docs(progress): X8 done; session tally 25 PRs — night-2 (#26)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

PROGRESS.md

@@ -73,7 +73,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - [ ] X5 orchestrate completion — BLOCKED (X2,X3,X4)
 - [ ] X6 `internal/doctor` full matrix + `--fix` — BLOCKED (C8,N2,N3)
 - [ ] X7 `workspace destroy`/`uninstall` — BLOCKED (N2,N3,S5,X6)
-- [ ] X8 self-update notifier — TODO
+- [x] X8 self-update notifier — **DONE** (PR #25, `28c4a78`)
 - [ ] X9 `internal/migrate` + `import` — TODO
 
 ### M7 GA (rolling)
@@ -96,3 +96,4 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (night 2 cont.) **S1 + N1 merged** (PRs #14–15) — started the M4 + M5 parallel tracks: the `secret://` core (parser/Provider/registry/batched Resolve) and the Caddy proxy route table + labels. **Gotcha learned the hard way:** pushing a non-semver milestone tag (`m2-done`) broke `release-dryrun` on the next PR (goreleaser `git describe`); deleted the tag, re-ran, green. Decision #1 updated — milestones go in this log, never as tags. **Next ready (all parallel): the provision saga phase (host-port coupling), S2 (SOPS via shelling to `sops`), S3/S5, N2–N4 (sudo/account-gated → mock/temp-file tests), X1 config completion, X8 self-update notifier, X9 migrate/import, G1 integration lane (also unblocks the saga daemon e2e).** Consider G1 next — it activates the already-written `-tags=integration` tests (docker/health/hooks) in CI and provides the isolation harness the saga e2e needs.
 - (night 2 cont.) **owner CI/test request + G1 + N3 + N2 merged** (PRs #17–21) — consolidated CI (7→2 jobs, fail-fast cheap→expensive, module/build cache, Docker for integration+e2e) + a `tests/` folder (functional + real-daemon e2e CLI, green on GitHub's runner ~4.5 min); then `internal/dns` (marker-fenced /etc/hosts) and `internal/trust` (mkcert wrapper), both behind injectable runners + fully temp-file/fake tested, with `dns setup|status|remove` and `trust install|uninstall|status` CLIs. **M5 has N1/N2/N3 done; N4 (tunnel) + N5 (saga trust phase) remain.** Per-PR `ci` now runs the e2e lane too, so docs PRs also take ~4.5 min — acceptable; add path filters later if noisy. **Next ready: N4 tunnel, N5 trust saga-phase, S2 (sops), the provision saga phase (host-port coupling), X1 config completion, X8 notifier, X9 import.**
 - (night 2 cont.) **N4 merged** (PR #23, `91f206f`) — `internal/tunnel` (cloudflared wrapper: login/create/route, wildcard-route refusal, deterministic ingress→Caddy, non-local-secret refusal) + `tunnel` CLI. Also added CI `paths-ignore` (`**/*.md`/docs/LICENSE/NOTICE) so **docs-only PRs now skip the heavy lane entirely** (merge with no checks). **M5 networking N1–N4 complete; N5 (wire proxy labels into generate + saga trust phase) is the remaining M5 piece.** Broad frontier still open: S2/S3/S5 secrets, the provision saga phase (host-port coupling), X1 config completion + the M6 fan-out (X2–X9), G2–G5.
+- (night 2 cont.) **X8 merged** (PR #25, `28c4a78`) — `selfupdate.Notifier`: throttled (≤1 network check/24h, XDG-cached), fail-silent, dev-build/`--json`/`--quiet`/`DEVSTACK_NO_UPDATE_NOTIFIER`-aware update notice wired into the CLI root's `PersistentPostRun`. **Session tally: 25 PRs merged, all green** — M2 complete (C1–C8), M4 S1, M5 N1–N4, M6 X8, M7 G1 + the consolidated CI/`tests` overhaul. **Remaining for `done`: N5; S2–S6; the provision saga phase (host-port coupling, the flagged M2 follow-up); X1–X7+X9 (M6); G2–G5 (M7).** Next-ready picks: X1 (config completion — unblocks X2/X3/X4), S2 (sops via shelling), X9 (devdock import), N5 (proxy-into-generate + trust saga phase), the provision phase.