TUFF 9.4.3

TUFF 9.4.3

• Reject damaged saved-chat caches before restoring them. The cache checksum now covers its header and K/V data, and the runner validates every source offset before copying. Older caches are rebuilt automatically; saved chats and models are kept.
• Stop generation with an error when model arithmetic produces no valid token, instead of treating a failure as token zero or passing an invalid ID into the next forward pass.
• Keep low-temperature top-k sampling numerically stable. Very small positive temperatures could underflow every candidate weight and select the first token on every draw.
• Accept TUFF_LOG_CACHE for conversation diagnostics, while keeping TFF_LOG_CACHE working (#9).
• Keep the bug and performance forms' model choices consistent, including Heretic, and check for mismatches (#6).

Thanks to @arker2 for reporting the repeating-output problem in #53. A controlled test with Gemma 26B reproduced garbled output after corrupting a synthetic cache header and reloading. This patch addresses that confirmed restore defect and two numerical failure paths. The original intermittent report has not been reproduced with an intact cache, so #53 remains open for follow-up.

Validation: the full local source gate passed, including 2,682 Swift tests. The optimized Gemma engine also rejected the deliberately damaged synthetic cache and answered correctly after a cold prefill.

The Mac app is ad-hoc signed and not notarized. Model weights are separate downloads.