Rackpad 1.8.4-beta.9

This beta completes the template-editor and mixed-member stack work, adds clear
container storage diagnostics, and independently applies security and dependency
maintenance. MCP remains disabled by default. Existing controller integrations
retain their non-destructive preview/apply workflow.

Changes

• Template editing provides copy feedback, artwork ordering, undo/redo, face
  transfers, module grids, colours and resizing while retaining linked ports.
• Stack members can use different templates and port mappings. Preview/apply
  checks authorization and current state before changing a layout; port IDs and
  cable links survive compatible edits. Schema 54 includes member layouts in
  logical and native recovery.
• Database-open and read-only failures include a short storage-permissions hint
  while retaining the original error. See the tested setup contract in
  bind mounts and custom users.
  PUID and PGID are unsupported; use the Compose service-level user setting.
• Dependencies include Nodemailer 10.0.13, Fastify 5.12.5, shell-quote 1.12.0 and
  source-map-js 1.2.2. Compatible maintenance suggestions were independently
  applied or already satisfied. Unused Recharts stays removed; SQLite and icon
  upgrades are retained. Explicit trusted-proxy handling remains unchanged.
• Contributions are maintainer-only. Reports, testing and feedback remain
  welcome; Dependabot suggestions are independently evaluated without merging
  bot or outside-contributor commits.

Upgrade and rollback

Before deploying schema 54, stop writes and take a protected, consistent
snapshot of the database/volume and configuration, including the original
RACKPAD_SECRET_KEY. Record the current image digest and retain that exact image
with the snapshot. A stopped-volume copy or SQLite-aware native backup avoids
an inconsistent copy of an active WAL database. A logical export is additional
recovery evidence, not a substitute for this paired pre-upgrade snapshot.

First rehearse on a disposable copy. Check login, inventory counts, linked ports,
stack layouts, editor save/reload, monitoring and persistence after restart.
Migrations are forward-only: never attach the previous image to a schema-54
database. Rollback restores the protected database/configuration pair and its
matching previous image. Logical and native restore revoke MCP tokens.

The upgrade does not move existing inventory. It preserves collision rejection
and the ability to select and repair an existing overlap. Root/host-network
discovery stays explicitly opt-in. Review file ownership before returning from
root discovery to ordinary operation; see discovery deployment.

Focused acceptance

• #164: Copy, layer and resize artwork; undo/redo; move or copy items between
  faces; resize module grids and colours; save/reload a template with linked ports.
• Mixed stacks (#146): Use different member templates, preview/apply port
  mappings, verify both faces and existing cable endpoints, export SVG/PNG, and
  round-trip a protected disposable backup.
• #170: Try occupied Studio drops, inspector saves and bulk changes on both
  faces. Conflicts must leave both records unchanged. Select either member of
  an existing overlap and move it into free space. A residual report still needs
  a usable reproduction; no speculative inventory relocation is included.
• MCP (#180): Explicitly enable MCP, use the real SDK with a lab-scoped token,
  review/apply a proposal in the browser, and confirm cross-lab/viewer denial and
  revocation. See MCP guidance.
• Cabling (#51): Check dense patch cords, trace selection, and SVG/PNG export.
• #184: Check an ordinary named volume, a correctly owned bind mount and a
  custom UID/GID, then restart and verify writes persist. Confirm that incorrect
  permissions fail with the new hint rather than silently changing ownership.

Quality, CodeQL, dependency and image scans gate publication of the exact release
revision. The low-severity DS0026 warning on
scripts/fixtures/snmp-interop/Dockerfile is retained: its container is a finite
test runner, and the harness checks its exit status and actual SNMP responses.
A synthetic healthcheck would not establish interoperability. No suppression or
production-image healthcheck change is introduced for that fixture warning.

Reporter-specific acceptance and real Cisco SNMP testing remain follow-ups.
Native Proxmox LXC stays experimental: the install, update, rollback, reboot,
recovery and seven-day soak matrix remains tracked in
the native LXC roadmap. V2 automation, branding,
Railyard endorsement, skins, template sharing and direct-rack rotation are outside
this beta. Stable maintenance is prepared separately in #182 and remains
unmerged; beta fixes do not resolve main-branch security alerts.