Release-bins lookup: a tag dispatch finds its own cache entry (API scope spelling refs/heads/<ref>)

[gunbai-bot]

Every fleet-converge dispatch on a tag at a sha whose release bins were first built on that tag refuses with StoreTransportDisagreeAbsentHit. That blocks the pinned-tag deploy pattern, including the #12482 door roll-forward on deploy/door-8e0c1fad16: runs 36653382960 and 36653490246.

Earliest wrong link (DESIGN §6b). The disagreement check refused correctly given the two observations it was handed. What was wrong is the model's assumption, in gunbc.fleet_release_bins_key release_bins_lookup_refs, that the cache API reports a dispatch's own scope as GITHUB_REF. Querying the API for key release-bins-25f14b25… (saved by plan run 36652280985 on that tag) shows ref=refs/heads/refs/tags/deploy/door-8e0c1fad16. The lookup matched refs/tags/deploy/door-8e0c1fad16, read the entry as absent, and actions/cache restored it as an exact hit.

The earlier tag apply on deploy/12482-178fb76c71 (run 36581756988) passed only because that sha's bins were already admitted under refs/heads/main.

Fix.

• The dispatch lookup reads RELEASE_BINS_DISPATCH_SCOPE_REF, which the step derives from github.ref: a tag becomes refs/heads/<ref>, and a branch is used verbatim.
• This is one spelling of the same ref, not a second admitted scope. An entry under any other tag or branch still reads absent.
• The disagreement check is untouched.
• The spelling is an observation of GitHub's cache API, and the code says so. If it changes, the lookup reads absent and refuses; it never widens.

Evidence, executed locally:

• test.claim.long.fleet_release_bins_key_witness release_bins_tag_dispatch_entry_is_present: the real decoder, over an answer listing the entry under the tag's API spelling, reads present. Under the old GITHUB_REF match the fixture reads absent.
• release_bins_RED_other_tag_entry_is_absence: another tag's entry still reads absent.
• release_bins_lookup_valid_empty_answer_is_absence is unchanged.
• fleet-converge.yml was regenerated with main_wet, and it is the only generated file that changed.
• Files gunbc.recurring_failure_mode a_tag_dispatch_cannot_find_its_own_cache_entry, which carries both run ids.

After merge: the discriminating live check is re-running the door apply on deploy/door-8e0c1fad16. Its bins were saved only under the tag's scope, so the retry must find them present and reuse them.

🤖 Generated with Claude Code

[gunbai-bot]

Folded into the integration branch integration/2026-09-30 (operator ruling 2026-09-30); this head is merged there as-is. — sent from proud-deer-538