@@ -27,10 +27,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Rust
-        run: |
-          curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      # Install Rust via the pinned action rather than piping sh.rustup.rs into a shell. This job holds
+      # contents:write + GH_TOKEN and publishes the otb/mock binaries every bench box downloads as the
+      # frozen instrument; the build-commit self-check below runs AFTER the toolchain install and cannot
+      # catch a compromised toolchain that still compiles the correct source. dtolnay/rust-toolchain is
+      # the same install path bench-tests.yml already trusts.
+      - uses: dtolnay/rust-toolchain@stable
 
       - name: Build mock (Rust, native ${{ matrix.arch }})
         run: |
 
@@ -16,6 +16,10 @@ on:
       - "gateways/**"
       - "lib/**"
       - "run-on-ec2.sh"
+      # history/append.py is the append-only, git-tracked, tamper-evident record; without this path an
+      # edit that regressed its nesting/dedup (audit P1-11, and the top-level-vs-matrix nesting bug) fired
+      # NO workflow and ran NO test - the same paths-as-decoration defect the rig-delivery job documents.
+      - "history/**"
       # The audit gate's own subjects. Without these, an edit that broke bench-audit.py (the exact
       # wrong-key-path class its header describes) or a results push that violated every invariant
       # never triggered the job that exists to catch it - the same paths-as-decoration defect the
@@ -62,6 +66,10 @@ on:
       - "gateways/**"
       - "lib/**"
       - "run-on-ec2.sh"
+      # history/append.py is the append-only, git-tracked, tamper-evident record; without this path an
+      # edit that regressed its nesting/dedup (audit P1-11, and the top-level-vs-matrix nesting bug) fired
+      # NO workflow and ran NO test - the same paths-as-decoration defect the rig-delivery job documents.
+      - "history/**"
       # The audit gate's own subjects. Without these, an edit that broke bench-audit.py (the exact
       # wrong-key-path class its header describes) or a results push that violated every invariant
       # never triggered the job that exists to catch it - the same paths-as-decoration defect the
@@ -188,6 +196,26 @@ jobs:
       - uses: actions/checkout@v4
       - name: The fetch lands files with the mode the commit recorded
         run: bash lib/fetch_modes_test.sh
+      # These lib/ guards existed on disk but ran NOWHERE - lib/** was a path trigger while only
+      # fetch_modes_test.sh was invoked, so a regression in the promote guard (RULES.md's "never
+      # overwrite a better snapshot with a worse one"), the concurrent-publish lock, or the
+      # box-reachability poll shipped green. Run them all here.
+      - name: The promote guard never lets a boot/build failure overwrite a served result
+        run: python3 lib/promote_guard_test.py
+      - name: Concurrent-publish lock (unique per-publish token, owner-only release, flock path)
+        run: bash lib/publish_lock_test.sh
+      - name: Box-reachability poll retries a transient ssh failure before declaring a box gone
+        run: bash lib/box_reachable_test.sh
+      # The provenance chain RULES.md calls the project's core: which instrument each run used.
+      - name: Rig provenance (fetch fallback order, origin labels, results-scoped engine dirty flag)
+        run: bash lib/rig_test.sh
+      # The shared-key lifetime filter behind the 2026-08-21 key-stranding incident.
+      - name: Shared-key teardown filter excludes only this run's own boxes
+        run: bash lib/teardown_filter_test.sh
+      # The append-only history collector: nesting (top-level vs data['matrix']), the dedup-by-
+      # (suite, measured_at) contract, and the dropped-row / garbage-line error paths.
+      - name: Append-only history preserves the nested matrix measurements (and dedups)
+        run: python3 history/append_test.py
 
   mock-shape:
     # The mock must never bottleneck and must serve every dialect identically; its per-dialect
 
@@ -25,13 +25,32 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    # PARITY WITH cf-pages.yml, because this workflow is STILL LIVE (pages: write / id-token: write) and
+    # fires on the same push paths. Without OTB_SINGLE_ENGINE=1 gen-data.mjs would NOT suppress rows a
+    # newer engine has not re-measured (its SINGLE_ENGINE gate only activates when this is literally "1"),
+    # and without the consistency gates below this job would upload a mixed-instrument or internally
+    # inconsistent board straight to the still-live GitHub Pages URL - the exact state cf-pages.yml's
+    # policy exists to prevent. This workflow can be deleted outright once the Cloudflare nameserver
+    # cutover is complete (see cf-pages.yml's header); until then it must not ship a board cf-pages would
+    # refuse.
+    env:
+      OTB_SINGLE_ENGINE: "1"
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 22
       - name: Generate site data
         run: node site/gen-data.mjs
+      # Gate the bundle BEFORE upload, exactly as cf-pages.yml does: structural invariants on the file
+      # being deployed, then the per-surface coverage siblings, then the table==drawer==compare==charts
+      # consistency guard. A red here must block the artifact upload, not ship past it.
+      - name: Structural invariants C1-C5 on the bundle being deployed
+        run: node site/check-consistency.mjs site/data.json
+      - name: Site coverage siblings (URL codec fixed points, one envelope one story)
+        run: node site/test-coverage.mjs
+      - name: Consistency guard (table == drawer == compare == charts)
+        run: node site/test.mjs
       - uses: actions/upload-pages-artifact@v3
         with:
           path: site
 
@@ -36,6 +36,10 @@ __pycache__/
 # orchestrator ships back onto the box. The DURABLE record is rig.box_qualify inside each snapshot
 # (results/snapshots/), which is committed — these are the working files that produced it.
 results/box-qualify/
+# write_snapshot's per-gateway advisory lockfile (flock rendezvous point held across the promote
+# guard's read->decide->rename critical section). Working-directory plumbing, never a result, so it
+# must not be committed alongside the snapshot JSON.
+results/**/.snapshot-lock-*
 target/
 
 # Rendered gateway config. The TEMPLATE (*.tmpl) is the source and is tracked; what the harness
 
@@ -70,19 +70,6 @@
 # equals the difference of its own published legs - the statement that is actually true of them.
 
 
-# The gateway's pinned core count, and how far the two samplers may disagree before it is a defect.
-#
-# NOT TUNING KNOBS. `run-on-ec2.sh` pins the gateway to CORES=0-3, so four is the divisor the
-# utilisation fraction is taken over - if that split changes, this must change with it or the check
-# silently compares against the wrong denominator. The tolerance is deliberately LOOSE (3x) because
-# the honest direction of disagreement is one-sided: the utilisation window spans a little more wall
-# time than the load window, so implied-from-CPU runs BELOW measured. Only the impossible direction
-# is flagged - a gateway appearing to burn more CPU than its cores accumulated, which means it is not
-# confined to them and the comparable-basis claim is false.
-COST_PINNED_CORES = 4
-COST_UTIL_TOLERANCE = 3.0
-
-
 def num(v):
     if isinstance(v, dict):
         v = v.get("value")
@@ -195,7 +182,7 @@ def main():
                 # 0.3 MiB (0.6%) on agentgateway's 48 MiB tree and 11.5 MiB (1.33%) on bifrost's 876 MiB
                 # one. Board-wide: 32 of 92 cells overshoot, median 0.22%, and the only cell above 1% is
                 # the largest tree on the board. That is the artefact's signature, not a defect's.
-                if hwm is not None and peak is not None and peak > hwm:
+                if hwm is not None and hwm != 0 and peak is not None and peak > hwm:
                     warnings.append(
                         f"{at}: sampled peak ({peak:.1f} MiB) exceeds kernel HWM ({hwm:.1f} MiB) by "
                         f"{(peak - hwm):.1f} MiB ({(peak / hwm - 1) * 100:.2f}%) - transient-worker artefact"
 
@@ -380,9 +380,8 @@ def check_sweep_carries_its_latency(name, c):
         "plateaued", "load_s",
         # Absent BECAUSE the measurement succeeded: these describe HOW a window failed to settle, so a
         # window that DID settle has no shape to publish and says exactly that. They are listed here
-        # for the reason every other field is - a null must carry a reason - and NOT held to
-        # check_no_bare_absence's "a served cell publishes a number", which is why that check reads
-        # SHAPE_FIELDS below and lets a reasoned absence stand.
+        # for the reason every other field is - a null must carry a reason in the absences map, which
+        # check_no_bare_absence enforces uniformly for them just like every other field.
         "shape", "idle_shape",
         # The idle window's own verdict and its fitted slope. The memory group measured both on every
         # served cell and CellMemory had nowhere to put them, so they reached the artifact as neither
@@ -393,9 +392,6 @@ def check_sweep_carries_its_latency(name, c):
     ],
 }
 
-# The fields whose absence is a RESULT rather than a gap. See the note in ABSENCE_CARRYING_FIELDS.
-SHAPE_FIELDS = {"memory": {"shape", "idle_shape"}}
-
 # The absence reasons that legitimately excuse a CAPACITY metric from being a number. Everything
 # else must be a number - a gateway that failed the gate at every rung is a measured 0, not a hole.
 CAPACITY_ABSENCE_OK = {"untestable", "rig_limited", "search_exhausted", "harness_error", "not_served"}
 
@@ -306,6 +306,27 @@ def main():
         if list(audit.check_stream_capacity_is_a_number("t", explained)):
             failures.append("check_stream_capacity_is_a_number rejected an absence that explains itself")
 
+    # ── check_search_spent_its_budget: the budget-EXHAUSTED accept side ────────────────────────────
+    #
+    # The REJECTS entry above proves the GAVE-UP branch (a gap the search declined to probe). Its own
+    # accept short-circuit `if walked_down >= MAX_CEILING_STEPDOWNS: return` had no positive fixture: a
+    # search that spent its FULL step-down budget ran OUT, it did not give up, and must be accepted even
+    # though it stopped at a rung above the one it carried. This is the plano anthropic>anthropic shape
+    # from the 2026-08-01 run - the bisection proved c=224, confirmation failed, and the step-down
+    # walked 176 -> 152 -> 140 -> 134, exactly MAX_CEILING_STEPDOWNS rungs. Delete or invert that
+    # short-circuit and this block fires; the REJECTS-side gap fixture would still pass, so only this
+    # catches it.
+    with isolated(failures, "check_search_spent_its_budget: budget-exhausted accept side"):
+        spent = [rung(32), rung(64), rung(224, passed=False), rung(176, passed=False),
+                 rung(152, passed=False), rung(140, passed=False), rung(134, passed=False)]
+        assert len({r["conc"] for r in spent if r["conc"] > 64 and r["conc"] < 224}) == audit.MAX_CEILING_STEPDOWNS
+        budget_spent = trace_cell(spent, sustained=None,
+                                  absence_detail="the bisection proved c=224 but no stepped-down rung "
+                                                 "held within MAX_CEILING_STEPDOWNS attempts")
+        if list(audit.check_search_spent_its_budget("t", budget_spent)):
+            failures.append("check_search_spent_its_budget flagged a search that spent its FULL "
+                            "step-down budget - a run-out is not a give-up")
+
     # ── the omitted-field check, both ways (ledger TOOL-04) ───────────────────────────────────────
     #
     # ACCEPT: a cell that carries every declared field passes, whether the field holds a number or an
 
@@ -140,14 +140,12 @@ def cell_fraction_done(phase_name):
 IP_RE = re.compile(r"ip=([0-9.]+)")
 TS_RE = re.compile(r"^\[(\d\d):(\d\d):(\d\d)\]")
 
-# A cell whose verdict is one of these was skipped or refused, and cost almost nothing. Anything else
-# was measured, and is what the remaining time is actually made of.
-CHEAP = ("not_configurable", "untestable", "unprobed_auth")
-# A CELL IS SERVED ONLY IF THE ENGINE SAID SO. This used to count anything whose verdict was not one
-# of CHEAP, which is fail-open: a new line shaped like `[cell N/M] <id>: <anything>` silently became a
-# served cell. That happened the day a per-cell cost breakdown was added under the same prefix - every
-# measured cell counted twice, gateways showed "10/8 served", and the ETA hit zero while they were
-# still running. Listing what DOES count means an unrecognised line is ignored rather than believed.
+# A CELL IS SERVED ONLY IF THE ENGINE SAID SO. This used to count anything whose verdict was not a
+# cheap skip/refusal ("not_configurable", "untestable", "unprobed_auth"), which is fail-open: a new
+# line shaped like `[cell N/M] <id>: <anything>` silently became a served cell. That happened the day a
+# per-cell cost breakdown was added under the same prefix - every measured cell counted twice, gateways
+# showed "10/8 served", and the ETA hit zero while they were still running. Listing what DOES count
+# means an unrecognised line is ignored rather than believed.
 MEASURED = ("served", "failed")
 
 
 
@@ -13,7 +13,8 @@
   cell-verdict.py --baseline <snap.json> --new <partial.json> --state <state.json> [--count-only]
 
 A cell counts as "measured" once it has a frontier RPS at the 10ms p99 bound; latency (added p50/p99,
-c=1 p99, cpu us/req) rides along as corroboration. Absences print their own reason rather than a zero.
+c=1 p99, cpu us/req) rides along as corroboration. An absent corroboration figure prints an em-dash
+(—) rather than a zero, so a missing measurement is never shown as a real value.
 """
 import argparse
 import json
@@ -52,6 +53,8 @@ def frontier_rps(cell, bound_us=BOUND_US):
 
 
 def perf_num(cell, field):
+    if not cell:
+        return None
     return ((cell.get("perf") or {}) or {}).get(field)
 
 
 
@@ -1,7 +1,10 @@
 #!/usr/bin/env python3
-"""Side-by-side: busbar 1.4.1 (published board) vs busbar 1.5.0 (private evaluation).
+"""Side-by-side: busbar 1.4.1 (published board) vs the private-eval busbar build.
 
-Reads the 1.4.1 numbers from its committed snapshot and the 1.5.0 numbers from whatever the
+The private-eval build's display name is read from its own gateways/busbar-151/definition.json (so the
+label never drifts from the version actually measured), NOT hardcoded here.
+
+Reads the 1.4.1 numbers from its committed snapshot and the private-eval numbers from whatever the
 evaluation box has written so far - the live `busbar-151.json`, pulled partial, or final snapshot -
 so a cell can be compared the moment it lands rather than at the end of an 11-hour grid.
 
@@ -88,6 +91,16 @@ def delta(a, b):
 ]
 
 HERE = os.path.dirname(os.path.abspath(__file__))
+
+
+def gateway_display(gw, fallback):
+    """The gateway's own declared display name, so a version label never drifts from the data it
+    prints. The private-eval snapshots come from gateways/<gw>/definition.json's build."""
+    d = load(os.path.join(HERE, "gateways", gw, "definition.json")) or {}
+    return d.get("display") or fallback
+
+
+NEW_DISPLAY = gateway_display("busbar-151", "Busbar 1.5.1")
 pairs = sys.argv[1:] or ["openai>openai"]
 
 old_doc = load(newest(os.path.join(HERE, "results/snapshots/result_busbar_2026-08-02*.json"))
@@ -98,17 +111,17 @@ def delta(a, b):
 new_doc = load(new_path)
 
 print(f"busbar 1.4.1 (published board)  <-  {os.path.basename(newest(os.path.join(HERE,'results/snapshots/result_busbar_2026-08-02*.json')) or '?')}")
-print(f"busbar 1.5.0 (private eval)     <-  {os.path.basename(new_path) if new_path else 'not written yet'}")
+print(f"{NEW_DISPLAY} (private eval)  <-  {os.path.basename(new_path) if new_path else 'not written yet'}")
 print()
 
 for pair in pairs:
     ing, _, eg = pair.partition(">")
     a, b = cell_of(old_doc, ing, eg), cell_of(new_doc, ing, eg)
     print(f"=== {ing} > {eg} ===")
     if not b:
-        print("  1.5.0 has not written this cell yet\n")
+        print(f"  {NEW_DISPLAY} has not written this cell yet\n")
         continue
-    print(f"  {'metric':<20} {'1.4.1':<28} {'1.5.0':<28}")
+    print(f"  {'metric':<20} {'1.4.1':<28} {NEW_DISPLAY:<28}")
     for label, block, field, unit, higher_better in ROWS:
         av, ar = num(a, block, field)
         bv, br = num(b, block, field)