feat(release): APR-RELEASE-001 §5 P0·Instrument — make build-report reads the 1092 ledger records nothing read

[noahgift]

What

APR-RELEASE-001 §5 P0·Instrument's Done test is "≥ 20 records; make build-report runs on a clean checkout". Measured on main: 1092 ledger records are committed under docs/build-ledger/ in exactly the P0·Instrument schema — 1084 of them job records — and nothing in the tree read one. So the first half passes 54× over and the second half had no mechanism, which is why §1's p95, §1's max-PRs-per-train and the whole of §7's gate: line were still [U] while the data sat in git.

This is the sccache class: recorded thousands of times, never compared.

scripts/build_report.sh reads them in 0.27 s, byte-identical across runs.

What it says — the numbers that were [U] until now

host_class	n	p50 total_s	p95 total_s	p50 queue_s	p95 queue_s
gx10	509	366	2282	137	1399
intel	454	666	4994	34	1066
yoga	121	340	3518	11	832

gate:    p95 ci/gate 20.1 | max PRs/train 120 | queue p95 intel 1066 yoga 832 gx10 1399

Two things fall out of that table that no occupancy average could show. gx10 carries more jobs than intel (509 vs 454) and has the worst queue p95 (1399 s vs 1066 s) — the box the packing rule treats as spare capacity is the busiest by count and the slowest to start. And intel is the slowest per job (p95 4994 s).

The correction §1 needs

The first run of the report falsified the spec's own equation. §1 computes max PRs/train ≈ 3 × 72 h / p95(ci / gate). The required checks on main are gate and workspace-test, and a PR merges when the slowest one is green:

required check	n	p95 total_s
workspace-test	147	6451 ← binds
ci / gate	163	1205
gate	158	255

So §1 as written answers 645 and the honest answer is 120 — a 5.4× overstatement, on the one number §8 uses to decide whether to stop cutting trains ("measured max PRs/train < 10 [A]"). The report computes the bound over the required-check set, names which check binds, and prints the ratio by which §1's own form overstates. The gate: line keeps its specified shape; only the number is honest.

Both spellings are listed because they are one check: branch protection names ci / gate, ruleset 13878864 names a bare gate, and scripts/pr_review_quorum_arm.sh already accepts either for that reason.

Contract

scripts/check_build_report.sh, 35 assertions, run from make lint-scripts and from the new workflow:

• exit 2 + decline: below the §8 floor of 20 job records — a report over a thin ledger that prints 0 reads exactly like a fast fleet
• exit 1 + reject: on anything that is not a JSON object, never a silent skip
• a valid record with no total_s is skipped and the skip is printed (8 of 1092: 5 fleet-pack, 2 reconcile, 1 train)
• nearest-rank percentiles, case-tabled over 1..100 at k=1, 7, 29, 50, 95, 100 and over [7] and [1,2,3]

The ledger is per job, not per test target; the output says so where §5 asks for "10 slowest test targets" rather than inventing per-target numbers. peak_rss_mb and free_disk_gb are null on every record because the Actions REST API does not expose them — the report prints them as [U], it does not drop them.

Review found four defects, and they are fixed

make gate and a 3-lane review quorum ran against the first green implementation.

#	Found by	Defect
1	3/3 lanes, grounding=measured	a JSON value that is not an object aborted jq with exit 5, not the contracted exit 1. The guard had only tried plain text, which jq rejects cleanly — so the contract looked kept
2	3/3 lanes	an empty or whitespace-only file parsed to nothing and exited 0 — silently dropped, never counted
3	1/3 lanes	ceil(k/100.0 × n) in floating point: (7/100.0)*100 is 7.000000000000001, so p7 of 1..100 answered 8. The same lane correctly judged that a k=50/95/100 table cannot reach it — too coarse, not wrong
4	check_guards_are_wired.sh	build_report.sh was named by no workflow. make lint-scripts runs its guard, but Makefile-only means make tier3, which CI does not run — the same gap toolchain-ceiling.yml documents for check_msrv.sh. Unwired guards grew 3 → 4

Each has a case-table row that goes RED without its fix. Defect 4 is why .github/workflows/build-report.yml exists; the guard is back to its 3-entry baseline.

Gate

make gate reports 4 failures on this branch. None is caused by this diff — each was run on this branch and on a branch without these changes, in the same minute:

check	this branch	without these changes	verdict
check_baseline_ratchets	rc=1	rc=1	pre-existing: baselines recorded under pmat 3.39.0 / bashrs 7.0.1, runner has 3.40.0 / 7.4.1
check_complexity_ratchet	rc=1	rc=1	pre-existing, same instrument drift
check_silicon_coverage	rc=0 now, rc=1 15 min earlier	rc=0	time-dependent — the verdict changed with no commit between. A guard whose answer moves on the wall clock is worth its own ticket
check_guards_are_wired	rc=0	rc=0	was mine (3 → 4), fixed

How it composes with #3207

#3207 is the writer — scripts/collect_build_ledger.sh plus the nightly that appends records. This is the reader. Disjoint files; neither blocks the other. #3207 is what keeps this report's input growing; without it the ledger stops at 1092.

no-close: P0·Instrument has no issue of its own — the row is named in docs/specifications/APR-RELEASE-001-train-and-build-kaizen.md §5, and arrival already outruns closure 2:1, so this files nothing new.

keep-open: #3269 is the ONT-1 epic this PR's pv-contract row waits on; #3225 stays open too — this PR lands the instrument but its receipt is PARTIAL (pv contract NotRun until ONT-1), so it deliberately does not close the ticket.

ont-delta: none — no entity type, shape or resolves: target yet; the §11.1 delta for this surface is a code contract over the ledger record schema, and it waits on ONT-1 (pv census), epic #3269.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3271 head=b6d36916ab555d56da7cc6ad2dad6431bc104af0 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

This tool just answered a §5 row that the spec still lists as unstarted work

Dogfooding build_report.sh's own data against §5 P2 · Shard across hosts, whose Done test reads: "one PR's gate runs on ≥ 2 hosts; build-report prints p95 queue-wait per host; zero ENOSPC in 10 trains."

Measured over the committed ledger (1084 job records, 119 distinct shas):

clause	verdict
one PR's gate runs on ≥ 2 hosts	112 of 119 shas (94%) ran jobs on ≥ 2 host classes; 50 on ≥ 3
build-report prints p95 queue-wait per host	this PR — queue p95 intel 1066 yoga 832 gx10 1399
zero ENOSPC in 10 trains	trailing-window, belongs to P0 · Reap

03a00ad55 -> ['gx10', 'intel', 'yoga']
03b526185 -> ['gx10', 'intel']
092cf3ea5 -> ['gx10', 'intel']

So P2 is not pending work — the fleet has been sharding gates across hosts for 119 shas and nothing read the record that proves it. That is the same shape as the row this PR closes: the data was there, nothing compared it.

Worth noting for whoever plans the next build row: §5's queue should be re-derived from the Done tests, not worked top-to-bottom. P0 · Instrument was two-thirds satisfied before this PR (321 gate records ≫ the floor of 20); P2 is two-thirds satisfied now. A row's position in the list is not evidence about its state.

🤖 Generated with Claude Code

[noahgift]

stale — APR-RELEASE-001 §6, applied mechanically 2026-09-20.

No activity since 2026-09-17 13:47Z; 2 release trains have been cut since (v0.68.2, v0.68.1). Age is the only input to this sweep — it is not a judgement on the work, and a train label such as pp-066/carry-* is not an exemption.

What happens next: if one more train passes while this is still labelled stale, §6 closes it. The branch is kept — closing a PR here discards a review thread, never commits.

To clear it: push, rebase, or say on the thread what it is waiting for. Any of the three removes the label at the next sweep. If it is blocked on something external, name that here — a blocker with an owner is not sprawl, and it stops the clock.

[noahgift]

Arming auto-merge at 8271036ab (roadmap/docs-only change; no quorum trigger per AD-04's scope — a real git merge origin/main with the by-id roadmap driver, check_roadmap_diff_additive deleted=0 and check_roadmap_fragment_required both PASS locally on this head). Refs #3459.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3225",
 "head": "8271036ab5053fd437863389534c452c07dbfeb0",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 1
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 3
  }
 ]
}

[noahgift]

Adopted (2026-09-21 sweep; branch cut 09-16, no live session). Quorum round 0: 2 FAIL / 1 PASS. One FAIL was real and is fixed in 9249cb8fd; the other was refuted by measurement.

Lane 3 (gemini-3.6-flash-high, measured, scripts/check_build_report.sh:156) — real, fixed. The label "required set covers the bare gate spelling" is a command substitution under double quotes: every self-test run printed line 156: gate: command not found and labelled the row the bare spelling. The row still passed, so nothing red pointed at it — the same class as the unquoted-heredoc backtick that once ran sudo apt-get from a receipt in this repo. Single quotes now; 0 occurrences, 35/35 rows PASS, bashrs 0 errors. Lane 3's second point — the receipt's table says 16/16 for this script — is also right: the self-test runs 35 rows today. Corrected in the receipt with the counting method named. Its third point (the receipt's own verdict is PARTIAL(escalate), pv contract NotRun) is the author's own statement and stands; whether that DoD item blocks 0.71 is for the owner/cop, not an adoption.

Lane 1 (gemini-3.1-pro-high, measured, Makefile:848) — refuted, not changed. Claim: under .ONESHELL:, appending @bash scripts/check_build_report.sh to lint-scripts swallows bashrs lint's exit code. Test, with the recipe's exact shape (SHELL := /bin/bash, .SHELLFLAGS := -o pipefail -c, .ONESHELL:, false || exit 1 inside the loop, then a second recipe line):

make: *** [Makefile:5: gate] Error 1     ← the second line never ran

exit 1 terminates the single shell; make sees Error 1. The gate is intact. Lane 1's grounding says measured; the measurement was not in the transcript. Recorded so the next reader does not re-derive it.

Earlier on this branch (8271036ab): real git merge origin/main with the by-id roadmap driver, picking up 3863d0819/PMAT-3539; additive guard deleted=0, fragment guard PASS. Re-running the quorum on 9249cb8fd. Refs #3225.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3225",
 "head": "9249cb8fd5a6505c59404f6ed865d21643ed038b",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 2
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 2
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 4
  }
 ]
}

[noahgift]

Quorum round 1 on 9249cb8fd: 2 PASS / 1 FAIL — and the FAIL is a spec-fidelity question I am not going to decide inside an adoption. Lane 1 (gemini-3.1-pro-high, cited scripts/build_report.sh:210, check_build_report.sh:83): APR-RELEASE-001 §5 asks for the 10 slowest test targets; the ledger is per job, so the script reports the 10 slowest jobs and prints that the ledger lacks target granularity, and the case table verifies only the job version. Lane 1's position: an implementation PR may not substitute a spec requirement without amending the spec. Both other lanes passed the same diff. This is a real disagreement about the spec, not about the code, and the spec is the release owner's — so: needs-an-owner on exactly this point. Two honest resolutions exist: (a) amend §5 to say per-job (the ledger cannot answer otherwise, and instrument-first doctrine records the gap), or (b) add a target-level ledger field first. Either is a decision, neither is mine. Everything else on this branch is green (35/35 self-test, bashrs clean, roadmap guards, real merge of main). Lanes preserved for cross-inspection. Refs #3225.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3225",
 "head": "83f3f1a7d8551fff270a8334eb426281d294b383",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 4
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 5
  }
 ]
}

[noahgift]

Round 2 on 83f3f1a7d: 2 PASS / 1 FAIL. Lane 1 (gemini-3.1-pro-high) accepted the §5 per-job amendment and raised three NEW spec-fidelity findings, all cited. Stopping the adoption here: this is a second layer of authoring decisions on a PR whose own receipt is PARTIAL, and they are the spec owner's, not an adopter's.

1. build_report.sh:63 — reports per host_class where §5 says per host, and assumes host_class exists in the ledger schema (sha host job queue_wait_s exec_s total_s peak_rss_mb free_disk_gb exit has no such field). check_build_report.sh:86 only greps for queue, so the case table cannot see the difference.
2. build_report.sh:114 — the PRs/train calculation keys on "binding required check" where the spec equation names ci / gate.
3. docs/audits/impl-estimates.jsonl:43 — the recorded turn estimate is 26; the receipt says the subagents took 43 and 45.

Each is either a spec amendment (as §5 line 421 was, by ruling) or a script change back to the spec's word, and either way it is a decision about APR-RELEASE-001, which I do not own. Two lanes passed the same diff; lane 1 has been the only dissent on this PR across all three rounds and each of its findings has been checkable at file:line. Everything mechanical on this branch is green (real merge of main, 35/35 self-test, bashrs, roadmap guards, §5 amendment + receipt ruling recorded, body carries keep-open and ont-delta). Disposition: needs-an-owner on these three points; the PR stays open and does not close #3225, as its receipt already says. Lanes preserved for all three rounds. Refs #3225.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3225",
 "head": "7748875cd3f941972bb32232f5c8fc1c515d091c",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 3
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 6
  }
 ]
}

[noahgift]

Round 3 on 7748875cd: 2 PASS / 1 FAIL — lane 1 again, three findings, all verified real and applied in 53a84e9f1. (a) asserted, right: deriving the required set at run time had made the binding-check case row depend on live branch protection; BUILD_REPORT_REQUIRED_CHECKS (JSON array) now pins it, the report prints [pinned (…)], and the derive path keeps its own un-pinned row plus the hidden-gh fallback row. (b) measured, right: the "bare gate spelling" row grepped the script's own source for the literal "gate" — vacuous by construction before and after this PR; replaced by a ledger recording the gate under both spellings and asserting both are measured under the pinned set and the slower one binds. (c) cited, right: impl-estimates.jsonl:43 is {est: 0, actual: 26} — an orchestrator turn total, not K̂ as my round-2 note claimed; the receipt's 43/45 are subagent tool-use counts, a different quantity. Note corrected; data untouched. Case table 42 → 44, bashrs 0 errors on both scripts. Round 4 running. Refs #3225.

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3225",
 "head": "53a84e9f1439a7383e82366fb05f1ab287f274e1",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 4
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 4
  }
 ]
}

[noahgift]

Cross-inspection of docs/audits/quorum-PMAT-3225.json lanes, round 4 (non-author: aprender-04, 01:33Z)

lane	conversation	status	verdict	findings	refs to sibling lanes / receipts / $WORK	duration
lane 1	9965521a	SUCCESS	PASS (structured_output)	0 (0 cited, 0 with commands)	0	240 s
lane 2	235b1e28	SUCCESS	PASS (structured_output)	4 (1 cited, 2 with commands)	0	104 s
lane 3	5acf14b5	SUCCESS	PASS (structured_output)	4 (2 cited, 2 with commands)	0	226 s

Distinct agy conversation ids: 3/3; no lane references a sibling lane, another receipt or $WORK. Read from /tmp/claude-1000/-home-noah-src-aprender/51506a7a-265a-4e5c-bc53-50274de4a757/scratchpad/lanes-3225-round4 on this box. Note: round 4 after rounds 0–3 each drew a real finding (backtick command substitution in a chk label; §5 per-job amendment; host class / required-set / turns rulings applied; round 3: a live-protection dependency pinned, a vacuous self-grep row replaced, and the cop's turn-count ruling corrected from the file — impl-estimates.jsonl:43 holds the orchestrator's actual turns, not K̂); receipt stays PARTIAL (pv NotRun), PR does not close #3225; d4 armed via the rail, this inspection is confirmatory.

Verdict line: 3/3 PASS, independent. Arm confirmed.

[noahgift]

Folded into the 0.69 release batch #3669 by the cop (08:05Z, operator: "most PRs can be batched"). One CI run and one queue slot for all of them, and the generated files (roadmap.yaml, census, graph, shapes, README count) regenerated once. This PR's receipt is in the batch tree unchanged, and its closing keywords are carried in #3669's body. Disarmed here so the queue doesn't take it twice. It closes as landed-in-#3669 when the batch merges. Don't push here; changes go to release/0.69-batch.

[noahgift]

Taken back out of release batch #3669 (08:45Z). The batch's CI traced a red guard to this PR: `check_no_pipe_into_grep_q.sh` went from 74 to 77 sites (ceiling 74), and all three new sites are in `scripts/build_report.sh` / `scripts/check_build_report.sh` (`printf … | grep -q` under pipefail). Convert them to here-strings (`grep -q … <<<"$x"`) or `[[ =~ ]]`. The receipt stands. It rides the next batch once fixed. The owner's session is gone, so this is adoptable by selector.