# CLAIMS.md — the fak honesty ledger

Every capability claim carries **exactly one** tag:

- `[SHIPPED]` — real code on the critical path, closed by a mechanical witness (a `go test`, a `go build`, a benchmark field, a file read-back). Reproducible now.
- `[SIMULATED]` — modeled with labeled stand-in data (no GPU / no live engine on the build box); the seam is real, the numbers are illustrative.
- `[STUB]` — plumbing present, behavior deferred; clearly labeled, returns a STUB/no-op result.

The lint witness (unit 96): every line beginning with `- [` carries one and only one of the three tags.

## The product

- [SHIPPED] One statically-linked Go binary (`fak`) runs an agentic tool loop where every tool call crosses one in-process syscall boundary. Witness: `go build ./...` exit 0; `fak run --trace ...` completes.
- [SHIPPED] Process-level fusion: harness + reference monitor + vDSO + pre-flight + context-MMU collapsed into one Go address space; no spawned hook, no IPC on the decide path. Witness: `TestNoOsExecOnHotPath` (ABSENCE proof, unit 72).
- [SHIPPED] The frozen ABI is a machine-checked contract (additive-only). Witness: `TestABIGoldenFreeze` over `internal/abi/testdata/abi_v0.1.golden` (unit 2/9).
- [SHIPPED] The whole module passes the Go data-race detector with **zero data races**, enforced by the `race-detector` CI job on every push/PR. `-race` needs cgo + a C compiler (absent on the Windows dev box: `CGO_ENABLED=0`, no gcc — run it via WSL/Linux/macOS or CI). Witness: `go test -race -count=1 -timeout=25m ./...` exit 0, 0 `DATA RACE`; `.github/workflows/ci.yml` (race-detector job); `docs/testing/race-detector.md` (E-001 / issue #12).

## The syscall subsystem latency check (not the headline KPI — unit 82)

- [SHIPPED] In-process adjudication p50 vs a spawned-hook baseline, measured on THIS machine, apples-to-apples (same `Fold` decide, two transports). Current report: 2.427 µs in-process vs 6.913 ms spawned `fak hook` (n=100) ⇒ ~2,849× (full-binary spawn). Witness: `report.json` `gate_primary=="pass"`; `report.json` `spawned_hook_baseline.p50_ns > 1ms`.
- [SHIPPED] The check is useful as a subsystem regression sentinel: it times the adjudication fold and confirms the decide path is not accidentally paying a per-call process boundary. It is deliberately **not** a production-readiness, model-quality, serving-throughput, or 45× fleet headline.

## Adjudication (the in-process DOS reference monitor)

- [SHIPPED] Provable refusal ⇒ `Deny`, unprovable ⇒ `Defer` (mirrors dos-preflake `decide.go`); default-deny on empty policy. Witness: `TestFoldDefaultDenyEmptyPolicy` (unit 15).
- [SHIPPED] Structured refusal from a closed 12-reason vocabulary + a bounded-disclosure witness (SELF_MODIFY returns only the offending glob). Witness: adjudicator tests (units 19, 20). Prior art: DOS `dos_refuse_reasons`; SMT unsat-core.
- [SHIPPED] Deny-as-value: a refusal carries a derived disposition (RETRYABLE/WAIT/ESCALATE/TERMINAL) the loop consumes (unit 74). Prior art: eBPF verdict, deny-loopback design.
- [SHIPPED] Batch adjudication (set shape) equals serial, in one pass (unit 75). Prior art: `dos-plan-price` generalized; speculative-decoding inverted.
- [SHIPPED] Deployable capability floor: the policy is a declarative, version-tagged JSON **manifest** loaded at runtime (`--policy FILE`), not a compiled-in Go literal — so an adopter configures WHICH tools the agent may call by editing a reviewable file, never by forking the kernel. Every `deny` reason is validated against the closed 12-reason vocabulary; unknown fields/reasons/versions are a fatal load error (fail-loud, never silently more-permissive); `--dump`↔`--check` round-trips exactly. `fak policy --dump|--check` authors+validates it; `fak preflight --policy` is the per-call oracle. Witness: `internal/policy` tests (9, incl. `TestRoundTrip`, `TestLoadedPolicyIsLoadBearing`, `TestUnknownDenyReasonRejected`); see `POLICY.md`, `examples/policy.example.json`. This is the deployable form of the "permissions as the floor" thesis.
- [SHIPPED] Git-shape prefilter: a registered adjudicator rung (`internal/gitgate`, rank 35) refuses the argv-decidable git hazards in a shell command — force-push, `commit --amend`, `add -A`, `--no-verify`, `tag -f`, `rebase -i` — at the call boundary, the in-kernel dual of `tools/githooks/*`. It Defers on non-git calls and on the state-dependent laws a stateless prefilter cannot honestly decide (OFF_TRUNK, sweep-a-peer, MERGE_HEAD — see `docs/notes/RESEARCH-git-in-kernel-prefilters-2026-06-22.md`); an operator whose git policy differs opts out with `FAK_GITGATE=off`. Witness: `go test ./internal/gitgate` (`TestClassify`, `TestAdjudicate`); `fak preflight --tool Bash --args '{"command":"git push --force"}'` ⇒ `DENY/POLICY_BLOCK/by=gitgate`.

## Tool vDSO (3-tier local fast path)

- [SHIPPED] Tier-1 pure registry (gated on readOnlyHint+idempotentHint, re-checked not trusted), tier-2 content-addressed cache (world-versioned, LRU), tier-3 static table. Witness: `vdso` tests (units 25–38). Prior art: kernel vDSO; RadixAttention prefix reuse.
- [SHIPPED] Arg-order-independent content keys (canonicalized JSON). Witness: vdso canonicalization test (unit 26).
- [SHIPPED] A write-shaped completion bumps the world-version and invalidates the cache (soundness: a hit equals a fresh call). Witness: units 28, 38.
- [SIMULATED] Real-world vDSO hit-rate: the demo trace `tau2-smoke` is deliberately cache-favorable (~50% hits). The EXPERIMENTS measured addressable purity on real tau2-airline is ~0.7% — far below a useful threshold. The vDSO is therefore an UPSIDE secondary, never the headline. Witness: `report.json` `vdso_hit_rate` (reported, never gated, unit 33/83).

## Pre-flight ladder + grammar rung

- [SHIPPED] Rung-0 static parse + rung-1 JSON-Schema validation, cheapest-first, escalate-on-pass; hard-negative label harvesting. Witness: `preflight` tests (units 47–51).
- [SHIPPED] Grammar rung: positional→named auto-repair (in-syscall TRANSFORM, no model turn) for arity-matched calls; unrepairable ⇒ Deny(MISROUTE); fail-open on unknown grammar; content-addressed grammar dedup. Witness: `grammar` tests (units 52–57). Prior art: GBNF/XGrammar; the tool-invocation-grammar design.
- [STUB] Rung-2 dry-run probe and rung-3 sandbox probe — the offline/sandbox escalation rungs above rung-1 — are not built in v0.1; only rung-0 static-parse (unit 47) and rung-1 schema-check (unit 48) are implemented in `internal/preflight` (see `STATUS.md`).
- [SHIPPED] Native decode-time constraint hook (#929, the in-kernel half of #907/#26): the in-kernel sampler boundary (`internal/model`, the greedy `argmaxF32` path) applies an OpenAI `logit_bias` map (token id → bias, clamped to ±100) and an injected JSON-schema/grammar `LogitMask` (the `AllowedSetMask`/`StepMask` per-step token mask, fed through `GenerateConstrained`) BEFORE argmax. Load-bearing **bit-exact-off**: with no bias and a dormant mask the decode is token-identical to `Session.Generate` (`max|Δ|=0`, same first-max tie-break). The schema mask is opt-in behind `FAK_NATIVE_GUIDED_DECODE` (default OFF); the logit-bias half needs no flag (an empty map is inert). Witness: `internal/model` `constraint_test.go` — bit-exact-off at the sampler and through the decode loop, logit-bias −100-removes/+100-forces, a real masked decode that emits schema-valid `{"name":…,"arguments":{}}` JSON with the mask proven load-bearing, and flag-defaults-off. The RIDE half — forwarding `response_format`/`logit_bias` to a vLLM/SGLang upstream — shipped in #907 (`internal/gateway`). Prior art: XGrammar/outlines/llguidance per-step logit masks; OpenAI `logit_bias`.
- [STUB] The tokenizer-aware compiler that lowers a `grammar.Grammar` `oneOf`-of-tools JSON-Schema to the per-step token masks above (the fleet-deduped, schema-driven `LogitMask` that fills the `internal/model` seam from `internal/grammar` + the tokenizer) is the named follow-on; #929 ships the sink + the concrete mask primitives, not the schema→token compiler.
- [SHIPPED] **gitgate destructive-op + off-trunk coverage** (`internal/gitgate`, the rank-35 git-shape Adjudicator prefilter). The argv-decidable hazard table now PROVABLY REFUSES the destructive shared-tree git ops the trunk discipline forbids but only the after-the-fact hooks caught before: `git reset --hard` (discards tracked-file working changes, incl. a peer's unstaged WIP), `git clean -f`/`-fd` (deletes untracked files — a peer's new files and your own uncommitted work), whole-tree `git checkout .` / `git restore .` (the `.` form only — a specific-path `checkout -- <file>` is left alone), the OFF_TRUNK branch/worktree OPEN (`git checkout -b`/`-B`, `git switch -c`/`-C`, `git worktree add`), the catastrophic `git push --mirror` (overwrites every remote ref), the `git filter-branch` / `git filter-repo` shared-history rewrite, and the persistent `git config` guard-disables — `core.hooksPath ...` (hook relocation) and `commit.gpgsign false` (signing off) — the durable siblings of the `-c core.hooksPath=` override and the `commit --no-gpg-sign` flag, while a `--get`/`--unset` (and setting gpgsign back on) stays safe. Each is a Deny citing the law + corrective at the call boundary, laundering-aware via the existing unwrap pass (a `bash -c` / pipe / `$()`-wrapped form is caught), and the safe neighbors DEFER (a `--soft`/`--mixed` reset, `clean -n`, a specific-path revert, `switch main`, `worktree list`) — no false-positive on a safe op. Operator escape unchanged (`FAK_GITGATE=off`). Witness: `go test ./internal/gitgate` (`TestClassifyDestructiveAndOffTrunk` — deny + no-false-positive defer + laundered rows; the existing `TestClassify` table stays green).

## Context-MMU (write-time result admission)

- [SHIPPED] Result-admit gate: secret-shaped and prompt-injection/poison results are QUARANTINED (held out of context, paged to a stub pointer); oversize benign results page out to a <2KB pointer (TRANSFORM); byte-repeat pollution quarantined. Witness: `ctxmmu` tests (units 61–70), `testdata/poison.json` fixture (unit 68).
- [SHIPPED] Page-in is gated on an explicit witness `Clear()` (unit 67); pollution-rate counter (unit 66); shared content-addressed blob store with the vDSO (unit 64).
- [SHIPPED] `normgate` driver (ResultAdmitter rank 5, in front of ctxmmu): a normalize-and-rescan gate that closes the measured detection-evasion gap — strips zero-width/variation-selector/bidi, folds homoglyph/fullwidth, decodes base64/hex, de-separates letter runs, broadens the secret vocabulary (ASIA/AIza/github_pat_/JWT/Slack), and provenance-gates trusted-local reads to a retrievable Transform instead of a sealed Quarantine. Measured (`cmd/ctxbench -chain`): agent red-team evasions 0→20/24 caught; private real-transcript false positives 4→2 with 0 new FPs and 0 leaks; residual = pure-semantic paraphrase (needs a classifier/IFC seam, by design). Witness: `normgate` tests (6, green). Enabling it is one blank-import line in `internal/registrations`.
- [SIMULATED] `headroom` (Rust) page-out codec: the v0.1 default is pure-Go content-addressed page-out; the headroom backend is an optional labeled seam, not on the critical path (unit 69).
- [SHIPPED] **Native context-compressor: terminal-control stripping + carriage-return redraw collapse** (`internal/headroom`, the `FAK_COMPRESSOR=native` plugin folded at ResultAdmitter rank 8). The in-process, dependency-free compressor now removes the dominant token-waste in real agentic tool output that its JSON-minify + line-dedup passes missed: ANSI/escape sequences (SGR color, cursor moves, OSC titles, DCS/PM/APC strings) and bare C0/DEL control bytes (`ansi-strip`), plus in-place carriage-return "redraw" frames — a progress bar reduced to its final frame (`cr-collapse`). Both are LOSSLESS TO THE MODEL (it renders no color and never sees a progress bar's intermediate frames), UTF-8-safe (a C0 control byte never appears inside a multi-byte rune), order-preserving, and reversible — the gate pins the pre-compression bytes in the shared CAS (the CCR promise), and the strip runs ONLY on benign results the gate already screened (`ctxmmu.ScreenBytes` before compress, after the `normgate` rank-5 rescan), so it can never hide an injection. NET-TRUE FENCE: these are large savings ON colorized / progress-bar output specifically (a 100-frame `\r` progress bar collapses by ≥0.80 in the witness), NOT a blanket ratio on all traffic, and a no-op never claims a codec (the transforms only ever remove bytes); the compressor stays DEFAULT-OFF (the build compresses nothing until `FAK_COMPRESSOR=native` selects it). Witness: `go test ./internal/headroom` (`TestStripEscapeSequences`, `TestCollapseCarriageReturnRedraw`, `TestNativeStripsANSIColor`, `TestNativeCollapsesProgressBar`, `TestNativeControlComposesWithLineDedup`, and `TestGateStripsANSIAndPreservesOriginal` — the gate-level reversible-CAS round-trip).
- [SHIPPED] **Native context-compressor: global (non-consecutive) duplicate-line folding** (`internal/headroom/fold.go`, the `line-fold` codec). The dual of the existing consecutive run-collapse: a line that recurs SCATTERED across a tool result — the same warning per file, a stack frame echoed per failure — is folded to its FIRST occurrence (kept in place, order preserved) plus a `… (×N more identical, elided) …` recurrence marker, with the later copies elided. Real test / lint / build output is full of this waste the consecutive pass cannot see. Conservative floor: a line must recur ≥3× AND be ≥8 bytes (short structural lines like `}` / `ok` are left alone), and the codec only fires on a real net saving. Model-readable (the marker states the count), order-preserving, and reversible via the gate's CAS — and, like every native transform, it runs ONLY on benign results the gate already screened, never on poison. NET-TRUE FENCE: a folded view drops the INTERLEAVING of the repeated line (a benign-result compression, not a structural rewrite of code under edit); the original is one demand-page away. Witness: `go test ./internal/headroom` (`TestFoldsScatteredDuplicates`, `TestGlobalFoldKeepsFirstOccurrenceOrder`, `TestGlobalFoldSkipsShortLines`, `TestGlobalFoldBelowThresholdNoop`, `TestNativeFoldsScatteredViaCompress`, `TestGlobalFoldComposesWithConsecutive`).
- [SHIPPED] **The "when to compress" decision layer + bench witness** (`internal/headroom/policy.go`, `internal/headroom/bench.go`, the `fak headroom bench` verb). fak's value in context-savings is NOT the compressor (anyone can shrink bytes — or bridge an ML compressor) but the GATE deciding WHEN shrinking is worth doing, per result, at the admission boundary. The gate already encoded two "when NOT" rules — it never compresses a result the security gates would quarantine (compressing would HIDE an injection/secret from detection, the load-bearing rule) and every saving is reversible via the CAS (a wrong compress costs one demand-page, never a lost fact). This adds the third: a WORTH-IT floor — a real but marginal saving on a small result is left RAW (the model reads the verbatim bytes, no preserve-write or codec annotation spent), compressing only when the saving clears `>= 256 bytes OR >= 15%` over a 48-byte minimum (env-tunable `FAK_HEADROOM_MIN_BYTES` / `_MIN_SAVED_BYTES` / `_MIN_SAVED_RATIO`; conservative by default since the original is always preserved). The companion `fak headroom bench [--via NAME] [--json]` replays a built-in representative corpus (colorized test output, a `\r` progress bar, scattered warnings, pretty JSON, retry spam, a CRLF log, and an incompressible prose control) and reports the realized per-sample + aggregate savings — the no-model witness of WHERE compression pays (logs/progress large, unique prose ~0), so a headline ratio is never read as a blanket claim. `--dir DIR` / `FILE...` point the same bench at REAL captured tool output (the dogfood path) — measured over 44 real scratch task-output files it saved only 0.1% (most short/unique, the worth-it floor leaving them raw), the honest net-true finding that the win concentrates in large duplicate/colorized/progress output, NOT small command results — evidence for or against a default-on flip, on real data rather than a strawman. Witness: `go test ./internal/headroom` (`TestWorthCompressing`, `TestWorthCompressingTunable`, `TestGateLeavesMarginalSavingRaw`, `TestGateTakesWorthItSaving`, `TestRunBenchNativeSavesAggregate`, `TestRunBenchNoopZero`, `TestBenchRender`, `TestGateDecisionStats`); `go run ./cmd/fak headroom bench`. The gate also records the WHEN-NOT decision breakdown — `considered == compressed + skipped(empty/poison/no-saving/not-worth)` — in its `Stats` and `fak headroom status`, so the governance is auditable, not just the savings (the poison skip is the load-bearing one: a result the security gates would quarantine is never compressed/hidden). ACTIVATION: `fak guard --compress` turns the native compressor on for a local-agent session (equivalent to `FAK_COMPRESSOR=native` for that process; an explicit env value, incl. `noop` to opt out, always wins) — so the whole context-savings stack is reachable by a flag on the flagship `fak guard -- claude` path, not just an obscure env var, while the library default stays OFF (no global behavior change, no broad test churn). Witness: `go test ./cmd/fak -run TestCompressActivates`.

## Answer-shape: the consumer-facing degeneration/verbosity witness

- [SHIPPED] `answershape.Measure` grades the SHAPE of a text — word-n-gram repeat (rep-n), repeated-line-block coverage, and short-period tiling (a graded generalization of the `looksDegenerate`/`dominantPeriod` detector, issue #91), headlined as one `repeat` fraction in [0,1] plus a rune-length budget — and judges it against caller thresholds (`--max-repeat`, `--max-chars`) above a 24-rune floor. It is the GRADED, tunable consumer dual of the context-MMU's conservative write-time repeat-admit rung (`ctxmmu.repeats`): the kernel quarantines only blatant byte-repeat pollution, this catches a loop the kernel's binary gate deliberately admits. Pure, deterministic, stdlib-only (architest tier 1). Witness: `internal/answershape` tests incl. `proofs_witness_test.go` (determinism, threshold-load-bearing, floor-load-bearing, repetition-monotone).
- [SHIPPED] `fak answer-shape` is the consumer WITNESS (reads stdin on `-`, exit 1 when degenerate — a pipeline gate); `fak doctor` wraps it into operator recommendations and cross-checks the real kernel admit verdict on the same bytes (`ctxmmu.ScreenBytes`), the fak analogue of `dos doctor`. Witness: `cmd/fak` `answershape_test.go` / `doctor_test.go` (exit-code + JSON contracts, kernel cross-check).

## Codelint: language-server packs over agent-written code

- [SHIPPED] `codelint` lints CODE the agent produces the way boundarylint lints the repo's own Go source: a `Pack` is one language's source of diagnostics keyed by file extension, and `DefaultRegistry` ships Go + JSON (in-process, via the stdlib parser/decoder) and Python + CUDA (shell out to their toolchains, degrading to no-opinion when absent). It reports only HARD parse/compile errors (zero-false-positive tier — semantic/type checks that need whole-package context are deliberately out of scope). Two deliberate differences from boundarylint, because the input is UNTRUSTED model output: it honors NO in-content ignore comment (the model must not switch the gate off by writing a magic comment), and it runs OFF the hot path (architest's `TestHotPathHasNoExec` keeps the decide path subprocess-free; `codelint` is a foundation leaf, never on it). Witness: `internal/codelint` tests (`TestGoPackReportsParseError`, `TestGoPackIgnoresSemanticErrors`, `TestJSONPackReportsSyntaxError`, `TestParseDiagnosticsGCCStyle`/`MSVCStyle`, `TestPythonPackRealCompile` (presence-gated)).
- [SHIPPED] `fak codelint PATH...` routes each file (or every file under a directory) to the owning pack and exits 1 on a hard error — the write-/definition-time code check at the kernel boundary, the code-content dual of `fak lint`'s tool-registry check. The SWE-bench fleet runs the same packs (`Registry.LintFile`) over every agent file write when `--lint-writes` is set, feeding parse/compile errors back to the model so it self-corrects (off by default, so a benchmark run's behavior is unchanged unless opted in; the write itself always lands — the lint is advisory). Witness: `cmd/fak` build + `internal/swebench` `TestExecToolLintsWriteWhenEnabled` (broken write gets a `GO_PARSE` diagnostic appended, a nil linter and a clean write stay silent).
- [SHIPPED] Write-scoped codelint verdict in the adjudicator (#536): under the opt-in `LintWrites` policy (a `lint_writes` manifest field, off by default so an existing floor is byte-for-byte unchanged), a whole-file write of unparseable Go/JSON is refused with `Deny(MALFORMED)` + a bounded `file:line:col` witness before it lands — the in-kernel dual of the fleet's advisory append. The Go/JSON grammars parse in-process via the stdlib (the adjudicator does NOT import `codelint`, whose Python/CUDA packs shell out — that would put a non-literal `exec.CommandContext` on the request-path closure and break architest's `TestHotPathHasNoExec`/`TestRequestPathInterpreterFree`); languages whose only checkers shell out (Python/CUDA), partial edits, and unlinted languages DEFER (fail open — lint is a quality signal, never a security gate). Witness: `internal/adjudicator` `TestLintWritesDeniesBrokenGoWriteWhenEnabled` (broken Go → Deny/MALFORMED + bounded witness, no content leak), `TestLintWritesAllowsCleanUnlintedAndAbsentChecker` (clean/.txt/.py pass), `TestLintWritesDeniesBrokenJSONWrite`, `TestLintWritesOffByDefaultDoesNotDeny`, `TestLintWritesScopedToWholeFileWritesNotEdits`; manifest round-trip `internal/policy` `TestLintWritesLoadsAndRoundTrips`.

## Session core-dump + context debugger (recall + cdb)

- [SHIPPED] `recall`: a finished session persists as a durable **core image** — `manifest.json` (the page table: roles + digests + a real content descriptor + the quarantine state + a frozen world-version) over `cas.json` (the content-addressed swap device). Reloaded in a FRESH process with its own CAS + a fresh gate; every blob is integrity-checked against its digest address (a tampered swap device fails closed at load). Witness: `recall` tests (green); `RECALL-RESULTS.md`.
- [SHIPPED] The durable moat: a page the gate sealed at write time is refused on page-in across the process boundary unless a witness `Clear()` ran AND the bytes pass a fresh content re-screen — a clearance alone does not launder poison. Witness: `TestQuarantineSurvivesTheSessionBoundary`, `TestClearIsNecessaryButNotSufficient`.
- [SHIPPED] `cdb`: the **context debugger** — `IngestSession` turns a REAL Claude Code transcript into a core image (one page per tool result, driven through the SAME shipped gate, content preserved byte-faithfully); `Attach` binds an inspection surface (Info/Backtrace/Examine/WorkingSet/Grep). A pure consumer of `recall`; registers nothing with the ABI. Witness: `cdb` tests (green); `grep abi.Register internal/cdb` = zero; `CDB-RESULTS.md`.
- [SHIPPED] Demand-paging the working set (Denning): a follow-up is answered by paging in only the pages it references through the gate, reporting residency = bytes-paged-in / resident-bytes. Measured on a real 2.8 MB session: an 18 KB page table over a 1.2 MB swap device (66× decomposition); two follow-ups demand-paged 6.18% and 1.83% of the 0.96 MB resident image. Witness: `TestWorkingSetIsASmallResidentSlice`; `fak debug --session …`.
- [SHIPPED] Agent/requester initiated context tombstones: `recall.Session.RequestContextChange` accepts a negative-only request to suppress a page from future model-visible `Resolve`/`Recall`/`cdb.WorkingSet` without deleting the CAS bytes or mutating the original page row; `fak debug --cmd tombstone`, HTTP `POST /v1/fak/context/change`, and MCP `fak_context_change` persist the same ledger row on a core image. This gives RSI/self-audit a way to say "do not put that memory back in my context" while preserving audit evidence. Witness: `TestContextChangeTombstoneSuppressesRecallButKeepsAuditBytes`, `TestContextChangeTombstonePersistsAcrossReload`, `TestWorkingSetSkipsAgentTombstonedPage`, `TestCmdDebugTombstonePersists`, `TestContextChangeTombstonesRecallImageOverHTTPAndMCP`.
- [SHIPPED] ECC-style metadata integrity for recall cells (#783/#785, epic #782): the CAS already self-verifies a page's BODY (a blob must hash to its key or load fails closed), but the page table carries integrity-critical METADATA the body digest does not cover — `Quarantined`/`QID`/`Taint`/`Digest`/`Len` — whose silent flip (e.g. `Quarantined` true→false to release a sealed page) would sail past the body check. `recall.computeSyndrome` binds that subset into a per-page check word stamped on `Page.Syndrome` at persist time, and `ClassifyFault(page, body)` → `FaultClass` is the syndrome read: `FaultClean` (check agrees, body present), `FaultRepairable` (body authoritative but metadata disagrees — re-derivable, the ECC single-error case), `FaultErasure` (body gone/rotted — uncorrectable locally, needs quarantine/tombstone/refuse), `FaultUnchecked` (a pre-rung page with no syndrome — honest absence of evidence, never a false fault). `Session.Verify()` is the read-only scrub classifier over a whole image. Default-neutral by `omitempty` (a pre-rung manifest is byte-identical). This is a corruption/tamper-EVIDENCE syndrome, NOT a Hamming code and NOT a secret-keyed MAC (a local image on the operator's disk makes no confidentiality claim). Witness: `go test ./internal/recall -run 'Syndrome|ClassifyFault|FaultClass|Verify'` (`TestSyndrome_CatchesEachIntegrityField`, `TestClassifyFault`, `TestVerify_EndToEnd`, `TestSyndrome_DefaultNeutral`); `docs/MEMORY-ECC-INTEGRITY.md`.
- [STUB] The off-path **patrol scrub** driver over persisted recall/sessionimage images (#784) and the **cross-witness/cross-agent parity** disagreement check before reuse (#786) are the named follow-on rungs of epic #782: `Session.Verify()` is the classifier the scrub consumes, and `Page.Witness`/`Page.TrustEpoch` are the per-page substrate the parity check would read, but neither the offline scrub loop nor the disagreement comparator is wired yet.
- [SHIPPED] Inherited detection ceiling, surfaced not hidden: the same real-session run sealed 2 of 59 pages — two large base64 image renders flagged `SECRET_EXFIL`, FALSE POSITIVES (the documented `≈100% evadable + FP-prone on our own context` ceiling). `cdb` makes the gate's decision durable/queryable; it does not improve the decision. Witness: `fak debug --session <real>` `info.sealed==2` on benign images.

## Portable session image + uniform dump/restore (session.Restore + sessionimage + snapshot)

- [SHIPPED] `session.Table.Restore`: the durable-resume write — load a full drive `State` VERBATIM (Rev preserved, a terminal session restored terminal, never silently revived as Running), the load-time inverse of `Snapshot`. This closes the SESSION-CONTROL-STATE §5 "no persistence yet" fence: a session re-homed to another host/instance resumes at the budget/priority/run-state it held, not a default. Witness: `go test ./internal/session` (`TestRestoreRoundTripsSnapshotVerbatim`, `TestRestoreReestablishesTerminalSession`, `TestRestoreForcesTraceKey`).
- [SHIPPED] Served-session long-context reset budget: `session.Budget.ContextTokensLeft` is debited from provider-normalized prompt/context usage (`prompt_tokens` plus Anthropic cache read/create counters), exhaustion moves the session to Draining, mints a deterministic `continuation_id`, and the gateway either returns `409` with `reset.action=restart_fresh_session` plus required dump/rehydrate actions, with `--reset-on-budget` distills a carryover seed and transparently re-arms the continuation trace with a fresh context budget, or with `fak guard --restart-on-budget` notifies the guard supervisor after the served turn so it recontinues the session, writes a seed JSON handoff, advances omitted-header callers to the continuation trace, and relaunches the child with `FAK_RESET_TRACE_ID` / `FAK_SESSION_ID` / `FAK_RESET_SEED_FILE`. `fak serve --session-id ID --context-budget-tokens N [--reset-on-budget]`, `fak guard --context-budget-tokens N [--reset-on-budget|--restart-on-budget]`, and `fak session budget --context-tokens N` expose the control surface; `guard` supplies a stable default trace id for clients that omit `X-Trace-Id`. MCP `fak_session_reset` exposes the cooperative variant for clients/wrappers that can report `context_tokens` and a transcript: it debits the budget, accepts only a budget-drained session, then returns the fresh continuation trace plus `seed_messages`. Honest fence: a generic relaunched child that ignores `FAK_RESET_SEED_FILE` starts under the fresh trace but does not automatically ingest the carryover seed. Witness: `go test ./internal/session ./internal/gateway ./cmd/fak -run "TestContextBudget|TestSessionContextBudget|TestTraceForUsesConfiguredDefaultTrace|TestSetDefaultTraceIDAdvancesOmittedCallerTrace|TestBudgetExhaustedCallbackReceivesServedTranscript|TestSessionCLIContextBudget|TestDebitSessionHookDebitsContextBudget|TestResetOnBudgetContinuesTransparently|TestResetServedSessionOnBudgetRecontinuesWithCarryover|TestMCPSessionResetDebitsAndRearmsContinuation|TestGuardBudgetRestarterRecontinuesAndEmitsSeed|TestBuildGuardChildIncludesRestartEnv|TestGuardRestartSeedFileAndEnv"`.
- [SHIPPED] `sessionimage`: a portable, versioned, **model-agnostic** SESSION image — composes the drive (`session.json`), the recall core image (`manifest.json`+`cas.json`+`index.json`), and the trajectory (`trajectory.jsonl`) into one bundle with a sha256 integrity index over every part, plus a deterministic single-file `.faksession` tar (`Pack`/`Unpack`, stdlib `archive/tar`, zero deps) for offload/archive across hosts, users, instances, and VMs. `Rehydrate` re-attaches the drive into a fresh table, reloads the gate-armed recall `Session` + ctxplan index, and logs a model/host `Migration`. Model-agnostic by design: it carries logical content only — no KV cache, no token ids — so a restore re-prefills on a DIFFERENT model. Witness: `go test ./internal/sessionimage` (`TestDumpLoadRoundTrip`, `TestTerminalSessionResumesStopped`, `TestPackIsDeterministic`, `TestRehydrateInPlaceRecordsNoMigration`, `TestDriveOnlyImage`).
- [SHIPPED] The recall moat survives the OFFLOAD boundary: a page the gate sealed stays SEALED after the image is packed to a `.faksession`, shipped, unpacked into a fresh directory, and reloaded under a different model — and a witness `Clear()` still does not launder it (the content re-screen holds); a flipped byte fails the integrity check closed; a path-traversal tar entry is refused. Witness: `go test ./internal/sessionimage` (`TestPackUnpackPreservesQuarantineAcrossBoundary`, `TestLoadDirFailsClosedOnTamper`, `TestUnpackRejectsPathTraversal`).
- [SHIPPED] `snapshot`: a UNIFORM dump/restore seam over any primitive on the loops ladder (turn → tool → session → fleet → rsi) — a sha256-integrity envelope (`Marshal`/`Parse`/`Into` over any JSON body, digest over the canonical-compacted bytes so a pretty-print round-trip stays verified and a content change fails closed) + a ladder registry (kind/level/desc) + typed codecs for the TURN level (a trajectory's `Turn` rows) and the FLEET level (a `session.Table`'s whole-fleet drive snapshot, restored verbatim via `session.Table.Restore`). The SESSION level has the richer multi-part `sessionimage`; rsi/tool ride the generic seam directly (`Marshal` over any body). Witness: `go test ./internal/snapshot` (`TestGenericRoundTripAnyBody`, `TestParseFailsClosedOnTamper`, `TestFleetRoundTripViaRestore`, `TestTraceRoundTrip`, `TestRegistryLadder`).
- [SHIPPED] The RESUME-CACHE decision is a first-class, deterministic, observable verb — the priced answer to "I am resuming a 250k-token session, what happens to the prompt cache?" `internal/resume.Plan(Input) Report` projects the cache POSTURE at the resume boundary (COLD when idle ≥ the cache TTL, so the provider prefix has aged out and the first turn re-prefills the whole transcript at the WRITE premium; WARM within the TTL; UNKNOWN when idle is unsupplied), prices RESUME_FULL / CUT / RESET (cold-reprefill, first-turn, and horizon cost each, at a caller-supplied base price), and recommends a CUT-by-default re-entry with a closed reason — keeping the prefix WARM (`warm_prefix_intact`) unless the horizon repays the burst (the cut-vs-keep break-even reproduces `docs/explainers/long-sessions-keep-the-cache-hit.md` exactly: dropping 20k cached tokens against a 40k warm suffix repays in 23 turns), never shedding on a guess (`unknown_idle`). Pure tier-1 leaf, stdlib-only; `fak resume plan [--resident-tokens N --idle-seconds S --ttl 5m|1h ...] [--image DIR | --transcript FILE.jsonl] [--json]` is the observable surface — `--transcript` grounds it on a REAL Claude Code session (resident = the last assistant turn's prompt size = `input + cache_read + cache_creation` tokens; idle from the last record's timestamp), the deterministic counterpart of `claude --resume`; `--image` grounds it on a portable session image's trajectory + timestamp. Honest fence: the posture and every dollar are a PROJECTION over idle-time and the resident-token count, never a fak-witnessed bill (the same OBSERVED-vs-WITNESSED discipline `gateway/cache_pricing.go` keeps); auto-firing the plan on a live `fak guard`/`serve` resume is the named follow-on. Witness: `go test ./internal/resume ./cmd/fak -run "TestHeadline250kColdResume|TestWarmResume|TestUnknownIdle|TestBreakEvenMatchesExplainer|TestResumePlan"`; `fak resume plan --resident-tokens 250000 --idle-seconds 7200` ⇒ `posture=COLD`, `recommended: CUT`; `fak resume plan --transcript <claude.jsonl>` derives the resident size from the real session.
- [SHIPPED] The resume-cache projection is now BACK-TESTED against billed reality, not just asserted — the validation rung that precedes the live-wiring follow-on. `internal/resume.Backtest([]ObservedTurn, ttl, band) BacktestReport` is a pure tier-1 leaf that scores the posture PROJECTION against the provider's OWN per-turn usage records: for each adjacent assistant-turn pair it compares the projected posture (`idle ≥ TTL ⇒ cold`, the exact call `Plan` makes) against the OBSERVED posture — the prior-prefix RECOVERY (`cache_read` on the later turn ÷ the earlier turn's prompt size), the content-free signal of whether the provider actually still served the prefix — and on confirmed-cold boundaries measures how completely the prompt was re-written (`cache_creation ÷ prompt`). `fak resume validate --corpus DIR [--ttl 5m|1h] [--max-files N] [--json]` is the observable surface: it scans real Claude Code transcripts (token counts + timestamps only, no content) and emits the residual. Findings on this box's real history (~82,483 scored adjacent-turn boundaries across three account namespaces): **97.7% posture-prediction accuracy**; the cold-cost premise holds EXACTLY where cold boundaries occur (`cache_creation ÷ prompt = 1.00` on the confirmed-cold turns — a cold first turn re-prefills essentially the whole resident, validating `Plan`'s RESUME_FULL cost model); and the dominant error is a CONSERVATIVE bias — the projection calls COLD while the provider prefix is still WARM in the 5–15 min band (Anthropic's 5-minute ephemeral TTL is a documented FLOOR refreshed on access, so real reuse runs longer than the cutoff). A CROSS-FILE instrument now covers the case within-file gaps miss: a genuine multi-hour resume starts a NEW transcript file whose FIRST assistant turn re-prefills the carried transcript — `Backtest` classifies every large (≥20k) first turn as a cold re-prefill or a cross-SESSION warm hit. Over the same history: ~960 large first-turn resumes, hundreds confirmed COLD (vs the 5 within-file boundaries — a far thicker cold sample) and hundreds cross-session WARM hits (the prior session's prefix was still provider-warm on re-open, a reuse `Plan`'s within-session model does not even price). The refined cold-cost finding: on those genuine resumes `cache_creation ÷ prompt ≈ 0.68`, not 1.0 — a resume re-caches only ~two-thirds of the transcript and sends the rest as plain input, so `Plan`'s RESUME_FULL (which prices the WHOLE resident at the write premium) OVER-states the cold cost by the ~⅓ billed at base. Honest fences: (1) the cross-session warm-hit reuse is COUNTED but not yet priced into the plan, and the cold cutoff is still the 5-minute floor — folding the measured effective-TTL + the 0.68 write share back into `Plan` is the named calibration follow-on. (2) This is still a PROJECTION-vs-OBSERVED back-test over historical usage, not a plan auto-fired on a live `fak guard`/`serve` resume (that live-wiring remains the other named follow-on). Witness: `go test ./internal/resume -run Backtest`, `go test ./cmd/fak -run ResumeValidate`; `fak resume validate --corpus ~/.claude/projects` ⇒ a posture-accuracy table, the confirmed-cold cost ratio, and the cross-file resume re-prefill breakdown over the operator's own sessions.

## In-kernel agent-to-agent message channel (`a2achan`)

- [SHIPPED] `a2achan`: the first in-kernel primitive that DELIVERS an addressed value from one agent to a DIFFERENT one, gated by the same default-deny floor that gates a tool call. A process-global, Ref-backed mailbox (`Bus`): `Send`/`Recv` (point-to-point) and `Publish`/`Subscribe` (one-to-many fan-out) ride a REGISTERED `a2aGate` adjudicator (the message capability floor) + `a2aIngress` result-admitter (the recv-time quarantine screen), so the floor lives in the same kernel registries every tool call folds — not a side library. Fail-closed by construction: a send without the negotiated `CapA2ASend` is `Deny(DEFAULT_DENY)`; a `ScopeAgent` (private) body crossing to another agent's channel is `Deny(TRUST_VIOLATION)` (widen `Scope` to share); a `TaintQuarantined` body is refused at send and HELD on ingress; a delivered body keeps its taint. ctx-aware blocking `Recv` gives async rendezvous between concurrent in-kernel agents (race-clean). Zero ABI edits; registers NO engine (avoids the `abi.Engine("")` lowest-id default hazard). Witness: `go test -race ./internal/a2achan` (`TestDeterministicDelivery`, `TestFailClosedDefault`, `TestScopeTaintEnforcement`, `TestAsyncRendezvous`, `TestRecvTimeoutNoLoss`, `TestRegisteredFloorInKernelChain`, `TestPubSubFanout`); `go run ./cmd/a2ademo` (no-key proof, exit 0). See `docs/a2a-in-kernel-channel.md`.
- [SHIPPED] One `ChannelKey{Locale,ID}` shape bridges three locales keyed differently: `InKernel` (a rendezvous within one process — concurrent goroutine-agents), `Session` (a peer `TraceID` — cross-session handoff), `Window` (a continuation id — an explicit, adjudicated handoff across a context-window compaction). Witness: `TestScopeTaintEnforcement` (Window self-handoff); `cmd/a2ademo` legs [3] session + [4] window.
- [STUB] DURABLE cross-process delivery — a session-image-backed mailbox so a Session/Window message survives a process boundary, plus an automatic child-process relaunch supervisor that consumes the shipped reset directive — is the named next rung; the in-process locales and continuation-id minting are real today. The fleet-level A2A HTTP edge (`tools/fleet_agent_link.py`, `docs/a2a-value-opportunities.md`) is the OUT-OF-kernel projection of this substrate, not a duplicate. Routing `Send`/`Recv` as true kernel syscalls awaits wiring the registered-but-dormant `abi` Op table (`LookupOp` is never called on the hot path today).

## Shared task record fold

- [SHIPPED] `internal/sharedtask` is the in-memory reference fold for the shared task record contract: a `Store` accepts a materialized task, applies user/agent patches against a base revision, advances the record and emits event rows on accepted edits, auto-merges stale append-only open-decision and ref-backed note writes, resolves human/user-level decision edits through `replace /open_decisions/<decision_id>/state`, admits `replace /title` and `replace /body_ref` updates on the current base, returns typed conflicts for stale non-commuting writes, and returns stable-revision `needs_approval` / `denied` / `quarantined` patch results with the adapter body needed to render the next action. Accepted event rows can be serialized to `abi.Ref` and published on a per-task `a2achan` topic (`EventTopic`/`PublishEvent`), so collaborators can observe live updates through the existing capability-floored pub/sub path; `ApplyAndPublish` folds a patch and publishes only the generated accepted event, while held/refused verdicts do not publish. Disaggregated artifact refs (`store != "local-cas"`), external note body refs, and external task body refs are admitted only when the ref is digest-shaped and carries a deletion certificate; missing witnesses or malformed refs are quarantined without advancing the record. It is off the request path and is not a durable/networked task service. Witness: `go test ./internal/sharedtask` (`TestAcceptedPatchAdvancesRecordAndEmitsEvent`, `TestReplaceTitleAdvancesRecordAndEmitsEvent`, `TestStaleReplaceTitleReturnsConflictValue`, `TestStaleAppendOpenDecisionAutoMerges`, `TestResolveOpenDecisionAdvancesRecord`, `TestDisaggregatedArtifactMissingDeletionWitnessIsHeld`, `TestReplaceBodyRefWithDeletionWitnessIsAccepted`, `TestPublishEventFansOutAcceptedEvent`, `TestPublishEventDoesNotPublishHeldVerdict`, `TestAcceptedStoreEventPublishesToLiveSubscribers`, `TestApplyAndPublishAcceptedPatchFansOut`, `TestApplyAndPublishHeldPatchDoesNotPublish`).
- [SHIPPED] `internal/sharedtask.View` and `EventsView` are the scoped read projections for shared task adapters: `View` returns a task snapshot for a reader scope, filters wider-scope or quarantined note refs, reports redaction counts, and leaves the stored record unchanged; `EventsView` applies the same reader max-scope boundary to historical event catch-up so a tenant-scoped event row does not appear in a fleet-scoped event log. This is a read projection, not a new authorization system or protocol adapter. Witness: `go test ./internal/sharedtask` (`TestViewFiltersNotesOutsideReaderScope`, `TestEventsViewFiltersEventsOutsideReaderScope`).
- [SHIPPED] `internal/sharedtask` has in-process live reader handshakes for shared task adapters: `SubscribeView` keeps the raw task-topic subscription plus current scoped `TaskView`, while `ScopedEventTopic` / `PublishEventScoped` / `ApplyAndPublishScoped` / `SubscribeScopedView` partition future accepted event rows by reader max-scope, so a tenant-scoped event does not land in a fleet-scoped inbox; missing tasks cancel the subscription, and private/quarantined event bodies are still refused by the `a2achan` floor. This is live in-process collaboration plumbing, not durable cross-process delivery. Witness: `go test ./internal/sharedtask` (`TestSubscribeViewReturnsScopedSnapshotAndFutureEvents`, `TestSubscribeViewMissingTaskCancelsSubscription`, `TestPublishEventScopedFiltersReaderTopics`, `TestPublishEventScopedRefusesPrivateOrQuarantinedBody`, `TestApplyAndPublishScopedUsesReaderScopeTopics`, `TestSubscribeScopedViewMissingTaskCancelsSubscription`).
- [SHIPPED] `internal/sharedtask` has a portable materialized journal for one task: `Store.Journal` exports the initial record plus each accepted event paired with the post-event record snapshot, `Journal.Verify` checks schema/task/rev/event-chain/digest integrity, and `LoadJournal` restores current state and accepted events into a fresh store. This is snapshot-based replay, not a claim that raw event rows alone rebuild state, and it is not a hosted durable task service. Witness: `go test ./internal/sharedtask` (`TestJournalRoundTripRestoresCurrentRecordAndEvents`).
- [SHIPPED] The shared task contract has executable docs and fixtures: `tools/shared_task_contract.py` validates JSON examples in `docs/shared-task-record-contract.md`, validates the mixed fixture lifecycle in `examples/shared-task-record/`, and validates non-acceptance collaboration verdict bodies in `examples/shared-task-record-verdicts/`. Witness: `python tools/shared_task_contract_test.py`; `python tools/shared_task_contract.py validate-doc docs/shared-task-record-contract.md`; `python tools/shared_task_contract.py validate-sequence examples/shared-task-record`; `python tools/shared_task_contract.py validate-verdicts examples/shared-task-record-verdicts`.

## Trajectory observability primitives (data plane + reference similarity + scorer seam)

- [SHIPPED] Trajectory data plane (`internal/trajectory`): a typed, exportable per-turn `Turn` record (trace, seq, query, tool, verdict, taint, digests, token/byte cost, optional embedding) folded from the kernel's lifecycle stream. A `Recorder` is an `abi.Emitter` — it reads the human query + per-turn cost from the OPEN `abi.Event.Fields` / `ToolCall.Meta` channels the producer stamps, so it adds NO field to the frozen ABI. Off by default; opt-in via `FAK_TRAJECTORY=1` (+ `FAK_TRAJECTORY_EMBED=1` to stamp query vectors) or `trajectory.Enable`, mirroring the audit journal's enablement seam. JSONL export round-trips through `ExportTo`/`ImportFrom`. Distinct from `internal/journal` by design: the journal is the tamper-evident audit ledger (a verdict over a digest), this is the analysis surface (the query text, the cost, the embedding). Witness: `go test ./internal/trajectory` (`TestRecorderFoldsTrace`, `TestFieldsEnrichment`, `TestExportImportRoundTrip`, `TestIndexSimilarity`).
- [SHIPPED] Reference vector-similarity primitive (`internal/simhash`): a deterministic, dependency-free `Embed`/`Cosine`/`Index.TopK` over hashed word+char n-grams — the substrate for finding near-duplicate "bad" queries the lexical token-overlap ranker (`internal/contextq`) misses. Honest ceiling, measured: shared-vocabulary paraphrases score ~0.70–0.78, but same-intent/different-vocabulary pairs ("delete every row" vs "drop all records") score ~0.35; it is a hashing-trick sketch, NOT a learned model, and the `Index` is model-agnostic so a deployment swaps in real `[]float32` embeddings through the same machinery. Tier-1 foundation leaf (imports nothing internal). Witness: `go test ./internal/simhash` (`TestEmbedDeterministic`, `TestNearDuplicateRanksAboveUnrelated`, `TestIndexTopK`).
- [SHIPPED] Pluggable trajectory-scorer seam (`internal/trajhook`): a `Registry` of named `Turn → Finding` scorers application code attaches WITHOUT a core edit — the analysis-layer analogue of `abi.RegisterEmitter`, with no ABI involved. Three reference scorers ship as worked examples (`duplicate_query` via simhash, `cost_outlier`, `high_deny_rate`); they are examples, not a hard-coded classifier. Surfaced as `fak traj similar|cluster|score|gc|export` over an exported corpus (`gc` PROPOSES prune candidates, never deletes). End-to-end proven on the shipped demo corpus (`examples/trajectory/sample-corpus.jsonl`) by the `trajectory-garden` skill. Witness: `go test ./internal/trajhook` (`TestDuplicateQueryFlagsParaphrase`, `TestDenyRate`, `TestSampleCorpusGardening`, `TestSampleCorpusGCProposes`); see `docs/observability/trajectory.md`.
- [SHIPPED] Continuous-dogfood cache-value ledger + #1066-honest regression gate (#1075): `internal/cachevalueledger` provides a durable, append-only JSONL ledger for cache-value observations from fak sessions (run/guard/serve), appended automatically on session exit in `cmd/fak/serve.go`, `run_model.go`, and `guard.go`. Each row records a session's cacheobs snapshot (turns, prompt_tokens, reused_tokens, frozen/partial/cold turns). `fak nightrun score` reports the **WITNESSED realized KV-prefix reuse ratio over multi-turn sessions** (turns ≥ 2 — cold single-turn `fak run`s have no reuse opportunity and are excluded, never a false regression) and gates it against a reuse-ratio floor (`--floor`, default 0.5). Per the `internal/cachewitness` #1066 fence it NEVER surfaces the vs-naive re-prefill multiple (`1/(1-reuse)`); the honest single-session cache value is marginal-over-tuned-warm-KV ≈ 1.0×. On a thin corpus (< `MinGateTurns` multi-turn turns) it reports **INSUFFICIENT and passes** rather than fabricating a verdict. `fak nightrun post-cache-value` posts the realized reuse % under `kv-prefix-realized-reuse`, not a multiple. Witness: `go test ./internal/cachevalueledger` (`TestScoreLedger`, `TestScoreLedgerExcludesSingleTurnColdRuns`, `TestScoreLedgerThinCorpusIsInsufficient`); `fak nightrun score` over the real `docs/nightrun/cache-value.jsonl` prints the realized reuse ratio + regime buckets and exits honestly. (The legacy Python `tools/cache_value_ledger.py --check` scores the synthetic `fak vcache score` FORECAST, not this realized ledger, and is superseded by the Go gate.)
- [SHIPPED] Cache-value roll-up front door (#1308): `docs/cache-value-rollup.md` is the reader-facing cache-effectiveness P&L map. It explains why the signal was scattered, keeps Track 1 WITNESSED kernel reuse separate from Track 2 OBSERVED provider-dollar savings, states the #1066 marginal-over-warm-KV / WITNESSED-vs-OBSERVED / net-not-gross fences, names how to read the Slack-card fields, and gives the shipped Track-1 reproduce command (`fak nightrun score --json`) without claiming the future `fak cachevalue report --since` spelling on builds that do not expose it yet. Linked from `README.md` and `llms.txt`; `llms-full.txt` is regenerated from the same map. Witness: `go test ./internal/cachevaluereport`; `python tools/gen_llms_full.py --check`; `make claims-lint`.

## Task manager snapshot

- [SHIPPED] Process-local task manager (`internal/taskmgr`): a stdlib-only `Manager` records running tasks and steps, samples the current process' Go runtime resource state (wall seconds, runtime CPU seconds when exposed, heap/sys memory, goroutines), reports per-task/per-step resource deltas, aggregates step runtime by concept bucket, and emits ETA only when a running task or step has positive progress against a known total. `fak task sample` exposes the same JSON snapshot shape for the current command process. Honest fence: this is not a durable scheduler, cross-PID monitor, or fleet oracle; it is the embeddable in-process reference fold. Witness: `go test ./internal/taskmgr`; `go test ./cmd/fak -run TestTask`; `go test ./internal/architest -run TestEveryPackageDeclaresTier`.

## S7 write-time durability gate (context is not memory)

- [SHIPPED] Rung-1 write-time durability classifier: `ctxmmu.classifyDurability` assigns a benign result a class from a cheap lexical/tense prior (punctual deictics + bare clock times ⇒ `turn`; habitual/stative frames ⇒ `durable`; a session-scoped frame ⇒ `session`; unmatched ⇒ fail-closed `turn`) — NOT a model call, NOT the Zhang-Choi fact-duration estimator. `MMU.Admit` stamps the class on the OPEN `Verdict.Meta["durability"]` map, orthogonal to the trust `Kind`. Witness: `go test ./internal/ctxmmu` (`TestClassifyDurabilityViaAdmit`, `TestDurabilityTagIsAdditiveOnTransform`, `TestQuarantineCarriesNoDurability`).
- [SHIPPED] Zero ABI / golden-freeze cost: the durability tag rides the additive `Meta` map, so the frozen ABI does not move. Witness: `TestABIGoldenFreeze` green over `internal/abi/testdata/abi_v0.1.golden` with the tag stamped.
- [SHIPPED] Rung-1 default-expire promotion gate: `recall.Page` carries a `Durability` field, and a `PromotionMode` gates promotion into the persisted core image — the headline inversion as a code gate, only a `durable`-classed benign fact crosses the durable boundary (under `PromotionEnforce` a `turn`/`session`/unknown page never reaches `manifest.json`/`cas.json`, so it cannot be recalled in a later process). This closes the **benign** over-promotion arm of OWASP Memory-Poisoning T1 — an ephemeral observation no longer silently becomes a persistent bias. It is NOT the adversarial-T1 floor: the durability classifier is a lexical prior, so durable-framed poison still classifies `durable`; the adversarial arm is held by the trust/quarantine gate (itself ~100% evadable, deliberately non-load-bearing — see the security-substrate ceiling). The reader fails closed to `turn` for a missing/unknown/reserved (`bounded`) class. Witness: `go test ./internal/recall` (`TestDurabilityPromotionGateBite` — `3pm→turn→refused` / `prefers-afternoon→durable→promoted` end to end; `TestPromotionClassFailsClosed`).
- [SHIPPED] Two-commit honesty split realized as a posture: `PromotionWarn` (the default) is non-behavior-changing — it stamps the class and counts the would-refuse (`Recorder.RefusedPromotions`) but still persists — so every production `recall.Recorder` caller (`internal/cdb/ingest.go`, plus the recall round-trip tests) stays green and is auditable before the boundary bites; `PromotionEnforce` is opt-in via `WithPromotion`. Witness: the WARN sub-case of `TestDurabilityPromotionGateBite` (page still persists with `Durability` stamped).
- [SHIPPED] Durability-tiered L3 promotion — the SAME default-expire gate re-pointed at a real multi-tier store (G6 / child C of the L3 epic; #76, study `docs/notes/L3-DISAGGREGATED-CACHE-REIMAGINED.md` §3 G6 + §4): `l3region.L3PromotionGate.Admit` decides admit/deny-to-L3 from a page's write-time `Meta["durability"]` class with a typed reason (`L3Reason`: admitted / denied_below_floor / denied_unknown), a configurable floor (default `bounded`+`durable` admitted, `turn`+`session` denied), and the same `PromotionWarn`/`PromotionEnforce` rollout. This converts CAMA's frequency-based admission (W-TinyLFU/SIEVE) into a truth-duration one: `l3region.L3RegionBackend.PutGated` admits a page to the shared L3 pool ONLY if its class is at/above the floor, so under `L3PromotionEnforce` a hot `turn`-class page is denied even at high access frequency (0 msets reach the store) while a `durable` page is admitted on its first write and round-trips bit-exact. Control-path only (gates `set` admission, not the data path); fails closed on a missing/unknown class. Layering: `l3region` is tier 1 so it cannot import `ctxmmu` (tier 2) — the durability vocabulary is mirrored locally and a drift guard pins it to the source. Witness: `go test ./internal/l3region` (`TestL3PromotionGateBite` — hot-turn-denied / durable-admitted-on-first-write; `TestL3PromotionFailsClosed`, `TestL3PromotionWarnIsNonBehaviorChanging`, `TestL3PromotionConfigurableFloor`, `TestL3DurabilityVocabularyMatchesCtxmmu`).
- [STUB] Rung-2 bitemporal: `recall.Page` validity interval (`ValidFrom`/`ValidTo`) + an as-of read gate (`ErrExpired`) that makes `bounded` the first temporally-enforced class (the Zep/Graphiti + SQL:2011 spine). Tracked: #81.
- [STUB] Rung-3 engine-integrated TTL: `kvmmu.Segment` TTL + `Context.Expire` over the bit-exact `model.KVCache.Evict`, so a turn/session span is forgotten on a clock the fact itself sets — bit-identical to never-having-seen-it for spans no later token attended (mid-context expiry is a coherent compaction, not never-saw). Tracked: #80.
- [STUB] Dream-time durability consolidation (principled sleep-time promotion) over the rung-1 class signal. Tracked under the S7 epic #82; live child remap still needed.

## In-kernel model (the model fused into the kernel)

- [SHIPPED] A pure-Go SmolLM2-135M forward pass (134.5M params / 272 tensors) runs in-process with the **KV cache as a kernel-owned Go structure**; every rung is proven against a HuggingFace oracle — embedding exact, per-layer cos=1.000000, final-logits max|Δ|≈4.4e-5, KV-decode and KV-quarantine-evict token-for-token identical (max|Δ|=0). Witness: `go test ./internal/model` (oracle argmax-exact); `IN-KERNEL-MODEL-RESULTS.md`. Prior art: the kernel owning its KV cache for provable eviction (vs RadixAttention's LRU).
- [SHIPPED] Native paged KV opt-in path (#34): `internal/model.PagedKVPool` carries fixed-size physical blocks, a per-sequence block table, a free list, copy-on-write fork, `Reserve`/`Clone`/`CloneWithReserve`, the 3-plane K/Kraw/V exact-span `Evict`, and an opt-in `FAK_PAGED_KV=1` CPU-reference HAL store whose `KeysView`/`ValuesView` feed paged gathers through `compute.Backend.Attention`; the default direct `KVCache` path stays unchanged. GLM-DSA's different K/V/index row geometry is covered by `pagedGLMDsaKVCache`, which snapshots the separate attention/index cache into paged row blocks and proves middle-span Evict matches the contiguous GLM cache bit-for-bit. Witness: `go test ./internal/model -run Paged` and `go test ./internal/compute -run "Attention|KV|Evict"` under WSL. Honest fences: this is a host-gather/reference-HAL path, not a device-side paged-attention kernel; hybrid recurrent sub-caches and radixkv block sharing remain follow-ons.
- [SHIPPED] Native scheduler KV preemption under paged-block pressure (#31): `modelengine.NativeScheduler` is opt-in armed by `FAK_NATIVE_KV_MAX_BLOCKS` / `SetKVPreemptionPolicy`; with no positive block budget it preserves the old contiguous-cache behavior and never preempts. When the live block estimate exceeds the budget, it deterministically preempts the most-recently-admitted running lane, keeps that lane's token stream open, frees its KV-bearing session, and later readmits preempted lanes before fresh waiting work. Swap mode snapshots the victim's real dense `KVCache` into `PagedKV`, serializes host bytes with `SwapToHost`, restores through `RestoreFromHost`/`ToKVCache`, and resumes from the saved logits; recompute mode drops KV and re-prefills `prompt+generated` on readmit. Counters are exposed through `KVPreemptionStats` and the shared `fak_sched_preempt_*` metrics fragment when a host attaches the preemptor. Witness: `go test ./internal/model ./internal/modelengine ./internal/gateway` under WSL, covering exhaustion-triggered preempt, swap and recompute bit-identical token streams, generated-lane readmit, the no-budget dependency gate, env policy parsing, and /metrics rendering. Honest fences: this is the native dense-softmax scheduler path over the host-gather paged allocator, not a device-side paged-attention kernel, a fleet-wide KV tier, or a throughput parity claim.
- [SHIPPED] GPTQ resident CPU path (issue #300 / A-002): `model.LoadGPTQ` parses AutoGPTQ/GPTQModel safetensors directories (single-file or sharded index) into resident 4-bit or 8-bit `qweight`/`qzeros`/`scales` tensors, honors optional `g_idx` activation-order groups, keeps embeddings/norms/biases in the f32 manifest, and routes opt-in `Session.GPTQ` decode/prefill through the shared resident matmul skeleton (`residentMatRows`) with GPTQ GEMV for quantized projection/head weights and f32 for small tensors. The loader accepts the Llama/Mistral-shaped projection names the existing in-kernel session already runs. Honest fences: this is CPU-resident weight-only GPTQ support; it does not claim a native packed GPTQ CUDA kernel, a measured "within 2x llama.cpp GPTQ" throughput result, or real-checkpoint HuggingFace/llama.cpp oracle parity on this build box. Witness: `go test ./internal/model -run TestGPTQ` (`TestGPTQDequantAndMatRows4BitAnd8Bit`, `TestGPTQGIdxSelectsScaleGroup`, `TestLoadGPTQSafetensorsRoundTripAndResidentDispatch`, `TestGPTQSessionUsesResidentHead`, `TestGPTQSessionArgmaxExactAgainstDequantizedF32`).
- [SHIPPED] Multi-node compute is runnable, not just loopback-tested: `fak cluster` runs a real cross-NODE collective (AllReduceSum / AllGather) over the `model.DistComm` coordinator-rooted process group on any two CPU hosts — `fak cluster coordinator --listen 0.0.0.0:PORT --size N --vec ...` on one box and `fak cluster worker --coord HOST:PORT --rank R --size N --vec ...` on each other, every rank holding ONLY its own part while the sum/concat is computed across the TCP wire (both nodes print the same result). It promotes the previously test-only `DistComm` into an operable command, and `fak cluster selftest` asserts the SAME path is bit-exact vs the in-process `LocalCollective` over loopback (max|Δ|=0, sizes 1..4) — the hardware-free witness an operator runs before a two-node launch. Honest fence: this is a cross-process / cross-node collective over HOST float32; it is NOT multi-GPU and NOT NCCL. The device-tensor collective (a non-cpu-ref `compute.CollectiveBackend` over NCCL/RCCL) is the separate GPU-gated rung, and live ForwardTP-across-processes, the band-running pipeline worker, and the KV→bytes byte mover are the named next rungs (docs/serving/multi-node-compute.md; #652, #639, #85, #30, #29, #25). Witness: `go test ./cmd/fak -run TestCluster` (`TestClusterSelftestPasses`, `TestRunLoopbackGroupAllReduce`, `TestRunLoopbackGroupRaggedFailsClosed`, the vec/width parsing gates) + the cross-process witnesses `go test ./internal/model -run 'DistComm|Pipeline|TP'`.
- [SHIPPED] Governed multimodal input seam (#399): `model.ForwardMultimodal` runs an ordered text+image prompt by splicing externally-produced CLIP/LLaVA-style vision embeddings into the same hidden-state sequence the text `Forward` uses, behind `MultimodalPolicy{Mode: "quarantine"}`. The zero policy is fail-closed: text-only requests are bit-identical to `Forward`, but any image-bearing request is quarantined out of the model until explicit quarantine-mode opt-in; admitted images are bounded by image count, bytes, pixels, and embedding-token width/count, and image metadata/raw bytes plus the embedding fingerprint are digested into a `vision-sha256:` quarantine pointer while raw bytes are never fed to the decoder. Honest fence: this is the in-kernel VLM input/governance layer and encoder interface, not a built-in CLIP weight runner or OCR/VLM classifier. Witness: `go test ./internal/model -run Multimodal` (`TestForwardMultimodalTextOnlyMatchesForward`, `TestForwardMultimodalDefaultQuarantinesImages`, `TestForwardMultimodalQuarantineIDBindsEmbeddingBits`, `TestForwardMultimodalQuarantineModeAllowsBoundedEmbeddings`, `TestForwardMultimodalGovernanceLimits`, `TestForwardMultimodalRejectsWrongEmbeddingWidth`).
- [SHIPPED] Parity lane: parallel matmul across output rows + batched prefill GEMM + an 8-accumulator `fdot`, each output **bit-identical** to the serial reference (`math.Float32bits` equality); decode now beats every same-precision HF f32 config and prefill closed ~16×, with no proven-correctness rung disturbed. Witness: `TestParallelMatchesSerial`, `TestPrefillBatchedMatchesSerial`; `MODEL-BASELINE-RESULTS.md` (Act 2).
- [SHIPPED] KV-quarantine bridge: a ctxmmu `Quarantine` verdict on poison bytes mechanically **evicts that result's K/V span**, leaving the kernel-owned attention cache bit-identical (max|Δ|=0.0) to never-having-seen it, against a non-vacuous poison control (max|Δ|≈0.33). Witness: `go test ./internal/kvmmu` (green); `KV-QUARANTINE-BRIDGE-RESULTS.md`. (The bridge's witness uses a synthetic model; the numerics are proven separately by the HF oracle, and the live agent loop is not yet wired to it.)
- [SHIPPED] Planned-elision → KV-eviction residency bridge (issue #550): `kvmmu.Context.ApplyPlan(plan ctxplan.Plan)` evicts every recorded K/V segment whose id is in the plan's ELIDED set (and not its SELECTED set), so the kernel-owned cache's RESIDENCY shrinks to the planner's O(1) resident VIEW — an O(1) view becomes an O(1) KV residency, byte-for-byte (the eviction is the proven `model.KVCache.Evict` re-RoPE+renumber). The plan's faithfulness witness (`ctxplan.Audit`) already guarantees every elided span carries a page-back-in handle, so evicting it loses nothing. Witness: `go test ./internal/kvmmu -run TestApplyPlan` — the post-plan next-token distribution is BIT-IDENTICAL (max|Δ|=0) to a reference that only ever prefilled the resident spans, with a non-vacuous control (keeping the elided spans perturbs the distribution). Honest fences: the witness uses a synthetic model (HF numerics proven separately by the `internal/model` oracle); the bridge only SHRINKS residency to match the view (paging a resident span back IN is the separate demand-fault path, `ctxplan.Materialize`); and it is not yet wired into the live agent HTTP loop.
- [SHIPPED] Context-planner candidate INDEX (`internal/ctxplan.Index`): the Postgres index access-path that bounds the planner's per-turn COMPUTE the way the budget bounds its per-turn resident TOKENS. `PlanCells` re-scans all N spans each turn, so cumulative re-planning is Θ(N²) (`scaling.go`'s `PlannerComputeCum`) — the one cost "O(1) resident" never bounded ("unless the candidate set is index-bounded, which would flatten this term"). `Index` maintains an inverted token index (the selective relevance scan), the append-order recency tail, and the durable set, so `Probe(forecast)` returns a candidate set bounded by `MaxCandidates` (default 128) — independent of N — and `Index.PlanCells` scores only that set. Cumulative planning flattens Θ(N²)→Θ(c·N) (`IndexBoundedPlannerCompute`), the compute analogue of `cumCapped`. Honest fences: pruning is a forecast MISS, never a lost fact — a pruned span stays in the lossless store, demand-pageable, and the trust gate still guards it (a sealed span that is probed still scores 0 and is elided sealed); exact set-equality with the full scan is NOT claimed — the full scan can fill leftover budget with low-benefit noise the index declines — but the index never drops an AVAILABLE span the full scan kept (pruning only frees budget). Witness: `go test ./internal/ctxplan` — `TestIndexPlanMatchesFullScan` (a full-scan-selected span the index also probed is kept; the high-value pins + top relevant span always kept; faithful + within budget), `TestProbeIsBoundedIndependentOfN` (probe size stable as N grows 100→5000), `TestInvertedIndexReachesBuriedSpan` (a relevant span 1000 deep, outside any recency window, is still found by CONTENT), `TestPrunedSpanStaysRecoverable`, `TestIndexSealedNeverSelected`, `TestProbeIsDeterministic`, `TestIndexBoundedPlannerComputeFlattensQuadratic`.
- [SHIPPED] Index maintenance + store-level faithfulness (`ctxplan.Index.SetSealed`/`SetTombstoned`/`Spans`, `ctxplan.StoreAudit`, issues #558/#565): the two rungs that make the candidate index deployable and honesty-complete. (1) **Incremental maintenance** — the live loop maintains ONE index (Add O(tokens)/turn + flag flips), proven STRUCTURALLY IDENTICAL to a fresh `BuildIndex` over the final span set (`reflect.DeepEqual` over the whole index: span table, posting lists, durable set, id index), so the Θ(c·N) compute flatten is real on the loop and not a rebuild-per-turn Θ(N²). The only per-span mutation is a trust/suppression flag (`SetSealed`/`SetTombstoned`), because content is content-addressed/immutable and `Add`/`Spans` clone the one reference field (`Attrs`) so a caller cannot mutate the index's scoring inputs. (2) **Store-level faithfulness** — `StoreAudit` certifies resident∪elided∪pruned partitions the WHOLE store with every pruned span recoverable, lifting `Audit`'s probed-set partition to store scope so "index pruning is a forecast miss, never a lost fact" is a witness, not a comment. Honest fences: the recovery handle is the id, so the witness DETECTS duplicate store ids and refuses to certify (ambiguous handle, fail-closed — no shipped store hits it; `MemStore`/`recall` assign unique ids); the equivalence holds under that unique-id addressing contract. An adversarial review (4 independent reviewers) caught the original id-keyed reasoning vs the package's row-correct accounting and the Attrs aliasing — both fixed before ship. Witness: `go test ./internal/ctxplan` — `TestIncrementalEqualsBatch`, `TestSetTombstonedSuppresses`, `TestSetSealedSuppresses`, `TestAddClonesAttrsDefendsImmutability`, `TestStoreAuditPartitionsAndFaithful`, `TestStoreAuditDetectsCompaction`, `TestStoreAuditDetectsForeignSpan`, `TestStoreAuditRefusesDuplicateStoreIDs`.
- [SHIPPED] Trajectory forecast AUTHOR — the general preemptive planner rung (issue #556, `ctxplan.Proposer`/`TrajectoryAuthor`): the piece that AUTHORS `Forecast.Intents` from the trajectory itself, closing the "the forecast is authored, not learned" fence (O1-TURN-CONTEXT-PLANNER-2026-06-23.md §6). Before this rung the only forecast authoring was a degenerate single-message heuristic in the agent adapter (`internal/agent/ctxplan_seam.go` — the LAST user message's content words), which sees one turn, lives in the wrong tier, and cannot be reused by the gateway or a demo. `TrajectoryAuthor.Propose(spans)` scans the recent trajectory tail and scores each content token by RECENCY-WEIGHTED RECURRENCE — a token that has appeared recently and repeatedly is the strongest predictor of what the next turns will touch (recurrence/momentum dominates, recency breaks near-ties) — emitting the top-K as the forecast's Intents. It is the PROACTIVE peer of `Forecast.Learn` (the REACTIVE fault→intent revision): Propose seeds the forecast from where the session has been; Learn refines it from where it was wrong. The `Proposer` interface is the one-method seam a MODEL-BACKED predictor satisfies through the same contract (wirescreen RUNG 4: "Seam: ctxplan.Forecast.Intents"), defined now so the model arm slots in without changing the planner. Honest fences: the shipped author is the deterministic, model-free SEED (the heuristicScreener analogue — RUNG 1 shipped its deterministic reference impl first; the model Screener is NEXT); the model-backed proposer is the higher-tier follow-on, gated on the outbound transform seam that does not yet exist on the flagship passthrough (so it cannot yet affect the live wire); it reasons over SAFE span metadata only (role+descriptor — the same vocabulary the planner scores), never sealed bytes; and it is off the live agent loop (the seam keeps its own heuristic; rewiring the seam is a separate follow-on). A MISS costs one demand-page fault, never a lost fact (the store is lossless), so a wrong author degrades efficiency, never correctness. Witness: `go test ./internal/ctxplan` — `TestAuthorDerivesIntentsFromTrajectory` (intents come from the spans' content, not fabricated), `TestAuthorPredictsRecurringTopic` (a token recurring across 3 spans outranks a one-off in the most-recent span — recurrence dominates), `TestAuthorRecencyBreaksNearTies` (equal-recurrence tokens: the more recent ranks higher), `TestAuthorIsDeterministic`, `TestAuthorPreemptsByKeepingPredictedSpanResident` (end-to-end: a trajectory-predicted runbook is pre-materialized resident by the planner under a tight budget — the preemptive property, with no hand-supplied intents), `TestAuthorFailClosedEmptyTrajectory`, `TestAuthorSkipsSealedAndTombstoned` (poison content is never predicted into context), `TestAuthorBoundsIntents`, `TestAuthorCarriesThroughPinsWeightsHorizon`, `TestAuthorSingleSpanPredictsItsTokens`, `TestProposerInterfaceIsSatisfied`.
- [SHIPPED] Local-model-on-the-wire semantic-screen SPINE — the witnessed-lossy-proposer foundation of the whole wirescreen program (epic #568, rung 1; commit b63264c; `internal/abi/semscreen.go` + `internal/ctxmmu/mmu.go` + `internal/wirescreen/`): a small LOCAL model (or any cheap predicate) is wired as an ADDITIVE, one-sided screen CONSULTED AFTER the context-MMU's deterministic regex floor (`ScreenBytes`), never as the load-bearing answer. Three additive seams: (1) the frozen-ABI-adjacent `abi.SemanticScreen` interface (`ScreenResult`→`ScreenAdvice{Disposition,Reason,Digest,By}`; `RegisterSemanticScreen`/`SemanticScreens()`) with `ScreenQuarantine` WIRED and `ScreenDigest` RESERVED for rung 2 — the interface needs no change when later rungs land, and it is additive to the closed `VerdictKind`/`Reason` freeze; (2) `ctxmmu.MMU.Admit` consults `SemanticScreens()` after `ScreenBytes` and routes a `ScreenQuarantine` through the EXISTING `quarantineResult`, inheriting the CAS-pin + `PageIn`-refused-until-`Clear` witness (a wrong proposal costs one page-fault, never a lost fact), with the new `MMU.Screened()` counter; (3) the `internal/wirescreen` leaf — `Screener` interface, named registry + `Register`/`Active` selected by env `FAK_WIRE_SCREEN`, the `screenAdapter` bridging the selected screener to `abi.SemanticScreen`, the deterministic dependency-free `heuristicScreener` reference impl, and `doc.go`'s 5-rung roadmap. DEFAULT-INERT: an empty `FAK_WIRE_SCREEN` registers NOTHING with the ABI, so `abi.SemanticScreens()` stays empty and the MMU is exactly the v0.1 regex floor at zero added cost. Honest fences: strictly one-sided (a screen may only turn Allow→Quarantine, never weaken a floor); the `heuristicScreener` is the deterministic floor (NOT a model, so no latency gate applies); the model arm (#569, `model_screener.go`, build-tag `fakwiremodel`) is the gated follow-on whose classify latency is UNMEASURED, so its default-on stays BLOCKED until an end-to-end admit-latency number is recorded; and on the flagship `fak guard -- claude` Anthropic passthrough the byte-removal is DEAD (the model reads `req.Raw` verbatim), so the live value there is taint-gate hardening (a quarantine raises the IFC high-water mark `adjudicateProposed` reads) — byte removal reaches the wire only on the non-passthrough re-marshal path. Closes epic #568: all five rungs shipped (rung 2 #570, rung 3 #571, rung 4 #556, rung 5 #572; rung 1's model arm #569). Witness: `go test ./internal/wirescreen ./internal/abi` (`TestDefaultInertRegistersNoABIScreen` — empty `FAK_WIRE_SCREEN` registers nothing; `TestABIGoldenFreeze`; `TestHeuristicScreenerFlagsSemanticInjection`; `TestScreenAdapterQuarantinesViaSelectedScreener`); `FAK_WIRE_SCREEN=heuristic go test ./internal/wirescreen -run TestEndToEndWithHeuristicScreen` proves the end-to-end env→init→adapter→MMU→quarantine path and that `MMU.Screened()` increments only on a one-sided Allow→Quarantine.
- [SHIPPED] Pre-send PII/secret redaction — the privacy-compressor rung of the local-model-on-the-wire spine (issue #572, wirescreen RUNG 5; `internal/wirescreen/redactor.go`): the deterministic, model-free COMPLIANCE FLOOR that proposes [start,end) byte spans to redact before bytes leave the box, and an `Apply` that replaces each with a `[REDACTED:<kind>]` placeholder while pinning the UNREDACTED original in the shared CAS so an authorized `Restore` returns it byte-exact (the same `abi.PageOut` + `PinResolved` witness `ctxmmu`'s quarantine uses — a wrong proposal costs one demand-page fault, never a lost fact). The reference `piiRedactor` is high-precision regex + Luhn detection (credit cards, US SSNs, AWS/GitHub/Slack/Stripe/Google keys, emails, bearer tokens, PEM private keys), precision-biased so a compliance floor does not break legit content. It is the Screener-STYLE redaction peer of RUNG 1 (a witnessed, one-sided, additive proposer) but emits SPANS rather than a quarantine bit, because a redaction is an in-place rewrite, not a whole-result hold-out. DEFAULT-INERT (`FAK_WIRE_REDACT`) and touches NO ABI seam (registers no SemanticScreen, no capability), so the default binary is unchanged and `TestABIGoldenFreeze` / `TestDefaultInertRegistersNoABIScreen` are unaffected. Honest fences: this is a compliance floor, NOT a token saver (a placeholder can be longer than the secret it scrubs); it is WIRED on the non-passthrough re-marshal path via `agent.RedactOutboundMessages` (called from `prepareUpstream`, `internal/agent/stream.go`, which runs `Apply` over each outbound message's content before the non-passthrough marshal), so the redaction DOES reach the wire there (OpenAI/xAI proxy, mock, local serve); the flagship `fak guard -- claude` Anthropic passthrough still sends `req.Raw` verbatim, so the redaction cannot reach the model on THAT route until the cache-prefix-preserving `req.Raw` transform (#555, ctxplan-owned) lands — that flagship-passthrough arm is the named, #555-gated follow-on, deferred in code + claim. MEASURED pre-send latency (the "measure before default-on" gate): end-to-end `Apply` on a ~480 B body carrying every pattern shape + ordinary prose is ~54 µs/op (classify ~52 µs + ~2 µs CAS witness pin; `BenchmarkApply`/`BenchmarkPropose`, `internal/wirescreen/redactor_bench_test.go`) — orders of magnitude under a turn; the gated model arm's NER-classify latency is UNMEASURED until weights land; the model-backed `Redactor` (native CPU 1-3B span task) is the gated follow-on that needs weights + a measured span latency before default-on — the SAME fence the forecast AUTHOR row above shipped the deterministic seed under. This is the floor for the OUTBOUND surface, not a duplicate of ctxmmu's INBOUND `ScreenBytes` quarantine (which removes a whole secret-bearing RESULT). Witness: `go test ./internal/wirescreen` (`TestPIIRedactor_DetectsSecretsAndPII`, `TestPIIRedactor_HighPrecision`, `TestPropose_CoalescesOverlaps`, `TestApply_RedactsSpansAndPinsOriginal`, `TestApply_NoSpansIsNoOp`, `TestDefaultInert_NoActiveRedactor`, `TestEndToEndWithPIIRedactor`).
- [SHIPPED] Useful page-out digest — the rung-3 page-out upgrade of the local-model-on-the-wire spine (issue #570, wirescreen RUNG 2; `internal/wirescreen/digester.go` + `internal/ctxmmu/mmu.go`): the RESERVED `abi.ScreenDigest` disposition is now WIRED. `ctxmmu.MMU.Admit` captures a `ScreenDigest` advisory from the screen chain and, on the oversize page-out path, pages the body out to a stub that carries the authored digest INSTEAD of the v0.1 opaque `{_paged,ref,len}` pointer, so the model reads the gist without a demand-page fault. The original is pinned in CAS under the held ledger and a witness `Clear` + `PageIn` restores it BYTE-EXACT — the digest is lossy display, never the witness. The reference `heuristicDigester` is the deterministic, model-free floor (leading-lines truncation to a ~200-token cap), the digest peer of RUNG 1's `heuristicScreener`; the model-backed `Digester` (native CPU 1-3B, decode-bound) is the gated follow-on that needs weights + a measured digest latency before default-on. DEFAULT-INERT (`FAK_WIRE_SCREEN`) and touches NO closed ABI value (`ScreenDisposition` is the OPEN additive enum, not the `VerdictKind` freeze), so `TestABIGoldenFreeze` / `TestDefaultInertRegistersNoABIScreen` are unaffected. Honest fences: a `ScreenDigest` on a NON-oversize body is captured but NOT applied (the full bytes are strictly better than a lossy digest) — the digest only UPGRADES the oversize page-out; the opaque v0.1 pointer is unchanged when no digest is advised; and the digest reaches the model only on the NON-passthrough re-marshal path — on the flagship `fak guard -- claude` Anthropic passthrough the model reads `req.Raw` verbatim, so the digest is dead there until the cache-prefix-preserving `req.Raw` transform (#555, ctxplan-owned) lands. Witness: `go test ./internal/ctxmmu` (`TestAdmitScreenDigestProducesDigestStubAndByteExactRestore`, `TestScreenDigestOnSmallBodyIsAdmittedAsIs`, `TestOpaqueOversizeUnchangedWithoutDigest`); `go test ./internal/wirescreen` (`TestHeuristicDigesterAuthorsLeadingLines`, `TestActiveDigesterInertWithoutEnv`).
- [SHIPPED] Multi-modal screenshot triage — perceptual-hash frame DEDUP (issue #571, wirescreen RUNG 3; `internal/wirescreen/phash.go`): the buildable arm of the multi-modal triage rung, ZERO model (pure-Go DCT perceptual hash, stdlib only — no vision encoder, no GPU). `phashDigester` decodes a base64/raw/JSON image block, computes a 64-bit DCT perceptual hash, and compares it against a bounded FIFO store of recently-seen frames; on a hit (a near-identical re-send) it authors an "unchanged, see frame#k" dedup POINTER that rides rung 2's `ScreenDigest` -> `ctxmmu.digestToPointer` reversible path — the duplicate pixels page into the SAME CAS and a witness `Clear` + `PageIn` restores them BYTE-EXACT, so a wrong "unchanged" call costs one demand-page fault, never a lost frame. On a miss (a new frame, an undecodable or sub-threshold image) it declines, so the body falls through to today's opaque oversize page-out / allow path — strictly one-sided, never a new refusal. The counter `Dedups()` (peer of `Flags()`/`Digests()`/`ctxmmu.MMU.Digested()`) increments on each collapse. DEFAULT-INERT: selected by `FAK_WIRE_SCREEN=phash` (the env gate) or a host registering `PhashScreen()` (the programmatic opt-in); with neither, `ActiveDigester()` is nil / nothing is registered and the MMU is the bare regex floor. Touches NO closed ABI value (`ScreenDisposition` is the OPEN additive enum) and NO `internal/ctxmmu` code (it reuses #570's machinery verbatim), so `TestABIGoldenFreeze` / `TestDefaultInertRegistersNoABIScreen` are unaffected. Honest fences: it reaches the model only on the NON-passthrough re-marshal path (flagship `fak guard -- claude` sends `req.Raw` verbatim, dead until #555); the OCR/VLM and crop-to-ROI arms are BLOCKED on a vision encoder (`internal/model` is text-only) and filed as future sub-tasks; and the Hamming-dedup threshold is deliberately tight (8/64) so a genuinely different screen is never collapsed. Witness: `go test ./internal/ctxmmu` (`TestPhashDedupCollapseAndByteExactRestore`, `TestPhashDedupNewAndDifferentFramesFallThrough`, `TestPhashDedupReSendNamesSamePriorFrame`); `go test ./internal/wirescreen` (`TestPerceptualHashStableAndSeparating`, `TestPhashDigesterDedupsIdenticalAndDeclinesNew`, `TestDedupsCounterIncrements`, `TestDecodeImageBlockHandlesWireShapes`, `TestPhashScreenBridgesToScreenDigest`).
- [SHIPPED] Planned view MEASURED over the heaviest REAL session transcripts (issue #559, `cmd/ctxplanbench`): the empirical counterpart to `scaling.go`'s synthetic Params model. Where `scaling.go` takes a mean tokens/turn + a hit rate and COMPUTES the resident curve, `ctxplanbench` ingests the heaviest real Claude Code transcripts through the SHIPPED `cdb`→`recall` ingest (so a result the write-time gate quarantines is sealed here too), bridges each `recall.Page` into a `ctxplan.Span`, and replays the session turn-by-turn through the real planner (`ctxplan.Materialize`) and the real page-fault handler (`ctxplan.DemandPage`). On the 5 heaviest transcripts on this box (715 replayed turns, 8 sealed by the real gate): resident tokens — planned cum 5.24M vs linear 69.81M (**13.3× fewer resident**, peak held to the 8000-token working set except documented pin-overrun turns); fault rate — 31.7% of the 38,068 real lexical back-references were forecast MISSES, and **100% of the 12,083 misses were SERVED** (0 refused, 0 lost — every miss is a recoverable page fault); quality vs compaction — planned kept exact recall 715/715 turns (`Audit.Faithful` witnessed on the real plans) while compaction destroyed facts on 695/715 turns, so the 12,083 served faults are exactly the facts the planned regime recovers that compaction would permanently lose. Honest fences: the forecast is a deliberately cheap recency-window heuristic (last K turn descriptors as intents + durable pins), NOT an oracle — a stronger forecast would lower the 31.7% miss rate, and the point of measuring it is that every miss is served, never lost; the "reference" ground truth is real lexical descriptor overlap (the same extractive signal the planner's relevance uses), not a fabricated oracle; resident units are the bytes/4 proxy (`ctxplan.TokenCost`), so a real BPE tokenizer shifts absolutes, not the regime; the **13.3× multiplier is this transcript-set's number, not a constant** (an independent 2026-06-26 re-run on the box's current, longer heaviest-5 reproduced the regime — 2055/2055 exact recall, 196,271/196,271 misses served, compaction lost facts on 2016/2055 turns — at 9.9×, since longer sessions miss the cheap forecast more often; the recall/served invariants hold, the multiplier moves with the set); and this `ctxplanbench` is a MEASUREMENT cmd, but the planner it measures is **no longer off the live path** — the same `ctxplan.Materialize` view is wired into the gateway per-turn buffered path (`--ctx-view-budget`, #555 shipped, OFF by default at 0) and witnessed end-to-end through the real HTTP handler (the flagship Anthropic `req.Raw` passthrough is the one wire it does not yet reach, the deferred #555 `req.Raw` transform, tracked as #927). Witness: `go test ./cmd/ctxplanbench` (`TestReplayInvariants`, `TestReplayLooseBudgetHoldsEverything`); `go run ./cmd/ctxplanbench -selfcheck` exit 0; the real-transcript run `go run ./cmd/ctxplanbench -heaviest 5`; the live-loop wiring witness `go test ./internal/gateway -run TestCtxViewHTTP` (`internal/gateway/gateway_ctxview_http_test.go`: OFF forwards the full history, ON forwards the bounded planned view, the passthrough forwards `req.Raw` byte-for-byte).
- [SHIPPED] Planner per-turn COMPUTE flatten MEASURED over the heaviest REAL session transcripts (issues #558/#559, `cmd/ctxplanbench` planning-cost arm): the empirical counterpart to `Index`'s `IndexBoundedPlannerCompute` model (claim above) — measuring the planner's OWN work, not just its resident output. The bench maintains ONE persistent `ctxplan.Index` across the replay (the `SessionPlanner` pattern) and per turn scores the bounded `Index.PlanCells` probe alongside the full-scan `Materialize` plan under the IDENTICAL forecast/budget/`Optimize(ObjGreedy)`, so the only variable is the candidate set (N vs c). On the 5 heaviest transcripts (851 replayed turns, W=8000, default cap c=128/recency 32): the per-turn probe never overran the cap on ANY of 851 turns (the Θ(c·N) bound held), cumulative candidate-scoring **100.1K full-scan vs 68.0K bounded (1.5× less planner work, growing with N** — 43-turn session 1.0× → 342-turn 1.7×, the Θ(N²)→Θ(c·N) shape); resident-token efficiency is PRESERVED under the bounded planner (bounded cum 6.29M vs full-scan 6.36M, within 1.2%; both ~12× below linear 76.97M). Mechanism equivalence witnessed end-to-end: probe=ALL candidates ⇒ **342/342 IDENTICAL plans** on the largest session. Honest fences: at the SHIPPED default width the bounded plan picks a DIFFERENT resident set than the full scan on most long-session turns (plan-agree 208/851) — the divergence is access-path COVERAGE, not the cap (a real session spreads selection-worthy benefit across more spans than recency/relevance/durability reach) — but every divergence is a bounded efficiency miss, NEVER a lost fact (15,530 back-reference faults, 100% served, 0 lost), and the cap/recency are a measured cost↔fidelity dial (recency 32→4096 lifts agreement 39→131/342 at ~equal cost; the named next lever is a utility access path); the flatten is Θ(N) in the horizon (modest at hundreds of turns, pays off on long sessions); resident units are the bytes/4 proxy; hardware-independent exact counts (reproduces on `node-macos-a`); off the live path (a bench cmd; the `SessionPlanner` it mirrors, #558, is the agent-seam home, unit-witnessed by `TestSessionPlannerBoundedMatchesStatelessFullScan`). Witness: `go test ./cmd/ctxplanbench` (`TestReplayInvariants` asserts the bound + plan-agreement at N<cap; `TestPlanningCostFlattenWhenBounded` forces the cap to bite and asserts the Θ(c·N) ceiling + a real flatten); `go run ./cmd/ctxplanbench -selfcheck` exit 0; the real run `-heaviest 5`; `docs/notes/CTXPLAN-PLANNING-COST-FLATTEN-2026-06-23.md`.
- [SHIPPED] Provable-deletion certificate (`internal/deletioncert`, demo `cmd/deletioncert`): a `DeletionCertificate` binds the evicted span, `EvictedCount`, the byte-exact equivalence (evicted == never-saw, max|Δ|=0), a tamper-evident hash-chained journal anchor, and the trust epoch under one ed25519 signature, and **fails closed** on any forged field, non-zero drift, or absent/rewritten anchor (re-verified live in the demo). Honest fences: it is a **self-signed v1** receipt (it attests the integrity of the recorded facts, not independence from the recorder); `EvictedCount` is a self-report; and the bound `max|Δ|=0` is checked as a **signed string, not re-measured** — the eviction's bit-exactness is proven separately by the KV-quarantine bridge above (synthetic model; HF numerics by the oracle). Witness: `go test ./internal/deletioncert`; `docs/proofs/deletioncert.md`; `go run ./cmd/deletioncert -selfcheck` exit 0.
- [SHIPPED] The in-kernel model is wired as a `RegisterEngine` backend (`internal/modelengine`, id `inkernel`) and now completes lifecycle requests through the native continuous-batching scheduler (#401): an allowed tool call is prefetched into a kernel-owned `model.Session`, concurrent admissions are promoted between decode steps, multi-lane decode advances through `model.BatchSession.StepBatch`, and finished/cancelled lanes reclaim their KV-bearing session. Batch-1 keeps the serial `Session.Step` fast path, so the scheduler does not impose a single-request regression in the committed witness; `FAK_NATIVE_MAX_RUNNING` caps the running set when an operator wants a smaller batch. Lazily builds a deterministic synthetic checkpoint (runs with no model export); `FAK_MODEL_DIR` / `fak serve --gguf` preload real weights through the identical dispatch path, with the armed tokenizer and resident-Q4_K mode preserved. Honest fences: resident Q4_K multi-lane decode falls back to per-lane `Session.Step` because `BatchSession` has no Q4_K dispatch yet, and production paged-attention / multi-tenant SLA policy remains outside this lifecycle scheduler. Witness: `go test ./internal/modelengine`; `BenchmarkEngineContinuousBatching` (`.\test.ps1 -run '^$' -bench BenchmarkEngineContinuousBatching -benchmem -benchtime=50x ./internal/modelengine`) records B1 1.12×, B2 1.30×, B4 1.61×, B8 1.92× req/s vs the legacy per-request lifecycle in `experiments/modelengine/native-continuous-batching-20260629.json`.
- [SHIPPED] SGLang is a first-class ridden engine adapter behind the frozen `abi.EngineDriver` / lifecycle seam (#39): `internal/engine` registers `abi.RegisterEngine("sglang", DefaultSGLangEngine)`, drives SGLang's public `/generate` streaming API, folds RadixAttention residency snapshots into the shared `PrefixResidencyIndex`, normalizes SGLang scheduler counters into the shared `fak_serving_*` schema, and keeps governance on the existing `enginecache.EngineSGLang` identity where `SupportsExactSpan==false` means whole-prefix `flush_cache`, not exact-span eviction. Honest fences: the radix-residency endpoint is a bridge/test seam because SGLang has no single standardized public radix-dump path; this is an adapter/control-plane integration, not an SGLang fork or a claim that fak owns SGLang KV pages. Witness: `go test ./internal/engine` (`TestSGLangIsRouterDispatchableNotProxyOnly`, `/generate` streaming, radix snapshot fold, Prometheus normalization, enginecache identity); live fak-fronted-SGLang vs raw-SGLang overhead is recorded in `experiments/qwen36/dgx-r4-20260622/compare.json` and `docs/benchmarks/QWEN36-27B-GPU-SERVER-RESULTS.md` (gateway tax 0.75x at C=64, 0.97x at C=128).
- [SHIPPED] Poly-model serving core (`internal/polymodel`, foundation leaf, stdlib-only): the deterministic **"host many models, share the prefill, decode one"** mechanism — a weight-byte-budgeted multi-model residency `Pool` (LRU eviction of the coldest UNPINNED model, all-or-nothing admit), a single **SERIAL** decode-lane scheduler (`Schedule`/`NextDecoder`, the at-most-one-model-decodes-per-step invariant asserted), and the cache-led multi-token-prediction accept core (`AcceptGreedy`: the greedy speculative-decoding accept rule whose KEEP/EVICT counts map 1:1 onto the bit-exact `KVCache.Clone` fork + `KVCache.Evict` rollback; `AcceptTree` the next-gen token-TREE generalization (Medusa/EAGLE-2/SpecInfer: many candidate continuations share a KV prefix, verified in one pass, only the accepted path kept); `PickDrafter` ensemble drafter selection; `EffectiveTokensPerVerify` geometric-series speedup model), plus `CanShare`, the cross-model prefill-share gate (model B reuses model A's prefix KV iff same `Family` + byte-identical `PrefixDigest` ⇒ lossless reuse — the verdict-layer unlock that lifts the cache's exact-ModelID barrier; share DECISION plus the verdict-layer wiring + KVCache.Clone splice, shipped in #534 — `cachemeta.PrefillSharePolicy` lifts the ModelID barrier for a declared-compatible family (opt-in via `WithPrefillShare`, ModelID-axis-only, every other axis still verified), and `internal/spec.CrossModelPrefillShare` / `SplicePrefillShare` is the off-defconfig bridge + bit-exact Clone splice). It encodes the prefill(compute-bound)/decode(HBM-bandwidth-bound) asymmetry that makes "decode one" a hardware consequence, not a compromise. Honest fence: this is the policy/accounting brain ONLY — it runs no model, moves no KV bytes, touches no GPU, and is **off mainline by construction**: the leaf is NOT in the defconfig (`internal/registrations`), so the `fak` binary never links it (only `cmd/polymodelbench` does), and the eventual live-path wiring is gated behind `polymodel.Enabled()` (`FAK_POLYMODEL`, default off); real multi-model residency on a backend remains sequenced (the verify EXECUTION shipped in #533 — single-pass batched + tree-attention masks); served cross-model prefill share — the verdict-layer barrier lift + KVCache.Clone splice — shipped in #534 (`cachemeta.MaterializeVerdict` + `WithPrefillShare`; `internal/spec` bridge) in `docs/serving/polymodel-prefill-share-plan.md` (the frozen ABI MTP envelope — `abi.SpeculationContext`/`TxnID`/`Outcome`/`ProvisionalSink` — has no implementation behind it yet). Witness: `go test ./internal/polymodel` (residency budget-never-exceeded + pinned-never-evicted, serial-lane invariant, accept KEEP+EVICT conservation, drafter selection, speedup monotonicity); `go test ./internal/architest` (tier-1 layering); `go run ./cmd/polymodelbench -selfcheck` exit 0 — hosts 10 synthetic models under a budget, drives the serial decode lane over REAL `model.Session` decode, and proves greedy speculative decode is token-identical to plain greedy even when an adversarial draft forces a rollback every round (the bit-exact `KVCache.Evict` path, exercised 96 spans / vacuity-guarded).
- [SHIPPED] Single-pass batched + tree-attention verify execution (`internal/model.VerifyForward` + `internal/spec`, rung #533 of epic #529): the throughput half that turns the shipped accept DECISION (`polymodel.AcceptGreedy`/`AcceptTree`) + bit-exact rollback (`spec.Sink`→`KVCache.Evict`) into a real ONE-pass forward over the candidate tokens, instead of one decode step per candidate. `model.VerifyForward(ids, pos, allow)` runs the PreNorm-standard batched forward over P candidates and returns each position's next-token logits: with nil `pos`/nil `allow` it is the CHAIN verify — bit-identical to P sequential `Session.Step` calls (same per-position logits AND the same appended K/Kraw/V/pos in every layer, witnessed `TestVerifyForwardChainMatchesSerial`), so `spec.SpeculativeGreedy` now verifies a kk-token draft in ONE pass instead of kk Steps and stays token-identical to plain greedy; with depth-based `pos` (siblings share `base+depth-1`) and an ancestor `allow` mask it is the TREE verify — tree-attention masks, where each node attends only to its ancestor chain + the committed prefix and never to sibling branches (witnessed `TestVerifyForwardTreeMaskIsolatesBranches`). `spec.VerifyTree`/`SpeculativeTree` drive the tree through `polymodel.AcceptTree` and commit the accepted path (rewind the speculation with one bit-exact `KVCache.Evict`, recommit the accepted chain as one `VerifyForward`); the accepted path is token-identical to plain greedy decode (`TestSpeculativeTreeLosslessGreedyPath`: 21/63 accepted, distractor branches rejected by the mask; `TestSpeculativeTreeLosslessArbitrary`: lossless regardless of drafter quality; `TestVerifyTreeRewindsAndCommitsCleanly`: the target cache is byte-exact to a greedy session after the round). Honest fences: it runs on the CPU synthetic PreNorm regime (no GPU, so no tokens/sec — the speedup is the closed-form `EffectiveTokensPerVerify` arithmetic; a measured number needs the bench harness #535); the chain falls back to sequential `Step`s on a non-batched regime (always correct, just not single-pass); the tree recomputes the accepted path's KV rather than keeping it from the verify pass (a tree-aware KV-compaction primitive is the honest sequenced cost, not a correctness gap); off mainline by construction (NOT in the defconfig, `FAK_POLYMODEL`-gated, default off). Witness: `go test ./internal/model ./internal/spec`.
- [SHIPPED] Multi-model weight-residency layer (`internal/residency`, mechanism leaf, rung #531): `Manager` lifts the single-`*model.Model` assumption (`modelengine.Default` is one `*model.Model`) — a pool of `*model.Model` under one weight-byte budget with LRU page-out, **reusing `polymodel.Pool` as the budget + eviction policy** and binding each residency descriptor (id / weightBytes / family / prefixDigest / pinned — the cross-model prefill-share and speculation keys) to the real in-kernel weights it governs. The budget test, the LRU victim choice, the pinned-exemption, and the all-or-nothing admit are ALL `polymodel.Pool`'s (Manager delegates, never re-implements), so every polymodel invariant holds here by construction; what this layer adds is the descriptor→weights binding and the page-out hand-back (an evicted resident's `*model.Model` is returned to the caller for release — the signal `polymodel.Pool` cannot give, since it owns no weights). Honest fence: it is the policy + binding layer ONLY — it moves no weight bytes and touches no GPU; the real per-backend weight load/evict (the compute-HAL per-weight budget `internal/compute/vulkan.go`, the process-wide `gpulease`) is the deeper rung a future wiring drives through `Admit`/`Evict`, and `WeightBytes` is caller-supplied at admit (the quantized footprint a real backend reports). It is **off mainline by construction**: NOT in the defconfig (`internal/registrations`) and registers nothing from `init()` (a library type a caller constructs, like `polymodel`), so the `fak` binary never links it; the eventual live-path wiring is gated behind `polymodel.Enabled()` (`FAK_POLYMODEL`, default off). Witness: `go test ./internal/residency` (budget-never-exceeded, LRU evicts coldest-unpinned WITH the weight handle handed back, pinned-never-evicted + ErrPinnedNoRoom fail-closed, all-or-nothing admit, re-admit-is-Touch, explicit Evict hand-back, nil-weights rejected, descriptor round-trip, concurrent-admit budget invariant under `-race`); `go test ./internal/architest` (tier-2 layering — composes model+polymodel under the root ABI).
- [SHIPPED] RadixAttention parity vs SGLang: SGLang's KV-cache radix attention (radix tree of token sequences + runtime longest-prefix match + LRU-**leaf** eviction + reference counting + cache-aware/DFS scheduling) rebuilt over the kernel-owned KVCache as `internal/radixkv` — a pure CONSUMER of the proven `Clone`/`Evict`/`Prefill` (an edge split truncates a child's cache to the boundary via `Evict`-of-tail, re-RoPEing no survivor). Measured (`cmd/radixbench`): **77.2–88.2 % cache hit rate** across the few-shot / multi-turn-chat / tree-of-thought / agents shapes — inside SGLang's verified **50–99 %** band — with reuse-through-an-edge-split proven **bit-identical to recompute** (max|Δ|=0); cache-aware (≡ DFS) scheduling recovers the interleaved agents workload from **FCFS 62.1 % → 100 % of optimal** (paper: 96 % avg); the radix tree discovers **1.4–2.5×** more reuse than fak's pre-radix declare-one-prefix path; and `EvictNode` adds **policy-driven span eviction** the opportunistic LRU cannot. Witness: `go test ./internal/radixkv` (green); `experiments/radixattention/*.json`; `RADIXATTENTION-RESULTS.md`. SGLang numbers CONFIRMED verbatim vs the NeurIPS 2024 proceedings PDF (arXiv:2312.07104). Prior art line above ("vs RadixAttention's LRU") is now a measured comparison, not a slogan.
- [SHIPPED] Cross-engine zero-copy KV co-residence SEAM (issue #448, `internal/xenginekv`): the frozen `RegisterRegionBackend`/`RegisterPageOutBackend` ABI seam now carries a real zero-copy backend, so the provable per-agent KV **Evict/Clone** quarantine — previously real only where fak owns the KV (its own in-kernel model, the rows above) and a stub against an engine fak does NOT run — holds against an EXTERNAL engine's KV. An `Arena` is one addressable region where an external engine's KV and fak's tool args/results CO-RESIDE: `Resolve` returns a VIEW that aliases the backing bytes (zero copy, the advertised `Capability "zerocopy"` — witnessed by address AND behaviour: a mutation through the view is seen by a later Resolve, which a copy could not be), `Evict` UNMAPS a span and ZEROES its bytes (after it the handle no longer resolves and a dangling view reads zeros — the cross-engine quarantine, the region-addressed dual of `model.KVCache.Evict`), `Clone` duplicates a resident span to a fresh handle (cross-engine prefix reuse, the dual of `KVCache.Clone`), and `PageOut`/`PageIn` hand the HANDLE across without moving bytes (the zero-movement an external engine's pinned KV pages need). DEFAULT-OFF: inert unless `FAK_XENGINE_KV` opts in (last-wins singleton swap; blob stays the live RegionBackend in every default build, imported first for deterministic order), declared in the `internal/architest` regionBackendRole gate. Honest fence: the arena is an in-process Go `[]byte` STAND-IN for what is, in production, a shared-memory / CUDA-IPC-imported handle onto the external engine's KV pages (`AttachArena` takes exactly such a buffer); the SEAM — the ABI boundary, the zero-copy Resolve, the Evict/Clone region primitives, the `zerocopy` capability, the opt-in backend swap — is shipped and tested, and what remains is the engine-specific TRANSPORT mapping a real vLLM/SGLang KV region into an Arena, which plugs in behind this exact frozen ABI with NO further ABI change (the remaining STUB under "What fak is NOT"). Witness: `go test ./internal/xenginekv` (`TestResolveIsZeroCopyView`, `TestEvictQuarantine`, `TestCloneIndependent`, `TestPageOutZeroMovement`, `TestBackendSeams`, `TestArenaBounded`, `TestInertByDefault`); `go test ./internal/architest` (the regionBackendRole singleton gate); `EXTENDING.md`/`ARCHITECTURE.md` ABI-swap rows.

The int8/Q8_0 SIMD lane (hand-written AVX2/AVX-512 Go assembly, CPUID-gated, scalar fallback; opt-in `Session.Quant`, the f32 path byte-for-byte untouched) is the **active in-flight increment** — witnessed green in the working tree (decode near-parity with llama.cpp Q8_0 at ~7.7 ms/tok, argmax-exact vs the f32 oracle; `TestQuantMatchesF32Logits`, `TestQdot8AsmMatchesScalar`), with numbers in `MODEL-BASELINE-RESULTS.md` Act 3 + `experiments/model-baseline/INT8-RUNG-VERIFICATION.md` (which adds the same-rung HF int8 peer: fak ~2.97× faster than HF dynamic-int8). It is deliberately **not** given a `[SHIPPED]` row here until the implementation lane commits it.

## Security substrate (the kernel stops believing the model)

- [SHIPPED] Information-flow control: `Ref.Taint` is source-stamped and a tainted→sink flow is sink-gated at adjudication time (rank-30, pre-call). Witness: `go test ./internal/ifc`. Prior art: FIDES/CaMeL IFC; the de-obfuscating canonicalization leaf (`internal/canon`) is shared with the recall re-screen.
- [SHIPPED] Kernel-authored trust/provenance: a classifier takes authorship of trust away from the model, with a hardened sink classifier (3 red-team fixes). Witness: `go test ./internal/provenance`.
- [SHIPPED] plan-CFI: a plan control-flow-integrity adjudicator with a `RequireApproval` verdict; `internal/harvest` folds the verdict stream into a frozen `LabelRow` corpus (the syscall-model training target). Witness: `go test ./internal/plancfi`, `./internal/harvest`.
- [SHIPPED] Effect-verifying witness gate: an in-process `dos_verify` effect-verify backs a `require-witness` verdict that fails closed when unwitnessed — a claim must be corroborated, not asserted. Witness: `go test ./internal/witness`.
- [SHIPPED] Dynamic attack battery: `internal/agentdojo` is an ASR-gated AgentDojo-style red-team that replaces the static poison fixture; the compiled defender loop (red-team → adjudicate → harvest → keep/revert) has 3 of 4 arrows shipped — the RL red-team generator is a documented seam. Witness: `go test ./internal/agentdojo`; `examples/agentdojo-redteam/README.md`.
- [SHIPPED] `normgate` (rank-5 canonicalize-and-decode ResultAdmitter, in front of ctxmmu) lifts agent-evasion catch 0→20/24 and cuts private real-transcript false positives 14.3%→7.1% with 0 new FPs / 0 leaks; one blank-import to enable. Witness: `go test ./internal/normgate` (6); `cmd/ctxbench -chain`.
- [SHIPPED] Default dev-agent floor + the CICD pillars on the **real** decision path: `adjudicator.DevAgentPolicy()` denies the shared-history git mutations (push/merge/tag), bounds writes off the kernel/policy spine (a spine write is SELF_MODIFY→ESCALATE), and allows one witness-gated `ship_release`; a registered `shipgate` adjudicator (rank 40) lifts a ship call to `require-witness` so an **unwitnessed ship is refused** and a **git-corroborated ship is allowed**; `witness` gains a `clean:` (green-tree) claim. Deployable as `examples/dev-agent-policy.json` (round-trips through the manifest loader). Witness: `go test ./internal/shipgate ./internal/adjudicator ./internal/witness` — `TestDevAgentDefaultPath` drives the real defconfig chain (self-modify denied ESCALATE, unwitnessed ship refused, corroborated ship allowed, RequireApproval emitted) (issue #11).

Honest ceiling, surfaced not hidden: the *detector* these drivers feed is ~100% evadable on a SOTA evasion battery and FP-prone on private real-transcript corpora. Detection is **deliberately non-load-bearing** — the structural guarantee is the capability floor + containment, which never run the detector; improving detection is additive, not the moat.

## Gateway (`fak serve`)

- [SHIPPED] `fak serve`: an OpenAI-compatible HTTP surface (`/v1/chat/completions` adjudication proxy, `/v1/fak/{syscall,adjudicate}`, `/v1/models`, `/healthz`) + MCP over stdio/HTTP, so a non-Go agent routes tool calls through the same in-process syscall boundary. A wire client never supplies an `abi.Ref` — the gateway mints a tainted, agent-scoped Ref from raw bytes, so the IFC/secret/self-modify rungs stay armed; optional bearer auth (constant-time compare); fails loud if the ABI isn't wired. Witness: `go test ./internal/gateway`; v0.2.1 folded an adversarial-review hardening pass (auth, DoS timeouts, MCP spec-conformance, no cross-trust-boundary leak).
- [SHIPPED] The served path arms the **result-side** stack: a new `fak_admit` op (`POST /v1/fak/admit` + the MCP tool) runs a CLIENT-produced tool result through `k.AdmitResult` (context-MMU quarantine + IFC source-stamp/taint ledger), and a `TraceID` is threaded end-to-end (`buildCall` mints one when the wire omits it) so the per-trace IFC ledger / plan-CFI key on it. Closes the structural gap where the proxy + `fak_adjudicate` ran `k.Decide` only, leaving the exfil floor inert off the in-process `Syscall` topology. Witness: `go test ./internal/gateway` — `TestServedResultArmsResultSideStack`: a served secret-shaped result comes back QUARANTINE with the bytes paged out AND `ifc.Ledger.Level(trace)` rises above Trusted (issue #7).
- [SHIPPED] `fak guard -- <agent>` is the one-command adopter front door that collapses the dogfood path (a shell launcher + two terminals + six env vars + manual teardown) into one cross-platform Go verb. It starts the in-process gateway on a private loopback port, injects its URL into the CHILD process env only (never the parent shell or `settings.json`), execs the real agent interactively, and prints a verdict roll-up on exit. The default upstream is the Anthropic API in passthrough mode, so `fak guard -- claude` wraps a normal Claude Code session with the capability floor armed while the user's own key + prompt-cache breakpoints pass through untouched. A secure floor is embedded in the binary so it works from any directory (`--dump-policy` prints it; `--policy FILE` overrides). The exit audit reads `Server.AdjudicationSummary` from the same operation counters `/metrics` exposes, so it cannot overstate the protection. Witness: `go test ./cmd/fak` — `TestGuardDefaultPolicyDeniesDangerAllowsBenign` (the embedded floor denies `rm -rf`/`sudo`/RCE-pipe, allows `Read`, fails closed on unlisted tools), `TestGuardEnvVar`, `TestGuardDefaultBaseURL`, `TestFormatAuditSummary`, `TestGuardWaitHealthy`; end-to-end, a wrapped child posting to `/v1/fak/adjudicate` is denied/allowed by the kernel and the exit line reports the real tally.
- [SHIPPED] **Serving-latency observability — percentile-capable TTFT / TPOT / end-to-end histograms on `/metrics`.** The gateway emitted TTFT and decode only as cumulative MEANS (`fak_gateway_inference_prefill_seconds_total` / `_ttft_turns_total`, a derived rate), which structurally hide the P95/P99 tail an operator watches under load. `internal/gateway` `writeInferenceMetrics` now also emits three Prometheus HISTOGRAMS, fed on the same turn-completion path under the same `inferenceMu`: `fak_gateway_inference_ttft_seconds` (time-to-first-token, over the streaming turns whose prefill boundary is observable), `fak_gateway_inference_tpot_seconds` (per-output-token / inter-token latency = decode wall-clock ÷ generated tokens), and `fak_gateway_inference_e2e_seconds` (whole model-turn wall-clock, every served turn) — the fak analogues of vLLM's `vllm:time_to_first_token_seconds` / `vllm:inter_token_latency_seconds` / `vllm:e2e_request_latency_seconds`, so P50/P95/P99 are now queryable instead of only a mean. They stay empty (count 0) on an idle gateway, so no phantom distribution is published. With the existing running-request gauge (`fak_gateway_inflight_requests` + `_inflight_max_age_seconds`), the token-level prefix-cache-hit family (`fak_gateway_kv_prefix_{prompt,reused}_tokens_total` + `_reuse_ratio`), and the KV-residency family (`fak_gateway_kv_memory_*`), this brings the de facto vLLM Prometheus metric-SET to parity. Honest fence: OTLP/OpenTelemetry distributed-trace span EXPORT (gen_ai.* spans, vLLM's `--otlp-traces-endpoint`) is NOT shipped — fak threads an end-to-end `TraceID` but does not export OTLP spans. Witness: `go test ./internal/gateway -run TestInferenceLatencyHistograms` (idle histograms count 0; a buffered turn lands in e2e only; a streamed turn lands in all three with the right buckets and sums).
- [SHIPPED] **Cache-prefix-preserving history compaction — the 100k+-session cost lever on the flagship `fak guard -- claude` / `fak serve` Anthropic passthrough, DEFAULT-ON** (`--compact-history-budget N`, defaulting to ~48k resident tokens via `gateway.DefaultCompactHistoryBudget` so a sprawling conversation is shed with NO operator configuration — a short session stays untouched, and `--compact-history-budget 0` is the explicit byte-for-byte opt-out; `agent.CompactAnthropicHistory` + `internal/gateway/messages.go:maybeCompactAnthropicRaw`; the #555 `req.Raw` transform). On the ONE route that forwards the body byte-for-byte (so the client's prompt-cache breakpoints survive), an append-only long session re-sends the whole transcript every turn. This compactor sheds OLD whole turns to a resident-token budget while keeping the cache_control prefix **byte-identical** — it SPLICES on the original bytes (a memcpy of the protected prefix through the last `cache_control` breakpoint, never a re-marshal that would reorder JSON keys and break the cache), so the upstream cache hit is preserved instead of destroyed. The protected prefix is whole-message-granular and the transform is **fail-safe identity** on any ambiguity (no breakpoint, suffix already under budget, non-JSON, <3 messages, or a splice that fails to re-decode), so it never breaks a turn; tool_use↔tool_result pairs and role alternation are preserved; a `[fak] compacted N earlier turns` stub marks the drop. It is a request-side transform only — the kernel still adjudicates the FULL decoded history, so the trust boundary is unchanged. Honest fence: token counts use the bytes/4 `EstimateAnthropicTokens` proxy (the budget unit); the value is provider-cache survival via byte-identity, and the live provider-side `cache_read_input_tokens` capture is the credentialed-host follow-on (epic #745). Witness: `go test ./internal/agent ./internal/gateway -run Compact` (`TestCompactPreservesCachePrefix`, the 8 fail-safe `TestCompactIdentityCases`, `TestCompactToolPairNotOrphaned`, `TestMaybeCompactOnShortensKeepsPrefix`, `TestMaybeCompactOffIsIdentity`, `TestMaybeCompactNonPassthroughIsIdentity`, the default-on trigger `TestMaybeCompactDefaultBudgetTrigger` + `TestMaybeCompactDefaultBudgetLeavesShortSessionAlone`, and the flag default `go test ./cmd/fak -run TestCompactHistoryBudgetDefaultsToDefaultConst`); end-to-end dogfood on the real wire — `experiments/agent-live/compact-100k-session-dogfood-2026-06-25.json` (142,516-token inbound → 6,597 forwarded, 95.4% shed, OFF/ON cache-prefix sha256 equal).
- [SHIPPED] **Oversized tool_result elision — the bounded-loss `req.Raw` byte-splice sibling of compaction (`--elide-result-bytes`).** `agent.ElideAnthropicResults` / `ElideAnthropicResultsWithOutcome` shrink an oversized scrolled-past tool_result body (a file dump, a long command output, a giant search result) to a bounded **head+tail** form, byte-splicing on the ORIGINAL bytes so the cached **head** prefix is copied VERBATIM — the same cache guarantee compaction makes, enforced the same way (`internal/agent/anthropic_elide.go`). The working-set guard only ever shrinks a tool_result that is STRICTLY AFTER the protected prefix (the first cache_control breakpoint message), OUTSIDE the recent working-set window (the last `elideRecentKeepMsgs=4` messages), and in a message carrying no cache_control a **deep** detector (`messageHasCacheControlForElide` — one nesting level deeper than compaction's, recursing into `tool_result.content`) can reach. Value byte-ranges are located by KEY (`objectValueSpan`), never a `bytes.Index` over the block a sibling field could mis-hit. Wired into BOTH serving wires so the saver is default-on regardless of which model is fronted: the flagship `fak guard -- claude` Anthropic passthrough (`gateway.maybeElideAnthropicRaw`, the req.Raw byte-splice above) AND the **decoded local-model path** (`gateway.maybeElideMessages` / `agent.ElideMessages` on the `[]Message` history — the OpenAI / in-kernel wire a model served BY fak takes, where `anthropicPassthrough()` is false and the byte-splice never fires, e.g. **GLM-5.2 / Qwen-3.6-27B**; a tool result there is a `Message{Role:"tool"}` string, shrunk deterministically so a local backend's RadixAttention prefix cache stays stable). Across both front doors (`fak guard`, `fak serve`); **ON by default** (`gateway.DefaultElideResultBytes = gateway.DocumentedElideResultBytes = 16384`; pass `--elide-result-bytes 0` to opt out). Fail-safe identity on any ambiguity (no cache anchor, non-JSON, nothing oversized, a splice that fails to re-decode or alters the head prefix); request-side transform only — the kernel adjudicates the FULL decoded history, so the trust boundary is unchanged. **Cache framing (honest):** this is the cascade trade compaction makes, NOT "never touches a cached byte" — editing the middle shifts the bytes a LATER (recent-turn) breakpoint caches, so those cascade-burst while the dominant HEAD-breakpoint prefix stays byte-identical (asserted before ship) and the provider's read walks back to it. **Default-on basis + HONEST FENCES:** flipped on by parity with the compaction sibling (default-on with the same class of evidence) plus a stronger safety basis — two adversarial-verification rounds (below), a synthetic dogfood (`TestElideShedMagnitudeOnLargeCodingSession`: ~56% shed on a 319 KB crafted coding session, recent + head preserved), and a real-corpus prevalence scan (oversized tool_results in ~31% of 600 sampled real Claude Code sessions, ~2.9M estimated tokens of elidable content; `experiments/agent-live/elide-oversized-prevalence-2026-06-26.json`). What is still NOT built: there is NO `fak elide-witness` command and NO `MeasureElisionTradeoff` (an earlier version of this entry described those plus a fabricated 200-session artifact as shipped — they never were; this entry corrected that overclaim). The EXACT per-turn shed measured on reconstructed real `/v1/messages` bodies (the `fak elide-witness` dogfood) is the remaining follow-on; the prevalence scan measures the elidable RAW MATERIAL, not the realized per-turn bill. An adversarial multi-agent review (two rounds, 6 skeptics) found and this implementation CLOSED four real bugs before ship: a cache_control nested in `tool_result.content` missed by the shallow detector (a cache-burst vector), a `bytes.Index` value mis-location when `tool_use_id` equalled the content (field corruption), a "strictly non-bursting" overclaim (corrected to the cascade framing above), and — on re-attack of the fix — an array-branch `decodeArrayElements` re-search that a byte-identical sibling array could still mis-splice (closed by `arrayElementSpans`, base-0 spans, so no `bytes.Index` over a container remains). Witness: `go test ./internal/agent -run 'TestElide|TestObjectValueSpan'` (shrinks an old oversized result; holds the head prefix byte-identical; protects the cache_control, the nested-cache_control, and the recent results; string + array content shapes; the duplicate-`tool_use_id` corruption regression; the deep-anchor regression; fail-safe identity) + `go test ./internal/gateway -run TestMaybeElide` (OFF identity, non-passthrough identity, ON shrinks while the head prefix stays verbatim).
- [SHIPPED] **ctxplan planned VIEW on the Anthropic passthrough — the deferred #555 `req.Raw` transform (#927).** The buffered `maybePlanMessages` path re-plans the DECODED `[]Message`, which could never reach the flagship `fak guard -- claude` route (that route forwards `req.Raw` byte-for-byte so the client's `cache_control` prefix survives → a real upstream cache hit; a re-marshal would reorder JSON keys and bust the cache). `agent.CompactAnthropicHistoryToView` + `gateway.maybePlanAnthropicRaw` close that gap: when `--ctx-view-budget > 0`, each passthrough turn the gateway plans `req.Messages` into an O(1) resident view and materializes it onto `req.Raw` by REPLACING each elided middle message IN PLACE with a same-role `[fak] ctxview-elided` stub — so the message COUNT and the user/assistant role alternation are preserved EXACTLY (Anthropic accepts the body), the protected `cache_control` prefix bytes and every resident message's original bytes are copied VERBATIM (upstream cache hit survives), and the planner's non-contiguous resident-set misses are shed (strictly harder than compaction's contiguous-suffix drop). Gated behind `--ctx-view-budget` (OFF at 0, same posture as the buffered path); fail-safe identity on any ambiguity (no breakpoint, non-JSON, a would-be-elided message that carries its own `cache_control`, tool_use/tool_result blocks fak cannot confidently match — always kept, so tool pairings stay intact, or a splice that fails to re-decode or alters the prefix). Request-side transform only — the kernel still adjudicates the FULL decoded history, so the trust boundary is unchanged. Honest fence: the same-role-stub approach preserves alternation but does NOT reduce the message count (it shrinks bytes, not slots), so a session near Anthropic's message-count limit gains less headroom than compaction's contiguous drop; and the resident set is the heuristic forecast's selection, not an oracle (a miss costs one demand-page fault, never a lost fact — witnessed at the seam in `internal/agent`). Witness: `go test ./internal/gateway -run TestCtxViewHTTPAnthropicPassthrough` (OFF forwards `req.Raw` byte-for-byte; ON stubs the off-topic middle turn beyond the cached system prefix, prefix bytes byte-identical, the elided span demand-pages back under a permissive re-plan); `go test ./internal/agent -run TestCompactToView` (byte-level stub + identity-when-all-resident + tool-blocks-kept).
- [SHIPPED] **In-kernel background-loop runtime (`internal/bgloop` + `fak bgloop`) — the loops the kernel keeps progressing while `fak serve` is up, observable by structure.** The "loops all the way down" story (`docs/explainers/engineering-is-building-loops.md`) and the loop substrate (the `loopmgr` durable ledger + the OS-scheduler adapters; `docs/notes/LONG-RUNNING-AGENT-LOOPS-2026-06-25.md` rungs 1–2) all drive each tick from OUTSIDE the kernel — cron/launchd/Task-Scheduler/HTTP fire it, and `loopmgr` only records what a producer emits ("schedules/spawns/notifies/authorizes nothing"). `bgloop` adds the missing in-kernel RUNTIME + tick source: a `Supervisor` runs each registered `Loop` in its own goroutine on the serve lifecycle context, so a loop progresses BECAUSE the kernel is up, with no external scheduler. It supervises by structure — a Tick that panics or errors is recovered, counted, and restarted under capped exponential backoff (the kernel stays up; a sibling loop is unaffected); on shutdown every loop is joined within a deadline or a timeout names the stuck loop. Wired into `fak serve` (`internal/gateway`: started after the listener binds, joined on graceful shutdown), it registers a built-in `heartbeat` loop and is observable two ways: `GET /v1/fak/loops` (a JSON snapshot — state/ticks/errors/panics/restarts/last-tick per loop; `fak bgloop status` renders it, the read-only twin of `fak ps`) and the `fak_bgloop_*` Prometheus family on `/metrics` (per-loop tick/error/panic/restart counters + a last-tick gauge + an `up` gauge). The runtime is stdlib-only (tier foundation) and exposes two seams a host wires WITHOUT coupling: `WithObserver` (push each tick into the loopmgr ledger so an in-kernel loop also shows in `fak loop status`) and `WithAdmit` (gate fires through `loopmgr.Governor.Admit` for operator pause/disable/cadence-floor). Honest fence: the network CONTROL endpoints (`POST /v1/fak/loops/{id}/fire|signal`, the rest of roadmap rung 3) and remote/typed execution targets (rung 4) are NOT shipped — this is the in-kernel RUNTIME + read-only observability, not the authenticated fire/signal bridge. Witness: `go test ./internal/bgloop` (progress under virtual time via `testing/synctest`; panic-containment leaves a sibling loop ticking; capped error backoff; clean-shutdown join + stuck-tick timeout; admit pause/resume; race-clean snapshot), `go test ./internal/gateway -run 'Bgloop|FakLoops'` (the route returns the heartbeat, the metrics family renders, `New` registers the heartbeat), `go test ./cmd/fak -run Bgloop` (the offline `fak bgloop demo` witnesses a heartbeat progressing while a panicking loop is contained; `fak bgloop status` renders a live snapshot).

## Model routing (per-aspect + ensemble — `fak route`)

- [SHIPPED] Per-aspect model routing as a first-class, deterministic policy spine (`internal/modelroute`): the routed unit is an ASPECT (the whole request, a single tool call, a sub-query, a planner state, a reasoning step), so within ONE request different aspects route to different models, and an ENSEMBLE (a SET of models on one item + a Reduction) is a first-class Plan — not a request-level pick. `Route(Subject) → Decision` selects the first matching rule's Plan (else a fail-closed Default); the policy is a version-tagged JSON manifest loaded at runtime (`DisallowUnknownFields`, round-trips `--dump`↔`--check`), mirroring the capability-floor `internal/policy` idiom. Pure, stdlib-only (architest tier 1). Witness: `go test ./internal/modelroute` (per-aspect-within-one-request routing, first-match, fail-closed default, prefix/complexity/label match, manifest round-trip + unknown-field rejection, determinism).
- [SHIPPED] First-class ensemble REDUCE (`modelroute.Combine`): fold many member outputs into one under a CLOSED Reduction vocabulary — `first` (fastest-wins/fallback), `vote` (weighted majority, deterministic tie-break), `best_of` (judge score), `all_reduce` (weighted numeric mean over SCALAR outputs — not a tensor all-reduce), `concat`. Deterministic given fixed member outputs in member order. The `fak route` verb is the oracle (mirrors `fak preflight`/`fak policy`): `--manifest`/`--aspect`/`--tool`/… prints the Decision; `--simulate "a,b,b"` folds stand-in member outputs through the plan's reduction so the ensemble half runs end to end with no model in the loop; `--dump`/`--check` author and validate. Witness: `go test ./internal/modelroute` (`TestCombine*`), `go test ./cmd/fak` (`TestRoute*` — exit-code + JSON contracts); `examples/model-routing.example.json`.
- [SHIPPED] Honest competitive framing: to our knowledge, fak is the only design that routes at ANY aspect of a single request — each to a different model — with first-class ensembles and configurable reductions under one deterministic, verifiable policy; surveyed routers (RouteLLM, Martian, NotDiamond, Unify) and gateways (OpenRouter, Portkey, LiteLLM) route the WHOLE request to a single model, and the one shipped model ensemble (OpenRouter Fusion) is a fixed parallel-synthesize recipe, not a configurable per-aspect reduction. This is a CATEGORICAL capability gap, NOT a measured speed/quality multiple — any "10×" is a target to be benchmarked, never an inferred or borrowed number; "deterministic" is scoped to the routing DECISION and the reduce FOLD, never to non-bit-exact end-to-end model outputs. Witness: `docs/model-routing.md` (the survey table + the hedged claim).
- [SHIPPED] Rough cost lens — "usage saved vs the SOTA frontier" on every routing decision (`internal/modelroute/cost.go`; surfaced as the `fak route` `usage` line, a per-rule tag in `--check`, and a JSON `usage` object). For a routed Decision it estimates how much CHEAPER (or, for an ENSEMBLE, how much MORE) the chosen Plan is than always-routing that aspect to one frontier model — the naive default a request-level router reduces from. Anchored to the repo's published price convention (Opus-class $3/$15 per Mtok; `experiments/parity`, `cmd/fanbench`), every figure is ROUGH and overridable (`--prices model=in/out`, `--frontier MODEL`) — a cost LENS for choosing a policy, never a bill. HONESTY FENCES: an ensemble's "savings" is NEGATIVE, so it is reported as a deliberate reliability PREMIUM, never dressed up as a saving; an unpriced member is charged at the CONSERVATIVE frontier rate and DISCLOSED (fak never invents a cheap number); a $0 baseline is "not estimated", not a divide-by-zero; the default ladder is proportional (every tier 1:5 in:out) so the saved fraction is blend-independent (identical on input and output tokens). This is a price-rate ESTIMATE, explicitly NOT a measured speed/quality multiple. Witness: `go test ./internal/modelroute` (`TestSavings*` — blend-independence, conservative-unpriced-disclosure, `--prices` override, premium-not-saving, $0-baseline), `go test ./cmd/fak` (`TestRouteUsage*` — the human line, the JSON `usage` object, the `--check` cost lens, the override).
- [SHIPPED] Offline routing benchmark (`internal/modelroute/bench.go`, `fak routebench`): runs a CORPUS of recorded cases through TWO manifests — a per-aspect + ensemble policy vs a single-model baseline (the SOTA shape) — and reports the delta on COST (reuses the cost lens), LATENCY (a rough per-call latency summed over members, the latency analogue of the cost lens), and QUALITY (the fraction of cases whose folded output matches the expected answer, where a vote/best_of ensemble can RESCUE a case a single model misses and a downgrade can LOSE one). OFFLINE means offline: each case carries the STAND-IN OUTPUT every candidate model produces (a recorded answer, never a live model call), so the benchmark reuses the pure `Route` + `Combine` halves over fixed votes — deterministic end to end, no key, no GPU. It measures what the POLICY does to a RECORDED workload, not what a non-bit-exact engine would do live (that is the live-dispatch half, still a stub). HONESTY FENCES: every figure is a ROUGH lens (never a bill or a measured SLA); an unpriced member is charged at the conservative frontier rate in BOTH lenses and DISCLOSED; the built-in demo corpus is an HONEST trade (cost ~20% cheaper, total compute ~10% less, quality TIED — one ensemble rescue offsets one downgrade), NOT a rigged "routing wins everything"; the corpus is a recorded fixture to make the benchmark runnable, not a claim about real traffic. Witness: `go test ./internal/modelroute` (`TestBench*` — exact demo aggregates, determinism, ensemble-rescue-wins-at-premium, downgrade-loses, best_of fold, corpus round-trip + validation, latency-book overlay/parse, unpriced-is-frontier; `TestRoutingBenchFixturesCanonicalAndReproducible` — the committed `examples/routing-bench/` corpus + manifests round-trip byte-exact AND reproduce the documented numbers), `go test ./cmd/fak` (`TestRoutebench*` — default demo, JSON contract, `--dump-corpus`, custom `--corpus`, exit codes); `examples/routing-bench/`.
- [SHIPPED] Fail-closed engine-residency floor (`internal/engine` `residencyGate`): the PDP that denies a tenant-scoped / sensitivity-tagged payload routed to a REMOTE engine now classifies remoteness fail-closed — only a route it can PROVE is on-box (`inkernel` / `local` / `on-device` / `mock` / `cassette`, by family prefix) is local; EVERY other route is remote. This closes the integration hole the old allow-list-of-remote-names form left open: an ensemble member or upstream bound to a LiteLLM / OpenRouter / Portkey / Together / Groq aggregator, a direct provider wire, or a user's own gateway ("their thing") matched none of the known remote substrings and so a sensitive payload sailed past the floor; now an engine the kernel cannot prove local is assumed off-box and denied. The classification stays consistent with the account-switcher's structural engine route (`modelroute.IsRemoteRoute` mirrors the same on-box family list, pinned cross-package). This is the security half of "first-class router / LiteLLM support" — see [`docs/integrations/litellm.md`](docs/integrations/litellm.md), [`docs/integrations/routers.md`](docs/integrations/routers.md). Witness: `go test ./internal/engine` (`TestResidencyGate*` — tenant/sensitive→remote deny, on-box families defer under tenant scope, aggregator/custom routes deny).
- [STUB] LIVE multi-model DISPATCH is not wired: nothing yet writes a single-model `Decision`'s `Plan.Primary()` to `abi.ToolCall.Engine`, nor executes an ensemble Plan as N engine calls + `Combine`. The frozen ABI seam `ToolCall.Engine` ("optional per-call engine route") is reserved and the kernel already routes on it (`kernel.routeFor`), but the gateway/agent loop never sets it (`gateway.buildCall` / `agent.execViaKernel` leave it empty) — so routing decisions are not yet executed. LOAD-BEARING WIRING CONTRACT (documented in the package so the wiring can't regress the default-deny floor): the route MUST be written to `c.Engine` BEFORE `Kernel.Submit` (the residency PDP `internal/engine` reads `c.Engine` inside the adjudication fold to deny a tenant/sensitive payload bound for a remote engine; a dispatch-time override would adjudicate an empty route and fail OPEN); an ensemble expands to N independently-adjudicated submits; the dispatcher preserves member order into the `Combine` fold. Tracked: the model-routing epic (per-aspect Engine wiring, gateway ensemble execution, scout-model live classify, telemetry→learned routing, observability).

## Turn-tax benchmark (`fak turntax`)

- [SHIPPED] `fak turntax` replays a class-labeled trace through the real kernel and prices the extra error-code MODEL turn a SOTA loop fires (malformed/duplicate/poison) vs fak's 1-shot adjudication, per lever, with the safety floor on a separate axis. The fak side is live kernel events (not modeled); the headline is decomposed honestly (forced vs elision) and a happy-path control saves exactly 0. Witness: `go test ./internal/turnbench` (incl. `TestRun_HappyPathSavesNothing`, `TestRun_VDSOAblationIsARealPathSwap`); `TURN-TAX-RESULTS.md`.
- [SHIPPED] Policy-replay spine (`turnbench.RunPolicyReplay`): K policies are scored against ONE recorded trajectory as model-free kernel replays — collapsing a policy comparison from `K × (full agent+model run)` to `1 recording + K deterministic replays` (product → sum), since the model sits below the syscall boundary and re-adjudication touches no engine. The per-policy verdict comparison is MEASURED (live `k.Syscall` counters differ by policy on the same trace); every arm carries a divergence witness — `exact` (every model-observed result class matches the reference, so resolve-rate replays soundly; two DIFFERENT policies can be exact on a trajectory) vs `bounded@i` (the observed result first flips at call i — verdict counters stay real, but resolve-rate past i is counterfactual and refused). HONESTY FENCES: proven on trace fixtures (Call carries its Args payload) — replaying a PRODUCTION corpus needs a payload-bearing trace sink first (the journal stores digests; now SHIPPED — see the `internal/tracesink` row below); the axis is the monitor decision table (Allow/Deny/arg-rules), and a monitor REDACT transform was not yet a divergence trigger (now CLOSED — see the divergence-witness-hardening row below). Witness: `go test ./internal/turnbench` (`TestPolicyReplay_SpineCollapsesPolicyComparison`, `TestPolicyReplay_Deterministic`, `TestPolicyReplay_NoDivergenceControl`).
- [SHIPPED] Divergence-witness hardening + divergence-rate histogram (closes both follow-ups the spine row above named). `RunPolicyReplay` now captures a RAW per-call monitor verdict (`abi.VerdictTransform` by the monitor) alongside the bucketed disposition, so a monitor REDACT whose rewritten args differ from the reference arm is detected as a divergence — a redact-only policy diff comes out `bounded@i`, not a false `exact` (the class-flip and the redact divergence fold, earlier index wins). `RunDivergenceHistogram` (`internal/turnbench/divhist.go`) scores a corpus of traces × candidate policies and emits the `first_divergence` index distribution + the exact-cell fraction — the measure-before-quoting gate that sets the true exact-cell fraction; the `no-divergence` control reads 100% exact. Witness: `go test ./internal/turnbench` (`TestPolicyReplay_RedactTransformDivergence`, `TestDivergenceHistogram_DistributionAndExactFraction`, `TestDivergenceHistogram_NoDivergenceControlIs100Exact`, `TestDivergenceHistogram_Deterministic`).
- [SHIPPED] Payload-bearing, IFC-labeled trajectory sink (`internal/tracesink`) — the production-corpus prerequisite the spine fence named. It registers as an `abi.Emitter` on `EvSubmit`, resolves each call's `Args` payload to bytes, and writes a `turnbench.Trace` carrying the payload plus IFC taint / world-version / args-digest / capture-seq in `Call.Meta`, so a content-inspecting policy (`arg_rules` / `redact_fields` / glob / byte-cap) can re-adjudicate a recorded run that the journal's digests cannot. A captured run round-trips through `RunPolicyReplay` reproducing the original verdict counters; the sink's egress floor mirrors `ifc.SinkGate` (it refuses to persist a payload the floor would block); a trace-is-total witness counts unresolvable calls as dropped. MEASURED: recorder overhead ~1.5 µs/call (~6 orders below a model turn), capture fidelity 1.0. (A new package, not `internal/journal`: a `journal → turnbench` edge would close an import cycle via `internal/registrations`.) Witness: `go test ./internal/tracesink` (`TestCaptureFidelity_ReplayReproducesLiveVerdictCounters`, `TestEgressFloor_RefusesToPersistWhatItWouldBlock`, `TestTraceIsTotal_CompletenessWitness`, `TestRecorderOverheadAndFidelity`).
- [SHIPPED] Per-kernel adjudicator-chain injection (`kernel.WithAdjudicators` + `abi.ScopedFor`): `RunPolicyReplay` now fans its K arms across goroutines — each on a fresh kernel with only the registered chain's monitor rung swapped per arm — instead of mutating the process-global `adjudicator.Default.SetPolicy` serially, so K-policy replay parallelizes with results IDENTICAL to the serial path. Existing `kernel.New(...)` callers are unchanged when no override is supplied (back-compat); `replay()` gained an additive `...ReplayOption`. Witness: `go test -race ./internal/turnbench ./internal/kernel ./internal/abi` (`TestPolicyReplay_ConcurrentEqualsSerial`, `TestPolicyReplay_ConcurrentRepeatable`, `TestNewWithoutOptionReadsGlobalRegistry`, `TestConcurrentInjectedKernelsAreIndependent`).
- [SHIPPED] Fleet counterfactual replay (`turnbench.RunFleetCounterfactual`): re-adjudicate a recorded CORPUS against candidate policies at $0 model and report, from real `k.Syscall` counters, the per-policy security-floor coverage (Quarantines/Denies/Transforms) across the whole population — the floor analog of the turn-tax replay, engine-agnostic so it holds in the API-consumer regime. Every (trace, candidate) cell is labeled `exact | bounded@i`: floor counters reported for ALL cells (MEASURED); resolve-rate reported ONLY for exact cells, bounded cells flagged "needs live re-run from frontier" and never aggregated. `ModelCallsSpent == 0`. Witness: `go test ./internal/turnbench` (`TestFleetCounterfactual_PerPolicyFloorCoverage`, `TestFleetCounterfactual_BoundedCellRefusesResolveRate`, `TestFleetCounterfactual_NoDivergenceControlFullCoverage`).
- [SHIPPED] OPE calibration past the divergence frontier: the `bounded@i` witness now carries a clearly-MODELED off-policy resolve-rate estimate ± CI (`PolicyArmResult.ResolveRateEstimate`, `Modeled=true`) ALONGSIDE — never blended into — the MEASURED floor counters and the `bounded@i` measured-refusal. A bounded doubly-robust (deterministic-policy) estimator: point = the frozen replay's served-fraction; the CI half-width grows monotonically with post-frontier depth and collapses to 0 (estimate == measured) at depth 0. IPS is explicitly refused (deterministic policies degenerate the importance ratio to 0/1). Witness: `go test ./internal/turnbench` (`TestOPE_BoundedArmReportsEstimateAndCI`, `TestOPE_CIWidensMonotonicallyWithDepth`, `TestOPE_ExactArmCollapsesToMeasured`).
- [SHIPPED] Replay-as-fitness policy search (`turnbench` policy-genome search): a deterministic, model-free ($0) hill-climb over the policy genome (Deny-by-name — paraphrase-invariant, on the provenance plane) scored entirely by replay over a frozen corpus on the honest replayable axes — `injections_admitted`, `destructive_executed`, `denies`, `quarantines`. Resolve-rate/completion is NOT a fitness term (the `SearchFitness` struct has no such field). A divergence GATE credits a harmful-sink catch only at-or-before the candidate's first-divergence frontier, so the search cannot win on a counterfactual `bounded@i` branch; top-k frontier candidates are FLAGGED for live re-validation, never run. Witness: `go test ./internal/turnbench` (`TestPolicySearch_OracleReducesInjectionsAtZeroModel`, `TestPolicySearch_DivergenceGateRefusesCounterfactualWin`, `TestPolicySearch_ResolveRateIsNotAFitnessTerm`).
- [SHIPPED] Lever-flip causal attribution (`turnbench.RunLeverFlip` + `abi.WithoutRung`/`RungName`): replay ONE recorded trace through L kernels, each with exactly one rung ablated via a generic per-replay registry mask (composes with the per-kernel injection), and diff `Transforms/VDSOHits/Quarantines/Denies` vs the all-rungs baseline → an exact per-rung attribution table. A rung is named by its self-reported `By`; the vDSO FastPath lever is realized by the existing vdso-off replay arm (architecturally not a chain rung) but flows through the SAME generic diff/witness logic, reproducing the existing `VDSO ON−OFF == VDSOHits` result. Honest gain: `L×K ≈ 10–300×` attribution-coverage/$ — MEASURED, explicitly NOT 10⁹× (the avoided model run is counted once by the spine). Witness: `go test ./internal/turnbench ./internal/abi` (`TestRunLeverFlip_VDSOLeverMatchesLegacyAblation`, `TestRunLeverFlip_GrammarChainRungAblatesCleanly`, `TestRunLeverFlip_AttributionTableShapeAndJSON`).
- [SHIPPED] World-pluggable replay (`turnbench.RunWithWorld`) + the tool-call token ledger demo (`cmd/tokendemo`): `RunWithCalls` is now `RunWithWorld(…, agent.Configure)`, so a demo can replay the SAME grounded machinery against a DIFFERENT tool world. `tokendemo` installs a coding-agent FILE world and scores two HONESTLY-DISTINCT meters. Win 1 (MODEL-CONTEXT): a prefilter on a mutating /bad call (`write_file`/`delete_path`/`run_shell`/`apply_patch` → structural DEFAULT_DENY) means the executed op's result is never produced — only a bounded deny-as-value verdict (~32 tok) enters the model, keeping (R−verdict) tokens out. Win 2 (TOOL-SIDE): a re-read served from the vDSO tier-2 content cache means the TOOL is not re-run (round-trip/latency/compute saved) — but the cached content is still RETURNED to the model (the gateway re-materializes it), so it is explicitly NOT a model-context cut; the model-side prefill/KV reuse is `ctxdemo`'s axis (the live-loop KV-eviction half is mechanism-proven, see docs/FAQ.md). The per-call DENY/DEDUP classification is the LIVE kernel verdict; the per-call result SIZES are a documented `result_tokens` knob (like the turnbench CostModel), so magnitudes are illustrative, not a measured production bill. A clean control saves 0 on both meters (anti-inflation). The deny's SAFETY value is a separate axis (`guarddemo`). Witness: `go test ./cmd/tokendemo` (`TestTokenLedgerInvariants`, `TestDedupIsToolSideNotContext`, `TestCleanControlInflatesNothing`) + `cmd/tokendemo -selfcheck` (win1 1,452 model tok kept out; win2 3 round-trips / 900 tool tok from cache; clean control 0).

## Self-ablation sweep (`fak ablate`)

- [SHIPPED] `fak ablate` generalizes the 2-arm `fak bench` (vDSO on/off) into an N-ARM feature sweep: it replays ONE frozen tool-call trace under a list of feature configs and prints one row per arm with the kernel counters + a per-arm delta vs the baseline, all bound to the trace's single workload hash by an N-arm identical-workload guard (`ablate.Report.Validate`, generalizing `metrics.Report.Validate` from a fixed pair to N) so the deltas are apples-to-apples. It is the deterministic, $0, no-model core of the self-ablation benchmark harness (epic #607). HONESTY FENCE: rung 1 sweeps only the RUNTIME-SETTABLE vDSO knob (`kernel.SetVDSO`, reused via `bench.RunArm`); the ~40 env-gated features (`FAK_NORMGATE` / `FAK_INKERNEL_RADIX` / `FAK_COMPRESSOR` / …) are read at process start and need the subprocess-re-exec rung, and the live-loop + cross-agent (pure fak vs Claude Code / ultracode) arms are separate rungs — `BuildSweep` fails loud on a non-runtime feature rather than silently measuring nothing. Witness: `go test ./internal/ablate ./cmd/fak` (`TestSweep_VDSO_NArmGuardAndIsolatedDelta`, `TestValidate_RefusesMismatchedWorkloadHash`, `TestBuildSweep_UnknownAndDuplicate`, `TestAblateJSONReport`, `TestAblateUnknownFeatureUsageError`); `go run ./cmd/fak ablate --sweep vdso`.

## Cross-agent ablation (Regime B — bare `claude -p` vs `fak guard -- claude -p`)

- [SHIPPED] **`tools/cross_agent_ablate.py` ran the first live cross-agent (Regime B) ablation (epic #607 rung 3, #623) — and on this trivial task the fak guard is a net INPUT-side COST, reported honestly with its real sign.** Regime B = an EXTERNAL model emits different tool calls each run, so the rung-1 `WorkloadHash` identical-workload guard does NOT apply; validity is DISTRIBUTIONAL, not exact-workload. The task `pong` (write `RESULT.txt` == `PONG`, deterministic read-back check) is a TRIVIAL 1-tool first-cut substrate, NOT a hard SWE instance — it stresses the kernel's fixed per-session hop, not its decide quality. K=5 reps/arm, BOTH arms on `claude-opus-4-8` (model held constant ⇒ the token delta is the kernel's, not the model's); both arms succeeded 5/5 (agent-capability `success_rate` 1.0 vs 1.0). MEASURED two-number decompose (mean ± CI95, Student-t, K=5): output FLAT — `claude_code` 126.8 ± 14.0 vs `claude_code+fak` 124.0 ± 10.5 tok (ratio 0.978, saved +2.8 tok within CI), turns 2.0 → 2.0; but total INGESTED input WORSE — 52,077.8 → 81,063.4 tok (ratio 1.557, **saved_total_input = −28,985.6 tok**), because the guard hop reshapes the prompt-cache split (fresh input 2503 → 2144 while provider cache_read 42.6k → 72.5k). The negative is the headline here, never spun as a saving; the +fak adjudication was 5/5 ALLOW (journal_rows=5, zero denies/repairs/quarantines — a benign 1-tool task gives the floor nothing to catch). The controller ENFORCES the validity contract: success-gate (no saved number unless both arms completed AND succeeded), N-run variance (mean ± CI95 over K≥5; `variance_ok` flags K<5), kernel-efficiency REFUSED unless the model is held constant BOTH across arms and WITHIN each arm (`models_seen`), and tokens always DECOMPOSED (input/output/cache_read/cache_create), never summed. HONEST FENCE: ONE tiny tool-light task on ONE Windows host, single OAuth account, single-shot sessions — the cold-prefix cache-split is illustrative, not a fleet SLA; a denial-inducing + multi-tool task and a `pure_fak` arm are follow-on rungs. Witness: `python tools/cross_agent_ablate_test.py` (21 hermetic tests — no network, no `claude`, no `fak` binary); the committed artifact `experiments/ablate/cross-agent-pong-opus.json` embeds its per-rep `raw_reps`, and every aggregate + comparison number re-derives from them offline via `python tools/cross_agent_ablate.py report --reps experiments/ablate/cross-agent-pong-opus.json`.

## Fan-out benchmark (`fanbench` — one master goal → N sub-agents, N=1…1024)

- [SHIPPED] `fanbench` sweeps the one-master-goal → N-subagent fan-out (the orchestrator-worker / lead-subagent topology) from N=1 to N=1024 — the regime no public benchmark maps (multi-agent suites top out at 5–7 agents; see `experiments/fanout/RESEARCH-BRIEF-fanout-2026-06-17.md`, a 19-agent verified survey) — and reports from REAL kernel events the cross-agent tool-result dedup the fan-out buys: a measured SHARED-world vs ISOLATED-world `k.Syscall` path-swap (`cross_uplift = shared − isolated`, the same ablation discipline as `fleetbench`), plus the exact shared-prefix KV-reuse geometry `(N−1)·prefix_tokens` the kernel does not redo (`model.NewBatchFromPrefix` prefills the master-goal prefix ONCE and clones it bit-identical into all N sub-agents). Both the N=1 single-agent control and the `no-share` profile give exactly 0 uplift (anti-inflation). Witness: `go test ./internal/turnbench ./cmd/fanbench` (incl. `TestFanoutNoShareZeroUplift`, `TestFanoutSingleAgentNoUplift`, `TestFanoutResearchPositiveUplift`, and `TestPrefixReuseFanoutWitness` — N clones bit-identical to an independent full prefill); `FANOUT-BENCH-RESULTS.md`.
- [SIMULATED] The token-multiplier, prefix-cache `tax_clawed_back` (~62% at the N≈256 plateau on the default cost model), critical-path-vs-total-work latency, throughput, and the saturation knee (parallel speedup plateaus ~73× as the fold's coordination cost grows with N) are a TRANSPARENT, knobbed cost model (`FanoutCostModel`) priced at documented Anthropic prompt-cache multiples — reported apart from the measured halves, never blended. HONESTY GUARDRAIL: this prefix-reuse number is the **reuse-vs-no-reuse / vs-stateless-consumer** ablation (the win over a stack that re-sends the master-goal prefix per sub-agent, the common framework default), NOT a head-to-head win over a tuned shared-prefix engine (SGLang/RadixAttention/vLLM-APC also prefill the prefix once); fanning out to N=1 is even a small net LOSS (orchestration + cache-write overhead). See `FANOUT-BENCH-RESULTS.md` §2.
- [SHIPPED] `fanrun` (`cmd/fanrun`, engine `internal/bench/fanrun.go`) is the MEASURED live capstone to `fanbench`'s modeled curve: it actually RUNS N real agent sessions — each a genuine `internal/agent.RunArm` loop through a real `kernel.New("localtools")` with the vDSO fast path on and real tool dispatch across the syscall boundary — all decomposing ONE shared research goal, and WALL-CLOCKS the wave, swept N=1…1024. Every field is a wall-clock, a real kernel counter, or exact geometry; the artifact carries NO modeled fields (asserted by a test gate). On a CPU-only box (no GPU, no model weights, no API key — a deterministic offline research planner drives each sub-agent) at N=1024: **1,024 real agent sessions complete the goal end-to-end** (`tasks_completed=1024`, `tool_errors_total=0`) in **364 ms total serial wall-clock** (~0.36 ms/agent, ~2,800 agents/s), with **3,069 real cross-agent vDSO dedup hits** (the sibling-only delta over the N=1 baseline) and **`vdso_fills` FLAT at 3 for every N** (sub-agent 0 warms the shared reads; all 1,023 siblings reuse them — a warm *per-agent* cache would fill 3·N), and **2,095,104 prefix tokens elided = exactly (N−1)·P**. With `-model-dir` the prefill-elision lever is additionally wall-clocked as a reuse-vs-no-reuse prefill race (the `cmd/fleetserve` methodology): 3.4× (N=4) / 8.2× (N=16) / 11.7× (N=64). HONESTY FENCE: **SERIAL by construction** — the kernel's fast-path world-version is process-global, so the N sub-agents share one epoch (which is exactly what makes cross-agent dedup real) and run one after another; `agents_per_sec_serial` is N÷Σt, explicitly **NOT a parallel rate**, and fanrun does **not** reproduce or claim fanbench's modeled 72.8× parallel speedup. The read-only research role is faithful to the orchestrator-worker pattern (sub-agents gather; the lead folds) and is what keeps the shared cache warm — a sub-agent that wrote would bump the world and strand the fleet. The no-share profile gives exactly 0 cross-uplift at every N (anti-inflation control). OPEN (#982): a real-MODEL fan-out (live decode per sub-agent) is reachable on the lab GPU fleet, tracked as the next rung. Witness: `go test ./internal/bench ./cmd/fanrun` (`TestFanrunSmallEndToEnd`, `TestFanrunDeterminism`, `TestFanrunNoShareZeroUplift`, `TestPrefixElisionGeometry`, `TestCrossHitsScaleWithN`, `TestFanrunReportShape` — no-modeled-field + no-timestamp gates, `TestFanrunCounterProjectionReproducible`); artifact `experiments/fanout/fanrun.json`; `FANOUT-BENCH-RESULTS.md` §0.
- [SIMULATED] The fan-out **task-quality** litmus (`tools/fanout_taskquality.py`, artifact `experiments/fanout/taskquality-litmus.json`, issue #429) runs a controlled one-goal → N-subagent suite with a known ground-truth atom set and reports the metrics the cost grid cannot — coverage@N, realized@N, verifier success, duplicate-work rate, failed/irrelevant-subagent rate, and injection containment — each JOINED to the MEASURED fanbench cost cell for the same N. The task OUTCOMES are a transparent knobbed model grounded in published anchors (homogeneous-pool ~4-agent saturation, imperfect-verifier K≤5 realized inversion, MAST 15.7% step-repetition, ~33–59% naive-MAS correctness) and the REAL injection quarantine evidence in `LIVE-RESULTS.md`; the cost columns are joined verbatim from the measured `fanbench-research.csv`. HEADLINE (honest separation): a **matched-budget single-agent control** matches or beats the fan-out on coverage at every N, realized@N peaks (N=64) then declines (N=256), so **fan-out saves cost/latency but does NOT prove better task quality** — only injection containment (fak 1.0 vs naive 0.0) changes the delivered outcome. NOT a real-model run (that half stays open, #106). Witness: `python tools/fanout_taskquality.py --check` reproduces the artifact byte-for-byte; `FANOUT-BENCH-RESULTS.md` §5.

## Ultra-long-context work floor (`longctxbench` — per-agent context > 100k tokens)

- [SHIPPED] `longctxbench` / `turnbench.RunLongContextLadder` compute the EXACT, contention-free work floor for the >100k-token regime as closed-form arithmetic from the session shape (P,T,C,D,R) and the model geometry — no model, no decode, no wall-clock — the regime sessionbench cannot run live because the naive arm's O(T²) re-prefill is intractable. Two floors: a TOKEN floor byte-identical to `cmd/sessionbench`'s `prefillTokens` (cross-validation), and an O(L²)-aware FLOP floor that counts the prefill-attention quadratic exactly (`n·prior + n²/2` query-key pairs per append). At the canonical ladder (Qwen2.5-7B geometry): a single >100k session eliminates **~10× vs naive re-prefill · ~1× vs a warm cache** (9.9× token / 9.5× FLOP, B/C ≡ 1.0 — no peer to share with), and a 5-agent fleet each >100k eliminates **~40×+ vs naive · ~4× vs a tuned warm-cache per-agent KV** (42.1× token / 34.4× FLOP / 4.3× B/C). A/C is vs the NAIVE re-prefill REFERENCE (not a serving baseline); B/C is vs the warm-cache serving baseline; both reported side by side. Decode-batching is a BANDWIDTH win (proven elsewhere) and is deliberately EXCLUDED so the floor isolates reread-elimination and never double-counts; B/C is therefore LOWER than the live sessionbench B/C by exactly that omitted term. The anchor row's token A/C of 62.0× reproduces the committed `62.0× token floor` for the 50×5 P=2048 session (independent correctness witness). Witness: `go test ./internal/turnbench` (`TestLongContextTokenFloorMatchesSessionbench`, `TestLongContextAntiInflation` — C=1 ⇒ B/C≡1, `TestLongContextHeadlineRegimes`, `TestLongContextBOverCMonotoneInPrefix`, `TestPrefillWorkQuadraticDominates`, `TestLongContextDecodeFLOPsInvariant`, `TestRunLongContextLadderDeterministicAndPicksRegimes`); `ULTRA-LONG-CONTEXT-RESULTS.md`; `experiments/session/ultra-long-context-floor-20260622.json`.
- [SIMULATED] The live WALL-CLOCK validation of the floor's ratios at >100k (the floor↔wall-clock loop sessionbench closes at small scale via `-validate`) needs a model resident on a GPU bench node and is not run on the build box; the floor itself is exact arithmetic, but the absolute wall-clock at this regime is a separate, gated measurement. Empirically gated: a 100k prefill in the pure-Go forward is intractable on a CPU host (measured ~120→29 t/s falling with context length on this box; only the llama.cpp Metal lane reaches 100k in bench-tractable time), so the anchor awaits a resident-GPU bench node. The step-by-step procedure to produce the live artifact and promote this line to SHIPPED is `experiments/session/ULTRA-LONG-LIVE-ANCHOR-NOTES.md` (#524). Witness: tracked in #524; the floor's WORK numbers (the SHIPPED line above) stand independently.

## Engine

- [SHIPPED] OpenAI-compatible `/v1/chat/completions` client, base_url-swappable local↔remote, bounded timeout + backoff; cassette record/replay for deterministic offline runs; token-usage extraction; a deterministic mock engine. Witness: `engine` tests (units 39–45).
- [SIMULATED] metrics-service scrape adapter / KV-residency / token-per-watt: labeled SIMULATED telemetry — there is no **watt source** on the build box (units 43, 78). (There IS now a GPU — see the AMD Vulkan backend below — but no power telemetry, so token-per-watt stays simulated.)
- [SHIPPED] **Hardware-aware cache placement & lifecycle (CXL/NUMA-far tiers, zero-copy share, per-tier TTL, demote-not-evict).** `internal/cachemeta` models the physical memory hierarchy as first-class metadata: **CXL** and **NUMA-far** residency tiers slotted into the HBM→DRAM→…→Disk ladder; a `TierProfile` per tier (latency / bandwidth / capacity / byte-addressable / coherent / persistent); a zero-copy `ShareKind`/`ShareDescriptor` on `Residency` (copy / mmap / CXL-HDM / RDMA / dma-buf, fail-safe **copy** default); **per-tier TTL** + a multi-state lifecycle (filling→resident→expiring→expired/spilled→evicted) with a wall-clock-free `Advance`; and a hardware-cost-driven `PlanPlacement` that **DEMOTES a hot KV prefix to CXL far memory instead of evicting it** — emitting the existing `KVTransfer` offload/restore directives — when the colder tier beats recompute cost, evicting only when nothing colder has room or the span is cheaper to rebuild. It is the payload-free **policy plane** (cachemeta touches no bytes); the physical CXL/RDMA movement is performed by the engine adapter that consumes the directives. Witness: `go test ./internal/cachemeta` (per-tier TTL expiry, demote-skips-full-to-CXL, spill-only-disk, cheap-span-evicts, promote-hot); `go run ./cmd/hwcachedemo` (deterministic — 28000 prefill tokens saved by demoting vs blind LRU evict). See `docs/serving/hardware-aware-cache.md`.
- [SHIPPED] **Capacity engine adapter — executing a `PlanPlacement` demote/spill against the live KV cache (#708, Plank 4 of the capacity bridge).** `internal/engine.CapacityAdapter.Execute` turns a `cachemeta.PlacementDecision` (the payload-free POLICY plane's verdict) into a real move against the kernel-owned cache: for a demote/spill it STAGES the span to the colder tier (`abi.KVBackend.StageSpan`, addressed by digest so the disaggregated direction survives) and then EVICTS it from the live KV tier (`abi.KVBackend.Evict`, the proven re-RoPE/renumber primitive) — the control path the two-plane gap was missing (the policy and physical planes previously met only at the meter). It is FAIL-SAFE: the live copy is staged BEFORE it is dropped, so a typed staging MISS/FAULT retains the span rather than losing it, and every transition is recorded through the same `CacheEventRecorder` as a typed offload event — a staging fault is a FAULT(residency_fault), never a silent recompute. An evict (no colder tier had room) skips staging; a promote (KVRestore) is the reverse direction and is left for the restore path. Witness: `go test ./internal/engine -run TestCapacityAdapter` (demote+spill stage-then-evict into a typed HIT offload; a stage fault/miss/transport-error retains the span and records a typed FAULT; a real backend's measured stage bytes win over the decision's estimate; evict skips staging; promote/keep not applied). Honest fences: the adapter executes a supplied placement decision; the pressure sweep now derives those decisions for caller-supplied candidates, but the live serving loop still does not invoke it automatically, runtime allocator OOM recovery is limited to classification plus the served path's idle-pool retry (not live spill/demote), and promote/restore stays on the restore path. See `docs/explainers/hardware-limits-and-capacity.md` §4.
- [SHIPPED] **Capacity pressure sweep — report→policy→execute loop for KV pressure.** `internal/engine.RunCapacityPressureSweep` binds the capacity bridge's report, planner, and executor into one bounded loop over caller-supplied KV candidates: it derives HBM pressure from the backend (`DeviceHBMPressure`), scales it to an operator high-water mark so "80% full" can be treated as placement pressure before allocator OOM, calls `cachemeta.PlanPlacement` through `PlanPlacementForDeviceAtHighWater`, executes demote/spill/compress-demote/evict through `CapacityAdapter`, and stops when estimated HBM pressure falls below target, the move cap is reached, or candidates run out. Successful HBM→DRAM/CXL moves land in the cache-event stream as `memory_class="ddr_cache"`; spill tiers remain `offload`; staging faults retain the live span and count as typed faults, not silent recompute. Unknown capacity fails open with no moves. Honest fences: this is the reusable engine pressure-relief primitive, not yet an automatic served-decode hook; the serving/cache owner still supplies candidate ordering, exact resident-byte accounting, restore, and retry policy. Witness: `go test ./internal/engine -run "Test(CapacityPressureSweep|PlanPlacementForDevice)"`.
- [SHIPPED] **Classed capacity fit + GGUF serve load-time refusal (Plank 1/5 of the capacity bridge).** `compute.MemoryPlan` / `MemoryDemand` preserve the byte class behind a fit request (`weights`, `kv_cache`, `ddr_cache`, `offload`, `scratchpad`, `activation`) and now carry scope (`device` default, `host` for CPU-offloaded expert bytes), so `RefuseMemoryPlanIfTooBig` keeps host offload visible in the typed `FitError` without counting it against VRAM. CUDA reports total/free VRAM through `cudaMemGetInfo`, Vulkan reports total device-local heap bytes plus current free device-local budget when the driver exposes `VK_EXT_memory_budget` (otherwise `free=FreeUnknown`), and Metal reports the device's recommended working-set size as a known total with current free bytes kept unknown, while unknown-capacity backends still fail open. The same classed fit contract also exposes optional `HostCapacity` / `Caps.HostCapacityProbe`: native GPU backends advertise it when a stdlib OS host-memory probe succeeds (Windows `GlobalMemoryStatusEx`, Linux `sysinfo`, Darwin `hw.memsize` total with `free=FreeUnknown`), so `RefuseMemoryPlanIfTooBig` checks host-scoped `offload`/`ddr_cache` bytes after VRAM and returns a host-scoped `FitError`; when no host probe is advertised, host-scoped bytes remain visible and fail open. `ggufload.WeightSource` now estimates the raw/lean GGUF payload plan (`EstimateLoadMemoryPlan`), the f32-resident plan used by `LoadModel` (`EstimateF32LoadMemoryPlan`), and the `--cpu-offload-experts` split plan (`EstimateCPUOffloadExpertsMemoryPlan`: dense/router/attention weights device-scoped, routed/shared experts host-scoped) from the tensor directory before allocation; `compute.EstimateKVStoreMemoryPlan` adds the HAL KV-cache demand (`Kraw` + `K` + `V` f32 rows) from model geometry and planned context tokens, and `compute.EstimateHALTransientMemoryPlan` adds a conservative f32 HAL activation/scratchpad demand for the token path. `fak serve --gguf --backend` resolves the device backend before eager model load and refuses a known-too-large classed plan: Q8/raw weights plus f32 KV/activation/scratch on quantized-upload backends, f32 weights plus the same runtime demands on f32-only backends, and dense+KV+HAL-transient VRAM accounting for expert-offload mode while host experts remain visible as host-scoped `offload`. On a successful eager load, the gateway carries that same admission profile into observability: `/metrics` exports `fak_model_load_memory_plan_bytes` by class+scope, `fak_model_load_memory_plan_dtype_bytes` by class+scope+bounded dtype/storage label, `fak_model_load_memory_capacity_*` for device/host capacity known/free-known/bytes, the reserved headroom ratio, and `fak_model_load_memory_fit_bytes` want/budget/margin rows by scope, while `/debug/vars` keeps the detailed plan rows, dtype labels, capacity snapshot, and `memory_fit` rows. Honest fences: safetensors, generic `model.Load`, runtime upload pre-checks, cgroup/container host limits, backend-specific transient peaks, and Metal live-free-memory probing are not wired; model-load telemetry is visibility over the pre-check and mixed-precision placement, not spill/retry or quantized KV. Witness: `go test ./internal/compute -run "Test(DeviceMemoryInfo|HostMemoryInfo|HostSystemMemoryProbe|CapacityProbe|DeviceCapacity|HostCapacity|FitsOnDevice|FitsOnHost|FreeUnknown|FitVerdict|Refuse|MemoryPlan|EstimateKVStore|EstimateHALTransient)"`; `CGO_ENABLED=1 go test -tags metal ./internal/compute -run TestMetalDeviceMemoryInfoReportsWorkingSet` on Apple Silicon; `go test ./internal/ggufload -run "Test(Estimate|Fit)"`; `go test ./cmd/fak -run "Test(GatewayLoadProfileCarriesServeMemoryPlanAndCapacity|FitServeGGUFOnDevice|ServeGGUFMemoryPlan|ServeGGUFCPUOffload)"`; `go test ./internal/gateway -run "TestModelLoadMetricsSuppressedUntilSet"`; `pwsh -File internal/compute/build_vulkan.ps1 test` (sets Vulkan CGO flags and runs the tagged compute/model suites, including the Vulkan memory-budget capacity probe when the driver supports it); `bash internal/compute/build_cuda.sh test` on a CUDA node (includes `TestCUDADeviceMemoryInfoReportsCurrentFree`).
- [SHIPPED] **Classed runtime device OOM recovery, request-time fit refusal, and visibility on the served in-kernel path (Plank 2/5 slice).** `compute.DeviceAllocError` carries failed bytes, allocator `Site`, and `MemoryClass`; CUDA/Metal/Vulkan allocator choke points raise it for nil device allocations with known classes where the allocation purpose is known (`weights`, `kv_cache`, `offload`, `scratchpad`, `activation`, otherwise `unknown`). Device KV cache growth/clone/preallocation paths are tagged `kv_cache`; HAL host uploads carry their purpose (immutable weight uploads stay `weights`, while the per-token f32 input upload is `activation` and bypasses backend weight-upload caches); GLM-DSA backend runtime operands for dense GEMM, sparse attention, index selection, and LM head are tagged `activation`; and the standalone paged-weight primitive tags each page-in allocation as `offload`. `agent.InKernelPlanner` recovers only that typed allocation fault into `InKernelOOMError`, preserving class/site; on the served backend path it now makes one bounded retry after asking the backend to recycle/trim idle transient pools (`Recycle`, `Trim`, or `TrimLarge(0)`) so a stale scratch bucket can be released before the request is refused. It also runs a backend-request capacity precheck after tokenization: the planned prompt+`max_tokens` KV window plus f32 HAL activation/scratchpad estimate is refused as `InKernelCapacityError{Site:"capacity-precheck"}` when a capacity-reporting backend says it cannot fit. When current free bytes are known, that request precheck can make one proactive idle-pool trim before decode if the plan is already over budget or within the low-margin pressure band, then rerun the fit check; a trim that makes the request fit proceeds instead of returning the capacity refusal. When current free bytes are known the request check does not double-count resident weights; when only total capacity is known it includes resident weights; when capacity is unknown it fails open. The gateway keeps the distinct 503 `in_kernel_oom` response while surfacing the class in the client-safe remedy string. The same classification lands in live observability: `/metrics` exports `fak_gateway_in_kernel_oom_total`, `fak_gateway_in_kernel_oom_failed_bytes_total`, and `fak_gateway_in_kernel_oom_last_failed_bytes` by memory class for allocation OOMs and capacity refusals, while `fak_gateway_in_kernel_oom_retry_total` reports post-OOM idle-pool retry attempts/successes/failures by backend and memory class, `fak_gateway_in_kernel_memory_pressure_trim_total` reports pre-decode pressure trims by backend/scope/class/reason/outcome, and the paired last-byte gauges/debug rows keep the latest sizing and trigger site without making allocator sites Prometheus labels. Honest fences: this is still panic/recover below the HAL for allocator OOMs and a precheck for request sizing, not ordinary allocator `error` returns; the trim hooks free only idle pools and do not demote/spill live KV or weights; tagged backend source needs the relevant GPU/tag build to exercise device-specific allocation failures; and generic allocator sites can still be `unknown`. Witness: `go test ./internal/compute -run TestDeviceAllocError`; `go test ./internal/model -run "Test(HALHostUploadsCarryMemoryClass|BackendKernelRuntimeUploadsCarryActivationClass|PagedKernelPageInUsesOffloadClass)"`; `go test ./internal/agent -run "Test(RecoverDevicePanic|PrepareDeviceOOMRetry|InKernelRequest|InKernelOOMRetryStats|InKernelRequestPressureTrim)"`; `go test ./internal/gateway -run "Test(InKernelOOMMetricsAndDebugVars|InKernelOOMRetryMetricsAndDebugVars|InKernelPressureTrimMetricsAndDebugVars|UpstreamErrorStatus)"`; `pwsh -File internal/compute/build_vulkan.ps1 test` (sets Vulkan CGO flags and runs the tagged compute/model suites).
- [SHIPPED] **Request-time in-kernel capacity precheck.** Before a served device-HAL `Complete` runs prefill/decode, `agent.InKernelPlanner` now builds a classed request `MemoryPlan` from prompt+`max_tokens` KV-cache geometry plus HAL activation/scratch/logit transients, includes resident weights only when the backend reports total capacity but not current free memory, and routes the plan through `compute.RefuseMemoryPlanIfTooBig` with the same headroom discipline as load admission. A known-too-large request returns `InKernelCapacityError` before allocator touch unless a one-shot pre-decode idle-pool trim turns current-free pressure back into a fit; the gateway maps remaining refusals to the same local `503` / `in_kernel_oom` client code and folds them into the in-kernel OOM metrics/debug family by memory class and `capacity-precheck` site. Successful backend requests are visible too: `agent.RequestMemoryReporter` exposes the last prompt/max_new/planned-token window, class/scope/dtype request plan, headroom, and device/host capacity snapshot; the gateway renders the detailed latest plan as `fak_gateway_in_kernel_request_memory_*` gauges, including per-scope want/budget/margin fit rows, plus `/debug/vars.request_memory`. The gateway also aggregates every observed served backend request plan into process-lifetime rows: `fak_gateway_in_kernel_request_memory_observations_total`, per-class plan observations/byte totals/high-water gauges, token totals/high-water gauges, fit observations/want high-water/margin low-water gauges, and `/debug/vars.metrics.request_memory*`; pre-decode pressure trims are separately counted as `fak_gateway_in_kernel_memory_pressure_trim_total`. Honest fences: unknown capacity still fails open, the detailed request-memory gauges remain last-request snapshots, aggregate totals/high-water rows reset with the process and are not histograms or policy, this is a refusal/visibility/idle-pool-cleanup surface rather than live spill/demote, and backend-specific transient peaks can still exceed the conservative HAL estimate. Witness: `go test ./internal/agent -run "Test(InKernelRequest|InKernelRequestPressureTrim)"`; `go test ./internal/gateway -run "Test(RequestMemoryMetricsAndDebugVars|RequestMemoryAggregateMetricsAndDebugVars|InKernelPressureTrimMetricsAndDebugVars|InKernelOOMMetricsAndDebugVars|UpstreamErrorStatus_InKernelCapacity)"`.
- [SHIPPED] **Resident KV-prefix memory visibility.** The in-kernel planner now implements an optional `agent.KVMemoryReporter` that reports local KV-cache residency as `kv_cache` memory: bytes per KV position from the same `compute.EstimateKVStoreBytes` geometry used by admission planning, true resident `PrefixTokens`, estimated resident bytes, configured radix LRU budget tokens, current LRU edge-token count, tree nodes/leaves/depth, splits, and LRU vs policy evictions. The same snapshot carries capacity/fit visibility: host radix KV uses the OS host-memory probe (`HostSystemMemoryInfo`) and device-backed planners use `DeviceMemoryInfo` when advertised, then the gateway exposes capacity-known/free-known, capacity bytes, headroom, and `want`/`budget`/`margin` fit rows as `fak_gateway_kv_memory_*`; resident-cache budget uses `free + resident` when free memory is known so the already-allocated cache is not double-counted as unavailable. `/debug/vars.kv_memory` carries the same fields, including `dtype="f32"` for the current HAL KV row storage. Non-reporting proxy/mock planners emit no resident-KV series, and a device backend currently reports per-token geometry plus capacity with `enabled=false` because device-HAL serve uses per-request backend sessions rather than a persistent device-side radix tree. Honest fence: this is visibility over local KV-prefix residency and fit headroom; it does not yet wire device-side radix reuse, quantized KV, pressure-driven demote/spill, or KV-pressure retry. Witness: `go test ./internal/gateway -run "Test(KVMemoryMetrics|MetricsExposesKVPrefixReuse)"`; `go test ./internal/agent -run "TestInKernelKVMemoryStats"`; `go test ./internal/compute -run "TestHostSystemMemoryProbeIsSaneWhenAvailable"`.
- [SHIPPED] **Memory-classed engine cache-event visibility for DDR cache tiers.** `engine.CacheEventMetrics` now projects every KV residency event's destination tier into the same memory-class vocabulary used by fit/OOM surfaces: `HBM -> kv_cache`, `DRAM`/`NUMA-far`/`CXL -> ddr_cache`, `Disk`/`Remote`/`Provider -> offload`, and missing tiers -> `unknown`. The Prometheus breakdowns carry `memory_class` on `fak_engine_cache_event_breakdown_total` and add per-class byte/token counters (`fak_engine_cache_bytes_moved_breakdown_total`, `fak_engine_cache_tokens_moved_breakdown_total`), so a demote into host DRAM is scrapeable as `memory_class="ddr_cache"` rather than only `to_tier="dram"`. Honest fence: this is visibility over cache residency metadata; it does not yet feed back into spill/retry policy or allocate DRAM itself. Witness: `go test ./internal/engine -run "Test(CacheTierMemoryClassProjection|CacheEventMetricsExposedAsPrometheus)"`.
- [SHIPPED] **AMD GPU backend (Vulkan compute).** A `//go:build vulkan` `compute.Backend` (`internal/compute/vulkan*` + SPIR-V `shaders/*.comp`) runs the in-kernel model on a **real AMD Radeon RX 7600** (RDNA3, via the native Windows Vulkan loader), registered as an `Approx` peer so `cpu-ref` stays the Default. **Numerical parity witnessed:** the full SmolLM2-135M forward pass is argmax-exact with **prefill-logit cosine = 1.0** vs cpu-ref, and all 7 op kernels pass the Approx gate. Witness: `pwsh -File internal/compute/build_vulkan.ps1 test` (sets Vulkan CGO flags; runs TestVulkan* and TestHALVulkanForwardMatchesNative); `VULKAN-AMD-RESULTS.md`.
- [SHIPPED] **llama.cpp parity — numerical YES, throughput NO.** The Vulkan f32 path is correct but ~37× slower than llama.cpp Vulkan (decode **394 ms/tok / 2.5 tok/s** on the RX 7600, after FFN-tail fusion, vs llama.cpp Vulkan 609.2 tok/s on the same GPU), because it issues one `vkQueueSubmit`+fence per primitive op (~300/token). Q8 device GEMM has since landed (**24.6 tok/s, ~1.49× vs the f32 GPU path**; and the CPU's small-model lead narrows from 7.2× at 135M to 1.16× at 1.5B as per-token compute grows — see `BENCHMARK-AUTHORITY.md`); the remaining levers (single command-buffer per forward pass, sub-buffer tensor allocation, async submission) are tracked follow-ups; the backend honestly advertises `Async=false`/`FusedAttn=false`/`GraphCompile=false`. Claiming throughput parity would be false. See `VULKAN-AMD-RESULTS.md` Rung 2.
- [SHIPPED] **NVIDIA GPU backend (CUDA) — decode parity with llama.cpp.** A CUDA `compute.Backend` (`internal/compute/cuda*`, `cuda_kernels.cu`) runs the in-kernel forward pass on a **real RTX 4070** (WSL2 passthrough), argmax-exact vs cpu-ref. With the reusable CUDA graph (`FAK_CUDA_GRAPH=1`, kernel KV-append + cross-session weight share) decode reaches **~119–120 tok/s — dead even with `llama.cpp` Q8_0 (120 ± 15 tok/s)** on a model that fits the GPU, and at **higher precision (fak runs f32, 4× the bytes of llama.cpp's 8-bit Q8_0)** at ~46% GPU utilization — a 16× decode speedup (7.5 → 120). The parity is on a *small* model (a 7B f32 set won't fit WSL's ~15 GB RAM, so large-model parity is not claimed); fp16 is tracked in issue #34. Witness: `GPU.md` §3b (real bench output, `llama-bench` reference).
- [SHIPPED] **NVIDIA datacenter GPU (8-GPU datacenter server, sm_80) — pure-kernel witnesses + end-to-end decode.** The `-tags cuda` backend builds for `sm_80` (`nvcc` → `libfakcuda.a`, `go build` green) and, in isolation on a real datacenter GPU, **passes** the pure-kernel device witnesses: `TestCUDAForwardMatchesRef` (full multi-layer decode forward, **argmax-exact, logit cosine = 1.0**, graphs off *and* `FAK_CUDA_GRAPH=1`), `TestCUDAFlashAttentionMatchesRef` (MHA/GQA/MQA cosine = 1.0), Q8_0 GEMV (cosine 0.99999970, argmax-exact) + batched (0.99999969), Q4_K batched (cosine 1.0), and the VRAM witness. End-to-end, **SmolLM2-135M Q8 decodes at 127.8 tok/s on the datacenter GPU through the pure `k_q8_gemm` + `k_flash_attention` path — zero cuBLAS** (`modelbench -backend cuda -lean`; required fixing the lean-Q8 resident-upload path, `cuda.go uploadQ8Resident`). **Honest findings (filed, not hidden):** the Q4_K **GEMV** argmax-exact gate is too tight for a 4-bit format (kernel correct — Q4_K batched passes at cosine 1.0); the combined `-tags cuda` suite panics under the graph pass (a 1-D weight reaches MatMul — a test-ordering/graph-path bug, not a kernel defect). Witness: `tools/dgx_pure_kernel_run.sh` + `tools/dgx_pure_kernel_bench.sh`; `docs/notes/GLM52-PURE-KERNEL-ON-GPU-SERVER-2026-06-21.md`.
- [SHIPPED] **GLM-5.2 (glm_moe_dsa) dense compute on the GPU pure kernel — #86 first slice, datacenter GPU-witnessed.** `requireGLMDsaSession` no longer panics on a `compute.Backend`; GLM-5.2's **MoE/FFN experts + router (via `backendKernel` in `decodeBandGLMDsa`) and the vocab head (`glmDsaHead`)** route through the backend, and on a lean Q8 model run on **`k_q8_gemm` — the pure fak GPU kernel** (the MoE/FFN is the bulk of GLM-5.2's params). Witnessed: `TestGLMMoeDsaBackendGEMMMatchesCPU` (cpu-ref, **bit-exact max|Δ|=0 + argmax-exact** vs all-host CPU; 23 prior GLM-DSA witnesses stay green) and **on the datacenter GPU `TestCUDAGLMMoeDsaBackendForward`: cosine = 1.000000, argmax-exact** vs the CPU Q8 forward (`tools/dgx_glm_gpu_witness.sh`). The DSA sparse-attention (learned-indexer top-k + sparse gather/softmax/ΣwV) + DSA KV stay **host-side** — a fused sparse-attention CUDA kernel + device DSA-KV is the next #86/#413 slice, bounded in the doc. So GLM-5.2's dense path is pure-GPU; its DSA attention is not yet.
- [SHIPPED] **Apple Silicon GPU backend (Metal/MPS) — first light (issue #300 / C-001).** A `//go:build darwin && metal` `compute.Backend` (`internal/compute/metal*`) runs the in-kernel forward pass on a **real Apple M3 Pro** GPU, registered as an `Approx` peer so `cpu-ref` stays the Default. GEMM uses `MPSMatrixMultiplication`; the seven elementwise/reduction ops are runtime-compiled MSL compute kernels (compiled in-process by cgo's clang — no offline kernel build). **Numerical parity witnessed:** a full multi-layer synthetic Llama decode (6-token prompt + 8 greedy steps) is **argmax-exact** with **logit cosine = 1.0** vs cpu-ref, and the op-level MPS MatMul matches at cosine = 1.0 (max|Δ| = 1.9e-6). Throughput is **not** yet claimed: this synchronous (encode→commit→wait per op) first increment targets correctness; batched command buffers, async, and quantized device GEMM are tracked follow-ups (the Go MatMul refuses non-F32 weights). Witness: `CGO_ENABLED=1 go test -tags metal ./internal/compute/` (TestMetalMatMulApproxMatchesRef, TestMetalForwardMatchesRef).
- [SHIPPED] Live-seam honesty: a run carries a real transcript hash XOR the explicit RED flag `live_seam_unverified` — never a silent skip (unit 46).
- [SHIPPED] The live seam is now exercised end-to-end: `fak agent` drove this kernel with a real OpenAI-compatible model (gemini-2.5-flash / -flash-lite and local Qwen2.5-1.5B/0.5B), every run carrying a real `transcript_sha` (not the `live_seam_unverified` flag). The v0.1 `fak bench` remains a deterministic OFFLINE replay by design; the live A/B is the separate `fak agent` lane. Witness: `experiments/agent-live/*.json` (each `live:true`); see `LIVE-RESULTS.md`.

## Stewards + RSI ship-gate

- [SHIPPED] Single-invariant stewards (secret-in-context, lease-disjointness, kpi-regression, vdso-soundness) that fire only with an independently-authored witness; a meta-steward prunes never-firing stewards. Witness: `steward` tests (units 87–92).
- [SHIPPED] RSI-as-ship-gate: keep-or-revert on a non-forgeable keep-bit (strict metric gain AND suite-green AND truth-clean), applied in an isolated git worktree; a run of non-keeps trips an escalation breaker. Witness: `shipgate` tests (units 93–95).
- [SHIPPED] RSI **closed loop** (`internal/rsiloop`, `cmd/rsiloop`): the true loop over `cmd/rsicycle`'s one-shot. Where `rsicycle` takes the keep-bit's witnesses (before/after/suite-green/truth-clean) AS FLAGS, `rsiloop` DERIVES every one from a real run it performs itself — it forks a detached worktree off `main`, rewrites the tunable (`DefaultCacheSize`), measures a deterministic KPI by running `cmd/kpiprobe` there, takes suite-green from a real build+vet and truth-clean from the worktree's git status, then folds through `shipgate.Evaluate` + `shipgate.Gate`. The baseline is re-measured from `main` every run (it competes against LATEST main, never a stale local number), and KEEPs recursively advance the running bar. `-mode track` records that `main` measurement to an append-only JSONL journal — the ongoing benchmark-against-main series, with vs-last-point regression detection (exit 3 to alert). The loop never mutates `main`: a kept candidate advances only the in-memory baseline + the journal; landing it is a separate gated step (EXTENDING.md "Land it"). Honesty fences: the cache-size demo KPI is a real but *deterministic* LRU hit-rate (wall-clock-free, reproduces bit-for-bit cross-platform — a legal witness per `docs/proofs/00-METHOD.md`), the suite-green gate defaults to `go build`+`go vet` (the native Windows-safe proxy; production overrides with the full WSL `go test` suite), and `-harness sessionobs` now drives the S0 loop-index itself: a no-op toolchain proposal REVERTs when the `loop_index` score does not move, while the linked value/waste corpus plus consuming loop KEEPs only after the Learn-derived S0 index rises to 100 with a clean `internal/sessionobs.Score` report. Witness: `internal/rsiloop` tests (keep/revert/escalate/breaker-reset, the keep-bit needing all three, journal round-trip + track/LastTrack, and sessionobs S0 keep/revert) + `cmd/rsiloop` driver test; see [`docs/rsi-loop.md`](docs/rsi-loop.md).
- [SHIPPED] Issue-dispatch **closed loop** (`tools/issue_*`, `tools/dispatch_*`): the witness-gated GitHub-issue backlog driver for a plan-empty repo. `issue_lane_router` routes each open `gh` issue to its `dos.toml` lane; `issue_resolve_dispatch` passes the `dispatch_preflight` DoS gate (host clean ∧ account free ∧ live < cap), picks the busiest lane's next fresh issue (anti-churn cooldown + in-flight de-dup), and spawns ONE detached `claude -p` worker rendered by `issue_worker_prompt` with the load-bearing `#N`-in-subject rule; the worker ships a commit citing `#N`; `issue_closure_audit` binds commit→issue and grades through `dos commit-audit` (`TRUE_RESOLVED`/`CLAIMED_CLOSED`/`OPEN_WITNESSED`); the deterministic `issue_resolve_witnessed` close arm re-runs `dos commit-audit` per-SHA at close time (no keep on a self-authored claim) and closes via `gh issue close` citing the SHA. The live-worker population is provably ≤ `cap = min(--max-workers, dos [supervise].target)` (the no-DoS proof), every tool is dry-run until `--live`, and the operator-local view is `.dispatch-runs/dispatch-status.md` (gitignored; backlog-by-lane + closure honesty + silent-worker scan), refreshed by the loop. Witness: `tools/issue_lane_router_test.py`, `tools/issue_closure_audit` + `dispatch_status_test.py` (silent-worker classification, render_md tables) and the rest of the dispatch-tool test suite; see [`docs/dispatch-loop.md`](docs/dispatch-loop.md).
- [SHIPPED] Harvest-corpus **advisory adjudication model** (`internal/advmodel`, #580): the consumer of the `internal/harvest` `LabelRow` corpus — the RSI loop's missing closing edge (the kernel harvested its own verdicts but nothing learned from them). A reproducible training run (`internal/advmodel/train.py`, numpy-only, deterministic) over a frozen, content-bearing corpus (`testdata/corpus.jsonl` — every label re-witnessed against the REAL adjudicator floor by `corpus_test.go`, and harvest-compatible by construction) trains a small logistic-regression classifier over a bag of call tokens and writes a model artifact (`testdata/adjudicator.json`); held-out precision/recall/F1 vs the stock reference (the inert model = the stock SmolLM2 emits no adjudication signal = F1 0) are printed and committed in the artifact `meta` (re-derivable by re-running train.py). The artifact loads as a fail-closed, opt-in `abi.Adjudicator` that may return ONLY `Deny` (corroborate) or `Defer` — never `Allow` — so under the kernel's restrictiveness fold (`kernel.Fold`) it can only tighten a decision, never weaken the deterministic floor; default-off (no self-registration; the frozen ABI is untouched). Witness: `internal/advmodel` tests (fail-closed-never-allows across benign/deny-worthy/inert, fold-safety under `kernel.Fold`, Go↔Python featurizer parity over all 65 corpus rows, corpus-matches-floor). HONEST SCOPE: this is a SMALL classifier (the issue's "small … model"), not a fine-tune of the fused SmolLM2 — see the retained STUB below; the 65-row corpus is a floor-grounded demo, and production accuracy needs a larger real harvest corpus.

## vCache Chains & Recall (M4)

- [SHIPPED] The vCache **chains & recall decision engine** (`internal/vcachechain`, #719) — the M4 milestone: the prefix DAG + cost-gated rebuild that decides, per recall, whether to REPLAY a chain (rebuild) or send the unit COLD. A pure, deterministic, off-path leaf (architest tier 2; stdlib + `cachemeta`(1) + `vcachegov`(2, the Law-D4 `SecretClassification`); NOT registered into the kernel) implements every #719 acceptance criterion: (1) a prefix DAG (`ChainNode`/`PrefixDAG`) carrying the parent chain per vBlock — the recall plan, not just identity — with `ChainTo`/`PrefixTokens`/single-rooted-arborescence `Validate`; (2) topological replay with the **send-one-then-fan** barrier (`TopologicalReplay` → `ReplayLevel{Lead, Fan}`) that releases sibling dependents only after the lead's first streamed content delta is observable (§8 + Rule C2); (3) the **20-block lookback** breakpoint placement (`PlaceBreakpoints` drops one every ~15 content blocks, capped at 4 — Rule C3); (4) partial-warmth replay from the first cold node (`WarmDepth`, fed by `cachemeta.FirstDivergeTokenOffset`); and (5) the load-bearing **§11.0 cost gate** — `PlanRecall` REFUSES a chain rebuild whenever `replay_cost ≥ amortized_savings` (i.e. `P·r ≥ S·U`), so it refuses almost every SINGLE-unit recall (the §11.0 headline: a 30 000-token prefix at r=0.1 to recall one 10-token unit is a 3000→10, i.e. **300× LOSS**) and allows rebuild ONLY for amortized fan-out (`P·r < S·U`), with `BreakEvenSiblings = floor(P·r/U)+1` = **301** for that example. **GATED OFF BY DEFAULT** (`DefaultEnabled = false`): with the gate off every recall is `DecisionGatedOff` and the caller sends the unit cold — the live provider recall loop is what flips it on, exactly as the M5 Governor waits on M1–M3. The proof surface is `fak vcache prove-recall [--prefix-tokens N --unit-tokens N --read-mult F --siblings N]`: the default run REFUTES the single-unit rebuild (exit 1, the 300× loss caught) and `--siblings 301` PROVES it (exit 0, the amortized exception); `fak vcache status` reports the engine up, gated off, and the cost-gate proof. Correctness never depends on the verdict (Law A2): whatever `PlanRecall` returns, the caller must always be able to re-send the full prefix. Witnesses: `go test ./internal/vcachechain ./cmd/fak -run "TestProveRecall|TestPlanRecall|TestRebuild|TestBreakEven|TestPlaceBreakpoints|TestTopologicalReplay|TestPrefixDAG|TestRunVCacheProveRecall"` pins the §11.0 numbers to the decimal (replay 3000, fresh 10, loss 300×, break-even 301, 301 allowed / 300 refused), the prefix-DAG validation/cycle/ChainTo order, the send-one-then-fan fan-out grouping, the warm-prefix skip, the 15-block/4-cap breakpoint placement, the Law-D4 secret-chain refusal, and the gated-off default; see [`docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md`](docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md) §8/§11.0/§13-M4. HONEST SCOPE: this is the off-path DECISION engine (prefix DAG + cost gate + replay scheduler), not the live provider recall transport — the live loop still waits on M1–M3 calibration/warming, the same posture as the M5 Governor.

## vCache Governor (M5)

- [SHIPPED] The vCache **Governor decision engine** (`internal/vcachegov`, #720) — the steady-state policy that turns the future M1-M3 warm set into a self-sustaining, rate-safe, secret-safe warm set. A pure, deterministic, off-path leaf (architest tier 2; stdlib + `cachemeta` only; not registered into the kernel) implements all four #720 acceptance criteria: pin/lazy/evict classification by the reconciled §10 cutoff `λT > ln((w+μ+L)/L)`, the rate-limit warm-budget scheduler `warms/min = min(R-R_real, (X-X_real)/P)`, cross-shard affinity routing with correlated-`p(hit)` collapse detection, and the Law-D4 secret classifier that refuses secrets/regulated content before any economics. The proof surface is `fak vcache status|prove|prove-telemetry`: default Codex-like star-anchor inputs (4096-token anchor, 7 sibling requests, 10-token suffixes, 0.1 read / 1.25 write multipliers) prove 21,094.4 token-equivalents saved (73.4%), below-minimum or unsafe-content workloads are first-class REFUTED outcomes, and observed provider telemetry is reconciled from JSONL instead of assumed. Live Claude Code witness: `go run ./cmd/fak vcache prove-telemetry --file experiments/agent-live/vcache-claude-prefix-probe-2026-06-25.jsonl` proves 13,141.5 input-token-equivalents saved (4.73%) over four prefix-sibling turns with first positive request 4, while the first three turns refute because cache reads did not yet repay the 1h cache-write cost. Codex/OpenAI witness path: raw Responses usage (`usage.input_tokens_details.cached_tokens`), Chat Completions usage (`usage.prompt_tokens_details.cached_tokens`), Codex CLI `token_count` rows (`payload.info.last_token_usage.cached_input_tokens`), and `codex exec --json` `turn.completed` usage are parsed into uncached/cached input portions and proven/refuted by the same telemetry proof; the replayable Codex CLI artifact at `experiments/agent-live/vcache-codex-token-count-proof-2026-06-25.jsonl` proves 9,147,340.8 token-equivalents saved (85.98%) over 68 events, while the optional raw OpenAI API probe skips without `OPENAI_API_KEY` instead of overclaiming. `status --json` exposes the verifier-ready state plus a cached-token sample proof and zero-cache refutation. Witnesses: `go test ./internal/vcachegov ./cmd/fak -run "TestRunVCache|TestProve"` covers the §5.4 cutoff, §5.5 warm-budget examples, affinity consistency, secret refusal, CLI JSON, OpenAI/Codex usage parsing, and proven/refuted proof exits; `fak vcache prove-telemetry` covers the live Claude and replayable Codex telemetry arithmetic. HONEST SCOPE: this is the policy/decision layer plus cost proof only — correctness never depends on a provider cache hit, and the live warming loop remains #716-#718. See [`docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md`](docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md) §5.4/§5.5/§9/§11.4/§13 and [`experiments/agent-live/VCACHE-CODEX-OPENAI-PROBE-2026-06-25.md`](experiments/agent-live/VCACHE-CODEX-OPENAI-PROBE-2026-06-25.md).
- [SHIPPED] The vCache **readiness scorecard** (`internal/vcachescore`, the `fak vcache score` verb; #789 dogfood, #791 floor gate) — the one verb the M4/M5 proof leaves fold into a single deterministic 2x agent-dev readiness gate. `Score` composes the planned star-anchor proof, the observed-telemetry proof, anchor concentration plus a payload-free hot-anchor index plan, prediction-error risk, and the §11.0 recall cost-gate into one `fak.vcache.score.v1` report (grade plus `two_x_better`); and when provider telemetry is supplied it emits an `economics` block reporting the four prompt-cache economics the agent-dev gate asks for — **hit** (cache-read share of input), **read** (cached input tokens served, with the cache-write companion), **rebate** (token-equivalents saved), and **cost** (token-equivalents actually paid vs the uncached baseline) — plus the realized 2x multiplier. Every economics value is OBSERVED: relayed straight from the provider's own cache counters, never a fak-caused effect, and emitted ONLY when telemetry is present, so a reported number always carries a provider witness; budgeting still happens at the uncached price, a hit is a realized rebate not a trust claim. The #789 dogfood replays the committed Codex CLI session telemetry — `go run ./cmd/fak vcache score --telemetry experiments/agent-live/vcache-codex-token-count-proof-2026-06-25.jsonl --json --out experiments/agent-live/vcache-score-codex-telemetry-2026-06-25.json` (no key, no network) — and the frozen artifact flips `active_source` to telemetry and reports hit 95.53%, read 10,163,712 cached tokens (0 writes), rebate 9,147,340.8 token-equiv (85.98%), cost 1,491,490.2 vs 10,638,831 baseline, multiplier 7.13× ≥ 2.00× → pass, alongside the deterministic planned floor (73.4%, the only fak-guaranteed number). HONEST SCOPE: the observed multiplier is what that provider delivered on that thread, not a fak-caused effect; the planned star-anchor floor is the ceiling fak guarantees without a provider, and the live warming loop remains #716-#718. Witnesses: `go test ./internal/vcachescore ./cmd/fak -run "TestRunVCacheScore|TestEconomicsBlock|TestTelemetryOverrides|TestDefaultScore"`; the repeatable floor gate `tools/vcache_scorecard_gate.py` (#791, default 2x-ready plus unreachable-threshold negative path); the frozen #789 dogfood [`experiments/agent-live/VCACHE-SCORECARD-TELEMETRY-DOGFOOD-2026-06-25.md`](experiments/agent-live/VCACHE-SCORECARD-TELEMETRY-DOGFOOD-2026-06-25.md).

## vCache observability (per-sub-concept lens)

- [SHIPPED] The vCache **per-sub-concept observability lens** (`internal/vcacheobserve`, the `fak vcache observe` verb) — the "10x observability" surface that answers, for a real account's own traffic, what every vCache sub-concept does ON TOP of the obvious base cache (any session with `cache_read>0` proves the base case). A pure, deterministic, clock-free, off-path leaf (architest tier 2; composes `vcachecal`/`vcachechain`/`vcachegov`/`vcachescore` + `cachemeta`; not registered) ingests real Claude Code transcripts (`--transcript`, repeatable) or a session-telemetry JSONL (`--telemetry`), groups turns by prefix family (one session = one shared system prefix), and runs the SHIPPED M1-M5 leaves over the real data into one panel per sub-concept, each labeled OBSERVED (relayed from the provider's own counters) or DECISION (fak's deterministic verdict): base cache hit, M2 per-family realized savings + first-positive turn, M1 measured-Zipf-s concentration (§5.2 defeated gate), M1 warmth-belief false-warm/false-cold (Law A1 safety), M3 natural-first warming, the §11.0 recall cost gate at the account's mean prefix, the §5.4 governor pin/lazy/evict verdict, the measured-vs-synthetic score grade, and the cachemeta canonicalization floor. Live Claude-account witness (frozen, replayable, no key/network): `go run ./cmd/fak vcache observe --telemetry experiments/agent-live/vcache-claude-session-telemetry-2026-06-26.jsonl` over 845 real assistant turns / 7 prefix families reports hit 93.0%, saved 77.1% (85,520,048 token-equiv, multiplier 4.37×), measured Zipf s=0.54 (flat → the cross-family hot-anchor sub-concepts are DEFEATED on this account), false-warm 0.00% (the lethal direction — Law A1 verify-then-trust holds on real traffic), and the headline contrast MEASURED C (60/100) vs SYNTHETIC A (100/100): same realized economics, different concentration assumption. Witnesses: `go test ./internal/vcacheobserve ./cmd/fak -run "Observe"` (family grouping + per-family↔aggregate savings reconciliation, the 0%-false-warm safety invariant, the single-unit recall refusal, the busy-family ride-natural verdict, the nine sub-concept panels, transcript + telemetry ingestion). HONEST SCOPE: a pure OBSERVABILITY lens over OBSERVED provider counters — every economics value is the provider's, never a fak-caused effect; correctness never depends on a hit (Law A2); the live warming loop remains #716-#718. See [`experiments/agent-live/VCACHE-SUBCONCEPT-OBSERVABILITY-2026-06-26.md`](experiments/agent-live/VCACHE-SUBCONCEPT-OBSERVABILITY-2026-06-26.md).

## What fak is NOT

- [STUB] No LIVE transport attaching a real *external* serving engine's KV region — vLLM/SGLang owns the KV in Python/CUDA, so importing its pinned pages into an `Arena` over CUDA-IPC / shared memory is the engine-specific transport still to build (`xenginekv.AttachArena` is the buffer entry point it plugs into; in-process the arena is a Go `[]byte` stand-in, not a mapped engine region). The cross-engine zero-copy KV co-residence SEAM itself shipped in #448 (`internal/xenginekv`, the SHIPPED row above) — the frozen `RegisterRegionBackend`/`RegisterPageOutBackend` ABI, the zero-copy Resolve view, and the region-addressed `Evict`/`Clone` quarantine that makes the per-agent KV-fusion hold against an engine fak does not itself run — so this remaining transport is a backend plug-in behind that frozen ABI, no further ABI change. (v0.2's in-kernel model owns *its own* KV cache — that is the original fusion; the seam above is its cross-engine dual.)
- [STUB] No FINE-TUNED *syscall/adjudication* LLM and no AsyncLM interrupt behavior — the harvest-corpus consumer edge CLOSED (#580) by a SMALL classifier (`internal/advmodel`, the SHIPPED row above): it trains on the floor-labeled corpus and emits a fail-closed advisory signal, but it is a logistic-regression bag-of-tokens model, NOT a fine-tune of the fused SmolLM2 forward pass. The model fused in v0.2 remains a *stock* SmolLM2 reference forward pass; training/grafting a tuned adjudication head onto that fused model (GPU + base weights + multi-hour training) is still unbuilt, as is AsyncLM's interrupt behavior.
- [SIMULATED] token-per-watt is read-only SIMULATED telemetry because there is no watt source on the box. Native continuous batching is no longer in this bucket for the in-kernel lifecycle path (#401), but production-grade multi-tenant p99 scheduling is still a separate honest no-claim. NOTE: "no GPU dependency" is no longer strictly true — the optional `-tags vulkan` AMD backend runs the model on a real RX 7600 — but it is OFF by default; the shipped pure-Go binary still has zero GPU dependency.

## Prior-art posture

- [SHIPPED] Consistent with the cluster's 0/29-NOVEL finding (0 of 29 audited claims are novel): every primitive here is established/emerging; the contribution is the ASSEMBLY (a fused, fail-open, witness-gated kernel with the tool call promoted to a syscall), not any single mechanism.
