docs: RENAMING.md + l-ui migration runbook

RENAMING.md: exact mapping, LUI_ inventory, sing-box orphan-scan
re-verification, Tianyi badge mechanism, intentionally-kept items
(module path, upstream mentions, frozen Windows, ps1, log
filenames, Postgres creds, generated schemas, stale test
binaries), and pending items (repo spelling BLOCKER, version
bump, ps1 URL after repo rename, schema regeneration).
docs/migration-l-ui.md: operator-only mv table, DB file rename,
unit-env translation, backup-then-delete, old-core stop rule,
rollback before acceptance only, per-machine acceptance
checklist, pilot order (probe node, master, rest one by one,
TYYUN untouched). docs/release.md: placeholder-repo warning.

RENAMING.md

@@ -0,0 +1,195 @@
+# Renaming: 3x-ui / x-ui → L-UI / l-ui / lui-agent
+
+Base: `8158ced` (panel V2.6.0 / agent A2.5.0). This batch is a pure
+rename: **no version bump, no feature change, no production change,
+no Gitea change, no release**. Versions stay V2.6.0 / A2.5.0; the
+version bump is left to the release step (see Pending below).
+
+## Mapping (exact — do not invent other aliases)
+
+| old | new | where it shows up |
+| --- | --- | --- |
+| display brand `3x-ui` / `x-ui` | `L-UI` | panel UI, i18n, README, docs |
+| panel binary / process | `l-ui` | release asset, `ps`, `/usr/bin/l-ui` (Docker), `l-ui setting …` |
+| agent binary / process | `lui-agent` | release asset, `ps`, `lui-agent agent …` |
+| install dir | `/usr/local/l-ui` | panel + agent binaries |
+| config / state dir | `/etc/l-ui` | `agent.json`, `node_token_key.json`, env files |
+| panel DB | `/etc/l-ui/l-ui.db` | driven by `internal/config/name` (`l-ui`) via `GetName()` + `GetDBFolderPath()` — no separate DB-name constant |
+| probe DB | `/etc/l-ui/probe.db` | name unchanged, directory moved (`probe/store.go` joins `GetDBFolderPath()`) |
+| cert dir | `/etc/l-ui/cert` | panel + subscription share it |
+| binary dir | `/usr/local/l-ui/bin` | `DefaultBinFolder`; sing-box live config `config-singbox.json` lives here |
+| log dir | `/var/log/l-ui` | panel log, agent log, sing-box log |
+| panel service | `l-ui.service` | systemd units `l-ui.service.{debian,arch,rhel}`, OpenRC `l-ui.rc` |
+| agent service | `lui-agent.service` | `systemd/lui-agent.service`, OpenRC `openrc/lui-agent` |
+| management CLI | `l-ui.sh` | was `x-ui.sh`; Docker copies it to `/usr/bin/l-ui` |
+| panel release assets | `l-ui-linux-amd64`, `l-ui-linux-arm64` (+ `.sha256`) | `scripts/release-build.sh`, `selfupdate.AssetName` |
+| agent release assets | `lui-agent-linux-amd64`, `lui-agent-linux-arm64` (+ `.sha256`) | `scripts/release-build.sh`, `selfupdate.AgentAssetName` |
+| agent version marker | `agent-version.txt` | name unchanged |
+| env prefix | `LUI_` | every `XUI_` variable, code + scripts + docs + tests (inventory below) |
+| source dir (Linux agent) | `cmd/lui-agent` | was `cmd/xui-agent`; `release-build.sh` builds `./cmd/lui-agent` |
+| Gitea repo (PLACEHOLDER) | `rogue/l-ui` | see Pending — **not yet real** |
+
+## Environment variables renamed
+
+Code reads **only** the new `LUI_` prefix. There is no dual-read
+fallback in code: an old unit file that still exports `XUI_*` will
+silently lose those settings, which is why the migration doc
+(`docs/migration-l-ui.md`) has an explicit unit-env translation
+table. Old units must be replaced, not edited in place.
+
+Full inventory (from a whole-tree scan; `LUI_DB_*` below is a docs
+glob, not a variable):
+
+`LUI_ACCESS_URL`, `LUI_ACME_EMAIL`, `LUI_ACME_HTTP_PORT`,
+`LUI_API_TOKEN`, `LUI_B1_OLD_BACKUP`, `LUI_B2_OLD_DB`,
+`LUI_BIN_FOLDER`, `LUI_DB_CACHE_MB`, `LUI_DB_DSN`,
+`LUI_DB_FOLDER`, `LUI_DB_JOURNAL_MODE`, `LUI_DB_MAX_IDLE_CONNS`,
+`LUI_DB_MAX_OPEN_CONNS`, `LUI_DB_MMAP_MB`, `LUI_DB_SYNCHRONOUS`,
+`LUI_DB_TYPE`, `LUI_DEBUG`, `LUI_DOMAIN`, `LUI_ENABLE_FAIL2BAN`,
+`LUI_GOGC`, `LUI_HOME` (install-agent.sh only), `LUI_INIT_SYSTEM`
+(install-agent.sh only), `LUI_INIT_WEB_BASE_PATH`, `LUI_IN_DOCKER`,
+`LUI_LOG_FOLDER`, `LUI_LOG_LEVEL`, `LUI_MAIN_FOLDER`,
+`LUI_MEMORY_LIMIT`, `LUI_MEMORY_RELEASE_INTERVAL`,
+`LUI_NODE_TOKEN_KEY`, `LUI_NODE_TOKEN_KEY_FILE`,
+`LUI_NODE_TOKEN_KEY_TEST`, `LUI_NONINTERACTIVE`,
+`LUI_ORPHAN_DUMMY`, `LUI_PANEL_PORT`, `LUI_PASSWORD`, `LUI_PORT`,
+`LUI_PPROF`, `LUI_RELEASE_BASE_URL`, `LUI_RELEASE_LATEST_URL`,
+`LUI_ROOT` (install-agent.sh only), `LUI_SCALE_DB_PATH`,
+`LUI_SCALE_SIZES`, `LUI_SCALE_TEST`, `LUI_SELFUPDATE_SYSTEMD`,
+`LUI_SERVER_IP`, `LUI_SERVICE`, `LUI_SERVICE_NAME`,
+`LUI_SINGBOX_BIN`, `LUI_SKIP_HSTS`, `LUI_SMOKE_VERSION`,
+`LUI_SOURCEMAP`, `LUI_SSL_IPV6`, `LUI_SSL_MODE`,
+`LUI_TEST_PG_DSN`, `LUI_TUNNEL_HEALTH_COOLDOWN`,
+`LUI_TUNNEL_HEALTH_FAILURES`, `LUI_TUNNEL_HEALTH_INTERVAL`,
+`LUI_TUNNEL_HEALTH_MONITOR`, `LUI_TUNNEL_HEALTH_PROXY`,
+`LUI_TUNNEL_HEALTH_TIMEOUT`, `LUI_TUNNEL_HEALTH_URL`,
+`LUI_UPDATE_RUN_ID`, `LUI_UPDATE_STATUS_FILE`, `LUI_UPDATE_TAG`,
+`LUI_URL` (install scripts only), `LUI_USERNAME`,
+`LUI_WEB_BASE_PATH`.
+
+## sing-box orphan-core check (special re-verification)
+
+The orphan scan (`internal/agent/singbox.go`,
+`singboxCmdlineMatchesConfig`) matches a core process by the exact
+argv triple `run -c <live config path>`. Both sides use the same
+source: the live path is `filepath.Join(config.GetBinFolderPath(),
+"config-singbox.json")`, and the agent sets `LUI_BIN_FOLDER` to
+`DefaultBinFolder` (`/usr/local/l-ui/bin`) when unset. So the rename
+propagates to both the writer and the matcher automatically; there
+is no hardcoded old path in `singbox.go`. After migration the only
+cores the new agent will reap are cores started with
+`/usr/local/l-ui/bin/config-singbox.json` — a core still running
+the old `/usr/local/x-ui/bin/config-singbox.json` is **not** matched
+and must be killed by the migration step (see migration doc), or it
+will hold the inbound ports and the new core will fail to bind.
+This is the one place where "rename both sides" is not enough: the
+old core has to be stopped, not re-adopted.
+
+## Tianyi update badge (same batch, panel side only)
+
+- Backend: `NodeView.agentOs` (from `AgentNode.ProbeOS`), overlaid
+  in `annotateAgentTelemetry` ahead of the telemetry early-exit,
+  like `ProbeOnly`.
+- Frontend: both badge sites in `NodeList.tsx` (list column +
+  detail) now gate on `!isWindowsAgentOS(agentOs)`, where the
+  helper (in `panel-version.ts`) is a case-insensitive `windows`
+  prefix test. Empty OS fails open (badge as before).
+- Backend: `requestAgentUpdate` refuses Windows rows up front
+  ("not available on Windows … re-running install-agent.ps1")
+  instead of recording an intent that would only age out. The
+  one-click action button itself is unchanged; clicking it on a
+  Windows row now errors clearly.
+- Why ProbeOS is reliable: the frozen A2.2.1 Windows agent reports
+  `probeFacts.os` = `winOSName()` — registry ProductName
+  ("Windows 10", "Windows 11", …) with DisplayVersion appended,
+  falling back to bare "Windows" — on register and on heartbeat,
+  and the panel persists it to `probe_os` (pinned by
+  `TestAgentLegacyWindows221Contract`). No fake version, no
+  per-node freeze switch, no Windows agent change, no new win asset.
+- Tianyi's machine itself is untouched; its agent stays A2.2.1.
+
+## Intentionally kept (not omissions)
+
+- **Go module path `github.com/mhsanaei/3x-ui/v3`** — the upstream
+  import path. Renaming it would break every import and the
+  `-ldflags -X` injection paths; it is not user-visible.
+- **Upstream mentions** — sentences that name the upstream original
+  ("upstream 3x-ui", "stock 3x-ui", "based on upstream 3x-ui",
+  `ghcr.io/mhsanaei/3x-ui`, `raw.githubusercontent.com/mhsanaei/3x-ui`)
+  stay, because that is the upstream project's actual name.
+- **Windows agent, frozen** — `cmd/xui-agent-windows/` untouched:
+  service name `x-ui-agent`, `C:\x-ui\agent.json`, display name
+  "3x-ui Agent", `x-ui-agent-windows.exe`. The shipped A2.2.1
+  binary cannot change without a new win release, which this batch
+  explicitly does not ship. Renaming its source would only make
+  the source lie about the shipped binary.
+- **`install-agent.ps1` untouched** — see Pending.
+- **Log filenames `3xui.log`, `3xipl.log`, `3xipl-banned.log` and
+  the fail2ban jail name `3x-ipl`** — only their directory moves
+  (`/var/log/l-ui/`). Renaming the files would break external
+  fail2ban configs beyond the directory move the migration
+  already requires.
+- **Docker Postgres user/DB `xui`** — renaming them would orphan
+  existing `pgdata` volumes (a fresh empty DB would appear and
+  the panel would start empty). Service/container names were
+  renamed (`l-ui`, `l-ui_app`, `l-ui_postgres`); credentials kept.
+- **Windows-only DB copy in `internal/config/config.go` `init()`** —
+  its source is now explicitly `/etc/x-ui/x-ui.db` (the only
+  pre-rename path left in Go code, as a copy source only). Normal
+  operation never reads it; operator migration moves the DB by mv.
+- **`install-agent.sh` legacy-process kill** — it now kills both
+  `/usr/local/l-ui/l-ui agent` and `/usr/local/x-ui/x-ui agent`.
+  The old form is a one-time migration cleanup, not a runtime
+  dual-path fallback; it can be deleted once old forms are gone.
+- **`frontend/src/generated/schemas.ts`** — generated by
+  `tools/openapigen`, marked DO NOT EDIT. Its three "3x-ui panel"
+  descriptions come from Go model comments and will refresh on
+  the next regeneration; hand-editing a generated file would be
+  overwritten anyway.
+- **Tracked test binaries `x-ui-agent-test-amd64`,
+  `x-ui-master-new-amd64`, `x-ui-with-ui-amd64`** — stale ELF
+  artifacts committed earlier, not referenced by any script or by
+  `release-build.sh`, not release assets. Left untouched (not
+  rebuilt, not renamed); deleting committed binaries is a separate
+  cleanup decision, not part of this rename.
+- **`docs/release.md` version-table examples (V2.4.0 / A2.3.0)** —
+  pre-existing stale examples, not version constants; left as-is
+  so this diff stays a rename. The agent-change glob there now
+  reads `cmd/lui-agent*`, which correctly excludes the frozen
+  Windows dir (Windows-only changes must not move the agent line).
+
+## Pending / must be decided before any release
+
+1. **Gitea repo spelling (BLOCKER).** `rogue/l-ui` is a placeholder.
+   The Gitea repo has NOT been renamed in this batch and must not
+   be assumed renamed. Before any release: user confirms the exact
+   spelling, then update `internal/selfupdate/selfupdate.go`
+   (annotated in code), `internal/web/service/panel/panel.go`,
+   `scripts/release-build.sh`, `install-agent.sh`,
+   `install-master.sh`, `update.sh`, `install.sh`, `docs/release.md`
+   and every `rogue/l-ui` URL in the tree to the confirmed spelling.
+   Until then, the renamed update check points at a repo that does
+   not exist yet — this branch must not be released as-is.
+2. **Version bump.** Panel stays V2.6.0, agent stays A2.5.0 in this
+   diff. The release step must bump the panel line (and the agent
+   line only if agent code changed in the release commit) and
+   `install-agent.sh`'s `RELEASE_BASE`.
+3. **`install-agent.ps1` (Windows, frozen, TYYUN only).** Untouched
+   on purpose: it is pinned to the V2.4.0 release base and
+   downloads `x-ui-agent-windows-amd64.exe` into `C:\x-ui`.
+   After the Gitea repo is renamed, that download URL
+   (`rogue/3x-ui-agent/releases/download/V2.4.0/…`) will 404
+   unless one of these is chosen: (a) leave ps1 alone and accept
+   that a future Windows reinstall needs a manual exe (the frozen
+   line needs no reinstall by design); (b) update only its repo
+   segment to the confirmed spelling, keeping the V2.4.0 pin and
+   the old asset name (the V2.4.0 release's assets keep their old
+   names only if the repo is renamed without re-uploading them —
+   verify before choosing); (c) unfreeze Windows and ship a new
+   win asset (out of scope for this batch). Do NOT quietly bump
+   its pin to a release that has no win asset.
+4. **Generated schemas regeneration** — run `tools/openapigen`
+   at release time so `frontend/src/generated/schemas.ts`
+   descriptions pick up the L-UI wording.
+5. **Tracked test binaries** — decide separately whether to delete
+   the three stale ELF files from the repo.

docs/migration-l-ui.md

@@ -0,0 +1,225 @@
+# Migration: x-ui → l-ui (operator runbook, no code runs this)
+
+This document is the only migration mechanism. The renamed code
+does **not** auto-migrate old paths at startup (except the
+Windows-only DB copy safety net noted in RENAMING.md) and does
+**not** read old `XUI_*` variables. Every old path below must be
+moved by the operator, on each machine, in the order given.
+
+Applies to: panel hosts (systemd), agent nodes (systemd / OpenRC /
+procd), and the master host that also runs a local agent. It does
+**not** apply to the frozen Windows agent (TYYUN): that machine is
+untouched — its panel-side update badge is suppressed by the panel,
+its agent stays A2.2.1, no file on it moves.
+
+## 0. Before anything
+
+- Confirm the Gitea repo spelling first (see RENAMING.md pending
+  item 1). The renamed binaries' update check points at the
+  placeholder `rogue/l-ui`; do not roll the renamed build out
+  while that placeholder is still in place, or the first update
+  check after migration will 404.
+- Confirm the release version for this migration (panel line, and
+  agent line only if agent code changed). The rename diff itself
+  keeps V2.6.0 / A2.5.0; the migration runs against the release
+  that actually ships the rename, whatever its number is.
+- One machine at a time. Never migrate the whole fleet at once:
+  a panel/agent restart interrupts that machine's inbounds for
+  seconds, and a bad step must be caught on the pilot before it
+  can repeat everywhere.
+
+## 1. Per-machine move table (mv, never cp)
+
+Stop the old service first, then move, then install the new
+binary + unit, then start. `mv` keeps the data in one place;
+`cp` leaves two copies and is how stale-DB incidents happen.
+
+| old | new | notes |
+| --- | --- | --- |
+| `/usr/local/x-ui/` | `/usr/local/l-ui/` | panel binary, `bin/` (sing-box, geo, `config-singbox.json`) |
+| `/etc/x-ui/` | `/etc/l-ui/` | `l-ui.db` is the renamed file: move `x-ui.db` → `l-ui.db` inside the move (see §2) |
+| `/etc/x-ui/x-ui.db` | `/etc/l-ui/l-ui.db` | the panel DB; see §2 for the file rename |
+| `/etc/x-ui/probe.db` | `/etc/l-ui/probe.db` | name unchanged, directory moved |
+| `/etc/x-ui/cert/` | `/etc/l-ui/cert/` | panel + subscription certs move with the dir |
+| `/etc/x-ui/agent.json` | `/etc/l-ui/agent.json` | agent nodes |
+| `/etc/x-ui/node_token_key.json` | `/etc/l-ui/node_token_key.json` | panel hosts |
+| `/var/log/x-ui/` | `/var/log/l-ui/` | log filenames inside (`3xui.log`, `3xipl.log`) do NOT change |
+| `/usr/local/x-ui/bin/config-singbox.json` | `/usr/local/l-ui/bin/config-singbox.json` | the live config the orphan scan matches on (see §5) |
+| `/etc/systemd/system/x-ui.service` | `/etc/systemd/system/l-ui.service` | delete the old unit file, install the new one from the repo — do not edit the old file in place |
+| `/etc/systemd/system/x-ui-agent.service` | `/etc/systemd/system/lui-agent.service` | same: delete old, install new |
+| `/etc/init.d/x-ui-agent` (OpenRC) | `/etc/init.d/lui-agent` | same: delete old, install new |
+| `/etc/init.d/x-ui` (OpenRC panel, if present) | `/etc/init.d/l-ui` | from `l-ui.rc` |
+| `/etc/default/x-ui` | `/etc/default/l-ui` | env file, with translation in §3 |
+| `/etc/conf.d/x-ui` | `/etc/conf.d/l-ui` | Arch/Alpine env file, with translation in §3 |
+| `/etc/sysconfig/x-ui` | `/etc/sysconfig/l-ui` | RHEL env file, with translation in §3 |
+| `/usr/bin/x-ui` (Docker management CLI) | `/usr/bin/l-ui` | Docker images only; from `l-ui.sh` |
+| `/tmp/xui.log` (install-master scratch) | `/tmp/lui.log` | scratch only; delete, don't migrate |
+
+Pure-probe nodes (56HL-NAT, AX6600, WW39, TYYUN excepted as
+frozen): same table, minus inbounds — they have no core config to
+worry about, which is why they go first (§6). AX6600 and 56HL-NAT
+carry a `probeOnly` preset in `agent.json`; it moves with the file.
+
+## 2. Database file rename
+
+The panel DB file itself is renamed, not just its directory:
+
+```
+mv /etc/x-ui/x-ui.db /etc/l-ui/l-ui.db
+```
+
+(`probe.db` keeps its name.) If the move is done as a whole-dir
+`mv /etc/x-ui /etc/l-ui` followed by `mv /etc/l-ui/x-ui.db
+/etc/l-ui/l-ui.db`, the result is identical. Do not leave a copy
+of `x-ui.db` behind "just in case" — the backup in §4 is the
+just-in-case copy, and it is deleted after acceptance.
+
+Postgres deployments: the DB name/user (`xui`) is intentionally
+unchanged (RENAMING.md), so no database rename is needed there;
+only the env prefix in the unit changes (`LUI_DB_TYPE`,
+`LUI_DB_DSN`).
+
+## 3. Unit environment translation (XUI_ → LUI_)
+
+Old units must be replaced with the new units from the repo. If a
+host has a local env-file override, translate every line:
+
+```
+XUI_...  →  LUI_...
+```
+
+i.e. `XUI_DB_FOLDER` → `LUI_DB_FOLDER`,
+`XUI_MAIN_FOLDER` → `LUI_MAIN_FOLDER`,
+`XUI_LOG_FOLDER` → `LUI_LOG_FOLDER`,
+`XUI_BIN_FOLDER` → `LUI_BIN_FOLDER`, and so on for the full
+inventory in RENAMING.md. There is no fallback: a leftover
+`XUI_DB_FOLDER` pointing at `/etc/x-ui` will simply be ignored
+by the new binary, which will then open the default
+`/etc/l-ui/l-ui.db` — that looks like "the panel lost its data"
+when it is really "the env file was never translated". After
+installing the new unit, run `systemctl daemon-reload` (systemd)
+or the OpenRC equivalent, and verify with
+`systemctl cat l-ui` / `systemctl cat lui-agent` that no `XUI_`
+line remains.
+
+## 4. Backup, and deleting it
+
+Before the move, on each machine:
+
+```
+cp -a /etc/x-ui /root/l-ui-migration-bak-$(date +%F)
+cp -a /usr/local/x-ui /root/l-ui-migration-bin-bak-$(date +%F)   # panel hosts only if bin/ holds local files worth keeping
+```
+
+(Adjust the backup root if `/root` is small; the panel DB is the
+critical part.) The backup exists only until that machine passes
+§7. **After acceptance, delete it.** A backup left in `/root`
+indefinitely is residual garbage by definition, and a later
+operator can mistake it for the live directory. Do not keep
+`x-ui.db` copies, `.bak` binaries, or old units "for safety"
+past acceptance — acceptance *is* the safety check.
+
+## 5. Old cores: stop them, do not re-adopt them
+
+The renamed agent's orphan scan matches only cores started with
+`/usr/local/l-ui/bin/config-singbox.json` (exact argv triple
+`run -c <path>`). A core still running the old
+`/usr/local/x-ui/bin/config-singbox.json` will **not** be matched
+and will keep holding the inbound ports, so the new core will fail
+to bind and the agent will roll back every 30 s. Before starting
+the new agent, confirm no old core survives:
+
+```
+ps -ef | grep -F "config-singbox.json" | grep -v grep
+# any line with /usr/local/x-ui/bin/config-singbox.json must be
+# stopped (kill it; SIGTERM, then SIGKILL if it survives 5 s)
+# before the new agent starts. Do NOT kill a core whose config
+# path belongs to another panel/agent/router (e.g. amo, momo).
+```
+
+The same rule applies to the panel's own old process: stop
+`x-ui` / `xui-agent` processes before starting `l-ui` /
+`lui-agent`. `install-agent.sh`'s legacy kill covers the
+dual-mode `x-ui agent` form as a one-time cleanup, but the
+migration step above is the authoritative check — do not rely on
+the installer to notice a stray core.
+
+## 6. Rollback (before acceptance only)
+
+If a machine fails §7, roll it back before moving on:
+
+```
+systemctl stop l-ui lui-agent 2>/dev/null
+mv /etc/l-ui /etc/x-ui
+mv /etc/x-ui/l-ui.db /etc/x-ui/x-ui.db   # if the DB file was renamed
+mv /usr/local/l-ui /usr/local/x-ui
+mv /var/log/l-ui /var/log/x-ui
+# reinstall the OLD unit files and the OLD binary, then:
+systemctl daemon-reload
+systemctl start x-ui x-ui-agent  # only the units that existed before
+```
+
+Rollback after acceptance is not a plan — it is a new migration
+in reverse, and it needs the backup from §4, which acceptance
+deletes. That is intentional: acceptance must mean "this machine
+is good on the new names".
+
+## 7. Per-machine acceptance checklist (all must pass)
+
+- [ ] `ps` shows `l-ui` / `lui-agent`, and **no** `x-ui` /
+      `xui-agent` process remains (except unrelated amo/momo
+      cores, identified by their own config paths).
+- [ ] No old directory remains: `ls /usr/local/x-ui /etc/x-ui
+      /var/log/x-ui` all fail with "No such file or directory".
+- [ ] No old unit remains: `systemctl list-unit-files |
+      grep x-ui` empty; `/etc/init.d/` has no `x-ui*` file.
+- [ ] No `XUI_` line remains in the active unit / env file
+      (`systemctl cat l-ui`, `systemctl cat lui-agent`).
+- [ ] Panel answers on its usual port; login works; node list
+      shows the machine with its agent version (A-line) and
+      probe data (CPU/mem/uptime) updating.
+- [ ] Inbounds on the machine accept a real client connection
+      (not just "port listening" — the Oracle 27084 lesson: a
+      bound port is not a working inbound).
+- [ ] Probe reporting is normal on the panel (history continues,
+      no gap longer than the machine's normal heartbeat interval).
+- [ ] Subscription endpoint serves (panel hosts: the usual
+      subscription URL returns a non-empty list for a test client).
+- [ ] Update check no longer points at the old repo: panel
+      update info resolves against the confirmed repo spelling
+      (placeholder `rogue/l-ui` must be gone before rollout).
+- [ ] Backup from §4 deleted.
+
+Only after every box is ticked is the machine done. Do not tick
+"probe normal" from a single heartbeat — watch at least two
+intervals.
+
+## 8. Pilot order (suggested)
+
+1. **One pure-probe node first** (e.g. 56HL-NAT or WW39): no
+   inbounds, so a failure costs nothing but probe history, and
+   it proves the agent rename + telemetry + probe path end to end.
+2. **The master (HW-SG) second, including its local agent**: the
+   master is the only machine whose failure blocks every other
+   machine's verification, so it goes early but never first —
+   the pilot must have proven the agent binary first.
+3. **Remaining nodes one by one**, core nodes before probe-only
+   leftovers, each fully through §7 before the next starts.
+   Never two at once: if a step is wrong, exactly one machine
+   is in the broken state, and its §6 rollback is still available.
+4. **TYYUN (Windows) last and untouched**: verify only that its
+   panel row shows A2.2.1 with **no** orange update badge, and
+   that probe data still updates. No file moves, no exe swap,
+   no service change on that machine.
+
+## 9. What this migration deliberately does not do
+
+- It does not rename the Gitea repo (see RENAMING.md pending
+  item 1) — the repo rename, if confirmed, is a separate step
+  with its own verification (new clone, new release read-back).
+- It does not touch the frozen Windows agent or its service.
+- It does not rename Docker Postgres credentials, log filenames,
+  or the fail2ban jail (RENAMING.md, intentionally kept).
+- It does not "fix" unrelated stale items found on a machine
+  (e.g. the old `install-master.sh` xray download, the legacy
+  GitHub Actions workflow). Note them, don't bundle them.

docs/release.md

@@ -1,6 +1,15 @@
 # Release process (L-UI fork)
 
-Releases are published on the self-hosted Gitea (`rogue/l-ui`).
+> PLACEHOLDER REPO — rename batch: `rogue/l-ui` in this document,
+> in `internal/selfupdate/selfupdate.go`, in `panel.go`, in
+> `scripts/release-build.sh` and in the install scripts is a
+> placeholder, NOT yet the real Gitea repo name. The Gitea
+> repository has not been renamed in this batch. Do not publish
+> any release from this branch until the user confirms the exact
+> repo spelling and every placeholder is updated to it.
+> See RENAMING.md (pending items).
+
+Releases are published on the self-hosted Gitea (`rogue/l-ui` — placeholder, see above).
 Build with `scripts/release-build.sh`; this document is the rules that
 script encodes. Read it before cutting a release — several rules exist
 because violating them already caused a production incident once.