release 0.3.14: merge master e1d0b23

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CLAUDE.md

@@ -85,3 +85,19 @@ Josh: "this question and answer should have not needed to be asked ... so that s
 
 ## A job never quits or restarts the installed app it did not start (standing rule, 5 October 2026, 23:05 UTC)
 Ember Tune's PC 1 playbook started a second engine, that engine's own updater saw itself as 0.3.9 and launched the per-user installer, and the installer's stop step POSTed `/api/quit` to the installed app, taking PC 1 off the network from 22:31Z (141 MH/s gone, the 0.3.11 Windows build blocked) with nobody awake to relaunch (corrected 6 October 2026 from the collected log; the playbook's own quit never fired and pointed at its scratch engine; fixed at e600e63: a second engine never runs the updater). Rule: a test engine started by a job runs on its own port and data dir with its own URL file, and a job may quit, pause, resume or restart only an engine it started itself (the URL it created); the installed app is touched only through the signed `restart` and `update-now` job kinds, and a job that needs the installed app's miners out of the way uses the runner's `--stop-miners` (the runner stops them before the script and restarts them on any exit), never `/api/pause` or `/api/resume` from the script, not even with a finally block (ruling 6 October 2026: a script that dies before its finally leaves the box paused unattended). `tools/ci` carries a check (`playbook-quit-check`) that fails a playbook which reads `%LOCALAPPDATA%\igneum\app\app.url` or `~/Library/Application Support/Igneum/app/app.url` and sends quit, pause or resume to it; the reviewer's row C35 is the record.
+
+## Devnet 2 gate and activation rules (standing rule, 6 October 2026, 16:4x UTC)
+
+Josh's ruling after the DAA 198,000 incident (a fixed-height activation crossed while the fleet was still updating: a two-sided chain, a 229-block reorg, execution reset to genesis on every node, proving at zero for an hour): releases stay hourly; what changes is where they land first.
+- Devnet 2 is the rented fleet as its own staging chain (own genesis and network id, refused by live peers at the handshake). Every release, activation and tuning kit crosses Devnet 2 through `tools/fleet/devnet2-gate.sh` (PASS = zero rejected blocks across the activation, no reorg over depth 3, exec roots agreeing on every box, a segment record paid, every node on the new version) before the live devnet or any of Josh's machines sees it. The shipper does not build the live object before the PASS line.
+- No fixed-height activation on the live devnet. A consensus change flips when 95 percent of mining weight over a window signals the new object, with a floor height as the backstop; the class v4 cut is the first to carry it (status file gates P1 and P2).
+- A deep reorg never resets execution; a snapshot a node cannot read fails loudly; the p2p snapshot path refuses a snapshot below the node's tip or the restart; a hands script never pgreps its own command line.
+- Main checks an agent's number against the log or the chain before relaying it to Josh, or labels it unverified.
+
+## A rule row closes only with its check (standing rule, 6 October 2026, 18:4x UK)
+
+Josh, after the pgrep self-match hit twice in one day (the shipper's hands script at lunchtime, the fleet's wave script at 17:1xZ: a `pgrep -f "<pattern>"` whose literal sat in the calling shell's own command line, so the check always passed and no node ever started): "again wasted time". Rules:
+- A bug class found today gets its `tools/ci` check merged on master the same hour, or the rule row stays OPEN and main says so. A rule row without a check is not closed.
+- Box operations (ssh to a rented box, install a payload, start a node, wait for sync, read height, peers and exec tip, start a miner or prover) live in ONE shared, tested library (`tools/fleet/lib/`), exercised against a Devnet 2 box by a test; agents call it and never write their own copy in bash or PowerShell.
+- A watcher or collector verifies the chain-side fact (height, peers, exec tip, paid records), never a reported rate or a process name.
+- `pgrep -f` / `ps | grep` with a literal pattern is banned in scripts; use the bracket form `[i]gneumd` or `pgrep -x` on the binary name (CI check: pgrep-self-match-check).