fix(playbooks): 3.0.1 herald reinstall, and two guards that were release-hostile

Reinstalls althing-core on nh3-extdev for 3.0.1 (the pane-route fix) and
restarts the herald. Both boxes verified BY CONTENT rather than by
version string -- forseti's own checks, grep for _PANE_ID and _live_pid,
because a dist-info directory records what was installed, not what the
files contain. Both went 0 -> 3 and 0 -> 2.

Two bugs in the playbook this run exposed, both of which only appear on
the second use:

The install step was gated on `postbox` not existing. That guard was
correct for the cutover, when postbox genuinely was absent, and wrong
for every release after it -- postbox exists now, so a version bump
would have silently skipped the install and the playbook would have
reported success having done nothing. `--force` already makes the
reinstall idempotent, so the guard bought nothing and cost correctness.

The post_office variable still pointed at nh3-dev, three hours after the
post office moved to nh3-docker. It failed in the verify rather than at
install time, which reads as a broken deploy rather than as a stale
constant. Worth noting the failure message was the outage semantics
working exactly as designed: "This is an outage, not an answer: do not
treat it as 'no mail'."

playbooks/nh3-extdev-althing-v3.yaml

@@ -1,4 +1,4 @@
-# nh3-extdev: cut the system-wide althing install over from v2.1.0 to v3.0.0 (U9b flag day).
+# nh3-extdev: cut the system-wide althing install over from v2.1.0 to v3.0.x (U9b flag day; re-run for each release).
 #
 # nh3-extdev is the one box a `git pull` cannot move: althing lives there as a system WHEEL
 # under /opt/uv-tools/althing-core with entry points in /usr/local/bin, installed from a wheel
@@ -19,17 +19,19 @@
 # Rerunnable: a second run shows the install and unit steps skipped.
 
 vars:
-  wheel_src: /home/lkraven/development/althing/dist/althing_core-3.0.0-py3-none-any.whl
+  wheel_src: /home/lkraven/development/althing/dist/althing_core-3.0.1-py3-none-any.whl
-  wheel_dest: /tmp/althing_core-3.0.0-py3-none-any.whl
+  wheel_dest: /tmp/althing_core-3.0.1-py3-none-any.whl
   uv: /home/infra-ops/.local/bin/uv
   tool_dir: /opt/uv-tools
   bin_dir: /usr/local/bin
-  post_office: http://10.100.10.50:8390
+  # ⚠ Moved off nh3-dev 2026-08-28. A stale value here does not fail loudly at
+  # install time — it fails in the VERIFY, which then reads as a broken deploy.
+  post_office: http://10.100.50.40:8390
 
 steps:
   - name: Stage the v3.0.0 wheel
     upload:
-      src: /home/lkraven/development/althing/dist/althing_core-3.0.0-py3-none-any.whl
+      src: /home/lkraven/development/althing/dist/althing_core-3.0.1-py3-none-any.whl
       dest: "{{ wheel_dest }}"
       mode: "0644"
 
@@ -41,9 +43,11 @@ steps:
     shell: sudo systemctl disable --now althing-herald.service althing-receiver.service
     when: "systemctl is-active --quiet althing-herald.service || systemctl is-active --quiet althing-receiver.service"
 
-  - name: Install althing-core 3.0.0 over the system wheel install
+  - name: Install the staged althing-core wheel over the system wheel install
+    # NOT gated on `postbox` existing — that guard was right for the cutover and
+    # wrong for every release after it: postbox exists now, so a version bump would
+    # silently skip. `--force` makes the reinstall idempotent on its own.
     shell: sudo env UV_TOOL_DIR={{ tool_dir }} UV_TOOL_BIN_DIR={{ bin_dir }} {{ uv }} tool install --force {{ wheel_dest }}
-    when: "! {{ bin_dir }}/postbox --help >/dev/null 2>&1"
 
   - name: Install the post-office herald as a system unit
     # A system unit rather than a user unit because that is how v2 was supervised here and
@@ -74,8 +78,8 @@ steps:
       sudo systemctl daemon-reload
     when: "! test -f /etc/systemd/system/althing-po-herald.service"
 
-  - name: Enable and start the herald
+  - name: Enable and (re)start the herald so it picks up the new code
-    shell: sudo systemctl enable --now althing-po-herald.service
+    shell: sudo systemctl enable --now althing-po-herald.service && sudo systemctl restart althing-po-herald.service
 
 verify:
   - name: postbox is installed and is v3
@@ -102,3 +106,11 @@ verify:
     # check fails on identity, not on reachability, and reads as a deployment fault.
     shell: ALTHING_POST_OFFICE={{ post_office }} {{ bin_dir }}/postbox --handle operator handles | wc -l | awk '{ if ($1 >= 70) exit 0; else exit 1 }'
     changed_when: "false"
+
+  - name: The 3.0.1 pane-route fix is present BY CONTENT, not by version string
+    # forseti's own checks. A dist-info directory records what was installed, not
+    # what the files contain — verify the code, not the label.
+    shell: |
+      SP={{ tool_dir }}/althing-core/lib/python3.13/site-packages/althing
+      grep -q _PANE_ID "$SP/zellij.py" && grep -q _live_pid "$SP/session_source.py"
+    changed_when: "false"