Bring Infer onto the live Train cores and add ring scheduling.

The verified units now refuse non-finite activations and match DaisyChain-Train at a28437c. The head can queue a busy ring, drop a disagreeing kernel probe, estimate a lap, keep a prefix index, overlap long prefills, score a prompt-lookup draft in one lap, and replay the prompt once if a peer drops.

public/app.js

@@ -418,6 +418,7 @@ function setupChannel(peerId, dc) {
   dc.onclose = () => { chans.delete(peerId); updatePeers(); wake(); scheduleReconnect(peerId); };
   dc.onmessage = (e) => onWire(peerId, e.data);
 }
+let peerDropped = false;
 function cleanupPeer(id) {
   clearWatchdog(id);
   const pc = pcs.get(id); if (pc) pc.close();
@@ -425,6 +426,8 @@ function cleanupPeer(id) {
   const dc = chans.get(id);
   if (dc && !dc.isRelay) chans.delete(id);       // keep a working relay channel
   for (const k of fragIn.keys()) if (k.startsWith(id + ":")) fragIn.delete(k);
+  if (running) peerDropped = true;
+  caps.delete(id);
   wake();
 }
 
@@ -555,14 +558,27 @@ async function loadRepo() {
   ui.loadRepo.disabled = false;
 }
 
-function buildPlan() {
-  if (!repoInfo) return null;
-  const list = [{ id: myId, capacity: myCapacity, backend: compute.backend }];
+const prefixIndex = Shard.makePrefixIndex(64);
+const kvSpill = Shard.makeKvSpill(32 * 1048576);
+const CHAT = "chat";
+const LAP_BUDGET_MS = 120000;
+
+function memberList() {
+  const list = [{ id: myId, capacity: myCapacity, backend: compute.backend, probe: probeHash }];
   for (const id of [...chans.keys()].sort((a, b) => +a.slice(1) - +b.slice(1))) {
     const c = caps.get(id);
-    if (c) list.push({ id, capacity: c.capacity, backend: c.backend });
+    if (!c) continue;
+    if (probeHash && c.probe && c.probe !== probeHash) {
+      log(`${nmeOf(id)} stays out of the plan: kernel probe ${c.probe} != ${probeHash}.`);
+      continue;
+    }
+    list.push({ id, capacity: c.capacity, backend: c.backend, probe: c.probe });
   }
-  return Shard.planStages(repoInfo.spec, list);
+  return list;
+}
+function buildPlan() {
+  if (!repoInfo) return null;
+  return Shard.planStages(repoInfo.spec, Shard.ringMembers(memberList(), probeHash));
 }
 function renderPlan() {
   if (!plan) {
@@ -676,10 +692,49 @@ async function onAct(peerId, buf) {
   const kind = Wire.classifyAct(nextIndex, me ? me.index : -99);
   if (kind === "return") { actIn.set(`${seq}:${tokenIdx}`, hidden); wake(); return; }
   if (kind === "other" || !me || !stageObj) return;
+  const rows = hidden.length / spec.hidden;
+  const chunked = Number.isInteger(rows) && rows !== stageObj.T;
+  if (chunked) {
+    if (!stageObj.inbox || stageObj.boxSeq !== seq) {
+      stageObj.inbox = new Map();
+      stageObj.boxSeq = seq;
+      stageObj.nextChunk = 0;
+      stageObj.posChunk = 0;
+      stageObj.span = { cache: [], pos0: 0, li: 0 };
+    }
+    stageObj.inbox.set(tokenIdx, hidden);
+    while (stageObj.inbox.has(stageObj.nextChunk)) {
+      const h = stageObj.inbox.get(stageObj.nextChunk);
+      stageObj.inbox.delete(stageObj.nextChunk);
+      const t0 = performance.now();
+      let x;
+      try {
+        stageObj.span.pos0 = stageObj.posChunk;
+        x = await Infer.runLayersChunk(stageObj, h, stageObj.span);
+      } catch (e) {
+        log(e.name === "NonFiniteError"
+          ? `REFUSED activation from ${nmeOf(peerId)}: ${e.message}. A non-finite hop is not forwarded.`
+          : `stage failed: ${redact(e.message)}`);
+        return;
+      }
+      if (auditFailure) { log("KERNEL AUDIT FAILED mid-hop — refusing to pass on a value I cannot vouch for"); return; }
+      stageObj.posChunk += h.length / spec.hidden;
+      stageObj.nextChunk++;
+      const hop = Wire.routeAfter(plan, me.index);
+      ui.ringState.textContent = `chunk ${stageObj.nextChunk - 1} in ${(performance.now() - t0).toFixed(0)} ms`;
+      await sendTo(hop.to, packAct(seq, stageObj.nextChunk - 1, hop.address, x));
+    }
+    return;
+  }
   const t0 = performance.now();
   let x;
   try { x = await Infer.runLayers(stageObj, hidden); }
-  catch (e) { log(`stage failed: ${redact(e.message)}`); return; }
+  catch (e) {
+    log(e.name === "NonFiniteError"
+      ? `REFUSED activation from ${nmeOf(peerId)}: ${e.message}. A non-finite hop is not forwarded.`
+      : `stage failed: ${redact(e.message)}`);
+    return;
+  }
   if (auditFailure) { log("KERNEL AUDIT FAILED mid-hop — refusing to pass on a value I cannot vouch for"); return; }
   const hop = Wire.routeAfter(plan, me.index);
   ui.ringState.textContent = `layers ${me.lo}–${me.hi - 1} in ${(performance.now() - t0).toFixed(0)} ms → ` +
@@ -687,8 +742,15 @@ async function onAct(peerId, buf) {
   await sendTo(hop.to, packAct(seq, tokenIdx, hop.address, x));
 }
 
-async function generate() {
-  if (running) return;
+const promptQueue = [];
+
+async function generate(isReplay) {
+  if (running) {
+    const waiting = (ui.prompt.value || "").slice(0, 80);
+    promptQueue.push(ui.prompt.value);
+    log(`ring busy — queued (${promptQueue.length} waiting): "${waiting}". The turn already generating keeps the ring.`);
+    return;
+  }
   if (!repoInfo) { log("load a model first — the device that loads it drives the ring"); return; }
   if (!tok) { log("no tokenizer loaded"); return; }
   running = true; abortRun = false; auditFailure = null;
@@ -698,6 +760,28 @@ async function generate() {
     const T = Math.min(ctxLen(), repoInfo.spec.maxPos);
     plan = buildPlan(); modelHash = repoInfo.fingerprint; spec = repoInfo.spec;
     renderPlan();
+    const promptText = ui.prompt.value || "The";
+    let idsPreview = [...Tokenizer.encode(tok, promptText)];
+    if (!idsPreview.length) idsPreview = [0];
+    const lapMs = Shard.estimateLapMs(spec, T, myCapacity);
+    log(`lap estimate ${Math.round(lapMs)} ms/token on this device's capacity (budget ${LAP_BUDGET_MS} ms).`);
+    if (lapMs > LAP_BUDGET_MS) {
+      throw new Error(`refusing the run: estimated ${Math.round(lapMs)} ms per token exceeds ${LAP_BUDGET_MS} ms. ` +
+                      `Add a faster device or lower the context length.`);
+    }
+    const fits = Shard.headCanHold(spec, repoInfo.tensors, navigator.deviceMemory || 0);
+    const local = Shard.preferLocal(idsPreview.length, plan.length - 1, fits);
+    const matched = prefixIndex.matchedBlocks(CHAT, idsPreview);
+    if (matched) {
+      log(`prefix index: ${matched} block(s) of 64 tokens match this chat. ` +
+          `The window is still recomputed so the token ids stay bit-identical to a full pass.`);
+    }
+    if (local) {
+      log(`short prompt (${idsPreview.length} tokens) fits on this device ` +
+          `(${(navigator.deviceMemory)} GB reported). Running here. The ring is not used for this turn.`);
+      plan = [{ id: myId, index: 0, lo: 0, hi: spec.layers, head: true, capacity: myCapacity, backend: compute.backend }];
+      renderPlan();
+    }
     if (plan.length > 1) {
       log(`plan: ${spec.layers} layers over ${plan.length} device(s) — ` +
           plan.map(s => `${s.id === myId ? "me" : nmeOf(s.id)}:${s.hi - s.lo}`).join(", "));
@@ -719,37 +803,110 @@ async function generate() {
     const seq = ++runSeq;
     const nTok = +ui.ntok.value, temp = +ui.temp.value / 100;
     const opts = { temperature: temp, topK: 40, rng: Infer.mulberry32(+ui.seed.value | 0) };
-    let ids = [...Tokenizer.encode(tok, ui.prompt.value || "The")];
-    if (!ids.length) ids = [0];
+    let ids = idsPreview.slice();
+    prefixIndex.note(CHAT, ids);
+    // The bytes kept here are the prefix-block hashes, not layer KV. Reusing
+    // K and V would change per-column int8 scales, so the pass still recomputes.
+    const hashBytes = new Uint8Array(new Uint32Array(prefixIndex.blocks(ids)).buffer);
+    if (!kvSpill.put(CHAT, hashBytes)) log("prefix record is larger than the spill cap; this chat is not retained.");
+    if (typeof indexedDB !== "undefined") {
+      const open = indexedDB.open("daisychain-infer", 1);
+      open.onupgradeneeded = () => open.result.createObjectStore("prefix");
+      open.onsuccess = () => {
+        const db = open.result;
+        db.transaction("prefix", "readwrite").objectStore("prefix").put(hashBytes, CHAT);
+      };
+    }
     const promptLen = ids.length;
     ui.out.textContent = ui.prompt.value;
     const tStart = performance.now();
     let hops = 0;
 
-    for (let n = 0; n < nTok && !abortRun; n++) {
+    const useChunks = plan.length > 1 && ids.length > 32;
+    let chunkedIds = null;
+    if (useChunks) {
+      log(`overlap prefill: ${ids.length} prompt tokens, chunks of 16, 2 in flight. ` +
+          `Each stage keeps KV for its own layers. This is not the full-window GEMM.`);
+      const chunks = Shard.prefillChunks(ids.length, 16, 2);
+      const span = { cache: [], pos0: 0, li: 0 };
+      const hop = async (index, hidden) => {
+        await sendTo(plan[1].id, packAct(seq, index, plan[1].index, hidden));
+        hops += plan.length;
+        const key = `${seq}:${index}`;
+        const ok = await waitFor(() => actIn.has(key) || peerDropped, 60000);
+        if (peerDropped) throw new Error("peer dropped");
+        if (!ok) throw new Error("stalled");
+        const h = actIn.get(key); actIn.delete(key);
+        return h;
+      };
+      const flights = [];
+      let last = null;
+      let nextIdx = 0;
+      for (const ch of chunks.chunks) {
+        if (abortRun) break;
+        const piece = ids.slice(ch.lo, ch.hi);
+        let x = Infer.embedRows(stageObj, piece, ch.lo);
+        span.pos0 = ch.lo;
+        x = await Infer.runLayersChunk(stageObj, x, span);
+        if (auditFailure) throw new Error("kernel audit failed");
+        flights.push(hop(nextIdx++, x));
+        if (flights.length >= chunks.window) last = await flights.shift();
+      }
+      while (flights.length) last = await flights.shift();
+      let produced = 0;
+      while (produced < nTok && !abortRun && last) {
+        const row = (last.length / spec.hidden) - 1;
+        const id = Infer.pickToken((await Infer.logitsAt(stageObj, last, [row]))[0], opts);
+        ids.push(id); produced++;
+        ui.out.textContent = Tokenizer.decode(tok, ids);
+        ui.tokcount.textContent = String(produced);
+        broadcast(Wire.packToken(seq, id, ids.length));
+        const pos = ids.length - 1;
+        let x = Infer.embedRows(stageObj, [id], pos);
+        span.pos0 = pos;
+        x = await Infer.runLayersChunk(stageObj, x, span);
+        last = await hop(nextIdx++, x);
+      }
+      chunkedIds = ids.slice();
+    }
+
+    if (!useChunks) {
+    for (let produced = 0; produced < nTok && !abortRun; ) {
+      let draft = Shard.promptLookupDraft(ids, 4);
+      const seqIds = ids.concat(draft);
+      const shown = seqIds.slice(-T);
+      const shownDraft = Math.min(draft.length, Math.max(0, shown.length - 1));
+      draft = draft.slice(draft.length - shownDraft);
       const win = new Int32Array(T);
-      const tail = ids.slice(-T);
-      for (let i = 0; i < tail.length; i++) win[T - tail.length + i] = tail[i];
+      for (let i = 0; i < shown.length; i++) win[T - shown.length + i] = shown[i];
       let x = Infer.embed(stageObj, win);
       x = await Infer.runLayers(stageObj, x);
       if (auditFailure) { log(`KERNEL AUDIT FAILED: ${auditFailure} — stopping`); break; }
       if (plan.length > 1) {
-        await sendTo(plan[1].id, packAct(seq, n, plan[1].index, x));
+        await sendTo(plan[1].id, packAct(seq, produced, plan[1].index, x));
         hops += plan.length;
-        const key = `${seq}:${n}`;
-        const ok = await waitFor(() => actIn.has(key), 60000);
-        if (!ok) { log(`the ring stalled at token ${n + 1}: no activation came back. Press Generate again to re-plan.`); break; }
+        const key = `${seq}:${produced}`;
+        const ok = await waitFor(() => actIn.has(key) || peerDropped, 60000);
+        if (peerDropped) throw new Error("peer dropped");
+        if (!ok) throw new Error("stalled");
         x = actIn.get(key); actIn.delete(key);
       }
-      const id = Infer.pickToken(await Infer.readout(stageObj, x), opts);
-      ids.push(id);
-      ui.out.textContent = Tokenizer.decode(tok, ids);
-      ui.tokcount.textContent = String(n + 1);
-      ui.hops.textContent = String(hops);
-      ui.tps.textContent = ((n + 1) / ((performance.now() - tStart) / 1000)).toFixed(2);
-      broadcast(Wire.packToken(seq, id, ids.length));
+      const rows = Infer.draftRows(T, shown.length, draft.length);
+      const picked = (await Infer.logitsAt(stageObj, x, rows)).map(l => Infer.pickToken(l, opts));
+      const got = Shard.acceptDraft(picked, draft);
+      if (draft.length) log(`draft span ${draft.length}, accepted ${Math.max(0, got.length - 1)} before the bonus token. One lap.`);
+      for (const id of got) {
+        if (produced >= nTok) break;
+        ids.push(id); produced++;
+        ui.out.textContent = Tokenizer.decode(tok, ids);
+        ui.tokcount.textContent = String(produced);
+        ui.hops.textContent = String(hops);
+        ui.tps.textContent = ((produced) / ((performance.now() - tStart) / 1000)).toFixed(2);
+        broadcast(Wire.packToken(seq, id, ids.length));
+      }
       await new Promise(r => setTimeout(r, 0));
     }
+    }
     // The differential check. In a pipeline nothing recomputes anything, so
     // this is the only instrument that can show a distributed answer is RIGHT
     // rather than merely self-consistent. It costs a full local run, which is
@@ -759,8 +916,12 @@ async function generate() {
       log("verifying: fetching the whole model here and re-running the same prompt…");
       const all = { id: myId, index: 0, lo: 0, hi: spec.layers, head: true };
       const solo = await loadMyStage({ repo: repoInfo.repo, revision: repoInfo.revision, spec, ctx: T }, all);
-      const ref = await Infer.generateLocal([solo], Tokenizer.encode(tok, ui.prompt.value || "The"), nTok,
-                                            { temperature: temp, topK: 40, rng: Infer.mulberry32(+ui.seed.value | 0) });
+      const promptIds = Tokenizer.encode(tok, ui.prompt.value || "The");
+      const ref = useChunks
+        ? await Infer.generateChunked([solo], promptIds.length ? promptIds : [0], nTok, 16,
+                                      { temperature: temp, topK: 40, rng: Infer.mulberry32(+ui.seed.value | 0) })
+        : await Infer.generateLookahead([solo], promptIds.length ? promptIds : [0], nTok, T,
+                                      { temperature: temp, topK: 40, rng: Infer.mulberry32(+ui.seed.value | 0), maxDraft: 4 });
       const same = ref.length === ids.length && ref.every((v, i) => v === ids[i]);
       log(same ? "VERIFIED: the distributed run and the single-device run produced identical token ids."
                : `MISMATCH: the ring and this device disagree. Distributed "${Tokenizer.decode(tok, ids).slice(0, 60)}" ` +
@@ -770,12 +931,25 @@ async function generate() {
                        `over ${plan.length} stage(s)`);
     broadcast(Wire.packDone(seq));
   } catch (e) {
+    if (!isReplay && /peer dropped|stalled/.test(String(e.message))) {
+      log("a peer left the ring. Replanning the remaining devices and replaying the prompt from the start.");
+      peerDropped = false;
+      running = false;
+      ui.genBtn.disabled = false; ui.stopBtn.disabled = true;
+      ui.ringState.textContent = "idle";
+      return generate(true);
+    }
     log(`run failed: ${redact(e.message)}`);
     console.error(e);
   }
   running = false;
   ui.genBtn.disabled = false; ui.stopBtn.disabled = true;
   ui.ringState.textContent = "idle";
+  if (promptQueue.length && !abortRun) {
+    ui.prompt.value = promptQueue.shift();
+    log(`starting queued prompt (${promptQueue.length} still waiting).`);
+    generate();
+  }
 }
 
 function onToken(peerId, buf) {

public/hf.js

@@ -125,17 +125,27 @@
     }
     let done = 0;
     const total = tensors.reduce((a, t) => a + t.bytes, 0);
-    for (const [file, list] of byFile) {
-      for (const run of ST.coalesce(list)) {
-        const buf = await getRange(repo, file, revision, token, run.start, run.end);
-        for (const t of run.tensors) {
-          const off = t.start - run.start;
-          out.set(t.name, ST.toF32(t.dtype, new Uint8Array(buf, off, t.bytes)));
-          done += t.bytes;
-          if (onProgress) onProgress(`${(done / 1048576).toFixed(1)} / ${(total / 1048576).toFixed(1)} MB`);
-        }
+    // One range stays in flight while the previous body is widened to f32.
+    // The bytes are unchanged. The next layer's read hides behind this one.
+    const runs = [];
+    for (const [file, list] of byFile)
+      for (const run of ST.coalesce(list)) runs.push({ file, run });
+    let pending = null;
+    const take = async (slot) => {
+      const buf = await slot.p;
+      for (const t of slot.run.tensors) {
+        const off = t.start - slot.run.start;
+        out.set(t.name, ST.toF32(t.dtype, new Uint8Array(buf, off, t.bytes)));
+        done += t.bytes;
+        if (onProgress) onProgress(`${(done / 1048576).toFixed(1)} / ${(total / 1048576).toFixed(1)} MB`);
       }
+    };
+    for (const slot of runs) {
+      const p = getRange(repo, slot.file, revision, token, slot.run.start, slot.run.end);
+      if (pending) await take(pending);
+      pending = { p, run: slot.run };
     }
+    if (pending) await take(pending);
     return out;
   }
 

public/infer.js

@@ -106,8 +106,14 @@
   }
 
   // ---- one layer --------------------------------------------------------------
-  async function layerForward(S, x, ly) {
-    const { spec, ctx } = S, C = spec.hidden, T = S.T;
+  // `span` is the chunked-prefill path. Absent, the layer is the verified
+  // full-window GEMM (one scale set for the whole window). Present, this stage
+  // keeps K and V for its own layers and attends the new rows to that cache.
+  // Those two paths are not bit-identical: per-column scales move when the
+  // matrix grows. Callers must not mix them in one comparison.
+  async function layerForward(S, x, ly, span) {
+    const { spec, ctx } = S, C = spec.hidden;
+    const T = span ? (x.length / C) | 0 : S.T;
     const hd = spec.headDim, nH = spec.heads, nKV = spec.kvHeads;
     const qDim = nH * hd, kvDim = nKV * hd;
 
@@ -130,7 +136,14 @@
         vmm(h1, ly.Wv, T, C, kvDim, ctx, ly.bv),
       ]);
     }
-    if (spec.rope) { applyRope(q, T, nH, hd, S.rope, 0); applyRope(k, T, nKV, hd, S.rope, 0); }
+    const pos0 = span ? span.pos0 : 0;
+    if (spec.rope) {
+      const need = pos0 + T + 1;
+      if (!S.rope || S.rope.cos.length < need * (hd >> 1))
+        S.rope = ropeTables(hd, spec.ropeTheta, Math.max(need, spec.maxPos || need));
+      applyRope(q, T, nH, hd, S.rope, pos0);
+      applyRope(k, T, nKV, hd, S.rope, pos0);
+    }
 
     // Grouped-query attention: several query heads share one kv head. Rather
     // than materialising repeated kv (memory this project does not have to
@@ -138,6 +151,18 @@
     const group = nH / nKV;
     const scale = 1 / Math.sqrt(hd);
     const ctxOut = new Float32Array(T * qDim);
+    let cache = null, n0 = 0, N = T;
+    if (span) {
+      if (!span.cache) span.cache = [];
+      cache = span.cache[span.li] || (span.cache[span.li] = { k: null, v: null, n: 0 });
+      n0 = cache.n;
+      N = n0 + T;
+      const nk = new Float32Array(N * kvDim), nv = new Float32Array(N * kvDim);
+      if (cache.k) { nk.set(cache.k); nv.set(cache.v); }
+      nk.set(k, n0 * kvDim); nv.set(v, n0 * kvDim);
+      cache.k = nk; cache.v = nv; cache.n = N;
+      k = nk; v = nv;
+    }
     // Scores and context are the two attention GEMMs. They are small per head
     // (T x hd and T x T), and the fused kernels in webgpu.js expect the
     // trainer's uniform-head layout, so at general head geometry they are run
@@ -145,23 +170,25 @@
     // through the units, and the CPU mirror and GPU kernel agree bit-for-bit.
     for (let h = 0; h < nH; h++) {
       const kvh = Math.floor(h / group);
-      const qh = new Float32Array(T * hd), kh = new Float32Array(T * hd), vh = new Float32Array(T * hd);
-      for (let t = 0; t < T; t++) {
+      const qh = new Float32Array(T * hd), kh = new Float32Array(N * hd), vh = new Float32Array(N * hd);
+      for (let t = 0; t < T; t++)
         qh.set(q.subarray(t * qDim + h * hd, t * qDim + h * hd + hd), t * hd);
+      for (let t = 0; t < N; t++) {
         kh.set(k.subarray(t * kvDim + kvh * hd, t * kvDim + kvh * hd + hd), t * hd);
         vh.set(v.subarray(t * kvDim + kvh * hd, t * kvDim + kvh * hd + hd), t * hd);
       }
-      const khT = TC.transpose(kh, T, hd);                       // hd x T
-      const scores = await V.vgemmBlock(qh, khT, { m: T, k: hd, n: T, batch: 1 }, ctx.L, ctx.bgemm, ctx.audit);
-      const a = new Float32Array(T * T);                          // causal softmax
+      const khT = TC.transpose(kh, N, hd);                       // hd x N
+      const scores = await V.vgemmBlock(qh, khT, { m: T, k: hd, n: N, batch: 1 }, ctx.L, ctx.bgemm, ctx.audit);
+      const a = new Float32Array(T * N);                          // causal softmax
       for (let i = 0; i < T; i++) {
+        const see = n0 + i;                                       // this query's own position in the cache
         let mx = -Infinity;
-        for (let j = 0; j <= i; j++) mx = Math.max(mx, scores[i * T + j] * scale);
+        for (let j = 0; j <= see; j++) mx = Math.max(mx, scores[i * N + j] * scale);
         let z = 0;
-        for (let j = 0; j <= i; j++) { const e = Math.exp(scores[i * T + j] * scale - mx); a[i * T + j] = e; z += e; }
-        for (let j = 0; j <= i; j++) a[i * T + j] /= z;
+        for (let j = 0; j <= see; j++) { const e = Math.exp(scores[i * N + j] * scale - mx); a[i * N + j] = e; z += e; }
+        for (let j = 0; j <= see; j++) a[i * N + j] /= z;
       }
-      const oh = await V.vgemmBlock(a, vh, { m: T, k: T, n: hd, batch: 1 }, ctx.L, ctx.bgemm, ctx.audit);
+      const oh = await V.vgemmBlock(a, vh, { m: T, k: N, n: hd, batch: 1 }, ctx.L, ctx.bgemm, ctx.audit);
       for (let t = 0; t < T; t++) ctxOut.set(oh.subarray(t * hd, t * hd + hd), t * qDim + h * hd);
     }
     const attn = await vmm(ctxOut, ly.Wo, T, qDim, C, ctx, ly.bo);
@@ -210,7 +237,42 @@
   }
 
   async function runLayers(S, x) {
+    // A non-finite activation used to quantize to a silent zero and keep
+    // travelling. Train refuses it (NonFiniteError). A hop must too: the
+    // next stage would otherwise agree on a wrong sum.
+    V.assertFinite(x, "activation");
     for (const ly of S.w.layers) x = await layerForward(S, x, ly);
+    V.assertFinite(x, "activation");
+    return x;
+  }
+
+  // One chunk of a pipelined prefill. `span.cache` is owned by the caller and
+  // lives for the whole prompt; each call appends this chunk's K and V.
+  // `span.pos0` is the first absolute position in `x`.
+  async function runLayersChunk(S, x, span) {
+    V.assertFinite(x, "activation");
+    const C = S.spec.hidden;
+    const T = (x.length / C) | 0;
+    if (T < 1 || T * C !== x.length) throw new Error("chunk length is not a whole number of rows");
+    for (let li = 0; li < S.w.layers.length; li++) {
+      span.li = li;
+      x = await layerForward(S, x, S.w.layers[li], span);
+    }
+    V.assertFinite(x, "activation");
+    return x;
+  }
+
+  function embedRows(S, ids, pos0) {
+    const { spec } = S, C = spec.hidden, T = ids.length;
+    const x = new Float32Array(T * C);
+    for (let i = 0; i < T; i++) {
+      const id = ids[i];
+      for (let j = 0; j < C; j++) x[i * C + j] = S.w.emb[id * C + j];
+      if (S.w.pos) {
+        const p = pos0 + i;
+        for (let j = 0; j < C; j++) x[i * C + j] += S.w.pos[p * C + j];
+      }
+    }
     return x;
   }
 
@@ -224,6 +286,65 @@
     return vmm(last, S.w.lmHead, 1, C, spec.vocab, ctx, null);
   }
 
+  // Logits at several rows of one window, so one lap can score a draft span.
+  // Row indexes are into the fixed context window the verified path uses.
+  async function logitsAt(S, x, rows) {
+    const { spec, ctx } = S, C = spec.hidden;
+    const T = (x.length / C) | 0;
+    const y = norm(spec, x, T, C, S.w.nrmF, S.w.nrmFb);
+    const out = [];
+    for (const r of rows) {
+      if (r < 0 || r >= T) throw new Error("readout row outside the window");
+      out.push(await vmm(y.subarray(r * C, (r + 1) * C), S.w.lmHead, 1, C, spec.vocab, ctx, null));
+    }
+    return out;
+  }
+
+  // Chunked prefill, then one new token per lap on the same KV. Both the
+  // ring and the differential check call this so they compare like with like.
+  // It is not the full-window path.
+  async function generateChunked(stages, ids0, nNew, chunkSize, opts) {
+    const ids = [...ids0];
+    const spans = stages.map(() => ({ cache: [], pos0: 0, li: 0 }));
+    const size = Math.max(1, chunkSize | 0);
+    let last = null;
+    for (let lo = 0; lo < ids.length; lo += size) {
+      const piece = ids.slice(lo, Math.min(ids.length, lo + size));
+      let x = embedRows(stages[0], piece, lo);
+      for (let s = 0; s < stages.length; s++) {
+        spans[s].pos0 = lo;
+        x = await runLayersChunk(stages[s], x, spans[s]);
+      }
+      last = x;
+    }
+    for (let n = 0; n < nNew; n++) {
+      const row = (last.length / stages[0].spec.hidden) - 1;
+      const id = pickToken((await logitsAt(stages[0], last, [row]))[0], opts);
+      ids.push(id);
+      const pos = ids.length - 1;
+      let x = embedRows(stages[0], [id], pos);
+      for (let s = 0; s < stages.length; s++) {
+        spans[s].pos0 = pos;
+        x = await runLayersChunk(stages[s], x, spans[s]);
+      }
+      last = x;
+    }
+    return ids;
+  }
+
+  // Where, in a left-padded window of length T, the logits sit that propose
+  // each draft token plus the one token after the first rejection.
+  function draftRows(T, seqLen, draftLen) {
+    const rows = [];
+    const first = seqLen - draftLen - 1;
+    for (let i = 0; i <= draftLen; i++) {
+      const tok = first + i;
+      if (tok < 0 || tok >= seqLen) break;
+      rows.push(T - seqLen + tok);
+    }
+    return rows;
+  }
+
   // ---- sampling ---------------------------------------------------------------
   function mulberry32(a) { return function () { a |= 0; a = a + 0x6D2B79F5 | 0; let t = Math.imul(a ^ a >>> 15, 1 | a); t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t; return ((t ^ t >>> 14) >>> 0) / 4294967296; }; }
   function pickToken(logits, opts) {
@@ -259,7 +380,40 @@
     return out;
   }
 
-  const api = { makeStage, embed, runLayers, readout, pickToken, generateLocal,
+  // Verified full-window path, with a prompt-lookup draft scored in the same lap.
+  // An empty draft is exactly one new token, the same window as generateLocal.
+  async function generateLookahead(stages, ids0, nNew, T, opts) {
+    const ids = [...ids0];
+    const head = stages[0];
+    const maxDraft = opts && opts.maxDraft != null ? opts.maxDraft : 4;
+    let produced = 0;
+    while (produced < nNew) {
+      let draft = SH.promptLookupDraft(ids, maxDraft);
+      const seqIds = ids.concat(draft);
+      const shown = seqIds.slice(-T);
+      const shownDraft = Math.min(draft.length, Math.max(0, shown.length - 1));
+      draft = draft.slice(draft.length - shownDraft);
+      const win = new Int32Array(T);
+      for (let i = 0; i < shown.length; i++) win[T - shown.length + i] = shown[i];
+      let x = embed(head, win);
+      for (const S of stages) x = await runLayers(S, x);
+      const rows = draftRows(T, shown.length, draft.length);
+      const picked = [];
+      for (const logits of await logitsAt(head, x, rows)) picked.push(pickToken(logits, opts));
+      const got = SH.acceptDraft(picked, draft);
+      if (!got.length) break;
+      for (const id of got) {
+        ids.push(id);
+        produced++;
+        if (produced >= nNew) break;
+      }
+    }
+    return ids;
+  }
+
+  const api = { makeStage, embed, embedRows, runLayers, runLayersChunk, readout, logitsAt, draftRows,
+                generateLookahead,
+                pickToken, generateLocal, generateChunked,
                 rmsNorm, layerNorm, norm, ropeTables, applyRope, silu, gelu, mulberry32 };
   if (typeof module !== "undefined" && module.exports) {
     TC = require("./traincore.js"); V = require("./verified_core.js"); SH = require("./shard.js");

public/shard.js

@@ -148,8 +148,165 @@
     return fnv1a(new TextEncoder().encode(parts.join("|")));
   }
 
+  // Peers whose kernel probe disagrees with the head are not in the ring.
+  // The head (index 0) is always kept. A missing probe is not a disagreement:
+  // the hello has not arrived yet, and buildPlan only lists peers that sent one.
+  function ringMembers(caps, probeHash) {
+    if (!caps.length) return [];
+    const head = caps[0];
+    const rest = caps.slice(1).filter(d => !probeHash || !d.probe || d.probe === probeHash);
+    return [head, ...rest];
+  }
+
+  // Budget check, not a latency model. `gemmPerSec` is the capacity probe:
+  // how many 32x64x64 verified GEMMs this device finishes per second. The
+  // count below is the MAC volume of one window through every layer, divided
+  // by that unit. It is there to refuse a split that cannot produce a token
+  // in `budgetMs`, before any weight download.
+  function estimateLapMs(spec, T, gemmPerSec) {
+    const unit = 32 * 64 * 64;
+    const C = spec.hidden;
+    const inter = spec.inter || (C * 4);
+    const hd = spec.headDim || Math.floor(C / spec.heads);
+    const q = spec.heads * hd;
+    const kv = (spec.kvHeads || spec.heads) * hd;
+    const macPerLayer = T * C * q + 2 * T * C * kv + T * q * C + 3 * T * C * inter
+      + spec.heads * (T * hd * T + T * T * hd);
+    const gemms = (macPerLayer * spec.layers) / unit;
+    return gemms / Math.max(gemmPerSec, 1e-6) * 1000;
+  }
+
+  // Whole-model f32 bytes versus a fraction of reported device RAM.
+  // `deviceGB` comes from navigator.deviceMemory when the browser provides it.
+  // Unknown memory returns false: the ring is used, rather than guessing.
+  function headCanHold(spec, tensors, deviceGB) {
+    if (!deviceGB || deviceGB <= 0) return false;
+    let bytes = 0;
+    for (const t of tensors.values()) bytes += t.elems * 4;
+    return bytes < deviceGB * 0.25 * 1073741824;
+  }
+
+  // A short prompt stays on the head when the head can hold every layer.
+  // The ring still exists for prompts that do not fit that rule.
+  function preferLocal(promptTokens, peerCount, fits) {
+    return !!(fits && peerCount > 0 && promptTokens > 0 && promptTokens <= 64);
+  }
+
+  // Rolling FNV blocks over token ids. This is the approximate prefix index:
+  // it records which prefix this chat last ran. The forward pass still
+  // recomputes the window. Per-column value scales depend on every token in
+  // the window, so skipping a matched block would not be bit-identical to the
+  // full pass, and this project does not ship a second answer.
+  function makePrefixIndex(blockSize) {
+    const B = blockSize || 64;
+    const sessions = new Map();
+    function blocks(ids) {
+      const out = [];
+      for (let i = 0; i < ids.length; i += B) {
+        const slice = ids.slice(i, Math.min(ids.length, i + B));
+        out.push(fnv1a(new TextEncoder().encode(slice.join(","))));
+      }
+      return out;
+    }
+    return {
+      blockSize: B,
+      blocks,
+      note(session, ids) { sessions.set(session, blocks(ids)); },
+      matchedBlocks(session, ids) {
+        const prev = sessions.get(session);
+        if (!prev) return 0;
+        const now = blocks(ids);
+        let n = 0;
+        while (n < now.length && n < prev.length && now[n] === prev[n]) n++;
+        return n;
+      },
+    };
+  }
+
+  // In-memory KV spill. When the byte cap is hit, the oldest block is dropped
+  // and the caller recomputes that span. `held` is what remained.
+  function makeKvSpill(maxBytes) {
+    let used = 0;
+    const order = [];
+    const map = new Map();
+    function drop() {
+      const k = order.shift();
+      const old = map.get(k);
+      if (!old) return;
+      map.delete(k);
+      used -= old.byteLength;
+    }
+    return {
+      get used() { return used; },
+      get size() { return map.size; },
+      put(key, bytes) {
+        const n = bytes.byteLength;
+        if (map.has(key)) {
+          used -= map.get(key).byteLength;
+          const i = order.indexOf(key);
+          if (i >= 0) order.splice(i, 1);
+        }
+        while (order.length && used + n > maxBytes) drop();
+        if (n > maxBytes) return false;
+        map.set(key, bytes);
+        order.push(key);
+        used += n;
+        return true;
+      },
+      get(key) { return map.get(key) || null; },
+    };
+  }
+
+  // Prompt chunks for a pipelined prefill. `window` is how many chunks may be
+  // in flight across the ring at once. Decode stays one token, one lap:
+  // the next token is not known until the lap returns.
+  function prefillChunks(nTokens, chunkSize, inFlight) {
+    const size = Math.max(1, chunkSize | 0);
+    const window = Math.max(1, inFlight | 0);
+    const chunks = [];
+    for (let lo = 0; lo < nTokens; lo += size)
+      chunks.push({ index: chunks.length, lo, hi: Math.min(nTokens, lo + size) });
+    return { chunks, window, chunkSize: size };
+  }
+
+  // Prompt-lookup draft: the longest suffix of the token ids that already
+  // occurred earlier, and the tokens that followed it. No second model.
+  // Empty when nothing repeats. The ring then scores that span in one lap.
+  function promptLookupDraft(ids, maxDraft) {
+    const cap = Math.max(0, maxDraft | 0);
+    const n = ids.length;
+    if (cap === 0 || n < 3) return [];
+    let best = [], bestLen = 0;
+    const maxLen = Math.min(n - 1, 8);
+    for (let len = 2; len <= maxLen; len++) {
+      for (let i = 0; i + len < n; i++) {
+        let match = true;
+        for (let j = 0; j < len; j++) if (ids[i + j] !== ids[n - len + j]) { match = false; break; }
+        if (!match) continue;
+        const draft = [];
+        // Tokens after the earlier copy, and before the suffix we just matched.
+        for (let k = 0; k < cap && i + len + k < n - len; k++) draft.push(ids[i + len + k]);
+        if (!draft.length) continue;
+        if (len > bestLen) { best = draft; bestLen = len; }
+      }
+    }
+    return best;
+  }
+
+  // picked[i] proposes draft[i]. picked has one extra entry: the token at the
+  // first position that rejected, which is always kept.
+  function acceptDraft(picked, draft) {
+    const out = [];
+    let i = 0;
+    while (i < draft.length && i < picked.length && picked[i] === draft[i]) out.push(draft[i]), i++;
+    if (i < picked.length) out.push(picked[i]);
+    return out;
+  }
+
   const api = { planStages, stageBytes, stageWeights, toKN, transposeEmb,
-                fnv1a, hashF32, modelFingerprint };
+                fnv1a, hashF32, modelFingerprint, ringMembers, estimateLapMs,
+                headCanHold, preferLocal, makePrefixIndex, makeKvSpill,
+                prefillChunks, promptLookupDraft, acceptDraft };
   if (typeof module !== "undefined" && module.exports) module.exports = api;
   else root.Shard = api;
 })(typeof self !== "undefined" ? self : this);

public/traincore.js

@@ -54,13 +54,29 @@
   // ORDER MATTERS: float addition is not associative, so every replica MUST
   // pass the gradients in the same order (the leader's roster order) or their
   // averages differ in the last bits and the weights fork. Never self-first.
+  //
+  // REFUSES (throws GradientError) rather than averaging when (a) the gradients differ in
+  // length -- typed arrays silently ignore out-of-range writes, so a truncated gradient used
+  // to be averaged over a prefix with no error -- or (b) any value is non-finite: one NaN
+  // would enter DaisyAdam's m/v on EVERY peer (and every later checkpoint) identically, so no
+  // fork check could see it. Refusing BEFORE the optimizer keeps weights and moments clean.
   function averageGrads(grads) {
-    const out = new Float32Array(grads[0].length);
+    const len = grads[0].length;
+    for (let r = 0; r < grads.length; r++) {
+      const g = grads[r];
+      if (!g || g.length !== len) throw gradError("gradient " + r + " has " +
+        (g ? g.length : "no") + " values, gradient 0 has " + len);
+      for (let i = 0; i < len; i++) if (!Number.isFinite(g[i]))
+        throw gradError("gradient " + r + " is non-finite at index " + i + " (" + g[i] + ")");
+    }
+    const out = new Float32Array(len);
     for (const g of grads) for (let i = 0; i < g.length; i++) out[i] += g[i];
     for (let i = 0; i < out.length; i++) out[i] /= grads.length;
     return out;
   }
 
+  function gradError(msg) { const e = new Error(msg); e.name = "GradientError"; return e; }
+
   // DaisyAdam — Adam with bias correction, applied to the cluster-averaged
   // gradient. State is a pure function of the gradient sequence, so every peer
   // that averages the same gradients keeps bit-identical moments: no optimizer

public/verified_core.js

@@ -8,7 +8,26 @@
 
   let TC;   // TrainCore (matmul/transpose) — resolved per environment at the end
 
+  // A float -> int8 conversion has no answer for NaN/Inf, and the quantizers below give a
+  // silent wrong one: an Inf makes the |max| scale Infinity and EVERY value quantizes to 0
+  // ([0.5, Inf, 3] -> [0, 0, 0]); a NaN is skipped by `a > mx` and then stored as 0 by the
+  // Int8Array. The Python trainer refuses the same input (qat.py); so does this. One pass,
+  // no effect on finite inputs, so builds with and without it still co-train.
+  function assertFinite(X, where) {
+    for (let i = 0; i < X.length; i++) {
+      if (!Number.isFinite(X[i])) {
+        let bad = 0;
+        for (let j = i; j < X.length; j++) if (!Number.isFinite(X[j])) bad++;
+        const e = new Error("non-finite input to " + where + " (" + bad + " of " + X.length +
+                            " values): the int8 quantize would turn it into 0");
+        e.name = "NonFiniteError";
+        throw e;
+      }
+    }
+  }
+
   function quantize(X) {
+    assertFinite(X, "quantize");
     let mx = 0; for (let i = 0; i < X.length; i++) { const a = Math.abs(X[i]); if (a > mx) mx = a; }
     const scale = Math.max(mx / 127, 1e-8);
     const q = new Int8Array(X.length);
@@ -16,8 +35,22 @@
     return { q, scale };
   }
 
+  // int32 accumulator headroom: |a*b| <= 128*128, so K*16384 must fit in int32. Same bound as
+  // the Python kernel (kernel.MAX_INT32_K). The Int32Array accumulators here WRAP exactly like
+  // WGSL i32, so CPU and GPU peers would agree -- on a silently wrong sum. Refuse instead.
+  const MAX_INT32_K = Math.floor((2 ** 31 - 1) / (128 * 128));      // 131071
+  function accBound(k, where) {
+    if (k > MAX_INT32_K) {
+      const e = new Error(where + ": contraction length " + k + " exceeds the int32 accumulator " +
+                          "headroom " + MAX_INT32_K + " (the sum would wrap)");
+      e.name = "AccumulatorBoundError";
+      throw e;
+    }
+  }
+
   // int8 matmul via the verified multiply LUT: acc(m×n) = sum_k mulLUT[Xq,Wq]
   function lutMatmulJS(Xq, Wq, m, k, n, L) {
+    accBound(k, "lutMatmulJS");
     const C = new Int32Array(m * n), mul = L.mul;
     for (let i = 0; i < m; i++) {
       for (let p = 0; p < k; p++) {
@@ -73,6 +106,7 @@
   // outlier no longer crushes the quantization resolution of every other
   // row/column. One LUT pass at this granularity beats the per-tensor 3-pass.
   function quantizeRows(X, rows, cols) {
+    assertFinite(X, "quantizeRows");
     const q = new Int8Array(rows * cols), s = new Float32Array(rows);
     for (let r = 0; r < rows; r++) {
       let mx = 0;
@@ -86,6 +120,7 @@
     return { q, s };
   }
   function quantizeCols(W, rows, cols) {
+    assertFinite(W, "quantizeCols");
     const q = new Int8Array(rows * cols), s = new Float32Array(cols);
     for (let c = 0; c < cols; c++) {
       let mx = 0;
@@ -120,6 +155,7 @@
   // (≤1 step) vs quantizeRows, so old and new builds cannot co-train — the
   // divergence guard stops such mixed groups by design.
   function rowAbsMax(X, rows, cols) {
+    assertFinite(X, "rowAbsMax");
     const mx = new Float32Array(rows);
     for (let r = 0; r < rows; r++) {
       let m = 0;
@@ -129,6 +165,12 @@
     return mx;
   }
   function scalesFromAbsMax(mx) {                // f64 divisions: exactly rounded, device-identical
+    // The GPU chain gets mx from an atomicMax over bitcast(abs(h)) and never passes through
+    // rowAbsMax, so this is where ITS non-finite guard lives: NaN bits (0x7FC00000) and Inf
+    // (0x7F800000) both order above every finite |h| as u32, so the row max is non-finite iff
+    // some element is. Before 2026-09-30 a GPU peer turned that into inv = 0/NaN and quantized
+    // floor(NaN) on the device (implementation-defined) where a CPU peer threw.
+    assertFinite(mx, "scalesFromAbsMax");
     const scale = new Float32Array(mx.length), inv = new Float32Array(mx.length);
     for (let i = 0; i < mx.length; i++) {
       scale[i] = Math.max(mx[i] / 127, 1e-8);
@@ -199,6 +241,7 @@
   function bgemmJS(Xq, Wq, rs, cs, d, L) {
     const { m, k, n } = d, batch = d.batch || 1, relu = !!d.relu, mul = L.mul;
     const raw = !!d.acc;
+    accBound(k, "bgemmJS");
     const out = raw ? new Int32Array(batch * m * n) : new Float32Array(batch * m * n);
     const acc = new Int32Array(n);
     for (let bz = 0; bz < batch; bz++) {
@@ -291,6 +334,40 @@
     return out;
   }
 
+  // ---- live audit for the split-K f32 GEMM -----------------------------------
+  // Every int8 kernel had a live-shape audit; the f32 backward GEMM -- whose
+  // output IS the embedding gradient -- had only its init gate at 7x4500x5 and
+  // 9x300x6, while training runs it at vocab x BT x C. Same remedy as auditTile:
+  // recompute a few cells (structural corners first) with the mirror's exact
+  // partition and rounding schedule, compare bit-for-bit (2026-10-14 review).
+  function fgemmCell(A, Bm, d, fma, row, col) {
+    const { m, k, n } = d, transA = !!d.transA;
+    const S = k > 4096 ? Math.min(16, Math.ceil(k / 2048)) : 1;
+    const ks = Math.ceil(k / S);
+    let acc = 0;
+    for (let z = 0; z < S; z++) {
+      const p0 = z * ks, p1 = Math.min(k, p0 + ks);
+      let s = 0;
+      for (let p = p0; p < p1; p++) {
+        const a = transA ? A[p * m + row] : A[row * k + p];
+        s = fma ? f32(s + a * Bm[p * n + col]) : f32(s + f32(a * Bm[p * n + col]));
+      }
+      acc = f32(acc + s);
+    }
+    return acc;
+  }
+  function auditFgemm(A, Bm, d, got, fma, nCells) {
+    const { m, n } = d, N = nCells || 8;
+    const edges = [[m - 1, n - 1], [0, n - 1], [m - 1, 0], [0, 0]];
+    for (let t = 0; t < N; t++) {
+      const [i, j] = t < edges.length ? edges[t] : [(Math.random() * m) | 0, (Math.random() * n) | 0];
+      const v = fgemmCell(A, Bm, d, fma, i, j);
+      if (bitDiff(got[i * n + j], v))
+        return `f32 GEMM audit failed at [${i},${j}] shape ${m}x${d.k}x${n}${d.transA ? " transA" : ""}: kernel ${got[i * n + j]} vs mirror ${v}`;
+    }
+    return null;
+  }
+
   // ---- live audits for the fused attention kernels ---------------------------
   // The attention kernels had exact INIT gates but nothing at live shapes —
   // the exact gap the GEMM audit exists to close, left open on the kernels with
@@ -379,6 +456,7 @@
   // The (BT·heads)×hd row view of q/k IS the contiguous buffer, so
   // quantizeRows(q, BT·heads, hd) gives per-(token,head) scales for free.
   function quantizeHeadCols(v, B, T, heads, hd) {   // per (batch,head,channel) column
+    assertFinite(v, "quantizeHeadCols");
     const C = heads * hd;
     const q = new Int8Array(B * T * C), s = new Float32Array(B * heads * hd);
     for (let bi = 0; bi < B; bi++)
@@ -403,6 +481,9 @@
   // d.acc=true returns the raw int32 accumulator (exact oracle for the kernel gate)
   function attScoresJS(qq, kq, qs, ks, d, L) {
     const { B, T, heads, hd } = d, C = heads * hd, mul = L.mul, raw = !!d.acc;
+    // the WGSL kernel sums these in i32; this mirror sums in doubles. Bound both identically so
+    // a CPU peer and a GPU peer refuse the same shapes instead of one halting alone.
+    accBound(hd, "attScoresJS");
     const out = raw ? new Int32Array(B * heads * T * T) : new Float32Array(B * heads * T * T);
     for (let bi = 0; bi < B; bi++) for (let h = 0; h < heads; h++) {
       const bz = bi * heads + h;
@@ -421,6 +502,7 @@
   // ctx[(bi,ti),(h,j)] = Σ_tj a[bz,ti,tj]·v[(bi,tj),(h,j)] — scatter fused into BT×C
   function attCtxJS(aq, vq, as, vs, d, L) {
     const { B, T, heads, hd } = d, C = heads * hd, mul = L.mul, raw = !!d.acc;
+    accBound(T, "attCtxJS");                       // contracts over keys, like gpuAttCtx
     const out = raw ? new Int32Array(B * T * C) : new Float32Array(B * T * C);
     for (let bi = 0; bi < B; bi++) for (let h = 0; h < heads; h++) {
       const bz = bi * heads + h;
@@ -487,10 +569,10 @@
     for (let j = 0; j < W2.length; j++) W2[j] -= lr * gAvg[W1.length + j];
   }
 
-  const api = { quantize, quantize2, quantizeRows, quantizeCols, quantizeHeadCols, lutMatmulJS, lutMatmul3JS, lutMatmul3,
+  const api = { assertFinite, accBound, MAX_INT32_K, quantize, quantize2, quantizeRows, quantizeCols, quantizeHeadCols, lutMatmulJS, lutMatmul3JS, lutMatmul3,
                 bgemmJS, vgemmBlock, auditTile, epi, attScoresJS, attCtxJS, linearFwd, forward, backward, splitApply,
                 rowAbsMax, scalesFromAbsMax, quantizeRowsInv, vmlpBlock, bitDiff,
-                auditAttScores, auditAttCtx, fgemmMirror };
+                auditAttScores, auditAttCtx, fgemmMirror, auditFgemm };
   if (typeof module !== "undefined" && module.exports) { TC = require("./traincore.js"); module.exports = api; }
   else { TC = root.TrainCore; root.Verified = api; }
 })(typeof self !== "undefined" ? self : this);

public/webgpu.js

@@ -286,7 +286,11 @@
                   matmulInt8: (Xq, Wq, m, k, n, LL) => root.Verified.lutMatmulJS(Xq, Wq, m, k, n, LL) };
     if (!(root.navigator && navigator.gpu)) return cpu;
     try {
-      const adapter = await navigator.gpu.requestAdapter();
+      // Ask for the discrete GPU: the default adapter on a laptop is the iGPU
+      // (measured 2026-10-14: Intel gen-9 picked while an RTX sat idle). The
+      // browser may still hand back the iGPU; the gates decide what runs.
+      const adapter = (await navigator.gpu.requestAdapter({ powerPreference: "high-performance" })) ||
+                      (await navigator.gpu.requestAdapter());
       if (!adapter) return cpu;
       const device = await adapter.requestDevice();
       const info = adapter.info || {};
@@ -330,9 +334,27 @@
       // because head-strided addressing is where these kernels can go wrong.
       let att = { scores: (qq, kq, qs, ks, d) => gpuAttScores(device, d.acc ? scoresVPipe : scoresPipe, qq, kq, qs, ks, d),
                   ctx: (aq, vq, as, vs, d) => gpuAttCtx(device, d.acc ? ctxVPipe : ctxPipe, aq, vq, as, vs, d) };
+      // Two sweeps: the second runs on RECYCLED pool buffers left full of
+      // large-magnitude residue (same shapes => same buckets, LIFO free list),
+      // the dirty-buffer gate the bgemm and MLP kernels already had. Without it
+      // a kernel that skips writing some output cell would pass on fresh
+      // buffers and corrupt live steps (2026-10-14 review).
+      const ATT_SHAPES = [{ B: 2, T: 8, heads: 2, hd: 8 }, { B: 1, T: 32, heads: 2, hd: 16 },
+                          { B: 3, T: 7, heads: 3, hd: 5 }, { B: 2, T: 33, heads: 4, hd: 8 }];
       try {
-        for (const d0 of [{ B: 2, T: 8, heads: 2, hd: 8 }, { B: 1, T: 32, heads: 2, hd: 16 },
-                          { B: 3, T: 7, heads: 3, hd: 5 }, { B: 2, T: 33, heads: 4, hd: 8 }]) {
+        for (const dirty of [false, true]) {
+          if (dirty) for (const d0 of ATT_SHAPES) {
+            const nQ = d0.B * d0.T * d0.heads * d0.hd, nA = d0.B * d0.heads * d0.T * d0.T;
+            const big = (n) => new Float32Array(n).fill(1e4);
+            for (const acc of [false, true]) {
+              const dv = { ...d0, acc };
+              await att.scores(new Int8Array(nQ).fill(127), new Int8Array(nQ).fill(127),
+                               big(d0.B * d0.T * d0.heads), big(d0.B * d0.T * d0.heads), dv);
+              await att.ctx(new Int8Array(nA).fill(127), new Int8Array(nQ).fill(127),
+                            big(d0.B * d0.heads * d0.T), big(d0.B * d0.heads * d0.hd), dv);
+            }
+          }
+        for (const d0 of ATT_SHAPES) {
           const nQ = d0.B * d0.T * d0.heads * d0.hd;
           const qq = new Int8Array(nQ), kq = new Int8Array(nQ), vq = new Int8Array(nQ);
           for (let i = 0; i < nQ; i++) { qq[i] = (Math.random() * 256 - 128) | 0; kq[i] = (Math.random() * 256 - 128) | 0; vq[i] = (Math.random() * 256 - 128) | 0; }
@@ -353,7 +375,8 @@
           const refS = root.Verified.attScoresJS(qq, kq, qs, ks, d0, L);
           const refC = root.Verified.attCtxJS(aq, vq, as, vs, d0, L);
           for (let i = 0; i < refS.length; i++) if (bitDiff(hwS[i], refS[i])) throw new Error(`scores epilogue mismatch @${i}`);
-          for (let i = 0; i < refC.length; i++) if (bitDiff(hwC[i], refC[i])) throw new Error(`ctx epilogue mismatch @${i}`);
+          for (let i = 0; i < refC.length; i++) if (bitDiff(hwC[i], refC[i])) throw new Error(`ctx epilogue mismatch @${i}${dirty ? " (dirty pool)" : ""}`);
+        }
         }
       } catch (e) {
         console.warn("fused attention kernels failed verification — using CPU LUT mirrors:", e.message);
@@ -398,6 +421,39 @@
         const Bt = Float32Array.from({ length: mT * nT }, () => Math.random() - 0.5);
         const Bn = Float32Array.from({ length: kT * nT }, () => Math.random() - 0.5);
         const dT = { m: kT, k: mT, n: nT, transA: true }, dN = { m: mT, k: kT, n: nT };
+        // transA against the MIRROR, not just against fgemm: before 2026-10-14
+        // the transA index pattern was only ever compared with itself (fgemm2
+        // leg vs fgemm call, same shader), so a wrong A[p*m+row] passed. The
+        // second shape puts transA through split-K (k > 4096) as well.
+        const fma = fgemmFma;
+        for (const [mA, kA, nA] of [[kT, mT, nT], [6, 4500, 3]]) {
+          const At = Float32Array.from({ length: mA * kA }, () => Math.random() - 0.5);
+          const Bx = Float32Array.from({ length: kA * nA }, () => Math.random() - 0.5);
+          const dX = { m: mA, k: kA, n: nA, transA: true };
+          const got = await fgemm(At, Bx, dX), want = root.Verified.fgemmMirror(At, Bx, dX, fma);
+          for (let i = 0; i < want.length; i++) if (bitDiff(got[i], want[i])) throw new Error(`fgemm transA differs from the mirror @${i} (${mA}x${kA}x${nA})`);
+        }
+        // SUBNORMALS: WGSL permits an implementation to flush f32 subnormals to
+        // zero, and the JS mirror never flushes. The random inputs above are
+        // ~0.1 in magnitude and never produce one, so a flushing GPU passed this
+        // gate and then forked from non-flushing peers on tiny gradients
+        // (2026-10-14; the emulator's FTZ/DAZ lesson). Products here are ~1e-40.
+        {
+          const dS = { m: 3, k: 64, n: 2 };
+          const As = Float32Array.from({ length: dS.m * dS.k }, (_, i) => (i % 2 ? 1 : -1) * (1 + (i % 7)) * 1e-20);
+          const Bs = Float32Array.from({ length: dS.k * dS.n }, (_, i) => (1 + (i % 5)) * 1e-20);
+          const got = await fgemm(As, Bs, dS), want = root.Verified.fgemmMirror(As, Bs, dS, fma);
+          let sub = 0;
+          for (let i = 0; i < want.length; i++) if (want[i] !== 0 && Math.abs(want[i]) < 1.1754943508222875e-38) sub++;
+          if (!sub) throw new Error("subnormal gate case produced no subnormal (test is vacuous)");
+          for (let i = 0; i < want.length; i++) if (bitDiff(got[i], want[i]))
+            throw new Error(`fgemm flushes or rounds subnormals differently @${i}: ${got[i]} vs mirror ${want[i]}`);
+        }
+        // dirty re-gate: poison the partial/output buckets at the gate's shapes, then re-check
+        await fgemm(new Float32Array(m0 * k0).fill(1e4), new Float32Array(k0 * n0).fill(1e4), dG);
+        const hw2 = await fgemm(A, Bm, dG);
+        const mRef = fma ? mFma : mStep;
+        for (let i = 0; i < hw2.length; i++) if (bitDiff(hw2[i], mRef[i])) throw new Error(`fgemm differs on a recycled (dirty) pool @${i}`);
         const [f1, f2] = await fgemm2(A2, Bt, dT, Bn, dN);
         const [r1, r2] = [await fgemm(A2, Bt, dT), await fgemm(A2, Bn, dN)];
         for (let i = 0; i < r1.length; i++) if (bitDiff(f1[i], r1[i])) throw new Error("fgemm2 transA leg differs");
@@ -559,7 +615,7 @@
 
       const viaLUT = { backend: "webgpu", label: `${gpuName} (LUT shader · exact-gated)`,
                        matmulInt8: (Xq, Wq, m, k, n) => gpuMatmulLUT(device, lutPipe, lutBuf, Xq, Wq, m, k, n),
-                       bgemm: bgLut, att, fgemm, fgemm2, mlp: mlpLut };
+                       bgemm: bgLut, att, fgemm, fgemm2, fgemmFma, mlp: mlpLut };
 
       // DP4A pipeline — only if the WGSL feature exists AND its batched kernel
       // reproduces the verified units exactly across the shape sweep
@@ -587,7 +643,7 @@
       // worse than a fixed choice. DP4A ships: it wins the int8-backward mode
       // by ~12% and ties elsewhere.
       return { backend: "webgpu", label: `${gpuName} (DP4A int8 dot · exact-gated vs units)`,
-               bgemm: bg, att, fgemm, fgemm2, mlp: mlpDp4 };
+               bgemm: bg, att, fgemm, fgemm2, fgemmFma, mlp: mlpDp4 };
     } catch (e) { console.warn("WebGPU init failed, CPU fallback:", e); return cpu; }
   }
 
@@ -611,6 +667,7 @@
   }
 
   async function gpuMatmulLUT(device, pipeline, lutBuf, Xq, Wq, m, k, n) {
+    root.Verified.accBound(k, "gpuMatmulLUT");                  // WGSL `var s : i32` wraps past this
     const X32 = Int32Array.from(Xq), W32 = Int32Array.from(Wq);   // byte -> i32
     const bufX = up(device, X32, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufW = up(device, W32, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
@@ -626,6 +683,7 @@
   // attention kernels: int8 (widened i32) in, f32 out, strided head indexing
   async function gpuAttScores(device, pipeline, qq, kq, qs, ks, d) {
     const { B, T, heads } = d;
+    root.Verified.accBound(d.hd, "gpuAttScores");
     const bufQ = up(device, Int32Array.from(qq), GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufK = up(device, Int32Array.from(kq), GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufQs = up(device, qs, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
@@ -640,6 +698,7 @@
   }
   async function gpuAttCtx(device, pipeline, aq, vq, as, vs, d) {
     const { B, T, heads, hd } = d;
+    root.Verified.accBound(T, "gpuAttCtx");
     const bufA = up(device, Int32Array.from(aq), GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufV = up(device, Int32Array.from(vq), GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufAs = up(device, as, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
@@ -759,6 +818,7 @@
 
   async function gpuBgemmLUT(device, pipeline, lutBuf, Xq, Wq, rs, cs, d) {
     const { m, k, n } = d, batch = d.batch || 1, flags = d.relu ? 1 : 0;
+    root.Verified.accBound(k, "gpuBgemmLUT");
     const bufX = up(device, Int32Array.from(Xq), GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufW = up(device, Int32Array.from(Wq), GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
     const bufR = up(device, rs, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
@@ -775,6 +835,7 @@
 
   async function gpuBgemmDP4(device, pipeline, Xq, Wq, rs, cs, d) {
     const { m, k, n } = d, batch = d.batch || 1, flags = d.relu ? 1 : 0;
+    root.Verified.accBound(k, "gpuBgemmDP4");
     const kw = Math.ceil(k / 4);
     const Xp = packRows(Xq, batch * m, k, kw);            // rows are (batch·m)
     const Wp = new Uint32Array(batch * n * kw);           // per-batch Wᵀ, packed
@@ -801,6 +862,7 @@
   // left operand is produced and consumed entirely on the GPU.
   async function gpuMlpChain(device, env, xq, w1q, w2q, xs, w1s, w2s, d) {
     const { m, k, h, n } = d, dp4 = !!env.dp4;
+    root.Verified.accBound(k, "gpuMlpChain gemm1"); root.Verified.accBound(h, "gpuMlpChain gemm2");
     const SU = GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST;
     let bufX, bufW1, bufW2, kw1, hw;
     if (dp4) {
@@ -850,7 +912,12 @@
     const mx = new Float32Array(readM.getMappedRange(0, m * 4).slice(0)); readM.unmap();
     // scale derivation in JS f64 — exactly rounded, identical on every device
     // (WGSL division is 2.5 ULP, which is why it never runs on the GPU)
-    const sc = root.Verified.scalesFromAbsMax(mx);
+    let sc;
+    try { sc = root.Verified.scalesFromAbsMax(mx); }   // refuses a non-finite row max
+    catch (e) {                                        // hand the pooled buffers back first
+      release(device, [bufX, bufW1, bufW2, bufRs, bufCs1, bufCs2, bufH, bufMX, bufD1, bufDM, readH, readM]);
+      throw e;
+    }
     const bufInv = up(device, sc.inv, SU), bufHs = up(device, sc.scale, SU);
     const bufQ = mk(device, m * hw * 4, GPUBufferUsage.STORAGE);
     const bufDQ = up(device, new Uint32Array([m, h, hw, 0]), UU);

test_pipeline.js

@@ -188,6 +188,87 @@ const GPT2 = Arch.fromConfig({
     assert.ok(a[0].head, "stage 0 must be the head");
   });
 
+  await t("a disagreeing kernel probe is left out of the ring", async () => {
+    const caps = [
+      { id: "head", capacity: 100, probe: 1 },
+      { id: "ok", capacity: 100, probe: 1 },
+      { id: "bad", capacity: 900, probe: 2 },
+    ];
+    const members = Shard.ringMembers(caps, 1);
+    assert.deepStrictEqual(members.map(d => d.id), ["head", "ok"]);
+    const plan = Shard.planStages(LLAMA, members);
+    assert.ok(plan.every(s => s.id !== "bad"));
+    assert.strictEqual(plan.reduce((s, x) => s + (x.hi - x.lo), 0), LLAMA.layers);
+  });
+
+  await t("lap estimate grows with context and refuses an idle device", async () => {
+    const spec = Object.assign({}, LLAMA, { inter: 64, headDim: 8 });
+    const slow = Shard.estimateLapMs(spec, 128, 0.01);
+    const fast = Shard.estimateLapMs(spec, 8, 1000);
+    assert.ok(slow > fast, "a longer window on a slower device must cost more");
+    assert.ok(fast > 0);
+  });
+
+  await t("a short prompt stays local only when the head can hold the model", async () => {
+    const tensors = new Map([["w", { elems: 1000 }]]);
+    const spec = { hidden: 8 };
+    assert.strictEqual(Shard.headCanHold(spec, tensors, 0), false);
+    assert.strictEqual(Shard.headCanHold(spec, tensors, 8), true);
+    assert.strictEqual(Shard.preferLocal(16, 2, true), true);
+    assert.strictEqual(Shard.preferLocal(128, 2, true), false);
+    assert.strictEqual(Shard.preferLocal(16, 2, false), false);
+    assert.strictEqual(Shard.preferLocal(16, 0, true), false);
+  });
+
+  await t("prefix blocks match a continuation and the spill evicts the oldest block", async () => {
+    const idx = Shard.makePrefixIndex(4);
+    const a = [1, 2, 3, 4, 5, 6, 7, 8];
+    idx.note("chat", a);
+    assert.strictEqual(idx.matchedBlocks("chat", a.concat([9])), 2);
+    assert.strictEqual(idx.matchedBlocks("chat", [9, 9, 9, 9]), 0);
+    const spill = Shard.makeKvSpill(12);
+    assert.strictEqual(spill.put("a", new Uint8Array(8)), true);
+    assert.strictEqual(spill.put("b", new Uint8Array(8)), true);
+    assert.strictEqual(spill.get("a"), null, "the oldest block must be spilled");
+    assert.ok(spill.get("b"));
+    assert.strictEqual(spill.put("huge", new Uint8Array(13)), false);
+  });
+
+  await t("prefill chunks, prompt-lookup drafts, and accept keep a bonus token", async () => {
+    const c = Shard.prefillChunks(40, 16, 2);
+    assert.strictEqual(c.chunks.length, 3);
+    assert.deepStrictEqual([c.chunks[2].lo, c.chunks[2].hi], [32, 40]);
+    assert.strictEqual(c.window, 2);
+    const ids = [1, 2, 3, 9, 1, 2, 3];
+    assert.deepStrictEqual(Shard.promptLookupDraft(ids, 4), [9]);
+    assert.deepStrictEqual(Shard.acceptDraft([9, 4], [9]), [9, 4]);
+    assert.deepStrictEqual(Shard.acceptDraft([8, 4], [9]), [8]);
+  });
+
+  await t("chunked prefill matches across a stage split", async () => {
+    const got = makeWeights(LLAMA);
+    const prompt = [3, 1, 4, 1, 5, 9, 2, 6, 5, 3, 5, 8];
+    const whole = await Infer.generateChunked(stagesFor(LLAMA, got, [LLAMA.layers], 16), prompt, 3, 4, { temperature: 0 });
+    const split = await Infer.generateChunked(stagesFor(LLAMA, got, [2, 2, 2], 16), prompt, 3, 4, { temperature: 0 });
+    assert.deepStrictEqual(split, whole);
+  });
+
+  await t("a lookahead draft scores in one window and survives a split", async () => {
+    const got = makeWeights(LLAMA);
+    const prompt = [4, 4, 4, 7, 4, 4, 4];
+    const opts = { temperature: 0, maxDraft: 4 };
+    const whole = await Infer.generateLookahead(stagesFor(LLAMA, got, [LLAMA.layers], 16), prompt, 4, 16, opts);
+    const split = await Infer.generateLookahead(stagesFor(LLAMA, got, [1, 2, 3], 16), prompt, 4, 16, opts);
+    assert.deepStrictEqual(split, whole);
+    assert.strictEqual(whole.length, prompt.length + 4);
+  });
+
+  await t("a non-finite activation is refused before any layer runs", async () => {
+    const S = { w: { layers: [] }, spec: LLAMA, T: 2 };
+    const bad = new Float32Array([0, 1, NaN, 2]);
+    await assert.rejects(() => Infer.runLayers(S, bad), (e) => e.name === "NonFiniteError");
+  });
+
   console.log(failed ? `\n${failed} failure(s)\n` : "\nall pipeline checks passed\n");
   process.exit(failed ? 1 : 0);
 })();