[noahgift]

This is the half of #3430 that makes its title true. #3581 landed the leaf and the upstream-extracted TRAITS[43]; this collapses the three enums into it.

Rebased onto main after #3581 merged (840c9c789). The diff is now exactly the three commits that belong here: Phase 1, Phases 3-4, and the receipt. 18 files, net +518.

The falsifier, met

#3430's acceptance criterion is "exactly 1 ggml tensor-type enum definition under crates/*/src":

$ grep -rnE '^\s*pub enum (GgmlType|GgmlQuantType)\b' crates/*/src --include='*.rs'
crates/aprender-quant/src/ggml_type.rs:140:pub enum GgmlType {

Four declarations of one fact are gone: serve's GgmlQuantType (16 ids), core's GgmlType (12), compute's GgmlType (15), and QTYPE_LABELS — the private 13-row table #3405 added while three enums of it already existed.

Behaviour preservation is measured, not asserted

Phase 1 wrote 12 characterization tests against unchanged code, and all 12 pass unchanged through Phases 3-4. That is the whole argument that this is safe, and the only part of it a reviewer can check without re-deriving the boundaries by hand.

crate	boundaries	sweep
serve	7 — gguf/dtype ×2, infer, apr/mod's from_binary dtype arm, apr/special_tokens, apr/dequant, the loader test mirroring the predicate	ids 0..=255, every admitted name, its lower-case form, 8 names that must stay unrecognised
compute	1	ids 0..=255, all 15 rows of block geometry, partial-block rounding
core	0 — measured: nothing in core turns an integer or a string into a GgmlType	24 (dtype, elements) points through byte_size

The id sweep is 0..=255 and not "the interesting ids" because the property is about what is refused as much as what is accepted, and a sweep over the admitted set cannot see a widening.

Exactly two edits to those tests, both named in advance: compute's GgmlType::from_u32(x) → from_u32(x) (an inherent method cannot follow a foreign type; the admitted set is untouched), and core's Q4_1 row below.

Each crate keeps its own admitted set

The leaf knows all 35 live ggml types. No crate may start accepting an id it used to refuse — that is how a loader begins decoding bytes it has no kernel for. compute → ADMITTED[15]; serve → ADMITTED[16] with admitted_from_id/admitted_from_name at all seven boundaries; core → none, and none is needed.

The one value that changes

core sized Q4_1 at 18 bytes/block; ggml says 20, and core's own format/gguf/shape.rs already said 20 — two tables in one crate disagreeing. It was never reachable: export_tensors_to_gguf uses data.len(), and byte_size() has no non-test caller. A unit test had asserted the 18 since it was written — a test pinning a defect.

Phase 1 anticipated it, asserted the disagreement directly so it could not be fixed by accident, and instructed its own deletion once fixed. Both happened in one commit: two expectations moved (36→40, 54→60), the companion test went, and the other 22 assertions passed untouched — evidence that delegation changed one value, not twelve.

What the collapse was worth, counted honestly

Four tables → one; one wrong value removed and one omission (QTYPE_LABELS had no Q8_1 row, so a refusal printed qtype 9). That is smaller than the collapse deserves credit for, and the reason matters: the big find is not in this diff. Measuring in-tree tables against the extracted one is what exposed ggml_dtype_element_size, a fifth id-indexed table, wrong in 10 of 31 rows including BF16 at 0.375 B/elem instead of 2.0 — which makes the #2569 truncation check fail-open on BF16 GGUFs. That is #3583, deliberately not folded in.

The guard

scripts/check_one_ggml_type_enum.sh — green here, 15-row case table (a re-export, a commented-out definition, GgmlTypeError, GgufValue, QuantType and a private enum all correctly not matched), and a zero-match arm that fails rather than passing vacuously. Mutation: re-adding a second definition to compute turns it RED naming both files; restoring turns it GREEN. guard_tree discovers it via git ls-files 'scripts/check_*.sh', so committing it is what wires it. Its root comes from $0, not git rev-parse — the container refuses the bind-mounted tree (#3586).

Verification

cargo nextest run --profile ci -p aprender-serve -p aprender-core -p aprender-quant --lib
                                              30,168 passed, 61 skipped
cargo test -p aprender-compute --lib           3,514 passed
cargo check --workspace --all-targets          clean
cargo clippy -p {quant,compute,core,serve} --lib -- -D warnings  clean
cargo fmt --all -- --check                     clean
check_one_ggml_type_enum.sh / --self-test      1 definition / 15 cases, 0 failures

Net -35 lines while adding a 111-line guard.

The stop condition did not fire

I said before starting that if a boundary's behaviour could not be preserved I would stop and surface it rather than widen an admitted set to make a test pass — and that under automatic publishing, widening would be a fabricated green feeding a release. It did not come up: all 12 snapshots passed unchanged, and both edits to them were named before the work began. The admitted sets were reproduced from measured behaviour, not chosen.

Receipt: docs/audits/impl-PMAT-3430-phases-3-4-receipt.md.

keep-open: #3421 is the epic, #3431 is M2 (not started), #3583 is the fifth table this work exposed and is deliberately separate; #3430 itself is closed by this PR.

Closes #3430

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3621 head=6931c01135821512312811ae9dcbe7b859629fec verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3430",
 "head": "5420b7e982a47ab1073870efb04aedce7e22ea86",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 5
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 4
  }
 ]
}