P0 anchor, P1 config-first pin, P2 registry detection + display, and P3 honest pinned apply/revert are all built and deployed. Records the detection nuance (digest-compare fully covers rolling apps; versioned newer-version enumeration is a P5 add) and the remaining deferred work. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>