feat(ENG-RESIDENCY-CONFIG): the disk-residency tier is a config key, an absent field means unchanged at BOTH ends of the install, and a typo anywhere in the document is refused (#1110, #1109, #1122, #1133)

[localai-bot]

The tier that makes a 370 GiB checkpoint fit in 119 GB was environment-only. It is now a config key, the mirror is untouched, a typo in that key is refused at every level of the document, and a second engine in one process can install a partial document without either failing or silently dropping the first engine's fields.

vllm.cpp offloads weights at two tiers and only one was reachable from the
config surface. --offload-config '{"uva":{"cpu_offload_gb":N,"cpu_offload_params":["experts"]}}'
runs from the server flag through EngineParams to LoadedEngine::FromModelDir.
The tier below it, the one that makes Qwen3.8-2.4T-A95B UD-Q1_0 serve on a
single 119 GB GB10 because ~330 GiB of experts stay borrowed in the mapping, was
VT_GGUF_MMAP, VT_GGUF_PREFAULT, VT_MOE_EXPERT_STREAM,
VT_MOE_EXPERT_STREAM_SLOTS, VT_MOE_EXPERT_STREAM_SLOT_BYTES and nothing else.
Qwen35ExpertStreamRequested read one getenv and had no other input. The
asymmetry was the more awkward for the first tier's config already being
expert-aware, so a user reaches for --offload-config to control expert
placement, gets the GPU tier, and finds nothing for the tier the big-model case
needs. Closes #1110.

The five knobs are now also keys under a namespaced vllm_cpp object inside that
same flag:

--offload-config '{"vllm_cpp":{"mmap":{"enabled":true,"prefault":false},
                               "expert_stream":{"enabled":true,"slots":8000}}}'

include/vllm/config/offload.h is unchanged. It transcribes
vllm/config/offload.py line for line and upstream has no disk tier at the pin
(OffloadBackend is Literal["auto","uva","prefetch"], offloader/uva.py:21 is
CPU-blanket UVA, offloader/prefetch.py:557-560 is cpu-only, and nothing reads a
weight off a file at inference time), so the extension is vllm.cpp-original by
construction rather than by preference. One flag still covers one user-facing
concept, two parsers read one string, and the key is literally named vllm_cpp
so nothing about it reads as upstream. The C ABI needed no new field for the same
reason: vllm_model_params.offload_config is one string carrying both halves, and
include/vllm.h now documents which half of it moves weights.

The schema's own rule, applied to both ends of the install

An absent field means UNCHANGED. That binds two pieces of code, and the first two
shapes of this row broke it in both directions, each with its own user-visible
failure on a legal two-model process. They are one root cause and are fixed as one
thing (#1133 H1, H2).

FrozenFields treated absent as a change. It compared in.expert_stream
against the stored optional, and nullopt != engaged is true, so once a process
had latched the streaming decision, {"vllm_cpp":{"mmap":{"enabled":true}}} on a
second engine threw std::logic_error out of LoadedEngine::FromModelDir and came
back as VLLM_ERR_MODEL_LOAD. The earlier narrowing had moved that failure, not
removed it. The message made it worse by asserting that "accepting this would
record a configuration the engine is not running" — for a document asking for
exactly what the process had resolved, the engine was running it.

The install treated absent as a clear. g.config = config replaced wholesale,
so a partial second document turned expert_stream=on with 8000 slots into OFF
with 64, with no diagnostic, and the slot store reads those values lazily — on the
first slice taken, which can be long after the second engine loaded. The wholesale
replace predates the per-field narrowing; the narrowing widened its reach, because
before it any differing document after a decision threw, so the drop could not
happen once anything had been decided.

Both now mean what the schema says. A field is scored frozen only when the
document SETS it. The comparison is against the decision actually taken — the
cached streaming answer, the geometry the store was built with — resolved through
the same function the production resolver calls, so a document that agrees with
the running engine installs, and so does one the environment overrides anyway,
while one that would make a resolver return something else still throws. The
install merges field by field, which makes the empty document a no-op by
construction rather than by a special case. The refusal message quotes the
decision rather than the stored document, because after the merge the stored
document is not what is in force either.

The streaming flag carries its own answer to make that comparison possible: one
tri-state atomic (nothing decided / decided off / decided on) rather than a bool
beside a value, so a reader takes one relaxed load and there is no ordering
question between a fact and a value in two places. The geometry's numbers move
from a file-static into Global under mu, beside the flag's writer. Both stores
are idempotent and both are monotonic, and that is what carries relaxed here —
not a synchronises-with edge, which a relaxed store outside mu does not give.

A typo is refused, at every level of the document

parse_offload_config_json looks its three keys up by name and never enumerates
the document, which is what makes a namespaced sibling key workable at all — and
it is also the hazard, because a misspelling is then invisible to both parsers. So
the extension parser enumerates the whole document.

That enumeration first closed only the top level and the inside of vllm_cpp,
while include/vllm.h promised an unknown key anywhere. Measured:
{"uva":{"cpu_offload_gbb":1}}, {"uva":{"cpu_offload_GB":10}} and
{"prefetch":{"offload_groupsize":8}} were all ACCEPTED, each giving a 0 GiB
budget or a group size of 0 under a document the operator believes configures
offloading (#1133 H3). The claim is made true rather than scoped down, because
refusing is mirror-faithful here too: UVAOffloadConfig
(vllm/config/offload.py:15-16 @ 555967922) and PrefetchOffloadConfig
(:47-48) each carry @config, whose body sets ConfigDict(extra="forbid")
(vllm/config/utils.py:68-69), so upstream refuses a nested typo and the tolerance
was the deviation. The enumeration stays in the extension parser and lists NAMES
only, so parse_offload_config_json is untouched and keeps sole ownership of those
fields' types, defaults and bounds.

A silently ignored {"vllm-cpp":…} or {"vllm_cpp":{"mmapp":…}} starts a server
running this tier at its defaults — prefault ON, streaming OFF, the two settings
the big-model case exists to change — which the operator meets as an out-of-memory
kill rather than as an error. It now says
offload config: unknown key "vllm-cpp" (expected one of: offload_backend uva prefetch vllm_cpp)
before the multi-GB load.

Precedence, and what latches

Precedence is environment variable, then config, then built-in default. Those
variables exist so a benchmark arm is switchable without restarting the server
with a new document and an A/B in flight depends on it, so an override that could
not turn a configured knob back off would be useless: VT_X=0 beats a config
true. The install prints one line naming the fields of the document it installed
and a second naming every variable that would win over one of them, because a
document silently overridden by something exported weeks ago is the one way that
polarity hurts. The first line reports what was asked for and not what the engine
resolves, and exactly one of the five is the reason: the streaming answer is
cached the first time it is asked, so resolving it at install would move that
decision ahead of the load. prefault and slots could be resolved there, and
mmap/slot_bytes need a default only their caller has, so reporting the document
for all five is a consistency choice on top of the one real constraint.

Two of the five knobs latch a decision; three do not.
ResolveExpertStreamRequested caches its answer in a function-local static
(Qwen35ExpertStreamRequested is the model-side name and a pure delegation to it),
and the slot store's slots x slot_bytes reservation is fixed when the store is
built. SetWeightResidencyConfig throws for exactly those two, and only for a
document that would change them. mmap does not latch — GgufLoadPolicy::FromEnv()
runs per load — and neither does prefault, whose site drops its static altogether
here: one getenv per span is nothing beside the megabytes of pages the function
then reads, and it buys a config that cannot be missed plus an A/B whose two arms
actually differ. The loader installs in FromModelDir's first statement block,
ahead of the offloader and every path and weight operation.

The five knobs get one named resolver each, and that is not decoration. The
polarities differ and one is deliberately odd: VT_GGUF_MMAP and
VT_GGUF_PREFAULT compare the whole value against ""/0/false/off, while
VT_MOE_EXPERT_STREAM examines only the first character, so
VT_MOE_EXPERT_STREAM=false is ON and docs/ENVIRONMENT.md says so. Routing all
five through one helper would have normalised that silently, and a row whose
subject is where a value comes from must not change what a value means.
VT_MOE_EXPERT_STREAM_STATS_EVERY stays environment-only by decision: it changes
a diagnostic cadence rather than what the process reserves, so it is the
instrument and not the configuration, and the config surface refuses it as an
unknown key rather than accepting and dropping it.

Also fixes #1109 in flow. docs/ENVIRONMENT.md gave VT_GGUF_PREFAULT's default
as off while the code has always defaulted it on. This change writes that default
into a resolver and a config key, so shipping it beside a table stating the
opposite would put the contradiction inside one commit. The direction matters to a
user and not only to a document: prefault on is exactly what a model larger than
memory has to turn off.

What the test shape was hiding

Eight mutations and a fresh review missed both behaviour defects, and the reason is
worth a case shape rather than another sentence. Every latch case installed a COPY
of the first document — mmap_too = cfg, mmap_only = sizes — or the empty one,
so the second install always restated the frozen field at the value it already
had, and that is the one shape in which neither defect can arise.

Two DIFFERENT partial documents in one process is the shape that distinguishes
them. It is now a case at the unit level and again through FromModelDir and
vllm_engine_load: engine A installs the full document and takes both decisions,
engine B brings mmap alone, engine C brings prefault alone, and each must
install without dropping what came before. The reach case has to read the global
rather than the return code, because a refused install and a missing checkpoint
both leave vllm_engine_load as VLLM_ERR_MODEL_LOAD; mmap asked for FALSE
against an installed TRUE is the discriminator. Neither new case assumes the
streaming answer's value — it is a per-process static, so the cases read it and
assert relative to it, or a single-case -tc run would pass or fail on test order
rather than on the code. Two more cases pin what the refusal must NOT do: accept a
document that agrees with the decision while the stored document is empty (the
shape the environment produces), and accept one the environment overrides.

Mutations

Sixteen for this round, each applied alone, with git diff --stat and the file's
sha256 printed before and after so a never-applied edit cannot read as a pass, the
build's own exit status and an ENOSPC count printed beside every result so a
non-building mutation is INVALID rather than a pass, a non-zero doctest case count
required, the LAST test cases: match read, every rc captured directly rather than
through a pipe, and the tree restored by byte copy with the sha256 compared. Three
results are worth naming.

R6 and R12 first came back INVALID on -Werror=unused-function, which is a
non-building mutation and not a passing test; both were re-run in a form that keeps
the call and discards its result. R12 then came back GREEN, and that was the
assertion's fault rather than the code's: the message check was
Mentions(e.what(), "expert_stream_slots=8000"), and at that point the stored
document also held 8000, so quoting either produced the substring. The check moved
to the one moment the two differ — a refusal taken while nothing is stored, where
quoting the document produced environment/default — and goes red there. R15
(the reset leaving a stale built geometry) is GREEN and recorded as GREEN: nothing
can observe it, because the numbers are read only while the geometry latch is set
and the reset clears that too. The code says so where the line is, rather than
letting a reader assume a gate exists.

The reachability mutation deletes the install call site in FromModelDir and turns
the reach suite red (4 failed) and the server suite red (3 failed).

Records

TEN stale or imprecise path:line anchors in this row's own spec were found by
checking anchors last against the final tree, and ALL TEN were already wrong at the
reviewed head. For qwen3_5.cpp and include/vllm.h that was verified by reading the
same line numbers out of git show HEAD~1:<path>; for the other three files it follows
from this change not touching them, so their lines cannot have moved. The Port map's
four VT_MOE_EXPERT_STREAM* rows pointed at a comment and at three lines of the
statistics printer rather than at the constructor beside them,
GgufLoadPolicy::FromEnv was cited 85 lines past itself, include/vllm.h:436 fell
mid-sentence, and the FromModelDir range started one line late and ended 30 lines
early. Three stale anchors belonging to OTHER rows are named in the spec and left
alone, because correcting them would widen this diff into three unrelated
subsystems.

## Owed's unreached-entry-point gap named #1122 as its owner — the very issue this
pull request closes, so on landing the gap would have had no open issue. Filed as
#1135 and pointed there, in the spec and in docs/USAGE.md.

Gate

CPU build, documented recipe, on the merged tree. origin/main moved twice during
this work, to d1e5e9bc0 and then to a7583ac75, and both are merged in. That matters
for more than currency: the trailer and commit-style gates scope themselves to
origin/main..HEAD, so before the first merge they reported nothing at all about this
branch.

• clean rebuild from an empty build directory on the d1e5e9bc0 merge, 974
  translation units: exit 0, zero compiler warnings, zero ENOSPC lines. Rebuilt
  incrementally on the a7583ac75 merge: exit 0, zero warnings, zero ENOSPC. The disk
  ran between 89% and 98% full throughout, and a full disk produces a link error that
  reads exactly like broken code, so an ENOSPC count is printed beside every build and
  mutation result here.
• ctest --test-dir build -j 3 on the final head, over a second clean rebuild from an
  empty build directory (974 translation units, exit 0, zero warnings, zero ENOSPC):
  508 of 508 passed, exit 0, two
  pre-existing environment skips (test_modelopt_mixed_precision_checkpoint,
  test_voxtral_e2e). The same command on the d1e5e9bc0 merge was 507/507 exit 0,
  twice; the extra test comes from a7583ac75.
• One flake, measured rather than asserted. test_engine_core_proc failed one of
  those runs, and a 30-run sweep of it alone gives 29 pass / 1 fail. It is
  #1052, open since before this work,
  also recorded at .agents/environment.md:540-547; grep -c for this row's symbols in
  that suite returns 0 and this change touches no file under src/vllm/v1/. A duplicate
  issue was opened for it during this gate and closed as a duplicate; the measurement
  went to test_engine_core_proc's immediate-shutdown case is load-dependent: a FIXED 1000-frame budget racing an unbounded producer, and no issue names it #1052 as a comment. What is NOT claimed: that it was red before this change,
  because no ctest was run on the pre-change tree. test_serve_low_tools also starved
  once at -j 6 under load average 47 and passes serially.
• scripts/agent-preflight.sh --staged --fail-on-skip: exit 0, all gates green,
  no gate skipped — commit-trailers and commit-style both ran and both ok, and
  each was additionally run by hand over origin/main..HEAD.
• focused suites, all exit 0, counts read from the last test cases: match:
  test_weight_residency_config 17 cases / 250 assertions,
  test_weight_residency_reach 7 / 76, test_expert_stream_latch 1 / 9,
  test_serve_residency_config 6 / 64 (1 skipped, the re-exec'd child).
• pr-size was already red on the reviewed head, and neither earlier round said
  so. It is a required check, and it had been failing since this row's first commit
  because scripts/check-pr-size.py classes any change to scripts/check-*.py as a
  governance_checker and demands a non-empty edit in the paired test file — and this
  row changed ENGINE_ROWS 157 -> 158 in check-agent-record.py and one
  RUNNABLE_BASELINE entry in check-gate-commands.py with no test edit at all. What
  slipped past three reviews is that both are MARKS with no branch to invert; what the
  contract is right about is that the constant was then the only artifact. Three cases
  make both marks executable, in the idiom the neighbouring credits for Binary release? #117, vllm-serve aborts on --enable-auto-tool-choice and --trust-remote-code, so 89 of 157 official recipe commands fail to start #606,
  vLLM-Omni has no parity pin: H3 W3+, LTX-2.5 and ~40 omni-only architectures (the whole TTS family included) cannot be gated against any oracle #633, Recorded line anchors are never validated against what they name, and ACTIVE rows are not anchor-checked at all #632 and Speculative decoding: MTP k>1, then dynamic and adaptive speculation depth #81 already use. Mutation-proven, and one mutation took three attempts
  to become VALID: removing the row from the engine matrix aborted the suite's
  setUpClass on a dirty baseline, so 51 of 78 cases ran and the new case never
  executed — a mutation that reads as a pass. Only removing the row, the pin and the
  row's claim file together yields a runnable tree, and then all 78 cases run and the
  new case is one of exactly two failures. check-pr-size.py goes from two ERRORs to
  OK.
• the index needed reconciling, not auto-merging. merge=union on
  .agents/issue-index.md concatenates both sides of a changed region without
  deduplicating, so merging a7583ac75 doubled ROCm Gemma-4 hyp B: GetBlas single TLS destroys hipBLAS handle on peer-MoE device hop #837, LTX-2.5: A2VidPipelineTwoStage has no recipe row, so audio-to-video rides the distilled two-stage trajectory #1117 and LTX-2.5: LoRA adapters fuse once at load, so no recipe can put the distilled adapter on stage 2 alone #1118 byte-identically
  and check-agent-record.py refused it by name — correctly, because under union a
  duplicate is exactly what two branches appending the same issue look like. Fixed the
  way AGENTS.md prescribes for a keyed record: take main's complete file, re-apply this
  branch's scoped append. a7583ac75's version is asserted to be a BYTE-EXACT PREFIX of
  the result, all 315 of its rows textually unchanged, with this branch's five rows
  after it.
• no force-push, and one commit exists only because of that. An earlier tip was
  pushed and then amended twice — once to correct claims this session's own audit found
  wrong — which made the local tip a sibling of the remote one and the push a
  non-fast-forward. The pushed commit is merged back in as a parent rather than
  overwritten; the resulting tree is byte-identical to the pre-merge one (git diff of
  the two is empty), and the reviewed head c7fa7084b and origin/main are both still
  ancestors, each verified with git merge-base --is-ancestor.
• both merge orders with fix(ENG-EXPERT-STREAM): refuse a GGUF the device cannot hold, at load, by name (#1123) #1132 (row/ENG-EXPERT-STREAM-DEVICE-FIT, which also
  edits model_loader.{cpp,h}, docs/USAGE.md, docs/ENVIRONMENT.md and the index)
  produce the SAME single conflict, in docs/ENVIRONMENT.md, where that branch appends
  a VT_DEVICE_WEIGHT_BUDGET_BYTES row against the expert-stream table rows this branch
  rewrote; the resolution is to keep this branch's rows and append theirs. Everything
  else auto-merges, model_loader.cpp included — and a clean merge-tree is not a tree
  that builds, so the merged tree was materialised and compiled: library exit 0, zero
  warnings, and test_weight_residency_config 17/17, test_weight_residency_reach 7/7
  and that branch's own test_gguf_device_fit_reach 3/3 all pass on it. The trial merge
  was then aborted and the head verified identical to the pushed SHA with a clean tree.

Spec committed before the implementation. Row ENG-RESIDENCY-CONFIG stays
ACTIVE, not DONE, and two things keep it there, both under the spec's ## Owed.
The 370 GiB checkpoint has not been driven through the JSON form on a box that can
hold it: everything here is CPU-local, and GPU work on this fleet goes through a
lease rather than a shell. And the config form reaches the generate server path and
the C ABI but not vllm-cli, nor the server's pooling and transcription paths,
which build their engine parameters without the offload document at all — the
mirrored uva/prefetch half included, and since before this key existed. That gap
is now #1135, and docs/USAGE.md says so beside the config form rather than leaving
a reader to discover it.

Closes #1110. Closes #1109. Closes #1122. Closes #1133.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5-1m [claude-code]

[localai-bot]

Third repair round, at 51b08a3ea. Per-finding disposition against #1133, then the claims audit.

Disposition

#	Finding	Disposition	Pinned by
H1	absent scored as a CHANGE: a partial second document threw out of FromModelDir	FIXED. A field is scored only when the document SETS it, and against the DECISION taken rather than the stored optional	new case "TWO DIFFERENT PARTIAL documents in one process"; mutations R1, R2; reach case through vllm_engine_load
H2	absent scored as a CLEAR: a partial second install dropped the first engine's fields	FIXED. The install merges field by field; the empty document is a no-op by construction	same case, asserted on both the stored struct and ResolveExpertStreamSlots(); mutation R3
H3	the ABI promised a refusal for an unknown key ANYWHERE; uva/prefetch interiors were open	FIXED by ENUMERATING them, as the round preferred — see the decision below	7 nested spellings added to refused[], dotted-path message assertions, mutations R4, R5, R16
M1	spec still said the install line prints the RESOLVED values	FIXED, and the reason narrowed to the one knob it is true of	prose
M2	qwen3_5.cpp stated the pre-narrowing contract	FIXED	prose
L1	the function-local static attributed to Qwen35ExpertStreamRequested	FIXED in the header (twice), the enum comment, the spec and qwen3_5.cpp	prose
L2	"refuses a late install" for a late CHANGE	FIXED	prose
L3	the commit body's 505 against the tree's 506	ADDRESSED, not edited: a landed commit body cannot be corrected without rewriting the reviewed head. The correct count is in this round's body and in the PR body, which is what the squash lands	n/a
L4	the reach case's "exactly as every GGUF load in the tree does"	FIXED, and what the case does NOT prove is now stated in it	prose
L5	"every knob resolves lazily"	FIXED in model_loader.cpp, docs/USAGE.md, the serve suite's header and the spec; the constraint binds expert_stream alone	prose
L6	include/vllm.h's "one line"	FIXED: one line plus a second when a variable overrides	prose
L7	"byte-identical" falsified by a {"typo":1} abort	FIXED: byte-identical is claimed for the ENGINE a legal document produces, not for the SET of documents accepted	prose
L8	## Owed owned by the issue this PR closes	FIXED: #1135 filed for that gap, pointed to from the spec and docs/USAGE.md	n/a

The H3 decision

Enumerate, in the extension parser, names only. Three reasons, in order of weight.

It is mirror-faithful rather than local strictness, and that was checked before it was written: UVAOffloadConfig (vllm/config/offload.py:15-16 @ 555967922) and PrefetchOffloadConfig (:47-48) each carry @config, whose body sets ConfigDict(extra="forbid") (vllm/config/utils.py:68-69). Upstream refuses a nested typo, so the tolerance was the deviation and the ABI's sentence was the accurate one.

It keeps parse_offload_config_json byte-faithful, which the round asked for if it could be done. The extension parser opens uva and prefetch and checks NAMES against the mirrored parser's own six field names; it checks no types, so defaults, bounds and type errors stay wholly with the transcription and no rule exists in two places. Nothing in src/vllm/config/offload.cpp changed.

It adds no refusal a user could previously rely on. The mirrored parser runs first at both entry points and already threw the same sentence for a non-object uva, so opening the object introduces no new message — and that is asserted rather than assumed: the extension parser's message for {"uva": 5} is compared string-for-string against parse_offload_config_json's.

The alternative the round allowed — keep the enumeration shallow and scope the four over-claiming sentences down — was rejected because the sentences describe the behaviour a user needs, and {"uva":{"cpu_offload_GB":10}} starting a server with a 0 GiB budget is H1's failure mode one level over.

The case shape, and its mutations

The hole was that every latch case installed a COPY of the first document (mmap_too = cfg, mmap_only = sizes) or the empty one, so the second install always restated the frozen field at the value it already had — the one shape in which neither defect can arise. Four cases now cover the difference:

1. two different partial documents in one process — A installs the full document and takes both decisions; B brings mmap alone; C brings prefault alone. Each must install, and A's fields must survive both, asserted on the struct AND through ResolveExpertStreamSlots(), because that is where a lazily-built slot store reads them.
2. the same shape at the production entry point — A through FromModelDir, B through vllm_engine_load, C through FromModelDir. The return code cannot discriminate here: a refused install and a missing checkpoint both spell VLLM_ERR_MODEL_LOAD, so mmap asked for FALSE against an installed TRUE is the observable.
3. a document that agrees with the decision while nothing is stored — the state VT_MOE_EXPERT_STREAM=1 plus a document-free first engine produces. Refused before; accepted now.
4. a document the environment overrides — accepted, and refused again once the variable is unset, so the acceptance is attributable to the variable rather than to a missing check.

Neither new case assumes the streaming answer's value. It is a per-process static, so each case reads it and asserts relative to it; hardcoding true would have made a single-case -tc run pass or fail on test order.

applied is a sha256 pair AND git diff --stat; compiled is the build's rc; an ENOSPC count sits beside every row; case counts are the LAST test cases: match and must be non-zero; every rc is captured directly.

#	Mutation	applied	compiled	Result
R1	FrozenFields compares in.expert_stream against the stored optional (the H1 defect)	1 file, 1+/1-	0	config RED 17 cases / 3 failed; reach RED 7 / 1; latch GREEN (it installs no partial document)
R2	the comparison targets the stored document, not the decision	1 file, 1+/1-	0	config RED 17 / 2 — the AGREES and ENVIRONMENT cases, exactly the two it targets
R3	the install replaces wholesale instead of merging (the H2 defect)	1 file, 1+/11-	0	config RED 17 / 2; reach RED 7 / 1
R4	the nested uva enumeration removed	1 file, 1+/3-	0	config RED 17 / 1
R5	the nested prefetch enumeration removed	1 file, 1+/5-	0	config RED 17 / 1
R6	the refusal never fires	1 file, 1+/1-	2	INVALID — -Werror=unused-function on FrozenFields. Not a pass
R6b	same, call kept and result discarded	1 file, 3+/1-	0	config RED 17 / 5; latch RED 1 / 1
R7	the store never records the geometry it built	1 file, 2+/2-	0	config RED 17 / 3; mixed-slot RED 1 / 1
R8	the flag records the fact but the wrong answer	1 file, 1+/1-	0	config RED 17 / 4; latch RED 1 / 1
R9	the decision is never recorded at all	1 file, 1+/1-	0	config RED 17 / 4; latch RED 1 / 1
R10	FrozenFields ignores VT_MOE_EXPERT_STREAM	1 file, 1+/2-	0	config RED 17 / 1
R11	the count comparison ignores VT_MOE_EXPERT_STREAM_SLOTS	1 file, 1+/3-	0	config RED 17 / 1
R12	the message quotes the stored document	1 file, 1+/1-	2	INVALID — -Werror on DecisionSummary
R12b	same, call kept	1 file, 1+/1-	0	GREEN — the assertion's fault, see below
R12c	same, against the repaired assertion	1 file, 1+/1-	0	config RED 17 / 1
R13	the install call site in FromModelDir deleted (reachability)	1 file, 1+/1-	0	reach RED 7 / 4; serve RED 6 / 3
R14	ResolveExpertStreamRequested reads .mmap (round two's survivor, re-run)	1 file, 1+/1-	0	latch RED 1 / 1; config RED 17 / 1
R15	the reset leaves a stale built geometry	1 file, 1+/1-	0	GREEN, and correctly so — see below
R16	the nested uva path built from a phantom vllm_cpp prefix	1 file, 1+/1-	0	config RED 17 / 1

R12 is the one worth reading. The first message assertion was Mentions(e.what(), "expert_stream_slots=8000"), and it passed with the mutation applied, because at that point the stored document also held 8000 — quoting either produced the substring. The assertion was insensitive, not the code right. It moved to the one moment the two differ, a refusal taken while nothing is stored, where quoting the document produced environment/default, and now also asserts that phrase is absent.

R15 is GREEN and stays recorded as GREEN. Clearing the built geometry on reset is coherence with BuiltExpertStreamGeometry()'s own "both zero until something builds one", not a behavioural guarantee: the numbers are read only while the geometry latch is set and the reset clears that too. The code says so where the line is, rather than letting a reader assume a gate exists. A green mutation is a statement about the tests.

Claims audit

58 claims examined, 5 wrong, all 5 corrected before the push. The three rounds before this were 14/69, 41/46 and 21/55.

• "eight stale anchors, seven already stale" — the actual count is ten, and all ten were already wrong at the reviewed head. Written before it was counted. Corrected in the spec, the commit body and the PR body.
• "the box hit 100% three times today" — carried over from the round's own briefing and never observed here; measured 89% to 98%. Replaced with the observed range.
• "neither starved test is on any path this change touches" — too strong: test_serve_low_tools starts a server, and a server calls FromModelDir. Replaced with what was measured, plus an explicit statement that they were NOT shown red before this change, because no ctest was run on the pre-change tree.
• test_weight_residency_config "245 assertions" — 250 after the last case landed. A number that was true when written and stale by the push.
• an issue was filed for the test_engine_core_proc flake found during this gate, before checking the index and the open issues. It duplicates #1052, which is open and indexed; the duplicate is closed with the reason and the measurement (29 pass / 1 fail in 30, plus the direct-run-exits-0 asymmetry) moved to test_engine_core_proc's immediate-shutdown case is load-dependent: a FIXED 1000-frame budget racing an unbounded producer, and no issue names it #1052.

Every guarantee stated in the code, the spec and the two bodies now names the case or mutation that makes it true, or says which it does not have. The three that do not have one, said so explicitly: L3's stale count (history, not correctable in place), the reset's geometry clear (R15 green, coherence not behaviour), and the eight prose repairs (a reader is their gate).

Deferred

• Three stale path:line anchors belonging to other rows, named in the spec and left alone: qwen3_5.cpp:8907 cites :7151 for BuildPaddedDecode (:9303), four places cite include/vllm.h:912 for ref_video (:972), and docs/USAGE.md:962 cites include/vllm.h:1072. All were already stale at the reviewed head — ref_video by 53 lines there — and this change worsens two by the seven lines its include/vllm.h prose repair adds and one by six, which no edit to any file can avoid. Correcting three other rows' comments would widen this diff into spec decode, LTX25-RETAKE and MiniMax-H3. That class is #632's subject.
• The 370 GiB reproduction through the JSON form stays owed under ## Owed (The disk-residency tier is configured only by VT_* env vars, beside a JSON offload config that already handles the tier above it #1110): everything here is CPU-local, and GPU work on this fleet goes through an rc lease.

[localai-bot]

Addendum to the round summary above, at 636cc3ea4.

pr-size was already RED on the reviewed head c7fa7084b, and neither earlier round mentioned it. It is a required check. scripts/check-pr-size.py classes any change to scripts/check-*.py as a governance_checker and demands a non-empty edit in the paired test file; this row changed ENGINE_ROWS 157 → 158 in check-agent-record.py and one RUNNABLE_BASELINE entry in check-gate-commands.py with no test edit at all, since 26a97b75e. What slipped past three reviews is that both edits are MARKS with no branch to invert. What the contract is right about is that the constant was then the only artifact, so "158 is the real row count" and "this row's Gates section names commands that can fail" were plausible rather than checkable.

Three cases now make both marks executable, in the idiom the neighbouring credits for #117, #606, #633, #632 and #81 already use: the row is named in the engine matrix with the count required to agree; the RUNNABLE_BASELINE credit is pinned together with the spec really yielding a command that can fail AND with the spec saying why no GPU, oracle or throughput leg is implicated; and dropping the entry from the pin is asserted to break it.

One of the two mutations took three attempts to become VALID, and that is the part worth recording. Dropping the RUNNABLE_BASELINE entry turns both new gate-commands cases RED with all 39 cases running. Removing the row from the engine matrix alone aborted AgentRecordMutationTests.setUpClass on a dirty baseline, so 51 of 78 cases ran and the new case never executed — a mutation that reads as a pass, the third shape of that failure this repository has recorded. Lowering the pin alongside it did not help, for the same reason. Only removing the row, the pin and the row's claim file together produces the tree state "this row was never added": then all 78 cases run and the new case is one of exactly two failures.

Case counts moved with the additions, which is the other half of proving the cases run: gate-commands 37 → 39 methods, 39 executed; agent-record 75 → 76 methods, 78 executed; both OK after restore. check-pr-size.py goes from two ERRORs to OK.

Also in this addendum: the first draft of the credit case asserted the bare string scripts/agent-preflight.sh against a list runnable_commands fills with WHOLE commands, so it went red on membership rather than on the spec. Caught by running it; the exact strings are asserted now and the reason is written beside them. That is a sixth wrong claim for the audit — 58 examined, 6 wrong, all 6 corrected before the push.

Gate re-run on 636cc3ea4: second clean rebuild from an empty build directory, 974 translation units, exit 0, zero warnings, zero ENOSPC; ctest --test-dir build -j 3 508/508 exit 0; scripts/agent-preflight.sh --fail-on-skip exit 0, all gates green, no gate skipped; check-pr-size.py OK. The build tree was removed afterwards — the disk peaked at 98%.

[localai-bot]

Second addendum, at 0f0c01a69. origin/main moved twice more while the gate ran, to a7583ac75 and then ac5057960, and both are merged in — otherwise the trailer and commit-style gates go vacuous, which scripts/agent-ready.py reported as two SKIPs rather than as a pass.

ac5057960 conflicted, in docs/ENVIRONMENT.md, and it is a KEYED record rather than an append-only log — so it is resolved per key rather than by taking a side. Both branches rewrote the same three adjacent table rows. VT_GGUF_KEEP_F16 takes MAIN's row, because rewriting it is the whole point of that commit. VT_GGUF_MMAP and VT_GGUF_PREFAULT take this branch's, because this row closes #1109 by correcting VT_GGUF_PREFAULT's documented default from off to ON and main's copy still carries the wrong one. Each of the three is asserted byte-identical to the side it came from, and check-env-doc reports all 342 production variables documented or classified.

The merge changed no file under src/, include/ or tests/ — but the gate was re-run in full anyway, and the reason is worth naming. tests/vllm/models/test_ltx2_pipeline.cpp READS docs/FEATURES.md at run time, and that merge touched it, so "doc-only, therefore the compiled gate carries" would have been an argument rather than a measurement. Second clean rebuild from an empty build directory: 974 translation units, exit 0, zero warnings, zero ENOSPC. test_ltx2_pipeline passes. ctest --test-dir build -j 3 508/508 exit 0. scripts/agent-preflight.sh --fail-on-skip exit 0, all gates green, no gate skipped.

test_engine_core_proc failed one of the two full runs on this tree and passed the other, plus a serial re-run — the same 1-in-30 flake measured earlier and now recorded on #1052. That is the only red observed, on any tree, in this round.

Merge order against #1132 was re-checked after the two merges: still exactly one conflict, still docs/ENVIRONMENT.md, still the same mechanical resolution.

The build tree was removed. git status is clean and origin/main is an ancestor of the pushed SHA. This branch will go stale again the moment main moves — the gate above is bound to ac5057960, and whoever merges should confirm --is-ancestor rather than assume it.