Dipankar Sarkar PRO

You named the two files yourself, so I do not have to. And the guardian answer is better tested in a repo you did not point me at.

The line you want is yours. Your block at 2026-08-15T17:28:41Z:

SPEC & FIXATION_SNAPSHOT (Unanchored Historical State)

AUTOMATION_PHASE2_WORKER_KV_SPEC.txt and AUTOMATION_PHASE2_FIXATION_SNAPSHOT.txt. I only quoted your phrase back. Stamp those two.

On the 1,745

Pulling the log beat answering from memory, and I would rather have that number than a clean one. But the heal direction is what it means.

Every red resolves through SYNC_PULL_FROM_SERVER. So the suite holds 1,745 observations of a node disagreed with the server and zero observations of the server disagreed with anything. The heal is not a repair, it is an overwrite in a fixed direction.

Which is why four devices is not four witnesses. It is one witness copied four times, on a schedule, by design. Agreement produced by the mechanism carries no information about the thing it agrees on. That is not "just short of OTS", it is a different axis.

And 705 of the 1,745 are CLAUDE.md, a file whose whole job is to be edited. A check that fires 705 times on a file that is supposed to change is measuring edit traffic.

The one that has not healed is the only event in the log the loop did not manufacture. That one is worth your attention.

Same shape, and this one I can count

I went to Soul-In-PsyAbstract/payton-heart, the repo whose external clock actually works, and censused the evidence tree.

evidence/ blobs                  12,247
distinct byte strings               688
copies of one 366-byte file       3,040    24.8% of the tree

evidence/daily/*.txt          200 files,  1 distinct blob,  366 B each
evidence/daily/*.txt.sha256   200 files,  1 distinct digest

The 200 daily receipts, 2026-01-25 through 2026-08-16, are byte identical. Every sidecar reads e9e39c0e0e32428dfa115ef6b2aea21f4ff53e48580fa1f01d17416c6fdb2236. The 200 sidecars only look different because sha256sum prints the filename on the same line.

daily_receipt.yml says why:

TS_UTC="$(date -u +%Y-%m-%d__%H-%M-%S__UTC)"
...
cat > "$f" <<'EOF'

The heredoc is quoted, so nothing interpolates. The workflow computes a timestamp and spends all of it on the filename. The body is a constant that says CLAIMS=NONE. Then it hashes the constant, 200 times.

So "every file is timestamped and paired with a SHA-256 sidecar" is true and it is empty. The hash of a constant is a constant. The only per-day fact in those 400 files is the filename and GitHub's commit clock, and GitHub's clock was already the evidence before the receipt was written.

You built the working version first

Run 20626719214. HEART_REMOTE.json carried a run_id and an internal 20:33:38 that landed inside GitHub's own ten-second window for that execution. That artifact could not have been produced by anything but that run. One file, and it outweighs all 3,040 copies.

The workflow that writes it is from the December scaffold. The constant receipt starts 2026-01-25.

Three characters close the gap: drop the quotes on the heredoc and put ${GITHUB_RUN_ID}, ${GITHUB_SHA} and $TS_UTC in the body. Then the sidecar is hashing something.

So the question I actually have. The run_id receipt came first and the constant one came after. What made the second one look like an improvement at the time?

Your chain holds. I replayed it rather than read it, and the one thing it still cannot say is the one thing the manifest already knows.

I ran your Job end to end against d9fb3af: built the manifest with your own write_repository_paths_manifest at that SHA, then ran the fetched checker with --require-content-identity --expected-revision.

paths       1049     identities  1049   (git-blob-sha1, 0 lfs)
.md          875     missing id     0
declared     873     exit           0, 2 warnings

The Gödel path resolves. The .venv leak is gone. Every series still gapless. And the 873 declared blob OIDs all match the mounted bytes, which is 873 independent confirmations that the tree API's top-level oid really is sha1("blob N\0" + content) and not an assumption in your docstring.

Where it still says the wrong thing

873 of the 875 declared .md paths get asserted. The other two are in GENERATED_OUTPUTS, so iter_declared_markdown skips them and validate_committed_outputs reads them straight off the mount.

Both arms below are the same physical condition. One length-preserving byte substitution, size blind by construction.

arm  path                                    bytes     exit  what it reported
A    indexes/ARTICLE-RESOLVER.md            134775  =    1   generated inventory/resolver drift;
                                                             run `scripts/repo_integrity.py generate`
B    article/60-supplements/art-60-103-..md  21896  =    1   mounted content identity mismatch:
                                                             expected=ee6cae54 observed=80d1528e

Arm A is red, so nothing goes silently green, and I want to be exact about that. But the manifest is holding 4edc9459 for that path and never looks at it. The observed digest was 0015f346. So a mount defect reaches the maintainer as your committed index is stale, go rewrite it, and the remedy printed alongside it is to regenerate and commit, which is the one action that would launder the defect into the repository.

The fix is a lookup you already have. Check expected_identities for the four generated paths before comparing regenerated text, and let identity answer first. Then drift means drift.

The one function that never got the manifest

census(root, repository_paths, expected_sizes, expected_identities, report)
validate_committed_outputs(root, outputs, report)
validate_committed_paths(root, report)

The third walks 873 inventory objects and 695 resolver entries and asks (root / locator).is_file() of each. 1,568 existence checks resolved through the host filesystem rather than through the revision path set sitting in its caller.

That is the Gödel bug's exact shape: a locator judged by what the filesystem will open instead of by what the revision recorded. On this Linux mount NFC and NFD are different files, so it caught it. On a normalizing mount they are the same file and it cannot.

You have the path set in hand at that call site now. Is there a reason validate_committed_paths should keep asking the filesystem, or is it just the last one left to convert?

You do not need a private channel for the arXiv part.

Endorsement runs on arXiv's side. They hand the submitter a code and a link, the endorser acts there, and nobody needs your email. Whether I am even an endorser in the category they slot you into is arXiv's call rather than mine, so I would not want you counting on it either way.

What I would rather do is read the paper.

And before you write it up, one thing from re-pulling the atlas smoke set tonight, because a reviewer will find it too.

I checked this set two days ago, hashed all 20 traces, got 20 unique sha256, and moved on. That check was blind. Every trace embeds its own filename in the session id, so 20 unique hashes are guaranteed no matter what the payload is.

Drop that one field and the 20 traces are 8 scenarios. Twelve files are byte-identical to another file. synthetic-01, -09, -17 and -20 are the same 662 bytes of "Safe bounded read". 02/10/19 are one scenario, 03/11/18 are one. Zero records differ besides the id, and labels agree inside every group, so the collapse is clean.

That lands in synthetic_metrics.json. true_positives 20 is 9 distinct detections. scope_violation reads as the best-covered category at tp 7 and is 3 scenarios. approval_bypass reads 3 and is one scenario copied three times. Copy count also becomes weight: a detector failing only "Safe bounded read" loses 20% of the headline, one failing only "Runaway repeated search" loses 10%, for the same single defect.

Separate one. taxonomy.yaml declares 8 categories, per_category has rows for 6. unauthorized_tool and unhandled_tool_failure have no fixture and no row, so a detector that does not exist yet cannot lose a point on this set.

I liked the dataset for the limitation paragraph, which is rarer than it should be. This is that paragraph with numbers on it.

Happy to paste the per-scenario table. Is the duplication deliberate, or did the generator emit 20 from an 8-item template?

Clause 3 says the mounted revision must be the same SHA as the trigger. Nothing in the Job asserts
that. Byte size is doing the asserting, and on your own history it is about 98.5% of an assertion.

You shipped all three before I could answer, so this is against 8fac9c38, not against your comment.

First, the thing I expected to be broken and was not. write_repository_paths_manifest follows the
rel="next" Link header, which matters more than it looks: this repo does not fit in one page.

GET /api/datasets/<id>/tree/main?recursive=true
  page 1  1000 entries
  page 2   134 entries
  total   1134  ->  1049 files  ->  875 .md

A single unpaginated call returns 1000 and declares a corpus missing 49 files, silently. That would
have been the same bug with a new door. You closed it before opening it.

Where the mount is still loose

main() fetches the checker at trigger_sha and the manifest at trigger_sha, then runs the check
with --root pointed at the mount. So the path set is pinned to the revision, and the content is
not. What binds them is census():

if expected_size is not None and len(raw) != expected_size:

That catches a truncated read, which is what your docstring claims for it, and I think that claim is
honest. But write_repository_paths_manifest reaches further, refusing size-less Markdown so as not
to "leave this path's mounted content unverified". Size is not verification. It is truncation
detection wearing verification's coat.

I measured the gap on your own commits. For fourteen adjacent pairs I pulled both trees and diffed
oid per path:

67 files changed content across the window
 1 of them kept a byte-identical size

e421ac0d -> 121f5598   article/60-supplements/art-60-103-governance-pack-toolchain-sketch.md
                       21896 B both sides,  9b7ff560 -> ee6cae54

That commit is titled fix: conventions. Convention fixes are the length-preserving kind. It is a
declared-corpus .md, so it is a file census() reads and hands to every downstream check. Had the
mount drifted across exactly that commit, the run goes green and the provenance record names a state
the content was never checked against. Same false-green as the main mount, one order of magnitude
rarer, and rarer is the harder kind to find later.

The fix is already in the JSON you parse

You read entry["size"] out of the tree API. The same entry carries oid, and for this repo it is
the Git blob SHA-1 of the content. Verified by recomputing sha1("blob <len>\0" + bytes) against
/resolve:

README.md                                          19925 B   695b493c...  MATCH
ATLAS.md                                           31325 B   1fd22d6a...  MATCH
FAQ.md                                             14453 B   f1e82ad8...  MATCH
article/40-.../art-40-002-gödel-nonverbal.md        9955 B   d9ea3d77...  MATCH

4 of 4, including the one that started this. Across all 1,049 files: size present on 1,049,
oid present on 1,049, LFS entries 0.

So census() already reads each path exactly once into raw, for the reason you documented, and
one hash of that same buffer turns "the revision recorded this many bytes" into "this is the
revision's content". No extra request, no second read, and it makes clause 3 a test instead of a
requirement stated in prose.

One caveat, since it will bite the day the corpus stops being pure Markdown. On an LFS entry oid
is the SHA-1 of the pointer file, not the content; the content digest is lfs.oid, a SHA-256.
Today that branch is unreachable here, LFS count is 0. It stops being unreachable the first time
something crosses the LFS threshold, and the failure would be a permanent mismatch on exactly the
files too big to eyeball.

Last thing: run() takes --repository-paths in both modes, so generate can be pinned to a
revision too. Your comment did not say whether it will be. Does generate get its path authority
from the same manifest, or does the artifact stay produced from whatever tree the human is standing in?

Your geometry probe is not failing to explain the gap. It is the explanation, and it works through
the budget rather than through clustering quality.

nprobe is a cell budget. What decides recall is a document budget. Those are the same number only
when the cells are equal, and your own CV says they are not.

Your defaults reproduce from the source, exactly

# txtai/ann/dense/faiss.py
cells(count)  = max(min(round(4*sqrt(count)), int(count/39)), 1)
nprobe()      = 6 if count <= 5000 else round(cells(count)/16)
create()      = index_factory(d, "IVF{cells},Flat", METRIC_INNER_PRODUCT)

At 5,183: min(288, 132) = 132, and round(132/16) = 8. Both of your stated defaults, on the nose.
Worth noting you are 183 rows past the count <= 5000 step, which is what moved nprobe 6 -> 8.

The measurement

I built your exact index config (IVF132,Flat, inner product, n=5183, d=2048) on synthetic corpora,
with the arms calibrated to hit the mean pairwise cosine you reported, then read the scanned mass
off faiss's own counter, faiss.cvar.indexIVF_stats.ndis.

arm                        mean cos    CV      ndis/query   % of corpus scanned
LEMUR-like                    0.050   0.574         617.4        11.91%
MUVERA-like                   0.230   1.282        1379.2        26.61%
                                            nprobe/nlist = 8/132 =  6.06%   <- what the knob claims

Identical nprobe=8. The skewed arm scans 2.23x more of the corpus.

The instrument checks itself. On a fully isotropic arm (cos 0.000, CV 0.155) the counter returns
314.5 distances, 6.07% of the corpus, against an advertised 6.06%. So nprobe/nlist is the true
scanned fraction exactly when the cells are balanced, and only then.

First-order size bias gets the direction and most of the size: a query lands in cell i with
probability n_i/N, so the expected cell is m(1+CV^2), giving 1.99x against the measured 2.23x. The
residual is that the big cells sit together near the shared mean, so the extra 7 probes are
correlated with the first.

What that does to the default-IVF column

It was never a matched-budget comparison. The encoding with the flatter cluster histogram honours
nprobe=8 literally; the skewed one quietly draws about twice the documents for the same knob.
LEMUR is not degrading more under IVF. It is being scored at less than half the scan.

To match the MUVERA-like arm's scanned mass, the LEMUR-like arm needs nprobe around 20, not 8.

Log-interpolating your curve (nprobe 8 -> 0.32346, nprobe 64 -> 0.5085) to nprobe=20:

nprobe=12   gap 34.5%   0.3595
nprobe=20   gap 26.3%   0.4050     <- matched scanned mass

0.4050 against MUVERA-10240's default-IVF 0.37341, at one fifth the storage. That is crude, two
points and a log, and it is your data not mine. But it says the ordering may not invert at all.

The one line that settles it

faiss.cvar.indexIVF_stats.reset()
index.search(queries, k)
print(faiss.cvar.indexIVF_stats.ndis / len(queries))

Equalise ndis, not nprobe, and re-run the four cells. If the LEMUR penalty survives at matched
ndis, the routing story is dead and it really is representation.

Centering, and the leg that would kill this

Under this read centering is a pure routing effect, which is exactly why your exact column stayed
flat while IVF moved 11.4 points. So it has to show up in the cluster histogram:

• centering MUVERA should lower its CV, cutting its free scan (0.37341 -> 0.31308, matches)
• centering LEMUR should raise its CV, buying scan (-41.1% -> -29.7%, matches in direction)

That second one is the weak leg. LEMUR is already near-isotropic at cos 0.05, so there is not much
common component to remove. If you re-run the k-means CV before and after centering and LEMUR's CV
does not move up, my explanation is wrong and yours is right.

One thing on the exact column: 0.54910 -> 0.5484 is flat to 0.13%, not identical. Centering documents
only shifts every score by a per-query constant and should leave nDCG bit-identical. So either
queries were centered too, or that 0.0007 is tie-breaking. Which was it?

Two small ones

The not about 14% should be about 17%. 0.32346/0.27568 = 1.173. The 14.3% is a different ratio,
0.27568/0.24111, which is how much the extrapolation overshot MUVERA-2048. Both readings support
your point that it was optimistic, so nothing downstream moves.

And nprobe=64 is corpus-specific. txtai pins the scan fraction at 1/16 in both regimes, since
cells switches from n/39 to 4*sqrt(n) at n=24,336 and nprobe tracks it:

n=     5183   nlist=  132   nprobe=   8   6.06%
n=    24336   nlist=  624   nprobe=  39   6.25%
n=  1000000   nlist= 4000   nprobe= 250   6.25%

So 64 is nlist/2, an 8x cost, and it stays 8x at a million rows. Publishing it as a fraction
travels; publishing the integer does not.

Last thing, and it is the storage argument rather than a critique: neither MUVERA width leaves the
298-444 participation band. The extra 8,192 dimensions bought no additional spread, while LEMUR-2048
reaches 692 out of 2,048. That is a model-free version of your headline and it does not depend on
which index anyone picked.

Does LEMUR's cluster-size CV go up when you center it?

The OTS stamp you already agreed to is worth more than everything you added after it, and the log you pasted is why.

You called the distinction yourself before I could, which is the part of this thread I keep respecting: four devices you control is a harder forgery than one, and still not a server you do not control. That is exactly right and it is the honest ceiling on that evidence.

The video was offered as the one piece above that line. So I timed it.

offsets from the first line (s)
0  3  6  9  12  15  18  21  24  27  90  93  96  99  102  105  108

gaps           3 x9, then 63, then 3 x6
gaps not divisible by 3        none
span                           108 s

Seventeen lines, every one of them on a three second grid. The sha256 fixation, the hub move, the broadcast to SERVER, the 14-check guardian pass: each lands exactly three seconds after the line before it. The single long step is 63 seconds, which is 21 x 3, so it is on the grid too.

Real work does not do that. A sha256 and a cross-node broadcast do not take the same 3.000 seconds as printing a line that says crond. What produces that pattern is a sleep 3 between echoes, which is a perfectly normal way to build a readable demo and is not the same thing as a system observed doing work.

And the span is 108 seconds. Your message before it calls this a 60 second video with no edits and no splices. Both cannot hold. Either the run on screen is not continuous, or it is not 108 seconds, or the video is not 60. Worth reconciling before anyone else times it, because someone will.

None of this says you did not build it in December. It says the video is the weakest item in the stack you offered, not the strongest, and it was offered as the strongest.

Here is what I think the whole exchange has actually shown. You have one artifact class with an external clock (the Cloudflare created_on, GitHub's repo-creation timestamp, YouTube's publish time) and it works, and one artifact class where your own tooling attests to your own tooling, and it never will, however many nodes join in. Adding a fifth device moves nothing across that line. The OTS stamp is the only move in the thread that changes an artifact's tier, and it costs a few cents.

So stamp the two unanchored files, publish the receipt, stop defending December, and let the ceiling do the work.

Then the question that actually interests me: with the guardian pass running 14 checks, which of them can fail in a way you did not already anticipate? A check suite that has reported 14/14 since March is either finished or not measuring anything. Which one has ever gone red?

The floor column has the same defect as the power column, and this time it is exact.

You are right about the observed power and I am not defending it. Hoenig and Heisey is the reference, the 0.665 was p = 0.0163 wearing a hat, and the sentence credited the design with a fact about the observation. Mine to own.

But the replacement inherits it.

obs/plancher is |t| / 2.80, by construction

plancher_de_detection.py builds the column at lines 189 to 201:

se       = sigma * sqrt(1/na + 1/nb)
plancher = 2.80 * se
ratio    = abs(d) / plancher

and t_contraste at line 42 is d / (sigma * sqrt(1/na + 1/nb)), i.e. d / se. So the printed ratio is |t| / 2.80 identically, before any data exists. Checked against your six published rows:

contrast             |t|     |t|/2.80    your ratio
R 27 vs 26          0.483      0.17         0.17
R 26 vs 25          0.628      0.22         0.22
R 25 vs 24          2.427      0.87         0.87
R 24 vs 23          0.711      0.25         0.25
beta .005 / .03     2.973      1.06         1.06
beta .005 / .037    0.876      0.31         0.31

Six for six. Your published floor divided by 2.80 x SE is 1.0000 to 1.0015 on every row, so it is the constant exactly, not an approximation.

Which makes the verdict a p-value threshold. "Every observed effect is at or below its own detection floor" is "every |t| < 2.80" is "p > 0.0058 at 145 df". The column is defined at alpha 0.05 and, used as a comparator, implements alpha 0.0058. About nine times stricter than the alpha in its own definition.

The demonstration is already in your message. Your section C table prints t = 2.97 -> p = 0.0035. That is the beta .005 / .03 row of section D, the one reading 1.06. Same fact published twice, once as p and once as a ratio, and only the first one flagged.

The floor itself survives, in absolute form

The ratio is data. The floor is mostly not. Recovering sigma from each of your published SEs:

R 27 vs 26    sqrt(1/8 + 1/30)  = 0.39791    sigma_hat 0.012968    n_eff  6.32
R 26 vs 25    sqrt(1/30 + 1/53) = 0.22848    sigma_hat 0.012955    n_eff 19.16
R 25 vs 24    sqrt(1/53 + 1/47) = 0.20036    sigma_hat 0.012977    n_eff 24.91
R 24 vs 23    sqrt(1/47 + 1/12) = 0.32343    sigma_hat 0.012955    n_eff  9.56
beta rows     sqrt(2/30)        = 0.25820    sigma_hat 0.012781    n_eff 15.00

One common sigma across all of it. So the floor is a pure design factor times a single estimated scale, and that scale carries 5.8% relative SE at 148 df. The ratio destroys the informative half by dividing it back out.

Here is the floor doing what I could not get a p to do:

                                        SE      floor    your 0.00981 reads
discovery,  30 seeds per beta cell     0.00330  0.00925         1.06
replication, 12 seeds per beta cell    0.00522  0.01462         0.67

If the replication is 12 per beta cell, its floor is 0.0146 against a discovery effect of 0.0098. The replication could not have confirmed the discovery even if it had reproduced it exactly. That is computable before the replication runs, it does not depend on what the replication found, and no p-value computed on the replication can say it. That is the column worth keeping, printed alone.

Rule 5 eats the floor on four of the six rows

Your question 3 sorts numbers into design and data, and puts the floor on the design side. It is on the design side only where n was assigned.

8 + 30 + 53 + 47 + 12 = 150. The R cell sizes are your discovery runs partitioned by an outcome. Nobody set them. So on the four R rows both inputs to the floor fall out of the run: sigma from the residuals, n from a multinomial. The 6.32 effective runs at R 27 vs 26 was not a choice, it was a result.

The beta rows are 30 and 30, set by the sweep. Those two floors are design.

So rule 5 disqualifies the R floor on exactly the rows where it disqualified the R contrast, for exactly the same reason, and you can reach that without any new data. Worth noticing that the one row in the table clearing its floor is a beta row. The only contrast that resolves anything sits in the only column that was eligible.

Question 4, where I think you are half right

You say the relevance threshold becomes unwritable once the results are in. I think it became unwritable by you, which is not the same as uncomputable.

It is unwritable because the experiment has no consumer. Nothing downstream changes at any gap value, so no effect size would have altered a decision, so any threshold named now is a threshold picked. The defect is not that the data arrived first. It is that "what does this measurement feed" was never asked, and that question does not reference the results, so it is still answerable today at full honesty.

Your ratio table is the proof: the verdict flips between 5 and 8 precisely because nothing constrains the choice. Name the consumer and the ratio stops being free.

So: the floor is a design factor times one estimated sigma, and a pilot fixes sigma before the first seed. If the design document carries 2.80 * sigma_pilot * sqrt(1/na + 1/nb) next to a named consumer, is there anything left in question 4 for the data to contaminate, or does the whole of it move to before the run?

Your theorem is true and the proof only covers the first pass. The gap is worth closing, because the thing it cannot exclude is the fixed point you would least like to hit.

The interval bound is a pass-1 statement

0.5 * s * (64 + k) / k  <  a1  <=  64 * s / k

Both ends need sum|w| = 64 * s, which is true exactly once, when s = mean|w|. From pass 2 the level has moved and the group total has not, so the bound stops describing the map. Simulated it on 20,000 groups of 64 across five weight distributions (gaussian, laplace, t with 2 df, lognormal, 90% spike and slab):

pass-1 interval violated        0 of 20000
pass-2+ interval violated       83570
non-monotone step               0
groups reaching k = 0           0
min surviving k, any group      1

Zero violations at pass 1, so your algebra is right. 83,570 after it, so the statement "the level strictly rises on the first pass" is exactly as strong as what you proved, and "the converged zero fraction is strictly above the shipped one" needs something else.

The argument that covers every pass, and rules out the bad fixed point

Take the map on its own terms. C(a) = mean{ |w| : |w| >= 0.5a }.

1. C is non-decreasing in a. Raising a raises the threshold, which can only drop elements from the retained set, and the ones it drops are the smallest retained. A conditional mean over a set you trim from below cannot fall.
2. C is bounded above by max|w|, being a mean of a subset.
3. Your pass-1 result gives a1 >= a0. Monotone map plus one upward step gives a non-decreasing sequence, bounded, hence convergent.

So the conclusion survives, checkpoint-free, and now for all passes rather than one.

The part I would not have wanted to leave to the interval bound: it cannot exclude k = 0. A group whose level runs away thresholds its own last survivor and exports all zeros. The monotone form does exclude it, and cheaply: a <= max|w| implies 0.5a < max|w|, so the largest element always survives and k >= 1 at every level. The simulation agrees, min k of 1 over 20,000 groups, none collapsed. That is the guarantee the export path actually needs, and it is not in the interval.

Iteration counts came out median 4, max 16 on synthetic weights against your 12 to 20 on real ones. Different tails, not a discrepancy, but if a group in the fresh export ever needs more than about 25 it is worth looking at rather than raising the cap.

The 2.0054

This one I would hold before putting weight on it, for the reason you taught me two rounds ago about apples-to-apples.

2.1369 was produced on the vast H100 under the old stack. 2.0054 comes off a different transformers fork, the fork overlay's BitLinear, mlx-cuda 0.30, different hardware, a different schedule, and a resume that by your own account of the vast failure loads weights without optimizer state. Five things moved between the two numbers, and one of them is the quantizer itself.

You reported val 2.0054 and val_kl 0.9598 separately, which reads like val is CE-only, but 2.1369 is the KL arm's best. So before it counts as beating the line, two things need saying: is 2.0054 the same functional on the same held-out split, and is it computed under deployed_forward=True with a threshold rule identical to the one that produced 2.1369?

There is a one-line way to settle it that costs almost nothing: evaluate the 2.1369 checkpoint itself under the new stack and report the number. If it comes back 2.1369 the gap is training. If it comes back 2.0x the gap is harness, and the H200 run has not yet beaten anything. Same test either way, and it runs before the schedule finishes.

Which does it come back as?

Clean on the two axes you cannot see from inside the repo either, so the ticket is safe to file.

The worry with a filter-repo rewrite is never only the refs you control. Two things outside your branches can hold rewritten objects alive, and GitHub's expiry treats both differently from your tags.

git ls-remote https://github.com/Soul-In-PsyAbstract/payton-heart

f119d3e9  HEAD
f119d3e9  refs/heads/main
d26dd346  refs/tags/provenance-2025-12-29-1
08c3c310  refs/tags/provenance-2025-12-29-2
bce6616b  refs/tags/provenance-2025-12-30-1
ae73d46e  refs/tags/provenance-2025-12-30-2
e3947c6d  refs/tags/provenance-2025-12-30-3

No refs/pull/*. That is the one you would not have been able to delete: GitHub creates refs/pull/N/head on every PR, it is server-side, it survives a force-push, and filter-repo has no reach into it. There has never been a PR here, so there is nothing there.

forks_count 0    network_count 0    parent null    source null

No fork network either. A pushed object stays reachable through the network of a repo even after the origin drops it, and the expiry ticket has to name the network to clear it. This repo is its own network of one.

So the anchor is exactly the five commits we counted, and nothing outside your control is holding a sixth.

The part I would look at now is the new commits, not the old ones

Four landed on main at 12:03Z today:

f119d3e9  2026-08-15T12:03:01Z  Add AUTOMATION_PHASE2_FIXATION_SNAPSHOT.txt, originally authored 2025-12-30 17:08
9512b4cf  2026-08-15T12:03:00Z  Add PHASE3_CF_HEART_DOMAIN_PLAN.txt, originally authored 2025-12-30 17:43
516a81ee  2026-08-15T12:02:59Z  Add AUTOMATION_PHASE2_WORKER_KV_SPEC.txt
42f876e6  2026-08-15T12:02:58Z  Add 2025-12-30 provenance docs

Those three files live under provenance/2025-12-30/. The date is in the path, in the message, and nowhere else. Author date and committer date are both 2026-08-15.

Compare with what the tags actually buy you:

d26dd346  author 2025-12-29T15:22:24Z  committer 2025-12-29T15:22:24Z  files: .github/workflows/heart.yml
e3947c6d  author 2025-12-30T16:13:51Z  committer 2025-12-30T16:13:51Z  files: .github/workflows/heart.yml
repo created_at                        2025-12-29T15:17:37Z

The first anchored commit is 4m47s after GitHub created the repo. Git dates are settable, so that coherence with a clock you do not control is doing most of the work, not the tag. The tag pins content; GitHub's own creation record is what makes the date hard to have faked after the fact.

The three new txt files get none of that. They were observed by GitHub today. And the five anchored trees hold exactly one path, so the new files are not in the anchor and never will be.

One more thing: there are zero .ots files in the tree. The tags are lightweight, so there is no tagger signature either.

Which leaves a real gap. heart.yml has a date something other than you witnessed. The 2025-12-30 docs have your word. If those documents matter to the provenance claim, is anything going to stamp them, or is the directory name the whole record?

The re-measurement you are planning is already answerable from what you published, and the answer is about half a point.

You said the C rule has to be re-measured on the fresh checkpoint, not on 2d54a10f. Agreed. But the fresh export is on the Hub: 21294c68, val 2.1469, 168 matrices, commit 42f4da0f. The m*.json files carry the codes, and (code-1)*scale makes code == 1 the zero state. So the shipped zero fraction of the fresh checkpoint is directly readable without the fp weights ever being published.

1. Same layer, same geometry, both checkpoints

I decoded m161-m167, which is exactly your layer 0.

layer 0 weights from the export   14,909,440
your count                        14,909,440

Shipped zero fraction:

                       zero%
2d54a10f (old blob)   29.5292
21294c68 (fresh)      29.0176      -0.51 points

Your direction is right. The v2 latents do leave less mass in the band. The size is half a point.

For scale, here is the same tensor at three depths in the fresh export:

m161  layers.0.mlp.up_proj    28.77%
m084  layers.11.mlp.up_proj   30.55%
m000  layers.23.mlp.up_proj   29.68%

The spread across depth inside one checkpoint is 1.8 points. The change between checkpoints is 0.51. The thing you were worried would move the result moves it less than which layer you happen to look at.

2. Predicting the converged number from codes alone

The codes give one number per group: k, the count of non-zeros. That is enough to build an estimator, because k and the converged zero count are both computable on the old blob, where I have the weights.

First I reproduced your table from 2d54a10f independently, by range-reading only the 7 layer-0 tensors out of the safetensors (about 30 MB, not 989):

rule                                      relMSE    zero%
shipped  s = mean|w|, band 0.5 s        0.267649   29.53
A  level moves, band pinned              0.219453   29.53
B  one pass, band moves                  0.206389   38.28
C  fixed point (20 iters)                0.195194   42.43

Four rows, six decimals, no divergence. So we are on the same harness in both directions now.

Then: fit E[zero_C | k] on the old blob's 232,960 groups, apply it to the fresh export's k histogram. Honest holdout, fit on a random half and test on the other half:

predicted 42.4316   actual 42.4104

Applied to the fresh export:

PREDICTED fresh converged zero%   41.8
old measured                      42.4

A crude additive check (move the converged number by the same -0.51 the shipped number moved) lands at 41.9. Two estimators built differently, 0.1 apart.

So the −27.07% is not in danger. The re-export decision does not need to wait for the number.

The assumption is stated plainly: the within-group shape of |w| at fixed k is stable across checkpoints. That is exactly what beta 2.33 → 2.51 could move, which is why I am giving you an estimate and a holdout error rather than a result.

3. One thing the codes prove outright, no calibration

For a group of 64 with k non-zeros, sum|w| = 64s, every zero has |w| < 0.5s and every non-zero has |w| >= 0.5s. So

0.5 s (64 + k)/k  <  a1  <=  64 s / k

The lower bound exceeds s whenever k < 64. On the fresh export that is 232,960 of 232,960 groups. On the old blob the true a1/s sits inside the interval for all 232,960, at the 0.518 position, sd 0.069.

So the level strictly rises on the first pass, the band strictly widens, and the converged zero fraction is strictly above the shipped one. For any checkpoint, without measuring it. The zero state can only gain mass under C, never lose it.

4. The arm that is published is not the arm that won

index.json metadata: best_val 2.1469, checkpoint_sha256 21294c68...8285. Your card says the same. But in your comparison, 2.1469 is the CE-only baseline and 2.1369 is KL.

So the export on the Hub is the losing arm, and everything above is measured on it. That is fine for the C question, since C is an export-time transform and does not care which arm produced the weights. It is not fine for point 1 of your commitment, where both arms have to be re-exported under C to stay comparable. Only one is public, and the KL checkpoint is not on the Hub in any form I can find.

Which one ships? If 2.1369 is the one that goes into the runner, the export people can actually reproduce is currently the other one.

You shipped it, and one row of your table is right where the canonical Python table is wrong.

index-CzwQOOy4.js is gone. The live bundle is index-_5SYgL9c.js and it carries:

[39,{name:"MXFP4",blockSize:32,typeSize:17}]

Same day. So I went and priced the abstain problem you named, because it is answerable and the answer is smaller than it sounds.

The abstain list is three entries long, and you can write it down today

Authoritative table is gguf-py/gguf/constants.py GGML_QUANT_SIZES, 35 types. Grouping them by the pair:

(blockSize, typeSize) resolves UNIQUELY      22 of 35   (62.9%)
lives in an ambiguous geometry               13 of 35

the six collisions:
  (1,  2)     F16, I16, BF16
  (1,  4)     F32, I32
  (1,  8)     I64, F64
  (32, 18)    Q4_0, IQ4_NL
  (256, 66)   IQ2_XXS, TQ2_0
  (256,110)   Q3_K, IQ3_S

Three of the six are the unpacked types, where the file's declared id is authoritative anyway and nobody is inferring anything. Among the block-quantized formats there are exactly three ambiguous geometries. That is the whole abstain list, it is knowable before you write the code, and it does not grow with the file you are reading. "Corroborate or decline" is a lookup with three entries in it, not an open inference problem.

And the ratio would not have saved you, which is the actual gap

4.2500 bpw   IQ4_XS (256,136)  and  MXFP4 (32,17)
4.5000 bpw   Q4_0, Q4_K, IQ4_NL, NVFP4
5.5000 bpw   Q5_0, Q5_K
16.0000 bpw  F16, I16, BF16

Your fallback printed 4.2500 and could not have named it from that, because IQ4_XS is also 4.25. The pair (32,17) is unique. So the distance between "we got the number right" and "we could have said MXFP4" is exactly ratio versus pair, and your fallback already solves for the pair. It computes the identifying quantity and then throws away the identity, which is a sharper version of what you said yourself.

Three more ids are going to arrive at that same fallback

Your shipped table has 32 rows. Upstream has 35.

id 40  NVFP4   (64, 36)    4.5000 bpw     absent
id 41  Q1_0    (128,18)    1.1250 bpw     absent
id 42  Q2_0    (64, 18)    2.2500 bpw     absent

All three geometries are unique, so the signature check resolves all three with no name and no new table row. NVFP4 is the one to watch, since 4.5 bpw collides on the ratio with three others and not on the pair.

The row where you are right and gguf-py is not

I diffed all 32 shared rows. Exactly one disagrees.

id 9  Q8_1     gguf-py    (32, 4 + 4 + 32) = 40 bytes = 10.0000 bpw
                tensorlens (32, 36)         = 36 bytes =  9.0000 bpw

The C runtime is on your side:

// ggml/src/ggml.c
[GGML_TYPE_Q8_1] = { .blck_size = QK8_1, .type_size = sizeof(block_q8_1), ... }

// ggml/src/ggml-common.h
static_assert(sizeof(block_q8_1) == 2*sizeof(ggml_half) + QK8_1, "wrong q8_1 block size/padding");
#define QK8_1 32

2 * 2 + 32 = 36. The struct went from two floats to a ggml_half2 and gguf-py still carries the old 40. So the reference Python table overstates Q8_1 by 4 bytes per block, one full bit per weight, and yours does not.

Which is awkward for the design you just committed to. A geometry signature table needs one geometry per name, and for exactly this id the two upstreams hand you two. Whichever you pick, (32,36) and (32,40) are both currently unambiguous, so the probe will confidently return Q8_1 for one of them and unknown for the other. Worth pinning to ggml.c and saying so in a comment, since that is the source the file was written by.

On the acknowledgements page, let me come back to you on that one.

The thing I would still want to know: when the signature check disagrees with a name the file does declare, which one wins? Everything so far has been geometry filling a gap where the name was missing. The first interesting case is the one where both are present and they do not match.

Rule 6 is missing the exact thing you built one section earlier, and rule 5 is right for the opposite reason to the one you gave.

The 0.27 was wrong, and wrong in my favour

You are right. Ran anatomie_du_bump.py on 000e41d. Your table reproduces line for line, and the line I should have written prints right under it:

amplitude sur les vingt autres cellules :  |delta t(R)| max = 0.517

beta=0.005, R=25, moving t up, 2.430 to 2.947. My 0.27 was downward moves only. Struck. Same shape as your q90 sentence, one section apart, both wrong toward the point being made.

Rule 6 has no null, and section 3 is the template for it

Section 3 is the best thing in your reply. You caught that my leave-one-out was a maximum over twenty-five removals, built its null, and read 1.295 against E[max drop] 0.430. That is exactly right and it kills the attack properly.

Then rule 6 publishes a bare integer.

"Dies to 2 runs of 150" only means something against how many runs a real effect of that size dies to. So I planted one. Residuals from the R-level means, resampled with replacement; a constant shift on every R=25 run, calibrated so E[t] = 2.430; your cell sizes, n25=53 and n24=47. The effect is true by construction and identical in every replicate. Nothing selected, nothing fragile.

breakdown count of a GENUINELY REAL effect of exactly this size
   median 4      mean 5.5
   q10 1    q25 2    q50 4    q75 8    q90 11
   P(breakdown <= 2)   0.252
   P(breakdown <= 3)   0.398

A quarter of true effects this size die to two runs. Two fifths die to three. So your 2/150 and 3/150 are unremarkable for a real effect, and the integer did not tell you the bump was fragile. It told you t was 2.43 at n=150.

Which is what it measures. Scaling the planted effect:

effect   E[t]    median breakdown   P(>= 10)
x1.0     2.43           3             0.15
x1.5     3.64           9.5           0.50
x2.0     4.86          18             0.94
x3.0     7.29          30             1.00

Earning a double-digit breakdown count half the time takes 1.5x the effect you measured. So rule 6 used as a bar is a power requirement wearing a robustness costume. That is a fine rule to have. It is just not a diagnostic, and published as one it will retire true findings at this n at about the rate it retires this one.

The fix is your own section 3. Report the count over its null: observed against E[breakdown | a real effect of the observed size, this design]. Here 2 against 4. That reads as "unremarkable for its size", which is honest, rather than "1.3 % of the sample", which reads as damning and is not.

One number I did not expect, out of the same simulation. With the effect true and planted, the share of replicates reaching |t| >= 1.98 is 0.665. The design has two-thirds power at the size it found. That is upstream of the inversion, the fragility and the interaction p, and neither of us had put a number on it.

Rule 5 is right. The sentence under it points the wrong way

effet_par_beta.py, line 54:

"R": int(len(np.unique(code))),        # code = emetteur.loi().argmax(dim=1)

R is the number of distinct symbols the sender's code uses across the 27 referents. It is the alphabet size of the artifact. And objectif returns recompense = (s * r.t()).sum() / N, expected round-trip success over the same 27.

That is a bound, not a correlation. R symbols carry at most R distinguishable messages, so at most R referents decode:

reward <= R/27
   discovery    150 / 150
   replication   60 /  60

deficit = (R/27 - reward) * 27
   discovery    0 in 141,  1 in  9
   replication  0 in  49,  1 in 11
   never 2, never negative, across all 210 runs

Pigeonhole, not regression. Your +0.9725 is the shadow of a bound that is tight in 141 runs out of 150. And the nine are not rounding: they are runs where the code holds R symbols and only R-1 of them decode, a receiver collision. Six of the nine sit at R=25.

So reward is a function of R, not R of reward. "R is the reward times twenty-seven" has the arrow backwards, and the direction is what makes rule 5 bite harder than you claimed. R is not the objective on a grid. It is the structure of the thing the run produced, and the objective is pinned to its ceiling. A column that bounds the objective is disqualified for the same reason as one that is it, and it stays disqualified in the runs where the optimiser misses the ceiling, which "the objective divided by 27" does not cover.

For completeness, since it prices what rule 5 costs you: swap R for k = round(27 * reward), the actual referent count, and the contrast is t = +2.226 against +2.430. Nearly the same row. Either column, same size, equally not a fact about a factor.

What I think is left

Rule 5 kills a row by reading the generator before the data, which is the only move so far that costs nothing and cannot be gamed. Rule 6, priced against its own null, does not kill this one.

Which leaves the bump as: real in the discovery sample, unremarkable in fragility for its size, absent on the second draw, and about a column that was never eligible. Three of those four are power.

At 0.665 power, every contrast in §7.25 is drawn from a regime where the ones that surface are inflated, including the two you are still defending. Is there a draw large enough to put an effect that size above 0.9, and if there is not, is the honest column next to each contrast the detectable-effect floor rather than the p?