Publish the 0.22.0 and 0.23.0 GitHub Releases once Phase 10 closes the dependency channels

[dprada]

The 0.22.0 and 0.23.0 tags exist. Neither has a GitHub Release, and that is deliberate.

tag	commit	what it carries
0.22.0	a11b4cb0	the MolSysMT surface collapses onto whole and regions; the trajectory plot and movie playback watched drawing for the first time
0.23.0	fe64aa45	remote render sessions: server-side rendering, split sessions, Qt session stability, projected context menus

Why the tags stop where they do

Publishing a Release is not a formality here: per devguide/release_and_citation.md it "also starts Conda publication and Zenodo ingestion". Conda is the gate deferred to 1.0:

[BLOCKED]  conda   conda artefacts against final dependency versions
           gates 1-5 of Phase 10 are open: the UIBCDF dependency versions and
           channels are not closed, so conda artefacts cannot be built against
           final versions

Publishing would start building conda artefacts against dependencies nobody has frozen — the exact thing the gate refuses to certify — and would mint a Zenodo DOI, which does not come back.

So the tags mark the code and the Releases wait for the channels.

What the tags already give

Everything except distribution. pip install git+https://github.com/uibcdf/molsysviewer@0.23.0 works, versioningit reports a clean version, and the JS metadata is synced at each tag (de1dc4a6, b2109828).

State of the gate at each tag

Both: 9 passed, 0 failed, 2 blocked — every runnable step green, including the full Python suite with nothing deselected and every E2E suite in one browser. The two blocked are qt (needs a real screen, Phase 7) and conda (this issue).

One difference worth carrying into any Release decision. 0.23.0’s gate was cleared with an explicit E2E_ALLOW_SKIP=1, because its remote-session suite certifies server-side rendering on a GPU host and no machine we have can run it. Client-side rendering is certified; server-side rendering is not certified by anything (#84). Publishing 0.23.0 would distribute a capability nothing has watched work.

What closing this looks like

1. Phase 10 gates 1-5 close: UIBCDF dependency versions and channels frozen.
2. python devtools/release_gate.py clears, including conda, and qt is observed on a real screen.
3. For 0.23.0, resolve Server-side rendering has never been certified: remote-session cannot run on a host without a GPU #84 first or say plainly in the Release notes that server-side rendering is unverified.
4. Publish the Releases on the existing tags — they are not recreated. devguide/release_and_citation.md: "Never silently retag a published release."
5. Verify each Zenodo record and the npm runtime per the release guide.

The decision this issue exists to force

If 1.0 arrives before the channels are frozen, closing this may instead mean deciding that these tags never get Releases and their content ships under the 1.0 one. That is a decision, not a default — say so here rather than letting the tags go quiet.

Two tags now sit in this state. A third would be worth pausing over: a tag nobody can install from a channel is a marker for us, not a release for anyone else.

[dprada]

Correction to carry into 0.23.0's Release notes, if it gets one.

The tag's own message says "server-side rendering is not certified by anything". That was true when it was written and is no longer true. #84 was closed the next day by running the suite on spika:

MSV_EXPECTED_GPU_REGEX='NVIDIA GeForce GTX 1080' npm run test:e2e:remote-session
renderer: ANGLE (NVIDIA Corporation, NVIDIA GeForce GTX 1080/PCIe/SSE2, OpenGL ES 3.2)

It passed WebGL2 hardware rendering, 1080p video, workbench controls, trajectory, PNG/HTML export, upload, camera, worker recovery and authoritative picking. The capability row moved from contract-tested to contract-tested, browser-observed.

The tag is not recreated — devguide/release_and_citation.md is explicit about that, and the message was accurate at fe64aa45. This is the place the correction lives instead.

Two things to keep straight when writing those notes:

• The evidence is site evidence for spika, not a portability claim for every deployment. That is how Server-side rendering has never been certified: remote-session cannot run on a host without a GPU #84 recorded it and how the row reads. A Release note saying "server-side rendering works" would overstate what was measured; "certified on an NVIDIA GTX 1080 host" is what happened.
• The gate that cleared this tag still ran with E2E_ALLOW_SKIP=1, because it ran here, where the suite cannot execute. The certification came afterwards on another machine. Both facts belong in the record; neither cancels the other.

Timeline: tag fe64aa45 on 2026-09-05, certification 09ec5178 on 2026-09-06.