The node lane's lockKind word for a transaction under a recovery lock ("finalised by a recovery lock") reads on the
row as "finalised (recovery lock)" with the why: the surviving majority's lock after a long pause, not a certified
checkpoint, not yet verified here. Known-failed first on build-2 (the word fell through to the label); 22 wallet UI
tests green. Until the node carries the field the pause word stands (wallet-words-20).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
docs/spec/finality-guarantees.md section 9: one vocabulary, included, executed, proven, finalised; the network's pause
is the network's word, never a transaction's. The wallet's History row read the node's "finality not active" word for a
transaction under a locked checkpoint while finality was paused; it reads "finalised" now, with the pause in the why
("under a locked checkpoint, not yet verified here; finality is paused on the network above it"). Known-failed first on
build-2 (view.test.mjs: the row's word and the vocabulary set); 21 wallet UI tests green.
docs/design/app-audit-2026-10-08.md gains section 7: the founder's reversals and additions for v2.0.1 (the Cards tab
back, the first-block card once per address, the four words, one positioning line, the watchdog's waiting words), each
with where it lands (branch cards-201 on release-2.0.1; this branch for the wallet).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
ember.rs: CLOCK_FLOOR_PCT 45 -> 20 (the PC 1 passes of 7 October: the 5090's best MH/W at 1,200 to 1,300 MHz, 39 to 42 percent of 3,090, under the old floor), CLOCK_FINE_STEP_MHZ 100, Plan.clock_fine, Plan::cap_row, Plan::clock_stop_reason ("rate fell 5.2 percent at 1200 MHz", "fingerprint mismatch at 2163 MHz, clocks reset", "the floor at 700 MHz"), the stop rule in Plan::next, LockResult + lock_result (lock_mhz/mhs/w/mhw, unlocked_mhs/w, lock_note; "no lever" without a clock maximum). state.rs: CardState lock_mhz, lock_mhs, lock_w, lock_mhw, unlocked_mhs, unlocked_w, lock_step, lock_steps, lock_at, lock_note. engine.rs: sweep_finish fills them (Baseline: "no lever" on Apple or without a maximum clock), the progress tick fills lock_step/lock_steps while a clock step runs. Tests: the ladder to the floor (2,781 .. 1,390, 1,300 .. 700), the knee at 1 and 1.5 percent on the measured 5090 rows (1,854 and 1,300 as the points), a Faulted clock row ends the search and the note says so, and the Run-level fake helper: a mismatch during 2,163's hold -> the row Faulted, no next step, the final Apply is the chosen 2,472 (the reset), Finished; the existing full-plan test updated to the stop rule. The 18 Ember tests green on box 2.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The sweep (main's item 1): 199 tracked text files, 783 lines. The founder's full name, first name and possessive become "the founder" (sentence starts capitalised); the lowercase operating-system user name in WSL paths and commands becomes <user>; the second owner login becomes "the second owner login"; the three earlier businesses and the two other brands become "the other business", "the earlier entity", "the earlier business" and "another brand"; the Chrome profile rule names the igneum.network profile, not the profile's label. The standing commit login igneum-labs is not a founder term here: the fresh-repository step renames it in the history (docs/plans/history-rewrite.md, tools/repo/fresh-repo.sh).
The patterns never appear in plain text in the tree (a plaintext list would be the hit): tools/ci/founder-strings.b64 (perl regex, tab, a sample per row) is read by tools/ci/founder-strings-check.sh (every tracked text file, perl, known-failed first: the self-test plants each row's sample in a fixture and the hit must name the file), by tools/community/discord-hooks.mjs (the guard's founder and business rows; the test takes its fixtures from the samples) and by tools/repo/fresh-repo.sh (the business names of the rewrite rules). site/forbidden-strings.txt carries the same patterns as b64: lines, decoded case-insensitive by site/scrub.mjs and tools/ci/launch-gates-check.mjs (whose fixture now plants an encoded made-up name). The check runs in the gate's tree checks on every merge.
Not in this commit, by main's word: the 105 commit messages and 40 personal-identity commits that need the history rewrite (listed, not run), and the secrets found by gitleaks over the history (reported with owners).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Main's rule of 6 October 2026 from the 0.3.14 repro (docs/evidence/reproduced/0.3.14.md): prost's protowire.rs embeds OUT_DIR,
libmimalloc-sys embeds __DATE__/__TIME__, sccache hid both. lib.sh bs_repro_env exports SOURCE_DATE_EPOCH=<author time> TZ=UTC in
front of every remote command (build-remote.sh, cross-remote.sh, workers-remote.sh); remote-run.sh exports BR_SDE too and logs it
as source_date_epoch; proto-cuda/windows-node/cross-build.sh exports the same; the PC job carries node.commit_time in the manifest
(push-build-inputs.sh) and exports it before every cargo build of a stage (jobbuild.rs, unit test asserts it; 4 of 4 pass on the
box). Target dirs stay one fixed path per target. tools/build-remote.sh --self-test-repro [--full] from a fork worktree, run on
the box: igneum-miner twice a minute apart without sccache (RUSTC_WRAPPER=/usr/bin/env, an empty value is unset to cargo) MATCH
91e130f5..., a per-run target path differs (OUT_DIR shown); --full: kaspad with libmimalloc-sys recompiled a minute later MATCH
70219bc2..., without the epoch differs (__DATE__ shown).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The audit (docs/plans/wallet-ui-3-audit.md, 24 before-captures), the design (docs/plans/wallet-ui-3.md) and the
build: five sections in the miner's rail (Home, Send, Receive, History, Settings), the balance first with the money
line ("no market price on devnet: coins have no value" until price_gbp_per_ign exists), one node line with Details,
Send confirmed in place with the fee behind Details and the pending row after, Receive with the address box and the
QR, History with the node's ONE state word per row (pending, included, executed, proven, finalised; the wallet's own
verified final wins; failed from the receipt) and a reason line, Settings as plain rows (Security, Backup, This
machine with Appearance, the Igneum Wallet update card, Node with the endpoint, Advanced with the remove ask), no
dialogs, dark and light, a bottom tab bar under 720 px. The Rust engine is untouched: the node words come from the
existing GET /api/tx/<hash>. One Swift line removed so the window follows the Mac's appearance.
view.test.mjs (11) with lock-screen (5) and update-card (4): 20 pass. tools/ui-mock/wallet.mjs and shoot-wallet.mjs
(one niced headless chromium, closed after the batch). Result captures n00 to n24 beside the audit's, and the real
Mac window m00 to m06 from this worktree's engine on a scratch data dir with a throwaway wallet (deleted after).
Site: wallet.html and the wallet section of index.html on the shipped design; wallet-home.webp and wallet-final.webp
from the mock with example addresses.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The node pin moves to 4c6b129d (release-0.3.14-node), which is what the live payload inputs carry, so windows-ci's payload-inputs step is green again (red since e9eca23 on master's 0.3.13 pin against the 0.3.14 inputs).
Conflicts: infra/fast-time/override-60x.json keeps master's side (the fresh-rule field was already there at u64::MAX; the release line would be a duplicate key); tools/ci/playbook-quit-check.sh keeps master's rule 2 and pre-rule list with the release side's Ember allow entry and the 0.3.15 expiry check.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Main's decision of 6 October 2026. CLAUDE.md 'Running agents on this Mac': every Linux and Windows cargo build and every
Linux test suite goes to igneum-build-1 through tools/build-remote.sh and tools/cross-remote.sh; the PCs keep GPU and
Windows-runtime jobs; the Mac keeps macOS binaries, the DMG and Metal tests under the lock. -Wl,--no-insert-timestamp in
cross-remote.sh, proto-cuda/windows-node/cross-build.sh and jobbuild.rs (two box builds byte-identical, verified).
The empty-commit class: tools/ci/commit-string-check.sh (self-test in ci.yml, shown firing on a Mac worktree build and
passing on a box build) runs on every igneumd from the three build scripts; push-build-inputs.sh adds node.commit_full,
the PC job writes a minimal node/.git from it at extract and cleans kaspa-build-info on a new commit (4 jobbuild tests
pass, run on the box); cross-build.sh refuses a worktree and cleans on a new commit. Plan: second worktree's clean build
1 min 18 s with sccache 604 hits of 993.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
On 3f70f83, by hand, the app half of the exec fix (fork exec-sync-0313 1f59c5d0 is the node half):
- app/igneum-app/src/prover.rs: igneum_exportSegments [n-1, n] for a shard and [first-1, last] for a segment,
never from 0 (on a restarted node the records below the restart carry zero roots and the exporter refused every
cut, the fleet 16:02Z); exec_boundary() reads igneum_getExecStatus.restartNumber (or the startedFrom text on a
0.3.13 node) and the prover claims no shard and no segment below it
- proving/igneum-prove/export: seeds the port from the export's preState (the node's account dump after the first
segment), checks its root against the node's there and replays from the next segment; without a dump the
restart-aware replay (execRestart) and the genesis replay stay
- tools/exec-sync/net.mjs (15 checks: the persisted state, the file, the wrong pin, another chain, the unreadable
flag file, the account-dump cut) and tools/exec-sync/reorg.mjs (18 checks: a 300-block reorg from the ring and
from the persisted generation)
- infra/fast-time/override-60x.json: the duplicate proving_v1 block from the 0.3.12 merge removed (the
consensus-core test fast_time_60x_file_is_the_devnet_at_60x failed on it)
The three UI files are untouched (byte-equal to 3f70f83); the igneum-prove-r0 tree is not in this cut.
Green on this tip (6 October 2026): cargo test in app/igneum-app 28 + 8; node --test app/igneum-app/ui 35; the 13
CI checks of ci.yml that run on this Mac; tools/exec-sync/net.mjs 15/15 in 97.2 s against this exporter and the
fork's igneumd (IGNEUM_EXEC_BIN, IGNEUM_EXPORTER).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The audit (docs/plans/miner-ui-3-audit.md, 27 screenshots): no money anywhere, three red n/a per Apple row,
tuning split across two pages, 370 px of controls per card, Prove's 95 words and four zeros, Node's eleven
numbers, the jobs table on every Updates page, fixes two taps away, no light mode, no layout under 900 px,
developer lines on user surfaces.
The design (docs/plans/miner-ui-3.md): four sections (Mine, Earnings, Prove, Settings); the card row carries the
state word with its reason, MH/s, W with MH/W, £ a day at the user's electricity price, °C, Tune, the switch,
and its details under a chevron (cap slider, identities, pin, telemetry, the tune table); the tune line per row
(not tuned yet / tuning: step k of n with a bar / tuned N ago · point · next check <weekday> / measured only and
why / pinned / stopped / fleet pause); Tune all; the goal (Efficiency, Balanced, Maximum) with its £ a day; Power
control as one switch where it is the fix; the node as one line with Details; updates as one card; earnings money
first, IGN second; proving as a tier sentence per card; every costly action confirmed in place (quit, change
address, show key, trust mode), no dialogs; light and dark; a bottom tab bar under 720 px.
The build: index.html, app.css, app.js rewritten on the same engine routes; the pure blocks keep their API and
carry ember-tune's tuneNotice, tuneWord, toggle states and tune-line test (e9738dd) so the merge is clean; the
update card is named Igneum Miner; the Rust side is untouched. node --test on the four UI files: 35 pass.
Screenshots of the result: docs/plans/miner-ui-3/n00 to n26.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
