Release beta 1.0.4 update settlement

docs/project-rules.md

@@ -18,6 +18,9 @@ exception.
   - every package `__version__`;
   - `README.md`;
   - `CHANGELOG.md`.
+- The first bullet under each release heading in `CHANGELOG.md` must be one
+  concise, user-facing sentence. It is the canonical group announcement
+  summary.
 - Do not mark production complete merely because code was committed. Production
   is complete only after staging, cutover, acceptance, observation, and backup
   restore checks pass.
@@ -63,6 +66,26 @@ Before touching production runtime files on production host:
   SQLite gates.
 - If any gate fails, confirm rollback state before retrying.
 
+## Mandatory Post-Release Settlement
+
+- After cutover and rollback gates pass, run the installed
+  `jwebot_release_update.py`.
+- The settlement grants exactly 200 Mora to every account that exists at the
+  start of that release settlement and appends a version-labelled account
+  movement.
+- Compensation uses the full release string as its idempotency key. Rerunning
+  the same release must not grant Mora twice.
+- The tool sends one guarded announcement containing the version, the first
+  changelog bullet, and the `Mora x200` compensation notice.
+- Announcement state is tracked separately from compensation. A missing or
+  uncertain GUI receipt must never roll back a healthy runtime or trigger
+  another grant.
+- If delivery is uncertain, inspect the configured group before using
+  `--retry-uncertain-announcement`; never retry blindly.
+- Production is not complete until the settlement reports success, SQLite
+  `quick_check` is `ok`, queues are empty, and service restart counts remain
+  stable.
+
 ## Backup And Restore
 
 - Pre-deploy and post-deploy baselines must include runtime files, systemd

docs/runbooks/production-deployment.md

@@ -73,7 +73,12 @@ The deployer prints an eight-stage progress bar and:
 - leaves legacy OCR disabled;
 - verifies Edge health and adaptive restart stability;
 - writes and verifies backup SHA-256 checksums;
-- rolls back files, state, and unit topology on failure.
+- rolls back files, state, and unit topology on cutover failure;
+- after rollback is disarmed, grants each existing account 200 Mora, records a
+  version-labelled movement, and sends the guarded group update announcement.
+
+The first bullet in the current `CHANGELOG.md` release section is the canonical
+one-sentence announcement summary. Keep it concise and user-facing.
 
 ## Post-Cutover
 
@@ -104,6 +109,28 @@ PY
 Player-visible acceptance must use deliberate synthetic messages in the
 configured group and confirm exactly one ACK and one final response.
 
+The deployer also runs the installed release settlement tool. Its successful
+JSON result must report the expected account count and announcement delivery.
+The operation is idempotent by the full release string, so rerunning the same
+command never grants Mora twice:
+
+```sh
+/opt/jwebot/venv/bin/python \
+  ~/.local/lib/wechat-health-watch/jwebot_release_update.py
+```
+
+If it reports `AnnouncementUncertainError`, inspect the configured group first.
+Only when the announcement is confirmed absent may the operator retry:
+
+```sh
+/opt/jwebot/venv/bin/python \
+  ~/.local/lib/wechat-health-watch/jwebot_release_update.py \
+  --retry-uncertain-announcement
+```
+
+Do not repeat the full deployment to repair an uncertain announcement. The
+runtime cutover and version-keyed compensation may already be complete.
+
 ## Rollback
 
 If any gate fails: