Vinary Tree 4.0.0-rc.3 release ledger

Train opened: 2026-08-24
Canonical tag: v4.0.0-rc.3
Policy: coordinated release runbook
Predecessor evidence: 4.0.0-rc.2
State: rejected; immutable tags and verified public dependency bytes retained.

This append-only ledger records the RC.3 correction, immutable-tag validation, publication that preceded the downstream failure, and the clean-build defects that caused the train to advance. A successful upload is called verified only after an independent exact-version consumer exercises the public bytes.

Final outcome

RC.3 corrected the malformed libdictenstein Cabal descriptor that rejected RC.2. Interop and libdictenstein then passed their complete immutable-tag matrices, their Rust crates were published and consumed successfully, and the interop npm package was published and exercised through both CommonJS and ECMAScript module (ESM) entry points.

The liblevenshtein-rust immutable-tag matrix subsequently failed two of its 18 jobs in run 32784322326:

1. npm job 97613162979 compiled the ClojureScript facade and then failed to load javascript-runtime/native/build/Release/vinary_tree_native.node. A clean release checkout had never built the shared native runtime. Earlier local tests passed only because that ignored build output already existed.
2. JVM job 97615041072 failed DictionaryCollectionsTest. The job staged the interop JAR but not the exact native libdictenstein dictionary provider, and its Gradle native-directory properties remained relative to whichever process directory invoked Gradle.

The run completed from immutable commit fe1895aa78860fc7d89970bf6f62560cd5150493: 16 jobs passed and exactly these two failed. Both are package-boundary source defects rather than registry or runner transients. RC.3 tags therefore remain fixed, the downstream train was stopped, and the correction advanced to RC.4.

Immutable source graph

Every annotated v4.0.0-rc.3 tag was pushed before validation began and peels to the commit below. lling-llang and duallity used isolated release branches so unrelated development worktrees were not altered.

Owner	Immutable commit	RC.3 validation disposition
vinary-tree-interop	6ade25175ee4350855359f5f97b455eea55bf6bd	complete matrix passed
javascript-runtime	9b182091bcf75a695a44d6a8628d974438ab72fe	not dispatched after root rejection
libdictenstein	267420b66b63ffd992da38083e584281a568bcd6	complete matrix passed
liblevenshtein-rust	fe1895aa78860fc7d89970bf6f62560cd5150493	rejected: 16 jobs passed, 2 failed
lling-llang	0442dfb28ca5d6e6a7107ab7b387e6fc58060a64	not dispatched after root rejection
duallity	98f7e2b6d67b4bb6de61691252fe44be326d8688	not dispatched after root rejection
liblevenshtein-npm	3b87416d5cd30a526f9f088e31e90937969a1788	not dispatched after root rejection

Validation and public-byte evidence

Shared interop

Validate-only run 32774149808 passed the Rust, native SDK, Python, JavaScript, Go, .NET, JVM/Javadoc, Swift, Fortran, OCaml, Haskell, and release-contract matrix at the exact tag. The checksummed GitHub prerelease was produced from the same source.

vinary-tree-interop@4.0.0-rc.3 was published by run 32775356325. Its .crate SHA-256 is 9b3f2818d49c32285919d1cabf6c1a7c6cebf530a29b688d6fef1b629e09b3ce, which exactly matched the GitHub release asset. A new locked Cargo consumer passed the ABI constants, status-wire, and resource-lifetime smoke.

@vinary-tree/interop@4.0.0-rc.3 was published with provenance by run 32780036937. Its integrity is sha512-VD1oFP/ziv5+UBsuvGAs0es1phTWk+bKIGPgkPFF9SNVGAVJFmbzRAFGxff+tzojAqv9tKOoe+808xtSLeVkeg==, its SHA-1 is ea0913f120518de0c0f35d39e591a35dcc2036ed, and the downloaded tarball SHA-256 is 7626a34d66e52ace8807f6b127d4b8e757207320f5603a92368c31e05dfb7ceb. That SHA-256 exactly matched the GitHub artifact. Fresh CommonJS and ESM consumers passed identity and interface-version tests. The candidate remained under next; RC.3 was never promoted to latest.

libdictenstein

Validate-only run 32780407897 passed all native targets, snapshot/contract tests, Python wheels, JVM, .NET, Ruby, SwiftPM, npm, LuaRocks, opam, and Hackage/fpm candidate jobs.

libdictenstein@4.0.0-rc.3 was published by run 32782923571. Its .crate SHA-256 is 43701458589cc1a2c0cd27f198e883ecba2b9679c2f3a51260e1cd8d213049c9. A new locked consumer constructed a dynamic DAWG, exercised map and dictionary semantics, and completed without warnings. Its npm facade was not published because the coordinated train was rejected downstream.

Lessons carried into RC.4

The failure was not caused by the release matrix being too small; it was caused by two jobs depending on state that the job did not construct. RC.4 therefore turns both prerequisites into explicit, executable contracts:

• JavaScript facade tests build the shared runtime from the exact synchronized family sources before any facade is loaded;
• JVM collection tests build and name the exact native dictionary provider, while Gradle resolves every supplied native directory to an absolute path;
• every family lockfile is a synchronizer-owned release surface, and native SDK bootstrap builds are locked; and
• clean-layout rehearsals must begin without ignored build products and must compare lockfiles before and after the build.

Closed checklist

• [x] All seven RC.3 tags are annotated, immutable, and resolve to the recorded source commits.
• [x] Interop and libdictenstein public crates passed exact clean-consumer smokes; interop npm passed fresh CommonJS and ESM smokes.
• [x] Root run 32784322326 and both failed job identifiers are recorded without reclassifying either failure as transient.
• [x] Remaining RC.3 publication stopped immediately after the source defect.
• [x] RC.3 scoped packages were not promoted to latest; legacy liblevenshtein@latest remained 2.0.4.
• [x] Corrective work moved to a new immutable candidate rather than moving or overwriting any RC.3 tag or registry byte.

Completion condition

RC.3 is historically closed as a rejected candidate. Its valid public subset remains immutable and independently verified, but it is not a promotable coordinated release. All subsequent validation, publication, tag normalization, and recovery evidence belongs to the RC.4 ledger.