Documented commands are checked against the tools now (D81) 45 documented flags, all valid, and no dead code among the 50 non-test tools. The new gate reports a tool it cannot ask as NOT CHECKED rather than as a pass.
DC-085 re-audited: the formats differ, with file-level evidence (D80) Its int4 is unsigned with a BF16 bias (its own dequantize() docstring) and ours is signed with an int8 zero; the containers differ too. No defect upstream. The evidence is now in THIRD_PARTY_NOTICES.md rather than only in a decision record, and 16 stray escaped quotes from earlier patches are cleaned.
Verify the install's 693 payload digests, which nothing had compared (D79) 21.7 GB in 26.69 s at 29.4 MB peak, zero problems, disk and swap unmoved. The milestone check now runs it by default, with --sample to bound it and the verifier's output inherited as the evidence.
Gate the install verifier; fix the false positive it found (D78) verify_install only ever ran by hand, and the milestone check now runs it before trusting a digest. The first run reported the checked-in fixtures as mis-tiled: the rule demanded exact contiguity while the format is 64-byte aligned. ALIGNMENT now has one home and the rule is the format's.
Home.md carried a false status; the claims gate now discovers its documents (D77) Three narrownesses hid it: the page was not a claim document, its phrasing did not match the patterns, and the claim was wrapped inside a blockquote. The widened gate found both false counts before they were corrected, and now checks 148 claims against 126.
Test M0's gate; both gates now record the flags they pass (D76) M0's gate had no instrument test while M1/M2/M3's did, and D74 changed its invocation unwatched. Both halves now run on the fixture, and the flags are recorded in the report and asserted, because a fixture cannot see a missing flag.
Vectorise the install dequantiser; M1's gate now passes on the install too (D75) The scalar path visited every value in Python: 0.253 s per expert, ~11 minutes of expert reads per forward. The block path is bit-identical (proven on the real install and pinned over both fixtures) and the gate now completes all five prompts against the install, which is M1's restated claim. DC-114 closed.
One home for 'which reader, with which flag'; M0's contract gains --uncached (D74) The audit found the 2B contract had no such flag at all, so M0's gate could not pass it and every M0 run mapped its checkpoint. tools/contract_source.py now decides once, both CLIs use it, and seven tests pin it -- including that an install wins over the flag, and byte-identity between the mapped and pread readers.
M1's gate passed on the real checkpoint, all five prompts (D73) The checkpoint path was still mapping 67 GB because the gate passed only one of the two flags the gate doc records. Measured 66.20 s / 0.397 GB for the contract, then all five prompts IDENTICAL with the 2026-09-16 digest. The declaration stays 4.2 GB: the peak is the engine's trace, not the contract's.
Give D71's class of defect a check, not just its instance (D72) Every tensor's nbytes matches the layout (693 real + 36 fixture, 0 mismatches), so the payload and geometry() were right and _rows_per_index was the unchecked derivation. check_index_mapping now runs at open, and a test pins both the D71 geometry and the refusal of the formula that was wrong.
DC-113 fixed: the install source mapped an expert to half its rows (D71) The bisection isolated it to the expert stacks; the manifest's nbytes proved the Python reader wrong, not the Swift one. D69's columns change was the wrong half and is reverted; the same table found a latent conv1d bug. The install-mode gate case now passes and the suite's expected failures dropped from 3 to 2.
DC-113 narrowed to the int4 path; DC-114 opens the contract's read cost (D70) Both sides agree on the tiny checkpoint and diverge only on the tiny install, at layer 0's padded partial groups. Separately, one real expert is 0.315 s whichever way it is accumulated, so the cost is the per-row Python crossing, not allocation -- a timing-phase item.
M1's gate can run against an install; DC-113 opens the fixture divergence (D69) The contract half never passed --stream-experts, the install source's row width came from the wrong shape, and the resource declaration now follows the source kind. On the tiny install the engine and contract DIFFER, which is DC-113 and is declared as an expected failure.
Re-verify M3's four-node mesh, and add --functional-only to its gate (D68) Four nodes, current binaries, every node IDENTICAL in tokens and digests against the single node. The new flag runs the functional half and stops, nulling the timing fields so the output cannot be read as a measurement.
The claims gate now checks documented paths too — all 53 were already right (D67) Templates are skipped by a rule (paths here are lower case), and the checked count rose from 73 to 126 so an empty scan cannot read as a pass. Also fixed the gate's own stale --help example.
Re-establish I2 and M2 on the current engine (D66) Two machines, real model, current binaries, peer reading its own install: both nodes IDENTICAL to the single-node reference, same digests, 40 reductions over ~800 terms each. The four-node mesh deliberately waits for the quiet window.
Verify M1's generated-token claim and make the gate require it (D65) Both generation paths produce the identical eight tokens with identical margins, including 0.1339 and 0.0445. run_m1_gate.py now runs both and requires equality, with an unreadable line failing rather than passing.
The tiled kernel is bit-exact and still slower — the engine is I/O-bound, so kernels are not M3's lever (D64) Coalescing the loads changed nothing, so the cost is the path around the kernel (~4 ms per dispatch). The profile says 68% of a forward is I/O at the sequential floor, so sharding the reads is the lever. DC-033 closed; the kernels stay opt-in as a tested asset.
The GPU matmul is bit-exact and slower — opt-in, and round 45's head number was drift (D63) Alternating the conditions instead of running them in sequence showed every phase that uses the kernel is slower (attn.core 4.05 -> 5.55 s) while untouched I/O is unchanged. Cause: a warp touches 32 cache lines for 4 useful bytes each. Fix: a threadgroup-tiled kernel, which cannot change the order.
The head's matmul on the GPU: bit-exact over 288 shapes, head 1.74 -> 1.28 s (D62) The chooser lives in the forward, not in Ops, with a work threshold and a fallback that cannot change a trace because the two are bit-identical. The totals hid the gain; the phase profile showed it. What remains in the head is 1.02 GB of weights at ~0.8 GB/s — the same I/O floor. attn.core (4.05 s, compute) is next.
D10's open question measured: no math mode is safe, fma(x,w,0) is (D61) .fast, .relaxed and .safe all contract a*b+acc; metal::fma(x,w,0) reproduces the contract under all three. The probe uses a one-ULP discriminator because a 257-term dot passed in every combination — a long-dot test would have declared the GPU exact and been wrong. The head kernel's arithmetic is now settled.
The GPU unpack is the default; a profile corrects DC-107 Verified bit-identical three ways (193 tests through the new path, both modes matching the stored scalar trace digest). mix.read is 7.23 s of a 19 s trace with the unpack 4.53 s inside it — not the 3.45 s the record held, and never at a limit. The read is (0.95 GB/s). Next kernel: the head, a plain GEMM at 1.76 s.
The GPU unpack is now faster than the CPU path, same digest (D59) 16.3 s against 18.2 s scalar and 38.2 s before, by caching the buffers and copying each section once. The numbers are one trace each, not a benchmark; the default stays opt-in until the timing phase.
DC-087 fixed; the GPU unpack is wired in behind SHARD_GPU_UNPACK and is bit-identical end to end, but slower The acceptance grid now includes the awkward widths it used to skip, plus the partial-row payload the engine actually assembles. Same digest with the flag off and on (trace_diff IDENTICAL); 18.2 s scalar vs 38.2 s GPU, so the remaining work is the plumbing, not the shader. Also: never remove the disk watchdog by hand — this round's run took free disk to 0 GB unwatched.
I6 closed by repairing the install's provenance; DC-112 decided from the logits 26 source-shard digests now in install.json, repo and revision corrected, verify_install clean, and the engine's trace unchanged so every recorded digest stands. The audit's I1/I3 now cite the round-39 matched weights proof. DC-112: the DeltaNet and attention projections should return to bf16 — the int4 pass is narrow (margin 0.27, top-8 overlap 5-8 of 8) — blocked on ~25 GB of free disk.
M1 verified: the engine reproduces the contract byte for byte with matched weights trace_diff between the engine and a contract run on the install reports IDENTICAL — 83 tensors, 0 elements, 40 discrete decisions, matching digests. The 40-discrete/1-float difference against a checkpoint contract is the declared, measured effect of int4. DC-111 closed and removed; DC-112 rescoped to the design choice.
M1's divergence is the quantisation policy, not the engine — proved byte-exactly (D55) The install holds the DeltaNet's three projections and attn.q/k/v/o as int4 while the contract is generated from the checkpoint's bf16. Fed the install's own values the reference reproduces the engine byte for byte; with the checkpoint's weights it differs by 24.5% median relative. The engine is correct and M1's claim cannot hold as configured — DC-112 decides. Also: the memory budget is now enforced (D54), after two of my own comparison scripts grew to gigabytes on this node.
News + tracker: the divergence is inside the delta rule and is 4.3% median, not rounding delta_core differs in all 20480 values with a median relative difference of 4.3% -- structural, not last-bit. The rule's inputs are the next comparison.
News + tracker: every stage of the chunked rule corresponds; reading has hit its limit Ten eliminations by reading, no runs spent. The next comparison must be numeric: capture inside chunk_gated_delta_rule and around the gated norm.
News + tracker: four attention-half stages eliminated; the chunked-vs-recurrent structure found The input norm (the prime candidate) checks out, as do silu/sigmoid with their branch at zero. The contract names the chunked delta rule; the engine has that plus a recurrent decode path.