update security

README.md

@@ -16,6 +16,13 @@ interactive menu. Update availability is checked in the background and cached;
 updates are installed only when explicitly selected or requested with
 `tapm update`.
 
+On a clustered Proxmox host, both `tapm update` and the management-menu update
+update every online cluster node over Proxmox's root SSH trust, then update the
+initiating node. Each node independently performs the same clean-worktree,
+branch, and fast-forward safety checks. Offline, unreachable, dirty, ahead, or
+diverged nodes are never overwritten and are reported as failures. Standalone
+hosts retain the local-only update behavior.
+
 When testing this branch, use `tapm main` to switch the installed copy back to
 the published main branch. The command refuses to switch when local changes,
 local-only commits, or diverged branch history would be at risk.
@@ -159,3 +166,20 @@ both values. Inputs are validated and written atomically with mode `0600`
 before update checks or menu actions continue. A non-interactive launch without
 valid configuration stops with an explicit setup message instead of selecting
 a default company URL.
+
+## Installation registry
+
+V2 creates a random installation UUID and 256-bit credential in
+`/var/lib/ta-proxmenu/identity.env`. The directory is mode `0700` and the file
+is mode `0600`. On each interactive launch, TA-ProxMenu makes best-effort HTTPS
+calls to the configured broker to record installation/upgrade state, start and
+completion status, duration, TA-ProxMenu and Git versions, PVE/OS/kernel
+versions, architecture, and whether the host is clustered. No background
+service is installed, and broker availability never prevents the menu from
+running.
+
+The registry does not send hostnames, machine IDs, MAC addresses, usernames,
+customer names, VM/container inventory, deployment codes, authorization
+tokens, or command output. The broker stores only a digest of the random host
+credential. A successful deployment-code exchange links the already-random
+installation ID to a verified registry entry.