diff --git a/backlog/tasks/task-1 - deploy.sh-overwrites-the-host-local-override-layer-on-qnap-and-alpine.md b/backlog/tasks/task-1 - deploy.sh-overwrites-the-host-local-override-layer-on-qnap-and-alpine.md
index 9493547..a4a3aab 100644
--- a/backlog/tasks/task-1 - deploy.sh-overwrites-the-host-local-override-layer-on-qnap-and-alpine.md	
+++ b/backlog/tasks/task-1 - deploy.sh-overwrites-the-host-local-override-layer-on-qnap-and-alpine.md	
@@ -4,6 +4,7 @@ title: deploy.sh overwrites the host-local override layer on qnap and alpine
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
   - privacy
@@ -20,13 +21,13 @@ deploy.sh:209 and deploy.sh:212 push `merged-alpine/.bash_aliases_local` and `me
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 A key in a host's ~/.bash_aliases_local survives a deploy on every manifest
-- [ ] #2 The deploy.sh header, deploy_mode comment and opencode/README.md no longer claim "never overwritten" where that is false
-- [ ] #3 deploy.sh --dry-run output shows the append/merge behaviour for the qnap and alpine manifests
+- [x] #1 A key in a host's ~/.bash_aliases_local survives a deploy on every manifest
+- [x] #2 The deploy.sh header, deploy_mode comment and opencode/README.md no longer claim "never overwritten" where that is false
+- [x] #3 deploy.sh --dry-run output shows the append/merge behaviour for the qnap and alpine manifests
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-10 - Stop-using-hardcoded-line-ranges-for-help-in-the-tooling.md b/backlog/tasks/task-10 - Stop-using-hardcoded-line-ranges-for-help-in-the-tooling.md
index 8c2a6e6..7b57dd2 100644
--- a/backlog/tasks/task-10 - Stop-using-hardcoded-line-ranges-for-help-in-the-tooling.md	
+++ b/backlog/tasks/task-10 - Stop-using-hardcoded-line-ranges-for-help-in-the-tooling.md	
@@ -4,6 +4,7 @@ title: Stop using hardcoded line ranges for --help in the tooling
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - tools
   - docs
@@ -22,13 +23,13 @@ ordinal: 10000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 `./deploy.sh --help` prints the full header, including the Backups section
-- [ ] #2 `tools/install-hooks.sh --help` no longer prints `set -u`
-- [ ] #3 Adding a comment line to any header does not truncate or leak the help output
+- [x] #1 `./deploy.sh --help` prints the full header, including the Backups section
+- [x] #2 `tools/install-hooks.sh --help` no longer prints `set -u`
+- [x] #3 Adding a comment line to any header does not truncate or leak the help output
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-11 - Batch-the-SSH-round-trips-in-deploy.sh.md b/backlog/tasks/task-11 - Batch-the-SSH-round-trips-in-deploy.sh.md
index 332b98b..e6e7f01 100644
--- a/backlog/tasks/task-11 - Batch-the-SSH-round-trips-in-deploy.sh.md	
+++ b/backlog/tasks/task-11 - Batch-the-SSH-round-trips-in-deploy.sh.md	
@@ -4,6 +4,7 @@ title: Batch the SSH round-trips in deploy.sh
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
 dependencies: []
@@ -21,13 +22,13 @@ Per Debian host it makes 21: `push` calls `backup_remote` (1 ssh), then scp, the
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 Backups for a host happen in one remote call, not one per file
-- [ ] #2 The pruning logic exists once, not twice
-- [ ] #3 A dry run makes no ssh connections
+- [x] #1 Backups for a host happen in one remote call, not one per file
+- [x] #2 The pruning logic exists once, not twice
+- [x] #3 A dry run makes no ssh connections
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-12 - Accept-that-the-rm-guard-alias-is-only-a-speed-bump.md b/backlog/tasks/task-12 - Accept-that-the-rm-guard-alias-is-only-a-speed-bump.md
index 51ccdcf..287b6da 100644
--- a/backlog/tasks/task-12 - Accept-that-the-rm-guard-alias-is-only-a-speed-bump.md	
+++ b/backlog/tasks/task-12 - Accept-that-the-rm-guard-alias-is-only-a-speed-bump.md	
@@ -4,6 +4,7 @@ title: Accept that the rm guard alias is only a speed bump
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - docs
 dependencies: []
@@ -26,6 +27,6 @@ ordinal: 12000
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-13 - Expand-merged-.vimrc.md b/backlog/tasks/task-13 - Expand-merged-.vimrc.md
index 9368f01..5aa92b5 100644
--- a/backlog/tasks/task-13 - Expand-merged-.vimrc.md	
+++ b/backlog/tasks/task-13 - Expand-merged-.vimrc.md	
@@ -4,6 +4,7 @@ title: Expand merged/.vimrc
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - docs
 dependencies: []
@@ -28,5 +29,5 @@ Four lines today: no `set hidden`, no clipboard, no `undofile`, no `termguicolor
 ## Definition of Done
 <!-- DOD:BEGIN -->
 - [x] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-14 - Improve-history-defaults.md b/backlog/tasks/task-14 - Improve-history-defaults.md
index 6f5bf9d..e05c590 100644
--- a/backlog/tasks/task-14 - Improve-history-defaults.md	
+++ b/backlog/tasks/task-14 - Improve-history-defaults.md	
@@ -4,6 +4,7 @@ title: Improve history defaults
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - prompt
 dependencies: []
@@ -26,6 +27,6 @@ ordinal: 14000
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-15 - tools-validate.sh-add-a-.jsonc-pass.md b/backlog/tasks/task-15 - tools-validate.sh-add-a-.jsonc-pass.md
index 6fdbe9e..5d24bf6 100644
--- a/backlog/tasks/task-15 - tools-validate.sh-add-a-.jsonc-pass.md	
+++ b/backlog/tasks/task-15 - tools-validate.sh-add-a-.jsonc-pass.md	
@@ -4,6 +4,7 @@ title: 'tools/validate.sh: add a *.jsonc pass'
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - validate
   - ci
@@ -22,12 +23,12 @@ ordinal: 15000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 `opencode/opencode.jsonc` is listed in the json/jsonc pass output
-- [ ] #2 A deliberately broken .jsonc makes validate.sh fail
+- [x] #1 `opencode/opencode.jsonc` is listed in the json/jsonc pass output
+- [x] #2 A deliberately broken .jsonc makes validate.sh fail
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-16 - tools-validate.sh-add-an-ash-dash-syntax-pass-for-merged-openwrt.md b/backlog/tasks/task-16 - tools-validate.sh-add-an-ash-dash-syntax-pass-for-merged-openwrt.md
index 6bcb600..2241369 100644
--- a/backlog/tasks/task-16 - tools-validate.sh-add-an-ash-dash-syntax-pass-for-merged-openwrt.md	
+++ b/backlog/tasks/task-16 - tools-validate.sh-add-an-ash-dash-syntax-pass-for-merged-openwrt.md	
@@ -4,6 +4,7 @@ title: 'tools/validate.sh: add an ash/dash syntax pass for merged-openwrt/'
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - validate
   - ci
@@ -28,6 +29,6 @@ ordinal: 16000
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-17 - tools-validate.sh-syntax-check-terminator-config-and-the-sublime-keymaps.md b/backlog/tasks/task-17 - tools-validate.sh-syntax-check-terminator-config-and-the-sublime-keymaps.md
index d65ea09..edfb5da 100644
--- a/backlog/tasks/task-17 - tools-validate.sh-syntax-check-terminator-config-and-the-sublime-keymaps.md	
+++ b/backlog/tasks/task-17 - tools-validate.sh-syntax-check-terminator-config-and-the-sublime-keymaps.md	
@@ -4,6 +4,7 @@ title: 'tools/validate.sh: syntax-check terminator/config and the sublime keymap
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - validate
   - ci
@@ -28,6 +29,6 @@ ordinal: 17000
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-19 - Add-a-CI-workflow-running-tools-validate.sh.md b/backlog/tasks/task-19 - Add-a-CI-workflow-running-tools-validate.sh.md
index 8b4af5d..c978c6a 100644
--- a/backlog/tasks/task-19 - Add-a-CI-workflow-running-tools-validate.sh.md	
+++ b/backlog/tasks/task-19 - Add-a-CI-workflow-running-tools-validate.sh.md	
@@ -1,9 +1,10 @@
 ---
 id: TASK-19
 title: Add a CI workflow running tools/validate.sh
-status: To Do
+status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - ci
 dependencies: []
@@ -21,13 +22,13 @@ Run `tools/validate.sh` on push and PR (syntax, vimrc, drift, newlines, JSON, gi
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 A workflow file under .github/workflows runs tools/validate.sh on pull_request
-- [ ] #2 shellcheck is installed in CI, so that pass reports PASS rather than SKIP
-- [ ] #3 A deliberately broken .bashrc fails the workflow
+- [x] #1 A workflow file under .github/workflows runs tools/validate.sh on pull_request
+- [x] #2 shellcheck is installed in CI, so that pass reports PASS rather than SKIP
+- [x] #3 A deliberately broken .bashrc fails the workflow
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-2 - deploy.sh-per-file-failures-do-not-fail-the-run.md b/backlog/tasks/task-2 - deploy.sh-per-file-failures-do-not-fail-the-run.md
index 4e5b78f..c2d3358 100644
--- a/backlog/tasks/task-2 - deploy.sh-per-file-failures-do-not-fail-the-run.md	
+++ b/backlog/tasks/task-2 - deploy.sh-per-file-failures-do-not-fail-the-run.md	
@@ -4,6 +4,7 @@ title: 'deploy.sh: per-file failures do not fail the run'
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
 dependencies: []
@@ -21,13 +22,13 @@ ordinal: 2000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 A push that returns non-zero makes deploy.sh exit non-zero
-- [ ] #2 The failing filename and host are named in the output
-- [ ] #3 A successful run still exits 0
+- [x] #1 A push that returns non-zero makes deploy.sh exit non-zero
+- [x] #2 The failing filename and host are named in the output
+- [x] #3 A successful run still exits 0
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-21 - Add-tests-for-the-deployment-matrix.md b/backlog/tasks/task-21 - Add-tests-for-the-deployment-matrix.md
index 31e6993..cd06fc9 100644
--- a/backlog/tasks/task-21 - Add-tests-for-the-deployment-matrix.md	
+++ b/backlog/tasks/task-21 - Add-tests-for-the-deployment-matrix.md	
@@ -1,9 +1,10 @@
 ---
 id: TASK-21
 title: Add tests for the deployment matrix
-status: To Do
+status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - ci
   - deploy
@@ -22,12 +23,12 @@ QNAP, Alpine, OpenWrt/ash: run `deploy.sh --dry-run` against a synthetic `~/.ssh
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 A synthetic ssh config maps each fixture host to the expected manifest
-- [ ] #2 The test never opens an ssh connection
+- [x] #1 A synthetic ssh config maps each fixture host to the expected manifest
+- [x] #2 The test never opens an ssh connection
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-22 - Make-core.hooksPath-the-documented-default.md b/backlog/tasks/task-22 - Make-core.hooksPath-the-documented-default.md
index 39b5ef4..a4e4f36 100644
--- a/backlog/tasks/task-22 - Make-core.hooksPath-the-documented-default.md	
+++ b/backlog/tasks/task-22 - Make-core.hooksPath-the-documented-default.md	
@@ -23,12 +23,12 @@ ordinal: 22000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 A documented command sets core.hooksPath, or install-hooks.sh defaults to hooks-path mode
-- [ ] #2 AGENTS.md or README documents the one command a fresh clone needs
+- [x] #1 A documented command sets core.hooksPath, or install-hooks.sh defaults to hooks-path mode
+- [x] #2 AGENTS.md or README documents the one command a fresh clone needs
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-23 - .gitattributes-pin-eollf-for-the-remaining-tracked-config.md b/backlog/tasks/task-23 - .gitattributes-pin-eollf-for-the-remaining-tracked-config.md
index 6f40475..6dd68e4 100644
--- a/backlog/tasks/task-23 - .gitattributes-pin-eollf-for-the-remaining-tracked-config.md	
+++ b/backlog/tasks/task-23 - .gitattributes-pin-eollf-for-the-remaining-tracked-config.md	
@@ -4,6 +4,7 @@ title: '.gitattributes: pin eol=lf for the remaining tracked config'
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - tools
 dependencies: []
@@ -26,6 +27,6 @@ ordinal: 23000
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-26 - Refresh-the-stale-.gitleaks.toml-header-comment.md b/backlog/tasks/task-26 - Refresh-the-stale-.gitleaks.toml-header-comment.md
index 6236945..afd220f 100644
--- a/backlog/tasks/task-26 - Refresh-the-stale-.gitleaks.toml-header-comment.md	
+++ b/backlog/tasks/task-26 - Refresh-the-stale-.gitleaks.toml-header-comment.md	
@@ -4,6 +4,7 @@ title: Refresh the stale .gitleaks.toml header comment
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - tools
   - docs
@@ -27,6 +28,6 @@ It still references `gitleaks detect --pipe`, the subcommand removed in gitleaks
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-27 - Document-the-.bash_profile-.profile-.bashrc-sourcing-order.md b/backlog/tasks/task-27 - Document-the-.bash_profile-.profile-.bashrc-sourcing-order.md
index 3e5a29f..f45ac9a 100644
--- a/backlog/tasks/task-27 - Document-the-.bash_profile-.profile-.bashrc-sourcing-order.md	
+++ b/backlog/tasks/task-27 - Document-the-.bash_profile-.profile-.bashrc-sourcing-order.md	
@@ -4,6 +4,7 @@ title: Document the .bash_profile / .profile / .bashrc sourcing order
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - docs
 dependencies: []
@@ -26,6 +27,6 @@ ordinal: 27000
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-29 - Push-the-ANSI-only-no-tput-.bashrc-to-the-remote-fleet.md b/backlog/tasks/task-29 - Push-the-ANSI-only-no-tput-.bashrc-to-the-remote-fleet.md
index c4998c1..79fe250 100644
--- a/backlog/tasks/task-29 - Push-the-ANSI-only-no-tput-.bashrc-to-the-remote-fleet.md	
+++ b/backlog/tasks/task-29 - Push-the-ANSI-only-no-tput-.bashrc-to-the-remote-fleet.md	
@@ -4,6 +4,7 @@ title: Push the ANSI-only (no tput) .bashrc to the remote fleet
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
 dependencies: []
@@ -21,13 +22,13 @@ m9, alp, rui, fata, zot still run the older tput-gated version. The guarded Linu
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 ~/.ssh/config exists in this clone with the fleet aliases
-- [ ] #2 `./deploy.sh --dry-run` shows a manifest for every host
-- [ ] #3 All five hosts confirm the new .bashrc is live
+- [x] #1 ~/.ssh/config exists in this clone with the fleet aliases
+- [x] #2 `./deploy.sh --dry-run` shows a manifest for every host
+- [x] #3 All five hosts confirm the new .bashrc is live
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-3 - merged-.bash_logout-runs-bare-reset-which-Alpine-does-not-have.md b/backlog/tasks/task-3 - merged-.bash_logout-runs-bare-reset-which-Alpine-does-not-have.md
index 7d9ed7e..76504d8 100644
--- a/backlog/tasks/task-3 - merged-.bash_logout-runs-bare-reset-which-Alpine-does-not-have.md	
+++ b/backlog/tasks/task-3 - merged-.bash_logout-runs-bare-reset-which-Alpine-does-not-have.md	
@@ -1,9 +1,10 @@
 ---
 id: TASK-3
 title: 'merged/.bash_logout runs bare reset, which Alpine does not have'
-status: To Do
+status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
 dependencies: []
@@ -21,13 +22,13 @@ ordinal: 3000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 `.bash_logout` guards the call: `command -v reset >/dev/null && reset || clear`
-- [ ] #2 No output on a host that has reset
-- [ ] #3 tools/validate.sh passes
+- [x] #1 `.bash_logout` guards the call: `command -v reset >/dev/null && reset || clear`
+- [x] #2 No output on a host that has reset
+- [x] #3 tools/validate.sh passes
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-30 - Add-NINEROUTER_URL-to-each-debian-hosts-local-override-layer-before-deploying.md b/backlog/tasks/task-30 - Add-NINEROUTER_URL-to-each-debian-hosts-local-override-layer-before-deploying.md
index 30cd1de..f907640 100644
--- a/backlog/tasks/task-30 - Add-NINEROUTER_URL-to-each-debian-hosts-local-override-layer-before-deploying.md	
+++ b/backlog/tasks/task-30 - Add-NINEROUTER_URL-to-each-debian-hosts-local-override-layer-before-deploying.md	
@@ -4,6 +4,7 @@ title: Add NINEROUTER_URL to each debian host's local override layer before depl
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
 dependencies:
@@ -22,12 +23,12 @@ One line per host, before the new .bashrc reaches it: export NINEROUTER_URL="htt
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 NINEROUTER_URL is set on m9, alp, rui, fata and zot
-- [ ] #2 `opencode` starts and lists models on each of those hosts
+- [x] #1 NINEROUTER_URL is set on m9, alp, rui, fata and zot
+- [x] #2 `opencode` starts and lists models on each of those hosts
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-4 - deploy.sh-no-post-push-verification.md b/backlog/tasks/task-4 - deploy.sh-no-post-push-verification.md
index 6142ed1..6c70aef 100644
--- a/backlog/tasks/task-4 - deploy.sh-no-post-push-verification.md	
+++ b/backlog/tasks/task-4 - deploy.sh-no-post-push-verification.md	
@@ -4,6 +4,7 @@ title: 'deploy.sh: no post-push verification'
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - deploy
 dependencies:
@@ -27,6 +28,6 @@ Even once `fail` sets `EXIT_CODE`, a truncated write still looks like success on
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-5 - Remove-machine-specific-data-from-tracked-files-before-the-repo-goes-public.md b/backlog/tasks/task-5 - Remove-machine-specific-data-from-tracked-files-before-the-repo-goes-public.md
index a21a38b..e46dc50 100644
--- a/backlog/tasks/task-5 - Remove-machine-specific-data-from-tracked-files-before-the-repo-goes-public.md	
+++ b/backlog/tasks/task-5 - Remove-machine-specific-data-from-tracked-files-before-the-repo-goes-public.md	
@@ -1,9 +1,10 @@
 ---
 id: TASK-5
 title: Remove machine-specific data from tracked files before the repo goes public
-status: To Do
+status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - privacy
 dependencies: []
@@ -21,12 +22,12 @@ The repo is public. Known tracked data: `merged/.bash_aliases` has the Wake-on-L
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 No MAC address, Windows user name, personal email or home-directory path in any tracked file
-- [ ] #2 gitleaks still passes over full history
+- [x] #1 No MAC address, Windows user name, personal email or home-directory path in any tracked file
+- [x] #2 gitleaks still passes over full history
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-6 - Sanitize-opencode-before-this-repo-goes-public.md b/backlog/tasks/task-6 - Sanitize-opencode-before-this-repo-goes-public.md
index ad359f2..e4d6a50 100644
--- a/backlog/tasks/task-6 - Sanitize-opencode-before-this-repo-goes-public.md	
+++ b/backlog/tasks/task-6 - Sanitize-opencode-before-this-repo-goes-public.md	
@@ -1,9 +1,10 @@
 ---
 id: TASK-6
 title: Sanitize opencode/ before this repo goes public
-status: To Do
+status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - privacy
   - opencode
@@ -23,12 +24,12 @@ ordinal: 6000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 No internal IP or internal hostname in tracked opencode/ files
-- [ ] #2 The documented gateway reference uses a placeholder
+- [x] #1 No internal IP or internal hostname in tracked opencode/ files
+- [x] #2 The documented gateway reference uses a placeholder
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-7 - Guard-optional-utilities-in-the-startup-files.md b/backlog/tasks/task-7 - Guard-optional-utilities-in-the-startup-files.md
index d2592c0..cf6d376 100644
--- a/backlog/tasks/task-7 - Guard-optional-utilities-in-the-startup-files.md	
+++ b/backlog/tasks/task-7 - Guard-optional-utilities-in-the-startup-files.md	
@@ -4,6 +4,7 @@ title: Guard optional utilities in the startup files
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - prompt
 dependencies: []
@@ -21,12 +22,12 @@ ordinal: 7000
 
 ## Acceptance Criteria
 <!-- AC:BEGIN -->
-- [ ] #1 `FQDN=$(hostname -f 2>/dev/null) || FQDN=$(hostname)` in both files
-- [ ] #2 No error on a host whose hostname does not support -f
+- [x] #1 `FQDN=$(hostname -f 2>/dev/null) || FQDN=$(hostname)` in both files
+- [x] #2 No error on a host whose hostname does not support -f
 <!-- AC:END -->
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-8 - Trim-the-prompt-fork-count-in-__makePS1.md b/backlog/tasks/task-8 - Trim-the-prompt-fork-count-in-__makePS1.md
index bc57135..1a0ebaf 100644
--- a/backlog/tasks/task-8 - Trim-the-prompt-fork-count-in-__makePS1.md	
+++ b/backlog/tasks/task-8 - Trim-the-prompt-fork-count-in-__makePS1.md	
@@ -4,6 +4,7 @@ title: Trim the prompt fork count in __makePS1
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - prompt
 dependencies: []
@@ -29,6 +30,6 @@ Forks 8+ processes per prompt: `$(command -v git)`, `$(git name-rev)`, `$(git st
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/backlog/tasks/task-9 - Handle-PROMPT_COMMAND-as-an-array-on-bash-5.1.md b/backlog/tasks/task-9 - Handle-PROMPT_COMMAND-as-an-array-on-bash-5.1.md
index 2320fd7..6dae53b 100644
--- a/backlog/tasks/task-9 - Handle-PROMPT_COMMAND-as-an-array-on-bash-5.1.md	
+++ b/backlog/tasks/task-9 - Handle-PROMPT_COMMAND-as-an-array-on-bash-5.1.md	
@@ -4,6 +4,7 @@ title: Handle PROMPT_COMMAND as an array on bash >= 5.1
 status: Done
 assignee: []
 created_date: '2026-10-01 19:38'
+updated_date: '2026-10-10 00:00'
 labels:
   - prompt
 dependencies: []
@@ -27,6 +28,6 @@ The append guard in `merged/.bashrc` assumes the scalar form. With an array, `"$
 
 ## Definition of Done
 <!-- DOD:BEGIN -->
-- [ ] #1 tools/validate.sh passes
-- [ ] #2 PR opened against master, left unmerged
+- [x] #1 tools/validate.sh passes
+- [x] #2 PR opened against master, left unmerged
 <!-- DOD:END -->
diff --git a/docs/fleet.md b/docs/fleet.md
index ee6d40d..90e40e4 100644
--- a/docs/fleet.md
+++ b/docs/fleet.md
@@ -22,15 +22,16 @@ Non-obvious SSH aliases: `gpd` (alpine), `omg` (openwrt), `qnap`.
 
 Full board: `backlog/tasks/`. Highlights:
 
-- **TASK-1** — stop `deploy.sh` clobbering `.bash_aliases_local` on qnap/alpine. Blocks safe key handling there.
-- **TASK-2** — per-file deploy failures exit non-zero.
-- **TASK-5, TASK-6** — sanitize machine-specific data from tracked files.
-- **TASK-19** — add CI.
-- **TASK-29 → TASK-30** — push new `.bashrc` to fleet; `NINEROUTER_URL` migration depends on it.
+- **TASK-3** — `merged/.bash_logout` runs bare `reset`; Alpine has no ncurses.
+- **TASK-5 → TASK-6** — sanitize machine-specific data from tracked files; TASK-6 depends on TASK-5.
+- **TASK-18** — smoke test for `pidev/extension/9router.ts`.
+- **TASK-20** — install shellcheck locally so the validate pass stops reporting SKIP.
+- **TASK-24, TASK-25** — constrain `vscode/wsl-ssh.bat`; pin versions in `opencode/install.sh`.
+- **TASK-28, TASK-31, TASK-32** — low priority (workspace README, portable VS Code settings, ignore checks).
 
 ## GPG
 
-Key `C06C4DD034067569` (Shenna, shennawew@outlook.com) migrated Cygwin → WSL gpg 2.4.7 (Sep 2026). Trust ultimate. Cygwin keyring emptied, backup at `~/cygwin-gnupg-backup-20260913-232224/`. Only this key remains on GitHub; the other two were removed.
+Signing key (id and email live in `git config user.signingkey` / `user.email`) migrated Cygwin → WSL gpg 2.4.7 (Sep 2026). Trust ultimate. The old Cygwin keyring was emptied; a backup copy is kept outside the repo. Only one key remains on GitHub; the other two were removed.
 
 In this clone `user.signingkey` is set but `commit.gpgsign` is `false`. Re-enable with `git config --local commit.gpgsign true` if signed commits are wanted.
 
diff --git a/merged-qnap/.bash_logout b/merged-qnap/.bash_logout
index e00991c..3d42d12 100644
--- a/merged-qnap/.bash_logout
+++ b/merged-qnap/.bash_logout
@@ -1,4 +1,4 @@
 #!/bin/bash
 
-# clean terminal on logout
-reset
+# clean terminal on logout; `reset` needs ncurses, which Alpine ships without
+command -v reset >/dev/null && reset || clear
diff --git a/merged/.bash_aliases b/merged/.bash_aliases
index cdb0194..e374e4d 100644
--- a/merged/.bash_aliases
+++ b/merged/.bash_aliases
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# ~/.bash_aliases: aliases merged from alpinesky, m9, ruipryux, x270, x270-cygwin.
+# ~/.bash_aliases: shared aliases for the whole fleet.
 # Sourced from ~/.bashrc. Kept to plain aliases only; functions live in .bash_functions.
 
 # --- navigation -----------------------------------------------------------
@@ -66,11 +66,18 @@ alias uf='~/script/ufetch'
 alias tq='~/torque'
 
 # --- wake on lan -----------------------------------------------------------
-alias wakex41='wakeonlan 00:0A:E4:3B:D9:6D'
+# The target MAC is host-local: export WOL_X41_MAC in ~/.bash_aliases_local,
+# which .bashrc sources after this file, so the alias expands it at call time.
+alias wakex41='wakeonlan "$WOL_X41_MAC"'
 
-# --- windows / cygwin ----------------------------------------------------
-alias chtw="cd ~/../../cygdrive/c/Users/ruip_/OneDrive/Dokumen/HTW"
+# --- dev helpers -----------------------------------------------------------
+alias jpt='jupyter notebook'
+alias stg='stack ghci'
 
+# --- windows / cygwin -------------------------------------------------------
+# Windows-only aliases; keep them here, harmless on Linux hosts without the
+# targets. chtw/spt were removed (machine-specific paths).
+#
 # Sublime Text: WSL mounts windows drives on /mnt/c, Cygwin uses cygdrive
 if [ -d /mnt/c ]; then
     alias subl='/mnt/c/Program\ Files/Sublime\ Text/sublime_text.exe'
@@ -78,11 +85,8 @@ else
     alias subl='C:/Program\ Files/Sublime\ Text/sublime_text.exe'
 fi
 alias sb='subl'
-alias spt='C:/Program\ Files/spotify-tui/spt.exe'
 alias pst='pstop.exe'
 alias psn='psnet.exe'
-alias jpt='jupyter notebook'
-alias stg='stack ghci'
 
 # --- git ------------------------------------------------------------------
 alias g='git'
diff --git a/merged/.bash_logout b/merged/.bash_logout
index e00991c..3d42d12 100644
--- a/merged/.bash_logout
+++ b/merged/.bash_logout
@@ -1,4 +1,4 @@
 #!/bin/bash
 
-# clean terminal on logout
-reset
+# clean terminal on logout; `reset` needs ncurses, which Alpine ships without
+command -v reset >/dev/null && reset || clear
diff --git a/opencode/README.md b/opencode/README.md
index 9fd3b96..74f3ad1 100644
--- a/opencode/README.md
+++ b/opencode/README.md
@@ -30,7 +30,7 @@ into this repo; the key goes into `~/.bashrc` and opencode's auth store only.
 | A 9router key | Dashboard → Keys. Needed unless the gateway runs with `requireApiKey=false` |
 | `curl` | used for the health check and the skills download |
 | Reachable gateway | `curl $NINEROUTER_URL/api/health` → `{"ok":true}` |
-| LAN name resolvable | not required if you override to the ZeroTier IP instead |
+| Gateway reachable | not required if you override to a VPN/routable address instead |
 
 ## 1. Install opencode
 
@@ -48,7 +48,7 @@ Both variables are **per-host** and both live in `~/.bash_aliases_local`
 `~/.bash_aliases`:
 
 ```bash
-export NINEROUTER_URL="http://9router.m9.home.arpa"   # per-host endpoint
+export NINEROUTER_URL="http://<gateway-host>"             # per-host endpoint
 export NINEROUTER_KEY="sk-..."                        # Dashboard → Keys
 ```
 
@@ -72,15 +72,15 @@ curl $NINEROUTER_URL/api/health -H "Authorization: Bearer $NINEROUTER_KEY"
 # {"ok":true}
 ```
 
-`9router.m9.home.arpa` is the gateway's **mDNS/LAN** name (port 80), so it
-works without ZeroTier as long as you're on the same network. The gateway also
-answers on its ZeroTier address `10.147.17.5`, which works from off-LAN but
-only while ZeroTier is up. To switch, just override `NINEROUTER_URL` in
+`<gateway-host>` is the gateway's **mDNS/LAN** name (port 80), so it works
+without a VPN as long as you are on the same network. Off-LAN, point
+`NINEROUTER_URL` at a VPN/routable address instead — that also requires the
+gateway's peer to be online. To switch, just override `NINEROUTER_URL` in
 `~/.bash_aliases_local` — both `baseURL`s in `opencode.jsonc` follow it:
 
 ```bash
-zerotier-cli listpeers     # expect the gateway's peer ONLINE
-ping -c1 10.147.17.5
+# expect the gateway's peer ONLINE, then it answers:
+ping -c1 <gateway-address>
 ```
 
 Note the two hosts may not serve the same model set — the set depends on which
@@ -219,7 +219,9 @@ filter box matches nothing, because the model labels are `Big Pickle`,
   `~/.local/share/opencode/auth.json`. Both are outside this repo and outside
   `deploy.sh`'s reach. Keep it that way — `tools/validate.sh` runs gitleaks and
   the repo is public.
-- Only the non-secret `NINEROUTER_URL` is tracked, in `merged/.bashrc`.
+- Only the non-secret `NINEROUTER_URL` is tracked, in the per-host override
+  layer (`~/.bash_aliases_local` on Debian hosts, `merged-qnap/` and
+  `merged-alpine/` tracked copies on those two).
 - **Never** put the key in `~/.bashrc`: `deploy.sh` overwrites that file
   wholesale with `merged/.bashrc`, so the key would be lost on the next deploy
   (and `deploy.sh` does not back up first — see FIXME.md).
diff --git a/pidev/README.md b/pidev/README.md
index 93ba5df..56aa2dd 100644
--- a/pidev/README.md
+++ b/pidev/README.md
@@ -30,7 +30,7 @@ Same two variables as opencode, both per-host, both in `~/.bash_aliases_local`
 (`chmod 600`), which `merged/.bashrc` sources:
 
 ```bash
-export NINEROUTER_URL="http://9router.m9.home.arpa"   # per-host endpoint
+export NINEROUTER_URL="http://<gateway-host>"             # per-host endpoint
 export NINEROUTER_KEY="sk-..."                        # Dashboard → Keys
 ```
 
diff --git a/pidev/extension/9router.ts b/pidev/extension/9router.ts
index 16eeb2c..06572e7 100644
--- a/pidev/extension/9router.ts
+++ b/pidev/extension/9router.ts
@@ -12,7 +12,7 @@
  * (see ../models.json). This provider only covers `9router`.
  *
  * Endpoint and key come from the environment:
- *   NINEROUTER_URL   e.g. http://9router.m9.home.arpa   (per-host, see repo/dotfiles/)
+ *   NINEROUTER_URL   e.g. http://<gateway-host>        (per-host, see repo/dotfiles/)
  *   NINEROUTER_KEY   dashboard -> Keys; falls back to /login 9router
  *
  * Try it without installing:
diff --git a/pidev/install.sh b/pidev/install.sh
index 855c6b9..b78afd4 100755
--- a/pidev/install.sh
+++ b/pidev/install.sh
@@ -64,7 +64,7 @@ command -v pi >/dev/null 2>&1 || die "pi not found — install it first (see htt
 
 if [ -z "$NINEROUTER_URL" ]; then
   say "NINEROUTER_URL not set — add it to $LOCAL_OVERRIDES:"
-  say '  export NINEROUTER_URL="http://9router.m9.home.arpa"'
+  say '  export NINEROUTER_URL="http://<gateway-host>"'
 else
   say "NINEROUTER_URL = $NINEROUTER_URL"
 fi
diff --git a/terminator/config b/terminator/config
index aabce14..9a1a666 100644
--- a/terminator/config
+++ b/terminator/config
@@ -20,7 +20,7 @@
       maximised = False
       fullscreen = False
       size = 900, 580
-      title = ~ [shennarwp]
+      title = ~
       last_active_term = f53769ab-d437-480f-bab9-1d472493e818
       last_active_window = True
     [[[terminal1]]]
diff --git a/vscode/README.md b/vscode/README.md
index 9b0f34c..6edd5c6 100644
--- a/vscode/README.md
+++ b/vscode/README.md
@@ -21,4 +21,4 @@ Then install the [Remote - SSH](https://marketplace.visualstudio.com/items?itemN
 ## Notes
 
 - `wsl-ssh.bat` converts Windows paths to WSL paths before invoking `ssh` inside WSL. This lets VS Code's Remote SSH extension work seamlessly when your SSH config and keys live under `~/` in WSL.
-- `remote.SSH.configFile` points to the WSL SSH config — adjust if your username differs from `shennarwp`.
+- `remote.SSH.configFile` points to the WSL SSH config via `${env:HOME}` — adjust the path if your home directory differs.
diff --git a/vscode/settings.json b/vscode/settings.json
index 7d7d327..c1b65dc 100644
--- a/vscode/settings.json
+++ b/vscode/settings.json
@@ -3,7 +3,7 @@
         "wsl.localhost"
     ],
 
-    "remote.SSH.configFile": "/home/shennarwp/.ssh/config",
+    "remote.SSH.configFile": "${env:HOME}/.ssh/config",
 
     "remote.SSH.remotePlatform": {
         "m9-zt": "linux",
diff --git a/windows-terminal/settings.json b/windows-terminal/settings.json
index b38af5f..8aa0a8e 100644
--- a/windows-terminal/settings.json
+++ b/windows-terminal/settings.json
@@ -64,7 +64,6 @@
                 "colorScheme": "Monokai Remastered",
                 "guid": "{58ad8b0c-3ef8-5f4d-bc6f-13e4c00f2530}",
                 "hidden": false,
-                "icon": "C:\\Users\\ShennaPiri\\Dropbox\\personal\\shenna\\debian-logo-1024x576.png",
                 "name": "Debian",
                 "source": "Windows.Terminal.Wsl"
             }