release(0.69): batch — 15 receipted PRs + fleet-pv andon fix, one CI run, one queue slot

.github/workflows/ci.yml

@@ -445,7 +445,9 @@ jobs:
           case "${GITHUB_EVENT_NAME}" in
             pull_request)
               git fetch --no-tags --depth=1 origin "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}"
-              git diff --name-only "origin/${GITHUB_BASE_REF}" HEAD > "$RUNNER_TEMP/touched.txt"
+              # --no-renames (#3664): a rename must list BOTH paths, or a source
+              # moved into docs/ reads as docs-only and runs zero tests.
+              git diff --no-renames --name-only "origin/${GITHUB_BASE_REF}" HEAD > "$RUNNER_TEMP/touched.txt"
               printf 'touched (tip vs tip): %s path(s)\n' "$(wc -l < "$RUNNER_TEMP/touched.txt" | tr -d ' ')"
               args+=(--diff-from "$RUNNER_TEMP/touched.txt")
               ;;
@@ -827,6 +829,17 @@ jobs:
         run: |
           printf 'workspace-test REUSED: %s\n' "${{ steps.tier.outputs.reason }}"
           printf 'cited PR head: %s\n' "${{ steps.tier.outputs.cite }}"
+      # #3658 NONE: the tier step proved the change gives workspace-test nothing
+      # to measure -- every touched path is under docs/roadmaps/ or docs/audits/
+      # and present at HEAD (no Rust source, test or tree reader reads them), or
+      # the change lands no path at all. Nothing is built or run; this step
+      # records why, so the skip is auditable in the log.
+      - name: "None: nothing for workspace-test to measure (#3658)"
+        if: steps.tier.outputs.tier == 'none'
+        env:
+          REASON: ${{ steps.tier.outputs.reason }}
+        run: |
+          printf 'workspace-test NOT RUN: %s\n' "$REASON"
       - name: Build.rs crate-root escape check (v0.31.1 yank guard)
         if: matrix.shard == 1
         # Static Poka-Yoke: flags build.rs files that panic on files outside
@@ -1211,6 +1224,14 @@ jobs:
         run: bash scripts/derive_model_manifest.sh --check
       - name: C14 model-parity case table (L0-1a, #2971)
         run: bash scripts/check_model_parity.sh --self-test
+      # #3577: the parity-receipt denominator is the SECOND, independent reader of the
+      # receipt corpus — the extractor is the first, and they share no code so a defect
+      # in either is caught by the other rather than by nobody. It shipped unwired, which
+      # `check_guards_are_wired.sh` caught: a refusal nothing runs is not a refusal, and
+      # `parity-receipt-v1.yaml`'s own equations name "both readers are wired into CI" as
+      # a precondition. Its 4-case self-test is cargo-free and model-free, so it runs here.
+      - name: Parity-receipt denominator case table (#3577)
+        run: bash scripts/parity_receipt_denominator.sh --self-test
       # F-1 (#3022, #3024): a model file the user NAMED is the model that answers, or
       # the command refuses — `apr chat` silently loaded its toy demo model for a
       # `model.safetensors.index.json` (exit 0, zero tokens, the real path in the banner)

README.md

@@ -41,7 +41,7 @@ publishing — all backed by YAML provable contracts that fail CI on drift.
 | Metric | Count | Source of truth |
 |-------:|------:|---|
 | Workspace crates | **79** workspace crates | `cargo metadata --no-deps` (NOT `ls crates/` — 4 are `exclude`d, 1 has no Cargo.toml) |
-| Provable contracts | **<!-- CONTRACT_COUNT_START -->1801<!-- CONTRACT_COUNT_END -->** provable contracts | `contracts/census.json` `.n_files` — the set `pv lint` walks (`pv census`, ONT-001 ONT-1; regenerated by `make contracts`, written by `make readme-sync`, guarded by `scripts/check_readme_claims.sh`) |
+| Provable contracts | **<!-- CONTRACT_COUNT_START -->1828<!-- CONTRACT_COUNT_END -->** provable contracts | `contracts/census.json` `.n_files` — the set `pv lint` walks (`pv census`, ONT-001 ONT-1; regenerated by `make contracts`, written by `make readme-sync`, guarded by `scripts/check_readme_claims.sh`) |
 | CLI commands | **110** CLI commands | `apr --help` |
 | Book CLI chapters | **112** chapters | `ls book/src/cli/*.md` |
 | Book lib chapters | **71** chapters | `ls book/src/lib/*.md` (parity with `pub mod`) |
@@ -262,7 +262,7 @@ falsification_tests:
   prediction: apr validate bad-model.apr exits non-zero
 ```
 
-The tree carries <!-- CONTRACT_COUNT_START -->1801<!-- CONTRACT_COUNT_END --> contracts across inference, training, quantization, attention, FFN,
+The tree carries <!-- CONTRACT_COUNT_START -->1828<!-- CONTRACT_COUNT_END --> contracts across inference, training, quantization, attention, FFN,
 tokenization, model formats, CLI safety — and this README itself.
 
 ## Migration from old crates

ci/explicit-test-commands.d/420-aprender-contracts-cli-ont4c3-parity-receipts.cmd

@@ -0,0 +1 @@
+cargo test -p aprender-contracts-cli --test ont4c3_parity_receipts

ci/explicit-test-commands.d/430-aprender-contracts-cli-ont-refusal-receipt.cmd

@@ -0,0 +1 @@
+cargo test -p aprender-contracts-cli --test ont_refusal_receipt

contracts/apr-dogfood-coverage-v1.yaml

@@ -56,6 +56,12 @@ metadata:
     # drifted, +45 lines at ce712eae0 and -39 at bd475b06f, so every citation was
     # 6 lines short of its arm), and two new rows for `apr test llm bench` and its
     # `--band` mode, which shipped with no ledger entry at all.
+    # PARTIAL RE-AUDIT, 0.69 release batch #3669 (G2.1). Same rule, same reason:
+    # `measured_commit` does not move, and a batch-branch SHA would not survive the
+    # squash merge anyway. #3604 inserted 4 lines (`--revalidate`) after line 138 of
+    # crates/apr-cli/src/commands_enum.rs. All 64 citations of that file in 55 rows
+    # were re-derived: 42 at lines >= 139 shifted by +4, 22 at <= 138 unchanged, and
+    # every cited line's text was checked identical between 79a3af79d and the batch.
     ledger: docs/audits/surface_audit.csv
 
     overall:

contracts/apr-inspect-dtype-naming-v1.yaml

@@ -1,12 +1,13 @@
 metadata:
-  version: 1.0.0
+  version: 1.1.0
   created: '2026-04-05'
   author: PAIML Engineering
   description: "apr inspect/rosetta dtype naming contract — DType column must render human-readable GGML type names (F32, Q4_K, Q6_K), never raw integer discriminants"
   references:
     - "paiml/aprender#619 (inspect/rosetta: DType column shows integer IDs instead of names)"
     - "paiml/aprender#605 (DType IDs historical pattern)"
     - "paiml/aprender#603 (quantization field shows '0' — downstream of same root cause)"
+    - "paiml/aprender#3601 (names read from trueno_quant::TRAITS; ids 31-42 — TQ1_0, TQ2_0, MXFP4, NVFP4, Q1_0, Q2_0 — are named, removed ids stay 'unknown')"
   registry: true
   tags:
     - cli
@@ -24,7 +25,7 @@ equations:
     invariants:
       - "TensorInfo.dtype is ALWAYS a human-readable name from the GGML canonical set"
       - "TensorInfo.dtype NEVER parses as an integer via str::parse::<u32>"
-      - "GGML_NAMES = {F32, F16, Q4_0, Q4_1, Q5_0, Q5_1, Q8_0, Q8_1, Q2_K, Q3_K, Q4_K, Q5_K, Q6_K, Q8_K, IQ2_XXS, IQ2_XS, IQ3_XXS, IQ1_S, IQ4_NL, IQ3_S, IQ2_S, IQ4_XS, I8, I16, BF16, I32, I64, F64, IQ1_M, unknown}"
+      - "GGML_NAMES = {F32, F16, Q4_0, Q4_1, Q5_0, Q5_1, Q8_0, Q8_1, Q2_K, Q3_K, Q4_K, Q5_K, Q6_K, Q8_K, IQ2_XXS, IQ2_XS, IQ3_XXS, IQ1_S, IQ4_NL, IQ3_S, IQ2_S, IQ4_XS, I8, I16, BF16, I32, I64, F64, IQ1_M, TQ1_0, TQ2_0, MXFP4, NVFP4, Q1_0, Q2_0, unknown}"
 
   cross_cmd_consistency:
     formula: "∀ tensor T in file F: dtype(inspect F, T) = dtype(tensors F, T)"
@@ -81,8 +82,8 @@ falsification_tests:
 
 kani_harnesses:
   - id: KANI-INSPECT-DTYPE-001
-    obligation: "Every GGML u32 discriminant ∈ [0,30] maps to a non-integer name"
-    bound: 31
+    obligation: "Every GGML u32 discriminant ∈ [0,42] (GGML_TYPE_COUNT = 43) maps to a non-integer name"
+    bound: 43
     strategy: bounded_int
 
 qa_gate:

contracts/binding.yaml

@@ -764,7 +764,7 @@ bindings:
   notes: "P = V*d + L*(d_attn + d_ffn + d_norm) + d_final + V*d. Per-layer terms come in as data\
     \ (&[LayerParams]) so a hybrid family can mix layer kinds. QE2E-INV-001 (P(9B) in [9.0B, 9.2B])\
     \ is NOT discharged: dense/GQA accounting gives 8.21B and the Gated DeltaNet d_attn needs\
-    \ inner_size/state_size/conv_kernel/group_count, which ModelConstraints does not carry (#3347)."
+    \ inner_size/state_size/conv_kernel/group_count, which the 9b descriptor disagrees with itself (inner_size 2048 at hidden_dim 4096, and group_count 8 fails group_count*state_size == inner_size), so P(9B) computes to 8.345B; settling it needs a real Qwen3.5-9B GGUF (#3346)."
 - contract: qwen35-e2e-verification-v1.yaml
   equation: flops_per_token
   module_path: aprender::format::model_arithmetic

contracts/census.json

@@ -1,18 +1,18 @@
 {
   "schema": "ont.paiml.dev/census/v1alpha1",
   "git_sha": null,
-  "n_files": 1801,
-  "n_parsed": 1801,
+  "n_files": 1828,
+  "n_parsed": 1828,
   "n_parse_errors": 0,
   "parse_errors": [],
   "quarantined_n": 0,
   "by_kind": {
     "beat-benchmark": 24,
     "corpus-assembly": 1,
-    "kernel": 363,
+    "kernel": 387,
     "model-family": 28,
     "model-family-variant": 1,
-    "pattern": 87,
+    "pattern": 90,
     "pretraining-corpus": 2,
     "registry": 519,
     "schema": 766,
@@ -22,14 +22,15 @@
   },
   "by_entity_type": {
     "gguf": 2,
+    "json": 3,
     "pv-contract": 1
   },
   "by_anchoring": {
-    "unanchored": 1798,
-    "class": 2,
-    "instance": 1
+    "unanchored": 1822,
+    "class": 4,
+    "instance": 2
   },
-  "id_set_sha256": "e624814d2c82e8a53ab24faac0b5281c0dad15618d9f14e970c740c8391cb712",
+  "id_set_sha256": "69d8018f1f9cc7c7f16fb61566d2a405c1c6ab652c90936cc55398a4549825fe",
   "declared_external": [
     {
       "name": "provable-contracts",