release(0.69.1): batch 1 — 20 receipted rows + 3 combination fixes, one CI run

[noahgift]

0.69.1 batch 1: 20 receipted rows plus 4 batch fixes, folded onto main a9502d9 (after batch-1's squash). One CI run, one queue slot.

Rows (fold order; each with its quorum receipt on its own branch): #3699 → #3708 → #3721 (row A) → #3717 → #3738 (B1) · #3694 · #3703 · #3691 · #3711 · #3688 (coverage on tag) · #3715 (SHACL release-readiness) · #3543 · #3563(A) → #3756 · #3733 · #3697 · #3747 (#3568 PR 1/4) · #3718 · #3726 (canonical BPE tokenizer) · #3571 unit 1 (zero-layer serve refusal).

Left out: #3462. It deleted publish-order.txt and reintroduced a literal 74; it's being reworked (PMAT-3462-publish-order-derived).

Batch-level resolutions (in the merge commits):

• apr hex / apr trace still say "Invalid APR format" for GGUF and SafeTensors failures — 6 more InvalidFormat sites after #3661 #3691 vs batch-1's apr inspect/tensors print "Invalid APR format" for GGUF and SafeTensors failures — CliError::InvalidFormat hardcodes the format name #3661: apr hex / apr trace still say "Invalid APR format" for GGUF and SafeTensors failures — 6 more InvalidFormat sites after #3661 #3691's additive side.
• apr's byte-level BPE tokenizer is non-canonical: every non-ASCII byte → id 0, ASCII segmented unlike llama.cpp (2 of 10 ids agree on a path) — corrupts copy tasks and every non-ASCII user; apr parity is blind (shared tokenizer) #3726 was branched from the PRE-squash batch branch. A plain merge silently dropped install-script.yml lines, so it's folded as -s ours plus exactly its own delta, verified per file.
• #3571u1 kept batch-1's new extract_gguf_vocab(&mapped) -> Result signature.
• PMAT-3571's cop quotes moved acceptance_criteria → notes (roadmap_diff_additive).
• roadmap.yaml regenerated.

Combination fixes (rows green alone, RED together):

• complexity ratchet: shapes_gate.rs::run_shapes_gate_with (aprender-97, 2a40dda) and constrain/tests.rs::generate_intent (aprender-0e, cf8d0f3), both pure refactors;
• check_release_bump_pr_body.sh fixtures moved to rows A/A2's receipt shape (aprender-62, release/0.69.1-batch-1: check_release_bump_pr_body.sh fixture ladder receipts are the pre-#3712 shape — the real judge no longer passes them (combination break of #3721 + #3738) #3770 @ 9e32cce).

The model pool is out (gemini 429, gpt-oss 503), so these three carry cop measured seats. Their model quorums re-run at the gemini reset, before this is armed.

Measured on this head (0544909):

• bash scripts/guard_tree.sh --no-cargo → 92 checks, 0 failed
• check_complexity_ratchet.sh rc 0
• cargo test -p aprender-contracts --lib → 1701 passed
• cargo fmt --all -- --check rc 0
• cargo check --workspace --tests rc 0
• cargo check -p apr-cli --tests --features cuda rc 0

Refs #3710, #3699, #3708, #3712, #3717, #3694, #3703, #3691, #3711, #3688, #3715, #3543, #3563, #3756, #3733, #3697, #3568, #3747, #3718, #3726, #3571, #3770, #3462

keep-open: this batch asserts NO issue's done_when. Each row's issue is closed by its owner once the fold is verified on main, against that issue's own criteria (per-row receipts live on the rows). #3712/#3563/#3571/#3697/#3568/#3715/#3726/#3756 are explicitly partial (row A/B1, split (A), unit 1, batch 1, PR 1/4, the VERBS remainder, the #3693 re-measure, the parity-block clause), and #3462 is not in this batch.

ont-delta: shape release-readiness-v1 (#3715 also adds the implemented entity type release-evidence with its pc_extract control)

Not armed: it arms after the fix rows' model quorums run at the gemini reset (slot 1, ~21:40Z).

🤖 Generated with Claude Code

[noahgift]

Fold gap in batch-1 @ 34a7fcd6a: PMAT-3792 landed as code + quorum artifact, without its fragment or receipt (aprender-97 [056b0a])

Checked against my branch PMAT-3715-shapes-gate-complexity@23cfea45d while pushing at wind-down:

path	in origin/release/0.69.1-batch-1
crates/aprender-contracts/src/lint/shapes_gate.rs (the split: prepare, order_by_family, needs_receipts, verdict_of, by_shape, by_entity_type)	present, all 6
docs/audits/quorum-PMAT-3792.json	present, byte-identical to my branch
docs/audits/impl-PMAT-3792-receipt.md	ABSENT
docs/roadmaps/entries/PMAT-3792.yaml	ABSENT
PMAT-3792 in docs/roadmaps/roadmap.yaml	0 occurrences

So batch-1 carries a quorum artifact for a ticket that has no fragment in the tree and no receipt for the artifact to have judged against — the fragment is the spec a quorum judges against, which is the thing #3606 established. Both files are on the pushed branch at 23cfea45d; cherry-picking those two paths closes it. Nothing here is a code defect — the shapes-gate split itself is fully folded.

(Method note: my first pass compared git cat-file -p output hashes and got e3b0c44298fc for both missing files — the sha256 of the empty string, i.e. a failed read reported as a value. Re-checked with git cat-file -e; the table above is the -e result.)

[noahgift]

ARMING RULING (aprender-cop, 2026-09-22) — why this integration PR arms without a quorum round of its own

Arming is the review, so the exemption belongs on the PR rather than in a session's head.

What this PR is. A cop fold of 20 receipted rows plus three combination fixes found by its own CI. Under the operator's batching rule (2026-09-21, "80% of PRs can be batched"), authors stop at their receipt and the cop folds; the batch is the merge unit. Each folded row carries its own receipt and, where it had one, its own quorum artifact — 86 docs/audits/quorum-PMAT-*.json files are committed in this tree. This PR is not a new diff seeking first review; it is the integration of diffs already judged.

What CI measured, at 935f2cc88 (run 35686965915, success 05:03Z). Both required contexts green under BOTH mechanisms, read separately rather than assuming they agree: branch protection requires ci / gate + workspace-test; ruleset 13878864 requires gate.

• ci / gate PASS · workspace-test PASS (shards 28m02s / 29m53s / 29m40s) · gate PASS
• mutants 3m51s · guard-cargo 19m27s · guard-tree 9m26s · cuda-unit 5m00s · gpu-quick 2m07s · mac-check 3m05s · determinism ARM64 + X64 + compare · vendored-schemas · Contract Enforcement · ci / test · ci / lint · ci / security · ci / provenance
• Not behind main: git rev-list --left-right --count origin/main...HEAD = 0 / 148.

The one red is present, and it is not this PR's. check_pr_review_arm4.sh reports a missing evidence/pr-review/3772 receipt directory. Measured by aprender-c7: present is red on every open PR sampled (#3772, #3814, #3808, #3802); 24 PRs have ever carried a receipt, newest #3491 (2026-09-20), with 45 PRs merged above it since and 0 receipts among them. It is required by neither mechanism. A check that fires on 100% of pull requests carries exactly as much information as one that fires on 0%. Filed as #3818 (0.70.0) with an explicit out-of-scope section forbidding making it required — arming it in this state would block all 58 open PRs at once.

Three defects were found and fixed during integration, two of them the cop's own, recorded here because a fold that reports no friction is usually a fold that did not look:

1. My cherry-pick of 23cfea45d carried quorum-PMAT-3792.json but not the fragment and receipt it judges against — a quorum artifact for a ticket with nothing in the tree to have reviewed. Found by aprender-97 auditing the cop's work. Fixed in 3f59f6d98.
2. That fix then turned check_roadmap_fragment_required RED (restoring a fragment without regenerating the aggregate is strictly worse than the absence). Fixed in 935f2cc88 after verifying the regeneration did not re-break check_roadmap_diff_additive (still PASS, reserialised=0).
3. guard-cargo found ONE new claim literal at run_tests_layer_trace.rs:57 — a doc comment citing tok/s figures no measurement resolves. Deleted rather than baselined; ratchet did not grow (439 known, 0 removed).

Also corrected during integration, on rows already inside this batch: PR #3753 and #3764 each claimed "AD-04 quorum: 3/3 PASS" while their own partial_reasons recorded 2 distinct model ids (PMAT-125). #3718 is an ancestor of this branch, so that was a false review claim on shipping code. Both bodies corrected in place. No guard reads a PR body — that gap is the finding.

Merge path. A merge queue is active on main (ruleset 17836320: merge_queue, SQUASH, ALLGREEN, min_entries_to_merge: 1). mergeStateStatus: BLOCKED is the pre-enqueue state, not a failure. Two hypotheses about a review block were raised and both refuted by checking rather than reasoning: there are no CI-signer commits in the range (all 148 authored and committed by Noah Gift <noah.gift@gmail.com>), and the GitHub API attributes all 148 to noahgift, so require_extra_approval_for_unattributed_changes never fires.

Enqueued on the operator's explicit instruction, 2026-09-22. The squash to a single commit is accepted: under batching the batch is the unit, and provenance lives in the 86 committed quorum artifacts and the per-row receipts, not in commit granularity.