@@ -202,26 +202,67 @@ export function c6Inversions(gwKey, rawMatrix) {
 //   - a gateway carries no engine stamp at all, while another does (silently pre-stamp data mixed in)
 // A board where NO gateway is stamped is left alone: that is entirely pre-stamp data, and failing it
 // would only punish history it cannot fix. The moment one stamped run lands, all of them must be.
-export function engineAgreement(gwKeys, resolve = (k) => newestSnapshotOnDisk(k)) {
+// Commits the repo ATTESTS are the same instrument, with built-artifact evidence. See
+// site/instrument-equivalence.json for the rule an entry has to meet. Returns commit -> instrument
+// id; a commit nobody attested maps to itself, so an unreadable or absent file degrades to the
+// original commit-equality behaviour rather than to a board that publishes anything.
+export function instrumentOf(fileText) {
+  const map = new Map();
+  let doc;
+  try { doc = JSON.parse(fileText); } catch { return map; }
+  for (const inst of (doc && doc.instruments) || []) {
+    if (!inst || !inst.id || !Array.isArray(inst.commits)) continue;
+    // An entry with no artifact evidence is INERT, not trusted: the file's own rule is that identical
+    // binaries are what admits an entry, and a rule nothing enforces is a comment.
+    const ev = inst.evidence && inst.evidence.otb_release_sha256;
+    const hashes = ev ? Object.values(ev) : [];
+    const proven = hashes.length >= inst.commits.length && new Set(hashes).size === 1;
+    if (!proven) continue;
+    for (const c of inst.commits) map.set(c, inst.id);
+  }
+  return map;
+}
+
+export function engineAgreement(gwKeys, resolve = (k) => newestSnapshotOnDisk(k), opts = {}) {
   const errors = [];
-  const seen = new Map();   // commit -> [gwKey]
+  const seen = new Map();   // instrument id -> [gwKey]
+  const commitsOf = new Map();  // instrument id -> Set(commit)
   const unstamped = [];
   let checked = 0;
+  const equiv = opts.equivalence !== undefined
+    ? opts.equivalence
+    : instrumentOf(readFileSync(join(ROOT, "site", "instrument-equivalence.json"), "utf8"));
   for (const k of gwKeys) {
     const found = resolve(k);
     const eng = found && found.snap && found.snap.rig && found.snap.rig.engine;
     if (!eng || !eng.commit) { unstamped.push(k); continue; }
     checked += 1;
     if (eng.dirty === true)
       errors.push(`C8: ${k} was measured by a DIRTY harness tree (engine.commit=${eng.commit.slice(0, 12)} with uncommitted edits) - the commit does not identify what ran, so this run is not reproducible and must be re-measured on a clean tree`);
-    if (!seen.has(eng.commit)) seen.set(eng.commit, []);
-    seen.get(eng.commit).push(k);
+    // The instrument, not the commit. Two commits that build the same binaries measured the same way,
+    // and failing that costs a whole field re-run to change nothing.
+    const inst = equiv.get(eng.commit) || eng.commit;
+    if (!seen.has(inst)) { seen.set(inst, []); commitsOf.set(inst, new Set()); }
+    seen.get(inst).push(k);
+    commitsOf.get(inst).add(eng.commit);
   }
   if (checked > 0 && unstamped.length > 0)
     errors.push(`C8: ${unstamped.length} gateway(s) carry no engine stamp (${unstamped.join(", ")}) while ${checked} do - the board would be mixing pre-stamp data with stamped data and cannot show they came from the same harness; re-measure the unstamped gateways`);
   if (seen.size > 1) {
     const groups = [...seen.entries()].map(([c, ks]) => `${c.slice(0, 12)}: ${ks.join(", ")}`).join(" | ");
-    errors.push(`C8: the board mixes ${seen.size} harness engines (${groups}) - columns measured by different instruments are not comparable, so a defect fixed between those commits applies to only part of the field; re-run the lagging gateways on the newest engine`);
+    const msg = `C8: the board mixes ${seen.size} harness engines (${groups}) - columns measured by different instruments are not comparable, so a defect fixed between those commits applies to only part of the field; re-run the lagging gateways on the newest engine`;
+    // THE OVERRIDE, for the rare case where the board must ship over C8's objection. It is deliberately
+    // awkward: it takes the reason as its value, it cannot be set by accident, and it does not silence
+    // anything. The mix is still reported, still counted, and rides along in the returned result so the
+    // caller publishes the fact that a human overrode a publish guard. An override nobody can see after
+    // the fact is just a disabled check.
+    const why = (opts.override !== undefined ? opts.override : process.env.OTB_ALLOW_MIXED_ENGINES) || "";
+    if (why.trim().length >= 12) {
+      return { errors, checked, commits: [...seen.keys()], overridden: { check: "C8.mix", reason: why.trim(), detail: msg } };
+    }
+    if (why.trim().length > 0)
+      errors.push(`C8: OTB_ALLOW_MIXED_ENGINES was set to ${JSON.stringify(why)}, which is not a reason - the override takes the justification as its value (12 characters or more) so that what gets published records WHY a publish guard was overridden`);
+    errors.push(msg);
   }
   return { errors, checked, commits: [...seen.keys()] };
 }
 
@@ -0,0 +1,27 @@
+{
+  "_what": "Commits that are DIFFERENT commits but the SAME INSTRUMENT. C8 groups the board by instrument, not by commit sha; every commit listed under one instrument id is treated as that instrument. A commit absent from this file is its own instrument, which is the safe default: silence never merges anything.",
+  "_why": "C8's claim is that one instrument measured every column, so the only thing differing between two columns is the gateway. The commit sha is a PROXY for the instrument, and it is a loose one in exactly one direction: a commit can change while the instrument does not (a gateway's own config, a test, a workflow). Failing those is a false positive that costs a full field re-run for no gain in truth. The proxy is never loose the other way, so this file can only ever excuse a difference the binaries prove is not there.",
+  "_evidence_rule": "An entry is only admissible with BUILT-ARTIFACT evidence: build the shipped binaries at each commit and record their hashes. Identical bytes out of a reproducible build is proof, not argument. Do NOT add an entry reasoned from a diff - 'this looks test-only' is how a real instrument change gets waved through. If the binaries differ, the commits are different instruments and the field re-runs.",
+  "instruments": [
+    {
+      "id": "otb-1fc78d7c",
+      "commits": [
+        "dd26a545026be44a0c38589242859138df05b2eb",
+        "8d742122630fb6cf66ea37969cf50469c8affde9"
+      ],
+      "reason": "The 14-box field ran on dd26a54. Plano failed to boot on it for two config reasons, and 8d74212 fixes plano's own config, corrects plano's matrix, adds tests, and wires an existing test into CI. Re-running the other thirteen to move a gateway config file would have changed no measurement.",
+      "evidence": {
+        "method": "cargo build --release --bin otb at each commit in a clean worktree, plus the mock-arm64 asset that bench-rig rebuilt from 8d74212, compared against the hash the running boxes recorded",
+        "otb_release_sha256": {
+          "dd26a545026be44a0c38589242859138df05b2eb": "1fc78d7c1e62db459e666e69b2bab4325c17ec385417b1f60cd603078f289631",
+          "8d742122630fb6cf66ea37969cf50469c8affde9": "1fc78d7c1e62db459e666e69b2bab4325c17ec385417b1f60cd603078f289631"
+        },
+        "mock_arm64_sha256": {
+          "recorded_by_boxes_on_dd26a54": "9a1c7b0e10f846602cf0e19a96f2d1e4a0e3f50b3b2634aa6786053a13cf9ab5",
+          "rebuilt_by_ci_from_8d74212": "9a1c7b0e10f846602cf0e19a96f2d1e4a0e3f50b3b2634aa6786053a13cf9ab5"
+        },
+        "verified_at": "2026-07-28T05:50:00Z"
+      }
+    }
+  ]
+}
@@ -3004,3 +3004,99 @@ test("protocol grid: a matrix-less gateway renders an all-n/a row with its reaso
 });
 
 console.log(`\n${passed} tests passed`);
+
+// ---- C8: THE BOARD IS GROUPED BY INSTRUMENT, NOT BY COMMIT SHA -----------------------------------
+//
+// C8's claim is that one instrument measured every column. The commit sha is a PROXY for that, and it
+// is loose in exactly one direction: a commit can change while the instrument does not. A gateway's
+// own config file, a test, a workflow - none of them can alter how a DIFFERENT gateway was measured,
+// yet each moves the sha and each used to cost a full field re-run to satisfy a check that would have
+// learned nothing. The proxy is never loose the other way, so attesting equivalence can only ever
+// excuse a difference the built binaries prove is not there.
+test("C8: commits the repo attests are one instrument, with artifact evidence, do not read as a mixed board", () => {
+  const snapOf = (commit) => ({ snap: { rig: { engine: { commit, dirty: false } } } });
+  const A = "a".repeat(40), B = "b".repeat(40);
+  const resolve = (k) => snapOf(k === "plano" ? B : A);
+  const keys = ["bifrost", "one-api", "plano"];
+
+  // RED-before: with no attestation, two commits are two instruments and the board is refused. This
+  // is the behaviour being preserved for every case that is NOT attested, so it is asserted first.
+  const bare = checkMod.engineAgreement(keys, resolve, { equivalence: new Map() });
+  assert.equal(bare.errors.length, 1, "an unattested mix must still fail");
+  assert.match(bare.errors[0], /mixes 2 harness engines/);
+
+  // GREEN-after: the same board, with the two commits attested as one instrument, publishes.
+  const attested = checkMod.instrumentOf(JSON.stringify({
+    instruments: [{ id: "otb-1fc78d7c", commits: [A, B],
+      evidence: { otb_release_sha256: { [A]: "1fc78d7c", [B]: "1fc78d7c" } } }],
+  }));
+  const ok = checkMod.engineAgreement(keys, resolve, { equivalence: attested });
+  assert.deepEqual(ok.errors, [], "commits proven to build the same binary are one instrument");
+  assert.equal(ok.checked, 3);
+
+  // An attestation whose evidence does NOT show identical binaries is inert. The file's rule is that
+  // identical bytes admit an entry; a rule nothing enforces is a comment, and this is the case where
+  // a real instrument change would otherwise be waved through by a hand-written claim.
+  const unproven = checkMod.instrumentOf(JSON.stringify({
+    instruments: [{ id: "wishful", commits: [A, B],
+      evidence: { otb_release_sha256: { [A]: "1111", [B]: "2222" } } }],
+  }));
+  assert.equal(unproven.size, 0, "differing binaries are differing instruments, whatever the file claims");
+  assert.equal(checkMod.engineAgreement(keys, resolve, { equivalence: unproven }).errors.length, 1);
+
+  // No evidence block at all is equally inert.
+  assert.equal(checkMod.instrumentOf(JSON.stringify({
+    instruments: [{ id: "bare", commits: [A, B] }] })).size, 0);
+  // Unparseable or absent file degrades to commit-equality, never to "everything agrees".
+  assert.equal(checkMod.instrumentOf("{ not json").size, 0);
+});
+
+// ---- C8: the override is loud, reasoned, and published ------------------------------------------
+//
+// A publish guard sometimes has to be overridden. The failure mode of an override is that it is
+// silent: a boolean env var flips, the board ships, and six months later nobody can say which numbers
+// were published over an objection. So the override takes the REASON as its value and hands it back to
+// the caller to publish. An override nobody can see after the fact is a disabled check.
+test("C8: the mixed-board override demands a reason and returns it for publication", () => {
+  const snapOf = (commit) => ({ snap: { rig: { engine: { commit, dirty: false } } } });
+  const resolve = (k) => snapOf(k === "plano" ? "b".repeat(40) : "a".repeat(40));
+  const keys = ["bifrost", "plano"];
+  const run = (override) => checkMod.engineAgreement(keys, resolve, { equivalence: new Map(), override });
+
+  assert.equal(run(undefined).errors.length, 1, "no override: the mix is refused");
+
+  // A truthy-but-meaningless value is NOT an override. This is the "1"/"true" habit the check exists
+  // to refuse, and it fails with a message saying what the field is for.
+  const bogus = run("1");
+  assert.equal(bogus.overridden, undefined, "a flag is not a justification");
+  assert.match(bogus.errors.join("\n"), /not a reason/);
+  assert.match(bogus.errors.join("\n"), /mixes 2 harness engines/, "and the original objection still stands");
+
+  // A real reason publishes, and the objection travels WITH the result rather than vanishing.
+  const forced = run("plano re-ran on a gateway-config-only commit; binaries verified identical");
+  assert.deepEqual(forced.errors, []);
+  assert.equal(forced.overridden.check, "C8.mix");
+  assert.match(forced.overridden.reason, /binaries verified identical/);
+  assert.match(forced.overridden.detail, /mixes 2 harness engines/,
+    "what was overridden is recorded, not just that something was");
+});
+
+// ---- the shipped attestation is itself valid ----------------------------------------------------
+// The file in the repo is data the publish path trusts, so it is tested like code: it must parse, and
+// every entry in it must meet the evidence rule it states for itself.
+test("C8: the repo's own instrument-equivalence.json meets the evidence rule it declares", () => {
+  const raw = readFileSync(join(ROOT, "site", "instrument-equivalence.json"), "utf8");
+  const doc = JSON.parse(raw);
+  const admitted = checkMod.instrumentOf(raw);
+  for (const inst of doc.instruments) {
+    const hashes = Object.values((inst.evidence || {}).otb_release_sha256 || {});
+    assert.equal(hashes.length, inst.commits.length,
+      `${inst.id}: every attested commit needs a built-artifact hash, not a subset`);
+    assert.equal(new Set(hashes).size, 1, `${inst.id}: the hashes must actually be identical`);
+    assert.ok(inst.reason && inst.reason.length > 20, `${inst.id}: an entry states why it exists`);
+    for (const c of inst.commits) {
+      assert.match(c, /^[0-9a-f]{40}$/, `${inst.id}: commits are full shas, so they cannot be ambiguous`);
+      assert.equal(admitted.get(c), inst.id, `${inst.id}: ${c.slice(0, 12)} must be admitted`);
+    }
+  }
+});