fix(deploy): accept collocated reference uploader upgrades

[proerror77]

Change contract

Allow a Binance USD-M Reference release produced by this cutover to pass the next upgrade preflight. The old uploader must be collocated with the previous collector release, and its release sidecar plus actual binary SHA-256 must match before any runtime transition starts. A long-lived baseline may retain planned RuntimeMaxSec restarts; the preflight still requires the exact running binary, while freshly started candidate and rollback processes must keep NRestarts=0. The receipt keeps the previous collector release SHA and actual uploader SHA; the obsolete standalone uploader-release field was removed after a full-repo search found no consumer.

Issue relationship

None

Out of scope

• No production host, service, symlink, spool, or OSS mutation.
• No manual migration of the current uploader path.
• No new installer or Cloud Assistant invoker.
• The feat(collector): publish per-modality PIT clocks in USD-M reference manifest v2 #803 Reference V2 runtime rollout requires a separate runtime issue with exact candidate, rollback identity, controller, stop rules, and readback after this code is merged and republished.

Dependencies and merge order

None

Focused validation

• deployment/aliyun/test-binance-usdm-reference-release-contract.sh
• deployment/aliyun/test-binance-usdm-reference-shadow-gate.sh
• deployment/aliyun/test-binance-usdm-reference-host-gate.sh
• bash -n deployment/aliyun/binance-usdm-reference-cutover.sh deployment/aliyun/test-binance-usdm-reference-host-gate.sh
• shellcheck deployment/aliyun/binance-usdm-reference-cutover.sh deployment/aliyun/test-binance-usdm-reference-host-gate.sh
• git diff --check
• Counterexamples: a standalone legacy uploader path is rejected; a collocated uploader whose bytes drift from its sidecar is rejected; an uploader sidecar rejected by the trust validator is rejected. A baseline with planned restarts is admitted, while the same non-zero count is rejected for a freshly started candidate.
• Contract assertion: previous_uploader_release_sha256 is absent and previous_uploader_sha256 remains bound to the actual old uploader bytes.

The repository preflight script itself exits 141 with the current 190+ worktrees because its git worktree list | awk ... exit pipeline trips pipefail; the same checks with the consumer draining the full worktree list returned verdict=ok. This PR does not alter that unrelated script.

Rollout and rollback

Code-only change; production was not touched. After merge, publish a new exact-head artifact before opening the separate #803 runtime rollout. Roll back this code by reverting the PR before any candidate staging.

Scope exception

None

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 64c7b2eb-7344-4561-b94f-12391ac4c1dc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}