Plan 0.3.15: owed rows (1065b81 with the merge, the manifest's activation-height guard)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans/release-0.3.15.md

@@ -105,6 +105,8 @@ The fix (node lane): the signal stamp and the signal read gated on publish 2's o
 - The prover thread drops its cached tool paths when a stale binary is named (0.3.16).
 - The relaunch helper fixed with a watcher, or `restart --what app` stays retired.
 - Env-only defaults for the eight scripts that name the shared checkout by absolute path.
+- With the after-rollout merge: the relay security fixes X23 to X28 (28c028b, on fud-close and the ledger-* branches only; the intake key gets 403 on console writes while master lacks them).
+- packaging/ota/publish-manifest.sh refuses an --activation-height at or below the live DAA (the engine's fork_is_close treats any passed height as close and makes the update urgent; the Ember agent fixes the engine half for 0.3.16), with a test on a known-bad height.
 - 0.3.16's app merge, as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 e31acab (the UI pinned to the 0.3.16 engine fields); src/live.rs and the /api/live route from ember-tune b55bc1f (the engine's node source in the site's row shape), not miner-ui-4's 0.3.15 file; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
 - The publish side owes a way to set the manifest's top-level "urgent": true for an emergency rollout through a finality pause (fd03f35 reads it; igneum-ota-sign passes the document through): a publish-manifest.sh flag.
 - The gate line for every node cut from here (main writes it into CLAUDE.md): a mining new node beside an old node on the live file for ten minutes, the old node's reject count read before and after, and one new node restarted mid-window re-syncing from an old peer.