docs(todo): record the captive-portal-login engine core landing

The portal-login repair tier shipped in dotfiles (a7d7559); net doctor / net portal run the real plain-DNS flow now. Note the three remaining items: name the DoT cause in diagnose, a dedicated panel button, and live validation.

1 files changed, 3 insertions, 0 deletions

diff --git a/todo.org b/todo.org
index 0ac7e3d..95f6cf8 100644
--- a/todo.org
+++ b/todo.org
@@ -26,6 +26,9 @@ Make the captive-portal login a first-class net-panel feature instead of the one
 
 Full mechanism writeup, the working script, and the integration plan: [[file:docs/design/2026-06-30-captive-portal-login.org]]. From the 2026-06-30 Hyatt saga.
 
+*** 2026-06-30 Tue @ 11:40 -0400 Engine core landed (dotfiles a7d7559)
+Replaced =net portal='s old captive-helper hand-off with a =portal-login= repair tier: drop DoT to plain DNS, probe the portal URL (302 / meta-refresh), open a throwaway browser profile, spawn a detached watcher that restores DoT once online (or on timeout). =net portal --restore= is the manual fallback. 7 tests. So =net doctor= / the bar's =net portal= hookups already run the real flow now. Remaining: (1) name the DoT-blocking cause in =net diagnose=; (2) a dedicated "Log in to this network" button in the panel's Diagnose/Repair tab (today it rides the generic =net portal=); (3) live validation against a real captive portal (unit-tested only — didn't run it live to avoid disrupting a meeting).
+
 ** DONE [#B] ZFS pre-pacman snapshot installer step (ZFS-root) :feature:zfs:
 CLOSED: [2026-06-30 Tue]
 Add a ZFS-root-gated installer step that installs the pre-pacman snapshot pacman hook plus a self-pruning =/usr/local/bin/zfs-pre-snapshot= (KEEP=10). The script is hand-placed on velox, not authored by archsetup, so a reinstall loses it; snapshots accumulated unbounded (53 since April) because nothing prunes them and Sanoid ignores non-autosnap_ names. Gate to ZFS-root (velox; ratio is btrfs). Also correct the stale 2026-01-17 security-doc line claiming it's "already in install-archzfs". Needs the hook file (source from velox) and a ZFS-root VM test.