batch(B2): CI/infra/scripts/workflow fold — replayed onto main (REPLACES #4315)

.claude/skills/apr-dogfood/SKILL.md

@@ -1591,7 +1591,7 @@ The nine clusters at zero, largest first: `http-orchestrate-banco` (95),
 `test-harness` (49), `rag-eval` (44), `qa-cgp` (37), `simulation` (18),
 `orchestrate-pacha-secrets` (17).
 
-**Report both numbers or neither (T2).** "5 of 14 clusters gated (35.7%)" without "144 of 838 features gated (17.2%)" beside it is a proxy masquerading as coverage, and the gate refuses to emit it — *on this line too*.
+**Report both numbers or neither (T2).** "5 of 14 clusters gated (35.7%)" without "144 of 864 features gated (16.7%)" beside it is a proxy masquerading as coverage, and the gate refuses to emit it — *on this line too*.
 
 The rule is about the NUMBER, not about a phrasing, and it is enforced on every
 surface that can emit one: the gate's own report, the receipt, the output of

.github/workflows/beat-speed-nightly.yml

@@ -130,7 +130,7 @@ jobs:
       # anything, and self-heal the known poisoned-uv-cache fault in place.
       - name: Preflight — scikit-learn/numpy baseline must be importable
         id: preflight
-        run: bash scripts/check_beat_baseline_env.sh
+        run: setsid --wait bash scripts/check_beat_baseline_env.sh
 
       - name: Pillar-1 — apr vs scikit-learn LinearRegression speed beat
         if: ${{ !cancelled() && steps.preflight.outcome == 'success' }}
@@ -212,7 +212,7 @@ jobs:
       # not "pass quietly", it went dark. Assert all ten reported.
       - name: Every beat must have reported a measurement
         if: ${{ !cancelled() }}
-        run: bash scripts/check_beat_measurements.sh "$BEAT_LOG"
+        run: setsid --wait bash scripts/check_beat_measurements.sh "$BEAT_LOG"
 
       # Closing half of the receipt. The neighbour count is passed in through
       # `env:` rather than spliced into the script body: Actions substitutes

.github/workflows/binary-release.yml

@@ -288,6 +288,10 @@ jobs:
           # runner (uid 1001) cannot write — run 34488955316 built the asset in 1m54s and
           # then died on `mkdir: cannot create directory 'target/aarch64-unknown-linux-gnu':
           # Permission denied`. Pre-creating it as the runner keeps the ownership.
+          # build.rs runs `git rev-parse` INSIDE this container, where the checkout is owned by
+          # the runner uid and git refuses it — so every release asset printed `(vX+no-git)` and
+          # scripts/apr_bin.sh (STRICT) could not attribute it to its tag. Ask the host checkout.
+          APR_SHA=$(git rev-parse --short HEAD)
           mkdir -p "$GITHUB_WORKSPACE/target"
           $DOCKER run --rm \
             -v "$GITHUB_WORKSPACE:/workspace" \
@@ -296,11 +300,13 @@ jobs:
             -w /workspace \
             -e CARGO_TARGET_DIR=/workspace/target \
             -e CARGO_INCREMENTAL=0 \
+            -e APR_GIT_SHA_OVERRIDE="$APR_SHA" \
             rust:1.93.0-bullseye \
             sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --features cuda --locked; strip target/${{ matrix.target }}/release/apr'
           # the mounted target dir is the host cache; expose the binary where the next steps expect it
           mkdir -p "target/${{ matrix.target }}/release"
           cp "$CACHE/target/${{ matrix.target }}/release/apr" "target/${{ matrix.target }}/release/apr"
+          grep -aqF "$APR_SHA" "target/${{ matrix.target }}/release/apr" || { echo "::error::apr binary does not embed its commit $APR_SHA"; exit 1; }
           GLIBC=$(cat "$CACHE/target/BUILDER_GLIBC"); RUSTC=$(cat "$CACHE/target/BUILDER_RUSTC")
           echo "builder glibc: $GLIBC"; echo "builder rustc: $RUSTC"; nvidia-smi -L | head -1
           {
@@ -433,6 +439,10 @@ jobs:
           # runner (uid 1001) cannot write — run 34488955316 built the asset in 1m54s and
           # then died on `mkdir: cannot create directory 'target/aarch64-unknown-linux-gnu':
           # Permission denied`. Pre-creating it as the runner keeps the ownership.
+          # build.rs runs `git rev-parse` INSIDE this container, where the checkout is owned by
+          # the runner uid and git refuses it — so every release asset printed `(vX+no-git)` and
+          # scripts/apr_bin.sh (STRICT) could not attribute it to its tag. Ask the host checkout.
+          APR_SHA=$(git rev-parse --short HEAD)
           mkdir -p "$GITHUB_WORKSPACE/target"
           $DOCKER run --rm \
             -v "$GITHUB_WORKSPACE:/workspace" \
@@ -441,11 +451,13 @@ jobs:
             -w /workspace \
             -e CARGO_TARGET_DIR=/workspace/target \
             -e CARGO_INCREMENTAL=0 \
+            -e APR_GIT_SHA_OVERRIDE="$APR_SHA" \
             rust:1.93.0-bullseye \
             sh -c 'set -e; ldd --version | head -1 > /workspace/target/BUILDER_GLIBC; rustc --version > /workspace/target/BUILDER_RUSTC; cargo build --release -p apr-cli --bin apr --target ${{ matrix.target }} --locked; strip target/${{ matrix.target }}/release/apr'
           # the mounted target dir is the host cache; expose the binary where the next steps expect it
           mkdir -p "target/${{ matrix.target }}/release"
           cp "$CACHE/target/${{ matrix.target }}/release/apr" "target/${{ matrix.target }}/release/apr"
+          grep -aqF "$APR_SHA" "target/${{ matrix.target }}/release/apr" || { echo "::error::apr binary does not embed its commit $APR_SHA"; exit 1; }
           GLIBC=$(cat "$CACHE/target/BUILDER_GLIBC"); RUSTC=$(cat "$CACHE/target/BUILDER_RUSTC")
           echo "builder glibc: $GLIBC"; echo "builder rustc: $RUSTC"
           {
@@ -556,7 +568,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           TAG="${{ github.event.release.tag_name || inputs.tag }}"
-          bash scripts/check_release_assets.sh "$TAG" | tee "$RUNNER_TEMP/assets.txt"
+          setsid --wait bash scripts/check_release_assets.sh "$TAG" | tee "$RUNNER_TEMP/assets.txt"
           rc=${PIPESTATUS[0]}
           # 2 is ENV (the release could not be read) and is NOT a pass; 1 names
           # each missing asset. Both are red here, distinguished in the summary.

.github/workflows/book.yml

@@ -103,7 +103,7 @@ jobs:
           # so the book's shell gate and the release's shell gate lint with different
           # linters. check_bashrs_gate.sh's own header calls that disagreement "the
           # defect this fixes".
-          bash scripts/check_tool_versions.sh
+          setsid --wait bash scripts/check_tool_versions.sh
           # Lint only check scripts; gen-*-stubs.sh contain markdown heredocs with em-dashes
           # that bashrs flags as SC1100, but those are intentional in the generated book output.
           #
@@ -129,7 +129,7 @@ jobs:
 
       # BOOK-CLOSEOUT-001 § Phase 1: zero broken file links
       - name: Linkcheck gate (FALSIFY-BOOK-LINKCHECK-001)
-        run: bash scripts/check_book_linkcheck.sh
+        run: setsid --wait bash scripts/check_book_linkcheck.sh
 
       # BOOK-CLOSEOUT-001 § Phase 4: every CLI subcommand has a chapter
       - name: CLI parity gate (FALSIFY-BOOK-CLI-PARITY-001)
@@ -146,19 +146,19 @@ jobs:
           # so name the host fault instead of mis-attributing it to the code.
           bash scripts/cargo_step.sh 'install apr-cli' -- \
             cargo install --path crates/apr-cli --locked --quiet --root "$RUNNER_TEMP/cargo-tools"
-          bash scripts/check_book_cli_parity.sh
+          setsid --wait bash scripts/check_book_cli_parity.sh
 
       # BOOK-CLOSEOUT-001 § Phase 4: every CLI stub has a runnable example
       - name: CLI example-block gate (FALSIFY-BOOK-EXAMPLE-001)
-        run: bash scripts/check_book_example_block.sh
+        run: setsid --wait bash scripts/check_book_example_block.sh
 
       # BOOK-CLOSEOUT-001 § Phase 3: every aprender-core public module has a chapter
       - name: Library parity gate (FALSIFY-BOOK-LIB-PARITY-001)
-        run: bash scripts/check_book_lib_parity.sh
+        run: setsid --wait bash scripts/check_book_lib_parity.sh
 
       # BOOK-CLOSEOUT-001 § Phase 3: every lib stub has a runnable rust example
       - name: Library example-block gate (FALSIFY-BOOK-LIB-EXAMPLE-001)
-        run: bash scripts/check_book_lib_example_block.sh
+        run: setsid --wait bash scripts/check_book_lib_example_block.sh
 
       # BOOK-CLOSEOUT-001 § Phase 4: pmat comply gates all book contracts together
       # (single check that asserts is_compliant=true; ties the linkcheck +
@@ -169,7 +169,7 @@ jobs:
           # fail-open shape check_tool_versions.sh was written to delete — a failed
           # install carried on with whatever was already on PATH, so a bad network day
           # silently downgraded the gate without failing the job that depends on it.
-          bash scripts/check_tool_versions.sh
+          setsid --wait bash scripts/check_tool_versions.sh
           # Validate the book-completeness contract via pv.
           #
           # This line used to call a bare `pv` and exited 127 (command not found)

.github/workflows/ci-unwedge.yml

@@ -65,7 +65,7 @@ jobs:
       # so a broken derivation cancels nothing instead of cancelling the queue.
       # Every guard is mutation-proved load-bearing; see the script header.
       - name: Predicate falsifier (must pass before anything is cancelled)
-        run: bash scripts/check_ci_unwedge.sh --self-test
+        run: setsid --wait bash scripts/check_ci_unwedge.sh --self-test
 
       - name: Scan and free
         env:
@@ -78,7 +78,7 @@ jobs:
         run: |
           set -euo pipefail
           if [ "${DRY_RUN:-false}" = "true" ]; then
-            bash scripts/check_ci_unwedge.sh --scan --repo "$GITHUB_REPOSITORY" --limit 20 --dry-run
+            setsid --wait bash scripts/check_ci_unwedge.sh --scan --repo "$GITHUB_REPOSITORY" --limit 20 --dry-run
           else
-            bash scripts/check_ci_unwedge.sh --scan --repo "$GITHUB_REPOSITORY" --limit 20
+            setsid --wait bash scripts/check_ci_unwedge.sh --scan --repo "$GITHUB_REPOSITORY" --limit 20
           fi

.github/workflows/coverage-nightly.yml

@@ -232,7 +232,7 @@ jobs:
           # one line. The fleet pin (infra machines/*/forjar.yaml) is the only
           # installer this repo may rely on; assert it and fail CLOSED.
           export PATH="$COV_TOOLS/bin:$HOME/.cargo/bin:$HOME/.local/bin:$PATH"
-          bash scripts/check_tool_versions.sh
+          setsid --wait bash scripts/check_tool_versions.sh
 
       # Dogfooded gap analysis — pmat query, NOT raw llvm-cov output (CLAUDE.md).
       # Same default ./target as the make step so pmat finds the coverage profiles.

.github/workflows/cuda-nightly.yml

@@ -204,7 +204,7 @@ jobs:
       # NOT_RUN marker `decide` already wrote is the record.
       - name: PP-26 marker gate can still go RED (case table, no GPU)
         if: steps.decide.outputs.proceed == 'true'
-        run: bash scripts/check_perf041_marker.sh --selftest
+        run: setsid --wait bash scripts/check_perf041_marker.sh --selftest
 
       - name: Preflight — CUDA device + parity model present
         if: steps.decide.outputs.proceed == 'true'
@@ -640,6 +640,54 @@ jobs:
           nice -n 19 cargo test -p aprender-serve --release \
             --test beat_ollama_decode_throughput_speed -- --ignored --nocapture
 
+      # #4179 (binary-debt #4057): F-QW3-MOE-C22214-001 spawns `apr run` on the
+      # 17 GB Qwen3-Coder-30B MoE GGUF (~157 s on lambda) -- huge, so nightly
+      # only, and gx10 holds the model at the test's canonical pacha path.
+      # APR_QW3_MOE_REQUIRE_MODEL=1 turns the test's no-model SKIP into a
+      # failure: in the lane that owns it, a skip would be a pass that measured
+      # nothing. LAST, and `!cancelled()`: it neither delays the measurements
+      # above nor hides behind their failures. Its non-cuda `apr` rebuild comes
+      # after the beat that measures the cuda one.
+      - name: F-QW3-MOE-C22214-001 - apr run emits on the Qwen3-Coder-30B MoE (aprender#4179)
+        if: ${{ !cancelled() && steps.decide.outputs.proceed == 'true' }}
+        env:
+          # The repo var wins; otherwise the runner user's pacha cache. $HOME, not a
+          # literal /home/<user>, so the hardcoded-path ratchet stays flat (#4315).
+          APR_QW3_MOE_GGUF_VAR: ${{ vars.APR_QW3_MOE_GGUF }}
+        run: |
+          set -euo pipefail
+          APR_QW3_MOE_REQUIRE_MODEL=1 \
+            APR_QW3_MOE_GGUF="${APR_QW3_MOE_GGUF_VAR:-$HOME/.cache/pacha/models/2b88b180a790988f.gguf}" \
+            nice -n 19 cargo test -p apr-cli --release --test qwen3_moe_apr_run_live_falsifier -- --nocapture
+
+      # #4250 (G0, #3596): apr serve prefills a Qwen3.5 prompt through ONE batched
+      # prefill on every route. ci.yml's cuda-unit runs this test on yoga-eph, which
+      # has no models, so there it SKIPs as model-absent and is allowed: dark. gx10
+      # holds the model at the test's MODEL_PATH, so this lane refuses the skip.
+      # The per-token run is the RED control, and it is ASSERTED to fail *on the
+      # batched-prefill assert*: a build error or a skip there is not a pass.
+      - name: G0 - serve routes prefill through the batched prefill (aprender#4250)
+        if: ${{ !cancelled() && steps.decide.outputs.proceed == 'true' }}
+        run: |
+          set -uo pipefail
+          t=api::openai_handlers::qwen35_serve_tests::gpu_every_serve_route_prefills_through_the_batched_prefill
+          model="$HOME/models/Qwen3.5-0.8B-Q4_K_M.gguf"
+          [ -f "$model" ] || { echo "::error::#4250 UNMEASURABLE on ${{ matrix.name }} (provisioning): $model is absent"; exit 1; }
+          nice -n 19 cargo test -p aprender-serve --features cuda --lib --release --no-run || exit 1
+          nice -n 19 cargo test -p aprender-serve --features cuda --lib --release -- \
+            "$t" --exact --test-threads 1 --nocapture > g0-green.log 2>&1; g=$?
+          tail -n 20 g0-green.log
+          if [ "$g" -ne 0 ] || grep -q 'is absent' g0-green.log || ! grep -q '^test result: ok. 1 passed' g0-green.log; then
+            echo "::error::#4250 GREEN arm failed or skipped (rc=$g)"; exit 1
+          fi
+          APR_QWEN35_SESSION_PREFILL=per-token nice -n 19 cargo test -p aprender-serve --features cuda --lib --release -- \
+            "$t" --exact --test-threads 1 --nocapture > g0-red.log 2>&1; r=$?
+          tail -n 20 g0-red.log
+          if [ "$r" -eq 0 ] || ! grep -q 'prefilled its prompt one token at a time' g0-red.log; then
+            echo "::error::#4250 RED control did not fail on the batched-prefill assert (rc=$r): the test cannot see per-token prefill"; exit 1
+          fi
+          echo "#4250 G0: GREEN passed, per-token RED control failed as required (rc=$r)"
+
   # ── ada-yoga: the sm_89 leg, restored ─────────────────────────────────────
   #
   # RESTORING A DELETION, NOT INVENTING A LANE. #2740 removed the x86_64 leg

.github/workflows/deploy-apr-install.yml

@@ -61,7 +61,7 @@ jobs:
       # pmat/bashrs are pinned-fleet tools, never installed per-job (BSE-10a,
       # PMAT-1066) — see ci.yml's identical step for why.
       - name: pmat/bashrs must match the pinned fleet versions (never install)
-        run: bash scripts/check_tool_versions.sh
+        run: setsid --wait bash scripts/check_tool_versions.sh
 
       - name: bashrs SEC/DET/IDEM (scripts/install.sh)
         run: bashrs lint --level error scripts/install.sh

.github/workflows/guards-nightly.yml

@@ -120,9 +120,9 @@ jobs:
       # ships 7 rows in both directions (a genuinely absent step still fails, and a
       # manifest that parsed almost nothing is refused rather than passed).
       - name: Manifest-vs-workflow case table (PMAT-3234, both directions)
-        run: bash scripts/check_guards_nightly_manifest.sh --self-test
+        run: setsid --wait bash scripts/check_guards_nightly_manifest.sh --self-test
       - name: Every step the manifest says moved here must exist here
-        run: bash scripts/check_guards_nightly_manifest.sh
+        run: setsid --wait bash scripts/check_guards_nightly_manifest.sh
       # THE COMPARAND, FETCHED ONCE, BEFORE ANY GUARD THAT NEEDS IT -- the
       # SATD step below measures its ceiling on origin/main with the HEAD-built
       # suite, and a depth-1 checkout has no such ref until this runs.
@@ -154,7 +154,7 @@ jobs:
       - name: pmat/bashrs must match the pinned fleet versions (never install)
         # The fleet pin is the only installer; this asserts the version on PATH
         # matches tools.toml and fails closed. Placed before the first use.
-        run: bash scripts/check_tool_versions.sh
+        run: setsid --wait bash scripts/check_tool_versions.sh
       # ─────────────────────────────────────────────────────────────────────
       # THE MOVED STEPS. Copied VERBATIM from ci.yml's guard-cargo job --
       # same `name:`, same `run:`, same docker/mount shape -- because the name
@@ -165,15 +165,15 @@ jobs:
       - name: "Test-tier decision case table (BSE-17): quick/full/reuse, drift is ENV"
         run: bash scripts/ci_test_tier.sh --self-test
       - name: aprender-core builds for wasm32
-        run: bash scripts/check_wasm32_core_builds.sh
+        run: setsid --wait bash scripts/check_wasm32_core_builds.sh
       - name: No test may assert about the fd 0 it inherited
-        run: bash scripts/check_hermetic_stdin_tests.sh
+        run: setsid --wait bash scripts/check_hermetic_stdin_tests.sh
       - name: Publish safety (binary/oversize files in published packages)
-        run: bash scripts/check_publish_safety.sh
+        run: setsid --wait bash scripts/check_publish_safety.sh
       - name: Perf gate can still discriminate (APR-PERF-GATE-001, case table)
         run: bash scripts/perf_gate.sh --selftest
       - name: Book rust examples compile
-        run: bash scripts/check_book_examples_compile.sh
+        run: setsid --wait bash scripts/check_book_examples_compile.sh
       - name: aprender-profile lib tests (was gated by nothing)
         run: cargo test -p aprender-profile --lib
       - name: model-tests falsification suites (was gated by nothing, aprender#2522) -- SATD ceiling measured on the comparand (BSE-03)

.github/workflows/install-script.yml

@@ -50,7 +50,7 @@ jobs:
       # pmat/bashrs are pinned-fleet tools, never installed per-job (BSE-10a,
       # PMAT-1066) — see ci.yml's identical step for why.
       - name: pmat/bashrs must match the pinned fleet versions (never install)
-        run: bash scripts/check_tool_versions.sh
+        run: setsid --wait bash scripts/check_tool_versions.sh
 
       - name: "bashrs SEC/DET/IDEM (scripts/install.sh, scripts/tests/install_test.sh)"
         run: |