docs(drill): the defaults are sane now, and that is exactly the danger

drill/README.md and drill.sh's assert_installed_from comment claimed both
installers default to main 'until #103 lands'. #103 landed (box installs
the BOX_RELEASE pin), and rig's install.sh has resolved the latest release
since #32 — six days before the README was written. The behaviour was
always right; the reason given for it expired, so both places now carry
the durable reason: a sane default is what makes an unstated ref
invisible, and the clean-looking record it produces proves nothing about
the candidate.

The --box-ref example (three copies: README, file header, --help — the
header IS the --help via sed 2,33p, so the window's line count is
preserved) moves from release/0.10.0 to the 0.9.0 tag: after #103 the box
that ships is the BOX_RELEASE tag, so a release/… branch is the wrong pin
for box while staying right for rig. The hazard-class citations at the
pre-flight refusal are untouched — they cite #103 as the hazard, not as a
pending change.

Closes #133

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -20,6 +20,7 @@ on the way to cutting its first release, and this file starts there.
 
 ### Fixed
 
+- The drill's docs no longer claim both installers default to `main` — box installs the `BOX_RELEASE` pin, rig the latest release, and its `--box-ref` example is now a tag (#133)
 - `kimi-bot-andresmgsl` is on the review panel — the roster predated it joining the bench (#120)
 
 ## 0.3.0 — 2026-07-21

drill/README.md

@@ -17,9 +17,12 @@ release (#105, and #107's debt).
 - **The pinned candidate refs, both of them.** `--rig-ref` and
   `--box-ref` are required; the harness refuses to run without them and
   refuses to continue if what installed disagrees with what was asked
-  (`INSTALLED_FROM`, both trees). Until heavy-duty/rig#103 lands, both
+  (`INSTALLED_FROM`, both trees). Since heavy-duty/rig#103 landed, both
-  installers default to `main` when unpinned — which is exactly why the
+  installers have sane defaults when unpinned — box installs the
-  drill will not let a ref go unstated.
+  `BOX_RELEASE` pin (currently `0.9.0`), rig's `install.sh` resolves the
+  latest release — and a sane default is exactly why the drill will not
+  let a ref go unstated: an unpinned run silently drills a shipping pair
+  that is not the candidate, and the record it leaves looks clean.
 - **A single-use, tagged tailscale pre-auth key** in `TS_AUTHKEY`
   (`tag:local` for the default `staging-server` role — bootstrap refuses
   `tag:server` outside the control-plane shapes).
@@ -45,11 +48,15 @@ in the checkout's `drills/`):
 
 ```sh
 TS_AUTHKEY=tskey-... bash drill/drill.sh \
-  --rig-ref release/0.4.0 --box-ref release/0.10.0 \
+  --rig-ref release/0.4.0 --box-ref 0.9.0 \
   --users ./drill-users --run-id drill-2026-07-24-a \
   --coolify-version 4.1.2 --runner-repo you/rig --yes
 ```
 
+`--box-ref` is a tag on purpose: since #103 the box that ships is the
+`BOX_RELEASE` tag, so a `release/…` branch is the wrong thing to pin for
+box — while a release branch stays exactly right for rig's own candidate.
+
 It runs unattended from there. Legs execute as 1, 4, 2, 3 — Coolify's
 installer is what puts Docker on the box and the db leg needs a daemon —
 and the record lists them as they ran. A failing check never aborts the

drill/drill.sh

@@ -8,10 +8,10 @@
 #     Never run it on a machine you care about.
 #
 #   TS_AUTHKEY=tskey-... bash drill/drill.sh \
-#     --rig-ref release/0.4.0 --box-ref release/0.10.0 \
+#     --rig-ref release/0.4.0 --box-ref 0.9.0 \
 #     --users ./drill-users --run-id drill-2026-07-24-a \
 #     --coolify-version 4.1.2 --runner-repo you/rig --yes
-#
+#   (--box-ref is a tag: since #103 the box that ships is the BOX_RELEASE tag.)
 # rig's drill asserts CONVERGENCE — a machine reaches its role, idempotently.
 # The legs (drills/README.md, issue #105):
 #
@@ -130,11 +130,12 @@ tree_of() {
 
 # assert_installed_from <what> <tree> <want> — ASSERT WHAT LANDED, never trust
 # that the install obeyed. An installer invoked with stale env vars silently
-# falls back to its defaults (rig#103: both BOX_REF and RIG_REF default to
+# falls back to its defaults — sane ones since rig#103 landed (box: the
-# main), and a drill that thinks it exercised release/X but actually got main
+# BOX_RELEASE pin, rig: the latest release), which is what makes the fallback
-# has proven nothing about the combination that ships — worse than one that
+# invisible — and a drill that thinks it exercised release/X but actually got
-# fails, because the record it leaves LOOKS like evidence. Refusal names both
+# whatever the defaults resolve to has proven nothing about the combination
-# refs, per #105's acceptance criteria.
+# that ships — worse than one that fails, because the record it leaves LOOKS
+# like evidence. Refusal names both refs, per #105's acceptance criteria.
 assert_installed_from() {
   local what="$1" tree="$2" want="$3" got
   got="$(cat "$tree/INSTALLED_FROM" 2>/dev/null || echo '<unreadable>')"