Merge ship-docs-0321 a7ea56cd into master (gate: green on a7ea56cd, recorded by tools/ci/pre-push.sh; the full gate runs in CI on this merge)

docs/plans/release-0.3.22.md

@@ -112,3 +112,13 @@ Three commits on 96161037: bd710a36 the sub-version 3 re-pin (byte 7, igneum-pow
 **The steward's two items before the public repository opens, both closed:** tools/exec-attacks/lib/common.mjs MINER_KEY is the public Anvil/Hardhat default account 1 key (five harnesses use it; balance 0 and nonce 0 on both chains at 20:55 and 20:59 BST; the fix is a chain-id guard in the five harnesses and a README line, a 0.3.24 steward row); app/igneum-wallet/src/hd.rs's KEY in one history commit is the public Hardhat default account 0 key in a removed test.
 
 **Proven share, the second hour (20:59 BST):** cumulative 0.468 (1,848 of 3,952 shards since DAA 0); the hour's own segments 0.84 (1,094 of 1,304), the shortfall mostly the 34a2dbaa sweep's one-minute node restart per prover; eleven provers (five 3060s at about 85 s a segment, two 3090s, three 4090s, one A5000), a twelfth starting; the next hour's own segments should read one and the founder's 24 hours count from the first that does. **The pool hour** counts from 20:33:28 BST (dn3-pool-b's first OPEN SHARE on the 017e7037 daemons a357c581; WRONG HASH 0 since), the pool split's condition.
+
+## 11. The 0.3.23 cut (21:1x to 21:3x BST): the fold, the version miss, the LG-4 shape
+
+**release-0.3.23 = 05c2ddfe on the mirror:** 2f27ecb1 (the rights step 332b82eb with the deferred rule and the WebView2 right, the unattended driver install 50cdb8e4) + check-labels-23 e6f9ef0b + ota-token-23 757d7870 + the Windows pin to 2720d8d2 + dpi-23 ad407b13 (per-monitor DPI; BUILD-APP.bat, host.rc, host.manifest, host.cpp) + network-23 b18a5b0f (the first-run network step: the manifest's default_network, the testnet card present and refused until testnet_open, `--testnet --netsuffix=1` with the seeds as --addpeer; view.test.mjs resolved as the union of the check-labels and network tests) + install-close-23 5140e6fe (main's fold inside 15 minutes: the installer's stop step ends the window host first by path and waits up to 30 s for the unlock, CloseApplicationsFilter and SetupMutex in the .iss, install-running.flag holds every relaunch, the engine prints EXIT update and the host ends instead of restarting; tests known-failed first on tonight's PC 2 sequence) + the version bump 05c2ddfe. App gate GREEN on build-1 at every step (last 284 + 35 + 8), UI 86, pre-push 59. The version miss (rule 15): the branch carried 0.3.22 in every place until 21:26 BST, caught by the build-server lane before the host job; the exes and kit from 1c5323be are void. The Mac DMG re-cut under the lock on the 2720d8d2 Mac pair (igneumd efff01cd, igneum-miner 45c4c68f); the 0.3.23 host from the 05c2ddfe kit in the PC 1 slot after the hash lane's floor grid; the manifest carries default_network devnet-3 and keeps the floor file; the 0.3.23 Windows smoke is the first read of install-close-23 over a running app (the installer's own stop step, no pre-stop by the job) and of the OTA-return line through the app's own path.
+
+**The 0.3.22 Windows smoke, take 1 FAIL (20:54 BST), the job shape:** the installer 5ac3dc62 built clean on PC 2 (every exe 0.3.22, the MSVC host 4bc25b7f through the host gate), but the job's silent install over the running 0.3.21 app sent api/quit, the engine stopped, the window host (the same pid since 19:14 BST) never stopped and its restart ladder relaunched the old engine 10 s later, Inno could not replace the locked host with its message box suppressed, every file stayed 0.3.21. Take 2 in the 0.3.10 smoke shape (the job stops the app by pid first, installs, asserts every file's version and sha, starts the host, reads the app alive at 60 s on 0.3.22 with stdin open). The defect is install-close-23 in 0.3.23. Devnet 3: the 34a2dbaa pass complete on every node by 21:17 BST (thirty-two read-backs incl. hub-1's and pool-1's second nodes); the 2720d8d2 pass started 21:17:23 BST with dn3-g1, the pair whole (igneumd df6476ed, miner dfdc6883, paired: program id 571131ccbd6e0de9 equal with c29f33bb at epoch 2).
+
+**LG-4 (the founder: "use PC 1 or PC 2 or get another machine"; main's ruling):** on PC 2 tonight after both smokes, a fresh Windows user account created by job (no Igneum state, no card cache), the three timed steps (download and install, sync to the tip, dataset build to the first accepted share) as FIRST-SHARE lines, ten runs with the app uninstalled and the profile wiped between runs, no click anywhere, the rows on /evidence labelled "PC 2, fresh user account, not a fresh image, 7 October 2026", the 9-of-10 under-10-minutes bar read against them; macOS the same way as a fresh user account on the Mac tomorrow; a rented Windows VM only if the account shape fails the bar for a reason an image would change. PC 1 stays the founder's desk.
+
+**0.3.22 Windows take 2 FAIL (21:13 BST) and the skip:** the job's detached helper was ended with the job's process tree before its first sleep ran out (Start-Process stays in the runner's tree; a survivor needs Win32_Process.Create or a scheduled task); nothing was installed, every file still 0.3.21, the payload untouched. Ruling: no take 3; the 0.3.22 Windows entry is skipped (the Mac and HiveOS entries stand); the first install over a running app is 0.3.23's installer with install-close-23 in the simplest job shape (Start-Process -Wait; the installer's own stop step and the install-running flag do the work), its smoke read the gate line for both; the Discord card publishes on the 0.3.23 Windows entry. **The version miss, second layer (21:30 BST):** the box cross of 0.3.23's exes failed in build.rs because igneum-app.rc still read 0.3.22 (Info.plist and the installer's AppVersion too); fixed at release-0.3.23 = 7c7489ac, the rule 15 check extended to six places and green on the tree; the 0.3.23 node pairs under /srv/artefacts/0323-2720d8d2/ (hands f2cf6a87/fb147dd1, seed 3edaf83d/be5ca735, win 8326d78a/38c74545) with the engine string.

docs/plans/release-rules.md

@@ -18,3 +18,4 @@ Every cut of the Igneum Miner app and its node runs under these. The dated plan
 11. **Kill by pid, never by name,** on the shared Mac; a merge worktree never checks out master.
 12. **The Discord card only when every platform is live.** Live manifest changes beyond the binaries (a moved consensus floor) go out only on the founder's explicit word, staged beside the release with their digest and a one-line diff.
 13. **Ship on green:** no calendar waits; when the gates are green, publish and state the clock time (UK). Checkpoints are for slips, not for waiting.
+15. **The version bump is the release branch's first commit (7 October 2026, after the 0.3.23 miss).** When a release-0.3.N branch opens, its first commit moves the six version places (app/igneum-app/Cargo.toml and Cargo.lock, app/windows/version.h, app/igneum-app/resources/igneum-app.rc's four fields, packaging/mac/app/Info.plist, the installer's AppVersion), never left to the cut: release-0.3.23 opened at 4cdcab31 and carried 0.3.22 in every place until 21:26 BST, so the app exes and the window host crossed from its first closed tip read 0.3.22 and were void. Gate check: on a push to release-0.3.N the pre-push gate (tools/ci/release-version-check.sh, self-test on tonight's shape first) reads all six places against the branch name and goes red on any mismatch; the .rc was the second layer of the same miss (the box cross failed in build.rs at 21:30 BST).

tools/ci/pre-push.sh

@@ -83,6 +83,8 @@ never_push_checks() {
   # the third never-push class (7 October 2026, 20:5x UK): a founder name on ANY branch, because every branch went to the public host's
   # mirror and a branch green-stamped before the check existed carried one onto master through the deferred merge
   run "no founder name, personal login, earlier business or personal address in any tracked text file (the pre-public scrub; self-test first, encoded list)" bash -c 'bash tools/ci/founder-strings-check.sh --self-test && bash tools/ci/founder-strings-check.sh'
+  # rule 15 (7 October 2026): a release branch reads its own version in Cargo.toml, Cargo.lock and version.h from its first commit
+  run "release-version: a release-0.3.N branch reads 0.3.N in Cargo.toml, Cargo.lock and version.h (self-test first)" bash -c 'bash tools/ci/release-version-check.sh --self-test && bash tools/ci/release-version-check.sh'
 }
 
 tree_checks() {

tools/ci/release-version-check.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Rule 15 (7 October 2026, after the 0.3.23 miss): the version bump is a release branch's first commit. release-0.3.23 opened
+# at 4cdcab31 and carried 0.3.22 in Cargo.toml, Cargo.lock and app/windows/version.h until 21:26 BST, so the app exes and the
+# window host crossed from its first closed tip read 0.3.22 and were void. On a push to release-0.3.N this check reads the
+# six version places (Cargo.toml, Cargo.lock, version.h, igneum-app.rc's four fields, Info.plist, the installer's AppVersion) against the branch name and goes red on a mismatch; a branch that is not release-* passes.
+#
+#   tools/ci/release-version-check.sh [<branch>]     # the current branch when omitted; exit 1 with the mismatch named
+#   tools/ci/release-version-check.sh --self-test    # a release-0.3.23 tree reading 0.3.22 fails on every place; a matching tree passes; a feature branch passes
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+check() {   # <branch> <cargo toml> <cargo lock> <version.h> [<igneum-app.rc> <Info.plist> <Igneum-Miner.iss>]  -> prints each mismatch, exit 1 if any
+  local branch="$1" toml="$2" lock="$3" vh="$4" rc="${5:-}" plist="${6:-}" iss="${7:-}" want bad=0
+  case "$branch" in release-*) want="${branch#release-}" ;; *) echo "release-version: $branch is not a release branch; nothing to check"; return 0 ;; esac
+  case "$want" in *.*.*) ;; *) echo "release-version: $branch is not a three-part version (rule 1)"; return 1 ;; esac
+  local got_toml got_lock got_h got_rc
+  got_toml=$(awk -F'"' '/^version = "/{print $2; exit}' "$toml")
+  got_lock=$(awk '/^name = "igneum-app"$/{f=1;next} f&&/^version = /{gsub(/"/,"",$3); print $3; exit}' "$lock")
+  got_h=$(awk -F'"' '/IGNEUM_HOST_VERSION_STR/{print $2; exit}' "$vh")
+  got_rc=$(awk '/IGNEUM_HOST_VERSION_RC/{print $3; exit}' "$vh" | tr -d ' ')
+  [ "$got_toml" = "$want" ] || { echo "release-version: $toml reads $got_toml, the branch is $branch"; bad=1; }
+  [ "$got_lock" = "$want" ] || { echo "release-version: $lock reads $got_lock for igneum-app, the branch is $branch"; bad=1; }
+  [ "$got_h" = "$want" ] || { echo "release-version: $vh IGNEUM_HOST_VERSION_STR reads $got_h, the branch is $branch"; bad=1; }
+  [ "$got_rc" = "$(echo "$want" | tr . ,),0" ] || { echo "release-version: $vh IGNEUM_HOST_VERSION_RC reads $got_rc, want $(echo "$want" | tr . ,),0"; bad=1; }
+  if [ -n "$rc" ]; then
+    local n; n=$(grep -cE "^(FILEVERSION|PRODUCTVERSION) +$(echo "$want" | tr . ,),0\$|VALUE \"(FileVersion|ProductVersion)\", +\"$want\"" "$rc" || true)
+    [ "$n" = 4 ] || { echo "release-version: $rc carries $n of 4 version fields at $want (build.rs refuses the cross otherwise)"; bad=1; }
+    grep -qF "<string>$want</string>" "$plist" || { echo "release-version: $plist does not read $want"; bad=1; }
+    grep -qF "#define AppVersion \"$want\"" "$iss" || { echo "release-version: $iss AppVersion does not read $want"; bad=1; }
+  fi
+  [ $bad = 0 ] && echo "release-version: $branch reads $want in Cargo.toml, Cargo.lock, version.h${rc:+, igneum-app.rc, Info.plist and the installer}"
+  return $bad
+}
+if [ "${1:-}" = "--self-test" ]; then
+  T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+  printf '[package]\nname = "igneum-app"\nversion = "0.3.22"\n' > "$T/Cargo.toml"
+  printf '[[package]]\nname = "igneum-app"\nversion = "0.3.22"\n' > "$T/Cargo.lock"
+  printf '#define IGNEUM_HOST_VERSION_STR "0.3.22"\n#define IGNEUM_HOST_VERSION_RC  0,3,22,0\n' > "$T/version.h"
+  out=$(check release-0.3.23 "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h" 2>&1 || true)
+  [ "$(printf '%s\n' "$out" | grep -cF ' reads 0.3.22')" = 3 ] && printf '%s\n' "$out" | grep -q 'VERSION_RC reads 0,3,22,0' || { echo "self-test: the 0.3.23 miss was not caught on every place"; printf '%s\n' "$out"; exit 1; }
+  sed -i.bak 's/0\.3\.22/0.3.23/g; s/0,3,22,0/0,3,23,0/' "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h"
+  check release-0.3.23 "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h" >/dev/null || { echo "self-test: a matching tree failed"; exit 1; }
+  check driver-check "$T/Cargo.toml" "$T/Cargo.lock" "$T/version.h" >/dev/null || { echo "self-test: a feature branch failed"; exit 1; }
+  echo "self-test passed: the 0.3.23 shape fails on every place, a matching release tree passes, a feature branch passes"; exit 0
+fi
+BRANCH="${1:-$(git rev-parse --abbrev-ref HEAD)}"
+check "$BRANCH" app/igneum-app/Cargo.toml app/igneum-app/Cargo.lock app/windows/version.h app/igneum-app/resources/igneum-app.rc packaging/mac/app/Info.plist packaging/windows/Igneum-Miner.iss