[RobertClarke]

Version 3.1.0 and its release notes, cut on 3.x.x. The coordinator gave the GO on 2026-10-26 for this scope: the 3.x.x head (442e2c70, which is 3.1.0-rc.1 a862e251 plus #777), the tokio update for RUSTSEC-2026-0386, the version bump, and the notes. Nothing else.

What 3.1.0 is

3.1.0-rc.1 plus two dependency updates. Since rc.1 there is no runtime code, setting or migration change: git diff v3.1.0-rc.1 touches only the two lockfiles, Cargo.toml, VERSION, README.md and docs.

Change	Crates	Advisories
#777 442e2c70 (already on 3.x.x)	rustls-webpki 0.103.15 → 0.103.16 and webpki-roots 1.0.9 → 1.0.10 (both lockfiles); rustls 0.23.45 → 0.23.46 (fuzz lockfile only)	RUSTSEC-2026-0382, -0381, -0346, -0347, -0348, -0349
this PR	tokio 1.53.1 → 1.53.3 (both lockfiles)	RUSTSEC-2026-0386

Changes

• tokio (adcf74da), as part 1 of main's main: update tokio for RUSTSEC-2026-0386, and keep the block-proof acknowledgement bound from dropping a disposition poll's connection #781 (b9579c67): cargo update -p tokio --precise 1.53.3 in the root and fuzz directories. As on main: update tokio for RUSTSEC-2026-0386, and keep the block-proof acknowledgement bound from dropping a disposition poll's connection #781, cargo also moved the windows-sys edges of errno, quinn-udp, rustix and tempfile from 0.61.2 to 0.52.0. Those edits were dropped, so each lockfile changes only tokio's version and checksum, the same hunks main: update tokio for RUSTSEC-2026-0386, and keep the block-proof acknowledgement bound from dropping a disposition poll's connection #781 has. main: update tokio for RUSTSEC-2026-0386, and keep the block-proof acknowledgement bound from dropping a disposition poll's connection #781's disposition-poll change (part 2) is not included: it changes runtime behaviour and goes in the next release.

• Version: VERSION, [workspace.package].version and the workspace-member entries of both Cargo.lock files move to 3.1.0 (6 root and 3 fuzz entries), the same lines DO NOT MERGE without coordinator GO: 3.x.x: version 3.1.0-rc.1 and its release notes #774 bumped.

• doc/release-notes-3.1.0.md:

  • release date 2026-10-26;
  • changes since 3.1.0-rc.1, with advisory IDs;
  • upgrading from rc.1 (a binary swap, no migration);
  • upgrading from 3.0.0 or 3.0.0-rc.6: DO NOT MERGE without coordinator GO: 3.1 pre-migrate: rc.6 serves while 3.1's migrate applies 027, 028 and 031, and p0 is never rewritten #773's pre-migrate for 027, 028 and 031 while 3.0 serves, then the binary, then the optional dual-writer cutover. It cites the migration guide's 031 section, ledger-ops' node identity, peer sync and carry owner chapters, the configuration reference's dual-writer settings, and the readiness doc's balancer section;
  • rollback;
  • known issues carried from rc.1. All 15 are still open. Two are added: 3.0.x: L3 l3-full fails on v3.0.0: 2fe-async-3-blocks refuses one valid share per run (#716), and 2fe-sync-r3 falls 479 offers short #779 (L3 presets on 3.0.0's tree, 3.x.x: a share under a tip-change lease is refused 'commit gate closed' when the authority try_read meets a writer, which can drop a valid share's credit and fires PrismShareAppendFailures #716's class) and the acknowledgement bound's dropped pooled connection that main fixes in main: update tokio for RUSTSEC-2026-0386, and keep the block-proof acknowledgement bound from dropping a disposition poll's connection #781;
  • a line that 3.1.0-rc.1 has run the mainnet pair in dual-writer mode since 2026-10-20.

  The notes point to the rc.1 notes for the dual writer, its settings, migrations and known limits, as the rc notes chain to each other.

• Production wording: the README banner, the development-line note's Status, release identity, Not done yet and Upgrade and rollback sections, and the migration guide now say 3.x.x is the production line, to be deployed from the v3.1.0 tag. The wording follows the 3.0.x README and 3.0.x: version 3.0.0 and its release notes (#557) #776. The development-line note, the migration guide and docs/prism-ledger-ops.md link the 3.0.0 notes' D5 boundary at blob/v3.0.0/, because this branch's doc/release-notes-3.0.0.md is still the pre-release D5 contract. That file is left as it is (out of scope); the main consolidation can settle it.

Checked locally

• python3 scripts/check_version_skew.py: VERSION 3.1.0 matches every workspace crate: qbit-pool-builder, qbit-prism, qbit-prism-dual-sim, qbit-prism-load, qbit-prism-server, qbit-prism-test-gate.
• python3 scripts/check_prism_settings.py: PRISM setting inventories and operator guidance agree.
• python3 scripts/check_toolchain_pin.py: Rust 1.98.1 is pinned consistently across rust-toolchain.toml, Cargo.toml rust-version, every crate, lab/prism/Dockerfile.
• cargo metadata --locked passes for the root and fuzz workspaces.
• cargo deny --locked check (cargo-deny 0.20.2): advisories ok, bans ok, licenses ok, sources ok. As a control, origin/3.x.x fails advisories on RUSTSEC-2026-0386.
• cargo check --locked --workspace --all-targets compiles.
• Every relative link and anchor in the changed Markdown files resolves, and so does every blob/<ref>/ link at its ref.
• A read-only agent checked every claim in the notes against the tree, the tags and the cited PRs and issues. Its findings were fixed, except that the mainnet dual-writer sentence stays as the coordinator asked. Two local /code-review medium rounds followed, and their findings were fixed: wording and accuracy in the notes, the dev-line note and the migration guide. One was left as it is: the development-line note keeps its section structure ("Not done yet" and so on), as 3.0.x: version 3.0.0 and its release notes (#557) #776 did on 3.0.x.

The v3.1.0 tag message

Robert signs the tag; this PR creates none. The message follows v3.1.0-rc.1's style:

qbit-mining-bootstrap 3.1.0

The 3.1.0 release: 3.1.0-rc.1 plus two dependency updates for RustSec
advisories, rustls-webpki, webpki-roots and the fuzz lockfile's rustls
(#777: RUSTSEC-2026-0381, RUSTSEC-2026-0382 and RUSTSEC-2026-0346 to
-0349), and tokio 1.53.3 (RUSTSEC-2026-0386), with no runtime change
since rc.1. Against 3.0.0 it adds the 3.1 dual writer: node identity and
peer sync (#766), per-node window cuts (#768), carry owner and peer
settlement (#767), dual-writer readiness and Stratum gating (#769), the
dual-writer E2E simulation and CI (#763), and the proof that rc.6 keeps
serving while 3.1 pre-migrates (#773). The dual writer is off by
default; with PRISM_DUAL_WRITER unset, a frontend behaves as 3.0 does.
Every start requires migrations 027, 028 and 031; 031 builds its index
online. From 3.1.0-rc.1 the upgrade is a binary swap. Release notes:
doc/release-notes-3.1.0.md.

Before merging and tagging

• Coordinator GO, given 2026-10-26.
• Release date in the notes: 2026-10-26. Update it if the tag lands later.
• When this is squash-merged, set the subject without the "DO NOT MERGE without coordinator GO:" prefix.
• The GitHub release body copied from the notes needs every relative link rewritten to https://github.com/Qbit-Org/qbit-mining-bootstrap/blob/v3.1.0/... (the notes' links are relative, as in the rest of doc/).
• L3 on this PR: 3.0.x: L3 l3-full fails on v3.0.0: 2fe-async-3-blocks refuses one valid share per run (#716), and 2fe-sync-r3 falls 479 offers short #779 saw throughput-400k-window-2fe-async-3-blocks fail on 3.0.0's tree with 3.x.x: a share under a tip-change lease is refused 'commit gate closed' when the authority try_read meets a writer, which can drop a valid share's credit and fires PrismShareAppendFailures #716's refusal. rc.1's full run on DO NOT MERGE without coordinator GO: 3.x.x: version 3.1.0-rc.1 and its release notes #774 passed. If this PR's run fails there, it is a known issue, not this diff. The tag promotes this PR's run on a tree match (3.x.x: production-window matrix (L3) on the version bump, release-candidate, v* tags and weekly (#550) #608).
• The run-dual-writer-e2e label, which ran the full dual-writer matrix on DO NOT MERGE without coordinator GO: 3.x.x: version 3.1.0-rc.1 and its release notes #774, is not set here. Add it if the release evidence should include the matrix.
• After the tag: the main consolidation PR.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T19:06:18.171337Z	9b102dd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.