release: 0.69.0

[noahgift]

Release bump for 0.69.0 (06x release schedule §4.2): bump-version.sh 0.69.0 across every workspace, and the CHANGELOG section below.

When this merges, scripts/release/autopilot.sh runs the rest of the train, fail-closed (APR-RELEASE-001 §4): T-1 deep run, pre-publish dogfood, tag + release, clean-room.yml dispatched on the tag with the run id recorded (T-3), all release assets checked with scripts/check_release_assets.sh, publish preflight, the crates.io cascade (T-4, automated per operator 2026-09-13), install.sh --version receipts on intel and gx10 plus the CUDA asset receipts on gx10 and yoga, and the epic and milestone close.

0.69.0 folds every remaining 0.68.x row into one train (EPIC #3080). The headline goal is Qwen models usable on pure CUDA. This release makes the CUDA path honest and routable:

• apr serve now routes the Qwen3.5 hybrid to the model apr run already used.
• apr run --gpu no longer reports a CPU fallback as success.
• apr devices no longer tells a CUDA build that CUDA is unavailable.
• The F2 hybrid guard runs once per model, version and device, and leaves a receipt.

Underneath, the must-carry quantization work (PP-QUANT-001 M1) is complete: one ggml tensor-type table, extracted from upstream, replaces the hand-typed copies. The release train itself now lives in the repository. The tag step cannot be reached while the milestone holds an open item, and the version is the scripts' only input. The logit-parity receipts are under contract, and the shapes gate runs with the fleet-pinned pv. A run of gates that were measured reporting the wrong thing were fixed. It is also the first release assembled as an integration batch (#3669): 17 receipted PRs and one andon fix in one CI run and one queue slot.

Qwen on CUDA — headline (Band 3)

• apr serve routes the Qwen3.5 hybrid to Qwen35Model, as apr run has since CPU: Qwen3.5 / Qwen3.8 hybrid GGUFs are refused entirely — no fallback exists #3091 (apr serve cannot load Qwen3.5 at all — 'Architecture qwen35 … runs through Qwen35Model'; goal A's floor and the P0 decide-lane design both name apr serve #3571 layer 1) (#3571 layer 1: apr serve routes the Qwen3.5 hybrid to Qwen35Model, as apr run has since #3091 #3608)
• apr run --gpu that fell back to the CPU now reports a refusal, not a success; the refusal had no production caller (refs apr run --gpu is 2-3x SLOWER than --no-gpu on the dense path: the GPU result fails correctness (cosine 0.4153) and falls back to CPU after the user has paid for it #3602) (#3602: apr run --gpu reported a CPU fallback as success — the refusal was written, tested, and never called #3638)
• apr devices told every user CUDA was unavailable on a binary that runs CUDA; one flag now decides both (apr devices reports 'cuda unavailable reason=NotCompiled' on a binary that demonstrably runs CUDA — the first screen a user sees is wrong #3545) (#3545: apr devices told every user CUDA was unavailable on a binary that runs CUDA — one flag now decides both #3619)
• The F2 hybrid guard runs once per (model sha256, apr version, device) and leaves a receipt; apr run --revalidate re-runs it (f2_validate_qwen35 runs a full CPU reference forward on EVERY call (67% of a 14s TTFT) — run it once per (model sha256, apr version, device) and receipt it #3604) (PMAT-3604: the F2 hybrid guard runs once per (model, apr version, device) — 9.7 s off TTFT, measured #3634)
• ModelConstraints keeps the gated-DeltaNet shape keys (refs QE2E-INV-001 asserts Qwen3.5-9B ∈ [9.0B, 9.2B] but the repo's own 9b descriptor sums to 8.209B — the descriptor declares no DeltaNet tensors #3346) (fix(format): ModelConstraints dropped the gated-DeltaNet shape, so 18 of every 24 Qwen3.5 layers were counted as if their tensors did not exist #3350)
• PP-LLAMA-001 row 2: the perf002 prefill-path probe, with refusals that fire (PMAT-3556) (PP-LLAMA-001 row 2: the perf002 prefill-path probe, with refusals that fire (PMAT-3556) #3557)

One ggml tensor-type table — PP-QUANT-001 M1, must-carry (Band 0)

• One ggml tensor-type table, extracted from upstream rather than typed (PMAT-3430 M1) (PMAT-3430 M1: one ggml tensor-type table, extracted from upstream rather than typed #3581)
• Three ggml enums become one; M1 complete (PMAT-3430 phases 3–4) (PMAT-3430 Phases 3-4: three ggml enums become one (M1 complete) #3621)
• Three hand-typed ggml id→name tables read the traits table instead (Hand-typed ggml id→name tables outside aprender-core: sliding_window_entropy.rs, validate_manifest.rs, aprender-serve model_source.rs name 11 of 35 live types; route through trueno_quant::GgmlType #3662) (fix(dtype-names): three hand-typed ggml id→name tables outside aprender-core now read trueno_quant::GgmlType (PMAT-3662) #3665)
• aprender-core's three hand-typed ggml tables read the traits table, and IQ dequantization refuses instead of inventing weights (apr inspect (RosettaStone / core::format::gguf::shape) has no byte-size entry for any IQ-family ggml type — crashes on real Unsloth dynamic quants #3601, apr convert/import invent IQ-quant weights: get_tensor_f32 'approximates' IQ2..IQ4 from raw bytes and exits 0 (std 36.6× the real tensor) #3656) (PMAT-3601/PMAT-3656: apr inspect/tensors read IQ/TQ GGUFs — aprender-core sizes ggml types from TRAITS, and refuses IQ dequant instead of inventing weights #3660)

The release train, in the repository (Band 0b and Band 4)

• The train's movable half and then its tag path are ported into scripts/release/ (PMAT-3459 parts 1–2) (PMAT-3459 (part 1): port the release train's movable half into scripts/release/ — 7 declared deltas #3582, PMAT-3459 (part 2): port the tag path into the repo — autopilot.sh + 2, 14 declared deltas #3599)
• The tag step cannot be reached without a clean milestone: the gate is called inside cut_tag(), and three mutants are killed (PMAT-3459) (PMAT-3459: the tag step cannot be reached without a clean milestone — gate inside cut_tag(), 3 mutants killed #3617)
• The release scripts take the version as their one input. The milestone, the release epic, the previous tag and the state directory are derived, and a guard refuses a hard-coded version or an out-of-repo path in scripts/release/ (Release scripts still carry 0.68.2's V/T/MS/EPIC and AP=/mnt/... — and the hardcoded-path ratchet does not match /mnt, so nothing catches it #3618) (fix(release): the train's identity is derived — release scripts carried 0.68.2's V/MS/EPIC/LAST_TAG and an out-of-repo AP (PMAT-3618) #3655)
• The T-0 preflight returned GO when the dogfood crashed; GO now requires positive evidence (PMAT-3561) (PMAT-3561: the T-0 preflight returned GO when the dogfood crashed — GO now requires positive evidence #3614)
• The tag-path and epic-follow-up tickets are registered (PMAT-3459, PMAT-3460) (PMAT-3459 + PMAT-3460: register the in-repo tag-path ticket (P0, 0.69.0 must-carry) and the epic-by-number follow-up #3461); so are PMAT-3604 (roadmap: mint PMAT-3604 so the AD-04 quorum for #3634 can run #3637) and VERIFY-001 on 0.71.0 (roadmap(PMAT-3495): VERIFY-001 on 0.71.0 — Kani harnesses run in CI, then a Verus pilot (#3495) #3496)
• The v0.68.2 T-5 reconcile receipt and the train ledger record (docs(release): v0.68.2 T-5 reconcile receipt + train ledger record #3564); the "always ask before make publish" check-in is withdrawn, because T-4 is unattended (docs(CLAUDE.md): withdraw the "always ask before make publish" check-in — T-4 is unattended #3566)

Ontology and SHACL (Band 3b)

• The shapes gate runs with the fleet-pinned pv on the runner it executes on, resolved the way forjar installs it, with the version checked against the pin (PMAT-3567) (PMAT-3567: the shapes gate on the FLEET-PINNED pv, on the runner it executes on — resolved the way forjar installs it, version proved against the pin #3633)
• The seven logit-parity receipts are migrated under contract (parity-receipt-v2) and counted as their own entity type (PMAT-3577) (PMAT-3577: the logit-parity receipts under contract — parity-receipt-v2, extract:parity-receipt, and the 7 back-filled #3600)
• removed_by gets a shape: refusal-receipt-v1 (removed_by has no shape, no schema and no validator — 0 occurrences tree-wide; settle it as a pv contract BEFORE any refusal is written (blocks #3597) #3605) (#3605: removed_by gets a shape — refusal-receipt-v1, with a closed sentinel set so the required field manufactures nothing #3613)
• A contract with no kind: says the kind was assumed, on the first error the default caused (ONT-6b, PMAT-3537) (ONT-6b: a kind-less contract says the kind was assumed, on the first error the default caused (PMAT-3537) #3538)
• pv L2's column counts links, not an index, and --table no longer panics on a byte-cut (pv proof-status --table panics on the real corpus: byte-index truncation inside a multi-byte char (obligation_matrix.rs:169) #3338) (fix(pv): the L2 column counted an INDEX, not a link — 3,573 of 3,753 obligations ticked without a test citing them #3351)
• AutoGluon becomes a CRUX competitor (category O, 24 contracts) (Admit AutoGluon 1.6.3 to CRUX as category O: 24 DRAFT contracts crux-O-01..24 with LIVE-PENDING gates (no implementation, no CLI, no tests), CRUX_COMPETITORS 14->15 in validator.rs + both crux_intake_tests.rs lists, CATEGORY_NAMES[O] in scripts/crux_scaffold_contracts.py, 24 master-registry rows (coverage_intake 267->291) + evidence_sources.autogluon, spec v2.3 §3/§5/§6, evidence/crux/autogluon/ (4 files), 26 roadmap fragments (PMAT-3370 epic, PMAT-3371..3394 stories, PMAT-3401 this ticket) + regenerated roadmap.yaml, README CONTRACT_COUNT 1842->1866 — child of #3370 #3401) (feat(crux): AutoGluon becomes a CRUX competitor — category O, 24 contracts, 25 tickets, registry edit + mutation proof #3395)

Gates that were measured reporting the wrong thing (Band 1)

• Fail-fast discarded verdicts: the explicit-command runner no longer stops at the first failure and reports skipped tests as a number (PMAT-3587: fail-fast discards verdicts — the default flips, and skipped becomes a number #3616), and nextest's [profile.ci] sets fail-fast = false; 3 of 6 verdicts had been discarded, measured (PMAT-3587 (nextest half): [profile.ci] fail-fast = false — 3 of 6 verdicts discarded, measured #3626) (PMAT-3587)
• The rmsnorm scale-invariance test asserted the ε=0 theorem, which is false where the generator reaches; it now asserts the ε>0 property (PMAT-3627) (PMAT-3627: rmsnorm scale invariance asserts the ε>0 property — the ε=0 theorem was false where the generator reaches #3631)
• fleet_utilization.sh --selftest read a MATCH as a FAIL under pipefail (EPIPE) (PMAT-3629) (PMAT-3629: fleet_utilization --selftest read a MATCH as FAIL under pipefail (EPIPE) — no producer process, ratchet 75→74 #3632)
• ci_resolve_dirty.sh selected every DIRTY PR, not the roadmap class: 14 where 8 qualified (ci_resolve_dirty.sh selected every DIRTY PR, not the roadmap class — 14 where 8 qualified #3623)
• guard_tree.sh now shows a passing guard's UNMEASURED and SUMMARY lines, so "not measured here" no longer reads as PASS (guard_tree.sh drops a passing guard's output — an UNMEASURED exit-0 reads as PASS in every CI log, so #3567's verdict can never be observed #3651) (fix(guard_tree): a passing guard's UNMEASURED / SUMMARY lines reach the log — a bare PASS could not say "not measured here" (PMAT-3651) #3653)
• The fleet-pinned pv shapes guard reports fleet state as UNMEASURED, never FAIL: a pin mismatch, a pv that returns no verdict, a missing parser, binary or capability. Intel's rewritten pin had turned guard-tree red on main (release(0.69): batch — 15 receipted PRs + fleet-pv andon fix, one CI run, one queue slot #3669)
• The wiring meta-guard read a workflow step NAME as a dispatch and passed four guards that nothing ran; the publish-strip guard (clean-room red 8/8: aprender-compute dev-deps bypass workspace.dependencies and are stripped on publish #3305) now runs, and it reports an interpreter without a TOML reader as ENV instead of a failure (check_guards_are_wired.sh reads a step NAME as a bare guard_tree.sh dispatch — 4 guards dark, incl. the #3305 publish-strip guard (which also dies on intel's python 3.10) #3644) (fix(guard): a step NAME read as a bare guard_tree.sh dispatch hid four dark guards; the #3305 guard runs nowhere and dies on intel's python 3.10 (PMAT-3644) #3647)
• Two functions over the complexity ratchet are brought back under it by extracting helpers, with no behaviour change (#3669 batch: two functions over the complexity ratchet (run_shapes_gate NEW 13/28, dispatch_runtime_commands GROWN 41->43) — extract helpers, no behaviour change #3681) (release(0.69): batch — 15 receipted PRs + fleet-pv andon fix, one CI run, one queue slot #3669)
• apr parity told the user "parity disproven" (exit 5) for a model whose quant type the CUDA capability gate refuses (F16, IQ*); it now REFUSES with exit 12 and names the quant, which the pre-publish C14 row reports rather than fails (apr parity exits 5 ("parity disproven") when CUDA init REFUSES the model's quant type (F16/IQ*, PMAT-785): a tool limit read as a model defect; turns pre-publish dogfood C14 NO-GO #3685) (PMAT-3685: apr parity REFUSES (exit 12) a model the CUDA capability gate turns down, instead of "parity disproven" (5) #3689)
• Two gates treated a runner WITHOUT a tool as a verdict: the path-only dev-deps guard went red on every intel runner with no TOML reader, and the parity-receipt denominator counted a missing python3 as "the tree holds 0". Both now report UNMEASURED naming the runner and the missing tool; a tool that is present and crashes stays red (guard-tree is RED on every intel runner since the 0.69 batch: check_pathonly_devdeps_unused_in_src.sh exits ENV for a missing TOML reader — fleet state must be UNMEASURED #3692, workspace-test RED on python-free runners: parity_receipt_denominator.sh scores a missing python3 as "the tree holds 0" #3695) (PMAT-3685: apr parity REFUSES (exit 12) a model the CUDA capability gate turns down, instead of "parity disproven" (5) #3689)

CI throughput

• Merge-queue groups no longer pay the full workspace run: the queue is SQUASH, so the tier script now diffs HEAD^1..HEAD instead of requiring a second parent. A docs/roadmap/audit-only change runs no workspace tests, and renames are listed on both sides (Every merge-group run is tier=full: ci_test_tier.sh requires HEAD^2 but the queue is SQUASH (one parent) — a text-only PR runs ~2 runner-hours of unit tests; HEAD^1..HEAD is already the PR diff #3658) (PMAT-3658: merge groups stop paying the full hour (HEAD^2 gate vs a SQUASH queue); docs-only changes run no workspace tests #3664)
• book-contracts.yml drops the three rust-cache steps (PMAT-3539) (book-contracts.yml: delete the three rust-cache steps — cache-bin false was never the fix (PMAT-3539) #3540)
• CB-200 601→599 and the complexity shrink under pmat 3.41.1 (chore(ratchet): CB-200 601→599 and the complexity shrink under pmat 3.41.1 — the pin itself landed in #3484 #3491)
• Five tickets minted in a working tree are pushed to the roadmap (roadmap: push the five tickets minted today (they existed only in a working tree) #3580)

🤖 Generated with Claude Code

keep-open: #3080 #3545 #3571 #3602 #3658 are cited by the CHANGELOG for context only. Each closes through its own PR or row; EPIC #3080 closes at T-4 publish (autopilot close step).

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3698 head=e72262cdd044ed022450732e9c3cdde4e2832eec verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Review ruling for arming (cop, non-author of the bump). This PR is the mechanical §4.2 bump produced by scripts/release/prepare_bump.sh 0.69.0. It's exempt from an agy quorum because it carries no logic, and I verified it directly:

• git diff --name-only origin/main: only Cargo.toml / Cargo.lock files plus CHANGELOG.md (the check for anything else printed nothing)
• version edits are 0.68.2 → 0.69.0 (workspace + path deps); bump-version.sh --check green (the script refuses --ship otherwise)
• CHANGELOG [0.69.0]: aprender-b3's curated section (every PR merged since v0.68.2 plus release(0.69): batch — 15 receipted PRs + fleet-pv andon fix, one CI run, one queue slot #3669's 15 constituents), plus two lines for PMAT-3685: apr parity REFUSES (exit 12) a model the CUDA capability gate turns down, instead of "parity disproven" (5) #3689 (apr parity exits 5 ("parity disproven") when CUDA init REFUSES the model's quant type (F16/IQ*, PMAT-785): a tool limit read as a model defect; turns pre-publish dogfood C14 NO-GO #3685, guard-tree is RED on every intel runner since the 0.69 batch: check_pathonly_devdeps_unused_in_src.sh exits ENV for a missing TOML reader — fleet state must be UNMEASURED #3692, workspace-test RED on python-free runners: parity_receipt_denominator.sh scores a missing python3 as "the tree holds 0" #3695); no placeholder
• T-2 GO receipt for the parent: GO 5f9bd9344 dogfood_rc=1 rows=12 declared=8 fails_excluding_version_row=0 (the only [FAIL] is the pre-bump version row; C14 is REPORT, measured=5)
• the parity denominator is MEASURED on the parent: PASS 7 receipt(s) (the condition set on workspace-test RED on python-free runners: parity_receipt_denominator.sh scores a missing python3 as "the tree holds 0" #3695)
• body: a keep-open: line for the CHANGELOG's context refs (§6 R-2). The first CI run was cancelled and the PR reopened so the guard reads the corrected payload.

Operator, 2026-09-21: "just by these optimization you should be able to release 0.69 today, ensure this happens". — aprender-04 (cop)