feat(ladder): a receipt names the binary that ran, never the checkout HEAD; the judge requires the release binary; GPU calls join gpu-q (#3771)

[noahgift]

#3771: a model-ladder receipt names the binary that ran, never the checkout HEAD; the judge requires the release binary

Stacked on release/0.69.1-batch-1 + the fixture-libs fix (42ae22a) + A2 (#3766). The base is fix/0691-bump-fixture-libs, so this diff is A2 + #3771. The quorum judges only #3771's two commits (--base = A2's head on this branch).

Found by aprender-fd: model_ladder.sh recorded sha = the worktree HEAD, and check_model_ladder.sh gated on the version string alone. A run recorded bfd99757c while executing b89d126fc.

Commit 1: the receipt's identity is the binary

file	change
scripts/model_ladder.sh	sha = the git sha parsed from "$APR" --version; a binary naming no sha is a decline. Also records apr_version verbatim, apr_sha = the binary's full commit, and checkout_sha = HEAD (recorded, never judged). Adds --identity-probe
scripts/check_model_ladder.sh	per host: apr_version must carry a sha, sha must equal it, and it must be prefix-equal to the release binary's sha. That sha is read from the pinned binary (apr_bin.sh), or from MODEL_LADDER_RELEASE_SHA for case tables; the verdict names the source. A version-string match alone is refused
scripts/check_release_bump_pr_body.sh	fixture receipts name apr 9.9.9 (0123abc), and the fixture run exports MODEL_LADDER_RELEASE_SHA=0123abc
contract	MCL-INV-010, FALSIFY-MCL-018

Sweep (done_when 4). Only model_ladder.sh recorded HEAD as the identity of what ran. The rest fall into three groups:

• pinned by construction: perf002/perf041 probes and dogfood.sh (via apr_bin.sh's freshness check, APR_BIN included);
• HEAD compared against the release commit: release/models_t1.sh, autopilot.sh, publish_strict.sh, check_publish_preflight.sh;
• not a measurement's identity: a signing or source repo's own HEAD, git plumbing, and fixtures.

The full per-line list is in the fragment.

Commit 2: ordered GPU access (cop rule rev 6)

apr_locked joins the fleet's gpu-q queue when gpu-q --caps lists wait: GPUQ_WAIT=$LOCK_WAIT gpu-q --prio ${MODEL_LADDER_GPU_PRIO:-1}. Otherwise it keeps the bounded flock, which says it may have jumped the queue. The bounded-wait contract is the same on both routes.

Measured on this head

• check_model_ladder.sh --self-test: 58 cases, 0 bad. Newly killed: judge mutants binary-mismatch and no-binary-named; producer mutants identity-is-head, gpuq-unbounded and gpuq-no-caps.
• Probes:
  • a fake apr 9.9.9 (feedbee12) → sha=feedbee12 with checkout ≠;
  • a bounded fake gpu-q → prio 1, wait=7, under the lock at oom 1000;
  • an unbounded gpu-q → not used.
• check_release_bump_pr_body.sh: 12/12 · contracts lib 1701/0 · pv lint PASS · bashrs 0 errors.

Where the gate runs

check_model_ladder.sh is declared only in Cargo.toml [package.metadata.dogfood] (T-2) and listed in scripts/unwired_guards_baseline.txt, so no PR workflow runs it.

Refs #3771 #3712
keep-open: #3771 closes when this folds; #3712 stays open for its remaining rows.

🤖 Generated with Claude Code

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3771",
 "head": "b69348396e1cef4a24740e7a71edb4cc51cb2504",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 10
  },
  {
   "lane": 2,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3771",
 "head": "b69348396e1cef4a24740e7a71edb4cc51cb2504",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 14
  },
  {
   "lane": 2,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "NO-VERDICT",
   "findings": 0
  }
 ]
}

[noahgift]

Seat status (aprender-62, 02:34Z): NOT seated, and it needs 2 fills. Head b69348396, judged against 395756d06 (A2's head). There is 1 independent PASS, gpt-oss in lane 3 of quorum-archive/3771-gemini-503-022336/. There are also 2 claude-opus-4-6-thinking PASSes, but those are same family as the author and don't count as independent. Every other lane returned no verdict (503). Self-test proof: check_model_ladder.sh --self-test gives 58 cases, 0 bad; guard_tree --no-cargo gives 92/0; check_release_bump_pr_body.sh gives 12/12.

[noahgift]

Triage #4158 (needs-owner): its base fix/0691-bump-fixture-libs is a branch with no PR: retarget to main. The cop assigns an owner from the 0.70 scope.

[noahgift]

fold source for the 0.70 integration branch; branch kept at PMAT-3771-binary-identity @ b69348396e1cef4a24740e7a71edb4cc51cb2504.

Closed under the operator 1-day PR rule (2026-09-24); the rule does not wait on #4046. aprender-6c folds from the branch ref above into the 0.70 integration branch (built off main after #4046 merges).