code/offload/dspark/probabilistic/pp3/INTEGRATION.md

PP3 probability path (OFF, prototype)

The two explicit switches are DSPARK_SAMPLED_TOP32=1 on the K2 TP2 worker and VLLM_DSPARK_SAMPLED_TOP32=1 on the experimental engine. No launch, unit, image, production staging or default configuration enables them here. Old peers refuse the HELLO mismatch. No use of the older v1/sample draft_probs API occurs.

The negotiated v1 extension has sample_mode2, capability8, STEP/reply flag2. This uniquely selects top32/tau.7/dyadic24-floor-first-v1, standard verification, fixed depth4/5. Existing target/draft/Markov identities are still checked by HELLO. Each request adds a 16-byte pre-row record: signed user seed64, T>0 bit32, zero padding32. Same-round gather metadata carries the seed and T>0 bit from engine state slots to the CPU proxy without an engine host synchronization. Request RNG key is BLAKE2b(session,slot,generation,user seed); round64 and absolute position64 form Philox counters with a distinct proposal domain. Positive target temperature only determines whether to sample; independent drafter tau is .7.

Reply trailer: <4sIII> = PP3Q/semantic1/n/depth; int32 mask[n]; int32 support IDs[n,depth,32]; FP32 q of the same shape; CRC32 of the entire reply body before the CRC. Original header/statuses/tokens/confidence precede it. Full B1depth5 reply including frame is 1416 bytes (1280 sparse payload); B4 is 5412 bytes. The request extension is 16bytes/request before alignment. CRC is corruption detection, not authentication. Existing frame sequence/session, STEP round and per-slot generation echoes remain mandatory. Missing q, wrong masks, corrupt CRC, noncanonical/out-of-range IDs, nonfinite/negative/nondyadic probabilities, wrong mass or absent proposed-token mass fail closed. No receiver normalization. Even unused/greedy IDs are range checked before dense GPU scatter.

ReplyLayout grows only in sampled mode: B4depth5 is 5320 bytes, below the existing 64KiB hostflag page capacity. Thread and process proxies, shared region metadata and watchdog failed buffers use the same negotiated layout. The existing claim/publish/release/consumed ordering and metadata-ring ownership remain in force. Probability buffers use engine slot mapping, not batch order. Sparse q becomes full-target-vocabulary FP32 q on GPU; off-support q is zero. No full-vocabulary softmax or logits is copied to the host. The eager worker prototype does stage full Markov-conditioned vocabulary shards GPU-to-GPU; candidate-only peer exchange and graph capture remain performance gaps.

prepare_verifier.py checks the pinned read-only image sources and writes two experimental overlays to an explicitly new directory. It never deploys. The sampler sees real probabilities (the legacy draft_logits argument is reused only as an ABI carrier with an explicit new semantic marker). Acceptance uses log(p)-log(q) for the standard min(1,p/q) test; rejected draws use the full target residual (p-q)+. q is never divided by target temperature, softmaxed, truncated to the proposal vocabulary or rounded to BF16. Target processors/grammar remain in the image's sampler. Finite precision log/exp arithmetic is qualified statistically on the solo; this does not assert real-arithmetic bit identity.

The runner overlay marks all drafts of a failed request invalid before standard verification. The image then uses its existing -1 placeholder path to sample the unchanged full target directly. This avoids failure-dependent point-mass substitution and keeps failed/missing q from sampled IDs. Both ranks receive the same status/q under the existing broadcast. Greedy rows use the original worker selector and image greedy branch. Reset/new-generation updates all q/valid entries for the current batch's state slots; absent slots are never consumed without a subsequent proposal update.

The sampled startup guard requires both overlay ABI markers, capacity policy, no margins, <=4 slots, standard rejection and a fixed depth. It refuses block or synthetic verification, watermarking, adaptive verification, depth-file reload, prompt lookup and dynamic schedules. A generic direct call to RemoteRound is a test surface; production admission must enter through the guarded speculator.

GPU receipt contains100K toy requests, including sparse/disjoint target tails and failed-proposal placeholders;100K paired T0 checks compare every emitted token and sampled length. Uninitialized padding past num_sampled in the image's output tensor is outside that contract. Real async CPU process/thread tests cover the expanded handoff. These checks are not end-to-end production K2, native pair, grammar-object lifecycle or GB10 qualification. No live A/B is recommended until those gates and exposed costs are resolved. The required CPython3.13 interpreter lacks production EXL3/facc; this lane did not substitute a CPython3.12 worker or install/rebuild dependencies.

Coordinator reproduction: copy the experiment package and pinned pure sampler sources into designated scratch; run tools/pp3_locked.sh --qualify with source, overlay and output arguments, in detached named PP3 tmux on x86host's permitted solo under its own flock. Use the required miniconda Python3 interpreter. See prepare_verifier.py for offline overlay preparation. The prepared files need separate coordinator review, source attestation and read-only experimental mounts; ordinary stage_overlay.sh deliberately does not deploy them. Both production switches remain OFF and rollback needs no action.