[noahgift]

Tree-identical re-cut of #5159 onto current main: one commit, same tree as a merge of main into #5159. #5159 was dirty against main and its required run was red, so no main-merge could go onto it. Conflicts were resolved once. The README contract count and the ONT witness were regenerated, not picked. Each surface-audit row is taken from the side whose cited source file the merged tree keeps.

Measured locally on the re-cut head: fmt, clippy (-D warnings on the touched crates), cargo deny advisories and the aprender-compute lib tests are green; the CI-profile workspace nextest run passed 84967 of 84969. The two reds are environmental and are not touched by this diff: test_find_apr_binary needs an apr binary on PATH (it is green with one), and falsify_4228_005 (4B prefill, model-gated) times out at 1200s in a debug build on a loaded host. It times out the same way on main.

Summary

Lands the review-experiment (rex) epic work on main as one commit (PMAT-4524).

• aprender-review-experiment: new and changed modules, their tests,
  and the rex and replay examples (Qwen3.5 as the model, llama.cpp as
  the runtime). replay run --out writes its file whole, so a rerun
  replaces the s1-v2 rows and never appends to them.
• contracts: new and amended contracts, with the ONT witness
  regenerated for the new relation set.
• aprender-serve: top-K logprobs per generated step on the Qwen3.5
  hybrid chat path, and POST /v1/chat/prompt-ids mounted on that
  path only. The infer path refuses --logprobs for an APR or
  SafeTensors model before the load.
• apr run: --logprobs K (at most 20, as top_logprobs on HTTP)
  records the K most likely next tokens and the encoded prompt ids
  in the --json and --stream documents (apr run: payload trace / --logprobs must record per-step top-k logits (no CLI path today; found on #4004) #4026). It is refused by name
  wherever it cannot be reported: text output, --benchmark (with or
  without --json) and --batch-jsonl. Recorded steps whose chosen
  tokens are not this run's generated tokens are refused, not
  reported. One exception: a turn that ended on a stop token may
  carry one trailing step more than its reply, the stop token the
  dense GGUF route drops from the reply; that one step is dropped.
• Gate change: check_append_only_ledgers.sh now accepts a file under
  docs/audits/ that .gitattributes declares audit-golden (written
  whole by one writer) without a union merge, and FAILs one declared
  both ways. Only the bare attribute declares a golden. .gitattributes
  declares the review corpus and the PRM-S1 v2 rows golden and unions
  the rex-001 admission ledgers by glob. The self-test proves a real
  ledger is not golden, that the scan FAILs a golden+union tree and
  passes the golden-only control, and that the value forms are not
  golden.
• The binding scanner now sees FALSIFY-TDC-009: a trailing comment on
  its attribute line hid the test fn.
• Three functions split below the complexity bar, with no change in
  behaviour: apr's model resolver, its run and diagnostic
  dispatch, and the orchestrate tool-call envelope parser.
• docs, evidence and scripts: the audit receipts and roadmap entries
  behind the above, and a read-only transcript-retention audit. The
  prm-04 parity capture carries <models>/ in place of two absolute
  weight paths; its receipt names that edit and both hashes.

Gate change (narrow)

scripts/check_append_only_ledgers.sh gains a declared audit-golden class. docs/audits/review-corpus/*.jsonl moves from must-union to audit-golden: the corpus is written whole by a single writer (one commit, 989cb01), and the guard never had a history check. New FAIL rows: a file declared both golden and union. Signed as a narrow gate change in its C314 round.

Test plan

• cargo test -p aprender-serve --lib: 16277 passed, 0 failed
• cargo test -p apr-cli --lib, the rex crate tests, and the apr run: payload trace / --logprobs must record per-step top-k logits (no CLI path today; found on #4004) #4026 CLI test
• clippy -D warnings on aprender-serve, apr-cli and the rex crate
• contracts gate: 8 of 8 steps ran, 0 failed
• README counts and ONT witness regenerated on this base

Refs #4354, #5159
keep-open: #4354 is the rex epic; this PR lands one ticket of it (PMAT-4524), other rows stay open. #5159 is the superseded PR, left open as a draft for its owner to close
ont-delta: resolves agent-trace-terms-v1 lane-independence-v1 review-b2-loop-v1 review-champion-challenger-v1 review-lane-perf-ratchet-v1 review-ledger-v1 review-ledger-v2 review-replay-v1 rex-pilot-projection-v1 rex-promotion-ladder-v1 rex-promotion-ladder-v2 sparse-logits-v1 trace-admission-prov-v1 trace-admission-secret-v1 trace-datacard-v1 trace-dedup-v1 trace-outcome-join-v1 trace-split-guard-v1 workload-profile-v1 (19 schema contracts enter contracts.nt)

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5393 head=b1c3b103ac5686a1bc6e6207a366493b270ffdd2 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat 1, aprender-seat-s12 @b1c3b103ac HOLD (scope: Opus-authored commits)

Scope: 9df5138 is the Opus 5.5-trailered commit (154 files, +22046/-352). a56c47b, 70f761b and the merge b1c3b10 are Sonnet or merge commits, so I did not review them. I could not read all 22k lines. I read the changes to existing files outside the new crate in depth: dispatch.rs, commands_enum.rs, Makefile, .gitattributes, Cargo.lock.

Blocking finding: cargo fmt --all -- --check fails on crates/apr-cli/src/dispatch.rs. In the new dispatch_run_command (~l.341), the field list of the let Commands::Run { ... } = cli.command.as_ref() else destructure is indented 12 spaces for the middle fields (positional_prompt through verbose) and 8 for the rest. I ran rustfmt with the repo's rustfmt.toml on the head's file: rc=1, and the diff is exactly those lines. origin/main's dispatch.rs is clean (rc=0), so the defect is this PR's. Fmt is in the pre-push checklist, so the PR cannot go green as is.
Fix: cargo fmt --all and re-run.

Otherwise, from the parts read:

• The --logprobs K flag is range-limited 0..=20, and run_batch_jsonl refuses K>0 by name.
• The dispatch split looks behaviour-preserving, and the Makefile targets look sane.
• The .gitattributes change is coherent: ledgers use union merge and single-writer goldens use audit-golden.

The rest of the 22k-line commit (crate internals, evidence data) was not read. This seat does not vouch for it. After the fmt fix I would re-seat on the new head.

[noahgift]

seat 2, aprender-seat-o10 @b1c3b103ac APPROVE (scope: Sonnet-authored commits)

Opus seat. The Sonnet-authored commits are a56c47b (the merge resolution) and 70f761b (the witness regeneration). b1c3b10 is a main-merge with no trailer; I read its one conflict resolution as well. 9df5138 is Opus-authored and out of scope. This session authored no commit on the PR.

a56c47b. git diff-tree --cc shows exactly three conflicted files:

• router.rs: RouteCapabilities keeps both fields, qwen35_prompt_ids from this branch and embedding_kind from main, in the struct, in of() and in all(). all() keeps main's embedding_kind: false and this branch's qwen35_prompt_ids: true. Nothing is dropped from either side, and the head-vs-main diff of router.rs is only those +3 lines plus the gated /v1/chat/prompt-ids route.
• README.md: contract count 1983. It is neither side's number (1982 / 1964), so it was regenerated, as the body says. 1983 − 1964 = 19, which matches the "19 new contracts" in 70f761b.
• surface_audit.csv: see the non-blocking finding below.

70f761b. Only census_id_set_sha256 and reasoner_git_sha change (the latter = a56c47b); relations_sha256 and checkable_n = 87 are unchanged. That is consistent with a census-only change (new contract IDs, no new relations). After it, the head merge brings in from main only a +6-line edit to apr-dogfood-coverage-v1.yaml and does not touch the witness. Whether the witness is still fresh is decided by lint_passes_on_real_contracts / ont5_consistency_gate in workspace-test. CI on this head is still IN_PROGRESS, so this APPROVE does not cover that result: the PR is READY only once the rollup reads green on b1c3b10.

Non-blocking finding (pre-existing on main, not introduced here): the router.rs:N refs in docs/audits/surface_audit.csv mostly do not point at the route they name. I checked every one: does line N of router.rs contain the quoted path? Rows that hit, out of 41:

• origin/main @5b1fd7b085: 20/41.
• 9df5138 (this branch before the merge): 36/41.
• a56c47b and the head: 20/41.

Example: POST /api/chat cites router.rs:178 at the head, and line 178 is ("GET", "/v1/models", …); the route is at :208. Main has the same error (cites :174, which is /v1/models; the route is at :204). Both merges took main's side for these rows and shifted each line number by the lines this branch inserts above it. That re-pointing is consistent, but it keeps main's stale targets. The PR adds no new miss (21 before, 21 after), and no gate reads these line numbers, so this is not blocking. I recommend one ticket with one owner to re-derive the router.rs refs from the route table instead of carrying offsets.

[noahgift]

seat 1, aprender-seat-s12 @b1c3b103ac APPROVE (scope: Opus-authored commits) -- supersedes my earlier HOLD at this head

Withdrawn: the fmt HOLD. My rc=1 came from running rustfmt 1.8.0-stable (the 1.93.0 pin) on dispatch.rs as a single standalone file. Run through the crate's real module tree (crates/apr-cli/src/lib.rs with the repo's rustfmt.toml, edition 2021) the same head gives no diff, so cargo fmt --all -- --check does not flag it. My standalone run formatted a file the real check does not reach, so it was the wrong measurement. ci / gate is also reported SUCCESS.

Remaining, cosmetic and non-blocking: the let-else field list in dispatch_run_command (dispatch.rs ~l.341) is indented 12 for the middle fields and 8 for the rest. Worth fixing when next touched.

Scope unchanged: I reviewed the existing-file changes in 9df5138 (dispatch split, --logprobs 0..=20 and the batch refusal, Makefile targets, .gitattributes, Cargo.lock). I did not read the new crate internals or the evidence data, and this seat does not vouch for them.