igneum/docs/plans/release-0.3.15.md

# Igneum Miner 0.3.15: class v4 signalling, generator-4 workers, miner-ui-4

Cut 6 October 2026, staged by the release engineer under the coordinator; the live cut waits for the Devnet 2 gate's PASS and the project lead's go. Worktree `igneum-wt-ship0315` (branch `release-0.3.15`), node `release-0.3.15-node` 713ef876 in `vendor/igneum-node-0315`.

## 1. Why

- The class v4 program (`mx8+sh256x27`, Counter ASIC 3.0) can now be signalled: the node reads `program_class_v4_activation_daa` and `program_class_v4_signal_window_daa`, flips the class at the first epoch whose 86,400-DAA window has 95 percent of blue blocks signalling, or at the floor. Both fields enter the consensus digest only once set, so this binary peers with 0.3.14 on today's file.
- Every GPU worker is the generator-4 one, built from this tree: a worker from 0.3.14 refuses a generator-4 pack and stops dead at the flip (the rehearsal of 6 October showed it on 52 boxes).
- The miner app's new Overview and Cards (miner-ui-4): the big-number hero, the chain scene, Ember Tune woven into every card row, the chain's own words with one grey explanation each.
- Ember Tune tunes through the Power Helper: the helper acts only on commands after its start, heartbeats before any command, acknowledges by its own log line.
- The Windows payload carries the Linux prover pair for WSL2 and refuses to build without it; every PC had run a stale host and exporter since 0.3.5.
- An update never installs while a remote job is active, urgent or not; an asked install is spent by the check it asked for (PC 1, 17:52:54Z).
- The exec layer names a stale exporter by path; the node says at start when the verifier host is older than proving v1 (`igneum_getProvingStatus.verifierStale`); a tip-0 snapshot pair is never resumed from, and a blocked follower asks a peer for its state within five minutes.
- The devnet hand nodes run under launchd; the app's default devnet peers include the build box's hand nodes.

## 2. The order (two publishes, the worker rule)

1. **Publish 1** (binaries, the live THIRTEEN-field object unchanged, digest b18ed271): the fleet's miners by script, PC 1, PC 2 and the Mac by `update-now`, the hands and the seed last. No window: a 0.3.15 node on the thirteen-field file peers with 0.3.14 (measured: same digest).
2. **Publish 2** (the SIXTEEN-field object: the thirteen plus `exec_restart_state_root`, `program_class_v4_activation_daa` = the floor at publish DAA + 14,400 rounded up to the epoch (at least 10,800 ahead), `program_class_v4_signal_window_daa` = 86,400): only when every NODE reports 0.3.15 AND every WORKER is the 0.3.15 one. A 0.3.14 node exits at parse on this file ("unknown field program_class_v4_activation_daa"); a 0.3.14 worker stops at the flip. Miners first, the hands and the seed last. The digest moves once, read from the 0.3.15 node on the exact file at the publish (2c1162e2 at floor 226,800; 1dddfa55 at 219,600; another floor moves it).
3. The hands move from the Mac to igneum-build-1 on the "0.3.15 live" line (the build-server agent's move-hand.sh, observer first, one hand down at a time).

## 3. Digests (0.3.15 Mac binary, no suffix, no peers)

| Object | Digest |
|---|---|
| the live thirteen-field file | b18ed271f75dd46406d230f4156c37472127415a4c32c558bac662f6f840e61c (equal to 0.3.14) |
| fourteen fields (the exec pin 0xed27bb2d...) | 23e7693634a9b8b3c0643f16c8a01e4cf057985c7e0e0e044f70bc919a3c0fef |
| sixteen fields, floor 219,600, window 86,400 | 1dddfa5574d5536109a5ae68dc415b55e954bd11208608440845e19670505871 (the node lane's pinned test value) |
| sixteen fields, floor 226,800 (DAA 209,458 at 19:47Z) | 2c1162e2ccf34531bf3af131d21c36e857e3e99e265969e4b094bd7421a1d74e |
| the 0.3.14 binary on the sixteen-field file | refused at parse, exits |

## 4. Builds

| Piece | Where | Commit | sha256 | Size |
|---|---|---|---|---|
| Linux igneumd (fleet, seed) | igneum-build-1, glibc 2.39 | 713ef876 | 06211d55b8cce1c19b31b218f5b61f42389a5ceaf68e0d27781b2e10e33b3f2a | 49,719,776 |
| Linux igneumd (HiveOS, glibc 2.36) | Mac zigbuild | 713ef876 | 1e51bfb6401e2d86022eeaddf03750a72d6eb200fa879b7c58fb5c3afbf38a50 | 48,434,344 |
| Linux igneum-miner (HiveOS) | Mac zigbuild | 713ef876 | c5b489105d933b01e4dceff8dc31e2db8e9aa53de06dddafc6eb12ee85b8f7a6 | 9,998,576 |
| Windows igneumd.exe | igneum-build-1 cross | 713ef876 | d08be1a72082880e91dceb0f34e4337663c9494ccc62eb108d7c3a274801e928 | 51,846,656 |
| Windows igneum-miner.exe | igneum-build-1 cross | 713ef876 | e251bd2b3146830ae8c22627b6b37eba3428d1ba64fbcbd938aa0a36c7916fe3 | 11,129,344 |
| Mac igneumd | Mac | 713ef876 | 7f0948d95996eb00f8f574dcaabc25b3ad8a407e08eac3b85055fd15abd0139f | 41,819,824 |
| igneum-worker-cuda.exe (generator 4) | Mac mingw | 563485b tree | 14b6637e1d1c9e83311f2cf4e8ca76fb5ff8e42336b5e09b2b89165da55ea00e | 1,537,024 |
| igneum-worker-opencl.exe (generator 4) | Mac mingw | 563485b tree | 0cbb65f0cadaa560037175d81d829ad7d50fcbdcf8a510d382681468f32f7ce8 | 479,232 |
| igneum-gpu-telemetry.exe | Mac mingw | 563485b tree | f7d924a7ba9ccd6f66fd7eee99f04835f52903456c4789f2c599e88fb02e2d37 | 387,584 |
| hive igneum-worker-cuda (generator 4) | Mac zig | 563485b tree | 97e036e23f4ace669b68b85980701ffe4e32017cdfbf28603bf992802a8b9828 | 6,756,480 |
| hive igneum-worker-opencl (generator 4) | Mac zig | 563485b tree | ef9fbd03e7ce14d1b2b9b85964397b244dc153edee0607d71f26dbc640a4c5e6 | 307,328 |
| igneum-prove-host (Linux, cuda, WSL2) | igneum-build-1 | master e1b5bc9 | 71bc2438856bb141f6cad3d18489f708568144fad5a06a002fbadefb9ce256f9 | 73,161,528 |
| igneum-prove-export (Linux, WSL2) | igneum-build-1 | master e1b5bc9 | 263bf4cef70af4a13a45b2e79b8dbab373282ea4c571f624d02ddb5791935361 | 3,609,360 |
| Igneum-Miner-0.3.15.dmg (miner-ui-4 872f1c9) | Mac | af36aaa | 90bdf8c8de965961e6b365ee8664bce3efe7873f45f7bc27793b692804fe42f5 | 41,961,932 |
| igneum-hive-0.3.15.tar.gz | Mac | | 1715e58ea1d4a1ed1b733881de51b8754ca975f0359b3b29ecb49061d02124c7 | 24,713,232 |

Rebuilt on the node lane's version-gate commit 17c60367 (the signal stamp and read gated on publish 2's object), 20:0xZ: Linux igneumd 0f1c0ddec8e81256... 49,720,288, igneum-miner ebc392fc4be5f873... 9,979,224 (box); Windows igneumd.exe f764d2080b9b12bde6163abf0252fb8cf195d72fbb0e77e180eb6ee8f5d91a35 51,854,336, igneum-miner.exe 4cf260160722787df29e569dcb66f3743f4c493a7a97dab530e0db990bd5599e 11,129,344 (cross); Mac igneumd 7966152f027c65a66f2573f7e05e78c781be44bd8c52884d7ed9af6d4e2c9d22 41,819,904. Digests unchanged (b18ed271 / 23e76936 / 1dddfa55 at 219,600). Suite: kaspa-consensus 97 + the recorded flake alone, igneum-exec 20, igneum-miner 18, kaspa-pow 15, p2p-flows 33. Superseded by the combined commit (version gate + the sync-panic fix) when it lands; the DMG, the hive package and the inputs rebuild on that one.

**Final node 7961c5f1** (17c60367 the version gate + 7961c5f1 the pruned-node sync fix), built 20:10Z to 20:15Z with master's reproducibility exports: Linux igneumd 6615571ced35f694fa016e9b36439b29d83cd6e7c1df49fc11a9d4bd0236cba6 49,719,840, igneum-miner 3976c1b270761218298105dd256123381894c6ec7b380a43c4a702e486fe7bf4 9,979,992 (box); Windows igneumd.exe 30b14d174eb5615989e2117425c59a8e59d64e89a7298cab2b3fda15c778534e 51,894,272, igneum-miner.exe 16e9991f27e67995b416e0860f732f354f4d8b2982f46a8268bf91512778aaa1 11,130,368 (cross); Mac igneumd c0a29bcadd782c65770c1d3942a85629158b4178605c2ae3c68ca33e39cd18e2 41,803,088, igneum-miner 414720ed...; HiveOS igneum-hive-0.3.15.tar.gz 79aa96fb12d34948d568af6a2785ee6fff090f216e8df318cfc328d71181e886 (glibc 2.36 node from this commit); Igneum-Miner-0.3.15.dmg ab925203c4e0615f4de9c75f284590366f942ed848505e4338524ad48a315436 41,940,411 (miner-ui-4 872f1c9); Igneum-Wallet-0.1.5.dmg bf37a4ec1b682de86032b24ed2f271149e794177e80880f74dffed54d9a8da71 20,132,824. Digests b18ed271 / 23e76936 / 1dddfa55 at 219,600. Suite: kaspa-consensus 99 pass 0 fail, consensus-core 111, igneum-exec 20, igneum-miner 18, kaspa-pow 15, p2p-flows 33. Inputs pushed 20:13:40Z (node_source_commit 7961c5f1); windows.yml run 37525228879 on c25a3ca (after the Windows-path rename).

**Final node f1ea7a38** (the five fix commits: 791ff22c, 713ef876, 17c60367, 7961c5f1, f1ea7a38 = the header-version rule on the receive side gated like the stamp), rebuilt 20:42Z to 20:46Z: Linux igneumd 7f0bde70cf2e72a3a9479ba6421f2b37162c3dd4391bf413717c99e6f168668d 49,711,008, igneum-miner 3976c1b2... (box); Mac igneumd and igneum-miner in the log; Igneum-Miner-0.3.15.dmg 041099c2a77f3f7ff145c9a88afc0160e6f5e2951bda0ae46882fbc0259370f5 41,936,114; igneum-hive-0.3.15.tar.gz b710ac596c31d811...; Igneum-Wallet-0.1.5.dmg daf259f272934f0c1a8155ef68762c344164ae8a77c8d0621d0fceed0fb163fa 20,122,390. Digests unchanged (b18ed271 / 23e76936 / 1dddfa55 at 219,600). Node lane's box line: kaspa-consensus 99/0, consensus-core 111 + 7. The compat gate with a POISONED peer (node-compat.mjs --poisoned, 20:42:55 to 20:45:42Z): PASS, the new node refused the poisoned blocks 12 times with 0.3.14's exact line and relayed nothing, the old hub's chain holds no 1026 block, 180/180/180/180/180 on every clean node, the new node mined 72 accepted blocks. Windows cross on f1ea7a38: igneumd.exe 181e10fd4b1ad0c259122d45abac018082a054c3836431f6802f0532a8ee1a43 51,894,272 (carries f1ea7a38), igneum-miner.exe 16e9991f... unchanged; inputs pushed 20:59:15Z; windows.yml run 37530680431 on 24132fb. Two earlier dispatches (37529276665, 37529597068) were cancelled: master's tools/cross-remote.sh had its defaults line swallowed by a trailing comment since the slots merge, so a default cross-build died under bash 3.2 ("CARGO_ARGS: unbound variable", then "OUT") and the chain silently kept 7961c5f1's exes while the inputs said f1ea7a38 (fixed on master 36e4ee7 with tools/ci/defaults-line-check.sh; merged here). Rule for me: an artefact's commit string is read before it is pushed anywhere (the inputs step now prints it; the installer check too). The Mac igneumd on f1ea7a38: 85ac04df27b342f5cd225762a940400bb6142401f33b41fc7ea8ea462508ded1 41,819,648. Suite on the box on f1ea7a38: kaspa-consensus 99/0, consensus-core 111 + 7, igneum-exec 20, igneum-miner 18, kaspa-pow 15, p2p-flows 33.

**Final Windows on f1ea7a38** (windows.yml run 37530680431 on 24132fb, 18 of 18 steps, 21:07Z): Igneum-Miner-Setup-0.3.15.exe 99ec575ccbeef2e0fd1ff5c4ce1646905cb5e88efe31f71eb3058337641b3ec7 62,652,179; igneum-windows-app.zip a379bc446d55b8d659d72e7fd403749cb9d6d751dd9a39a8be2672cbfd1c7ecd 90,511,038 (its igneumd.exe 181e10fd carries f1ea7a38; wsl2/bin/SHA256SUMS names the prover pair 71bc2438 / 263bf4ce). Final manifest 0.3.15: mac 041099c2 + windows 99ec575c, the thirteen-field object, signed and verified locally; the site index Mac/Windows/HiveOS at 0.3.15 (hive b710ac59). Deploy on the retry's PASS.

Earlier Windows (windows.yml run 37525228879 on c25a3ca, 18 of 18 steps, 20:24:00Z; superseded): Igneum-Miner-Setup-0.3.15.exe 9db842fce524b2a45978f0de6060923ed67144204131724d517b9e1a063695c9 62,663,008; igneum-windows-app.zip 65d463c305d23128896e33c10cca9c6dc6ccac12ba829ed1890d3d4a2acd9240 90,518,322 (the Linux prover pair inside: wsl2/bin/igneum-prove-host 73,161,528 with SHA256SUMS). Manifest 0.3.15: mac ab925203 + windows 9db842fc, the thirteen-field object, signed and verified locally (the deploy on main's line).

Installer, zip and manifest rows above (`tools/ship-app.mjs 0.3.15 ... --until manifest`).

## 5. Gate

| Line | Result |
|---|---|
| node suite on igneum-build-1 (713ef876, six crates, --no-fail-fast) | kaspa-consensus 97 + the recorded flake `ban_is_decided...` 1/1 alone, consensus-core 111 + 7, igneum-exec 20, kaspa-pow 15, igneum-miner 18, p2p-flows 33 |
| app crate tests (release-0.3.15) | 162 + 28 + 8; UI 37 |
| worker smoke, Mac (Metal, serve mode, epoch-2 v4 pack 24304f0788ea9408) | 1,024 of 1,024, sha256 7bf77506... equal to igneum-pow's derivation (19:16Z) |
| worker smoke, Linux (the hive package's igneum-worker-cuda 97e036e2 on the fleet's p1-4090, RTX 4090) | 1,024 of 1,024, sha256 7bf77506... equal to the Mac's; done g2 in 2.44 s, self-test PASS (19:2xZ; rechecked from this tree) |
| worker smoke, Windows (the kit's igneum-worker-cuda.exe 14b6637e on PC 2's RTX 5090, job v4-smoke-1ccfe586) | 1,024 of 1,024, sha256 7bf77506... equal to the Mac's; done g2 in 2.71 s (19:24:25Z) |
| Live retry on 7f0bde70, clean form (p2-4090-3 wiped and mining beside the 0.3.14 peers, 21:27Z to 21:37Z) | PASS: 0 version-1026 headers accepted or relayed through a 129,000-block IBD and the window, 0 rejects from any peer, never disconnected, the 0.3.14 hub holding 3 blocks by its key mined in the window; verifierStale null |
| Live forced poisoned-peer confirmation on f1ea7a38 (22:18Z to 22:24Z, after publish 1: the 713ef876 miner into the 6615571c relay pool-1, the target p2-4090-3) | PASS on the receive side: 6 relayed 1026 blocks refused with "wrong block version: got 1026 but expected 2, disconnecting from peer 213.173.98.36:18451", none accepted or relayed, the hands and the hub never rejected the target, its mined blocks kept landing in the hub; both boxes restored with wiped datadirs |
| Devnet 2: P1 rehearsal | PASS (19:33Z): the flip by signal on 52 nodes, three epochs' ids, zero rejected on 16 nodes, the stale box refused both ways, blocks on v4, the floor crossed with v4 in force |
| Devnet 2: 0.3.15 canary (run 4, 19:41Z: p2-3090-1, p2-4090-3, p1-3080, p1-a5000 on 713ef876, the thirteen-field file) | FAIL. The handshake peers (digest b18ed271) but the node writes block version 1026 (the class v4 signal bit) from its first block with no window and no floor set; every 0.3.14 node answers "wrong block version: got 1026 but expected 2" and disconnects (the hub: 45 disconnects since 19:41Z, 146 today); p2-3090-1 fell behind and could not re-sync (peers 0); the siblings lost every block they mined. Rolled back to 0.3.14. |

## 6. Incidents of the day that shaped this cut

- 17:52:54Z, PC 1: 0.3.14 installed under a measurement job; cause install_asked from a two-hour-old update-now, which counts as urgent (section 1, the updater rule).
- 18:2x UK: the desktop app crashed and both hand nodes (nohup children of agent shells) died for about 70 minutes; now LaunchAgents (`infra/devnet/hands-launchd.sh`).
- 18:3xZ: every PC ran a stale igneum-prove-host and igneum-prove-export (the payload never carried the Linux pair); placed by job tonight (zigbuild pair 75166ad8 / 24d34cb9), required in the payload from 0.3.15.
- 18:58Z: `restart --what app` jobs to both PCs quit the apps and the relaunch helper did not bring them back (the engine exits under the stale window host); retired until fixed with a watcher. Recovery through the relay agent on PC 2; PC 1's agent was down.
- 17:47Z onward: the pre-push hook's site build wrote 0.3.14's download rows into five worktrees; fixed on master (SITE_DOWNLOADS_REFRESH, tools/ci/no-foreign-tree-writes.sh).
- 18:5xZ: the P1 rehearsal's flip stopped every GPU miner on the 0.3.14 worker (generator-4 refusal); hence section 2's worker rule.

## 6a. The evening's two blocks on the ship itself

- 19:24Z onward: every GitHub-hosted Actions job dies at start ("recent account payments have failed or your spending limit needs to be increased"); the Windows installer and payload zip are made only by windows.yml on windows-latest, so the Windows side waits for the org's Billing & plans. The Mac DMG, the HiveOS package and the Linux binaries do not depend on it.
- 19:30Z: tools/ship-app.mjs's commit step pushed the release tree's HEAD to origin/master although the run had --branch release-0.3.15 (the step pushes master by design); master carries the 0.3.15 tree from 272e30a. Row: the tool honours --branch for the push, and the after-rollout merge is thereby already done.
- The inputs step compared the state's short fork commit with the manifest's full one (`!==`): two needless re-pushes and a false failure; fixed (a prefix match, the manifest read bypasses the CDN cache).
- `--until <step>` added to the ship tool: a cut is staged (built, signed, verified locally) with nothing deployed.

## 6c. The canary's FAIL and the gate line that was missing

The digest readings were on a throwaway node with no peers; the node lane's compat harness peered a new and an old node on the thirteen-field file but neither mined; the rehearsal ran the signalling binary on every node. None of the three put a BLOCK from a new node in front of an old node. The line every node cut needs from here: a mining new node beside an old node on the live file, the old node accepting the new node's blocks, plus a fresh join of a clean new node against an old peer. Proposed for CLAUDE.md's Devnet 2 rules (main's call).

The fix (node lane): the signal stamp and the signal read gated on publish 2's object (both v4 fields set); a template on the thirteen-field file has header version 2, on the sixteen-field file 1026; the digest tests unchanged; the harness with the new node mining. Then the node rebuilds (Linux, Windows cross, Mac), the digests are re-read, the canary runs again. The app tree needs nothing.

## 6d. The second canary FAIL (20:36Z): the receive side

On 7961c5f1 (the stamp gated), two boxes with clean datadirs got "wrong block version: got 1026 but expected 2" from both hands within three minutes: a version-1026 block from the poisoned boxes' branch reached them via relay through pool-1 (a 7961c5f1 node poisoned by p1-a5000), the new node ACCEPTED and RELAYED it, the 0.3.14 nodes rejected the relay and disconnected the sender. One poisoned peer poisons every new node it touches. The fix (node lane): the header-version RULE gated like the stamp (window or floor absent: version 2 only, 1026 rejected with 0.3.14's line, no relay; publish 2's object: both accepted); unit tests both ways; the compat harness with a poisoned peer. The retry form adds the poisoned peer relaying into the new node. Fleet: pool-1 and the three retry boxes held on 6615571c for the next cut; the 0.3.14 poisoned boxes (p1-3080, p2-3090-1, p1-a5000) wiped and fresh-joined from the hub.

Lesson for every node cut: the compat gate needs the receive side as well as the mining side: a peer feeding the new node the headers the rule must refuse, with the old node watching the new node's relays.

## 6e. Publish 1 as run (21:39Z to 21:47Z, 22:39 to 22:47 UK)

- 21:40Z deploy: the public folder verified file by file (200 with the local sizes); the live manifest 0.3.15 with mac 041099c2 and windows 99ec575c, the thirteen-field object (13 fields, exec_restart_number 27276), digest b18ed271.
- 21:41:33Z update-now to PC 1 (ae432dc7), PC 2 (1ccfe586) and the Mac (d937c69d). PC 2 took it at 21:42:26Z ("updated to Igneum Miner 0.3.15 from 0.3.14", node igneumd 2.1.0-f1ea7a38); the Mac and PC 1 show app 0.3.15 on the console within the minute.
- 21:42Z the hands (announced), through hands-launchd.sh on the Mac igneumd 85ac04df: observer pid 60931 and node 1 pid 61387, both igneumd/2.1.0-f1ea7a38, digest b18ed271, each resumed from its own exec snapshot (node 1 at tip 147,215), eth_blockNumber 147,233 on 26790 and 26791 a minute later.
- 21:43Z the seed: the box's Linux igneumd 7f0bde70 (glibc 2.39) does not run on the seed (Debian 12, glibc 2.36: "version GLIBC_2.38 not found", 14 restarts in a loop, about three minutes down); re-run at 21:46Z on the zigbuild igneumd ede4a61ac9ab0993c644f82d61077c34fce11d7f8ffc642e8052887b978deeb3 (48,421,224, glibc 2.34 max, carries f1ea7a38): active, exec resumed from its own snapshot at tip 147,247. Rule: the seed and every Debian 12 host take the zigbuild (glibc 2.36) binary, the fleet (Ubuntu 24.04) takes the box's; restart-seed.sh now has to refuse a binary whose GLIBC need exceeds the host's (row).
- The fleet's standing boxes: by the fleet agent's script on 7f0bde70 (table owed).

## 6f. The leak: the Mac and PC 1 took earlier 0.3.15 builds before the publish

The downloads folder (~/Projects/igneum-dlsite) is shared disk state and every `publish-jobs.sh --deploy` by any agent deploys the whole of it; the dl project deployed every few minutes all evening (other lanes' job publishes). So the manifests and DMGs I wrote there "undeployed" at 19:4xZ (DMG on node 713ef876) and 20:24Z (installer on node 7961c5f1) went live within minutes. The Mac applied 0.3.15 at 20:12:25Z (ota-apply.log; its installed igneumd carries 713ef876, its igneum-bench is the 19:41Z DMG's); PC 1 took 0.3.15 at its 20:35Z slot (installer 9db842fc, node 7961c5f1). Neither took the 21:40Z publish: the updater compares version strings only, and the version scheme is three-part, so a same-version republish cannot reach them. Harm so far none (the Mac's miner is paused; PC 1's node writes version 2; no 1026 header can be created any more). The move: a version bump with the same tree (main's number), update-now to both; or hand installs.

Rule rows: nothing is staged in the live downloads folder (a scratch copy, or publish-manifest.sh writes to a staging folder, and the live folder changes only in the deploy step); `publish-jobs.sh --deploy` deploys a jobs-only change, never the whole folder; a box's installed build is read back by its node commit string (not the version) after every publish.

## 6g. 0.3.16, the corrective cut (21:55Z to 22:13Z): every machine on f1ea7a38

The same tree under a new number (8bf922d; node pin unchanged at f1ea7a38), because the Mac and PC 1 held earlier 0.3.15 builds and the updater compares version strings only. DMG Igneum-Miner-0.3.16.dmg 0a542bad002c252bc7a80c5810781e9ec8ea31173ce2bd597a9e29892c50b6c3 (41,936,050); windows.yml run 37537291393 (18 of 18, 22:03:42Z): Igneum-Miner-Setup-0.3.16.exe a1eaa1dfaa0cd428378fd1ab86245e146c180070861dc4643d62773a92239a0c (62,671,852), igneum-windows-app.zip b47939c1... (90,520,492), the payload's igneumd.exe carrying f1ea7a38 (read before the push). Manifest 0.3.16 with both rows written and deployed in one step at 22:04Z. update-now 22:08Z. Read-back: the Mac applied 22:12:27Z ("0.3.16 is running", installed igneumd carries f1ea7a38, api/state 0.3.16 current, miner paused); PC 1 "updated to 0.3.16 from 0.3.15" 22:12:33Z, node 2.1.0-f1ea7a38; PC 2 the same at 22:11:24Z, 95.2 MH/s. Hands, seed and the fleet's 14 boxes as in 6e; the hub's last 1,000 blocks at 22:10Z hold blocks by 11 of 14 standing keys (the other three in IBD or in the confirmation). HiveOS renamed igneum-hive-0.3.16.tar.gz (the same bytes, b710ac59) at 22:17Z. The jobs-only deploy guard fired once on its first use (the index's "updated" stamp alone) and now ignores that field. The Discord release card for 0.3.16 posted 22:18Z (message 1557154778415505432).

0.3.17 is the planned tree (the lanes renumbered: node ca3-v4-0316 plus the proving lane's exec-sync-0313 tip past da2d17ec with the override's proving ids as the statement's ids when set, Ember 8f581de, miner-ui-4 past e31acab, proving 38b65e7 / fc08246 with X34, the finality LEAVE item, relay 28c028b, the testing-integration crate fixed). Devnet 2 nodes on 4c6b129d need IGNEUM_PROOF_PROGRAM_IDS=0x2b1a81cb...,0x474678f3... in their environment until then (the fleet has the line).

## 6h. Wallet 0.1.5 published (22:27Z) and publish 2's floor rule

Igneum Wallet 0.1.5: DMG daf259f272934f0c1a8155ef68762c344164ae8a77c8d0621d0fceed0fb163fa (20,122,390; node f1ea7a38, the live thirteen-field object bundled; wallet-ui-3 ab8dfdc). No wallet publisher script exists (0.1.4's manifest was written by hand): igneum-wallet-latest.json written in the app manifest's canonical form, signed with igneum-ota-sign and verified, then publish-public.sh --app --wallet --deploy; live at 22:27Z, the site's wallet row 0.1.5. The fresh-joiner gate line could not run on this Mac (the installed 0.1.4 wallet's protocol-12 node holds 26620/26800; it is the hub's "level is 0" source); the installed wallet's own OTA to 0.1.5 is the live check, read back below. Row: a wallet publisher (publish-manifest.sh --product wallet).

Publish 2's floor: the node flips the class at the floor unconditionally (class_signal.rs: the floor rule when the floor has passed), so the object carries program_class_v4_activation_daa a week past the publish (DAA + 604,800 rounded up to the epoch; 828,000 at 22:24Z), the window 86,400, the exec pin; the digest with that object read 0f9e26fe on f1ea7a38 and is recomputed at the publish. The vote opens with publish 2; the flip comes by the 95 percent signal; the floor is the backstop a week out (the 0.3.17 P2 rule in advance).

## 6i. Publish 2 as run (22:42Z to 22:57Z, 23:42 to 23:57 UK): the vote is open

- The object from the live DAA at 22:42:52Z (223,667): the thirteen + exec_restart_state_root 0xed27bb2d... + program_class_v4_activation_daa 831,600 (epoch 231, a week out, the unconditional floor's backstop) + program_class_v4_signal_window_daa 86,400. Digest on f1ea7a38: eada4bda8aa8368c2b2c3d17744bc7a70a0ff0e996dad681884d3ac5de1207eb. Manifest 0.3.16 with the sixteen-field override written and deployed in one step at 22:43Z (live read 22:46Z: 16 fields, floor 831600, window 86400).
- 22:46Z update-now to the Mac, PC 1, PC 2; the PCs' nodes restarted on the object ("consensus override changed", "Program class v4 from the override file: active from epoch 231", "Consensus params digest: eada4bda") by 22:53Z. The Mac's app held its node restart "for a safe moment"; a `restart --what node` job at 22:59Z restarted it 23:01Z (synced, 7 peers); its own digest line is not in the app's log (the node's stdout is not logged there): row.
- The fleet by the fleet agent 22:47Z to 22:54Z: 14 of 14 standing boxes print eada4bda on f1ea7a38 with the sixteen-field override.json (the thirteen-field file kept as override-13.json), the two program-class lines on every node, miners up (p2-3090-3 and pool-1 finishing fresh IBDs on the object); the five-minute check reads eada4bda as the live digest and posts on any box left behind. Expected during the sweep: every moved box logged 3 to 12 digest-mismatch refusals from the not-yet-moved hands and seed.
- 22:56Z the hands (announced): observer pid 13170 and node 1 pid 13188, eada4bda, "active from epoch 231", exec resumed from their own snapshots (node 1 at 149,729), eth_blockNumber 149,742; the seed 22:56:04Z: eada4bda, igneumd/2.1.0-f1ea7a38, 16 fields in /etc/igneum/override-v3.json, active.
- The window: 86,400 DAA ending at each epoch's seed block, 9500 bps of blue blocks signalling flips the class at the next epoch; the flip comes by miner signal; the floor 831,600 is the backstop (about 7 days at 1 DAA/s).

## 6b. Publish 1 as staged (the downloads folder, local until the line)

- Manifest 0.3.15, Mac row only (Igneum-Miner-0.3.15.dmg 90bdf8c8, 41,961,932), the thirteen-field object, signed; a Windows box reads "no file for this platform" and waits. Site rows: Mac 0.3.15, HiveOS 0.3.15 (1715e58e), Windows carried on 0.3.14 (publish-public.sh keeps a platform's previous file when the manifest lacks it: packaging/ota/aliases.py), wallet 0.1.4.
- Sequence (scratchpad r0315/publish1.sh): deploy the folder; update-now to the Mac (d937c69d, miner paused per the project lead); the fleet's standing boxes by the fleet agent's script (06211d55, generator-4 workers); the hands on the Mac binary 7f0948d9 through hands-launchd.sh (announced); the seed on 06211d55; every version and digest line read back. The Windows row joins through `ship-app.mjs --from ci` when GitHub's billing block lifts. The Discord card waits for the full set.
- Trigger: the fleet's canary PASS (run 4: three of four boxes met every criterion at 19:49Z; p2-3090-1's re-sync is the open verdict) or main's call at 20:00Z.

## 7. Owed

- Publish 2 after every node and every worker reports 0.3.15; the hands' move; the first locked checkpoint after the flip.
- Pool-v0 fork commits (48c8163b, b8070476) for 0.3.16 (b8070476 conflicts with the 0.3.15 miner).
- Ember 995530b (card.tune_floor) for 0.3.16.
- The prover thread drops its cached tool paths when a stale binary is named (0.3.16).
- The relaunch helper fixed with a watcher, or `restart --what app` stays retired.
- Env-only defaults for the eight scripts that name the shared checkout by absolute path.
- The Mac app's own igneumd never runs while hand node 1 holds 26610/26611 on this Mac: the app reads the hand node as its own ("node1" watch lines), api/state's digest field reads empty. A port collision must be loud in the app, and the hands' move to the box frees the ports.
- The app's log does not carry its node's stdout, so the node's digest line is unreadable from api/log: the app should log the node's "Consensus params digest" and "Program class" lines (or expose consensus_digest from the node's RPC).
- The build box's 188.40.146.49:26611 answers "Network mismatch: igneum-devnet-2" to the 0.3.16 apps' default peer dial; the live-devnet hand must own it before the hands move.
- Publish 2's "safe moment" hold: with the miner paused the Mac's engine held the override restart until a restart job; the hold's condition wants reading (an idle engine should restart its node at once).
- 0.3.17 node tree (ca3-v4-0316; the planned tree moved one number: 0.3.16 is the corrective cut of 6 October, the same release as 0.3.15 under a new number): 8e2f5cbe (the unwrap class), 0760b844 (the seven-window signalling rule, gate PASSED four cases), b2e21447 (finality cause fields), eec34ac3 (igneum_getRecentBlocks), 325f8b98 (difficulty rule v3 behind difficulty_v3_activation_daa at u64::MAX, digest unchanged until set). Pre-existing breakage to fix in that cut: `cargo check -p kaspa-testing-integration --tests` fails on the fork (the Header initialiser lacks vote_key_hash; the KaspadPayloadOps match is non-exhaustive on the finality ops), broken since the finality fields landed; the box suite then compiles EVERY test crate (`cargo test --no-run --workspace` or the crate list widened) so a test crate cannot rot silently again.
- 0.3.17 node tree (was 0.3.16), proving agent: exec-sync-0313 da2d17ec (on 2e5d3d30) = consensus proof verification in-process (sp1-sdk 6.8.1 linked, 169 crates; three override fields in the digest once set: proving_consensus_verify_daa, proving_shard_program_id 0x2b1a81cb..., proving_aggregator_id 0x474678f3...; p2p payload 78 IgneumRequestProofRecords; a node with other embedded keys exits 3 at start); never by default, a digest move when switched, miners first. App side exec-app-0314 c00e608 (the proving-dir cap, forged.mjs harness 8/8, ledger P21 round 4 and its export-disk row labelled X31, which the site lane already used on master (X31 the testnet date, X32, X33): renumber the proving row X34 at the merge and rerun the ledger-text check). The fork's proof fixture is untracked at igneum/exec/testdata/ (the test skips without it): a build row.
- Wallet 0.1.5 (Igneum-Wallet-0.1.5.dmg daf259f2, node f1ea7a38, wallet-ui-3 ab8dfdc): the gate and the publish straight after "0.3.15 live" (the wallet in the wild bundles a 5 October igneumd at protocol 12, the hub's 172 "level is 0" rejects); not held.
- A standalone igneum-miner does not recover its template subscription after a node restart (fleet, 20:24Z): ledger row, fix = resubscribe on reconnect (0.3.16, the miner's owner); the fleet's restart script restarts the miner with the node until then.
- 0.3.17 node tree (the finality lane's branch notes still say 0.3.16; the lane is closed, the number here is the one that counts): the finality lane's LEAVE item (finality-pause-node 766e70ca on the box mirror /srv/igneum-node.git, one commit on 4c6b129d, rebases onto the 0.3.15 node with only params.rs overlapping; docs on origin finality-pause 27f82ec) is a digest move (the devnet digest becomes 63703f5b..., protocol 17) gated by finality_leave_activation_daa (never on devnet until the 95 percent signal); its Devnet 2 gate is tools/finality-attacks/leave.mjs both ways with the new binaries, before it merges.
- With the after-rollout merge: the relay security fixes X23 to X28 (28c028b, on fud-close and the ledger-* branches only; the intake key gets 403 on console writes while master lacks them).
- DONE 20:3xZ: packaging/ota/publish-manifest.sh refuses an --activation-height at or below the live DAA (the observer's executedTipDaa; IGNEUM_MANIFEST_ALLOW_PAST_HEIGHT=1 for a replay; --self-test-height), the engine half with the Ember agent for 0.3.16.
- 0.3.17's app merge (was 0.3.16), as the lanes handed it: app/igneum-app/ui/ whole from miner-ui-4 57bb4f7 (the UI pinned to the engine fields, the Ember off-state copy, N4's app half: sync_decision_v2, is_stall_exit, NodeState.tip_age_s / sync_cause / stall_exits in engine.rs and state.rs, which want the node lane's miner half (exit 45, the STALLED line) in the same cut); src/live.rs, ui/app.js, the /api/live route and packaging/ota/publish-manifest.sh from ember-tune da11c6f (cbd4d51: one monotonic wire sequence space for every helper writer, powertask::wire_seq; without it a 0.3.16 user with Power control on gets the caps and no tune; pinned to the node lane's ca3-v4-0316 b2e21447 finality-pause fields and eec34ac3 igneum_getRecentBlocks, reading the absent-field path on an older node; the node source in the site's row shape, the finality-paused state, the activation-height guard with --self-test-height; 652f6fc's guard is dropped at that merge), not miner-ui-4's 0.3.15 files; Ember's 995530b and aa73005 fields (watts_total, pounds_per_day, balance_wei, price null with the manifest rule, tune_floor, the finality pause rule fd03f35).
- The publish side owes a way to set the manifest's top-level "urgent": true for an emergency rollout through a finality pause (fd03f35 reads it; igneum-ota-sign passes the document through): a publish-manifest.sh flag.
- The gate line for every node cut from here (main writes it into CLAUDE.md): a mining new node beside an old node on the live file for ten minutes, the old node's reject count read before and after, and one new node restarted mid-window re-syncing from an old peer.