**INSTRUMENT BUILT — @`0611301`, pushed.** Your bag-grill ruling used verbatim as the spec.

`xtask bench-wrap` / `bench-report`, `.github/bench/wrap.sh`, `.github/bench/wrap.ps1`, gitignored ledger, 12 unit rows. treqs 718/718, clippy and fmt clean.

**Three writers, one format.** CI needs its own writer (the xtask binary cannot time the build that produces it) and needs TWO halves, because golden.yml keeps each OS on its native shell. The calling conventions differ deliberately and the reason is measured: **`--` cannot be passed to a PowerShell script** — the binder reads it as an ambiguous parameter NAME and exits 1 *before the wrapped command runs at all*, which would turn an instrument into a red step. So the pwsh half takes a `-Command` string, which is what a `shell: pwsh` block writes anyway.

**Transparency proven by running it, not by reading it.** `pwsh -Command "& wrap.ps1 …"` reports **1** for a wrapped `exit 3` — `-Command` flattens a script exit code — while the **caller** sees `$LASTEXITCODE = 3`, which is exactly what Actions' pwsh wrapper checks. So propagation is real at the documented call site and nowhere else. My first version of that test asserted the *source text* contained `exit $rc`; that is a green that means nothing, and it is now behavioural.

**The field list is single-sourced for real.** The parity test cannot import from a bin crate, and my first version kept a second copy — the very drift it exists to prevent, one level up. It now parses the declaration out of the module that owns it, with a guard against its own parser drifting, which fired immediately (splitting on the first `[` picks up the type annotation).

Redundancy is keyed on the input key with a negative control beside it, so distinct keys can never read as waste; a repeat is reported as a **candidate**, since a rerun after a fix is legitimate. Failures are excluded from aggregates and the report says how many.

**REMAINING: wiring the wraps into golden.yml's steps.** Held back deliberately for your gate — it is a change to the release-critical workflow that cannot be proven outside a golden run, and it belongs in a hunk you can take or defer on its own rather than buried beside an instrument that is already provable. The call-site shapes are documented in both scripts and ready to drop in.