diff --git a/docs/plans/release-0.3.22.md b/docs/plans/release-0.3.22.md
index 03ef2b509..d59906804 100644
--- a/docs/plans/release-0.3.22.md
+++ b/docs/plans/release-0.3.22.md
@@ -122,3 +122,7 @@ Three commits on 96161037: bd710a36 the sub-version 3 re-pin (byte 7, igneum-pow
 **LG-4 (the founder: "use PC 1 or PC 2 or get another machine"; main's ruling):** on PC 2 tonight after both smokes, a fresh Windows user account created by job (no Igneum state, no card cache), the three timed steps (download and install, sync to the tip, dataset build to the first accepted share) as FIRST-SHARE lines, ten runs with the app uninstalled and the profile wiped between runs, no click anywhere, the rows on /evidence labelled "PC 2, fresh user account, not a fresh image, 7 October 2026", the 9-of-10 under-10-minutes bar read against them; macOS the same way as a fresh user account on the Mac tomorrow; a rented Windows VM only if the account shape fails the bar for a reason an image would change. PC 1 stays the founder's desk.
 
 **0.3.22 Windows take 2 FAIL (21:13 BST) and the skip:** the job's detached helper was ended with the job's process tree before its first sleep ran out (Start-Process stays in the runner's tree; a survivor needs Win32_Process.Create or a scheduled task); nothing was installed, every file still 0.3.21, the payload untouched. Ruling: no take 3; the 0.3.22 Windows entry is skipped (the Mac and HiveOS entries stand); the first install over a running app is 0.3.23's installer with install-close-23 in the simplest job shape (Start-Process -Wait; the installer's own stop step and the install-running flag do the work), its smoke read the gate line for both; the Discord card publishes on the 0.3.23 Windows entry. **The version miss, second layer (21:30 BST):** the box cross of 0.3.23's exes failed in build.rs because igneum-app.rc still read 0.3.22 (Info.plist and the installer's AppVersion too); fixed at release-0.3.23 = 7c7489ac, the rule 15 check extended to six places and green on the tree; the 0.3.23 node pairs under /srv/artefacts/0323-2720d8d2/ (hands f2cf6a87/fb147dd1, seed 3edaf83d/be5ca735, win 8326d78a/38c74545) with the engine string.
+
+## 12. The 2720d8d2 split and the one-minute form (21:1x to 21:4x BST)
+
+The 0.3.23 node's heights move Devnet 3's digest to ba75bf6f, and the one-box-at-a-time sweep to it split the network: dn3-g1 flipped at 21:18 BST and sat alone twenty minutes on its own fork (blocks 12,553 to 12,793, peers 0; the 83eb50cd nodes refuse ba75bf6f at the handshake; build-1's seed logged 27 digest-mismatch rejects by 21:37); the fleet stopped the pass at 21:31 after that one box (the Vast ssh proxies ssh1, 3, 4, 5, 6 refused the next five, so nothing else flipped) and reverted dn3-g1 to 34a2dbaa on its kept datadir, where it reorgs onto the network's heavier chain; no record or share of the network's sat on the solo blocks; the pool pair, the provers and the second nodes stayed on 83eb50cd. The shipper's part of the fault: the 0.3.23 Mac entry (both folders, 21:39:09 BST, DMG 4ada2807 on 7c7489ac) and the 0.3.23 HiveOS alias (0d716ed9, 21:37) were published ahead of the fleet's move, against rule 5's own word; both pulled back to 0.3.22 (live again at 21:41:08 and 21:44:48 BST; the Mac still runs 0.3.22; the 0.3.23 hive package held in scratch r0323/held-public). The move to 2720d8d2 is the 0.3.20 form (rule 5 extended): binaries pre-placed on every Devnet 3 node (the fleet's thirty, build-1's three, the pool pair's two), every node restarted inside one minute at a clock the fleet names ten minutes ahead once the proxies answer, the digest read back per node, the first lock on the new side as the line; the 0.3.23 Mac entry, the hive alias and the Windows entry publish at that minute or after. Pool split: the hour's 13,209 + 7,200 = 20,409 lands before the 0.3.24 publish minute, so the split goes into the 0.3.24 object at or after the v5 floor on IGNH/IGNW (pending main); the node lane holds it out of the v5 object commit. PC 1: the 5090 floor grid exited 0 at 21:41 BST but the Power Helper hung at its 1,000 MHz step and the 5090 mines at the 1,100 MHz lock until the hash lane's unelevated restore job runs; the grid gets the fix (stop at the first helper timeout, restart the task before the reset).
diff --git a/docs/plans/release-rules.md b/docs/plans/release-rules.md
index ecddb7a3a..3a4b8f5ab 100644
--- a/docs/plans/release-rules.md
+++ b/docs/plans/release-rules.md
@@ -9,7 +9,7 @@ Every cut of the Igneum Miner app and its node runs under these. The dated plan
 4c. **The proving ids gate (main, 7 October 2026, after the 0.3.20 blocker).** On every candidate, a node started on the LIVE override file reports both proving ids (the shard program id and the aggregator id) on its proving v1 start line, and a prover's first statement against it is accepted; a zero-id statement is the known-failed shape. It runs beside the kept-datadir read, since both share the warm pod. Why: c4459193 read the ids as unknown, built statements with zeros and refused every proof; a sweep would have stopped every prover's pay.
 4a. **Every gate starts on every candidate the moment its binary builds, never after the pin (the founder, 7 October 2026).** The digest and mixed-version gates, the kept-datadir start, the relay and poison cases and the wipe canary all begin on each candidate binary as it lands; a struck candidate's runs are stopped and its successor's begin. The post-pin wait is then the longest single form (about 80 minutes, the wipe), not the sum.
 4b. **Warm pods per gate class (the founder, 7 October 2026, ordered to the fleet lane).** The fleet keeps synced pods warm for each gate class so a case form's target starts at the tip (a kept copy of the live line, caught up), never from a kept copy far behind it; the wipe canary is the only full IBD in the set.
-5. **Rollout in waves, each box read back (the founder, 7 October 2026, replacing one-box-at-a-time):** PC 1 first, then PC 2, the Mac, the seed, the hands and the fleet in parallel waves as the lock lines allow; a lock line from the hub between waves; hold if the frozen table's signed share reads under 75; every box read back by its commit string. When the publish moves the consensus floor (a new digest), every 0.3.x node on the old file refuses the new ones as peers until it is swept, so the seed, the hands and the fleet move in the first wave with the apps' pollers, not last. Every lock line of a sweep that replaces nodes carrying a consensus floor names the date the sweep must finish (0.3.20: before 13 October 2026 09:00 UK). The wave list is written, not remembered: every sweep's first wave names each Hetzner seed by address (188.245.5.161:26611 for the shared devnet; the testnet seeds when they move) beside the hands and the fleet, and the seed's row closes only on its own read-back line (string, digest, first accepted block) from the lane that holds its key (the build-server lane, infra/devnet/restart-seed.sh). Added 7 October 2026 after the 0.3.20 sweep left the seed on the old object for one hour forty, found by the 0.3.21 wipe canary's reject lines.
+5. **Rollout in waves, each box read back (the founder, 7 October 2026, replacing one-box-at-a-time):** PC 1 first, then PC 2, the Mac, the seed, the hands and the fleet in parallel waves as the lock lines allow; a lock line from the hub between waves; hold if the frozen table's signed share reads under 75; every box read back by its commit string. When the publish moves the consensus floor (a new digest), every 0.3.x node on the old file refuses the new ones as peers until it is swept, so the seed, the hands and the fleet move in the first wave with the apps' pollers, not last. Every lock line of a sweep that replaces nodes carrying a consensus floor names the date the sweep must finish (0.3.20: before 13 October 2026 09:00 UK). The wave list is written, not remembered: every sweep's first wave names each Hetzner seed by address (188.245.5.161:26611 for the shared devnet; the testnet seeds when they move) beside the hands and the fleet, and the seed's row closes only on its own read-back line (string, digest, first accepted block) from the lane that holds its key (the build-server lane, infra/devnet/restart-seed.sh). Added 7 October 2026 after the 0.3.20 sweep left the seed on the old object for one hour forty, found by the 0.3.21 wipe canary's reject lines. **Digest-moving node releases (7 October 2026, after the 2720d8d2 split):** when the node commit moves the consensus params digest (a height, a floor, a new switch field), a one-box-at-a-time sweep is a network split (dn3-g1 sat alone twenty minutes on its own fork at 21:18 BST), so the move is the 0.3.20 floor-move form: the binaries pre-placed on every node of the network (the fleet's, the hands, the seeds, the pool pair, every second node), every node restarted inside one minute at a clock named ten minutes ahead, the digest read back per node after, the first lock on the new side as the line; the apps' entries (manifest, HiveOS alias) publish at that minute or after, never before, so no app sits alone on the new digest. The one-box form is for digest-preserving releases only (34a2dbaa tonight). The release note names which form a release takes before its first box moves.
 6. **Read-back is by commit string plus digest plus engine:** on 0.3.18+ nodes igneum_getNodeInfo powEngine must read "igneum-pow" ("stub" = FAIL); on earlier trees `strings igneumd | grep -c igneum-pow/src/` above zero. The miner embeds no commit string; its pairing is the build line and the sha.
 7. **igneum-pow pairing:** a fork build takes igneum-pow by path from the igneum worktree it sits in; build each node tree inside its own app worktree whose igneum-pow is the pinned tree; the pairing log line names it. Master's build tools need rust-toolchain.toml in the tree (the app tree's pin applies to a vendor worktree under it; a standalone node checkout is unpinned until the node line carries its own file). Extended 7 October 2026 (the Devnet 3 pool pair, three WRONG HASH rounds each a tree a step behind the chain): the rule binds every crate that embeds kaspa-pow, the node, the pool daemon (igneum-pool) and the app's CPU re-check alike, each built against the pinned igneum-pow by path from the release worktree (017e7037 on 0.3.22 and 0.3.23), and the packs pin travels with the generator (the proto-cuda packs are the pin's export, never an older one); the read-back is the paired miner's "class v4 program id <16 hex>" line equal to the node's per epoch, and the daemon accepting its shares.
 8. **glibc classes:** HiveOS 2.31 (`--ship hive`, smoke in ubuntu:20.04 on the box), seeds and generic 2.35 (`--ship seed`), fleet 24.04 boxes native 2.39.