releaselisted

# Cutting a release For a Go module the tag *is* the release: once `proxy.golang.org` has served a version, its checksum is immutable and cannot be corrected. Retagging a version that anyone has fetched gives them a `SECURITY ERROR: checksum mismatch`, which looks like an attack rather than a mistake. So the order below matters — every check happens before the tag is pushed, not after. ## 1. The tree must be releasable ```bash git switch main && git pull --ff-only git status --porcelain # must be empty make lint # both tag sets make test-all # unit + integration, needs Docker ``` A dirty tree is the most common cause of tagging something that was never tested. Do not continue past a non-empty `git status`. ## 2. Check the pinned server is still current `.version` pins the `tile38/tile38:edge` digest the integration tests ran against. If upstream has moved, the suite just certified an old server: ```bash cat .version docker buildx imagetools inspect tile38/tile38:edge --format '{{.Manifest.Digest}}' ``` If they differ, bump `.version`, re-run `make test-integration`, and land that as its own change before releasing. The `Tile38 Upstream Check` workflow opens an issue when this drifts, so there may already be one open. ## 3. Check what the release breaks Run the `api-compat-reviewer` agent against the last tag. This module is public, so removed or renamed exported identifiers break consumers you cannot see. The result d