0.5.215: adopt edge v29.5.0 — the file door, the drive read, and the self-room rule (edge-only bump)

[emooreatx]

edge v29.5.0 is tagged (277ed33). It is an edge-only bump — persist stays v46.3.1, verify stays v16.1.0, all four ABI constants unmoved, no wheel-floor move. So the repin is one tag = line, and then the interesting part: this release is the one that makes the self-file path buildable on your side.

Design of record: FSD/CONTENT_TRANSFER.md — §6.2 (the source rule), §6.3 (the self room), §6.7–§6.9 (file shape, the drive read, local-vs-crossed), §9 (the DX contract). Release note: docs/RELEASE_NOTES.md v29.5.0.

---

1. The pin

ciris-edge = { git = "…/CIRISEdge", tag = "v29.5.0" }   # was v29.3.1

Nothing else moves. Ladder triple: edge v29.5.0 · persist v46.3.1 · verify v16.1.0.

2. What breaks (one thing, and only in Rust)

PullOutcome gained NoOtherNode { attempts, retrying } and AuthorUnresolved { attempts, retrying }; MeaningRefusal gained GroupIdAmbiguous { scope, detail }. Neither enum is #[non_exhaustive], so an exhaustive match on either needs new arms. If you match with a _ fallback you are unaffected — but for these two I would rather you did not: see §5, where each new variant is a distinct thing to see on the ladder.

Everything else is additive.

3. What you gain

files — one door for a file at any cohort.

use ciris_edge::{files::{self, FileWrite}, self_room, scope_room::ScopeRoom};

let published = files::publish(
    &*dir, &store,
    ciris_edge::replication::attestation_bind::Signers { node: &node_signer, actor: None },
    &FileWrite {
        room: &self_room::room(&owner_fed_id),   // or ScopeRoom::community(room_id) / ::family(fid)
        bytes: &jpeg, media_type: "image/jpeg",
        filename: Some("boat.jpg"), asserted_at: Utc::now(),
    },
).await?;

It seals at the room's tier, fills persist's group slot (the community at community, the owner at self, the family at family), authors the citing row with the right cohort target field, and crosses it to the room's audience. Every refusal is typed: FileError::{TooLargeForInline, ReadableByNobody, Seal, Author, Cross, Row}.

Read side — files::in_room(&*dir, &room, limit) → Vec<FileRow>, and FileRow::open(&store, viewer) → bytes or UnopenedReason. NotFetched is the first-class "on another device" state your /v1/drive shows.

self_room — the rule, so you write IO and not policy: roster(), snapshot(), and decide() -> SelfRoomAction.

scope_room::ScopeRoom — one type answering scope(), content_group_id(), table_group_id(), cohort_target_field(), row_scope_token(), widen_to(). Use it instead of spelling a group id. cohort_addressing::{group_id_for, scope_for} still work and now delegate to it.

4. How to adopt — three pieces

(a) The self-room drive, beside ensure_room_addresses

Tick it on the same cadence as the chat-room drive, and on occurrence-announce admission:

let roster = self_room::roster(&owner_fed_id, &lens).await;      // the directory's answer
match self_room::decide(&own_node_key, &roster, held.as_ref(), rival.as_ref()) {
    SelfRoomAction::Create            => { /* CohortGroup::create, stamp the CommitClaim */ }
    SelfRoomAction::PublishKeyPackage => { /* chat::key_package_attestation → cross With::MyDevices */ }
    SelfRoomAction::Add(nodes)        => { /* add_member per published KeyPackage → Commit + Welcome rows */ }
    SelfRoomAction::Remove(nodes)     => { /* remove_member → Commit row; epoch advances */ }
    SelfRoomAction::Abandon { in_favour_of } => { /* drop local state; join from the winner's Welcome */ }
    SelfRoomAction::Idle              => { /* seal_due on the cadence */ }
    SelfRoomAction::SoleDevice        => { /* nothing — ends when a second device announces */ }
    SelfRoomAction::NotInRoster       => { /* the owner binding is wrong; never derive */ }
}

held is HeldRoom { claim, members } from your stored group; rival is a CommitClaim seen in a Welcome/Commit row for the same identity. After any Create / Add / Remove / join:

let snap = self_room::snapshot(&group, &owner_fed_id).await?;
let scope = self_room::room(&owner_fed_id).scope();
lifecycle.install(&scope, &snap)?;                       // first time
lifecycle.advance(&scope, &snap, Instant::now())?;       // the epoch moved
lifecycle.refresh_members(&scope, &snap)?;               // same epoch, roster resolved late (#648)
lifecycle.seal_due(Instant::now());                      // on the cadence

Two things that are edge's, not yours, and must not be reimplemented: who creates (decide), and what a room's ids are (ScopeRoom). Both exist because two hosts inventing them independently is how one identity ends up with two rooms and two secrets.

(b) GET /v1/drive on files::in_room

#615 §3's read. Map UnopenedReason::NotFetched → "on another device" and keep it distinct from NotGranted ("this key does not open it") — they are different states with different remedies, which is why they are different variants.

(c) The mine_on_b ladder stage — red by design

Write it now, before the drive works. §5 is the expected sequence.

5. How to validate — the reds, in order

The whole point of the rung table is that a red names its rung. Run A-writes → B-reads and expect these in this order as you build:

stage	what you should see	what it means
before (a)	pull DEBUG outcome=FetchFailed { reason: "…NO scope address table…" }, or on a scope-native node blob_route_refusals{blob_group_not_installed} + WARN naming installed_groups=[]	R5: no self room. Expected until the drive lands
after (a), before the peer's room converges	blob_route_refusals{blob_holder_not_in_group}	R5: the room exists, that holder is not in this epoch. refresh_members or advance is the remedy
converged	outcome=Stored { announced: false }	R7. announced MUST be false — a self blob never emits a holder claim (CC 5.2 / persist I52). true here is a conformance break, not a nicety

Three things that must NEVER appear for a self pull — each is a specific regression, so fail the stage on them rather than lumping them in:

• NoHolders → the §6.2 source rule regressed. A self pull must never consult the claim index; there is nothing in it, by construction.
• NoMeaning(GroupWithoutId) → the §6.2 projector regressed. Note this is not the same as AuthorUnresolved, which is the legitimate "the author's directory records have not converged yet" wait.
• blob_pull_sources{self:claim_index} → same as the first, seen from the counter. For self pulls the counter must show self:author_nodes and no *:claim_index key at all. It is in the metrics snapshot and the PyO3 dict.

Write-side checks, cheap and worth asserting in the stage:

• published.tier == CryptoTier::InvisibleEncrypted and published.crossed == true. crossed == false means the file reached nobody — it is local-tier, and persist's E5 invariant keeps local-tier rows out of every federation stream, so it is invisible to other devices and to your own /v1/drive (FSD §6.9). It parks only when the crossing awaits an actor signature.
• published.excluded empty — non-empty is partial readability (those occurrences will read NotGranted).
• No holds_bytes: row exists anywhere for a self write.

6. What this does not buy

• Bytes do not cross until (a) is built. Everything else on the self path is green; the room's driver is the last rung, and it is yours.
• Files cap at 1 MiB until the chunk-DAG door lands — FileError::TooLargeForInline names it (CIRISPersist#821 → CIRISEdge#633, FSD §6.7).
• files::in_room is a bounded walk, not a query — AttestationFilter has no cohort_scope axis and the filtered read is not the resumable one (CIRISPersist#891, FSD §6.8). Fine for a drive of hundreds; it should not be your hot path.
• Family has the machinery but no witnesses. ScopeRoom::Family, the projector, the source rule, the send set and files::publish(room: ScopeRoom::family(..)) all work; what family still needs is a roster function (list_families_for_member_active → nodes), its own trigger (a membership row, not an occurrence announce), and witnesses exercised with a second member — membership and principal equality are different predicates, so a self witness proves nothing about family.

7. Also in this tag

Six review findings fixed, two security-relevant: decide returns Remove before Add (a late KeyPackage could otherwise hold a revoked device in the MLS tree, deriving every epoch that followed); files::in_room matches a self listing against its identity (it previously accepted every self-scoped row, which on a multi-identity node put one person's file metadata in another's drive). Plus publish refusing seals nobody can open, the drive read paging to its limit, and two retry misclassifications.

Happy to review the drive's decide call site when you have it — the ordering constraints in there are the part worth a second pair of eyes.

[emooreatx]

Two corrections to this issue, both found by verifying persist's answers (CIRISPersist#821 / #891) against the pinned tree. Edge PR CIRISAI/CIRISEdge#655 carries them; nothing about the v29.5.0 pin or the adoption steps changes.

1. §6 said "files cap at 1 MiB until the chunk-DAG door lands (CIRISPersist#821)". Wrong — it is edge's unbuilt work, not an upstream gate. Persist's chunk doors all exist at the version edge pins today (put_blob_chunk_scoped, seal_stream_scoped, read_blob_range_as, read_stream_chunk_as, adopt_sealed_chunk); Q1 shipped in v44.5.0 and Q2 is settled. CIRISEdge#633 is unblocked on the current pin — so the cap lifts when edge wires it, with no persist release in between.

2. NEW, and it bears on GET /v1/drive directly: files::in_room is caller-UNGATED. list_attestations_since is persist's replication cursor and composes no §4.3 caller-visibility predicate — right for a replication door, wrong for a reader's. So in_room takes a room and returns its files without asking whether the requester may see that room. On a one-human node that is invisible. On a shared device it means a request naming another person's identity enumerates their file rows.

So when you build (b): gate the request before you call it. For a self drive, require that the requester's principal IS the identity whose room is being asked for — the same principal fold audience_withholds uses. Do not rely on in_room to refuse; it cannot, and edge deliberately is not adding a second spelling of a visibility rule a week before persist ships the real one (#891, v46.4.0, which composes the gate in SQL). Edge will adopt that door, take a caller parameter, and delete the precondition — at which point your call site gets simpler, not harder.

Everything in §5's validation sequence is unaffected.

[emooreatx]

Supersede the pin in this issue: adopt edge v29.6.0, not v29.5.0, once CIRISAI/CIRISEdge#657 merges (it is up now). Still edge-only from your side in the sense that persist moves with it: edge v29.6.0 · persist v46.4.0 · verify v16.1.0. ABI constants unmoved, wheel floor unchanged.

One signature you will call moves, and it is the one from §4(b):

files::in_room(engine, &room, caller_occurrence_key_id, limit)   // was (dir, &room, limit)

The §2 caller-gating precondition I gave you is DELETED — do not implement it. persist v46.4.0 (CIRISPersist#891) put the cohort_scope axis on the gated reader door, so the §4.3 visibility predicate now runs inside the query. The limit bounds the answer rather than a global page, and a request naming another person's identity is refused by the substrate rather than by a check you had to remember. Pass the requester's occurrence key id and you are done.

New, and it changes what you can build now: a community or family drive returns FileError::DriveGateUnavailable — refused by name, never silently empty. The §4.3 gate's targeted arms cannot match any row AV-84 admits (CIRISPersist#893): a community row must name its PRODUCER in attested_key_id, the gate compares that against your room set, and the intersection is empty by construction. The self drive — the one #615 §3 asks for — is unaffected and works. Build that; a community drive waits on #893, where the ruling is posted and the fix is persist's.

Everything else in this issue stands: the adoption steps, and §5's validation sequence in particular, are unchanged.

[emooreatx]

edge v30.0.0 is tagged (2316238). This supersedes both earlier pins in this issue — adopt v30.0.0, not v29.5.0 or v29.6.0.

Ladder triple: edge v30.0.0 · persist v46.4.0 · verify v16.1.0. All four persist ABI constants unmoved, wheel floor unchanged.

Why it is a MAJOR, and what it costs you

files::in_room's signature moves. I first cut this as a minor on the house rule (pick the bump from who adopted the version you are amending) assuming v29.5.0 had no holders — then checked the way the rule actually says to, by grepping your Cargo.toml, and found tag = "v29.5.0" in two places with 0.5.215 built on it. So: major.

The review then moved these signatures four times. Rather than make you diff my churn, here are the final shapes, all of them:

// ── the file door (unchanged from v29.5.0) ────────────────────────────────
files::publish(dir, store, signers, &FileWrite {
    room: &room, bytes, media_type, filename, asserted_at,
}).await? -> PublishedFile { row, pointer, tier, shared, crossed, granted, excluded }

// ── the drive read (CHANGED) ──────────────────────────────────────────────
files::in_room(engine, &room, caller_occurrence_key_id, limit, after).await?
    -> DrivePage { files: Vec<FileRow>, resume: Option<AttestationCursor> }
//  was: in_room(dir, &room, limit) -> Result<Vec<FileRow>, String>

// ── the handshake (NEW — CIRISEdge#656) ───────────────────────────────────
let room = self_room::room(&owner_fed_id);   // ScopeRoom; ::family(fid) / ::community(id)
chat::key_package_attestation_in(&node_signer, &room, &kp_bytes, now).await?
chat::welcome_attestation_in(&node_signer, &room, joiner_key_id, &welcome, epoch, now).await?
chat::welcome_for(dir, from, room_id, recipient_key_id).await?   // the Welcome addressed to YOU

FileError gains Drive, DriveGateUnavailable, TooLargeForInline; it is not #[non_exhaustive], so an exhaustive match needs the new arms. Everything else is additive.

What this unblocks for you

1. opened_on_b — CIRISEdge#656 is fixed. decide returned PublishKeyPackage/Add and neither could be executed, because the two builders derived a pair room while a self room's group id is the owner's key. The rows landed in chat:pair:v1:<hash>, your adder looked in the self room, and the creator held a KeyPackage it could not see — Added(0) forever, every step logging success.

The _in twins take a ScopeRoom, not a bare id, and that matters beyond self: each kind names its room under a different envelope member, so a family handshake writes family_key_id — the member persist's widen door and write gate read. A bare string would have written community_key_id for every room.

welcome_attestation_in takes the room and the joiner. One parameter answered both only while a room was its two members; your creator places one Welcome per device into one room. Use welcome_for on the read side — welcome_from returns the last Welcome in the room, which is right for a pair and wrong for a collective.

2. The drive read is gated and resumable. AttestationFilter gained cohort_scope in persist v46.4.0, so the listing runs on Engine::list_attestations with the §4.3 visibility predicate inside the query. Delete the caller-gating precondition I gave you in §2 of this issue — the substrate does it now; just pass the requester's occurrence key id.

resume is the contract: None means the room is exhausted, anything else means there is more. Loop until it is None if you want everything. Three review rounds went into that: the first version truncated at a fixed ceiling, the second reported a short page in a WARN a caller cannot branch on, and the third resumed from the end of a backing page — which skipped every unreturned file in it, permanently. The witness pages a three-file drive one file at a time; against the pre-fix code it returns 1 of 3.

3. Community and family drives are still refused, by name. FileError::DriveGateUnavailable, on CIRISPersist#893 — the §4.3 gate's targeted arms cannot match any row AV-84 admits. Self is unaffected, which is the one #615 §3 asks for. Persist has the fix in flight (V150 cohort_target generated column) and it lands in v46.5.0; edge will adopt it as a v30.1.0 MINOR — no signature moves — so a community drive is a cheap follow-on, not another breaking adopt.

Validation

§5's sequence in this issue is unchanged and still the right ladder. Two additions now that the handshake works:

• the KeyPackage row's community_key_id (self) or family_key_id (family) must equal the room the adder looks in — that equality was the bug;
• Added(n) with n > 0, and the room's member count reaching the roster's, before expecting opened_on_b.

FSD is current as of v30.0.0 — §6.3 (the room driver's action table, with the doors named), §6.7 (file shape and the 1 MiB bound), §6.8/§6.8.1 (the drive query and the #893 block), §9 (the DX contract) are the sections to build from.

[emooreatx]

Adopt v30.1.0, not v30.0.0 — understood that you are waiting for CIRISPersist#893, and that is the right call: a community drive built on the current gate would be refused by name, and self alone does not need you to take a breaking adopt twice.

So treat v30.0.0 as a staging post. v30.1.0 will be the adopt, and it will contain:

• everything in the block above (the file door, the gated resumable drive read, the CIRISEdge#656 handshake fix) — the signatures in that block are final and will not move again;
• persist v46.5.0, which lands #893's fix (the V150 cohort_target generated column and both gate twins taking the row's room per arm);
• the removal of FileError::DriveGateUnavailable as a reachable outcome for community and family, plus a community-room witness on the drive listing.

Ladder triple at that point: edge v30.1.0 · persist v46.5.0 · verify v16.1.0.

Two things worth knowing while you wait:

1. It is a MINOR from v30.0.0, so nothing in the block above changes shape. If review turns up something that does need to move, it stays a minor rather than becoming v31 — v30.0.0 will have no holders, and this repo picks the bump from who adopted the version being amended, not from the diff. (Which is the rule I got wrong in the other direction last time, by assuming instead of grepping your Cargo.toml.)
2. §5's validation sequence gains one rung when #893 lands: a community drive listing that returns the room's files rather than DriveGateUnavailable. Worth writing the stage now, red, for the same reason mine_on_b was worth writing red — it names the cause instead of leaving a blank.

I will post here the moment v30.1.0 is tagged.

[emooreatx]

edge v30.1.0 is tagged (36cf23b). This is the adopt. Ladder triple: edge v30.1.0 · persist v47.1.0 · verify v16.1.0.

Everything in the final-signatures block above is unchanged. On top of it, since that note:

• persist v46.5.0 (#893): the community and family drives are open — files::in_room takes every room kind through one gate; FileError::DriveGateUnavailable is deleted (an exhaustive match on FileError loses an arm). Witnessed on edge's e2e: the room's file, only the room's file, not in the owner's self drive.
• persist v47.0.0 (#897, #797): With / EncryptedCohort / RoutesTo ::Affiliations { community_key_id } (the unit variants are gone); edge's serve arm keys on the row's room like Community. Persist's MembershipUnresolved splits "roster not held yet" (transient, retry_after_roster) from "not a member" (terminal, not_a_community_member / not_a_family_member) — metric token change: retry_after_community_roster / retry_after_family_roster are gone.
• persist v47.1.0 (#842, #861): BlobError::SealDidNotOpen is typed (edge's map_err no longer string-matches persist's prose); both membership-removal doors are idempotent.
• harness(632): the production-shaped ladder — split, owned, Advisory-admitted, genesis-imported — and the consent fold that let it converge #633: a file over 1 MiB is sealed as a chunk DAG by the same files::publish call; pointer.stream_id is the answer to "is this chunked". Cross-node fetch of a DAG is still to come; a far node reads not_fetched for one, honestly.

All four persist ABI constants and CONSENT_GRAMMAR_HASH unchanged; wheel floor ciris-persist>=47,<48. Python: an AV-45 ValueError now reads federation_write_scope_refused: <kind> (only an equality match on the message breaks); RuntimeError("blob_seal_did_not_open: <sha>") replaces the blob_backend token for that case.

Not in this tag, tracked separately: CIRISEdge#659 (attribution split; PR #660), #661 (no baked production dial under a test anchor; PR #663), #662 (responder inbox drops).

[emooreatx]

edge v30.2.0 is tagged (834e12d). Ladder triple: edge v30.2.0 · persist v47.1.0 · verify v16.1.0 — no pin move, no ABI move, wheel floor unchanged (ciris-persist>=47,<48).

What it carries (full note: docs/RELEASE_NOTES.md § v30.2.0):

• GET /v1/my-data/capacity is one path with two owners and two incompatible payloads #659 — attribution is not trust. SourceKeyId::from_attributed_binding(key_id, owns_key) replaces from_rooted_binding (provenance is not an input; a direct caller updates the call, the FFI is already updated). A self-signed, owned agent is now Attributed on its first announce and its rows are admitted. Rooted is a pair property, computed every sweep (rooted_with: owner-binding → owner's acceptance → a valid root in common via persist owner_of/trusted_roots_of/trust_root_valid), never stored. The serve floor: nothing this node holds about others is served below Rooted (WithholdReason::RecipientNotRooted, token recipient_not_rooted), with one exemption found by the ladder — rows the node's own self-publish identities authored (its owner-binding, its owner's acceptance) cross to an Attributed peer, because replication is pull-based and those are the rows that make a pair Rooted; without it two fresh peers withheld from each other forever (PR Two facts about the node have no node route, so two cards labelled "this node" read the brain and fail open #668). trace:* keeps its conferral gate; trust weighting and audience untouched.
• The first-contact ladder as an edge e2e — tests/first_contact_ladder_659.rs, two nodes on real Reticulum links, peer shaped like every production agent (self-signed, owned, subject-bound records, Adopt CIRISPersist v31.1.0 — two hash re-pins, entrenched() widens, and three .pyi signatures are wrong in the SHIPPED 31.0.0 wheel #406 route). Shared root: both directions land. Different roots: A's own facts cross, what A holds about another is withheld across N rounds and A's RecipientNotRooted ledger moved, and it arrives the moment B's owner also accepts A's root. In the CI reticulum lane.
• The memory reads carry a storage partition where the client needs a cohort, and serve a sampled date as a fact #661 — no baked production canonical dial while a test trust root is active (init_edge_runtime(..., baked_canonical_dials: Optional[bool] = None)).
• There is no cohort-scoped roster read, so the first card in every Rules tab fetches nothing #662 — a full responder inbox names the driver's phase (driver_phase gauge), drops are counted by role (replication_inbound_backpressure_drops_by_role), the driver never ends on a step error.
• Observability (A client cannot ask a remote node whether it already has an owner, and owned-nodes rows are two fields #667) — every dropped frame logs its attribution operands at debug; the bootstrap door logs both identities (federation key + transport destination); cold-start rooting rejections at a throttled warn per key.

What to expect on the canonical after adopting: agents become Attributed and their rows land (the "no row since 2026-09-18" symptom ends). They are served once their owner and the canonical's owner accept a common valid root — the "traces flow" milestone is this tag; "the mesh serves" is the owners' acceptances + the canonical side (server step 2). The end-to-end cut is one PR behind this: persist v47.3.0 (CIRISPersist#901 — a valid root is as attested as its holders) is tagged, and edge v30.3.0 (CIRISEdge#670) adopts it: ladder triple edge v30.3.0 · persist v47.3.0 · verify v16.1.0, no ABI / grammar-hash / wheel-floor move. Its ladder e2e is green locally over evidence-carrying holder records. If you have not started on v30.2.0, wait for the v30.3.0 tag post (same thread); a canonical on v30.2.0 with persist v47.1.0 judges roots WITHOUT the holder-hardware leg.

[emooreatx]

edge v30.3.0 is tagged (f70e878) — this is the end-to-end cut for CIRISEdge#659. Ladder triple: edge v30.3.0 · persist v47.3.0 · verify v16.1.0. All four persist ABI constants and CONSENT_GRAMMAR_HASH are unchanged from v47.1.0; wheel floor ciris-persist>=47,<48 unchanged. Full note: docs/RELEASE_NOTES.md § v30.3.0.

What lands with persist v47.3.0 (CIRISPersist#901 / #903): trust_root_valid now judges every charter holder's key record where the root is judged — Layer A (structural hardware evidence, no clock) and Layer B (YubiKey PIV chain walk where the node pins a root; None for TPM / Secure Enclave / StrongBox, never a refusal), holders_hardware_attested folded into valid. Edge's rooted_with reads .valid and re-derives nothing, so the ruling lands in the serve floor by construction. A Key-kind root whose holder record carries no hardware evidence is not valid ⇒ two peers accepting only it are Attributed, never Rooted ⇒ served nothing but each other's self-authored facts. Witness: bridge::a_common_root_whose_holder_is_unattested_is_not_rooted_901 (the evidence column is the only difference). The first-contact ladder (tests/first_contact_ladder_659.rs) is green against v47.3.0 over evidence-carrying holder records.

For the canonical (server), the whole chain now reads: a self-signed, owned agent announces → Attributed (owns_key ∧ hybrid binding; no conferral asked) → its rows are admitted → the agent's owner and the canonical's owner each accept one common root whose holders carry attested hardware (the canonical accord's three YubiKey holders pass Layer A + Layer B against the production pin) → Rooted → served. Persist's note asks the same of you: re-run the replication ladder against the canonical's evidence-carrying records before pinning.

Also in this pin, from persist v47.2.0 (no edge code change): BlobError::Withdrawn (blob_withdrawn) from the read and serve doors — edge's MissReason::Withdrawn / ChunkSourceRefusal::Withdrawn are now reachable from persist; Engine::evict_blob; Python RuntimeError("blob_withdrawn: <sha>").

Test-side only: edge's dev-dependency on ciris-persist enables persist's test-anchor feature so fixtures reach fresh_accord_holder_evidence — unified into cargo test / --all-targets builds only; release artifacts unchanged.

[emooreatx]

edge v31.0.0 is tagged (d53056a, PR CIRISEdge#674) — MAJOR: adopts persist v48.0.0 (CIRISPersist#860 / #905), which adds the 17th replicated kind. Ladder triple: edge v31.0.0 · persist v48.0.0 · verify v16.1.0. Full note: docs/RELEASE_NOTES.md § v31.0.0.

Re-pin all three (no ABI move; DIRECTORY_ABI_VERSION stays 5):

Pin	new value
persist REPLICATION_POLICY_HASH	9d62d3a86f7a0ab955969256a10c8160da73a390953ba3c87167a2da96828a19
persist CONSENT_GRAMMAR_HASH (kind list is in the hash; grammar unchanged)	07a677bbcdff236e2018f0786e8d9b0d0ef6b5b7cc2b871d41459e26ff8864a9
edge SERVE_ADVERTISE_POLICY_HASH (new plane row)	d6e4f0dfccbf02d274b7c76a70f8b3af8548d177fffaeed699efe3bd423b1df0
wheel floor	ciris-persist>=48,<49

What it carries for the mesh:

• The roster converges both ways — CommunityMembershipWidening, the append-plane mirror of the revocation: rooms are keyless (V151: every pair room can be revoked from), a widening replicates as its own kind and folds at read (active_community_members; a removal wins a tie), so CommunityRosterFork stops. Edge wires it exactly like the revocation (structural, Global, bodies held, V2 framing, three-part resume id). Producer change: add_community_member's spec is the authority's scrub over the widening row (community_roster::community_membership_widening does it); the v47 grown-record scrub is refused with the signature reason.
• #905 — sealed traces become offerable on an owned agent: the promotion sweep and the crossing take a grant by principals (the machine's own, or its bound steward's naming it in for_key_id). Persist-side; your production ladder should now read offerable>0 with no server change beyond the pin.
• OAuth redirect check accepts //evil.host, any https host, and localhost.evil.host — the login code goes to an attacker's host #672 — tests/anchor_block_generate.rs is gone; mint with persist's cargo run --example mint_test_anchor --features test-anchor.

Two deployment preconditions the first-contact chain silently assumed, now stated as invariants (FSD/FIRST_CONTACT.md I10/I11) — please check both on the canonical before the ladder run:

1. The canonical's self-publish set must name its owner key ([node_key, owner_key]). First contact (A run-without-AI node has no inbound data-subject-request surface, and the duty does not depend on owning an AI #671) carries only rows authored by a self-publish identity, and an owned node is judged through its owner's acceptance — a set of [node] alone hands the agent the node's own acceptance and no root for the trust subject, and the pair never Roots.
2. A root is judged from the judge's own records: the agent must hold the accord's charter and the holders' evidence-carrying key records (genesis-seeded on every node — verify the seeded accord-holder records carry attestation_evidence, or v47.3.0's holder-hardware leg reads the accord invalid at the agent).

With v31.0.0 on both ends the chain edge can witness is complete: announce → Attributed (v30.2.0) → the agent's allegiance lands (consented) → the canonical reads it Rooted with attested holders (v30.3.0) → the canonical's allegiance reaches the agent without consent (v30.3.1) → the agent reads the canonical Rooted → serves trace:* under the conferral gate → the sealed traces are offerable (v31.0.0). What remains is yours: the owner's acceptance written (#636), the two preconditions above, and the production-shaped run — that run is the certification; edge's ladder is its model with software roots.

[emooreatx]

Checked against main at 046e1b3 (0.5.217). Edge v31.0.0 supersedes v29.5.0, v29.6.0, v30.x and v31.0.0 as named in this thread. Leaving this open for ladder assertions only.

Done

• Pin: edge v31.0.0 (Cargo.toml:139, :366).
• The file door is used. files::publish is called in src/drive.rs. The write path warns when crossed is false or excluded is non-empty (src/drive.rs:950, :960).
• The drive read is gated and paged. files::in_room(engine, room, caller, limit, after) is called at src/drive.rs:1031, :1750 and :2908, and each loop follows resume until None. The caller-gating precondition from the first correction was not built, as the later comment asked.
• NotFetched and NotGranted stay distinct. src/drive.rs:1381-1386 maps edge's UnopenedReason::kind(). not_fetched returns 409 and not_granted returns 403.
• The self-room drive exists. src/self_room_drive.rs:226-299 handles every SelfRoomAction arm from self_room::decide, with roster, snapshot, and install/advance/refresh_members at :850-852. seal_due runs on the Idle arm.
• ScopeRoom is used instead of spelled group ids, across src/drive.rs, src/self_room_drive.rs, src/contacts_chat.rs and src/communities.rs. cohort_addressing::group_id_for has no callers.
• The v30.0.0 handshake twins are used. key_package_attestation_in, welcome_attestation_in, welcome_for and commit_attestation_in are called at src/contacts_chat.rs:1105, :1125, :1188 and :1198, and in src/self_room_drive.rs.
• The v31.0.0 re-pins are in place. SERVE_ADVERTISE_POLICY_HASH = d6e4f0df… at tests/replication_policy_gate.rs:173, and the persist hashes are listed on Adopt persist v47.4.0 — your #805 shipped: persist mints the block, logs the rooting rejection, checks the minted-by tag; add the seventh compose line #637. No server wheel depends on ciris-persist, so the wheel-floor line does not apply here.
• The first-contact preconditions are covered. The publish-own set includes the owner (0.5.215, 0.5.214: the consent:replication grant is authored on the agent (prefixes include trace:) but never reaches the canonical — no kind=Attestation round is ever scheduled #629), and the owner accepts the root (0.5.216: adopt edge v30.3.0 / persist v47.3.0 — the trace plane relights, and the OWNER accepts the root (CIRISServer#632 step 2) #636).
• Ladder rungs exist. mine_on_b and opened_on_b are both required in harness/mesh-repro/scenarios/selffiles.sh:51-60. The community rungs comm_file and comm_file_on_b are on scenarios/chat.sh.
• The breaking enum arms (PullOutcome, MeaningRefusal, FileError) need no work here. The server matches none of edge's versions. The PullOutcome in src/receive_axis.rs is the server's own type.

Remaining (size S, harness only)
Section 5 asked for these as failing checks. The ladder prints some of them as evidence, or does not check them.

• selffiles.sh:405-413 prints blob_pull_sources{…} but does not fail on self:claim_index. It should fail the stage when that key appears.
• No stage fails on NoHolders or NoMeaning(GroupWithoutId) for a self pull.
• stage_file (selffiles.sh:360-367) asserts only status == 200 and crossed == true. It does not assert tier == InvisibleEncrypted, an empty excluded, Stored { announced: false }, or that no holds_bytes: row exists for a self write.