[noahgift]

Draft — plan and receipt only, no code. Refs #3430 (does not close it). Parent #3421.

The plan for PP-QUANT-001 M1 (one GgmlType + TRAITS[43], homed in aprender-quant) went through four plan-quorum rounds: 0/3, 1/3, 1/3, 1/3. The operator's rule on #3421 is no code before 3/3 and no v5 if an objection survives two rounds; two Q1 objection classes survived three. The grid, every lane reason verbatim, and the repeat analysis are in docs/audits/impl-PMAT-3430-receipt.md and posted on #3421 for a ruling.

What the lanes did not dispute in any round: the target, the home crate (aprender-quant is a leaf under core, compute and serve — derived from cargo metadata), Table E after v1, and X1 ordering.

Found on re-runs, independent of the ruling:

• core GgufTensor::byte_size sizes Q4_1 at 18 bytes/block; upstream is 20.
• Q8_1 is 36 by ggml's C static_assert and 40 in gguf-py at the pinned sha, so the ticket's falsifier cannot be met as worded.

Verdict: PARTIAL(escalate). This PR stays draft and must not merge as is.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3452 head=b5eb08cece6179c84e44356aecfe92974725573a verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

RULING (operator, 2026-09-20) — PMAT-3430 M1

Recorded verbatim. Lane A is unblocked; no fifth quorum round.

1. Settled, no further quorum: target (one #[repr(u32)] GgmlType, 43 rows: 35 live + 8 Removed), home crate aprender-quant, Table E, X1 ordering. Undisputed in rounds 1-4; they are closed.

2. Oracle: upstream ggml at the pinned llama.cpp sha (3173a5647) is the reference [X]. In-tree enums are the defendant, never the reference. Where they disagree, in-tree is a defect.

3. Falsifier, re-worded. Old wording (agreement with the existing core/compute/serve values) is unsatisfiable: core Q4_1 = 18 bytes/block vs upstream 20 (2xf16 + 16); Q8_1 upstream is 36 by static_assert vs 40 in-tree (pre-f16 layout).
   New: for every live row i, TRAITS[i].{blck_size,type_size} equals the value extracted from ggml at the pinned sha by a committed command; the extraction output is a checked-in fixture; mutation of any one row turns the test RED (shown in the PR body).

4. Every in-tree disagreement is a row in the reconciliation table (PMAT-3431), each with: upstream value, in-tree value, call sites, and a verdict of NEVER-WORKED or REGRESSION, measured on the v0.68.1 binary - not inferred.

5. Fix-or-refuse per type: a type whose in-tree size was wrong ships in M1 with the upstream value AND a one-line refusal + exit code on load, until a round-trip fixture for that type is green. No silent behaviour change for Q4_1/Q8_1 consumers.

6. Remaining disputed D-rows: one amendment round, then HRQ. No fifth open round.

One clause needs a correction before it can be executed — clause 2's sha

The ruling makes the pinned llama.cpp sha the oracle, so every number in M1's fixture is extracted from whatever that sha resolves to. It does not resolve here. Measured on the release tree:

sha	status
d1d3c3396	the pin of record — scripts/llama_pin.toml build_commit, pinned_on = 2026-09-15, pin_expiry = 2026-12-01, 216 references in-tree
39173bcac	an older comparator pin, still referenced 124 times (e.g. the CPU-leg parity basis in evidence/parity/thresholds.yaml)
3173a5647 (the ruling's)	appears nowhere in the tree — grep -rl over the repo returns nothing

I am not substituting a sha into the ruling by inference: the whole point of clause 2 is that the oracle is named, and an oracle resolved by guessing is not an oracle. The implementer needs one line back: is the oracle d1d3c3396 (the pin of record), or a deliberate new pin? If it is a new pin, note that bumping the comparator invalidates every ratio measured against the old one — llama_pin.toml says so itself, and that is a decision with a named cost rather than a bump.

Second-order finding, independent of the answer: two comparator pins are live in-tree at once — 216 references to d1d3c3396 and 124 to 39173bcac. Some committed artifacts are therefore measured against a superseded oracle. That deserves its own row regardless of how clause 2 resolves.

What proceeds now, unblocked

• Clauses 1, 3, 4, 5, 6 need nothing further. Clause 1 closes the design questions; clause 3 replaces the unsatisfiable falsifier with an extraction-plus-mutation test, which is the shape that can actually turn RED; clause 5's fix-or-refuse matches the doctrine adopted for batched decode in the 0.69 epic — ship the correct value with an explicit refusal rather than a silent behaviour change.
• PP-QUANT-001 M1: one #[repr(u32)] GgmlType (43 rows: 35 live + 8 Removed) + TRAITS[43] below core/compute/serve — ggml enums 3 → 1 #3430's original falsifier is superseded by clause 3 and must not be implemented as written.
• PP-QUANT-001 M2: reconciliation gate — GgmlType vs the vendored ggml.h id list at a pinned sha; exhaustive matches, no _ => #3431 is now scoped by clause 4: every disagreement is a row with upstream value, in-tree value, call sites, and a NEVER-WORKED / REGRESSION verdict measured on the v0.68.1 binary, not inferred.
• Chain: PMAT-3430: M1 plan + quorum history (0/3, 1/3, 1/3, 1/3) — draft, no code, awaiting a ruling #3452 (ruled) → spec(PP-QUANT-001): quant-type dispatch consolidation — design, contract, Phase 0 gate #3420 → PP-QUANT-001 M1: one #[repr(u32)] GgmlType (43 rows: 35 live + 8 Removed) + TRAITS[43] below core/compute/serve — ggml enums 3 → 1 #3430 → PMAT-3427: PP-QUANT-001 slice M is 0.69.0 must-carry — measured tables, fix-diff Pareto, the queue #3447 → docs(release): APR-RELEASE-001 has no must-carry section on main — land §1.5 (must-carry rows; T-0 waits; > 72 h andon) #3446, epic EPIC: PP-QUANT-001 — quant-type dispatch, Phase 0/1 (0.69 train) #3421. This is Band 0 of EPIC: release train 0.69.0 — COMPLETE Qwen usability on pure CUDA (all 0.68.x folded in) #3080 and it gates T-0.

Refs #3080, #3430, #3431, #3421, #3562

[noahgift]

AMENDMENT (operator, 2026-09-20) — clause 2 of the M1 ruling, recorded verbatim

2'. The oracle is scripts/llama_pin.toml build_commit, by reference, never a literal sha. Today that resolves to d1d3c3396. No pin bump is ordered by this ruling. "3173a5647" in the original clause is struck: it was the checkout the 43/35/8 count was first measured at, not a pin.

2a. The TRAITS fixture records the sha it was extracted from. A test asserts fixture.sha == llama_pin.toml build_commit. A pin bump therefore turns the fixture RED until it is regenerated by the committed extraction command — the bump's cost is visible in the bump PR, not discovered later.

2b. Row counts are derived, not ruled. Re-extract at d1d3c3396; if live/Removed differs from 35/8, the extraction wins and the PMAT-3430 title is corrected. "43" is [U] until then.

2b is now measured — the ticket's numbers hold. [U] cleared.

Extracted from the pinned checkout at /home/noah/src/llama.cpp-d1d3c3396 (git rev-parse HEAD → d1d3c3396aa1…, matching llama_pin.toml build_commit), from ggml/include/ggml.h:

	count	ids
live	35	0–3, 6–30, 34, 35, 39–42
Removed (commented out)	8	4 Q4_2, 5 Q4_3, 31 Q4_0_4_4, 32 Q4_0_4_8, 33 Q4_0_8_8, 36 IQ4_NL_4_4, 37 IQ4_NL_4_8, 38 IQ4_NL_8_8
total slots	43	GGML_TYPE_COUNT = 43, ids 0…42, and 35 + 8 = 43 ✓

So 43 rows: 35 live + 8 Removed is confirmed at the pin. No title correction is needed and the count can stop being [U].

Method note, because it nearly went the other way. A first pass with a one-line grep returned 44/41/3 and looked like a disagreement. It was wrong twice: it counted GGML_TYPE_COUNT as a type, and it classified a commented row as live whenever the comment did not contain the word "removed" (// GGML_TYPE_Q4_0_4_8 = 32, says nothing). Reading the enum settled it. Worth stating because clause 3's fixture will be generated by a command, and a sloppy extractor produces a fixture that is confidently wrong on exactly these rows — the commented block at 31–33 and 36–38 is the trap.

Four live types are recent — MXFP4 (39), NVFP4 (40), Q1_0 (41), Q2_0 (42). Whether in-tree carries them at all is part of clause 4's reconciliation, and a NEVER-WORKED verdict is the likely shape there rather than REGRESSION.

What clause 3's committed extraction command must do

1. Parse enum ggml_type from ggml/include/ggml.h at the resolved pin, taking commented rows as Removed by position, not by comment wording.
2. Take blck_size / type_size from ggml's own type-traits table, not from the header comment, and not from any in-tree value.
3. Emit the fixture with the sha it read, so 2a's assertion has something to compare.
4. Prove it can fail: mutate one row, expect RED (in the PR body, per clause 3).

2a generalises, and there is already a ticket for the general case

2a — an artifact derived from the pin records the pin, and a test asserts they match, so a bump's cost surfaces in the bump PR — is exactly the mechanism #3563 asks for repo-wide, where two comparator pins are live at once (216 references to d1d3c3396, 124 to the earlier 39173bcac). The TRAITS fixture should be the first artifact built to this shape, and #3563's guard should be written as the general form of it rather than as a separate idea.

Refs #3080, #3430, #3431, #3452, #3563

[noahgift]

done_when

(Fixed heading, written by the cop for tab 2. pmat work add derives no acceptance_criteria and pmat work edit cannot set them on a planned ticket — paiml-mcp-agent-toolkit#1414. The ticket authorizes; this heading is the definition of done. Tabs write their own done_when only for rows they mint.)

This is Band 0. It and the tag-path move (#3459/#3461) are the two gates on 0.69's T-0 — 06x-release-schedule.md §1.1a makes slice M the must-carry row and APR-RELEASE-001 §0 row 1a puts it above everything.

The plan quorum ran 0/3, 1/3, 1/3, 1/3 and was closed by operator ruling 2026-09-20, amended the same day (recorded in this issue's comments). No fifth round: remaining disputed D-rows get one amendment round, then HRQ (#3562).

• Settled, not re-opened: one #[repr(u32)] GgmlType (43 rows), home crate aprender-quant, Table E, X1 ordering. These were undisputed in all four rounds and are closed.
• Oracle by reference, never a literal sha: the oracle is scripts/llama_pin.toml build_commit, resolved at run time. Do not write any sha into the falsifier, the fixture assertion, the contract or this checklist — the ruling's original literal is struck, and a struck literal is still a literal that a grep, a copy-paste or a future reader will find. Resolve it; never quote it.
• Falsifier (re-worded — the original was unsatisfiable): for every live row i, TRAITS[i].{blck_size,type_size} equals the value extracted from ggml at the resolved pin by a committed command; the extraction output is a checked-in fixture recording the sha it read; a test asserts fixture.sha == build_commit; mutation of any one row turns the test RED, shown in the PR body.
• Row counts are derived, and already are: re-extracted at the resolved pin on 2026-09-20 → 35 live (ids 0–3, 6–30, 34, 35, 39–42), 8 Removed (4, 5, 31–33, 36–38), GGML_TYPE_COUNT = 43. The title's numbers hold; [U] is cleared. No title correction needed.
• Extractor trap, measured: classify Removed by position, not by comment wording — // GGML_TYPE_Q4_0_4_8 = 32, contains no "removed", and a crude grep returns 44/41/3. Take sizes from ggml's own type-traits table, never from a header comment and never from an in-tree value.
• Fix-or-refuse per type (clause 5): a type whose in-tree size was wrong ships with the upstream value plus a one-line refusal + exit code on load, until a round-trip fixture for that type is green. No silent behaviour change for Q4_1 / Q8_1 consumers. Each refusal carries removed_by and never blocks a cut.
• Known disagreements to carry into PP-QUANT-001 M2: reconciliation gate — GgmlType vs the vendored ggml.h id list at a pinned sha; exhaustive matches, no _ => #3431: core Q4_1 18 bytes/block vs upstream 20; Q8_1 36 upstream by static_assert vs 40 in-tree. Four live types are recent — MXFP4 (39), NVFP4 (40), Q1_0 (41), Q2_0 (42) — and NEVER-WORKED is the likely verdict there rather than REGRESSION.
• Chain order: PMAT-3430: M1 plan + quorum history (0/3, 1/3, 1/3, 1/3) — draft, no code, awaiting a ruling #3452 → spec(PP-QUANT-001): quant-type dispatch consolidation — design, contract, Phase 0 gate #3420 → PP-QUANT-001 M1: one #[repr(u32)] GgmlType (43 rows: 35 live + 8 Removed) + TRAITS[43] below core/compute/serve — ggml enums 3 → 1 #3430 → PMAT-3427: PP-QUANT-001 slice M is 0.69.0 must-carry — measured tables, fix-diff Pareto, the queue #3447 → docs(release): APR-RELEASE-001 has no must-carry section on main — land §1.5 (must-carry rows; T-0 waits; > 72 h andon) #3446, epic EPIC: PP-QUANT-001 — quant-type dispatch, Phase 0/1 (0.69 train) #3421. §1.1a lands in the tag-path chain, not here.

STOP: any threshold or size typed into a test instead of extracted from the pin · a second quorum round on the settled items · touching contracts/census.json or contracts/lint-baseline.json without the touches-shared-contracts label (group of one, behind this row).

Measure in a fresh worktree off origin/main, never the driver checkout — four wrong claims came from that mistake today.

[noahgift]

Two of the ruling's own premises are wrong — measured by the correctness lane, and they change clause 5

Recorded here because the ruling lives in this issue and an implementer will read it before #3430's comments.

1. There is no Q8_1 = 40 anywhere in the tree. The ruling states "Q8_1 is 36 by ggml's static_assert and 40 in gguf-py at the pinned sha" and clause 4 asks for a reconciliation row with call sites. The 40 is gguf-py's, reached through a document — not in-tree code. So there is no in-tree disagreement to reconcile for Q8_1.

2. Clause 5 has no Q4_1 case either. GgufTensor::byte_size does size Q4_1 at 18 bytes/block against upstream's 20 — but it has no non-test caller. Clause 5 says a type whose in-tree size was wrong ships with the upstream value plus a one-line refusal on load; there is no load path for that refusal to sit on.

Consequence: clause 5 ships with no refusal — stated, not skipped. That distinction is the whole point: a refusal nobody can reach is a refusal that reads as coverage while providing none, which is the defect class this train is clearing. The reconciliation row for Q4_1 is therefore NEVER-WORKED with no live consumer, not a fix-or-refuse row.

Full measurement in #3430 comment 5749705532.

And the ruling's real casualty turned up while deriving the table

aprender-core::ggml_dtype_element_size is ordered by its own comment rather than by ggml id and is wrong in 10 of 31 rows — BF16 reads 0.375 B/elem instead of 2.0, which makes the #2569 truncation check fail-open on BF16 GGUFs. Filed #3583, P0, verified here by reading the table on origin/main.

That is the argument for slice M with a user-visible casualty attached: a hand-maintained mirror of an upstream table, partially repaired once by PMAT-869 in June, wrong ever since in the rows nobody re-checked. #3583 lands immediately after #3581 as its first consumer — a lookup into TRAITS, never an eleventh hand-typed row.

[noahgift]

Closed: superseded by #3581. Operator ruling 2026-09-20 ~14:00Z.

This is a draft plan PR (272 lines, two files, no code) for PP-QUANT-001 M1. The ruling it says it awaits was recorded this morning on #3452 / #3430 / #3431 — it is not waiting on anything, and #3581 is executing the plan it holds. A draft plan PR is not a T-0 gate; the code PR is.

Nothing is lost by closing: the quorum history (0/3, 1/3, 1/3, 1/3), every lane reason verbatim, and the repeat analysis live in docs/audits/impl-PMAT-3430-receipt.md and on #3421, and the ruling is preserved in the issue body of #3430. The branch is kept.

Carried forward so it does not die with this PR — one finding here was independent of the ruling and is not in #3581's scope as filed: core GgufTensor::byte_size sizes Q4_1 at 18 bytes/block; upstream is 20. That belongs to the same table family as #3583's BF16 size row (ggml id 30 sized 0.375 instead of 2.0) — two wrong rows in id-indexed size tables, found separately, which is the partial-repair class. If #3581 does not already fold the Q4_1 row in, it needs its own row against the TRAITS table.

T-0 blocker count on 0.69 drops by one.

[noahgift]

The ruling landed. This PR's header is stale, and nothing is blocked on it.

Answering the question directly, because two readers have now re-derived it: the operator ruled on #3430 on 2026-09-20, with an amendment the same day (the ruling sits above my execution report). So the "no code before 3/3" rule on #3421 is discharged for M1 — not waived, and not routed around by narrowing scope. Clause 1 closed the design questions outright: "Settled, no further quorum: target (one #[repr(u32)] GgmlType, 43 rows: 35 live + 8 Removed), home crate aprender-quant, Table E, X1 ordering. Undisputed in rounds 1-4; they are closed." Clause 6 disposed of the remainder: "one amendment round, then HRQ. No fifth open round."

The two Q1 objection classes that survived three rounds did not survive the ruling either. Both were about the falsifier, and clause 3 replaced it: the old wording (agreement with the existing core/compute/serve values) is unsatisfiable, so it was struck in favour of extraction-plus-mutation against upstream ggml at the pinned commit. A quorum cannot converge on a falsifier that cannot be met; that is what the four rounds were actually measuring.

M1 is implemented in #3581, running full CI now. It is not a narrower scope: it is clauses 1-6 as written, with the amended 2'/2a/2b. The leaf, TRAITS[43], the committed extraction command, the fixture recording its sha, the pin-agreement invariant, and six mutations RED with every control GREEN.

This PR's own content is still worth keeping

Plan v4 and the four-round grill record are the provenance for #3581 and are cited by its receipt. Three things in them were correct and load-bearing: the home-crate derivation from cargo metadata (aprender-quant is the leaf under core, compute and serve), the boundary inventory behind Q1-c, and round 3's ruling that the Q4_1 fix must not ride the refactor — which #3581 honours by changing no consumer at all.

Two things in it are now superseded and should not be implemented as written:

1. The Q8_1 exception list is void. Q1-d proposed "TRAITS equals gguf-py GGML_QUANT_SIZES except a named list, today exactly [Q8_1]". gguf-py is no longer consulted at all, so there is no list to maintain and no list to rot. Upstream's C table says 36 and that is simply the value.
2. The premise that in-tree carries 40 for Q8_1 is false. Measured across the tree: aprender-compute's block_bytes, aprender-core's shape.rs:230 and the GPU dp4a kernels all say 36. The 40 came from Table S of the PMAT-3427 receipt, which read gguf-py — a document, not code. Clause 5 therefore has no Q8_1 case, and (measured separately) no Q4_1 case either, since GgufTensor::byte_size has no non-test caller.

Disposition

Nothing depends on this PR. #3581 does not need it merged, and the milestone gate counts it as an open item. Recommend close it, or take it out of draft as a docs-only provenance merge — tab 1's call, either way. If it closes, the plan and grill record survive in #3581's receipt (docs/audits/impl-PMAT-3430-m1-leaf-receipt.md §6 lists every deviation from plan v4 with its reason), so nothing is lost.

What should not happen is a fifth quorum round on this plan. Clause 6 forecloses it, and the objections it would re-litigate are objections to a falsifier that no longer exists.

Refs #3430, #3421, #3581