docs: R-94 closed, R-29 leg (a) closed + leg (b) half, R-168 minted

hub/CHANGELOG v0.87.0 + scripts/CHANGELOG gate-enforcement entry. CONTEXT gains S-6 (the
hub renders no host-install version and the gate pins its absence) and S-7 (gates run from
one entry point per repo; reuse_refs_check was fixed rather than the REUSE.md convention,
with both rejected alternatives recorded).

OPEN-ITEMS: R-94 CLOSED all three legs, leg (a) by DELETION with its reason; R-29 leg (a)
CLOSED and leg (b) HALF-SHIPPED with the census result written into the row (13 gates; every
gate a CLAUDE.md names was green, two of the four unnamed were red); R-161 gains its
successor pointer. NEW R-168 (grep established R-167 was the highest in use): Gitea Actions
runner — measured 2026-08-02 as Gitea 1.26.2, Actions enabled on all four repos, 0 runners,
0 workflow runs, 0 branch protections, and the consequence that trunk-based direct-to-main
pushes leave no merge for a status check to gate, so CI here can detect but not block.
BLOCKED on a spike over host-mode vs privileged DinD on DooPlex and whether the workflow can
avoid JavaScript actions.

ROADMAP: R-94 collapsed to its one-liner, R-29 updated, R-168 added.

hub/CHANGELOG.md

@@ -1,3 +1,42 @@
+## v0.87.0 — the Setup tab stops claiming a host-install version it cannot know (2026-08-02)
+
+**R-94, all three legs, closed by deletion rather than derivation.** The customer page's Setup
+Command card read *"Day-0 host bootstrap for host-install **1.19.0**"*. The served script was
+**1.22.0**, and had been since 14 July — nineteen days of an operator-facing number that was simply
+wrong, with a version number's authority behind it.
+
+**Why deriving it is not achievable honestly.** The Option-1 command downloads
+`felhom-host-install.sh` from the website **at run time**, and the website git-syncs `main` every
+thirty seconds (R-110). The hub therefore cannot know which version a given box will run — not at
+build time, not at render time. Any literal there is a guess. The comment that guarded the old const
+already half-admitted this ("Display-only… the served script is always current"). R-94(a) offered
+*derive it, or delete it*; deleting removes the drift class permanently instead of automating it.
+
+**What changed.**
+- `internal/web/configs.go`: `const hostInstallVersion`, the `pageData.ScriptVersion` field and its
+  assignment are **gone**. A NOTE stands in their place recording why there is deliberately no
+  constant here, so the next person does not helpfully re-add one.
+- `internal/web/templates/customer_unified.html`: the sentence now says the command always fetches
+  the **current** installer and renders no version at all.
+- `internal/web/render_test.go`: the assertion `strings.Contains(html, hostInstallVersion)` compared
+  the constant to itself and **passed at any value** — demonstrated green with the const set to
+  `9.9.9` while the served script was 1.22.0. Deleted, not replaced: there is no longer a version to
+  assert. The `data-customer-id` and static-fallback assertions stay.
+- `scripts/hostinstall_gates.py` gate 1 **inverts**: it used to require the hub const to EQUAL
+  `SCRIPT_VERSION`; it now asserts the hub carries **no host-install version literal at all**,
+  matched in six code shapes across every `.go`/`.html` under `hub/`. Comments are deliberately not
+  stripped — a `//` inside a URL string literal would truncate the scan and blind the gate — so the
+  patterns match declarations, fields, assignments and the template action, never prose.
+- `scripts/felhom-host-install.sh`: **comment only**, `SCRIPT_VERSION` untouched. It claimed the gate
+  keeps the hub copy equal, an invariant that no longer exists; a comment asserting an invariant the
+  code does not provide is a wish.
+
+**Red-proofs.** Restoring the const fails the rewritten gate 1 on three of its six shapes. The old
+`render_test.go` assertion passes with the const at `9.9.9`.
+
+**Live verification:** endpoint-level (no browser on DooPlex) — the customer Setup tab is fetched and
+grepped for a version literal.
+
 ## v0.86.0 — Copy works without revealing, and every copy branch reports itself (2026-07-31)
 
 **Found by the operator, in the way that matters: it cost a real login.** The v0.84.0 Console access