Squid 1.8.1 — 1.8.0 hardening review followups Post-merge self-audit of the 1.8.0 Upgrade Hardening initiative surfaced one cosmetic bug and three test-coverage gaps that wouldn't have caught a future regression. This release addresses all four in PR #362. Bug fix (H4) — Clock-skew Math.Max(0, ...) guard for `elapsed` in upgrade-lock contention message. Pre-fix, two server pods disagreeing on UTC (NTP slew, fresh-pod startup) showed the operator "~-3599s ago" cosmetically; dispatch itself worked correctly. Test gap (H7) — CapabilityKeys.Role.* constant pinning added to CapabilityKeysConstantsTests (matching Shell / Bin / Privilege pattern). Drift in role:iis / role:docker / role:nginx / role:systemd literals now surfaces at build time. Test gap (H7) — TentacleHealthCheckStrategy cache-population test with installedRoles in metadata. Pins the read-side wire contract between agent capability emission and server cache write. Test gap (H7) — MachineRuntimeCapabilitiesPersistence JSON shape tests pin installedRoles serialisation, deserialisation, AND the 1.8.0 → 1.8.1 backward-compat path (blobs without installedRoles field deserialise to null). 5603/5603 unit suite green (+7 net new vs 1.8.0). No operator-visible behaviour change beyond the cosmetic contention message fix.