jaanisoe · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -18,9 +18,9 @@ exclude = ["crates/core/fuzz"]
 [workspace.package]
 # The exact version being shipped, pre-release suffix and all: this is what the binary
 # reports as `CARGO_PKG_VERSION`, and `version-guard` in release.yml compares the tag to it
-# with no stripping. So this tree tags `v1.0.0-rc.2`, and the final release means setting
+# with no stripping. So this tree tags `v1.0.0-rc.3`, and the final release means setting
 # `1.0.0` here and tagging `v1.0.0`.
-version = "1.0.0-rc.2"
+version = "1.0.0-rc.3"
 edition = "2024"
 rust-version = "1.96"
 license = "MIT OR Apache-2.0"

diff --git a/README.md b/README.md
@@ -23,7 +23,7 @@ metadata a harvester needs. It does nothing else, which is why it stays small: o
 no database, no message bus. It runs on a laptop, and
 [Quickstart 1](#quickstart-1--see-it-work) has it answering a query in minutes.
 
-**Pre-release.** `v1.0.0-rc.2` is out. Binaries, a container image and checksums are on the
+**Pre-release.** `v1.0.0-rc.3` is out. Binaries, a container image and checksums are on the
 [Releases page](https://github.com/GenomicDataInfrastructure/gdi-node-standalone/releases).
 It is a candidate, so the image has no `:latest` tag.
 [CHANGELOG.md](CHANGELOG.md) records what `1.0.0` will commit to.
@@ -144,7 +144,7 @@ binary is Linux only and is the full build; the tool also ships for macOS and Wi
 ([platforms](docs/deployment.md#binaries-and-platforms)).
 
 ```bash
-V=v1.0.0-rc.2
+V=v1.0.0-rc.3
 U=https://github.com/GenomicDataInfrastructure/gdi-node-standalone/releases/download/$V
 R=https://raw.githubusercontent.com/GenomicDataInfrastructure/gdi-node-standalone/$V/crates/gdi-dataset-tool/tests/fixtures
 mkdir -p ~/gdi-demo && cd ~/gdi-demo
@@ -163,7 +163,7 @@ not, so compile that one there. Each release also has a provenance attestation i
 attestation store; the commands to check it are in
 [operating.md §20](docs/operating.md#20-verifying-release-artifacts--the-container-image).
 There is an image too, `linux/amd64` only:
-`docker pull ghcr.io/genomicdatainfrastructure/gdi-node-standalone:v1.0.0-rc.2`.
+`docker pull ghcr.io/genomicdatainfrastructure/gdi-node-standalone:v1.0.0-rc.3`.
 
 **Build** to work on the code, or for the tool where there is no download (Intel Macs,
 aarch64 Linux). The service runs on Linux only
@@ -240,7 +240,7 @@ For a Beacon that answers like a real export (1 637 sites, twelve populations, c
 build the realistic sample instead and repeat the `deploy` and `publish` lines with its id:
 
 ```bash
-V=v1.0.0-rc.2
+V=v1.0.0-rc.3
 S=https://raw.githubusercontent.com/GenomicDataInfrastructure/gdi-node-standalone/$V/crates/test-util/tests/fixtures/sample
 curl --fail-early -fsSLO "$S/gdi-sample.package.yaml" -O "$S/gdi-sample.GRCh38.vcf.gz"
 gdi-dataset-tool build gdi-sample.package.yaml --cc EE -o build-sample   # checkout: crates/test-util/tests/fixtures/sample/

diff --git a/THIRD-PARTY-LICENSES.md b/THIRD-PARTY-LICENSES.md
@@ -7639,13 +7639,13 @@ limitations under the License.
 ### Apache License 2.0 (Apache-2.0)
 
 Used by:
-- gdi-node-standalone-beacon 1.0.0-rc.2
-- gdi-build-info 1.0.0-rc.2
-- gdi-node-standalone-core 1.0.0-rc.2
-- gdi-node-standalone-fairdp 1.0.0-rc.2
-- gdi-dataset-tool 1.0.0-rc.2
-- gdi-node-standalone 1.0.0-rc.2
-- test-util 1.0.0-rc.2
+- gdi-node-standalone-beacon 1.0.0-rc.3
+- gdi-build-info 1.0.0-rc.3
+- gdi-node-standalone-core 1.0.0-rc.3
+- gdi-node-standalone-fairdp 1.0.0-rc.3
+- gdi-dataset-tool 1.0.0-rc.3
+- gdi-node-standalone 1.0.0-rc.3
+- test-util 1.0.0-rc.3
 - anyhow 1.0.104
 - arraydeque 0.5.1
 - async-trait 0.1.92

diff --git a/crates/core/fuzz/Cargo.lock b/crates/core/fuzz/Cargo.lock
diff --git a/docs/api.md b/docs/api.md
@@ -547,7 +547,7 @@ programmatic consumer should check the status code before parsing the body as JS
 
 ```json
 {
-  "service_version": "1.0.0-rc.2",
+  "service_version": "1.0.0-rc.3",
   "gdi_metadata_version": "<pinned gdi-metadata model version>",
   "git_sha": "<git commit, 12 hex chars; 'unknown' if no repository was reachable>",
   "build_epoch": "<Unix seconds; 'unknown' if no repository was reachable>"

diff --git a/docs/deployment.md b/docs/deployment.md
@@ -28,7 +28,7 @@ The service is a single binary, built in two flavours:
 
 Prefer `gnu`. Reach for `musl` only when the gnu binary will not start.
 
-There are prebuilt binaries for `v1.0.0-rc.2`, listed further down. To build from source:
+There are prebuilt binaries for `v1.0.0-rc.3`, listed further down. To build from source:
 
 ```bash
 cargo build --release --features full -p gdi-node-standalone
@@ -148,7 +148,7 @@ single-writer invariant.
 ## Container image
 
 > **There is no `:latest`.** The workflow moves it only on a stable release, and
-> `v1.0.0-rc.2` is a candidate. Pull the exact tag.
+> `v1.0.0-rc.3` is a candidate. Pull the exact tag.
 
 Tagged releases publish a container image to GHCR, packaged from the same released `gnu`
 (glibc) binary onto a minimal `distroless/cc` base. There is no recompile: the binary is

diff --git a/docs/gdi-dataset-tool.md b/docs/gdi-dataset-tool.md
@@ -145,7 +145,7 @@ version is 1.96, and every crate builds a C-dependent build script, so a linker
 Nothing else: no S3 endpoint, no Vault, no at-rest encryption. The binary does always link
 the S3 and network stack, as the note below explains.
 
-> **There are prebuilt binaries now.** `v1.0.0-rc.2` ships the tool for Linux (`gnu` and
+> **There are prebuilt binaries now.** `v1.0.0-rc.3` ships the tool for Linux (`gnu` and
 > `musl`), macOS on Apple silicon and Windows, with checksums and a provenance attestation,
 > on the [Releases page](https://github.com/GenomicDataInfrastructure/gdi-node-standalone/releases).
 > Building from source, below, still works.

diff --git a/docs/images/wizard.svg b/docs/images/wizard.svg
diff --git a/docs/operating.md b/docs/operating.md
@@ -2758,7 +2758,7 @@ operational invariant covered above under [Where things live](#where-things-live
 
 ## 20. Verifying release artifacts + the container image
 
-> **`v1.0.0-rc.2` is the current release.** Being a candidate, it has no `:latest` image
+> **`v1.0.0-rc.3` is the current release.** Being a candidate, it has no `:latest` image
 > tag, so use the exact tag in the commands below.
 
 Each release publishes, alongside the per-platform binaries: one `SHA256SUMS`, a keyless

diff --git a/scripts/demo/record-wizard.sh b/scripts/demo/record-wizard.sh
@@ -14,13 +14,17 @@
 #
 #   DEMO_NODE_URL / DEMO_MGMT_URL / DEMO_S3_ENDPOINT / DEMO_S3_BUCKET / DEMO_S3_REGION /
 #   DEMO_S3_ACCESS_KEY / DEMO_S3_SECRET_KEY point at another stack (shifted host ports, a
-#   bucket of your own). DEMO_KEEP=1 keeps the scratch dir with the .cast; DEMO_DUMP=1 also
+#   bucket of your own). The URLs are typed into the recording, so a shifted stack shows
+#   shifted ports; to record the defaults on a host whose :8080 is taken, put the stack behind
+#   a container that forwards 127.0.0.1:8080/9090/3900 and set DEMO_NETWORK=container:<name>,
+#   the docker network the wizard joins (default: host). The readiness probe runs in that
+#   network too. DEMO_KEEP=1 keeps the scratch dir with the .cast; DEMO_DUMP=1 also
 #   writes the ANSI-stripped transcript there, which is what to read when a prompt changed and
 #   drive-wizard.py's SCRIPT table needs the new wording.
 #
 # The wizard runs in a throwaway container with a clean home directory, so every path in the
-# recording is a provider's (`/home/provider/...`), not this machine's. `--network host` is
-# what lets it reach the stack's loopback-published ports. The image is pinned by digest like
+# recording is a provider's (`/home/provider/...`), not this machine's. `--network host` (the
+# default) is what lets it reach the stack's loopback-published ports. The image is pinned by digest like
 # every other image in the tree; Debian trixie's glibc is newer than the tool's floor.
 set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -34,6 +38,7 @@ OUT="${1:-docs/images/wizard.svg}"
 : "${DEMO_S3_REGION:=garage}"
 : "${DEMO_S3_ACCESS_KEY:=GK0123456789abcdef01234567}"
 : "${DEMO_S3_SECRET_KEY:=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef}"
+: "${DEMO_NETWORK:=host}"
 TOOL="${DEMO_TOOL:-target/release/gdi-dataset-tool}"
 IMAGE="python:3.13-slim-trixie@sha256:9d2e5553305c7c7b0097999bb17187c69b921ccd6bc9d40e4bb5ebe652c00285"
 
@@ -47,8 +52,17 @@ if [ -n "$(find crates/gdi-dataset-tool/src crates/core/src -name '*.rs' -newer
   echo "record-wizard: $TOOL is older than the tool's sources; rebuild it first (cargo build --release -p gdi-dataset-tool)" >&2
   exit 1
 fi
-curl -fsS "$DEMO_MGMT_URL/health/ready" >/dev/null 2>&1 \
-  || { echo "record-wizard: no ready node at $DEMO_MGMT_URL (start the Compose S3 stack first)" >&2; exit 1; }
+# Probe where the wizard will run: in a namespaced network the URL means nothing on the host.
+node_ready() {
+  if [ "$DEMO_NETWORK" = host ]; then
+    curl -fsS "$DEMO_MGMT_URL/health/ready" >/dev/null 2>&1
+  else
+    docker run --rm --network "$DEMO_NETWORK" "$IMAGE" python3 -c \
+      "import urllib.request; urllib.request.urlopen('$DEMO_MGMT_URL/health/ready', timeout=5)" >/dev/null 2>&1
+  fi
+}
+node_ready \
+  || { echo "record-wizard: no ready node at $DEMO_MGMT_URL in network $DEMO_NETWORK (start the Compose S3 stack first)" >&2; exit 1; }
 
 work="$(mktemp -d)"
 # Named, and removed on exit: when the driver gives up on a prompt it kills the docker client,
@@ -67,7 +81,7 @@ python3 scripts/demo/drive-wizard.py --out "$work/wizard.cast" "${dump[@]}" \
   --node-url "$DEMO_NODE_URL" --management-url "$DEMO_MGMT_URL" \
   --s3-endpoint "$DEMO_S3_ENDPOINT" --s3-bucket "$DEMO_S3_BUCKET" --s3-region "$DEMO_S3_REGION" \
   --s3-access-key "$DEMO_S3_ACCESS_KEY" --s3-secret-key "$DEMO_S3_SECRET_KEY" -- \
-  docker run --rm -it --name "$container" --network host --user "$(id -u):$(id -g)" \
+  docker run --rm -it --name "$container" --network "$DEMO_NETWORK" --user "$(id -u):$(id -g)" \
     -e HOME=/home/provider -e TERM=xterm-256color -w /home/provider/work \
     -v "$work/home:/home/provider" \
     -v "$REPO_ROOT/crates/test-util/tests/fixtures/sample:/home/provider/work/data:ro" \