From efbe355070d8eca80e977437e45ee7d416520499 Mon Sep 17 00:00:00 2001
From: m5r <mokhtar@mial.net>
Date: Sat, 15 Aug 2026 12:24:05 +0200
Subject: [PATCH] changelog: 0.0.3 releases today

---
 CHANGELOG.md  | 42 ++++++++++++++++++++++++++++++++++++++++++
 build.zig.zon |  2 +-
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7a0df87..24a1899 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,48 @@ subject rarely does.
 
 ## [Unreleased]
 
+## [0.0.3] - 2026-08-15
+
+Devices name themselves: the clients table asks the router over reverse DNS
+instead of waiting for the operator to type every name. The CI container gate
+also moved from workflow shell into a compiled, tested tool, which fixed a
+latent temp-directory bug shared with the release tool.
+
+### Added
+
+- **Client names learned over reverse DNS.** A client row that carries no
+  hand-typed name gets one from the network: each tracker flush pass takes up
+  to 16 unnamed rows, builds each address's reverse name, matches it against
+  the declared `forward_zones`, and on a match sends one PTR query to that
+  zone's resolver, storing the answer as a *learned* name. This requires a
+  conditional forward zone covering the LAN's reverse space — for example
+  `168.192.in-addr.arpa` pointed at the router; without one, nothing is sent
+  anywhere. A hand-typed name always wins, learned names never appear in
+  `nxdns export` and are never set by `nxdns import`, and each row refreshes
+  once a day (an hour after a failure), so a rename can show stale for up to
+  24 hours. The API's `Client` object gains a `learned_name` field and the
+  clients page shows it.
+
+### Changed
+
+- The container CI gate — image build, image-contents assertion against the
+  packaged artifacts, and the startup/shutdown smoke test — moved from
+  workflow shell into `tools/container_check.zig`, compiled and unit-tested by
+  `zig build test` and runnable on a laptop against a local docker daemon.
+  The health probe now runs under a real 60-second deadline (the shell loop's
+  "30 seconds" could stretch past three minutes), and the gate's docker
+  objects carry an ownership label so anything a dead runner leaks is
+  discoverable. The version in CI is parsed from `build.zig.zon` through the
+  zon grammar, once, instead of by two copies of a `sed` regex.
+
+### Fixed
+
+- The release tool's temporary-directory claim was not exclusive: the
+  "create" it relied on succeeds on a directory that already exists, so a
+  stale or concurrent directory could be silently adopted, written into, and
+  deleted on exit. Both the release tool and the new container gate now claim
+  their directories exclusively and retry on collision.
+
 ## [0.0.2] - 2026-08-14
 
 Configuration can now be a file that every boot converges to, filtering gains
diff --git a/build.zig.zon b/build.zig.zon
index 0b76e6e..b826477 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -1,6 +1,6 @@
 .{
     .name = .nxdns,
-    .version = "0.0.2",
+    .version = "0.0.3",
     .minimum_zig_version = "0.16.0",
     .paths = .{""},
     .fingerprint = 0x3307b311dded1d91,