diff --git a/sidecar/README.md b/sidecar/README.md
index cb5a1af..bd774fe 100644
--- a/sidecar/README.md
+++ b/sidecar/README.md
@@ -41,10 +41,10 @@ So you can never accidentally run without auth. Rotate by editing the token and
 
 ## Protocol version
 
-The wire protocol has a version (`PROTOCOL_VERSION`, currently **1**), so the website and sidecar detect a mismatch immediately instead of failing in strange ways when a message shape changes.
+The wire protocol has a version (`PROTOCOL_VERSION`, currently **3**), so the website and sidecar detect a mismatch immediately instead of failing in strange ways when a message shape changes.
 
-- Every response carries an `X-UOLink-Version: 1` header.
-- `/health` and the WebSocket `ws.hello` include `"protocol": 1`.
+- Every response carries an `X-UOLink-Version: 3` header.
+- `/health` and the WebSocket `ws.hello` include `"protocol": 3`.
 - If a request sends `X-UOLink-Version` and it disagrees with the sidecar, the request is rejected **409 Conflict** with `{sidecar_protocol, client_protocol}` so the mismatch is obvious.
 
 Bump `PROTOCOL_VERSION` in `main.rs` whenever an event or endpoint's shape changes.
diff --git a/sidecar/src/main.rs b/sidecar/src/main.rs
index c9cc854..1a5a659 100644
--- a/sidecar/src/main.rs
+++ b/sidecar/src/main.rs
@@ -24,7 +24,12 @@ use tracing_subscriber::EnvFilter;
 /// v2 (Protocol 2.0): adds the account-provisioning verbs/endpoints (`POST /accounts/create`,
 /// `DELETE /link/:account`) and their events. Outbound event kinds are additive, so a v1 website
 /// keeps working against the live feed; the new *endpoints* require a v2 sidecar.
-pub const PROTOCOL_VERSION: u32 = 2;
+///
+/// v3 (Protocol 3.0): adds `world.ruleset`, `points.board` and `vendor.listing` /
+/// `vendor.listing.remove`, with the `GET /ruleset`, `/points` and `/market` reads that serve them
+/// from the store. Same shape as the v2 bump — the kinds are additive, the endpoints are not — and
+/// there is deliberately no feature-negotiation array: v3 implies all three kinds.
+pub const PROTOCOL_VERSION: u32 = 3;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {