Plan: the 0.3.17 merge rule names ember-tune d5f236a (the helper's wire-sequence fix)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans/release-0.3.15.md

@@ -148,6 +148,6 @@ Publish 2's floor: the node flips the class at the floor unconditionally (class_
 - 0.3.17 node tree (the finality lane's branch notes still say 0.3.16; the lane is closed, the number here is the one that counts): the finality lane's LEAVE item (finality-pause-node 766e70ca on the box mirror /srv/igneum-node.git, one commit on 4c6b129d, rebases onto the 0.3.15 node with only params.rs overlapping; docs on origin finality-pause 27f82ec) is a digest move (the devnet digest becomes 63703f5b..., protocol 17) gated by finality_leave_activation_daa (never on devnet until the 95 percent signal); its Devnet 2 gate is tools/finality-attacks/leave.mjs both ways with the new binaries, before it merges.
 - With the after-rollout merge: the relay security fixes X23 to X28 (28c028b, on fud-close and the ledger-* branches only; the intake key gets 403 on console writes while master lacks them).
 - DONE 20:3xZ: packaging/ota/publish-manifest.sh refuses an --activation-height at or below the live DAA (the observer's executedTipDaa; IGNEUM_MANIFEST_ALLOW_PAST_HEIGHT=1 for a replay; --self-test-height), the engine half with the Ember agent for 0.3.16.
-- 0.3.17's app merge (was 0.3.16), as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 57bb4f7 (the UI pinned to the engine fields, the Ember off-state copy, N4's app half: sync_decision_v2, is_stall_exit, NodeState.tip_age_s / sync_cause / stall_exits in engine.rs and state.rs, which want the node lane's miner half (exit 45, the STALLED line) in the same cut); src/live.rs, ui/app.js, the /api/live route and packaging/ota/publish-manifest.sh from ember-tune b726ce4 (pinned to the node lane's ca3-v4-0316 b2e21447 finality-pause fields and eec34ac3 igneum_getRecentBlocks, reading the absent-field path on an older node; the node source in the site's row shape, the finality-paused state, the activation-height guard with --self-test-height; 652f6fc's guard is dropped at that merge), not miner-ui-4's 0.3.15 files; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
+- 0.3.17's app merge (was 0.3.16), as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 57bb4f7 (the UI pinned to the engine fields, the Ember off-state copy, N4's app half: sync_decision_v2, is_stall_exit, NodeState.tip_age_s / sync_cause / stall_exits in engine.rs and state.rs, which want the node lane's miner half (exit 45, the STALLED line) in the same cut); src/live.rs, ui/app.js, the /api/live route and packaging/ota/publish-manifest.sh from ember-tune da11c6f (cbd4d51: one monotonic wire sequence space for every helper writer, powertask::wire_seq; without it a 0.3.16 user with Power control on gets the caps and no tune; pinned to the node lane's ca3-v4-0316 b2e21447 finality-pause fields and eec34ac3 igneum_getRecentBlocks, reading the absent-field path on an older node; the node source in the site's row shape, the finality-paused state, the activation-height guard with --self-test-height; 652f6fc's guard is dropped at that merge), not miner-ui-4's 0.3.15 files; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
 - The publish side owes a way to set the manifest's top-level "urgent": true for an emergency rollout through a finality pause (fd03f35 reads it; igneum-ota-sign passes the document through): a publish-manifest.sh flag.
 - The gate line for every node cut from here (main writes it into CLAUDE.md): a mining new node beside an old node on the live file for ten minutes, the old node's reject count read before and after, and one new node restarted mid-window re-syncing from an old peer.