0.29.0

The release verdict (the 0.29 v2 gate)

GREEN at the release cut (main @ 4be0f72, the fresh run of
unfreeze_gate.py --office-tests pass --gate-target 0.29 — exit 0, the
summary is committed in the lockstep PR):

Goal	Verdict	Evidence
typed share ≥ 3500 bp (OWNER-FIXED 2026-10-04)	MET	4670 bp — 241/516 = 46.70%
precise share ≥ 3000 bp (№605, the audit X-3, OWNER-FIXED 2026-10-06, ADR-0181 §3.1)	MET	3042 bp — 157/516 = 30.42%; the honest RED record (2131 bp, PR #1069) landed BEFORE the movement
open High findings (server path) = 0	MET	the release-block counter = 0 (machine-read, never hand-zeroed)
the domain quorum	MET	0/8 groups carry duplicates
the serve-e2e inventory	MET	every state-accumulating declaration done

§4 (ADR-0177) GREEN across the board: types 4670 bp, dedup 0 (mirrors 6/6),
debt 17/0 + 33/33, the memory office-E2E evidence record GREEN.

The publication is the owner's act (docs/release-checklist.md, step 5 —
"the machine never publishes"): executed by the owner's PAT on the verbatim
chat verdict «Делай релизный наряд 0.29.0» (2026-10-06), the v0.28.2
precedent.

What is in the release

• №612 (gh#1061, PR #1068) — the loop semantics fixed: a bare call in
  the body NEVER terminates the loop, the tails execute; the vacuous
  greens eliminated as a class (the test harness reads ControlFlow now —
  an early return in a test body is a LOUD failure, the corpus scan:
  zero test bodies use explicit return). Pre/post on the honest-count
  program: 1 → 3. The TW↔VM parity e2e pinned (the honest count 3 on
  BOTH backends).
• №611 (gh#1060, PR #1067) — the schema-as-code references fixed: the
  qualified name parsed in EVERY spacing (the dot is the separator —
  references(parent.id) no longer drops the modifier silently, the
  broken REFERENCES parent(.) clause is impossible); mlog check
  validates the generated DDL on an in-memory SQLite dry-run over the
  SSOT renderer (ast::schema_table_ddl) — a DDL SQLite rejects fails
  the check LOUDLY, never the apply.
• The 0.29 gate movement: №605 (gh#1046, PR #1062) — the X-3
  precise-share goal goal_precise_share_bp: 3000 OWNER-FIXED
  (ADR-0181 §3.1), the coarse goal stays the floor; №613 (gh#1070,
  PR #1071) — 47 verified PRECISE rows, 2131 → 3042 bp, the floors
  raised in the same PR per the №757 procedure (precise 3042, general
  4670, TYPED_FLOOR 190 → 237); the between-releases enforcement is the
  precise-baseline ratchet (the share may ONLY GROW).

The owner's decisions archived (the records)

• ADR-0184 (№603, gh#1044, PR #1063) — the depth-≥2 respond boundary:
  REFUSED FOREVER, variant Б. RESPOND_SWALLOWED stays forever — the
  bare respond*/respond_html* form at depth ≥ 2 is refused at startup
  on BOTH backends; the migration remains one word (return respond(...)).
• ADR-0185 (№609, gh#1050, PR #1066) — the memory_forget container
  form: DEFERRED to the memory-phase planning (postponed, NOT
  rejected; the return trigger is the memory-phase planning).

Process

• №608 (gh#1049, PR #1064): the Y-4 quota line in the wave report — the
  counter learns the real formats, the --line mode; the quota is
  machine-counted on every wave report.
• №610 (gh#1051, PR #1065): the newcomer path — the broken first step
  fixed (the clone URLs), the live pool list rendered from
  gh#951–gh#959, 9/9 acceptance criteria.
• The 0.28.2 post-publication sync (PR #1059): fact_open_high_server
  closed at 0 on the live tag, REALITY §6.17 → PUBLISHED.

The full verbatim wave records: CHANGELOG [0.29.0]; the release prep:
REALITY §6.18.

---

The assets (attached by the release pipeline, release: published →
the tagged commit is built):

• mlog-linux-x86_64 — the release binary (cargo build --release --locked -p metalogos-server --bin mlog; the exact toolchain is
  recorded in BUILD-INFO.txt).
• mlog-linux-x86_64.cdx.json — CycloneDX SBOM describing exactly that
  binary.
• SHA256SUMS — digests of the binary, the SBOM and BUILD-INFO.
• Two Sigstore attestations via GitHub artifact attestations: the SLSA
  build provenance and the SBOM attestation bound to the same binary
  subject.

Built from the tag v0.29.0 (4be0f72), the version lockstep 0.29.0 in
the workspace manifests (№614, gh#1072, PR #1073 — the №583 pattern:
Cargo.toml + Cargo.lock ×5 members + the README badge + the generated
SSOT blocks).

---

The post-publication fact sync: REALITY §6.18 release state →
PUBLISHED — the syncing PR #1074 (merged
2026-10-06; ADR-0181 §4.1 step 1 — the syncing PR linked from the
release notes). The gate facts unchanged by the release:
fact_open_high_server 0 (no release-block carriers opened), the
precise share 3042 bp (the ratchet holds — only up), the quorum 0/8.

---

Security (ADVISORY — restart your tests)

0.28.x and earlier are affected on the TW interpreter — the fix ships IN
0.29.0; users of earlier versions should re-run their existing tests on
≥ 0.29.0. The Камертон matrix finding (the unified audit of e40ce8e /
v0.29.0, the dispatch gh#1089) traced the №612 loop defect to its
user-facing consequences: until 0.29.0, a call with a non-Unit result at
the END of a loop body was read as an early Return of the ENCLOSING
function — the loop ran exactly ONE iteration, the tail after the loop
was silently cut, and in mlog test bodies the harness flattened the
fabricated Return into Ok — a GREEN run that never executed the
checks. The return here was FABRICATED by the implicit block-value
mechanics, not written by the author — the dictionary class «a
respond*/deny*/return being IGNORED» (№604), mirrored: a return being
INVENTED.

each row in rows { db_execute("INSERT …", row) } — with the INSERT
call last in the body, the first iteration returned from the function:
one row inserted, the rest skipped, exit code 0.

• The guard patterns with an audit loop: a loop that re-checks a
  condition (audit/retry/scan) stopped after the first iteration — the
  code after the loop, the second half of the guard, never ran.

• The batch inserts/updates: a loop over rows executed exactly ONE
  element — the remaining rows were silently skipped (no error, no
  warning, exit code 0).

• The false confidence of vacuous green runs: in mlog test, a test
  whose body tripped the shape reported GREEN while its asserts never
  executed. The harness reads ControlFlow NOW (№612): an early
  termination is a LOUD failure — a green run on ≥ 0.29.0 means the body
  ran to completion.

• Affected: mlog run, mlog test, and mlog serve with
  METALOGOS_SERVE_BACKEND=interpreter (the fallback backend; the serve
  DEFAULT is the VM) — on every published release BEFORE 0.29.0. The VM
  backend is NOT affected. The fix landed in 0.29.0 (№612, PR #1068).

• The user action: restart your existing tests on ≥ 0.29.0; re-check
  the batch insert/update loops and the guard patterns with audit loops
  written before 0.29.0. The fix/audit date: 2026-10-06/07.