---
name: v0400-published
description: "v0.40.0 published 2026-07-22 (counter 73, MINOR) — NOTIF-TRUTH + OBS rider; four CI runs on byte-identical code, all four reds environmental, zero code defects"
metadata: 
  node_type: memory
  type: project
  originSessionId: 618a37a6-4f1a-437c-b465-1c6d0ba7e293
  modified: 2026-07-22T08:09:44.810Z
---

**v0.40.0 PUBLIC 2026-07-22T06:55:30Z, counter 73, main @f31849c.** MINOR (notification behavior changes broadly on an existing surface). Contents: NOTIF-TRUTH W1 #53 + W2 #54 (ADR-0046), OBS rider #55, release cut #56. deployah drove the whole lane (preflight → cut → gate liaison → tag → sign+publish); doyle gated.

Changelog shape: **Changed** ×4 — notices no longer interrupt an attached session (wait for a break or the next attach); the same notice no longer repeats across a subnet, and single-machine notices stay local; notices self-clear once resolved; one-shot cleanup of stale "update available" notices on upgrade with current ones re-shown. **Internal** ×1 — debug-only diagnostics, off by default, cannot be armed in a released build. Mechanism vocabulary (scope / coalesce key / TTL / quiet-delivery / seam dismissal) stayed OUT per the runbook's no-internal-lingo rule.

## ⭐ THE STORY OF THIS CUT: four CI runs, byte-identical code, ZERO code defects

The release commit a9bd167 never changed after it was written. It contained no `.rs` delta at all — 3 files, Cargo.toml + Cargo.lock + CHANGELOG.md. Yet:

| run | box state | result |
|---|---|---|
| 1 | C: 3.2% free | RED — `brain_decouple::suspended_brain_controller_is_stall_evicted_take_completes_viewer_ticks` |
| 2 | C: 3.2% free | RED — same test AGAIN + `adapter_translate_proof_gates_on_commit` |
| 3 | C: 5.65% (46 GB swept) | RED — `adapter_digest_proof_gates_on_drops`; **brain_decouple GREEN** |
| 4 | disk OK + session-0 leaks purged | **GREEN, all jobs** |

**The rider was suspected on strong evidence and exonerated by removal.** The OBS rider had wrapped `resolve_subscribe` with a synchronous `eprintln!` on the TAKE path — under the broker's `&mut self` lock — and run 1's failure was a stall-eviction/take test in exactly that seam. That is a real, correctly-raised suspicion: doyle's earlier "no seam overlap" dismissal did NOT transfer, and the repeat-proof rule fired instead of a flake filing. It was then cleared not by argument but by the box being fixed: brain_decouple passed the moment it had disk headroom, on the same bytes.

**Lesson worth more than the release:** a release-shape PR with zero `.rs` delta CANNOT introduce a test failure — that fact is available immediately (`git diff main..HEAD --name-only | grep '\.rs$'`) and should be the FIRST thing established when a release PR goes red. It does not tell you the tree is healthy, but it tells you where not to look.

## Publish-lane mechanics worth reusing

- **`gh pr checks --watch` exiting 0 does NOT mean green.** It means the watch finished. I nearly mis-read this twice; always re-read the per-check table and grep for non-pass rows. Same tool also exits instantly with `no checks reported on '<branch>'` if it races check registration after a rerun — for a rerun, watch at run level (`gh run watch <run-id>`) instead.
- **Re-verify the counter immediately before signing, not once at authoring time.** Publishing is irreversible; the read is two seconds. Confirmed published v0.39.4 metadata `"version":72` → ours 73, then re-read the LIVE v0.40.0 asset after publish to confirm 73 actually landed rather than trusting intent.
- **Verify the tagged commit's contents before pushing the tag** (Cargo.toml version + the `## [0.X.Y]` section present at that sha).
- `cargo metadata --offline` is the right way to bump `Cargo.lock` after a workspace version change: it touches workspace members only and leaves third-party pins alone. ⚠ `quick-xml` legitimately sits at `0.39.4` — a blind sed of the old version string across Cargo.lock would have corrupted it (second cut in a row this trap appeared).
- `xtask gen` produced only CRLF churn on `docs-site/src/cli/reference.md` (`--ignore-all-space` diff empty ⇒ zero content drift). Reverted rather than committed; do not commit line-ending noise into a release PR.

## Process rulings earned here

- **Runbook cite that won an argument and saved a CI cycle:** `push:[main]` CI is a non-blocking backstop, NOT the tag gate — the release PR's own CI validates the exact tagged commit. doyle's hold on my release-PR push was over-serial and he withdrew it; parallel beat serial with the tag still waiting on both greens.
- **A failure inside a seam the change touched is not filable as a load flake on one observation** — repeat-proof it. Written into the runbook by this cut ([[shared-seam-change-run-all-seam-tests]], and the preflight rule now says derive the seam set by grep, never recall it).
- Date convention: local PDT is authoritative for the `## [0.X.Y] - <date>` line; git rendering UTC a day ahead is not a second day. v0.40.0 and v0.39.4 both carry 2026-07-21.

See [[hfenduleam-disk-full-ci]] (disk presenting as timing-assert reds — new symptom class), [[e2e-leaked-daemons-shared-box]] (session-0 runner leaks invisible to sweep-by-path; orphan-conhost solved), [[v0394-published]], [[notif-truth-plan]].

## Doyle close-out (gate lane, post-publish sequencing)

**Quiesce-partial window shape (reusable):** scoped leaked-daemon sweep (path-verified session-1 kills; session-0 needed operator elevation — ⚠ Restart-Service did NOT reap detached orphans, they outlive their service) → fleet hold announced → single watched rerun → merge/tag/publish inside the window → all-clear on publish confirm. Mid-window a relayed "operator says proceed" from flynn was VERIFIED DIRECTLY with the operator before release ([[no-version-floor-before-it-ships]] rider) — confirmed genuine.

**Dispatched post-publish:** hertz field-verify (NOTIF observables ×5, separate verdicts + the 2 RCA capture protocols; ⚠ debug-build caveat stated in the dispatch — byte taps are compiled no-ops in release binaries, only the breadcrumbs work on stock 0.40.0). deployah runbook-doc **PR #57 MERGED @89779e0d on 2026-07-22T07:14:56Z** — docs-only, `docs/RELEASE-RUNBOOK.md`, zero `.rs`; doyle read the diff himself rather than trusting the author's summary, and confirmed the doc correctly does NOT pin the brain_decouple reds on the rider. Release lane fully closed. Remaining queue: emit-after-lock KH-7.12 followup (backlog, A/B loop = its acceptance) · reboot-window for 4 pinned skeletons + 1 orphan conhost (~7 MB cosmetic).

**2026-07-22 family-wave legs 1+2 GATED + MERGED (PR #58, 3 rounds, doyle):** REQ-CI-POSTJOB-DAEMON-REAP + REQ-CI-WINDOWS-PHASE-A-BOUND. Gate produced 5 confirmed defects across rounds, ALL grounded by running commands on kitsubito itself, none by argument: D1 `pgrep -E` doesn't exist in procps (silent no-op — matcher erroring into empty output reads as a clean box, [[absence-needs-sibling-probe]] textbook); D2 kernel 15-char comm truncation silently excluded 3 fixture names; D3 `pgrep -c || echo 0` double-print; D4 `readlink -f` SUCCEEDS on a deleted /proc exe (last component needn't exist) so todlando's fallback-only strip was unreachable — proven with a spawned-then-unlinked decoy that survived the reap; D5 hard-exclusion guarded a Linux layout that doesn't exist (real fleet binary = ~/.local/bin/spt). todlando's round-2 response raised the bar: /proc-walk with exe path as single membership+scope oracle, sourceable-as-library selftest (44 asserts, runs anywhere), loud self-check. FIRST REAL EXECUTIONS both decisive: cancelled round-2 run's always() step cleaned 6 leaked daemons ON THE CANCELLATION PATH; round-3's GREEN Linux battery still leaked 6 — reap killed all — so green runs leak too, the leg is not a failure-path shim. ⭐ STANDING: strict trigger armed — 3 consecutive clean end-censuses → SPT_CI_REAP_STRICT=1 default + failed-self-check-exits-1 rider (recorded in the code at the strict check). Round-3 run 29901572091 = clean #1. Wave does NOT close on warn-only; family members still need looped-under-load proof. Windows Phase-A bound=8 cost ~nothing (15m50s test job).

**2026-07-22 wake follow-through (doyle):** (1) hertz status received — perch outage self-repaired (new adapterless receiver on 127.0.0.1:57092), field-verify NOT yet started; hertz sequencing = bug-4 breadcrumbs first (no debug build needed) → bug-3 only after debug broker safely staged → NOTIF observables separate, version-pin CLI+broker before any verdict, per-observable results, no ETA. doyle CONFIRMED the sequencing against the dispatch contract and restated acceptance per item (bug-4 pin = the two subscribe records for ONE frozen viewport; bug-3 A/B capture + `[1m` discriminator + pure-ASCII early kill test; TEARDOWN-AUTHORITY's 3 unverified claims re-queued AFTER this batch, separate verdicts). (2) **Family-wave legs 1+2 DISPATCHED to todlando** (operator-ratified via commune): leg 1 = in-job post-job reap + start/end census (session-0 leak population is reachable ONLY from inside the runner's own job context — that fact is the leg's whole design), leg 2 = Windows-leg Phase-A parallelism cut (deployah option c). Leg 3 (host separation) stays operator-only; leg 4 (member hardening) explicitly out of scope. Acceptance: looped-under-load repro-then-green per member + zero-surviving-daemons census diff + clean-census next run; registry-first REQs required. Gate-rig mechanism debts banked as bite #7 legs (leg omega end-of-battery daemon kill + leg-0 df/stale-target/prior-gate sweep) in [[gate-rig-mechanisms-not-remembered-steps]].