Merge pool-guard-docs 41bce269 into master (gate: green on 63d0d43e, recorded by tools/ci/pre-push.sh; landed on the box mirror)

docs/plans/igneum-2.0-test-harness-map.md

@@ -265,7 +265,7 @@ Rule: a case maps to a cell only where the cell's tests visibly answer it; cover
 - Fixtures: F0, F1
 - Cases:
   - UX-05 Keep voting keys with the miner through pooling: partial: the vote-key commitment on the wire (verify::tests::a_share_under_another_key_is_refused_before_the_hash: known-pass the member's key, known-fail another key on the share and a job naming another key, refused with code vote_key before the hash), the open pool's sidechain::check_key (the claimed key, the header's key and the reveal are one key), the same-nonce-other-template wrong_hash test, the TLS binding test; the malicious-pool run and the leave-and-retain run on the devnet-4 pair are the UX-05 batch's other evidence; review B INT-15 (8 October 2026): server::authorise_tests::a_replayed_proof_of_possession_is_not_an_authorisation (a public PoP replayed into another session, payout, pool or chain, or under another key, refused; only the challenge-bound binding v2 admits on a public network) and the_binding_policy_follows_the_network
-  - UX-04 Pay small operators without hidden custody: partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets)
+  - UX-04 Pay small operators without hidden custody: partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets); the devnet-4 pair's class (8 October 2026 21:24 UK): state_provider::tests::an_unsynced_node_hands_the_pool_no_state_and_no_job (no job on a node whose igneum_getExecStatus reads synced false, blocked or re-executing; known-failed first against the 8ff7a0f4 provider; pool-synced-guard-202 f3e99e9c on release-2.0.2, 986252e7 on pool-2.0, 52 of 52 on build-6)
 
 ### harness:economics-model
 

docs/plans/pool.md

@@ -254,3 +254,7 @@ The second external review (docs/analysis/review-2026-10-08-b) and the full-syst
 Known-failed first: commit 75383929 on pool-review-b carried the tests over the 8 October semantics, and the suite read seven red on build-6 (the three payout tests paid 200 of 100 due or never settled, the frame reader blocked on a newline that never came, the registry kept two members, the queue took 10,000 lines, the nonce set held 100,000 refused nonces); 065148a2 and 4a8dcbc0 turned them green, 51 of 51.
 
 Consequences per tier. A pool member on any card: a payout cannot be paid twice or lost across a pool crash, a lost node answer, a reorg or a stuck transaction; a payment shows `mined` until the chain's own finality covers it, so the row a member reads as final is final. A pool operator: the ledger cannot start empty over a corrupt file, the previous snapshot and its digest are always there to restore from, and one bad member cannot hold the daemon's memory or its verifier (every bound has a flag and a default). The network: a captured `authorize` cannot be replayed to redirect a member's pay or to vote under its key from another session, and the vote key stays the member's in every template (the pin "vote keys stay with the miner", docs/plans/igneum-2.0.md).
+
+### 11a. 21:24 UK, the devnet-4 pair's class: no job on an unsynced node's state
+
+The pair's evidence (the pool seat): identical epoch seed, day, class v5 and era on node, pool and member, the freeze's generator (`igneum-pow fingerprint cbc5bd0a`, read back on every 2.0.x line: `igneum-pow/src` is tree 93c36844, the freeze commit 1c420786's) on all three binaries, and every member share `wrong_hash`, because the node was still in class v5 catch-up and answered `igneum_getPowStateLeaves` from its still-settling state. Closed by construction: `pool/src/state_provider.rs` reads `igneum_getExecStatus` beside the leaves and refuses a stream while the node reads `synced` false, `blocked` or `reexecuting` (a missing field is not synced), so the engine builds no epoch and no job goes out on catch-up leaves; the STATUS line says `node not synced (class v5 catch-up): no jobs` with the exec RPC named while it holds. Known-failed first against the 8ff7a0f4 provider on build-6, then 52 of 52. Shas: f3e99e9c (release-2.0.2), 986252e7 (pool-2.0). Consequence per tier: a pool member is never handed work its pool's node cannot verify; an operator reads the cause, not a reject count.

tools/ci/test-map.json

@@ -455,7 +455,7 @@
       ],
       "coverage": {
         "UX-05": "partial: the vote-key commitment on the wire (verify::tests::a_share_under_another_key_is_refused_before_the_hash: known-pass the member's key, known-fail another key on the share and a job naming another key, refused with code vote_key before the hash), the open pool's sidechain::check_key (the claimed key, the header's key and the reveal are one key), the same-nonce-other-template wrong_hash test, the TLS binding test; the malicious-pool run and the leave-and-retain run on the devnet-4 pair are the UX-05 batch's other evidence; review B INT-15 (8 October 2026): server::authorise_tests::a_replayed_proof_of_possession_is_not_an_authorisation (a public PoP replayed into another session, payout, pool or chain, or under another key, refused; only the challenge-bound binding v2 admits on a public network) and the_binding_policy_follows_the_network",
-        "UX-04": "partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets)"
+        "UX-04": "partial: PPLNS distribution tests (fee first, never overpays, late joiner), the payout key file round trip, the signed transfer decode; the live payout path on the devnet-4 pair is the UX-04 batch's evidence; review B F12 and INT-03/INT-04 (8 October 2026): payout::intent_tests (a restart from the pre-broadcast snapshot, a lost send response, a crash on either side of the broadcast, a stuck transaction replaced under the same intent, a reorged receipt and a finality pause, a failed transaction, a ledger that cannot be written: never a duplicate or a lost obligation, finalised only under the chain's final lock) and state::ledger_tests (an unreadable ledger is refused or restored, never emptied); F13/INT-16: frame, admission and pool::share_tests (the frame bound while reading, the bounded outgoing queue, one membership per session, the nonce and in-flight bounds, the share and connection budgets); the devnet-4 pair's class (8 October 2026 21:24 UK): state_provider::tests::an_unsynced_node_hands_the_pool_no_state_and_no_job (no job on a node whose igneum_getExecStatus reads synced false, blocked or re-executing; known-failed first against the 8ff7a0f4 provider; pool-synced-guard-202 f3e99e9c on release-2.0.2, 986252e7 on pool-2.0, 52 of 52 on build-6)"
       }
     },
     "harness:economics-model": {