Finalize CellScript 0.24 release hardening

Author: a19q3

BRANCHES.md

@@ -8,15 +8,12 @@ discussions. Do not use that historical baseline to describe the current
 
 ## nightly-0.24
 
-`nightly-0.24` is the active release-candidate line for independently verified
+`nightly-0.24` is the closed maintenance line for independently verified
 artifacts and executable package evidence. It builds on the closed 0.23
-Edition 2026 and native-tooling boundary. The stable release boundary will be
-the exact `v0.24.0` tag only after the compiler, checker, Registry worker,
-executable tests, source maps, docs, and the `dev`, `ci`, `backend`, and
-`release` gates agree on the final source. Until then, passing candidate gates
-is evidence, not a stable-release claim. External Myelin, Fiber, and RGB++
-claims remain separately evidence gated as described in the 0.24 release
-notes.
+Edition 2026 and native-tooling boundary. The stable release boundary is the
+exact `v0.24.0` tag; later commits on the branch are not implicitly part of
+that release. External Myelin, Fiber, and RGB++ claims remain separately
+evidence gated as described in the 0.24 release notes.
 
 ## nightly-0.23
 
@@ -39,18 +36,19 @@ nightly branch name.
 comparisons and an exact nightly branch for development-scope comparisons;
 do not infer release evidence from `main` alone.
 
-## v0.24.0 (reserved)
+## v0.24.0
 
-`v0.24.0` is reserved for the final 0.24 source and has not been issued. Do not
-use the name as a stable comparison until the final tag exists. The eventual
-release will not by itself promote the separately pending Myelin, Fiber, or
-RGB++ external evidence boundaries.
+`v0.24.0` is the current stable release for the verified-artifact checker,
+executable package scenarios, lock-authoritative package graph, and LS-IDL
+Registry path. Use the exact tag ref `refs/tags/v0.24.0` for stable
+comparisons. The release does not promote the separately pending Myelin,
+Fiber, or RGB++ external evidence boundaries.
 
 ## v0.23.0
 
-`v0.23.0` remains the current stable baseline for Edition 2026, the Registry,
-and native release tooling. Use the exact tag ref `refs/tags/v0.23.0` for
-stable comparisons while 0.24 remains a release candidate.
+`v0.23.0` is the historical stable baseline for Edition 2026, the Registry,
+and native release tooling. Use the exact tag ref `refs/tags/v0.23.0` when
+reproducing that release.
 
 ## v0.22.0
 

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 0.24.0 - Unreleased
+## 0.24.0 - 2026-08-22
 
 - Align the complete 0.24 release identity across every workspace and verifier
   crate, the independent checker dependency, lockfiles, Registry Type Script,
@@ -16,6 +16,12 @@
   collection, expression, frame, runtime, schema, and Cell-operation modules;
   remove crate-wide Clippy exemptions; and replace long positional helper
   signatures with named context records.
+- Harden the final wide-integer boundary: resolve dynamic Molecule-backed
+  `u128` fields before loading limbs, preserve the left operand across a
+  second dynamic load, and make `u128 +/- u64` overflow and underflow fail
+  closed with runtime error 49. Add exact CKB-VM regression vectors, remove
+  zero-divisor paths from the NFT and vesting examples, and reject
+  non-canonical SemVer at Registry admission.
 - Remove the CKB adapter's deprecated, permanently fail-closed automatic
   deployment methods. Callers must build a verified unsigned deployment
   transaction and hand signing to an external wallet.
@@ -33,13 +39,12 @@
   origins, chain selection, sandbox expiry, no-index policy, and storage remain
   isolated.
 - Preserve the corrected website release lineage that removed stale 0.22
-  metadata. While 0.24 remains untagged, keep the homepage on the published
-  `v0.23.0` release and prepare the Playground with the 0.24 candidate
-  compiler. The canonical WASM bundle uses asset identity
-  `20260819-v0.24.0-19ce8898` and SHA-256
+  metadata. Publish the homepage as `v0.24.0` while keeping the Playground on
+  the matching 0.24 compiler identity. The canonical WASM bundle uses asset
+  identity `20260819-v0.24.0-19ce8898` and SHA-256
   `19ce8898e8161f100edebf6f982d856f3e59bfac31572642b53f2e01c70a1a17`;
   distribution checks bind the current stable release URL and displayed tag
-  separately from the candidate compiler version, asset identity, and digest.
+  separately from the compiler version, asset identity, and digest.
   Remove inherited 0.25-only package-interface, typed-semantics, and future-
   syntax presentation fields from the 0.24 website branch while retaining the
   0.24 LS-IDL surface. Publish the exact 0.24 and 0.25 website gitlinks on

README.md

@@ -4,7 +4,7 @@
 </p>
 
 [![CellScript CI](https://github.com/CellScript-Labs/CellScript/actions/workflows/ci.yml/badge.svg)](https://github.com/CellScript-Labs/CellScript/actions/workflows/ci.yml)
-[![Release: v0.23.0](https://img.shields.io/badge/release-v0.23.0-2f6f4e.svg)](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.23.0)
+[![Release: v0.24.0](https://img.shields.io/badge/release-v0.24.0-2f6f4e.svg)](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.24.0)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE-MIT)
 [![Rust 1.97.1](https://img.shields.io/badge/rust-1.97.1-orange.svg)](Cargo.toml)
 [![Targets: CKB](https://img.shields.io/badge/targets-CKB-2f6f4e.svg)](#target-profiles)
@@ -20,9 +20,9 @@ artifacts, together with typed metadata for auditing, policy checks, schema
 binding, and scheduler-aware execution.
 
 The current stable release is
-[CellScript v0.23.0](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.23.0).
+[CellScript v0.24.0](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.24.0).
 The [0.24 release notes](docs/releases/CELLSCRIPT_0_24_RELEASE_NOTES.md)
-describe the active release candidate and are not yet a stable-release claim.
+describe its verified-artifact, executable-test, and integration boundaries.
 The [0.24 roadmap](roadmap/CELLSCRIPT_0_24_ROADMAP.md) records its independently
 checked artifact, executable-test, and explicitly deferred ecosystem
 boundaries.
@@ -119,15 +119,15 @@ curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scr
 Or pin a specific version:
 
 ```bash
-CELLSCRIPT_VERSION=0.23.0 curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scripts/install.sh | sh
+CELLSCRIPT_VERSION=0.24.0 curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scripts/install.sh | sh
 ```
 
 The release page publishes `SHA256SUMS` alongside all four platform archives.
 
 Build the exact published source instead:
 
 ```bash
-git clone --branch v0.23.0 --depth 1 https://github.com/CellScript-Labs/CellScript.git
+git clone --branch v0.24.0 --depth 1 https://github.com/CellScript-Labs/CellScript.git
 cd CellScript
 cargo install --locked --path .
 ```

docs/releases/CELLSCRIPT_0_24_RELEASE_NOTES.md

@@ -1,13 +1,13 @@
 # CellScript 0.24 Release Notes
 
-**Status**: stable-release candidate on `nightly-0.24`; no final tag or release
-date has been issued. Candidate `dev`, `ci`, `backend`, and `release` evidence
-is recorded in the validation section. The refreshed iCKB
+**Status**: stable release at `refs/tags/v0.24.0`. Final `dev`, `ci`, `backend`,
+`release-quick`, and `release` evidence is recorded in the validation section.
+The refreshed iCKB
 evidence submodule commit `0e18ccd97bd75cac7de9211dc8d344c0bc08942f` is
 published and bound by the parent gitlink. External ecosystem claims remain
 limited to the explicit integration status below.
 
-**Release date**: TBD
+**Release date**: 2026-08-22
 
 **Source edition**: 2026
 
@@ -171,23 +171,23 @@ not claim to emit or execute a production ELF.
 
 ## Website Release Identity
 
-The 0.24 website carries forward the corrected release boundary. While the
-candidate remains untagged, its homepage continues to name `v0.23.0` as the
-current stable release, while its Playground worker, compiler sample, and
-distribution checks prepare the 0.24 compiler identity. Its 0.24 release
-branch removes the forward-looking 0.25-only package-interface,
-typed-semantics, and syntax-highlighting presentation fields; those remain
-outside the 0.24 release. The canonical Playground asset is
+The 0.24 website carries forward the corrected release boundary. Its homepage
+names `v0.24.0` as the current stable release, while its Playground worker,
+compiler sample, and distribution checks use the matching 0.24 compiler
+identity. Its 0.24 release branch removes the forward-looking 0.25-only
+package-interface, typed-semantics, and syntax-highlighting presentation
+fields; those remain outside the 0.24 release. The canonical Playground asset
+is
 `20260819-v0.24.0-19ce8898`; its WASM SHA-256 is
 `19ce8898e8161f100edebf6f982d856f3e59bfac31572642b53f2e01c70a1a17`.
 The raw module is 1,485,936 bytes and 567,048 bytes under the gate's gzip
 measurement, below the 600 KiB budget.
 
 The Node 22 website build validates both production and Pudge Testnet outputs,
-the six-route byte-identical asset parity boundary, the current `v0.23.0`
-release URL and tag, the candidate compiler asset identity, and the exact WASM
-digest. The parent repository pins website commit
-`dd4e895bd0a68b6fa63bc59c6377b7db0864cd76` on the published
+the six-route byte-identical asset parity boundary, the current `v0.24.0`
+release URL and tag, the compiler asset identity, and the exact WASM digest.
+The parent repository pins website commit
+`9849c0cb051439901bd3d9c01bd6ba58e8e40751` on the published
 `codex/nightly-0.24-release` branch.
 
 The 0.25-only Playground verification surface remains on the separate
@@ -227,6 +227,14 @@ grid, clearer evidence hierarchy, refined substrate material, and the restored
 homepage brand animation. These presentation changes do not alter Registry
 evidence semantics or the mainnet/testnet isolation boundary.
 
+Final release hardening resolves dynamic Molecule-backed `u128` pointers once
+before limb loads and spills the first wide operand while loading the second,
+so schema validation cannot overwrite live arithmetic state. Mixed
+`u128 +/- u64` operations now reject overflow and underflow with runtime error
+49. Exact CKB-VM vectors cover both boundaries. Registry admission now rejects
+non-canonical SemVer forms such as leading-zero core or numeric prerelease
+identifiers.
+
 ## Integration Status
 
 - The CellScript side of the Myelin 0.24 handoff is versioned and tested. The
@@ -353,10 +361,9 @@ or conversion of executable/copy artifacts into source dependencies.
 
 ## Validation
 
-The release-candidate snapshot at commit
-`b90c4b562cceb95059bf410c617c920fa2483570` passed all five canonical gates on
-the validation date 2026-08-20. This validation date is not the release date.
-The environment used Rust `1.97.1`, Node `22.23.2`, CKB revision
+The exact source identified by `refs/tags/v0.24.0` passed all five canonical
+gates on the release date 2026-08-22. The environment used Rust `1.97.1`, Node
+`22.23.2`, CKB revision
 `f7fa4436737756f97a24e254f22c13a36316ecea`, CKB SDK `v5.1.0`, the
 `riscv64imac-unknown-none-elf` target, and the pinned Docker base
 `rust:1.97.1-slim-bookworm@sha256:99e09cb2284e2ddbb73a995deee3e91783fd04d177602ccf6eab326d778ee777`:
@@ -393,10 +400,7 @@ The canonical website build produced the 0.24 WASM identity recorded above and
 passed the 600 KiB gzip budget. Gates establish source and artifact evidence;
 they do not publish either crates.io package or deploy the Registry Type
 Script. Publication and deployment remain explicit release-operator actions
-and must preserve the validated source and artifact identities. Because the
-candidate remains open to change, the final operator must rerun the required
-gates on the exact source that receives `v0.24.0`; the tag and release date
-remain unset until then.
+and must preserve the validated source and artifact identities.
 
 ## Detailed References
 

services/registry-api/src/domain.ts

@@ -378,8 +378,13 @@ export function validatePackageIdent(value: string, field: string): string {
 
 export function validateVersion(value: string): string {
   const trimmed = value.trim();
-  if (!/^[0-9]+[.][0-9]+[.][0-9]+(?:[-+][0-9A-Za-z.-]+)?$/.test(trimmed)) {
-    throw new ApiError(400, "invalid_version", "version must be semver-like");
+  const match = /^(0|[1-9][0-9]*)[.](0|[1-9][0-9]*)[.](0|[1-9][0-9]*)(?:-([0-9A-Za-z-]+(?:[.][0-9A-Za-z-]+)*))?(?:[+]([0-9A-Za-z-]+(?:[.][0-9A-Za-z-]+)*))?$/.exec(trimmed);
+  if (!match) {
+    throw new ApiError(400, "invalid_version", "version must be valid SemVer");
+  }
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((identifier) => /^[0-9]+$/.test(identifier) && identifier.length > 1 && identifier.startsWith("0"))) {
+    throw new ApiError(400, "invalid_version", "numeric SemVer prerelease identifiers must not contain leading zeroes");
   }
   return trimmed;
 }

services/registry-api/test/registry-api.test.ts

@@ -33,6 +33,7 @@ import {
   sha256Hex,
   validatePublishPayload,
   validateArtifactDescriptor,
+  validateVersion,
   type CapabilityAuthorisationPayload,
   type CapabilityRevocationPayload,
   type AvailabilityPayload,
@@ -95,6 +96,20 @@ describe("capability scopes", () => {
   });
 });
 
+describe("SemVer admission", () => {
+  it("accepts canonical release, prerelease, and build metadata forms", () => {
+    expect(validateVersion("0.24.0")).toBe("0.24.0");
+    expect(validateVersion("1.2.3-rc.1+build.7")).toBe("1.2.3-rc.1+build.7");
+  });
+
+  it.each(["01.2.3", "1.02.3", "1.2.03", "1.2.3-01", "1.2.3-rc..1", "1.2.3+"])(
+    "rejects non-canonical version %s",
+    (version) => {
+      expect(() => validateVersion(version)).toThrow(ApiError);
+    },
+  );
+});
+
 function bytesHex(value: Uint8Array): string {
   return `0x${[...value].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }

src/codegen/expr.rs

@@ -190,10 +190,7 @@ impl CodeGenerator {
             self.emit_fail(CellScriptRuntimeError::FixedByteComparisonUnresolved);
             return;
         };
-        if !self.emit_u128_operand_limbs("t0", "t1", "t6", "t4", left, "u128 arithmetic left") {
-            return;
-        }
-        if !self.emit_u128_operand_limbs("t2", "t3", "t6", "t5", right, "u128 arithmetic right") {
+        if !self.emit_u128_binary_operand_limbs(left, right, "u128 arithmetic") {
             return;
         }
         let ok_label = self.fresh_label("u128_arithmetic_ok");
@@ -237,10 +234,7 @@ impl CodeGenerator {
     }
 
     fn emit_u128_compare(&mut self, dest: &IrVar, op: BinaryOp, left: &IrOperand, right: &IrOperand) {
-        if !self.emit_u128_operand_limbs("t0", "t1", "t6", "t4", left, "u128 compare left") {
-            return;
-        }
-        if !self.emit_u128_operand_limbs("t2", "t3", "t6", "t5", right, "u128 compare right") {
+        if !self.emit_u128_binary_operand_limbs(left, right, "u128 compare") {
             return;
         }
         self.emit("# cellscript abi: u128 compare high limb first");
@@ -292,10 +286,7 @@ impl CodeGenerator {
             self.emit_fail(CellScriptRuntimeError::FixedByteComparisonUnresolved);
             return;
         };
-        if !self.emit_u128_operand_limbs("t0", "t1", "t6", "t4", left, "u128 multiplication left") {
-            return;
-        }
-        if !self.emit_u128_operand_limbs("t2", "t3", "t6", "t5", right, "u128 multiplication right") {
+        if !self.emit_u128_binary_operand_limbs(left, right, "u128 multiplication") {
             return;
         }
         self.emit("# cellscript abi: checked u128 multiplication");
@@ -347,10 +338,7 @@ impl CodeGenerator {
             self.emit_fail(CellScriptRuntimeError::FixedByteComparisonUnresolved);
             return;
         };
-        if !self.emit_u128_operand_limbs("t0", "t1", "t6", "t4", left, "u128 division numerator") {
-            return;
-        }
-        if !self.emit_u128_operand_limbs("t2", "t3", "t6", "t5", right, "u128 division denominator") {
+        if !self.emit_u128_binary_operand_limbs(left, right, "u128 division") {
             return;
         }
         self.emit("# cellscript abi: checked u128 division by restoring long division");

src/codegen/frame.rs

@@ -1063,17 +1063,12 @@ impl CodeGenerator {
             self.emit_store_u128_pointer_for_var(dest.id, dest_offset);
             return true;
         }
-        let Some(source) = self.expected_u128_source(src) else {
-            self.emit("# cellscript abi: u128 source is not addressable; fail closed");
-            self.emit_fail(CellScriptRuntimeError::FixedByteComparisonUnresolved);
-            return true;
-        };
-        self.emit_prepare_fixed_byte_source(&source, 16, "u128 materialize");
         self.emit(format!("# cellscript abi: materialize u128 operand into var{}", dest.id));
-        for byte_index in 0..16 {
-            self.emit_fixed_byte_source_byte_to("t0", "t4", &source, byte_index);
-            self.emit_store_byte_to_stack_offset("t0", dest_offset + byte_index);
+        if !self.emit_u128_operand_limbs("t0", "t1", "t6", "t4", src, "u128 materialize") {
+            return true;
         }
+        self.emit_stack_store("t0", dest_offset);
+        self.emit_stack_store("t1", dest_offset + 8);
         self.emit_store_u128_pointer_for_var(dest.id, dest_offset);
         true
     }
@@ -1111,8 +1106,37 @@ impl CodeGenerator {
             return false;
         };
         self.emit_prepare_fixed_byte_source(&source, 16, context);
-        self.emit_u64_le_from_fixed_byte_source(low_reg, scratch_reg, base_reg, &source, 0);
-        self.emit_u64_le_from_fixed_byte_source(high_reg, scratch_reg, base_reg, &source, 8);
+        if self.emit_fixed_byte_source_pointer_to(base_reg, &source) {
+            // Resolve schema-backed pointers before either accumulator is
+            // live. Dynamic Molecule bounds checks use t0..t5 internally, so
+            // resolving the pointer for every byte would overwrite the limb
+            // being assembled.
+            self.emit_unaligned_scalar_load(base_reg, low_reg, scratch_reg, 0, 8);
+            self.emit_unaligned_scalar_load(base_reg, high_reg, scratch_reg, 8, 8);
+        } else {
+            // Constants intentionally have no addressable storage.
+            self.emit_u64_le_from_fixed_byte_source(low_reg, scratch_reg, base_reg, &source, 0);
+            self.emit_u64_le_from_fixed_byte_source(high_reg, scratch_reg, base_reg, &source, 8);
+        }
+        true
+    }
+
+    pub(super) fn emit_u128_binary_operand_limbs(&mut self, left: &IrOperand, right: &IrOperand, context: &str) -> bool {
+        if !self.emit_u128_operand_limbs("t0", "t1", "t6", "t4", left, &format!("{} left", context)) {
+            return false;
+        }
+        let left_low_offset = self.runtime_expr_temp_offset(0);
+        let left_high_offset = self.runtime_expr_temp_offset(1);
+        self.emit_stack_store("t0", left_low_offset);
+        self.emit_stack_store("t1", left_high_offset);
+        if !self.emit_u128_operand_limbs("t2", "t3", "t6", "t5", right, &format!("{} right", context)) {
+            return false;
+        }
+        // Loading a dynamic schema field runs Molecule validation that uses
+        // t0/t1. Restore the left limbs only after the right operand is fully
+        // materialized.
+        self.emit_stack_load("t0", left_low_offset);
+        self.emit_stack_load("t1", left_high_offset);
         true
     }