feat(bootstrap): dial always-on bootstrap peers so a fresh node has a dialable peer

.github/workflows/release.yml

@@ -88,3 +88,47 @@ jobs:
           files: release/*
           generate_release_notes: true
           fail_on_unmatched_files: true
+
+  # Tell apt.dig.net a new stable release exists, so its signed APT index re-ingests this tag's
+  # `.deb`s (dig_ecosystem#425). Without this the packages sit on the GitHub release and the apt
+  # repository keeps serving the previous version until someone runs its deploy by hand.
+  #
+  # `repository_dispatch` deliberately, NOT `on: release:` in apt.dig.net. A `release:` run sets
+  # `github.ref` to the TAG, so every job there guarded on `refs/heads/main` skips while the run
+  # still reports `completed` — nothing red, nothing ran. A `repository_dispatch` arrives on the
+  # default branch, where those guards hold.
+  #
+  # INERT UNTIL apt.dig.net ADDS THE LISTENER. As of this commit apt.dig.net's deploy.yml triggers
+  # only on its OWN `v*` tags + workflow_dispatch, and the dispatches API returns 204 whether or not
+  # anything is listening — so this job currently emits a signal nobody consumes. It is committed as
+  # the producer half because the consumer half lives in another repo; apt.dig.net must add
+  # `on: repository_dispatch: types: [upstream-release]` to deploy.yml for the hook to do anything.
+  # Do NOT read a green run here as evidence the apt index re-ingested.
+  #
+  # Best-effort: a failure here does not un-publish a release that is already live and correct, and
+  # apt.dig.net's own deploy remains runnable directly. It is reported rather than silent.
+  notify-apt:
+    name: Notify apt.dig.net
+    needs: publish
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Dispatch the re-ingest
+        continue-on-error: true
+        env:
+          # The ecosystem release PAT: cross-repo dispatch needs a token that carries write access to
+          # apt.dig.net, which the run-scoped GITHUB_TOKEN cannot.
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::warning::RELEASE_TOKEN absent; apt.dig.net was NOT notified of $TAG"
+            exit 0
+          fi
+          gh api repos/DIG-Network/apt.dig.net/dispatches \
+            -f event_type=upstream-release \
+            -F "client_payload[repo]=dig-node" \
+            -F "client_payload[tag]=$TAG"
+          echo "apt.dig.net notified of $TAG"

Cargo.toml

@@ -32,7 +32,7 @@ edition = "2021"
 # the ROOT manifest (`[workspace.package].version`), so it MUST be set here for a
 # release to fire (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet)
 # keep their own independent versions — only the released binary tracks the workspace version.
-version = "0.126.0"
+version = "0.127.0"
 
 # Release hardening, matching digstore: keep integer-overflow checks ON in release.
 # The node parses untrusted serialized input and does offset/length arithmetic over

crates/dig-node-core/Cargo.toml

@@ -23,7 +23,7 @@ name = "dig-node-core"
 # out-of-workspace implementor; this crate is consumed in-workspace only and is pre-1.0, so it is a
 # MINOR bump under SemVer's 0.x rule -- recorded here rather than letting the number imply the trait
 # surface held still.
-version = "0.47.0"
+version = "0.48.0"
 edition = "2021"
 license = "GPL-2.0-only"
 description = "The canonical DIG node ENGINE library (crate `dig_node_core`): the JSON-RPC dispatch (`handle_rpc`, the same contract as rpc.dig.net), local-first content serve/fetch/redirect from LOCAL .dig store modules (via digstore_host::serve_blind), chain-anchored-root resolution, chain-watch + subscriptions + generation gap-fill, the LRU cache, and the full P2P stack. Shared UNCHANGED by both host shells: the `dig-node` OS-service binary (dig-node-service) and the DIG Browser's in-process cdylib (dig-runtime). Native Rust so the compiled-module serve path works."

crates/dig-node-core/src/lib.rs

@@ -83,7 +83,7 @@ pub use seams::content::{bandwidth, verification_ledger, ContentServer};
 /// The `PeerNetwork` trait is seam 2's public surface (#1285 W1b-2) — bring it into scope to
 /// call `peer_status`/`set_inventory_refresher`/`set_gossip_handle`/`gossip_handle`/
 /// `refresh_dht_inventory` on a `Node`.
-pub use seams::dig_peer::{address_book, dht, net, pex, session, PeerNetwork};
+pub use seams::dig_peer::{address_book, bootstrap, dht, net, pex, session, PeerNetwork};
 /// The `RpcDispatch` trait is seam 4's public surface (#1285 W1b-5) — the crate-root
 /// `handle_rpc`/`handle_rpc_json` free functions delegate to it; most callers keep using those
 /// stable entry points and never need this trait in scope directly.

crates/dig-node-core/src/peer.rs

@@ -2780,6 +2780,16 @@ async fn run_peer_network(node: Arc<crate::Node>) -> Result<(), String> {
         )),
     );
 
+    // Bootstrap dials (#923): a fresh install knows no peers — peer exchange and the DHT can only
+    // spread peers this node already has, and the relay reservation only makes it reachable. Dial the
+    // always-on anchors so `connected_peers` has a floor above zero on a node that can reach the
+    // internet. Spawned: bring-up must not block on an anchor that may be unreachable.
+    crate::bootstrap::spawn_bootstrap_dials(
+        handle.clone(),
+        crate::bootstrap::bootstrap_targets_from_env(),
+        stun_server,
+    );
+
     // The served responder carries the LIVE pool handle so `dig.getPeers` reflects connected peers,
     // and the DHT so inbound DHT RPCs are answered.
     let mut node_responder = NodeResponder::with_pool(node, handle);