#476 merged first, which removed edge_open3e_pkg, edge_e3oncan_repo and edge_e3oncan_version in favour of the image. The audit entry added here still told the agent to read those, so it would have gone looking for variables that no longer exist and reported nothing -- the same silent non-auditing the entry was written to prevent. Repointed at where the pins actually live now: OPEN3E_REF and E3ONCAN_REF as ARGs in ci/images/heating-can/Containerfile. The awkward specifics carry over unchanged, since they are properties of the upstreams rather than of how we package them: open3e publishes no tags so the comparison must be against commits, and E3onCAN's pin is an untagged commit later than its newest tag. Added a note the previous version could not have made: heating_can_image is :latest, so the node follows whatever CI last built. The Containerfile ARGs are what actually fix the versions, and bumping one is what requires a rebuild -- otherwise a reader could reasonably conclude the tag is the pin. The pin commit itself is now a no-op against master and survives only as the audit registration; its conflict on heating-can/defaults resolved in favour of the image. Co-Authored-By: Claude Bot <claude-bot@renner.uno> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>