[noahgift]

Replaces #6404 in the merge queue: same tree (c454f1db), one commit 9c2c112 on chore/bump-0.72.0-r2; #6404 stays open and idle. Refs #6390.

Release bump for 0.72.0 (06x release schedule §4.2): bump-version.sh 0.72.0 across every workspace, both Cargo.lock files synced (so package_tarball_build leaves the tree clean), the CRUX prompt certification carried from 0.71.3, and the CHANGELOG section below.

Size: the bump is mechanical. 212+/212- are version strings and lockfile entries; the CHANGELOG adds 160 lines; evidence/crux/0.72.0/ is the carried certification inventory (about 9,000 generated lines). This is over the 400-line PR cap by construction.

README hand-check: README.md has no version or crate/contract count literals; readme_contract passes (17/17). The pv README step lands for 0.73.0.

When this merges, scripts/release/autopilot.sh runs the rest of the train, fail-closed (APR-RELEASE-001 §4).

Release commit-range: v0.71.4..a781138 (250 non-merge commits). Entries are commit subjects.

Added

• feat(roadmap): fragment shape check, newline-safe aggregation, bump regenerates (Refs ci: roadmap fragment shape check (part 1 of #6270) #6288)
• feat(ci): one-PR-per-ticket R1 allowance for EMR-001 squash PRs (Refs ci: one-PR-per-ticket allowance for EMR-001 squash integration PRs (R1) #6267)
• feat(run): apr run --json response contract: status, error, model_digest (Refs apr response contract for consumers (#3716): weights digest + seed determinism, empty completion = error, refused vs did-not-run distinguishable — on run --json and serve #3720)
• feat(ladder): per-cell memory admission, deferred cells are not_measured (Refs model-ladder: per-cell memory admission so 27B cells don't swap gx10 during pool jobs #6211)
• feat(roadmap): generator and guard learn the frozen roadmap-base.yaml (S1a, Refs roadmap: stop PRs conflicting on generated roadmap.yaml (S1: frozen base.yaml, generator reads it) #6185)
• feat(affected-set): docs/contracts/*.md give READERS, not ALL; dormant, no consumer (Refs gate: affected_set.sh narrows docs/contracts/*.md to READERS-only (split out of #6035) #6042)
• feat(ci-tools): lockfile-registry-packages, the Rust port of lockfile_registry_packages.py (Refs PY-PORT: lockfile_registry_packages.py -> aprender-ci-tools lockfile-registry-packages #4827)
• feat(pre-push): keyed warm cache + parallel guard-tree for pre_push_local.sh (PRE-PUSH-LATENCY: guard-cargo 6223 s cold in pre_push_local.sh — keyed shared target dir + overlap guard-tree #5983)
• feat(train): train-step profiler JSON report contract (Refs test(cov): top coverage-gap fn in apr-cli (≤200 lines, w5404) #5577)
• feat(flow-010): affected_set.sh helper, diff to crates + reverse-dep closure + nextest filter (E5)
• feat(rollup): rollup bot — select, build, verify, close-with-SHA (Refs T-rollup: rollup bot merges ready PRs into one commit (≤200 lines via gh, close constituents only after SHA on main) #5737) (feat(rollup): rollup bot — select, build, verify, close-with-SHA (Refs #5737) #5742)
• feat(simulate): PR-flow, repo-flow, course-flow scenarios and flow-model rows B1-B7 (Refs aprender-simulate: PR-flow model SIM-1..5 (port, contract tests, live drift andon; no Python) #5511) (feat(simulate): PR-flow, repo-flow, course-flow scenarios and flow-model rows B1-B7 (Refs #5511) #5559)
• feat(viz): GGPlot::to_svg draws title, xlab and ylab (Refs aprender-viz: draw titles and axis labels, ship runnable Facet/Coord examples #5334, Refs aprender-viz: GGPlot::title/xlab/ylab are accepted and silently discarded — never drawn, and #[allow(dead_code)] hides it #3590) (feat(viz): GGPlot::to_svg draws title, xlab and ylab #5453)
• feat(apr-cli): derived-cell coverage for release surfaces, LAB checks and zero-cell refusal (P0: release cells are hand-coded, not DERIVED from apr's interface — the gate cannot see a verb, flag or input shape nobody typed into a list (run --prompt --chat, serve, code all leaked) #3745) (feat(apr-cli): derived-cell coverage for release surfaces, LAB checks and zero-cell refusal (#3745) #5417)
• feat(bench): parity receipts carry per-replicate server resources (Refs Speed measurement harness: resource receipts, observability and the ollama/llama.cpp ratio #5322) (feat(bench): parity receipts carry per-replicate server resources (Refs #5322) #5419)
• feat(ci-tools): port model_ladder_cells_produce.py to ladder-cells-produce (PY-PORT-2f: port model_ladder_cells_produce.py to aprender-ci-tools ladder-cells-produce (C301) #5225) (feat(ci-tools): port model_ladder_cells_produce.py to ladder-cells-produce (#5225) #5410)
• feat(rex): land the review-experiment epic work on main (PMAT-4524) (feat(rex): land the review-experiment epic work on main (PMAT-4524) #5393)
• feat(embed): EmbeddingGemma 2 EG-3..EG-6 — serve, CUDA f32, refusals + qa gate, GGUF round trip (Refs EmbeddingGemma 2 in apr: load, embed, serve, CUDA and the model-ops round trip #5319) (feat(embed): EmbeddingGemma 2 EG-3..EG-6 — serve, CUDA f32, refusals + qa gate, GGUF round trip (Refs #5319) #5390)
• feat(serve): Qwen3.5 on CUDA batches concurrent chat requests, sampled slots seeded per request (apr serve on CUDA: batch concurrent Qwen3.5 requests correctly #5312) (feat(serve): Qwen3.5 on CUDA batches concurrent chat requests, sampled slots seeded per request (#5312) #5364)
• feat(contracts): pv census ratchet, LAB nightly (CENSUS-RATCHET: entity-bound contracts never drop and rise every release #4709) (feat(contracts): pv census ratchet, LAB nightly (#4709) #5359)
• feat(edge): ollama parity rows, chat-template fix and verb x device matrix (ci(lab): nightly fast-verbs CRUX smoke + tok/s on the ARM64 CUDA edge runner, ranked gap list #5254) (feat(edge): ollama parity rows, chat-template fix and verb x device matrix (#5254) #5292)

Performance

• perf(ci): balance workspace-test shards — GPU crates + their Σ check + two guards to shard 2 (Refs perf(ci): CI caps merge throughput — shard spread, runner wait, 21% failed+cancelled (2026-10-16) #5486) (perf(ci): balance workspace-test shards — GPU crates + their Σ check + two guards to shard 2 (Refs #5486) #5487)
• perf(ci): CARGO_PROFILE_{DEV,TEST}_DEBUG=0 in workspace-test-shard (P1a, Refs perf(ci): CI caps merge throughput — shard spread, runner wait, 21% failed+cancelled (2026-10-16) #5486) (perf(ci): DEBUG=0 for the shard build (P1a, Refs #5486) #5745)
• perf(guard): check_crux_ollama_in_lock runs its 6 dogfood rows 3 at a time, 71s -> 37s, output identical (perf(guard): check_crux_ollama_in_lock rows run in parallel (71s -> 37s) #5485)
• perf(guard): check_silicon_coverage forked tr twice per label test (3680 forks per run) (perf(guard): check_silicon_coverage forked tr twice per label test (3680 forks per run) #5484)
• perf(guard): cut forks in the guard-cargo apr-pinning scan (same verdicts) (perf(guard): cut forks in the guard-cargo apr-pinning scan (same verdicts) #5482)
• perf(ci): tree-reader derive in one grep pass; guard-tree m0 1404s -> 606s (Refs perf(ci): guard-tree#m0 runs serial ~23 min in x86-main; shard to <=10 min (PR-flow kaizen) #5427) (perf(ci): tree-reader derive in one grep pass; guard-tree m0 1404s -> 606s (Refs #5427) #5434)

Fixed

• fix(contracts): regenerate contracts.nt for the 917 breakdown (Refs fix(audit): surface ledger rows for the aprender-rollup bin (T-2 31/31) #6385)
• fix(audit): contract breakdowns sum to 917 (per-binary aprender-rollup, test-harness, q5_6)
• fix(audit): ledger the aprender-rollup verify verb and --apply (917 rows)
• fix(audit): restate the dogfood coverage totals for the 915-row ledger
• fix(audit): surface ledger rows for the aprender-rollup bin (T-2 pre-publish 31/31)
• fix(release): infra_gh names the path and status of a refused read (Refs release-rehearsal-nightly pick step: infra clean-room read fails silently (not_measured every night since 10-15) #6386)
• fix(crux): classify POST /v1/chat/prompt-ids as a not-generation route (Refs models-crux RED: POST /v1/chat/prompt-ids is an unclassified route (16 cells/host) #6383)
• fix(roadmap): single-quote the PMAT-6360 criterion that held a colon (Refs examples-nightly: aprender-review-experiment replay classified fail, not needs-args #6360)
• fix(examples): replay prints a Usage: line on a bare run (Refs examples-nightly: aprender-review-experiment replay classified fail, not needs-args #6360)
• fix(clippy): clippy 1.99 findings, part 1 of the workspace sweep (Refs A-5: five-whys on the 2026-10-18 nightly fails #5782)
• fix(deps): tokio 1.52.3 -> 1.53.3 for RUSTSEC-2026-0386
• fix(cbtop): pcie collector reads link width from a fixture-testable root and ignores sentinel widths (Refs cbtop pcie collector counts 63 (unknown width sentinel) as max_width; test_pcie_collector fails on kfocus-mq, ejecting MG runs #6282)
• fix(guards): --list --shard lists GITHUB_PATH/ENV writers in every shard before the m check, as the run path runs them (Refs guard-cargo: split the 77 serial guard items into parallel sections so guards p50 <= 8 min #6255)
• fix(ci): guard-cargo shards wait 600 s for ci-target-admit; 3 sibling shards meet the live<2 cap (Refs guard-cargo: split the 77 serial guard items into parallel sections so guards p50 <= 8 min #6255)
• fix(guards): --list --shard rejects a non-m step id like the run path does (Refs guard-cargo: split the 77 serial guard items into parallel sections so guards p50 <= 8 min #6255)
• fix(ci): the guard-cargo verdict job checks out scripts/ so ci_guards.sh --verdict exists (Refs guard-cargo: split the 77 serial guard items into parallel sections so guards p50 <= 8 min #6255)
• fix(guards): state-writer match is an append to GITHUB_PATH/ENV; regenerate roadmap.yaml (guard-cargo: split the 77 serial guard items into parallel sections so guards p50 <= 8 min #6255)
• fix(ci): skip absent dirs in the post-job chown, fix the stale comment, quiet SEC011 (Refs ci: ownership restores chown to the runner uid and report failure (follow-up to #6235) #6256)
• fix(ci): ownership restores chown to the runner uid and say when they fail (Refs ci: ownership restores chown to the runner uid and report failure (follow-up to #6235) #6256)
• fix(run): --benchmark exits 8 on an empty completion like every other surface (Refs apr response contract for consumers (#3716): weights digest + seed determinism, empty completion = error, refused vs did-not-run distinguishable — on run --json and serve #3720)
• fix(ci): pre-checkout ownership restore chowns to the runner uid (Refs ci/sections.yml: pre-checkout ownership restore chowns to hardcoded 1000:1000, not the runner uid #6235)
• fix(release): the LAB model ladder runs with per-cell admission on (Refs model-ladder: per-cell memory admission so 27B cells don't swap gx10 during pool jobs #6211)
• fix(ci): pr-light runs on an X64 clean-room runner, off the gx10 build host (Refs ci: pr-light runs on an X64 clean-room runner, not gx10-build #6239)
• fix(affected-set): rex-001/prereg.lock is a build input, build_inputs reads each include whole, shard table narrowing dropped (Refs gate: affected_set.sh narrows docs/contracts/*.md to READERS-only (split out of #6035) #6042)
• fix(train): restore the test: cover train in aprender-train/src/finetune/classify_trainer.rs #5686 ClassifyTrainer::train tests train-loop-v1 cites (Refs test: cover load_qwen35_layers in aprender-serve/src/gguf/qwen35_load.rs #5678)
• fix(ci): carry test: fold branch-only lines #5678 #5713 #5540 #5539 #5594 #5595 #5596 #5674 #5686 #5724 test fold onto current main, overlap with EMG-001 flush epic 5875-a (2 tickets) #5935 kept as nested mod (Refs test: cover load_qwen35_layers in aprender-serve/src/gguf/qwen35_load.rs #5678)
• fix(simulate): repo-flow binding_station is the argmin of the station bounds (FLOW-007 B1, Refs repo_flow binding_station is the argmin of the station bounds (flow model eq 2/3/5/6) #6068)
• fix(ci): check_ci_wait_cancel gate rows read the step env EVT, so merge_group rows ran as pull_request (check_ci_wait_cancel.sh inherits EVT from the x86-main step env (run 39888226186) #6061)
• fix(ci): ci_resolve_dirty self-test reads its output by here-string, not a pipe into grep -q (Refs EPIC FLAKE-0: producer | grep -q under pipefail turns a match into no-match (62 sites; 6 fail open on required paths) #4780)
• fix(pre-push): checked CRATES selection, one trapped scratch dir, clone-isolation row in --prove (PRE-PUSH-LATENCY: guard-cargo 6223 s cold in pre_push_local.sh — keyed shared target dir + overlap guard-tree #5983)
• fix(ladder): hung health-wait case asserts the stall event, not stall+3 ticks
• fix(guards): check_ladder_cells_producer reaps its fake serves when SIGKILLed
• fix(resolve_base): name merge_group.base_sha and pull_request.base.sha so a REBASE-replayed PR is judged whole
• fix(ci): silicon coverage re-reads an all-empty listing once and prints request ids (Refs check_silicon_coverage: re-read an all-empty listing once and print request ids (follow-up to #5974) #5978)
• fix(ci): silicon coverage reads the workflow's newest run when listing and probe both come back empty (Refs ci: silicon-coverage scores a consistently empty workflow listing MISSING instead of NOT_MEASURED #5974)
• fix(ci): draft_skip shard-unguarded mutant missed the shard once needs: sat above its if: (main red since ci: drop X64 from arch-neutral runs-on, pin + assert x86_64 on the FULL tier (#5871 re-cut, #5882 blocker) #5891) (fix(ci): draft_skip shard-unguarded mutant survives on main #5905)
• fix(rollup): aprender-rollup answers --version with the build sha (Refs aprender-rollup has no --version: nightly build-failed (version-failed) since 10-21 #5888) (fix(rollup): aprender-rollup answers --version with the build sha (Refs #5888) #5890)
• fix(ci): pv_bin.sh keeps exit status and raw output of an empty --version (Refs pv-snapshot: empty pv --version read in guard-cargo#m5 (MG 39666040051) #5894)
• fix(ci): remove check_harness_server_cleanup.sh + its 817 explicit command; keep fix(harness): crux launchers kill their fixture servers on TERM/INT/KILL #5806's launcher fixes (Refs fix(harness): crux launchers kill their fixture servers on TERM/INT/KILL #5806)
• fix: read pull_request.base.sha past the nested repo/user objects of a real payload (fix(resolve_base): name merge_group.base_sha (PR base sha fallback) so a REBASE-replayed PR is judged whole (#5855) #5859)
• fix(laya-rules): judge merge_group.base_sha..head so a REBASE-replayed multi-commit PR is not exit 2 (check_laya_train_rules.sh exits 2 on multi-commit PRs in the merge queue under REBASE (MG 39591283990) #5855)
• fix(harness): crux launchers kill their fixture servers on TERM/INT/KILL (fix(harness): crux launchers kill their fixture servers on TERM/INT/KILL #5806)
• fix(ci): bogus-m-crux fixture hermetic CARGO_TARGET_DIR (PMAT-5817) (fix(ci): bogus-m-crux fixture hermetic CARGO_TARGET_DIR (PMAT-5817) #5818)
• fix(deps): ureq 2→3 + webpki bumps — RUSTSEC-2026-0381/0382/0383 (main-red P0) (fix(deps): ureq 2→3 + webpki bumps — RUSTSEC-2026-0381/0382/0383 (main-red P0) #5813)
• fix(arm): plain gh pr merge on merge-queue repos, RED scanner on method flags (fix(arm): plain gh pr merge on merge-queue repos, RED scanner on method flags #5796)
• fix(deps): wasmtime 48.0.7 clears RUSTSEC-2026-0378/0379 (lock only) (fix(deps): wasmtime 48.0.7 clears RUSTSEC-2026-0378/0379 (lock only) #5789)
• fix(contracts): stop writing volatile reasoner_git_sha and cpu_ms to the witness (P5) (fix(contracts): stop writing volatile reasoner_git_sha and cpu_ms to the witness (P5) #5752)
• fix(data): validate_readme reports unparseable YAML front matter instead of returning Ok (Refs hf_hub validate_readme: unparseable front matter must be an error, not Ok #5500, apr CLI: wrong help text, missing output fields, bad defaults and signal handling #5328) (fix(data): validate_readme reports unparseable YAML front matter (Refs #5500) #5513)
• fix(serve): accept absent/null assistant content, max_completion_tokens alias, gate the GGUF router (supersedes fix(serve): accept absent/null content on assistant request messages (PMAT-801 follow-up) #5411) (fix(serve): accept absent/null assistant content, max_completion_tokens alias, gate the GGUF router (supersedes #5411) #5544)
• fix(deps): aprender-viz-ttop build.rs reads YAML through serde-saphyr; drop unused serde_yaml_ng from the present/test workspace shells (Refs Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths #5326) (fix(deps): aprender-viz-ttop reads YAML through serde-saphyr; drop unused serde_yaml_ng from present/test shells (Refs #5326) #5499)
• fix(ci-tools): Serve::signal_group used a kill executable the rust-slim clean-room lacks (clean-room-p1 B2: Serve::signal_group spawns a kill executable the rust-slim image lacks (serve_is_up_...dies_with_its_group) #5492) (fix(ci-tools): signal_group via sh builtin kill (release clean-room B2) #5493)
• fix(deps): aprender-decide reads YAML through serde-saphyr, not serde_yaml (Refs Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths #5326) (fix(deps): aprender-decide reads YAML through serde-saphyr, not serde_yaml (Refs #5326) #5413)
• fix(ci): vendored-schemas mutant harness runs its nine guard runs in parallel (fix(ci): vendored-schemas mutant harness runs its nine guard runs in parallel #5481)
• fix(build-sha): stamp apr --version with --short=9, the comparators' length (fix(build-sha): stamp apr --version with --short=9, the comparators' length #5262)
• fix(pr-review): current quorum-lane model ids (gemini-4-argon-high, claude-sonnet-5-5, claude-haiku-5-5) (fix(pr-review): current quorum-lane model ids (gemini-4-argon-high, claude-sonnet-5-5, claude-haiku-5-5) #5428)
• fix(gate): laya-train SCOPE no longer reads the judge crate's laya-named files as model code (Refs check_laya_train_rules: SCOPE treats the judge crate's laya-named files as laya-train model code #5448) (fix(gate): laya-train SCOPE no longer reads the judge crate's laya-named files as model code (Refs #5448) #5450)
• fix(guard): dogfood.sh C14 reads its output with here-strings, not printf into grep -q (Refs dogfood.sh C14: two printf|grep -q sites push check_no_pipe_into_grep_q over its ceiling #5457) (fix(guard): dogfood.sh C14 reads its output with here-strings, not printf into grep -q (Refs #5457) #5458)
• fix(apr-cli): apr ptx --help carries the unavailable-in-this-build marker (Refs apr ptx --help (0.69.3) omits the 'unavailable in this build' marker that #2399 says it must carry #4474) (fix(apr-cli): apr ptx --help carries the unavailable-in-this-build marker (Refs #4474) #5456)
• fix(deps): zip 2.4.2 -> 9.0.4 for RUSTSEC-2026-0367, deflate only (Refs RUSTSEC-2026-0367: zip 2.4.2 in aprender-train fails guard-cargo on main #5459) (fix(deps): zip 2.4.2 -> 9.0.4 for RUSTSEC-2026-0367, deflate only (Refs #5459) #5460)
• fix(deps): port aprender-orchestrate to serde-saphyr (Refs serde_yaml → serde-saphyr swap, stage S4: apr-cli, contracts-cli, train #5209) (fix(deps): port aprender-orchestrate to serde-saphyr (Refs #5209) #5421)
• fix(guard): check_bashrs_gate.sh feeds grep -q without a pipe (Refs check_hardcoded_paths.sh self-test flakes: printf | grep -q gets SIGPIPE under pipefail #5374) (fix(guard): check_bashrs_gate.sh feeds grep -q without a pipe (Refs #5374) #5424)
• fix(guard): check_row_pr_write_set.sh feeds grep -q without a pipe (Refs check_hardcoded_paths.sh self-test flakes: printf | grep -q gets SIGPIPE under pipefail #5374) (fix(guard): check_row_pr_write_set.sh feeds grep -q without a pipe (Refs #5374) #5422)
• fix(PP-QUANT-001 M2: reconciliation gate — GgmlType vs the vendored ggml.h id list at a pinned sha; exhaustive matches, no _ => #3431): GgmlType matches name every id instead of swallowing them with _ (Refs PP-QUANT-001 M2: reconciliation gate — GgmlType vs the vendored ggml.h id list at a pinned sha; exhaustive matches, no _ => #3431) (fix(#3431): GgmlType matches name every id instead of swallowing them with _ (Refs #3431) #5420)
• fix(guard): ci_gpu_touched.sh feeds grep -q without a pipe (Refs check_hardcoded_paths.sh self-test flakes: printf | grep -q gets SIGPIPE under pipefail #5374) (fix(guard): ci_gpu_touched.sh feeds grep -q without a pipe (Refs #5374) #5425)
• fix(serve): apr run -v prints every encoded prompt id, not the first 30 (Refs E7: qwen3_moe model-family contract first (contract → code → parity) #5056) (fix(serve): apr run -v prints every encoded prompt id, not the first 30 (Refs #5056) #5418)
• fix(rex): S-4 cap in decide() records its reason (FALSIFY-RXG-008) (fix(rex): S-4 cap in decide() records its reason (FALSIFY-RXG-008) #5415)
• fix(serve): Ollama shim reports done_reason "length" when num_predict is hit (Refs apr serve /api/chat stream says done_reason stop when num_predict truncates (R-5, Ollama shape) #5357) (fix(serve): Ollama shim reports done_reason "length" when num_predict is hit (Refs #5357) #5414)
• fix(serve): GPU/CUDA routes stop on the EOS plus every EOG marker (Refs apr serve: GPU/CUDA /v1/completions paths stop on a single EOS or none (follow-up to #4339) #4345) (fix(serve): GPU/CUDA routes stop on the EOS plus every EOG marker (Refs #4345) #5386)
• fix(ci): a kicked merge-queue entry's re-enqueue cancels the dead run on its ref (CI: a kicked merge-queue entry's dead run holds the concurrency group of its re-enqueue #5381) (fix(ci): a kicked merge-queue entry's re-enqueue cancels the dead run on its ref (#5381) #5385)
• fix(serve): constrained EOS and 499, response_format type refusal, Ollama done_reason, code help (Schema-constrained decoding in apr (--json-schema or grammar) — three customers: arbiter's quorum lane, tool calling in verb set V, and the ruchy language #3568 apr serve /api/chat stream says done_reason stop when num_predict truncates (R-5, Ollama shape) #5357 apr code --output-format json help text lists a stale envelope (no backend, status, error) #5211) (fix(serve): constrained EOS and 499, response_format type refusal, Ollama done_reason, code help (#3568 #5357 #5211) #5407)
• fix(ci): test tier diffs the PR from its merge-base, not the base tip (Test tier picks crates by diffing the base tip against HEAD, not merge-base against HEAD: a PR behind main goes red on crates only main touched #5391) (fix(ci): test tier diffs the PR from its merge-base, not the base tip (#5391) #5405)
• fix(release): rehearsal guard refuses a cargo config token (Refs rehearsal guard: a registry token in $CARGO_HOME/config.toml is not checked (follow-up to #4813) #4844) (fix(release): rehearsal guard refuses a cargo config token (Refs #4844) #5402)
• fix(docs): no README or manifest points at an archived pre-monorepo repo; pv ontology readme gates it (Refs README ontology: no README links an archived pre-monorepo repo; pv-validated #5382) (fix(docs): no README or manifest points at an archived pre-monorepo repo; pv ontology readme gates it (Refs #5382) #5392)
• fix(ci): install the pinned toolchain before the x86-main sections (kaizen: guard-cargo#m60 downloads the pinned 1.93.0 toolchain at test time — the toolchain step installs stable, so a network blip kills a merge group #5403) (fix(ci): install the pinned toolchain before the x86-main sections (#5403) #5406)
• fix(ci): the merge_group tier step retries its two GitHub lookups, then falls to full (Refs kaizen: tier step dies on a non-JSON GitHub reply — a 60-min merge group lost at step 7; retry, then fall back to the full tier #5399) (fix(ci): the merge_group tier step retries its two GitHub lookups, then falls to full (Refs #5399) #5400)
• fix(finetune): from_pretrained refuses a trained adapter it cannot read (aprender-train: InstructPipeline::from_pretrained only warns when the adapter cannot be read, then trains fresh adapters #4698) (fix(finetune): from_pretrained refuses a trained adapter it cannot read (#4698) #5377)
• fix(deps): aprender-present-terminal reads YAML through serde-saphyr (S3b, Refs Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths #5326) (fix(deps): aprender-present-terminal reads YAML through serde-saphyr (S3b, Refs #5326) #5378)
• fix(guard): four self-test rows read a match as a miss under pipefail (Refs check_hardcoded_paths.sh self-test flakes: printf | grep -q gets SIGPIPE under pipefail #5374) (fix(guard): four self-test rows read a match as a miss under pipefail (Refs #5374) #5379)
• fix(build): serve reads its arch-requirements and tensor-names contracts in-tree; three dead binding stubs removed (Refs build scripts still read the gone provable-contracts sibling path: serve codegen (arch-requirements, tensor-names), graph, verify, verify-ml (#4369 class) #4380) (fix(build): serve reads its arch-requirements and tensor-names contracts in-tree; three dead binding stubs removed (Refs #4380) #5372)
• fix(contracts): 370 contracts bound to real tests, off the no-test debt list (803 -> 433) (DEFECT: pv validate passes a contract with no falsification tests or an empty test_harness (763 contracts have zero tests) #5291) (fix(contracts): 370 contracts bound to real tests, off the no-test debt list (803 -> 433) (#5291) #5369)
• fix(deps): 14 small crates read YAML through serde-saphyr, not serde_yaml (Refs Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths #5326) (fix(deps): 14 small crates read YAML through serde-saphyr, not serde_yaml (Refs #5326) #5365)
• fix(pv): refuse empty or missing falsification tests; walk kaizen; no-test debt 803 only shrinks, capped per release (Refs DEFECT: pv validate passes a contract with no falsification tests or an empty test_harness (763 contracts have zero tests) #5291) (fix(pv): refuse empty or missing falsification tests; walk kaizen; no-test debt 803 only shrinks, capped per release (Refs #5291) #5362)
• fix(rehearse): D5 matched a refusal line prepare_bump no longer prints (E1 D5: --ship takes the rehearsal's T-2 GO on an ancestor commit, not a GO on origin/main's head (design first) #5060) (fix(rehearse): D5 matched a refusal line prepare_bump no longer prints (#5060) #5354)
• fix(nightly): the lanes rows test pinned rows main no longer has, so the train self-test broke before any verdict (B1: Nightly Train 2026-10-10 has 14 not_measured verdict rows, one owner per row #5079) (fix(nightly): the lanes rows test pinned rows main no longer has, so the train self-test broke before any verdict (#5079) #5355)
• fix(deps): wasmtime 48.0.4 -> 48.0.6 for the RUSTSEC-2026-0353..0364 advisories (Refs wasmtime 47.0.4 is affected by RUSTSEC-2026-0315/0316: security job red on main and every PR #4633) (fix(deps): wasmtime 48.0.4 -> 48.0.6 for the RUSTSEC-2026-0353..0364 advisories (Refs #4633) #5361)
• fix(flake): test_stack_unwinding_does_not_crash lists a dir it owns, and says why it failed (Refs GATE flake: aprender-profile test_stack_unwinding_does_not_crash fails in workspace-test shard 3 (MQ run 38015871565) #5018) (fix(flake): re-enable test_stack_unwinding_does_not_crash on a dir it owns (Refs #5018) #5352)
• fix(deps): drop the unused bashrs crate from aprender-compute-xtask and aprender-orchestrate (cargo-deny: unsafe-libyaml unmaintained (RUSTSEC-2024-0449) — interim ignore, then serde_yaml swap #5205) (fix(deps): drop the unused bashrs crate (#5205 S1) #5350)
• fix(deps): rustls 0.23.46 and drop aws-sdk-s3's legacy rustls 0.21 client (RUSTSEC-2026-0346..0349) (fix(deps): rustls 0.23.46 and drop aws-sdk-s3's legacy rustls 0.21 client (RUSTSEC-2026-0346..0349) #5343)
• fix(apr-wgpu): the stop token ended the reply and was printed as its id (Refs APR model on the wgpu path emits the EOS id in its text; GGUF with the same tokens is clean #4984) (fix(apr-wgpu): the stop token ended the reply and was printed as its id (Refs #4984) #5269)

Changed

• refactor(simulate): split tsp_instance.rs so each file passes the pre-commit complexity limit (Refs complexity split: aprender-simulate tsp_engine.rs / tsp_instance.rs / edd/loader.rs tests out (pre-commit file limit), unblocks #6020 #6025)
• refactor(simulate): split edd/loader.rs so each file passes the pre-commit complexity limit (Refs complexity split: aprender-simulate tsp_engine.rs / tsp_instance.rs / edd/loader.rs tests out (pre-commit file limit), unblocks #6020 #6025)
• refactor(simulate): split tsp_engine.rs so each file passes the pre-commit complexity limit (Refs complexity split: aprender-simulate tsp_engine.rs / tsp_instance.rs / edd/loader.rs tests out (pre-commit file limit), unblocks #6020 #6025)
• refactor(yaml): aprender-simulate build.rs reads contract YAML through serde-saphyr (S2, Refs serde_yaml swap S3: aprender-simulate → serde-saphyr (build.rs done in #6019; src/ remains) #6020)
• refactor(yaml): aprender-contracts-cli reads YAML through serde-saphyr (S4, Refs serde_yaml → serde-saphyr swap, stage S4: apr-cli, contracts-cli, train #5209) (refactor(yaml): aprender-contracts-cli reads YAML through serde-saphyr (S4, Refs #5209) #5507)
• refactor(apr-cli): five hook-refused files under complexity 30/25 (unblocks DIRTY fix(build-sha): stamp apr --version with --short=9, the comparators' length #5262/fix(pv): refuse empty or missing falsification tests; no-test debt only shrinks, capped per release (Refs #5291) #5295/ci: x86-main-advisories runs on any clean-room runner, not only X64 (Refs #5435) #5440/ci: mg-reuse runs on push only; x86-main asks for a runner at t=0 on the queue (20X S1) #5447) (refactor(apr-cli): five hook-refused files under complexity 30/25 (unblocks DIRTY #5262/#5295/#5440/#5447) #5464)
• refactor(yaml): apr-cli reads YAML through serde-saphyr (S4, Refs serde_yaml → serde-saphyr swap, stage S4: apr-cli, contracts-cli, train #5209) (refactor(yaml): apr-cli reads YAML through serde-saphyr (S4, Refs #5209) #5416)
• refactor(yaml): five crates read YAML through serde-saphyr (S2, Refs serde_yaml swap S2: present, present-yaml, test-lib, serve, qa-runner, core → serde-saphyr #5208) (refactor(yaml): five crates read YAML through serde-saphyr (S2, Refs #5208) #5363)

Other

• evidence(perf041): refresh the PP-26 witness and marker on lambda at 046ad6a
• roadmap: regenerate roadmap.yaml from fragments (main + PMAT-6200 only) (Refs CI: pin ci/gate, gate and mg-reuse-self-test to X64 runners #6200)
• lab: guard against per-function coverage tickets; the scan updates epic EPIC: Coverage gaps — function-level tests (single checklist) #5875 (Refs intake: coverage scan updates the #5875 report, never one ticket per function #5879)
• batch: lane-a-1 coverage fold, regenerate (Refs test(serve): crux_c_34_003 bounds uptime delta by measured wall clock (Refs #5783) #5784)
• Revert "ci: drop X64 from arch-neutral runs-on, pin the FULL tier's shards to X64 ... (ci: drop X64 from arch-neutral runs-on, pin + assert x86_64 on the FULL tier (#5871 re-cut, #5882 blocker) #5891)" (Revert "ci: drop X64 from arch-neutral runs-on ... (#5891)" (REVERT RULE: 0 merges/h) #5907)
• tooling(arm): arm_pr_automerge.sh refuses a PR whose base is not main (tooling(arm): arm_pr_automerge.sh refuses a PR whose base is not main #5824)
• batch 6: draw_scrollbar + render_disk_box tests (Refs test: cover draw_scrollbar in aprender-explain/src/tui/mod.rs #5623, test: cover render_disk_box in aprender-cbtop/src/app/render/panels.rs #5603) (batch 6: draw_scrollbar + render_disk_box tests (Refs #5623, #5603) #5777)
• batch 5: StepProfiler split + /health binary_sha256 (Refs test(cov): top coverage-gap fn in apr-cli (≤200 lines, w5404) #5577, EPIC 0.73.0: Agent Ready — apr serve as the one agent gateway (E-1/E-2, R-1..R-9) #5348) (batch 5: StepProfiler split + /health binary_sha256 (Refs #5577, #5348) #5776)
• batch 4: SIM-4 capacity-bound check (Refs aprender-simulate: PR-flow model SIM-1..5 (port, contract tests, live drift andon; no Python) #5511) (batch 4: SIM-4 capacity-bound check (Refs #5511) #5774)
• batch(manual-1615): fold 6 ready branches (test(simulate): cover validate_verification_tests (EDD-07) #5735 test: fold train loader try_load_apr coverage #5592 test: fold #5538 DataCard::paint coverage #5586 test(apr-cli): fold run print_run_output coverage (FALSIFY-OPS-013) #5657 test(registry): fold DownloadProgress human accessors coverage #5672 contracts.nt + witness are generated shared files: every contract PR conflicts (regen-at-merge vs fragment) #5762) (batch(manual-1615): fold 6 ready branches (#5735 #5592 #5586 #5657 #5672 #5762) #5765)
• batch(manual-b2): fold 3 ready branches (test: cover print_coverage_report in aprender-contracts-cli/src/commands/coverage.rs #5621 test: cover collect_partials_cdp in aprender-test-lib/src/validators.rs #5625 test: cover generate_fkr_tests in aprender-ptx-debug/src/output/fkr_generator.rs #5624) (batch(manual-b2): fold 3 ready branches (#5621 #5625 #5624) #5766)
• test+refactor: fold cbtop bottleneck (test: cover analyze_bottlenecks in aprender-cbtop/src/optimize/bottleneck.rs #5548) and process_tracer next cog (test: cover to_otlp_span in aprender-profile/src/process_tracer.rs #5568) (test+refactor: fold cbtop bottleneck (#5548) and process_tracer next cog (#5568) #5709)
• evidence(perf041): Qwen3.5-4B batched-serving witnesses, c 1/4/8/16 (Refs apr serve on CUDA: batch concurrent Qwen3.5 requests correctly #5312) (evidence(perf041): Qwen3.5-4B batched-serving witnesses, c 1/4/8/16 (Refs #5312) #5495)
• ci-tools: nextest-fail-fast, the nextest guard's TOML judge in Rust (Refs port the nextest fail-fast guard's embedded Python TOML reader to Rust (C301) #5032) (ci-tools: nextest-fail-fast, the nextest guard's TOML judge in Rust (Refs #5032) #5370)

Also in this range: 112 ci, test, chore and docs commits (not listed).

keep-open: #3568 #3720 #3745 #4698 #4709 #4780 #5060 #5079 #5312 #5326 #5348 #5381 #5399 #5403 #5427 #5577 #5678 #5875 #6042 #6185 #6211 #6235 #6255 #6360 -- cited by the CHANGELOG for context; each closes via its own PR; the release EPIC closes at T-4

🤖 Generated with Claude Code

[noahgift]

Size disclosure (MT-11): same tree as #6404 (c454f1db), over the 400-line guideline. Most of the added lines (8906) are the release evidence file evidence/crux/0.72.0/prompt-certification.json; the rest is the version bump, CHANGELOG, Cargo.lock/Cargo.toml and roadmap. MT-11 is not CI-enforced. Handled as for #6321/#6404: disclosure comment, no waiver trailer.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=6412 head=c32f19d0be0557a93603ff7a4213602cc652944b verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.