Sunbelt Computer Software

Flash Coder — TODO (atomic, derived from `SPEC.md`)

Rules for this file:

A box is checked only after its vector has been run in a terminal this session (or is a recorded live arm in PLAN Appendix A with a date).
[V] = verification-only task. [B] = build task. [L] = needs a live model run (cost printed in the commit note).
Order is SPEC §7's priority order. Do not reorder without a reason in the log.

P0 — Reversibility (I-1)

[B] git init + .gitignore + baseline commit of the measured tree → vector: git status clean, 72 files, no .venv in the index. Done 2026-09-25: commit 0ea2798. Unblocks I-1, R-7.2, M15.

H — Clean build and battery honesty (cross-cutting, runs after every change)

[V] python -m pyflakes flash/*.py benchmarks/*.py → 0 findings (SPEC §6.1b). Nine pre-existing warnings removed 2026-09-26: dead imports in grammar/learn/power and three benchmark scripts, one placeholder-less f-string block in vision, and — the only one that was a real defect — ConstrainedSampler.finish was defined twice in flash/grammar.py (47/47 stayed green because the two bodies were identical, so the shadowing was invisible; a future edit to one of them would have been silently dead). benchmarks/tasks/*_test.py is out of scope on purpose: a test file there is a fragment whose names come from the candidate code the harness prepends, so pyflakes' "undefined name" is its correct state. Verified with the whole battery after the edits, not just the lint: harness 12 · lsp 14 · power 22 · jobs 14 · trace 30 · web 9 · grammar 47 · patches 37 · debug 55 · resume 11 · debug premise 32 · edit premise 60 · m0 dry-run 20 → 363 green.
[B] SPEC §6's offline total recomputed from the tree, not remembered: it said 222 while flash.patches (37), flash.harness (12) and both suite premises (32 + 60) had already shipped — a stale count is a claim about coverage that no longer matches the code. Now 363, each line named with its command. README's battery gained the harness line and the lint gate; flash/__init__.py's selftest list names flash.harness and says where flash.web's battery actually lives (no __main__; it runs through flash web --selftest).
[V] flash trace --selftest is 30/30, but README said 29 — the count was written before a check was added. Doc numbers are re-read from a run.

P1 — R-4.2 Constrained decoding (malformed output structurally impossible)

[B] flash/grammar.py: character-level DFA (Contract) over the output contract (# file: <name> header → fenced block → close fence), compiled to per-position vocabulary masks (Masks.allowed) and applied at every decode step by ConstrainedSampler. Done 2026-09-26. The mask is keyed on the live position — pending backtick count, header-literal progress and the unwritten names — so it is exact, not a superset: 10 154 sampled pieces, 0 refusals, 0 dead ends.
[B] Wire the mask into the sampler path in flash/loop.py::_generate (mlx logits_processors), with a --constrain flag and a fallback path when no contract can be named. Done 2026-09-26: _generate(..., contract=) + _contract_for(), loop.CONSTRAIN set by flash run/run-suite/resume --constrain; a task with no nameable file set generates freely (I-7). Telemetry: constrained, mask_steps, mask_breaches per generate record.
[V] [offline] python -m flash.grammar --selftest: 42/42, 2026-09-26. Accepts the 6 mw reference file sets, rejects each historical mutation class (fence without header, header without body, prose before the first header, unterminated fence, path escape, file outside the set), proves tokenization independence (40 random splits × 6 references), masks every historical shape, and adds three the spec did not ask for: liveness (no reference is blocked by its own mask), no dead ends, and the end-of-turn policy at exactly the positions where stopping parses.
[V] [L] Contract-violation census: 100 constrained generations, 0 malformed, 0 mask breaches, 99/100 recoverable by the parser (2026-09-26, benchmarks/results/census/final_con100.log, temp 0.7, max_tokens 1500, 6 mw prompts). The one violation is an answer that opened its block and wrote nothing inside — a content failure, not a shape one, and the mask must not pretend otherwise. The unconstrained arm on the same prompts and seeds: 20/20 violations, 0/20 recoverable (final_free20.log) — it narrates around the protocol and then runs out of budget. Reasons are broken out so the gate is auditable: malformed (the DFA is dead: the structural claim), unclosed/file set (completeness — a stop inside a body or an exhausted budget, which no logit mask can or should forbid).
[V] [L] Latency cost ≤ 5% — measured, not met, mechanism identified. * The mask's own arithmetic (--overhead, no weights loaded): 0.145-0.183 ms to apply a 152064-wide mask = 0.4% of a 42.6 ms decode step; 7-27 ms to compile a position once. * End-to-end, same prompts and seeds, both arms, two pairs: free 25.8/25.5 vs constrained 24.1/23.3 tok/s = -6.3% to -8.6%. Matched on generation length (both arms under 500 tokens) it is still -6.3% (25.5 vs 23.9), so the length difference is not the story. * Where the residual is, from hook_ms accumulated inside the sampler: the hook stands in 44.7% of wall time while its arithmetic is 0.4% of it. It is not computing, it is waiting — reading the sampled id back is a device→host sync, and mlx's loop launches step n+1 before syncing step n precisely so the two overlap; asking for the id from inside step n+1's processor collapses that overlap. Tested and rejected as the cause: a zero-allocation single-id fast path (no join, no set, no list, penalty materialised once per dtype) moved nothing — 23.3 tok/s and 44.7% of wall both before and after. Python is not the cost, so no amount of hook micro-optimisation will reach 5%; only giving up the exactness would. * Why the box stays open instead of being reworded: knowing each sampled token is what makes the guarantee exact, so the sync cannot be removed without weakening it (a lazy read-back with a one-token lag would let up to one token slip past the header mask right after a fence closes). SPEC §10.5 proposes gating on seconds per usable answer, where this build measures better (mw suite 95s → 72s at a higher pass rate); that is a change to an acceptance criterion, so it is the user's call. --constrain stays opt-in until it is made.
[V] [L] Reference sweep, run as pairs under identical flags (a stored pass rate from a different configuration is not a control): * m0: 18/20 unconstrained, 18/20 with --constrain — unaffected ✓ (and matches the 7B's recorded 18/20 from 2026-09-23). * mw: 5/6 unconstrained, 6/6 with --constrain — the constraint gained a task, at 72s vs 95s wall clock. The mw suite was the one the malformed-output bug class lived in, so this is the expected shape. Logs: benchmarks/results/sweeps/{m0,mw}_{free,constrain}.log. Wall-clock note: the constrained mw run is 24% faster despite a lower per-token rate, because a masked answer goes straight into the protocol instead of narrating to the token budget. That is the number an operator feels, and it is reported next to the per-token one, not instead of it.
[B] Docs move together: README command, flash/__init__.py map, SPEC R-4.2 → SHIPPED, PLAN §33.3 status + Appendix A row. Verified in tree: README:98-106, flash/__init__.py:13, SPEC.md's R-4.2 row, PLAN §33.3 and its Appendix A row. The census/sweep logs that back the numbers are tracked under benchmarks/results/, not ignored.

P2 — R-4.3 Debugger skill (watch execution, don't re-guess)

[B] flash/debug.py: a line-tracer session in the same isolated -I subprocess — executed trail, the value each local took as it changed, locals at the failing frame, last-mutated line, serialised digest. Done 2026-09-26. Not pdb: a model cannot drive an interactive loop, and the harness needs a digest it can put in a prompt.
[B] Feed the digest into retry feedback as a distinct kind="debug". Done: loop._debug_feedback, --debug, skipped for static failures (broken syntax has no execution to watch) and on a pass.
[V] [offline] python -m flash.debug --selftest: 55/55, 2026-09-26. Five seeded bugs each blamed on the line that made the value wrong, a hang that still reports the line it spun on, a raise that names its frame's locals, a compile error blamed on the candidate rather than the debugger, execution observed in a child pid, a path-escape refused, and the trail cap.
[B] Seeded-bug suite benchmarks/tasks/dbg_tasks.jsonl: 8 tasks, built by benchmarks/gen_dbg_tasks.py, verified offline — every solution passes, every seeded bug fails, and every causing line is ABSENT from the traceback and PRESENT in the digest (that last pair is the suite's whole premise, and --selftest checks it per task).
[V] [L] Arm A: traceback feedback. Arm B: debug feedback. Same tier, same budget → B solves ≥ 2 more. RUN on four substrates, NOT MET: * 21 tasks selected from measured first-attempt failure (benchmarks/gen_dbg_hard.py, from results/probe/*_one_attempt.log): A 6/21, B 5/21 — the digest arm lost h12_min_remove_parens; 59 generations and 59 attempts in each arm; wall 500s → 591s (+18%). * 8 repair tasks with the tests shown (dbg_fix_tasks.jsonl): A 7/8, B 7/8; fix01_alias_sort went 3 attempts → 2. * 8 blind repair tasks, brief + broken module, tests not shown (dbg_blind_tasks.jsonl): A 8/8, B 8/8, every task on the first greedy attempt — a ceiling, and proof the 7B is not fooled by these traps once the code is in front of it. * 30-task wide-band substrate (dbg_band_tasks.jsonl, built by the box below, frozen ledger cut): A 27/30, B 25/30, 52 attempts in each arm, wall 414.5s → 463.5s (+11.8%). 15 of the 30 tasks took a second or third attempt (8 at two, 7 at three), so this band can see a ≥2 difference — and the two-task gap is not a digest solve: on the 25 tasks that ran the small tier in BOTH arms it is 25/25 vs 25/25, and the entire delta is h12_min_remove_parens and mw1_ringbuf reaching the escalation boundary under B and being denied by §34.1 at --allow-big never — R-6.4's shed-tier confound again. The digest's footprint is two tries and one outcome: 28 of 30 attempt counts identical, fix01_alias_sort 3 → 2 (the one effect, now reproduced from the tests-shown substrate, solved either way), mw1_ringbuf 2 → 3 with that third try crossing the denied escalation, and on h12 both arms used 3 tries with only the traceback arm's third one passing — the same task the 21-task substrate also lost to the digest. Net 0 gained, 2 lost. Logs benchmarks/results/dbg_band_arm{A,B}.log, sessions 20260926-222341-run-suite-e6fe and 20260926-223150-run-suite-4cc6. Why, measured rather than asserted: attempt 0 is greedy and identical in both arms, so the digest can only matter on a task that survives to a second retry. Pairing the 12 tasks both arms solved on the first substrate: 11 have identical attempt counts. On the three original substrates the discriminating band was one task wide, so a ≥2 gate could not be observed there at any effect size — the instrument was the limit, not the mechanism (which is verified offline: flash.debug --suite, 32/32 causing lines invisible to the traceback and present in the digest). The band has since been widened on purpose, to 15 retried tasks, and the gate still misses: the mechanism is verified offline, changes attempt counts on 2 of 30, and does not raise the pass rate. --debug therefore stays off by default, now on a measured negative rather than an unmeasurable one.
[B] P2-follow-up: build an instrument with a band wide enough to measure. BUILT 2026-09-26 and used: benchmarks/gen_dbg_band.py → benchmarks/tasks/dbg_band_tasks.jsonl, 30 tasks, vector benchmarks/dbg_band_check.py 172/172 + 5 mutants, and the A/B re-run on it (the box above, fourth substrate). The recipe was followed with one disclosed reading rule: the ledger has no escalated boolean, so "whose tier was small, never escalated" is tier == "small" AND solved AND attempts >= 2 AND not shed — a row that carries tier: small and also a shed verdict contradicts itself and is dropped rather than kept because it is convenient (gen_dbg_band.band_from_ledger). An earlier revision of this box claimed the ledger has no tier field; it has one in all 839 rows, the generator has always filtered on it, and the claim was wrong. The requirement is a task set where the tier needs 2-3 retries under traceback feedback; it exists in the ledger already. Select from benchmarks/results/ledger.jsonl the tasks whose recorded attempts ≥ 2 and whose tier was small (never escalated), and grow the set to ≥ 30 by generating more of that difficulty shape (gen_vis_assets-style generator, seeded-bug repairs with the tests withheld and two bugs rather than one). Then re-run this A/B. Do not tune the digest's wording against the current suites: with one discriminating task there is nothing to tune on, and any apparent gain would be noise. How it was met: 18 rows are the ledger's own band, carried with the run that put them there (band_ts, a frozen cut so re-generating is byte-identical while the ledger grows — proven the hard way, two band tasks arrived between the two runs of this vector and the cut held); 12 are generated into that shape from 31 bug families over 14 correct references, and a mutant survives only if the oracle sees it without raising (an exception names its own line, so it cannot be misleading), both causing lines are invisible in the failure text and named by the digest, and each bug still fails the test alone. The A/B was NOT tuned: --debug's wording is untouched from the three earlier substrates, and the gate missed on the wide band exactly as it missed on the narrow one.
[B] Docs move together (SPEC R-4.3, README, §33.2 status, Appendix A). Verified: README:143-175 (the debugger block plus the band instrument — the earlier README:108-113 citation went stale when this session's battery and ambient blocks were inserted above it, so the numbers moved with the text), SPEC.md R-4.3 → PARTIAL with all four substrates and the wide-band verdict, PLAN §33.2's close note and its Appendix A rows. --debug is documented as off by default on a measured negative, and the instrument box below is the closed follow-up.

P3 — R-8.1 Speculative decoding (G5: brain ≥ 46 tok/s)

[B] Draft model selection in the bake-off harness: --draft <repo|key> and --draft-tokens N, threaded through bench_model into mlx's stream_generate(draft_model=…), recorded in the result JSON so a speculated row cannot be mistaken for a plain one. Harness still --dry-run 20/20 after the change.
[V] [L] The arms, run 2026-09-26 — both fail, and the reasons are separate: * Brain (Qwen3-30B-A3B-4bit, the G5 target): the speculative path faults the GPU. kIOGPUCommandBufferCallbackErrorTimeout, every time, with both a vocabulary-matched draft (Qwen3-0.6B-4bit, width 151646 = the target's own) and a mismatched one (Qwen2.5-Coder-7B, 151657), at --draft-tokens 4 and 2. The same target with no draft runs the suite normally (2/2, 17.3 GB peak) before and after, so the fault is the draft-verify path on an MoE target under this mlx/Metal build — not my wiring, not the tokenizer, not the batch size. * Fast tier (Qwen2.5-Coder-7B + Qwen2.5-Coder-1.5B-4bit, the same tokenizer family, so this is the mechanism working as intended): speculation is 40% SLOWER. 11.7 tok/s against a 19.4 tok/s baseline on the identical task, and TTFT 1219 ms against 337 ms. Not claimed as proof of the mechanism: with a vocabulary-incompatible draft (Qwen3-0.6B, 151646 against the target's 151657) the same target made 18.8 tok/s, which is within noise of the 19.4 baseline — but that is ambiguous, because mlx may have quietly disabled speculation on the shape mismatch rather than paid for a draft that always rejects. What is not ambiguous is the matched pair, where the path demonstrably ran and moved throughput the wrong way.
[V] [L] Acceptance test → RECORDED AS A NEGATIVE, which is the box's own second branch. Throughput did not reach 46 tok/s anywhere: on the dense target where speculation actually functions it moves the wrong way, and on the MoE target it cannot be measured at all. 4-bit weights on Apple Silicon are already bandwidth-bound at one token per step, so verifying k drafted tokens costs the full k forwards and the only saving is launch overhead — which is not what the GPU is short of here.
[B] Docs move together: SPEC R-8.1 → measured-negative with the two distinct causes, G5's target kept as unmet with the single-model figures (46.5 best-case / 31.2 sustained) as the honest standing numbers, §9 gains the arm register row, PLAN §8.1 and Appendix A record the runs.

P4 — R-3.2 Symbol-precise edits (§33.1's ACT leg)

P5 — R-3.3 Tournament mode (G2, AC-only)

[B] k-candidate sampling under the governor's width cap, oracle-scored, best-of-k adopted. *Done 2026-09-26 (offline half): flash/tourney.py — candidate 0 greedy (so pass@k contains pass@1), the rest sampled per-seed, first-pass adoption, early exit, ranking only chooses the surfaced diagnostic; power.tournament_width (4/2/1 by profile) is the AC-only clamp; loop._tourney_arm replaces the small-tier chain only when tourney.eligible says yes (width ≥ 2, single-file, k ≥ 2) and the refusal reason rides the route record. harness.score() is the new ranking oracle (passes-count + first failure), with diagnose now a projection of it — proven equal by a check. --tournament K on run/run-suite/resume; the suite summary prints pass@1 vs best-of-k and generations spent, and resume replays the candidate table from the trace without re-charging a model. Vector: python -m flash.tourney --selftest 16/16 (schedule, clamp, adoption, ties, STATIC refusal, real h-task reference adopted, trace event); python -m flash.harness --selftest 20/20 (8 new score checks incl. the "probes pass but full-test gate fails" case); whole battery re-run green (14/22/14/30/47/37/55/9/16 + 32 + 60 premise + 11 resume + 20 dry-run), pyflakes 0 findings.
[V] [L] Hard family (h-tasks): best-of-3 beats single-attempt by ≥ 8 points at ≤ the same total token spend, on AC. MET, as measured on matched input. Run 2026-09-26, 8 h-tasks, small tier, --allow-big never, AC (maximum-performance, width 4), both arms tee-logged: * B (--tournament 3): suite 7/8. 7 of 8 tasks were tournament-eligible; in-arm, on identical prompts and one model load: pass@1 (candidate 0) 5/7 → best-of-3 6/7 = +14 pts (gate ≥ 8) ✓. The gained task is h06_log_error_windows — candidates 0 and 1 died on assert 1/3, candidate 2 passed ([0/3,0/3,P] adopted=2). benchmarks/results/tourney/armB_tourney3.log, session 20260926-105917-run-suite-6386. * A (chain, --attempts 3, same flags): suite 6/8 — the chain arm lost h06 after 3 feedback attempts. Suite-level delta +12.5 pts. armA_chain3.log, session 20260926-110220-run-suite-3a97. * Spend ✓: both arms 12 generations; B 3 330 tokens (1 412 prompt + 1 918 completion) vs A 5 559 (3 894 + 1 665) — 40% less, because a chain retry re-sends the prompt plus the growing feedback, while a candidate re-sends only the prompt and the arm exits at the first pass. Wall 135s vs 128s (+5%). * Stated honestly, three ways the number could be over-read. (1) The suite-level delta is exactly one task, and single-run swings of ±2 are documented (Appendix A) — the defensible figure is the in-arm one, where both numbers come from the same load and the same prompts. (2) The design input proved ranking is nearly inert (6/7 real failures die at assert 1 — benchmarks/fail_position_check.py, output above in the §33.4 module docstring) and the run confirmed it: passed chose nothing here, a passing candidate did. The mechanism's value is pass@k. (3) A first launch went out while the machine was on battery and the governor clamped to width 2 (best-of-2); the arm was stopped after 2 tasks and kept as armB_tourney3_PARTIAL_battery_width2.log — not evidence, a demonstration that the AC-only clamp is real. * Live bonus: at h03 the mid-run probe read low-power for one task, and eligible() declined the tournament per-task (tour_why in the route record: "governor width 1 cannot run 2+ candidates"), so that task ran the feedback chain and solved on attempt 1. The refusal reason made the anomaly answerable from the trace alone, no re-run — §33.6 working.
[B] Docs move together. Done 2026-09-26: SPEC R-3.3 → SHIPPED with the in-arm numbers and the one-task-delta caveat; SPEC §6 battery re-read from the tree (harness 12→20, new flash.tourney 16 line, total 363→387); README's battery + --tournament usage; flash/__init__.py §33.4 row and selftest list; PLAN §33.4 status paragraph + Appendix A row. Re-verified against the tree after the doc edits: whole battery green and python -m pyflakes flash/*.py benchmarks/*.py → 0 findings.

P6 — R-2.3 confidence from verification + R-6.3 label hygiene

[B] Prospective confidence signal from static diagnostics / coverage / suite flakiness (not model probability). Shipped as flash/confidence.py + --confidence on run/run-suite/resume: four streams judge the answer the visible oracle already accepted — static errors, the share of the answer's statement lines the visible tests executed, the visible verdict re-run under PYTHONHASHSEED 0/1/7, and shape-typed adversarial calls that crash or hang. The offer and every number behind it ride the ledger (conf_static … conf_reasons) and the trace. Run 2026-09-26: flash.confidence --selftest 21/21, benchmarks/confidence_wiring_check.py 30/30, benchmarks/subtle_premise_check.py 52/52, benchmarks/p6_key_check.py 13/13, pyflakes 0. Two premises the battery re-proves every run, because both were learned by being wrong first: -I silently disables PYTHONHASHSEED (the seeded re-runs use -s), and a probe that ignores the argument's shape reports an answer's crash on input it was never asked to take (8/20 correct references offered before shape typing; 1/20 after).
[V] [L] Seeded subtle-bug suite: offered on ≥ 90% of outputs that would fail hidden tests, < 1 false escalation per 20 routine tasks. NOT MET, and one clause is unmeasurable rather than passed. Live arm 2026-09-26, Qwen2.5-Coder-7B-4bit, benchmarks/tasks/p6_tasks.jsonl (8 seeded-subtle + 15 differential-keyed routine), AC maximum-performance, --confidence --trace-full, 23/23 solved in 102s (22 small tier, 1 escalated), session 20260926-141119-run-suite-d086, log benchmarks/results/p6/live_arm_7b_keyed.log: [R-2.3] 2/23 answer(s) carried evidence; recall on would-fail-hidden 0/0 (gate: >= 90%), 2 false offer(s) over 23 hidden-accepted answer(s) (gate: < 1 per 20) / gate's own population (rows tagged routine): recall 0/0 (>= 90%), 1 false offer(s) over 15 hidden-accepted of 15 task(s).* Recall clause: empty denominator — every one of the 23 answers survives its held-out key (the 7B answered the seeded-subtle tasks correctly, and the keyed routine tasks correctly), so ≥ 90% of zero is untested, not met. Measured offline instead, where the would-fail answers exist by construction: 6/6 = 100% recall on the seeded answers the hidden tests sink (subtle_premise_check), with the two masked-value cases declared blind and staying blind. False-offer clause: missed by a single offer — 1 over 15 routine (1 per 15 against < 1 per 20), 2 over 23 blended. The extra offer is on a seeded-subtle answer whose unexecuted branch is true evidence, so the routine-only figure is the clause's own; both are printed.* The one routine false offer is max_subarray([]) -> IndexError on an answer whose own reference raises the same way, and the differential key records that crash as the expectation — the edge stream calling a spec-admitted crash a finding. What would close this, and is NOT done here: a population that produces real hidden failures (harder tasks, or the 4B tier) to give recall a denominator, and a second live arm at n ≥ 40 to give the false-offer clause any resolution. Live arm 2026-09-27, the same 7B over the 59-row wide instrument (session 20260927-001446-run-suite-bcf3, log benchmarks/results/p6/arm_7b_p6b.log, 47/59 solved in 396s, avg 6.7s/task): [R-2.3] 9/59 answer(s) carried evidence; recall on would-fail-hidden 4/11 (gate: >= 90%), 5 false offer(s) over 48 hidden-accepted answer(s) (gate: < 1 per 20) / gate's own population (rows tagged routine): recall 0/1 (>= 90%), 1 false offer(s) over 14 hidden-accepted of 15 task(s) (< 1 per 20). Both clauses MISSED with real denominators: the recall clause has 11 answers the hidden key sinks, so 4/11 = 36% is a measurement rather than an empty set. Live arm 2026-09-27, the 1.5B pilot tier over the same 59 rows (session 20260927-002448-run-suite-7bb2, log benchmarks/results/p6/arm_1b5_p6b.log, 7/59 solved in 1252s, avg 21.2s/task, 52 tasks denied escalation by the §34.1 governor at load 2.4/core on low-power): [R-2.3] 45/59 answer(s) carried evidence; recall on would-fail-hidden 44/52 (gate: >= 90%), 1 false offer(s) over 7 hidden-accepted answer(s) (gate: < 1 per 20) / gate's own population (rows tagged routine): recall 13/15 (>= 90%), false offers NOT MEASURABLE (none of the 15 routine row(s) was accepted by a hidden test, so the per-20 clause has no population).* A weaker tier does produce answers that pass the visible oracle and fail the held-out key — 52 of 59 — which is the population the recall clause was written for and never had. Recall is 44/52 = 84.6% overall and 13/15 = 86.7% on the routine rows: MISSED at both, and the shape of the 8 misses says why. Five are coverage-shaped but ABOVE the shipped COVERAGE_TAU 0.55 (cov01_invoice_tax 0.667, seed02_shared_name 0.75, h24_md_table 0.818, h08_settle_fees 0.846, cov02_report_sum 0.875); three have total visible coverage and a wrong value anyway (t09_max_subarray, t14_topk_frequent, h25_luhn_check) — the documented masked-value blind spot, not a new one. Both routine misses are in that second group. Whether a stricter threshold could close it is measured by benchmarks/confidence_tau_check.py 7/7 (offline, no model): the shipped predicate is re-derived from each arm's own recorded per-answer numbers, and the re-derivation must reproduce the recorded conf_offer on 59/59 answers at both tiers before a single sweep row prints (dropping the static short-circuit is the mutant that proves the clause bites). At tau 0.85 the 1.5B's recall becomes 48/52 = 92.3%, over the gate — while the 7B's rises only to 63.6% and its routine false offers go 1 → 3, i.e. 1 per 15 tasks → 1 per 5, deeper into the < 1 per 20 miss. The two clauses move in opposite directions across tiers, so R-2.3's gate is not a knob-tuning problem on this feature set: it needs a stream that reaches a wrong value on a line that ran (§32.4's untried levers). Stated limit of that sweep: it is a re-derivation from recorded fields, not the four streams re-run over the answers (the traces keep the evidence, not the source), and the 1.5B's 7 hidden-accepted answers cannot resolve a per-20-tasks clause at all. Void data, kept for the record: the two arms run before 13:35 against a p6_tasks.jsonl whose keys were broken (gen_p6_key.observe never interpolated the function name, so every probe "raised NameError") reported recall 2/17. Those 17 hidden-failures were the generator, not the model; the hidden_ok in sessions 20260926-130301-* and 20260926-130853-* is non-evidence (the ledger's own rows are clean — hidden_ok never left the trace), and their logs are renamed benchmarks/results/p6/live_arm_7b{_full}_VOID_keys.log. A third arm (20260926-133556-*) died at the 30B load on [METAL] Insufficient Memory and was superseded rather than resumed for the same reason. p6_key_check.py's mutation clause puts that bug back and proves the generator now refuses to write.
[V] [offline] trainable() exclusion audit: AUC on excluded-only re-fit == AUC on all-minus-override re-fit (no signal lost). MET within measurement precision, and the precision is stated. Run 2026-09-26, benchmarks/trainable_audit.py (log: benchmarks/results/p6/trainable_audit.log): fit A = 314 trainable-only rows; fit B = 370 rows minus the mandated policy exclusions only (routed=big(...), tier=shed) — B therefore keeps exactly the 56 vision rows A drops, and the audit measures trainable()'s one exclusion beyond the hygiene minimum. Shared honest eval: 66 held-out rows (m4–m7, tier∈{small,big,failed}, none big-routed), 10 positive. Pooled AUC: A 0.618, B 0.736; difference −0.118 with a bootstrap 95% interval [−0.369, +0.099] over 4 000 replicates — the gap does not separate from zero, so no measurable signal is lost; at 10 positives a true gap of up to ~0.37 could also hide here, and that is stated rather than smoothed. m7 reports n/a on purpose: its honest-label pool has one class only (its big rows are all gate-routed, excluded as policy). Cost note (box is marked offline but this crossed the line): 69 prompts were not in the embedding cache, so one 7B load ran forward passes only — no generation, no outcomes; the selftest (16/16: AUC ranks/ties/empty, set-definitions, bootstrap band contains zero for identical fits and excludes it for a true separation) needs no model.
[B] Docs move together (SPEC R-2.3, R-6.3). Moved 2026-09-26: SPEC R-2.3 → PARTIAL (mechanism shipped, both clauses missed, with the live numbers and the empty-denominator reading stated), SPEC §6's battery re-read from the tree 387 → 503 green (confidence 21, wiring 30, seeded-suite premise 52, key premise 13), README's §34.2 command block, flash/__init__.py's module map, PLAN §34.2 status line and an Appendix A row that carries the void-key arms as non-evidence. R-6.3's docs move here rather than with dbdd7bf, which touched only this file: its SPEC status is now MET (within the stated precision) and its Appendix A row records the −0.118 / [−0.369, +0.099] figure and the forward-pass-only cost.

P6b — the learned router must survive a model switch (R-2.2)

Found by the 1.5B pilot: switching --small made the shipped router crash. Both failures were correctness bugs in code already marked SHIPPED, so both are booked here rather than folded into P6's confidence work.

P7 — R-5.3 task-granular recovery → R-5.4 M16 chaos

[B] Checkpoint in-flight task: partial generation + sandbox state. Built 2026-09-26 as flash/checkpoint.py — one frame per armed session keyed by (task, arm, stage, attempt), holding the chat-templated prompt, the pending and cumulative decoded text, the token ids (for R-4.2's mask replay), the sampler settings, the retry conversation and the caller's sandbox state (merged file union, targeted-repair list); flushed every 16 tokens through temp+fsync+rename, with arm() sweeping the orphaned temps a kill between write and rename leaves. flash.resume adopts the frame only when it names the task being solved. 31/31 offline checks, including two real kill -9 races (0 torn reads in ~35k parent reads).
[V] [offline] Kill/resume check extended to mid-task (--resume does not regenerate attempt 1 of the interrupted task). Ran 2026-09-26: benchmarks/checkpoint_resume_check.py 35/35, seven scenarios, each a real SIGKILL on a real flash run-suite child resumed by a fresh process with only the model scripted — mid-generation, repeat kill inside one span, mid-chain, multi-file sandbox union, tournament candidate, big tier, inertness. Measured: the resume's prompt begins at the dead run's last durable 64 characters and decodes only the remaining 125 of 189; the killed task settles attempts=1. Stable over five consecutive clean runs (the fifth is its line in the P7 docs re-read below), and deleting the carried text fails 15 of the 35 (mutation-checked).
[V] [L] Real kill -9 between two tokens of a live run-suite, then flash resume → in-flight task completes. Ran 2026-09-26 (benchmarks/live_checkpoint_arm.py, 7B small tier, m0's first 3 tasks, AC maximum-performance, --allow-big never; log benchmarks/results/p7/live_arm_7b_kill_resume.log). The signal landed 3.5s in, inside t01's attempt 0, 16 tokens / 62 characters durable; flash resume settled it solved=True attempts=1 tier=small, suite 3/3 in 15s. The arm then runs the same argv with no kill and prints both sessions from their own records: all three answers byte-identical (sha1, --trace-full), t01 completion_tokens 22/22, prompt_tokens 94 vs 78 — grown by exactly the 16 carried tokens — 455ms of decode against the control's 960ms, and the ledgers agreeing at task granularity (1.3s resumed vs 1.8s cold, one row per task across the kill and its resume); t02/t03 show resumed=None and cost the same in both runs. Run twice: the earlier pass printed 456ms against a 968ms control.
[V] [L] M16: 24h window with random kills, memory pressure, network loss, thermal load → 0 data loss, every session closed-or-resumable, no torn ledger lines. (Needs a scheduled 24h window — see SPEC §9.)
[B] Docs move together. Moved 2026-09-26: SPEC R-5.3 → SHIPPED (the offline paragraph carries the 31/31 + 35/35, the seven scenarios, the 64-carried/125-of-189 measurement, the 15-of-35 mutation and the two defects the vector found, then a "Not covered, stated so" clause and the live arm's numbers), SPEC §6's battery re-read from the tree 503 → 569 green (checkpoint storage 31, recovery vector 35) with each command named, SPEC §9's M16 interim now reading "11/11 suite-granular + 31/31 frame storage + 35/35 task-granular recovery", README's R-5.3 command block (resume, checkpoint --selftest, the two check scripts, the live arm), flash/__init__.py's module map and selftest list, PLAN §33.7's status paragraph and an Appendix A row. §6 also gained the capture trap this re-read hit: a grep for "checks passed" drops grammar 47 and debug 55, which print a bare fraction, so the first pass collected 214 of 316 and looked like a clean run while missing 102 checks.

P8 — R-6.4 first learned self-improvement (G9) + LoRA

[B] LoRA experiment path inside jobs.py's AC+idle gate. (flash train mines the verified-outcome dataset behind a split law — train/valid by task id, so no task straddles — and flash learn --lora fits and promotes an adapter inside §34.3's budget, resumable, and raising rather than promoting a fit that produced no weights. Vectors RUN: flash.train --selftest 36/36, benchmarks/lora_path_check.py 31/31 with 14/14 mutants defeated, flash learn --selftest 14→20 with the LoRA gate's decision, and a real 48-step fit taken end to end and paused/resumed under kill -9.)
[V] [L] Before/after on a frozen suite for one named component (skills, memory or weights — whichever lands first), I-2 gate satisfied: the changed component beats the frozen harness. Weights arm measured 2026-09-26 and the gate MISSES. m0's 20 tasks, AC, --attempts 2, --allow-big never: base 18/20 at 7.0 s/task, +lora:v1 16/20 twice (identical failure set) at 72.6 / 87.8 s/task, shuffled-weight control 19/20 at 7.7 s/task — the control beats the trained adapter, so the number attributes to nothing learned. Both halves of I-2 miss: −2 tasks and ~10× the seconds. Mechanisms, measured not assumed: every extra loss is shed-tier (4 escalations denied by §34.1 where base has 2; on the 16 tasks that did run the small tier the adapter is 16/16), and after the answer ends the trained weights degenerate into !!!! repetition with no stop list, so one attempt burns its full 1024-token budget at 15.6 tok/s. The adapter path itself is clean: load 0.7–1.1s, TTFT 202–286ms, 14–18 tok/s across base, v1 and both controls. And the next arm cannot rise either: §27.3's law admits only oracle-verified successes, so the base model already solves 12/12 of the 12 tasks the weights were fit on — the in-distribution question has zero headroom by construction. Closing R-6.4 needs rows the current tier fails or a component with headroom (skills, memory).
[B] Docs move together. Moved 2026-09-26, and the gate box above stays unchecked on purpose — the arm missed, so the spec row is OPEN, not SHIPPED or PARTIAL. Re-read against the tree: SPEC.md:335 → R-6.4 (OPEN — first arm measured, gate MISSED) with both halves of I-2's numbers, the shed-tier decomposition and the zero-headroom finding at SPEC.md:374; SPEC §9's register row (SPEC.md:603) naming the data law as the blocker; SPEC §6's battery line carrying +36 train and +31 lora_path; README.md:190-215's R-6.4 block (the fit command, the shuffle-control script, lora_path_check with its 31+14, and the measured 18/20 · 16/20 · 19/20 line); flash/__init__.py:30's §27.3/R-6.4: flash.train map entry; PLAN §34.3's close note (PLAN.md:1482) pointing at the decomposition, and the full Appendix A row at PLAN.md:1572. All of it landed in 6b1fde5. The §6 re-read is now a run rather than an arithmetic: benchmarks/battery_reread.py holds one line per vector, requires the exact fraction each prints, sums checks (683) / oracle (20) / mutants (20) apart, and exits non-zero if the tree's total moves off the page's number — 9/9-vs-10/10 and 14-vs-15 mutants were both seeded and caught before the script was trusted. It exists because the hand-sum hit two capture traps (SPEC §6 records both).

P9 — Product shell and adoption

Backlog (OPEN, not scheduled; each needs ledger demand to earn a slot)

R-1.3 knowledge graph (flash graph <symbol> blast radius < 200ms) Run 2026-09-27, python -m flash.graph --selftest --mutants → 44/44 + 12/12 mutants, and python -m pyflakes flash/*.py benchmarks/*.py → 0 findings. flash/graph.py is AST-only (no embedding, no vector store): nodes are functions/classes/modules/module-level constants, edges are calls/reads/imports/inheritance, and each edge carries the file, line and source text that proves it plus the via label of the rule that bound it. The clause's own repo answers in 0.1 ms of the 200 ms budget, and that is stated as a weakness rather than banked — five files cannot bound a budget — so the same check also runs on a generated 401-file repo (5377 nodes, 10058 edges) where depth-3 blast costs 29–106 ms cold across the runs taken. Three judgement calls went the honest way and each has a named mutant: an attribute name matching two symbols becomes no edge (but is still counted in blind_spots(), so a hole cannot be silently dropped), json.dumps and list.append are boundaries not holes, and parameters are locals not callers. The 11th mutant is the one that justifies the instrument size: it replaces the cached reverse index with a scan of every edge per hop, which the budget check catches at 443–943 ms on 400 files and would NOT catch on the fixtures repo, where the scan measured faster than the index (0.08 ms vs 0.11 ms). That is why the wide repo's size is part of the gate. Incremental merge() is checked by hash (re-extracts exactly the one changed file; a second pass over the wide repo re-extracts nothing) and the shrink guard is checked against its worst case — a scan of an empty directory may not delete 5377 nodes. The LSP seam is wired, not stubbed: live_upgrade asks jedi about this pass's own blind spots and reports what it settled (measured 1 asked, 1 settled), deliberately outside the 200 ms clause — and with no server answering it returns no language server answered rather than raising, which is a check without a mutant because the sweep passes live=False on purpose (twelve mutants cannot each start a server). Writing the README is what found a real defect: the claim "the nearest addresses are offered" had no witness, so pinning it meant trying a needle like Cart. — whose last dotted component is the EMPTY string, a substring of every symbol — and watching it offer five arbitrary nodes as neighbours. That is the mirror image of the failure the absence answer exists to avoid, now guarded in nearest() and covered from both directions (wrong list, and no list invented). Battery: flash.graph --selftest joins SPEC §6's re-read at 44 checks + 12 mutants, moving the tree's printed totals to 997 + 20 = 1017 green, offline, 42 mutants.
[B] Correction, R-1.1 (2026-09-27): the clause was marked SHIPPED on a vector that did not test it. Picked up while choosing R-1.3b's seam — the graph was about to be injected into a path that turned out not to reach the model. SPEC R-1.1 says resolve a symbol named in an error to its real source and inject it into retry feedback. lsp.symbol_hint did the resolving; loop.solve called it inside the Attempt(...) constructor, so its output went into the record and the retry prompt was built from the plain err. flash trace prints that record, which is why this survived a month of green vectors and a "live" note in the README. Proof it was dead, three ways: the code had one call site and it was in the record constructor; a stubbed-_generate probe showed the retry prompt lacking BULK_MIN_QTY before the fix and carrying it after; and benchmarks/hint_live_audit.py finds the header in 0 of 248 stored prompts (56 of them retry prompts) across every --trace-full run captured before today. Fix: err = _symbol_hint(task, err, code) on a failed attempt before both the record and the feedback template are built — one string, so the model and the trace see the same thing. (Name updated when R-1.3b landed: that call is now _perceive(task, err, code), which appends the LSP source block and the graph's dependents block at the same assignment. The fix itself is unchanged — same position, one string, one consumer that is also the record.) Vector moved: three wiring: checks added to flash lsp-selftest (14 → 17), driving loop.solve itself with a stubbed generator and reading the retry message back: the source arrives, it arrives verbatim and exactly once, and (control) a task with no repo context gains nothing. Mutation is hand-run and logged — put the old line back, the two prompt checks FAIL and the control still passes, 15/17 (benchmarks/results/lsp_wiring_mutation_20260927.log). Live arm re-taken on the real 7B (run-suite --with-context --allow-big never --attempts 3 --trace-full, session 20260927-035552-run-suite-b2b4): both retries carry Symbols in play with models.py:21 CartLine and pricing.py:5 BULK_MIN_QTY, hint_live_audit.py --expect present exits 0, and the pre-fix half still exits 1 if any older prompt is found carrying it (benchmarks/results/hint_live_audit_20260927.log). r03 still did not solve on the small tier, so no accuracy delta is claimed — only that the text now reaches the model. Battery: 997 + 20 = 1017 → 1000 + 20 = 1020, mutants still 42. What this voids: any live delta credited to symbol injection before today, including the 2026-09-25 README note (corrected in place, not deleted). What it does not void: the M2 context-skeleton A/B — the skeleton is prepended to the prompt itself, and Project context (real API appears in 10 of those same 248 captured prompts, which is exactly the difference: one path wrote into prompt, the other only into the record.*
R-1.1b does symbol injection actually HELP? A/B on a frozen suite, hint on vs off, same model, same seeds — the clause is now live-verified in the prompt (benchmarks/hint_live_audit.py --expect present) and its outcome value has never been measured, because the one live note that claimed it was read from the record. Gate: a stated delta or a stated nil. (Switch, updated by R-1.3b: _perceive is now the single call site and it appends TWO blocks, so an arm that turns "the hint" off must say which — --no-source-hint, --no-graph-hint, or both — or the A/B measures one block while believing it measured the pair. Both arms must be scored with --trace-full and the injection presence proven per-arm by benchmarks/hint_live_audit.py --header …, which now takes the header as an argument precisely so each arm can be certified separately.) (Prerequisite, cleared 2026-09-27 by R-1.1c below: with the budget aborting on the first oversized symbol, an arm could come back with no source block because the failure happened to name a long function — which would have made the A/B compare an invisible arm against an invisible control. Empty now means "nothing repo-defined is at issue", and that is the only silence this arm produces.) Result (2026-09-27): a stated nil, which is what this box's gate asked for. The two blocks are now separately switchable (loop.HINTS, _perceive(…, hints=…), --no-source-hint / --no-graph-hint, both recorded in SUITE_PARAMS so a trace states its own arm), and the question was run as four arms over a frozen 10-task suite at --attempts 3 --allow-big never --trace-full: pass@N is both 3/10, graph only 2/10, source only 2/10, off 2/10, pass@1 is 0/10 in every arm and is the control rather than a measurement, because all four arms share one greedy attempt-0 answer per task. The injection columns prove the switches are live: the OFF arm shows a block on 0 of 18 retries, source only on 18 of 18, graph only on 0, and the two are never transposed. So both is +1 task over off at n=10 — one task, ten points — and at that sample size the per-task flips are not ordered by arm: hc16_paid_line_cents is solved by both, graph only AND off and lost by source only; hc36_add_twice_qty is solved by both and source only and not by graph only or off. Retries move 18→17, which is the same single task. Neither block is shown to help and neither is shown to hurt; this box does not license turning either switch off, and it does not license a win. The durable finding is about the instrument, and it is why the box closes here instead of iterating: 8 of 10 tasks are unsolved in all four arms, so the band has ~2 tasks of headroom and cannot report a real effect — see SPEC §5's R-1.1b for the re-pick-the-boundary follow-up, which is explicitly NOT booked as a requirement and has no number projected from it. Vectors: benchmarks/hint_ab_check.py offline (14/14 + 8/8 mutants, benchmarks/results/hint_ab_offline_20260927.log), whose 10th and 11th checks certify eligibility at the seam R-1.1 exposed (loop.solve over a stubbed generator shows both headers, and shows the four arms as four different prompts), and benchmarks/hint_ab_report.py live (benchmarks/results/hint_ab_live_20260927.log).
R-1.1c (SHIPPED, found by R-1.3b's vector) A failure whose top-ranked symbol is long lost the source hint entirely. lsp.symbol_hint's budget check was a break, so when the FIRST ranked symbol's own source exceeded max_chars=1200 the loop never reached the symbols that would have fit and the empty block returned "" — the block did not shrink, it vanished. Measured on this repo (2026-09-27): err="lsp.symbol_source is broken: AttributeError" ranks symbol_source at 1631 chars and broken at 72, and symbol_hint("flash", err, …) returned 0 characters. Gate: a too-long symbol contributes a truncated block with a stated tail — graph.scope_hint's … N more not shown (context budget) is the in-repo precedent — and never a silent zero while a ranked symbol sits unused; plus a check that a non-empty ranking yields a non-empty block. Why it is booked rather than fixed here: it changes R-1.1's shipped semantics and its 17/17 vector, and R-1.3b's commit is the graph's wiring. It also blocks R-1.1b: with this live, a hint-OFF arm can come back empty for a reason nobody measured, and the A/B would compare an invisible arm against an invisible control. Found because _shared_index_cost needed a symbol that fits on flash/ to have a source block to compare at all. Result (2026-09-27). The budget now overflows: the top hit is clipped at a LINE boundary by the new _clip (which refuses to emit anything that cannot hold a signature plus a def, so a tiny budget yields silence rather than a header over an empty block), the note … source truncated here (context budget) is kept inside the ceiling rather than appended past it, and the symbols that then had no room are counted: … N symbol(s) at issue not shown (context budget). Re-measured on this repo with the box's own shape — an error naming symbol_source, which ranks it first with 1631 chars of source (3276 for its whole block, location and signature line included) against the 1200 budget, beside ranked symbols of 183 and 102 chars: 0 → 1118 chars, tail … 2 symbol(s) at issue not shown (context budget). Vector: flash lsp-selftest 22/22, five new checks as section 6c — four on the helper (clipped-with-def-intact at 1156 of 1200; the tail counted; the ceiling held at every size that can hold a signature; 150 → '' while 1100 → a block) and the fifth at the seam R-1.1 demands, driving loop.solve with a stubbed generator and reading the retry back: 1592 chars, clipped block present. Mutation, hand-run like R-1.1's and kept in benchmarks/results/lsp_r11c_mutation_20260927.log: the pre-fix break installed over the shipped function, the shipped selftest run UNMODIFIED → 18/22; three of the four helper checks FAIL (0 chars against a 1200 budget, no block at all, and the too-small-budget one failing on its 1100-char arm while printing its static message) and the seam check FAILs at 394 chars of retry — the graph's block arrived, the source block did not. Stated at precision: the fourth (ceiling) check survives the mutant VACUOUSLY, 0 and 0, because an empty block is under any ceiling; it is a no-overshoot guard and is not part of the defeat. Battery +5, 1027 → 1032 checks, mutants unchanged at 51, §6 total 1047 → 1052, re-read quiet on the tree with all 29 lines OK and flash lsp-selftest 22/22 the only line that moved (benchmarks/results/battery_reread_r11c_20260927.log); the vector's own run is benchmarks/results/lsp_r11c_selftest_20260927.log. R-1.1b is unblocked: a hint-OFF arm can now only be empty because nothing repo-defined was at issue. (Two notes on the fix's shape, because both were bugs met on the way: the clip branch initially appended a block without marking emitted, so the whole hint still returned ""; and reserving no room for the tail note made it report zero skipped symbols — an overflow that said nothing about overflowing.)
R-1.3b feed the graph's subgraph into loop.py's PERCEIVE context (PLAN §28.2 step 3). The graph and its CLI answer ship; the agent does not yet consult it unprompted. (Seam note, 2026-09-27: inject it where R-1.1 now injects — into err before the Attempt and the feedback template are both built. Anything added to the record side alone will pass every check and reach no model; that is precisely the bug corrected above. The vector has to read the retry message back, and benchmarks/hint_live_audit.py's --expect present is the shape a live arm for this should take.) Shipped 2026-09-27, at the seam the note names. graph.scope_hint(root, err, code) ranks the at-issue symbols through lsp.symbols_involved — the SAME function the source hint ranks with, so the two blocks answer about one set — takes each to depth 2 (§28.2's own words are "small context"), caps at 6 dependents per symbol and 900 characters with a stated … N more not shown (context budget) tail, and returns "" rather than guessing when a name binds two graph nodes and the file the AST read does not settle it. loop._perceive appends both blocks to err at the one call site in solve, and _repo_index parses the repo ONCE per retry for both — measured on this repo's own 26 files at 32-33 ms shared against ~170 ms parsed twice, a number the vector prints. The per-root graph cache is an LRU of 8 roots, because a suite over ten repos is a suite holding ten graphs. Vector: benchmarks/graph_perceive_check.py 27/27 + 9/9 mutants (the file prints 33/33 + 12/12 from R-1.1b onward — its switch checks joined it), run for §6 as --sweep (one fresh process per mutant). Three of the 27 drive loop.solve with a stubbed generator and read the retry message back; one is the control that a first attempt pays nothing; one requires every cited file:line to be re-read from disk and match the call text it quotes. Two of the nine mutants are the reason this box was worth opening: record_only puts R-1.1's bug back at THIS seam (compute the block, never append it — 6 checks fail), and nested re-creates the assembly this shipped with first, where the graph ranked over the source hint's own quoted text and one retry showed two different symbol sets for one failure. Live arm, real 7B (run-suite --with-context --allow-big never --attempts 3 --trace-full, session 20260927-044613-run-suite-d366): both stored retry prompts of r03_bulk_rule carry Dependents of the symbols at issue, headed CartLine [class] minishop/models.py:20 — 2 symbol(s) reach it with d1 minishop/cart.py::Cart.add calls it: self.lines.append(CartLine(product, qty)) [minishop/cart.py:18 via import-alias] under it, and BULK_MIN_QTY [constant] minishop/pricing.py:5 reaching to depth 2 at Cart.subtotal_cents. hint_live_audit.py grew a --header for exactly this and now reads 2 of 6 post-fix retries carrying it, 0 of 248 pre-fix prompts (benchmarks/results/hint_live_audit_graph_20260927.log). No accuracy delta is claimed — r03 failed all three small-tier attempts, as it always has, and whether either hint helps at all is R-1.1b's open question. Battery: +27 checks, +9 mutants, 1020 → 1027, mutants 42 → 51; re-read on a quiet box as checks 1027 oracle 20 §6 total 1047 mutants 51, all 29 lines OK (benchmarks/results/battery_reread_r13b_20260927.log), pyflakes 0. What it found on the way is booked as R-1.1c above rather than fixed here — it has since shipped, and the shared-parse figure has reprinted 32 ms since, so the ratio rather than the millisecond is what holds.*
R-1.4 second language for perception (choose from ledger evidence) Opened 2026-09-28, PARTIAL — the choice is measured and the language has arrived, the vector's own sentence is not yet true. The choice, out of records not taste: the ledger (1148 outcome rows, every prompt template classified) has 0 rows asking for SQL and 0 asking for TypeScript, so it cannot pick between them and that null is booked as a finding; the tree the tool indexes holds 21 TypeScript-family files (14 .tsx, 7 .ts) — the number flash.lang_ts.ts_files('.') prints — against 0 .sql and 0 .db. An earlier draft of this record said 23 by counting two .css files, one of them site/dist's generated bundle; a stylesheet is not indexed here and build output is not edited, so the count is the tool's own. TypeScript by file count; SQL not chosen because nothing here is written in it. What shipped: flash/lang_ts.py — a tree-sitter TypeScript/TSX index that emits flash.graph's own Node/Edge/Unresolved, so blast(), Radius.summary() and --json answer about .ts/.tsx with no second query engine; --lang py,ts on flash graph (default stays python, so every published figure still describes the index that built it); the grammar as a fourth optional extra (pip install .[ts]) whose absence is one printed refusal, not a guess — a hand-rolled scanner would be a regex pretending to be a parser. Vector benchmarks/ts_perception_check.py: 47 checks + 13 mutants, green in this process and one fresh process per mutant. On the real tree: 21 TS files in 44–55 ms inside a mixed cold build of 1.03–1.09 s, +103 nodes / +240 edges over 4446/24574, and 151 unplaceable uses each with its own sentence (npm package, non-exported name, export *, re-export, unknown name, unparseable file, missing grammar). flash.graph --selftest still 44/44. Closed the same day, on the ACT side: flash/patches.py now dispatches an address by the file it names — .ts/.tsx to flash.lang_ts, everything else to ast including the empty path flash.graph passes, so the published Python figures are the same numbers from the same code path — and takes TypeScript spans from the same _declarations walk the graph's node comes out of. A replacement must keep the symbol's name and the export keyword its own span begins with (the TS shape of Python's decorator rule: dropping it un-exports the symbol while the file still looks fine), and a replacement that does not parse is refused with the grammar's line and marker, not Python's invalid syntax. Vector benchmarks/ts_patch_check.py: 44 checks + 13 mutants, green in this process and one fresh process per mutant, two of the checks driving loop._solve_edits with its generation and verification seams stubbed. On this repo's own front end: Hero resolves to L31-L180 of a 181-line site/src/components/Hero.tsx where it was refused as an unknown symbol, re-emitting those bytes applies with 0 lines changed outside the span, and dropping the keyword refuses with no longer exports Hero (as Hero L31-L180). flash.patches --selftest still 46/46 and --suite 60/60. Why the box stays unchecked — the vector is "R-1.1..1.2 equivalents pass on a fixture tree in that language", and two of its equivalents do not run on TypeScript yet: (1) the loop's PERCEIVE hint still ranks symbols with flash.lsp.symbols_involved and graph.scope_graph(), both Python-only, so a .tsx failure gets no ranked hint; (2) live_upgrade asks jedi, and there is no tsserver bound, so the R-1.2 live-upgrade behaviour has no TS counterpart. The third item this record carried — # edit: App.tsx :: Widget refused as an unknown symbol while # edit: App.tsx :: L11-L15 applied — closed on 2026-09-28 as above, and a fourth opened in its place: what closed is the ACT leg, not a verdict. The whole-file control arm (harness.CODE_FENCE and its # file: heading regex) is still Python, and no TypeScript edit is verified — diagnose_files has no node/vitest runner behind it, so a .tsx patch that parses is accepted on the strength of a parse. Each is named in SPEC R-1.4 rather than described as shipped.
R-8.2 latent compute — adopt only on a measured ≥ 20% token saving
G6 watts/task (blocked: powermetrics needs sudo)
§34.1 16GB co-residency arm (blocked: this box is 32GB)

Log

2026-09-26 — P5 (R-3.3) ran and the gate MET, with two facts I want on record because they are easy to over-read. First, the first launch went out while the machine was on battery (the power --json probe was minutes stale); the governor clamped the tournament to width 2 and I stopped the arm after 2 tasks, keeping the log as armB_tourney3_PARTIAL_battery_width2.log — not evidence, a demonstration that the AC-only rule bites. Second, the gate's honest number is the in-arm one: candidate 0 vs best-of-k on the same load, same prompts, same model — +14 pts (5/7 → 6/7). The suite-level B-vs-A delta is also +1 task (7/8 vs 6/8), but that sits inside the documented ±2 single-run swing, so it corroborates and does not carry the claim. What the run did prove about the mechanism: h06_log_error_windows died at assert 1/3 for the greedy candidate AND for all three chain attempts, then a sampled candidate passed it — variance where feedback got nothing. And the design pre-check held exactly: 6/7 real hard-task failures die at the first assert, so passed ranked nothing anywhere; adoption-by-pass is the whole mechanism.
2026-09-26 — P4 (R-3.2) run, and the interesting part is not the score: it is that the control arm was invalid on first principles and I did not see it until it had run. Edit prompts carried only the change request, never the source, so the whole-file control was answering about a project it had never seen — it "failed nearly everything" and I nearly booked that as the patch arm's win. Stopped the background run, moved the project listing into the stored prompt so both arms read identical material, added a premise check ("the task ships its own project text"), and kept the superseded logs renamed _v1_blind rather than deleting them. The matched rerun then showed the arms tied on capability (8/10, both all-first-attempt) and separated only on cost and guarantee — the opposite of what the invalid arm implied.
2026-09-26 — The same live run caught a VERIFY defect that no offline test could have: diagnose() decided an assert by evaluating its condition, then evaluated each side again to print GOT/WANT. For assert q.pop() == "high" that produced GOT: 'high' | WANT: 'high' for a failing assert — feedback that names no difference, on which both arms burned a retry. Now each side is evaluated once and the printed pair is the comparison that failed. Two notes: the oracle had no selftest of its own before this (12/12 now, and the offline battery count in SPEC §6 was 202 → 343 checks), and I deliberately did not re-run the R-3.2 arms after fixing it — the fix changes what a future retry is told, not the measured outcome, and re-running a missed gate until it passes is not evidence.
2026-09-26 — Clause 2 of R-3.2 missed for a reason worth stating to myself: the request said "when the Box is built", the change lived in Box.__init__, and the model addressed Box — the noun it was handed — while re-typing the class correctly. The address width follows the noun in the request, not the locus of the change. I could have reworded the gate to measure the addressed symbol instead of the annotated one and reported 10/10; that reading also makes * pass by definition, so I kept the stricter metric and escalated the ambiguity as SPEC §10.6 instead.
2026-09-26 — P1 offline shipped and its live arm run. The live run found three defects the offline battery could not: (1) this checkpoint returns 152064-wide logits over a 151657-token vocabulary, and a table-sized mask does not broadcast — the arm crashed on its first masked step; (2) the mask excused the whole special-token family as "template control" while the decoder only ever strips the piece that ends the turn, so a role marker sampled mid-body passed the mask and the walk then called the answer malformed — every masked answer was reported as a violation; (3) the sampler's baseline was len(tokens) - 1, so the prompt's last token was walked as generated text and 49 refusals were booked against the mask. All three are fixed and each is pinned by a check (47/47 offline). A fourth survived those fixes as 99 breaches in 100 generations — one per run. My first diagnosis (the turn guard tested eos where the mask offers the whole turn family) was wrong, and disproved in five minutes by the offline probe that the numbers were claimed to need: eos is in the family, the stop policy is right at both positions, and feeding the stop plus trailing tokens produces no breach. The real cause was consume joining a multi-id array into one string and walking it as a single piece, while the mask had been compiled piece by piece — the same mask/walk disagreement as defect (2), reached from the other side. With pieces absorbed one at a time: 6/6 live runs, 0 breaches; then 100/100, 0 breaches. Two process notes worth keeping: the breach count was the symptom the offline walk could not show, because the walk always fed one piece per step; and illegal_picks was changed to also record the first offending ids, text and position, because a count without a named instance invites exactly the confident wrong diagnosis I just made. Observed on the pre-fix build, 84 constrained generations over the mw prompts: 0 malformed, 0 dead ends, 82/84 recoverable by the parser — the two misses were answers that opened their block and wrote nothing inside it, which is a content failure the mask cannot and should not prevent. The same arm's answers averaged 150-330 tokens where the unconstrained arm consumed the whole 1500-token budget to say less, which is why the latency claim is measured as --overhead (ms of mask per decode step) rather than as end-to-end tok/s: the two arms do not generate the same workload.
2026-09-25 — P0 complete. Repo initialised; baseline 0ea2798 (72 files, .venv/__pycache__/benchmarks/cache ignored, results+traces tracked as evidence). Working tree clean.

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

TODO.md

TODO.md

Flash Coder — TODO (atomic, derived from `SPEC.md`)

P0 — Reversibility (I-1)

H — Clean build and battery honesty (cross-cutting, runs after every change)

P1 — R-4.2 Constrained decoding (malformed output structurally impossible)

P2 — R-4.3 Debugger skill (watch execution, don't re-guess)

P3 — R-8.1 Speculative decoding (G5: brain ≥ 46 tok/s)

P4 — R-3.2 Symbol-precise edits (§33.1's ACT leg)

P5 — R-3.3 Tournament mode (G2, AC-only)

P6 — R-2.3 confidence from verification + R-6.3 label hygiene

P6b — the learned router must survive a model switch (R-2.2)

P7 — R-5.3 task-granular recovery → R-5.4 M16 chaos

P8 — R-6.4 first learned self-improvement (G9) + LoRA

P9 — Product shell and adoption

Backlog (OPEN, not scheduled; each needs ledger demand to earn a slot)

Log

Sunbelt Computer Software

PL/B Language Development and Support

FilesExpand file tree

TODO.md

Latest commit

History

TODO.md

File metadata and controls

Flash Coder — TODO (atomic, derived from SPEC.md)

P0 — Reversibility (I-1)

H — Clean build and battery honesty (cross-cutting, runs after every change)

P1 — R-4.2 Constrained decoding (malformed output structurally impossible)

P2 — R-4.3 Debugger skill (watch execution, don't re-guess)

P3 — R-8.1 Speculative decoding (G5: brain ≥ 46 tok/s)

P4 — R-3.2 Symbol-precise edits (§33.1's ACT leg)

P5 — R-3.3 Tournament mode (G2, AC-only)

P6 — R-2.3 confidence from verification + R-6.3 label hygiene

P6b — the learned router must survive a model switch (R-2.2)

P7 — R-5.3 task-granular recovery → R-5.4 M16 chaos

P8 — R-6.4 first learned self-improvement (G9) + LoRA

P9 — Product shell and adoption

Backlog (OPEN, not scheduled; each needs ledger demand to earn a slot)

Log

Flash Coder — TODO (atomic, derived from `SPEC.md`)