diff --git a/docs/plans/release-0.3.15.md b/docs/plans/release-0.3.15.md
index ed91b5dfd..1a4509486 100644
--- a/docs/plans/release-0.3.15.md
+++ b/docs/plans/release-0.3.15.md
@@ -117,7 +117,7 @@ Rule rows: nothing is staged in the live downloads folder (a scratch copy, or pu
 
 ## 6g. 0.3.16, the corrective cut (21:55Z to 22:13Z): every machine on f1ea7a38
 
-The same tree under a new number (8bf922d; node pin unchanged at f1ea7a38), because the Mac and PC 1 held earlier 0.3.15 builds and the updater compares version strings only. DMG Igneum-Miner-0.3.16.dmg 0a542bad002c252bc7a80c5810781e9ec8ea31173ce2bd597a9e29892c50b6c3 (41,936,050); windows.yml run 37537291393 (18 of 18, 22:03:42Z): Igneum-Miner-Setup-0.3.16.exe a1eaa1dfaa0cd428378fd1ab86245e146c180070861dc4643d62773a92239a0c (62,671,852), igneum-windows-app.zip b47939c1... (90,520,492), the payload's igneumd.exe carrying f1ea7a38 (read before the push). Manifest 0.3.16 with both rows written and deployed in one step at 22:04Z. update-now 22:08Z. Read-back: the Mac applied 22:12:27Z ("0.3.16 is running", installed igneumd carries f1ea7a38, api/state 0.3.16 current, miner paused); PC 1 "updated to 0.3.16 from 0.3.15" 22:12:33Z, node 2.1.0-f1ea7a38; PC 2 the same at 22:11:24Z, 95.2 MH/s. Hands, seed and the fleet's 14 boxes as in 6e; the hub's last 1,000 blocks at 22:10Z hold blocks by 11 of 14 standing keys (the other three in IBD or in the confirmation). HiveOS stays named 0.3.15 (the same bytes). The jobs-only deploy guard fired once on its first use (the index's "updated" timestamp alone): row, the guard ignores that field.
+The same tree under a new number (8bf922d; node pin unchanged at f1ea7a38), because the Mac and PC 1 held earlier 0.3.15 builds and the updater compares version strings only. DMG Igneum-Miner-0.3.16.dmg 0a542bad002c252bc7a80c5810781e9ec8ea31173ce2bd597a9e29892c50b6c3 (41,936,050); windows.yml run 37537291393 (18 of 18, 22:03:42Z): Igneum-Miner-Setup-0.3.16.exe a1eaa1dfaa0cd428378fd1ab86245e146c180070861dc4643d62773a92239a0c (62,671,852), igneum-windows-app.zip b47939c1... (90,520,492), the payload's igneumd.exe carrying f1ea7a38 (read before the push). Manifest 0.3.16 with both rows written and deployed in one step at 22:04Z. update-now 22:08Z. Read-back: the Mac applied 22:12:27Z ("0.3.16 is running", installed igneumd carries f1ea7a38, api/state 0.3.16 current, miner paused); PC 1 "updated to 0.3.16 from 0.3.15" 22:12:33Z, node 2.1.0-f1ea7a38; PC 2 the same at 22:11:24Z, 95.2 MH/s. Hands, seed and the fleet's 14 boxes as in 6e; the hub's last 1,000 blocks at 22:10Z hold blocks by 11 of 14 standing keys (the other three in IBD or in the confirmation). HiveOS renamed igneum-hive-0.3.16.tar.gz (the same bytes, b710ac59) at 22:17Z. The jobs-only deploy guard fired once on its first use (the index's "updated" stamp alone) and now ignores that field. The Discord release card for 0.3.16 posted 22:18Z (message 1557154778415505432).
 
 0.3.17 is the planned tree (the lanes renumbered: node ca3-v4-0316 plus the proving lane's exec-sync-0313 tip past da2d17ec with the override's proving ids as the statement's ids when set, Ember 8f581de, miner-ui-4 past e31acab, proving 38b65e7 / fc08246 with X34, the finality LEAVE item, relay 28c028b, the testing-integration crate fixed). Devnet 2 nodes on 4c6b129d need IGNEUM_PROOF_PROGRAM_IDS=0x2b1a81cb...,0x474678f3... in their environment until then (the fleet has the line).
 
@@ -139,7 +139,7 @@ The same tree under a new number (8bf922d; node pin unchanged at f1ea7a38), beca
 - 0.3.17 node tree (was 0.3.16), proving agent: exec-sync-0313 da2d17ec (on 2e5d3d30) = consensus proof verification in-process (sp1-sdk 6.8.1 linked, 169 crates; three override fields in the digest once set: proving_consensus_verify_daa, proving_shard_program_id 0x2b1a81cb..., proving_aggregator_id 0x474678f3...; p2p payload 78 IgneumRequestProofRecords; a node with other embedded keys exits 3 at start); never by default, a digest move when switched, miners first. App side exec-app-0314 c00e608 (the proving-dir cap, forged.mjs harness 8/8, ledger P21 round 4 and its export-disk row labelled X31, which the site lane already used on master (X31 the testnet date, X32, X33): renumber the proving row X34 at the merge and rerun the ledger-text check). The fork's proof fixture is untracked at igneum/exec/testdata/ (the test skips without it): a build row.
 - Wallet 0.1.5 (Igneum-Wallet-0.1.5.dmg daf259f2, node f1ea7a38, wallet-ui-3 ab8dfdc): the gate and the publish straight after "0.3.15 live" (the wallet in the wild bundles a 5 October igneumd at protocol 12, the hub's 172 "level is 0" rejects); not held.
 - A standalone igneum-miner does not recover its template subscription after a node restart (fleet, 20:24Z): ledger row, fix = resubscribe on reconnect (0.3.16, the miner's owner); the fleet's restart script restarts the miner with the node until then.
-- 0.3.17 node tree (was 0.3.16): the finality lane's LEAVE item (finality-pause-node 766e70ca on the box mirror /srv/igneum-node.git, one commit on 4c6b129d, rebases onto the 0.3.15 node with only params.rs overlapping; docs on origin finality-pause 27f82ec) is a digest move (the devnet digest becomes 63703f5b..., protocol 17) gated by finality_leave_activation_daa (never on devnet until the 95 percent signal); its Devnet 2 gate is tools/finality-attacks/leave.mjs both ways with the new binaries, before it merges.
+- 0.3.17 node tree (the finality lane's branch notes still say 0.3.16; the lane is closed, the number here is the one that counts): the finality lane's LEAVE item (finality-pause-node 766e70ca on the box mirror /srv/igneum-node.git, one commit on 4c6b129d, rebases onto the 0.3.15 node with only params.rs overlapping; docs on origin finality-pause 27f82ec) is a digest move (the devnet digest becomes 63703f5b..., protocol 17) gated by finality_leave_activation_daa (never on devnet until the 95 percent signal); its Devnet 2 gate is tools/finality-attacks/leave.mjs both ways with the new binaries, before it merges.
 - With the after-rollout merge: the relay security fixes X23 to X28 (28c028b, on fud-close and the ledger-* branches only; the intake key gets 403 on console writes while master lacks them).
 - DONE 20:3xZ: packaging/ota/publish-manifest.sh refuses an --activation-height at or below the live DAA (the observer's executedTipDaa; IGNEUM_MANIFEST_ALLOW_PAST_HEIGHT=1 for a replay; --self-test-height), the engine half with the Ember agent for 0.3.16.
 - 0.3.17's app merge (was 0.3.16), as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 e31acab (the UI pinned to the 0.3.16 engine fields); src/live.rs, ui/app.js, the /api/live route and packaging/ota/publish-manifest.sh from ember-tune b726ce4 (pinned to the node lane's ca3-v4-0316 b2e21447 finality-pause fields and eec34ac3 igneum_getRecentBlocks, reading the absent-field path on an older node; the node source in the site's row shape, the finality-paused state, the activation-height guard with --self-test-height; 652f6fc's guard is dropped at that merge), not miner-ui-4's 0.3.15 files; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
diff --git a/packaging/ota/publish-jobs.sh b/packaging/ota/publish-jobs.sh
index fb5248f12..82f1f126d 100755
--- a/packaging/ota/publish-jobs.sh
+++ b/packaging/ota/publish-jobs.sh
@@ -423,7 +423,9 @@ jobs_only_check() {
     if [ -z "$live_size" ]; then echo "  not live yet: $rel (a new file; the release step deploys it)" >&2; bad=1; continue; fi
     if [ "$live_size" != "$local_size" ]; then echo "  differs from the live copy: $rel (local $local_size B, live $live_size B)" >&2; bad=1; continue; fi
     case "$n" in *.json|*.sig|*.sha256) # small: compare the bytes
-      local_sha="$(shasum -a 256 "$f" | cut -c1-64)"; live_sha="$(curl -s -m 15 -H 'Cache-Control: no-cache' "$base$rel?x=$RANDOM" | shasum -a 256 | cut -c1-64)"
+      # the downloads index carries an "updated" stamp rewritten after every alias pass; the stamp is not a change
+      norm() { if [ "$n" = igneum-downloads.json ]; then sed -E 's/"updated": *"[^"]*"/"updated": ""/'; else cat; fi; }
+      local_sha="$(norm < "$f" | shasum -a 256 | cut -c1-64)"; live_sha="$(curl -s -m 15 -H 'Cache-Control: no-cache' "$base$rel?x=$RANDOM" | norm | shasum -a 256 | cut -c1-64)"
       [ "$local_sha" = "$live_sha" ] || { echo "  differs from the live copy: $rel (content)" >&2; bad=1; } ;;
     esac
   done