Three pages closing the medium-risk gaps in the EN doc tree. All claims
verified against source before writing:
- api/protocol-evolution.md — versioning policy + capability detection
+ cross-version operability matrix. Locked-in regime: strict equality
on protocolVersion (verified at plugin/src/transport/RpcConnection.ts:71),
current value 1 (verified at server/internal/proto/types.go:13). Lists
what bumps the version vs what's safe to add via capabilities.
- server/firewall.md — leads with the punchline: zero new network ports
needed. Verified daemon binds Unix-only via net.Listen('unix', ...) at
server/cmd/obsidian-remote-server/main.go:99. Then walks through 4
topologies (LAN, home NAT, cloud VPS, corporate-firewalled) and
hardening checklist for sshd.
- server/multi-user.md — natural per-OS-user model works without config
(defaults are home-relative). Documents the shared-user anti-pattern
+ reasons (single token, daemon thrash, no audit trail). Per-vault
multiple-profiles flow + container-isolated layout.
Wired into api/overview.md (5th sub-page) and server/overview.md
(extends the 'three ways to run it' picture with two ops-time concerns).
Bump: 1.0.45-beta.7 → 1.0.45-beta.8.
