diff --git a/.gitattributes b/.gitattributes
index 33be96150eb..2cff62757c6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -19,6 +19,7 @@
 .github/workflows/fleet-desired.yml merge=generated-artifact
 .github/workflows/heal-publish.yml merge=generated-artifact
 .github/workflows/heal.yml merge=generated-artifact
+.github/workflows/instrument-dispatch.yml merge=generated-artifact
 .github/workflows/microvm-shakedown.yml merge=generated-artifact
 .github/workflows/witnesses.yml merge=generated-artifact
 .gitignore merge=generated-artifact
diff --git a/.github/workflows/instrument-dispatch.yml b/.github/workflows/instrument-dispatch.yml
new file mode 100644
index 00000000000..0884b981005
--- /dev/null
+++ b/.github/workflows/instrument-dispatch.yml
@@ -0,0 +1,105 @@
+# Generated by gunbc.instrument_dispatch_workflow expected_instrument_dispatch_yml — do not hand-edit.
+# Authority: gunbc.instrument_dispatch_workflow instrument_dispatch_workflow; regen via tools.generated_artifact_gate main_wet.
+name: instrument-dispatch
+run-name: instrument-dispatch ${{ inputs.label }}
+on:
+  workflow_dispatch:
+    inputs:
+      label:
+        description: The rostered instrument to run (gunbc.instrument_targets); the run executes `gunbc test <label>` at the dispatched ref.
+        required: true
+        options: [//gunbc/instruments:dag-emit-real-grammar-round-trips]
+        type: choice
+permissions:
+  contents: read
+concurrency: instrument-dispatch
+jobs:
+  instrument:
+    runs-on: [self-hosted, linux, arm64]
+    timeout-minutes: 240
+    permissions:
+      contents: read
+    steps:
+      - name: Seed the run's receipt before anything that can fail
+        id: seed_receipt
+        run: |
+          set -e
+          'mkdir' '-p' "$RUNNER_TEMP"'/instrument-dispatch'
+          'echo' 'instrument-dispatch label='"$INSTRUMENT_LABEL"' revision='"$GITHUB_SHA"' run='"$GITHUB_RUN_ID"' attempt='"$GITHUB_RUN_ATTEMPT" > "$RUNNER_TEMP"'/instrument-dispatch/receipt.txt'
+          'echo' 'not-started' > "$RUNNER_TEMP"'/instrument-dispatch/stdout.txt'
+          'echo' 'exit=not-started' > "$RUNNER_TEMP"'/instrument-dispatch/exit.txt'
+        shell: bash
+        env:
+          INSTRUMENT_LABEL: ${{ inputs.label }}
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - name: Isolate toolchain homes
+        run: |-
+          # dissolve-on: ci_toolchain_home_isolation_script -- orch-emitted foreign-executor prelude step wiping and setting HOME/CARGO_HOME/RUSTUP_HOME under RUNNER_TEMP so concurrent runner slots stop sharing one toolchain; leaf rm/echo strings remain until a typed per-job filesystem-and-environment effect lands on host_effect_apply (shell-to-intent Phase 2). This obligation covers THIS carrier and ci_isolate_toolchain_script, which share that terminal construction; ci_pin_rustup_default_script carries its own obligation because it does not
+          rm -rf "$RUNNER_TEMP/rustup" "$RUNNER_TEMP/cargo"
+          echo "HOME=$RUNNER_TEMP" >> "$GITHUB_ENV"
+          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
+          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7
+        with:
+          components: rustfmt
+          cache: false
+          rustflags: -D warnings
+      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
+        run: |-
+          # dissolve-on: ci_pin_rustup_default_script -- orch-emitted foreign-executor step selecting a rustup default toolchain inside an isolated RUSTUP_HOME, which starts with none, and resolving the cargo binary that selection implies. The leaf rustup/command/echo strings remain until a typed TOOLCHAIN-SELECTION effect lands on host_effect_apply -- NOT the filesystem-and-environment effect ci_toolchain_home_isolation_script waits on, which is why this is a separate obligation: that effect landing alone would leave this carrier standing
+          rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
+          if [ -x "$CARGO_HOME/bin/cargo" ]; then CARGO_BIN="$CARGO_HOME/bin/cargo"; else CARGO_BIN="$(command -v cargo || true)"; fi
+          if [ -z "$CARGO_BIN" ]; then echo "::error::no cargo binary: neither the isolated $CARGO_HOME/bin/cargo shim nor PATH carries one"; exit 1; fi
+          echo "CARGO_BIN=$CARGO_BIN" >> "$GITHUB_ENV"
+      - name: Build the compiler
+        id: build_witness_fold
+        run: |+
+          GUNBC_FLOOR_LOG='gunbc-floor-cmd.log'
+          'set' '+e'
+          'set' '-o' 'pipefail'
+          ('sh' '-e' '-c' 'cargo build --release -p v1-compiler --bin gunbc') 2>&1 | 'tee' "$GUNBC_FLOOR_LOG"
+          GUNBC_FLOOR_EXIT="$?"
+          GUNBC_FLOOR_RECEIPT='gunbc-floor-outcome.txt'
+          GUNBC_FLOOR_CLASS='structural'
+          GUNBC_FLOOR_SIGNATURE=''
+          if '[' "$GUNBC_FLOOR_EXIT" '-eq' '126' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandInvokedCannotExecute'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '127' ']'; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='CommandNotFound'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' "$GUNBC_FLOOR_EXIT" '-eq' '0' ']'; then GUNBC_FLOOR_CLASS='none'; GUNBC_FLOOR_SIGNATURE=''; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'MemoryStallRefusedPageThrash' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='MemoryStallRefusedPageThrash'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'The runner has received a shutdown signal' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='RunnerLost'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: error: failed to execute compile' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFailedToExecuteCompile'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' '(exit status: 254)' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheRustcWrapperExit254'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'sccache: encountered fatal error' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='SccacheFatalError'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'failed to spawn' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ProcessSpawnFailure'; fi
+          if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' && '[' '-f' "$GUNBC_FLOOR_LOG" ']' && 'grep' '-q' 'Resource temporarily unavailable' "$GUNBC_FLOOR_LOG"; then GUNBC_FLOOR_CLASS='infra'; GUNBC_FLOOR_SIGNATURE='ResourceTemporarilyUnavailable'; fi
+          if (! '[' '-f' "$GUNBC_FLOOR_RECEIPT" ']') || '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']' || ('[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT"))) || ('[' "$GUNBC_FLOOR_CLASS" '=' 'none' ']' && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=structural' "$GUNBC_FLOOR_RECEIPT")) && (! ('[' '-f' "$GUNBC_FLOOR_RECEIPT" ']' && 'grep' '-q' 'class=infra' "$GUNBC_FLOOR_RECEIPT"))); then 'printf' 'class=%s\nsignature=%s\nexit=%s\n' "$GUNBC_FLOOR_CLASS" "$GUNBC_FLOOR_SIGNATURE" "$GUNBC_FLOOR_EXIT" > "$GUNBC_FLOOR_RECEIPT"; if '[' "$GUNBC_FLOOR_CLASS" '=' 'infra' ']'; then 'echo' '::error title=environment::floor_class='"$GUNBC_FLOOR_CLASS"' signature='"$GUNBC_FLOOR_SIGNATURE"' exit='"$GUNBC_FLOOR_EXIT"'; this is not a verdict about the diff. Attempt receipt: '"$GUNBC_FLOOR_RECEIPT"; fi; if '[' "$GUNBC_FLOOR_CLASS" '=' 'structural' ']'; then 'echo' '::error title=subject::floor_class='"$GUNBC_FLOOR_CLASS"' exit='"$GUNBC_FLOOR_EXIT"'; read the step log for the subject defect'; fi; fi
+          'exit' "$GUNBC_FLOOR_EXIT"
+
+      - name: Require isolated toolchain homes
+        run: |
+          if [ -z "${CARGO_HOME:-}" ] || [ -z "${RUSTUP_HOME:-}" ]; then echo "::error::ToolchainHomesNotIsolated CARGO_HOME=${CARGO_HOME:-unset} RUSTUP_HOME=${RUSTUP_HOME:-unset} -- the isolation step did not run, so this job shares a toolchain with every other runner slot on this host and a concurrent install can replace a binary mid-run" >&2; exit 1; fi
+        if: "!cancelled()"
+      - name: Run the dispatched instrument
+        id: instrument
+        run: |
+          set -e
+          status='0'
+          'target/release/gunbc' 'test' "$INSTRUMENT_LABEL" > "$RUNNER_TEMP"'/instrument-dispatch/stdout.txt' || status="$?"
+          'cat' "$RUNNER_TEMP"'/instrument-dispatch/stdout.txt'
+          'echo' 'exit='"$status" > "$RUNNER_TEMP"'/instrument-dispatch/exit.txt'
+          '[' "$status" '=' '0' ']'
+        shell: bash
+        env:
+          INSTRUMENT_LABEL: ${{ inputs.label }}
+      - name: Upload the run's receipt and output
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: instrument-dispatch-receipt
+          path: ${{ runner.temp }}/instrument-dispatch
+          if-no-files-found: error
+          retention-days: 30
+        if: always()
diff --git a/dag/gunbc/generated_artifact.dag b/dag/gunbc/generated_artifact.dag
index 76f02388cb2..6a2ad48cefd 100644
--- a/dag/gunbc/generated_artifact.dag
+++ b/dag/gunbc/generated_artifact.dag
@@ -14,6 +14,7 @@ type GeneratedArtifact
   | FleetConvergeYamlArtifact
   | FleetDesiredAdmissionYamlArtifact
   | MicrovmShakedownYamlArtifact
+  | InstrumentDispatchYamlArtifact
   | HealWorkflowYamlArtifact
   | HealPublisherWorkflowYamlArtifact
   | GitignoreArtifact
@@ -174,6 +175,7 @@ fn artifact_location(a: GeneratedArtifact) -> ArtifactLocation {
     FleetConvergeYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "fleet-converge.yml" }
     FleetDesiredAdmissionYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "fleet-desired.yml" }
     MicrovmShakedownYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "microvm-shakedown.yml" }
+    InstrumentDispatchYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "instrument-dispatch.yml" }
     HealWorkflowYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "heal.yml" }
     HealPublisherWorkflowYamlArtifact => ArtifactLocation { directory: ".github/workflows", name: "heal-publish.yml" }
     GitignoreArtifact => ArtifactLocation { directory: ".", name: ".gitignore" }
@@ -265,6 +267,7 @@ fn artifact_commit_policy(a: GeneratedArtifact) -> CommitPolicy {
     FleetConvergeYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     FleetDesiredAdmissionYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     MicrovmShakedownYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
+    InstrumentDispatchYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     HealWorkflowYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     HealPublisherWorkflowYamlArtifact => CommitRequired { consumer: GithubActionsWorkflow }
     RoadmapArtifact => CommitRequired { consumer: ProjectDocumentation }
@@ -323,6 +326,7 @@ fn artifact_eq(a: GeneratedArtifact, b: GeneratedArtifact) -> Bool {
     FleetConvergeYamlArtifact => match b { FleetConvergeYamlArtifact => true  _ => false }
     FleetDesiredAdmissionYamlArtifact => match b { FleetDesiredAdmissionYamlArtifact => true  _ => false }
     MicrovmShakedownYamlArtifact => match b { MicrovmShakedownYamlArtifact => true  _ => false }
+    InstrumentDispatchYamlArtifact => match b { InstrumentDispatchYamlArtifact => true  _ => false }
     HealWorkflowYamlArtifact => match b { HealWorkflowYamlArtifact => true  _ => false }
     HealPublisherWorkflowYamlArtifact => match b { HealPublisherWorkflowYamlArtifact => true  _ => false }
     GitignoreArtifact => match b { GitignoreArtifact => true  _ => false }
@@ -398,6 +402,7 @@ fn artifact_producer(a: GeneratedArtifact) -> DeclarationRef {
     FleetConvergeYamlArtifact => decl_ref(module_path: "gunbc.fleet_converge_workflow", decl_name: "expected_fleet_converge_yml")
     FleetDesiredAdmissionYamlArtifact => decl_ref(module_path: "gunbc.fleet_desired_admission_workflow", decl_name: "expected_fleet_desired_yml")
     MicrovmShakedownYamlArtifact => decl_ref(module_path: "gunbc.runner_microvm_shakedown_workflow", decl_name: "expected_microvm_shakedown_yml")
+    InstrumentDispatchYamlArtifact => decl_ref(module_path: "gunbc.instrument_dispatch_workflow", decl_name: "expected_instrument_dispatch_yml")
     HealWorkflowYamlArtifact => decl_ref(module_path: "gunbc.heal_workflow", decl_name: "expected_heal_workflow_yml")
     HealPublisherWorkflowYamlArtifact => decl_ref(module_path: "gunbc.heal_publisher_workflow", decl_name: "expected_heal_publisher_workflow_yml")
     GitignoreArtifact => decl_ref(module_path: "gunbc.gitignore_emit", decl_name: "expected_gitignore")
diff --git a/dag/gunbc/generated_artifact_emit.dag b/dag/gunbc/generated_artifact_emit.dag
index 18fb44c3bfe..1c04e121cd1 100644
--- a/dag/gunbc/generated_artifact_emit.dag
+++ b/dag/gunbc/generated_artifact_emit.dag
@@ -8,7 +8,7 @@ import v2.extdeps.languages.swift.rows { SwiftRowEmitted, SwiftRowEmissionRefuse
 import gunbc.approve_ios_swift_wire { expected_approve_ios_wire_swift }
 import gunbc.approve_ios_swift_protocol_vector_tests { expected_approve_ios_protocol_vector_tests_swift }
 import product.printed_chassis.cadquery_realization { CouponProgramGeneration, CouponProgramGenerated, CouponProgramRefused, expected_coupon_cadquery_program }
-import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, RunnerDeployArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact, artifact_path, artifact_commit_policy, CommitRequired, NotCommitted, GitProtocol, CargoToolchain, GithubActionsWorkflow, ProjectDocumentation, HostReconciler, CompilerRunInput, CrossLanguageClientTest, XcodeProjectGenerator, SwiftCompiler }
+import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, RunnerDeployArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact, artifact_path, artifact_commit_policy, CommitRequired, NotCommitted, GitProtocol, CargoToolchain, GithubActionsWorkflow, ProjectDocumentation, HostReconciler, CompilerRunInput, CrossLanguageClientTest, XcodeProjectGenerator, SwiftCompiler }
 import gunbc.generated_artifact_registry { committed_generated_artifacts, heal_regenerated_after_provisional_merge_paths }
 import gunbc.whole_corpus_compile_demand_projection { expected_whole_corpus_compile_measured_root_demands_json }
 import gunbc.generated_workflow_provenance {
@@ -19,6 +19,7 @@ import gunbc.generated_workflow_provenance {
 import gunbc.fleet_converge_workflow { expected_fleet_converge_yml, FleetConvergeYamlGenerated, FleetConvergeYamlGenerationRefused }
 import gunbc.fleet_desired_admission_workflow { expected_fleet_desired_yml, FleetDesiredGenerationOutcome, FleetDesiredGenerated, FleetDesiredGenerationRefused }
 import gunbc.runner_microvm_shakedown_workflow { expected_microvm_shakedown_yml, MicrovmShakedownWorkflowGenerated, MicrovmShakedownWorkflowGenerationRefused }
+import gunbc.instrument_dispatch_workflow { expected_instrument_dispatch_yml, InstrumentDispatchWorkflowGenerated, InstrumentDispatchWorkflowGenerationRefused }
 import gunbc.heal_workflow { expected_heal_workflow_yml, HealWorkflowGenerated, HealWorkflowGenerationRefused }
 import gunbc.heal_publisher_workflow { expected_heal_publisher_workflow_yml, HealPublisherWorkflowGenerated, HealPublisherWorkflowGenerationRefused }
 import gunbc.witness_floor_workflow { WitnessFloorGenerationOutcome, WitnessFloorGenerated, WitnessFloorGenerationRefused }
@@ -97,6 +98,10 @@ fn artifact_generate_unadorned(a: GeneratedArtifact) -> ArtifactGenerationOutcom
       MicrovmShakedownWorkflowGenerated { content } => artifact_generated(content: content)
       MicrovmShakedownWorkflowGenerationRefused { reason } => ArtifactGenerationRefused { reason: reason }
     }
+    InstrumentDispatchYamlArtifact => match expected_instrument_dispatch_yml() {
+      InstrumentDispatchWorkflowGenerated { content } => artifact_generated(content: content)
+      InstrumentDispatchWorkflowGenerationRefused { reason } => ArtifactGenerationRefused { reason: reason }
+    }
     HealWorkflowYamlArtifact => match expected_heal_workflow_yml() {
       HealWorkflowGenerated { content } => artifact_generated(content: content)
       HealWorkflowGenerationRefused { reason } => ArtifactGenerationRefused { reason: reason }
@@ -255,6 +260,7 @@ fn artifact_extra_valid(a: GeneratedArtifact, generated: ArtifactGenerationOutco
     FleetConvergeYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     FleetDesiredAdmissionYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     MicrovmShakedownYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
+    InstrumentDispatchYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     HealWorkflowYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     HealPublisherWorkflowYamlArtifact => ci_yml_parses(path: artifact_path(a: a))
     GitignoreArtifact => true
diff --git a/dag/gunbc/generated_artifact_registry.dag b/dag/gunbc/generated_artifact_registry.dag
index 8b50650d453..817975f23b6 100644
--- a/dag/gunbc/generated_artifact_registry.dag
+++ b/dag/gunbc/generated_artifact_registry.dag
@@ -6,7 +6,7 @@ import gunbc.plan_registry { all_plans }
 import gunbc.fleet_intent { fleet_intent_known_hosts }
 import gunbc.generated_artifact {
   GeneratedArtifact, GeneratedArtifactProducerRow,
-  WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact,
+  WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact,
   AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact,
   AuthorRegeneratesBeforeMerge, HealRegeneratesAfterProvisionalMerge,
   concurrent_divergence_repair, artifact_path, artifact_is_committed, artifact_eq, artifact_producer_row
@@ -22,7 +22,7 @@ import gunbc.generated_artifact {
 data generated_artifact_registry: List<GeneratedArtifact> = concat(
   concat(
     concat(
-      [WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact],
+      [WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, CouponCadQueryProgramArtifact, Fci1BoundedExecutionContextArtifact, FileTransportRealizationGeneratedRsArtifact, WholeCorpusCompileMeasuredRootDemandsArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact],
       map(fleet_autoinstall_specs, s => AutoinstallUserDataArtifact { spec: s })
     ),
     map(fleet_intent_known_hosts, h => RunnerHostSudoersArtifact { host: h.identity })
diff --git a/dag/gunbc/generated_workflow_provenance.dag b/dag/gunbc/generated_workflow_provenance.dag
index b2a24b04cf3..4827e248c07 100644
--- a/dag/gunbc/generated_workflow_provenance.dag
+++ b/dag/gunbc/generated_workflow_provenance.dag
@@ -1,7 +1,7 @@
 module gunbc.generated_workflow_provenance
 
 import std.types { String, List }
-import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact }
+import gunbc.generated_artifact { GeneratedArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact }
 import gunbc.generated_artifact_registry { generated_artifact_registry }
 import v2.std.optional { Present, Absent }
 
@@ -76,6 +76,10 @@ fn generated_workflow_provenance(a: GeneratedArtifact) -> GeneratedWorkflowProve
       generator: "gunbc.runner_microvm_shakedown_workflow expected_microvm_shakedown_yml",
       authority: "gunbc.runner_microvm_shakedown_workflow microvm_shakedown_workflow",
     } }
+    InstrumentDispatchYamlArtifact => Present { value: GeneratedWorkflowProvenance {
+      generator: "gunbc.instrument_dispatch_workflow expected_instrument_dispatch_yml",
+      authority: "gunbc.instrument_dispatch_workflow instrument_dispatch_workflow",
+    } }
     HealWorkflowYamlArtifact => Present { value: GeneratedWorkflowProvenance {
       generator: "gunbc.heal_workflow expected_heal_workflow_yml",
       authority: "gunbc.heal_workflow heal_workflow",
diff --git a/dag/gunbc/instruments/docs_projection_gate.dag b/dag/gunbc/instruments/docs_projection_gate.dag
index bededcd3117..411e5b94da0 100644
--- a/dag/gunbc/instruments/docs_projection_gate.dag
+++ b/dag/gunbc/instruments/docs_projection_gate.dag
@@ -4,7 +4,7 @@ import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import extdeps.filesystem.filesystem_io { Filesystem, filesystem_read_outcome, FilesystemReadSucceeded, FilesystemReadRefused }
 import gunbc.design_ledgers { expected_design_failure_modes_md, expected_design_rung_drops_md }
 import gunbc.contributor_onboarding_path { expected_contributor_onboarding_md }
-import gunbc.generated_artifact { GeneratedArtifact, artifact_path, artifact_location, artifact_is_committed, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, CouponCadQueryProgramArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact }
+import gunbc.generated_artifact { GeneratedArtifact, artifact_path, artifact_location, artifact_is_committed, DesignArtifact, DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact, WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact, HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact, GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0ExecutableAssemblyGeneratedDagArtifact, Stage0LinkedPartitionCratesArtifact, SeedRetentionFrontierGeneratedRsArtifact, V1InterpreterDispatchGeneratedRsArtifact, EvaluationBudgetConsequenceGeneratedRsArtifact, ReleaseLocusSeedConstantsGeneratedRsArtifact, FileTransportRealizationGeneratedRsArtifact, Fci1BoundedExecutionContextArtifact, AutoinstallUserDataArtifact, RunnerHostSudoersArtifact, PlanArtifact, CouponCadQueryProgramArtifact, ApprovalDeviceVectorsArtifact, ApproveIosProjectYmlArtifact, ApproveIosProtocolSwiftArtifact, ApproveIosWireSwiftArtifact, ApproveIosProtocolVectorTestsSwiftArtifact }
 import gunbc.generated_artifact_registry { generated_artifact_registry }
 import v2.std.optional { Optional, Absent, Present }
 import tools.docs_projection_agreement { docs_projection_bytes_agree }
@@ -48,6 +48,7 @@ fn docs_projection_producer(a: GeneratedArtifact) -> Optional<String> {
     FleetConvergeYamlArtifact => Absent
     FleetDesiredAdmissionYamlArtifact => Absent
     MicrovmShakedownYamlArtifact => Absent
+    InstrumentDispatchYamlArtifact => Absent
     HealWorkflowYamlArtifact => Absent
     HealPublisherWorkflowYamlArtifact => Absent
     GitignoreArtifact => Absent
diff --git a/dag/gunbc/instruments/instrument_dispatch_workflow.dag b/dag/gunbc/instruments/instrument_dispatch_workflow.dag
new file mode 100644
index 00000000000..5eaa04f07c9
--- /dev/null
+++ b/dag/gunbc/instruments/instrument_dispatch_workflow.dag
@@ -0,0 +1,344 @@
+module gunbc.instrument_dispatch_workflow
+
+import std.types { Bool, Int, List, String }
+import std.algebra { list_append }
+import v2.std.algebra { list_map, filter, length }
+import v2.std.optional { Present }
+import v2.std.diagnostic { Outcome, Accepted, Rejected }
+import v2.std.node { Node }
+import extdeps.bazel.label { Label, render_label }
+import extdeps.languages.yaml.types { yaml_string, yaml_int, kv }
+import extdeps.languages.yaml.emit { emit_yaml, EmittedYaml, YamlEmitRefused, yaml_emit_refusal_text }
+import extdeps.languages.yaml.gha_workflow { project_workflow_to_yaml }
+import extdeps.github.actions {
+  Workflow, Job, Step, RunStep, UsesStep, Bash,
+  WorkflowDispatch, DispatchInput, InputChoice,
+  WorkflowPermissions, PermRead, ConcurrencyScalar,
+}
+import gunbc.action_use_admission {
+  upload_artifact_action,
+  admit_workflow_checkout_refs, WorkflowCheckoutRefsAdmitted, WorkflowCheckoutRefsRefused, workflow_checkout_refs_refusal_reason,
+  admit_workflow_action_uses, WorkflowActionUsesAdmitted, WorkflowActionUsesRefused,
+  workflow_action_uses_refusal_reason,
+}
+import gunbc.toolchain_home_standing {
+  admit_workflow_toolchain_homes, WorkflowToolchainHomesAdmitted, WorkflowToolchainHomeRefused,
+  toolchain_home_refusal_reason,
+}
+import gunbc.ci_runner_target { gunbc_ci_selected_runner_spec }
+import gunbc.compiler_gate_workflow { compiler_gate_hosted_build_prelude_bound_steps }
+import gunbc.witness_floor_workflow { witness_toolchain_homes_isolated_guard_step }
+import gunbc.instrument_targets { dag_emit_real_grammar_round_trips_label, instrument_targets }
+import v2.workflow.bash_emit { bash_emit_stmts }
+import v2.extdeps.languages.bash_build {
+  bash_build_word_lit, bash_build_word_var, bash_build_word_concat_from_nodes,
+  bash_build_assign_lit, bash_build_assign_var, bash_build_or_else,
+  bash_build_command_from_lits, bash_build_command_with_words,
+  bash_build_test_bracket, bash_build_with_redir_to_file,
+}
+
+// ONE OPERATOR-DISPATCHED RUN OF ONE ROSTERED INSTRUMENT, ON THE FLEET, AND NOTHING ELSE.
+//
+// WHY IT EXISTS (operator ruling 2026-10-02). `gunbc test <label>` is the door to every instrument, but
+// some subjects emit and build the whole compiler closure and then read the whole corpus, which no
+// session container or free remote runner can hold within its limits -- the D13 dependency-demand
+// census is the case that forced this, and joins the label list with its instrument row (gunbc#12992). The witnesses lanes carry fixed instruments on every pull request; this workflow carries
+// none on any event. It is dispatched by hand at the head under test (`gh workflow run
+// instrument-dispatch.yml --ref <branch> -f label=<label>`), so a change that needs an instrument's
+// verdict at its own head -- D13's row-deletion change, which must execute the census at the tree it
+// merges -- gets that run, and the run's artifact is what it cites.
+//
+// THE OPERATOR'S CONDITIONS, EACH HELD BY CONSTRUCTION HERE:
+//   - workflow_dispatch is the ONLY trigger: `on` below has one arm, and nothing schedules, pushes or
+//     reviews into it, so it costs the fleet nothing until someone asks.
+//   - the input is a CLOSED choice over rostered labels: instrument_dispatch_labels names labels from
+//     gunbc.instrument_targets, never a free string, and the input reaches the script only through the
+//     step environment, never by interpolation into the script text.
+//   - an explicit timeout, and a concurrency group so dispatches queue rather than stack on the
+//     shared pool.
+//   - contents: read and nothing else; no token is written to and none is persisted by the checkout.
+//   - the run's revision, run id and the instrument's own output and exit are uploaded as an artifact,
+//     seeded under RUNNER_TEMP before the fallible prelude so every termination uploads one.
+//
+// THE PRELUDE IS gunbc.compiler_gate_workflow's HOSTED BUILD PRELUDE, NOT A COPY OF IT: checkout,
+// isolated toolchain homes, the pinned toolchain and the `gunbc` build are the steps emit-build already
+// runs to reach `gunbc test`, so the two cannot disagree about how the door is built.
+
+data instrument_dispatch_workflow_name: String = "instrument-dispatch"
+
+data instrument_dispatch_job_id: String = "instrument"
+
+data instrument_dispatch_label_input: String = "label"
+
+data instrument_dispatch_directory: String = "instrument-dispatch"
+
+data instrument_dispatch_artifact_name: String = "instrument-dispatch-receipt"
+
+data instrument_dispatch_retention_days: Int = 30
+
+// A bound, not a budget: the census emits and builds the compiler closure (about 35 minutes measured on
+// emit-build) and then reads the whole corpus; a timeout that cut an honest run would turn its verdict
+// into silence.
+data instrument_dispatch_timeout_minutes: Int = 240
+
+// THE DISPATCHABLE LABELS: instruments whose subject is too large for any per-change lane and is run
+// on purpose. The round-trip battery is the first (its own row says it is run by name, not a merge
+// gate). Each is a row of gunbc.instrument_targets (instrument_dispatch_labels_are_rostered), and
+// adding one is a row here.
+fn instrument_dispatch_labels() -> List<Label> {
+  [dag_emit_real_grammar_round_trips_label()]
+}
+
+fn instrument_dispatch_label_options() -> List<String> {
+  list_map(xs: instrument_dispatch_labels(), f: fn(l) { render_label(l: l) })
+}
+
+fn instrument_dispatch_labels_are_rostered() -> Bool {
+  let rostered = list_map(xs: instrument_targets(), f: fn(l) { render_label(l: l) })
+  length(xs: filter(xs: instrument_dispatch_label_options(), predicate: fn(o) {
+    length(xs: filter(xs: rostered, predicate: fn(r) { r == o })) == 0
+  })) == 0
+}
+
+fn instrument_dispatch_label_expression() -> String {
+  join(["${{ inputs.", instrument_dispatch_label_input, " }}"], "")
+}
+
+// THE RECEIPT LIVES UNDER RUNNER_TEMP, NOT THE CHECKOUT, so it exists before the checkout does: the
+// seed step that writes it runs first, and nothing the prelude does -- a failed checkout, toolchain
+// install or build -- can leave the always() upload with nothing to read (review of gunbc#12998).
+fn instrument_dispatch_dir_word() -> Node {
+  bash_build_word_concat_from_nodes(parts: [bash_build_word_var(name: "RUNNER_TEMP"), bash_build_word_lit(text: join(["/", instrument_dispatch_directory], ""))])
+}
+
+fn instrument_dispatch_path_word(file: String) -> Node {
+  bash_build_word_concat_from_nodes(parts: [bash_build_word_var(name: "RUNNER_TEMP"), bash_build_word_lit(text: join(["/", instrument_dispatch_directory, "/", file], ""))])
+}
+
+fn instrument_dispatch_upload_path() -> String {
+  join(["${{ runner.temp }}/", instrument_dispatch_directory], "")
+}
+
+fn instrument_dispatch_echo_to(words: List<Node>, file: String) -> Node {
+  bash_build_with_redir_to_file(
+    inner: bash_build_command_with_words(words: [bash_build_word_lit(text: "echo"), bash_build_word_concat_from_nodes(parts: words)]),
+    path: instrument_dispatch_path_word(file: file),
+  )
+}
+
+// THE SEED: the receipt line, and placeholders the instrument step overwrites. A run that never reaches
+// the instrument uploads stdout `not-started` and exit `not-started`, never an absent artifact and never
+// a fabricated exit code.
+fn instrument_dispatch_seed_statements() -> List<Node> {
+  [
+    bash_build_command_with_words(words: [bash_build_word_lit(text: "mkdir"), bash_build_word_lit(text: "-p"), instrument_dispatch_dir_word()]),
+    instrument_dispatch_echo_to(words: [
+      bash_build_word_lit(text: "instrument-dispatch label="),
+      bash_build_word_var(name: "INSTRUMENT_LABEL"),
+      bash_build_word_lit(text: " revision="),
+      bash_build_word_var(name: "GITHUB_SHA"),
+      bash_build_word_lit(text: " run="),
+      bash_build_word_var(name: "GITHUB_RUN_ID"),
+      bash_build_word_lit(text: " attempt="),
+      bash_build_word_var(name: "GITHUB_RUN_ATTEMPT"),
+    ], file: "receipt.txt"),
+    instrument_dispatch_echo_to(words: [bash_build_word_lit(text: "not-started")], file: "stdout.txt"),
+    instrument_dispatch_echo_to(words: [bash_build_word_lit(text: "exit=not-started")], file: "exit.txt"),
+  ]
+}
+
+fn instrument_dispatch_seed_script() -> Outcome<String> {
+  bash_emit_stmts(statements: instrument_dispatch_seed_statements(), set_e: true)
+}
+
+data instrument_dispatch_seed_step_name: String = "Seed the run's receipt before anything that can fail"
+
+fn instrument_dispatch_seed_step(script: String) -> Step {
+  RunStep {
+    name: Present { value: instrument_dispatch_seed_step_name },
+    id: Present { value: "seed_receipt" },
+    run: script,
+    shell: Present { value: Bash },
+    env: Present { value: [kv(key: "INSTRUMENT_LABEL", value: yaml_string(s: instrument_dispatch_label_expression()))] },
+    working_directory: none,
+    if_condition: none,
+    continue_on_error: none,
+    timeout_minutes: none,
+  }
+}
+
+// THE RUN SCRIPT. The seed step has already written the receipt; this overwrites the placeholders with
+// the instrument's stdout (also replayed into the log) and its exit, and the step fails exactly when the
+// instrument did not hold. The
+// instrument's stderr is left on the log, where its progress lines belong.
+fn instrument_dispatch_statements() -> List<Node> {
+  [
+    bash_build_assign_lit(name: "status", text: "0"),
+    bash_build_or_else(
+      left: bash_build_with_redir_to_file(
+        inner: bash_build_command_with_words(words: [
+          bash_build_word_lit(text: "target/release/gunbc"),
+          bash_build_word_lit(text: "test"),
+          bash_build_word_var(name: "INSTRUMENT_LABEL"),
+        ]),
+        path: instrument_dispatch_path_word(file: "stdout.txt"),
+      ),
+      right: bash_build_assign_var(name: "status", var_name: "?"),
+    ),
+    bash_build_command_with_words(words: [bash_build_word_lit(text: "cat"), instrument_dispatch_path_word(file: "stdout.txt")]),
+    instrument_dispatch_echo_to(words: [bash_build_word_lit(text: "exit="), bash_build_word_var(name: "status")], file: "exit.txt"),
+    bash_build_test_bracket(words: [bash_build_word_var(name: "status"), bash_build_word_lit(text: "="), bash_build_word_lit(text: "0")]),
+  ]
+}
+
+fn instrument_dispatch_script() -> Outcome<String> {
+  bash_emit_stmts(statements: instrument_dispatch_statements(), set_e: true)
+}
+
+fn instrument_dispatch_run_step(script: String) -> Step {
+  RunStep {
+    name: Present { value: "Run the dispatched instrument" },
+    id: Present { value: "instrument" },
+    run: script,
+    shell: Present { value: Bash },
+    env: Present { value: [kv(key: "INSTRUMENT_LABEL", value: yaml_string(s: instrument_dispatch_label_expression()))] },
+    working_directory: none,
+    if_condition: none,
+    continue_on_error: none,
+    timeout_minutes: none,
+  }
+}
+
+// The receipt is uploaded on every termination: a did-not-hold run is exactly when it is wanted.
+fn instrument_dispatch_upload_step() -> Step {
+  UsesStep {
+    name: Present { value: "Upload the run's receipt and output" },
+    id: none,
+    uses: upload_artifact_action,
+    with: Present {
+      value: [
+        kv(key: "name", value: yaml_string(s: instrument_dispatch_artifact_name)),
+        kv(key: "path", value: yaml_string(s: instrument_dispatch_upload_path())),
+        kv(key: "if-no-files-found", value: yaml_string(s: "error")),
+        kv(key: "retention-days", value: yaml_int(n: instrument_dispatch_retention_days)),
+      ]
+    },
+    env: none,
+    if_condition: Present { value: "always()" },
+    continue_on_error: none,
+    timeout_minutes: none,
+  }
+}
+
+fn instrument_dispatch_steps(seed: String, script: String) -> List<Step> {
+  list_append(
+    left: [instrument_dispatch_seed_step(script: seed)],
+    right: list_append(
+      left: list_map(xs: compiler_gate_hosted_build_prelude_bound_steps(), f: fn(b) { b.step }),
+      right: [witness_toolchain_homes_isolated_guard_step(), instrument_dispatch_run_step(script: script), instrument_dispatch_upload_step()],
+    ),
+  )
+}
+
+fn instrument_dispatch_job(seed: String, script: String) -> Job {
+  Job {
+    id: instrument_dispatch_job_id,
+    name: none,
+    runner: gunbc_ci_selected_runner_spec(),
+    environment: none,
+    steps: instrument_dispatch_steps(seed: seed, script: script),
+    needs: [],
+    env: none,
+    outputs: none,
+    if_condition: none,
+    timeout_minutes: Present { value: instrument_dispatch_timeout_minutes },
+    continue_on_error: none,
+    concurrency: none,
+    permissions: Present {
+      value: WorkflowPermissions {
+        contents: Present { value: PermRead },
+        pull_requests: none,
+        issues: none,
+        actions: none,
+        id_token: none,
+      }
+    }
+  }
+}
+
+fn instrument_dispatch_workflow(seed: String, script: String) -> Workflow {
+  Workflow {
+    name: instrument_dispatch_workflow_name,
+    run_name: Present { value: join(["instrument-dispatch ", instrument_dispatch_label_expression()], "") },
+    on: [
+      WorkflowDispatch {
+        inputs: [
+          DispatchInput {
+            name: instrument_dispatch_label_input,
+            description: Present { value: "The rostered instrument to run (gunbc.instrument_targets); the run executes `gunbc test <label>` at the dispatched ref." },
+            required: true,
+            default: none,
+            type: InputChoice { options: instrument_dispatch_label_options() },
+          },
+        ]
+      }
+    ],
+    concurrency: Present { value: ConcurrencyScalar { group: instrument_dispatch_workflow_name } },
+    env: none,
+    permissions: Present {
+      value: WorkflowPermissions {
+        contents: Present { value: PermRead },
+        pull_requests: none,
+        issues: none,
+        actions: none,
+        id_token: none,
+      }
+    },
+    jobs: [instrument_dispatch_job(seed: seed, script: script)],
+  }
+}
+
+type InstrumentDispatchWorkflowGenerationOutcome
+  = InstrumentDispatchWorkflowGenerated { content: String }
+  | InstrumentDispatchWorkflowGenerationRefused { reason: String }
+
+fn expected_instrument_dispatch_yml() -> InstrumentDispatchWorkflowGenerationOutcome {
+  if instrument_dispatch_labels_are_rostered() {
+    match instrument_dispatch_seed_script() {
+      Rejected { diagnostics: _ } =>
+        InstrumentDispatchWorkflowGenerationRefused { reason: "gunbc.instrument_dispatch_workflow: v2.workflow.bash_emit refused the seed script, so no workflow is emitted" }
+      Accepted { value: seed, diagnostics: _ } =>
+        match instrument_dispatch_script() {
+          Rejected { diagnostics: _ } =>
+            InstrumentDispatchWorkflowGenerationRefused { reason: "gunbc.instrument_dispatch_workflow: v2.workflow.bash_emit refused the run script, so no workflow is emitted" }
+          Accepted { value: script, diagnostics: _ } =>
+            expected_instrument_dispatch_yml_with(workflow: instrument_dispatch_workflow(seed: seed, script: script))
+        }
+    }
+  } else {
+    InstrumentDispatchWorkflowGenerationRefused { reason: "gunbc.instrument_dispatch_workflow: a dispatchable label is not a row of gunbc.instrument_targets instrument_targets" }
+  }
+}
+
+fn expected_instrument_dispatch_yml_with(workflow: Workflow) -> InstrumentDispatchWorkflowGenerationOutcome {
+  match admit_workflow_action_uses(workflow: workflow) {
+    WorkflowActionUsesRefused { refusals: rs } =>
+      InstrumentDispatchWorkflowGenerationRefused { reason: workflow_action_uses_refusal_reason(workflow_module: "gunbc.instrument_dispatch_workflow", refusals: rs) }
+    WorkflowActionUsesAdmitted =>
+      match admit_workflow_checkout_refs(workflow: workflow, declared: []) {
+        WorkflowCheckoutRefsRefused { refusals: crs } =>
+          InstrumentDispatchWorkflowGenerationRefused { reason: workflow_checkout_refs_refusal_reason(workflow_module: "gunbc.instrument_dispatch_workflow", refusals: crs) }
+        WorkflowCheckoutRefsAdmitted =>
+          match admit_workflow_toolchain_homes(workflow: workflow) {
+            WorkflowToolchainHomesAdmitted =>
+              match emit_yaml(v: project_workflow_to_yaml(workflow: workflow)) {
+                EmittedYaml { text: t } => InstrumentDispatchWorkflowGenerated { content: t }
+                YamlEmitRefused { path: p, reason: r } =>
+                  InstrumentDispatchWorkflowGenerationRefused { reason: yaml_emit_refusal_text(module_path: "gunbc.instrument_dispatch_workflow", path: p, reason: r) }
+              }
+            WorkflowToolchainHomeRefused { job_id: j, refusal: r } =>
+              InstrumentDispatchWorkflowGenerationRefused { reason: toolchain_home_refusal_reason(job_id: j, refusal: r) }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/ledger_row_coherence.dag b/dag/gunbc/ledger_row_coherence.dag
index 11a7e8a3584..e29a420905e 100644
--- a/dag/gunbc/ledger_row_coherence.dag
+++ b/dag/gunbc/ledger_row_coherence.dag
@@ -3,7 +3,7 @@ module gunbc.ledger_row_coherence
 import std.types { String, List, Bool }
 import gunbc.generated_artifact {
   GeneratedArtifact,
-  WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact,
+  WitnessFloorYamlArtifact, FleetConvergeYamlArtifact, FleetDesiredAdmissionYamlArtifact, MicrovmShakedownYamlArtifact, InstrumentDispatchYamlArtifact,
   HealWorkflowYamlArtifact, HealPublisherWorkflowYamlArtifact,
   GitignoreArtifact, GitattributesArtifact, CargoConfigArtifact, RoadmapArtifact, DesignArtifact,
   DesignFailureModesArtifact, DesignRungDropsArtifact, ContributorOnboardingArtifact,
@@ -117,6 +117,7 @@ fn ledger_rows(a: GeneratedArtifact) -> List<LedgerRow> {
     FleetConvergeYamlArtifact => []
     FleetDesiredAdmissionYamlArtifact => []
     MicrovmShakedownYamlArtifact => []
+    InstrumentDispatchYamlArtifact => []
     HealWorkflowYamlArtifact => []
     HealPublisherWorkflowYamlArtifact => []
     GitignoreArtifact => []
diff --git a/dag/test/claim/action_use_admission_witness_test.dag b/dag/test/claim/action_use_admission_witness_test.dag
index 9e500b04327..efbd8dd6285 100644
--- a/dag/test/claim/action_use_admission_witness_test.dag
+++ b/dag/test/claim/action_use_admission_witness_test.dag
@@ -280,7 +280,7 @@ fn census_holds(c: RealizedCensus) -> Bool {
 // eval-step budget. This join is what makes the per-file claims the census: a workflow added without
 // a claim, or a claim naming a file that is gone, refuses here, by name.
 data realized_workflow_files: List<String> = [
-  "fleet-converge.yml", "fleet-desired.yml", "heal-publish.yml", "heal.yml", "microvm-shakedown.yml", "mtcollins-canary.yml", "witnesses.yml"
+  "fleet-converge.yml", "fleet-desired.yml", "heal-publish.yml", "heal.yml", "instrument-dispatch.yml", "microvm-shakedown.yml", "mtcollins-canary.yml", "witnesses.yml"
 ]
 
 fn listed_workflow_files() -> List<String> {
@@ -345,6 +345,15 @@ test fn census_heal_uses_are_modeled_and_executed_exactly() -> Bool {
     && any(c.admitted_texts, t => t == action_release_uses_text(action_release: upload_artifact_action))
 }
 
+// The instrument-dispatch workflow: its checkout, setup-rust-toolchain and upload-artifact steps are
+// among the admitted uses (gunbc.instrument_dispatch_workflow).
+test fn census_instrument_dispatch_uses_are_modeled_and_executed_exactly() -> Bool {
+  let c = census_file(name: "instrument-dispatch.yml")
+  census_holds(c: c)
+    && any(c.admitted_texts, t => t == action_release_uses_text(action_release: checkout_action))
+    && any(c.admitted_texts, t => t == action_release_uses_text(action_release: upload_artifact_action))
+}
+
 // THE SHAKEDOWN WORKFLOW USES NO ACTION, AND ZERO IS THE READING, NOT AN EMPTY FILE. Its one job is a
 // run step by design (gunbc.runner_microvm_shakedown_workflow: no checkout and no action, so a proof
 // about whether the guest can run a step does not depend on the action-download path). census_file
diff --git a/dag/test/claim/instruments/instrument_dispatch_workflow_witness_test.dag b/dag/test/claim/instruments/instrument_dispatch_workflow_witness_test.dag
new file mode 100644
index 00000000000..340dd1bfa27
--- /dev/null
+++ b/dag/test/claim/instruments/instrument_dispatch_workflow_witness_test.dag
@@ -0,0 +1,71 @@
+module test.claim.instruments.instrument_dispatch_workflow_witness_test
+
+import std.types { Bool, List, String }
+import v2.std.algebra { length }
+import extdeps.github.actions { Step, RunStep, UsesStep }
+import v2.std.optional { Absent, Present }
+import gunbc.instrument_dispatch_workflow {
+  instrument_dispatch_steps, instrument_dispatch_seed_step_name,
+  InstrumentDispatchWorkflowGenerated, InstrumentDispatchWorkflowGenerationRefused,
+  expected_instrument_dispatch_yml, instrument_dispatch_label_options, instrument_dispatch_labels_are_rostered
+}
+
+// THE OPERATOR'S CONDITIONS FOR THE DISPATCH-ONLY INSTRUMENT WORKFLOW, AS THE GENERATED TEXT CARRIES
+// THEM. The drift gate (gunbc.generated_artifact) holds the committed file to this generator; these
+// claims hold the generator to the conditions.
+
+// The input is a closed choice whose every option is a rostered instrument label.
+test fn every_dispatch_option_is_a_rostered_instrument_label_holds() -> Bool {
+  instrument_dispatch_labels_are_rostered() && (length(xs: instrument_dispatch_label_options()) > 0)
+}
+
+fn generated_text() -> String {
+  match expected_instrument_dispatch_yml() {
+    InstrumentDispatchWorkflowGenerated { content: c } => c
+    InstrumentDispatchWorkflowGenerationRefused { reason: _ } => ""
+  }
+}
+
+// workflow_dispatch is the only trigger; the input is a choice; the job is bounded, serialized and
+// read-only; and the receipt is uploaded on every termination.
+test fn the_workflow_is_dispatch_only_bounded_serialized_and_read_only_holds() -> Bool {
+  let t = generated_text()
+  contains(t, "workflow_dispatch:")
+    && !contains(t, "pull_request")
+    && !contains(t, "merge_group")
+    && !contains(t, "schedule")
+    && !contains(t, "push:")
+    && contains(t, "type: choice")
+    && contains(t, "timeout-minutes: 240")
+    && contains(t, "concurrency: instrument-dispatch")
+    && contains(t, "contents: read")
+    && !contains(t, ": write")
+    && contains(t, "instrument-dispatch-receipt")
+    && contains(t, "if: always()")
+}
+
+fn step_name(step: Step) -> String {
+  match step {
+    RunStep { name: n, id: _, run: _, shell: _, env: _, working_directory: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match n {
+        Present { value: v } => v
+        Absent => ""
+      }
+    UsesStep { name: n, id: _, uses: _, with: _, env: _, if_condition: _, continue_on_error: _, timeout_minutes: _ } =>
+      match n {
+        Present { value: v } => v
+        Absent => ""
+      }
+  }
+}
+
+// THE RECEIPT'S PRODUCER PRECEDES EVERYTHING THAT CAN FAIL (review of gunbc#12998). Over the job's own
+// step list: the first step is the seed, and the checkout and the build come after it, so a run that dies
+// in the prelude still has a receipt for the always() upload to read.
+test fn the_receipt_is_seeded_before_the_fallible_prelude_holds() -> Bool {
+  let names = map(instrument_dispatch_steps(seed: "", script: ""), s => step_name(step: s))
+  let first = fold(names, init: "", f: fn(acc, n) { if acc == "" { n } else { acc } })
+  (first == instrument_dispatch_seed_step_name)
+    && any(names, n => n == "Checkout")
+    && any(names, n => n == "Build the compiler")
+}