SuperSLM 1.9.0

SuperSLM 1.9.0

Released 2026-09-25.

SuperSLM 1.9.0 changes the CPU save format so a saved sequence keeps its four per-site saturation
counts, refuses at map time an artifact whose damped-greedy scale no decode can use, and adds C-ABI
tests for schema-constrained and damped-greedy decoding. No token, status ordinal, ABI surface,
SslmGpuStatus ordinal or measured figure changes, and no model-artifact reconversion is required.

What changed

SequenceLayerState carries a saturation total, kv_saturation_count, and the four per-site counts
it sums: kv_landing_saturation_count, k_channel_landing_saturation_count,
rope_q_saturation_count and rope_k_saturation_count. 1.8.1 made the four travel with the total
through prefill and prefix adoption, and stated one limit it left: sslm_seq_save recorded only the
total, so a sequence restored with sslm_seq_restore had its total and per-site counts of 0.

• Save. sslm_seq_save writes a new format, SSB5: the SSB4 layout with the four per-site
  counts appended to its fixed header (little-endian 64-bit each, in the order above, at byte offsets
  124, 132, 140 and 148). Every field SSB4 has keeps its offset. The blob grows by 32 bytes, and
  sslm_seq_state_size grows by the same 32 bytes, so it stays an upper bound on what
  sslm_seq_save writes.
• Restore. sslm_seq_restore reads the four counts from an SSB5 blob, so the restored
  sequence's per-site counts are the ones it was saved with and sum to its total.

The counters are written beside the arithmetic, never read by it, so no token changes.

Blobs saved by earlier releases

sslm_seq_restore still accepts SSB4 (1.2.1 to 1.8.1), SSB3 and SSB2 blobs, under the same
rules as before. They record only the saturation total, so a sequence restored from one has that
total and per-site counts of 0; its per-site counts do not sum to its total until it is reset. The
blob never recorded which site produced each saturation, so any non-zero split would be invented,
and restoring the total as 0 would discard a value the blob does record. Restore does not require an
SSB5 blob's four counts to sum to its total: a sequence restored from an older blob and saved again
carries a per-site sum below its total, and it restores as saved.

The GPU path

Checked at source and by execution; unchanged. GPU prefill and decode both pack the four counts into
the device's sequence state and read them back with the total, and the GPU save format (SLM5, and
the legacy SLM4 it still reads) already carries all four. The GPU has no prefix adoption.

Damped greedy: an unusable scale is refused at map

sslm_model_map already refused, with SSLM_ARTIFACT_REJECTED, an artifact whose DGC1 damped-greedy
scale falls outside the i-exp domain. Its check derived the scale's i-exp constants and checked the
softmax row width, but not the i-exp peak that sslm_decode_step_v2 requires. A scale such as
(m = 0, e = 0) derives constants of 0, 0 and 0. Before 1.9.0 it passed that check: the artifact
mapped, sslm_decode_params_init offered damped greedy, and every damped-greedy decode then returned
SSLM_INVALID_ARGUMENT. Map time and decode now apply the same peak check, so such an artifact is
refused by sslm_model_map with SSLM_ARTIFACT_REJECTED. The scale tools/convert_model.py writes
passes both, and a converted model maps and decodes as before; this path is reachable only from a
hand-built or corrupted artifact.

New C-ABI tests

tests/test_slm19x_schema_damped_greedy.cpp adds C-ABI cells to superslm_tests for
include/superslm/schema_masks.h and the three src/damped_greedy_*.cpp files. They cover
schema-bound prefill and decode, damped-greedy availability, parameter domains, anti-LM and top-k
behaviour, and workspace and save/restore equivalence.

Compatibility and required action

A blob saved by 1.9.0 is SSB5 and is not readable by 1.8.1 or earlier, which reject its magic with
SSLM_INVALID_ARGUMENT. A host that keeps saved sequences across a downgrade must keep them in the
older format. A consumer that reads or checks the save blob's magic must accept SSB5 where it
accepted SSB4; every field SSB4 has keeps its offset, so a reader of an existing SSB4 field
needs only the magic check widened. An artifact whose DGC1 scale fails the i-exp peak check,
which 1.8.1 mapped, is now refused at map with SSLM_ARTIFACT_REJECTED; no converter output has
that shape. Every C ABI verb, struct and status ordinal is unchanged. The per-site counts are
internal SequenceLayerState fields, not part of the public ABI.

Verification

Each binary was built fresh from a git archive of 66e5828 into an empty directory. Commits
after it change comments and documentation, add test cells, and re-pin the release gate's
compiled diagnostics; no engine code changes.

• Red first, as the test authors read it. At 1.8.1 the save/restore census cells fail on both
  models, 6 checks on Qwen2.5-1.5B-Instruct and 12 on Qwen3-Embedding-0.6B: the restored sequence
  carries its total with every per-site count at 0. At 1.8.1 the map-time DGC1 cell fails 1
  check: a (0, 0) scale maps.
• Windows, MSVC, CMake Release with the GPU on: superslm_tests 35,631 checks, 0 failures; at
  4f2183b, which adds one decode-side damped-greedy cell, 35,655 checks, 0 failures. The
  damped-greedy suite's Phase D cells at 4f2183b on build.bat's fixture: 18/0, 251/0 (the
  adapter-composition cell skips, as above), 29/0 and 1,805/0.
• build.bat: every gate up to its damped-greedy Phase D acceptance run passes. That run stops as
  it did before this release, on 251 checks, 0 failures and 1 skip: its adapter-composition cell
  needs a runtime adapter whose base model carries damped-greedy constants, and no such pair exists
  on the release machine. Run to completion with that one gate recorded instead of stopping,
  build.bat passes every later gate, including the T-2138 ABI suite, the T-2899 cell build and
  its own superslm_tests step (35,625 checks, 0 failures).
• Save/restore and GPU census suite (tests/te441-sat-restore-red-suite), run on
  Qwen2.5-1.5B-Instruct and Qwen3-Embedding-0.6B on an RTX 2080 SUPER. Every cell passes: CPU
  save/restore, the pinned 1.8.1 CPU blob restoring with per-site counts of 0, GPU prefill,
  decode and save/restore, and the pinned 1.8.1 GPU blobs restoring their per-site counts. A GPU
  blob with its per-site counts zeroed fails the cells, as it must.
• Linux, GCC 13.3 Release: superslm_tests 25,274 checks, 0 failures; ASan and UBSan 25,274
  checks, 0 failures.
• pytest tests/ci on a fresh full-history clone: 916 passed. tools/test_t2704_release_gate.py:
  4 passed, with the gate's compiled diagnostics rebuilt from 4e8d3de.

Files changed

• src/sslm_abi.cpp -- SSB5 written by sslm_seq_save and read by sslm_seq_restore;
  sslm_seq_state_size's fixed header grows from 128 to 160 bytes.
• include/superslm/sslm_abi_functions_g5_comparable.inc -- the save/restore contract names SSB5
  and what an older blob restores as.
• include/superslm/sslm_abi.h, docs/api.md -- the save format descriptions; docs/api.md also
  states the map-time DGC1 refusal.
• src/damped_greedy_phaseD.cpp, include/superslm/sslm_phaseD.h, src/sslm_abi.cpp --
  DampedGreedyPeakInDomain, the one i-exp peak check the map-time DGC1 check and
  sslm_decode_step_v2 both apply.
• tests/test_slm19x_schema_damped_greedy.cpp, tests/test_main.cpp, CMakeLists.txt,
  build.bat -- the new C-ABI cells, wired into superslm_tests.
• tests/te441-sat-restore-red-suite/ -- the save/restore and GPU saturation-census cells.
• tests/test_slm18x_saturation_census.cpp and the t2138, t2199 and t2899 suites -- cells for
  SSB5 save/restore and the SSB5 layout.
• tests/data/t2704_release_manifest.json, tools/test_t2704_release_gate.py -- the release gate's
  compiled diagnostics re-pinned to binaries rebuilt from the 1.9.0 sources.
• tools/t2693_prefix_clone.cpp, docs/fused_k_numeric_spec.md -- a comment naming the retired
  save format.
• CMakeLists.txt, tests/install-consumer/CMakeLists.txt, README.md, CHANGELOG.md, this note
  -- version 1.9.0.