test(llup): add exact-APK LLUP-50 physical evidence runner

[daniele21]

Scope

Adds LLUP-50 physical evidence tooling only; no runtime/product behavior changes.

• run-llup50-physical-side.sh consumes CI-built device-test-runner app/test APK pairs and their package manifest; it never invokes Gradle;
• fails closed when package sourceRevision or APK SHA-256 does not match the expected evidence ref;
• records the frozen runtime source SHA separately from the evidence-harness SHA;
• serializes same-device thermal-gated model-load, Qwen tuning, cancellation/repeated-memory, LOW_MEMORY and A→B→A lifecycle evidence;
• compare-llup50-evidence.py rejects mismatched device/model/profile/thermal identities and reports descriptive control/candidate medians and deltas without inventing promotion thresholds;
• run-llup50-physical-ab.sh is the one-command PC controller: physical preflight, optional exact GGUF download, frozen GitHub Actions artifact download, control/candidate execution, canonical comparison, cleanup and final PASS / FAIL / INCONCLUSIVE result.

The controller deliberately does not make the LLUP-70 promotion decision. PASS means the frozen control and candidate produced comparable physical evidence; promotion remains an explicit later decision.

Current exact identities

• tooling HEAD: 498dd155ab10cc8c5cebe3af7a7e148c102c1b32;
• frozen control runtime: 80164329bbc41a00b75721e3d0524294c03fdb56;
• candidate runtime: 59af48313b450d9cff13c7f43458c2e5e6560374;
• control evidence ref: evidence/llup50-control@fcbefc7cd9af84de570da96d039582175dd1700b;
• candidate evidence ref: evidence/llup50-candidate@a2a050d9551db541bb4c6b152cba8623c782164d;
• frozen package run: 33334957429.

Both evidence refs carry the same instrumentation-only model-load probe. The package run already produced exact-ref app/test APK pairs plus manifests for control, candidate and candidate-runtime.

One-command usage

With one physical Android device connected over ADB and GitHub CLI authenticated:

bash scripts/run-llup50-physical-ab.sh --download-models

Use --device SERIAL when more than one ADB device is online. Existing exact GGUF paths can be supplied with --model-0.8b and --model-2b; already-downloaded package artifacts can be supplied with --artifact-root.

The controller writes a bounded run directory under build/llup50-physical-ab/ containing logs, side evidence, comparison output, result.json and result.md.

Exit/result semantics:

• 0 / PASS: control and candidate executed successfully on the same physical device and canonical evidence comparison passed;
• 1 / FAIL: candidate physical instrumentation/lifecycle failed after a valid control;
• 2 / INCONCLUSIVE: environment, control baseline, artifact identity or comparison validity did not permit a trustworthy A/B conclusion.

Signal handling is fail-safe: INT/TERM exit and the EXIT cleanup removes pushed model files and temporary test/app installations.

Validation

Exact tooling HEAD 498dd155ab10cc8c5cebe3af7a7e148c102c1b32:

• repository-owned Validate run 33336253443: SUCCESS;
• selector-effective depth: FULL (unknown or repository-wide executable scope on the frozen merge-ref);
• shell parsing (bash -n over all shell scripts): PASS;
• Python compilation and repository/architecture guards: PASS;
• selected Android FULL validation: PASS.

Repository-health run 33336253412 is independently red because current dev contains an unrelated documentation-lifecycle defect in docs/assets/brand/reference/hbridge-core/README.md (Status metadata missing). That baseline defect is not patched in this LLUP tooling PR.

Physical acceptance boundary

The LLUP-50 controller covers:

• model-load latency;
• cold/warm TTFT;
• prefill/decode throughput and total latency;
• PSS/memory and thermal identity;
• cancellation/recovery;
• repeated-memory behavior;
• LOW_MEMORY release;
• A→B→A lifecycle switching.

The comparator fails closed on mismatched device/model/profile/thermal identities and deliberately reports descriptive deltas without introducing an unreviewed percentage promotion threshold.

LLUP-60 remains a separate affected-evidence replay. In particular, existing LLRT physical owners must not be reused blindly against the new backend identity: the canonical LLRT-6 wrapper currently pins the production b9637 backend revision. Candidate-safe LLRT/quality replay therefore remains a separate work item rather than being falsely reported as part of this LLUP-50 controller.

This PR remains draft/unmerged while the frozen physical A/B and LLUP-70 decision are pending.

[daniele21]

/preflight auto