release: 5.3.0

[Masterplanner25]

Steps 1–5 of the release sequence in CLAUDE.md. Stops at the tag — nothing
is published by merging this.

What 5.3.0 is

Seven issues, one theme: a declaration either binds or is refused where it is
written. Each surface accepted something that read as a decision and enforced
none of it.

Issue	Was
#473	a CapabilityPolicy denying everything denied nothing outside the four sandbox flags
#478	SyscallSpec.capability published by syscall_list(), read by nothing
#467	FS_READ declared and attached to nothing; allowed_paths had no write dimension
#490	nodus.toml accepted any table and discarded what it did not read
#492	an unhonoured worker: ran in-process and reported success
#471 / #537	a conditional edge rendered identically to an unconditional one

Not purely additive

A nodus.toml declaring unknown tables used to load and now does not (#490).
Strictly that makes previously-"working" input fail, so it is the one thing in
5.3.0 a reader should not assume is safe. It is recorded in the SemVer policy
section rather than left to be discovered.

I shipped it as a refusal rather than the warn-then-error staging used for
worker: (#492) and concurrent writes (#547), because a manifest is
configuration read once at load rather than behaviour observed during a run, and
a warning there is read by nobody. The fix is one word in the cases seen, and the
error says which word. Happy to restage it if you'd rather.

The version-claim sweep

The --versions gate found 8 stale claims after the bump — llms.txt,
llms-full.txt, CLAUDE.md ×3, ECOSYSTEM_READINESS_ASSESSMENT.md ×3. All
fixed in this commit, which is the point of running it after step 2 rather than
only in step 1, where it passes by definition.

README.md's "Recent:" paragraph is rewritten now, before the tag, because
readme = "README.md" makes it the permanent PyPI page and release immutability
makes a later fix impossible.

Gate 10b probes, written before the tag

Extended with nine 5.3.0 claims and run against the dev tree. They caught one
real stale artifact that no other gate could see:

ECOSYSTEM_COVERAGE_ANALYSIS.md still recorded SyscallSpec.capability as
"declarative metadata, never enforced" — which #478 had made false.

Corrected here. That is the second cycle running where the pre-tag prose
probe caught something after every code gate was green.

Two probe fixes worth keeping:

• CHANGELOG.md is excluded from the stale-prose sweep. It flagged the 5.3.0
  entries describing what was fixed — recording what was is a changelog's job.
• The reporter reconfigures stdout to utf-8. It crashed on cp1252 while
  printing a real finding, turning a caught defect into a traceback. A probe that
  dies while reporting is worse than no probe.

  package   C:\dev\Coding Language\src\nodus
  version   5.3.0
24/24 probes passed

Gates

• Full suite: 2,623 passed, 3 skipped
• ruff check src/ tests/ — clean · mypy src/nodus/ — clean
• nodus_gate --all — PASS (135/135 symbols, 245/245 doc blocks, 26/26 opcodes)
• nodus_gate --closed-issues --section 5.3.0 — 7/7
  (the plain --all run reports 0 of 0 against the now-empty [Unreleased],
  which is exactly the vacuous pass step 4 exists to catch)
• nodus_gate --versions — 11/11 agree with 5.3.0

Known follow-up

nodus_gate --consumers reports nodus-run-action needs republishing — its
README pins a nodus-lang version and that pin is what new users copy. It cannot
be done until the release is live, so it is Stage 6 work (step 12).
nodus-vscode is unaffected: no keywords changed.

🤖 Generated with Claude Code