docs(specs): 018 record the v0.3.0 release and close out tasks

specs/018-v0-3-release-readiness/audit/evidence/final-validation.txt

@@ -0,0 +1,48 @@
+# T075 final validation (quickstart.md § Final validation)
+# master after v0.3.0 tag; run 2026-10-06
+
+$ grep -cE '\| (untested|fail) \|' inventory.md                               # expect 0
+8
+$ grep -cE '\| (imported|open|fixing|fixed-unverified) \|' findings.md        # expect 0
+291
+$ grep -cE '\| (not-started|in-review) \|' coverage.md                        # expect 0
+0
+$ grep -E '\| blocked \|' inventory.md   # each row must appear under "Not live-verified" in report.md
+INV-CRD-029
+INV-CRD-030
+INV-AUX-009
+INV-AUX-010
+INV-AUX-011
+INV-AUX-012
+INV-AUX-013
+INV-MOD-033
+INV-MOD-034
+INV-MOD-035
+INV-MOD-036
+INV-MOD-049
+INV-MOD-050
+INV-MOD-051
+INV-MOD-052
+INV-MOD-053
+INV-MOD-054
+INV-MOD-055
+INV-MOD-056
+
+# Cross-check: every blocked row ID above appears in report.md: 0 missing
+
+# Status breakdown of the blocking findings count:
+    229 | fixed-unverified |
+     25 | imported |
+     37 | open |
+
+# Untested inventory rows:
+INV-UPG-001
+INV-UPG-002
+INV-UPG-003
+INV-UPG-004
+INV-UPG-005
+INV-NODE-001
+INV-NODE-002
+INV-NODE-003
+
+# Result: checks 1 and 2 do not meet the expected values (RC-01 and RC-03, not met, accepted as known risk at the go decision: T070, report.md#decision). Checks 3 and 4 pass. No inventory row is `fail`.

specs/018-v0-3-release-readiness/audit/release-criteria.md

@@ -11,7 +11,7 @@ Written before round 0 (FR-015). Columns are fixed by [contracts/audit-records.m
 | RC-05 | Live beta.8 → RC upgrade with zero data loss and zero lost accounts | SC-005, OD-005 | [inventory.md#upg](inventory.md#upg) | not met (accepted risk, T070) |
 | RC-06 | The baseline snapshot matches the post-cleanup snapshot, with zero `audit018-` resources remaining | SC-006 | [rounds.md](rounds.md), [kubelab-baseline.md](kubelab-baseline.md) | not met (accepted risk, T070) |
 | RC-07 | Every `not-a-defect` and `out-of-scope` closure is justified, and each out-of-scope one cites a roadmap line | SC-009 | [findings.md](findings.md) | partially (accepted risk, T070) |
-| RC-08 | CI is green on the tagged commit | FR-017 | [rounds.md#v030](rounds.md#v030) | pending (set after the v0.3.0 tag, T073) |
+| RC-08 | CI is green on the tagged commit | FR-017 | [rounds.md#v030](rounds.md#v030) | pending (the `ci` push run on the tagged commit was cancelled by later merges and is being re-run; the PR head it merges, #587 `23c23401`, passed the full `ci` run) |
 
 ## Change log
 

specs/018-v0-3-release-readiness/audit/rounds.md

@@ -140,3 +140,41 @@ Informal live feature sweep of `master`, recorded after the fact from the descri
 ### Test resources
 
 Not recorded.
+
+## v0.3.0
+
+Release record for the public `v0.3.0` tag (T073). The maintainer chose to skip rc.2 and tag `v0.3.0` directly after the go decision ([report.md#decision](report.md#decision)).
+
+- **Tag**: `v0.3.0`, annotated, tag object `d6f7a9afc1e2480da928b6418b8dcb438bb5866b`, tagger valgulnecron, 2026-10-06T04:03:41Z, pointing at commit `040e10ee16253f6ead593bd076ed90835b68e2c1` (merge of [#587](https://github.com/ValgulNecron/Gameplane/pull/587)). GitHub reports the tag object as signature-verified; OD-013 asked for an unsigned tag, but a signed tag does not change the release pipeline.
+- **Module ref**: the chart default `ref: v0.3.0` resolves to `gameplane-module` tag `v0.3.0` (tag object `bca8143ddaac15cd392fe709a2e288156564dd89`, commit `b42eea2f051b7b4b416758d7c9763843ac32c146`, the commit the `modules` submodule points at on master).
+
+### Release run
+
+`release.yaml` run [37411911079](https://github.com/ValgulNecron/Gameplane/actions/runs/37411911079), event `push`, head `040e10ee16253f6ead593bd076ed90835b68e2c1`, 2026-10-06T04:03:44Z to 04:10:54Z. Conclusion: **success**, every job green (the F-257 timeout from rc.1 did not recur).
+
+| Job | Conclusion |
+|-----|------------|
+| build & push images: agent, api, audit-syslog-bridge, capture-sidecar, mcp-server, operator, sentinel, telemetry-receiver, web | success |
+| build & push images: tunnel-frp, tunnel-playit, tunnel-tailscale | success |
+| push & sign module bundles | success |
+| package Helm chart | success |
+| publish GitHub release | success |
+
+### Checks (contracts/rc-deploy.md §1)
+
+| Check | Result |
+|-------|--------|
+| Images signed | Each image job ran `sign image (keyed, logged)` and `verify signature & check published key`, both success. For `api`, the cosign signature manifest `sha256-ccbe2975….sig` exists in GHCR for the release digest. |
+| Chart signed | `sign chart (keyed, logged)` and `verify chart signature` success; `oci://ghcr.io/valgulnecron/charts/gameplane` lists tag `0.3.0`. |
+| GitHub release not prerelease | [Release v0.3.0](https://github.com/ValgulNecron/Gameplane/releases/tag/v0.3.0), published 2026-10-06T04:10:51Z: `prerelease: false`, `draft: false`, and it is the repository's latest release. |
+| Notes from `## [0.3.0]` | The release body opens with the `## [0.3.0]` section text of `CHANGELOG.md` at the tag ("The first Gameplane release without a pre-release suffix…"). |
+| `0.3` image tag | `ghcr.io/valgulnecron/gameplane/api` tags `0.3.0`, `v0.3.0`, `0.3` and `latest` all resolve to digest `sha256:ccbe29755dd72fe191f97f0a3bc36e13bd672d6578e659272c9cb0be64198ae3`. |
+| CI on the tagged commit (RC-08) | The `ci` push run on `040e10e` ([37411539484](https://github.com/ValgulNecron/Gameplane/actions/runs/37411539484)) was cancelled by `cancel-in-progress` when later PRs merged into master. The PR head it merges ([#587](https://github.com/ValgulNecron/Gameplane/pull/587), `23c23401`) passed the full `ci` run (19 jobs passed, 0 failed); see RC-08 in [release-criteria.md](release-criteria.md) for the re-run. |
+
+### Other tag-triggered workflows
+
+- `screenshot refresh` run [37411911070](https://github.com/ValgulNecron/Gameplane/actions/runs/37411911070) failed (3 of 139 gallery shots: `mods-registry-browse`, `server-console`, `server-detail-logs`). It has failed on every run since 2026-09-06, including `v0.3.0-rc.1`; it does not publish release artifacts and is not a release criterion.
+
+### Test resources
+
+None created.