[verified] fix: enforce canonical native runtime pin

.scratch/distributed-gguf-runtime/evidence/DGR-025/README.md

@@ -72,17 +72,22 @@ explicitly requires fingerprinting the "runtime pin/patch stack".
   committed manifest only; fetching/patching stays with
   `scripts/llama_cpp_dependency.py` (DGR-027).
 - `packages/node/meshnet_node/runtime_recipe.py` — `runtime_version` is now
-  pin-enforced (`_require_pin`) exactly like `tokenizer_revision`; docstring
-  points at the canonical derivation.
+  pin-enforced (`_require_pin`) exactly like `tokenizer_revision`; for the
+  llama.cpp backend it must also match the canonical
+  `llama.cpp@<40-hex>+patchstack.<64-hex>` grammar.
+- `packages/node/meshnet_node/native_backend.py` — the production native
+  identity seam no longer accepts a caller-supplied runtime string. It derives
+  `runtime_version` directly through `load_runtime_pin()` from the committed
+  lock and rejects a non-llama backend at this llama.cpp-specific boundary.
 - `packages/tracker/meshnet_tracker/recipe.py` — the independent tracker
-  implementation applies the same pin rule in `parse_identity`, keeping the two
-  implementations in step.
-- `tests/test_runtime_pin_identity.py` (new, TDD — written first and observed
-  failing) — 17 deterministic tests: the committed manifest derives a
-  deterministic pin whose axis value is a valid recipe pin; a changed patch
-  byte and a reordered stack each change the runtime identity; every manifest
-  disagreement above fails closed; and both node and tracker reject a moving
-  `runtime_version`.
+  implementation applies the same backend-specific grammar before re-deriving
+  the recipe digest, so forged operator labels cannot register or certify.
+- `tests/test_runtime_pin_identity.py` and
+  `tests/test_native_identity_emission.py` — deterministic tests cover lock
+  derivation, production native emission, and node/tracker rejection of the
+  forged values from independent review. Conformance vectors were regenerated
+  through `scripts/gen_recipe_fingerprint_vectors.py` for the tightened wire
+  contract.
 
 ### Backlog-consistency repair (pre-existing damage, honestly recorded)
 
@@ -136,7 +141,7 @@ Marked `DGR-025.passes = true` with `completionNotes`; regenerated
 PYTHONPATH=packages/node:packages/tracker python3 -m pytest -q tests/test_runtime_pin_identity.py
 ```
 ```text
-17 passed in 0.11s
+23 passed in 0.15s
 ```
 
 ```bash
@@ -146,7 +151,7 @@ PYTHONPATH=packages/node:packages/tracker python3 -m pytest -q \
   tests/test_node_admission.py tests/test_node_capability.py tests/test_recipe_benchmark.py
 ```
 ```text
-196 passed, 1 warning in 5.35s
+202 passed, 1 warning in 5.38s
 ```
 
 ```bash
@@ -169,13 +174,12 @@ artifact was touched and nothing was written under `/home`.
 
 ## Limitations
 
-- `runtime_pin.py` proves what the *manifest* pins; it does not prove the
-  running binary was built from that manifest. Binding the built native worker
-  to the pin it reports (e.g. embedding the patched-tree hash at build time and
-  echoing it through the DGR-022 status contract) belongs with the native
-  worker stories (DGR-028+/DGR-031); until then `runtime_version` is exactly as
-  trustworthy as the rest of the declared axes — a claim the tracker digests,
-  with real distributed certification as the trust boundary (unchanged design).
+- The production native identity seam now derives the manifest pin and cannot
+  accept an operator-supplied runtime label. It still cannot attest that the
+  running binary was built from those locked bytes. Embedding the patched-tree
+  hash at build time and echoing it through the DGR-022 status contract belongs
+  with DGR-028+/DGR-031; real distributed certification remains the final trust
+  boundary.
 - The DGR-027-recorded blocker stands: `0002-dense-llama-owned-range-loader.patch`
   does not apply cleanly against the pin (DGR-028). That does not affect this
   story: the identity commits to the patch *bytes as committed*, which is