Ship 0.2.162; handoff: record relay analyze-hang outage

Wire v0.2.162 into the version graph (the 890d671 relay-client dedup,
now built and installed on the box).

Rewrite Current state around the active relay outage: a Gemini analyze
call black-holed and jammed the relay's single in-memory hardware FIFO
slot, blocking all manual + subscription jobs. Root cause is relay-side;
the full diagnosis + 2-part fix is captured to the standards inbox for a
separate ../recap-relay /triage session. Records the recap-side open
question (background sub-check entitlement gate may also skip silently
post-core-decoupling).

Move the standing operator-actions list from Current state to ROADMAP.

ROADMAP.md

@@ -13,6 +13,16 @@ Longer-term backlog for Recaps. Near-term in-flight work and known issues live i
 - **Decide the Max tier-quota default.** The relay code default is `max.monthly: null` (unlimited) → cards render "Unlimited" on a fresh install. The operator set `max.monthly: 120` on their box via the Adjust-Tier-Quotas action (so cards show 120 there). Decide whether a metered number (e.g. 120) should be the shipped default in `recap-relay/server/config.js` — note it also enforces the ceiling, not just the card label.
 - **Add Gemini 3.5 to model selection.** First have a research agent confirm which stable Gemini model versions are actually available and the correct model id/name before wiring anything. The model list is duplicated server + client (provider config under `server/providers/` + the model picker in `public/index.html`) — add the option in lockstep, like the URL-parser convention. Coordinate with the matching relay-side capture (the relay routes Gemini, so its model list must agree). — captured 2026-06-16
 
+## Pending operator actions
+
+Operator to-dos (verification + real-world tests on the live box), not coding work.
+
+1. **Verify the mobile can't-scroll-to-top fix on the iPad** — UNVERIFIED in 0.2.157 (iOS-layout-specific, not reproducible off-device); send a screen recording if it persists.
+2. (optional) Rotate the still-live Gemini key in AI Studio, then `rm /Users/macpro/Projects/recap-keyleak-purge-backup.bundle`.
+3. Real-world cloud tests: first Bitcoin purchase; enable Zaprite cards (relay "Set Zaprite Connection" + webhook); eyeball a reminder email.
+4. If recaps.cc ever gains a CDN/LB hop, set `RECAP_TRUSTED_PROXY_HOPS` or the trial-cap bypass reopens.
+5. **Smoke-test the Daily Digest (0.2.158)** — installed but not yet exercised off-box: (a) `POST /api/admin/digest/run {test_email}` to eyeball the sample render; (b) toggle it on in Settings, add a recap, then `POST /api/admin/digest/run` (no body) to force a real scan — confirms relay synthesis + SMTP send + the unsubscribe link end-to-end. Needs System-SMTP configured.
+
 ## Design-contract conformance cleanup (from the 2026-06-16 `/design` extract)
 
 The `design/` contract (`design/DESIGN.md` + `design/tokens.tokens.json`) was extracted