R12 DWS EOS-Suppressed Trace Field Screen Preregistration

Protocol: R12-DWS-EOS-SUPPRESSED-FIELD-SCREEN-DEV-v4

Status: CPU mechanics GO; Linux publication, Newton deployment, H100 execution, and full-state recurrence NO-GO. This document authorizes only the local 100-episode development screen in train/eval_dws_eos_suppressed_trace.py. It does not authorize promotion, hidden confirmation, training, checkpoint changes, a verifier-backed capability claim, or an H100 claim. Linux/Lustre qualification and a fresh hostile review of the exact four uncommitted file bytes remain mandatory before commit or any qualification. Any later commit must preserve the reviewed hashes exactly. All commit, Linux, Stokes, Newton, publication, and H100 gates remain NO-GO for this untracked repair.

Execution custody status: blocked until these exact repaired bytes have been reviewed and committed. After that commit, a separate external read-only runtime-source manifest and externally signed run authorization must bind the exact commit, source bytes, allocation, inputs, and output custody as specified below. This revision does not authorize or report a GPU launch, a Newton run, or an accepted publication artifact.

1. Question and prior observations

The hypothesis is deliberately broad:

Suppressing a model-selected EOS can expose partial recurrent use of generated DWS history under an external decode clock.

It is not a newline-specific hypothesis. Fixed token overrides supply an external halt veto and clock. They are not model-authored halting, autonomous state control, or autonomous reasoning.

The following independent local development observations were supplied before this preregistration and are motivation only. They are not results produced by the frozen evaluator:

• At the first three observed EOS boundaries, generic EOS masking selected tokenizer ID 211, which decodes to one LF.
• For 428 - 181, ordinary decoding had exact prefix 1; LF 211 and semicolon 39 had prefix 2; space 233 had prefix 1.
• For 181868 + 116989, ordinary decoding had exact prefix 1; LF, semicolon, and space had prefix 2.
• LF continuations could emit labels such as Check:; semicolon could produce text shaped like ;z=0;dws...; space could emit a foreign token before a new DWS line. These observations veto a uniquely causal LF interpretation.
• In generated-history counterfactuals, changing only the emitted carry often failed to change the next state even when the active result digit should change. Changing the already-written result digit propagated into the next tape. Active operand perturbations changed the next digit imperfectly.
• On an independent 16-case local board, nominal next-state exactness was 5/16. Carry-flip full-target exactness was 7/16, but output changed only 3/16. In the true-carry-one stratum, nominal exactness was 0/8 while carry-flip exactness was 6/8, consistent with a default-carry-zero policy producing spurious counterfactual accuracy. Written-result output changed in 7/16, while its full counterfactual target was exact in 1/16.
• On eight further carry interventions, full-history S0 + generated S1 continuation had true exact 3/8, counterfactual exact 4/8, output switch 1/8, and paired causal exact 1/8. A fresh exact core prompt containing only canonicalized S1 had true exact 8/8, counterfactual exact 7/8, output switch 8/8, and paired causal exact 7/8 on the same model. That contrast jointly removes prior context, resets positions, and canonicalizes the state surface; it does not identify which component caused recovery.
• A non-preregistered 12-case cross-width replication, balanced two per (width 4/6/8, add/sub), found full-history paired carry exact 2/12 (0/4, 2/4, 0/4 by width) versus compound fresh-state paired exact 10/12 (3/4, 4/4, 3/4). Fresh-state true exact was 12/12, counterfactual exact 10/12, and output switch 12/12.
• A no-weight cache-pruning probe was negative. Keeping only latest generated- state KV became malformed after the first interval; immutable-prefix plus latest-state KV also failed; dropping only stale S0 keys while retaining the original prefix, suffix, and latest state stayed near full-history behavior and did not reproduce fresh-prompt isolation. Cached suffix/state values were already contextualized by S0, so post-hoc slicing could not undo that source.

Consequently, full-target exactness and paired target-switch response are separate, non-substitutable endpoints. Nominal trace prefixes cannot establish field use. Failed carry target-switch is a noncompensatory carry-use veto.

2. Frozen inputs

The exact checkpoint-step JSON value is the string "sft_ep1". The evaluator accepts no checkpoint, tokenizer, heldout, case-count, prompt-style, arm, budget, device, or precision override. Each input must be a regular, non-symlink, single-link file. The checkpoint is hashed before loading from the same open descriptor and hashed again after loading. The small inputs are parsed only from their verified bytes.

Runtime-source seal

The execution wrapper is train/jobs/eval_dws_eos_suppressed_trace.sbatch. It accepts execution only from an absolute normalized SOURCE_ROOT after the submitter sets SOURCE_ROOT_REVIEWED=YES, and only when SOURCE_COMMIT is the exact lowercase 40-hex checked-out HEAD. The source tree must be clean under git status --porcelain=v1 -z --untracked-files=all.

An externally stored regular, non-symlink, single-link manifest with no write permission bits must use schema r12_dws_eos_suppressed_runtime_sources_v7. Its separate externally supplied SHA-256 is mandatory. The manifest has exactly these top-level keys: schema, source_root, source_commit, files, runtime. Its files object has exactly the following lexicographically ordered closure and one lowercase SHA-256 for each. The complete manifest must be canonical sorted compact JSON with one final LF:

R12_DWS_EOS_SUPPRESSED_TRACE_PREREG.md
train/eval_dws_eos_suppressed_trace.py
train/jobs/eval_dws_eos_suppressed_trace.sbatch
train/model.py
train/test_eval_dws_eos_suppressed_trace.py

The test and preregistration sources are sealed conservatively even though the evaluator does not import them. Adding any other repository-local runtime import requires a reviewed protocol revision and an expanded manifest closure.

The runtime object freezes schema r12_dws_eos_runtime_identity_v4; normalized absolute Python, Git, scontrol, sacct, and nvidia-smi paths, executable hashes and version output; complete installed PyTorch and tokenizers distribution closures; the isolated Python startup flags, search-path inode surface, loaded module origins, and every consumed regular source, bytecode, or extension component; every absolute file mapping already present in Linux /proc/self/maps bound to the mapping record's device and inode; and the CUDA, precision, math-SDPA, cuBLAS, and deterministic-algorithm backend contract. Cryptography is not a runtime package dependency for authorization: Ed25519 public-key derivation, signing, and verification are implemented in the reviewed evaluator source. Point decoding requires a 32-byte RFC 8032 canonical field encoding (y < 2^255 - 19), rejects the set sign bit when the recovered x is zero, requires exact canonical re-encoding, membership in the prime-order subgroup, and an explicit non-identity point. This rejects canonical and alternate identity encodings, noncanonical field encodings, identity public keys, identity R, and every small-order trivial-forgery input. Signature scalar decoding separately requires an exact 32-byte little-endian integer strictly below the Ed25519 subgroup order.

The wrapper replaces Bash with the descriptor-held interpreter using exec and starts Python with exactly -I -S -B. site, sitecustomize, usercustomize, .pth processing, Python startup/path environment variables, and preauthorization site-package search paths are forbidden. Every already consumed stdlib source, existing .pyc, native extension, built-in/frozen module origin, and Python search-path inode or verified archive is included in the startup closure before run authorization is accepted. The exact closure is recomputed immediately before and immediately after production-signature verification. A lazy import or path/component change at either boundary makes the authorization ineffective; no key request or namespace mutation has yet occurred. PyTorch and tokenizers paths are not activated by site; their complete externally sealed RECORD closures are rehashed first, their verified distribution roots are then appended explicitly, and the distributions are rehashed after import.

Each package closure is reconstructed from one strict CSV RECORD. The exact importlib.metadata.files set must equal the exact RECORD path set. Every listed file, including transitive Python, native extension, console-script, metadata, and RECORD files, is bound by normalized absolute path, original canonical RECORD-relative path, SHA-256, byte count, device, inode, UID, mode, and link count. Leading ../ components are permitted only in canonical wheel form and only when their normalized target remains under the running interpreter's normalized sys.prefix; an absolute path, mid-path .., symlink, hardlink, group/other-writable file, missing file, duplicate, manifest mismatch, or declared RECORD hash/size mismatch is fatal. The sorted full file manifest, distribution root, installation root, name, and version have one canonical closure digest. The closure is observed before third-party package import and rehashed after import; the imported __init__.py paths and versions must match.

Before external authorization is accepted on Linux, all absolute file mappings already loaded into the process are independently hashed with the same regular-file/inode/mode rules. The parsed hexadecimal device major/minor and decimal inode from each /proc/self/maps row must equal the reopened pathname's actual device and inode. A deleted mapping, path replacement, zero inode, or one pathname associated with multiple mapped identities is fatal. The same map-record binding is required for later loaded-runtime snapshots. These records form the canonical native-library closure. The source-contained Ed25519 verifier validates the production signature before PyTorch or tokenizers is imported, so unsealed third-party package code cannot verify the authority that permits its own import. Non-Linux execution records an explicit development-only absence of /proc/self/maps qualification.

For every listed path, wrapper and evaluator require current SHA-256 equality to the manifest and byte-for-byte equality to git show SOURCE_COMMIT:<path>. The wrapper opens and retains descriptors for the reviewed Python, Git, scontrol, sacct, nvidia-smi, external manifest, and actual Slurm-spooled $0. It executes those binaries through Linux /proc/self/fd, rechecks each held descriptor against its reviewed pathname, and requires the running interpreter inode to equal the held Python inode. The spooled wrapper bytes and the exact parsed Slurm Command file bytes must both equal the manifest's wrapper hash.

Every Git invocation uses the held executable with a constructed environment, not the inherited Git environment. System/global configuration, replacement objects, optional locks, pagers, prompts, and system attributes are disabled; core.fsmonitor=false, core.hooksPath=/dev/null, an empty external diff, and a null attributes file override repository configuration. Thus git status, show, cat-file, and rev-parse cannot execute an unsealed fsmonitor or hook from local, global, system, or injected GIT_CONFIG_* configuration.

After source verification, the wrapper copies the exact evaluator and train/model.py bytes into separate anonymous sealed memfds. Generation and independent verification execute the evaluator memfd under the descriptor-held interpreter with -I -S -B; model construction compiles only the sealed model memfd bytes. Pathname replacement cannot change those executed source bytes. The wrapper holds the external manifest and output-directory descriptors for the complete transaction and rechecks source, commit, executable, manifest, spooled-wrapper, Slurm, and output-directory identities before acceptance.

The accepted output path and its deterministic .r12-acceptance-commit.json sidecar must be absolute, normalized, outside SOURCE_ROOT, and absent. Their pre-existing parent must be a normalized, current-UID-owned mode-0700 directory. The wrapper opens it with O_DIRECTORY|O_NOFOLLOW, records device and inode, and uses only relative operations through that held dirfd. Before inspecting or deleting any protocol residue, the wrapper takes a nonblocking exclusive advisory flock on that exact held directory inode and binds the lease to its PID, Slurm job ID, accepted name, production-authorization nonce, and directory device/inode. A live cooperating publisher therefore makes startup fail before cleanup. Every publication phase rechecks that the pathname still names the held inode. Thus execution is ineligible while any repaired owned file is uncommitted or while the external seal has not been created from that exact commit.

External production authorization

The wrapper cannot root its own acceptance authority. The production Ed25519 public anchor is source-pinned as key ID r12-production-authority-2026-07-v1, raw public key 3805039655eef59153ba2b148551df2376d7c2cfa550ee5f6386745d4d0ed857, raw-key SHA-256 b47cb1db3d3ef97ad5cf9f80405e979f4be58f5ea1d570f092825f272bd978dc, and canonical external public-key-file SHA-256 09b3f77db76b1277c79f82fa28920fff1d749925231de1ba1f85e73e2ae7e642. Only the public key is in the reviewed repository. No corresponding production private key may be present in source, the runtime manifest, wrapper memory, or any repository pathname. Provisioning and custody of the matching external private key are outside this protocol and remain a prerequisite for execution.

Before scientific decoding, the wrapper requires canonical schema r12_dws_eos_external_run_authorization_v5 signed by that production key. It binds a positive authorization sequence, random nonce, issue/not-before/expiry times, exact source commit, external manifest path and hash, canonical output path and parent device/inode/UID/mode, accepted filename, all checkpoint/ tokenizer/heldout/prereg paths and hashes, ordered-board hash, the complete live scontrol/sacct/cgroup/GPU allocation record, and one delegated publication key whose exact scopes are the domain-separated post-publication marker and durable post-fsync acceptance receipt. It also embeds one exact replayable r12_dws_eos_linux_qualification_authorization_receipt_v1 object produced by the reviewed version-6 Linux/Lustre qualification. That object contains the complete structured qualification result and the accepted qualification broker request/report/marker/receipt publication, with both the inner marker/ receipt signatures and an outer mechanics-only signature replayed before the production signature is accepted. The qualification evaluator SHA-256 must equal the sealed evaluator SHA-256 in the report acceptance context. The production authorization signature, not the mechanics-only key, binds that receipt into accepted report state. It also binds a sorted exact stale_cleanup_entries list. Every such entry identifies one protocol-shaped candidate, temp, or quarantine under the exact accepted name by name, device, inode, UID, mode, link count, size, and SHA-256. Candidate and temp names may encode a prior canonical job ID and nonce, and terminal quarantine names may likewise come from a prior run, but only an exact entry in the fresh signed authorization grants mutation or recovery authority. No unsigned pattern match grants deletion authority. Expiry is enforced before generation and again at both wrapper final-check stages. Output no-overwrite, exact job identity, sequence, nonce, and expiry make an authorization non-portable to another run or output.

The delegated publication private key is not accepted from a pathname and is never inherited by Bash. The reviewed Slurm directives require --export=NONE, and the job starts the reviewed wrapper with Bash privileged startup mode (#!/bin/bash -p), so inherited user environment, BASH_ENV, exported functions, and normal startup files cannot run. Before opening any held source descriptor or executing Python, Bash rejects every nonempty LD_PRELOAD, LD_AUDIT, LD_LIBRARY_PATH, LD_DEBUG, LD_PROFILE, LD_USE_LOAD_BIAS, GLIBC_TUNABLES, and listed DYLD_* variable, then unsets all shell, Python, and loader startup variables. The external scheduler and controller remain trust roots for enforcing the exact --export=NONE launch; an already loader-compromised shell cannot repair itself from inside the job. Bash inherits only the connected message-boundary broker socket, never opens the production authority or authorization path, opens only the reviewed source, manifest, and executable descriptors, and uses exec to replace itself with the held Python interpreter under -I -S -B; no dumpable Bash parent survives.

The Python process sets and verifies PR_SET_DUMPABLE=0 before opening either external authorization file or inspecting the inherited broker socket. It first verifies exact source, manifest, sanitized Git state, and startup/package/native closure from held reviewed descriptors. It then opens and retains the production public key and signed authorization with O_NOFOLLOW, requires exact device/inode/mode/link/size/mtime and bytes through every authorization use, and verifies the canonical signature, full live Slurm/output identity, source/manifest/prereg cross-binding, and signed stale-cleanup set. Only after those checks may it validate the broker descriptor and send canonical broker schema r12_delegated_key_broker_request_v1. The request binds its PID, exact Python executable and startup closure, authorization/manifest/evaluator/wrapper hashes, and the authorized delegated public key and private-key hash. Qualification requests canonicalize sys.executable once to its strict resolved absolute non-symlink path and hash the bytes at that same path; parent and child therefore bind one identical executable record even when the parent was invoked through a Python symlink.

The external broker must independently withhold authority from every Bash or unattested requester. Before responding, it must verify the peer PID survived the required exec boundary, /proc/PID/exe and held descriptor identities, exact -I -S -B command/startup state, non-dumpability, and every request hash against the independently reviewed authorization. It may then send exactly one anonymous 32-byte, fully sealed, zero-link memfd by SCM_RIGHTS with canonical response schema r12_delegated_key_broker_response_v1. The wrapper rejects extra descriptors, stream transports, truncation, wrong response binding, wrong bytes, wrong public key/hash, wrong seal mask, or an inheritable received descriptor. The broker socket contains no key bytes and is closed immediately after the transfer. The signed production authorization binds both the key's public key and private-key SHA-256 plus the exact two permitted publication schemas. A separate test-only key uses scope test_only_no_production_authority; production validation rejects that scope. The external broker/controller and signer are operational trust roots, not scientific evidence. Their real integration is not exercised by this repair.

This is not a complete immutable executed-runtime seal. Generator and verifier record their loaded-file mapping source, every observed loaded file hash and inode, shared-object closure, libc and loader objects, CUDA-family objects, CUDA runtime, driver API version, device UUID, /proc/driver/nvidia/version, the required absence of all forbidden loader environment, including LD_LIBRARY_PATH, LD_PRELOAD, and DYLD_INSERT_LIBRARIES. Dynamic-loader and CUDA library resolution still occurs from system configuration at process construction, before loaded-object snapshots can be taken. These observations narrow the custody claim to the scheduler-enforced empty exported environment, held executables, and measured loaded-object snapshots; they do not prove that every runtime byte was immutable from process start to exit. The preauthorization native mapping closure is a point-in-time snapshot; later dynamic loads are observed again but are not made immutable retroactively. The package RECORDs and externally signed manifest bind installed bytes, but do not independently prove the upstream package supply chain. The source-contained Ed25519 implementation also requires fresh specialist review before production authorization.

Frozen Slurm allocation

The only eligible wrapper allocation is partition normal, one node, one task, four CPUs for that task, node memory 64G (68,719,476,736 bytes), time limit 08:00:00 (28,800 seconds), no requeue, and GRES gpu:nvidia_h100_pcie:1. The wrapper directives freeze those values.

The wrapper independently parses one exact scontrol show job -o JOB_ID record and one pipe-delimited base-job record from pinned sacct. It requires exact agreement on job ID/name/state, partition, node list, CPU allocation, requested memory, time, requested and allocated TRES, plus scontrol user, command, host, node/task/CPU counts, MinMemoryNode, Requeue, Gres, and TresPerNode. Requested and allocated TRES must each contain exactly one generic GPU and one typed nvidia_h100_pcie GPU, plus cpu=4, mem=64G, and node=1; any additional GPU TRES is fatal. Non-GPU accounting TRES such as billing are retained. Gres is exactly gpu:nvidia_h100_pcie:1, and TresPerNode is exactly gres/gpu:nvidia_h100_pcie=1. Raw scontrol, sacct, and cluster configuration hashes are bound into the authorization and marker.

Node identity has one exact single-node representation. scontrol BatchHost, scontrol NodeList, pipe-delimited base-job sacct NodeList, and the current socket.gethostname() value must be byte-identical lowercase canonical names matching [a-z0-9][a-z0-9-]{0,62}. Missing or empty fields, FQDNs, brackets, commas, ranges, ambiguous lists, case normalization, disagreement, or any multi-node allocation fail closed; no nodelist expansion or substring matching is accepted.

Visible CUDA hardware must map one-to-one to that scheduler allocation. The wrapper parses the current process's cgroup-v1 devices controller, requires an exact job_<JOB_ID> path component, records the complete canonical devices.list, and requires the concrete major/minor for exactly one /dev/nvidiaN. The same single-row pinned nvidia-smi query binds display index, minor_number, UUID, PCI bus ID, name, and MIG state. The device node is derived from minor_number, never from display index, and its character-device minor must equal that observation. GPU-major wildcards or another allowed concrete physical-GPU minor are fatal. Concrete rules on the physical-GPU major are enumerated from devices.list, not inferred by walking only existing /dev/nvidiaN nodes; an extra permitted minor is rejected even when its device node is absent. Observed named NVIDIA control-device major/minors are separated from physical-GPU permissions only after each named identity is checked against the allocated physical-GPU character-device identity. An exact alias is fatal for every named control device, and a named control identity cannot hide a second concrete physical-GPU permission. Duplicate named identities, noncanonical control identities, and an unclassified concrete minor all fail closed. Cgroup-v2 device-BPF state is not inferred: without separately reviewable exact controller evidence, it fails closed. Pinned nvidia-smi must report exactly one physical NVIDIA H100 PCIe, one UUID and PCI bus address, MIG disabled, and no MIG devices. The PCI sysfs vendor must be 0x10de and class must be display/ compute class 0x03...; BDF, vendor, device, class, and their canonical hash are recorded. CUDA_VISIBLE_DEVICES and SLURM_JOB_GPUS must each contain exactly one selector, resolve through the same physical index/UUID inventory, and match the CUDA runtime UUID observed by both generator and verifier. Slurm controller, accounting, configured device cgroup, sysfs, and NVIDIA driver inventory are explicit infrastructure trust roots. Environment strings or device-name substrings alone cannot satisfy this contract.

3. Frozen score-blind board

Selection uses only frozen episode metadata, never model output or a score. For each cell in this order:

1. regimes fit_w4, fit_w6, value_ood_w4, value_ood_w6, width_ood_w8;
2. operations add, sub;
3. rank by ascending SHA256(b"R12-DWS-EOS-SUPPRESSED-FIELD-SCREEN-DEV-v1\0" + id_ascii), then by case ID;
4. take the first 10.

This freezes 10 cases in each of 10 cells, 100 total. Widths 4 and 6 are the primary partition (n=80); width 8 is extrapolation (n=20). The ordered case IDs, joined with LF and a final LF, have SHA-256 c83796c32fdc69efd99bff579103b0a6e2be9812cbc94b91a061bcbb24a1ad7b. Changing row order in the source file cannot change selection. Selection is completed before any model output exists.

An exact evaluator-owned 12-case replication subset is selected only from that frozen 100. For widths 4, 6, and 8, then operations add and sub, rank by SHA256(selection_domain + b"replication\0" + id_ascii) and take two. Its ordered IDs are:

fit_w4-00258
value_ood_w4-00217
fit_w4-00261
fit_w4-00196
fit_w6-00122
value_ood_w6-00028
value_ood_w6-00280
value_ood_w6-00067
width_ood_w8-00120
width_ood_w8-00176
width_ood_w8-00180
width_ood_w8-00103

Those IDs with LF separators and a final LF have SHA-256 1dc75ec7995e61a85f7bec9ae1fa62aa1adaf71bd46172e880aea901482396b9. This subset is a prospective replication of the supplied 12-case pattern, not a reuse or claim-bearing rescore of the earlier observations.

4. Exact prompt bytes

Every episode starts at its frozen canonical p=0,c=0,z=0 DWS state. The sole prompt is the exact ASCII concatenation below, with no leading or trailing byte beyond the shown Answer: suffix:

Microstate update. Digits in a, b, and r are least-significant first. Use the digit at p with c, write only r[p], then advance p by one.
State: {initial_state}
Return exactly one dws state line.
Answer:

The final code-block newline is Markdown presentation only and is not part of the prompt. Frozen byte commitments are:

Each report records exact prompt text, byte count and SHA-256, the complete ordered prompt token-ID array, token count, and canonical little-endian token-ID SHA-256. Every primary and secondary decode independently records its complete prompt token-ID array and hash. Replay reconstructs each initial, full-history, destroyed-history, intervention, and fresh-core prompt and requires exact ordered ID equality, not merely equal count or a self-rehashed reported array.

5. Primary decode arms

All arms are greedy, batch one, KV-cached, and capped at exactly 768 new tokens. The initial prompt is prefilled once per arm; every later model call receives only the selected previous token and the uninterrupted cache. There is no sampling, retry, online parser, arithmetic, solver, verifier, semantic stop, answer stop, state schedule, state repair, or state injection in a primary arm.

The fixed replacement IDs must decode to exactly the one-character text shown and that text must encode back to exactly the same single ID. The generic mask must leave every non-EOS logit bit-identical. Every raw model-selected EOS event records generated index, absolute token position, EOS logit, best non-EOS ID, text and logit, actual replacement ID, text and raw logit, and whether an override occurred. Every arm reports generated-token count, exact EOS positions, mask positions, override positions, and override count.

The five fixed-budget arms share the same generated-token budget and model decode-step count. No wall-clock, FLOP, memory-traffic, prompt-length, or hardware compute-matching claim is made for any sham or replacement arm.

Deterministic CUDA contract

The wrapper exports CUBLAS_WORKSPACE_CONFIG=:4096:8 and PYTHONDONTWRITEBYTECODE=1, unsets Python startup/path variables, and invokes the absolute sealed interpreter with -I -S -B, so site, customization hooks, user startup, and repo-local import caches are excluded. The evaluator requires exactly one visible CUDA device with BF16 support and the exact scheduler/cgroup-bound CUDA_VISIBLE_DEVICES selector. Both CUDA name sources must equal the complete string NVIDIA H100 PCIe, compute capability must equal 9.0, a device UUID is mandatory, and reported physical memory must lie in the frozen full-device band from 75 through 85 GiB. Its UUID must equal the nvidia-smi, Slurm-selector, cgroup-device, and signed authorization UUID. This rejects A100, H100 SXM, non-H100 BF16 devices, and reduced-memory MIG views. It calls torch.use_deterministic_algorithms(True, warn_only=False), seeds CPU and all visible CUDA RNGs with 0, sets cuDNN deterministic mode, disables cuDNN benchmarking, disables both CUDA-matmul and cuDNN TF32, and sets float32 matmul precision to highest. Any unavailable control is fatal.

All model attention is run inside an exclusive torch.nn.attention.sdpa_kernel([SDPBackend.MATH]) context. Math SDPA is the single pinned backend; Flash, memory-efficient, and cuDNN SDPA must all report disabled inside that context. Before model execution, a fixed CUDA BF16 SDPA probe is run twice and must be bitwise equal. Math SDPA supports the planned H100 BF16 execution path, but selecting it is a determinism choice, not a throughput or H100 performance claim. The report records Python, PyTorch, CUDA runtime, CUDA_VISIBLE_DEVICES, visible-device count, exact device name, capability, total memory, UUID, every determinism flag, the backend identity, and probe result. Generator and independent-verifier observations must agree on all device fields. This document records no device run or result.

6. Offline first-boundary field screen

Only after all primary decodes finish may the evaluator decode text, parse DWS lines, or construct an oracle. The ordinary response must stop at exactly one model-selected EOS and its pre-EOS content must be exactly one canonical, token-round-tripping, nonterminal p=1 DWS line. Missing, malformed, labeled, duplicated, or noncanonical content makes every field endpoint for that episode a failure.

Field-screen availability is not trusted from the reported field object. Full replay derives it independently from the ordinary arm's exact mode, stop rule, EOS event, generated IDs, decoded bytes, canonical one-line grammar, p=1,z=0 state, and tokenizer round trip. A missing field screen is accepted only when that derivation returns the exact frozen unavailable reason. If the ordinary decode proves an eligible boundary, missing field work is a schema failure.

At that frozen first boundary, the evaluator prepares five offline history branches:

1. intact: the exact model-emitted state;
2. carry_flip: change only c to 1-c;
3. written_result_r0_flip: change only r[0] by minus one modulo 10;
4. active_operand_digit_perturbation: at position p, try tapes a then b, and deltas plus one then minus one modulo 10; select the first canonical state whose next active result digit differs;
5. equal_token_length_destroyed_history: replace every emitted-history token with non-format ID 100, preserving exact history token count.

The five clocks are the generic non-EOS runner-up and fixed IDs 211, 233, 39, and 100. For every clock and history branch, a fresh prefix contains the exact initial prompt tokens, that branch's history tokens, and the boundary clock token. It then receives one independent, uninterrupted, fixed 768-token cached continuation under the same clock rule. Parsing and scoring happen only after all such calls finish. This secondary causal screen deliberately injects offline-edited generated history; it is not an autonomous trace arm and cannot be counted in nominal prefix scores.

Only destroyed history is guaranteed equal-token-length. Digit substitutions may change tokenizer length and their exact counts are reported. No branch is claimed compute-matched.

Compound fresh latest-state re-encoding

A separate external context renders a fresh exact core prompt with the latest model-emitted S1 branch in the sole State: slot. It jointly removes S0 and prior generated-history tokens, resets all token positions, and canonicalizes the latest-state surface. For intact, carry-flip, written-result-flip, and active-operand branches, it uses ordinary EOS stopping with the same 768-token cap. It never uses the equal-length destroyed-state prefix.

This is one compound fresh-latest-state re-encoding/canonicalization package. It is neither an autonomous trace arm nor a position-, surface-, and clock-matched stale-context contrast. A recovery is attributable only to the compound package and cannot identify any specific context-selection or architectural mechanism.

Finite negative control: post-hoc KV slicing

The supplied no-weight cache-pruning observation is frozen as a descriptive negative control with three variants: latest-state KV only, immutable prefix plus latest-state KV, and stale-S0 key deletion while retaining contextualized suffix/latest tensors. This evaluator does not rerun those variants because the completed finite probe already falsified post-hoc slicing as a sufficient test. It records them as posthoc_kv_slicing_negative_control.status=descriptive_supplied_development_negative_not_reexecuted.

No zero-weight cache-surgery mechanism is promised. A later mechanism test must apply attention masking or segment isolation while representations are constructed/trained, or add a genuinely position-, surface-, and clock-matched contrast. Fresh re-encoding alone does not supply that identification.

7. Frozen offline scoring

The scorer independently reconstructs the complete decimal oracle from the initial DWS state after generation. It also verifies the frozen heldout expected_states and expected_answer against that reconstruction. Full report validation reopens the exact hash-verified heldout bytes, reruns the frozen selector, and binds each report index to that selected row's exact ID, split, operation, width, initial state, and selection digest. Every oracle record also contains the exact selected-row SHA-256, expected-state-list SHA-256, case ID, and expected answer. Missing, substituted, reordered, or internally self-consistent but non-heldout case/oracle content is a failure; no heldout verification field is hardcoded.

For each primary arm, every line containing dws: is inspected. A DWS line is valid only when the whole line is the exact canonical serialization and passes state invariants. Malformed candidates, repeated states, and any DWS candidate after the first valid z=1 state are recorded separately. The scorer reports:

• first-state exactness;
• longest exact state prefix;
• full exact trace through the first z=1 state;
• exact terminal state and exact final r,c tape;
• terminal tape-derived answer and any explicit answer=<integer> line;
• all-line canonicality, transition grammar, response grammar;
• all EOS positions, logits, replacements, generated-token counts, and serialization diagnostics.

For each clock, intact reports both nominal second-state exactness against the episode oracle and adjacent-transition exactness against T(emitted state). These are distinct.

Each carry, written-result, and operand intervention reports:

• full counterfactual target-state exactness;
• whether the whole output changed;
• endpoint-level intact target, counterfactual target, intact observation, and counterfactual observation;
• whether the target changed, whether output changed, each endpoint's target exactness, and paired target-switch exactness.

Paired target-switch exactness requires a changed target, a changed observed endpoint, exact intact endpoint response, and exact counterfactual endpoint response. Carry uses the next active result digit as its noncompensatory switch endpoint and also reports next carry. Written-result uses retained r[0]. Operand uses the next active result digit and perturbed operand digit.

Destroyed history reports whether intact adjacent transition was exact, whether destroyed history still matched that target, whether output changed, and paired loss (intact exact && destroyed not exact). Full-target exactness never rescues target-switch, and target-switch never rescues full-target exactness.

The aggregate denominator for each carry clock is all 100 planned episodes; missing or malformed episodes count as failures. Unless paired carry target-switch is exact in all 100, that clock receives carry_target_switch_noncompensatory_veto=true. Any clock veto makes the global carry-use veto true. This strict veto cannot be overridden by nominal prefix, terminal, serialization, full-target, written-result, operand, or destroyed- history scores.

The compound fresh re-encoding package separately reports intact adjacent exactness, carry full-target exactness, carry output switch, carry paired switch, written-result and operand endpoints, and per-case paired carry recovery versus the full-history LF clock. Results are split at widths 4, 6, and 8 on both the 100-case board and frozen 12-case subset. The descriptive compound screen pass requires every check below:

Passing these gates emits only compound_fresh_reencoding_screen_pass=true. Because the contrast changes context, positions, surface form, and stopping clock together, this flag is not a mechanism signal. It does not clear the full-history carry veto, change full-state recurrence from NO-GO, or authorize promotion.

8. Output and custody

The report schema is exactly r12_dws_eos_suppressed_field_screen_dev_v4 under protocol R12-DWS-EOS-SUPPRESSED-FIELD-SCREEN-DEV-v4.

The exact top-level JSON keys are:

schema, protocol, development_only, claim_boundary, frozen_contract,
execution, aggregate, cases, adjudication, wrapper_acceptance,
generator_attestation

wrapper_acceptance uses exact schema r12_dws_eos_wrapper_acceptance_v8. The canonical report package has exactly schema, report under r12_dws_eos_canonical_report_bundle_v5; it has no completion field. The separately published marker uses r12_dws_eos_post_publication_marker_v5 and is not acceptance. Durable acceptance requires the distinct r12_dws_eos_durable_post_fsync_acceptance_receipt_v1 record with status wrapper_durable_post_fsync_acceptance_complete.

Every case has exactly:

case_id, split, operation, width, selection_sha256, initial_state, prompt,
oracle, primary_arms, field_screen

Every primary arm has exactly:

mode, decode_prompt_token_ids, decode_prompt_token_ids_sha256,
decode_prompt_token_count, generated_token_ids, generated_token_count,
content_token_count, generated_token_ids_sha256, stop_reason, fixed_budget,
eos_mask_applied_positions, model_selected_eos_positions, override_positions,
override_count, eos_events, response_text, response_sha256, trace_score

The validator rejects extra or missing keys at these levels, wrong arm sets, wrong case order/count, or a changed adjudication. It mechanically replays each decode's mode and arm identity, exact prompt-token array/hash/count, generated and content-token counts, generated-token hash, mask positions, model-selected EOS positions, absolute EOS positions, replacement identity, override count, and ordinary-stop versus fixed-budget rule. Fixed-budget arms must contain exactly 768 non-EOS generated tokens; generic masking must list every generated position and no other arm may report a mask. Ordinary EOS may appear only as the final token of an EOS-stopped decode. Full validation reloads the hash-verified frozen tokenizer, re-tokenizes each initial and branch prompt, re-decodes every content token list, and verifies all reported runner-up and replacement token text.

Before semantic checks, every accepted report, context, authorization, attestation, verifier record, package, marker, and receipt must be a recursively plain JSON tree. Dict/list subclasses, bool-as-int, int-as-float, float-as-int, custom numeric subclasses, NaN, infinity, and overflow-produced nonfinite values are rejected. Counters and token IDs require exact built-in integers; logits and rates require exact finite built-in floats where specified. Recomputed trace, intervention, aggregate, and adjudication objects use type-strict recursive equality so Python numeric aliases cannot pass by 1 == 1.0.

The validator independently rebuilds each oracle and primary trace score. For every available field screen it reconstructs the intact, carry, written-result, active-operand, and destroyed-history branch contracts from the emitted state; reconstructs each branch target; reparses each first continuation state; and recomputes full-target, whole-output-switch, endpoint target-switch, history-destruction, compound-fresh-re-encoding, aggregate, and adjudication fields. Both the fresh-re-encoding record and its detail must state external_reencoding=true and the exact fresh-core-prompt mode. No reported full-target value can substitute for a failed paired response during replay.

Crash-atomic publication

The report is serialized as canonical UTF-8 JSON with sorted keys, compact separators, one final LF, duplicate-key rejection on readback, and no non-finite JSON numbers. The wrapper creates distinct random generator and verifier Ed25519 keys in anonymous sealed memfds. The acceptance context records their public keys, private-key hashes, and exact seal mask. Only the generator receives the generator descriptor, and only the independent verifier receives the verifier descriptor. Marker authority instead comes from the externally signed run authorization and its bound, post-exec broker-delivered sealed delegated marker descriptor. No wrapper-created or report-embedded key can root acceptance. Bash never holds any authority-bearing private key. Before asking the external broker for that key, the exec-replaced Linux Python process sets itself non-dumpable with prctl(PR_SET_DUMPABLE, 0) and verifies PR_GET_DUMPABLE == 0, preventing same-UID processes from inspecting its non-inherited descriptors or memory through proc/ptrace. Production root private material is never available to the wrapper. No private-key bytes are written into the report or marker.

Generation receives no output-directory descriptor. It writes the complete report only to a wrapper-owned anonymous mode-0600 descriptor and signs a canonical attestation that binds the report-body hash, sealed evaluator/model hashes, wrapper and manifest hashes, parsed Slurm job ID, and nonce. The wrapper validates that signature and the full report before publishing a hidden private candidate. Candidate publication uses an exclusive random same-directory temp, write/fsync/readback/full replay, mode 0400, and Linux renameat2(..., RENAME_NOREPLACE) through the held output dirfd. It then fsyncs the parent and verifies exact candidate inode, mode, link count, size, bytes, and full schema through the descriptor retained from creation. Before candidate rename, while the private temp pathname still names that creation-held inode, the publisher also opens and validates a non-inheritable O_RDONLY descriptor for the verifier. The wrapper never reopens the published candidate pathname. Before candidate consumption, the wrapper parses the exact creation-held bytes, requires equality to the in-memory report and read-only verifier binding, and revalidates the path, device, inode, mode, link count, size, mtime, and bytes. A move-then-error removes no pathname. Exact rollback and successful candidate consumption instead use RENAME_NOREPLACE to move the held inode to a deterministic hidden rollback quarantine, fsync the parent, and revalidate the quarantine pathname against the same held descriptor and bytes. The wrapper retains that descriptor through canonical publication and performs a final quarantine hold before success. An inode substitution or same-inode byte mutation is preserved and is fatal.

The independent verifier receives only a read-only descriptor for that mode-0400, single-link candidate, not the output dirfd. It reruns the exact heldout selection and semantic replay, checks the signed generator attestation, rechecks source/manifest/executable/Slurm custody, rehashes every frozen input at its exact frozen path, records an independent loaded-runtime snapshot, and signs one canonical verifier record with its distinct Ed25519 key. That signature binds candidate hash and inode, report-body and generator-attestation hashes, validation-time frozen input paths/hashes, and validation-time runtime observation. The wrapper checks the signed record against the still-open candidate descriptor; generation cannot self-rehash or fabricate it.

Before canonical publication the wrapper renames the now-verified private candidate with RENAME_NOREPLACE to a deterministic retained rollback quarantine and fsyncs the held parent; it never pathname-unlinks the candidate. It revalidates that quarantine against the exact descriptor retained from the candidate temp's creation, and keeps that descriptor open through canonical publication and the final quarantine hold. It then creates a new exclusive random temp in the same held directory and writes a canonical mode-0444 report package. That package contains only its schema and the unchanged signed report. It contains no acceptance receipt, completion status, or wrapper acceptance signature. It is fully parsed and replayed, fsynced, and atomically renamed to the absent canonical name with RENAME_NOREPLACE.

Canonical rename is not acceptance. The wrapper fsyncs the parent; rechecks that the output pathname still names the held current-UID mode-0700 directory inode; reads and fully validates the final canonical inode; rechecks source, external-manifest inode and bytes, held executables, actual wrapper, the complete parsed Slurm allocation and cluster config; and requires final mode 0444, link count 1, exact size and bytes. Only after all those post-publication checks succeed does the wrapper exclusively create the deterministic durable-receipt name as an empty inode, change it to mode 0444, fsync that inode, and fsync the parent. The wrapper retains its original writable O_SYNC descriptor and fails closed if synchronous-open semantics are unavailable. This durable empty slot is intentionally invalid evidence; replay rejects it until valid signed receipt bytes are later written and fsynced through that retained descriptor. The wrapper then generates a fresh 256-bit marker nonce and creates a separate exclusive commit-marker temp.

The commit-marker builder consumes the report descriptor retained from its exclusive temp creation through canonical rename. It requires the held dirfd pathname, full descriptor policy identity, and exact bytes to remain equal before it can use the externally authorized delegated marker key. The signed marker binds the production authorization hash, authority key ID/fingerprint, authorization sequence, delegated public key, canonical report hash, full final inode/mode/link-count/size record, its own future final inode, both signed attestation hashes, complete parsed Slurm allocation, wrapper/manifest/ runtime hashes, frozen input observation, marker nonce and timestamp, and five explicit report-publication checks. It is read back and signature-validated, changed to mode 0444, and atomically renamed without replacement to the deterministic sidecar name. The marker status is only wrapper_post_publication_marker_complete; the marker never claims that its own rename is parent-durable and never constitutes acceptance. The marker signature is accepted only after independently verifying the production signature over the embedded run authorization and its exact marker scope delegation. Self-rehashing cannot edit any signed field or replace the authority root.

Immediately after marker rename, the deterministic failure-injection boundary before_commit_marker_parent_fsync runs before any parent fsync. The wrapper then fsyncs the parent, reads and fully validates the marker through its retained descriptor, semantically replays report plus marker from both retained descriptors, and repeats all final source, authorization, Slurm/cgroup/GPU, runtime, and output-parent checks. It next requires both canonical pathnames still to name the exact transaction-owned device/inode/mode/link/size/mtime and bytes, fsyncs those same held descriptors, and fsyncs the held parent. These are fresh durability operations, not an assertion that an earlier fsync happened.

Only after those operations return does the wrapper build the externally authorized durable acceptance receipt. The production-signed run authorization must explicitly delegate the receipt schema to the same sealed publication key. The signed receipt binds report, marker, and receipt names; full report and marker inode/mode/link-count/size records; its own preflushed inode; report and marker hashes; output parent; authorization hash, sequence, authority identity, and delegated key; a fresh nonce and timestamp; and the just-completed retained- descriptor revalidation, file-fsync, parent-fsync, and final-wrapper checks. The wrapper writes the bytes only through the retained O_SYNC descriptor for the already parent-fsynced empty slot. Each completed write is synchronous; an interrupted partial prefix is invalid JSON, while a completed final write is already durable. The wrapper then fsyncs that receipt inode again and reads it back. There is no receipt rename after the durability checks, so there is no second rename-before-parent-fsync acceptance window.

The wrapper then holds report, marker, and receipt descriptors concurrently, fully replays the same three-artifact parser/validator twice, and requires every canonical path plus descriptor to retain the transaction-owned device, inode, mode, link count, size, mtime, and exact bytes. Restart replay likewise opens the external manifest, running evaluator source, report, marker, and receipt once, retains all descriptors through semantic replay, and performs a final exact-byte hold before returning. A symlink, hardlink, rename, same-inode byte mutation, or replacement of any artifact is fatal. Wrapper success is printed only after this final three-artifact validation returns.

Normal failure never pathname-unlinks a transaction-derived report, marker, receipt, candidate, or temp. It moves each still-exact held entry with RENAME_NOREPLACE to a deterministic rollback quarantine, fsyncs the parent, and revalidates full policy identity and exact bytes there. A swap before rename moves the foreign entry into quarantine, preserves both inodes, and makes rollback fail closed. Startup cleanup occurs only after the production signature, authority identity, live Slurm allocation, output inode, delegated key identity, source commit, manifest path/hash, and prereg hash have all cross-bound, and after the exact lease binding validates. All canonical names must be absent, the complete observed protocol-residue set must exactly equal the externally signed cleanup set, and every entry is fully read and identity-checked before mutation. Each active authorized entry is moved with RENAME_NOREPLACE to a deterministic protocol quarantine name derived from the signed entry, and the held parent is fsynced immediately after that rename. The entry is re-read and must retain the signed device, inode, bytes, mode, link count, and size. Startup stale cleanup never calls pathname unlink on either an active entry or quarantine. This is intentional: POSIX offers no atomic "unlink this pathname only if it still names inode X" operation against a hostile same-UID namespace mutator. A replacement after rename is therefore preserved at quarantine and causes failure rather than risking deletion of a foreign inode.

A hard death after either rollback or stale-cleanup quarantine rename leaves an inert deterministic quarantine. A later authorization may list that exact quarantine name and full inode/hash record, including after a new job or nonce. Cleanup moves a signed rollback quarantine into terminal stale-cleanup quarantine; it recognizes and revalidates an already terminal quarantine without moving or unlinking it, then permits the publication transaction to continue. Physical deletion of terminal quarantines is outside this wrapper and requires separate offline custody. An omitted, additional, live-owner, unrelated, or differently scoped residue is never mutated. An empty signed list authorizes no cleanup. The directory lease is advisory and protects only cooperating publishers; hostile same-UID denial of service remains possible and real Lustre flock behavior is still unqualified. A pre-existing canonical name is never replaced. A hard process death after canonical report fsync can leave a report without a marker. A hard death at the injected pre-parent-fsync boundary can leave a visible report, valid marker, and durable empty receipt slot. A hard death after marker parent fsync but during receipt writes can leave an empty or invalid partial receipt. Every such state is an uncommitted partial publication, and normal read-only replay rejects it. Only a fully signed, inode-bound receipt whose bytes were written after the fresh report, marker, and parent fsync sequence authorizes replay. Protocol-shaped residue from a different run/stage identity requires a new externally signed recovery authorization; unrelated names are untouched.

No mutating durability-recovery mode is implemented. Any future idempotent recovery mode must require separate external authorization, reopen and fsync the canonical report and marker, fsync the parent, and only then publish a new durable acceptance receipt. It must not convert a marker claim into evidence or self-attest that any fsync occurred before recovery began.

Acceptance is independently replayable after the Slurm job ends only from the triple of canonical report package, valid post-publication marker, and valid durable post-fsync acceptance receipt, using the source-pinned production public key, its externally signed run authorization, the delegated marker public key, the generator/verifier public keys, the externally frozen runtime-source manifest, the exact frozen tokenizer/heldout/checkpoint paths, and all three inode bindings. The report/marker pair is never accepted. Replay does not require a live Slurm job and cannot silently replace parsed Slurm fields with environment strings. A test-scope authorization, marker, or receipt is rejected by production replay. The evaluator's generation CLI has no output-dir or accepted-output descriptor and no canonical publication path; wrapper authority is the held dirfd, externally authorized sealed delegated marker descriptor, and independently signed verifier record.

The execution record embeds the external manifest path, hash, device, inode, UID, mode, and size; exact source root and commit; all five source hashes; clean-status and git show equality assertions; exact runtime identity; sealed evaluator/model memfd records; and isolated Python startup mode. wrapper_acceptance binds the report to complete parsed scontrol, sacct, cluster configuration, devices-cgroup, /dev major/minor, nvidia-smi, PCI sysfs, CUDA selector, and Slurm selector observations. It includes exact job, user, command, host, partition, node/task/CPU, memory, time, requeue, typed TRES, GPU UUID/BDF/full-MIG state, raw hashes, and one-to-one normalized selector mapping. Slurm environment name/cluster strings and substring matching are not evidence. The context also binds the output-directory inode, wrapper, manifest and runtime hashes, nonce, candidate/final names, external authority-key file, signed authorization file/hash/body, delegated marker key record, generator/ verifier public keys, and sealed generator hashes.

The external-controller ceiling is deliberately descriptive and unexecuted in this implementation: a future controller could feed every oracle state into a fresh canonical one-step prompt. Its absence is explicit in the frozen output contract and cannot be silently represented as an autonomous comparator.

The maximum frozen workload is 100 ordinary primary calls, 500 fixed-budget primary calls (384,000 generated tokens), up to 2,500 fixed-budget full-history field calls (1,920,000 generated tokens), and up to 400 ordinary-stop compound-fresh calls capped at 768 tokens. Missing or malformed first states reduce secondary calls but remain endpoint failures. No throughput or hardware-equivalence claim follows from these accounting bounds.

Required Linux/Lustre qualification

Command linux-smoke is an explicit non-scientific qualification surface. It requires Linux, an exact reviewed evaluator SHA-256, and a current-UID-owned mode-0700 root on a mount parsed exactly as lustre. It performs no tokenizer, checkpoint, CUDA, model, or DWS decode. It exercises real renameat2(RENAME_NOREPLACE) success and collision, sealed memfd readback, prctl non-dumpability, file and directory fsync, injected failures immediately before and after directory fsync with exact held-inode rollback quarantine, random crash-temp cleanup, symlink and hardlink rejection, held-dirfd pathname substitution, and Lustre rename/fsync/reopen durability. It also acquires the production publisher lease helper, forks a separate concurrent process that opens the same directory and must lose a real nonblocking flock, validates an ephemeral mechanics-only Ed25519 authorization over an exact stale inode, executes the production stale-quarantine helper, substitutes a foreign inode after the quarantine rename, and requires that foreign inode to survive. These are reported as separate structured evidence records only after each observation returns. The ephemeral mechanics signature has no production or test authority. Success requires exactly 16 ordered checks: publisher lease acquisition, concurrent flock rejection, production SCM_RIGHTS receiver traversal, signed stale quarantine, foreign-inode preservation, no-replace rename, directory-fsync rollback, three receipt crash/replay outcomes, held-evaluator pathname substitution before the first child, symlink rejection, hardlink rejection, random crash-temp cleanup, held-directory substitution rejection, and Lustre rename/fsync/reopen.

The qualification first exercises the production canonical broker-request builder and production connected message-boundary SCM_RIGHTS receiver. Each crash child repeats that same transfer, obtains only a deterministic mechanics-only signing key, and binds the exact broker request hash and public key into distinct qualification report, marker, and receipt schemas. Those artifacts carry valid Ed25519 signatures under the transferred ephemeral key, but the explicit mechanics_only_ephemeral_broker_key_no_production_or_test_authority boundary cannot satisfy production or test-authority replay.

The same qualification runs three deterministic cases in separate child processes using fixed hard-exit codes, then waits for each child and independently opens and replays its private scenario directory. Every child acquires the production publisher lease and invokes the same publish_accepted_bundle_exclusive transaction as production with inert qualification-only parsers and builders. Thus qualification traverses the same exclusive temp creation, no-replace report and marker renames, retained report/ marker descriptors, parent and file fsyncs, empty mode-0444 O_SYNC receipt slot, signed receipt construction, complete synchronous write, exact rollback, and final shared three-descriptor replay code. The first child exits after marker creation but before its publication-parent fsync, leaving an empty receipt. The second writes exactly a nonempty proper receipt prefix through the retained O_SYNC descriptor and exits. The final child exits after the shared complete O_SYNC write helper returns but before its redundant explicit receipt fsync.

Before any qualification child is spawned, the parent reads the exact reviewed evaluator into one anonymous memfd, changes it to mode 0400, applies and verifies the complete Linux seal mask, and records its SHA-256, byte count, descriptor kind, and seals. Each child inherits only that held descriptor. A minimal isolated -I -S -B -c bootstrap reads the descriptor with pread, requires the exact byte count and SHA-256, compiles those bytes, and executes them as the worker; the mutable evaluator pathname is not the executed image. The worker again verifies the same held descriptor and embeds that exact source record in the version-3 qualification report and receipt. Parent replay requires exact source-record equality. Production linux-smoke first creates a private mode-0444 exact-byte evaluator probe in its Lustre transaction. Its preregistered first_child_before_spawn callback renames the original probe inode to retained evidence, fsyncs the parent, creates and fsyncs a hostile replacement at the probe pathname, and records both inode/hash identities. The first child must still execute the held reviewed bytes; absence of the callback or its retained/substituted evidence is fatal. The non-Linux unit-test fallback uses an unlinked held file descriptor and is explicitly development only; it is not Linux/Lustre qualification evidence.

Fresh parent replay must reject the pre-parent-fsync empty slot and the partial receipt, and must accept only the canonical complete receipt whose inode and hash bindings state all required report-file, marker-file, receipt-slot, retained-descriptor, and parent fsync steps. Report and marker are independently replayed in all three cases so an unrelated failure cannot count as receipt rejection. The qualification requires receipt sizes to progress from zero to a strict partial prefix to a complete payload. It cleans each scenario plus its private random transaction directory and fsyncs each parent before success.

This mode has not been run by this revision. Its schema is r12_dws_eos_linux_publication_qualification_v6, and success status states only that the listed Linux/Lustre mechanics were exercised for exact-byte review. It does not infer that an unlisted production, authority, scientific, CUDA, or H100 path ran. A successful Stokes/Linux run is mechanical qualification evidence only; it does not authorize production, validate the external signer/controller integration, exercise H100 decoding, or produce a scientific result. The output additionally contains one canonical r12_dws_eos_linux_qualification_authorization_receipt_v1 object. Its exact keys are schema, qualification_result, accepted_publication, signature_hex; accepted_publication has exactly broker_request, report, marker, receipt. Replay verifies all inner hashes, schemas, inode records, durability booleans, broker identity, and Ed25519 signatures, then verifies the outer signature over the complete result and accepted publication. The mechanics-only key grants no authority: a separately reviewed production signer must embed this exact object in a fresh version-5 authorization, whose signed body is then embedded in the scientific report and hash-bound by the final marker and durable receipt. Linux publication and H100 remain NO-GO until the exact committed bytes pass that run and a fresh review accepts and binds its output.

Local repair verification

On 2026-07-18, the unrepaired suite first reproduced the independent symlinked- Python result exactly: 2 failed and 85 passed. After this repair, the isolated macOS development gate passed all 92 warning-strict tests under the same symlinked python3, with third-party pytest plugin autoload and pytest cache disabled. The seven-test focused defect gate also passed. Ruff formatting was applied only to the evaluator and its test; ruff check then passed both files. Isolated no-bytecode in-memory compilation under python3 -I -S -B -W error passed both Python files, and bash -n passed the wrapper. ASCII and whitespace checks also passed all four owned files. The tests cover the real message-boundary SCM_RIGHTS broker transfer and socket-identity race, strict canonical point and scalar Ed25519 bounds, every canonical small-order encoding, disabled site/.pth customization, loader/startup neutralization order, explicit verified-package activation order, held descriptor mode/link/same-inode byte mutation, both preauthorization and later mapped-device/inode pathname substitution, Git environment/config/fsmonitor suppression, a real forked concurrent publisher flock, signed exact stale quarantine, prior-job/nonce quarantine discovery, a rollback validation-to-rename pathname swap that preserves both inodes, foreign substitution after quarantine rename, actual hard process death and signed quarantine recovery, report/marker/receipt same-inode mutation through publication and restart final holds, candidate creation-FD custody across pathname substitution, canonical Python identity under symlinked invocation, held-evaluator substitution wired into production linux-smoke, replayable qualification-receipt authorization/report binding, rename-only retained candidate evidence, shared production broker/publisher qualification mechanics, and exact Slurm/GPU cross-binding. They do not substitute for a reviewed production broker/controller, Linux/Lustre, Stokes, Newton, H100, or independent exact-byte review.

9. Claim boundary

The only allowed conclusion is a development characterization of token-clocked serialization and field response under externally overridden EOS. Full-state recurrence remains NO-GO. Fixed token overrides are external resources. The screen cannot establish autonomous halting, autonomous recurrence, robust carry use, arithmetic reasoning, broad transfer, hidden-set performance, promotion readiness, a new computational primitive, or a stale-context mechanism. A compound-fresh recovery only characterizes that joint re-encoding package; it does not nominate a component without a matched future contrast. Post-hoc KV slicing remains the finite negative control and is not promised as a zero-weight mechanism. The present repaired working tree contains no sealed execution artifact: no launch is permitted until exact commit review and the external manifest, production authorization, signer/controller integration, and Linux/Lustre qualification are complete. No job or artifact publication was performed and no result is claimed by this revision. CPU mechanics are GO only for local development validation. Linux publication, Newton deployment, and H100 launch remain NO-GO pending fresh review of the repaired committed bytes and a real Stokes/Linux qualification run.

10. Required next actions

1. Obtain a fresh independent hostile review of the exact four-file hashes, before commit, qualification, cluster access, publication, or scientific execution. Concentrate on strict Ed25519 canonicality, full RECORD and native mapping closure, authorization/broker ordering, retained descriptor policy, signed cleanup/lease/prior-quarantine recovery, the shared qualification publisher path, and single-node cross-binding.
2. Only after review, commit exactly those reviewed hashes and verify that the commit preserves them. Then generate the external version-7 runtime manifest from independently observed bytes.
3. Run the same 92-test warning-strict suite on the target Linux runtime, then run linux-smoke on a real Lustre directory and preserve its complete version-6 output and exact nested authorization receipt. Confirm real flock, sealed memfd, first-child evaluator-path substitution, /proc/self/maps, hostname/Slurm, O_SYNC, no-replace rename, fsync, crash/replay, exact final receipt verification, and foreign-inode behavior under that filesystem and kernel.
4. Only after independent replay accepts that exact qualification output may the external signer create a version-5 production authorization embedding its exact authorization_receipt. Any stale cleanup list must be enumerated and signed out of process from exact inode/content evidence; never infer mutation authority from a filename.
5. Keep publication, Newton deployment, and H100 execution blocked unless every preceding gate passes on one exact committed source/runtime identity. A failure requires a new reviewed revision, not an exception or relaxed field.