[ashhart]

Part of #2370: DeepSeek-V4.1's TF_DSV41_* settings on CUDA stop reading a bad value as something else.

Refused by name, before loading. A setting that used to fall back to a default, or flip to the other state of a switch, on bad text now stops the server with the variable, the raw value and the accepted forms. The check runs at the start of Model.open, before the experimental-family gate, any allocation, device setup or checkpoint access, and at the start of the AOT planner (families/deepseek_v41/env_validate.zig, cuda_model.zig, aot_needs.zig). It covers 48 switches, 14 integer settings, 16 real-valued settings and 3 structured ones. The readers themselves use the same parser (platform/strict_env.zig), so a later direct read refuses rather than coercing too.

Valid values read as before:

• 0 and 1 everywhere. The forms some readers already took (true/false, on/off, yes/no, an empty string for off) are kept where they were.
• Default-on settings stay on.
• BIAS_VL keeps its presence meaning (0 and 1 both select the bias; unset or blank is off).
• TENSORFOLD_TOOL_GRAMMAR still takes precedence over its DeepSeek alias.

Two settings change, both from silently wrong to named (see the revision below for the rest):

• TF_DSV41_FLOOR_HARD_GIB had two readers that disagreed: one made a bad value 4 GiB, the other refused it. It now has one reader in the KV budget, shared by boot admission, graph room, the scheduler and the 4K workspace. Unset is still 4 GiB.
• TF_DSV41_ENGRAM_READERS above 32 is refused instead of clamped.

Registry. Twenty deepseek_v41/CUDA rows in core/profile.zig, one per independently settable variable, so explicit settings show on the startup line and in the disk-cache key. No default changes. The Engram path shows as <set>, never its value. docs/profiles.md lists the rows.

Checks

• Host steps on this head: the DeepSeek environment, shared, bounds, CUDA, serve-line, token-map, assets and device-plan steps, plus the profile registry and its startup line, all pass (48 of 48 steps, 754 tests, 3 skipped).
• The Linux CUDA tests compile (compile-cuda-tests -Dtarget=x86_64-linux-gnu). No touched file is over 600 lines, and lean has no new findings.
• Five planted faults fail their tests: a boolean fallback, a numeric fallback, removing the early loader check, misclassifying a registry row, and printing the Engram path.

We hold no DeepSeek checkpoint, so nothing here ran on a device. The change is in setting parsing and reporting only, with no kernel, arithmetic or default touched.

Revision (0abc692e73), after an independent read:

• A build fix. native/disk_identity.zig now handles the registry's new explicit syntax, which the native CUDA and Metal builds reach. Its key changes only for deepseek_v41. The Linux native build, the Mac native build and the Metal disk-identity check all pass now. The first head's checks hadn't built them.
• Valid forms kept. The nonzero switches take true/on/yes and false/off/no as well as 0 and 1, and other text is refused. TF_DSV41_ROWS_CAP takes every bucket its reader takes (1-8, 12, 16, 24, 32, 48, 64). The served knobs again treat an empty value as unset.
• The visible changes, now in the CHANGELOG line:
  • A blank default-on switch (GRAPHS, OWN_PREFILL, DRAFTS and the others listed in docs/profiles.md) used to read as on, and is now refused by name.
  • A malformed TF_DSV41_TOOL_GRAMMAR, the old alias of TENSORFOLD_TOOL_GRAMMAR, is refused at server start on every family. A set TENSORFOLD_TOOL_GRAMMAR still masks it.
• Checks on this head: Metal disk identity, the DeepSeek and profile host steps (57 of 57 steps, 768 tests, 3 skipped); zig build native -Dcpu=apple_m1 (66 of 66); zig build -Dtarget=x86_64-linux-gnu (31 of 31).

[ashhart]

Held from tonight's landing queue, until after the 1.2.4 cut. This adds a second strict environment parser (platform/strict_env.zig) beside #2405's platform/environment.zig, for the same goal (#2370). It also refuses an empty TF_DSV41_* value where main reads it as unset, which #2405 was changed tonight to avoid. Both should be one parser, with one rule for empty values, before either path grows. The DeepSeek build line this carried (lanes for the server module) lands with #2412 instead.