Root problem: to provide Drydock in the cluster, we need to expose Almanac, and doing so would let users accidentally or intentionally create a bunch of repo006.phacility.net devices/services which could conflict with the real ones we manage.
There's currently no way to say "you can't create anything named *.blah.net". This adds "namespaces", which let you do that (well, not yet, but they will after the next diff).
After the next diff, if you try to create repo003.phacility.net, but the namespace phacility.net already exists and you don't have permission to edit it, you'll be asked to choose a different name.
Also various modernizations and some new docs.