bump to 0.9.8; add padded-canary build (app_version_padding_tests)

Canary re-proven on this base: reconstruct-from-components trips the
fixture checks; an unpadded fixture trips the non-vacuity assertion.
De-literalizes stale version examples in comments.

CMakeLists.txt

@@ -4,15 +4,34 @@ cmake_minimum_required(VERSION 3.19)
 # Version — SINGLE SOURCE OF TRUTH (Phase V, V1). Edit REASAMPLER_VERSION here and
 # nowhere else: it flows to the binary constant, the ext-state writing-version stamp,
 # and the "show version" action via a configure_file'd header (below). The string is
-# authoritative verbatim — leading zero preserved (Daniel-fixed: exactly "0.9.01",
-# two-digit zero-padded patch). We deliberately do NOT reconstruct the display string
-# from project(VERSION)'s numeric components, since CMake may normalize a numeric patch
-# field; the string variable is what renders. project(VERSION ...) is still set (with a
-# normalized 0.9.1 triple) for CMake hygiene / any downstream numeric use, but it is NOT
-# the rendered source of truth.
-set(REASAMPLER_VERSION "0.9.01")
+# authoritative verbatim — any leading zeros are preserved exactly as written (Daniel's
+# ruling: padded and unpadded versions are BOTH legitimate — "0.9.8" and "0.9.80" are
+# different versions, and the system must never force zero-padding). We deliberately do
+# NOT reconstruct the display string from project(VERSION)'s numeric components, since
+# CMake may normalize a numeric patch field; the string variable is what renders.
+# project(VERSION ...) is still set for CMake hygiene / any downstream numeric use, but
+# it is NOT the rendered source of truth.
+#
+# *** INVARIANT — DO NOT COLLAPSE OR DERIVE ***
+# The set(REASAMPLER_VERSION ...) line below MUST remain a verbatim string literal,
+# even when it is textually identical to the project(VERSION ...) line. It must NEVER
+# become
+#   set(REASAMPLER_VERSION "${PROJECT_VERSION}")
+#   set(REASAMPLER_VERSION "${CMAKE_PROJECT_VERSION}")
+# or any other form that derives the string from project(). CMake normalizes numeric
+# patch fields: a padded "0.9.01" would silently round-trip to "0.9.1" and break the
+# displayed version string. The verbatim-threading invariant is guarded at build time
+# by app_version_padding_tests (a synthetic zero-padded canary; see the padding-canary
+# block after app_version_tests). That guard detects reconstruct-from-components
+# regressions in app_version.cpp but does NOT guard against this line being changed to
+# a CMake variable derivation — that is this comment's job.
+#
+# There is a SECOND set(REASAMPLER_VERSION ...) inside the padding-canary function
+# further down. That one is a permanent test fixture ("0.9.01") and must NEVER be
+# bumped on release.
+set(REASAMPLER_VERSION "0.9.8")
 
-project(reaper_reasampler VERSION 0.9.1 LANGUAGES CXX)
+project(reaper_reasampler VERSION 0.9.8 LANGUAGES CXX)
 
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
@@ -584,6 +603,47 @@ add_executable(app_version_tests tests/test_app_version.cpp)
 target_link_libraries(app_version_tests PRIVATE app_version)
 add_test(NAME app_version_tests COMMAND app_version_tests)
 
+# Anti-normalization padding canary (see tests/test_app_version_padding.cpp for the full
+# rationale). The live-version assertions in app_version_tests can only DETECT a
+# "reconstruct the string from numeric components" regression when the live version
+# happens to be zero-padded — at an unpadded version (e.g. 0.9.8) the reconstruction
+# coincides with the verbatim string and the check silently goes vacuous. So: run the
+# SAME version_generated.h.in template through configure_file a second time with a
+# SYNTHETIC padded version, and compile the SAME src/app_version.cpp against that header
+# (include-dir substitution — the canary target never sees the live generated/ dir).
+# The "0.9.01" here is a permanent test fixture, NOT the shipped version (see also the
+# source-of-truth comment at the top of this file for the live-version invariant); it
+# must match the literals in test_app_version_padding.cpp and must never be bumped on
+# release.
+#
+# COVERAGE BOUNDARY: the canary detects "reconstruct-from-numeric-components"
+# regressions inside app_version.cpp. It does NOT detect the live source-of-truth line
+# becoming a CMake variable derivation; that case is separately guarded by the comment
+# block at the top of this file.
+function(_configure_padding_canary)
+    # set() inside a function is function-scoped — the clobber cannot leak into the
+    # parent scope, so no save/restore/unset dance is needed. REASAMPLER_CHANNEL_IS_BETA
+    # and CMAKE_CURRENT_SOURCE_DIR / CMAKE_CURRENT_BINARY_DIR are inherited read-only.
+    set(REASAMPLER_VERSION "0.9.01")
+    configure_file(
+        ${CMAKE_CURRENT_SOURCE_DIR}/src/version_generated.h.in
+        ${CMAKE_CURRENT_BINARY_DIR}/generated_padding_canary/version_generated.h
+        @ONLY)
+endfunction()
+_configure_padding_canary()
+
+# NOTE: app_version_padding_tests deliberately recompiles src/app_version.cpp rather
+# than linking the app_version library target. This is required for the include-dir
+# substitution to work — the canary needs to see generated_padding_canary/ instead of
+# the live generated/ dir. If app_version ever gains a link dependency (e.g. a new
+# pure-module link), the canary target_link_libraries must mirror it here.
+add_executable(app_version_padding_tests
+    tests/test_app_version_padding.cpp
+    src/app_version.cpp)
+target_include_directories(app_version_padding_tests PRIVATE
+    ${CMAKE_CURRENT_BINARY_DIR}/generated_padding_canary src)
+add_test(NAME app_version_padding_tests COMMAND app_version_padding_tests)
+
 # The provenance test links bank_model too — it proves the recorded recipe survives
 # the Sample-JSON round-trip (Provenance.fxChainSnapshot), the M1 seam M10 rides on.
 add_executable(provenance_tests tests/test_provenance.cpp)