v2.35.4

v2.35.4 (2026-10-07)

This release is published under the Apache-2.0 License.

Bug Fixes

• capture: held Python-level torch functions get the same call ids as direct calls (ba36afc)
• capture: models built before the first capture no longer need a rescue forward (abc4fdf)
• capture: journal held-ref rebinds outside the trace, restore only untouched locations, keep aliased holders aliased (6416553)
• capture: skip wrapper and torch internals in the held-ref rebind, rebind partial args and keywords, restore on the failed-forward path; route rescue tests through an unrebindable holder (7909ca7)
• capture: rebind module-held pristine torch functions to the wrappers for each capture and restore them at cleanup (c34fb60)
• rng: run the torch warm before the session-reader imports so a failed import cannot skip it (b920a8f)
• rng: resolve the observability session reader before the RNG monitor window arms (b057537)
• rng: warm torch's lazy opt_einsum import before the RNG monitor window arms (9e02837)
• weightsfree: import torch._dynamo before the meta factory slot arms (7b907cd)
• call trace and the capture runner through user_funcs instead of copying them into the public implementations (2ed6bf9)
• agent: count the limits block inside the response token budget (ac16a54)
• witness: never verify a value-free capture (83d3fe0)
• paddle: never credit a parameter the forward wrote in place outside a wrapped op (89d9f1e)
• tf: replay Pad (MobileNetV3's last unverified op) (561c44f)
• paddle: perturbation rebuild reuses the parameter replay copies (09ab9d1)
• tf: default unset depthwise replay attrs (ff67e91)
• tf: re-read variables only when no op type seen in the forward can write one (0cb0bd3)
• paddle: wrap paddle.nn.layer import-time aliases so BatchNorm2D is captured (120829f)
• tf: re-read variables to verify ReadVariableOp when no op can write them (2d5e241)
• tf: keep validate_metadata out of the TF capture in validate_entry (4b54ef3)
• capture: a module returning its own Parameter is not a stale-ref escape; expect the opaque-exit disclosure in the raw-aten tripwire tests (7009df5)
• capture: disclose and rescue a stale torch ref whose output a module returns (71ebf56)
• capture: copy payloads with preserve_format so a dense source keeps its exact strides (2e36883)
• validation: prove a zero-weight group_norm, layer_norm or rms_norm input cannot reach its output (84e2f2c)
• bundle: import the bundle-graph helpers inside show_bundle_graph so the L3 module gains no eager L7 import (af42572)
• validation: derive the output-scoped credit flag from the wrapper name in post_init (668f82e)
• rescue: canonicalize the long and nonzero aliases; exempt never-completing delitem from the guard (443e4ba)
• rescue: keep in-place trailing underscore in the recovery oracle; derive the dunder guard from the allowlist (fbab204)
• rescue: canonicalize mode-respelled operator dunders in the recovery oracle (5a65bb2)
• witness: set the output-scoped credit flag at token creation and test it before the dispatch call; pin alias edges and multi-dispatch opaque outputs (1140969)
• witness: credit a pure alias of a boundary tensor, such as autograd's saved detach (d6102fd)
• witness: credit a boundary-backed module token only for the dispatch that built a boundary tensor (46937d3)
• validation: check the integer-mod proof in the promoted computation dtype, not only the out= dtype (5c53527)
• validation: narrow the class-3 proofs to the inputs they hold for (7cab207)
• validation: prove four rung-1 false perturbation failures from the op definitions (949ac7e)
• validation: count a dispatch owned only by a module-forward token as a completeness drop (188120c)
• capture: resolve a roster namespace shadowed by a same-named package attribute (f6bc03e)
• capture: track torch.nn.utils.weight_norm's module-level _weight_norm alias (51a1ca4)
• capture: rebind deferred payload aliases without bumping the source version (3537077)
• validation: restore a plain attribute aliasing a Parameter without registering it (788105f)
• validation: keep refusing a structured np.void plain attribute; make the alias test exercise a real plain attribute (4a04173)
• validation: restore a plain attribute whose forward-time value became unsnapshottable (1fc94a2)
• validation: type the copy-fidelity namespace walk for mypy (be3e20a)
• validation: fall back when deepcopy drops attributes; snapshot NumPy scalars and registered-tensor aliases (9f25500)

Chores

• drop an unused mypy ignore code in the held-ref rebind (cf41b29)

Continuous Integration

• run Nightly, Weekly and Canary on work branches only by manual dispatch (56b4775)
• deselect the 5.18-keyed T5 sdpa construction pin on the 4.x HF band legs (6eb8c0c)
• set the Weekly rare executed floor to 7 after the two rare-step removals (436661f)
• keep the same-box perf gate and the 15 GB validation_50k graph off the 4-core Weekly rare step (1dc2ce4)

Documentation

• tests: list the split validation test siblings in the test map (9fef774)
• list the split validation modules in validation/AGENTS.md (7ca708d)

Refactoring

• walk modules by named_modules in the held-ref rebind (no new producer-ledger site) (1991365)
• rng: warm both first-capture imports in one guarded block and keep _torch_compat under its size ceiling (312bc9d)
• validation: read the norm proof's parent slots through exemptions' helpers so it adds no ledger read site (8b82ad9)
• keep rung-2 backend changes inside the layer, global-state and trace reach-in ratchets (aa62b5f)
• keep the new paddle rebuild leaves under the return-count ratchet; scan nn.layer by package (0055738)
• paddle: keep the parameter identity map on the backend, not the trace (858bb2f)
• capture: share one boundary-adoption recorder for module entry and exit (ce4c24a)
• validation: split exemptions coverage proofs and value predicates; pay PLR0911/PLR0915 debt (ec47f72)
• visualization: split collapse frontier algebra and bundle graph helpers (bf245db)
• flatten the dict branch of the deepcopy fidelity walk (SIM102) (e9ebdab)
• keep rung-1 helpers under the C901 and file-size ratchets (9a08b13)
• validation: split backstop census, index-domain probes and integer-mod proof out of core/exemptions (72f9d56)

Testing

• drop the capture-bench matrix known-failure row; the held-ref rebind makes it pass (strict XPASS) (c868b5b)
• refresh the tiny_transformer surface golden for the held-ref rebind (e7cdf14)
• held pristine torch functions capture with the same call ids, nesting and graph as direct calls (dff88e2)
• model preparation allocates no func_call_ids, with pristine builtin and Python torch functions held (7a73e3a)
• the direct-aten rebound cases expect their own provenance disclosure (c9e02d2)
• the direct-aten shapes take their rescue forward for the aten call, never for the rebound relu (450e6ef)
• count rebound-case forwards inside the root forward, as the holder tests do (8e3ac7c)
• pin each formerly stale attribute- and closure-held case as rebound: one forward, the ops captured, no escape (5144cc5)
• keep completeness and transform tripwires on a genuine escape through an unrebindable holder; docstrings, state-access and skip-ledger fixes for the held-ref rebind (eb1197e)
• name the shadow-detector holder tests for their rebound-or-reported outcomes (ad31003)
• gpt_bigcode expects the stale GELUTanh partial to be disclosed and rescued (rung-2 module-exit adoption) (21e0515)
• drop the xcit_tiny_24_p8_224 known-failure row; the rung-2 replay stride fix makes it validate (strict XPASS) (9fd08a3)
• move the r41 except-skip ledger row to the site's new line (4bfb8e6)
• join the pre-existing worker thread on stop so its exit cannot land in a later capture window (87c393a)
• put the heavy meta-path finder in a real source file so the first-einsum regression discriminates (27ac78b)
• fresh-process meta capture survives torch's lazy dynamo import (4e55983)
• io: collect garbage before the fd baseline in the lazy-materialize leak test (b27fc3a)
• restore the completeness-witness mode the boundary-credit census tests arm, and both diagnostic modes after every test (3fe2f7f)
• consume the stale-alias output so the gap is interior (da81f28)
• paddle layer-parameter replay and preview hash/buffers (da11701)
• capture: a clean capture leaves capture_verified unset; assert it is never False (01debdf)
• capture: pin module-returned stale refs per holder shape and opaque-return disclosure (65cc58a)
• gallery: read the offline-venue signature from the pre-import snapshot (7089afb)
• ledger: re-anchor the transforms ViT except-skip row after line drift (5c21fa6)
• r1: pin distilbert in the registry and run the transforms tokenizer rows in the nightly R1 step (c8874c3)
• r1: read the offline-venue signature from a snapshot taken before test modules import (ebfd6c0)
• rescue: add a tuple-index operand so the dunder guard reaches getitem on torch 2.1 (81e2b36)
• gate real-tokenizer transform rows behind the R1 offline venue and give the distilgpt2 evidence bar a checked argmax-moving perturbation (8437802)
• explicit zip strictness at the two new B905 test sites (9898b15)
• re-anchor numeral census rows for the moved test docstrings (13a6e80)
• split the segment-run prefix group out of test_collapse_optimizer.py (a3633ee)
• split the R08 discrete-bool section out of test_validation_hardening.py (7627187)
• split perturbation and deep-clone unit tests out of test_validation.py (46eea44)
• rescue: move the operand-misfit except out of the loop so the S112 ratchet does not grow (f310bd7)
• re-anchor four except-skip ledger rows that moved with their files (d7af80d)
• xdist: give the fake summary config a getoption so the test runs outside CI (5db6af1)
• tviz: load t5-small with eager attention so the cross-attention pattern exists (64287b0)
• io: pin the synchronous writer in the blobs-before-postprocess ordering test (be64e79)
• exports: check the producer version stamp against tl.version instead of freezing it in the goldens (d4f488f)
• producer-parity: record the four parent_arg_positions reads the 2026-10-04 exemption proofs added (51dc3db)
• compo: lower the S-18 warn-site baselines to the 225 left after 92e3244 folded six refusal warns into one helper (8cf7204)
• rescue: fail the smoke guard if an exempted dunder starts completing (4be9a5f)
• rescue: assert the stale-ref provenance advisory in the end-to-end case (63f576c)
• rescue: build dunder operands outside the recording mode (c6d1503)
• witness: keep the primary capture and expect the provenance disclosure in the boundary-credit tests (c692970)
• refresh producer-parity static rows changed by the rung-1 work and its splits (10bb41a)
• split the registry ledger and the module-forward backstop unit test into their own files (b2c395e)
• validation: expect the provenance disclosure for the stale weight_norm alias (d39c1f2)
• capture: unwrap restores the weight_norm module alias; shadowed-namespace resolution stays narrow (e1d956b)
• capture: read the weight_norm alias off the submodule, not the shadowing function (ca1dc81)
• capture: keep the custom-Function view test's validation call in that test (73cb4ff)
• capture: a custom-Function view written in place still raises under capture (21328d4)
• validation: expect the per-call replay fallback warning on the second AttrDict validation (5085108)
• skip the transforms rows as offline only when the tokenizer fetch delivered no files (5a548f7)
• fetch missing tokenizer files instead of skipping when another test cached only distilgpt2 weights (bf061f8)
• drop eleven ledger rows the validation fixes made pass (XPASS strict in Weekly 37182352732) (e0bdf81)
• skip the offline transforms rows when the HF cache lacks distilgpt2's tokenizer files (59b1c29)
• mark five runner-limited real models big_memory; ledger two reproduced slow-tier capture bugs (39f4c4b)

The full annotated changelog for this release is in CHANGELOG.md.