The release gate's first real stage is `cargo fmt --check`, and it had
44 diffs across 15 files — enough to abort `create-release.sh` at step 0
before it touched a version number. Some of that drift is mine from the
last two days, some predates it in files I never opened
(bootstrap.rs, ghost_reaper.rs, openwrt/router.rs), and one is the
regenerated fips/app_ports.rs.
No behaviour change — rustfmt only.
Gate now: 8 of 9 green. The remaining red is cargo-test-weekly exiting
124, which is the 25-minute `timeout` expiring during a cold
CARGO_INCREMENTAL=0 rebuild on a loaded node — the tests never started.
Not a test failure.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Root cause observed live 2026-08-16: onboarding/seed-restore rewrite
identity/node_key on disk but server_info.pubkey is only seeded at boot,
so until the next restart every peer-joined advertised the stale boot key
while signing with the new seed-derived key — deterministically rejected
by every receiver, once per 90s heal tick, forever.
- seed.generate / seed.restore now refresh server_info.pubkey in the live
snapshot immediately (mirrors the DID-rotation handler).
- The 90s heal loop advertises the SAME key it signs with (disk identity,
like federation sync already did) instead of the boot snapshot.
- notify_join no longer logs "delivered" for an HTTP-200 JSON-RPC
rejection; in-band errors are terminal (identical signed bytes can
never succeed on retry).
- The heal loop backs off per peer (doubling toward a daily re-assert)
instead of re-notifying every 90s forever — Observer-held peers never
appear in Trusted-only exported hints, so they_list_us could never
become true for them.
- Receiver now binds the DID to the advertised pubkey (the old check was
self-referential) and logs malformed signatures distinctly from
genuine mismatches.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
