docs/TODO #6: targeted-connect test-path bench-verified (0bfe872 mounts one image)

0bfe872 builds, deploys, and the host now mounts ONLY its own version's image
instead of connect-all'ing every served version — the targeted 'nvme connect -n
rd.nvmf.nqn' works. Each host = 1 controller on its own subsystem, which is what
lets old versions drain to 0 and spdk-loader auto-reap. Still to confirm: the reap
payoff (migrate a host, watch its old version drain + reap), and the secure path's
new step-6 connect over macsec0.

docs/TODO.md

@@ -696,12 +696,16 @@ must be built around **never restarting the process that holds live connections.
     boot. Now each host = 1 controller on its own subsystem → versions drain to 0
     when their hosts move off → auto-reap works; connections scale O(hosts) not
     O(hosts × versions). Requires a rebuild + re-sign (cmdline change, invariant #6).
-    **BENCH-VERIFY:** (a) test path — after rebuild, `spdk-release list` shows each
-    box on ONLY its version; old versions reap after hosts migrate; (b) secure path
-    — the new step-6 connect brings up the NVMe root over macsec0 (this path was not
-    yet bench-confirmed end-to-end); (c) confirm the dracut nvmf module isn't ALSO
-    connect-all-ing on the secure path (if it is, suppress it — the targeted connect
-    is meant to be the sole connector).
+    **(a) TEST PATH BENCH-VERIFIED 2026-07-03 (commit `0bfe872`): builds, deploys, and
+    the host mounts ONLY ONE image** (its own version's subsystem) instead of connect-
+    all'ing every served version — the targeted `nvme connect -n rd.nvmf.nqn` works.
+    So each host now = 1 controller on its own subsystem, which is what lets old
+    versions drain to 0 and `spdk-loader` auto-reap. **Still to confirm:** the reap
+    payoff itself (migrate a host, watch its old version drain to 0 and get reaped);
+    (b) SECURE PATH — the new step-6 connect brings up the NVMe root over macsec0
+    (this path is not yet bench-confirmed end-to-end); (c) that the dracut nvmf module
+    isn't ALSO connect-all-ing on the secure path (if it is, suppress it — the targeted
+    connect is meant to be the sole connector).
   - **BENCH FINDING 2026-07-03 (FIXED) — the target WAS still recreated on an
     `IMAGE_VERSION` bump.** Despite the above, the `nvmeof` (spdk-target) service
     still carried a versioned `type: image` bootstrap mount