Plan: the planned 0.3.16 tree is 0.3.17; 0.3.16 is the corrective cut

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans/release-0.3.15.md

@@ -129,13 +129,13 @@ Rule rows: nothing is staged in the live downloads folder (a scratch copy, or pu
 - The prover thread drops its cached tool paths when a stale binary is named (0.3.16).
 - The relaunch helper fixed with a watcher, or `restart --what app` stays retired.
 - Env-only defaults for the eight scripts that name the shared checkout by absolute path.
-- 0.3.16 node tree (ca3-v4-0316): 8e2f5cbe (the unwrap class), 0760b844 (the seven-window signalling rule, gate PASSED four cases), b2e21447 (finality cause fields), eec34ac3 (igneum_getRecentBlocks), 325f8b98 (difficulty rule v3 behind difficulty_v3_activation_daa at u64::MAX, digest unchanged until set). Pre-existing breakage to fix in that cut: `cargo check -p kaspa-testing-integration --tests` fails on the fork (the Header initialiser lacks vote_key_hash; the KaspadPayloadOps match is non-exhaustive on the finality ops), broken since the finality fields landed; the box suite then compiles EVERY test crate (`cargo test --no-run --workspace` or the crate list widened) so a test crate cannot rot silently again.
-- 0.3.16 node tree, proving agent: exec-sync-0313 da2d17ec (on 2e5d3d30) = consensus proof verification in-process (sp1-sdk 6.8.1 linked, 169 crates; three override fields in the digest once set: proving_consensus_verify_daa, proving_shard_program_id 0x2b1a81cb..., proving_aggregator_id 0x474678f3...; p2p payload 78 IgneumRequestProofRecords; a node with other embedded keys exits 3 at start); never by default, a digest move when switched, miners first. App side exec-app-0314 c00e608 (the proving-dir cap, forged.mjs harness 8/8, ledger P21 round 4 and its export-disk row labelled X31, which the site lane already used on master (X31 the testnet date, X32, X33): renumber the proving row X34 at the merge and rerun the ledger-text check). The fork's proof fixture is untracked at igneum/exec/testdata/ (the test skips without it): a build row.
-- Wallet 0.1.5 (Igneum-Wallet-0.1.5.dmg bf37a4ec, node 7961c5f1, wallet-ui-3 ab8dfdc): the gate and the publish straight after "0.3.15 live" (the wallet in the wild bundles a 5 October igneumd at protocol 12, the hub's 172 "level is 0" rejects); not held.
+- 0.3.17 node tree (ca3-v4-0316; the planned tree moved one number: 0.3.16 is the corrective cut of 6 October, the same release as 0.3.15 under a new number): 8e2f5cbe (the unwrap class), 0760b844 (the seven-window signalling rule, gate PASSED four cases), b2e21447 (finality cause fields), eec34ac3 (igneum_getRecentBlocks), 325f8b98 (difficulty rule v3 behind difficulty_v3_activation_daa at u64::MAX, digest unchanged until set). Pre-existing breakage to fix in that cut: `cargo check -p kaspa-testing-integration --tests` fails on the fork (the Header initialiser lacks vote_key_hash; the KaspadPayloadOps match is non-exhaustive on the finality ops), broken since the finality fields landed; the box suite then compiles EVERY test crate (`cargo test --no-run --workspace` or the crate list widened) so a test crate cannot rot silently again.
+- 0.3.17 node tree (was 0.3.16), proving agent: exec-sync-0313 da2d17ec (on 2e5d3d30) = consensus proof verification in-process (sp1-sdk 6.8.1 linked, 169 crates; three override fields in the digest once set: proving_consensus_verify_daa, proving_shard_program_id 0x2b1a81cb..., proving_aggregator_id 0x474678f3...; p2p payload 78 IgneumRequestProofRecords; a node with other embedded keys exits 3 at start); never by default, a digest move when switched, miners first. App side exec-app-0314 c00e608 (the proving-dir cap, forged.mjs harness 8/8, ledger P21 round 4 and its export-disk row labelled X31, which the site lane already used on master (X31 the testnet date, X32, X33): renumber the proving row X34 at the merge and rerun the ledger-text check). The fork's proof fixture is untracked at igneum/exec/testdata/ (the test skips without it): a build row.
+- Wallet 0.1.5 (Igneum-Wallet-0.1.5.dmg daf259f2, node f1ea7a38, wallet-ui-3 ab8dfdc): the gate and the publish straight after "0.3.15 live" (the wallet in the wild bundles a 5 October igneumd at protocol 12, the hub's 172 "level is 0" rejects); not held.
 - A standalone igneum-miner does not recover its template subscription after a node restart (fleet, 20:24Z): ledger row, fix = resubscribe on reconnect (0.3.16, the miner's owner); the fleet's restart script restarts the miner with the node until then.
-- 0.3.16 node tree: the finality lane's LEAVE item (finality-pause-node 766e70ca on the box mirror /srv/igneum-node.git, one commit on 4c6b129d, rebases onto the 0.3.15 node with only params.rs overlapping; docs on origin finality-pause 27f82ec) is a digest move (the devnet digest becomes 63703f5b..., protocol 17) gated by finality_leave_activation_daa (never on devnet until the 95 percent signal); its Devnet 2 gate is tools/finality-attacks/leave.mjs both ways with the new binaries, before it merges.
+- 0.3.17 node tree (was 0.3.16): the finality lane's LEAVE item (finality-pause-node 766e70ca on the box mirror /srv/igneum-node.git, one commit on 4c6b129d, rebases onto the 0.3.15 node with only params.rs overlapping; docs on origin finality-pause 27f82ec) is a digest move (the devnet digest becomes 63703f5b..., protocol 17) gated by finality_leave_activation_daa (never on devnet until the 95 percent signal); its Devnet 2 gate is tools/finality-attacks/leave.mjs both ways with the new binaries, before it merges.
 - With the after-rollout merge: the relay security fixes X23 to X28 (28c028b, on fud-close and the ledger-* branches only; the intake key gets 403 on console writes while master lacks them).
 - DONE 20:3xZ: packaging/ota/publish-manifest.sh refuses an --activation-height at or below the live DAA (the observer's executedTipDaa; IGNEUM_MANIFEST_ALLOW_PAST_HEIGHT=1 for a replay; --self-test-height), the engine half with the Ember agent for 0.3.16.
-- 0.3.16's app merge, as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 e31acab (the UI pinned to the 0.3.16 engine fields); src/live.rs, ui/app.js, the /api/live route and packaging/ota/publish-manifest.sh from ember-tune b726ce4 (pinned to the node lane's ca3-v4-0316 b2e21447 finality-pause fields and eec34ac3 igneum_getRecentBlocks, reading the absent-field path on an older node; the node source in the site's row shape, the finality-paused state, the activation-height guard with --self-test-height; 652f6fc's guard is dropped at that merge), not miner-ui-4's 0.3.15 files; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
+- 0.3.17's app merge (was 0.3.16), as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 e31acab (the UI pinned to the 0.3.16 engine fields); src/live.rs, ui/app.js, the /api/live route and packaging/ota/publish-manifest.sh from ember-tune b726ce4 (pinned to the node lane's ca3-v4-0316 b2e21447 finality-pause fields and eec34ac3 igneum_getRecentBlocks, reading the absent-field path on an older node; the node source in the site's row shape, the finality-paused state, the activation-height guard with --self-test-height; 652f6fc's guard is dropped at that merge), not miner-ui-4's 0.3.15 files; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
 - The publish side owes a way to set the manifest's top-level "urgent": true for an emergency rollout through a finality pause (fd03f35 reads it; igneum-ota-sign passes the document through): a publish-manifest.sh flag.
 - The gate line for every node cut from here (main writes it into CLAUDE.md): a mining new node beside an old node on the live file for ten minutes, the old node's reject count read before and after, and one new node restarted mid-window re-syncing from an old peer.