docs(plan): the updates module, and two spec corrections

Drafting the code found two holes in the spec. Awaiting build was
limited to the user's own recipes, so an SBo package whose recipe had
caught up but was not yet built (nessus) showed in no section; it now
covers any recipe. And "the newest ChangeLog line decides" would never
call a package new once it had been upgraded after being added; only
Added and Removed lines count now. The prefix rule for kernel suffixes
is dropped as redundant: version order already ranks a suffixed version
newer, which is never behind.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 17 insertions, 12 deletions

diff --git a/docs/superpowers/specs/2026-10-15-updates-design.md b/docs/superpowers/specs/2026-10-15-updates-design.md
index e6a3458..54ebfbf 100644
--- a/docs/superpowers/specs/2026-10-15-updates-design.md
+++ b/docs/superpowers/specs/2026-10-15-updates-design.md
@@ -42,10 +42,12 @@ matches, so a row shows the next step and nothing after it.
 1. **Slackware**, three groups, all from the mirror:
    - *Upgrade*: an installed package whose name is on the mirror with a
      different version or build.
-   - *New*: the ChangeLog's newest line for the package says `Added.`, it is
-     on the mirror, and it is not installed. These are slackpkg's
-     `install-new` semantics.
-   - *Removed*: the ChangeLog's newest line for the package says `Removed.`,
+   - *New*: of the ChangeLog's `Added.` and `Removed.` lines for the package,
+     the newest says `Added.`; it is on the mirror and not installed. These
+     are slackpkg's `install-new` semantics. Other lines (`Upgraded.`,
+     `Rebuilt.`) are ignored, or a package added and later upgraded would
+     never count as new.
+   - *Removed*: of the same lines, the newest says `Removed.`,
      it is installed, and it is not on the mirror. The row carries the date of
      that ChangeLog entry.
 
@@ -54,11 +56,13 @@ matches, so a row shows the next step and nothing after it.
    skipped in all three, as slackpkg skips them; so are blacklisted names.
 2. **Upgrade here**: B newer than I. The package is built and sitting in the
    repo.
-3. **Awaiting build**: R is the user's (not `SBo`), R equals U, and B is older
-   than U. The SlackBuild is bumped and only needs building.
+3. **Awaiting build**: R is at or past U, B is older than U, and the package
+   is installed. The SlackBuild, the user's or SBo's, is current and only
+   needs building.
 4. **Upstream newer**: U newer than both R and B. The SlackBuild or its hint
-   needs bumping, then a build. `SBo` rows land here until the build appears
-   in B.
+   needs bumping, then a build. An `SBo` recipe that lags upstream lands
+   here: the bump is a hint file on the build VM. Shown when the package is
+   installed, or when the recipe is the user's (repo work either way).
 5. **App updates**: I comes from AppImage or flatpak and is older than U.
 
 "Newer" and "older" are version order, never equality: an installed 2.1.278
@@ -83,10 +87,11 @@ Rows are `{name, repo, from, to}`; Slackware rows are `{name, from, to}`,
 
 **Version order** is a small `vercmp`: split on non-alphanumerics, compare
 numeric chunks as numbers and alphabetic chunks as strings, numbers before
-letters. It replaces nvtable's normalised equality, including its rule that
-an installed version extending upstream at a component boundary (a kernel
-suffix, a git hash) counts as equal; that rule is kept as a prefix check
-before ordering.
+letters; when one runs out, the longer is newer unless its next chunk is
+alphabetic (a pre-release). It replaces nvtable's normalised equality. Its
+rule that an installed version extending upstream at a component boundary (a
+kernel suffix, a git hash) counts as equal needs no special case: the longer
+version orders as newer, which is never behind.
 
 **NFS reads** (`PACKAGES.TXT` of the repo and of the mirror, the mirror's
 `ChangeLog.txt`) go through `subprocess.run(["cat", path], timeout=5)`. The