SuperSLM 1.12.0

SuperSLM 1.12.0

Released 2026-10-12.

SuperSLM 1.12.0 stores the CPU backend's K/V memory in pages. A sequence can declare a budget, the
positions it will write itself, and reserve only the pages that budget needs instead of a whole
context-length block. Sequences that adopt a shared prompt prefix can share the prefix's pages
instead of copying them, and a budget sequence's save blob holds its live rows, the adopted prefix's
span included, so its size follows its live length instead of the context length.

Output does not change. Tokens and K/V values are bit-identical to 1.11.0 on every path, as read on
Windows x64 with MSVC; the paged-KV suites were run there only (see Verification). A host that
calls only the 1.11.0 verbs keeps 1.11.0's results, admission counts and save blobs, apart from the
changes listed under Compatibility. Its speed is not unchanged: saving a no-budget sequence takes
1.14 to 2.00 times as long as in 1.11.0 on the release code, at every length measured (24 of 24
readings across four captures; readings, not resolved changes; see Speed), and a later release is
planned to fix that.
The memory savings come only from the new budget-mode verbs. The GPU API is unchanged (gpu_1p0.h
changed in comment text only), and no model artifact needs reconversion (the loader and the
converter tools are unchanged since 1.11.0).

What changed

• Pages. A KV pool is now a pool of pages of B positions (sslm_kv_page_positions). B
  follows from the model's head dimension, context cap and K/V element width, and the artifact's
  stored block size does not select it: 64 for Qwen2.5-0.5B at cap 4,096 and for Qwen2.5-1.5B at
  cap 32,768, the two sizes measured below. docs/api.md states the rule. A sequence or prefix
  reaches its K/V through a page table. The old block pool (sslm_kv_pool_create) is the same
  number of bytes at a cap B divides, cut into block_count · ceil(cap / B) pages.
• Budget-mode sequences and prefixes. sslm_seq_create_budgeted and
  sslm_prefix_begin_budgeted take a budget, 1 ≤ budget ≤ cap, and reserve
  R(budget) = min(ceil(budget / B) + 1, ceil(cap / B)) pages up front (sslm_kv_pages_for_budget).
  Prefill and decode then take pages only from that reservation, so they never fail for lack of pool
  pages below the holder's limit, min(origin + budget, cap). A write past the limit returns the new
  status SSLM_KV_BUDGET_EXCEEDED (ordinal 29), with no row written. At the cap the existing
  SSLM_CONTEXT_CAP_EXCEEDED fires instead.
• Shared prefixes. A budget sequence that adopts a frozen prefix maps the prefix's full pages
  and copies at most one page. sslm_prefix_begin_from builds a budget-mode prefix on top of a frozen
  parent the same way, so prefixes can nest (a world, then a persona on the world). A shared page is
  freed when the prefix and every holder that maps it have let go of it. Sequences made by
  sslm_seq_create still copy, as before. Sharing, residency by budget and a cheap high cap hold at
  a cap of more than one page; at a cap that fits in one page a holder is a single page, so adopt
  copies it and a budget reserves all of it.
• Page pools and diagnostics. sslm_kv_page_pool_create sizes a pool in pages
  (sslm_kv_page_size, sslm_kv_page_pool_overhead_size). sslm_kv_pool_stats reports a pool's
  free and shared pages, and sslm_seq_kv_stats a sequence's mode, origin, budget, limit and pages.
• Contiguous pool option (CPU). sslm_kv_pool_contiguous_size and
  sslm_kv_pool_create_contiguous build a pool whose page is the whole context cap, one page per
  block: 1.11.0's contiguous layout, through the same page module. Every verb works on it. A holder
  in it takes one page, so adopt and sslm_prefix_begin_from copy and share no page, and saves are
  the same in every pool kind, so a blob restores across pool kinds. It gives up what a page pool
  gives a budget holder, which is sharing a prefix's pages and reserving by budget, and it is
  outside the claims for reset and adopt cost, shared prefixes and residency by budget. It is the
  reference that decode speed is measured against (see Speed).
• Save and restore. A budget sequence saves a new format, SSB6: the SSB5 header plus its mode,
  budget and origin, then its live rows, from position 0 to its live length, the span of an adopted
  prefix included, so its size follows its live length. A sequence that adopted a 1,200-token prefix
  and generated 512 tokens saves 1,712 rows. Cell 7.11 asserts the exact size at live lengths of 0,
  1, one page and 1,000. A no-budget sequence keeps saving SSB5, byte-equal to 1.11.0's blob, so 1.9.0 to 1.11.0 still read
  every save a 1.11.0-style host makes. Restore keeps a budget sequence's budget, origin and limit.
  sslm_seq_restore_shared takes a live prefix handle and re-shares its pages when the prefix's
  bytes match the blob's exactly; without a matching handle it restores privately and still
  succeeds.
• Softmax fast path. On the AVX2 and AVX-512 tiers, SoftmaxRowQ15's fast path admits rows up
  to width 32,767 (it was 2^14). Every probability and the returned bool stay bit-identical to the
  1.9.0 body, pinned by the softmax golden stream (docs/attention-rowsites/s4/golden.txt, 882,516
  values, regenerated from a build of the 1.9.0 tag) and by cell 6.9. No speed figure is claimed for
  it.

docs/api.md (Paged KV memory) is the full contract: every verb, the SSB6 layout, the restore
rules, the thread rules and the limits.

Memory, graded by admission

The memory figures are graded by what a pool admits, never by the library's own page counts. The
example cohort is an assumption, not a measured workload: a 1,000-token world prefix, 10 persona
prefixes of 200 tokens built on it with sslm_prefix_begin_from, the world handle then released, and
50 budget sequences of 512 tokens each (5 per persona), each run to its budget. At Qwen2.5-0.5B with
cap 4,096 a page is 384 KiB (64 positions), and a 1.11.0 block is 64 pages (24 MiB).

• A page pool of 505 pages admits the whole cohort, and a pool of 504 pages refuses exactly
  one create, the 50th sequence, with SSLM_KV_POOL_EXHAUSTED. 505 pages is 189.4 MiB. 1.11.0's
  layout holds the same cohort in 60 whole blocks, 1,440 MiB (arithmetic from the 24 MiB block, 60
  times 24; no 1.11.0 run measured it). The admission and the refusal are confirmed on the
  release machine (cell 10.4, real Qwen2.5-0.5B artifact).
• A pool of 1.11.0-style blocks (sslm_kv_pool_create, with the same bytes and admission at this
  cap as in 1.11.0) in the same 189.4 MiB
  admits 7 sequences and refuses the 8th, because an eighth block needs 192 MiB. Cell 10.4 runs
  this contrast leg on the 1.12.0 build with the 1.11.0 verb; it is not a run of the 1.11.0 binary.
• After every sequence is saved mid-budget and at its limit, the world and personas rebuilt in a
  fresh pool and the world released, the 50 sequences restored with their persona handles fit in
  505 pages, and 504 refuses exactly the 50th, for both saves; confirmed on the release machine
  (cell 10.6, real Qwen2.5-0.5B artifact).
• Restored without handles, the same blobs need 1,405 pages (1,404 refuses the 50th), until
  each sequence resets and re-adopts its persona; after that the pool admits 100 more budget-512
  sequences, for both saves; confirmed on the release machine (cell 10.8, real Qwen2.5-0.5B artifact).

These numbers hold in budget mode only, and for this artifact's page size. Another model or cap has
another page size and its own figures. They are confirmed on the real artifact on the release machine.

Speed

This release makes speed claims for Windows x64, CPU only, at the ordinary background load of the
release machine: an AMD Ryzen 9 3950X (16 cores, 32 logical processors) with AVX2 and without
AVX-512, running Windows 10.0.19045, where the dispatched kernel tier is AVX2. A process watch ran
beside every timing row and listed no process other than the row's own, and the shared-prefix run
read 2% and 3% CPU load before and after. Decode speed is claimed for single-conversation
generation only: one sequence, decoding one token at a time. Nothing is claimed under load, on the
GPU, or for batched decode.

• Decode, one conversation. Attention reads K/V one page run at a time. Single-conversation
  decode is no more than 5% slower than the contiguous cache at both targets, to the 0.5B cap of
  4,096 and to width 18,682 at 1.5B, with 7.9b reported (below). The contiguous
  cache is the contiguous pool option of the same build. The comparison is not against 1.11.0, and
  no measurement ties the option's speed to an older release. Cell 7.9 restores one saved sequence into each
  of two arms on one artifact: the paged arm, in a page pool at the model's page size with its pages
  in scattered order, and the contiguous arm, in a contiguous-option pool. It decodes the same
  tokens in both, alternating one token per arm in an order drawn at random for each pair, and
  times each token alone. A process of 104 pairs gives a median slowdown, paged time over
  contiguous time minus one. A row is five processes on one boot, and it passes when the largest of
  its five process medians is at most 5.0%. The scattered order is no more step-regular than a
  random one; it is not claimed to be a worst case. Cell 7.9 times whole-token sslm_decode_step
  calls with no host parallel-for hook, on the AVX2 tier. Decode with the hook, decode sliced
  across calls, and decode on the AVX-512 or SSE2 tier are not measured.

  All six rows pass. Each row's figures, in percent slower than the contiguous cache:

  Model, cap	Restored at	Timed widths	Largest process median	SD of the five medians	Mean of the five, ± 95% half-width
  Qwen2.5-0.5B, 4,096	1,200	1,204 to 1,307	+1.001	0.067	0.941 ± 0.083
  Qwen2.5-0.5B, 4,096	2,044	2,048 to 2,151	+1.706	0.098	1.629 ± 0.122
  Qwen2.5-0.5B, 4,096	3,988	3,992 to 4,095	+2.682	0.089	2.582 ± 0.110
  Qwen2.5-1.5B, 32,768	8,188	8,192 to 8,295	+1.310	0.178	not stated
  Qwen2.5-1.5B, 32,768	15,872	15,876 to 15,979	+3.349	0.520	not stated
  Qwen2.5-1.5B, 32,768	18,678	18,682 to 18,785	+3.861	0.439	not stated

  At 0.5B the half-width is the resolution of the mean of the five process medians. The largest
  median, which the rule grades, has no resolution of its own. The 1.5B figures are not resolved
  finer than about one point. The same comparison run with two identical contiguous-option arms (an
  A/A run, which should read zero) read +0.05% at the 0.5B row restored at 3,988, and +1.16% and
  +1.13% at the 1.5B rows restored at 15,872 and 18,678, in this measuring session. So 1.5B figures
  carry a zero-point offset of about one point at the time they were measured. The 1.5B row restored at 8,188 has
  no A/A run of its own, and the offset statement covers it by extension from the other two,
  unmeasured at that width. This release states no 1.5B figure as a paged overhead finer than that
  offset, no figure corrected for the A/A reading, no margin under the 5% bar at 1.5B as
  established, and no ordering of or trend among the 1.5B rows. Decode at widths beyond the table
  (at 1.5B, above 18,785) and at Qwen2.5-0.5B with a cap above 4,096 is not measured.

• Decode over a shared prefix, reported. Cell 7.9b times a budget sequence that adopted a
  persona prefix against a sequence holding the same prompt in a contiguous-option pool, on
  Qwen2.5-0.5B at cap 4,096: 508 pairs over widths 1,204 to 1,712, the order drawn at random for
  each pair. The median slowdown is +1.063%, with a sign interval of +0.990% to +1.130% (half-width
  0.070 points), against the same 5% bar. It is reported and is not part of the claim above.

• Batched decode has no speed claim. sslm_decode_step over several sequences works and stays
  bit-identical: cell 8.1 decodes a no-budget sequence and a budget sequence that share a prefix in
  the same sslm_decode_step calls, 40 tokens that cross one page boundary of the cell's synthetic fixture, and requires each to equal its
  solo no-budget twin in tokens and save blob. On the release machine it
  is one of the 70 cells of the paged-KV suite superslm_pkv_c5, which ran green (156 checks in
  cell 8.1; 70 cells, 0 red, 74,052 checks in the suite). No batched speed is measured or claimed.

• Reset and adopt: cost does not grow with the context cap, except that at head_dim ≤ 64 a cap
  above 4,096 doubles the page and its one-page tail copy (0.5B: 384 KiB at caps up to 4,096, 768
  KiB above), at a cap of more than one page. (The one-page tail copy is the copy of a single
  page, made when a sequence adopts a prefix whose length is not a multiple of the page size.)
  Create, reset and adopt no longer touch a whole block, and release poisons only the pages a
  sequence wrote. Create reads 5.60 microseconds at 1.5B with cap 32,768, against 24,698.10 in
  1.11.0 (lifecycle table below). Cell 7.4 times reset and adopt at the same live length at cap 4,096
  and at cap 32,768 on Qwen2.5-0.5B, inside one binary, with the page size pinned to 64 positions at
  both caps (a test-only setting), and grades the ratio of the two (cap 32,768 over cap 4,096)
  against a fixed bound of 2.0. "Does not grow" is therefore graded as no more than 2.0 times over an
  eightfold cap. The pinned page leaves out the doubling the exception names: in production the page
  is 64 positions at cap 4,096 and 128 at cap 32,768, and that pair was not timed. The doubled tail
  copy (384 KiB against 768 KiB) follows from the page rule and was not measured. The cell compares
  the two caps and publishes no absolute figure.
  For each holder kind and verb it takes 205 paired ratios, sorts them, and passes when the 120th
  smallest is at most 2.0. The 86th and 120th smallest ratios, an interval around the median, were:

  Holder, verb	86th smallest	120th smallest	Bound
  Budget, adopt	0.996	1.004	2.0
  Budget, reset	1.000	1.000	2.0
  No-budget, adopt	0.950	1.018	2.0
  No-budget, reset	1.188	1.750	2.0

  All four pass at equal page size. The no-budget reset reads up to 1.750, inside the bound of 2.0,
  and its interval, 1.188 to 1.750, lies above 1: at the same page size it costs more at cap 32,768
  than at cap 4,096, within that bound.

• Lifecycle verbs against 1.11.0. This build's lifecycle cell and a 1.11.0 build ran the same
  readings on no-budget holders, the holders both builds have: create into an empty one-block pool,
  release of a fresh holder, and restore, save, release and reset at live lengths of 16, 1,000 and
  the cap, and copy adopt of prefixes of 16, 1,000 and 2,048 tokens, at Qwen2.5-0.5B with cap 4,096
  and Qwen2.5-1.5B with cap 32,768. That is 34 readings. At 1.5B the full-cap state is the
  1,000-token state with its length set to the cap, so that every position is live. The two builds
  ran as separate processes: the 1.11.0 readings were taken on 2026-10-03 and the 1.12.0 readings on
  2026-10-11, in separate sessions, by separately built executables. A change is therefore stated
  only where the two medians differ by a factor of at least 4. The rule was checked before use: a
  healthy pair of builds of the same source read as no change at every one of the 34 readings, and a
  build with a deliberate cap-proportional walk in reset and adopt was reported as changed.
  Twenty-two readings differ by that factor, and every one is a speed-up. Times are medians in
  microseconds; the last column is the spread of the reading, the larger of the two builds' spreads
  among their repeated measurements.

  Case	Live length or prefix	1.11.0	1.12.0	Change	Spread
  0.5B, cap 4,096: create		1860.50	6.40	-99.66%	67.19%
  0.5B, cap 4,096: release	0	1845.80	1.60	-99.91%	31.25%
  0.5B, cap 4,096: restore	16	4114.70	27.90	-99.32%	12.54%
  0.5B, cap 4,096: release	16	1451.90	39.60	-97.27%	19.19%
  0.5B, cap 4,096: reset	16	1533.10	11.60	-99.24%	27.59%
  0.5B, cap 4,096: adopt	16	2306.10	10.60	-99.54%	12.26%
  0.5B, cap 4,096: restore	1,000	4144.60	608.50	-85.32%	17.65%
  0.5B, cap 4,096: reset	1,000	1532.90	11.10	-99.28%	12.61%
  0.5B, cap 4,096: adopt	1,000	2370.50	271.60	-88.54%	18.04%
  0.5B, cap 4,096: reset	4,096	1530.90	10.80	-99.29%	8.33%
  1.5B, cap 32,768: create		24698.10	5.60	-99.98%	46.43%
  1.5B, cap 32,768: release	0	24662.10	2.50	-99.99%	16.00%
  1.5B, cap 32,768: restore	16	57347.40	49.00	-99.91%	2.86%
  1.5B, cap 32,768: release	16	24703.00	83.40	-99.66%	1.68%
  1.5B, cap 32,768: reset	16	24718.30	10.20	-99.96%	3.92%
  1.5B, cap 32,768: adopt	16	32383.00	22.40	-99.93%	26.79%
  1.5B, cap 32,768: restore	1,000	57320.40	1799.00	-96.86%	2.50%
  1.5B, cap 32,768: release	1,000	24739.50	1208.20	-95.12%	4.72%
  1.5B, cap 32,768: reset	1,000	24686.80	11.00	-99.96%	0.31%
  1.5B, cap 32,768: adopt	1,000	32368.80	1817.30	-94.39%	87.20%
  1.5B, cap 32,768: adopt	2,048	32310.20	3609.40	-88.83%	82.73%
  1.5B, cap 32,768: reset	32,768	24701.60	11.90	-99.95%	5.04%

  The other 12 readings are not resolved at that factor: save at every length for both models;
  release at 1,000 and at 4,096 at 0.5B; release at 32,768 at 1.5B; restore at the full cap for both
  models; and adopt of a 2,048-token prefix at 0.5B. The six save readings are stated in the next
  bullet. This release claims no size or direction of change for the other six.

• Save is slower than 1.11.0. sslm_seq_save of a no-budget sequence writes the same bytes as in
  1.11.0 and is slower at every length measured, on both models. These are readings, not resolved
  changes: the comparison above resolves a change only at a factor of 4 or more, and it graded all
  six save readings as not resolved. The table is the graded run of 2026-10-11 (medians in
  microseconds; the spread is as in the table above):

  Case	Live length	1.11.0	1.12.0	1.12.0 over 1.11.0	Spread
  0.5B, cap 4,096: save	16	1715.50	2231.30	1.30	19.76%
  0.5B, cap 4,096: save	1,000	1713.50	2311.80	1.35	17.96%
  0.5B, cap 4,096: save	4,096	1719.10	3317.70	1.93	6.56%
  1.5B, cap 32,768: save	16	32144.20	39038.60	1.21	1.35%
  1.5B, cap 32,768: save	1,000	32103.80	39777.70	1.24	1.59%
  1.5B, cap 32,768: save	32,768	32121.30	60326.90	1.88	6.22%

  Four captures of the lifecycle cell read these six saves: the graded run above; a second run of the
  same executable and a run of a rebuild of the same source, both on 2026-10-11; and a run of an
  earlier build on 2026-10-06. All 24 readings are slower than 1.11.0. The three captures of the
  release code read 1.14 to 2.00 times as long (the graded run, 1.21 to 1.93), and at full length
  about 1.9 to 2.0 times; the earlier build read up to 2.23. The two shortest 0.5B readings of the
  graded run have spreads of 19.76% and 17.96% against changes of 30.07% and 34.92%; the other four
  have spreads of 1.35% to 6.56%. The cause of the slowdown has not been measured. A later release is
  planned to remove it.

Compatibility and required action

A host that calls only the 1.11.0 verbs needs no code change. These changes apply to every host:

• sslm_seq_save of a no-budget sequence is slower: 1.14 to 2.00 times as long as in 1.11.0 on
  the release code, at every length measured (24 of 24 readings across four captures; readings, not
  resolved changes; see Speed). The blob is unchanged. A later release is planned to remove the
  slowdown.
• sslm_seq_state_size is 20 bytes larger. Its fixed part is 180 bytes, against 160 in 1.11.0,
  so it stays an upper bound for SSB6 blobs. A host that sizes save buffers with it needs no change.
• sslm_kv_pool_create refuses a block_count whose page total exceeds UINT32_MAX with
  SSLM_INVALID_ARGUMENT. At cap 32,768 that is 8,388,608 blocks or more for Qwen2.5-1.5B, whose
  page is 64 positions, and 16,777,216 blocks or more for Qwen2.5-0.5B, whose page is 128. These
  counts are computed from the page rule; the cell that asserts them on the real artifacts was not
  run.
• sslm_kv_pool_overhead_size is larger at a cap the page size does not divide, by
  block_count · (ceil(cap / B) · B − cap) positions of K/V. sslm_kv_block_size and the no-budget
  save blob are unchanged at every cap.
• sslm_prefix_freeze, on its first call, returns the prefix's unused pages to the pool. A pool
  can therefore admit more handles than in 1.11.0, never fewer: a pool of N blocks whose handles were
  all made by the 1.11.0 verbs still admits N handles.
• sslm_seq_reset no longer zero-fills the sequence's K/V memory. No read reaches the old rows,
  and a no-budget save still writes zeros past the live length, so saved blobs are unchanged.
• Restore refuses a blob of any format that is mid-token at the context cap, with
  SSLM_INVALID_ARGUMENT. No save produces such a blob.
• Restore reads SSB6. An SSB6 blob must be passed with exactly the size its save returned;
  SSB5 and older still accept a larger buffer.
• sslm_status gains SSLM_KV_BUDGET_EXCEEDED, appended as ordinal 29. Only budget-mode
  sequences and prefixes can return it. Every other ordinal is unchanged.
• The axis digest differs from 1.11.0's. The digest tool's attention section now covers softmax
  rows up to width 32,767 (1.11.0's ended at 2^14), so its GLOBAL hash is not 1.11.0's f740f833….
  This follows from the tool's source; this note records no 1.12.0 digest value. The digest is not
  part of the bit-identity statement above.
• Decode speed against 1.11.0 is not measured. The decode claim compares paged decode with the
  contiguous pool option of the same build, which has 1.11.0's layout, and not with a 1.11.0 binary; no
  measurement ties the option's speed to 1.11.0's.

A host that adopts budget mode should know:

• An SSB6 blob cannot be read by 1.11.0 or earlier, which refuse it on its magic.
• Once a budget-mode handle is in a pool, admission follows the pages actually held: a budget
  sequence that shares a released prefix's pages keeps them counted until it resets, adopts or
  releases. Size admissions from sslm_kv_pool_stats' free_pages.
• Restoring a cohort without its prefix handles holds each sequence's prefix span privately until it
  resets or re-adopts (the 1,405 pages above, against 505). Pass each restore its live prefix
  handle through sslm_seq_restore_shared.
• A budget sequence's adopt of a prefix from another pool is refused with SSLM_INVALID_ARGUMENT.

A host can test for the surface at compile time with SSLM_HAS_PAGED_KV_ABI.

Not in this release

• GPU paging. GPU sequences keep one whole-cap buffer each, and the GPU has no prefix verbs. GPU
  paging is planned for a later release.
• Memory savings for the 1.11.0 verbs. They keep one block's pages per handle, and a no-budget
  save is still the whole block.
• A removed cap. The context cap stays: RoPE tables and the attention scratch are sized by it.
  Paging only makes a high cap cheaper to reserve.
• Automatic prefix matching, adapter-shaped prefixes, and batched shared-prefix attention.
  Prefixes are explicit, base-only handles, and each sequence still reads shared pages in its own
  attention step.

Verification

The cell numbers in this note (7.4, 7.9, 10.4 and so on) name cells in tests/paged-kv/; each source
file lists its own cells in its header.

• Bit-identity (real artifacts, release machine): the Qwen2.5-0.5B cohort's tokens and K/V rows
  equal a no-sharing v1.11.0 run (cell 10.1), and so do the Qwen2.5-1.5B cohort's at cap 32,768
  (cell 10.2).
• Old readers (v1.11.0 binary, read on 2026-10-02, before this release): a binary built from
  the v1.11.0 tag restored a real no-budget SSB5 blob with SSLM_OK and refused a real budget
  SSB6 blob with SSLM_INVALID_ARGUMENT (cell 9.3; 18 checks, 0 failures). This is a reading of
  the v1.11.0 binary taken before the release, not a release-machine reading at the release commit.
• Paged-KV suites (release machine, commit ed1cf52): all green. The CPU suites superslm_pkv_r0
  (5 cells, 441 checks), superslm_pkv_c2 (7 cells, 4,021 checks), superslm_pkv_c3 (6 cells, 114
  checks), superslm_pkv_c4 (30 cells, 5,335 checks) and superslm_pkv_c5 (70 cells, 74,052 checks)
  pass with 0 failures on the dispatched AVX2 tier. The 70 cells of superslm_pkv_c5 also pass with
  the AVX2 tier forced (74,053 checks), with the SSE2 tier forced (each cell run as its own process,
  70 of 70, 74,398 checks in all, since each process repeats its cell's own setup checks), and with
  the AVX-512 tier forced on an AMD Ryzen 9 7950X3D (70 cells, 74,053 checks, 0 failures); the
  release machine has no AVX-512. These counts were measured at ed1cf52, and the release changes
  none of these suites' inputs, except the pool teardown fix below. The page rule, the partial-last-page
  and contiguous-option cases and the adopt boundary at caps 64 and 65 are in
  superslm_pkv_r9 (58 cells, 5,306 checks, 0 failures), which was run twice on the release machine
  at ed1cf52, on the dispatched tier: the first run failed one cell because an environment variable
  was not set, and the second was green. Its forced-tier legs last ran on an earlier build, and no
  AVX-512 run of them is recorded. All of these suites ran on Windows x64 with MSVC. No run of them on
  Linux or macOS is recorded, and no CI job builds them.
• Readings and a later fix: the readings in Speed and Memory, and the suite counts above,
  were taken at commit ed1cf52. The release adds one fix after them, run at none of those
  readings: sslm_kv_pool_destroy no longer writes through the model, so destroying a pool after
  sslm_model_unmap, an order 1.11.0 allowed, stays safe. (1.12.0 added a count of live pools to the
  model, and destroy decremented it through the model, which unmap may already have freed; 1.11.0's
  destroy never touched the model.)
• Suites (CI): superslm_tests runs on Windows x64, Linux x64, Linux x64 with AddressSanitizer and
  UndefinedBehaviorSanitizer, Linux x64 Debug, macOS arm64 and, under ThreadSanitizer, Linux x64.
  The Python source checks (python -m pytest tools/ tests/reference/, as the converter-validate
  job runs it, with the 17 paged-KV tool test files that need the Windows build ignored) pass:
  2159 passed, 31 skipped, 1 expected failure, measured on the release machine at the release commit.
• Found before release, not yet removed: the slowdown of a no-budget save was seen in development:
  a development build's full-length save at cap 32,768 on Qwen2.5-1.5B read 2.18 times 1.11.0's
  (one reading, 2026-10-03). It remains in the release (see Speed), and a later release is planned
  to remove it.
• Code review: the final review of the release diff returned fix-then-ship. It found a
  use-after-free in sslm_kv_pool_destroy after sslm_model_unmap, and two release statements that
  said more than the code or the record showed. All three were fixed, and the re-check of the fixes
  returned ship. Windows suite run of the fix: superslm_tests on MSVC Release, 134,066 checks,
  0 failures.
• Release machine: build.bat ran to completion in ten stages (the slices of the script that
  its staged runner runs) on commit 8b58684, each stage exiting 0 and the last printing its completion line, with MSVC 19.33.31631.0 configured by CMake.
  The export-slot check passed: the headers declare 51 C verbs (13 new in 1.12.0) and the verb list
  holds the same 51; 76 names are exported (25 C++ and 51 C) against 76 listed, with none missing
  and none extra; and a consumer links against and imports all 76. superslm_tests on MSVC: 129,131
  checks, 0 failures, including the 2,152 checks of the decode-threading cells. The object-code scan
  suite reads 232 passed, 1 skipped and 1 expected failure, and the seven source checkers of the
  last stage pass.
  The commits between ed1cf52, where the suites and timings above ran, and 8b58684 change the
  build script, the repository's line-ending attributes, test suites and their fixtures, the oracle
  tools of two tests, one CI workflow and the source-line citations in one header; nothing under
  src/ changed. The release commit differs from 8b58684 by documents, by comment-only edits to
  one header (its code tokens are the same on the same lines), and by the teardown fix, which is the
  only change under src/ after ed1cf52, together with the fix's test cells
  (tests/test_slm18x_saturation_census.cpp and tests/test_main.cpp), which the 129,131-check run
  above did not include. The release gate's tests
  (tools/test_t2704_release_gate.py) check compiled diagnostics pinned to a commit in
  tests/data/t2704_release_manifest.json; they are rebuilt and re-pinned to commit 9d882b1, the last commit that changes
  an input they check: python -m pytest tools/test_t2704_release_gate.py reads 4 passed.
• Skipped checks, release machine (build.bat): the ten stages print 41 skip-class lines, and
  each matched a listed expected skip. One is CMake's note that it skips its compiler check after
  ABI detection, which is not a test. In the red suites, 21 checks skip (and 15 summary lines restate
  their counts): 2 are searches for an adversarial refusal that found none within budget, 11 are
  product cells that need inputs not supplied for this release (a different-shape model, an adapter,
  or a tokenizer-bearing artifact) or, for one, a model whose geometry does not match the frozen
  one, and 8 are stubs by design. The other four lines are one cell that needs a second,
  differently shaped real artifact (not supplied); the GPU cell cell_functional_commission, which
  build.bat excludes unless asked for; the one skipped source-check test, a documented gap in the
  disassembler it uses (it never renders one instruction prefix the test would exercise); and one
  attention-rowsites check that needs a one-layer synthetic artifact (not supplied).

Principal files changed

• src/kv_pages.h, src/kv_pages.cpp: the page allocator.
• src/sslm_abi.cpp, include/superslm/sslm_abi.h, include/superslm/sslm_abi_functions.inc,
  include/superslm/sslm_abi_functions_g5_comparable.inc: the page pool, budget holders, shared
  adopt, sslm_prefix_begin_from, SSB6, sslm_seq_restore_shared, the stats verbs, the
  contiguous pool option and SSLM_KV_BUDGET_EXCEEDED.
• src/forward/forward_sites.cpp, include/superslm/forward_sites.h, src/matmul.cpp,
  include/superslm/matmul.h: the page view and per-page attention, with the flat workspace as its
  one-page case.
• include/superslm/checked_chain_funnel.h, src/forward/checked_chain_funnel.cpp,
  include/superslm/gpu_layer_loop_guards.def, include/superslm/gpu_port.h,
  src/gpu/superslm_gpu.cpp: the page-coverage guard and its GPU mirror (it cannot fire on the GPU).
• tests/paged-kv/, tools/gen_paged_kv_fixture.py, tools/build_paged_kv_reference.*,
  tools/check_paged_kv_red.sh, tools/run_paged_kv_c6_box.ps1, tools/paged_kv_box_common.ps1,
  tools/paged_kv_c6_provenance.ps1 (with tools/test_paged_kv_c6_provenance.ps1):
  the fixtures, references, cells and timing harnesses.
• src/intmath.cpp: the softmax fast-path width cap, 32,767.
• include/superslm/gpu_1p0.h, include/superslm/model.h: comment text only.
• docs/platform-support.md, docs/sslm_format.md, docs/attention-rowsites/,
  tests/attn_rowsite_golden_pin.h, tests/support/attention_cases.h, tools/ci/ and
  .github/workflows/tests.yml: the platform and format notes, the softmax golden pins and case
  set, the CI digest tool and checks, and the CI workflow. The other changed files are tests,
  fixtures, references and tool scripts.
• CMakeLists.txt, build.bat and the MSVC build lists: src/kv_pages.cpp.
• tests/t2807-api-slot/c_abi_verbs.txt: 51 C verbs. The status mirrors in tests/t2130-g5-red-suite
  and tests/t2138-abi-red-suite: ordinal 29.
• tests/install-consumer/CMakeLists.txt, README.md, CHANGELOG.md, docs/api.md and this note:
  version 1.12.0.