diff --git a/.github/workflows/binary-release.yml b/.github/workflows/binary-release.yml
index 7bfcbc9e91..bcfefcb3b2 100644
--- a/.github/workflows/binary-release.yml
+++ b/.github/workflows/binary-release.yml
@@ -10,9 +10,10 @@ name: Binary Release
 # The aprender workspace ships dozens of crates; the `pv` lane scopes
 # itself to `aprender-contracts-cli`. The `apr-cuda` and `apr-cpu` lanes
 # below ship FOUR `apr` binaries per tag — {cuda, cpu} x {x86_64, aarch64} —
+# plus apr (cpu) for aarch64-apple-darwin and apr (wgpu) for x86_64 (#4353), six —
 # an operator HARD REQUIREMENT for every tag and every release (2026-09-10,
 # PMAT-1096/PMAT-1098, row 67-A1 of docs/specifications/06x-release-schedule.md,
-# Alfredo's #2869): a release without all four is not done, and
+# Alfredo's #2869): a release without all six is not done, and
 # `verify-apr-assets` FAILS the workflow when any is missing. v0.66.0 shipped
 # ZERO apr binaries and nothing was red — the verify job asked about two
 # assets, and only after a build lane that had already died. The question is
@@ -59,6 +60,14 @@ name: Binary Release
 # scratch / Alpine; gnu variants are smaller, match typical Linux
 # distributions, and import nothing above GLIBC_2.31. No GitHub-hosted
 # runner and no `cross` (#3073: the operator rule of 2026-09-10).
+#
+# WHO STARTS THIS. A pushed tag emits no event here, and creating a draft emits `created`, not
+# `published`. So an rc (operator ruling 2026-09-25 16:58: a tag on a queue-green main) runs this
+# only because the rc tagger does two things in order: `gh release create <tag> --draft`, then
+# `gh workflow run binary-release.yml -f tag=<tag>`. Every release lookup below lists releases
+# (drafts included) and fails by name when that first step was skipped. The draft goes public
+# only through scripts/release/rc_fleet_stage.sh --publish (#4327). A final promoted with
+# promote_rc.sh is `published`, and it arrives with its assets already in place (#4286).
 
 on:
   release:
@@ -79,6 +88,34 @@ concurrency:
 
 
 jobs:
+  # A release that already carries every asset is NOT rebuilt (#4286). A promoted final
+  # is its rc's exact bytes (scripts/release/promote_rc.sh); publishing it with a
+  # personal token fires `release: published` here, and the upload steps below delete
+  # and replace same-named assets, so an ungated rebuild would silently swap the bytes
+  # that were dogfooded for new ones. With all twenty-two present the build jobs skip and
+  # verify + smoke still run, on the promoted bytes. A partial release (a lane died)
+  # still rebuilds. An unreadable release (exit 2) fails this job, so the builds skip:
+  # when in doubt, never overwrite.
+  assets:
+    name: Does the release already carry every asset?
+    runs-on: [self-hosted, Linux, X64, clean-room]
+    timeout-minutes: 5
+    outputs:
+      present: ${{ steps.check.outputs.present }}
+    steps:
+      - uses: actions/checkout@v7
+      - id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          bash scripts/check_release_assets.sh "$TAG"; rc=$?
+          case "$rc" in
+            0) echo "present=true" >> "$GITHUB_OUTPUT"; echo "$TAG already carries every asset: nothing is rebuilt" >> "$GITHUB_STEP_SUMMARY" ;;
+            1) echo "present=false" >> "$GITHUB_OUTPUT" ;;
+            *) echo "::error::could not read release $TAG (rc=$rc); refusing to build over assets that may exist"; exit 1 ;;
+          esac
+
   # The pv lane on the fleet (#3073; operator rule 2026-09-10: no GitHub-hosted runners). It ran on
   # ubuntu-latest, with cross for aarch64. Each target now builds natively on the box of its architecture
   # (x86_64 on yoga, aarch64 on gx10) in a sibling container, the pattern of build-apr-cpu: gnu targets
@@ -86,6 +123,8 @@ jobs:
   # well, so no floor rises), musl targets inside rust:1.93.0-bookworm (static). Asset names unchanged.
   build:
     name: pv ${{ matrix.target }} on ${{ matrix.host }}
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
     runs-on: ${{ fromJSON(matrix.labels) }}
     strategy:
       fail-fast: false
@@ -124,6 +163,20 @@ jobs:
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
+      # #4110/#4290: an rc asset's crate version IS its tag. The rc commit's Cargo.toml says
+      # X.Y.Z, so without this every vX.Y.Z-rc.N asset printed bare `X.Y.Z` (v0.69.3-rc.2:
+      # `apr 0.69.3 (v0.69.3+no-git)`). The stamper comes from THIS workflow's commit, not the
+      # tag's tree, which may predate it. A final tag stamps nothing.
+      # verify-apr-assets then requires `apr --version` to equal the tag exactly.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
       - name: Preflight - this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh --need docker objdump
 
@@ -220,7 +273,10 @@ jobs:
         run: |
           TAG="${{ steps.tag.outputs.tag }}"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
           rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
             # --clobber semantics: delete an asset of the same name first
@@ -233,6 +289,8 @@ jobs:
 
   build-apr-cuda:
     name: apr (cuda) ${{ matrix.target }} on ${{ matrix.host }}
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
     runs-on: ${{ fromJSON(matrix.labels) }}
     strategy:
       fail-fast: false
@@ -261,6 +319,20 @@ jobs:
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
+      # #4110/#4290: an rc asset's crate version IS its tag. The rc commit's Cargo.toml says
+      # X.Y.Z, so without this every vX.Y.Z-rc.N asset printed bare `X.Y.Z` (v0.69.3-rc.2:
+      # `apr 0.69.3 (v0.69.3+no-git)`). The stamper comes from THIS workflow's commit, not the
+      # tag's tree, which may predate it. A final tag stamps nothing.
+      # verify-apr-assets then requires `apr --version` to equal the tag exactly.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
       # FIRST thing this box does after it has a working tree. Run 34448908554
       # built a 21 MB CUDA asset here and then died on `gh: command not found`
       # at the upload — forty minutes of GPU spent on a shell error a one-second
@@ -296,6 +368,7 @@ jobs:
             -w /workspace \
             -e CARGO_TARGET_DIR=/workspace/target \
             -e CARGO_INCREMENTAL=0 \
+            -e APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
             rust:1.93.0-bullseye \
             sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --features cuda --locked; strip target/${{ matrix.target }}/release/apr'
           # the mounted target dir is the host cache; expose the binary where the next steps expect it
@@ -348,7 +421,10 @@ jobs:
         run: |
           TAG="${{ steps.tag.outputs.tag }}"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
           rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
             # --clobber semantics: delete an asset of the same name first
@@ -378,7 +454,9 @@ jobs:
   # `rust:1.93.0-bullseye` for a glibc 2.31 floor; this lane is written to be the
   # same step, so the merge moves both or neither.
   build-apr-cpu:
-    name: apr (cpu) ${{ matrix.target }} on ${{ matrix.host }}
+    name: apr (${{ matrix.flavour }}) ${{ matrix.target }} on ${{ matrix.host }}
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
     runs-on: ${{ fromJSON(matrix.labels) }}
     strategy:
       fail-fast: false
@@ -386,10 +464,22 @@ jobs:
         include:
           - target: x86_64-unknown-linux-gnu
             host: yoga
+            flavour: cpu
+            features: ''
             labels: '["self-hosted", "Linux", "X64", "cuda", "yoga"]'
           - target: aarch64-unknown-linux-gnu
             host: gx10
+            flavour: cpu
+            features: ''
             labels: '["self-hosted", "Linux", "ARM64", "cuda", "gx10"]'
+          # #4353 (operator 2026-09-25: "wgpu enabled binary for intel"): intel has no
+          # NVIDIA device, so neither -cpu (refuses --gpu) nor -cuda serves it. Same
+          # container, same glibc floor; `--features wgpu` is what flips the refusal off.
+          - target: x86_64-unknown-linux-gnu
+            host: yoga
+            flavour: wgpu
+            features: '--features wgpu'
+            labels: '["self-hosted", "Linux", "X64", "cuda", "yoga"]'
     steps:
       - name: Resolve release tag
         id: tag
@@ -400,13 +490,27 @@ jobs:
             exit 1
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "Building apr (default features, no cuda) for $TAG -> ${{ matrix.target }}"
+          echo "Building apr (${{ matrix.flavour }}, no cuda) for $TAG -> ${{ matrix.target }}"
 
       - name: Checkout at tag
         uses: actions/checkout@v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
+      # #4110/#4290: an rc asset's crate version IS its tag. The rc commit's Cargo.toml says
+      # X.Y.Z, so without this every vX.Y.Z-rc.N asset printed bare `X.Y.Z` (v0.69.3-rc.2:
+      # `apr 0.69.3 (v0.69.3+no-git)`). The stamper comes from THIS workflow's commit, not the
+      # tag's tree, which may predate it. A final tag stamps nothing.
+      # verify-apr-assets then requires `apr --version` to equal the tag exactly.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
       # 67-C2: the first thing this box does after it has a working tree. No
       # `--cuda` here — a CPU asset must build on a box with no visible device,
       # and asserting one would make this lane lie about what it needs. `docker`
@@ -425,7 +529,7 @@ jobs:
           # machines/<box>/forjar-ephemeral.yaml): the bullseye build is a SIBLING container
           # through the mounted socket, so every bind-mount path must exist on the HOST at
           # the same path. The work root is mirrored host<->container; $HOME is not.
-          CACHE="$(cd "$GITHUB_WORKSPACE/../.." && pwd)/cache-apr-cpu/${{ matrix.target }}"
+          CACHE="$(cd "$GITHUB_WORKSPACE/../.." && pwd)/cache-apr-${{ matrix.flavour }}/${{ matrix.target }}"
           mkdir -p "$CACHE/registry" "$CACHE/target"
           # The bind-mount TARGET inside the workspace must exist BEFORE the container
           # starts: when it does not, dockerd creates the mountpoint as root, and after
@@ -441,15 +545,16 @@ jobs:
             -w /workspace \
             -e CARGO_TARGET_DIR=/workspace/target \
             -e CARGO_INCREMENTAL=0 \
+            -e APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
             rust:1.93.0-bullseye \
-            sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --locked; strip target/${{ matrix.target }}/release/apr'
+            sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --locked ${{ matrix.features }}; strip target/${{ matrix.target }}/release/apr'
           # the mounted target dir is the host cache; expose the binary where the next steps expect it
           mkdir -p "target/${{ matrix.target }}/release"
           cp "$CACHE/target/${{ matrix.target }}/release/apr" "target/${{ matrix.target }}/release/apr"
           GLIBC=$(cat "$CACHE/target/BUILDER_GLIBC"); RUSTC=$(cat "$CACHE/target/BUILDER_RUSTC")
           echo "builder glibc: $GLIBC"; echo "builder rustc: $RUSTC"
           {
-            echo "### apr (cpu) ${{ matrix.target }} built on ${{ matrix.host }} inside rust:1.93.0-bullseye"
+            echo "### apr (${{ matrix.flavour }}) ${{ matrix.target }} built on ${{ matrix.host }} inside rust:1.93.0-bullseye"
             echo "- toolchain: $RUSTC"
             echo "- glibc floor of this asset (the container's): $GLIBC"
           } >> "$GITHUB_STEP_SUMMARY"
@@ -470,6 +575,25 @@ jobs:
           fi
           "$BIN" --version
 
+      # #4353: the flavour is read from BEHAVIOUR, not bytes. Every inference build links
+      # trueno's wgpu backend (aprender-serve enables trueno/gpu unconditionally), so a
+      # `wgpu` byte count cannot tell the two apart (measured 2026-09-25: 125-127 hits in
+      # cpu and gpu builds alike). What `--features wgpu` changes is accel.rs: a -cpu build
+      # REFUSES `apr run --gpu` (exit 9, "no GPU backend compiled in") before it touches the
+      # model; a GPU build goes on and fails on the missing file instead (exit 3). Both
+      # polarities are asserted, so each lane is the other's positive control.
+      - name: Prove the flavour (--gpu refusal present iff -cpu)
+        run: |
+          BIN="target/${{ matrix.target }}/release/apr"
+          out=$("$BIN" run /nonexistent/apr-flavour-probe.gguf --gpu --prompt x 2>&1) && rc=0 || rc=$?
+          n=$(printf '%s\n' "$out" | grep -c 'no GPU backend compiled in' || true)
+          echo "flavour=${{ matrix.flavour }} rc=$rc refusal_lines=$n"
+          case "${{ matrix.flavour }}" in
+            cpu)  if [ "$rc" -eq 0 ] || [ "$n" -lt 1 ]; then echo "::error::-cpu asset did not refuse --gpu (rc=$rc): not a cpu build"; exit 1; fi ;;
+            wgpu) if [ "$rc" -eq 0 ] || [ "$n" -ne 0 ]; then echo "::error::-wgpu asset refused --gpu (rc=$rc): the wgpu feature is not in the build"; exit 1; fi ;;
+            *)    echo "::error::unknown flavour ${{ matrix.flavour }}"; exit 1 ;;
+          esac
+
       # The asset's floor is what its BYTES require, not what the builder happens
       # to run: objdump -T names every versioned glibc symbol it imports. Recorded
       # on both lanes so the CPU tarball's portability is a measured number in the
@@ -495,7 +619,7 @@ jobs:
         run: |
           VERSION="${{ steps.tag.outputs.tag }}"
           TARGET="${{ matrix.target }}"
-          ARCHIVE="apr-${VERSION}-${TARGET}-cpu"
+          ARCHIVE="apr-${VERSION}-${TARGET}-${{ matrix.flavour }}"
           mkdir -p "$ARCHIVE"
           cp "target/${TARGET}/release/apr" "$ARCHIVE/"
           for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do
@@ -515,7 +639,10 @@ jobs:
         run: |
           TAG="${{ steps.tag.outputs.tag }}"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
           rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
           for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
             # --clobber semantics: delete an asset of the same name first
@@ -526,8 +653,155 @@ jobs:
               | python3 -c 'import json,sys; a=json.load(sys.stdin); print("uploaded", a["name"], a["size"], "bytes")'
           done
 
-  # The hard requirement, as a check that can fail: all FOUR apr assets (tarball +
-  # sha256) and the eight pv assets must be on the release. A missing one is a red
+  # mini (Darwin arm64) is fleet hardware and could not take v0.69.3-rc.2: the release shipped
+  # no darwin asset, so mini was RED on every rc (#4327, infra-64 evidence/fleet-versions.md).
+  # Native build on the self-hosted mini-m4 runner (no hosted runners, #3073). No container:
+  # macOS has no glibc floor to pin, and the stamped version + the sha are checked below
+  # before anything is uploaded.
+  build-apr-darwin:
+    name: apr (cpu) aarch64-apple-darwin on mini
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
+    runs-on: [self-hosted, macOS, ARM64, apple-silicon, m4, mini]
+    steps:
+      - name: Resolve release tag
+        id: tag
+        run: |
+          TAG="${{ github.event.release.tag_name || inputs.tag }}"
+          [ -n "$TAG" ] || { echo "::error::No tag resolved"; exit 1; }
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout at tag
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.tag.outputs.tag }}
+
+      # The release scripts come from THIS workflow's commit: the tag tree predates them.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          for f in stamp_rc_version.sh asset_version_check.sh; do
+            git show "FETCH_HEAD:scripts/release/$f" > "$RUNNER_TEMP/$f"
+          done
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
+      - name: Build apr on the default features (no cuda)
+        run: |
+          APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
+            cargo build --release -p apr-cli --bin apr --target aarch64-apple-darwin --locked
+          strip target/aarch64-apple-darwin/release/apr
+
+      - name: The binary names its tag and commit (#4110)
+        run: |
+          line=$(target/aarch64-apple-darwin/release/apr --version)
+          bash "$RUNNER_TEMP/asset_version_check.sh" "${{ steps.tag.outputs.tag }}" "$(git rev-parse HEAD)" "$line"
+
+      - name: Package archive
+        id: package
+        run: |
+          ARCHIVE="apr-${{ steps.tag.outputs.tag }}-aarch64-apple-darwin-cpu"
+          mkdir -p "$ARCHIVE"
+          cp target/aarch64-apple-darwin/release/apr "$ARCHIVE/"
+          for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do [ -f "$f" ] && cp "$f" "$ARCHIVE/"; done
+          tar czf "${ARCHIVE}.tar.gz" "$ARCHIVE"
+          shasum -a 256 "${ARCHIVE}.tar.gz" > "${ARCHIVE}.tar.gz.sha256"
+          echo "archive=${ARCHIVE}.tar.gz" >> "$GITHUB_OUTPUT"
+          echo "sha=${ARCHIVE}.tar.gz.sha256" >> "$GITHUB_OUTPUT"
+
+      - name: Upload assets to release (REST, no gh)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327)
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
+          rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), ""))' "$f")
+            [ -n "$aid" ] && curl -sSf -X DELETE -H "Authorization: Bearer $GH_TOKEN" "$API/releases/assets/$aid" > /dev/null
+            curl -sSf -X POST -H "Authorization: Bearer $GH_TOKEN" -H "Content-Type: application/octet-stream" \
+              --data-binary @"$f" "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/$rid/assets?name=$f" \
+              | python3 -c 'import json,sys; a=json.load(sys.stdin); print("uploaded", a["name"], a["size"], "bytes")'
+          done
+
+  # #4353 (operator 2026-09-25: "mac is critical"): mini ran pv 0.69.1 because no release
+  # carried a darwin pv. Same native build as build-apr-darwin above; the asset name follows
+  # the pv lane's `pv-<tag>-<target>` convention (no flavour suffix).
+  build-pv-darwin:
+    name: pv aarch64-apple-darwin on mini
+    needs: assets
+    if: needs.assets.outputs.present == 'false'
+    runs-on: [self-hosted, macOS, ARM64, apple-silicon, m4, mini]
+    steps:
+      - name: Resolve release tag
+        id: tag
+        run: |
+          TAG="${{ github.event.release.tag_name || inputs.tag }}"
+          [ -n "$TAG" ] || { echo "::error::No tag resolved"; exit 1; }
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout at tag
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ steps.tag.outputs.tag }}
+
+      # The release scripts come from THIS workflow's commit: the tag tree predates them.
+      - name: Stamp the rc version into the tag tree (#4110)
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          git fetch --no-tags --depth 1 origin "$GITHUB_WORKFLOW_SHA"
+          git show "FETCH_HEAD:scripts/release/stamp_rc_version.sh" > "$RUNNER_TEMP/stamp_rc_version.sh"
+          case "$TAG" in *-rc.*) ;; *) echo "final tag $TAG: nothing to stamp"; exit 0 ;; esac
+          bash "$RUNNER_TEMP/stamp_rc_version.sh" "$GITHUB_WORKSPACE" "$TAG"
+
+      - name: Build pv
+        run: |
+          APR_GIT_SHA_OVERRIDE="$(git rev-parse --short=9 HEAD)" \
+            cargo build --release -p aprender-contracts-cli --bin pv --target aarch64-apple-darwin --locked
+          strip target/aarch64-apple-darwin/release/pv
+
+      # As the linux pv lane: the asset must run on the box that built it.
+      - name: The asset runs
+        run: target/aarch64-apple-darwin/release/pv --version
+
+      - name: Package archive
+        id: package
+        run: |
+          ARCHIVE="pv-${{ steps.tag.outputs.tag }}-aarch64-apple-darwin"
+          mkdir -p "$ARCHIVE"
+          cp target/aarch64-apple-darwin/release/pv "$ARCHIVE/"
+          for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE; do [ -f "$f" ] && cp "$f" "$ARCHIVE/"; done
+          tar czf "${ARCHIVE}.tar.gz" "$ARCHIVE"
+          shasum -a 256 "${ARCHIVE}.tar.gz" > "${ARCHIVE}.tar.gz.sha256"
+          echo "archive=${ARCHIVE}.tar.gz" >> "$GITHUB_OUTPUT"
+          echo "sha=${ARCHIVE}.tar.gz.sha256" >> "$GITHUB_OUTPUT"
+
+      - name: Upload assets to release (REST, no gh)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327)
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
+          rid=$(printf '%s' "$rel" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
+          for f in "${{ steps.package.outputs.archive }}" "${{ steps.package.outputs.sha }}"; do
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), ""))' "$f")
+            [ -n "$aid" ] && curl -sSf -X DELETE -H "Authorization: Bearer $GH_TOKEN" "$API/releases/assets/$aid" > /dev/null
+            curl -sSf -X POST -H "Authorization: Bearer $GH_TOKEN" -H "Content-Type: application/octet-stream" \
+              --data-binary @"$f" "https://uploads.github.com/repos/${GITHUB_REPOSITORY}/releases/$rid/assets?name=$f" \
+              | python3 -c 'import json,sys; a=json.load(sys.stdin); print("uploaded", a["name"], a["size"], "bytes")'
+          done
+
+  # The hard requirement, as a check that can fail: all SIX apr assets (tarball +
+  # sha256) and the ten pv assets must be on the release. A missing one is a red
   # workflow, never a partial summary.
   #
   # THE LOOP THAT USED TO LIVE HERE IS NOW A SCRIPT. Inline, it could only ever run
@@ -537,8 +811,8 @@ jobs:
   # checker all four callers share, and its own case table carries the removed-asset
   # mutation (RED) that this job cannot demonstrate on a real release.
   verify-apr-assets:
-    name: All four apr assets are on the release
-    needs: [build, build-apr-cuda, build-apr-cpu]
+    name: All six apr assets are on the release
+    needs: [build, build-apr-cuda, build-apr-cpu, build-apr-darwin, build-pv-darwin]
     runs-on: [self-hosted, Linux, X64, clean-room]
     if: always()
     steps:
@@ -550,7 +824,7 @@ jobs:
       - name: Preflight - this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh
 
-      - name: Require the four apr assets (+ sha256) and the eight pv assets
+      - name: Require the six apr assets (+ sha256) and the ten pv assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -571,6 +845,8 @@ jobs:
   smoke-cuda:
     name: smoke apr (cuda) on ${{ matrix.host }}
     needs: verify-apr-assets
+    # verify runs under always(); a skipped build two levels up must not skip this
+    if: ${{ !cancelled() && needs.verify-apr-assets.result == 'success' }}
     strategy:
       fail-fast: false
       matrix:
@@ -605,16 +881,25 @@ jobs:
           T="${{ matrix.target }}"
           D="$RUNNER_TEMP/apr-cuda-smoke"; rm -rf "$D"; mkdir -p "$D"; cd "$D"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
           for f in "apr-${TAG}-${T}-cuda.tar.gz" "apr-${TAG}-${T}-cuda.tar.gz.sha256"; do
-            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next(a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n))' "$f")
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; a=next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), None); a or sys.exit(f"release has no asset {n}"); print(a)' "$f")
             curl -sSfL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/octet-stream" -o "$f" "$API/releases/assets/$aid"
           done
           sha256sum -c "apr-${TAG}-${T}-cuda.tar.gz.sha256"
           tar xzf "apr-${TAG}-${T}-cuda.tar.gz"
-          BIN="$D/apr-${TAG}-${T}-cuda/apr"
-          v=$("$BIN" --version); echo "$v"
-          case "$v" in *"${TAG#v}"*) ;; *) echo "::error::asset reports '$v', not ${TAG#v}"; exit 1 ;; esac
+          # A promoted final (#4286) is its rc's exact bytes, so the archive's top directory
+          # may carry the rc label (apr-vX.Y.Z-rc.N-...). Take the one apr directory it holds.
+          set -- "$D"/apr-v*-"${T}"-cuda/apr
+          if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then echo "::error::expected exactly one apr binary in the archive, found: $*"; exit 1; fi
+          BIN=$1
+          v=$("$BIN" --version | head -1); echo "$v"
+          # #4275: X.Y.Z whole (an rc tag's -rc.N stripped) AND the asset's sha is the tag's commit
+          COMMIT=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/commits/$TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])')
+          bash "$GITHUB_WORKSPACE/scripts/release/asset_version_check.sh" "$TAG" "$COMMIT" "$v" || { echo "::error::asset reports '$v', which does not belong to $TAG ($COMMIT)"; exit 1; }
           [ "$(grep -ac 'libcuda.so' "$BIN")" -ge 1 ] || { echo "::error::downloaded asset is not a CUDA build"; exit 1; }
           floor=$(objdump -T "$BIN" 2>/dev/null | grep -oE 'GLIBC_[0-9.]+' | sort -Vu | tail -1)
           echo "highest GLIBC symbol version required: $floor"
@@ -631,8 +916,10 @@ jobs:
   # defect the inverted loader-string check exists to catch), and on both GPU
   # hosts for their own architecture (an aarch64 asset is only proven on aarch64).
   smoke-cpu:
-    name: smoke apr (cpu) on ${{ matrix.host }}
+    name: smoke apr (${{ matrix.flavour }}) on ${{ matrix.host }}
     needs: verify-apr-assets
+    # verify runs under always(); a skipped build two levels up must not skip this
+    if: ${{ !cancelled() && needs.verify-apr-assets.result == 'success' }}
     env:
       # The CPU assets build inside rust:1.93.0-bullseye (glibc 2.31) like the cuda lane, so the floor is
       # declared and GATED: an asset whose bytes import a newer GLIBC_* symbol fails here. 0.66.0 shipped a
@@ -643,14 +930,23 @@ jobs:
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
+            flavour: cpu
+            host: clean-room
+            labels: '["self-hosted", "Linux", "X64", "clean-room"]'
+            preflight: ''
+          # #4353's x86_64 wgpu asset gets the same #4275 tag/commit binding (quorum r4, agy 8ba6854b)
+          - target: x86_64-unknown-linux-gnu
+            flavour: wgpu
             host: clean-room
             labels: '["self-hosted", "Linux", "X64", "clean-room"]'
             preflight: ''
           - target: x86_64-unknown-linux-gnu
+            flavour: cpu
             host: yoga
             labels: '["self-hosted", "Linux", "X64", "cuda", "yoga"]'
             preflight: '--need docker objdump'
           - target: aarch64-unknown-linux-gnu
+            flavour: cpu
             host: gx10
             labels: '["self-hosted", "Linux", "ARM64", "cuda", "gx10"]'
             preflight: '--need docker objdump'
@@ -669,21 +965,30 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           TAG="${{ github.event.release.tag_name || inputs.tag }}"
-          T="${{ matrix.target }}"
+          T="${{ matrix.target }}"; F="${{ matrix.flavour }}"
           D="$RUNNER_TEMP/apr-cpu-smoke"; rm -rf "$D"; mkdir -p "$D"; cd "$D"
           API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
-          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases/tags/$TAG")
-          for f in "apr-${TAG}-${T}-cpu.tar.gz" "apr-${TAG}-${T}-cpu.tar.gz.sha256"; do
-            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; print(next(a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n))' "$f")
+          # by listing, not releases/tags/: an rc is a DRAFT until every fleet host runs it (#4327),
+          # and releases/tags/ never returns a draft
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
+          for f in "apr-${TAG}-${T}-${F}.tar.gz" "apr-${TAG}-${T}-${F}.tar.gz.sha256"; do
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; a=next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), None); a or sys.exit(f"release has no asset {n}"); print(a)' "$f")
             curl -sSfL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/octet-stream" -o "$f" "$API/releases/assets/$aid"
           done
-          sha256sum -c "apr-${TAG}-${T}-cpu.tar.gz.sha256"
-          tar xzf "apr-${TAG}-${T}-cpu.tar.gz"
-          BIN="$D/apr-${TAG}-${T}-cpu/apr"
-          v=$("$BIN" --version); echo "$v"
-          case "$v" in *"${TAG#v}"*) ;; *) echo "::error::asset reports '$v', not ${TAG#v}"; exit 1 ;; esac
+          sha256sum -c "apr-${TAG}-${T}-${F}.tar.gz.sha256"
+          tar xzf "apr-${TAG}-${T}-${F}.tar.gz"
+          # A promoted final (#4286) is its rc's exact bytes, so the archive's top directory
+          # may carry the rc label (apr-vX.Y.Z-rc.N-...). Take the one apr directory it holds.
+          set -- "$D"/apr-v*-"${T}"-"${F}"/apr
+          if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then echo "::error::expected exactly one apr binary in the archive, found: $*"; exit 1; fi
+          BIN=$1
+          v=$("$BIN" --version | head -1); echo "$v"
+          # #4275: X.Y.Z whole (an rc tag's -rc.N stripped) AND the asset's sha is the tag's commit
+          COMMIT=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/commits/$TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])')
+          bash "$GITHUB_WORKSPACE/scripts/release/asset_version_check.sh" "$TAG" "$COMMIT" "$v" || { echo "::error::asset reports '$v', which does not belong to $TAG ($COMMIT)"; exit 1; }
           n=$(grep -ac 'libcuda.so' "$BIN" || true)
-          [ "$n" -eq 0 ] || { echo "::error::the downloaded -cpu asset carries $n libcuda.so string(s) — it is a CUDA build"; exit 1; }
+          [ "$n" -eq 0 ] || { echo "::error::the downloaded -${F} asset carries $n libcuda.so string(s) — it is a CUDA build"; exit 1; }
           # The floor is READ on every row and ASSERTED only where the build was
           # containerised. On this branch the CPU lane builds natively, so its
           # floor is the builder's glibc and a `<= 2.31` assertion here would fail
@@ -693,7 +998,7 @@ jobs:
           if command -v objdump > /dev/null 2>&1; then
             FLOOR=$(objdump -T "$BIN" | grep -oE 'GLIBC_[0-9]+\.[0-9]+(\.[0-9]+)?' | sort -u -t_ -k2 -V | tail -1)
             echo "asset glibc floor: ${FLOOR:-none}"
-            echo "- apr-${TAG}-${T}-cpu on ${{ matrix.host }}: $v, glibc floor ${FLOOR:-none}" >> "$GITHUB_STEP_SUMMARY"
+            echo "- apr-${TAG}-${T}-${F} on ${{ matrix.host }}: $v, glibc floor ${FLOOR:-none}" >> "$GITHUB_STEP_SUMMARY"
             if [ -n "${APR_ASSET_GLIBC_FLOOR:-}" ]; then
               want="${APR_ASSET_GLIBC_FLOOR}"
               highest=$(printf '%s\n%s\n' "$FLOOR" "$want" | sort -t_ -k2 -V | tail -1)
@@ -702,9 +1007,43 @@ jobs:
           fi
           echo "smoke ok on ${{ matrix.host }}: $v runs with no driver dependency"
 
+  # #4353: the darwin asset gets the same download + checksum + #4275 tag/commit binding as the
+  # linux smoke rows, on the host it is for. build-apr-darwin's inline check does not cover a
+  # promoted final (#4286), whose build jobs skip (quorum r5, agy 5656f794/de646ba5).
+  smoke-darwin:
+    name: smoke apr (cpu) aarch64-apple-darwin on mini
+    needs: verify-apr-assets
+    if: ${{ !cancelled() && needs.verify-apr-assets.result == 'success' }}
+    runs-on: [self-hosted, macOS, ARM64, apple-silicon, m4, mini]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Download, verify checksum, run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.event.release.tag_name || inputs.tag }}"
+          T=aarch64-apple-darwin
+          D="$RUNNER_TEMP/apr-darwin-smoke"; rm -rf "${D:?}"; mkdir -p "$D"; cd "$D"
+          API="https://api.github.com/repos/${GITHUB_REPOSITORY}"
+          rel=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/releases?per_page=100" \
+            | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}: the rc tagger must create it as a draft first (#4327)"); print(json.dumps(r))' "$TAG")
+          for f in "apr-${TAG}-${T}-cpu.tar.gz" "apr-${TAG}-${T}-cpu.tar.gz.sha256"; do
+            aid=$(printf '%s' "$rel" | python3 -c 'import json,sys; n=sys.argv[1]; a=next((a["id"] for a in json.load(sys.stdin)["assets"] if a["name"]==n), None); a or sys.exit(f"release has no asset {n}"); print(a)' "$f")
+            curl -sSfL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/octet-stream" -o "$f" "$API/releases/assets/$aid"
+          done
+          shasum -a 256 -c "apr-${TAG}-${T}-cpu.tar.gz.sha256"
+          tar xzf "apr-${TAG}-${T}-cpu.tar.gz"
+          set -- "$D"/apr-v*-"${T}"-cpu/apr
+          if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then echo "::error::expected exactly one apr binary in the archive, found: $*"; exit 1; fi
+          v=$("$1" --version | head -1); echo "$v"
+          COMMIT=$(curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "$API/commits/$TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])')
+          bash "$GITHUB_WORKSPACE/scripts/release/asset_version_check.sh" "$TAG" "$COMMIT" "$v" || { echo "::error::asset reports '$v', which does not belong to $TAG ($COMMIT)"; exit 1; }
+          echo "- apr-${TAG}-${T}-cpu on mini: $v" >> "$GITHUB_STEP_SUMMARY"
+
   summary:
     name: Summary
-    needs: [build, build-apr-cuda, build-apr-cpu, verify-apr-assets, smoke-cuda, smoke-cpu]
+    needs: [assets, build, build-apr-cuda, build-apr-cpu, build-apr-darwin, build-pv-darwin, verify-apr-assets, smoke-cuda, smoke-cpu, smoke-darwin]
     runs-on: [self-hosted, Linux, X64, clean-room]
     if: always()
     steps:
@@ -724,6 +1063,8 @@ jobs:
             echo ""
             if [ "$STATUS" = "success" ]; then
               echo "- Build matrix: **4/4 targets succeeded**"
+            elif [ "$STATUS" = "skipped" ] && [ "${{ needs.assets.outputs.present }}" = "true" ]; then
+              echo "- Build matrix: **not rebuilt** — every asset was already on the release (a promoted rc, #4286)"
             else
               echo "- Build matrix: **partial** (status=$STATUS)"
             fi
@@ -732,12 +1073,15 @@ jobs:
             echo "  - x86_64-unknown-linux-gnu"
             echo "  - aarch64-unknown-linux-musl"
             echo "  - aarch64-unknown-linux-gnu"
+            echo "  - aarch64-apple-darwin (mini): ${{ needs.build-pv-darwin.result }}"
             echo ""
-            echo "### apr Binary Release: $TAG - four assets, {cuda,cpu} x {x86_64,aarch64}"
-            echo "- cuda build: ${{ needs.build-apr-cuda.result }} · cpu build: ${{ needs.build-apr-cpu.result }}"
-            echo "- all four on the release: ${{ needs.verify-apr-assets.result }} · smoke cuda (yoga+gx10): ${{ needs.smoke-cuda.result }} · smoke cpu (clean-room+yoga+gx10): ${{ needs.smoke-cpu.result }}"
+            echo "### apr Binary Release: $TAG - six assets, {cuda,cpu} x {x86_64,aarch64} + darwin cpu + x86_64 wgpu"
+            echo "- cuda build: ${{ needs.build-apr-cuda.result }} · cpu build: ${{ needs.build-apr-cpu.result }} · darwin build (mini): ${{ needs.build-apr-darwin.result }} · pv darwin: ${{ needs.build-pv-darwin.result }}"
+            echo "- all six on the release: ${{ needs.verify-apr-assets.result }} · smoke cuda (yoga+gx10): ${{ needs.smoke-cuda.result }} · smoke cpu (clean-room+yoga+gx10): ${{ needs.smoke-cpu.result }} · smoke darwin (mini): ${{ needs.smoke-darwin.result }}"
             echo "  - apr-$TAG-x86_64-unknown-linux-gnu-cuda.tar.gz (+ .sha256)"
             echo "  - apr-$TAG-aarch64-unknown-linux-gnu-cuda.tar.gz (+ .sha256)"
             echo "  - apr-$TAG-x86_64-unknown-linux-gnu-cpu.tar.gz (+ .sha256)"
             echo "  - apr-$TAG-aarch64-unknown-linux-gnu-cpu.tar.gz (+ .sha256)"
+            echo "  - apr-$TAG-x86_64-unknown-linux-gnu-wgpu.tar.gz (+ .sha256)"
+            echo "  - apr-$TAG-aarch64-apple-darwin-cpu.tar.gz (+ .sha256)"
           } >> "$GITHUB_STEP_SUMMARY"
diff --git a/Cargo.lock b/Cargo.lock
index 5e1d7bff28..d8f7edccd4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3803,9 +3803,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if 1.0.4",
  "cpufeatures 0.3.0",
@@ -10425,7 +10425,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
- "chacha20 0.10.0",
+ "chacha20 0.10.2",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
diff --git a/contracts/apr-version-traceability-v1.yaml b/contracts/apr-version-traceability-v1.yaml
index 8c5bf391cd..98b2226cce 100644
--- a/contracts/apr-version-traceability-v1.yaml
+++ b/contracts/apr-version-traceability-v1.yaml
@@ -1,11 +1,12 @@
 metadata:
-  version: 1.1.0
+  version: 1.2.0
   created: '2026-04-05'
   author: PAIML Engineering
   description: "apr --version traceability contract — the version output must always contain an informative build identifier; never the bare '(unknown)' sentinel when a CARGO_PKG_VERSION or any alternative identifier is available; AND the embedded git SHA must match the actual HEAD of the source tree at build time (including in git worktrees)"
   references:
     - "paiml/aprender#597 (Version string shows (unknown) instead of git hash)"
     - "paiml/aprender#1862 (build.rs misses HEAD changes in worktrees because ../../.git is a file pointer, not a directory)"
+    - "paiml/aprender#4110 (crates.io installs print +no-git although the tarball's .cargo_vcs_info.json carries the commit)"
   registry: true
   tags:
     - cli
@@ -36,11 +37,13 @@ equations:
       - "Common sentinel forms are forbidden: (unknown), 0000000, <empty>, null"
 
   fallback_hierarchy:
-    formula: "APR_GIT_SHA = override ∨ git_hash ∨ committed_sha ∨ 'v{version}+no-git'"
+    formula: "APR_GIT_SHA = override ∨ vcs_info_sha ∨ git_hash ∨ committed_sha ∨ 'v{version}+no-git'"
     domain: "build-time environment"
     codomain: "APR_GIT_SHA environment variable"
     invariants:
       - "Env var APR_GIT_SHA_OVERRIDE, if set, wins (for CI/release)"
+      - "Otherwise: read git.sha1 from the package's .cargo_vcs_info.json (written by cargo package into every published crate), short 9-hex form, -dirty suffix when cargo recorded a dirty tree; a value that is not 40 hex is ignored (#4110)"
+      - "The vcs rung precedes git rev-parse: an unpacked crate may sit inside an UNRELATED repository whose HEAD is not the crate's commit"
       - "Otherwise: try git rev-parse --short HEAD"
       - "Otherwise: try reading crates/apr-cli/.git-sha committed file"
       - "Otherwise: emit 'v{CARGO_PKG_VERSION}+no-git' as informative fallback"
@@ -89,6 +92,11 @@ falsification_tests:
     prediction: "When built without git context, apr --version output contains the package version string"
     test: "apr --version 2>&1 | grep -qE '0\\.[1-9][0-9]*\\.[0-9]+'"
     if_fails: "Version string missing entirely"
+  - id: FALSIFY-VERSION-005
+    rule: "a packaged apr-cli (no .git of its own) names the commit in its .cargo_vcs_info.json, even inside a foreign repository"
+    prediction: "The shipped build.rs, compiled and run as cargo runs it on a package dir holding the byte-exact apr-cli-0.69.1 vcs file, emits APR_GIT_SHA=d8a6df53a; inside an unrelated repo it still does; with the vcs rung removed or placed behind git rev-parse the table goes RED"
+    test: "cargo test -p apr-cli --lib build_rs_vcs_sha"
+    if_fails: "crates.io installs regress to '+no-git' (0.68.1/0.69.1 shape), or report an enclosing repository's HEAD"
   - id: FALSIFY-VERSION-004
     rule: "build.rs registers worktree-aware rerun-if-changed triggers"
     prediction: "build.rs invokes `git rev-parse --git-dir` and `--git-common-dir` (not a hardcoded `../../.git/HEAD` path)"
diff --git a/crates/apr-cli/build.rs b/crates/apr-cli/build.rs
index 4667107f37..aadbb5c959 100644
--- a/crates/apr-cli/build.rs
+++ b/crates/apr-cli/build.rs
@@ -1,9 +1,14 @@
 // Contract: apr-version-traceability-v1 F-VERSION-001..004 (paiml/aprender#597, #1862).
 // Resolve APR_GIT_SHA with a multi-source fallback hierarchy:
 //   1. APR_GIT_SHA_OVERRIDE env var (CI/release hook)
-//   2. git rev-parse --short HEAD (dev builds from worktree or primary checkout)
-//   3. committed .git-sha file (crates.io installs)
-//   4. "v{CARGO_PKG_VERSION}+no-git" (informative fallback — never bare "unknown")
+//   2. .cargo_vcs_info.json `git.sha1` — written by `cargo package` into every published
+//      tarball, so a crates.io install knows its commit (#4110). Ahead of `git rev-parse`
+//      because an unpacked crate may sit inside SOME OTHER repository whose HEAD is not ours
+//   3. git rev-parse --short HEAD (dev builds from worktree or primary checkout; retried with
+//      the enclosing checkout marked safe.directory when git refuses a checkout owned by another
+//      user — binary-release.yml builds as root in a container over the runner's checkout)
+//   4. committed .git-sha file
+//   5. "v{CARGO_PKG_VERSION}+no-git" (informative fallback — never bare "unknown")
 fn main() {
     let sha = resolve_git_sha();
     println!("cargo:rustc-env=APR_GIT_SHA={sha}");
@@ -16,6 +21,7 @@ fn main() {
 
     println!("cargo:rerun-if-env-changed=APR_GIT_SHA_OVERRIDE");
     println!("cargo:rerun-if-changed=.git-sha");
+    println!("cargo:rerun-if-changed=.cargo_vcs_info.json");
 }
 
 fn register_git_rerun_triggers() {
@@ -58,12 +64,20 @@ fn resolve_git_sha() -> String {
         }
     }
 
-    // 2. Live git hash from worktree (works for both primary checkouts and worktrees)
-    if let Some(sha) = run_git(&["rev-parse", "--short", "HEAD"]) {
+    // 2. The commit `cargo package` recorded (crates.io / packaged builds, no .git)
+    if let Some(sha) = vcs_info_sha() {
         return sha;
     }
 
-    // 3. Committed .git-sha fallback (updated by release script at publish time)
+    // 3. Live git hash from worktree (works for both primary checkouts and worktrees).
+    //    `trusted_git_retry`: the release binaries are built as root in a container over the
+    //    runner-owned checkout, where git refuses the repo as "dubious ownership" (#4110)
+    let head = ["rev-parse", "--short", "HEAD"];
+    if let Some(sha) = run_git(&head).or_else(|| trusted_git_retry(&head)) {
+        return sha;
+    }
+
+    // 4. Committed .git-sha fallback (updated by release script at publish time)
     if let Ok(contents) = std::fs::read_to_string(".git-sha") {
         let s = contents.trim().to_string();
         if !s.is_empty() {
@@ -71,7 +85,57 @@ fn resolve_git_sha() -> String {
         }
     }
 
-    // 4. Informative fallback — never bare "unknown"
+    // 5. Informative fallback — never bare "unknown"
     let version = std::env::var("CARGO_PKG_VERSION").unwrap_or_else(|_| "0.0.0".to_string());
     format!("v{version}+no-git")
 }
+
+/// `git.sha1` from `.cargo_vcs_info.json`, shortened to 9 hex digits (what `git rev-parse
+/// --short` prints in this repository), with `-dirty` when cargo packaged a dirty tree.
+/// Parsed by hand: a build script has no serde, and the file is cargo's own fixed shape.
+fn vcs_info_sha() -> Option<String> {
+    let dir = std::env::var("CARGO_MANIFEST_DIR").unwrap_or_else(|_| ".".to_string());
+    let text = std::fs::read_to_string(format!("{dir}/.cargo_vcs_info.json")).ok()?;
+    let after = &text[text.find("\"sha1\"")? + "\"sha1\"".len()..];
+    let open = after.find('"')?;
+    let value = &after[open + 1..];
+    let sha = &value[..value.find('"')?];
+    if sha.len() != 40 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
+    let dirty = text.contains("\"dirty\": true") || text.contains("\"dirty\":true");
+    Some(format!(
+        "{}{}",
+        &sha[..9],
+        if dirty { "-dirty" } else { "" }
+    ))
+}
+
+/// `git <args>` again, with the checkout that encloses this package marked `safe.directory`.
+///
+/// git refuses a repository owned by another user ("detected dubious ownership"), and the release
+/// lane builds as root in a container over the runner-owned checkout, so every published binary
+/// printed `+no-git` (#4110). The exception goes in a private GLOBAL config under OUT_DIR:
+/// git ignores `safe.directory` given by `-c` or GIT_CONFIG_* before 2.39 (measured, 2.34.1).
+/// Only the checkout found by walking up from CARGO_MANIFEST_DIR is trusted, never `*`, and
+/// `rev-parse` runs no hooks. This build is already compiling that checkout's code.
+fn trusted_git_retry(args: &[&str]) -> Option<String> {
+    let manifest = std::env::var("CARGO_MANIFEST_DIR").ok()?;
+    let top = std::path::Path::new(&manifest)
+        .ancestors()
+        .find(|d| d.join(".git").exists())?;
+    let config =
+        std::path::Path::new(&std::env::var("OUT_DIR").ok()?).join("apr-safe-directory.gitconfig");
+    std::fs::write(
+        &config,
+        format!("[safe]\n\tdirectory = {}\n", top.display()),
+    )
+    .ok()?;
+    let out = std::process::Command::new("git")
+        .args(args)
+        .env("GIT_CONFIG_GLOBAL", &config)
+        .output()
+        .ok()?;
+    let s = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    (out.status.success() && !s.is_empty()).then_some(s)
+}
diff --git a/crates/apr-cli/src/build_rs_vcs_sha_tests.rs b/crates/apr-cli/src/build_rs_vcs_sha_tests.rs
new file mode 100644
index 0000000000..5ad718d263
--- /dev/null
+++ b/crates/apr-cli/src/build_rs_vcs_sha_tests.rs
@@ -0,0 +1,221 @@
+//! #4110 — a crates.io install of apr names its commit, never `+no-git`.
+//!
+//! The 0.69.1 post-publish install printed `apr 0.69.1 (v0.69.1+no-git)` (0.68.1 did too) although
+//! the published tarball carried the commit: `cargo package` writes `.cargo_vcs_info.json` into
+//! every crate. These tests compile the SHIPPED `build.rs` with rustc and run it the way cargo runs a
+//! build script (CARGO_MANIFEST_DIR, CARGO_PKG_VERSION, cwd = the package dir) in a temp package
+//! dir with no `.git` of ours above it. The vcs file is byte-exact from the real apr-cli-0.69.1 crate.
+//! The release binaries printed `+no-git` too: binary-release.yml builds as root in a container over
+//! the runner-owned checkout, and git refuses it ("dubious ownership"); row `foreign-owner`.
+//! `planted_regressions_turn_red` re-runs the table on three planted copies of `build.rs` — the vcs
+//! rung removed (the pre-#4110 script), the vcs rung behind `git rev-parse`, and the safe.directory
+//! retry removed — and requires each to fail, so the table cannot pass vacuously.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+const BUILD_RS: &str = include_str!("../build.rs");
+const VCS_CALL: &str = "    if let Some(sha) = vcs_info_sha() {";
+
+/// Byte-exact `.cargo_vcs_info.json` of apr-cli-0.69.1 as downloaded from crates.io.
+const VCS_REAL: &str = "{\n  \"git\": {\n    \"sha1\": \"d8a6df53a6c7104ef4eabfd2284908f93f1d6a3f\"\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+const VCS_DIRTY: &str = "{\n  \"git\": {\n    \"sha1\": \"d8a6df53a6c7104ef4eabfd2284908f93f1d6a3f\",\n    \"dirty\": true\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+const VCS_BAD: &str =
+    "{\n  \"git\": {\n    \"sha1\": \"not-a-sha\"\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+
+fn compile(source: &str, dir: &Path, name: &str) -> PathBuf {
+    let src = dir.join(format!("{name}.rs"));
+    let bin = dir.join(name);
+    std::fs::write(&src, source).expect("write build.rs copy");
+    let rustc = std::env::var("RUSTC").unwrap_or_else(|_| "rustc".to_string());
+    let out = Command::new(rustc)
+        .args([
+            "--edition",
+            "2021",
+            "--crate-name",
+            "build_script_build",
+            "-o",
+        ])
+        .arg(&bin)
+        .arg(&src)
+        .output()
+        .expect("rustc must be runnable: this test compiles the shipped build.rs");
+    assert!(
+        out.status.success(),
+        "rustc rejected {name}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    bin
+}
+
+fn git(dir: &Path, args: &[&str]) -> String {
+    let out = Command::new("git")
+        .args([
+            "-c",
+            "core.hooksPath=/dev/null",
+            "-c",
+            "user.email=f@x",
+            "-c",
+            "user.name=f",
+        ])
+        .args(args)
+        .current_dir(dir)
+        .output()
+        .expect("git must be runnable");
+    assert!(
+        out.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    String::from_utf8_lossy(&out.stdout).trim().to_string()
+}
+
+/// A fresh package dir under `root`; the vcs file written when given; optionally its own repo.
+fn package(root: &Path, name: &str, vcs: Option<&str>) -> PathBuf {
+    let dir = root.join(name);
+    std::fs::create_dir_all(&dir).expect("mkdir package");
+    if let Some(v) = vcs {
+        std::fs::write(dir.join(".cargo_vcs_info.json"), v).expect("write vcs file");
+    }
+    dir
+}
+
+/// Runs the compiled build script like cargo does; returns the APR_GIT_SHA it emits.
+/// `ceiling` stops git's upward search there (None: search freely, as a real install would).
+fn run(bin: &Path, pkg: &Path, ceiling: Option<&Path>, env: &[(&str, &str)]) -> String {
+    let out_dir = pkg.join("target-out");
+    std::fs::create_dir_all(&out_dir).expect("mkdir OUT_DIR");
+    let mut cmd = Command::new(bin);
+    cmd.current_dir(pkg)
+        .env("CARGO_MANIFEST_DIR", pkg)
+        .env("OUT_DIR", &out_dir)
+        .env("CARGO_PKG_VERSION", "9.9.9")
+        .env_remove("APR_GIT_SHA_OVERRIDE")
+        .env_remove("GIT_DIR")
+        .env_remove("GIT_WORK_TREE")
+        .env(
+            "GIT_CEILING_DIRECTORIES",
+            ceiling.unwrap_or_else(|| Path::new("/nonexistent")),
+        )
+        .envs(env.iter().copied());
+    let out = cmd.output().expect("run build script");
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .find_map(|l| l.strip_prefix("cargo:rustc-env=APR_GIT_SHA="))
+        .unwrap_or("<none>")
+        .to_string()
+}
+
+/// The case table. Returns the names of the rows that landed wrong (empty = all as expected).
+fn table(build_rs: &str, label: &str) -> Vec<String> {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let root = tmp.path();
+    let bin = compile(build_rs, root, label);
+    let mut wrong = Vec::new();
+    let mut expect = |row: &str, got: String, want: &str| {
+        if got != want {
+            wrong.push(format!("{row}: got {got:?}, want {want:?}"));
+        }
+    };
+    let pkgs = root.join("pkgs");
+    let p = package(&pkgs, "packaged", Some(VCS_REAL));
+    expect("packaged", run(&bin, &p, Some(&pkgs), &[]), "d8a6df53a");
+    // an unrelated repository ABOVE the unpacked crate, with a commit, and no ceiling between them
+    let foreign = package(&pkgs, "foreign", None);
+    git(&foreign, &["init", "-q"]);
+    git(
+        &foreign,
+        &["commit", "-q", "--allow-empty", "-m", "foreign"],
+    );
+    let p = package(&foreign, "crate", Some(VCS_REAL));
+    expect("foreign-repo", run(&bin, &p, None, &[]), "d8a6df53a");
+    let p = package(&pkgs, "dirty", Some(VCS_DIRTY));
+    expect("dirty", run(&bin, &p, Some(&pkgs), &[]), "d8a6df53a-dirty");
+    let p = package(&pkgs, "malformed", Some(VCS_BAD));
+    expect(
+        "malformed",
+        run(&bin, &p, Some(&pkgs), &[]),
+        "v9.9.9+no-git",
+    );
+    let p = package(&pkgs, "no-vcs", None);
+    expect("no-vcs", run(&bin, &p, Some(&pkgs), &[]), "v9.9.9+no-git");
+    let p = package(&pkgs, "override", Some(VCS_REAL));
+    expect(
+        "override",
+        run(
+            &bin,
+            &p,
+            Some(&pkgs),
+            &[("APR_GIT_SHA_OVERRIDE", "release123")],
+        ),
+        "release123",
+    );
+    // a dev checkout: no vcs file, its own repo -> `git rev-parse --short HEAD` (worktree freshness)
+    let dev = package(&pkgs, "dev", None);
+    git(&dev, &["init", "-q"]);
+    git(&dev, &["commit", "-q", "--allow-empty", "-m", "dev"]);
+    let head = git(&dev, &["rev-parse", "--short", "HEAD"]);
+    expect("dev-checkout", run(&bin, &dev, None, &[]), &head);
+    // the release lane: root in a container over the runner-owned checkout. git's own test knob
+    // makes it see another owner; the precondition proves plain git really refuses the repo here
+    let other_owner = [("GIT_TEST_ASSUME_DIFFERENT_OWNER", "1")];
+    let refused = Command::new("git")
+        .args(["rev-parse", "HEAD"])
+        .current_dir(&dev)
+        .envs(other_owner)
+        .output();
+    assert!(
+        !refused.expect("git").status.success(),
+        "cannot simulate a checkout owned by another user: this git ignores GIT_TEST_ASSUME_DIFFERENT_OWNER"
+    );
+    expect("foreign-owner", run(&bin, &dev, None, &other_owner), &head);
+    wrong
+}
+
+#[test]
+fn packaged_build_rs_names_its_commit() {
+    let wrong = table(BUILD_RS, "shipped");
+    assert!(
+        wrong.is_empty(),
+        "shipped build.rs rows landed wrong: {wrong:#?}"
+    );
+}
+
+#[test]
+fn planted_regressions_turn_red() {
+    assert_eq!(
+        BUILD_RS.matches(VCS_CALL).count(),
+        1,
+        "the vcs rung call site moved; re-anchor the plants"
+    );
+    let no_rung = BUILD_RS.replace(VCS_CALL, "    if let Some(sha) = None::<String> {");
+    let git_first = BUILD_RS.replace(
+        VCS_CALL,
+        "    if let Some(sha) = run_git(&[\"rev-parse\", \"--short\", \"HEAD\"]).or_else(vcs_info_sha) {",
+    );
+    let w1 = table(&no_rung, "plant_no_rung");
+    assert!(
+        w1.iter().any(|r| r.starts_with("packaged:")),
+        "no-vcs-rung plant survived: {w1:#?}"
+    );
+    let retry = "run_git(&head).or_else(|| trusted_git_retry(&head))";
+    assert_eq!(
+        BUILD_RS.matches(retry).count(),
+        1,
+        "the git retry call site moved; re-anchor the plant"
+    );
+    let w3 = table(&BUILD_RS.replace(retry, "run_git(&head)"), "plant_no_retry");
+    assert!(
+        w3.iter().any(|r| r.starts_with("foreign-owner:")),
+        "no-retry plant survived: {w3:#?}"
+    );
+    let w2 = table(&git_first, "plant_git_first");
+    assert!(
+        w2.iter().any(|r| r.starts_with("foreign-repo:")),
+        "git-first plant survived: {w2:#?}"
+    );
+    assert!(
+        !w2.iter().any(|r| r.starts_with("packaged:")),
+        "git-first plant should still pass packaged: {w2:#?}"
+    );
+}
diff --git a/crates/apr-cli/src/lib.rs b/crates/apr-cli/src/lib.rs
index 72230fa4c9..17f643c307 100644
--- a/crates/apr-cli/src/lib.rs
+++ b/crates/apr-cli/src/lib.rs
@@ -48,6 +48,10 @@ pub mod verbosity;
 
 /// PERF-021: the accelerator refusal, shared by serve, run and chat.
 mod accel;
+
+/// #4110: the shipped build.rs, compiled and run as cargo would on a packaged crate.
+#[cfg(test)]
+mod build_rs_vcs_sha_tests;
 mod commands;
 pub mod error;
 mod output;
diff --git a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs
index 68d3539b9b..c0ccf253aa 100644
--- a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs
+++ b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt.rs
@@ -48,7 +48,8 @@ pub struct F2ReceiptKey {
     /// prefix or a size+mtime fingerprint would let a planted receipt with the
     /// wrong hash pass, which is the first falsifier.
     pub model_sha256: String,
-    /// The version of the crate that ran the guard.
+    /// The build that ran the guard: its version AND its executable's hash (#4290), see
+    /// [`apr_version`]. The field keeps its name so older receipts parse and then mismatch.
     pub apr_version: String,
     /// The device the GPU half ran on, as the driver names it.
     pub device: String,
@@ -308,10 +309,33 @@ pub fn model_sha256(bytes: &[u8]) -> String {
     s
 }
 
-/// The version of this crate — the one that ran the guard.
+/// The BUILD that ran the guard: `<CARGO_PKG_VERSION> exe:<16 hex of the running executable's
+/// sha256>`.
+///
+/// #4290: keyed on the version alone, v0.69.3-rc.1, rc.2, the final tag and every dev build of
+/// release/0.69.3 shared receipts, so a build that rewrote the forward path (RC2's one-engine
+/// loop, #4263) skipped F2 on a receipt an older build wrote. The executable's own bytes are
+/// the identity: every rebuild changes them, including a dirty one with no new commit, which a
+/// git sha would not see. The version stays in front so the log line still reads as a version.
 #[must_use]
 pub fn apr_version() -> String {
-    env!("CARGO_PKG_VERSION").to_string()
+    let exe = std::env::current_exe().and_then(std::fs::read).ok();
+    build_identity(env!("CARGO_PKG_VERSION"), exe.as_deref())
+}
+
+/// Pure half of [`apr_version`]. An executable that cannot be read gets a key no receipt can
+/// hold (pid + clock), so that run validates: an unknown build is never a known one.
+#[must_use]
+pub fn build_identity(version: &str, exe: Option<&[u8]>) -> String {
+    match exe {
+        Some(bytes) => format!("{version} exe:{}", &model_sha256(bytes)[..16]),
+        None => {
+            let nanos = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_or(0, |d| d.as_nanos());
+            format!("{version} exe:unreadable-{}-{nanos}", std::process::id())
+        },
+    }
 }
 
 /// Now, in unix seconds; 0 if the clock is before the epoch.
diff --git a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs
index 448adc179b..236c441299 100644
--- a/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs
+++ b/crates/aprender-serve/src/gguf/inference/forward/f2_receipt_tests.rs
@@ -9,8 +9,8 @@
 //! device.
 
 use super::{
-    apr_version, decide, model_sha256, read_receipt, receipt_path, write_receipt, F2Decision,
-    F2Receipt, F2ReceiptKey, F2ValidateReason, F2_RECEIPT_SCHEMA,
+    apr_version, build_identity, decide, model_sha256, read_receipt, receipt_path, write_receipt,
+    F2Decision, F2Receipt, F2ReceiptKey, F2ValidateReason, F2_RECEIPT_SCHEMA,
 };
 
 fn key() -> F2ReceiptKey {
@@ -221,9 +221,56 @@ fn model_sha256_is_the_real_sha256_lowercase_hex() {
 }
 
 #[test]
-fn apr_version_is_this_crates_version() {
-    assert_eq!(apr_version(), env!("CARGO_PKG_VERSION"));
-    assert!(!apr_version().is_empty());
+fn apr_version_names_this_crates_version_and_this_executable() {
+    let v = apr_version();
+    let want = format!("{} exe:", env!("CARGO_PKG_VERSION"));
+    assert!(v.starts_with(&want), "{v:?} does not start with {want:?}");
+    // the mutant #4290 names: a version-only key. It would print the bare version.
+    assert_ne!(
+        v,
+        env!("CARGO_PKG_VERSION"),
+        "the key is the version alone (#4290)"
+    );
+    assert_eq!(
+        v,
+        apr_version(),
+        "the same executable must key the same way twice"
+    );
+}
+
+/// #4290's case table, through `decide`: the key must tell builds apart, not versions.
+#[test]
+fn f2_receipt_key_is_the_build_not_the_version() {
+    let device = "NVIDIA GeForce RTX 4090".to_string();
+    let k = |id: String| F2ReceiptKey {
+        model_sha256: "ab".repeat(32),
+        apr_version: id,
+        device: device.clone(),
+    };
+    let rc1 = build_identity("0.69.3", Some(b"rc.1 forward loop"));
+    let rc2 = build_identity("0.69.3", Some(b"rc.2 one-engine loop"));
+    let written = receipt_for(&k(rc1.clone()));
+    // same version, different build -> validate
+    assert!(matches!(
+        decide(Ok(Some(written.clone())), &k(rc2), false),
+        F2Decision::Validate(F2ValidateReason::AprVersionMismatch { .. })
+    ));
+    // the identical build -> skip
+    assert!(matches!(
+        decide(Ok(Some(written)), &k(rc1), false),
+        F2Decision::Skip { .. }
+    ));
+    // an unreadable executable never matches, not even another unreadable one
+    let (u1, u2) = (
+        build_identity("0.69.3", None),
+        build_identity("0.69.3", None),
+    );
+    assert_ne!(u1, u2);
+    let unreadable = receipt_for(&k(u1));
+    assert!(matches!(
+        decide(Ok(Some(unreadable)), &k(u2), false),
+        F2Decision::Validate(F2ValidateReason::AprVersionMismatch { .. })
+    ));
 }
 
 #[test]
diff --git a/crates/aprender-serve/tests/driver_cuda_gguf.rs b/crates/aprender-serve/tests/driver_cuda_gguf.rs
index 612cbf87bd..090dfa8708 100644
--- a/crates/aprender-serve/tests/driver_cuda_gguf.rs
+++ b/crates/aprender-serve/tests/driver_cuda_gguf.rs
@@ -85,6 +85,8 @@ fn create_test_model(config: &GGUFConfig) -> OwnedQuantizedModel {
             ffn_norm_bias: None,
             attn_q_norm_weight: None,
             attn_k_norm_weight: None,
+            post_attn_norm_weight: None,
+            post_ffw_norm_weight: None,
         });
     }
 
@@ -141,6 +143,7 @@ fn test_driver_cuda_model_creation() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -181,6 +184,7 @@ fn test_driver_cuda_model_with_max_seq_len() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -222,6 +226,7 @@ fn test_driver_cuda_forward_basic() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -266,6 +271,7 @@ fn test_driver_cuda_forward_multi_token() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -303,6 +309,7 @@ fn test_driver_cuda_generate() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -346,6 +353,7 @@ fn test_driver_cuda_generate_greedy() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -388,6 +396,7 @@ fn test_driver_cuda_generate_with_stop_token() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -433,6 +442,7 @@ fn test_driver_cuda_gqa_forward() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
@@ -488,6 +498,7 @@ fn test_driver_cuda_multi_layer() {
         rope_theta: 10000.0,
         eps: 1e-5,
         rope_type: 0,
+        query_pre_attn_scalar: None,
         bos_token_id: None,
         eos_token_id: None,
         explicit_head_dim: None,
diff --git a/docs/audits/quorum-release-tooling-4314-salvage.json b/docs/audits/quorum-release-tooling-4314-salvage.json
new file mode 100644
index 0000000000..18551e0732
--- /dev/null
+++ b/docs/audits/quorum-release-tooling-4314-salvage.json
@@ -0,0 +1,159 @@
+{
+  "branch": "batch/release-tooling-4314-salvage",
+  "author": "claude-opus-5-5",
+  "origin": "PR #4314 closed as superseded (cop-approved D); salvage via cherry-pick -x",
+  "rounds": [
+    {
+      "round": 1,
+      "range": "origin/main...0edc34a89",
+      "lanes": {
+        "claude-sonnet-5": "PASS",
+        "claude-haiku-4-5": "PASS",
+        "gemini-3.1-pro-high": {
+          "verdict": "FAIL",
+          "agy_status": "SUCCESS",
+          "conversation_id": "2da40e08-59a9-4d5b-8cbd-6296d0c35387",
+          "blocking": [
+            "binary-release.yml draft lookup StopIteration when no release exists",
+            "rc_fleet_stage.sh gh release edit with no draft"
+          ]
+        }
+      },
+      "fix": "de3209315"
+    },
+    {
+      "round": 2,
+      "range": "0edc34a89..de3209315",
+      "lanes": {
+        "claude-sonnet-5": "PASS",
+        "gemini-3.1-pro-high": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "6d704450-06f0-4a3d-9134-ad8963ecef0d"
+        },
+        "claude-haiku-4-5": {
+          "verdict": "FAIL",
+          "blocking": [
+            "asset-id lookups ~881/~959 bare next()"
+          ]
+        }
+      },
+      "fix": "732580218"
+    },
+    {
+      "round": 3,
+      "range": "de3209315..732580218",
+      "lanes": {
+        "claude-sonnet-5": "PASS",
+        "gemini-3.1-pro-high": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "9d79c306-64de-4c9a-827a-58b23c5a53eb"
+        },
+        "claude-haiku-4-5": "PASS"
+      }
+    },
+    {
+      "round": 4,
+      "range": "732580218 full diff",
+      "lanes": {
+        "gemini-3.1-pro-high#a": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "0365ee7f-92dd-4fb5-b16c-0c28480a3ef0",
+          "note": "7 non-blocking notes"
+        },
+        "gemini-3.1-pro-high#b": {
+          "verdict": "FAIL",
+          "agy_status": "SUCCESS",
+          "conversation_id": "8ba6854b-6d18-40f0-a11f-b66e8dbae7ff",
+          "note": "x86_64 wgpu asset built but not smoked; asset counts in prose drift"
+        }
+      },
+      "fixed_in": "d74fe1b73"
+    },
+    {
+      "round": 5,
+      "range": "d74fe1b73 full diff",
+      "lanes": {
+        "gemini-3.1-pro-high#a": {
+          "verdict": "FAIL",
+          "agy_status": "SUCCESS",
+          "conversation_id": "5656f794-cd03-40d7-8876-bdbe50086f05",
+          "note": "darwin asset not smoked on a promoted final"
+        },
+        "gemini-3.1-pro-high#b": {
+          "verdict": "FAIL",
+          "agy_status": "SUCCESS",
+          "conversation_id": "de646ba5-d8b3-445c-8da1-ed1cdaf41b74",
+          "note": "bare next() in check_release_assets.sh and promote_rc.sh"
+        },
+        "gemini-3.1-pro-high#c": {
+          "verdict": "NO_VERDICT",
+          "agy_status": "SUCCESS",
+          "conversation_id": "5da13830-b883-482e-b3f7-c922282f12fb",
+          "note": "no parseable verdict block; not counted"
+        }
+      },
+      "fixed_in": "0a853d1c1"
+    },
+    {
+      "round": 6,
+      "range": "0a853d1c1 full diff",
+      "lanes": {
+        "gemini-3.1-pro-high#a": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "ca2a36a0-c2a8-4f83-a459-fb710586b524"
+        },
+        "gemini-3.1-pro-high#b": {
+          "verdict": "FAIL",
+          "agy_status": "SUCCESS",
+          "conversation_id": "58483f69-9133-42ba-b680-8d8252da1950",
+          "note": "claimed the workflow cannot run for a tag on main; the triggers are unchanged from origin/main and workflow_dispatch -f tag= is the rc tagger's entry. Contract made explicit at on:"
+        },
+        "gemini-3.1-pro-high#c": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "49a78747-9818-4d09-a3db-74900bb095f8"
+        }
+      },
+      "fixed_in": "6f83d92c8"
+    },
+    {
+      "round": 7,
+      "range": "6f83d92c8 full diff (origin/main...6f83d92c8)",
+      "lanes": {
+        "gemini-3.1-pro-high#a": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "df9f9795-c63e-4b9f-92dd-98960543e108"
+        },
+        "gemini-3.1-pro-high#b": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "ef73298e-e30c-4e50-8d3f-e3675e77eeaa"
+        },
+        "gemini-3.1-pro-high#c": {
+          "verdict": "PASS",
+          "agy_status": "SUCCESS",
+          "conversation_id": "2e5ac164-12df-4ffc-b869-c0ab36e683ad"
+        }
+      }
+    }
+  ],
+  "result": {
+    "head": "6f83d92c8",
+    "verdict": "PASS 3/3 non-Claude (gemini-3.1-pro-high x3, round 7, full diff)",
+    "secrets": "GITHUB_TOKEN only",
+    "runs_on_targets": "mini macOS (darwin build + smoke-darwin, #4353), yoga cuda + gx10 (smoke-cuda/cpu), clean-room (smoke-cpu incl. wgpu row); all labels pass scripts/check_runner_labels.sh; no runner-host config changed"
+  },
+  "open_by_design": "fleet_cells_gate.sh self-test WIRING row RED (UNWIRED) until the rc tagger calls it (RC_TAGGER); the rc tagger must create the rc as a draft release (#4327)",
+  "local_checks": {
+    "check_release_assets_test": "18/18",
+    "rc_fleet_stage --self-test": "PASS",
+    "promote_rc --self-test": "PASS",
+    "check_apr_bin_pinned": "OK",
+    "cargo test -p apr-cli --lib build_rs_vcs_sha": "2 passed"
+  }
+}
diff --git a/docs/roadmaps/entries/PMAT-4275.yaml b/docs/roadmaps/entries/PMAT-4275.yaml
new file mode 100644
index 0000000000..c6e830ca32
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4275.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4275
+  github_issue: 4275
+  item_type: task
+  title: 'binary-release smoke: strip -rc.N and bind the asset to its commit'
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:17:31Z
+  updated: 2026-09-24T14:17:31Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4286.yaml b/docs/roadmaps/entries/PMAT-4286.yaml
new file mode 100644
index 0000000000..0ccd8c3177
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4286.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4286
+  github_issue: 4286
+  item_type: task
+  title: promote rc to final with no rebuild
+  status: planned
+  priority: medium
+  assigned_to: null
+  created: 2026-09-24T14:17:31Z
+  updated: 2026-09-24T14:17:31Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4327.yaml b/docs/roadmaps/entries/PMAT-4327.yaml
new file mode 100644
index 0000000000..3246cfbd8b
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4327.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4327
+  github_issue: 4327
+  item_type: task
+  title: rc staged on every fleet host before publish, darwin-arm64 asset
+  status: in_progress
+  priority: medium
+  assigned_to: aprender-ea
+  created: 2026-09-24T18:11:17Z
+  updated: 2026-09-24T18:11:17Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/docs/roadmaps/entries/PMAT-4328.yaml b/docs/roadmaps/entries/PMAT-4328.yaml
new file mode 100644
index 0000000000..74f630e275
--- /dev/null
+++ b/docs/roadmaps/entries/PMAT-4328.yaml
@@ -0,0 +1,16 @@
+- id: PMAT-4328
+  github_issue: 4328
+  item_type: task
+  title: fleet andon: rc cut refuses while a fleet cell is RED (C1 C2 C4)
+  status: in_progress
+  priority: critical
+  assigned_to: aprender-ea
+  created: 2026-09-24T18:11:17Z
+  updated: 2026-09-24T18:11:17Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels: []
+  notes: null
diff --git a/scripts/check_release_assets.sh b/scripts/check_release_assets.sh
index 3fa0973450..eff577194f 100755
--- a/scripts/check_release_assets.sh
+++ b/scripts/check_release_assets.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# check_release_assets.sh — a tagged release carries the SIXTEEN assets it owes,
+# check_release_assets.sh — a tagged release carries the TWENTY-TWO assets it owes,
 # or this exits non-zero (row 67-A1, PMAT-1098, issue #3082).
 #
 # WHY THIS EXISTS
@@ -9,7 +9,11 @@
 # inline, in a loop that lived in the workflow — so it could not be run on release
 # day by a human, by the dogfood, or by the release-criteria table. No gate asserted
 # the ASSET SET. The operator's rule (2026-09-10) is four `apr` binaries on every
-# tag: {cuda, cpu} x {x86_64, aarch64}, each with a .sha256.
+# tag: {cuda, cpu} x {x86_64, aarch64}, each with a .sha256. Since #4327 also the cpu
+# apr for aarch64-apple-darwin: mini is fleet hardware and took no rc without it.
+# Since #4353 (operator 2026-09-25: "mac is critical and also wgpu enabled binary for
+# intel") also the darwin pv, and a `--features wgpu` apr for x86_64 (intel has no NVIDIA
+# device). A release missing either is not done, and there is no waiver path here.
 #
 # This script is that assertion, in ONE place, so the workflow and the release-day
 # protocol share one checker.
@@ -46,7 +50,7 @@ usage: check_release_assets.sh <tag> [--assets-from FILE]
 USAGE
 }
 
-# expected_assets TAG — the sixteen names, derived from the two matrices, printed
+# expected_assets TAG — the twenty-two names, derived from the two matrices, printed
 # one per line. The apr set is the operator's hard requirement; the pv set is what
 # the `build` lane of binary-release.yml has always produced.
 expected_assets() {
@@ -57,12 +61,18 @@ expected_assets() {
             printf 'apr-%s-%s-unknown-linux-gnu-%s.tar.gz.sha256\n' "$tag" "$arch" "$flavour"
         done
     done
+    printf 'apr-%s-aarch64-apple-darwin-cpu.tar.gz\n' "$tag"
+    printf 'apr-%s-aarch64-apple-darwin-cpu.tar.gz.sha256\n' "$tag"
+    printf 'apr-%s-x86_64-unknown-linux-gnu-wgpu.tar.gz\n' "$tag"
+    printf 'apr-%s-x86_64-unknown-linux-gnu-wgpu.tar.gz.sha256\n' "$tag"
     for arch in x86_64 aarch64; do
         for libc in musl gnu; do
             printf 'pv-%s-%s-unknown-linux-%s.tar.gz\n' "$tag" "$arch" "$libc"
             printf 'pv-%s-%s-unknown-linux-%s.tar.gz.sha256\n' "$tag" "$arch" "$libc"
         done
     done
+    printf 'pv-%s-aarch64-apple-darwin.tar.gz\n' "$tag"
+    printf 'pv-%s-aarch64-apple-darwin.tar.gz.sha256\n' "$tag"
 }
 
 # read_assets TAG — the asset names actually on the release, one per line.
@@ -93,7 +103,9 @@ read_assets() {
         return 2
     }
     json=$(curl -sSf -H "Authorization: Bearer $token" -H "Accept: application/vnd.github+json" \
-        "https://api.github.com/repos/${repo}/releases/tags/${tag}" 2>/dev/null); rc=$?
+        "https://api.github.com/repos/${repo}/releases?per_page=100" 2>/dev/null \
+        | python3 -c 'import json,sys; t=sys.argv[1]; r=next((r for r in json.load(sys.stdin) if r["tag_name"]==t), None); r or sys.exit(f"no release (draft or published) for {t}"); print(json.dumps(r))' "$tag" 2>/dev/null); rc=$?
+    # ^ by listing: an rc is a DRAFT until every fleet host runs it (#4327); releases/tags/ hides drafts
     [ "$rc" -eq 0 ] && [ -n "$json" ] || {
         printf '%s: ENV — REST read of %s release %s failed (rc=%s)\n' "$PROG" "$repo" "$tag" "$rc" >&2
         return 2
@@ -110,7 +122,10 @@ check_tag() { # check_tag TAG -> 0 complete · 1 missing · 2 ENV
     have=$(read_assets "$tag") || return 2
     while IFS= read -r want; do
         [ -n "$want" ] || continue
-        if printf '%s\n' "$have" | grep -qxF "$want"; then
+        # here-string, not `printf | grep -q`: under pipefail grep -q exits on the first match,
+        # printf takes SIGPIPE (141) and a PRESENT asset reads as MISSING (#4353: 5 of 30
+        # self-test runs went red on the complete set once the list grew to 22).
+        if grep -qxF "$want" <<< "$have"; then
             printf 'ok      %s\n' "$want"
         else
             printf 'MISSING %s\n' "$want"
@@ -119,9 +134,9 @@ check_tag() { # check_tag TAG -> 0 complete · 1 missing · 2 ENV
         fi
     done <<< "$(expected_assets "$tag")"
     if [ "$rc" -eq 0 ]; then
-        printf '%s: %s carries all 16 expected assets (4 apr + 4 sha256 + 8 pv)\n' "$PROG" "$tag"
+        printf '%s: %s carries all 22 expected assets (6 apr + 6 sha256 + 10 pv)\n' "$PROG" "$tag"
     else
-        printf '%s: %s is MISSING %s expected asset(s) — a release without its four apr binaries is not done (operator rule 2026-09-10)\n' "$PROG" "$tag" "$miss" >&2
+        printf '%s: %s is MISSING %s expected asset(s) — a release without its six apr binaries and five pv binaries is not done (operator rule 2026-09-10)\n' "$PROG" "$tag" "$miss" >&2
     fi
     return "$rc"
 }
@@ -135,6 +150,9 @@ selftest() {
     grep -vx "apr-$tag-aarch64-unknown-linux-gnu-cpu.tar.gz" "$work/complete.txt" > "$work/mutant.txt"
     grep -vx "apr-$tag-x86_64-unknown-linux-gnu-cuda.tar.gz.sha256" "$work/complete.txt" > "$work/nosha.txt"
     grep -v '^pv-' "$work/complete.txt" > "$work/nopv.txt"
+    grep -vx "apr-$tag-aarch64-apple-darwin-cpu.tar.gz" "$work/complete.txt" > "$work/nodarwin.txt"
+    grep -vx "pv-$tag-aarch64-apple-darwin.tar.gz" "$work/complete.txt" > "$work/nopvdarwin.txt"
+    grep -vx "apr-$tag-x86_64-unknown-linux-gnu-wgpu.tar.gz" "$work/complete.txt" > "$work/nowgpu.txt"
     : > "$work/empty.txt"
 
     row() { # row <want-rc> <label> <cmd...>
@@ -152,8 +170,11 @@ selftest() {
 
     row 0 "the complete asset set is credited"                bash "$0" "$tag" --assets-from "$work/complete.txt"
     row 1 "MUTATION: apr-<tag>-aarch64-...-cpu.tar.gz removed" bash "$0" "$tag" --assets-from "$work/mutant.txt"
+    row 1 "MUTATION: the darwin apr removed (mini takes no rc, #4327)" bash "$0" "$tag" --assets-from "$work/nodarwin.txt"
+    row 1 "MUTATION: the darwin pv removed (mini ran pv 0.69.1, #4353)" bash "$0" "$tag" --assets-from "$work/nopvdarwin.txt"
+    row 1 "MUTATION: the x86_64 wgpu apr removed (intel, #4353)" bash "$0" "$tag" --assets-from "$work/nowgpu.txt"
     row 1 "a missing .sha256 is as fatal as a missing tarball" bash "$0" "$tag" --assets-from "$work/nosha.txt"
-    row 1 "the eight pv assets are required too"               bash "$0" "$tag" --assets-from "$work/nopv.txt"
+    row 1 "the ten pv assets are required too"               bash "$0" "$tag" --assets-from "$work/nopv.txt"
     row 1 "an empty release is MISSING (1), not ENV"           bash "$0" "$tag" --assets-from "$work/empty.txt"
     row 2 "an unreadable asset list is ENV (2), never a pass"  bash "$0" "$tag" --assets-from "$work/nope.txt"
     row 2 "no tag at all is a usage error (2)"                 bash "$0"
@@ -165,9 +186,9 @@ selftest() {
     out=$(bash "$0" "$tag" --assets-from "$work/mutant.txt" 2>&1)
     row 0 "the missing asset is named in the output" \
         grep -q "MISSING apr-$tag-aarch64-unknown-linux-gnu-cpu.tar.gz" <<< "$out"
-    # Sixteen, not "some": a table that expected four would pass the rows above.
-    row 0 "sixteen assets are expected, and four of them are apr tarballs" \
-        bash -c "[ \$(bash '$0' --list '$tag' | grep -c .) -eq 16 ] && [ \$(bash '$0' --list '$tag' | grep -c '^apr-.*tar.gz\$') -eq 4 ]"
+    # Twenty-two, not "some": a table that expected four would pass the rows above.
+    row 0 "twenty-two assets are expected: six apr tarballs (one darwin, one wgpu), five pv (one darwin)" \
+        bash -c "[ \$(bash '$0' --list '$tag' | grep -c .) -eq 22 ] && [ \$(bash '$0' --list '$tag' | grep -c '^apr-.*tar.gz\$') -eq 6 ] && [ \$(bash '$0' --list '$tag' | grep -c '^pv-.*tar.gz\$') -eq 5 ] && grep -qx 'apr-$tag-aarch64-apple-darwin-cpu.tar.gz' <(bash '$0' --list '$tag')"
 
     printf '%s/%s rows\n' "$((n - red))" "$n"
     [ "$red" = 0 ] || return 1
diff --git a/scripts/dogfood.sh b/scripts/dogfood.sh
index e47797aada..c6c0d6402b 100755
--- a/scripts/dogfood.sh
+++ b/scripts/dogfood.sh
@@ -1295,7 +1295,7 @@ if [ "$DOGFOOD_PHASE" = pre-publish ]; then
 elif [ $DRC -eq 0 ]; then mark publish-dry-run PASS "packages cleanly"
 else mark publish-dry-run FAIL "$(printf '%s' "$DRY" | grep -iE 'error' | head -1)"; fi
 
-# ── 10b. the four apr binaries the tag owes (row 67-A1, PMAT-1098, #3082) ───
+# ── 10b. the apr binaries the tag owes (row 67-A1, PMAT-1098, #3082) ───
 # v0.66.0 shipped eight `pv` tarballs and ZERO `apr` binaries, and no gate said
 # so. The asset set is a POST-PUBLISH question by construction: binary-release.yml
 # fires on `release: published`, so the assets do not exist until the tag does.
@@ -1314,7 +1314,7 @@ if [ "$DOGFOOD_PHASE" = post-publish ]; then
     RA_RC=$RUN_RC
     RA_MISS=$(grep -c '^MISSING ' "$WORKLOG/release-assets.log" 2>/dev/null || true)
     if [ "$RA_RC" -eq 0 ]; then
-      mark release-assets PASS "v$VERSION carries all 16 assets (4 apr {cuda,cpu}x{x86_64,aarch64} + 4 sha256 + 8 pv)"
+      mark release-assets PASS "v$VERSION carries every asset check_release_assets.sh requires"
     elif [ "$RA_RC" -eq 2 ]; then
       # ENV is a FAIL here on purpose: "the release could not be read" is not
       # evidence that the release is complete.
@@ -1323,7 +1323,7 @@ if [ "$DOGFOOD_PHASE" = post-publish ]; then
       mark release-assets FAIL "v$VERSION is missing ${RA_MISS:-?} asset(s): $(grep -m1 '^MISSING ' "$WORKLOG/release-assets.log" | sed 's/^MISSING //')"
     fi
   else
-    mark release-assets FAIL "scripts/check_release_assets.sh is absent — the four apr binaries are asserted by nothing"
+    mark release-assets FAIL "scripts/check_release_assets.sh is absent — the apr binaries are asserted by nothing"
   fi
 else
   mark release-assets SKIP "assets exist only after the tag; measured by the post-publish dogfood (DOGFOOD_PHASE=post-publish), not by this phase"
diff --git a/scripts/install.sh b/scripts/install.sh
index 72ccaf56bd..93898f3ec4 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -252,6 +252,19 @@ install() {
     step "Installing"
     tar -xzf "$tmp_dir/archive.tar.gz" -C "$tmp_dir"
     extracted="$tmp_dir/${asset}/${BINARY_NAME}"
+    if [ ! -f "$extracted" ]; then
+        # A promoted final (#4286) is its rc's exact bytes, so the archive's top
+        # directory still carries the rc label (apr-vX.Y.Z-rc.N-<target>-<variant>/).
+        # Take the one ${BINARY_NAME}-* directory the archive holds, and only one.
+        found=''
+        n=0
+        for cand in "$tmp_dir/${BINARY_NAME}-"*"/${BINARY_NAME}"; do
+            [ -f "$cand" ] || continue
+            found=$cand
+            n=$((n + 1))
+        done
+        [ "$n" -eq 1 ] && extracted=$found
+    fi
     [ -f "$extracted" ] || error "Binary '${BINARY_NAME}' not found in archive (expected at ${asset}/${BINARY_NAME})"
 
     mkdir -p "$INSTALL_DIR"
diff --git a/scripts/release/asset_version_check.sh b/scripts/release/asset_version_check.sh
new file mode 100755
index 0000000000..7e40f2e937
--- /dev/null
+++ b/scripts/release/asset_version_check.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# asset_version_check.sh — does a release asset belong to its tag? (#4275, RC-DOGFOOD-001)
+#
+#   bash scripts/release/asset_version_check.sh TAG COMMIT "VERSION_LINE"
+#   bash scripts/release/asset_version_check.sh --self-test
+#
+# TAG is vX.Y.Z or vX.Y.Z-rc.N. COMMIT is the full sha the tag points at.
+# VERSION_LINE is the first line of the asset's `apr --version`: `apr X.Y.Z (<sha>)`.
+#
+# The printed version must equal the tag EXACTLY, -rc.N included (operator 2026-09-24: "we
+# need actual version numbers", "version number needs release canidate info in it"). The rc
+# commit's Cargo.toml says X.Y.Z; binary-release.yml runs stamp_rc_version.sh on the tag tree
+# before building, so an rc asset's CARGO_PKG_VERSION is X.Y.Z-rc.N. The v0.69.3-rc.2 asset,
+# built before that, printed `apr 0.69.3 (v0.69.3+no-git)`: refused twice over, since the sha
+# is required too. The version names WHICH rc; only the sha binds it to the tag's commit
+# (`vX.Y.Z+no-git`, what every container build reported before binary-release.yml passed
+# APR_GIT_SHA_OVERRIDE, is refused).
+#
+# The smoke this replaces tested `case "$v" in *"${TAG#v}"*)`: a substring match. It
+# refused every rc (0.69.3 does not contain 0.69.3-rc.1) and accepted 0.69.30 for
+# v0.69.3. The version here is compared whole.
+#
+# Exit: 0 the asset belongs to the tag, 1 it does not, 2 usage.
+set -uo pipefail
+PROG=asset_version_check
+
+# Pure. Prints `ok <version> at <sha>` or `bad <reason>`.
+avc_decide() {
+    local tag=$1 commit=$2 line=$3 want got sha
+    if [[ $tag =~ ^v([0-9]+\.[0-9]+\.[0-9]+)(-rc\.[0-9]+)?$ ]]; then
+        want=${tag#v}
+    else
+        echo "bad tag '$tag' is not vX.Y.Z or vX.Y.Z-rc.N"; return
+    fi
+    if [[ ! $commit =~ ^[0-9a-f]{40}$ ]]; then
+        echo "bad commit '$commit' is not a full 40-hex sha"; return
+    fi
+    if [[ $line =~ ^apr\ ([0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?)\ \((.*)\)$ ]]; then
+        got=${BASH_REMATCH[1]}; sha=${BASH_REMATCH[3]}
+    else
+        echo "bad version line '$line' is not 'apr X.Y.Z[-rc.N] (<sha>)'"; return
+    fi
+    if [ "$got" != "$want" ]; then
+        echo "bad asset reports $got; tag $tag wants $want"; return
+    fi
+    if [[ ! $sha =~ ^[0-9a-f]{7,40}$ ]]; then
+        echo "bad asset carries no commit ('$sha'), so nothing binds it to $tag"; return
+    fi
+    if [ "${commit#"$sha"}" = "$commit" ]; then
+        echo "bad asset was built from $sha; tag $tag is $commit"; return
+    fi
+    echo "ok $got at $sha"
+}
+
+self_test() {
+    local fail=0 got want tag line c=7ff50ec2a1f671ad031ba427a275b1f983031d66
+    echo "$PROG self-test: case table"
+    # want<TAB>tag<TAB>commit<TAB>version line<TAB>why
+    while IFS=$'\t' read -r want tag commit line why; do
+        got=$(avc_decide "$tag" "$commit" "$line")
+        if [ "${got%% *}" = "$want" ]; then echo "  ok   $why"; else echo "  FAIL $why: wanted $want, got '$got'"; fail=1; fi
+    done <<EOF
+ok	v0.69.3	$c	apr 0.69.3 (7ff50ec2a)	a final tag matches its version
+ok	v0.69.3-rc.1	$c	apr 0.69.3-rc.1 (7ff50ec2a)	an rc asset prints its rc (stamp_rc_version.sh)
+ok	v0.69.3-rc.12	$c	apr 0.69.3-rc.12 (7ff50ec)	a two-digit rc and a 7-hex short sha
+bad	v0.69.3-rc.1	$c	apr 0.69.3 (7ff50ec2a)	an rc asset printing bare X.Y.Z is refused (never bare 0.69.3 on an rc)
+bad	v0.69.3-rc.2	$c	apr 0.69.3-rc.1 (7ff50ec2a)	rc.1's version on the rc.2 tag
+bad	v0.69.3-rc.1	$c	apr 0.69.3-rc.12 (7ff50ec2a)	rc.12 is not rc.1 (compared whole)
+bad	v0.69.3	$c	apr 0.69.3-rc.2 (7ff50ec2a)	an rc version on the final tag
+bad	v0.69.3-rc.2	$c	apr 0.69.3 (v0.69.3+no-git)	the measured v0.69.3-rc.2 asset (2026-09-24): no rc, no sha
+ok	v0.69.3	$c	apr 0.69.3 ($c)	a full-length sha
+bad	v0.69.3-rc.1	$c	apr 0.69.2 (7ff50ec2a)	an rc tag does not match the previous version
+bad	v0.69.3	$c	apr 0.69.30 (7ff50ec2a)	0.69.30 is not 0.69.3 (the old substring glob said it was)
+bad	v0.69.3	$c	apr 0.69.3 (0badc0de1)	a sha that is not the tag's commit
+bad	v0.69.3	$c	apr 0.69.3 (v0.69.3+no-git)	an asset built without a sha cannot be bound to a commit
+bad	v0.69.3	$c	apr 0.69.3 ()	an empty sha
+bad	v0.69.3	$c	apr 0.69.3 (7ff50e)	a 6-hex sha is too short to bind anything
+bad	v0.69.3-beta	$c	apr 0.69.3 (7ff50ec2a)	a tag that is neither vX.Y.Z nor vX.Y.Z-rc.N
+bad	v0.69.3	7ff50ec2a	apr 0.69.3 (7ff50ec2a)	the expected commit must be a full sha
+bad	v0.69.3	$c	pv 0.69.3 (7ff50ec2a)	a line that is not apr's
+EOF
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+main() {
+    case "${1:-}" in
+        --self-test) self_test; return ;;
+        -h|--help) sed -n '2,21p' "${BASH_SOURCE[0]}"; return 0 ;;
+    esac
+    if [ "$#" -ne 3 ]; then echo "$PROG: usage: TAG COMMIT \"VERSION_LINE\" | --self-test" >&2; return 2; fi
+    local verdict
+    verdict=$(avc_decide "$1" "$2" "$3")
+    echo "$PROG: $verdict"
+    [ "${verdict%% *}" = ok ]
+}
+
+main "$@"
diff --git a/scripts/release/autopilot.sh b/scripts/release/autopilot.sh
index 8827a1a204..2b85a4b3f4 100755
--- a/scripts/release/autopilot.sh
+++ b/scripts/release/autopilot.sh
@@ -202,7 +202,7 @@ if run_step cleanroom; then
   say "CLEANROOM GREEN on $T: B2-cpu infra run $crun + B2-gpu aprender run $grun, both on $MC"
 fi
 
-# 4. assets: the release run completes and all sixteen assets are on the release, checked by command
+# 4. assets: the release run completes and every asset check_release_assets.sh requires is on the release, checked by command
 if run_step assets; then
   run=""; for _ in $(seq 1 40); do
     run=$(gh run list --repo $REPO --workflow binary-release.yml --event release --limit 10 --json databaseId,headBranch --jq ".[] | select(.headBranch==\"$T\") | .databaseId" | head -1)
@@ -282,8 +282,10 @@ set -e; d=\$(mktemp -d); cd "\$d"
 u=https://github.com/$REPO/releases/download/$T
 curl -sSfLO "\$u/$a.tar.gz"; curl -sSfLO "\$u/$a.tar.gz.sha256"
 sha256sum -c "$a.tar.gz.sha256"; tar xzf "$a.tar.gz"
-echo "version: \$("./$a/apr" --version | head -1)"
-echo "devices:"; "./$a/apr" devices --json || echo "(apr devices --json failed)"
+# a promoted final (#4286) keeps its rc's top directory: take the one apr-v* dir
+set -- ./apr-v*/apr; [ \$# -eq 1 ] && [ -f "\$1" ] || { echo "expected one apr in the archive, found: \$*"; exit 1; }; b=\$1
+echo "version: \$("\$b" --version | head -1)"
+echo "devices:"; "\$b" devices --json || echo "(apr devices --json failed)"
 cd /; rm -rf -- "\$d"
 HOST
     rc=$?; say "HOST $h rc=$rc: $(grep -m1 '^version:' "$AP/receipts/$h.txt")"
diff --git a/scripts/release/fleet-waivers.tsv b/scripts/release/fleet-waivers.tsv
new file mode 100644
index 0000000000..6eb2ad595b
--- /dev/null
+++ b/scripts/release/fleet-waivers.tsv
@@ -0,0 +1,16 @@
+# Fleet-cell waivers for the rc cut (#4328 C4) -- read by scripts/release/fleet_cells_gate.sh.
+# One line per waiver, TAB-separated, dated, with a reason. A waiver expires after `until`.
+#   <host|*>  <binary|*>  <until YYYY-MM-DD>  <reason, who ruled, when>
+# `*  *` also covers MISSING or STALE cells (the C3 monitor down); a host key never does.
+# A retired host is removed from the cells by C3; it is never waived here (C7).
+*	forjar	2026-09-27	forjar#639 no-sha; non-aprender, 48h waiver; cop aprender-77 ruling 2026-09-25 ~21:50Z
+*	bashrs	2026-09-27	bashrs#393 no-sha; non-aprender, 48h waiver; cop aprender-77 ruling 2026-09-25 ~21:50Z
+*	pzsh	2026-09-27	pzsh#34 no-sha; non-aprender, 48h waiver; cop aprender-77 ruling 2026-09-25 ~21:50Z
+*	copia	2026-09-27	copia#73/#74 no-sha/behind; non-aprender, 48h waiver; cop aprender-77 ruling 2026-09-25 ~21:50Z
+*	pmat	2026-09-27	pmat#1428 GLIBC (behind); non-aprender, 48h waiver; cop aprender-77 ruling 2026-09-25 ~21:50Z
+*	apex	2026-09-27	apex#153/#154 mirror-unreachable; non-aprender, 48h waiver; cop aprender-77 ruling 2026-09-25 ~21:50Z
+lambda-labs	llama.cpp	2026-09-27	crux-latest gpu-q 75 misreported, fix awaits merge+deploy (paiml/infra#1155); owner infra-64 fleetbins
+lambda-labs	rmedia	2026-09-27	paiml/rmedia#746 'WAIVED dev' reads RED by design; non-aprender, 48h; cop aprender-77 ruling 2026-09-25
+# pv: the #4219 fix ships inside car/0.70.0, so an unwaived pv deadlocks its own cut. This waiver is for the v0.70.0-rc cut ONLY:
+# DELETE this row at the 0.70.0 fleet install. After that, pv must read GREEN and any later cut refuses on pv. No apr waiver, ever.
+*	pv	2026-09-26	aprender#4219 no-sha; v0.70.0 cut only, remove at the 0.70.0 fleet install; cop aprender-77 ruling 2026-09-25
diff --git a/scripts/release/fleet_cells_gate.sh b/scripts/release/fleet_cells_gate.sh
new file mode 100755
index 0000000000..a95b05c9b7
--- /dev/null
+++ b/scripts/release/fleet_cells_gate.sh
@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# fleet_cells_gate.sh -- no rc is cut while a fleet cell is RED, unless a dated waiver names it (#4328 C4)
+#
+#   fleet_cells_gate.sh --cells FILE [--waivers FILE] [--now EPOCH]   judge; rc 0 cut, 1 refuse
+#   fleet_cells_gate.sh --self-test                                   case table + mutants
+#
+# rc.2 was cut with intel on an old apr, mini unable to install anything (no darwin asset)
+# and jetson unreachable: every one of those cells was RED and nothing on the cut path read
+# them. The rc tagger must run this gate before it writes the tag (see the WIRING row).
+#
+# CELLS come from infra-64's andon monitor (#4328 C3), published where the clean-room cut
+# job can read it: `fleet/cells.tsv` on the `fleet-state` branch of this repo.
+#   # measured 2026-09-24T17:58:00Z
+#   <host>\t<binary>\t<GREEN|RED>\t<reason>
+# A retired host is REMOVED from the cells, not listed RED (C7: jetson, 2026-09-24).
+#
+# WAIVERS are recorded in git, dated, and expire: scripts/release/fleet-waivers.tsv
+#   <host|*>\t<binary|*>\t<until YYYY-MM-DD>\t<reason>
+# `*\t*` is the only key that covers MISSING or STALE cells -- no data is not green data.
+#
+# Refuses: any unwaived RED cell · a state other than GREEN/RED · no cells · no `# measured`
+# stamp · cells older than FLEET_CELLS_MAX_AGE_H (default 6) hours. EXIT 0 cut · 1 refuse · 2 usage.
+set -uo pipefail
+PROG=fleet_cells_gate
+
+# fleet_cells_verdict <cells text> <waivers text> <now epoch> -> `ok ...` rc 0 | `refuse ...` rc 1
+fleet_cells_verdict() {
+    CELLS=$1 WAIVERS=$2 NOW=$3 MAX_AGE_H=${FLEET_CELLS_MAX_AGE_H:-6} python3 - <<'EOF'
+import datetime as dt, os, sys
+now = dt.datetime.fromtimestamp(int(os.environ["NOW"]), dt.timezone.utc)
+today = now.date().isoformat()
+def waived(host, binary):  # host "*" asks for the `*\t*` key only (missing/stale cells)
+    for line in os.environ["WAIVERS"].splitlines():
+        f = line.split("\t")
+        if not line.strip() or line.lstrip().startswith("#") or len(f) < 4 or not f[3].strip():
+            continue
+        if host == "*":
+            hit = f[0] == "*" and f[1] == "*"
+        else:
+            hit = f[0] in (host, "*") and f[1] in (binary, "*")
+        if hit and f[2] >= today:
+            return f"{f[0]}/{f[1]} until {f[2]}: {f[3]}"
+    return None
+lines = os.environ["CELLS"].splitlines()
+stamp = next((l.split(None, 2)[2] for l in lines if l.startswith("# measured ") and len(l.split()) >= 3), "")
+bad, notes, n = [], [], 0
+try:
+    measured = dt.datetime.strptime(stamp.strip(), "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=dt.timezone.utc)
+    age_h = (now - measured).total_seconds() / 3600
+    if age_h > float(os.environ["MAX_AGE_H"]):
+        bad.append(f"cells are stale: measured {stamp.strip()}, {age_h:.1f} h ago (max {os.environ['MAX_AGE_H']} h)")
+except ValueError:
+    bad.append("cells carry no '# measured <YYYY-MM-DDTHH:MM:SSZ>' stamp")
+for l in lines:
+    if not l.strip() or l.startswith("#"):
+        continue
+    f = l.split("\t")
+    if len(f) < 3:
+        bad.append(f"malformed cell: {l!r}")
+        continue
+    n += 1
+    host, binary, state = f[0], f[1], f[2]
+    reason = f[3] if len(f) > 3 else ""
+    if state == "GREEN":
+        continue
+    if state == "RED":
+        w = waived(host, binary)
+        if w:
+            notes.append(f"{host}/{binary} RED waived ({w})")
+        else:
+            bad.append(f"{host}/{binary} RED: {reason or 'no reason given'}")
+        continue
+    bad.append(f"{host}/{binary} state {state!r} is neither GREEN nor RED")
+if n == 0:
+    bad.append("no fleet cells")
+data_bad = [b for b in bad if b.startswith(("cells ", "no fleet cells"))]
+if data_bad and len(data_bad) == len(bad):
+    w = waived("*", "*")
+    if w:
+        notes.append(f"cells unusable, waived ({w}): " + "; ".join(data_bad))
+        bad = []
+if bad:
+    print("refuse " + "; ".join(bad))
+    sys.exit(1)
+print(f"ok {n} fleet cells, none RED unwaived" + ("; " + "; ".join(notes) if notes else ""))
+EOF
+}
+
+self_test() {
+    local fail=0 got rc now d mut
+    now=$(date -u -d 2026-09-24T18:00:00Z +%s)
+    local S='# measured 2026-09-24T17:58:00Z'
+    row() {  # row <want rc> <label> <cells> [waivers]
+        got=$(fleet_cells_verdict "$(printf '%b' "$3")" "$(printf '%b' "${4:-}")" "$now"); rc=$?
+        if [ "$rc" = "$1" ]; then echo "  ok   $2 -> rc $rc"; else printf '  FAIL %s: want rc %s, got %s\n       %s\n' "$2" "$1" "$rc" "$got"; fail=1; fi
+    }
+    echo "$PROG self-test"
+    row 0 'every cell GREEN' "$S\nlambda\tapr\tGREEN\t\nmini\tapr\tGREEN\t\n"
+    row 1 'ONE RED cell refuses the cut' "$S\nlambda\tapr\tGREEN\t\nintel\tapr\tRED\tv0.69.1 on PATH\n"
+    row 0 'a dated waiver covers that cell' "$S\nintel\tapr\tRED\told\n" 'intel\tapr\t2026-09-24\tintel reimage, cop 2026-09-24\n'
+    row 0 'a host-wide waiver covers any binary on it' "$S\nintel\tpv\tRED\told\n" 'intel\t*\t2026-09-30\treimage\n'
+    row 1 'an EXPIRED waiver covers nothing' "$S\nintel\tapr\tRED\told\n" 'intel\tapr\t2026-09-23\tx\n'
+    row 1 'a waiver for another host covers nothing' "$S\nintel\tapr\tRED\told\n" 'mini\tapr\t2026-12-31\tx\n'
+    row 1 'a waiver with no reason is not recorded' "$S\nintel\tapr\tRED\told\n" 'intel\tapr\t2026-12-31\t\n'
+    row 1 'an unknown state refuses' "$S\nyoga\tapr\tAMBER\t\n"
+    row 1 'no cells refuses: no data is not green' "$S\n"
+    row 1 'no measured stamp refuses' 'lambda\tapr\tGREEN\t\n'
+    row 1 'stale cells refuse' '# measured 2026-09-24T09:00:00Z\nlambda\tapr\tGREEN\t\n'
+    row 0 'only *\t* waives missing cells' '' '*\t*\t2026-09-24\tC3 not publishing yet, cop 2026-09-24\n'
+    row 1 'a host waiver does not waive missing cells' '' 'intel\t*\t2026-09-30\tx\n'
+    row 1 'a waiver for another binary covers nothing' "$S\nintel\tapr\tRED\told\n" '*\tpv\t2026-09-30\tx\n'
+    # MUTANTS: the refusal made a no-op must let the RED cell through.
+    d=$(mktemp -d) || return 2
+    for m in 's/            bad.append(f"{host}\/{binary} RED: /            pass  # /' 's/^    sys.exit(1)$/    sys.exit(0)/'; do
+        mut=$d/m.sh; sed "$m" "${BASH_SOURCE[0]}" > "$mut"
+        if cmp -s "$mut" "${BASH_SOURCE[0]}"; then echo "  FAIL mutant '$m' not built: the anchor moved"; fail=1; continue; fi
+        got=$(bash -c ". '$mut' --source-only; fleet_cells_verdict \"\$(printf '%b' '$S\nintel\tapr\tRED\told\n')\" '' $now" 2>&1); rc=$?
+        if [ "$rc" = 0 ]; then echo "  ok   mutant lets the RED cell through: the refusal is load-bearing"
+        else echo "  FAIL mutant still refuses (rc $rc): $got"; fail=1; fi
+    done
+    # WIRING: the rc tagger runs this gate before it writes the tag, and dies on a refusal.
+    # rc_cut.sh (#4314) was superseded by the 2026-09-25 16:58 ruling (rc = tag on a queue-green
+    # main); its successor is rc_tag_main.sh (#4327). An unwired gate blocks nothing, so this
+    # row goes RED if the tagger stops calling the gate before it writes the tag.
+    local cut; cut="${RC_TAGGER:-$(dirname -- "${BASH_SOURCE[0]}")/rc_tag_main.sh}"
+    local call tagline
+    call=$(grep -n 'fleet_cells_gate.sh' "$cut" | grep -v '^\s*[0-9]*:\s*#' | head -n 1 | cut -d: -f1)
+    tagline=$(grep -nF 'out=$(api_post git/refs' "$cut" | head -n 1 | cut -d: -f1)
+    if [ -n "$call" ] && [ -n "$tagline" ] && [ "$call" -lt "$tagline" ]; then echo "  ok   $(basename -- "$cut") runs the gate (line $call) before it writes the tag (line $tagline)"
+    else echo "  FAIL UNWIRED: $(basename -- "$cut") does not run fleet_cells_gate.sh before creating the tag (call=${call:-none}, tag=${tagline:-none})"; fail=1; fi
+    rm -rf -- "${d:?}"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+main() {
+    local cells='' waivers='' now
+    now=$(date -u +%s)
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --source-only) return 0 ;;
+            --cells) cells=$2; shift 2 ;;
+            --waivers) waivers=$2; shift 2 ;;
+            --now) now=$2; shift 2 ;;
+            *) echo "usage: $PROG --cells FILE [--waivers FILE] [--now EPOCH] | --self-test" >&2; return 2 ;;
+        esac
+    done
+    [ -n "$cells" ] || { echo "usage: $PROG --cells FILE [--waivers FILE]" >&2; return 2; }
+    fleet_cells_verdict "$(cat -- "$cells" 2>/dev/null)" "$([ -n "$waivers" ] && cat -- "$waivers" 2>/dev/null)" "$now"
+}
+
+if [ "${1:-}" = --source-only ]; then return 0 2>/dev/null || exit 0; fi
+main "$@"
diff --git a/scripts/release/lib_cut_receipt.sh b/scripts/release/lib_cut_receipt.sh
new file mode 100644
index 0000000000..5a4efa522c
--- /dev/null
+++ b/scripts/release/lib_cut_receipt.sh
@@ -0,0 +1,40 @@
+# lib_cut_receipt.sh -- the rc cut's receipt ledger: one row BEFORE each step acts, one after (#4327)
+#
+# Sourced by rc_tag_main.sh, rc_fleet_stage.sh and rc_cut_resumable.sh. A cut is several writes that
+# other systems see (a tag, a draft, a dispatch, a binary on each fleet host, the publish). A session
+# that died between two of them left no record of how far it got: the next one re-ran the tagger
+# (refused: the tag exists) or finished by hand.
+#
+# Each step writes `intent` before it acts and `done` once it is confirmed. A fresh session reads
+# the last row for (step, key):
+#   done    -- confirmed; never repeated (a deploy is re-VERIFIED, never re-installed)
+#   intent  -- it may or may not have landed: the caller asks the world, not the ledger
+#   (none)  -- it never started
+#
+# Rows: <utc>\t<tag>\t<step>\t<key>\t<intent|done|fail>\t<detail>
+# File: $RC_CUT_LEDGER, else ${XDG_STATE_HOME:-$HOME/.local/state}/rc-cut/<tag>.tsv -- on the box that
+# runs the cut (lambda), outside any worktree, so a new session in a new worktree finds it.
+#
+# A SOURCED library: no `set` here, it would change the caller's shell. Failures are return codes.
+
+receipt_file() {  # receipt_file <tag>
+    printf '%s\n' "${RC_CUT_LEDGER:-${XDG_STATE_HOME:-$HOME/.local/state}/rc-cut/$1.tsv}"
+}
+
+receipt_write() {  # receipt_write <tag> <step> <key> <intent|done|fail> [detail]
+    local f
+    f=$(receipt_file "$1") || return 2
+    mkdir -p -- "$(dirname -- "$f")" || return 2
+    printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" "$2" "$3" "$4" \
+        "$(printf '%s' "${5:-}" | tr '\t\n' '  ')" >> "$f" || return 2
+}
+
+receipt_field() {  # receipt_field <tag> <step> <key> <awk column> -> that column of the LAST matching row
+    local f
+    f=$(receipt_file "$1") || return 2
+    [ -f "$f" ] || return 0
+    awk -F'\t' -v t="$1" -v s="$2" -v k="$3" -v c="$4" '$2==t && $3==s && $4==k {v=$c} END {print v}' "$f"
+}
+receipt_state() { receipt_field "$1" "$2" "$3" 5; }    # intent | done | fail | empty
+receipt_detail() { receipt_field "$1" "$2" "$3" 6; }
+receipt_time() { receipt_field "$1" "$2" "$3" 1; }     # utc of the last row
diff --git a/scripts/release/promote_rc.sh b/scripts/release/promote_rc.sh
new file mode 100755
index 0000000000..09456afd6d
--- /dev/null
+++ b/scripts/release/promote_rc.sh
@@ -0,0 +1,274 @@
+#!/usr/bin/env bash
+# promote_rc.sh — promote vX.Y.Z-rc.N to vX.Y.Z with NO rebuild (#4286, RC-DOGFOOD-001 §4.4)
+#
+#   bash scripts/release/promote_rc.sh vX.Y.Z-rc.N [--dry-run] [--work DIR]
+#   bash scripts/release/promote_rc.sh --self-test
+#
+# The final's assets ARE the rc's bytes. Cargo stays at X.Y.Z for an rc (cop ruling,
+# 2026-09-24), so the rc binary already reports `apr X.Y.Z (<sha>)`, and the bytes that
+# were dogfooded are the bytes that ship. Only the asset NAME carries the rc label, so
+# only the name changes:
+#
+#   1. read the rc release: a prerelease, carrying every asset check_release_assets.sh requires
+#      (scripts/check_release_assets.sh), its tag resolved to a commit
+#   2. download every asset and verify each tarball against its .sha256; a missing
+#      .sha256 or a mismatch refuses
+#   3. stage each tarball under its final name (`-vX.Y.Z-rc.N-` -> `-vX.Y.Z-`), with
+#      a .sha256 whose hash EQUALS the rc's
+#   4. create release vX.Y.Z as a DRAFT at the rc's commit, and upload
+#   5. read every final asset back and assert its sha256 equals the rc's. A mismatch
+#      exits 1 and deletes nothing: the draft stays for a human to inspect
+#   6. publish the draft, then check that the tag vX.Y.Z points at the rc's commit
+#
+# The tarball's top directory keeps the rc label (apr-vX.Y.Z-rc.N-<target>-<variant>/):
+# renaming it would change the bytes. install.sh, the binary-release smoke and
+# autopilot's host check therefore take the one apr-* directory an archive holds.
+#
+# Publishing with a personal token fires `release: published` in binary-release.yml.
+# Its `assets` job sees every required asset present and skips every build, so nothing
+# overwrites these bytes. Verify and smoke still run, on the promoted bytes.
+#
+# Exit: 0 promoted (or the dry run passed) · 1 refused / a check failed · 2 ENV/usage.
+set -uo pipefail
+PROG=promote_rc
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+API="https://api.github.com/repos/${GITHUB_REPOSITORY:-paiml/aprender}"
+UPLOADS="https://uploads.github.com/repos/${GITHUB_REPOSITORY:-paiml/aprender}"
+
+die()  { echo "$PROG: $*" >&2; exit 1; }
+env_die() { echo "$PROG: ENV — $*" >&2; exit 2; }
+
+# ── pure / offline parts (the case table runs these on real files) ─────────────
+
+# final_of RC — vX.Y.Z-rc.N -> vX.Y.Z; empty on anything else
+final_of() {
+    if [[ $1 =~ ^(v[0-9]+\.[0-9]+\.[0-9]+)-rc\.[0-9]+$ ]]; then echo "${BASH_REMATCH[1]}"; fi
+}
+
+# final_name RC FINAL NAME — the asset's final name; empty unless NAME carries
+# `-RC-` exactly once (an asset from some other tag is not renamed, it is refused)
+final_name() {
+    local rc=$1 final=$2 name=$3 rest
+    rest=${name#*"-$rc-"}
+    [ "$rest" != "$name" ] || return 0
+    [ "${rest#*"$rc"}" = "$rest" ] || return 0
+    echo "${name%%"-$rc-"*}-$final-$rest"
+}
+
+sha_of() { sha256sum "$1" | awk '{print $1}'; }
+
+# stage RC FINAL SRC DST — verify every tarball in SRC against its .sha256, copy it
+# into DST under its final name, and write the final .sha256 carrying the SAME hash.
+# Prints `<final tarball>\t<hash>` per asset. Refuses (returns 1) on: an asset whose
+# name does not carry the rc, a tarball without a .sha256, a .sha256 without its
+# tarball, a hash mismatch, or nothing to promote.
+stage() {
+    local rc=$1 final=$2 src=$3 dst=$4 f base fin want have n=0
+    for f in "$src"/*; do
+        [ -f "$f" ] || continue
+        base=${f##*/}
+        fin=$(final_name "$rc" "$final" "$base")
+        if [ -z "$fin" ]; then echo "$PROG: refuse: $base does not carry -$rc-" >&2; return 1; fi
+        case "$base" in
+            *.sha256)
+                if [ ! -f "${f%.sha256}" ]; then echo "$PROG: refuse: $base has no tarball" >&2; return 1; fi
+                continue ;;
+        esac
+        if [ ! -f "$f.sha256" ]; then echo "$PROG: refuse: $base has no .sha256" >&2; return 1; fi
+        want=$(awk 'NR==1{print $1}' "$f.sha256")
+        have=$(sha_of "$f")
+        if [ "$want" != "$have" ]; then echo "$PROG: refuse: $base is $have, its .sha256 says $want" >&2; return 1; fi
+        cp -- "$f" "$dst/$fin" || return 1
+        printf '%s  %s\n' "$have" "$fin" > "$dst/$fin.sha256" || return 1
+        printf '%s\t%s\n' "$fin" "$have"
+        n=$((n + 1))
+    done
+    if [ "$n" -eq 0 ]; then echo "$PROG: refuse: nothing to promote in $src" >&2; return 1; fi
+}
+
+# readback MANIFEST DIR — every final tarball in DIR, and the hash its .sha256 states,
+# equal the rc's hash recorded in MANIFEST. Prints each mismatch; returns 1 on any.
+readback() {
+    local manifest=$1 dir=$2 fin want bad=0 have stated
+    while IFS=$'\t' read -r fin want; do
+        have=$( [ -f "$dir/$fin" ] && sha_of "$dir/$fin" )
+        stated=$( [ -f "$dir/$fin.sha256" ] && awk 'NR==1{print $1}' "$dir/$fin.sha256" )
+        if [ "$have" != "$want" ]; then echo "$PROG: MISMATCH $fin is '${have:-missing}', the rc's bytes are $want"; bad=1; fi
+        if [ "$stated" != "$want" ]; then echo "$PROG: MISMATCH $fin.sha256 states '${stated:-missing}', the rc's is $want"; bad=1; fi
+    done < "$manifest"
+    [ "$bad" -eq 0 ]
+}
+
+self_test() {
+    local fail=0 w rc=v0.70.0-rc.3 final=v0.70.0 got
+    w=$(mktemp -d) || return 2
+    # shellcheck disable=SC2064
+    trap "rm -rf -- '$w'" RETURN
+    row() { # want(0|1) reason why cmd... — a refusal must refuse for ITS reason, not a later check's
+        local want=$1 reason=$2 why=$3; shift 3
+        if "$@" > "$w/out" 2>&1; then got=0; else got=1; fi
+        if [ "$got" = "$want" ] && { [ -z "$reason" ] || grep -qF -- "$reason" "$w/out"; }; then echo "  ok   $why"
+        else echo "  FAIL $why (wanted rc $want and '$reason', got rc $got)"; sed 's/^/       | /' "$w/out"; fail=1; fi
+    }
+    # a fixture rc: two real tarballs and their .sha256 files
+    fixture() { # dir
+        local d=$1 a
+        mkdir -p "$d/pkg"
+        for a in "apr-$rc-x86_64-unknown-linux-gnu-cpu" "pv-$rc-x86_64-unknown-linux-musl"; do
+            mkdir -p "$d/pkg/$a"; printf 'bytes of %s\n' "$a" > "$d/pkg/$a/bin"
+            tar czf "$d/$a.tar.gz" -C "$d/pkg" "$a"
+            (cd "$d" && sha256sum "$a.tar.gz" > "$a.tar.gz.sha256")
+        done
+        rm -rf -- "${d:?}/pkg"
+    }
+    echo "$PROG self-test: names"
+    [ "$(final_of v0.70.0-rc.3)" = v0.70.0 ] && echo "  ok   final_of strips -rc.N" || { echo "  FAIL final_of"; fail=1; }
+    [ -z "$(final_of v0.70.0)" ] && echo "  ok   a final tag is not an rc" || { echo "  FAIL final_of v0.70.0"; fail=1; }
+    [ -z "$(final_of v0.70.0-rc.)" ] && echo "  ok   -rc. without N is not an rc" || { echo "  FAIL final_of -rc."; fail=1; }
+    [ "$(final_name $rc $final "apr-$rc-aarch64-unknown-linux-gnu-cuda.tar.gz")" = "apr-$final-aarch64-unknown-linux-gnu-cuda.tar.gz" ] \
+        && echo "  ok   final_name renames only the version" || { echo "  FAIL final_name"; fail=1; }
+    [ -z "$(final_name $rc $final "apr-v0.70.0-rc.30-x.tar.gz")" ] && echo "  ok   rc.30 is not rc.3" || { echo "  FAIL rc.30 renamed as rc.3"; fail=1; }
+    [ -z "$(final_name $rc $final "apr-$rc-$rc-x.tar.gz")" ] && echo "  ok   a doubled label is refused" || { echo "  FAIL doubled label"; fail=1; }
+
+    echo "$PROG self-test: stage + readback on real files"
+    mkdir -p "$w/good" "$w/good.out"; fixture "$w/good"
+    row 0 "tar.gz" "rc -> final: every tarball staged, same bytes" stage $rc $final "$w/good" "$w/good.out"
+    mkdir -p "$w/good.out2"; stage $rc $final "$w/good" "$w/good.out2" > "$w/manifest" 2>/dev/null
+    row 0 "" "read-back: final bytes and stated hashes equal the rc's" readback "$w/manifest" "$w/good.out2"
+    got=$(cmp -s "$w/good/apr-$rc-x86_64-unknown-linux-gnu-cpu.tar.gz" "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz" && echo same)
+    [ "$got" = same ] && echo "  ok   the final tarball is byte-identical to the rc's (cmp)" || { echo "  FAIL bytes differ"; fail=1; }
+
+    mkdir -p "$w/tamper" "$w/tamper.out"; fixture "$w/tamper"
+    printf 'x' >> "$w/tamper/pv-$rc-x86_64-unknown-linux-musl.tar.gz"
+    row 1 "its .sha256 says" "a tampered rc asset refuses" stage $rc $final "$w/tamper" "$w/tamper.out"
+
+    mkdir -p "$w/nosha" "$w/nosha.out"; fixture "$w/nosha"
+    rm -f -- "$w/nosha/pv-$rc-x86_64-unknown-linux-musl.tar.gz.sha256"
+    row 1 "has no .sha256" "a missing .sha256 refuses" stage $rc $final "$w/nosha" "$w/nosha.out"
+
+    mkdir -p "$w/orphan" "$w/orphan.out"; fixture "$w/orphan"
+    rm -f -- "$w/orphan/pv-$rc-x86_64-unknown-linux-musl.tar.gz"
+    row 1 "has no tarball" "a .sha256 without its tarball refuses" stage $rc $final "$w/orphan" "$w/orphan.out"
+
+    mkdir -p "$w/foreign" "$w/foreign.out"; fixture "$w/foreign"
+    cp -- "$w/foreign/apr-$rc-x86_64-unknown-linux-gnu-cpu.tar.gz" "$w/foreign/apr-v0.69.9-x86_64-unknown-linux-gnu-cpu.tar.gz"
+    row 1 "does not carry" "an asset from another tag refuses" stage $rc $final "$w/foreign" "$w/foreign.out"
+
+    mkdir -p "$w/empty" "$w/empty.out"
+    row 1 "nothing to promote" "nothing to promote refuses" stage $rc $final "$w/empty" "$w/empty.out"
+
+    cp -- "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz" "$w/swap"
+    printf 'y' >> "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz"
+    row 1 "MISMATCH apr-" "read-back: an uploaded final that differs from the rc fails" readback "$w/manifest" "$w/good.out2"
+    cp -- "$w/swap" "$w/good.out2/apr-$final-x86_64-unknown-linux-gnu-cpu.tar.gz"
+    printf '%s  x\n' "$(printf 0%.0s {1..64})" > "$w/good.out2/pv-$final-x86_64-unknown-linux-musl.tar.gz.sha256"
+    row 1 "states '0000" "read-back: a final .sha256 stating another hash fails" readback "$w/manifest" "$w/good.out2"
+    rm -f -- "$w/good.out2/pv-$final-x86_64-unknown-linux-musl.tar.gz.sha256"
+    row 1 "states 'missing'" "read-back: a missing final .sha256 fails" readback "$w/manifest" "$w/good.out2"
+
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+# ── GitHub I/O ─────────────────────────────────────────────────────────────────
+
+api() { # METHOD PATH [JSON] — prints the body; fails on a non-2xx
+    local m=$1 p=$2
+    if [ "$#" -ge 3 ]; then
+        curl -sSf -X "$m" -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.github+json" --data "$3" "$API/$p"
+    else
+        curl -sSf -X "$m" -H "Authorization: Bearer $TOKEN" -H "Accept: application/vnd.github+json" "$API/$p"
+    fi
+}
+json() { local code=$1; shift; python3 -c "import json,sys; d=json.load(sys.stdin); $code" "$@"; }
+download_assets() { # RELEASE_JSON DIR — fails closed: an unparseable or empty listing is an error
+    local id name list
+    list=$(printf '%s' "$1" | json 'print("\n".join(map(lambda a: str(a["id"]) + "\t" + a["name"], d["assets"])))') || return 1
+    [ -n "$list" ] || { echo "$PROG: the release lists no assets" >&2; return 1; }
+    while IFS=$'\t' read -r id name; do
+        curl -sSfL -H "Authorization: Bearer $TOKEN" -H "Accept: application/octet-stream" \
+            -o "$2/$name" "$API/releases/assets/$id" || return 1
+    done <<< "$list"
+}
+
+promote() {
+    local rc=$1 dry=$2 work=$3 final rel commit tag_json rid out f drafts body
+    final=$(final_of "$rc")
+    [ -n "$final" ] || { echo "$PROG: usage: '$rc' is not vX.Y.Z-rc.N" >&2; exit 2; }
+    TOKEN=${GH_TOKEN:-${GITHUB_TOKEN:-}}
+    [ -n "$TOKEN" ] || env_die "no GH_TOKEN/GITHUB_TOKEN"
+    command -v python3 > /dev/null && command -v sha256sum > /dev/null || env_die "needs python3 and sha256sum"
+
+    # 1. the rc
+    # by listing: an rc is a DRAFT until rc_fleet_stage.sh has it on every fleet host (#4327),
+    # and releases/tags/ never returns a draft -- a still-draft rc must be refused by name
+    rel=$(api GET "releases?per_page=100" | json 'r = next((r for r in d if r["tag_name"] == sys.argv[1]), None); r or sys.exit(1); print(json.dumps(r))' "$rc") \
+        || env_die "cannot read release $rc (not among the newest 100 releases)"
+    [ "$(printf '%s' "$rel" | json 'print(d["draft"])')" = False ] || die "refuse: $rc is still a DRAFT -- it is not on every fleet host yet (scripts/release/rc_fleet_stage.sh $rc --publish, #4327)"
+    [ "$(printf '%s' "$rel" | json 'print(d["prerelease"])')" = True ] || die "refuse: $rc is not a prerelease"
+    if api GET "releases/tags/$final" > /dev/null 2>&1; then die "refuse: release $final already exists (a draft from a failed run is deleted by hand, after reading it)"; fi
+    drafts=$(api GET "releases?per_page=100" | json 'print(" ".join(map(lambda r: str(r["id"]), filter(lambda r: r["draft"] and r["tag_name"] == sys.argv[1], d))))' "$final") \
+        || env_die "cannot list releases"
+    [ -z "$drafts" ] || die "refuse: draft release(s) $drafts of $final already exist: read them and delete them by hand"
+    tag_json=$(api GET "git/ref/tags/$rc") || env_die "cannot read tag $rc"
+    commit=$(printf '%s' "$tag_json" | json 'o=d["object"]; print(o["sha"] if o["type"]=="commit" else "TAG:"+o["url"])')
+    if [ "${commit#TAG:}" != "$commit" ]; then
+        commit=$(curl -sSf -H "Authorization: Bearer $TOKEN" "${commit#TAG:}" | json 'print(d["object"]["sha"])') || env_die "cannot dereference $rc"
+    fi
+    echo "$PROG: $rc is commit $commit"
+    bash "$ROOT/scripts/check_release_assets.sh" "$rc" || die "refuse: $rc does not carry every asset"
+
+    # 2 + 3. download, verify, stage
+    mkdir -p "$work/rc" "$work/final" "$work/back" || env_die "cannot create $work"
+    download_assets "$rel" "$work/rc" || env_die "download from $rc failed"
+    stage "$rc" "$final" "$work/rc" "$work/final" > "$work/manifest" || die "refuse: $rc's assets do not verify"
+    echo "$PROG: staged $(wc -l < "$work/manifest") tarball(s) under $final names, hashes equal to the rc's"
+    if [ "$dry" = 1 ]; then echo "$PROG: --dry-run: nothing written. Staged in $work/final"; return 0; fi
+
+    # 4. draft final at the rc's commit, upload
+    body="Promoted from $rc with no rebuild (RC-DOGFOOD-001 §4.4, #4286).
+
+Every asset is the byte-identical rc asset, renamed; each .sha256 states the rc's hash. The tarball's top directory keeps the rc label.
+
+Commit: $commit"
+    out=$(api POST releases "$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": sys.argv[1], "draft": True, "prerelease": False, "body": sys.argv[3]}))' "$final" "$commit" "$body")") \
+        || die "could not create the draft release $final"
+    rid=$(printf '%s' "$out" | json 'print(d["id"])')
+    for f in "$work/final"/*; do
+        curl -sSf -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/octet-stream" \
+            --data-binary @"$f" "$UPLOADS/releases/$rid/assets?name=${f##*/}" > /dev/null \
+            || die "upload of ${f##*/} failed; draft $rid left as is"
+    done
+
+    # 5. read back
+    rel=$(api GET "releases/$rid") || die "cannot read the draft back"
+    download_assets "$rel" "$work/back" || die "read-back download failed; draft $rid left as is"
+    readback "$work/manifest" "$work/back" || die "read-back does not equal the rc's bytes; draft $rid left, nothing deleted"
+    echo "$PROG: read-back: every final asset equals the rc's bytes"
+
+    # 6. publish, then the tag must be the rc's commit
+    api PATCH "releases/$rid" '{"draft":false,"make_latest":"true"}' > /dev/null || die "publish of draft $rid failed"
+    [ "$(api GET "git/ref/tags/$final" | json 'print(d["object"]["sha"])')" = "$commit" ] \
+        || die "published, but tag $final does not point at $commit: inspect before announcing"
+    echo "$PROG: PROMOTED $rc -> $final at $commit"
+}
+
+main() {
+    local rc='' dry=0 work=''
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return ;;
+            --dry-run) dry=1 ;;
+            --work) work=${2:-}; shift ;;
+            -h|--help) sed -n '2,31p' "${BASH_SOURCE[0]}"; return 0 ;;
+            -*) echo "$PROG: unknown flag $1" >&2; return 2 ;;
+            *) rc=$1 ;;
+        esac
+        shift
+    done
+    [ -n "$rc" ] || { echo "$PROG: usage: promote_rc.sh vX.Y.Z-rc.N [--dry-run] [--work DIR] | --self-test" >&2; return 2; }
+    [ -n "$work" ] || work=$(mktemp -d) || env_die "mktemp"
+    promote "$rc" "$dry" "$work"
+}
+
+main "$@"
diff --git a/scripts/release/rc_cut_resumable.sh b/scripts/release/rc_cut_resumable.sh
new file mode 100755
index 0000000000..6607c3ca92
--- /dev/null
+++ b/scripts/release/rc_cut_resumable.sh
@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+# rc_cut_resumable.sh -- one command cuts an rc end to end, and the SAME command finishes a cut a
+# killed session left half done (#4327, RESUMABLE-CUT)
+#
+#   rc_cut_resumable.sh --tag vX.Y.Z-rc.N --sha <40-hex>    tag -> assets -> every host -> publish
+#   rc_cut_resumable.sh --self-test                         the kill falsifier (fake GitHub + fleet)
+#
+# Steps, each receipted in the cut's ledger (lib_cut_receipt.sh) BEFORE it acts:
+#   1. rc_tag_main.sh      tag, DRAFT, dispatch binary-release.yml (a tag this cut wrote is resumed, never re-cut)
+#   2. wait (bounded) until check_release_assets.sh reports the full asset set on the draft
+#   3. rc_fleet_stage.sh --publish   every host installs + verifies, then the draft is published
+#      (a host already done is re-verified only; an asset already on a host at its sha256 is not copied)
+#
+# A session killed anywhere is finished by a NEW session running the same command: 0 manual steps.
+# The ledger lives outside any worktree (${XDG_STATE_HOME:-~/.local/state}/rc-cut/<tag>.tsv, or
+# $RC_CUT_LEDGER), so the new session finds it from any checkout on the cutting box (lambda).
+#
+#   RC_CUT_ASSET_WAIT=<s>   how long step 2 waits for binary-release.yml (default 5400)
+#
+# EXIT 0 published on every host · 1 refused or held (the tagger/stager says why) · 2 usage/ENV,
+#      or the assets never completed within RC_CUT_ASSET_WAIT.
+set -uo pipefail
+PROG=rc_cut_resumable
+HERE=${RC_CUT_HERE:-"$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"}
+. "$HERE/lib_cut_receipt.sh" || { echo "$PROG: cannot source lib_cut_receipt.sh" >&2; exit 2; }
+
+fault_point() {  # the self-test's kill -9 (RC_CUT_FAULT=<name>); a live run refuses the variable
+    [ "${RC_CUT_FAULT:-}" = "$1" ] || return 0
+    echo "$PROG: RC_CUT_FAULT=$1: kill -9 $$" >&2; kill -9 $$ $BASHPID
+}
+
+run_cut() {
+    local tag=$1 sha=$2 t0 rc deadline
+    t0=$(date +%s)
+    export RC_CUT_LEDGER=${RC_CUT_LEDGER:-$(receipt_file "$tag")}
+    echo "$PROG: ledger $RC_CUT_LEDGER"
+    bash "$HERE/rc_tag_main.sh" --tag "$tag" --sha "$sha"; rc=$?
+    [ "$rc" = 0 ] || { echo "$PROG: the tagger stopped (rc $rc): nothing staged. Re-run this command to resume." >&2; return 1; }
+
+    deadline=$((t0 + ${RC_CUT_ASSET_WAIT:-5400}))
+    until bash "$HERE/../check_release_assets.sh" "$tag" > /dev/null 2>&1; do
+        [ "$(date +%s)" -lt "$deadline" ] || { echo "$PROG: $tag lacks assets after ${RC_CUT_ASSET_WAIT:-5400}s (scripts/check_release_assets.sh $tag)" >&2; return 2; }
+        sleep "${RC_CUT_POLL:-30}"
+    done
+    fault_point before:deploy   # the operator's falsifier: tagged, nothing deployed
+
+    RC_FLEET_COMMIT=${RC_FLEET_COMMIT:-$sha} bash "$HERE/rc_fleet_stage.sh" "$tag" --publish; rc=$?
+    echo "$PROG: $tag finished rc $rc in $(( $(date +%s) - t0 ))s"
+    return "$rc"
+}
+
+self_test() {
+    local fail=0 d me tag=v9.9.9-rc.3 sha=1234567890abcdef1234567890abcdef12345678 h rc got
+    local hosts='good1 good2 good3'
+    me="$HERE/$(basename -- "${BASH_SOURCE[0]}")"
+    fkey() { printf '%s' "$1" | tr -c 'A-Za-z0-9._-' '_'; }
+    d=$(mktemp -d) || return 2
+    world() {  # a fresh fake GitHub (every judge input green) + a fresh fake fleet of three hosts
+        rm -rf -- "${d:?}/api" "${d:?}/hosts" "${d:?}/ledger.tsv" "${d:?}/scp.log" "${d:?}/gh.log"
+        mkdir -p "$d/api/get" "$d/api/code" "$d/bin" "$d/assets" "$d/pkg"
+        printf '{"status":"identical"}' > "$d/api/get/$(fkey "compare/$sha...main")"
+        printf '{"check_runs":[{"name":"ci / gate","status":"completed","conclusion":"success","started_at":"2026-09-25T20:00:00Z"}]}' \
+            > "$d/api/get/$(fkey "commits/$sha/check-runs?check_name=ci%20%2F%20gate&per_page=100")"
+        printf '{"content":"%s"}' "$(printf '[workspace.package]\nversion = "9.9.9"\n' | base64 -w0)" > "$d/api/get/$(fkey "contents/Cargo.toml?ref=$sha")"
+        printf '[]' > "$d/api/get/$(fkey "git/matching-refs/tags/$tag")"
+        echo 201 > "$d/api/code/$(fkey git/refs)"; echo 201 > "$d/api/code/releases"
+        echo 204 > "$d/api/code/$(fkey actions/workflows/binary-release.yml/dispatches)"
+        printf '# measured 2026-09-25T20:00:00Z\nlambda-labs\tapr\tGREEN\tprobe\n' > "$d/cells.tsv"
+        : > "$d/hosts.tsv"
+        for h in $hosts; do
+            mkdir -p "$d/hosts/$h/.cargo/bin"
+            printf '#!/bin/sh\necho "apr 9.9.8 (aaaaaaaaa)"\n' > "$d/hosts/$h/.cargo/bin/apr"; chmod +x "$d/hosts/$h/.cargo/bin/apr"
+            printf '%s\t%s\tx86_64-unknown-linux-gnu-cpu\tx86_64-unknown-linux-gnu\n' "$h" "$h" >> "$d/hosts.tsv"
+        done
+        local n a
+        for n in apr pv; do
+            a="$n-$tag-x86_64-unknown-linux-gnu-cpu.tar.gz"; [ "$n" = pv ] && a="pv-$tag-x86_64-unknown-linux-gnu.tar.gz"
+            rm -rf -- "${d:?}/pkg/x"; mkdir -p "$d/pkg/x"
+            if [ "$n" = apr ]; then printf '#!/bin/sh\necho "apr 9.9.9-rc.3 (123456789)"\n' > "$d/pkg/x/apr"
+            else printf '#!/bin/sh\necho "pv 9.9.9-rc.3 (aprender provable-contracts verifier)"\n' > "$d/pkg/x/pv"; fi
+            chmod +x "$d/pkg/x/$n"; tar -czf "$d/assets/$a" -C "$d/pkg" x
+            (cd "$d/assets" && sha256sum "$a" > "$a.sha256")
+        done
+        cat > "$d/bin/ssh" <<EOF
+#!/usr/bin/env bash
+while [ "\${1:-}" = -o ]; do shift 2; done
+h=\$1; shift
+[ -d "$d/hosts/\$h" ] || { echo "ssh: \$h: No route to host" >&2; exit 255; }
+export HOME="$d/hosts/\$h"; export PATH="\$HOME/.cargo/bin:/usr/bin:/bin"
+cd "\$HOME" && eval "\$*"
+EOF
+        cat > "$d/bin/scp" <<EOF
+#!/usr/bin/env bash
+args=(); for a in "\$@"; do case "\$a" in -q|-o|BatchMode=yes) ;; *) args+=("\$a") ;; esac; done
+dst=\${args[-1]}; unset 'args[-1]'; h=\${dst%%:*}; p=\${dst#*:}
+for a in "\${args[@]}"; do echo "\$h \$(basename "\$a")" >> "$d/scp.log"; done
+cp -- "\${args[@]}" "$d/hosts/\$h/\$p"
+EOF
+        echo true > "$d/isdraft"
+        cat > "$d/bin/gh" <<EOF
+#!/usr/bin/env bash
+echo "gh \$*" >> "$d/gh.log"
+case "\$1 \$2" in
+  "release download") while [ \$# -gt 0 ]; do [ "\$1" = -D ] && dst=\$2; shift; done; cp "$d/assets/"* "\$dst/" ;;
+  "release view") case "\$*" in *isDraft*) cat "$d/isdraft" ;; *) echo "notes" ;; esac ;;
+  "release edit") echo false > "$d/isdraft" ;;
+esac
+EOF
+        chmod +x "$d/bin/"*
+        bash "$HERE/../check_release_assets.sh" --list "$tag" > "$d/complete.txt"
+    }
+    session() {  # session <script>: ONE fresh session, sharing nothing with the last but the fakes and the ledger
+        rm -rf -- "${d:?}/work"; mkdir -p "$d/work"
+        env PATH="$d/bin:$PATH" TMPDIR="$d" RC_CUT_FAULT="${F:-}" RC_CUT_LEDGER="$d/ledger.tsv" \
+            RC_TAG_FAKE="$d/api" RC_TAG_CELLS="$d/cells.tsv" RC_TAG_NOW="$(date -u -d 2026-09-25T21:00:00Z +%s)" \
+            RELEASE_ASSETS_FIXTURE="$d/complete.txt" RC_FLEET_HOSTS_FILE="$d/hosts.tsv" RC_FLEET_WORK="$d/work" \
+            RC_FLEET_TODAY=2026-09-25 RC_CUT_ASSET_WAIT=5 RC_CUT_POLL=1 ${HERE_OVERRIDE:+RC_CUT_HERE=$HERE_OVERRIDE} \
+            bash "$1" --tag "$tag" --sha "$sha" > "$d/out" 2>&1
+    }
+    finished() {  # finished <label>: 1 tag, 1 draft, 1 dispatch, 0 duplicate copies, published, every host on the rc sha
+        local posts dup on=0 v
+        posts=$(cut -d' ' -f2 "$d/api/posts" 2>/dev/null | sort | uniq -c | awk '{printf "%s:%s ", $2, $1}')
+        dup=$(sort "$d/scp.log" 2>/dev/null | uniq -d | wc -l)
+        for h in $hosts; do v=$("$d/hosts/$h/.cargo/bin/apr" --version); [ "$v" = "apr 9.9.9-rc.3 (123456789)" ] && on=$((on + 1)); done
+        if [ "$posts" = "actions/workflows/binary-release.yml/dispatches:1 git/refs:1 releases:1 " ] && [ "$dup" = 0 ] \
+            && [ "$(cat "$d/isdraft")" = false ] && [ "$(grep -c -- '--draft=false' "$d/gh.log")" = 1 ] && [ "$on" = 3 ]; then
+            echo "  ok   $1: 1 tag, 1 draft, 1 dispatch, 0 duplicate copies, 1 publish, 3/3 hosts on 123456789"
+        else echo "  FAIL $1: posts '$posts', duplicate copies $dup, hosts on the rc $on/3, isDraft $(cat "$d/isdraft")"; sed 's/^/       /' "$d/out" | tail -n 8; fail=1; fi
+    }
+
+    echo "$PROG self-test: the kill falsifier (#4327 RESUMABLE-CUT)"
+    world; F='' session "$me"; rc=$?
+    [ "$rc" = 0 ] || { echo "  FAIL an uninterrupted cut: rc $rc"; tail -n 5 "$d/out"; fail=1; }
+    finished 'an uninterrupted cut'
+
+    world; { F=before:deploy session "$me"; rc=$?; } 2>/dev/null
+    if [ "$rc" = 137 ] && [ ! -s "$d/scp.log" ] && grep -q '^POST git/refs' "$d/api/posts"; then echo "  ok   killed -9 after the tag, before the first deploy (tagged, 0 copies)"
+    else echo "  FAIL the kill did not land between tag and deploy (rc $rc)"; fail=1; fi
+    F='' session "$me"; rc=$?
+    [ "$rc" = 0 ] || { echo "  FAIL the fresh session: rc $rc"; tail -n 5 "$d/out"; fail=1; }
+    finished 'a fresh session after the kill'
+    grep -q 'resume v9.9.9-rc.3' "$d/out" || { echo "  FAIL the fresh session did not RESUME the tag"; fail=1; }
+
+    for pt in after:tag after:draft after:install:good2 after:publish; do
+        world; { F=$pt session "$me"; } 2>/dev/null; F='' session "$me"; rc=$?
+        [ "$rc" = 0 ] || { echo "  FAIL killed at $pt, fresh session rc $rc"; tail -n 5 "$d/out"; fail=1; }
+        finished "killed at $pt, then a fresh session"
+    done
+    for v in RC_CUT_FAULT; do   # the fault hook on a live run (no fakes) is refused before any call
+        env -u RC_TAG_FAKE "$v=before:deploy" GH_TOKEN=unused bash "$me" --tag "$tag" --sha "$sha" > /dev/null 2>&1; rc=$?
+        if [ "$rc" = 2 ]; then echo "  ok   live run with $v set: refused (rc 2)"; else echo "  FAIL live run with $v set: rc $rc"; fail=1; fi
+    done
+
+    echo "$PROG self-test: mutant"
+    # the ledger made per-session (a new session cannot see the old one's rows): the fresh session
+    # must now fail -- the tag exists and nothing says it is this cut's -- or the resume is not the ledger's
+    mkdir -p "$d/m"; cp -- "$HERE"/*.sh "$HERE/fleet-waivers.tsv" "$d/m/"
+    sed 's|^    export RC_CUT_LEDGER=.*|    export RC_CUT_LEDGER=$(mktemp -u)|' "$me" > "$d/m/$(basename -- "$me")"
+    if cmp -s "$d/m/$(basename -- "$me")" "$me"; then echo "  FAIL ledger mutant not built: the anchor moved"; fail=1
+    else
+        world; { F=before:deploy HERE_OVERRIDE=$d/m session "$d/m/$(basename -- "$me")"; } 2>/dev/null
+        HERE_OVERRIDE=$d/m session "$d/m/$(basename -- "$me")"; rc=$?
+        if [ "$rc" != 0 ] && [ "$(grep -c '^POST git/refs' "$d/api/posts")" = 1 ] && [ ! -s "$d/scp.log" ]; then
+            echo "  ok   mutant without a shared ledger strands the killed cut (rc $rc, never re-tags): the ledger is what resumes"
+        else echo "  FAIL mutant without a shared ledger still finished (rc $rc)"; fail=1; fi
+    fi
+    rm -rf -- "${d:?}"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+main() {
+    local tag='' sha=''
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --tag) tag=${2:-}; shift 2 || return 2 ;;
+            --sha) sha=${2:-}; shift 2 || return 2 ;;
+            -h | --help) sed -n '2,22p' "${BASH_SOURCE[0]}"; return 0 ;;
+            *) echo "$PROG: unknown argument $1" >&2; return 2 ;;
+        esac
+    done
+    if [ -n "${RC_CUT_FAULT:-}${RC_CUT_HERE:-}" ] && [ -z "${RC_TAG_FAKE:-}" ]; then
+        echo "$PROG: RC_CUT_FAULT/RC_CUT_HERE are self-test only" >&2; return 2
+    fi
+    [ -n "$tag" ] && [ -n "$sha" ] || { echo "$PROG: --tag vX.Y.Z-rc.N and --sha <40-hex> are required" >&2; return 2; }
+    run_cut "$tag" "$sha"
+}
+
+main "$@"
diff --git a/scripts/release/rc_fleet_stage.sh b/scripts/release/rc_fleet_stage.sh
new file mode 100755
index 0000000000..0ca5dee36e
--- /dev/null
+++ b/scripts/release/rc_fleet_stage.sh
@@ -0,0 +1,393 @@
+#!/usr/bin/env bash
+# rc_fleet_stage.sh -- an rc is published only when every fleet host already runs it (#4327, #4328 C2)
+#
+#   rc_fleet_stage.sh vX.Y.Z-rc.N               stage + verify on every host; print the receipt
+#   rc_fleet_stage.sh vX.Y.Z-rc.N --publish     ...and on N/N flip the DRAFT to a visible prerelease
+#   rc_fleet_stage.sh --self-test               verdict table + mutants + a fake fleet (no network)
+#
+# Operator, verbatim (2026-09-24): "THE INSTANT we do a release candidate it needs to be on all
+# hardware either before or same time. change process". v0.69.3-rc.2 was published while
+# lambda still ran rc.1, intel ran an older apr, and mini had no darwin asset to install: the
+# fleet install ran on an hourly timer that nothing tied to the cut.
+#
+# THE NEW ORDER. The rc tagger creates the rc as a DRAFT release (rc_cut.sh did, until #4314
+# was superseded by rc = tag on a queue-green main; the tagger now owns that step) and binary-release.yml attaches the
+# assets to it (a draft is invisible to install.sh and to the fleet poller). This script then,
+# for every host in the fleet (lambda, gx10, yoga, intel, mini; jetson is retired, #4328 C7):
+#   1. copies the host's apr asset (+ .sha256), and pv's on linux, onto the host;
+#   2. installs it: the host's own `fleet-bins install <tag> <dir> <commit>` (infra 620249d8)
+#      when it has one,
+#      otherwise the built-in atomic install below (sha256 checked, rename over the binary
+#      PATH resolves, the previous copy kept beside it);
+#   3. verifies what PATH now resolves: `apr --version` must equal `apr <X.Y.Z-rc.N> (<sha>)`
+#      of THIS tag's commit (asset_version_check.sh, #4110), and `pv --version` its version.
+# It publishes only when every host passes. A failed host holds the rc. An unreachable host
+# holds it too -- never skipped silently (#4328 C7) -- unless a dated waiver names it:
+#   RC_FLEET_WAIVERS=FILE   lines `<host>\t<until YYYY-MM-DD>\t<reason>`, valid through `until`
+# A waiver never covers a host that was reached and failed.
+#
+# The per-host receipt (host, arch, tag, sha, path resolved, verdict) is printed, written to
+# $RC_FLEET_RECEIPT, and appended to the release notes on publish (#4327 step 5).
+#
+# Runs on lambda as the operator user: it needs ssh to the fleet and an authenticated gh (it
+# reads a draft). The fleet boxes and the CI runners have neither.
+#
+# RESUMABLE (lib_cut_receipt.sh). Each host's deploy writes `deploy <host> intent` before it copies
+# and `done` once its PATH serves this tag; the publish writes `publish intent` before the edit. A
+# re-run after a kill: a host whose deploy is done is re-VERIFIED only, never re-copied; an asset
+# already on the host with a matching sha256 is not copied again; a publish that landed (the release
+# is no longer a draft) is recorded, not re-edited.
+#
+# EXIT  0 every host passes (published with --publish) · 1 held: a host failed or was not
+#       reached · 2 usage/ENV: the release, its assets or the tag commit could not be read.
+set -uo pipefail
+PROG=rc_fleet_stage
+HERE=${RC_FLEET_HERE:-"$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"}  # a mutant copy runs from a tmp dir
+REPO=${RC_FLEET_REPO:-paiml/aprender}
+SSH=${RC_FLEET_SSH:-ssh}
+SCP=${RC_FLEET_SCP:-scp}
+. "$HERE/lib_cut_receipt.sh" || { echo "$PROG: cannot source lib_cut_receipt.sh" >&2; exit 2; }
+fault_point() {  # the self-test's kill -9 (RC_CUT_FAULT=<name>); a live run refuses the variable
+    [ "${RC_CUT_FAULT:-}" = "$1" ] || return 0
+    echo "$PROG: RC_CUT_FAULT=$1: kill -9 $$" >&2; kill -9 $$ $BASHPID   # $BASHPID too: a $(...) subshell would outlive $$ and finish the step
+}
+
+# host  ssh-target(- = this box)  apr asset suffix  pv asset suffix (- = none ships)
+FLEET_DEFAULT='lambda	-	x86_64-unknown-linux-gnu-cuda	x86_64-unknown-linux-gnu
+gx10	gx10	aarch64-unknown-linux-gnu-cuda	aarch64-unknown-linux-gnu
+yoga	yoga	x86_64-unknown-linux-gnu-cuda	x86_64-unknown-linux-gnu
+intel	intel	x86_64-unknown-linux-gnu-cpu	x86_64-unknown-linux-gnu
+mini	mini	aarch64-apple-darwin-cpu	-'
+
+# stage_verdict -- pure. stdin: rows `<host>\t<pass|fail|unreachable>`; $1 waivers text; $2 today
+# (YYYY-MM-DD). Prints `publish` or `hold <why; why>`. Returns 0 for both.
+stage_verdict() {
+    local waivers=$1 today=$2 host state why='' n=0 until
+    while IFS=$'\t' read -r host state _; do
+        [ -n "$host" ] || continue
+        n=$((n + 1))
+        case "$state" in
+            pass) ;;
+            fail) why+="$host failed; " ;;
+            unreachable)
+                until=$(printf '%s\n' "$waivers" | awk -F'\t' -v h="$host" '$1==h {print $2}' | sort | tail -n 1)
+                if [ -n "$until" ] && [[ "$until" > "$today" || "$until" = "$today" ]]; then :
+                else why+="$host unreachable (no waiver through $today); "; fi ;;
+            *) why+="$host state '$state'; " ;;
+        esac
+    done
+    [ "$n" -gt 0 ] || why='no hosts; '
+    if [ -z "$why" ]; then echo publish; else echo "hold ${why%; }"; fi
+}
+
+# ---- the remote side: one bash script, run on the host with its login PATH ------------
+# args: <dir, relative to $HOME> <bin> <asset>. Prints one line: INSTALLED <path> | <REASON> <detail>.
+INSTALL_SH='set -u
+d=$HOME/$1 bin=$2 asset=$3
+cd "$d" || { echo "NO-DIR $d"; exit 1; }
+want=$(cut -d" " -f1 "$asset.sha256" 2>/dev/null)
+if command -v sha256sum >/dev/null 2>&1; then got=$(sha256sum "$asset" | cut -d" " -f1); else got=$(shasum -a 256 "$asset" | cut -d" " -f1); fi
+[ -n "$want" ] && [ "$got" = "$want" ] || { echo "SHA-MISMATCH $asset want=$want got=$got"; exit 1; }
+rm -rf -- "${d:?}/x" && mkdir x && tar -xzf "$asset" -C x || { echo "UNTAR $asset"; exit 1; }
+new=$(find x -type f -name "$bin" | head -n 1)
+[ -n "$new" ] || { echo "NO-BINARY $bin in $asset"; exit 1; }
+chmod 0755 "$new"
+tgt=$(command -v "$bin" 2>/dev/null || true)
+case "$tgt" in /*) ;; *) tgt=$HOME/.cargo/bin/$bin; mkdir -p "$HOME/.cargo/bin" ;; esac
+dir=$(dirname "$tgt"); run=
+if [ ! -w "$dir" ]; then
+    if sudo -n true 2>/dev/null; then run="sudo -n"; else echo "NOT-WRITABLE $dir (no passwordless sudo)"; exit 1; fi
+fi
+[ -e "$tgt" ] && $run cp -p "$tgt" "$dir/.$bin.rc-stage.prev"
+$run cp "$new" "$dir/.$bin.rc-stage.new" && $run mv -f "$dir/.$bin.rc-stage.new" "$tgt" || { echo "SWAP $tgt"; exit 1; }
+echo "INSTALLED $tgt"'
+
+rx() {  # rx <ssh-target> <command string> -> runs it under a login bash on the host
+    if [ "$1" = - ]; then bash -lc "$2"; else "$SSH" -o BatchMode=yes -o ConnectTimeout=10 "$1" "bash -lc $(printf '%q' "$2")"; fi
+}
+rx_script() {  # rx_script <ssh-target> <args...> < script
+    local t=$1; shift
+    if [ "$t" = - ]; then bash -l -s -- "$@"; else "$SSH" -o BatchMode=yes -o ConnectTimeout=10 "$t" "bash -l -s -- $(printf '%q ' "$@")"; fi
+}
+put() {  # put <ssh-target> <remote dir, relative to $HOME> <files...>
+    local t=$1 d=$2; shift 2
+    if [ "$t" = - ]; then mkdir -p "$HOME/$d" && cp -- "$@" "$HOME/$d/"; else rx "$t" "mkdir -p \"\$HOME/$d\"" && "$SCP" -q -o BatchMode=yes "$@" "$t:$d/"; fi
+}
+sha_of() { if command -v sha256sum > /dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi; }
+put_asset() {  # put_asset <ssh-target> <remote dir> <asset>: copy asset + .sha256 unless the host has both at this sha256
+    local t=$1 d=$2 a=$3 b want have
+    b=$(basename -- "$a"); want=$(sha_of "$a") || return 1
+    have=$(rx "$t" "cd \"\$HOME/$d\" 2>/dev/null && [ \"\$(cut -d' ' -f1 $b.sha256 2>/dev/null)\" = $want ] && { sha256sum $b 2>/dev/null || shasum -a 256 $b; } | cut -d' ' -f1" 2>/dev/null | tail -n 1)
+    if [ "$have" = "$want" ]; then echo "$PROG: $b already on the host at sha256 ${want:0:12}: not copied" >&2; return 0; fi
+    put "$t" "$d" "$a" "$a.sha256"
+}
+
+# stage_host <name> <ssh> <apr suffix> <pv suffix> <tag> <commit> <assets dir>
+# prints one receipt row: host arch tag sha path verdict detail
+stage_host() {
+    local h=$1 t=$2 as=$3 ps=$4 tag=$5 commit=$6 ad=$7 rdir out arch path line pvline detail='' ok=1 f verdict
+    rdir=.cache/rc-stage/$tag
+    if ! arch=$(rx "$t" 'uname -sm' 2>/dev/null | tr ' ' '-') || [ -z "$arch" ]; then
+        printf '%s\t?\t%s\t%s\t-\tunreachable\tssh %s failed\n' "$h" "$tag" "${commit:0:9}" "$t"; return 0
+    fi
+    if [ "$(receipt_state "$tag" deploy "$h")" = done ] && [ "$(receipt_detail "$tag" deploy "$h")" = "$commit" ]; then
+        detail+="deployed by an earlier session: re-verified only; "
+    else
+    receipt_write "$tag" deploy "$h" intent "$commit" || { printf '%s\t%s\t%s\t%s\t-\tfail\tcannot write the ledger\n' "$h" "$arch" "$tag" "${commit:0:9}"; return 0; }
+    local staged=()  # bin:asset pairs copied onto the host
+    for f in "apr:$as" "pv:$ps"; do
+        local bin=${f%%:*} sfx=${f#*:} asset
+        [ "$sfx" = - ] && { detail+="$bin: no asset ships for this host; "; continue; }
+        asset="$bin-$tag-$sfx.tar.gz"
+        [ -f "$ad/$asset" ] && [ -f "$ad/$asset.sha256" ] || { ok=0; detail+="$bin: $asset not downloaded; "; continue; }
+        put_asset "$t" "$rdir" "$ad/$asset" || { ok=0; detail+="$bin: copy failed; "; continue; }
+        staged+=("$f")
+    done
+    if [ "${#staged[@]}" -gt 0 ] && rx "$t" 'command -v fleet-bins' > /dev/null 2>&1; then
+        # infra's installer (620249d8): verifies each .sha256, swaps atomically, records the
+        # commit, never downgrades. Its rc is the verdict, not its prose.
+        out=$(rx "$t" "fleet-bins install $(printf '%q' "$tag") \"\$HOME/$rdir\" $commit" 2>&1) \
+            || { ok=0; detail+="fleet-bins install: $(printf '%s' "$out" | tail -n 1); "; }
+    else
+        for f in "${staged[@]}"; do
+            out=$(rx_script "$t" "$rdir" "${f%%:*}" "${f%%:*}-$tag-${f#*:}.tar.gz" <<< "$INSTALL_SH" 2>&1 | tail -n 1)
+            case "$out" in INSTALLED*) ;; *) ok=0; detail+="${f%%:*}: install: $out; " ;; esac
+        done
+    fi
+    fault_point "after:install:$h"
+    fi
+    # Verify what PATH resolves NOW -- not the file just written: a shadow earlier on PATH
+    # would keep serving the old build (lambda's ~/.cargo/bin +no-git copy, #4327).
+    path=$(rx "$t" 'command -v apr' 2>/dev/null | tail -n 1)
+    line=$(rx "$t" 'apr --version' 2>/dev/null | head -n 1)
+    if ! out=$(bash "$HERE/asset_version_check.sh" "$tag" "$commit" "$line" 2>&1); then ok=0; detail+="apr: $out; "; fi
+    if [ "$ps" != - ]; then
+        pvline=$(rx "$t" 'pv --version' 2>/dev/null | head -n 1)
+        [ "$(printf '%s' "$pvline" | cut -d' ' -f1,2)" = "pv ${tag#v}" ] || { ok=0; detail+="pv: '$pvline' is not pv ${tag#v}; "; }
+    fi
+    verdict=$([ "$ok" = 1 ] && echo pass || echo fail)
+    receipt_write "$tag" deploy "$h" "$([ "$ok" = 1 ] && echo done || echo fail)" "$commit"
+    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$h" "$arch" "$tag" "${commit:0:9}" "${path:--}" "$verdict" "${detail%; }"
+}
+
+tag_commit() {  # the commit a tag names (annotated tags dereferenced)
+    [ -n "${RC_FLEET_COMMIT:-}" ] && { echo "$RC_FLEET_COMMIT"; return 0; }
+    local refs
+    refs=$(git ls-remote "https://github.com/$REPO" "refs/tags/$1" "refs/tags/$1^{}") || return 2
+    printf '%s\n' "$refs" | awk '/\^\{\}$/ {d=$1} {p=$1} END {print (d != "" ? d : p)}'
+}
+
+stage() {
+    local tag=$1 publish=$2 commit work rows verdict today hosts receipt waivers='' n pass
+    [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]] || { echo "$PROG: $tag is not vX.Y.Z-rc.N" >&2; return 2; }
+    commit=$(tag_commit "$tag") && [[ "$commit" =~ ^[0-9a-f]{40}$ ]] || { echo "$PROG: cannot resolve the commit of $tag" >&2; return 2; }
+    bash "$HERE/../check_release_assets.sh" "$tag" > /dev/null || { echo "$PROG: $tag does not carry every asset yet (scripts/check_release_assets.sh $tag)" >&2; return 2; }
+    work=${RC_FLEET_WORK:-$(mktemp -d)} || return 2
+    gh release download "$tag" -R "$REPO" -D "$work" --clobber -p "apr-$tag-*" -p "pv-$tag-*" > /dev/null 2>&1 \
+        || { echo "$PROG: cannot download the assets of $tag" >&2; return 2; }
+    hosts=${RC_FLEET_HOSTS_FILE:+$(grep -vE '^\s*(#|$)' "$RC_FLEET_HOSTS_FILE")}
+    hosts=${hosts:-$FLEET_DEFAULT}
+    [ -n "${RC_FLEET_WAIVERS:-}" ] && waivers=$(grep -vE '^\s*(#|$)' "$RC_FLEET_WAIVERS")
+    rows=$(while IFS=$'\t' read -r h t as ps; do stage_host "$h" "$t" "$as" "$ps" "$tag" "$commit" "$work"; done <<< "$hosts")
+    today=${RC_FLEET_TODAY:-$(date -u +%F)}
+    verdict=$(printf '%s\n' "$rows" | awk -F'\t' '{print $1 "\t" $6}' | stage_verdict "$waivers" "$today")
+    n=$(printf '%s\n' "$rows" | grep -c .); pass=$(printf '%s\n' "$rows" | awk -F'\t' '$6=="pass"' | grep -c .)
+    receipt=${RC_FLEET_RECEIPT:-$work/receipt.md}
+    {
+        echo "### Fleet staging of $tag at ${commit:0:9}: $pass/$n hosts (#4327)"
+        echo
+        echo "| host | arch | tag | sha | path resolved | verdict | detail |"
+        echo "|---|---|---|---|---|---|---|"
+        printf '%s\n' "$rows" | awk -F'\t' '{printf "| %s | %s | %s | %s | %s | %s | %s |\n", $1,$2,$3,$4,$5,($6=="pass"?"PASS":toupper($6)),$7}'
+        echo
+        echo "verdict: $verdict"
+    } > "$receipt"
+    cat "$receipt"
+    case "$verdict" in
+        publish) ;;
+        *) echo "$PROG: HELD -- $tag stays a draft" >&2; return 1 ;;
+    esac
+    [ "$publish" = 1 ] || { echo "(no --publish: $tag stays a draft)"; return 0; }
+    local body st
+    st=$(receipt_state "$tag" publish "$tag")
+    [ "$st" = done ] && { echo "PUBLISHED $tag: by an earlier session (ledger); $pass/$n hosts re-verified"; return 0; }
+    if [ "$st" = intent ]; then   # killed mid-publish: ask GitHub whether the edit landed, never append the notes twice
+        case "$(gh release view "$tag" -R "$REPO" --json isDraft -q .isDraft 2>/dev/null)" in
+            false) receipt_write "$tag" publish "$tag" done "found on resume"; echo "PUBLISHED $tag: the edit landed before the kill; $pass/$n hosts re-verified"; return 0 ;;
+            true) ;;
+            *) echo "$PROG: cannot read whether $tag is still a draft" >&2; return 2 ;;
+        esac
+    fi
+    receipt_write "$tag" publish "$tag" intent || { echo "$PROG: cannot write the ledger $(receipt_file "$tag")" >&2; return 2; }
+    body=$(gh release view "$tag" -R "$REPO" --json body -q .body) || { echo "$PROG: cannot read the notes of $tag" >&2; return 2; }
+    printf '%s\n\n%s\n' "$body" "$(cat "$receipt")" > "$work/notes.md"
+    gh release edit "$tag" -R "$REPO" --draft=false --prerelease --latest=false --notes-file "$work/notes.md" > /dev/null \
+        || { echo "$PROG: every host passed but publishing $tag failed" >&2; return 2; }
+    fault_point after:publish
+    receipt_write "$tag" publish "$tag" done
+    echo "PUBLISHED $tag: on $pass/$n fleet hosts before it was visible"
+}
+
+# ---- self-test ---------------------------------------------------------------------
+self_test() {
+    local fail=0 got d mut rc log F='' KEEP=''
+    v() {  # v <want> <label> <rows> [waivers] [today]
+        got=$(printf '%b' "$3" | stage_verdict "${4:-}" "${5:-2026-09-24}")
+        if [ "$got" = "$1" ]; then echo "  ok   $2"; else printf '  FAIL %s\n       want: %s\n       got:  %s\n' "$2" "$1" "$got"; fail=1; fi
+    }
+    echo "$PROG self-test: stage_verdict"
+    v publish 'every host passes -> publish' 'lambda\tpass\ngx10\tpass\nmini\tpass\n'
+    v 'hold gx10 failed' 'ONE host failing holds the rc' 'lambda\tpass\ngx10\tfail\nmini\tpass\n'
+    v 'hold intel unreachable (no waiver through 2026-09-24)' 'an unreachable host is RED, never skipped (#4328 C7)' 'lambda\tpass\nintel\tunreachable\n'
+    v publish 'a dated waiver through today covers an unreachable host' 'lambda\tpass\nintel\tunreachable\n' $'intel\t2026-09-24\tmaintenance'
+    v 'hold intel unreachable (no waiver through 2026-09-24)' 'an expired waiver covers nothing' 'lambda\tpass\nintel\tunreachable\n' $'intel\t2026-09-23\tmaintenance'
+    v 'hold intel failed' 'a waiver never covers a host that was reached and failed' 'lambda\tpass\nintel\tfail\n' $'intel\t2026-12-31\tx'
+    v 'hold no hosts' 'no hosts is not N/N' ''
+    v "hold yoga state 'maybe'" 'an unknown state holds' 'yoga\tmaybe\n'
+
+    # MUTANTS: the refusal made a no-op must PUBLISH past the bad host, or the rows above are
+    # not what refuses it. (Deleting the arm alone is not a mutant: the catch-all holds too.)
+    mutant() {  # mutant <label> <sed expr> <rows>
+        mut=$(mktemp) || return 2
+        sed "$2" "${BASH_SOURCE[0]}" > "$mut"
+        if cmp -s "$mut" "${BASH_SOURCE[0]}"; then echo "  FAIL mutant '$1' not built: the anchor moved"; fail=1
+        else
+            got=$(printf '%b' "$3" | RC_FLEET_HERE=$HERE bash -c ". '$mut' --source-only; stage_verdict '' 2026-09-24")
+            if [ "$got" = publish ]; then echo "  ok   mutant '$1' publishes past the bad host: the refusal is load-bearing"
+            else echo "  FAIL mutant '$1' still says '$got': something else refuses"; fail=1; fi
+        fi
+        rm -f -- "$mut"
+    }
+    mutant 'fail arm is a no-op' 's/fail) why+="\$host failed; " ;;/fail) ;;/' 'lambda\tpass\ngx10\tfail\n'
+    mutant 'unreachable counts as pass' 's/^            unreachable)$/            unreachable) continue ;; x)/' 'lambda\tpass\nintel\tunreachable\n'
+
+    # A FAKE FLEET, end to end: three hosts behind a fake ssh/scp/gh. The operator's
+    # acceptance (#4327): "a cut where one host fails verify does NOT publish".
+    d=$(mktemp -d) || return 2
+    local tag=v9.9.9-rc.3 sha=1234567890abcdef1234567890abcdef12345678 h
+    mkdir -p "$d/bin" "$d/assets" "$d/pkg"
+    for h in good1 good2 bad; do mkdir -p "$d/hosts/$h/.cargo/bin"; done
+    fake_bin() {  # fake_bin <name> <version line> -> a tarball + .sha256 in $d/assets
+        local n=$1 a
+        a="$n-$tag-x86_64-unknown-linux-gnu-${3:-cpu}.tar.gz"; [ "$n" = pv ] && a="pv-$tag-x86_64-unknown-linux-gnu.tar.gz"
+        rm -rf -- "${d:?}/pkg/x"; mkdir -p "$d/pkg/x"
+        printf '#!/bin/sh\necho "%s"\n' "$2" > "$d/pkg/x/$n"; chmod +x "$d/pkg/x/$n"
+        tar -czf "$d/assets/$a" -C "$d/pkg" x
+        (cd "$d/assets" && sha256sum "$a" > "$a.sha256")
+    }
+    fake_bin apr "apr 9.9.9-rc.3 (123456789)"
+    fake_bin pv "pv 9.9.9-rc.3 (aprender provable-contracts verifier)"
+    # the bad host runs an old apr and a fleet-bins that SAYS installed and swaps nothing:
+    # only verifying what PATH serves afterwards can see it (the installer is not trusted)
+    mkdir -p "$d/hosts/bad/shadow"; printf '#!/bin/sh\necho "apr 9.9.9 (v9.9.9+no-git)"\n' > "$d/hosts/bad/shadow/apr"
+    printf '#!/bin/sh\necho "apr INSTALLED $2"\n' > "$d/hosts/bad/shadow/fleet-bins"
+    # ...and an already-current pv, so apr's verify is the ONLY thing that can hold it
+    printf '#!/bin/sh\necho "pv 9.9.9-rc.3 (aprender provable-contracts verifier)"\n' > "$d/hosts/bad/shadow/pv"; chmod +x "$d/hosts/bad/shadow/"*
+    log=$d/gh.log
+    # fake ssh: `ssh -o .. -o .. HOST CMD` runs CMD with HOME and PATH of that host
+    cat > "$d/bin/ssh" <<EOF
+#!/usr/bin/env bash
+while [ "\${1:-}" = -o ]; do shift 2; done
+h=\$1; shift
+[ -d "$d/hosts/\$h" ] || { echo "ssh: connect to host \$h: No route to host" >&2; exit 255; }
+export HOME="$d/hosts/\$h"; export PATH="\$HOME/shadow:\$HOME/.cargo/bin:/usr/bin:/bin"
+cd "\$HOME" && eval "\$*"
+EOF
+    cat > "$d/bin/scp" <<EOF
+#!/usr/bin/env bash
+args=(); for a in "\$@"; do case "\$a" in -q|-o|BatchMode=yes) ;; *) args+=("\$a") ;; esac; done
+dst=\${args[-1]}; unset 'args[-1]'; h=\${dst%%:*}; p=\${dst#*:}
+for a in "\${args[@]}"; do echo "\$h \$(basename "\$a")" >> "$d/scp.log"; done
+cp -- "\${args[@]}" "$d/hosts/\$h/\$p"
+EOF
+    cat > "$d/bin/gh" <<EOF
+#!/usr/bin/env bash
+echo "gh \$*" >> "$log"
+case "\$1 \$2" in
+  "release download") while [ \$# -gt 0 ]; do [ "\$1" = -D ] && dst=\$2; shift; done; cp "$d/assets/"* "\$dst/" ;;
+  "release view") case "\$*" in *isDraft*) cat "$d/isdraft" ;; *) echo "notes" ;; esac ;;
+  "release edit") echo false > "$d/isdraft" ;;
+esac
+EOF
+    chmod +x "$d/bin/"*
+    printf '%s\n' "apr-$tag-x86_64-unknown-linux-gnu-cpu.tar.gz" > "$d/assets.list"
+    run_fleet() {  # run_fleet <hosts...> -> rc of a --publish run over those hosts (of $self)
+        printf '' > "$log"; : > "$d/hosts.tsv"; [ -n "${KEEP:-}" ] || { echo true > "$d/isdraft"; rm -f -- "${d:?}/ledger.tsv" "${d:?}/scp.log"; }
+        for h in "$@"; do printf '%s\t%s\tx86_64-unknown-linux-gnu-cpu\tx86_64-unknown-linux-gnu\n' "$h" "$h" >> "$d/hosts.tsv"; done
+        PATH="$d/bin:$PATH" RC_FLEET_COMMIT=$sha RC_FLEET_HOSTS_FILE="$d/hosts.tsv" RC_FLEET_WORK="$d/work" \
+            RELEASE_ASSETS_FIXTURE="$d/complete.txt" RC_FLEET_TODAY=2026-09-24 \
+            RC_CUT_LEDGER="$d/ledger.tsv" RC_CUT_FAULT=${F:-} RC_FLEET_HERE=$HERE bash "$self" "$tag" --publish > "$d/out.txt" 2>&1
+    }
+    bash "$HERE/../check_release_assets.sh" --list "$tag" > "$d/complete.txt"
+    mkdir -p "$d/work"
+    e2e() {  # e2e <want rc> <want edit 0|1> <label> <hosts...>
+        local wrc=$1 wedit=$2 label=$3; shift 3
+        rm -rf -- "${d:?}/work"; mkdir -p "$d/work"
+        run_fleet "$@"; rc=$?
+        local edited=0; grep -q '^gh release edit' "$log" && edited=1
+        if [ "$rc" = "$wrc" ] && [ "$edited" = "$wedit" ]; then echo "  ok   $label (rc $rc, published=$edited)"
+        else echo "  FAIL $label: rc $rc (want $wrc), published=$edited (want $wedit)"; sed 's/^/       /' "$d/out.txt"; fail=1; fi
+    }
+    echo "$PROG self-test: a fake fleet, end to end"
+    local self=${BASH_SOURCE[0]}
+    e2e 0 1 'every host installs and verifies -> the draft is published' good1 good2
+    grep -q -- '--draft=false' "$log" || { echo "  FAIL publish did not flip --draft=false"; fail=1; }
+    grep -q '| good2 | .* | PASS |' "$d/work/receipt.md" || { echo "  FAIL receipt has no PASS row for good2"; fail=1; }
+    e2e 1 0 'ONE host whose PATH resolves an old apr -> NOT published (operator acceptance, #4327)' good1 bad good2
+    grep -q 'bad.*FAIL.*wants 9.9.9-rc.3' "$d/work/receipt.md" || { echo "  FAIL the bad host's row does not name the version it served"; fail=1; }
+    e2e 1 0 'an unreachable host -> NOT published (#4328 C7)' good1 gone
+    # RESUME: kill -9 mid-fleet (good2 installed, not verified), then a fresh run. good1 is done:
+    # re-verified, never re-copied. good2's assets are on it at the right sha256: not re-copied.
+    rm -rf -- "${d:?}/hosts/good1/.cache" "${d:?}/hosts/good2/.cache"
+    { F=after:install:good2 run_fleet good1 good2; rc=$?; } 2>/dev/null
+    KEEP=1 run_fleet good1 good2; local rc2=$?
+    got=$(sort "$d/scp.log" | uniq -c | awk '$1 > 1' | wc -l)
+    if [ "$rc" = 137 ] && [ "$rc2" = 0 ] && [ "$got" = 0 ] && [ "$(wc -l < "$d/scp.log")" = 8 ] \
+        && grep -q 're-verified only' "$d/out.txt" && grep -q 'not copied' "$d/out.txt" && [ "$(grep -c -- '--draft=false' "$log")" = 1 ]; then
+        echo "  ok   killed mid-fleet, resumed: each asset copied once per host (8 copies), good1 re-verified only, 1 publish"
+    else echo "  FAIL resume mid-fleet: rc $rc/$rc2, duplicate copies $got, copies $(wc -l < "$d/scp.log")"; sed 's/^/       /' "$d/out.txt"; fail=1; fi
+    # killed after the publish edit landed: the re-run records it and does not edit (or append notes) again
+    { F=after:publish run_fleet good1 good2; } 2>/dev/null; KEEP=1 run_fleet good1 good2; rc=$?
+    if [ "$rc" = 0 ] && ! grep -q '^gh release edit' "$log" && grep -q 'landed before the kill' "$d/out.txt"; then
+        echo "  ok   killed after the publish landed: the re-run records it, no second edit"
+    else echo "  FAIL resume after publish: rc $rc"; sed 's/^/       /' "$d/out.txt"; fail=1; fi
+    # MUTANT: the sha256 skip deleted -- the resumed run must re-copy what good2 already has
+    self=$d/mutant.sh
+    sed 's/if \[ "$have" = "$want" \]; then/if false; then/' "${BASH_SOURCE[0]}" > "$self"
+    if cmp -s "$self" "${BASH_SOURCE[0]}"; then echo "  FAIL skip mutant not built: the anchor moved"; fail=1
+    else
+        rm -rf -- "${d:?}/hosts/good1/.cache" "${d:?}/hosts/good2/.cache"
+        { F=after:install:good2 run_fleet good1 good2; } 2>/dev/null; KEEP=1 run_fleet good1 good2
+        if [ "$(sort "$d/scp.log" | uniq -c | awk '$1 > 1' | wc -l)" -gt 0 ]; then echo "  ok   mutant without the sha256 skip copies good2's assets twice: the skip is load-bearing"
+        else echo "  FAIL mutant without the sha256 skip copied nothing twice"; fail=1; fi
+    fi
+    self=${BASH_SOURCE[0]}
+    # MUTANT: the per-host verify deleted -- the lying installer's host must now get published
+    self=$d/mutant.sh
+    sed 's/if ! out=$(bash "$HERE\/asset_version_check.sh"/if false \&\& out=$(bash "$HERE\/asset_version_check.sh"/' "${BASH_SOURCE[0]}" > "$self"
+    if cmp -s "$self" "${BASH_SOURCE[0]}"; then echo "  FAIL verify mutant not built: the anchor moved"; fail=1
+    else e2e 0 1 'mutant (asset_version_check deleted) publishes past the lying host: the verify is what holds it' good1 bad good2; fi
+    rm -rf -- "${d:?}"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+main() {
+    local tag='' publish=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --source-only) return 0 ;;
+            --publish) publish=1; shift ;;
+            -h|--help) sed -n '2,40p' "${BASH_SOURCE[0]}"; return 0 ;;
+            v*) tag=$1; shift ;;
+            *) echo "$PROG: unknown argument $1" >&2; return 2 ;;
+        esac
+    done
+    if [ -n "${RC_CUT_FAULT:-}" ] && [ -z "${RC_FLEET_COMMIT:-}" ]; then echo "$PROG: RC_CUT_FAULT is self-test only" >&2; return 2; fi
+    [ -n "$tag" ] || { echo "usage: $PROG vX.Y.Z-rc.N [--publish] | --self-test" >&2; return 2; }
+    stage "$tag" "$publish"
+}
+
+if [ "${1:-}" = --source-only ]; then return 0 2>/dev/null || exit 0; fi
+main "$@"
diff --git a/scripts/release/rc_tag_main.sh b/scripts/release/rc_tag_main.sh
new file mode 100755
index 0000000000..e2bfd2f90d
--- /dev/null
+++ b/scripts/release/rc_tag_main.sh
@@ -0,0 +1,329 @@
+#!/usr/bin/env bash
+# rc_tag_main.sh -- the rc tagger: tag vX.Y.Z-rc.N on a queue-green main commit (#4327, #4328 C4)
+#
+#   rc_tag_main.sh --tag vX.Y.Z-rc.N --sha <40-hex> [--dry-run]   judge, then cut
+#   rc_tag_main.sh --self-test                                     case table + fake API + mutant
+#
+# Operator ruling 2026-09-25 16:58: an rc is a tag on a queue-green main, cut within 5 min.
+# This script replaces rc_cut.sh (#4285, cut on the tip of release/X.Y.Z), which that ruling
+# superseded. In order:
+#   1. judge  -- the commit is on main (it is main's head or an ancestor of it), `ci / gate`
+#                completed with success on it, its Cargo.toml reads X.Y.Z, and no tag of that
+#                name exists yet. Any miss refuses and writes nothing.
+#   2. fleet  -- scripts/release/fleet_cells_gate.sh on infra-64's cells (fleet/cells.tsv on
+#                the fleet-state branch) with scripts/release/fleet-waivers.tsv. A RED cell
+#                without a dated waiver, or missing or stale cells, refuses and writes nothing.
+#   3. tag    -- POST git/refs. The name is the lock: a concurrent cut gets 422 here.
+#   4. draft  -- POST releases as a DRAFT prerelease, never latest. A draft is invisible to
+#                install.sh and to the fleet poller (#4327).
+#   5. dispatch binary-release.yml -f tag=<tag>: creating a draft emits `created`, not
+#                `published`, so nothing else starts the asset build.
+# Next, by hand or by the caller: scripts/release/rc_fleet_stage.sh <tag> --publish.
+#
+# RESUMABLE (lib_cut_receipt.sh). Each write above is preceded by an `intent` row in the cut's
+# ledger and followed by a `done` row. A session killed anywhere in 3-5 is finished by running the
+# same command again: a tag that exists AT THIS SHA and that the ledger says this cut wrote is
+# `resume`, not `refuse`; a draft that exists is not re-created; a dispatch whose run exists is not
+# re-sent. A tag the ledger does not know about (someone else's) still refuses.
+#
+# GitHub is read and written with curl + jq. GH_TOKEN is taken from `gh auth token` when unset.
+# EXIT 0 cut (or --dry-run would cut) · 1 refused or a write failed · 2 usage / cannot read.
+set -uo pipefail
+PROG=rc_tag_main
+HERE=${RC_TAG_HERE:-"$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"}   # a mutant copy runs from a tmp dir
+REPO=${RC_TAG_REPO:-paiml/aprender}
+. "$HERE/lib_cut_receipt.sh" || { echo "rc_tag_main: cannot source lib_cut_receipt.sh" >&2; exit 2; }
+# The input overrides are for the self-test's fake only. On a live run, a green cells file, a moved clock or a
+# mutant gate would each write a real tag past the fleet gate, so a live run refuses to start when any is set.
+if [ "${1:-}" != --self-test ] && [ -z "${RC_TAG_FAKE:-}" ] && [ -n "${RC_TAG_HERE:-}${RC_TAG_CELLS:-}${RC_TAG_NOW:-}${RC_CUT_FAULT:-}" ]; then
+    echo "$PROG: RC_TAG_HERE/RC_TAG_CELLS/RC_TAG_NOW/RC_CUT_FAULT are self-test only (RC_TAG_FAKE unset): refusing a live run" >&2; exit 2
+fi
+
+# rc_tag_decide -- pure. Reads D_TAG D_SHA D_ON_MAIN D_GATE D_VERSION D_TAG_AT D_OURS.
+# Prints `cut <tag> <sha>`, `resume <tag> <sha>` or `refuse <why>`. Returns 0 for all three.
+# D_OURS=1: this cut's ledger holds a tag intent for exactly this sha (the tag may be ours).
+rc_tag_decide() {
+    local x
+    [[ "${D_TAG:-}" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)-rc\.[1-9][0-9]*$ ]] \
+        || { printf 'refuse tag %s is not vX.Y.Z-rc.N\n' "${D_TAG:-?}"; return 0; }
+    x=${BASH_REMATCH[1]}
+    [[ "${D_SHA:-}" =~ ^[0-9a-f]{40}$ ]] || { printf 'refuse sha %s is not a full 40-hex commit\n' "${D_SHA:-?}"; return 0; }
+    case "${D_ON_MAIN:-}" in
+        identical | ahead) ;;   # compare <sha>...main: main is the commit, or is ahead of it
+        *) printf 'refuse %s is not on main (compare: %s)\n' "${D_SHA:0:9}" "${D_ON_MAIN:-unread}"; return 0 ;;
+    esac
+    [ "${D_GATE:-}" = "completed success" ] \
+        || { printf 'refuse ci / gate on %s is %s, not completed success\n' "${D_SHA:0:9}" "${D_GATE:-absent}"; return 0; }
+    [ "${D_VERSION:-}" = "$x" ] \
+        || { printf 'refuse Cargo.toml@%s reads %s, the tag wants %s\n' "${D_SHA:0:9}" "${D_VERSION:-?}" "$x"; return 0; }
+    [ "${D_TAG_AT:-}" != '?unread' ] || { printf 'refuse cannot read whether %s exists\n' "$D_TAG"; return 0; }
+    if [ -n "${D_TAG_AT:-}" ]; then
+        [ "$D_TAG_AT" = "$D_SHA" ] && [ "${D_OURS:-}" = 1 ] && { printf 'resume %s %s\n' "$D_TAG" "$D_SHA"; return 0; }
+        printf 'refuse %s already exists at %s\n' "$D_TAG" "${D_TAG_AT:0:9}"; return 0
+    fi
+    printf 'cut %s %s\n' "$D_TAG" "$D_SHA"
+}
+
+# ---- I/O: GitHub REST via curl + jq. RC_TAG_FAKE=<dir> swaps in the self-test's fake. ----
+fkey() { printf '%s' "$1" | tr -c 'A-Za-z0-9._-' '_'; }
+api_get() {  # api_get PATH -> body on stdout; returns 2 on any failure
+    if [ -n "${RC_TAG_FAKE:-}" ]; then cat -- "$RC_TAG_FAKE/get/$(fkey "$1")" 2>/dev/null || return 2; return 0; fi
+    curl -sSf -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
+        "https://api.github.com/repos/$REPO${1:+/$1}" || return 2
+}
+api_post() {  # api_post PATH JSON -> line 1 is the HTTP code, the rest is the body
+    local out code
+    if [ -n "${RC_TAG_FAKE:-}" ]; then
+        printf 'POST %s %s\n' "$1" "$2" >> "$RC_TAG_FAKE/posts"
+        code=$(cat -- "$RC_TAG_FAKE/code/$(fkey "$1")" 2>/dev/null) || code=500
+        case "$code $1" in   # a stateful fake: what a POST creates, a later GET sees (the resume path reads it)
+            "201 git/refs") printf '[{"ref":"%s","object":{"sha":"%s"}}]' "$(jq -r .ref <<< "$2")" "$(jq -r .sha <<< "$2")" \
+                > "$RC_TAG_FAKE/get/$(fkey "git/matching-refs/tags/$(jq -r '.ref | ltrimstr("refs/tags/")' <<< "$2")")" ;;
+            "201 releases") jq -c '[{tag_name: .tag_name, draft: true}]' <<< "$2" > "$RC_TAG_FAKE/get/$(fkey releases?per_page=100)" ;;
+            "204 actions/workflows/binary-release.yml/dispatches")
+                printf '{"workflow_runs":[{"created_at":"%s"}]}' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+                    > "$RC_TAG_FAKE/get/$(fkey "actions/workflows/binary-release.yml/runs?event=workflow_dispatch&per_page=30")" ;;
+        esac
+        echo "$code"; return 0
+    fi
+    out=$(mktemp) || return 2
+    code=$(curl -sS -o "$out" -w '%{http_code}' -X POST -H "Authorization: Bearer $GH_TOKEN" \
+        -H "Accept: application/vnd.github+json" "https://api.github.com/repos/$REPO/$1" -d "$2") || { rm -f -- "${out:?}"; return 2; }
+    printf '%s\n' "$code"; cat -- "$out"; rm -f -- "${out:?}"
+}
+post_ok() {  # post_ok <want code> <what> <api_post output>
+    local code; code=$(printf '%s\n' "$3" | head -1)
+    [ "$code" = "$1" ] && return 0
+    printf '%s: %s returned HTTP %s: %s\n' "$PROG" "$2" "$code" "$(printf '%s\n' "$3" | tail -n +2 | head -c 400)" >&2
+    return 1
+}
+b64file() { jq -r '.content' | tr -d '\n' | base64 -d 2>/dev/null; }   # contents API -> the file
+fault_point() {  # fault_point <name>: the self-test's kill -9 (RC_CUT_FAULT=<name>); live runs refuse the variable
+    [ "${RC_CUT_FAULT:-}" = "$1" ] || return 0
+    echo "$PROG: RC_CUT_FAULT=$1: kill -9 $$" >&2; kill -9 $$ $BASHPID   # $BASHPID too: a $(...) subshell would outlive $$ and finish the step
+}
+# step_needed <tag> <step> <world-check fn>: 0 = act now, 1 = already done (skip), 2 = cannot tell (refuse).
+# done -> skip. No row -> act. `intent` -> the session died mid-step: ask the world whether it landed.
+step_needed() {
+    local st; st=$(receipt_state "$1" "$2" "$1") || return 2
+    case "$st" in
+        done) echo "$PROG: $2: ledger says done, skipped"; return 1 ;;
+        '') return 0 ;;
+    esac
+    "$3" "$1"; case $? in
+        0) receipt_write "$1" "$2" "$1" done "found on resume" || return 2; echo "$PROG: $2: landed before the kill, recorded, skipped"; return 1 ;;
+        1) echo "$PROG: $2: intent without effect, re-doing"; return 0 ;;
+        *) echo "$PROG: $2: cannot read whether it landed: refusing" >&2; return 2 ;;
+    esac
+}
+draft_exists() {  # 0 yes, 1 no, 2 unread
+    local b; b=$(api_get 'releases?per_page=100') || return 2
+    jq -e --arg t "$1" 'any(.[]?; .tag_name == $t)' <<< "$b" > /dev/null 2>&1 && return 0; return 1
+}
+dispatch_exists() {  # a workflow_dispatch run created at or after the intent row
+    local b since; since=$(receipt_time "$1" dispatch "$1")
+    b=$(api_get 'actions/workflows/binary-release.yml/runs?event=workflow_dispatch&per_page=30') || return 2
+    jq -e --arg s "$since" 'any(.workflow_runs[]?; .created_at >= $s)' <<< "$b" > /dev/null 2>&1 && return 0; return 1
+}
+
+run_tag() {
+    local tag=$1 sha=$2 dry=$3 decision cells gate rc out notes cargo
+    D_TAG=$tag D_SHA=$sha
+    D_ON_MAIN=$(api_get "compare/$sha...main" | jq -r '.status // empty' 2>/dev/null) || D_ON_MAIN=''
+    D_GATE=$(api_get "commits/$sha/check-runs?check_name=ci%20%2F%20gate&per_page=100" \
+        | jq -r '[.check_runs[]? | select(.name == "ci / gate")] | sort_by(.started_at) | last
+                 | if . == null then "" else .status + " " + (.conclusion // "-") end' 2>/dev/null) || D_GATE=''
+    # read the whole file first: an early-exiting awk SIGPIPEs the decoder, and under pipefail the
+    # `||` fallback would then wipe the version it had already printed
+    cargo=$(api_get "contents/Cargo.toml?ref=$sha" | b64file) || cargo=''
+    D_VERSION=$(printf '%s\n' "$cargo" | awk -F'"' '/^version *=/{v=$2; exit} END{print v}')
+    D_TAG_AT=$(api_get "git/matching-refs/tags/$tag" \
+        | jq -r --arg r "refs/tags/$tag" '.[]? | select(.ref == $r) | .object.sha' 2>/dev/null) || D_TAG_AT='?unread'   # a failed read must refuse, not read as "new"
+    D_OURS=''; [ -n "$(receipt_state "$tag" tag "$tag")" ] && [ "$(receipt_field "$tag" tag "$tag" 6 | cut -d' ' -f1)" = "$sha" ] && D_OURS=1
+    decision=$(rc_tag_decide)
+    echo "$PROG: $decision"
+    case "$decision" in cut\ *) ;; resume\ *) resume_tag "$tag" "$sha" "$dry"; return $? ;; *) return 1 ;; esac
+
+    # The fleet (#4328 C4): no rc is cut while a fleet cell is RED, unless a dated waiver in
+    # scripts/release/fleet-waivers.tsv names it. Missing or stale cells refuse too.
+    cells=$(mktemp) || return 2
+    if [ -n "${RC_TAG_CELLS:-}" ]; then cat -- "$RC_TAG_CELLS" > "$cells"
+    else api_get "contents/fleet/cells.tsv?ref=fleet-state" 2>/dev/null | b64file > "$cells" || : > "$cells"; fi
+    gate=$(bash "$HERE/fleet_cells_gate.sh" --cells "$cells" --waivers "$HERE/fleet-waivers.tsv" ${RC_TAG_NOW:+--now "$RC_TAG_NOW"}); rc=$?
+    rm -f -- "${cells:?}"
+    echo "$PROG: fleet cells: $gate"
+    [ "$rc" = 0 ] || { echo "$PROG: REFUSED to cut $tag -- the fleet cells gate refused (#4328 C4)" >&2; return 1; }
+    if [ "$dry" = 1 ]; then echo "$PROG: dry run: no tag, draft or dispatch written"; return 0; fi
+
+    receipt_write "$tag" tag "$tag" intent "$sha" || { echo "$PROG: cannot write the ledger $(receipt_file "$tag"): not tagging" >&2; return 2; }
+    out=$(api_post git/refs "{\"ref\":\"refs/tags/$tag\",\"sha\":\"$sha\"}") || return 1
+    post_ok 201 "creating tag $tag" "$out" || { receipt_write "$tag" tag "$tag" fail "$sha HTTP $(head -1 <<< "$out")"; return 1; }
+    fault_point after:tag
+    receipt_write "$tag" tag "$tag" done "$sha"
+    after_tag "$tag" "$sha"
+}
+
+# resume_tag: the tag is ours at this sha. Never re-tag, never re-judge the fleet (the rc was judged
+# when it was cut; rc_fleet_stage.sh re-proves every host). Finish the draft and the dispatch.
+resume_tag() {
+    local tag=$1 sha=$2 dry=$3
+    [ "$(receipt_state "$tag" tag "$tag")" = done ] || receipt_write "$tag" tag "$tag" done "$sha found on resume" || return 2
+    if [ "$dry" = 1 ]; then echo "$PROG: dry run: resume would finish the draft + dispatch of $tag"; return 0; fi
+    after_tag "$tag" "$sha"
+}
+
+after_tag() {  # the draft, then the dispatch; each skipped when the ledger (or, after a kill, the world) has it
+    local tag=$1 sha=$2 out notes rc
+
+    notes="Release candidate of ${tag#v}: a tag on queue-green main (operator ruling 2026-09-25 16:58). Not on crates.io.
+
+Commit \`$sha\`; \`ci / gate\` completed success on it. Cut at $(date -u +%Y-%m-%dT%H:%M:%SZ) by scripts/release/rc_tag_main.sh.
+binary-release.yml attaches the apr and pv assets to this DRAFT; scripts/release/rc_fleet_stage.sh publishes it
+only after every reachable fleet host runs it (#4327).
+
+Install: \`install.sh --version $tag\`, or \`install.sh --channel rc\` for the newest rc."
+    step_needed "$tag" draft draft_exists; rc=$?
+    [ "$rc" = 2 ] && return 1
+    if [ "$rc" = 0 ]; then
+    receipt_write "$tag" draft "$tag" intent || return 2
+    out=$(api_post releases "$(jq -nc --arg t "$tag" --arg n "$notes" \
+        '{tag_name: $t, name: "\($t) (release candidate)", body: $n, draft: true, prerelease: true, make_latest: "false"}')") || return 1
+    post_ok 201 "creating the draft $tag (the tag exists: re-run this command to resume)" "$out" || return 1
+    fault_point after:draft
+    receipt_write "$tag" draft "$tag" done
+    fi
+
+    step_needed "$tag" dispatch dispatch_exists; rc=$?
+    [ "$rc" = 2 ] && return 1
+    if [ "$rc" = 0 ]; then
+    receipt_write "$tag" dispatch "$tag" intent || return 2
+    out=$(api_post actions/workflows/binary-release.yml/dispatches "{\"ref\":\"main\",\"inputs\":{\"tag\":\"$tag\"}}") || return 1
+    post_ok 204 "dispatching binary-release.yml for $tag (tag + draft exist: re-run this command to resume)" "$out" || return 1
+    fault_point after:dispatch
+    receipt_write "$tag" dispatch "$tag" done
+    fi
+    echo "$PROG: cut $tag at ${sha:0:9}: tag, DRAFT prerelease, binary-release.yml dispatched. Next: rc_fleet_stage.sh $tag --publish (#4327)"
+}
+
+self_test() {
+    local fail=0 d A B got rc rc2 F=''
+    A=$(printf 'a%.0s' {1..40}) B=$(printf 'b%.0s' {1..40})
+    expect() {  # expect <want> <label>
+        got=$(rc_tag_decide)
+        if [ "$got" = "$1" ]; then echo "  ok   $2"; else echo "  FAIL $2: got '$got', want '$1'"; fail=1; fi
+    }
+    base() { D_TAG=v0.70.0-rc.1 D_SHA=$A D_ON_MAIN=identical D_GATE='completed success' D_VERSION=0.70.0 D_TAG_AT=''; }
+    echo "$PROG self-test: decision table"
+    base; expect "cut v0.70.0-rc.1 $A" 'main head, gate green, version matches, tag free'
+    base; D_ON_MAIN=ahead; expect "cut v0.70.0-rc.1 $A" 'an ancestor of main cuts'
+    base; D_ON_MAIN=behind; expect 'refuse aaaaaaaaa is not on main (compare: behind)' 'a commit ahead of main (a PR head) refused'
+    base; D_ON_MAIN=diverged; expect 'refuse aaaaaaaaa is not on main (compare: diverged)' 'a side-branch commit refused'
+    base; D_ON_MAIN=''; expect 'refuse aaaaaaaaa is not on main (compare: unread)' 'an unread compare never cuts'
+    base; D_GATE='completed failure'; expect 'refuse ci / gate on aaaaaaaaa is completed failure, not completed success' 'red gate refused'
+    base; D_GATE='in_progress -'; expect 'refuse ci / gate on aaaaaaaaa is in_progress -, not completed success' 'running gate refused'
+    base; D_GATE=''; expect 'refuse ci / gate on aaaaaaaaa is absent, not completed success' 'no gate run refused'
+    base; D_VERSION=0.69.3; expect 'refuse Cargo.toml@aaaaaaaaa reads 0.69.3, the tag wants 0.70.0' 'unbumped workspace refused'
+    base; D_TAG_AT=$B; expect 'refuse v0.70.0-rc.1 already exists at bbbbbbbbb' 'an existing tag refused'
+    base; D_TAG_AT='?unread'; expect 'refuse cannot read whether v0.70.0-rc.1 exists' 'an unreadable tag list refused'
+    base; D_TAG=v0.70.0; expect 'refuse tag v0.70.0 is not vX.Y.Z-rc.N' 'a final tag is not this script'"'"'s'
+    base; D_TAG=v0.70.0-rc.0; expect 'refuse tag v0.70.0-rc.0 is not vX.Y.Z-rc.N' 'rc.0 refused'
+    base; D_SHA=aaaaaaaaa; expect 'refuse sha aaaaaaaaa is not a full 40-hex commit' 'a short sha refused'
+
+    echo "$PROG self-test: fake API, real fleet_cells_gate.sh"
+    d=$(mktemp -d) || return 2
+    fake() {  # fake <cells state for lambda/apr>: a fresh fake GitHub where every judge input is green
+        rm -rf -- "${d:?}/api"; rm -f -- "${d:?}/ledger.tsv"; mkdir -p "$d/api/get" "$d/api/code"
+        printf '{"status":"identical"}' > "$d/api/get/$(fkey "compare/$A...main")"
+        printf '{"check_runs":[{"name":"ci / gate","status":"completed","conclusion":"success","started_at":"2026-09-25T20:00:00Z"}]}' \
+            > "$d/api/get/$(fkey "commits/$A/check-runs?check_name=ci%20%2F%20gate&per_page=100")"
+        # large, as the real one is: a small file hides a SIGPIPE in the read
+        printf '{"content":"%s"}' "$({ printf '[workspace.package]\nversion = "0.70.0"\n'; seq -f 'k%g = 1' 1 40000; } | base64 -w0)" > "$d/api/get/$(fkey "contents/Cargo.toml?ref=$A")"
+        printf '[]' > "$d/api/get/$(fkey "git/matching-refs/tags/v0.70.0-rc.1")"
+        echo 201 > "$d/api/code/$(fkey git/refs)"; echo 201 > "$d/api/code/releases"
+        echo 204 > "$d/api/code/$(fkey actions/workflows/binary-release.yml/dispatches)"
+        printf '# measured 2026-09-25T20:00:00Z\nlambda-labs\tapr\t%s\tprobe\n' "$1" > "$d/cells.tsv"
+    }
+    cut_with() {  # cut_with <script>: run a real cut against the fake; posts land in $d/api/posts
+        RC_CUT_LEDGER=$d/ledger.tsv RC_CUT_FAULT=${F:-} RC_TAG_FAKE=$d/api RC_TAG_CELLS=$d/cells.tsv RC_TAG_NOW=$(date -u -d 2026-09-25T21:00:00Z +%s) bash "$1" --tag v0.70.0-rc.1 --sha "$A" > "$d/out" 2>&1
+    }
+    local me; me="$HERE/$(basename -- "${BASH_SOURCE[0]}")"
+    fake GREEN; cut_with "$me"; rc=$?
+    got=$(cut -d' ' -f2 "$d/api/posts" 2>/dev/null | tr '\n' ' ')
+    if [ "$rc" = 0 ] && [ "$got" = "git/refs releases actions/workflows/binary-release.yml/dispatches " ] \
+        && grep -q '"draft":true' "$d/api/posts"; then echo "  ok   green fleet: tag, then DRAFT, then dispatch"
+    else echo "  FAIL green fleet: rc $rc, posts '$got': $(tail -n 2 "$d/out")"; fail=1; fi
+    fake RED; cut_with "$me"; rc=$?
+    if [ "$rc" = 1 ] && [ ! -s "$d/api/posts" ] && grep -q 'REFUSED' "$d/out"; then echo "  ok   RED fleet cell: refused, nothing written"
+    else echo "  FAIL RED fleet cell: rc $rc, posts: $(cat "$d/api/posts" 2>/dev/null | cut -c1-80)"; fail=1; fi
+    fake GREEN; printf '[{"ref":"refs/tags/v0.70.0-rc.1","object":{"sha":"%s"}}]' "$B" > "$d/api/get/$(fkey "git/matching-refs/tags/v0.70.0-rc.1")"
+    cut_with "$me"; rc=$?
+    if [ "$rc" = 1 ] && [ ! -s "$d/api/posts" ]; then echo "  ok   existing tag: refused before the fleet read, nothing written"
+    else echo "  FAIL existing tag: rc $rc"; fail=1; fi
+    fake GREEN; echo 422 > "$d/api/code/$(fkey git/refs)"; cut_with "$me"; rc=$?
+    got=$(cut -d' ' -f2 "$d/api/posts" 2>/dev/null | tr '\n' ' ')
+    if [ "$rc" = 1 ] && [ "$got" = "git/refs " ]; then echo "  ok   tag POST 422 (a concurrent cut): no draft, no dispatch"
+    else echo "  FAIL tag POST 422: rc $rc, posts '$got'"; fail=1; fi
+    fake GREEN; mv -- "$d/api/get/$(fkey git/matching-refs/tags/v0.70.0-rc.1)" "$d/api/unread"; cut_with "$me"; rc=$?
+    if [ "$rc" = 1 ] && [ ! -s "$d/api/posts" ]; then echo "  ok   unreadable tag list: refused, nothing written"
+    else echo "  FAIL unreadable tag list: rc $rc"; fail=1; fi
+    fake GREEN; printf '[{"ref":"refs/tags/v0.70.0-rc.1","object":{"sha":"%s"}}]' "$A" > "$d/api/get/$(fkey "git/matching-refs/tags/v0.70.0-rc.1")"
+    cut_with "$me"; rc=$?
+    if [ "$rc" = 1 ] && [ ! -s "$d/api/posts" ]; then echo "  ok   tag at this sha the ledger never wrote (someone else's): refused"
+    else echo "  FAIL foreign tag at this sha: rc $rc"; fail=1; fi
+
+    echo "$PROG self-test: kill -9 mid-cut, then a fresh run"
+    local pt
+    for pt in after:tag after:draft after:dispatch; do
+        fake GREEN; { F=$pt cut_with "$me"; rc=$?; } 2>/dev/null   # bash's own "Killed" line
+        [ "$rc" = 137 ] || { echo "  FAIL $pt: the fault did not kill (rc $rc)"; fail=1; }
+        cut_with "$me"; rc=$?; cut_with "$me"; rc2=$?
+        got=$(cut -d' ' -f2 "$d/api/posts" 2>/dev/null | sort | uniq -c | awk '{printf "%s:%s ", $2, $1}')
+        if [ "$rc" = 0 ] && [ "$rc2" = 0 ] && [ "$got" = "actions/workflows/binary-release.yml/dispatches:1 git/refs:1 releases:1 " ]; then
+            echo "  ok   killed $pt, resumed twice: exactly 1 tag, 1 draft, 1 dispatch"
+        else echo "  FAIL killed $pt: resume rc $rc/$rc2, posts '$got': $(tail -n 2 "$d/out")"; fail=1; fi
+    done
+    for v in RC_TAG_HERE RC_TAG_CELLS RC_TAG_NOW RC_CUT_FAULT; do   # live run (no RC_TAG_FAKE): exits before any API call
+        env -u RC_TAG_FAKE "$v=$d" GH_TOKEN=unused bash "$me" --tag v0.70.0-rc.1 --sha "$A" --dry-run > /dev/null 2>&1; rc=$?
+        if [ "$rc" = 2 ]; then echo "  ok   live run with $v set: refused (rc 2)"
+        else echo "  FAIL live run with $v set: rc $rc"; fail=1; fi
+    done
+
+    echo "$PROG self-test: mutant"
+    # the gate call deleted: the RED cell must now be tagged, or the refusal above was not the gate's
+    mkdir -p "$d/m"; cp -- "$HERE/fleet_cells_gate.sh" "$HERE/fleet-waivers.tsv" "$HERE/lib_cut_receipt.sh" "$d/m/"
+    sed 's|^    gate=$(bash "$HERE/fleet_cells_gate.sh" --cells.*|    gate=mutant; rc=0|' "$me" > "$d/m/rc_tag_main.sh"
+    fake RED; RC_TAG_HERE=$d/m cut_with "$d/m/rc_tag_main.sh"; rc=$?
+    if grep -q '^POST git/refs' "$d/api/posts" 2>/dev/null; then echo "  ok   mutant without the gate call tags past a RED cell: the gate is load-bearing"
+    else echo "  FAIL mutant still refuses (rc $rc): the RED refusal came from somewhere else"; fail=1; fi
+    # the ledger check deleted: after a kill after the tag, the resume must refuse (its own tag) -- the
+    # resume path is what finishes a killed cut, not something else
+    sed 's|^    D_OURS=.*|    D_OURS=|' "$me" > "$d/m/rc_tag_main.sh"; cp -- "$HERE/lib_cut_receipt.sh" "$d/m/"
+    fake GREEN; { F=after:tag RC_TAG_HERE=$d/m cut_with "$d/m/rc_tag_main.sh"; } 2>/dev/null; RC_TAG_HERE=$d/m cut_with "$d/m/rc_tag_main.sh"; rc=$?
+    if [ "$rc" = 1 ] && ! grep -q '^POST releases' "$d/api/posts"; then echo "  ok   mutant without the ledger check strands a killed cut: the resume is load-bearing"
+    else echo "  FAIL mutant without the ledger check still resumes (rc $rc)"; fail=1; fi
+    rm -rf -- "${d:?}"
+    if [ "$fail" = 0 ]; then echo "$PROG self-test: PASS"; else echo "$PROG self-test: FAIL"; fi
+    return "$fail"
+}
+
+main() {
+    local tag='' sha='' dry=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --self-test) self_test; return $? ;;
+            --tag) tag=${2:-}; shift 2 || return 2 ;;
+            --sha) sha=${2:-}; shift 2 || return 2 ;;
+            --dry-run) dry=1; shift ;;
+            -h | --help) sed -n '2,25p' "${BASH_SOURCE[0]}"; return 0 ;;
+            *) echo "$PROG: unknown argument $1" >&2; return 2 ;;
+        esac
+    done
+    [ -n "$tag" ] && [ -n "$sha" ] || { echo "$PROG: --tag vX.Y.Z-rc.N and --sha <40-hex> are required" >&2; return 2; }
+    command -v jq >/dev/null || { echo "$PROG: jq is required" >&2; return 2; }
+    if [ -z "${RC_TAG_FAKE:-}" ] && [ -z "${GH_TOKEN:-}" ]; then
+        GH_TOKEN=$(gh auth token 2>/dev/null) || { echo "$PROG: GH_TOKEN unset and gh auth token failed" >&2; return 2; }
+    fi
+    run_tag "$tag" "$sha" "$dry"
+}
+
+main "$@"
diff --git a/scripts/release/stamp_rc_version.sh b/scripts/release/stamp_rc_version.sh
new file mode 100755
index 0000000000..b9708a4c96
--- /dev/null
+++ b/scripts/release/stamp_rc_version.sh
@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# stamp_rc_version.sh -- an rc asset's crate version IS its tag: 0.69.3-rc.2, never bare 0.69.3
+# (#4110, #4256, #4290)
+#
+#   bash scripts/release/stamp_rc_version.sh TREE TAG    # rewrite TREE's workspace to TAG's version
+#   bash scripts/release/stamp_rc_version.sh --self-test # case table + mutants on a scratch workspace
+#
+# WHY. The rc is tagged on the commit CI gated, whose Cargo.toml says X.Y.Z. Built as is, every
+# v0.69.3-rc.N asset printed `apr 0.69.3 (...)`: rc.1, rc.2 and the final were indistinguishable,
+# and every CARGO_PKG_VERSION-keyed record (the F2 forward receipt, #4290) collided across them.
+# Operator 2026-09-24: "we need actual version numbers" / "version number needs release canidate
+# info in it". binary-release.yml runs this on the checked-out tag tree before `cargo build
+# --locked`, so CARGO_PKG_VERSION itself is X.Y.Z-rc.N.
+#
+# WHAT IS REWRITTEN, and only when the workspace version is exactly TAG's X.Y.Z:
+#   - every workspace member manifest (and the root): `version = "X.Y.Z"` on its own line;
+#   - every dependency line that names a `path =` and a version requirement "X.Y.Z" / "=X.Y.Z" /
+#     "^X.Y.Z" / "~X.Y.Z": a plain "0.69.3" requirement does NOT match 0.69.3-rc.2 (semver: a
+#     pre-release only satisfies a requirement naming that same pre-release), so the pins move too;
+#   - Cargo.lock `[[package]]` entries at X.Y.Z WITHOUT a `source` (workspace crates only; a
+#     registry crate that happens to share the number keeps it).
+# A final tag (vX.Y.Z) is a no-op. A tag whose X.Y.Z is not the workspace version is refused:
+# stamping it would publish a binary claiming a version its source never was.
+# Cargo itself is the oracle: the build that follows runs `--locked`, and the self-test runs
+# `cargo metadata --locked --offline` on the stamped scratch workspace.
+#
+# EXIT 0 stamped (or a final tag: nothing to do) · 1 refused · 2 usage / unreadable tree.
+set -uo pipefail
+PROG=stamp_rc_version
+
+stamp() {  # stamp TREE TAG
+    python3 - "$1" "$2" <<'EOF'
+import os, re, sys
+tree, tag = sys.argv[1], sys.argv[2]
+m = re.fullmatch(r"v(\d+\.\d+\.\d+)(-rc\.(\d+))?", tag)
+if not m:
+    print(f"refuse: tag {tag!r} is not vX.Y.Z or vX.Y.Z-rc.N"); sys.exit(1)
+base, new = m.group(1), tag[1:]
+root = os.path.join(tree, "Cargo.toml")
+try:
+    text = open(root, encoding="utf-8").read()
+except OSError as e:
+    print(f"usage: {e}"); sys.exit(2)
+ws = re.search(r'^\[workspace\.package\]\s*\n(?:(?!\[).*\n)*?version\s*=\s*"([^"]+)"', text, re.M)
+if not ws:
+    print("usage: no [workspace.package] version in the root Cargo.toml"); sys.exit(2)
+have = ws.group(1)
+if have == new:
+    print(f"ok {new}: already stamped"); sys.exit(0)
+if have != base:
+    print(f"refuse: tag {tag} names {base}, the workspace is {have}"); sys.exit(1)
+if not m.group(2):
+    print(f"ok {new}: a final tag, nothing to stamp"); sys.exit(0)
+# members: root + every Cargo.toml under crates/ that is not in a nested workspace we exclude
+mem = re.search(r'^members\s*=\s*\[(.*?)\]', text, re.M | re.S)
+exc = re.search(r'^exclude\s*=\s*\[(.*?)\]', text, re.M | re.S)
+quoted = lambda s: re.findall(r'"([^"]+)"', re.sub(r'#.*', '', s)) if s else []
+import glob
+manifests = [root]
+for pat in quoted(mem.group(1) if mem else ""):
+    for d in sorted(glob.glob(os.path.join(tree, pat))):
+        f = os.path.join(d, "Cargo.toml")
+        if os.path.isfile(f):
+            manifests.append(f)
+excluded = [os.path.normpath(os.path.join(tree, e)) for e in quoted(exc.group(1) if exc else "")]
+manifests = [f for f in manifests if not any(os.path.normpath(f).startswith(e + os.sep) for e in excluded)]
+b = re.escape(base)
+own = re.compile(rf'^(version\s*=\s*"){b}(")', re.M)
+# a pin's number may be partial ("0.69" in aprender-core -> apr-format): any X / X.Y / X.Y.Z that
+# base satisfies is a pin on this workspace, and none of them matches a pre-release
+req = r'([=^~]?)(\d+(?:\.\d+){0,2})'
+dep = re.compile(rf'^(.*\bpath\s*=.*\bversion\s*=\s*"){req}(")', re.M)
+dep2 = re.compile(rf'^(.*\bversion\s*=\s*"){req}(".*\bpath\s*=)', re.M)
+def pin(mo):
+    num = mo.group(3).split(".")
+    if num != base.split(".")[:len(num)]:
+        return mo.group(0)
+    return mo.group(1) + mo.group(2) + new + mo.group(4)
+n_own = n_dep = 0
+for f in manifests:
+    s = open(f, encoding="utf-8").read()
+    s, a = own.subn(rf'\g<1>{new}\g<2>', s)
+    s, c = dep.subn(pin, s)
+    s, d = dep2.subn(pin, s)
+    n_own, n_dep = n_own + a, n_dep + c + d
+    open(f, "w", encoding="utf-8").write(s)
+lock = os.path.join(tree, "Cargo.lock")
+n_lock = 0
+if os.path.isfile(lock):
+    blocks = open(lock, encoding="utf-8").read().split("\n[[package]]\n")
+    for i, blk in enumerate(blocks):
+        if i and "\nsource = " not in blk:
+            blk, k = re.subn(rf'^version = "{b}"$', f'version = "{new}"', blk, flags=re.M)
+            blocks[i], n_lock = blk, n_lock + k
+    open(lock, "w", encoding="utf-8").write("\n[[package]]\n".join(blocks))
+print(f"stamped {base} -> {new}: {len(manifests)} manifests, {n_own} package versions, {n_dep} path pins, {n_lock} lock entries")
+sys.exit(0 if n_own else 1)
+EOF
+}
+
+self_test() {
+    local d fail=0 got rc row want name
+    command -v cargo > /dev/null || { echo "$PROG self-test: needs cargo (it is the oracle)"; return 2; }
+    d=$(mktemp -d) || return 2
+    # a scratch workspace shaped like the real one: [workspace.package] version, a member that
+    # inherits it, one that declares its own, a path dep with a caret pin and one with =, an
+    # excluded nested crate, and a lock entry for a REGISTRY crate at the same number
+    mkws() {
+        local w=$1; rm -rf -- "${w:?}"; mkdir -p "$w/crates/a/src" "$w/crates/b/src" "$w/crates/c/src" "$w/crates/d/src" "$w/crates/x/src"
+        printf '[workspace]\nmembers = ["crates/*"]\nexclude = [\n    "crates/x", # nested\n]\nresolver = "2"\n\n[workspace.package]\nversion = "0.69.3"\nedition = "2021"\n\n[workspace.dependencies]\nb = { path = "crates/b", version = "0.69.3" }\n' > "$w/Cargo.toml"
+        printf '[package]\nname = "a"\nversion.workspace = true\nedition = "2021"\n\n[dependencies]\nb = { workspace = true }\nd = { path = "../d", version = "0.69" }\nc = { version = "=0.69.3", path = "../c" }\n' > "$w/crates/a/Cargo.toml"
+        printf '[package]\nname = "b"\nversion = "0.69.3"\nedition = "2021"\n' > "$w/crates/b/Cargo.toml"
+        printf '[package]\nname = "c"\nversion = "0.69.3"\nedition = "2021"\n' > "$w/crates/c/Cargo.toml"; : > "$w/crates/c/src/lib.rs"
+        printf '[package]\nname = "d"\nversion = "0.69.3"\nedition = "2021"\n' > "$w/crates/d/Cargo.toml"; : > "$w/crates/d/src/lib.rs"
+        printf '[package]\nname = "x"\nversion = "0.69.3"\nedition = "2021"\n[workspace]\n' > "$w/crates/x/Cargo.toml"
+        : > "$w/crates/a/src/lib.rs"; : > "$w/crates/b/src/lib.rs"; : > "$w/crates/x/src/lib.rs"
+        (cd "$w" && cargo generate-lockfile --offline -q 2> /dev/null) || return 1
+    }
+    # versions WT -> "a=<v> b=<v>" from cargo, resolving --locked; "LOCKED-FAIL" when cargo refuses
+    versions() {
+        (cd "$1" && cargo metadata --locked --offline --format-version 1 2> /dev/null) \
+        | python3 -c 'import json,sys; print(" ".join(sorted(p["name"]+"="+p["version"] for p in json.load(sys.stdin)["packages"])))' 2> /dev/null \
+        || echo LOCKED-FAIL
+    }
+    expect() {  # expect ROW WANT GOT
+        if [ "$3" = "$2" ]; then echo "  ok   $1"; else printf '  FAIL %s\n       want: %s\n       got:  %s\n' "$1" "$2" "$3"; fail=1; fi
+    }
+    echo "$PROG self-test: case table (cargo metadata --locked is the oracle)"
+    mkws "$d/w" || { echo "  FAIL cannot build the scratch workspace"; rm -rf -- "${d:?}"; return 2; }
+    stamp "$d/w" v0.69.3-rc.2 > "$d/out"; rc=$?
+    expect "rc tag stamps and exits 0" 0 "$rc"
+    expect "cargo resolves the stamped workspace --locked, every member at the rc" "a=0.69.3-rc.2 b=0.69.3-rc.2 c=0.69.3-rc.2 d=0.69.3-rc.2" "$(versions "$d/w")"
+    expect "the excluded nested crate keeps its version" 'version = "0.69.3"' "$(grep '^version' "$d/w/crates/x/Cargo.toml")"
+    mkws "$d/w"; printf '\n[[package]]\nname = "zzz-registry"\nversion = "0.69.3"\nsource = "registry+https://github.com/rust-lang/crates.io-index"\n' >> "$d/w/Cargo.lock"
+    stamp "$d/w" v0.69.3-rc.2 > /dev/null
+    expect "a registry lock entry at the same number is untouched" 'version = "0.69.3"' "$(grep -A1 'name = "zzz-registry"' "$d/w/Cargo.lock" | tail -1)"
+    mkws "$d/w"; stamp "$d/w" v0.69.3-rc.2 > /dev/null
+    stamp "$d/w" v0.69.3-rc.2 > /dev/null; expect "re-stamping the same rc is idempotent" 0 "$?"
+    mkws "$d/w"; stamp "$d/w" v0.69.3 > /dev/null; rc=$?
+    expect "a final tag is a no-op (exit 0, workspace unchanged)" "0 a=0.69.3 b=0.69.3 c=0.69.3 d=0.69.3" "$rc $(versions "$d/w")"
+    for row in "1 v0.69.4-rc.1 a tag for another version is refused" "1 v0.69.3-beta.1 a non-rc prerelease is refused" "1 0.69.3-rc.1 a tag without v is refused"; do
+        mkws "$d/w"; want=${row%% *}; row=${row#* }; name=${row%% *}
+        stamp "$d/w" "$name" > /dev/null; expect "${row#* }" "$want" "$?"
+    done
+    # MUTANTS, built from THIS file: each drops one rewrite, and cargo must refuse the result.
+    # Without them the table could pass on a stamper that only renamed the packages.
+    for row in "lock|blocks[i], n_lock = blk, n_lock + k|n_lock = n_lock + k" \
+               "path-first pins|s, c = dep.subn|c = 0; _ = dep.subn" \
+               "version-first pins|s, d = dep2.subn|d = 0; _ = dep2.subn" \
+               "partial (X.Y) pins|(?:\\.\\d+){0,2}|(?:\\.\\d+){2}"; do
+        IFS='|' read -r name a1 b1 <<< "$row"
+        A1=$a1 B1=$b1 python3 -c 'import os,sys; s=open(sys.argv[1]).read(); a=os.environ["A1"]; assert s.count(a)>=1 and s.index(a)<s.index("self_test()"); open(sys.argv[2],"w").write(s.replace(a,os.environ["B1"],1))' \
+            "${BASH_SOURCE[0]}" "$d/mut.sh" 2> /dev/null || { echo "  FAIL mutant $name: anchor moved, re-anchor it"; fail=1; continue; }
+        mkws "$d/w"; bash "$d/mut.sh" "$d/w" v0.69.3-rc.2 > /dev/null
+        got=$(versions "$d/w")
+        case "$got" in *LOCKED-FAIL*) echo "  ok   mutant ($name rewrite dropped): cargo refuses the tree";;
+                       *) echo "  FAIL mutant ($name rewrite dropped) survived: $got"; fail=1;; esac
+    done
+    rm -rf -- "${d:?}"
+    if [ "$fail" -eq 0 ]; then echo "$PROG self-test: PASS"; return 0; fi
+    echo "$PROG self-test: FAIL"; return 1
+}
+
+case "${1:-}" in
+    --self-test) self_test ;;
+    -h|--help) sed -n '2,28p' "${BASH_SOURCE[0]}" ;;
+    *) if [ "$#" -ne 2 ] || [ ! -d "$1" ]; then echo "$PROG: usage: TREE TAG | --self-test" >&2; exit 2; fi
+       stamp "$1" "$2" ;;
+esac
diff --git a/scripts/release_criteria.sh b/scripts/release_criteria.sh
index cbba976915..f122b7996c 100755
--- a/scripts/release_criteria.sh
+++ b/scripts/release_criteria.sh
@@ -23,7 +23,7 @@ cmd_of() {
         C8)  echo 'bash scripts/run_clean_room.sh   # clean-room p1 via ../infra (hard gate)' ;;
         C9)  echo 'bash scripts/check_receipt_complete.sh --dag docs/specifications/pp-066-dag.yaml   # every 0.66 row credited has a receipt whose marker says complete' ;;
         C11) echo 'bash scripts/check_backend_registry.sh --static   # 15 fixtures (FX-1..15) each observed RED once; zero cfg!(feature) reads in apr-cli backend decisions' ;;
-        C13) echo 'bash scripts/check_release_assets.sh "v$(sed -n '"'"'s/^version = "\(.*\)"/\1/p'"'"' Cargo.toml | head -1)"   # the four apr tarballs (cuda,cpu x x86_64,aarch64) + .sha256 + the eight pv assets; the tag is READ from the root manifest, never typed (no cargo: the release box has none). Seam: RELEASE_ASSETS_FIXTURE' ;;
+        C13) echo 'bash scripts/check_release_assets.sh "v$(sed -n '"'"'s/^version = "\(.*\)"/\1/p'"'"' Cargo.toml | head -1)"   # the six apr tarballs (cuda,cpu x x86_64,aarch64 + darwin cpu + x86_64 wgpu) + .sha256 + the ten pv assets (incl. darwin); the tag is READ from the root manifest, never typed (no cargo: the release box has none). Seam: RELEASE_ASSETS_FIXTURE' ;;
         C14) echo 'bash scripts/check_model_parity.sh --manifest   # GPU=CPU per manifest model over >= 64 positions, or the GPU refuses it (L0-1a)' ;;
         C1|C2|C3|C5|C10|C12) echo '0.67 (SPEC-2.0: moved with its track; never credited in 0.66)' ;;
         *) return 1 ;;
@@ -109,7 +109,7 @@ case "${1:-}" in
         C13_TAG="v$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)"
         bash scripts/check_release_assets.sh --list "$C13_TAG" > "$C13_WORK/complete.txt"
         grep -vx "apr-$C13_TAG-aarch64-unknown-linux-gnu-cpu.tar.gz" "$C13_WORK/complete.txt" > "$C13_WORK/mutant.txt"
-        t 0 "C13 is credited when the release carries all sixteen assets" \
+        t 0 "C13 is credited when the release carries every required asset" \
             env RELEASE_ASSETS_FIXTURE="$C13_WORK/complete.txt" bash "$0" C13
         t 1 "C13 RED: one apr tarball removed and C13 is NOT credited (it cannot pass vacuously)" \
             env RELEASE_ASSETS_FIXTURE="$C13_WORK/mutant.txt" bash "$0" C13
diff --git a/scripts/tests/check_release_assets_test.sh b/scripts/tests/check_release_assets_test.sh
index c2d66cdc5c..9020f18b0d 100755
--- a/scripts/tests/check_release_assets_test.sh
+++ b/scripts/tests/check_release_assets_test.sh
@@ -68,12 +68,19 @@ trap 'rm -rf "$WORK"' EXIT
       printf 'pv-%s-%s-unknown-linux-%s.tar.gz.sha256\n' "$TAG" "$t_arch" "$libc"
     done
   done
+  # #4327 mini (darwin apr), #4353 darwin pv + the intel wgpu apr
+  for a in apr-$TAG-aarch64-apple-darwin-cpu apr-$TAG-x86_64-unknown-linux-gnu-wgpu pv-$TAG-aarch64-apple-darwin; do
+    printf '%s.tar.gz\n%s.tar.gz.sha256\n' "$a" "$a"
+  done
 } > "$WORK/complete.txt"
 
 MUTANT_NAME="apr-$TAG-aarch64-unknown-linux-gnu-cpu.tar.gz"
 grep -vx "$MUTANT_NAME" "$WORK/complete.txt" > "$WORK/mutant.txt"
 grep -vx "apr-$TAG-x86_64-unknown-linux-gnu-cuda.tar.gz.sha256" "$WORK/complete.txt" > "$WORK/nosha.txt"
 grep -v '^pv-' "$WORK/complete.txt" > "$WORK/nopv.txt"
+grep -vx "apr-$TAG-aarch64-apple-darwin-cpu.tar.gz" "$WORK/complete.txt" > "$WORK/nodarwin.txt"
+grep -vx "pv-$TAG-aarch64-apple-darwin.tar.gz.sha256" "$WORK/complete.txt" > "$WORK/nopvdarwin.txt"
+grep -vx "apr-$TAG-x86_64-unknown-linux-gnu-wgpu.tar.gz" "$WORK/complete.txt" > "$WORK/nowgpu.txt"
 
 # 1. the guard's own table, and it is not vacuous
 t 0 "$GUARD --selftest is green" bash "$GUARD" --selftest
@@ -86,7 +93,10 @@ t 1 "MUTATION: aarch64 cpu tarball removed -> 1" bash "$GUARD" "$TAG" --assets-f
 t 0 "the mutation is NAMED, not merely counted" \
   bash -c "bash '$GUARD' '$TAG' --assets-from '$WORK/mutant.txt' 2>&1 | grep -q '$MUTANT_NAME'"
 t 1 "a missing .sha256 is as fatal as a missing tarball" bash "$GUARD" "$TAG" --assets-from "$WORK/nosha.txt"
-t 1 "the eight pv assets are required too" bash "$GUARD" "$TAG" --assets-from "$WORK/nopv.txt"
+t 1 "the pv assets are required too" bash "$GUARD" "$TAG" --assets-from "$WORK/nopv.txt"
+t 1 "MUTATION: darwin apr removed -> 1 (mini, #4327)" bash "$GUARD" "$TAG" --assets-from "$WORK/nodarwin.txt"
+t 1 "MUTATION: darwin pv .sha256 removed -> 1 (mini, #4353)" bash "$GUARD" "$TAG" --assets-from "$WORK/nopvdarwin.txt"
+t 1 "MUTATION: x86_64 wgpu apr removed -> 1 (intel, #4353)" bash "$GUARD" "$TAG" --assets-from "$WORK/nowgpu.txt"
 
 # 3. unreadable is ENV (2), never a pass
 t 2 "an unreadable asset list is ENV (2), never 0" bash "$GUARD" "$TAG" --assets-from "$WORK/does-not-exist.txt"
@@ -95,9 +105,12 @@ t 2 "no tag is a usage error (2), never a pass" bash "$GUARD"
 # 4. the wiring: the workflow shares this checker
 t 0 "binary-release.yml calls the shared checker" \
   bash -c "grep -q 'check_release_assets.sh' '$WF'"
-t 0 "the verify job requires all four apr assets (it is no longer cuda-only)" \
+t 0 "the verify job exists (it requires all six apr assets; it is no longer cuda-only)" \
   bash -c "grep -q 'verify-apr-assets:' '$WF'"
 t 0 "a build-apr-cpu lane exists" bash -c "grep -q 'build-apr-cpu:' '$WF'"
+t 0 "a build-pv-darwin lane exists (#4353)" bash -c "grep -q '^  build-pv-darwin:' '$WF'"
+t 0 "build-apr-cpu carries a wgpu flavour built with --features wgpu (#4353)" \
+  bash -c "grep -q 'flavour: wgpu' '$WF' && grep -q 'features: .--features wgpu.' '$WF'"
 t 0 "a smoke-cpu lane exists" bash -c "grep -q 'smoke-cpu:' '$WF'"
 
 printf '%s/%s rows\n' "$((n - red))" "$n"