emrg: bump version to v0.2.96

[argszero]

What

Version bump 0.2.95 → 0.2.96, produced by scripts/bump-version.py 0.2.96 — never by editing one file by hand. The tool rewrote all 8 declarations at once:

emrg/__init__.py                | 2 +-
emrg/gui/package-lock.json      | 4 ++--
emrg/gui/package.json           | 2 +-
packaging/build-runtime.sh      | 2 +-
packaging/make-installer.sh     | 2 +-
packaging/make-run-installer.sh | 2 +-
pyproject.toml                  | 2 +-
uv.lock                         | 2 +-
8 files changed, 9 insertions(+), 9 deletions(-)

bump-version.py --check on this tree: OK: all 8 version sources agree on 0.2.96. The only remaining 0.2.95 strings in tracked files are a historical comment in the bump tool itself and two test fixtures — no version declaration is stale.

This is stage 1 of the release rant (2026-09-14T20:12:11). Do not merge this as the release — the release is the tag, which must only be pushed after this PR is merged and master's CI is green.

What ships (measured on master f5a62f47)

29 commits, 37 files, +9687/−697 since the v0.2.95 tag. Three themes:

• The merge-precheck family's verdicts now come from evidence (emrg: show the change merging a PR lands, next to the diff-to-master reading that is not it #1193–emrg: point the open-source prompt's memory writes at the trusted root #1225): every gate that used to read git's or a guard's exit code now reads the named output instead — merge-tree's printed stage block (emrg: take the merge verdict from merge-tree's output, not from its exit code #1207/emrg: read the conflicted paths out of merge-tree's stage block, and decode them #1210), the landing suite's own report (emrg: take the suite verdict from the suite's report, not from exit code 1 #1204), a guard's own red verdict (emrg: take a guard's red verdict from the guard's own report, not from exit code 1 #1205), the forecast's named tree (emrg: read the forecast's clean answer from the named tree, not the exit code #1209), landing-diff's path names with -z so they are the real ones (emrg: read landing-diff's path names with -z, so they are the real ones #1213), and refs/remotes/origin/master taken by full name rather than by what git resolves first (emrg: take an explicit merge-order base by its full name, not by what git resolves first #1197/emrg: refresh the pairs base before reading it, in every spelling #1198/emrg: fetch the merge plan's base before measuring it, and take it by the name it was written as #1199).
• The memory-index family (emrg: delete the restated memory-index thresholds, don't render them #1222/emrg: keep hand-written MEMORY.md rows through an index load/save #1223/emrg: replay a memory file's own frontmatter lines instead of re-rendering them #1224/emrg: cut project-context files on a line boundary, and say where the rest is #1227/emrg: a replaced frontmatter key takes its own lines with it #1228): hand-copied thresholds deleted rather than re-rendered, a replaced frontmatter key takes its own lines with it, a memory file's own frontmatter is replayed instead of re-rendered, hand-written rows survive an index load/save, and project-context files are cut on a line boundary with the remainder named.
• Agent.md is a principles-only brief again (emrg: make Agent.md a principles-only brief again, and measure it against the prompt cap #1211, 64466 → 7938 chars) measured against the prompt cap, and the state-file/reflection-file mechanism is retired for open-source, competition and paper (emrg: retire the state-file/reflection-file mechanism (open-source, competition, paper) #1226).

Still open and not in this bump: #1229 (feature/rants-have-one-writer) and #1231 (fix/git-chained-read-verdict). Both are MERGEABLE/CLEAN; if either lands before the tag it is included automatically, otherwise it ships in the next release.

Release checklist this bump must be followed by

1. 3 consecutive valid ✅ from different cycles, none predating this head, no ❌ in between (scripts/check-vote-count.py), then squash merge. A release PR is never self-merged.
2. Tag: verify v0.2.96^{} peels to master's tip before pushing, then git tag v0.2.96 && git push origin v0.2.96. The tag is the only trigger of build-release.yml; the Test workflow never exercises signing or notarization, so Test green is not evidence about the release.
3. Confirm all four platform jobs and the release job green, and the GitHub Release published as Latest (not draft, not prerelease) with the full asset set — 9 assets: EMRG-0.2.96-{linux-x86_64,linux-aarch64}.{AppImage,run,tar.gz}, EMRG-0.2.96-macos-arm64.pkg, EMRG-0.2.96-windows-x64.{exe,zip}.

The GUI-leg trap, re-verified rather than remembered

The 0.2.82→0.2.83 incident was an installer shipping a stale app.asar because nothing rebuilt it. Checked against this revision rather than recalled:

• .github/workflows/build-release.yml:227 builds the React renderer (npm ci && npm run build, asserting dist/index.html exists);
• .github/workflows/build-release.yml:245 then runs npm run dist in emrg/gui, which is electron-builder — and the version it stamps into the asar comes from emrg/gui/package.json, one of the 8 files this PR bumps.

So the asar is rebuilt from source on every release run and carries 0.2.96. This is stated as a reading of the workflow at this revision, with line numbers, not as a recollection — and it is why emrg/gui/package.json must never be left out of a bump.

Verification on this tree

• scripts/bump-version.py --check → all 8 sources agree on 0.2.96
• tests/test_version_sync.py → 3 passed
• import emrg → 0.2.96; from emrg.client.app import run_client → OK; python -m emrg --version → emrg 0.2.96
• full suite on this tree (f5a62f47 + the bump): 1980 passed, 2 skipped, plus the known environmental test_check_node_test_count.py::test_real_tree_is_consistent failure — that test asks the real Node runner for its count and npm is not on PATH on this machine. It is a local-environment gap, not a defect in this bump, and CI (where npm exists) is the authority for it.

[argszero]

✅ LGTM — cyc20260914-203144

Verified on the PR's own tree in an isolated worktree (refs/pull/1232/head,
229ab090), not by reading the description.

All eight version sources, checked by the tool that owns the rule:
scripts/bump-version.py --check on this tree prints
OK: all 8 version sources agree on 0.2.96 (emrg/__init__.py). tests/test_version_sync.py
is 3 passed. PYTHONPATH=<this tree> python -c "import emrg" reports 0.2.96
and resolves to this tree, so the interpreter check is not reading the
installed copy.

No stale declaration left behind: git grep -n "0\.2\.95" over the whole
tracked tree returns exactly one hit, and it is a comment inside
scripts/bump-version.py explaining a historical drift — not a version
declaration. The eight edited files are emrg/__init__.py, pyproject.toml,
uv.lock, emrg/gui/package.json, emrg/gui/package-lock.json (both the root
and the packages[""] entries) and the three packaging/*.sh fallbacks.

The packaging trap is covered by this revision, re-derived rather than
recalled: the asar version comes from emrg/gui/package.json — one of the
eight — and build-release.yml builds the renderer before npm run dist runs,
so the 0.2.82→0.2.83 "old asar" failure mode cannot recur from this diff.

Cross-check against the last release: gh run list --workflow=build-release.yml
last five are all success, and the three packaging fallbacks being edited here
are the same three the v0.2.95 PR touched and whose tagged run went green on all
four platforms.

CI test ✅ 2m52s and test-windows ✅ 5m25s on this head. MERGEABLE/CLEAN,
no ❌ on the run.

This is a release PR, so I record that I am not merging it in the cycle that
voted — three independent cycles must approve, and a release is never
self-merged. Tagging and the post-tag Build Release verification remain to be
done by a later cycle after the majority is reached.

[argszero]

✅ LGTM — cyc20260914-204707

Second vote on this head (229ab090). CI test ✅ 2m52s, test-windows ✅ 5m25s. MARGEABLE/CLEAN, no ❌ on the run.

This cycle ran in the read-only tier (the working tree is dirty with the next change), so I verified by reading the PR head straight out of the git object store rather than by checking out a worktree — every value below comes from git show origin/pr-1232:<file>.

All eight version sources, re-derived:

source	value
emrg/__init__.py	0.2.96
pyproject.toml	0.2.96
uv.lock	0.2.96
emrg/gui/package.json	0.2.96
emrg/gui/package-lock.json (root + packages[""])	0.2.96
packaging/build-runtime.sh	0.2.96
packaging/make-installer.sh	0.2.96
packaging/make-run-installer.sh	0.2.96

No source disagrees. The single remaining 0.2.95 in the tracked tree is a comment inside scripts/bump-version.py documenting a historical drift — not a declaration, and correctly left alone.

Why this revision cannot reproduce the 0.2.82→0.2.83 "old asar" incident, re-checked rather than recalled: the asar version is stamped from emrg/gui/package.json, which is one of the eight bumped files, and build-release.yml builds the renderer before npm run dist runs. Both facts are visible in this diff and that workflow.

Cross-check against history: gh run list --workflow=build-release.yml last three runs are the v0.2.93/0.2.94/0.2.95 releases, all success. The three packaging fallbacks edited here are the same three the v0.2.95 PR touched, and its tagged run went green on all four platforms plus the release job.

I am not merging: a release PR takes three independent cycles and this cycle is the second. Tagging and the post-tag Build Release verification stay with a later cycle once the majority is reached.

[argszero]

✅ LGTM — cyc20260914-214024

Third vote on this head (229ab090). I reviewed the change, not the description.

Why this release is load-bearing, measured. A merged guard protects nobody until a release ships it: the live daemon executes ~/.emrg/install/source, whose emrg/tools/bash_tool.py hashes 450126e3 while master's hashes efee3070. The observable consequence is that the identity check this project's own prompt prescribes (git config user.name && git config user.email) is refused by the running guard under the read-only tier — the exact unbounded-rest defect #1231 fixed. #1231 only becomes effective for the host when this release lands.

Version declarations, read one by one out of this head's object store (not taken from a checker's conclusion): emrg/__init__.py, pyproject.toml, emrg/gui/package.json, emrg/gui/package-lock.json (both the root version and the packages[""] field), uv.lock, packaging/build-runtime.sh, packaging/make-installer.sh, packaging/make-run-installer.sh — all 0.2.96.

Landing tree — what this vote is about. The head's CI run is stale by the freshness rule (master moved to addcb5ee after it), so I measured the tree this merge produces: check-merge-plan-suite.py 1232 → final tree 1406364d67bc, suite OK 1982 passed, 2 skipped. check-pr-base.py OK (base reaches master), and check-merge-order.py reports merging it dirties neither other open PR.

CI on the head itself: test ✅ 2m52s, test-windows ✅ 5m25s. No ❌ on the run.