diff --git a/.github/workflows/binary-release.yml b/.github/workflows/binary-release.yml
index 7bfcbc9e91..7ba0422b47 100644
--- a/.github/workflows/binary-release.yml
+++ b/.github/workflows/binary-release.yml
@@ -10,9 +10,10 @@ name: Binary Release
 # The aprender workspace ships dozens of crates; the `pv` lane scopes
 # itself to `aprender-contracts-cli`. The `apr-cuda` and `apr-cpu` lanes
 # below ship FOUR `apr` binaries per tag — {cuda, cpu} x {x86_64, aarch64} —
+# plus apr (cpu) for aarch64-apple-darwin and apr (wgpu) for x86_64 (#4353), six —
 # an operator HARD REQUIREMENT for every tag and every release (2026-09-10,
 # PMAT-1096/PMAT-1098, row 67-A1 of docs/specifications/06x-release-schedule.md,
-# Alfredo's #2869): a release without all four is not done, and
+# Alfredo's #2869): a release without all six is not done, and
 # `verify-apr-assets` FAILS the workflow when any is missing. v0.66.0 shipped
 # ZERO apr binaries and nothing was red — the verify job asked about two
 # assets, and only after a build lane that had already died. The question is
@@ -79,6 +80,34 @@ concurrency:
 
 
 jobs:
+  # A release that already carries every asset is NOT rebuilt (#4286). A promoted final
+  # is its rc's exact bytes (scripts/release/promote_rc.sh); publishing it with a
+  # personal token fires `release: published` here, and the upload steps below delete
+  # and replace same-named assets, so an ungated rebuild would silently swap the bytes
+  # that were dogfooded for new ones. With all twenty-two present the build jobs skip and
+  # verify + smoke still run, on the promoted bytes. A partial release (a lane died)
+  # still rebuilds. An unreadable release (exit 2) fails this job, so the builds skip:
+  # when in doubt, never overwrite.
+  assets:
+    name: Does the release already carry every asset?
+    runs-on: [self-hosted, Linux, X64, clean-room]
+    timeout-minutes: 5
+    outputs:
+      present: ${{ steps.check.outputs.present }}
+    steps:
+      - uses: actions/checkout@v7
+      - id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          bash scripts/check_release_assets.sh "$TAG"; rc=$?
+          case "$rc" in
+            0) echo "present=true" >> "$GITHUB_OUTPUT"; echo "$TAG already carries every asset: nothing is rebuilt" >> "$GITHUB_STEP_SUMMARY" ;;
+            1) echo "present=false" >> "$GITHUB_OUTPUT" ;;
+            *) echo "::error::could not read release $TAG (rc=$rc); refusing to build over assets that may exist"; exit 1 ;;
+          esac
+
   # The pv lane on the fleet (#3073; operator rule 2026-09-10: no GitHub-hosted runners). It ran on
   # ubuntu-latest, with cross for aarch64. Each target now builds natively on the box of its architecture
   # (x86_64 on yoga, aarch64 on gx10) in a sibling container, the pattern of build-apr-cpu: gnu targets
@@ -86,6 +115,8 @@ jobs:
   # well, so no floor rises), musl targets inside rust:1.93.0-bookworm (static). Asset names unchanged.
   build:
     name: pv ${{ matrix.target }} on ${{ matrix.host }}
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
     runs-on: ${{ fromJSON(matrix.labels) }}
     strategy:
       fail-fast: false
@@ -124,6 +155,20 @@ jobs:
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
+      # #4110/#4290: an rc asset's crate version IS its tag. The rc commit's Cargo.toml says
+      # X.Y.Z, so without this every vX.Y.Z-rc.N asset printed bare `X.Y.Z` (v0.69.3-rc.2:
+      # `apr 0.69.3 (v0.69.3+no-git)`). The stamper comes from THIS workflow's commit, not the
+      # tag's tree, which an rc cut from release/X.Y.Z predates. A final tag stamps nothing.
+      # verify-apr-assets then requires `apr --version` to equal the tag exactly.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
       - name: Preflight - this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh --need docker objdump
 
@@ -220,7 +265,10 @@ jobs:
         run: |
           TAG="${{ steps.tag.outputs.tag }}"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
           rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
             # --clobber semantics: delete an asset of the same name first
@@ -233,6 +281,8 @@ jobs:
 
   build-apr-cuda:
     name: apr (cuda) ${{ matrix.target }} on ${{ matrix.host }}
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
     runs-on: ${{ fromJSON(matrix.labels) }}
     strategy:
       fail-fast: false
@@ -261,6 +311,20 @@ jobs:
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
+      # #4110/#4290: an rc asset's crate version IS its tag. The rc commit's Cargo.toml says
+      # X.Y.Z, so without this every vX.Y.Z-rc.N asset printed bare `X.Y.Z` (v0.69.3-rc.2:
+      # `apr 0.69.3 (v0.69.3+no-git)`). The stamper comes from THIS workflow's commit, not the
+      # tag's tree, which an rc cut from release/X.Y.Z predates. A final tag stamps nothing.
+      # verify-apr-assets then requires `apr --version` to equal the tag exactly.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
       # FIRST thing this box does after it has a working tree. Run 34448908554
       # built a 21 MB CUDA asset here and then died on `gh: command not found`
       # at the upload — forty minutes of GPU spent on a shell error a one-second
@@ -296,6 +360,7 @@ jobs:
             -w /workspace \
             -e CARGO_TARGET_DIR=/workspace/target \
             -e CARGO_INCREMENTAL=0 \
+            -e APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
             rust:1.93.0-bullseye \
             sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --features cuda --locked; strip target/${{ matrix.target }}/release/apr'
           # the mounted target dir is the host cache; expose the binary where the next steps expect it
@@ -348,7 +413,10 @@ jobs:
         run: |
           TAG="${{ steps.tag.outputs.tag }}"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
           rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
             # --clobber semantics: delete an asset of the same name first
@@ -378,7 +446,9 @@ jobs:
   # `rust:1.93.0-bullseye` for a glibc 2.31 floor; this lane is written to be the
   # same step, so the merge moves both or neither.
   build-apr-cpu:
-    name: apr (cpu) ${{ matrix.target }} on ${{ matrix.host }}
+    name: apr (${{ matrix.flavour }}) ${{ matrix.target }} on ${{ matrix.host }}
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
     runs-on: ${{ fromJSON(matrix.labels) }}
     strategy:
       fail-fast: false
@@ -386,10 +456,22 @@ jobs:
         include:
           - target: x86_64-unknown-linux-gnu
             host: yoga
+            flavour: cpu
+            features: ''
             labels: '["self-hosted", "Linux", "X64", "cuda", "yoga"]'
           - target: aarch64-unknown-linux-gnu
             host: gx10
+            flavour: cpu
+            features: ''
             labels: '["self-hosted", "Linux", "ARM64", "cuda", "gx10"]'
+          # #4353 (operator 2026-09-25: "wgpu enabled binary for intel"): intel has no
+          # NVIDIA device, so neither -cpu (refuses --gpu) nor -cuda serves it. Same
+          # container, same glibc floor; `--features wgpu` is what flips the refusal off.
+          - target: x86_64-unknown-linux-gnu
+            host: yoga
+            flavour: wgpu
+            features: '--features wgpu'
+            labels: '["self-hosted", "Linux", "X64", "cuda", "yoga"]'
     steps:
       - name: Resolve release tag
         id: tag
@@ -400,13 +482,27 @@ jobs:
             exit 1
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "Building apr (default features, no cuda) for $TAG -> ${{ matrix.target }}"
+          echo "Building apr (${{ matrix.flavour }}, no cuda) for $TAG -> ${{ matrix.target }}"
 
       - name: Checkout at tag
         uses: actions/checkout@v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
+      # #4110/#4290: an rc asset's crate version IS its tag. The rc commit's Cargo.toml says
+      # X.Y.Z, so without this every vX.Y.Z-rc.N asset printed bare `X.Y.Z` (v0.69.3-rc.2:
+      # `apr 0.69.3 (v0.69.3+no-git)`). The stamper comes from THIS workflow's commit, not the
+      # tag's tree, which an rc cut from release/X.Y.Z predates. A final tag stamps nothing.
+      # verify-apr-assets then requires `apr --version` to equal the tag exactly.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
       # 67-C2: the first thing this box does after it has a working tree. No
       # `--cuda` here — a CPU asset must build on a box with no visible device,
       # and asserting one would make this lane lie about what it needs. `docker`
@@ -425,7 +521,7 @@ jobs:
           # machines/<box>/forjar-ephemeral.yaml): the bullseye build is a SIBLING container
           # through the mounted socket, so every bind-mount path must exist on the HOST at
           # the same path. The work root is mirrored host<->container; $HOME is not.
-          CACHE="$(cd "$GITHUB_WORKSPACE/../.." && pwd)/cache-apr-cpu/${{ matrix.target }}"
+          CACHE="$(cd "$GITHUB_WORKSPACE/../.." && pwd)/cache-apr-${{ matrix.flavour }}/${{ matrix.target }}"
           mkdir -p "$CACHE/registry" "$CACHE/target"
           # The bind-mount TARGET inside the workspace must exist BEFORE the container
           # starts: when it does not, dockerd creates the mountpoint as root, and after
@@ -441,15 +537,16 @@ jobs:
             -w /workspace \
             -e CARGO_TARGET_DIR=/workspace/target \
             -e CARGO_INCREMENTAL=0 \
+            -e APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
             rust:1.93.0-bullseye \
-            sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --locked; strip target/${{ matrix.target }}/release/apr'
+            sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --locked ${{ matrix.features }}; strip target/${{ matrix.target }}/release/apr'
           # the mounted target dir is the host cache; expose the binary where the next steps expect it
           mkdir -p "target/${{ matrix.target }}/release"
           cp "$CACHE/target/${{ matrix.target }}/release/apr" "target/${{ matrix.target }}/release/apr"
           GLIBC=$(cat "$CACHE/target/BUILDER_GLIBC"); RUSTC=$(cat "$CACHE/target/BUILDER_RUSTC")
           echo "builder glibc: $GLIBC"; echo "builder rustc: $RUSTC"
           {
-            echo "### apr (cpu) ${{ matrix.target }} built on ${{ matrix.host }} inside rust:1.93.0-bullseye"
+            echo "### apr (${{ matrix.flavour }}) ${{ matrix.target }} built on ${{ matrix.host }} inside rust:1.93.0-bullseye"
             echo "- toolchain: $RUSTC"
             echo "- glibc floor of this asset (the container's): $GLIBC"
           } >> "$GITHUB_STEP_SUMMARY"
@@ -470,6 +567,25 @@ jobs:
           fi
           "$BIN" --version
 
+      # #4353: the flavour is read from BEHAVIOUR, not bytes. Every inference build links
+      # trueno's wgpu backend (aprender-serve enables trueno/gpu unconditionally), so a
+      # `wgpu` byte count cannot tell the two apart (measured 2026-09-25: 125-127 hits in
+      # cpu and gpu builds alike). What `--features wgpu` changes is accel.rs: a -cpu build
+      # REFUSES `apr run --gpu` (exit 9, "no GPU backend compiled in") before it touches the
+      # model; a GPU build goes on and fails on the missing file instead (exit 3). Both
+      # polarities are asserted, so each lane is the other's positive control.
+      - name: Prove the flavour (--gpu refusal present iff -cpu)
+        run: |
+          BIN="target/${{ matrix.target }}/release/apr"
+          out=$("$BIN" run /nonexistent/apr-flavour-probe.gguf --gpu --prompt x 2>&1) && rc=0 || rc=$?
+          n=$(printf '%s\n' "$out" | grep -c 'no GPU backend compiled in' || true)
+          echo "flavour=${{ matrix.flavour }} rc=$rc refusal_lines=$n"
+          case "${{ matrix.flavour }}" in
+            cpu)  if [ "$rc" -eq 0 ] || [ "$n" -lt 1 ]; then echo "::error::-cpu asset did not refuse --gpu (rc=$rc): not a cpu build"; exit 1; fi ;;
+            wgpu) if [ "$rc" -eq 0 ] || [ "$n" -ne 0 ]; then echo "::error::-wgpu asset refused --gpu (rc=$rc): the wgpu feature is not in the build"; exit 1; fi ;;
+            *)    echo "::error::unknown flavour ${{ matrix.flavour }}"; exit 1 ;;
+          esac
+
       # The asset's floor is what its BYTES require, not what the builder happens
       # to run: objdump -T names every versioned glibc symbol it imports. Recorded
       # on both lanes so the CPU tarball's portability is a measured number in the
@@ -495,7 +611,7 @@ jobs:
         run: |
           VERSION="${{ steps.tag.outputs.tag }}"
           TARGET="${{ matrix.target }}"
-          ARCHIVE="apr-${VERSION}-${TARGET}-cpu"
+          ARCHIVE="apr-${VERSION}-${TARGET}-${{ matrix.flavour }}"
           mkdir -p "$ARCHIVE"
           cp "target/${TARGET}/release/apr" "$ARCHIVE/"
           for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do
@@ -515,7 +631,10 @@ jobs:
         run: |
           TAG="${{ steps.tag.outputs.tag }}"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
           rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
             # --clobber semantics: delete an asset of the same name first
@@ -526,8 +645,155 @@ jobs:
               | python3 -c 'import json,sys; a=json.load(sys.stdin); print("uploaded", a["name"], a["size"], "bytes")'
           done
 
-  # The hard requirement, as a check that can fail: all FOUR apr assets (tarball +
-  # sha256) and the eight pv assets must be on the release. A missing one is a red
+  # mini (Darwin arm64) is fleet hardware and could not take v0.69.3-rc.2: the release shipped
+  # no darwin asset, so mini was RED on every rc (#4327, infra-64 evidence/fleet-versions.md).
+  # Native build on the self-hosted mini-m4 runner (no hosted runners, #3073). No container:
+  # macOS has no glibc floor to pin, and the stamped version + the sha are checked below
+  # before anything is uploaded.
+  build-apr-darwin:
+    name: apr (cpu) aarch64-apple-darwin on mini
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
+    runs-on: [self-hosted, macOS, ARM64, apple-silicon, m4, mini]
+    steps:
+      - name: Resolve release tag
+        id: tag
+        run: |
+          TAG="${{ github.event.release.tag_name || inputs.tag }}"
+          [ -n "$TAG" ] || { echo "::error::No tag resolved"; exit 1; }
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout at tag
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.tag.outputs.tag }}
+
+      # The release scripts come from THIS workflow's commit: the tag tree predates them.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          for f in stamp_rc_version.sh asset_version_check.sh; do
+            git show "FETCH_HEAD:scripts/release/$f" > "$RUNNER_TEMP/$f"
+          done
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
+      - name: Build apr on the default features (no cuda)
+        run: |
+          APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
+            cargo build --release -p apr-cli --bin apr --target aarch64-apple-darwin --locked
+          strip target/aarch64-apple-darwin/release/apr
+
+      - name: The binary names its tag and commit (#4110)
+        run: |
+          line=$(target/aarch64-apple-darwin/release/apr --version)
+          bash "$RUNNER_TEMP/asset_version_check.sh" "${{ steps.tag.outputs.tag }}" "$(git rev-parse HEAD)" "$line"
+
+      - name: Package archive
+        id: package
+        run: |
+          ARCHIVE="apr-${{ steps.tag.outputs.tag }}-aarch64-apple-darwin-cpu"
+          mkdir -p "$ARCHIVE"
+          cp target/aarch64-apple-darwin/release/apr "$ARCHIVE/"
+          for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do [ -f "$f" ] && cp "$f" "$ARCHIVE/"; done
+          tar czf "${ARCHIVE}.tar.gz" "$ARCHIVE"
+          shasum -a 256 "${ARCHIVE}.tar.gz" > "${ARCHIVE}.tar.gz.sha256"
+          echo "archive=${ARCHIVE}.tar.gz" >> "$GITHUB_OUTPUT"
+          echo "sha=${ARCHIVE}.tar.gz.sha256" >> "$GITHUB_OUTPUT"
+
+      - name: Upload assets to release (REST, no gh)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327)
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
+          rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), ""))' "$f")
+            [ -n "$aid" ] && curl -sSf -X DELETE -H "Authorization: Bearer $GH_TOKEN" "$API/releases/assets/$aid" > /dev/null
+            curl -sSf -X POST -H "Authorization: Bearer $GH_TOKEN" -H "Content-Type: application/octet-stream" \
+              --data-binary @"$f" "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/$rid/assets?name=$f" \
+              | python3 -c 'import json,sys; a=json.load(sys.stdin); print("uploaded", a["name"], a["size"], "bytes")'
+          done
+
+  # #4353 (operator 2026-09-25: "mac is critical"): mini ran pv 0.69.1 because no release
+  # carried a darwin pv. Same native build as build-apr-darwin above; the asset name follows
+  # the pv lane's `pv-<tag>-<target>` convention (no flavour suffix).
+  build-pv-darwin:
+    name: pv aarch64-apple-darwin on mini
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
+    runs-on: [self-hosted, macOS, ARM64, apple-silicon, m4, mini]
+    steps:
+      - name: Resolve release tag
+        id: tag
+        run: |
+          TAG="${{ github.event.release.tag_name || inputs.tag }}"
+          [ -n "$TAG" ] || { echo "::error::No tag resolved"; exit 1; }
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout at tag
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.tag.outputs.tag }}
+
+      # The release scripts come from THIS workflow's commit: the tag tree predates them.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
+      - name: Build pv
+        run: |
+          APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
+            cargo build --release -p aprender-contracts-cli --bin pv --target aarch64-apple-darwin --locked
+          strip target/aarch64-apple-darwin/release/pv
+
+      # As the linux pv lane: the asset must run on the box that built it.
+      - name: The asset runs
+        run: target/aarch64-apple-darwin/release/pv --version
+
+      - name: Package archive
+        id: package
+        run: |
+          ARCHIVE="pv-${{ steps.tag.outputs.tag }}-aarch64-apple-darwin"
+          mkdir -p "$ARCHIVE"
+          cp target/aarch64-apple-darwin/release/pv "$ARCHIVE/"
+          for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do [ -f "$f" ] && cp "$f" "$ARCHIVE/"; done
+          tar czf "${ARCHIVE}.tar.gz" "$ARCHIVE"
+          shasum -a 256 "${ARCHIVE}.tar.gz" > "${ARCHIVE}.tar.gz.sha256"
+          echo "archive=${ARCHIVE}.tar.gz" >> "$GITHUB_OUTPUT"
+          echo "sha=${ARCHIVE}.tar.gz.sha256" >> "$GITHUB_OUTPUT"
+
+      - name: Upload assets to release (REST, no gh)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327)
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
+          rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), ""))' "$f")
+            [ -n "$aid" ] && curl -sSf -X DELETE -H "Authorization: Bearer $GH_TOKEN" "$API/releases/assets/$aid" > /dev/null
+            curl -sSf -X POST -H "Authorization: Bearer $GH_TOKEN" -H "Content-Type: application/octet-stream" \
+              --data-binary @"$f" "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/$rid/assets?name=$f" \
+              | python3 -c 'import json,sys; a=json.load(sys.stdin); print("uploaded", a["name"], a["size"], "bytes")'
+          done
+
+  # The hard requirement, as a check that can fail: all SIX apr assets (tarball +
+  # sha256) and the ten pv assets must be on the release. A missing one is a red
   # workflow, never a partial summary.
   #
   # THE LOOP THAT USED TO LIVE HERE IS NOW A SCRIPT. Inline, it could only ever run
@@ -537,8 +803,8 @@ jobs:
   # checker all four callers share, and its own case table carries the removed-asset
   # mutation (RED) that this job cannot demonstrate on a real release.
   verify-apr-assets:
-    name: All four apr assets are on the release
-    needs: [build, build-apr-cuda, build-apr-cpu]
+    name: All six apr assets are on the release
+    needs: [build, build-apr-cuda, build-apr-cpu, build-apr-darwin, build-pv-darwin]
     runs-on: [self-hosted, Linux, X64, clean-room]
     if: always()
     steps:
@@ -550,7 +816,7 @@ jobs:
       - name: Preflight - this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh
 
-      - name: Require the four apr assets (+ sha256) and the eight pv assets
+      - name: Require the six apr assets (+ sha256) and the ten pv assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -571,6 +837,8 @@ jobs:
   smoke-cuda:
     name: smoke apr (cuda) on ${{ matrix.host }}
     needs: verify-apr-assets
+    # verify runs under always(); a skipped build two levels up must not skip this
+    if: ${{ !cancelled() && needs.verify-apr-assets.result == 'success' }}
     strategy:
       fail-fast: false
       matrix:
@@ -605,16 +873,25 @@ jobs:
           T="${{ matrix.target }}"
           D="$RUNNER_TEMP/apr-cuda-smoke"; rm -rf "$D"; mkdir -p "$D"; cd "$D"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
           for f in "apr-${TAG}-${T}-cuda.tar.gz" "apr-${TAG}-${T}-cuda.tar.gz.sha256"; do
             aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next(a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n))' "$f")
             curl -sSfL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/octet-stream" -o "$f" "$API/releases/assets/$aid"
           done
           sha256sum -c "apr-${TAG}-${T}-cuda.tar.gz.sha256"
           tar xzf "apr-${TAG}-${T}-cuda.tar.gz"
-          BIN="$D/apr-${TAG}-${T}-cuda/apr"
-          v=$("$BIN" --version); echo "$v"
-          case "$v" in *"${TAG#v}"*) ;; *) echo "::error::asset reports '$v', not ${TAG#v}"; exit 1 ;; esac
+          # A promoted final (#4286) is its rc's exact bytes, so the archive's top directory
+          # may carry the rc label (apr-vX.Y.Z-rc.N-...). Take the one apr directory it holds.
+          set -- "$D"/apr-v*-"${T}"-cuda/apr
+          if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then echo "::error::expected exactly one apr binary in the archive, found: $*"; exit 1; fi
+          BIN=$1
+          v=$("$BIN" --version | head -1); echo "$v"
+          # #4275: X.Y.Z whole (an rc tag's -rc.N stripped) AND the asset's sha is the tag's commit
+          COMMIT=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/commits/$TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])')
+          bash "$GITHUB_WORKSPACE/scripts/release/asset_version_check.sh" "$TAG" "$COMMIT" "$v" || { echo "::error::asset reports '$v', which does not belong to $TAG ($COMMIT)"; exit 1; }
           [ "$(grep -ac 'libcuda.so' "$BIN")" -ge 1 ] || { echo "::error::downloaded asset is not a CUDA build"; exit 1; }
           floor=$(objdump -T "$BIN" 2>/dev/null | grep -oE 'GLIBC_[0-9.]+' | sort -Vu | tail -1)
           echo "highest GLIBC symbol version required: $floor"
@@ -633,6 +910,8 @@ jobs:
   smoke-cpu:
     name: smoke apr (cpu) on ${{ matrix.host }}
     needs: verify-apr-assets
+    # verify runs under always(); a skipped build two levels up must not skip this
+    if: ${{ !cancelled() && needs.verify-apr-assets.result == 'success' }}
     env:
       # The CPU assets build inside rust:1.93.0-bullseye (glibc 2.31) like the cuda lane, so the floor is
       # declared and GATED: an asset whose bytes import a newer GLIBC_* symbol fails here. 0.66.0 shipped a
@@ -672,16 +951,25 @@ jobs:
           T="${{ matrix.target }}"
           D="$RUNNER_TEMP/apr-cpu-smoke"; rm -rf "$D"; mkdir -p "$D"; cd "$D"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$TAG")
           for f in "apr-${TAG}-${T}-cpu.tar.gz" "apr-${TAG}-${T}-cpu.tar.gz.sha256"; do
             aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next(a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n))' "$f")
             curl -sSfL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/octet-stream" -o "$f" "$API/releases/assets/$aid"
           done
           sha256sum -c "apr-${TAG}-${T}-cpu.tar.gz.sha256"
           tar xzf "apr-${TAG}-${T}-cpu.tar.gz"
-          BIN="$D/apr-${TAG}-${T}-cpu/apr"
-          v=$("$BIN" --version); echo "$v"
-          case "$v" in *"${TAG#v}"*) ;; *) echo "::error::asset reports '$v', not ${TAG#v}"; exit 1 ;; esac
+          # A promoted final (#4286) is its rc's exact bytes, so the archive's top directory
+          # may carry the rc label (apr-vX.Y.Z-rc.N-...). Take the one apr directory it holds.
+          set -- "$D"/apr-v*-"${T}"-cpu/apr
+          if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then echo "::error::expected exactly one apr binary in the archive, found: $*"; exit 1; fi
+          BIN=$1
+          v=$("$BIN" --version | head -1); echo "$v"
+          # #4275: X.Y.Z whole (an rc tag's -rc.N stripped) AND the asset's sha is the tag's commit
+          COMMIT=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/commits/$TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])')
+          bash "$GITHUB_WORKSPACE/scripts/release/asset_version_check.sh" "$TAG" "$COMMIT" "$v" || { echo "::error::asset reports '$v', which does not belong to $TAG ($COMMIT)"; exit 1; }
           n=$(grep -ac 'libcuda.so' "$BIN" || true)
           [ "$n" -eq 0 ] || { echo "::error::the downloaded -cpu asset carries $n libcuda.so string(s) — it is a CUDA build"; exit 1; }
           # The floor is READ on every row and ASSERTED only where the build was
@@ -704,7 +992,7 @@ jobs:
 
   summary:
     name: Summary
-    needs: [build, build-apr-cuda, build-apr-cpu, verify-apr-assets, smoke-cuda, smoke-cpu]
+    needs: [assets, build, build-apr-cuda, build-apr-cpu, build-apr-darwin, build-pv-darwin, verify-apr-assets, smoke-cuda, smoke-cpu]
     runs-on: [self-hosted, Linux, X64, clean-room]
     if: always()
     steps:
@@ -724,6 +1012,8 @@ jobs:
             echo ""
             if [ "$STATUS" = "success" ]; then
               echo "- Build matrix: **4/4 targets succeeded**"
+            elif [ "$STATUS" = "skipped" ] && [ "${{ needs.assets.outputs.present }}" = "true" ]; then
+              echo "- Build matrix: **not rebuilt** — every asset was already on the release (a promoted rc, #4286)"
             else
               echo "- Build matrix: **partial** (status=$STATUS)"
             fi
@@ -732,12 +1022,15 @@ jobs:
             echo "  - x86_64-unknown-linux-gnu"
             echo "  - aarch64-unknown-linux-musl"
             echo "  - aarch64-unknown-linux-gnu"
+            echo "  - aarch64-apple-darwin (mini): ${{ needs.build-pv-darwin.result }}"
             echo ""
-            echo "### apr Binary Release: $TAG - four assets, {cuda,cpu} x {x86_64,aarch64}"
-            echo "- cuda build: ${{ needs.build-apr-cuda.result }} · cpu build: ${{ needs.build-apr-cpu.result }}"
-            echo "- all four on the release: ${{ needs.verify-apr-assets.result }} · smoke cuda (yoga+gx10): ${{ needs.smoke-cuda.result }} · smoke cpu (clean-room+yoga+gx10): ${{ needs.smoke-cpu.result }}"
+            echo "### apr Binary Release: $TAG - six assets, {cuda,cpu} x {x86_64,aarch64} + darwin cpu + x86_64 wgpu"
+            echo "- cuda build: ${{ needs.build-apr-cuda.result }} · cpu build: ${{ needs.build-apr-cpu.result }} · darwin build (mini): ${{ needs.build-apr-darwin.result }} · pv darwin: ${{ needs.build-pv-darwin.result }}"
+            echo "- all six on the release: ${{ needs.verify-apr-assets.result }} · smoke cuda (yoga+gx10): ${{ needs.smoke-cuda.result }} · smoke cpu (clean-room+yoga+gx10): ${{ needs.smoke-cpu.result }}"
             echo "  - apr-$TAG-x86_64-unknown-linux-gnu-cuda.tar.gz (+ .sha256)"
             echo "  - apr-$TAG-aarch64-unknown-linux-gnu-cuda.tar.gz (+ .sha256)"
             echo "  - apr-$TAG-x86_64-unknown-linux-gnu-cpu.tar.gz (+ .sha256)"
             echo "  - apr-$TAG-aarch64-unknown-linux-gnu-cpu.tar.gz (+ .sha256)"
+            echo "  - apr-$TAG-x86_64-unknown-linux-gnu-wgpu.tar.gz (+ .sha256)"
+            echo "  - apr-$TAG-aarch64-apple-darwin-cpu.tar.gz (+ .sha256)"
           } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/rc-cut.yml b/.github/workflows/rc-cut.yml
new file mode 100644
index 0000000000..ea86e867c4
--- /dev/null
+++ b/.github/workflows/rc-cut.yml
@@ -0,0 +1,89 @@
+name: RC Cut
+
+# Cut vX.Y.Z-rc.N as a GitHub PRERELEASE when CI goes green on the tip of
+# release/X.Y.Z (#4285, RC-DOGFOOD-001 §4.1). The decision and every write live in
+# scripts/release/rc_cut.sh; this file only wires the trigger and the token.
+#
+# TRIGGER. ci.yml does not run on a push to release/**. A release branch is gated by
+# CI on its release PR (release/X.Y.Z -> main), which re-runs on every push with
+# head_sha = the branch tip. `workflow_run` fires when any CI run completes. The
+# `branches` filter matches the run's HEAD branch, so a release PR's runs arrive
+# here and a feature PR's do not. rc_cut.sh then requires, on that run:
+# `ci / gate` and `workspace-test` success, head repository = this repository
+# (fork PRs can name a branch release/X.Y.Z), head_sha still the tip, and no rc
+# tag already on that commit. Anything else is a logged skip, not a failure.
+#
+# `workflow_run` always runs this file as it is on the DEFAULT branch, with this
+# repository's token, so a release branch cannot change what the cut does.
+#
+# ASSETS. A release created with GITHUB_TOKEN does not fire `release: published`
+# in binary-release.yml (GitHub suppresses recursive triggers), so rc_cut.sh
+# dispatches binary-release.yml with inputs.tag. That needs `actions: write`.
+#
+# PUBLISH GATE (#4287). Before anything is written, the job decides with --dry-run,
+# checks the rc commit out beside the default-branch checkout (in RUNNER_TEMP, so no
+# cargo config is inherited from this tree) and runs scripts/release/rc_publish_gate.sh
+# on it: the publish graph (R6), the path-only dev-dep rule that #3425 broke v0.68.0
+# on, and a `cargo package --no-verify` walk of every publishable crate. Red means the
+# job fails and no rc exists; the defect is found on the rc, never at the final tag.
+# The real cut then re-decides from the same run, so it tags the commit that was gated.
+#
+# CI cuts the tag and the prerelease. Publishing a crate stays out of CI (RP-001).
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: ['release/**']
+
+permissions:
+  contents: write   # create the tag ref and the prerelease
+  actions: write    # dispatch binary-release.yml for the assets
+
+# One cut at a time per release branch, never cancelled: N is read then written,
+# and two green runs racing would both read the same N. The tag ref is also the
+# lock (a duplicate gets HTTP 422 and writes nothing else).
+concurrency:
+  group: rc-cut-${{ github.event.workflow_run.head_branch }}
+  cancel-in-progress: false
+
+jobs:
+  cut:
+    # Operator rule (2026-09-10): self-hosted fleet only. The job needs bash, curl
+    # and python3, which clean-room carries (binary-release.yml's verify job).
+    runs-on: [self-hosted, Linux, clean-room]
+    # the package walk is ~65 s warm on lambda; a cold registry index is the rest
+    timeout-minutes: 30
+    # Cheap pre-filter only; rc_cut.sh re-judges every condition itself.
+    if: github.event.workflow_run.conclusion != 'cancelled'
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # the default branch's script, never the release branch's
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 1
+      - name: Case tables (the decision and the gate must still be able to refuse)
+        run: |
+          bash scripts/release/rc_cut.sh --self-test
+          bash scripts/release/rc_publish_gate.sh --self-test
+      - name: Decide (writes nothing)
+        id: decide
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: bash scripts/release/rc_cut.sh --run-id "$RUN_ID" --dry-run
+      - name: Publish gate on the rc commit (#4287)
+        if: steps.decide.outputs.tag != ''
+        env:
+          SHA: ${{ steps.decide.outputs.sha }}
+        run: |
+          git fetch --no-tags --depth 1 origin "$SHA"
+          git worktree add --detach "$RUNNER_TEMP/rc-tree" "$SHA"
+          bash scripts/release/rc_publish_gate.sh "$RUNNER_TEMP/rc-tree"
+      - name: Cut the rc
+        if: success() && steps.decide.outputs.tag != ''  # explicit: a red publish gate never reaches the cut
+        id: cut
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: bash scripts/release/rc_cut.sh --run-id "$RUN_ID"
diff --git a/Cargo.lock b/Cargo.lock
index 5e1d7bff28..d8f7edccd4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3803,9 +3803,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if 1.0.4",
  "cpufeatures 0.3.0",
@@ -10425,7 +10425,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
- "chacha20 0.10.0",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
diff --git a/contracts/apr-version-traceability-v1.yaml b/contracts/apr-version-traceability-v1.yaml
index 8c5bf391cd..98b2226cce 100644
--- a/contracts/apr-version-traceability-v1.yaml
+++ b/contracts/apr-version-traceability-v1.yaml
@@ -1,11 +1,12 @@
 metadata:
-  version: 1.1.0
+  version: 1.2.0
   created: '2026-04-05'
   author: PAIML Engineering
   description: "apr --version traceability contract — the version output must always contain an informative build identifier; never the bare '(unknown)' sentinel when a CARGO_PKG_VERSION or any alternative identifier is available; AND the embedded git SHA must match the actual HEAD of the source tree at build time (including in git worktrees)"
   references:
     - "paiml/aprender#597 (Version string shows (unknown) instead of git hash)"
     - "paiml/aprender#1862 (build.rs misses HEAD changes in worktrees because ../../.git is a file pointer, not a directory)"
+    - "paiml/aprender#4110 (crates.io installs print +no-git although the tarball's .cargo_vcs_info.json carries the commit)"
   registry: true
   tags:
     - cli
@@ -36,11 +37,13 @@ equations:
       - "Common sentinel forms are forbidden: (unknown), 0000000, <empty>, null"
 
   fallback_hierarchy:
-    formula: "APR_GIT_SHA = override ∨ git_hash ∨ committed_sha ∨ 'v{version}+no-git'"
+    formula: "APR_GIT_SHA = override ∨ vcs_info_sha ∨ git_hash ∨ committed_sha ∨ 'v{version}+no-git'"
     domain: "build-time environment"
     codomain: "APR_GIT_SHA environment variable"
     invariants:
       - "Env var APR_GIT_SHA_OVERRIDE, if set, wins (for CI/release)"
+      - "Otherwise: read git.sha1 from the package's .cargo_vcs_info.json (written by cargo package into every published crate), short 9-hex form, -dirty suffix when cargo recorded a dirty tree; a value that is not 40 hex is ignored (#4110)"
+      - "The vcs rung precedes git rev-parse: an unpacked crate may sit inside an UNRELATED repository whose HEAD is not the crate's commit"
       - "Otherwise: try git rev-parse --short HEAD"
       - "Otherwise: try reading crates/apr-cli/.git-sha committed file"
       - "Otherwise: emit 'v{CARGO_PKG_VERSION}+no-git' as informative fallback"
@@ -89,6 +92,11 @@ falsification_tests:
     prediction: "When built without git context, apr --version output contains the package version string"
     test: "apr --version 2>&1 | grep -qE '0\\.[1-9][0-9]*\\.[0-9]+'"
     if_fails: "Version string missing entirely"
+  - id: FALSIFY-VERSION-005
+    rule: "a packaged apr-cli (no .git of its own) names the commit in its .cargo_vcs_info.json, even inside a foreign repository"
+    prediction: "The shipped build.rs, compiled and run as cargo runs it on a package dir holding the byte-exact apr-cli-0.69.1 vcs file, emits APR_GIT_SHA=d8a6df53a; inside an unrelated repo it still does; with the vcs rung removed or placed behind git rev-parse the table goes RED"
+    test: "cargo test -p apr-cli --lib build_rs_vcs_sha"
+    if_fails: "crates.io installs regress to '+no-git' (0.68.1/0.69.1 shape), or report an enclosing repository's HEAD"
   - id: FALSIFY-VERSION-004
     rule: "build.rs registers worktree-aware rerun-if-changed triggers"
     prediction: "build.rs invokes `git rev-parse --git-dir` and `--git-common-dir` (not a hardcoded `../../.git/HEAD` path)"
diff --git a/crates/apr-cli/Cargo.toml b/crates/apr-cli/Cargo.toml
index 57b82ad6f0..3cdb5700cb 100644
--- a/crates/apr-cli/Cargo.toml
+++ b/crates/apr-cli/Cargo.toml
@@ -106,7 +106,10 @@ cuda = ["inference", "realizar/cuda", "entrenar/cuda", "trueno/cuda", "aprender-
 # the binary was built with it (§2.1 INVALID-BUILD reads that entry).
 cuda-batch = ["cuda"]
 # PMAT-335: WGPU backend for AMD/Intel/Apple GPU inference via Vulkan/Metal/WebGPU
-wgpu = ["inference"]
+# #4056: the finetune wgpu path (commands/finetune.rs) uses entrenar items gated
+# behind entrenar's own `gpu` feature. Weak dep: enabled only when `training`
+# brings entrenar in, which is exactly when that path compiles.
+wgpu = ["inference", "entrenar?/gpu"]
 visualization = ["renacer", "trueno-viz"]
 zram = ["trueno-zram-core"]
 training = ["dep:entrenar", "dep:entrenar-lora", "dep:aprender-train-distill", "dep:aprender-train-common", "aprender-train-distill?/shard-batch-source"]
diff --git a/crates/apr-cli/build.rs b/crates/apr-cli/build.rs
index 4667107f37..aadbb5c959 100644
--- a/crates/apr-cli/build.rs
+++ b/crates/apr-cli/build.rs
@@ -1,9 +1,14 @@
 // Contract: apr-version-traceability-v1 F-VERSION-001..004 (paiml/aprender#597, #1862).
 // Resolve APR_GIT_SHA with a multi-source fallback hierarchy:
 //   1. APR_GIT_SHA_OVERRIDE env var (CI/release hook)
-//   2. git rev-parse --short HEAD (dev builds from worktree or primary checkout)
-//   3. committed .git-sha file (crates.io installs)
-//   4. "v{CARGO_PKG_VERSION}+no-git" (informative fallback — never bare "unknown")
+//   2. .cargo_vcs_info.json `git.sha1` — written by `cargo package` into every published
+//      tarball, so a crates.io install knows its commit (#4110). Ahead of `git rev-parse`
+//      because an unpacked crate may sit inside SOME OTHER repository whose HEAD is not ours
+//   3. git rev-parse --short HEAD (dev builds from worktree or primary checkout; retried with
+//      the enclosing checkout marked safe.directory when git refuses a checkout owned by another
+//      user — binary-release.yml builds as root in a container over the runner's checkout)
+//   4. committed .git-sha file
+//   5. "v{CARGO_PKG_VERSION}+no-git" (informative fallback — never bare "unknown")
 fn main() {
     let sha = resolve_git_sha();
     println!("cargo:rustc-env=APR_GIT_SHA={sha}");
@@ -16,6 +21,7 @@ fn main() {
 
     println!("cargo:rerun-if-env-changed=APR_GIT_SHA_OVERRIDE");
     println!("cargo:rerun-if-changed=.git-sha");
+    println!("cargo:rerun-if-changed=.cargo_vcs_info.json");
 }
 
 fn register_git_rerun_triggers() {
@@ -58,12 +64,20 @@ fn resolve_git_sha() -> String {
         }
     }
 
-    // 2. Live git hash from worktree (works for both primary checkouts and worktrees)
-    if let Some(sha) = run_git(&["rev-parse", "--short", "HEAD"]) {
+    // 2. The commit `cargo package` recorded (crates.io / packaged builds, no .git)
+    if let Some(sha) = vcs_info_sha() {
         return sha;
     }
 
-    // 3. Committed .git-sha fallback (updated by release script at publish time)
+    // 3. Live git hash from worktree (works for both primary checkouts and worktrees).
+    //    `trusted_git_retry`: the release binaries are built as root in a container over the
+    //    runner-owned checkout, where git refuses the repo as "dubious ownership" (#4110)
+    let head = ["rev-parse", "--short", "HEAD"];
+    if let Some(sha) = run_git(&head).or_else(|| trusted_git_retry(&head)) {
+        return sha;
+    }
+
+    // 4. Committed .git-sha fallback (updated by release script at publish time)
     if let Ok(contents) = std::fs::read_to_string(".git-sha") {
         let s = contents.trim().to_string();
         if !s.is_empty() {
@@ -71,7 +85,57 @@ fn resolve_git_sha() -> String {
         }
     }
 
-    // 4. Informative fallback — never bare "unknown"
+    // 5. Informative fallback — never bare "unknown"
     let version = std::env::var("CARGO_PKG_VERSION").unwrap_or_else(|_| "0.0.0".to_string());
     format!("v{version}+no-git")
 }
+
+/// `git.sha1` from `.cargo_vcs_info.json`, shortened to 9 hex digits (what `git rev-parse
+/// --short` prints in this repository), with `-dirty` when cargo packaged a dirty tree.
+/// Parsed by hand: a build script has no serde, and the file is cargo's own fixed shape.
+fn vcs_info_sha() -> Option<String> {
+    let dir = std::env::var("CARGO_MANIFEST_DIR").unwrap_or_else(|_| ".".to_string());
+    let text = std::fs::read_to_string(format!("{dir}/.cargo_vcs_info.json")).ok()?;
+    let after = &text[text.find("\"sha1\"")? + "\"sha1\"".len()..];
+    let open = after.find('"')?;
+    let value = &after[open + 1..];
+    let sha = &value[..value.find('"')?];
+    if sha.len() != 40 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
+    let dirty = text.contains("\"dirty\": true") || text.contains("\"dirty\":true");
+    Some(format!(
+        "{}{}",
+        &sha[..9],
+        if dirty { "-dirty" } else { "" }
+    ))
+}
+
+/// `git <args>` again, with the checkout that encloses this package marked `safe.directory`.
+///
+/// git refuses a repository owned by another user ("detected dubious ownership"), and the release
+/// lane builds as root in a container over the runner-owned checkout, so every published binary
+/// printed `+no-git` (#4110). The exception goes in a private GLOBAL config under OUT_DIR:
+/// git ignores `safe.directory` given by `-c` or GIT_CONFIG_* before 2.39 (measured, 2.34.1).
+/// Only the checkout found by walking up from CARGO_MANIFEST_DIR is trusted, never `*`, and
+/// `rev-parse` runs no hooks. This build is already compiling that checkout's code.
+fn trusted_git_retry(args: &[&str]) -> Option<String> {
+    let manifest = std::env::var("CARGO_MANIFEST_DIR").ok()?;
+    let top = std::path::Path::new(&manifest)
+        .ancestors()
+        .find(|d| d.join(".git").exists())?;
+    let config =
+        std::path::Path::new(&std::env::var("OUT_DIR").ok()?).join("apr-safe-directory.gitconfig");
+    std::fs::write(
+        &config,
+        format!("[safe]\n\tdirectory = {}\n", top.display()),
+    )
+    .ok()?;
+    let out = std::process::Command::new("git")
+        .args(args)
+        .env("GIT_CONFIG_GLOBAL", &config)
+        .output()
+        .ok()?;
+    let s = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    (out.status.success() && !s.is_empty()).then_some(s)
+}
diff --git a/crates/apr-cli/src/build_rs_vcs_sha_tests.rs b/crates/apr-cli/src/build_rs_vcs_sha_tests.rs
new file mode 100644
index 0000000000..5ad718d263
--- /dev/null
+++ b/crates/apr-cli/src/build_rs_vcs_sha_tests.rs
@@ -0,0 +1,221 @@
+//! #4110 — a crates.io install of apr names its commit, never `+no-git`.
+//!
+//! The 0.69.1 post-publish install printed `apr 0.69.1 (v0.69.1+no-git)` (0.68.1 did too) although
+//! the published tarball carried the commit: `cargo package` writes `.cargo_vcs_info.json` into
+//! every crate. These tests compile the SHIPPED `build.rs` with rustc and run it the way cargo runs a
+//! build script (CARGO_MANIFEST_DIR, CARGO_PKG_VERSION, cwd = the package dir) in a temp package
+//! dir with no `.git` of ours above it. The vcs file is byte-exact from the real apr-cli-0.69.1 crate.
+//! The release binaries printed `+no-git` too: binary-release.yml builds as root in a container over
+//! the runner-owned checkout, and git refuses it ("dubious ownership"); row `foreign-owner`.
+//! `planted_regressions_turn_red` re-runs the table on three planted copies of `build.rs` — the vcs
+//! rung removed (the pre-#4110 script), the vcs rung behind `git rev-parse`, and the safe.directory
+//! retry removed — and requires each to fail, so the table cannot pass vacuously.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+const BUILD_RS: &str = include_str!("../build.rs");
+const VCS_CALL: &str = "    if let Some(sha) = vcs_info_sha() {";
+
+/// Byte-exact `.cargo_vcs_info.json` of apr-cli-0.69.1 as downloaded from crates.io.
+const VCS_REAL: &str = "{\n  \"git\": {\n    \"sha1\": \"d8a6df53a6c7104ef4eabfd2284908f93f1d6a3f\"\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+const VCS_DIRTY: &str = "{\n  \"git\": {\n    \"sha1\": \"d8a6df53a6c7104ef4eabfd2284908f93f1d6a3f\",\n    \"dirty\": true\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+const VCS_BAD: &str =
+    "{\n  \"git\": {\n    \"sha1\": \"not-a-sha\"\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+
+fn compile(source: &str, dir: &Path, name: &str) -> PathBuf {
+    let src = dir.join(format!("{name}.rs"));
+    let bin = dir.join(name);
+    std::fs::write(&src, source).expect("write build.rs copy");
+    let rustc = std::env::var("RUSTC").unwrap_or_else(|_| "rustc".to_string());
+    let out = Command::new(rustc)
+        .args([
+            "--edition",
+            "2021",
+            "--crate-name",
+            "build_script_build",
+            "-o",
+        ])
+        .arg(&bin)
+        .arg(&src)
+        .output()
+        .expect("rustc must be runnable: this test compiles the shipped build.rs");
+    assert!(
+        out.status.success(),
+        "rustc rejected {name}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    bin
+}
+
+fn git(dir: &Path, args: &[&str]) -> String {
+    let out = Command::new("git")
+        .args([
+            "-c",
+            "core.hooksPath=/dev/null",
+            "-c",
+            "user.email=f@x",
+            "-c",
+            "user.name=f",
+        ])
+        .args(args)
+        .current_dir(dir)
+        .output()
+        .expect("git must be runnable");
+    assert!(
+        out.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    String::from_utf8_lossy(&out.stdout).trim().to_string()
+}
+
+/// A fresh package dir under `root`; the vcs file written when given; optionally its own repo.
+fn package(root: &Path, name: &str, vcs: Option<&str>) -> PathBuf {
+    let dir = root.join(name);
+    std::fs::create_dir_all(&dir).expect("mkdir package");
+    if let Some(v) = vcs {
+        std::fs::write(dir.join(".cargo_vcs_info.json"), v).expect("write vcs file");
+    }
+    dir
+}
+
+/// Runs the compiled build script like cargo does; returns the APR_GIT_SHA it emits.
+/// `ceiling` stops git's upward search there (None: search freely, as a real install would).
+fn run(bin: &Path, pkg: &Path, ceiling: Option<&Path>, env: &[(&str, &str)]) -> String {
+    let out_dir = pkg.join("target-out");
+    std::fs::create_dir_all(&out_dir).expect("mkdir OUT_DIR");
+    let mut cmd = Command::new(bin);
+    cmd.current_dir(pkg)
+        .env("CARGO_MANIFEST_DIR", pkg)
+        .env("OUT_DIR", &out_dir)
+        .env("CARGO_PKG_VERSION", "9.9.9")
+        .env_remove("APR_GIT_SHA_OVERRIDE")
+        .env_remove("GIT_DIR")
+        .env_remove("GIT_WORK_TREE")
+        .env(
+            "GIT_CEILING_DIRECTORIES",
+            ceiling.unwrap_or_else(|| Path::new("/nonexistent")),
+        )
+        .envs(env.iter().copied());
+    let out = cmd.output().expect("run build script");
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .find_map(|l| l.strip_prefix("cargo:rustc-env=APR_GIT_SHA="))
+        .unwrap_or("<none>")
+        .to_string()
+}
+
+/// The case table. Returns the names of the rows that landed wrong (empty = all as expected).
+fn table(build_rs: &str, label: &str) -> Vec<String> {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let root = tmp.path();
+    let bin = compile(build_rs, root, label);
+    let mut wrong = Vec::new();
+    let mut expect = |row: &str, got: String, want: &str| {
+        if got != want {
+            wrong.push(format!("{row}: got {got:?}, want {want:?}"));
+        }
+    };
+    let pkgs = root.join("pkgs");
+    let p = package(&pkgs, "packaged", Some(VCS_REAL));
+    expect("packaged", run(&bin, &p, Some(&pkgs), &[]), "d8a6df53a");
+    // an unrelated repository ABOVE the unpacked crate, with a commit, and no ceiling between them
+    let foreign = package(&pkgs, "foreign", None);
+    git(&foreign, &["init", "-q"]);
+    git(
+        &foreign,
+        &["commit", "-q", "--allow-empty", "-m", "foreign"],
+    );
+    let p = package(&foreign, "crate", Some(VCS_REAL));
+    expect("foreign-repo", run(&bin, &p, None, &[]), "d8a6df53a");
+    let p = package(&pkgs, "dirty", Some(VCS_DIRTY));
+    expect("dirty", run(&bin, &p, Some(&pkgs), &[]), "d8a6df53a-dirty");
+    let p = package(&pkgs, "malformed", Some(VCS_BAD));
+    expect(
+        "malformed",
+        run(&bin, &p, Some(&pkgs), &[]),
+        "v9.9.9+no-git",
+    );
+    let p = package(&pkgs, "no-vcs", None);
+    expect("no-vcs", run(&bin, &p, Some(&pkgs), &[]), "v9.9.9+no-git");
+    let p = package(&pkgs, "override", Some(VCS_REAL));
+    expect(
+        "override",
+        run(
+            &bin,
+            &p,
+            Some(&pkgs),
+            &[("APR_GIT_SHA_OVERRIDE", "release123")],
+        ),
+        "release123",
+    );
+    // a dev checkout: no vcs file, its own repo -> `git rev-parse --short HEAD` (worktree freshness)
+    let dev = package(&pkgs, "dev", None);
+    git(&dev, &["init", "-q"]);
+    git(&dev, &["commit", "-q", "--allow-empty", "-m", "dev"]);
+    let head = git(&dev, &["rev-parse", "--short", "HEAD"]);
+    expect("dev-checkout", run(&bin, &dev, None, &[]), &head);
+    // the release lane: root in a container over the runner-owned checkout. git's own test knob
+    // makes it see another owner; the precondition proves plain git really refuses the repo here
+    let other_owner = [("GIT_TEST_ASSUME_DIFFERENT_OWNER", "1")];
+    let refused = Command::new("git")
+        .args(["rev-parse", "HEAD"])
+        .current_dir(&dev)
+        .envs(other_owner)
+        .output();
+    assert!(
+        !refused.expect("git").status.success(),
+        "cannot simulate a checkout owned by another user: this git ignores GIT_TEST_ASSUME_DIFFERENT_OWNER"
+    );
+    expect("foreign-owner", run(&bin, &dev, None, &other_owner), &head);
+    wrong
+}
+
+#[test]
+fn packaged_build_rs_names_its_commit() {
+    let wrong = table(BUILD_RS, "shipped");
+    assert!(
+        wrong.is_empty(),
+        "shipped build.rs rows landed wrong: {wrong:#?}"
+    );
+}
+
+#[test]
+fn planted_regressions_turn_red() {
+    assert_eq!(
+        BUILD_RS.matches(VCS_CALL).count(),
+        1,
+        "the vcs rung call site moved; re-anchor the plants"
+    );
+    let no_rung = BUILD_RS.replace(VCS_CALL, "    if let Some(sha) = None::<String> {");
+    let git_first = BUILD_RS.replace(
+        VCS_CALL,
+        "    if let Some(sha) = run_git(&[\"rev-parse\", \"--short\", \"HEAD\"]).or_else(vcs_info_sha) {",
+    );
+    let w1 = table(&no_rung, "plant_no_rung");
+    assert!(
+        w1.iter().any(|r| r.starts_with("packaged:")),
+        "no-vcs-rung plant survived: {w1:#?}"
+    );
+    let retry = "run_git(&head).or_else(|| trusted_git_retry(&head))";
+    assert_eq!(
+        BUILD_RS.matches(retry).count(),
+        1,
+        "the git retry call site moved; re-anchor the plant"
+    );
+    let w3 = table(&BUILD_RS.replace(retry, "run_git(&head)"), "plant_no_retry");
+    assert!(
+        w3.iter().any(|r| r.starts_with("foreign-owner:")),
+        "no-retry plant survived: {w3:#?}"
+    );
+    let w2 = table(&git_first, "plant_git_first");
+    assert!(
+        w2.iter().any(|r| r.starts_with("foreign-repo:")),
+        "git-first plant survived: {w2:#?}"
+    );
+    assert!(
+        !w2.iter().any(|r| r.starts_with("packaged:")),
+        "git-first plant should still pass packaged: {w2:#?}"
+    );
+}
diff --git a/crates/apr-cli/src/lib.rs b/crates/apr-cli/src/lib.rs
index 72230fa4c9..17f643c307 100644
--- a/crates/apr-cli/src/lib.rs
+++ b/crates/apr-cli/src/lib.rs
@@ -48,6 +48,10 @@ pub mod verbosity;
 
 /// PERF-021: the accelerator refusal, shared by serve, run and chat.
 mod accel;
+
+/// #4110: the shipped build.rs, compiled and run as cargo would on a packaged crate.
+#[cfg(test)]
+mod build_rs_vcs_sha_tests;
 mod commands;
 pub mod error;
 mod output;
diff --git a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs
index 68d3539b9b..c0ccf253aa 100644
--- a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs
+++ b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs
@@ -48,7 +48,8 @@ pub struct F2ReceiptKey {
     /// prefix or a size+mtime fingerprint would let a planted receipt with the
     /// wrong hash pass, which is the first falsifier.
     pub model_sha256: String,
-    /// The version of the crate that ran the guard.
+    /// The build that ran the guard: its version AND its executable's hash (#4290), see
+    /// [`apr_version`]. The field keeps its name so older receipts parse and then mismatch.
     pub apr_version: String,
     /// The device the GPU half ran on, as the driver names it.
     pub device: String,
@@ -308,10 +309,33 @@ pub fn model_sha256(bytes: &[u8]) -> String {
     s
 }
 
-/// The version of this crate — the one that ran the guard.
+/// The BUILD that ran the guard: `<CARGO_PKG_VERSION> exe:<16 hex of the running executable's
+/// sha256>`.
+///
+/// #4290: keyed on the version alone, v0.69.3-rc.1, rc.2, the final tag and every dev build of
+/// release/0.69.3 shared receipts, so a build that rewrote the forward path (RC2's one-engine
+/// loop, #4263) skipped F2 on a receipt an older build wrote. The executable's own bytes are
+/// the identity: every rebuild changes them, including a dirty one with no new commit, which a
+/// git sha would not see. The version stays in front so the log line still reads as a version.
 #[must_use]
 pub fn apr_version() -> String {
-    env!("CARGO_PKG_VERSION").to_string()
+    let exe = std::env::current_exe().and_then(std::fs::read).ok();
+    build_identity(env!("CARGO_PKG_VERSION"), exe.as_deref())
+}
+
+/// Pure half of [`apr_version`]. An executable that cannot be read gets a key no receipt can
+/// hold (pid + clock), so that run validates: an unknown build is never a known one.
+#[must_use]
+pub fn build_identity(version: &str, exe: Option<&[u8]>) -> String {
+    match exe {
+        Some(bytes) => format!("{version} exe:{}", &model_sha256(bytes)[..16]),
+        None => {
+            let nanos = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_or(0, |d| d.as_nanos());
+            format!("{version} exe:unreadable-{}-{nanos}", std::process::id())
+        },
+    }
 }
 
 /// Now, in unix seconds; 0 if the clock is before the epoch.
diff --git a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs
index 448adc179b..236c441299 100644
--- a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs
+++ b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs
@@ -9,8 +9,8 @@
 //! device.
 
 use super::{
-    apr_version, decide, model_sha256, read_receipt, receipt_path, write_receipt, F2Decision,
-    F2Receipt, F2ReceiptKey, F2ValidateReason, F2_RECEIPT_SCHEMA,
+    apr_version, build_identity, decide, model_sha256, read_receipt, receipt_path, write_receipt,
+    F2Decision, F2Receipt, F2ReceiptKey, F2ValidateReason, F2_RECEIPT_SCHEMA,
 };
 
 fn key() -> F2ReceiptKey {
@@ -221,9 +221,56 @@ fn model_sha256_is_the_real_sha256_lowercase_hex() {
 }
 
 #[test]
-fn apr_version_is_this_crates_version() {
-    assert_eq!(apr_version(), env!("CARGO_PKG_VERSION"));
-    assert!(!apr_version().is_empty());
+fn apr_version_names_this_crates_version_and_this_executable() {
+    let v = apr_version();
+    let want = format!("{} exe:", env!("CARGO_PKG_VERSION"));
+    assert!(v.starts_with(&want), "{v:?} does not start with {want:?}");
+    // the mutant #4290 names: a version-only key. It would print the bare version.
+    assert_ne!(
+        v,
+        env!("CARGO_PKG_VERSION"),
+        "the key is the version alone (#4290)"
+    );
+    assert_eq!(
+        v,
+        apr_version(),
+        "the same executable must key the same way twice"
+    );
+}
+
+/// #4290's case table, through `decide`: the key must tell builds apart, not versions.
+#[test]
+fn f2_receipt_key_is_the_build_not_the_version() {
+    let device = "NVIDIA GeForce RTX 4090".to_string();
+    let k = |id: String| F2ReceiptKey {
+        model_sha256: "ab".repeat(32),
+        apr_version: id,
+        device: device.clone(),
+    };
+    let rc1 = build_identity("0.69.3", Some(b"rc.1 forward loop"));
+    let rc2 = build_identity("0.69.3", Some(b"rc.2 one-engine loop"));
+    let written = receipt_for(&k(rc1.clone()));
+    // same version, different build -> validate
+    assert!(matches!(
+        decide(Ok(Some(written.clone())), &k(rc2), false),
+        F2Decision::Validate(F2ValidateReason::AprVersionMismatch { .. })
+    ));
+    // the identical build -> skip
+    assert!(matches!(
+        decide(Ok(Some(written)), &k(rc1), false),
+        F2Decision::Skip { .. }
+    ));
+    // an unreadable executable never matches, not even another unreadable one
+    let (u1, u2) = (
+        build_identity("0.69.3", None),
+        build_identity("0.69.3", None),
+    );
+    assert_ne!(u1, u2);
+    let unreadable = receipt_for(&k(u1));
+    assert!(matches!(
+        decide(Ok(Some(unreadable)), &k(u2), false),
+        F2Decision::Validate(F2ValidateReason::AprVersionMismatch { .. })
+    ));
 }
 
 #[test]
diff --git a/crates/aprender-serve/tests/driver_cuda_gguf.rs b/crates/aprender-serve/tests/driver_cuda_gguf.rs
index 612cbf87bd..090dfa8708 100644
--- a/crates/aprender-serve/tests/driver_cuda_gguf.rs
+++ b/crates/aprender-serve/tests/driver_cuda_gguf.rs
@@ -85,6 +85,8 @@ fn create_test_model(config: &GGUFConfig) -> OwnedQuantizedModel {
             ffn_norm_bias: None,
             attn_q_norm_weight: None,
             attn_k_norm_weight: None,
+            post_attn_norm_weight: None,
+            post_ffw_norm_weight: None,
         });
     }
 
@@ -141,6 +143,7 @@ fn test_driver_cuda_model_creation() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -181,6 +184,7 @@ fn test_driver_cuda_model_with_max_seq_len() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -222,6 +226,7 @@ fn test_driver_cuda_forward_basic() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -266,6 +271,7 @@ fn test_driver_cuda_forward_multi_token() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -303,6 +309,7 @@ fn test_driver_cuda_generate() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -346,6 +353,7 @@ fn test_driver_cuda_generate_greedy() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -388,6 +396,7 @@ fn test_driver_cuda_generate_with_stop_token() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -433,6 +442,7 @@ fn test_driver_cuda_gqa_forward() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -488,6 +498,7 @@ fn test_driver_cuda_multi_layer() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
diff --git a/crates/aprender-train/src/autograd/wgpu_block.rs b/crates/aprender-train/src/autograd/wgpu_block.rs
index b5cca3bec5..da308ad04a 100644
--- a/crates/aprender-train/src/autograd/wgpu_block.rs
+++ b/crates/aprender-train/src/autograd/wgpu_block.rs
@@ -214,7 +214,7 @@ impl WgpuBlockManager {
             // Kaiming init for A, zero for B
             let kaiming = |fan_in: usize, len: usize| -> Vec<f32> {
                 let std = (2.0 / fan_in as f32).sqrt();
-                (0..len).map(|i| ((i as f32 * 0.013 + layer_idx as f32).sin() * std)).collect()
+                (0..len).map(|i| (i as f32 * 0.013 + layer_idx as f32).sin() * std).collect()
             };
             let zeros = |len: usize| vec![0.0f32; len];
 
diff --git a/crates/aprender-train/src/finetune/instruct_pipeline/mod.rs b/crates/aprender-train/src/finetune/instruct_pipeline/mod.rs
index 5f240e6b6c..769015e77b 100644
--- a/crates/aprender-train/src/finetune/instruct_pipeline/mod.rs
+++ b/crates/aprender-train/src/finetune/instruct_pipeline/mod.rs
@@ -234,6 +234,9 @@ pub struct InstructPipeline {
 
 /// State for wgpu-based training pipeline (WgpuTrainingPipeline)
 #[cfg(feature = "gpu")]
+// `fwd` and the lm_head buffers are held to keep GPU allocations alive; the
+// config fields are not read yet. First linted by #4056.
+#[allow(dead_code)]
 struct WgpuTrainingState {
     /// GPU forward pass with persistent weight buffers + tiled GEMM
     fwd: trueno::backends::gpu::WgslForwardPass,
diff --git a/crates/aprender-train/src/finetune/instruct_pipeline/wgpu.rs b/crates/aprender-train/src/finetune/instruct_pipeline/wgpu.rs
index a02ed42fb4..95e907020a 100644
--- a/crates/aprender-train/src/finetune/instruct_pipeline/wgpu.rs
+++ b/crates/aprender-train/src/finetune/instruct_pipeline/wgpu.rs
@@ -161,7 +161,7 @@ impl InstructPipeline {
         let num_layers = _model_config.num_hidden_layers;
         let num_heads = _model_config.num_attention_heads as u32;
         let num_kv_heads = _model_config.num_kv_heads as u32;
-        let head_dim = (hidden / num_heads);
+        let head_dim = hidden / num_heads;
         let inter = _model_config.intermediate_size as u32;
 
         // Create WgslForwardPass with persistent weight buffers + tiled GEMM
diff --git a/crates/aprender-train/src/finetune/wgpu_pipeline.rs b/crates/aprender-train/src/finetune/wgpu_pipeline.rs
index 2f18477f88..bd4381940e 100644
--- a/crates/aprender-train/src/finetune/wgpu_pipeline.rs
+++ b/crates/aprender-train/src/finetune/wgpu_pipeline.rs
@@ -94,6 +94,7 @@ pub struct WgpuInstructPipeline {
     /// Normed hidden state — GPU-resident
     normed_buf: wgpu::Buffer,
     /// RMSNorm epsilon
+    #[allow(dead_code)] // stored but not yet read; first linted by #4056
     eps: f32,
 }
 
@@ -403,7 +404,7 @@ impl WgpuInstructPipeline {
                 // Kaiming init for A: std = sqrt(2/fan_in)
                 let std = (2.0 / in_d as f32).sqrt();
                 let a_data: Vec<f32> = (0..in_d * r)
-                    .map(|i| ((i as f32 * 0.013 + layer_idx as f32 * 7.0).sin() * std))
+                    .map(|i| (i as f32 * 0.013 + layer_idx as f32 * 7.0).sin() * std)
                     .collect();
                 // Zero init for B (contract: lora-gradient-flow-v1)
                 let b_data = vec![0.0f32; r * out_d];
@@ -459,7 +460,7 @@ impl WgpuInstructPipeline {
             lora_scale: scale,
             lora_step: 0,
             learning_rate,
-            lora_target_set: lora_target_set,
+            lora_target_set,
             num_layers,
             hidden_dim,
             vocab_size,
@@ -474,6 +475,7 @@ impl WgpuInstructPipeline {
 
     /// LoRA addmm: output += (input @ A) @ B * scale. One GPU dispatch.
     /// Contract: lora-algebra-v1/lora_shape
+    #[allow(dead_code)] // no caller yet; first linted by #4056
     fn dispatch_lora_addmm(
         &self,
         input: &wgpu::Buffer,
@@ -1090,8 +1092,7 @@ impl WgpuInstructPipeline {
         // This is simplified (skips SiLU backward, RMSNorm backward, up_proj path,
         // and attention backward) but provides DIFFERENT gradients per layer because
         // W_down and W_gate are different for each of the 28 layers.
-        let h = self.hidden_dim as u32;
-        let mut grad_buf = grad_hidden_buf;
+        let grad_buf = grad_hidden_buf;
 
         for layer_idx in (0..self.lora.len()).rev() {
             let layer_lora = &self.lora[layer_idx];
diff --git a/crates/aprender-train/src/transformer/wgpu_block.rs b/crates/aprender-train/src/transformer/wgpu_block.rs
index 7190856fda..9c52f2f7b6 100644
--- a/crates/aprender-train/src/transformer/wgpu_block.rs
+++ b/crates/aprender-train/src/transformer/wgpu_block.rs
@@ -344,7 +344,12 @@ impl WgpuForwardPass {
             );
 
             // Execute all ops in single batch — KAIZEN-023: persistent pipeline cache
-            batch.execute_with_cache(&mut self.pipeline_cache.borrow_mut()).await?;
+            // Move the cache out for the await so no RefCell borrow is held across
+            // it (clippy::await_holding_refcell_ref); put it back before `?`.
+            let mut cache = self.pipeline_cache.take();
+            let executed = batch.execute_with_cache(&mut cache).await;
+            *self.pipeline_cache.borrow_mut() = cache;
+            executed?;
 
             // Download result
             let result_data = batch.read(ffn_out).await?;
diff --git a/docs/roadmaps/entries/GH-4110.yaml b/docs/roadmaps/entries/GH-4110.yaml
new file mode 100644
index 0000000000..42613aeb4c
--- /dev/null
+++ b/docs/roadmaps/entries/GH-4110.yaml
@@ -0,0 +1,20 @@
+- id: GH-4110
+  github_issue: 4110
+  item_type: task
+  title: 'apr --version prints +no-git on BOTH published surfaces (crates.io install, release binaries)'
+  status: inprogress
+  priority: medium
+  assigned_to: null
+  created: 2026-09-23T23:59:54.621480081+00:00
+  updated: 2026-09-23T23:59:54.621480081+00:00
+  spec: null
+  acceptance_criteria:
+  - 'a packaged apr-cli (.cargo_vcs_info.json, no .git) emits APR_GIT_SHA = the 9-hex vcs sha, never +no-git (must-RED: the vcs rung removed)'
+  - 'an unpacked crate inside an UNRELATED repository still names its own vcs sha, not that repo HEAD (must-RED: vcs rung behind git rev-parse)'
+  - 'a checkout owned by another user (the root build container of binary-release.yml) still yields git rev-parse HEAD (must-RED: the safe.directory retry removed)'
+  - 'dev checkouts, the override, the malformed-sha and no-vcs fallbacks are unchanged'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: 'Cop rows (aprender-cf, 2026-09-23/24): (1) build.rs reads the sha1 from .cargo_vcs_info.json with a must-RED fixture; scope widened after aprender-70 found the release binaries print +no-git too: cover both surfaces, each with its own must-RED, and keep any binary-release.yml edit a separate commit. ROOT CAUSE (b), measured: git inside rust:1.93.0-bookworm running as root refuses the runner-owned checkout (fatal: detected dubious ownership); main build.rs printed v0.69.1+no-git there, this one prints the HEAD. The retry marks ONLY the enclosing checkout safe.directory through a private GIT_CONFIG_GLOBAL under OUT_DIR (-c safe.directory is ignored before git 2.39, measured on 2.34.1), so NO workflow edit is needed. Tests: crates/apr-cli/src/build_rs_vcs_sha_tests.rs (8 rows, 3 plants), run by workspace-test. Also Cargo.lock chacha20 0.10.0 (yanked) -> 0.10.2, lock-only.'
diff --git a/docs/roadmaps/entries/PMAT-4110.yaml b/docs/roadmaps/entries/PMAT-4110.yaml
new file mode 100644
index 0000000000..38aa0f212d
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4110.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4110
+  github_issue: 4110
+  item_type: task
+  title: apr version names rc tag and commit
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T17:50:47Z
+  updated: 2026-09-24T17:50:47Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4256.yaml b/docs/roadmaps/entries/PMAT-4256.yaml
new file mode 100644
index 0000000000..0594ef7955
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4256.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4256
+  github_issue: 4256
+  item_type: task
+  title: release assets carry git sha
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T17:50:48Z
+  updated: 2026-09-24T17:50:48Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4275.yaml b/docs/roadmaps/entries/PMAT-4275.yaml
new file mode 100644
index 0000000000..37557371c7
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4275.yaml
@@ -0,0 +1,17 @@
+- id: PMAT-4275
+  github_issue: 4275
+  item_type: task
+  kind: code
+  title: 'binary-release smoke: strip -rc.N and bind the asset to its commit'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:17:31Z
+  updated: 2026-09-24T14:17:31Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4285.yaml b/docs/roadmaps/entries/PMAT-4285.yaml
new file mode 100644
index 0000000000..a6c0c2948e
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4285.yaml
@@ -0,0 +1,17 @@
+- id: PMAT-4285
+  github_issue: 4285
+  item_type: task
+  kind: code
+  title: 'rc cut: tag vX.Y.Z-rc.N on every green merge to release/X.Y.Z'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:01:18Z
+  updated: 2026-09-24T14:01:18Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4286.yaml b/docs/roadmaps/entries/PMAT-4286.yaml
new file mode 100644
index 0000000000..12f47d5637
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4286.yaml
@@ -0,0 +1,17 @@
+- id: PMAT-4286
+  github_issue: 4286
+  item_type: task
+  kind: code
+  title: promote rc to final with no rebuild
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:17:31Z
+  updated: 2026-09-24T14:17:31Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4287.yaml b/docs/roadmaps/entries/PMAT-4287.yaml
new file mode 100644
index 0000000000..53fc10391d
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4287.yaml
@@ -0,0 +1,17 @@
+- id: PMAT-4287
+  github_issue: 4287
+  item_type: task
+  kind: code
+  title: 'rc gate: run the publish preflight + cargo package cascade at rc cut'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:33:50Z
+  updated: 2026-09-24T14:33:50Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4327.yaml b/docs/roadmaps/entries/PMAT-4327.yaml
new file mode 100644
index 0000000000..3246cfbd8b
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4327.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4327
+  github_issue: 4327
+  item_type: task
+  title: rc staged on every fleet host before publish, darwin-arm64 asset
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T18:11:17Z
+  updated: 2026-09-24T18:11:17Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4328.yaml b/docs/roadmaps/entries/PMAT-4328.yaml
new file mode 100644
index 0000000000..74f630e275
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4328.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4328
+  github_issue: 4328
+  item_type: task
+  title: fleet andon: rc cut refuses while a fleet cell is RED (C1 C2 C4)
+  status: in_progress
+  priority: critical
+  assigned_to: aprender-ea
+  created: 2026-09-24T18:11:17Z
+  updated: 2026-09-24T18:11:17Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/roadmap.yaml b/docs/roadmaps/roadmap.yaml
index 1ed4aee59d..dbee311d95 100644
--- a/docs/roadmaps/roadmap.yaml
+++ b/docs/roadmaps/roadmap.yaml
@@ -18191,6 +18191,26 @@ roadmap:
   estimated_effort: null
   labels: []
   notes: null
+- id: GH-4110
+  github_issue: 4110
+  item_type: task
+  title: 'apr --version prints +no-git on BOTH published surfaces (crates.io install, release binaries)'
+  status: inprogress
+  priority: medium
+  assigned_to: null
+  created: 2026-09-23T23:59:54.621480081+00:00
+  updated: 2026-09-23T23:59:54.621480081+00:00
+  spec: null
+  acceptance_criteria:
+  - 'a packaged apr-cli (.cargo_vcs_info.json, no .git) emits APR_GIT_SHA = the 9-hex vcs sha, never +no-git (must-RED: the vcs rung removed)'
+  - 'an unpacked crate inside an UNRELATED repository still names its own vcs sha, not that repo HEAD (must-RED: vcs rung behind git rev-parse)'
+  - 'a checkout owned by another user (the root build container of binary-release.yml) still yields git rev-parse HEAD (must-RED: the safe.directory retry removed)'
+  - 'dev checkouts, the override, the malformed-sha and no-vcs fallbacks are unchanged'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: 'Cop rows (aprender-cf, 2026-09-23/24): (1) build.rs reads the sha1 from .cargo_vcs_info.json with a must-RED fixture; scope widened after aprender-70 found the release binaries print +no-git too: cover both surfaces, each with its own must-RED, and keep any binary-release.yml edit a separate commit. ROOT CAUSE (b), measured: git inside rust:1.93.0-bookworm running as root refuses the runner-owned checkout (fatal: detected dubious ownership); main build.rs printed v0.69.1+no-git there, this one prints the HEAD. The retry marks ONLY the enclosing checkout safe.directory through a private GIT_CONFIG_GLOBAL under OUT_DIR (-c safe.directory is ignored before git 2.39, measured on 2.34.1), so NO workflow edit is needed. Tests: crates/apr-cli/src/build_rs_vcs_sha_tests.rs (8 rows, 3 plants), run by workspace-test. Also Cargo.lock chacha20 0.10.0 (yanked) -> 0.10.2, lock-only.'
 - id: GH-4140
   github_issue: 4140
   item_type: task
@@ -21257,6 +21277,138 @@ roadmap:
   labels:
   - kind:code
   notes: null
+- id: PMAT-4110
+  github_issue: 4110
+  item_type: task
+  title: apr version names rc tag and commit
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T17:50:47Z
+  updated: 2026-09-24T17:50:47Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4256
+  github_issue: 4256
+  item_type: task
+  title: release assets carry git sha
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T17:50:48Z
+  updated: 2026-09-24T17:50:48Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4275
+  github_issue: 4275
+  item_type: task
+  kind: code
+  title: 'binary-release smoke: strip -rc.N and bind the asset to its commit'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:17:31Z
+  updated: 2026-09-24T14:17:31Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4285
+  github_issue: 4285
+  item_type: task
+  kind: code
+  title: 'rc cut: tag vX.Y.Z-rc.N on every green merge to release/X.Y.Z'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:01:18Z
+  updated: 2026-09-24T14:01:18Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4286
+  github_issue: 4286
+  item_type: task
+  kind: code
+  title: promote rc to final with no rebuild
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:17:31Z
+  updated: 2026-09-24T14:17:31Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4287
+  github_issue: 4287
+  item_type: task
+  kind: code
+  title: 'rc gate: run the publish preflight + cargo package cascade at rc cut'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:33:50Z
+  updated: 2026-09-24T14:33:50Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4327
+  github_issue: 4327
+  item_type: task
+  title: rc staged on every fleet host before publish, darwin-arm64 asset
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T18:11:17Z
+  updated: 2026-09-24T18:11:17Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
+- id: PMAT-4328
+  github_issue: 4328
+  item_type: task
+  title: 'fleet andon: rc cut refuses while a fleet cell is RED (C1 C2 C4)'
+  status: in_progress
+  priority: critical
+  assigned_to: aprender-ea
+  created: 2026-09-24T18:11:17Z
+  updated: 2026-09-24T18:11:17Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
 - id: PMAT-3817
   github_issue: 3817
   item_type: task
diff --git a/scripts/check_pathonly_devdeps_unused_in_src.sh b/scripts/check_pathonly_devdeps_unused_in_src.sh
index c2719e7984..2ebc80fd79 100755
--- a/scripts/check_pathonly_devdeps_unused_in_src.sh
+++ b/scripts/check_pathonly_devdeps_unused_in_src.sh
@@ -60,6 +60,13 @@
 #
 # Runs bare, no arguments, from anywhere in the repo. `--selftest` runs the case
 # table only. A bare run does BOTH: the case table first, then the tree.
+#
+# `--rc-gate ROOT` (#4287) judges ANOTHER tree -- a release candidate's checkout --
+# against THIS file's baseline, which is the default branch's triage. The rc tree's
+# own baseline is not trusted: v0.68.0's listed `aprender-core|entrenar`, so the
+# guard was green on the exact commit #3425 could not publish. Only NEW pairs refuse
+# (a stale row describes this tree, not the rc's), and a missing tool is ENV rc 2,
+# never fleet state: a release gate that cannot measure has not passed.
 #   PATHONLY_GUARD_PYTHON=<interpreter>   test seam: a missing one is fleet state, a dead one is ENV
 #   PATHONLY_GUARD_FORCE_NO_TOML=1        test seam: both readers fail to import, for real (the intel shape)
 set -euo pipefail
@@ -294,13 +301,49 @@ selftest() {
   return "$rc"
 }
 
+# rc_gate ROOT (#4287): NEW pairs in ROOT against this file's baseline; no stale check.
+rc_gate() {
+  local root=$1 out pairs new scan_rc=0
+  if [ -z "$root" ] || [ ! -f "$root/Cargo.toml" ]; then
+    printf 'ENV: --rc-gate needs the root of a checked-out tree (got %s)\n' "${root:-nothing}"
+    return 2
+  fi
+  out="$(scan "$root")" || scan_rc=$?
+  if [ "$scan_rc" -ne 0 ]; then
+    printf 'ENV: the rc tree was not scanned (rc=%s); a release gate that cannot measure has not passed\n' "$scan_rc"
+    return 2
+  fi
+  pairs="$(printf '%s\n' "$out" | awk -F'|' 'NF>=2 {print $1"|"$2}' | sort -u)"
+  new="$(comm -23 <(printf '%s\n' "$pairs" | grep -v '^$' || true) \
+                  <(grep -vE '^\s*(#|$)' "$BASELINE" | sort -u))"
+  if [ -z "$new" ]; then
+    printf 'OK: the rc tree uses no publish-stripped dev-dep from src/ beyond the %s triaged pair(s) on the default branch\n' \
+      "$(grep -cvE '^\s*(#|$)' "$BASELINE")"
+    return 0
+  fi
+  printf 'FAIL: the rc tree cannot publish -- src/ uses a dev-dep the publish step deletes, so the\n'
+  printf 'published crate cannot compile its own lib tests (the #3425 defect: v0.68.0 never reached crates.io):\n'
+  printf '%s\n' "$new" | while IFS='|' read -r manifest alias; do
+    printf '  %s declares %s path-only, and src/ uses it:\n' "$manifest" "$alias"
+    printf '%s\n' "$out" | awk -F'|' -v m="$manifest" -v a="$alias" \
+      '$1==m && $2==a {print "      " $3}' | head -5
+  done
+  return 1
+}
+
 main() {
   local st_rc=0
   selftest || st_rc=$?
+  # a release gate never takes the fleet-state exit: a runner without the tool has not measured
+  if [ "$st_rc" -eq 3 ] && [ "${1:-}" = "--rc-gate" ]; then
+    echo 'ENV: --rc-gate cannot measure on this runner (no TOML reader); not a pass'
+    return 2
+  fi
   # fleet state (#3692): the UNMEASURED line is already printed; exit 0, and no tree verdict
   [ "$st_rc" -eq 3 ] && return 0
   [ "${1:-}" = "--selftest" ] && return "$st_rc"
   [ "$st_rc" -eq 0 ] || return "$st_rc"
+  if [ "${1:-}" = "--rc-gate" ]; then rc_gate "${2:-}"; return; fi
 
   local out pairs rc=0 new stale scan_rc=0
   out="$(scan "$REPO")" || scan_rc=$?
diff --git a/scripts/check_publish_preflight.sh b/scripts/check_publish_preflight.sh
index e0e8c004a1..18d7b67f77 100755
--- a/scripts/check_publish_preflight.sh
+++ b/scripts/check_publish_preflight.sh
@@ -52,6 +52,7 @@
 #   bash scripts/check_publish_preflight.sh             # the gate
 #   bash scripts/check_publish_preflight.sh --selftest  # case table, both polarities
 #   bash scripts/check_publish_preflight.sh --receipt-only  # R2+R5 only: T-1, before the tag (#3708)
+#   bash scripts/check_publish_preflight.sh --graph-only    # R2+R6 only: the rc cut (#4287)
 #   bash scripts/check_publish_preflight.sh --scope crux-smoke [--cut-commit SHA]
 #       R7 under a RECORDED operator emergency scope (contracts/model-capability-ladder-v1.yaml
 #       `ladder.emergency_scopes`; 0.69.1 only): the judge's own `--scope` path
@@ -192,6 +193,65 @@ rule_r7() {
     return 1
 }
 
+# R6, ONE function for both ends (#4287): the full gate at T-4, and --graph-only at the
+# rc cut, so a publish-graph defect is found on the rc and not at the final tag.
+# rule_r6 root -> prints its row; 0 accepted, 1 refused
+rule_r6() {
+    local root=$1
+    # R6 no versioned sibling dev-dependency lies on a cycle (PMAT-955, #3468). A
+    # dev-dependency with a version is kept in the published manifest and resolved
+    # on the registry at publish time; a path-only one is stripped. The edge is a
+    # defect only when its target can reach its source: then neither crate can be
+    # uploaded first. Acyclic edges are printed, so the publish order that must
+    # honour them is visible in the receipt.
+    local r6
+    r6="$(cargo metadata --no-deps --offline --format-version 1 --manifest-path "$root/Cargo.toml" 2>/dev/null | python3 -c '
+import json, sys
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print("UNREADABLE"); sys.exit(0)
+pk = {p["name"]: p for p in d.get("packages", []) if p.get("publish") != []}
+edges = {n: set() for n in pk}
+vdev = []
+for n, p in pk.items():
+    for dep in p.get("dependencies", []):
+        t = dep.get("name")
+        if t not in pk or t == n:
+            continue
+        if dep.get("kind") == "dev":
+            if (dep.get("req") or "*") == "*":
+                continue
+            vdev.append((n, t, dep.get("req")))
+        edges[n].add(t)
+def reaches(src, dst):
+    seen, stack = set(), [src]
+    while stack:
+        x = stack.pop()
+        for y in edges.get(x, ()):
+            if y == dst:
+                return True
+            if y not in seen:
+                seen.add(y); stack.append(y)
+    return False
+for n, t, req in sorted(vdev):
+    print("%s %s -> %s %s" % ("CYCLE" if reaches(t, n) else "ACYCLIC", n, t, req))')"
+    if [ "$r6" = UNREADABLE ]; then
+        echo "FAIL  R6 cargo metadata is unreadable, so sibling dev-dependencies cannot be judged"
+        return 1
+    elif grep -q '^CYCLE ' <<< "$r6"; then
+        printf 'FAIL  R6 a versioned sibling dev-dependency lies on a cycle (kept in the published manifest; neither crate can be uploaded first):\n%s\n' \
+            "$(printf '%s\n' "$r6" | sed -n 's/^CYCLE //p')"
+        return 1
+    elif [ -n "$r6" ]; then
+        printf 'ok    R6 %s versioned sibling dev-dependency edge(s), none on a cycle (the target publishes first):\n%s\n' \
+            "$(printf '%s\n' "$r6" | grep -c '^ACYCLIC ')" "$(printf '%s\n' "$r6" | sed -n 's/^ACYCLIC /        /p')"
+    else
+        echo "ok    R6 no sibling dev-dependency carries a version (path-only, stripped at publish)"
+    fi
+    return 0
+}
+
 # R7 under a recorded operator emergency scope (0.69.1: CRUX smoke only). The scope is READ by the
 # judge (`--scope`, scripts/lib/crux_smoke_scope.py), never re-implemented here: it refuses another
 # release, receipts from another binary, and a missing host. This rule adds the one binding the judge
@@ -295,56 +355,7 @@ gate() {
     # R5 dogfood receipt: GO, this commit, this version
     rule_r5 "$root" "$head" "$version" || fails=1
 
-    # R6 no versioned sibling dev-dependency lies on a cycle (PMAT-955, #3468). A
-    # dev-dependency with a version is kept in the published manifest and resolved
-    # on the registry at publish time; a path-only one is stripped. The edge is a
-    # defect only when its target can reach its source: then neither crate can be
-    # uploaded first. Acyclic edges are printed, so the publish order that must
-    # honour them is visible in the receipt.
-    r6="$(cargo metadata --no-deps --offline --format-version 1 --manifest-path "$root/Cargo.toml" 2>/dev/null | python3 -c '
-import json, sys
-try:
-    d = json.load(sys.stdin)
-except Exception:
-    print("UNREADABLE"); sys.exit(0)
-pk = {p["name"]: p for p in d.get("packages", []) if p.get("publish") != []}
-edges = {n: set() for n in pk}
-vdev = []
-for n, p in pk.items():
-    for dep in p.get("dependencies", []):
-        t = dep.get("name")
-        if t not in pk or t == n:
-            continue
-        if dep.get("kind") == "dev":
-            if (dep.get("req") or "*") == "*":
-                continue
-            vdev.append((n, t, dep.get("req")))
-        edges[n].add(t)
-def reaches(src, dst):
-    seen, stack = set(), [src]
-    while stack:
-        x = stack.pop()
-        for y in edges.get(x, ()):
-            if y == dst:
-                return True
-            if y not in seen:
-                seen.add(y); stack.append(y)
-    return False
-for n, t, req in sorted(vdev):
-    print("%s %s -> %s %s" % ("CYCLE" if reaches(t, n) else "ACYCLIC", n, t, req))')"
-    if [ "$r6" = UNREADABLE ]; then
-        echo "FAIL  R6 cargo metadata is unreadable, so sibling dev-dependencies cannot be judged"
-        fails=1
-    elif grep -q '^CYCLE ' <<< "$r6"; then
-        printf 'FAIL  R6 a versioned sibling dev-dependency lies on a cycle (kept in the published manifest; neither crate can be uploaded first):\n%s\n' \
-            "$(printf '%s\n' "$r6" | sed -n 's/^CYCLE //p')"
-        fails=1
-    elif [ -n "$r6" ]; then
-        printf 'ok    R6 %s versioned sibling dev-dependency edge(s), none on a cycle (the target publishes first):\n%s\n' \
-            "$(printf '%s\n' "$r6" | grep -c '^ACYCLIC ')" "$(printf '%s\n' "$r6" | sed -n 's/^ACYCLIC /        /p')"
-    else
-        echo "ok    R6 no sibling dev-dependency carries a version (path-only, stripped at publish)"
-    fi
+    rule_r6 "$root" || fails=1
 
     # R7 the model matrix, re-read at T-4 through the T-1 judge (#3717)
     rule_r7 "$root" "$version" || fails=1
@@ -361,6 +372,32 @@ for n, t, req in sorted(vdev):
     return 0
 }
 
+# --graph-only (#4287): R2 + R6 on PUBLISH_PREFLIGHT_ROOT, the rc cut's end of the
+# publish graph. R1/R3/R4/R5/R7 describe the upload (a tag, main, receipts) and are
+# judged at T-4 as before.
+graph_gate() {
+    local root="${PUBLISH_PREFLIGHT_ROOT:-}" version
+    for t in cargo python3; do
+        command -v "$t" >/dev/null 2>&1 || die_env "$t is not on PATH"
+    done
+    if [ -z "$root" ]; then
+        root="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+    fi
+    [ -f "$root/Cargo.toml" ] || die_env "$root has no Cargo.toml"
+    version="$(root_version "$root")" || version=""
+    if [ -z "$version" ]; then
+        echo "FAIL  R2 cargo metadata names no version for the root manifest"
+        echo "REFUSE $PROG --graph-only: no version to judge."
+        return 1
+    fi
+    echo "ok    R2 version $version (cargo metadata, root manifest)"
+    if ! rule_r6 "$root"; then
+        echo "REFUSE $PROG --graph-only: the publish graph of $version cannot be uploaded (R6)."
+        return 1
+    fi
+    echo "PASS  $PROG --graph-only: R6 holds at $version (R1/R3/R4/R5/R7 are judged at publish)"
+}
+
 # --receipt-only (#3708): R2 + R5 and nothing else. R1/R3/R4/R6 describe the tree
 # being UPLOADED and the tag it is uploaded from; at T-1 there is no tag yet, so
 # they are judged at T-4 by the full gate, as before.
@@ -602,6 +639,14 @@ FXJUDGE
     row versioned_sibling_devdep_acyclic_passes 0 "fx-a -> fx-b" "$d"
     d="$tmp/devdep_path"; build_ws_repo "$d" ''
     row pathed_sibling_devdep_passes   0 "PASS" "$d"
+    # --graph-only (#4287), both polarities: the rc cut refuses the same cycle, and passes
+    # an untagged, off-main tree that the full gate would refuse on R3/R4.
+    d="$tmp/devdep_cycle"; row graph_only_cycle_refuses      1 "FAIL  R6" "$d" graph_gate
+    d="$tmp/devdep_version"; git -C "$d" tag -d v1.2.3 >/dev/null
+    git -C "$d" -c core.hooksPath=/dev/null -c user.name=t -c user.email=t@t commit -q --allow-empty -m 'off main' >/dev/null
+    git -C "$d" update-ref refs/heads/fixture-main HEAD~1
+    row graph_only_acyclic_untagged_passes 0 "PASS  $PROG --graph-only" "$d" graph_gate
+    row graph_only_control_full_gate_refuses 1 "FAIL  R3" "$d"
 
     # R7 (#3717): the committed model-matrix receipts, judged by the T-1 judge. all_rules_hold above
     # is the green row (the stub refuses any version but 1.2.3, so it also proves the argument).
@@ -686,6 +731,7 @@ done
 case "$MODE" in
     --selftest) selftest ;;
     --receipt-only) receipt_gate ;;
+    --graph-only) graph_gate ;;
     '')         gate ;;
     -h|--help)  sed -n '2,48p' "$0" ;;
     *)          printf '%s: unknown argument %s\n' "$PROG" "$MODE" >&2; exit 2 ;;
diff --git a/scripts/check_release_assets.sh b/scripts/check_release_assets.sh
index 3fa0973450..8618e09c92 100755
--- a/scripts/check_release_assets.sh
+++ b/scripts/check_release_assets.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# check_release_assets.sh — a tagged release carries the SIXTEEN assets it owes,
+# check_release_assets.sh — a tagged release carries the TWENTY-TWO assets it owes,
 # or this exits non-zero (row 67-A1, PMAT-1098, issue #3082).
 #
 # WHY THIS EXISTS
@@ -9,7 +9,11 @@
 # inline, in a loop that lived in the workflow — so it could not be run on release
 # day by a human, by the dogfood, or by the release-criteria table. No gate asserted
 # the ASSET SET. The operator's rule (2026-09-10) is four `apr` binaries on every
-# tag: {cuda, cpu} x {x86_64, aarch64}, each with a .sha256.
+# tag: {cuda, cpu} x {x86_64, aarch64}, each with a .sha256. Since #4327 also the cpu
+# apr for aarch64-apple-darwin: mini is fleet hardware and took no rc without it.
+# Since #4353 (operator 2026-09-25: "mac is critical and also wgpu enabled binary for
+# intel") also the darwin pv, and a `--features wgpu` apr for x86_64 (intel has no NVIDIA
+# device). A release missing either is not done, and there is no waiver path here.
 #
 # This script is that assertion, in ONE place, so the workflow and the release-day
 # protocol share one checker.
@@ -46,7 +50,7 @@ usage: check_release_assets.sh <tag> [--assets-from FILE]
 USAGE
 }
 
-# expected_assets TAG — the sixteen names, derived from the two matrices, printed
+# expected_assets TAG — the twenty-two names, derived from the two matrices, printed
 # one per line. The apr set is the operator's hard requirement; the pv set is what
 # the `build` lane of binary-release.yml has always produced.
 expected_assets() {
@@ -57,12 +61,18 @@ expected_assets() {
             printf 'apr-%s-%s-unknown-linux-gnu-%s.tar.gz.sha256\n' "$tag" "$arch" "$flavour"
         done
     done
+    printf 'apr-%s-aarch64-apple-darwin-cpu.tar.gz\n' "$tag"
+    printf 'apr-%s-aarch64-apple-darwin-cpu.tar.gz.sha256\n' "$tag"
+    printf 'apr-%s-x86_64-unknown-linux-gnu-wgpu.tar.gz\n' "$tag"
+    printf 'apr-%s-x86_64-unknown-linux-gnu-wgpu.tar.gz.sha256\n' "$tag"
     for arch in x86_64 aarch64; do
         for libc in musl gnu; do
             printf 'pv-%s-%s-unknown-linux-%s.tar.gz\n' "$tag" "$arch" "$libc"
             printf 'pv-%s-%s-unknown-linux-%s.tar.gz.sha256\n' "$tag" "$arch" "$libc"
         done
     done
+    printf 'pv-%s-aarch64-apple-darwin.tar.gz\n' "$tag"
+    printf 'pv-%s-aarch64-apple-darwin.tar.gz.sha256\n' "$tag"
 }
 
 # read_assets TAG — the asset names actually on the release, one per line.
@@ -93,7 +103,9 @@ read_assets() {
         return 2
     }
     json=$(curl -sSf -H "Authorization: Bearer $token" -H "Accept: application/vnd.github+json" \
-        "https://api.github.com/repos/${repo}/releases/tags/${tag}" 2>/dev/null); rc=$?
+        "https://api.github.com/repos/${repo}/releases?per_page=100" 2>/dev/null \
+        | python3 -c 'import json,sys; t=sys.argv[1]; print(json.dumps(next(r for r in json.load(sys.stdin) if r["tag_name"]==t)))' "$tag" 2>/dev/null); rc=$?
+    # ^ by listing: an rc is a DRAFT until every fleet host runs it (#4327); releases/tags/ hides drafts
     [ "$rc" -eq 0 ] && [ -n "$json" ] || {
         printf '%s: ENV — REST read of %s release %s failed (rc=%s)\n' "$PROG" "$repo" "$tag" "$rc" >&2
         return 2
@@ -110,7 +122,10 @@ check_tag() { # check_tag TAG -> 0 complete · 1 missing · 2 ENV
     have=$(read_assets "$tag") || return 2
     while IFS= read -r want; do
         [ -n "$want" ] || continue
-        if printf '%s\n' "$have" | grep -qxF "$want"; then
+        # here-string, not `printf | grep -q`: under pipefail grep -q exits on the first match,
+        # printf takes SIGPIPE (141) and a PRESENT asset reads as MISSING (#4353: 5 of 30
+        # self-test runs went red on the complete set once the list grew to 22).
+        if grep -qxF "$want" <<< "$have"; then
             printf 'ok      %s\n' "$want"
         else
             printf 'MISSING %s\n' "$want"
@@ -119,9 +134,9 @@ check_tag() { # check_tag TAG -> 0 complete · 1 missing · 2 ENV
         fi
     done <<< "$(expected_assets "$tag")"
     if [ "$rc" -eq 0 ]; then
-        printf '%s: %s carries all 16 expected assets (4 apr + 4 sha256 + 8 pv)\n' "$PROG" "$tag"
+        printf '%s: %s carries all 22 expected assets (6 apr + 6 sha256 + 10 pv)\n' "$PROG" "$tag"
     else
-        printf '%s: %s is MISSING %s expected asset(s) — a release without its four apr binaries is not done (operator rule 2026-09-10)\n' "$PROG" "$tag" "$miss" >&2
+        printf '%s: %s is MISSING %s expected asset(s) — a release without its six apr binaries and five pv binaries is not done (operator rule 2026-09-10)\n' "$PROG" "$tag" "$miss" >&2
     fi
     return "$rc"
 }
@@ -135,6 +150,9 @@ selftest() {
     grep -vx "apr-$tag-aarch64-unknown-linux-gnu-cpu.tar.gz" "$work/complete.txt" > "$work/mutant.txt"
     grep -vx "apr-$tag-x86_64-unknown-linux-gnu-cuda.tar.gz.sha256" "$work/complete.txt" > "$work/nosha.txt"
     grep -v '^pv-' "$work/complete.txt" > "$work/nopv.txt"
+    grep -vx "apr-$tag-aarch64-apple-darwin-cpu.tar.gz" "$work/complete.txt" > "$work/nodarwin.txt"
+    grep -vx "pv-$tag-aarch64-apple-darwin.tar.gz" "$work/complete.txt" > "$work/nopvdarwin.txt"
+    grep -vx "apr-$tag-x86_64-unknown-linux-gnu-wgpu.tar.gz" "$work/complete.txt" > "$work/nowgpu.txt"
     : > "$work/empty.txt"
 
     row() { # row <want-rc> <label> <cmd...>
@@ -152,8 +170,11 @@ selftest() {
 
     row 0 "the complete asset set is credited"                bash "$0" "$tag" --assets-from "$work/complete.txt"
     row 1 "MUTATION: apr-<tag>-aarch64-...-cpu.tar.gz removed" bash "$0" "$tag" --assets-from "$work/mutant.txt"
+    row 1 "MUTATION: the darwin apr removed (mini takes no rc, #4327)" bash "$0" "$tag" --assets-from "$work/nodarwin.txt"
+    row 1 "MUTATION: the darwin pv removed (mini ran pv 0.69.1, #4353)" bash "$0" "$tag" --assets-from "$work/nopvdarwin.txt"
+    row 1 "MUTATION: the x86_64 wgpu apr removed (intel, #4353)" bash "$0" "$tag" --assets-from "$work/nowgpu.txt"
     row 1 "a missing .sha256 is as fatal as a missing tarball" bash "$0" "$tag" --assets-from "$work/nosha.txt"
-    row 1 "the eight pv assets are required too"               bash "$0" "$tag" --assets-from "$work/nopv.txt"
+    row 1 "the ten pv assets are required too"               bash "$0" "$tag" --assets-from "$work/nopv.txt"
     row 1 "an empty release is MISSING (1), not ENV"           bash "$0" "$tag" --assets-from "$work/empty.txt"
     row 2 "an unreadable asset list is ENV (2), never a pass"  bash "$0" "$tag" --assets-from "$work/nope.txt"
     row 2 "no tag at all is a usage error (2)"                 bash "$0"
@@ -165,9 +186,9 @@ selftest() {
     out=$(bash "$0" "$tag" --assets-from "$work/mutant.txt" 2>&1)
     row 0 "the missing asset is named in the output" \
         grep -q "MISSING apr-$tag-aarch64-unknown-linux-gnu-cpu.tar.gz" <<< "$out"
-    # Sixteen, not "some": a table that expected four would pass the rows above.
-    row 0 "sixteen assets are expected, and four of them are apr tarballs" \
-        bash -c "[ \$(bash '$0' --list '$tag' | grep -c .) -eq 16 ] && [ \$(bash '$0' --list '$tag' | grep -c '^apr-.*tar.gz\$') -eq 4 ]"
+    # Twenty-two, not "some": a table that expected four would pass the rows above.
+    row 0 "twenty-two assets are expected: six apr tarballs (one darwin, one wgpu), five pv (one darwin)" \
+        bash -c "[ \$(bash '$0' --list '$tag' | grep -c .) -eq 22 ] && [ \$(bash '$0' --list '$tag' | grep -c '^apr-.*tar.gz\$') -eq 6 ] && [ \$(bash '$0' --list '$tag' | grep -c '^pv-.*tar.gz\$') -eq 5 ] && grep -qx 'apr-$tag-aarch64-apple-darwin-cpu.tar.gz' <(bash '$0' --list '$tag')"
 
     printf '%s/%s rows\n' "$((n - red))" "$n"
     [ "$red" = 0 ] || return 1
diff --git a/scripts/install.sh b/scripts/install.sh
index 72ccaf56bd..93898f3ec4 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -252,6 +252,19 @@ install() {
     step "Installing"
     tar -xzf "$tmp_dir/archive.tar.gz" -C "$tmp_dir"
     extracted="$tmp_dir/${asset}/${BINARY_NAME}"
+    if [ ! -f "$extracted" ]; then
+        # A promoted final (#4286) is its rc's exact bytes, so the archive's top
+        # directory still carries the rc label (apr-vX.Y.Z-rc.N-<target>-<variant>/).
+        # Take the one ${BINARY_NAME}-* directory the archive holds, and only one.
+        found=''
+        n=0
+        for cand in "$tmp_dir/${BINARY_NAME}-"*"/${BINARY_NAME}"; do
+            [ -f "$cand" ] || continue
+            found=$cand
+            n=$((n + 1))
+        done
+        [ "$n" -eq 1 ] && extracted=$found
+    fi
     [ -f "$extracted" ] || error "Binary '${BINARY_NAME}' not found in archive (expected at ${asset}/${BINARY_NAME})"
 
     mkdir -p "$INSTALL_DIR"
diff --git a/scripts/release/asset_version_check.sh b/scripts/release/asset_version_check.sh
new file mode 100755
index 0000000000..7e40f2e937
--- /dev/null
+++ b/scripts/release/asset_version_check.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# asset_version_check.sh — does a release asset belong to its tag? (#4275, RC-DOGFOOD-001)
+#
+#   bash scripts/release/asset_version_check.sh TAG COMMIT "VERSION_LINE"
+#   bash scripts/release/asset_version_check.sh --self-test
+#
+# TAG is vX.Y.Z or vX.Y.Z-rc.N. COMMIT is the full sha the tag points at.
+# VERSION_LINE is the first line of the asset's `apr --version`: `apr X.Y.Z (<sha>)`.
+#
+# The printed version must equal the tag EXACTLY, -rc.N included (operator 2026-09-24: "we
+# need actual version numbers", "version number needs release canidate info in it"). The rc
+# commit's Cargo.toml says X.Y.Z; binary-release.yml runs stamp_rc_version.sh on the tag tree
+# before building, so an rc asset's CARGO_PKG_VERSION is X.Y.Z-rc.N. The v0.69.3-rc.2 asset,
+# built before that, printed `apr 0.69.3 (v0.69.3+no-git)`: refused twice over, since the sha
+# is required too. The version names WHICH rc; only the sha binds it to the tag's commit
+# (`vX.Y.Z+no-git`, what every container build reported before binary-release.yml passed
+# APR_GIT_SHA_OVERRIDE, is refused).
+#
+# The smoke this replaces tested `case "$v" in *"${TAG#v}"*)`: a substring match. It
+# refused every rc (0.69.3 does not contain 0.69.3-rc.1) and accepted 0.69.30 for
+# v0.69.3. The version here is compared whole.
+#
+# Exit: 0 the asset belongs to the tag, 1 it does not, 2 usage.
+set -uo pipefail
+PROG=asset_version_check
+
+# Pure. Prints `ok <version> at <sha>` or `bad <reason>`.
+avc_decide() {
+    local tag=$1 commit=$2 line=$3 want got sha
+    if [[ $tag =~ ^v([0-9]+\.[0-9]+\.[0-9]+)(-rc\.[0-9]+)?$ ]]; then
+        want=${tag#v}
+    else
+        echo "bad tag '$tag' is not vX.Y.Z or vX.Y.Z-rc.N"; return
+    fi
+    if [[ ! $commit =~ ^[0-9a-f]{40}$ ]]; then
+        echo "bad commit '$commit' is not a full 40-hex sha"; return
+    fi
+    if [[ $line =~ ^apr\ ([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?)\ \((.*)\)$ ]]; then
+        got=${BASH_REMATCH[1]}; sha=${BASH_REMATCH[3]}
+    else
+        echo "bad version line '$line' is not 'apr X.Y.Z[-rc.N] (<sha>)'"; return
+    fi
+    if [ "$got" != "$want" ]; then
+        echo "bad asset reports $got; tag $tag wants $want"; return
+    fi
+    if [[ ! $sha =~ ^[0-9a-f]{7,40}$ ]]; then
+        echo "bad asset carries no commit ('$sha'), so nothing binds it to $tag"; return
+    fi
+    if [ "${commit#"$sha"}" = "$commit" ]; then
+        echo "bad asset was built from $sha; tag $tag is $commit"; return
+    fi
+    echo "ok $got at $sha"
+}
+
+self_test() {
+    local fail=0 got want tag line c=7ff50ec2a1f671ad031ba427a275b1f983031d66
+    echo "$PROG self-test: case table"
+    # want<TAB>tag<TAB>commit<TAB>version line<TAB>why
+    while IFS=$'\t' read -r want tag commit line why; do
+        got=$(avc_decide "$tag" "$commit" "$line")
+        if [ "${got%% *}" = "$want" ]; then echo "  ok   $why"; else echo "  FAIL $why: wanted $want, got '$got'"; fail=1; fi
+    done <<EOF
+ok	v0.69.3	$c	apr 0.69.3 (7ff50ec2a)	a final tag matches its version
+ok	v0.69.3-rc.1	$c	apr 0.69.3-rc.1 (7ff50ec2a)	an rc asset prints its rc (stamp_rc_version.sh)
+ok	v0.69.3-rc.12	$c	apr 0.69.3-rc.12 (7ff50ec)	a two-digit rc and a 7-hex short sha
+bad	v0.69.3-rc.1	$c	apr 0.69.3 (7ff50ec2a)	an rc asset printing bare X.Y.Z is refused (never bare 0.69.3 on an rc)
+bad	v0.69.3-rc.2	$c	apr 0.69.3-rc.1 (7ff50ec2a)	rc.1's version on the rc.2 tag
+bad	v0.69.3-rc.1	$c	apr 0.69.3-rc.12 (7ff50ec2a)	rc.12 is not rc.1 (compared whole)
+bad	v0.69.3	$c	apr 0.69.3-rc.2 (7ff50ec2a)	an rc version on the final tag
+bad	v0.69.3-rc.2	$c	apr 0.69.3 (v0.69.3+no-git)	the measured v0.69.3-rc.2 asset (2026-09-24): no rc, no sha
+ok	v0.69.3	$c	apr 0.69.3 ($c)	a full-length sha
+bad	v0.69.3-rc.1	$c	apr 0.69.2 (7ff50ec2a)	an rc tag does not match the previous version
+bad	v0.69.3	$c	apr 0.69.30 (7ff50ec2a)	0.69.30 is not 0.69.3 (the old substring glob said it was)
+bad	v0.69.3	$c	apr 0.69.3 (0badc0de1)	a sha that is not the tag's commit
+bad	v0.69.3	$c	apr 0.69.3 (v0.69.3+no-git)	an asset built without a sha cannot be bound to a commit
+bad	v0.69.3	$c	apr 0.69.3 ()	an empty sha
+bad	v0.69.3	$c	apr 0.69.3 (7ff50e)	a 6-hex sha is too short to bind anything
+bad	v0.69.3-beta	$c	apr 0.69.3 (7ff50ec2a)	a tag that is neither vX.Y.Z nor vX.Y.Z-rc.N
+bad	v0.69.3	7ff50ec2a	apr 0.69.3 (7ff50ec2a)	the expected commit must be a full sha
+bad	v0.69.3	$c	pv 0.69.3 (7ff50ec2a)	a line that is not apr's
+EOF
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+main() {
+    case "${1:-}" in
+        --self-test) self_test; return ;;
+        -h|--help) sed -n '2,21p' "${BASH_SOURCE[0]}"; return 0 ;;
+    esac
+    if [ "$#" -ne 3 ]; then echo "$PROG: usage: TAG COMMIT \"VERSION_LINE\" | --self-test" >&2; return 2; fi
+    local verdict
+    verdict=$(avc_decide "$1" "$2" "$3")
+    echo "$PROG: $verdict"
+    [ "${verdict%% *}" = ok ]
+}
+
+main "$@"
diff --git a/scripts/release/autopilot.sh b/scripts/release/autopilot.sh
index 8827a1a204..2600553d99 100755
--- a/scripts/release/autopilot.sh
+++ b/scripts/release/autopilot.sh
@@ -282,8 +282,10 @@ set -e; d=\$(mktemp -d); cd "\$d"
 u=https://github.com/$REPO/releases/download/$T
 curl -sSfLO "\$u/$a.tar.gz"; curl -sSfLO "\$u/$a.tar.gz.sha256"
 sha256sum -c "$a.tar.gz.sha256"; tar xzf "$a.tar.gz"
-echo "version: \$("./$a/apr" --version | head -1)"
-echo "devices:"; "./$a/apr" devices --json || echo "(apr devices --json failed)"
+# a promoted final (#4286) keeps its rc's top directory: take the one apr-v* dir
+set -- ./apr-v*/apr; [ \$# -eq 1 ] && [ -f "\$1" ] || { echo "expected one apr in the archive, found: \$*"; exit 1; }; b=\$1
+echo "version: \$("\$b" --version | head -1)"
+echo "devices:"; "\$b" devices --json || echo "(apr devices --json failed)"
 cd /; rm -rf -- "\$d"
 HOST
     rc=$?; say "HOST $h rc=$rc: $(grep -m1 '^version:' "$AP/receipts/$h.txt")"
diff --git a/scripts/release/fleet-waivers.tsv b/scripts/release/fleet-waivers.tsv
new file mode 100644
index 0000000000..e34e958eac
--- /dev/null
+++ b/scripts/release/fleet-waivers.tsv
@@ -0,0 +1,5 @@
+# Fleet-cell waivers for the rc cut (#4328 C4) -- read by scripts/release/fleet_cells_gate.sh.
+# One line per waiver, TAB-separated, dated, with a reason. A waiver expires after `until`.
+#   <host|*>  <binary|*>  <until YYYY-MM-DD>  <reason, who ruled, when>
+# `*  *` also covers MISSING or STALE cells (the C3 monitor down); a host key never does.
+# A retired host is removed from the cells by C3; it is never waived here (C7).
diff --git a/scripts/release/fleet_cells_gate.sh b/scripts/release/fleet_cells_gate.sh
new file mode 100755
index 0000000000..026a863db0
--- /dev/null
+++ b/scripts/release/fleet_cells_gate.sh
@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# fleet_cells_gate.sh -- no rc is cut while a fleet cell is RED, unless a dated waiver names it (#4328 C4)
+#
+#   fleet_cells_gate.sh --cells FILE [--waivers FILE] [--now EPOCH]   judge; rc 0 cut, 1 refuse
+#   fleet_cells_gate.sh --self-test                                   case table + mutants
+#
+# rc.2 was cut with intel on an old apr, mini unable to install anything (no darwin asset)
+# and jetson unreachable: every one of those cells was RED and nothing on the cut path read
+# them. rc_cut.sh now runs this gate before it writes the tag.
+#
+# CELLS come from infra-64's andon monitor (#4328 C3), published where the clean-room cut
+# job can read it: `fleet/cells.tsv` on the `fleet-state` branch of this repo.
+#   # measured 2026-09-24T17:58:00Z
+#   <host>\t<binary>\t<GREEN|RED>\t<reason>
+# A retired host is REMOVED from the cells, not listed RED (C7: jetson, 2026-09-24).
+#
+# WAIVERS are recorded in git, dated, and expire: scripts/release/fleet-waivers.tsv
+#   <host|*>\t<binary|*>\t<until YYYY-MM-DD>\t<reason>
+# `*\t*` is the only key that covers MISSING or STALE cells -- no data is not green data.
+#
+# Refuses: any unwaived RED cell · a state other than GREEN/RED · no cells · no `# measured`
+# stamp · cells older than FLEET_CELLS_MAX_AGE_H (default 6) hours. EXIT 0 cut · 1 refuse · 2 usage.
+set -uo pipefail
+PROG=fleet_cells_gate
+
+# fleet_cells_verdict <cells text> <waivers text> <now epoch> -> `ok ...` rc 0 | `refuse ...` rc 1
+fleet_cells_verdict() {
+    CELLS=$1 WAIVERS=$2 NOW=$3 MAX_AGE_H=${FLEET_CELLS_MAX_AGE_H:-6} python3 - <<'EOF'
+import datetime as dt, os, sys
+now = dt.datetime.fromtimestamp(int(os.environ["NOW"]), dt.timezone.utc)
+today = now.date().isoformat()
+def waived(host, binary):  # host "*" asks for the `*\t*` key only (missing/stale cells)
+    for line in os.environ["WAIVERS"].splitlines():
+        f = line.split("\t")
+        if not line.strip() or line.lstrip().startswith("#") or len(f) < 4 or not f[3].strip():
+            continue
+        if host == "*":
+            hit = f[0] == "*" and f[1] == "*"
+        else:
+            hit = f[0] in (host, "*") and f[1] in (binary, "*")
+        if hit and f[2] >= today:
+            return f"{f[0]}/{f[1]} until {f[2]}: {f[3]}"
+    return None
+lines = os.environ["CELLS"].splitlines()
+stamp = next((l.split(None, 2)[2] for l in lines if l.startswith("# measured ") and len(l.split()) >= 3), "")
+bad, notes, n = [], [], 0
+try:
+    measured = dt.datetime.strptime(stamp.strip(), "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=dt.timezone.utc)
+    age_h = (now - measured).total_seconds() / 3600
+    if age_h > float(os.environ["MAX_AGE_H"]):
+        bad.append(f"cells are stale: measured {stamp.strip()}, {age_h:.1f} h ago (max {os.environ['MAX_AGE_H']} h)")
+except ValueError:
+    bad.append("cells carry no '# measured <YYYY-MM-DDTHH:MM:SSZ>' stamp")
+for l in lines:
+    if not l.strip() or l.startswith("#"):
+        continue
+    f = l.split("\t")
+    if len(f) < 3:
+        bad.append(f"malformed cell: {l!r}")
+        continue
+    n += 1
+    host, binary, state = f[0], f[1], f[2]
+    reason = f[3] if len(f) > 3 else ""
+    if state == "GREEN":
+        continue
+    if state == "RED":
+        w = waived(host, binary)
+        if w:
+            notes.append(f"{host}/{binary} RED waived ({w})")
+        else:
+            bad.append(f"{host}/{binary} RED: {reason or 'no reason given'}")
+        continue
+    bad.append(f"{host}/{binary} state {state!r} is neither GREEN nor RED")
+if n == 0:
+    bad.append("no fleet cells")
+data_bad = [b for b in bad if b.startswith(("cells ", "no fleet cells"))]
+if data_bad and len(data_bad) == len(bad):
+    w = waived("*", "*")
+    if w:
+        notes.append(f"cells unusable, waived ({w}): " + "; ".join(data_bad))
+        bad = []
+if bad:
+    print("refuse " + "; ".join(bad))
+    sys.exit(1)
+print(f"ok {n} fleet cells, none RED unwaived" + ("; " + "; ".join(notes) if notes else ""))
+EOF
+}
+
+self_test() {
+    local fail=0 got rc now d mut
+    now=$(date -u -d 2026-09-24T18:00:00Z +%s)
+    local S='# measured 2026-09-24T17:58:00Z'
+    row() {  # row <want rc> <label> <cells> [waivers]
+        got=$(fleet_cells_verdict "$(printf '%b' "$3")" "$(printf '%b' "${4:-}")" "$now"); rc=$?
+        if [ "$rc" = "$1" ]; then echo "  ok   $2 -> rc $rc"; else printf '  FAIL %s: want rc %s, got %s\n       %s\n' "$2" "$1" "$rc" "$got"; fail=1; fi
+    }
+    echo "$PROG self-test"
+    row 0 'every cell GREEN' "$S\nlambda\tapr\tGREEN\t\nmini\tapr\tGREEN\t\n"
+    row 1 'ONE RED cell refuses the cut' "$S\nlambda\tapr\tGREEN\t\nintel\tapr\tRED\tv0.69.1 on PATH\n"
+    row 0 'a dated waiver covers that cell' "$S\nintel\tapr\tRED\told\n" 'intel\tapr\t2026-09-24\tintel reimage, cop 2026-09-24\n'
+    row 0 'a host-wide waiver covers any binary on it' "$S\nintel\tpv\tRED\told\n" 'intel\t*\t2026-09-30\treimage\n'
+    row 1 'an EXPIRED waiver covers nothing' "$S\nintel\tapr\tRED\told\n" 'intel\tapr\t2026-09-23\tx\n'
+    row 1 'a waiver for another host covers nothing' "$S\nintel\tapr\tRED\told\n" 'mini\tapr\t2026-12-31\tx\n'
+    row 1 'a waiver with no reason is not recorded' "$S\nintel\tapr\tRED\told\n" 'intel\tapr\t2026-12-31\t\n'
+    row 1 'an unknown state refuses' "$S\nyoga\tapr\tAMBER\t\n"
+    row 1 'no cells refuses: no data is not green' "$S\n"
+    row 1 'no measured stamp refuses' 'lambda\tapr\tGREEN\t\n'
+    row 1 'stale cells refuse' '# measured 2026-09-24T09:00:00Z\nlambda\tapr\tGREEN\t\n'
+    row 0 'only *\t* waives missing cells' '' '*\t*\t2026-09-24\tC3 not publishing yet, cop 2026-09-24\n'
+    row 1 'a host waiver does not waive missing cells' '' 'intel\t*\t2026-09-30\tx\n'
+    row 1 'a waiver for another binary covers nothing' "$S\nintel\tapr\tRED\told\n" '*\tpv\t2026-09-30\tx\n'
+    # MUTANTS: the refusal made a no-op must let the RED cell through.
+    d=$(mktemp -d) || return 2
+    for m in 's/            bad.append(f"{host}\/{binary} RED: /            pass  # /' 's/^    sys.exit(1)$/    sys.exit(0)/'; do
+        mut=$d/m.sh; sed "$m" "${BASH_SOURCE[0]}" > "$mut"
+        if cmp -s "$mut" "${BASH_SOURCE[0]}"; then echo "  FAIL mutant '$m' not built: the anchor moved"; fail=1; continue; fi
+        got=$(bash -c ". '$mut' --source-only; fleet_cells_verdict \"\$(printf '%b' '$S\nintel\tapr\tRED\told\n')\" '' $now" 2>&1); rc=$?
+        if [ "$rc" = 0 ]; then echo "  ok   mutant lets the RED cell through: the refusal is load-bearing"
+        else echo "  FAIL mutant still refuses (rc $rc): $got"; fail=1; fi
+    done
+    # WIRING: rc_cut.sh runs this gate before it writes the tag, and dies on a refusal.
+    local cut; cut="$(dirname -- "${BASH_SOURCE[0]}")/rc_cut.sh"
+    local call tagline
+    call=$(grep -n 'fleet_cells_gate.sh' "$cut" | grep -v '^\s*[0-9]*:\s*#' | head -n 1 | cut -d: -f1)
+    tagline=$(grep -nF 'out=$(api_post git/refs' "$cut" | head -n 1 | cut -d: -f1)
+    if [ -n "$call" ] && [ -n "$tagline" ] && [ "$call" -lt "$tagline" ]; then echo "  ok   rc_cut.sh runs the gate (line $call) before it writes the tag (line $tagline)"
+    else echo "  FAIL rc_cut.sh does not run fleet_cells_gate.sh before creating the tag (call=${call:-none}, tag=${tagline:-none})"; fail=1; fi
+    rm -rf -- "${d:?}"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+main() {
+    local cells='' waivers='' now
+    now=$(date -u +%s)
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --source-only) return 0 ;;
+            --cells) cells=$2; shift 2 ;;
+            --waivers) waivers=$2; shift 2 ;;
+            --now) now=$2; shift 2 ;;
+            *) echo "usage: $PROG --cells FILE [--waivers FILE] [--now EPOCH] | --self-test" >&2; return 2 ;;
+        esac
+    done
+    [ -n "$cells" ] || { echo "usage: $PROG --cells FILE [--waivers FILE]" >&2; return 2; }
+    fleet_cells_verdict "$(cat -- "$cells" 2>/dev/null)" "$([ -n "$waivers" ] && cat -- "$waivers" 2>/dev/null)" "$now"
+}
+
+if [ "${1:-}" = --source-only ]; then return 0 2>/dev/null || exit 0; fi
+main "$@"
diff --git a/scripts/release/promote_rc.sh b/scripts/release/promote_rc.sh
new file mode 100755
index 0000000000..29d848f2f1
--- /dev/null
+++ b/scripts/release/promote_rc.sh
@@ -0,0 +1,274 @@
+#!/usr/bin/env bash
+# promote_rc.sh — promote vX.Y.Z-rc.N to vX.Y.Z with NO rebuild (#4286, RC-DOGFOOD-001 §4.4)
+#
+#   bash scripts/release/promote_rc.sh vX.Y.Z-rc.N [--dry-run] [--work DIR]
+#   bash scripts/release/promote_rc.sh --self-test
+#
+# The final's assets ARE the rc's bytes. Cargo stays at X.Y.Z for an rc (cop ruling,
+# 2026-09-24), so the rc binary already reports `apr X.Y.Z (<sha>)`, and the bytes that
+# were dogfooded are the bytes that ship. Only the asset NAME carries the rc label, so
+# only the name changes:
+#
+#   1. read the rc release: a prerelease, carrying all eighteen assets
+#      (scripts/check_release_assets.sh), its tag resolved to a commit
+#   2. download every asset and verify each tarball against its .sha256; a missing
+#      .sha256 or a mismatch refuses
+#   3. stage each tarball under its final name (`-vX.Y.Z-rc.N-` -> `-vX.Y.Z-`), with
+#      a .sha256 whose hash EQUALS the rc's
+#   4. create release vX.Y.Z as a DRAFT at the rc's commit, and upload
+#   5. read every final asset back and assert its sha256 equals the rc's. A mismatch
+#      exits 1 and deletes nothing: the draft stays for a human to inspect
+#   6. publish the draft, then check that the tag vX.Y.Z points at the rc's commit
+#
+# The tarball's top directory keeps the rc label (apr-vX.Y.Z-rc.N-<target>-<variant>/):
+# renaming it would change the bytes. install.sh, the binary-release smoke and
+# autopilot's host check therefore take the one apr-* directory an archive holds.
+#
+# Publishing with a personal token fires `release: published` in binary-release.yml.
+# Its `assets` job sees all eighteen present and skips every build, so nothing
+# overwrites these bytes. Verify and smoke still run, on the promoted bytes.
+#
+# Exit: 0 promoted (or the dry run passed) · 1 refused / a check failed · 2 ENV/usage.
+set -uo pipefail
+PROG=promote_rc
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+API="https://api.github.com/repos/${GITHUB_REPOSITORY:-paiml/aprender}"
+UPLOADS="https://uploads.github.com/repos/${GITHUB_REPOSITORY:-paiml/aprender}"
+
+die()  { echo "$PROG: $*" >&2; exit 1; }
+env_die() { echo "$PROG: ENV — $*" >&2; exit 2; }
+
+# ── pure / offline parts (the case table runs these on real files) ─────────────
+
+# final_of RC — vX.Y.Z-rc.N -> vX.Y.Z; empty on anything else
+final_of() {
+    if [[ $1 =~ ^(v[0-9]+\.[0-9]+\.[0-9]+)-rc\.[0-9]+$ ]]; then echo "${BASH_REMATCH[1]}"; fi
+}
+
+# final_name RC FINAL NAME — the asset's final name; empty unless NAME carries
+# `-RC-` exactly once (an asset from some other tag is not renamed, it is refused)
+final_name() {
+    local rc=$1 final=$2 name=$3 rest
+    rest=${name#*"-$rc-"}
+    [ "$rest" != "$name" ] || return 0
+    [ "${rest#*"$rc"}" = "$rest" ] || return 0
+    echo "${name%%"-$rc-"*}-$final-$rest"
+}
+
+sha_of() { sha256sum "$1" | awk '{print $1}'; }
+
+# stage RC FINAL SRC DST — verify every tarball in SRC against its .sha256, copy it
+# into DST under its final name, and write the final .sha256 carrying the SAME hash.
+# Prints `<final tarball>\t<hash>` per asset. Refuses (returns 1) on: an asset whose
+# name does not carry the rc, a tarball without a .sha256, a .sha256 without its
+# tarball, a hash mismatch, or nothing to promote.
+stage() {
+    local rc=$1 final=$2 src=$3 dst=$4 f base fin want have n=0
+    for f in "$src"/*; do
+        [ -f "$f" ] || continue
+        base=${f##*/}
+        fin=$(final_name "$rc" "$final" "$base")
+        if [ -z "$fin" ]; then echo "$PROG: refuse: $base does not carry -$rc-" >&2; return 1; fi
+        case "$base" in
+            *.sha256)
+                if [ ! -f "${f%.sha256}" ]; then echo "$PROG: refuse: $base has no tarball" >&2; return 1; fi
+                continue ;;
+        esac
+        if [ ! -f "$f.sha256" ]; then echo "$PROG: refuse: $base has no .sha256" >&2; return 1; fi
+        want=$(awk 'NR==1{print $1}' "$f.sha256")
+        have=$(sha_of "$f")
+        if [ "$want" != "$have" ]; then echo "$PROG: refuse: $base is $have, its .sha256 says $want" >&2; return 1; fi
+        cp -- "$f" "$dst/$fin" || return 1
+        printf '%s  %s\n' "$have" "$fin" > "$dst/$fin.sha256" || return 1
+        printf '%s\t%s\n' "$fin" "$have"
+        n=$((n + 1))
+    done
+    if [ "$n" -eq 0 ]; then echo "$PROG: refuse: nothing to promote in $src" >&2; return 1; fi
+}
+
+# readback MANIFEST DIR — every final tarball in DIR, and the hash its .sha256 states,
+# equal the rc's hash recorded in MANIFEST. Prints each mismatch; returns 1 on any.
+readback() {
+    local manifest=$1 dir=$2 fin want bad=0 have stated
+    while IFS=$'\t' read -r fin want; do
+        have=$( [ -f "$dir/$fin" ] && sha_of "$dir/$fin" )
+        stated=$( [ -f "$dir/$fin.sha256" ] && awk 'NR==1{print $1}' "$dir/$fin.sha256" )
+        if [ "$have" != "$want" ]; then echo "$PROG: MISMATCH $fin is '${have:-missing}', the rc's bytes are $want"; bad=1; fi
+        if [ "$stated" != "$want" ]; then echo "$PROG: MISMATCH $fin.sha256 states '${stated:-missing}', the rc's is $want"; bad=1; fi
+    done < "$manifest"
+    [ "$bad" -eq 0 ]
+}
+
+self_test() {
+    local fail=0 w rc=v0.70.0-rc.3 final=v0.70.0 got
+    w=$(mktemp -d) || return 2
+    # shellcheck disable=SC2064
+    trap "rm -rf -- '$w'" RETURN
+    row() { # want(0|1) reason why cmd... — a refusal must refuse for ITS reason, not a later check's
+        local want=$1 reason=$2 why=$3; shift 3
+        if "$@" > "$w/out" 2>&1; then got=0; else got=1; fi
+        if [ "$got" = "$want" ] && { [ -z "$reason" ] || grep -qF -- "$reason" "$w/out"; }; then echo "  ok   $why"
+        else echo "  FAIL $why (wanted rc $want and '$reason', got rc $got)"; sed 's/^/       | /' "$w/out"; fail=1; fi
+    }
+    # a fixture rc: two real tarballs and their .sha256 files
+    fixture() { # dir
+        local d=$1 a
+        mkdir -p "$d/pkg"
+        for a in "apr-$rc-x86_64-unknown-linux-gnu-cpu" "pv-$rc-x86_64-unknown-linux-musl"; do
+            mkdir -p "$d/pkg/$a"; printf 'bytes of %s\n' "$a" > "$d/pkg/$a/bin"
+            tar czf "$d/$a.tar.gz" -C "$d/pkg" "$a"
+            (cd "$d" && sha256sum "$a.tar.gz" > "$a.tar.gz.sha256")
+        done
+        rm -rf -- "${d:?}/pkg"
+    }
+    echo "$PROG self-test: names"
+    [ "$(final_of v0.70.0-rc.3)" = v0.70.0 ] && echo "  ok   final_of strips -rc.N" || { echo "  FAIL final_of"; fail=1; }
+    [ -z "$(final_of v0.70.0)" ] && echo "  ok   a final tag is not an rc" || { echo "  FAIL final_of v0.70.0"; fail=1; }
+    [ -z "$(final_of v0.70.0-rc.)" ] && echo "  ok   -rc. without N is not an rc" || { echo "  FAIL final_of -rc."; fail=1; }
+    [ "$(final_name $rc $final "apr-$rc-aarch64-unknown-linux-gnu-cuda.tar.gz")" = "apr-$final-aarch64-unknown-linux-gnu-cuda.tar.gz" ] \
+        && echo "  ok   final_name renames only the version" || { echo "  FAIL final_name"; fail=1; }
+    [ -z "$(final_name $rc $final "apr-v0.70.0-rc.30-x.tar.gz")" ] && echo "  ok   rc.30 is not rc.3" || { echo "  FAIL rc.30 renamed as rc.3"; fail=1; }
+    [ -z "$(final_name $rc $final "apr-$rc-$rc-x.tar.gz")" ] && echo "  ok   a doubled label is refused" || { echo "  FAIL doubled label"; fail=1; }
+
+    echo "$PROG self-test: stage + readback on real files"
+    mkdir -p "$w/good" "$w/good.out"; fixture "$w/good"
+    row 0 "tar.gz" "rc -> final: every tarball staged, same bytes" stage $rc $final "$w/good" "$w/good.out"
+    mkdir -p "$w/good.out2"; stage $rc $final "$w/good" "$w/good.out2" > "$w/manifest" 2>/dev/null
+    row 0 "" "read-back: final bytes and stated hashes equal the rc's" readback "$w/manifest" "$w/good.out2"
+    got=$(cmp -s "$w/good/apr-$rc-x86_64-unknown-linux-gnu-cpu.tar.gz" "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz" && echo same)
+    [ "$got" = same ] && echo "  ok   the final tarball is byte-identical to the rc's (cmp)" || { echo "  FAIL bytes differ"; fail=1; }
+
+    mkdir -p "$w/tamper" "$w/tamper.out"; fixture "$w/tamper"
+    printf 'x' >> "$w/tamper/pv-$rc-x86_64-unknown-linux-musl.tar.gz"
+    row 1 "its .sha256 says" "a tampered rc asset refuses" stage $rc $final "$w/tamper" "$w/tamper.out"
+
+    mkdir -p "$w/nosha" "$w/nosha.out"; fixture "$w/nosha"
+    rm -f -- "$w/nosha/pv-$rc-x86_64-unknown-linux-musl.tar.gz.sha256"
+    row 1 "has no .sha256" "a missing .sha256 refuses" stage $rc $final "$w/nosha" "$w/nosha.out"
+
+    mkdir -p "$w/orphan" "$w/orphan.out"; fixture "$w/orphan"
+    rm -f -- "$w/orphan/pv-$rc-x86_64-unknown-linux-musl.tar.gz"
+    row 1 "has no tarball" "a .sha256 without its tarball refuses" stage $rc $final "$w/orphan" "$w/orphan.out"
+
+    mkdir -p "$w/foreign" "$w/foreign.out"; fixture "$w/foreign"
+    cp -- "$w/foreign/apr-$rc-x86_64-unknown-linux-gnu-cpu.tar.gz" "$w/foreign/apr-v0.69.9-x86_64-unknown-linux-gnu-cpu.tar.gz"
+    row 1 "does not carry" "an asset from another tag refuses" stage $rc $final "$w/foreign" "$w/foreign.out"
+
+    mkdir -p "$w/empty" "$w/empty.out"
+    row 1 "nothing to promote" "nothing to promote refuses" stage $rc $final "$w/empty" "$w/empty.out"
+
+    cp -- "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz" "$w/swap"
+    printf 'y' >> "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz"
+    row 1 "MISMATCH apr-" "read-back: an uploaded final that differs from the rc fails" readback "$w/manifest" "$w/good.out2"
+    cp -- "$w/swap" "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz"
+    printf '%s  x\n' "$(printf 0%.0s {1..64})" > "$w/good.out2/pv-$final-x86_64-unknown-linux-musl.tar.gz.sha256"
+    row 1 "states '0000" "read-back: a final .sha256 stating another hash fails" readback "$w/manifest" "$w/good.out2"
+    rm -f -- "$w/good.out2/pv-$final-x86_64-unknown-linux-musl.tar.gz.sha256"
+    row 1 "states 'missing'" "read-back: a missing final .sha256 fails" readback "$w/manifest" "$w/good.out2"
+
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+# ── GitHub I/O ─────────────────────────────────────────────────────────────────
+
+api() { # METHOD PATH [JSON] — prints the body; fails on a non-2xx
+    local m=$1 p=$2
+    if [ "$#" -ge 3 ]; then
+        curl -sSf -X "$m" -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.github+json" --data "$3" "$API/$p"
+    else
+        curl -sSf -X "$m" -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.github+json" "$API/$p"
+    fi
+}
+json() { local code=$1; shift; python3 -c "import json,sys; d=json.load(sys.stdin); $code" "$@"; }
+download_assets() { # RELEASE_JSON DIR — fails closed: an unparseable or empty listing is an error
+    local id name list
+    list=$(printf '%s' "$1" | json 'print("\n".join(map(lambda a: str(a["id"]) + "\t" + a["name"], d["assets"])))') || return 1
+    [ -n "$list" ] || { echo "$PROG: the release lists no assets" >&2; return 1; }
+    while IFS=$'\t' read -r id name; do
+        curl -sSfL -H "Authorization: Bearer $TOKEN" -H "Accept: application/octet-stream" \
+            -o "$2/$name" "$API/releases/assets/$id" || return 1
+    done <<< "$list"
+}
+
+promote() {
+    local rc=$1 dry=$2 work=$3 final rel commit tag_json rid out f drafts body
+    final=$(final_of "$rc")
+    [ -n "$final" ] || { echo "$PROG: usage: '$rc' is not vX.Y.Z-rc.N" >&2; exit 2; }
+    TOKEN=${GH_TOKEN:-${GITHUB_TOKEN:-}}
+    [ -n "$TOKEN" ] || env_die "no GH_TOKEN/GITHUB_TOKEN"
+    command -v python3 > /dev/null && command -v sha256sum > /dev/null || env_die "needs python3 and sha256sum"
+
+    # 1. the rc
+    # by listing: an rc is a DRAFT until rc_fleet_stage.sh has it on every fleet host (#4327),
+    # and releases/tags/ never returns a draft -- a still-draft rc must be refused by name
+    rel=$(api GET "releases?per_page=100" | json 'print(json.dumps(next(r for r in d if r["tag_name"] == sys.argv[1])))' "$rc") \
+        || env_die "cannot read release $rc (not among the newest 100 releases)"
+    [ "$(printf '%s' "$rel" | json 'print(d["draft"])')" = False ] || die "refuse: $rc is still a DRAFT -- it is not on every fleet host yet (scripts/release/rc_fleet_stage.sh $rc --publish, #4327)"
+    [ "$(printf '%s' "$rel" | json 'print(d["prerelease"])')" = True ] || die "refuse: $rc is not a prerelease"
+    if api GET "releases/tags/$final" > /dev/null 2>&1; then die "refuse: release $final already exists (a draft from a failed run is deleted by hand, after reading it)"; fi
+    drafts=$(api GET "releases?per_page=100" | json 'print(" ".join(map(lambda r: str(r["id"]), filter(lambda r: r["draft"] and r["tag_name"] == sys.argv[1], d))))' "$final") \
+        || env_die "cannot list releases"
+    [ -z "$drafts" ] || die "refuse: draft release(s) $drafts of $final already exist: read them and delete them by hand"
+    tag_json=$(api GET "git/ref/tags/$rc") || env_die "cannot read tag $rc"
+    commit=$(printf '%s' "$tag_json" | json 'o=d["object"]; print(o["sha"] if o["type"]=="commit" else "TAG:"+o["url"])')
+    if [ "${commit#TAG:}" != "$commit" ]; then
+        commit=$(curl -sSf -H "Authorization: Bearer $TOKEN" "${commit#TAG:}" | json 'print(d["object"]["sha"])') || env_die "cannot dereference $rc"
+    fi
+    echo "$PROG: $rc is commit $commit"
+    bash "$ROOT/scripts/check_release_assets.sh" "$rc" || die "refuse: $rc does not carry every asset"
+
+    # 2 + 3. download, verify, stage
+    mkdir -p "$work/rc" "$work/final" "$work/back" || env_die "cannot create $work"
+    download_assets "$rel" "$work/rc" || env_die "download from $rc failed"
+    stage "$rc" "$final" "$work/rc" "$work/final" > "$work/manifest" || die "refuse: $rc's assets do not verify"
+    echo "$PROG: staged $(wc -l < "$work/manifest") tarball(s) under $final names, hashes equal to the rc's"
+    if [ "$dry" = 1 ]; then echo "$PROG: --dry-run: nothing written. Staged in $work/final"; return 0; fi
+
+    # 4. draft final at the rc's commit, upload
+    body="Promoted from $rc with no rebuild (RC-DOGFOOD-001 §4.4, #4286).
+
+Every asset is the byte-identical rc asset, renamed; each .sha256 states the rc's hash. The tarball's top directory keeps the rc label.
+
+Commit: $commit"
+    out=$(api POST releases "$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": sys.argv[1], "draft": True, "prerelease": False, "body": sys.argv[3]}))' "$final" "$commit" "$body")") \
+        || die "could not create the draft release $final"
+    rid=$(printf '%s' "$out" | json 'print(d["id"])')
+    for f in "$work/final"/*; do
+        curl -sSf -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/octet-stream" \
+            --data-binary @"$f" "$UPLOADS/releases/$rid/assets?name=${f##*/}" > /dev/null \
+            || die "upload of ${f##*/} failed; draft $rid left as is"
+    done
+
+    # 5. read back
+    rel=$(api GET "releases/$rid") || die "cannot read the draft back"
+    download_assets "$rel" "$work/back" || die "read-back download failed; draft $rid left as is"
+    readback "$work/manifest" "$work/back" || die "read-back does not equal the rc's bytes; draft $rid left, nothing deleted"
+    echo "$PROG: read-back: every final asset equals the rc's bytes"
+
+    # 6. publish, then the tag must be the rc's commit
+    api PATCH "releases/$rid" '{"draft":false,"make_latest":"true"}' > /dev/null || die "publish of draft $rid failed"
+    [ "$(api GET "git/ref/tags/$final" | json 'print(d["object"]["sha"])')" = "$commit" ] \
+        || die "published, but tag $final does not point at $commit: inspect before announcing"
+    echo "$PROG: PROMOTED $rc -> $final at $commit"
+}
+
+main() {
+    local rc='' dry=0 work=''
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return ;;
+            --dry-run) dry=1 ;;
+            --work) work=${2:-}; shift ;;
+            -h|--help) sed -n '2,31p' "${BASH_SOURCE[0]}"; return 0 ;;
+            -*) echo "$PROG: unknown flag $1" >&2; return 2 ;;
+            *) rc=$1 ;;
+        esac
+        shift
+    done
+    [ -n "$rc" ] || { echo "$PROG: usage: promote_rc.sh vX.Y.Z-rc.N [--dry-run] [--work DIR] | --self-test" >&2; return 2; }
+    [ -n "$work" ] || work=$(mktemp -d) || env_die "mktemp"
+    promote "$rc" "$dry" "$work"
+}
+
+main "$@"
diff --git a/scripts/release/rc_cut.sh b/scripts/release/rc_cut.sh
new file mode 100755
index 0000000000..f0e3196a2f
--- /dev/null
+++ b/scripts/release/rc_cut.sh
@@ -0,0 +1,269 @@
+#!/usr/bin/env bash
+# rc_cut.sh -- cut vX.Y.Z-rc.N when CI goes green on the tip of release/X.Y.Z (#4285,
+# RC-DOGFOOD-001 §4.1, paiml/infra#1030).
+#
+# WHY THIS EXISTS
+# ---------------
+# Before this, every rc was cut by hand. v0.69.3-rc.1, the only -rc tag in the repo's
+# history, was tagged at 10:25:19Z on 2026-09-24. Its prerelease was published by
+# hand 23 minutes later (10:48:32Z), and binary-release.yml then attached 16 assets
+# in 8 minutes. This script removes the 23 manual minutes. CI cuts the tag and the
+# prerelease. It never publishes a crate (RP-001).
+#
+# WHERE "GREEN" COMES FROM
+# ------------------------
+# ci.yml does not run on a push to release/**. A release branch is gated by CI on
+# its release PR (release/X.Y.Z -> main, e.g. #4224). Every push to the branch
+# re-runs that PR's CI with head_sha = the new branch tip. rc-cut.yml fires on the
+# completion of any CI run whose head branch is release/**, and this script decides:
+#   - the run's head repository is THIS repository. A fork can name its branch
+#     release/9.9.9, so this check is required.
+#   - the branch is exactly release/X.Y.Z.
+#   - both required checks, `ci / gate` and `workspace-test`, concluded success on
+#     THIS run. The run's overall conclusion is not read: it also covers jobs that
+#     branch protection does not require.
+#   - head_sha is still the branch tip. A run for a superseded push cuts nothing,
+#     because the newer push has its own run.
+#   - no vX.Y.Z-rc.* tag already points at head_sha. A re-run cuts nothing.
+# Then N = 1 + the highest existing rc number for X.Y.Z. The spec says "1 + the
+# count". The two agree while the rc numbers are contiguous. Max+1 also stays
+# collision-free if an rc tag is ever deleted, where count+1 would reuse a live name.
+#
+# A release created with GITHUB_TOKEN does NOT fire `release: published` in another
+# workflow (GitHub suppresses recursive triggers). So the script dispatches
+# binary-release.yml itself with inputs.tag, the path that workflow already takes
+# for backfills. Without that dispatch the prerelease would carry zero assets.
+#
+#   rc_cut.sh --run-id <CI run id>      decide, then cut (needs GH_TOKEN, GITHUB_REPOSITORY)
+#   rc_cut.sh --run-id <id> --dry-run   decide and print; write nothing
+#   rc_cut.sh --self-test               case table for the decision, no network
+#
+# EXIT CODES
+#   0  cut, or a deliberate skip. The result is written to $GITHUB_OUTPUT as
+#      result=cut|skip|dry-run. A red CI run cutting nothing is correct, not an error.
+#   1  a write failed (the tag already exists from a race, the release could not be
+#      created, or the dispatch was refused).
+#   2  ENV/usage: the run or the refs could not be read. This is never a skip.
+set -uo pipefail
+PROG=rc_cut
+REQUIRED_CHECKS=("ci / gate" "workspace-test")
+PER_PAGE=100   # the jobs API's maximum page size
+
+# rc_version_of_branch BRANCH -> prints X.Y.Z; returns 1 if BRANCH is not release/X.Y.Z.
+rc_version_of_branch() {
+    [[ "$1" =~ ^release/([0-9]+\.[0-9]+\.[0-9]+)$ ]] || return 1
+    printf '%s\n' "${BASH_REMATCH[1]}"
+}
+
+# rc_decide -- the whole decision, pure. Inputs are named variables so the case table
+# can vary exactly one at a time:
+#   D_REPO D_HEAD_REPO D_BRANCH D_HEAD_SHA D_TIP_SHA
+#   D_JOBS  lines "<job name>\t<conclusion>"
+#   D_TAGS  lines "<tag name>\t<commit sha>" for existing tags matching v<X.Y.Z>-rc.*
+# Prints "cut <tag>" or "skip <reason>". Returns 0 for both.
+rc_decide() {
+    local v name c n max=0 have
+    if [ "${D_HEAD_REPO:-}" != "${D_REPO:-}" ]; then
+        printf 'skip head repository %s is not %s\n' "${D_HEAD_REPO:-?}" "${D_REPO:-?}"; return 0
+    fi
+    if ! v=$(rc_version_of_branch "${D_BRANCH:-}"); then
+        printf 'skip branch %s is not release/X.Y.Z\n' "${D_BRANCH:-?}"; return 0
+    fi
+    for name in "${REQUIRED_CHECKS[@]}"; do
+        # Every job with this name must be success, and at least one must exist:
+        # a missing required check is not a green one.
+        have=$(printf '%s\n' "${D_JOBS:-}" | awk -F'\t' -v n="$name" '$1==n {print $2}')
+        if [ -z "$have" ]; then printf 'skip required check "%s" is absent from the run\n' "$name"; return 0; fi
+        if [ -n "$(printf '%s\n' "$have" | grep -v '^success$')" ]; then
+            printf 'skip required check "%s" concluded %s\n' "$name" "$(printf '%s' "$have" | paste -sd, -)"; return 0
+        fi
+    done
+    if [ -z "${D_HEAD_SHA:-}" ] || [ "${D_HEAD_SHA:-}" != "${D_TIP_SHA:-}" ]; then
+        printf 'skip %s is no longer the tip of %s (tip %s)\n' "${D_HEAD_SHA:-?}" "$D_BRANCH" "${D_TIP_SHA:-?}"; return 0
+    fi
+    while IFS=$'\t' read -r name c; do
+        [ -n "$name" ] || continue
+        [[ "$name" =~ ^v${v//./\\.}-rc\.([0-9]+)$ ]] || continue
+        n=$((10#${BASH_REMATCH[1]}))
+        if [ "$c" = "$D_HEAD_SHA" ]; then printf 'skip %s already points at %s\n' "$name" "$D_HEAD_SHA"; return 0; fi
+        [ "$n" -gt "$max" ] && max=$n
+    done <<< "${D_TAGS:-}"
+    printf 'cut v%s-rc.%d\n' "$v" "$((max + 1))"
+}
+
+self_test() {
+    local fail=0 got mut loop_head
+    local J_OK=$'ci / gate\tsuccess\nworkspace-test\tsuccess\nlint\tfailure'
+    local A=aaaaaaaa B=bbbbbbbb
+    expect() {  # expect <want> <label> -- rc_decide under the current D_* vs the full line
+        got=$(rc_decide)
+        if [ "$got" = "$1" ]; then printf '  ok   %s\n' "$2"; else printf '  FAIL %s\n       want: %s\n       got:  %s\n' "$2" "$1" "$got"; fail=1; fi
+    }
+    base() { D_REPO=paiml/aprender D_HEAD_REPO=paiml/aprender D_BRANCH=release/0.70.0 D_HEAD_SHA=$A D_TIP_SHA=$A D_JOBS=$J_OK D_TAGS=''; }
+    echo "$PROG self-test: rc_decide case table"
+    base; expect 'cut v0.70.0-rc.1' 'first green run on a fresh release branch -> rc.1 (a red non-required job does not block)'
+    base; D_TAGS=$'v0.70.0-rc.1\t'$B; expect 'cut v0.70.0-rc.2' 'rc.1 exists on an older commit -> rc.2'
+    base; D_TAGS=$'v0.70.0-rc.1\tc1\nv0.70.0-rc.3\tc3'; expect 'cut v0.70.0-rc.4' 'gap in numbering -> max+1, never reuse a name'
+    base; D_TAGS=$'v0.70.0-rc.1\tc1\nv0.70.0-rc.10\tc10\nv0.70.0-rc.9\tc9'; expect 'cut v0.70.0-rc.11' 'numeric max over the API'"'"'s LEXICAL order (rc.10 sorts before rc.9)'
+    base; D_TAGS=$'v0.69.3-rc.7\tc7\nv0.70.0\tcf\nv0.70.00-rc.5\tcx\nv0x70x0-rc.6\tcy'; expect 'cut v0.70.0-rc.1' 'other versions, the final tag and near-miss names (dots are literal) do not count'
+    base; D_TAGS=$'v0.70.0-rc.2\t'$A; expect "skip v0.70.0-rc.2 already points at $A" 're-run on an already-cut commit cuts nothing'
+    base; D_BRANCH=main; expect 'skip branch main is not release/X.Y.Z' 'main is not a release branch'
+    base; D_BRANCH=release/0.69.1-batch-2; expect 'skip branch release/0.69.1-batch-2 is not release/X.Y.Z' 'suffixed release branch refused'
+    base; D_BRANCH=release/0.70; expect 'skip branch release/0.70 is not release/X.Y.Z' 'two-part version refused'
+    base; D_HEAD_REPO=someone/aprender; expect 'skip head repository someone/aprender is not paiml/aprender' 'fork PR with a release/X.Y.Z head refused'
+    base; D_JOBS=$'ci / gate\tfailure\nworkspace-test\tsuccess'; expect 'skip required check "ci / gate" concluded failure' 'red ci / gate cuts nothing'
+    base; D_JOBS=$'ci / gate\tsuccess\nworkspace-test\tcancelled'; expect 'skip required check "workspace-test" concluded cancelled' 'cancelled workspace-test cuts nothing'
+    base; D_JOBS=$'ci / gate\tsuccess'; expect 'skip required check "workspace-test" is absent from the run' 'a missing required check is not green'
+    base; D_JOBS=$'ci / gate\tsuccess\nci / gate\tfailure\nworkspace-test\tsuccess'; expect 'skip required check "ci / gate" concluded success,failure' 'every job of the name must pass'
+    base; D_JOBS=$'ci / gate\tskipped\nworkspace-test\tsuccess'; expect 'skip required check "ci / gate" concluded skipped' 'skipped is not success'
+    base; D_TIP_SHA=$B; expect "skip $A is no longer the tip of release/0.70.0 (tip $B)" 'superseded push cuts nothing'
+    base; D_HEAD_SHA=''; D_TIP_SHA=''; expect 'skip ? is no longer the tip of release/0.70.0 (tip ?)' 'empty head sha never cuts'
+    # MUTANT: a decider with the required-check loop deleted must turn the red-gate row
+    # the other way. Build it from THIS file, so the mutant tracks the shipped code.
+    mut=$(mktemp) || return 2
+    sed '/for name in "\${REQUIRED_CHECKS\[@\]}"; do/,/^    done$/d' "${BASH_SOURCE[0]}" > "$mut"
+    # the mutant must hold FEWER uses of REQUIRED_CHECKS than this file (the loop is gone)
+    loop_head='REQUIRED_CHECKS[@]'
+    if [ "$(grep -cF "$loop_head" "$mut")" -ge "$(grep -cF "$loop_head" "${BASH_SOURCE[0]}")" ]; then echo "  FAIL mutant was not built (the check loop is still present)"; fail=1
+    else
+        got=$(D_REPO=paiml/aprender D_HEAD_REPO=paiml/aprender D_BRANCH=release/0.70.0 D_HEAD_SHA=$A D_TIP_SHA=$A \
+              D_JOBS=$'ci / gate\tfailure\nworkspace-test\tsuccess' D_TAGS='' bash -c ". '$mut' --source-only; rc_decide")
+        if [ "$got" = 'cut v0.70.0-rc.1' ]; then echo "  ok   mutant (check loop deleted) cuts on a red gate: the red-gate row can see that defect"
+        else printf '  FAIL mutant did not behave as a mutant: %s\n' "$got"; fail=1; fi
+    fi
+    rm -f -- "$mut"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+# ---- I/O: GitHub REST via curl + python3 (the fleet boxes carry no gh) ------------
+api_get() {  # api_get PATH -> body on stdout; returns 2 on any failure
+    curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+        "https://api.github.com/repos/$GITHUB_REPOSITORY${1:+/$1}" || return 2
+}
+api_post() {  # api_post PATH JSON -> line 1 is the HTTP code, the rest is the body
+    local out code
+    out=$(mktemp) || return 2
+    code=$(curl -sS -o "$out" -w '%{http_code}' -X POST -H "Authorization: Bearer $GH_TOKEN" \
+        -H "Accept: application/vnd.github+json" "https://api.github.com/repos/$GITHUB_REPOSITORY/$1" -d "$2") || { rm -f -- "$out"; return 2; }
+    printf '%s\n' "$code"; cat "$out"; rm -f -- "$out"
+}
+json() { python3 -c "import json,sys; d=json.load(sys.stdin); $1"; }
+emit() { if [ -n "${GITHUB_OUTPUT:-}" ]; then printf '%s=%s\n' "$1" "$2" >> "$GITHUB_OUTPUT"; fi; }
+summary() { if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then printf '%s\n' "$@" >> "$GITHUB_STEP_SUMMARY"; fi; printf '%s\n' "$@"; }
+post_ok() {  # post_ok <want code> <what> <api_post output>
+    local code; code=$(printf '%s\n' "$3" | head -1)
+    [ "$code" = "$1" ] && return 0
+    printf '%s: %s returned HTTP %s: %s\n' "$PROG" "$2" "$code" "$(printf '%s\n' "$3" | tail -n +2 | head -c 400)" >&2
+    return 1
+}
+
+run_cut() {
+    local run_id=$1 dry=$2 run v page body n decision tag out merged_at notes ref rc
+    : "${GH_TOKEN:?GH_TOKEN is required}" "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
+    run=$(api_get "actions/runs/$run_id") || { echo "$PROG: cannot read run $run_id" >&2; return 2; }
+    D_REPO=$GITHUB_REPOSITORY
+    D_HEAD_REPO=$(printf '%s' "$run" | json 'print((d.get("head_repository") or {}).get("full_name",""))') || return 2
+    D_BRANCH=$(printf '%s' "$run" | json 'print(d.get("head_branch") or "")') || return 2
+    D_HEAD_SHA=$(printf '%s' "$run" | json 'print(d.get("head_sha") or "")') || return 2
+    D_JOBS='' D_TAGS='' D_TIP_SHA=''
+    # Read the jobs, tip and tags only for a candidate; rc_decide still judges every field.
+    if v=$(rc_version_of_branch "$D_BRANCH") && [ "$D_HEAD_REPO" = "$D_REPO" ]; then
+        page=1
+        while :; do  # CI can exceed one page of jobs once shards and matrices are counted: paginate
+            body=$(api_get "actions/runs/$run_id/jobs?filter=latest&per_page=$PER_PAGE&page=$page") || { echo "$PROG: cannot read the jobs of run $run_id" >&2; return 2; }
+            D_JOBS+=$(printf '%s' "$body" | json 'print("\n".join(j["name"]+"\t"+str(j.get("conclusion")) for j in d["jobs"]))')$'\n' || return 2
+            n=$(printf '%s' "$body" | json 'print(len(d["jobs"]))') || return 2
+            [ "$n" -lt "$PER_PAGE" ] && break
+            page=$((page + 1))
+        done
+        body=$(api_get "git/ref/heads/release/$v") || { echo "$PROG: cannot read the tip of release/$v" >&2; return 2; }
+        D_TIP_SHA=$(printf '%s' "$body" | json 'print(d["object"]["sha"])') || return 2
+        # matching-refs returns [] when nothing matches; an annotated tag is dereferenced to its commit.
+        body=$(api_get "git/matching-refs/tags/v$v-rc.") || { echo "$PROG: cannot list the v$v-rc.* tags" >&2; return 2; }
+        D_TAGS=$(printf '%s' "$body" | python3 -c '
+import json, os, sys, urllib.request
+def get(url):
+    r = urllib.request.Request(url, headers={"Authorization": "Bearer " + os.environ["GH_TOKEN"], "Accept": "application/vnd.github+json"})
+    return json.load(urllib.request.urlopen(r))
+for ref in json.load(sys.stdin):
+    o = ref["object"]
+    sha = o["sha"] if o["type"] == "commit" else get(o["url"])["object"]["sha"]
+    print(ref["ref"][len("refs/tags/"):] + "\t" + sha)
+') || { echo "$PROG: cannot resolve the v$v-rc.* tags" >&2; return 2; }
+    fi
+    decision=$(rc_decide)
+    summary "### rc-cut: CI run $run_id on ${D_BRANCH:-?} @ ${D_HEAD_SHA:0:9}" "" "$decision"
+    case "$decision" in
+        skip*) emit result skip; return 0 ;;
+        "cut "*) tag=${decision#cut } ;;
+        *) echo "$PROG: rc_decide printed '$decision'" >&2; return 2 ;;
+    esac
+    emit tag "$tag"
+    emit sha "$D_HEAD_SHA"   # rc-cut.yml gates exactly this commit before the real cut (#4287)
+
+    # 0. The fleet (#4328 C4): no rc is cut while a fleet cell is RED, unless a dated waiver
+    #    in scripts/release/fleet-waivers.tsv names it. The cells are infra-64's andon output
+    #    (C3) on the fleet-state branch; missing or stale cells refuse too.
+    local cells gate
+    cells=$(mktemp) || return 2
+    api_get "contents/fleet/cells.tsv?ref=fleet-state" 2>/dev/null \
+        | json 'import base64; sys.stdout.write(base64.b64decode(d["content"]).decode())' > "$cells" 2>/dev/null || : > "$cells"
+    gate=$(bash "$(dirname -- "${BASH_SOURCE[0]}")/fleet_cells_gate.sh" --cells "$cells" \
+        --waivers "$(dirname -- "${BASH_SOURCE[0]}")/fleet-waivers.tsv"); rc=$?
+    rm -f -- "$cells"
+    summary "fleet cells: $gate"
+    [ "$rc" = 0 ] || { echo "$PROG: REFUSED to cut $tag -- $gate (#4328 C4)" >&2; emit result fleet-red; return 1; }
+    if [ "$dry" = 1 ]; then summary "(dry run: no tag, release or dispatch written)"; emit result dry-run; return 0; fi
+
+    # 1. The tag. Creating the ref first makes the name the lock: a concurrent cut of
+    #    the same N gets 422 here and writes nothing else.
+    out=$(api_post git/refs "{\"ref\":\"refs/tags/$tag\",\"sha\":\"$D_HEAD_SHA\"}") || return 1
+    post_ok 201 "creating tag $tag" "$out" || return 1
+
+    # 2. The prerelease, never latest, created as a DRAFT (#4327). Operator, 2026-09-24:
+    #    "THE INSTANT we do a release candidate it needs to be on all hardware either before
+    #    or same time". A draft is invisible to install.sh and the fleet poller; it becomes
+    #    visible only when rc_fleet_stage.sh has installed and verified it on every
+    #    reachable fleet host. The notes carry the provenance the fleet pins by (commit and
+    #    gating run) and the merge time the <=45 min target is measured from.
+    merged_at=$(api_get "commits/$D_HEAD_SHA" | json 'print(d["commit"]["committer"]["date"])') || merged_at=unknown
+    notes="Release candidate of ${v}, cut by CI (#4285). Not on crates.io.
+
+Commit \`$D_HEAD_SHA\` on \`release/$v\`, merged $merged_at.
+Gated by CI run https://github.com/$GITHUB_REPOSITORY/actions/runs/$run_id (\`ci / gate\` and \`workspace-test\` green).
+Cut at $(date -u +%Y-%m-%dT%H:%M:%SZ). binary-release.yml attaches the apr and pv assets to this DRAFT;
+scripts/release/rc_fleet_stage.sh publishes it only after every reachable fleet host runs it (#4327).
+
+Install: \`install.sh --version $tag\`, or \`install.sh --channel rc\` for the newest rc."
+    body=$(TAG=$tag NOTES=$notes python3 -c 'import json,os; print(json.dumps({"tag_name":os.environ["TAG"],"name":os.environ["TAG"],"body":os.environ["NOTES"],"prerelease":True,"draft":True,"make_latest":"false"}))') || return 1
+    out=$(api_post releases "$body") || return 1
+    post_ok 201 "creating prerelease $tag (the tag exists; create the release and dispatch binary-release.yml by hand)" "$out" || return 1
+
+    # 3. The assets. A GITHUB_TOKEN-created release does not fire `release: published`.
+    ref=$(api_get "" | json 'print(d["default_branch"])') || ref=main
+    out=$(api_post actions/workflows/binary-release.yml/dispatches "{\"ref\":\"$ref\",\"inputs\":{\"tag\":\"$tag\"}}") || return 1
+    post_ok 204 "dispatching binary-release.yml for $tag" "$out" || return 1
+    summary "Cut $tag at ${D_HEAD_SHA:0:9} as a DRAFT prerelease and dispatched binary-release.yml on $ref. Next: rc_fleet_stage.sh $tag --publish (#4327)."
+    emit result cut
+}
+
+main() {
+    local run_id='' dry=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --source-only) return 0 ;;
+            --run-id) run_id=${2:-}; shift 2 || return 2 ;;
+            --dry-run) dry=1; shift ;;
+            -h|--help) sed -n '2,48p' "${BASH_SOURCE[0]}"; return 0 ;;
+            *) echo "$PROG: unknown argument $1" >&2; return 2 ;;
+        esac
+    done
+    [[ "$run_id" =~ ^[0-9]+$ ]] || { echo "$PROG: --run-id <numeric CI run id> is required" >&2; return 2; }
+    run_cut "$run_id" "$dry"
+}
+
+# Sourced with --source-only (the self-test's mutant): define the functions, run nothing.
+if [ "${1:-}" = --source-only ]; then return 0 2>/dev/null || exit 0; fi
+main "$@"
diff --git a/scripts/release/rc_fleet_stage.sh b/scripts/release/rc_fleet_stage.sh
new file mode 100755
index 0000000000..8a5aebac21
--- /dev/null
+++ b/scripts/release/rc_fleet_stage.sh
@@ -0,0 +1,325 @@
+#!/usr/bin/env bash
+# rc_fleet_stage.sh -- an rc is published only when every fleet host already runs it (#4327, #4328 C2)
+#
+#   rc_fleet_stage.sh vX.Y.Z-rc.N               stage + verify on every host; print the receipt
+#   rc_fleet_stage.sh vX.Y.Z-rc.N --publish     ...and on N/N flip the DRAFT to a visible prerelease
+#   rc_fleet_stage.sh --self-test               verdict table + mutants + a fake fleet (no network)
+#
+# Operator, verbatim (2026-09-24): "THE INSTANT we do a release candidate it needs to be on all
+# hardware either before or same time. change process". v0.69.3-rc.2 was published while
+# lambda still ran rc.1, intel ran an older apr, and mini had no darwin asset to install: the
+# fleet install ran on an hourly timer that nothing tied to the cut.
+#
+# THE NEW ORDER. rc_cut.sh creates the rc as a DRAFT and binary-release.yml attaches the
+# assets to it (a draft is invisible to install.sh and to the fleet poller). This script then,
+# for every host in the fleet (lambda, gx10, yoga, intel, mini; jetson is retired, #4328 C7):
+#   1. copies the host's apr asset (+ .sha256), and pv's on linux, onto the host;
+#   2. installs it: the host's own `fleet-bins install <tag> <dir> <commit>` (infra 620249d8)
+#      when it has one,
+#      otherwise the built-in atomic install below (sha256 checked, rename over the binary
+#      PATH resolves, the previous copy kept beside it);
+#   3. verifies what PATH now resolves: `apr --version` must equal `apr <X.Y.Z-rc.N> (<sha>)`
+#      of THIS tag's commit (asset_version_check.sh, #4110), and `pv --version` its version.
+# It publishes only when every host passes. A failed host holds the rc. An unreachable host
+# holds it too -- never skipped silently (#4328 C7) -- unless a dated waiver names it:
+#   RC_FLEET_WAIVERS=FILE   lines `<host>\t<until YYYY-MM-DD>\t<reason>`, valid through `until`
+# A waiver never covers a host that was reached and failed.
+#
+# The per-host receipt (host, arch, tag, sha, path resolved, verdict) is printed, written to
+# $RC_FLEET_RECEIPT, and appended to the release notes on publish (#4327 step 5).
+#
+# Runs on lambda as the operator user: it needs ssh to the fleet and an authenticated gh (it
+# reads a draft). The fleet boxes and the CI runners have neither.
+#
+# EXIT  0 every host passes (published with --publish) · 1 held: a host failed or was not
+#       reached · 2 usage/ENV: the release, its assets or the tag commit could not be read.
+set -uo pipefail
+PROG=rc_fleet_stage
+HERE=${RC_FLEET_HERE:-"$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"}  # a mutant copy runs from a tmp dir
+REPO=${RC_FLEET_REPO:-paiml/aprender}
+SSH=${RC_FLEET_SSH:-ssh}
+SCP=${RC_FLEET_SCP:-scp}
+
+# host  ssh-target(- = this box)  apr asset suffix  pv asset suffix (- = none ships)
+FLEET_DEFAULT='lambda	-	x86_64-unknown-linux-gnu-cuda	x86_64-unknown-linux-gnu
+gx10	gx10	aarch64-unknown-linux-gnu-cuda	aarch64-unknown-linux-gnu
+yoga	yoga	x86_64-unknown-linux-gnu-cuda	x86_64-unknown-linux-gnu
+intel	intel	x86_64-unknown-linux-gnu-cpu	x86_64-unknown-linux-gnu
+mini	mini	aarch64-apple-darwin-cpu	-'
+
+# stage_verdict -- pure. stdin: rows `<host>\t<pass|fail|unreachable>`; $1 waivers text; $2 today
+# (YYYY-MM-DD). Prints `publish` or `hold <why; why>`. Returns 0 for both.
+stage_verdict() {
+    local waivers=$1 today=$2 host state why='' n=0 until
+    while IFS=$'\t' read -r host state _; do
+        [ -n "$host" ] || continue
+        n=$((n + 1))
+        case "$state" in
+            pass) ;;
+            fail) why+="$host failed; " ;;
+            unreachable)
+                until=$(printf '%s\n' "$waivers" | awk -F'\t' -v h="$host" '$1==h {print $2}' | sort | tail -n 1)
+                if [ -n "$until" ] && [[ "$until" > "$today" || "$until" = "$today" ]]; then :
+                else why+="$host unreachable (no waiver through $today); "; fi ;;
+            *) why+="$host state '$state'; " ;;
+        esac
+    done
+    [ "$n" -gt 0 ] || why='no hosts; '
+    if [ -z "$why" ]; then echo publish; else echo "hold ${why%; }"; fi
+}
+
+# ---- the remote side: one bash script, run on the host with its login PATH ------------
+# args: <dir, relative to $HOME> <bin> <asset>. Prints one line: INSTALLED <path> | <REASON> <detail>.
+INSTALL_SH='set -u
+d=$HOME/$1 bin=$2 asset=$3
+cd "$d" || { echo "NO-DIR $d"; exit 1; }
+want=$(cut -d" " -f1 "$asset.sha256" 2>/dev/null)
+if command -v sha256sum >/dev/null 2>&1; then got=$(sha256sum "$asset" | cut -d" " -f1); else got=$(shasum -a 256 "$asset" | cut -d" " -f1); fi
+[ -n "$want" ] && [ "$got" = "$want" ] || { echo "SHA-MISMATCH $asset want=$want got=$got"; exit 1; }
+rm -rf -- "${d:?}/x" && mkdir x && tar -xzf "$asset" -C x || { echo "UNTAR $asset"; exit 1; }
+new=$(find x -type f -name "$bin" | head -n 1)
+[ -n "$new" ] || { echo "NO-BINARY $bin in $asset"; exit 1; }
+chmod 0755 "$new"
+tgt=$(command -v "$bin" 2>/dev/null || true)
+case "$tgt" in /*) ;; *) tgt=$HOME/.cargo/bin/$bin; mkdir -p "$HOME/.cargo/bin" ;; esac
+dir=$(dirname "$tgt"); run=
+if [ ! -w "$dir" ]; then
+    if sudo -n true 2>/dev/null; then run="sudo -n"; else echo "NOT-WRITABLE $dir (no passwordless sudo)"; exit 1; fi
+fi
+[ -e "$tgt" ] && $run cp -p "$tgt" "$dir/.$bin.rc-stage.prev"
+$run cp "$new" "$dir/.$bin.rc-stage.new" && $run mv -f "$dir/.$bin.rc-stage.new" "$tgt" || { echo "SWAP $tgt"; exit 1; }
+echo "INSTALLED $tgt"'
+
+rx() {  # rx <ssh-target> <command string> -> runs it under a login bash on the host
+    if [ "$1" = - ]; then bash -lc "$2"; else "$SSH" -o BatchMode=yes -o ConnectTimeout=10 "$1" "bash -lc $(printf '%q' "$2")"; fi
+}
+rx_script() {  # rx_script <ssh-target> <args...> < script
+    local t=$1; shift
+    if [ "$t" = - ]; then bash -l -s -- "$@"; else "$SSH" -o BatchMode=yes -o ConnectTimeout=10 "$t" "bash -l -s -- $(printf '%q ' "$@")"; fi
+}
+put() {  # put <ssh-target> <remote dir, relative to $HOME> <files...>
+    local t=$1 d=$2; shift 2
+    if [ "$t" = - ]; then mkdir -p "$HOME/$d" && cp -- "$@" "$HOME/$d/"; else rx "$t" "mkdir -p \"\$HOME/$d\"" && "$SCP" -q -o BatchMode=yes "$@" "$t:$d/"; fi
+}
+
+# stage_host <name> <ssh> <apr suffix> <pv suffix> <tag> <commit> <assets dir>
+# prints one receipt row: host arch tag sha path verdict detail
+stage_host() {
+    local h=$1 t=$2 as=$3 ps=$4 tag=$5 commit=$6 ad=$7 rdir out arch path line pvline detail='' ok=1 f
+    rdir=.cache/rc-stage/$tag
+    if ! arch=$(rx "$t" 'uname -sm' 2>/dev/null | tr ' ' '-') || [ -z "$arch" ]; then
+        printf '%s\t?\t%s\t%s\t-\tunreachable\tssh %s failed\n' "$h" "$tag" "${commit:0:9}" "$t"; return 0
+    fi
+    local staged=()  # bin:asset pairs copied onto the host
+    for f in "apr:$as" "pv:$ps"; do
+        local bin=${f%%:*} sfx=${f#*:} asset
+        [ "$sfx" = - ] && { detail+="$bin: no asset ships for this host; "; continue; }
+        asset="$bin-$tag-$sfx.tar.gz"
+        [ -f "$ad/$asset" ] && [ -f "$ad/$asset.sha256" ] || { ok=0; detail+="$bin: $asset not downloaded; "; continue; }
+        put "$t" "$rdir" "$ad/$asset" "$ad/$asset.sha256" || { ok=0; detail+="$bin: copy failed; "; continue; }
+        staged+=("$f")
+    done
+    if [ "${#staged[@]}" -gt 0 ] && rx "$t" 'command -v fleet-bins' > /dev/null 2>&1; then
+        # infra's installer (620249d8): verifies each .sha256, swaps atomically, records the
+        # commit, never downgrades. Its rc is the verdict, not its prose.
+        out=$(rx "$t" "fleet-bins install $(printf '%q' "$tag") \"\$HOME/$rdir\" $commit" 2>&1) \
+            || { ok=0; detail+="fleet-bins install: $(printf '%s' "$out" | tail -n 1); "; }
+    else
+        for f in "${staged[@]}"; do
+            out=$(rx_script "$t" "$rdir" "${f%%:*}" "${f%%:*}-$tag-${f#*:}.tar.gz" <<< "$INSTALL_SH" 2>&1 | tail -n 1)
+            case "$out" in INSTALLED*) ;; *) ok=0; detail+="${f%%:*}: install: $out; " ;; esac
+        done
+    fi
+    # Verify what PATH resolves NOW -- not the file just written: a shadow earlier on PATH
+    # would keep serving the old build (lambda's ~/.cargo/bin +no-git copy, #4327).
+    path=$(rx "$t" 'command -v apr' 2>/dev/null | tail -n 1)
+    line=$(rx "$t" 'apr --version' 2>/dev/null | head -n 1)
+    if ! out=$(bash "$HERE/asset_version_check.sh" "$tag" "$commit" "$line" 2>&1); then ok=0; detail+="apr: $out; "; fi
+    if [ "$ps" != - ]; then
+        pvline=$(rx "$t" 'pv --version' 2>/dev/null | head -n 1)
+        [ "$(printf '%s' "$pvline" | cut -d' ' -f1,2)" = "pv ${tag#v}" ] || { ok=0; detail+="pv: '$pvline' is not pv ${tag#v}; "; }
+    fi
+    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$h" "$arch" "$tag" "${commit:0:9}" "${path:--}" "$([ "$ok" = 1 ] && echo pass || echo fail)" "${detail%; }"
+}
+
+tag_commit() {  # the commit a tag names (annotated tags dereferenced)
+    [ -n "${RC_FLEET_COMMIT:-}" ] && { echo "$RC_FLEET_COMMIT"; return 0; }
+    local refs
+    refs=$(git ls-remote "https://github.com/$REPO" "refs/tags/$1" "refs/tags/$1^{}") || return 2
+    printf '%s\n' "$refs" | awk '/\^\{\}$/ {d=$1} {p=$1} END {print (d != "" ? d : p)}'
+}
+
+stage() {
+    local tag=$1 publish=$2 commit work rows verdict today hosts receipt waivers='' n pass
+    [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]] || { echo "$PROG: $tag is not vX.Y.Z-rc.N" >&2; return 2; }
+    commit=$(tag_commit "$tag") && [[ "$commit" =~ ^[0-9a-f]{40}$ ]] || { echo "$PROG: cannot resolve the commit of $tag" >&2; return 2; }
+    bash "$HERE/../check_release_assets.sh" "$tag" > /dev/null || { echo "$PROG: $tag does not carry every asset yet (scripts/check_release_assets.sh $tag)" >&2; return 2; }
+    work=${RC_FLEET_WORK:-$(mktemp -d)} || return 2
+    gh release download "$tag" -R "$REPO" -D "$work" --clobber -p "apr-$tag-*" -p "pv-$tag-*" > /dev/null 2>&1 \
+        || { echo "$PROG: cannot download the assets of $tag" >&2; return 2; }
+    hosts=${RC_FLEET_HOSTS_FILE:+$(grep -vE '^\s*(#|$)' "$RC_FLEET_HOSTS_FILE")}
+    hosts=${hosts:-$FLEET_DEFAULT}
+    [ -n "${RC_FLEET_WAIVERS:-}" ] && waivers=$(grep -vE '^\s*(#|$)' "$RC_FLEET_WAIVERS")
+    rows=$(while IFS=$'\t' read -r h t as ps; do stage_host "$h" "$t" "$as" "$ps" "$tag" "$commit" "$work"; done <<< "$hosts")
+    today=${RC_FLEET_TODAY:-$(date -u +%F)}
+    verdict=$(printf '%s\n' "$rows" | awk -F'\t' '{print $1 "\t" $6}' | stage_verdict "$waivers" "$today")
+    n=$(printf '%s\n' "$rows" | grep -c .); pass=$(printf '%s\n' "$rows" | awk -F'\t' '$6=="pass"' | grep -c .)
+    receipt=${RC_FLEET_RECEIPT:-$work/receipt.md}
+    {
+        echo "### Fleet staging of $tag at ${commit:0:9}: $pass/$n hosts (#4327)"
+        echo
+        echo "| host | arch | tag | sha | path resolved | verdict | detail |"
+        echo "|---|---|---|---|---|---|---|"
+        printf '%s\n' "$rows" | awk -F'\t' '{printf "| %s | %s | %s | %s | %s | %s | %s |\n", $1,$2,$3,$4,$5,($6=="pass"?"PASS":toupper($6)),$7}'
+        echo
+        echo "verdict: $verdict"
+    } > "$receipt"
+    cat "$receipt"
+    case "$verdict" in
+        publish) ;;
+        *) echo "$PROG: HELD -- $tag stays a draft" >&2; return 1 ;;
+    esac
+    [ "$publish" = 1 ] || { echo "(no --publish: $tag stays a draft)"; return 0; }
+    local body
+    body=$(gh release view "$tag" -R "$REPO" --json body -q .body) || { echo "$PROG: cannot read the notes of $tag" >&2; return 2; }
+    printf '%s\n\n%s\n' "$body" "$(cat "$receipt")" > "$work/notes.md"
+    gh release edit "$tag" -R "$REPO" --draft=false --prerelease --latest=false --notes-file "$work/notes.md" > /dev/null \
+        || { echo "$PROG: every host passed but publishing $tag failed" >&2; return 2; }
+    echo "PUBLISHED $tag: on $pass/$n fleet hosts before it was visible"
+}
+
+# ---- self-test ---------------------------------------------------------------------
+self_test() {
+    local fail=0 got d mut rc log
+    v() {  # v <want> <label> <rows> [waivers] [today]
+        got=$(printf '%b' "$3" | stage_verdict "${4:-}" "${5:-2026-09-24}")
+        if [ "$got" = "$1" ]; then echo "  ok   $2"; else printf '  FAIL %s\n       want: %s\n       got:  %s\n' "$2" "$1" "$got"; fail=1; fi
+    }
+    echo "$PROG self-test: stage_verdict"
+    v publish 'every host passes -> publish' 'lambda\tpass\ngx10\tpass\nmini\tpass\n'
+    v 'hold gx10 failed' 'ONE host failing holds the rc' 'lambda\tpass\ngx10\tfail\nmini\tpass\n'
+    v 'hold intel unreachable (no waiver through 2026-09-24)' 'an unreachable host is RED, never skipped (#4328 C7)' 'lambda\tpass\nintel\tunreachable\n'
+    v publish 'a dated waiver through today covers an unreachable host' 'lambda\tpass\nintel\tunreachable\n' $'intel\t2026-09-24\tmaintenance'
+    v 'hold intel unreachable (no waiver through 2026-09-24)' 'an expired waiver covers nothing' 'lambda\tpass\nintel\tunreachable\n' $'intel\t2026-09-23\tmaintenance'
+    v 'hold intel failed' 'a waiver never covers a host that was reached and failed' 'lambda\tpass\nintel\tfail\n' $'intel\t2026-12-31\tx'
+    v 'hold no hosts' 'no hosts is not N/N' ''
+    v "hold yoga state 'maybe'" 'an unknown state holds' 'yoga\tmaybe\n'
+
+    # MUTANTS: the refusal made a no-op must PUBLISH past the bad host, or the rows above are
+    # not what refuses it. (Deleting the arm alone is not a mutant: the catch-all holds too.)
+    mutant() {  # mutant <label> <sed expr> <rows>
+        mut=$(mktemp) || return 2
+        sed "$2" "${BASH_SOURCE[0]}" > "$mut"
+        if cmp -s "$mut" "${BASH_SOURCE[0]}"; then echo "  FAIL mutant '$1' not built: the anchor moved"; fail=1
+        else
+            got=$(printf '%b' "$3" | bash -c ". '$mut' --source-only; stage_verdict '' 2026-09-24")
+            if [ "$got" = publish ]; then echo "  ok   mutant '$1' publishes past the bad host: the refusal is load-bearing"
+            else echo "  FAIL mutant '$1' still says '$got': something else refuses"; fail=1; fi
+        fi
+        rm -f -- "$mut"
+    }
+    mutant 'fail arm is a no-op' 's/fail) why+="\$host failed; " ;;/fail) ;;/' 'lambda\tpass\ngx10\tfail\n'
+    mutant 'unreachable counts as pass' 's/^            unreachable)$/            unreachable) continue ;; x)/' 'lambda\tpass\nintel\tunreachable\n'
+
+    # A FAKE FLEET, end to end: three hosts behind a fake ssh/scp/gh. The operator's
+    # acceptance (#4327): "a cut where one host fails verify does NOT publish".
+    d=$(mktemp -d) || return 2
+    local tag=v9.9.9-rc.3 sha=1234567890abcdef1234567890abcdef12345678 h
+    mkdir -p "$d/bin" "$d/assets" "$d/pkg"
+    for h in good1 good2 bad; do mkdir -p "$d/hosts/$h/.cargo/bin"; done
+    fake_bin() {  # fake_bin <name> <version line> -> a tarball + .sha256 in $d/assets
+        local n=$1 a
+        a="$n-$tag-x86_64-unknown-linux-gnu-${3:-cpu}.tar.gz"; [ "$n" = pv ] && a="pv-$tag-x86_64-unknown-linux-gnu.tar.gz"
+        rm -rf -- "${d:?}/pkg/x"; mkdir -p "$d/pkg/x"
+        printf '#!/bin/sh\necho "%s"\n' "$2" > "$d/pkg/x/$n"; chmod +x "$d/pkg/x/$n"
+        tar -czf "$d/assets/$a" -C "$d/pkg" x
+        (cd "$d/assets" && sha256sum "$a" > "$a.sha256")
+    }
+    fake_bin apr "apr 9.9.9-rc.3 (123456789)"
+    fake_bin pv "pv 9.9.9-rc.3 (aprender provable-contracts verifier)"
+    # the bad host runs an old apr and a fleet-bins that SAYS installed and swaps nothing:
+    # only verifying what PATH serves afterwards can see it (the installer is not trusted)
+    mkdir -p "$d/hosts/bad/shadow"; printf '#!/bin/sh\necho "apr 9.9.9 (v9.9.9+no-git)"\n' > "$d/hosts/bad/shadow/apr"
+    printf '#!/bin/sh\necho "apr INSTALLED $2"\n' > "$d/hosts/bad/shadow/fleet-bins"
+    # ...and an already-current pv, so apr's verify is the ONLY thing that can hold it
+    printf '#!/bin/sh\necho "pv 9.9.9-rc.3 (aprender provable-contracts verifier)"\n' > "$d/hosts/bad/shadow/pv"; chmod +x "$d/hosts/bad/shadow/"*
+    log=$d/gh.log
+    # fake ssh: `ssh -o .. -o .. HOST CMD` runs CMD with HOME and PATH of that host
+    cat > "$d/bin/ssh" <<EOF
+#!/usr/bin/env bash
+while [ "\${1:-}" = -o ]; do shift 2; done
+h=\$1; shift
+[ -d "$d/hosts/\$h" ] || { echo "ssh: connect to host \$h: No route to host" >&2; exit 255; }
+export HOME="$d/hosts/\$h"; export PATH="\$HOME/shadow:\$HOME/.cargo/bin:/usr/bin:/bin"
+cd "\$HOME" && eval "\$*"
+EOF
+    cat > "$d/bin/scp" <<EOF
+#!/usr/bin/env bash
+args=(); for a in "\$@"; do case "\$a" in -q|-o|BatchMode=yes) ;; *) args+=("\$a") ;; esac; done
+dst=\${args[-1]}; unset 'args[-1]'; h=\${dst%%:*}; p=\${dst#*:}
+cp -- "\${args[@]}" "$d/hosts/\$h/\$p"
+EOF
+    cat > "$d/bin/gh" <<EOF
+#!/usr/bin/env bash
+echo "gh \$*" >> "$log"
+case "\$1 \$2" in
+  "release download") while [ \$# -gt 0 ]; do [ "\$1" = -D ] && dst=\$2; shift; done; cp "$d/assets/"* "\$dst/" ;;
+  "release view") echo "notes" ;;
+  "release edit") ;;
+esac
+EOF
+    chmod +x "$d/bin/"*
+    printf '%s\n' "apr-$tag-x86_64-unknown-linux-gnu-cpu.tar.gz" > "$d/assets.list"
+    run_fleet() {  # run_fleet <hosts...> -> rc of a --publish run over those hosts (of $self)
+        printf '' > "$log"; : > "$d/hosts.tsv"
+        for h in "$@"; do printf '%s\t%s\tx86_64-unknown-linux-gnu-cpu\tx86_64-unknown-linux-gnu\n' "$h" "$h" >> "$d/hosts.tsv"; done
+        PATH="$d/bin:$PATH" RC_FLEET_COMMIT=$sha RC_FLEET_HOSTS_FILE="$d/hosts.tsv" RC_FLEET_WORK="$d/work" \
+            RELEASE_ASSETS_FIXTURE="$d/complete.txt" RC_FLEET_TODAY=2026-09-24 \
+            RC_FLEET_HERE=$HERE bash "$self" "$tag" --publish > "$d/out.txt" 2>&1
+    }
+    bash "$HERE/../check_release_assets.sh" --list "$tag" > "$d/complete.txt"
+    mkdir -p "$d/work"
+    e2e() {  # e2e <want rc> <want edit 0|1> <label> <hosts...>
+        local wrc=$1 wedit=$2 label=$3; shift 3
+        rm -rf -- "${d:?}/work"; mkdir -p "$d/work"
+        run_fleet "$@"; rc=$?
+        local edited=0; grep -q '^gh release edit' "$log" && edited=1
+        if [ "$rc" = "$wrc" ] && [ "$edited" = "$wedit" ]; then echo "  ok   $label (rc $rc, published=$edited)"
+        else echo "  FAIL $label: rc $rc (want $wrc), published=$edited (want $wedit)"; sed 's/^/       /' "$d/out.txt"; fail=1; fi
+    }
+    echo "$PROG self-test: a fake fleet, end to end"
+    local self=${BASH_SOURCE[0]}
+    e2e 0 1 'every host installs and verifies -> the draft is published' good1 good2
+    grep -q -- '--draft=false' "$log" || { echo "  FAIL publish did not flip --draft=false"; fail=1; }
+    grep -q '| good2 | .* | PASS |' "$d/work/receipt.md" || { echo "  FAIL receipt has no PASS row for good2"; fail=1; }
+    e2e 1 0 'ONE host whose PATH resolves an old apr -> NOT published (operator acceptance, #4327)' good1 bad good2
+    grep -q 'bad.*FAIL.*wants 9.9.9-rc.3' "$d/work/receipt.md" || { echo "  FAIL the bad host's row does not name the version it served"; fail=1; }
+    e2e 1 0 'an unreachable host -> NOT published (#4328 C7)' good1 gone
+    # MUTANT: the per-host verify deleted -- the lying installer's host must now get published
+    self=$d/mutant.sh
+    sed 's/if ! out=$(bash "$HERE\/asset_version_check.sh"/if false \&\& out=$(bash "$HERE\/asset_version_check.sh"/' "${BASH_SOURCE[0]}" > "$self"
+    if cmp -s "$self" "${BASH_SOURCE[0]}"; then echo "  FAIL verify mutant not built: the anchor moved"; fail=1
+    else e2e 0 1 'mutant (asset_version_check deleted) publishes past the lying host: the verify is what holds it' good1 bad good2; fi
+    rm -rf -- "${d:?}"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+main() {
+    local tag='' publish=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --source-only) return 0 ;;
+            --publish) publish=1; shift ;;
+            -h|--help) sed -n '2,40p' "${BASH_SOURCE[0]}"; return 0 ;;
+            v*) tag=$1; shift ;;
+            *) echo "$PROG: unknown argument $1" >&2; return 2 ;;
+        esac
+    done
+    [ -n "$tag" ] || { echo "usage: $PROG vX.Y.Z-rc.N [--publish] | --self-test" >&2; return 2; }
+    stage "$tag" "$publish"
+}
+
+if [ "${1:-}" = --source-only ]; then return 0 2>/dev/null || exit 0; fi
+main "$@"
diff --git a/scripts/release/rc_publish_gate.sh b/scripts/release/rc_publish_gate.sh
new file mode 100755
index 0000000000..a60ab388cd
--- /dev/null
+++ b/scripts/release/rc_publish_gate.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# rc_publish_gate.sh — can this release candidate reach crates.io? (#4287, RC-DOGFOOD-001 §4.5)
+#
+#   bash scripts/release/rc_publish_gate.sh ROOT     # judge the checked-out rc tree at ROOT
+#   bash scripts/release/rc_publish_gate.sh --self-test
+#
+# WHY AT THE RC. v0.68.0 and v0.69.0 never reached crates.io. v0.68.0 went GitHub-only
+# when clean-room B2 went red AT PUBLISH: aprender-core's lib tests named `entrenar`, a
+# path-only dev-dep that `cargo publish` deletes (#3425). The fix was a whole hotfix
+# cycle. The same defects are visible on the commit, long before the tag, so the rc cut
+# (rc-cut.yml, #4285) runs this before it writes the tag: red here means no rc.
+#
+# THREE CHECKS, each the tool that already owns its rule, pointed at ROOT:
+#   graph     check_publish_preflight.sh --graph-only: R6, no versioned sibling
+#             dev-dependency on a cycle (PMAT-955, #3468). R1/R3/R4/R5/R7 describe the
+#             upload itself and stay at publish.
+#   pathonly  check_pathonly_devdeps_unused_in_src.sh --rc-gate ROOT: src/ uses no
+#             dev-dep the publish strips, judged against THIS checkout's triage (the
+#             default branch), never the rc tree's own baseline, which masked #3425.
+#   package   `cargo package --no-verify --locked` over every publishable member in one
+#             invocation, so unpublished sibling versions resolve through cargo's local
+#             overlay: the cascade's manifests, includes and version pins, without an
+#             upload. Every selected crate must print a Packaged line.
+#
+# ROOT is a clean checkout of the rc commit. The checks run from THIS file's checkout,
+# so a release branch cannot weaken the gate that judges it.
+#
+# EXIT  0 all three green · 1 a check found a publish defect · 2 a check could not measure
+#       (a defect found outranks a check that could not run: 1 wins over 2).
+set -uo pipefail
+PROG=rc_publish_gate
+HERE="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPTS="$(cd -- "$HERE/.." && pwd)"
+
+# Pure: the verdict of the three check exit codes. Prints `green`, `red` or `env`.
+rpg_verdict() {
+    local rc red=0 env=0
+    for rc in "$@"; do
+        case "$rc" in
+            0) ;;
+            1) red=1 ;;
+            *) env=1 ;;
+        esac
+    done
+    if [ "$red" = 1 ]; then echo red
+    elif [ "$env" = 1 ] || [ "$#" -ne 3 ]; then echo env
+    else echo green
+    fi
+}
+
+self_test() {
+    local fail=0 got want args why
+    echo "$PROG self-test: case table"
+    while IFS='|' read -r want args why; do
+        # shellcheck disable=SC2086  # args is a space-separated list of exit codes on purpose
+        got=$(rpg_verdict $args)
+        if [ "$got" = "$want" ]; then echo "  ok   $why"; else echo "  FAIL $why: wanted $want, got $got"; fail=1; fi
+    done <<'EOF'
+green|0 0 0|all three green
+red|1 0 0|the graph refused
+red|0 1 0|the path-only rule refused (the #3425 shape)
+red|0 0 1|the package walk refused
+env|2 0 0|a check that could not measure is not a pass
+red|1 2 0|a defect found outranks a check that could not run
+env|0 0 101|an unexpected exit code is not a pass
+env|0 0|a missing check is not a pass
+EOF
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+# package_walk ROOT -> 0 every publishable member packaged, 1 cargo refused, 2 cannot measure
+package_walk() {
+    local root=$1 log n got rc=0
+    local -a sel=()
+    mapfile -t sel < <(cargo metadata --no-deps --offline --format-version 1 --manifest-path "$root/Cargo.toml" 2>/dev/null \
+        | python3 -c 'import json,sys; print("\n".join(sorted(map(lambda p: p["name"], filter(lambda p: p.get("publish") != [], json.load(sys.stdin)["packages"])))))')
+    n=${#sel[@]}
+    if [ "$n" -eq 0 ] || [ -z "${sel[0]}" ]; then
+        echo "ENV   package: cargo metadata names no publishable member in $root"
+        return 2
+    fi
+    local -a args=()
+    local c
+    for c in "${sel[@]}"; do args+=(-p "$c"); done
+    log=$(mktemp) || return 2
+    (cd -- "$root" && cargo package "${args[@]}" --no-verify --locked) > "$log" 2>&1 || rc=$?
+    got=$(grep -cE '^ +Packaged ' "$log")
+    if [ "$rc" -eq 0 ] && [ "$got" -eq "$n" ]; then
+        echo "ok    package: $got/$n publishable members packaged (cargo package --no-verify --locked)"
+        rm -f -- "$log"; return 0
+    fi
+    echo "FAIL  package: cargo package exited $rc with $got/$n members packaged:"
+    grep -E '^(error|Caused by)' -A 4 "$log" | head -n 20 | sed 's/^/        /'
+    rm -f -- "$log"; return 1
+}
+
+main() {
+    case "${1:-}" in
+        --self-test) self_test; return ;;
+        -h|--help) sed -n '2,30p' "${BASH_SOURCE[0]}"; return 0 ;;
+        '') echo "$PROG: usage: ROOT | --self-test" >&2; return 2 ;;
+    esac
+    local root=$1 g p k verdict
+    [ -f "$root/Cargo.toml" ] || { echo "$PROG: $root has no Cargo.toml" >&2; return 2; }
+    root="$(cd -- "$root" && pwd)"
+    echo "=== $PROG: can $root reach crates.io? ==="
+    PUBLISH_PREFLIGHT_ROOT="$root" bash "$SCRIPTS/check_publish_preflight.sh" --graph-only; g=$?
+    bash "$SCRIPTS/check_pathonly_devdeps_unused_in_src.sh" --rc-gate "$root"; p=$?
+    package_walk "$root"; k=$?
+    verdict=$(rpg_verdict "$g" "$p" "$k")
+    echo "$PROG: graph=$g pathonly=$p package=$k -> $verdict"
+    case "$verdict" in
+        green) return 0 ;;
+        red) return 1 ;;
+        *) return 2 ;;
+    esac
+}
+
+main "$@"
diff --git a/scripts/release/stamp_rc_version.sh b/scripts/release/stamp_rc_version.sh
new file mode 100755
index 0000000000..b9708a4c96
--- /dev/null
+++ b/scripts/release/stamp_rc_version.sh
@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# stamp_rc_version.sh -- an rc asset's crate version IS its tag: 0.69.3-rc.2, never bare 0.69.3
+# (#4110, #4256, #4290)
+#
+#   bash scripts/release/stamp_rc_version.sh TREE TAG    # rewrite TREE's workspace to TAG's version
+#   bash scripts/release/stamp_rc_version.sh --self-test # case table + mutants on a scratch workspace
+#
+# WHY. The rc is tagged on the commit CI gated, whose Cargo.toml says X.Y.Z. Built as is, every
+# v0.69.3-rc.N asset printed `apr 0.69.3 (...)`: rc.1, rc.2 and the final were indistinguishable,
+# and every CARGO_PKG_VERSION-keyed record (the F2 forward receipt, #4290) collided across them.
+# Operator 2026-09-24: "we need actual version numbers" / "version number needs release canidate
+# info in it". binary-release.yml runs this on the checked-out tag tree before `cargo build
+# --locked`, so CARGO_PKG_VERSION itself is X.Y.Z-rc.N.
+#
+# WHAT IS REWRITTEN, and only when the workspace version is exactly TAG's X.Y.Z:
+#   - every workspace member manifest (and the root): `version = "X.Y.Z"` on its own line;
+#   - every dependency line that names a `path =` and a version requirement "X.Y.Z" / "=X.Y.Z" /
+#     "^X.Y.Z" / "~X.Y.Z": a plain "0.69.3" requirement does NOT match 0.69.3-rc.2 (semver: a
+#     pre-release only satisfies a requirement naming that same pre-release), so the pins move too;
+#   - Cargo.lock `[[package]]` entries at X.Y.Z WITHOUT a `source` (workspace crates only; a
+#     registry crate that happens to share the number keeps it).
+# A final tag (vX.Y.Z) is a no-op. A tag whose X.Y.Z is not the workspace version is refused:
+# stamping it would publish a binary claiming a version its source never was.
+# Cargo itself is the oracle: the build that follows runs `--locked`, and the self-test runs
+# `cargo metadata --locked --offline` on the stamped scratch workspace.
+#
+# EXIT 0 stamped (or a final tag: nothing to do) · 1 refused · 2 usage / unreadable tree.
+set -uo pipefail
+PROG=stamp_rc_version
+
+stamp() {  # stamp TREE TAG
+    python3 - "$1" "$2" <<'EOF'
+import os, re, sys
+tree, tag = sys.argv[1], sys.argv[2]
+m = re.fullmatch(r"v(\d+\.\d+\.\d+)(-rc\.(\d+))?", tag)
+if not m:
+    print(f"refuse: tag {tag!r} is not vX.Y.Z or vX.Y.Z-rc.N"); sys.exit(1)
+base, new = m.group(1), tag[1:]
+root = os.path.join(tree, "Cargo.toml")
+try:
+    text = open(root, encoding="utf-8").read()
+except OSError as e:
+    print(f"usage: {e}"); sys.exit(2)
+ws = re.search(r'^\[workspace\.package\]\s*\n(?:(?!\[).*\n)*?version\s*=\s*"([^"]+)"', text, re.M)
+if not ws:
+    print("usage: no [workspace.package] version in the root Cargo.toml"); sys.exit(2)
+have = ws.group(1)
+if have == new:
+    print(f"ok {new}: already stamped"); sys.exit(0)
+if have != base:
+    print(f"refuse: tag {tag} names {base}, the workspace is {have}"); sys.exit(1)
+if not m.group(2):
+    print(f"ok {new}: a final tag, nothing to stamp"); sys.exit(0)
+# members: root + every Cargo.toml under crates/ that is not in a nested workspace we exclude
+mem = re.search(r'^members\s*=\s*\[(.*?)\]', text, re.M | re.S)
+exc = re.search(r'^exclude\s*=\s*\[(.*?)\]', text, re.M | re.S)
+quoted = lambda s: re.findall(r'"([^"]+)"', re.sub(r'#.*', '', s)) if s else []
+import glob
+manifests = [root]
+for pat in quoted(mem.group(1) if mem else ""):
+    for d in sorted(glob.glob(os.path.join(tree, pat))):
+        f = os.path.join(d, "Cargo.toml")
+        if os.path.isfile(f):
+            manifests.append(f)
+excluded = [os.path.normpath(os.path.join(tree, e)) for e in quoted(exc.group(1) if exc else "")]
+manifests = [f for f in manifests if not any(os.path.normpath(f).startswith(e + os.sep) for e in excluded)]
+b = re.escape(base)
+own = re.compile(rf'^(version\s*=\s*"){b}(")', re.M)
+# a pin's number may be partial ("0.69" in aprender-core -> apr-format): any X / X.Y / X.Y.Z that
+# base satisfies is a pin on this workspace, and none of them matches a pre-release
+req = r'([=^~]?)(\d+(?:\.\d+){0,2})'
+dep = re.compile(rf'^(.*\bpath\s*=.*\bversion\s*=\s*"){req}(")', re.M)
+dep2 = re.compile(rf'^(.*\bversion\s*=\s*"){req}(".*\bpath\s*=)', re.M)
+def pin(mo):
+    num = mo.group(3).split(".")
+    if num != base.split(".")[:len(num)]:
+        return mo.group(0)
+    return mo.group(1) + mo.group(2) + new + mo.group(4)
+n_own = n_dep = 0
+for f in manifests:
+    s = open(f, encoding="utf-8").read()
+    s, a = own.subn(rf'\g<1>{new}\g<2>', s)
+    s, c = dep.subn(pin, s)
+    s, d = dep2.subn(pin, s)
+    n_own, n_dep = n_own + a, n_dep + c + d
+    open(f, "w", encoding="utf-8").write(s)
+lock = os.path.join(tree, "Cargo.lock")
+n_lock = 0
+if os.path.isfile(lock):
+    blocks = open(lock, encoding="utf-8").read().split("\n[[package]]\n")
+    for i, blk in enumerate(blocks):
+        if i and "\nsource = " not in blk:
+            blk, k = re.subn(rf'^version = "{b}"$', f'version = "{new}"', blk, flags=re.M)
+            blocks[i], n_lock = blk, n_lock + k
+    open(lock, "w", encoding="utf-8").write("\n[[package]]\n".join(blocks))
+print(f"stamped {base} -> {new}: {len(manifests)} manifests, {n_own} package versions, {n_dep} path pins, {n_lock} lock entries")
+sys.exit(0 if n_own else 1)
+EOF
+}
+
+self_test() {
+    local d fail=0 got rc row want name
+    command -v cargo > /dev/null || { echo "$PROG self-test: needs cargo (it is the oracle)"; return 2; }
+    d=$(mktemp -d) || return 2
+    # a scratch workspace shaped like the real one: [workspace.package] version, a member that
+    # inherits it, one that declares its own, a path dep with a caret pin and one with =, an
+    # excluded nested crate, and a lock entry for a REGISTRY crate at the same number
+    mkws() {
+        local w=$1; rm -rf -- "${w:?}"; mkdir -p "$w/crates/a/src" "$w/crates/b/src" "$w/crates/c/src" "$w/crates/d/src" "$w/crates/x/src"
+        printf '[workspace]\nmembers = ["crates/*"]\nexclude = [\n    "crates/x", # nested\n]\nresolver = "2"\n\n[workspace.package]\nversion = "0.69.3"\nedition = "2021"\n\n[workspace.dependencies]\nb = { path = "crates/b", version = "0.69.3" }\n' > "$w/Cargo.toml"
+        printf '[package]\nname = "a"\nversion.workspace = true\nedition = "2021"\n\n[dependencies]\nb = { workspace = true }\nd = { path = "../d", version = "0.69" }\nc = { version = "=0.69.3", path = "../c" }\n' > "$w/crates/a/Cargo.toml"
+        printf '[package]\nname = "b"\nversion = "0.69.3"\nedition = "2021"\n' > "$w/crates/b/Cargo.toml"
+        printf '[package]\nname = "c"\nversion = "0.69.3"\nedition = "2021"\n' > "$w/crates/c/Cargo.toml"; : > "$w/crates/c/src/lib.rs"
+        printf '[package]\nname = "d"\nversion = "0.69.3"\nedition = "2021"\n' > "$w/crates/d/Cargo.toml"; : > "$w/crates/d/src/lib.rs"
+        printf '[package]\nname = "x"\nversion = "0.69.3"\nedition = "2021"\n[workspace]\n' > "$w/crates/x/Cargo.toml"
+        : > "$w/crates/a/src/lib.rs"; : > "$w/crates/b/src/lib.rs"; : > "$w/crates/x/src/lib.rs"
+        (cd "$w" && cargo generate-lockfile --offline -q 2> /dev/null) || return 1
+    }
+    # versions WT -> "a=<v> b=<v>" from cargo, resolving --locked; "LOCKED-FAIL" when cargo refuses
+    versions() {
+        (cd "$1" && cargo metadata --locked --offline --format-version 1 2> /dev/null) \
+        | python3 -c 'import json,sys; print(" ".join(sorted(p["name"]+"="+p["version"] for p in json.load(sys.stdin)["packages"])))' 2> /dev/null \
+        || echo LOCKED-FAIL
+    }
+    expect() {  # expect ROW WANT GOT
+        if [ "$3" = "$2" ]; then echo "  ok   $1"; else printf '  FAIL %s\n       want: %s\n       got:  %s\n' "$1" "$2" "$3"; fail=1; fi
+    }
+    echo "$PROG self-test: case table (cargo metadata --locked is the oracle)"
+    mkws "$d/w" || { echo "  FAIL cannot build the scratch workspace"; rm -rf -- "${d:?}"; return 2; }
+    stamp "$d/w" v0.69.3-rc.2 > "$d/out"; rc=$?
+    expect "rc tag stamps and exits 0" 0 "$rc"
+    expect "cargo resolves the stamped workspace --locked, every member at the rc" "a=0.69.3-rc.2 b=0.69.3-rc.2 c=0.69.3-rc.2 d=0.69.3-rc.2" "$(versions "$d/w")"
+    expect "the excluded nested crate keeps its version" 'version = "0.69.3"' "$(grep '^version' "$d/w/crates/x/Cargo.toml")"
+    mkws "$d/w"; printf '\n[[package]]\nname = "zzz-registry"\nversion = "0.69.3"\nsource = "registry+https://github.com/rust-lang/crates.io-index"\n' >> "$d/w/Cargo.lock"
+    stamp "$d/w" v0.69.3-rc.2 > /dev/null
+    expect "a registry lock entry at the same number is untouched" 'version = "0.69.3"' "$(grep -A1 'name = "zzz-registry"' "$d/w/Cargo.lock" | tail -1)"
+    mkws "$d/w"; stamp "$d/w" v0.69.3-rc.2 > /dev/null
+    stamp "$d/w" v0.69.3-rc.2 > /dev/null; expect "re-stamping the same rc is idempotent" 0 "$?"
+    mkws "$d/w"; stamp "$d/w" v0.69.3 > /dev/null; rc=$?
+    expect "a final tag is a no-op (exit 0, workspace unchanged)" "0 a=0.69.3 b=0.69.3 c=0.69.3 d=0.69.3" "$rc $(versions "$d/w")"
+    for row in "1 v0.69.4-rc.1 a tag for another version is refused" "1 v0.69.3-beta.1 a non-rc prerelease is refused" "1 0.69.3-rc.1 a tag without v is refused"; do
+        mkws "$d/w"; want=${row%% *}; row=${row#* }; name=${row%% *}
+        stamp "$d/w" "$name" > /dev/null; expect "${row#* }" "$want" "$?"
+    done
+    # MUTANTS, built from THIS file: each drops one rewrite, and cargo must refuse the result.
+    # Without them the table could pass on a stamper that only renamed the packages.
+    for row in "lock|blocks[i], n_lock = blk, n_lock + k|n_lock = n_lock + k" \
+               "path-first pins|s, c = dep.subn|c = 0; _ = dep.subn" \
+               "version-first pins|s, d = dep2.subn|d = 0; _ = dep2.subn" \
+               "partial (X.Y) pins|(?:\\.\\d+){0,2}|(?:\\.\\d+){2}"; do
+        IFS='|' read -r name a1 b1 <<< "$row"
+        A1=$a1 B1=$b1 python3 -c 'import os,sys; s=open(sys.argv[1]).read(); a=os.environ["A1"]; assert s.count(a)>=1 and s.index(a)<s.index("self_test()"); open(sys.argv[2],"w").write(s.replace(a,os.environ["B1"],1))' \
+            "${BASH_SOURCE[0]}" "$d/mut.sh" 2> /dev/null || { echo "  FAIL mutant $name: anchor moved, re-anchor it"; fail=1; continue; }
+        mkws "$d/w"; bash "$d/mut.sh" "$d/w" v0.69.3-rc.2 > /dev/null
+        got=$(versions "$d/w")
+        case "$got" in *LOCKED-FAIL*) echo "  ok   mutant ($name rewrite dropped): cargo refuses the tree";;
+                       *) echo "  FAIL mutant ($name rewrite dropped) survived: $got"; fail=1;; esac
+    done
+    rm -rf -- "${d:?}"
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+case "${1:-}" in
+    --self-test) self_test ;;
+    -h|--help) sed -n '2,28p' "${BASH_SOURCE[0]}" ;;
+    *) if [ "$#" -ne 2 ] || [ ! -d "$1" ]; then echo "$PROG: usage: TREE TAG | --self-test" >&2; exit 2; fi
+       stamp "$1" "$2" ;;
+esac
diff --git a/scripts/release_criteria.sh b/scripts/release_criteria.sh
index cbba976915..82bec36e91 100755
--- a/scripts/release_criteria.sh
+++ b/scripts/release_criteria.sh
@@ -23,7 +23,7 @@ cmd_of() {
         C8)  echo 'bash scripts/run_clean_room.sh   # clean-room p1 via ../infra (hard gate)' ;;
         C9)  echo 'bash scripts/check_receipt_complete.sh --dag docs/specifications/pp-066-dag.yaml   # every 0.66 row credited has a receipt whose marker says complete' ;;
         C11) echo 'bash scripts/check_backend_registry.sh --static   # 15 fixtures (FX-1..15) each observed RED once; zero cfg!(feature) reads in apr-cli backend decisions' ;;
-        C13) echo 'bash scripts/check_release_assets.sh "v$(sed -n '"'"'s/^version = "\(.*\)"/\1/p'"'"' Cargo.toml | head -1)"   # the four apr tarballs (cuda,cpu x x86_64,aarch64) + .sha256 + the eight pv assets; the tag is READ from the root manifest, never typed (no cargo: the release box has none). Seam: RELEASE_ASSETS_FIXTURE' ;;
+        C13) echo 'bash scripts/check_release_assets.sh "v$(sed -n '"'"'s/^version = "\(.*\)"/\1/p'"'"' Cargo.toml | head -1)"   # the six apr tarballs (cuda,cpu x x86_64,aarch64 + darwin cpu + x86_64 wgpu) + .sha256 + the ten pv assets (incl. darwin); the tag is READ from the root manifest, never typed (no cargo: the release box has none). Seam: RELEASE_ASSETS_FIXTURE' ;;
         C14) echo 'bash scripts/check_model_parity.sh --manifest   # GPU=CPU per manifest model over >= 64 positions, or the GPU refuses it (L0-1a)' ;;
         C1|C2|C3|C5|C10|C12) echo '0.67 (SPEC-2.0: moved with its track; never credited in 0.66)' ;;
         *) return 1 ;;
diff --git a/scripts/tests/check_release_assets_test.sh b/scripts/tests/check_release_assets_test.sh
index c2d66cdc5c..9020f18b0d 100755
--- a/scripts/tests/check_release_assets_test.sh
+++ b/scripts/tests/check_release_assets_test.sh
@@ -68,12 +68,19 @@ trap 'rm -rf "$WORK"' EXIT
       printf 'pv-%s-%s-unknown-linux-%s.tar.gz.sha256\n' "$TAG" "$t_arch" "$libc"
     done
   done
+  # #4327 mini (darwin apr), #4353 darwin pv + the intel wgpu apr
+  for a in apr-$TAG-aarch64-apple-darwin-cpu apr-$TAG-x86_64-unknown-linux-gnu-wgpu pv-$TAG-aarch64-apple-darwin; do
+    printf '%s.tar.gz\n%s.tar.gz.sha256\n' "$a" "$a"
+  done
 } > "$WORK/complete.txt"
 
 MUTANT_NAME="apr-$TAG-aarch64-unknown-linux-gnu-cpu.tar.gz"
 grep -vx "$MUTANT_NAME" "$WORK/complete.txt" > "$WORK/mutant.txt"
 grep -vx "apr-$TAG-x86_64-unknown-linux-gnu-cuda.tar.gz.sha256" "$WORK/complete.txt" > "$WORK/nosha.txt"
 grep -v '^pv-' "$WORK/complete.txt" > "$WORK/nopv.txt"
+grep -vx "apr-$TAG-aarch64-apple-darwin-cpu.tar.gz" "$WORK/complete.txt" > "$WORK/nodarwin.txt"
+grep -vx "pv-$TAG-aarch64-apple-darwin.tar.gz.sha256" "$WORK/complete.txt" > "$WORK/nopvdarwin.txt"
+grep -vx "apr-$TAG-x86_64-unknown-linux-gnu-wgpu.tar.gz" "$WORK/complete.txt" > "$WORK/nowgpu.txt"
 
 # 1. the guard's own table, and it is not vacuous
 t 0 "$GUARD --selftest is green" bash "$GUARD" --selftest
@@ -86,7 +93,10 @@ t 1 "MUTATION: aarch64 cpu tarball removed -> 1" bash "$GUARD" "$TAG" --assets-f
 t 0 "the mutation is NAMED, not merely counted" \
   bash -c "bash '$GUARD' '$TAG' --assets-from '$WORK/mutant.txt' 2>&1 | grep -q '$MUTANT_NAME'"
 t 1 "a missing .sha256 is as fatal as a missing tarball" bash "$GUARD" "$TAG" --assets-from "$WORK/nosha.txt"
-t 1 "the eight pv assets are required too" bash "$GUARD" "$TAG" --assets-from "$WORK/nopv.txt"
+t 1 "the pv assets are required too" bash "$GUARD" "$TAG" --assets-from "$WORK/nopv.txt"
+t 1 "MUTATION: darwin apr removed -> 1 (mini, #4327)" bash "$GUARD" "$TAG" --assets-from "$WORK/nodarwin.txt"
+t 1 "MUTATION: darwin pv .sha256 removed -> 1 (mini, #4353)" bash "$GUARD" "$TAG" --assets-from "$WORK/nopvdarwin.txt"
+t 1 "MUTATION: x86_64 wgpu apr removed -> 1 (intel, #4353)" bash "$GUARD" "$TAG" --assets-from "$WORK/nowgpu.txt"
 
 # 3. unreadable is ENV (2), never a pass
 t 2 "an unreadable asset list is ENV (2), never 0" bash "$GUARD" "$TAG" --assets-from "$WORK/does-not-exist.txt"
@@ -95,9 +105,12 @@ t 2 "no tag is a usage error (2), never a pass" bash "$GUARD"
 # 4. the wiring: the workflow shares this checker
 t 0 "binary-release.yml calls the shared checker" \
   bash -c "grep -q 'check_release_assets.sh' '$WF'"
-t 0 "the verify job requires all four apr assets (it is no longer cuda-only)" \
+t 0 "the verify job exists (it requires all six apr assets; it is no longer cuda-only)" \
   bash -c "grep -q 'verify-apr-assets:' '$WF'"
 t 0 "a build-apr-cpu lane exists" bash -c "grep -q 'build-apr-cpu:' '$WF'"
+t 0 "a build-pv-darwin lane exists (#4353)" bash -c "grep -q '^  build-pv-darwin:' '$WF'"
+t 0 "build-apr-cpu carries a wgpu flavour built with --features wgpu (#4353)" \
+  bash -c "grep -q 'flavour: wgpu' '$WF' && grep -q 'features: .--features wgpu.' '$WF'"
 t 0 "a smoke-cpu lane exists" bash -c "grep -q 'smoke-cpu:' '$WF'"
 
 printf '%s/%s rows\n' "$((n - red))" "$n"