0.30.0

A verification and library-surface release. Nothing about using prikk from the command line
changes except two help lines. The one breaking change is in the library API, and it is the kind that
makes future releases less disruptive rather than more.

Breaking change — PrikkError (library only, no CLI effect)

• PrikkError is now #[non_exhaustive]. Code that matches on it must carry a wildcard arm.
  This is the change worth having: from here, adding a new error variant is no longer a breaking
  change for anyone matching on the type.
• Io(String) became Io { kind: Option<std::io::ErrorKind>, context: String }, and
  From<std::io::Error> now preserves the operating system's error kind instead of discarding it.
  kind is None at the sites that construct the variant by hand — which is most of them today, and
  is recorded honestly rather than filled with a placeholder.

No message text and no exit code changed. Display renders exactly as before, and the CLI
converts every error to a string before it reaches you, so this release is invisible from the command
line except for the help text below.

Crate source APIs remain an explicitly unstable compatibility surface
(release compatibility).

Changed

• prikk commit --help and prikk worktree-status --help now mention .prikkignore, which shipped
  in 0.29.0 without appearing in either.

Verification

None of this changes behaviour; it changes what the project can catch.

• Ten doctests on the kernel entry points — compiler-verified examples on ObjectId,
  CanonicalWriter, path validation, the Ed25519 surface, and RefStore::publish. The workspace
  previously ran zero.
• Property tests for the patch algebra, covering classifier conservatism and the difference
  between pairwise and full-order replay.
• A prikk-benchmarks workspace member carrying criterion, outside default-members so it
  reaches no product crate's manifest and no shipped dependency graph.

Documentation

• .prikkignore now has a guide page describing its syntax, the two commands that consult it,
  the surfaces it deliberately does not affect, and its limits.

• The architecture reference's verify cost section was corrected. It described verify as
  roughly O(N³) — about 34 seconds at 160 blocks — which stopped being true on 2026-08-18. verify
  is linear: 27.04 ms at 160 blocks, and the property is held by a gate.

• A latent fragility is recorded, in the architecture reference's known-costs table. A text
  span's identity includes its position among textually- and contextually-identical occurrences,
  recomputed against the buffer in front of it — so a sequence of edits authored against a shared
  baseline, rather than each against its predecessor's result, does not replay. It was found by this
  release's own new property tests. Tracked as RFC 134.

  Corrected 2026-09-04, the same day this release was published. This entry first said
  "merge can reach it". It cannot. Every EditText is authored against the text its
  predecessors produced, so the operations merge composes carry indices consistent with the replay
  that reproduces them — verified by building the exact two-commit case and replaying it, not by
  reading. No user-facing path reaches this, and no shipped behaviour is affected: the correction
  is to a claim about the code, not to the code. What remains is an unstated invariant that nothing
  checks, and a refusal reported as malformed evidence rather than as what it is.

Prebuilt binaries

Linux (aarch64/x86_64), Windows (x86_64), macOS (aarch64). Each archive contains the prikk binary, LICENSE, and a sibling .sha256
checksum plus .build-info.txt recording the exact toolchain and command used to build
it — reproduce with:

git checkout <tag> && cargo build -p prikk --release --target <triple> --locked

cargo install prikk remains the toolchain-based install path; these binaries are an
additional option, not a replacement.

macOS binaries are unsigned. Gatekeeper will warn on first run — right-click (or Control-click) the binary and choose Open, or clear the quarantine attribute directly with xattr -d com.apple.quarantine <path>. Notarization needs an Apple Developer identity and is a stated gap for a future increment, not an oversight.

Release authority — read before relying on this release

This release does not pass the DC-35 signer-authority audit, and does not claim to. The
committed release-signer set (release-signers.toml) is empty and fail-closed, so no release
currently satisfies that gate. A checksum published beside a binary on this page proves integrity of
transport, not authority of origin. Verify what you obtain by content, not by release authority —
see prikk verify and this project's
release-compatibility reference.