I2829 — An alpha is published as a pre-release end to end, and never becomes the latest release anywhere

Let a pre-release tag (vX.Y.Z-alpha.N, -beta.N, -rc.N) go through the release pipeline: the publish job publishes its tag file and leaves latest.json alone, the release smoke waits on that file, installs it pinned and requires latest.json to name another release, release-check holds a published pre-release to its record and orders versions by semantic-version precedence, and the installer installs a pre-release only by name.

DONE wave 0 · p0 · implementation profile · runs alone

Part of safe-self-update — Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked.

Objective

Why

Audit of 2026-10-17 before v1.0.0-alpha.1: once #1313 makes latest_stable stable-only, the derived latest.json keeps naming the stable release, so scripts/site-deploy --release-metadata (release.yml publish job) refused the alpha, the record proposal after it never ran, the smoke waited 15 minutes for latest.json to name the alpha and failed, and install-check --expect required the same. Every one failed closed; the obvious repair of a red alpha run was to make latest.json name the alpha. release-check ignored suffixed tags (an unrecorded alpha went unreported) and its sort -t. ranked 1.0.0-alpha.1 above 1.0.0. The installer resolved whatever latest.json named.

Current state

A pre-release tag cannot be published: the publish job and the smoke require latest.json to name it.

Desired state

A pre-release is published beside the latest release and installable by name; latest.json naming a pre-release is refused by site-deploy, the smoke, install-check and the installer.

Scope

scripts/site-deploy
scripts/ci/install-check
scripts/ci/release-check
share/install/install.sh.in
site/static/install.sh
.github/workflows/release.yml
test/cases/3222_an_alpha_publishes_beside_the_latest_release.sh
test/cases/3223_the_release_smoke_installs_an_alpha_pinned.sh
test/cases/3224_a_published_alpha_owes_its_record.sh
test/cases/3225_the_installer_takes_an_alpha_only_by_name.sh

Dependencies

None. This issue is a root of the graph.

Acceptance criteria

site-deploy --release-metadata of a pre-release changes only its tag file on gh-pages, and refuses a latest.json naming it
install-check --expect of a pre-release reads its tag file, installs it pinned, and refuses a site whose latest release is the pre-release
release-check reports a published pre-release with no record, ignores a tag whose suffix is not a pre-release, and ranks 1.0.0 above 1.0.0-alpha.1
install.sh refuses metadata that resolves to a pre-release it was not asked for by name, and resolves one asked for by name
release.yml's smoke waits on a pre-release's tag file and fails when latest.json names it

Validation

bash test/run.sh 3222_an_alpha_publishes_beside_the_latest_release 3223_the_release_smoke_installs_an_alpha_pinned 3224_a_published_alpha_owes_its_record 3225_the_installer_takes_an_alpha_only_by_name
bash scripts/ci/shell-lint

Evidence required

prerelease_cases
mutation_check

Evidence

covers	type	command	result	at commit
prerelease_cases	test	MJ_TEST_JOBS=4 bash test/run.sh 3222_an_alpha_publishes_beside_the_latest_release 3223_the_release_smoke_installs_an_alpha_pinned 3224_a_published_alpha_owes_its_record 3225_the_installer_takes_an_alpha_only_by_name 85_installer 86_installer_platform	tests: 6 passed, 0 failed (run 2026-10-17 ~18:35Z at 261c45caf74); regression 1041 3021 3029 97_install_gate 87 26 103 1087 green at 2d4131a4a99	261c45c
mutation_check	test	per assertion: mutate the fix, run its case, restore (scratchpad mutate.py)	9 of 9 mutations killed: site-deploy prerelease branch and latest refusal (3222); install-check latest refusal, pin flag, pinned install line (3223); release-check tag filter and semver precedence (3224); install.sh refusal at 2d4131a4a99 and again at 261c45caf74 (3225). release.yml smoke is untested by run: actionlint and shell-lint clean only.	261c45c

Timeline

started: 2026-10-17T18:38:11Z
verified: 2026-10-17T18:38:18Z
completed: 2026-10-17T18:38:30Z

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2829.yaml. Read it back with majordomus plan show I2829.