diff --git a/decode_dse/README.md b/decode_dse/README.md
new file mode 100644
index 0000000..efbfa41
--- /dev/null
+++ b/decode_dse/README.md
@@ -0,0 +1,326 @@
+# PackedKV decode-chip study
+
+This package evaluates a dedicated PLENA decode chip for disaggregated
+Qwen3-32B and Llama-3.1-8B serving. It keeps numerical accuracy, compiler
+support, emulator support, RTL validation, timing calibration, and power
+calibration as separate claims. The two pinned model configurations use the
+same precision search and publication contracts; Llama-3.1-8B is the first
+execution target, followed by Qwen3-32B.
+
+The organising principle is that **no result inherits evidence from another**.
+A precision profile that is accurate says nothing about whether the compiler can
+emit it; a compiler that emits it says nothing about whether the RTL executes
+it; and an emulator cycle count is not an RTL cycle count. Every number carries
+the tier it was measured at, and a comparison between two tiers is refused
+rather than silently made.
+
+## Contents
+
+- [Execution contract](#execution-contract) — how prefill, admission and decode divide
+- [Canonical search](#canonical-search) — the 3,585-profile grid and what admits to hardware pricing
+- [Workflow](#workflow) — the four protocols, launch checks, and module map
+- [Validity scope](#validity-scope) — what evidence does and does not carry over
+- [Publication outcomes](#publication-outcomes) — how results may be framed
+- [Pipeline stages](#pipeline-stages) — what `sweep pipeline` runs, in order
+
+To run the study on an execution host, follow `docs/server_setup.md`; this
+document describes the design, not the bring-up.
+
+## Execution contract
+
+- Prefill runs in BF16 on a separate chip and produces the first token.
+- The BF16 prompt cache crosses the chip boundary unchanged.
+- Decode admission quantizes K/V once into the selected PackedKV format.
+- New `q_len=1` K/V entries are quantized directly into that format.
+- Admission time and energy belong to TTFT; cached decode contributes TPOT.
+- Embeddings remain BF16. The headline path executes the BF16 LM head as a
+  calibrated reserved endpoint on the same prefill chip after each decode-chip
+  final RMSNorm; no third device is introduced.
+
+The evaluator uses an immutable BF16 prefill artifact and a content-addressed
+admission catalog. One KV format is deterministically recomputed and verified
+at a time, then released before the next format, so the approximately 149 GiB
+Qwen logical admission write volume is not retained simultaneously. Screening
+and refinement report `post_handoff_greedy_conditioned_nll`: the
+prefill-greedy handoff token is unscored, and later dataset tokens use cached
+`q_len=1` teacher forcing with exact cache positions and one-entry growth. It
+is not standard WikiText-2 perplexity. Cache-free perplexity is not part of
+this path.
+
+## Canonical search
+
+The main block size is 8, the native RTL MX block. W, A, and shared K/V each
+use:
+
+```text
+MXINT2 MXINT4 MXINT8 E1M2 E2M1 E3M4 E4M3 E5M2
+```
+
+Every W/A/KV point is evaluated with:
+
+```text
+FP_E3M2 FP_E2M3 FP_E6M5 FP_E5M6 FP_E4M7 FP_E8M5
+```
+
+The deterministic manifest contains:
+
+- 3,072 quantized profiles;
+- 512 vector-BF16 controls; and
+- one split-execution BF16 software reference.
+
+The 3,585 IDs are enumerated exactly. Optuna is not used for this numerical
+grid. Blocks 16 and 32 are reserved for a selected-profile numerical
+sensitivity study and are not deployment candidates for the native block-8
+datapath. Split K/V precision is confined to promoted-profile refinement.
+
+Accuracy is evaluated once for every precision profile and model, while the
+hardware search evaluates the complete precision-by-hardware cross-product.
+Final selection is joint under the accuracy, area, and HBM constraints; there
+is no staged partial-objective decomposition of the canonical search.
+
+Static datapath legality admits 574 rows to hardware pricing: 492 quantized
+profiles and 82 vector-BF16 controls. The complete structural spaces contain
+1,413,216 Qwen and 1,848,096 Llama candidates, giving 811,185,984 and
+1,060,807,104 raw profile-candidate pairs. Exact compiler geometry admits
+79,488 Qwen and 272,160 Llama candidates. The factorized artifact stores
+476,928 and 1,632,960 physical-cost evaluation rows, respectively, plus the
+ordered memberships required to reconstruct every eligible conceptual join;
+it never materializes the raw cross-product. The scheduler compresses this
+work only by exact physical-cost equivalence, prices each equivalence class
+once, and joins the result back to every accuracy row. Its
+provenance records the raw, hard-accuracy-gated, hard-resource-gated,
+simulator-priced, and joined counts. It performs no performance, bandwidth
+demand, memory-bound, or objective-based pruning.
+
+## Workflow
+
+Four protocols govern the study, each held separately from the code:
+
+- the **exhaustive sweep** protocol defines immutable inputs, the measured pilot,
+  state-isolation checks, runtime rebinding, homogeneous-device sharding, and
+  launch gates;
+- the **stack validation** protocol defines compiler, emulator, RTL, and DC
+  evidence;
+- the **precision refinement** protocol defines GPTQ/Erry, selective rotation,
+  split K/V variants, and doomed-profile handling; and
+- the **final benchmarks** protocol defines the four-configuration WikiText-2,
+  IFEval, and GSM8K study, with the complete 4K/8K/16K/32K RULER set enabled
+  only when long-context budget is available.
+
+The full sweep must not start until its measured preflight report passes.
+Structural capability alone cannot become a deployment claim.
+
+Both model configurations require explicit single-device placement, BF16,
+`sm_100`, minimum package versions, and declarative resource requirements.
+Planning includes the full immutable manifest, run plan, provenance, logical
+write volume, concurrency-bounded peak footprint, device requirement, and the
+42-hour ceiling. Preflight reports only the machine on which it actually runs;
+it does not substitute or project a remote host. It also does not invent a
+wall-clock projection before the first completed measured profile; the runner
+records that first duration and updates the ETA continuously.
+
+The deterministic, write-free launch checks are:
+
+```bash
+python -m decode_dse.software.sweep stage plan \
+  --config decode_dse/configs/llama3_1_8b.json \
+  --output-dir /data/plena/llama3_1_8b \
+  --device-label b200 --dry-run
+
+python -m decode_dse.software.sweep stage plan \
+  --config decode_dse/configs/qwen3_32b.json \
+  --output-dir /data/plena/qwen3_32b \
+  --device-label b200 --dry-run
+```
+
+Remove `--dry-run` only on a host that passes every reported package, model,
+tokenizer, simulator, GPU, BF16, host-memory, and workspace-capacity gate.
+Persisted (non-dry-run) planning additionally requires `--prompt-manifest`,
+produced by `sweep inputs samples`. The complete execution-host bring-up —
+repository layout, model/dataset staging, evidence-artifact production
+(`decode_timing_evidence.json`, the stack-validity stage reports, and the
+measured BF16 head service), and the full per-model launch order — is
+documented in `decode_dse/docs/server_setup.md`.
+
+The hardware evaluator optionally accepts `--handoff-artifact` for the E1
+prefill-to-decode schedule analysis. That JSON must bind the pinned model and
+reference workload; provide BF16 prefill latency and energy evidence for every
+searched batch; and state admission, readiness, idle/stall power, direct-link,
+and host-link inputs explicitly. A requested missing or mismatched artifact
+fails before the study starts. Omitting it leaves steady-state decode ranking
+unchanged; supplying it adds fully-pipelined, back-pressure, and host-buffered
+TTFT, utilization, energy, and balanced prefill:decode chip-ratio results to
+each hardware row without changing decode feasibility or Pareto ranking.
+
+The principal modules are:
+
+```text
+profiles.py                          canonical precision profiles and the grid
+legality.py                          profile legality and PackedKV capability
+manifest.py                          exact manifest and restart journal
+simulator_bridge.py                  analytic decode performance model
+plots.py                             publication figures
+
+software/precision_bindings.py       MASE phase-split quantization bindings
+software/decode_evaluator.py         cached one-token decode evaluator
+software/cached_decode.py            teacher-forced cached decode primitives
+software/token_samples.py            sweep and refinement token sample bundles
+software/cache_artifacts.py          BF16 prefill and admitted-cache artifacts
+software/sweep_plan.py               run plan, manifests, shared executor context
+software/sweep_runner.py             restartable per-profile sweep execution
+software/sweep.py                    inputs / stage / shards / pipeline commands
+software/preflight.py                check / evidence commands
+software/refinement_schedule.py      refinement schedule and shard plans
+software/refinement_runner.py        prepare / run / launch / merge commands
+software/refinement_evaluator.py     sealed GPTQ, clipping, and rotation banks
+software/benchmark_runner.py         manifest / configuration / benchmark commands
+software/benchmark_evaluator.py      benchmark suites over split-cached decode
+software/gpu_baseline.py             measured BF16 GPU cached one-token baseline
+software/block_size_sensitivity.py   block 16/32 sensitivity for selected points
+software/runtime_environment.py      deterministic runtime policy and identity
+
+hardware/design_space.py             exact enumeration and factorized artifacts
+hardware/evaluation.py               simulator and power evaluation
+hardware/power_model.py              calibrated area and energy ingestion
+hardware/selection.py                Pareto promotion and final selection
+hardware/packedkv_claims.py          capacity-first PackedKV claim gate
+hardware/synthesis_anchor.py         selected-candidate DC/SAIF evidence
+hardware/admission_cost.py           decode-cache admission cost and evidence
+hardware/workload_events.py          decode event counts for dense decoders
+hardware/lm_head_service.py          BF16 output-head service boundary
+hardware/calibration.py              holdout gates for area, power, timing
+hardware/hbm_sensitivity.py          post-selection HBM technology schedule
+hardware/statistics.py               deterministic statistical helpers
+```
+
+## Validity scope
+
+Software accuracy is portable across hardware candidates. Successful compiler,
+emulator, and RTL evidence applies only to the exact measured geometry and
+batch. Fitted power is rankable only inside its measured interpolation
+envelope. Deployment requires a candidate-exact full-chip DC/SAIF anchor whose
+activity is bound to the serving batch. Off-target success becomes unknown
+until matching evidence exists; observed failures remain false.
+
+The PackedKV compiler emits a record for the exact synchronous equal-length
+batch requested by the candidate. Compiler, emulator, RTL, and timing evidence
+never carries over to a different batch, even when its geometry otherwise
+matches.
+
+## Publication outcomes
+
+PackedKV is framed capacity first:
+
+1. physical KV bytes decrease;
+2. the feasible serving batch increases;
+3. capacity-limited throughput increases.
+
+A TPOT claim is optional and requires matching compiler, emulator, RTL, and
+timing-overlap evidence. Reports keep the ideal-pipeline algorithmic limit
+separate from the realized memory, serialization, or compute limit; neither is
+rewritten to force a memory-bound result.
+
+Power and timing are rankable only after their holdout gates pass. BF16 is the
+software accuracy reference; it is not represented as a PLENA BF16 matrix-chip
+realization.
+
+The local BF16 LM head is an explicitly unrankable hardware sensitivity. A
+locally quantized LM head is accuracy-only and cannot supply hardware costs or
+enter deployment selection.
+
+HBM technology does not multiply the 3,585-point numerical manifest. Four
+selected native-datapath hardware profiles receive a separate 20-point
+HBM2/HBM2E/HBM3/HBM3E/HBM4 sensitivity schedule with geometry, batch,
+interface-unit count, and chip count fixed. HBM4 is a conservative 11 Gb/s
+lower-bound representation of Micron's stated greater-than-11 Gb/s 36 GB
+device and is technology-peak sensitivity only. Cross-generation ranking is
+disabled until each generation, pin rate, and interface-unit count has matching
+measured bandwidth calibration.
+
+## Pipeline stages
+
+`sweep pipeline` is the publication launch path for each model study, run after
+that model's plan and preflight evidence pass. It executes in this order:
+
+1. **Measured GPU baseline.** The immutable run plan lists every
+   cached-`q_len=1` BF16 baseline batch; the pipeline measures those batches on
+   its first visible GPU before any sweep work.
+2. **Hardware-validation shards**, evaluated with compiler-trace timing.
+3. **Joint source selection** over the verified partitions.
+4. **Refinement**, following the declared protocol.
+5. **Repricing** of the selected refined profiles.
+6. **Publication figures**, rendered only once the above have completed.
+
+### Restartability
+
+Every command carries an immutable identity and a completion receipt. An
+interrupted command is repeated; completed commands and complete directory trees
+are checksum-verified and skipped. The contract, terminal rows, report and stage
+receipt are all bound to the same sweep provenance.
+
+### The final deployment table
+
+It verifies and records the measured GPU report and stage receipt, the benchmark
+contract and report, the exact refined hardware artifact, and the post-accuracy
+selection. Evidence tiers appear side by side, and:
+
+- the throughput ratio stays **empty** until a same-tier measured PLENA result
+  exists;
+- headline ratios accept measured evidence on both sides only;
+- A100 and H100 peak-roofline values remain a separate labelled table and never
+  acquire a ratio.
+
+### Measured baseline energy
+
+Each successful baseline row also attempts board energy, measured over only the
+synchronized post-warmup decode region. The NVML cumulative-energy counter is
+preferred; a timestamped NVML board-power trace with trapezoidal integration is
+the fallback. The report retains the raw counters or trace samples, the physical
+GPU UUIDs, the sampling interval, tokens per joule, and EDP.
+
+If neither meter is supported, throughput remains valid and energy is reported
+as explicitly unavailable. No analytic value may stand in for it in a measured
+energy comparison.
+
+### The `external/` evidence boundary
+
+`publication_pipeline` declares every post-accuracy input, output and resource
+choice. Three inputs live under the workspace `external/` boundary:
+
+1. **Passing decode timing evidence.** Currently produced at the emulator tier
+   (mode `emulator_serialized`), because RTL does not execute at the anchor
+   geometry; the artifact carries `evidence_tier: emulator` and every consumer
+   surfaces that tier. An RTL-tier artifact satisfies the same gate.
+2. **The full-model independent-request compiler trace set.**
+3. **The BF16 output-head service calibration.**
+
+The third cannot be produced by timing `lm_head` on the execution GPU. The
+headline boundary places a dedicated BF16 endpoint on the prefill chip, so the
+artifact requires measurements taken at that physical endpoint: repeated and
+holdout logits, remote-link request and response timing, component dynamic
+energy, and leakage. The first pipeline command validates it against the pinned
+model and every searched batch, and fails before any GPU sweep work if it is
+missing or incomplete. No component energy or link measurement is ever inferred
+from GPU timing.
+
+### Refinement and benchmarks
+
+Refinement is partitioned into exactly four logical source shards from one
+immutable master schedule, run in two waves across the two-GPU execution pool.
+The merge accepts only complete, checksum-verified terminal coverage, and every
+accuracy-selected refinement profile is repriced against the exact hardware
+space before publication configurations are sealed.
+
+Before any GPU stage, the enabled publication path enumerates complete
+WikiText-2, IFEval and GSM8K splits from their declared dataset ID,
+configuration, immutable revision, split, expected row count and local cache
+root. Datasets are read offline in two independent ways — Hugging Face offline
+controls and direct prepared-Arrow reads — and the Hub-aware loader is never
+called, so a missing snapshot fails rather than downloading or silently
+switching revisions. Ordered item content and every local source file are
+checksum-sealed into the benchmark manifest.
+
+RULER is either omitted entirely or supplied as the complete 4K/8K/16K/32K set;
+a partial set is not accepted. Contract construction, benchmark execution, the
+post-accuracy exact hardware join, and the fail-closed final selection receipt
+all remain inside the same restartable pipeline.
diff --git a/decode_dse/__init__.py b/decode_dse/__init__.py
new file mode 100644
index 0000000..79de8bd
--- /dev/null
+++ b/decode_dse/__init__.py
@@ -0,0 +1,34 @@
+"""Decode-only precision, accuracy, and hardware co-design interfaces."""
+
+from decode_dse.legality import (
+    CrossStackCapability,
+    PackedKVRuntimeTarget,
+    StackValidity,
+    constrain_stack_validity,
+    evaluate_profile_legality,
+    evaluate_stack_capability,
+)
+from decode_dse.profiles import DecodePrecisionProfile, enumerate_decode_profiles
+from decode_dse.simulator_bridge import (
+    CompilerTracePointDescriptor,
+    CompilerTraceRequestBinder,
+    DecodeMetrics,
+    DecodeSimulator,
+    Precision,
+)
+
+__all__ = [
+    "CrossStackCapability",
+    "CompilerTracePointDescriptor",
+    "CompilerTraceRequestBinder",
+    "DecodeMetrics",
+    "DecodePrecisionProfile",
+    "DecodeSimulator",
+    "PackedKVRuntimeTarget",
+    "Precision",
+    "StackValidity",
+    "constrain_stack_validity",
+    "enumerate_decode_profiles",
+    "evaluate_profile_legality",
+    "evaluate_stack_capability",
+]
diff --git a/decode_dse/configs/llama3_1_8b.json b/decode_dse/configs/llama3_1_8b.json
new file mode 100644
index 0000000..7cf98e4
--- /dev/null
+++ b/decode_dse/configs/llama3_1_8b.json
@@ -0,0 +1,466 @@
+{
+  "_comment": "Deterministic decode-only precision sweep for Llama-3.1-8B-Instruct.",
+  "model_name": "meta-llama/Llama-3.1-8B-Instruct",
+  "model_revision": "0e9e39f249a16976918f6564b8830bc894c89659",
+  "tokenizer_revision": "0e9e39f249a16976918f6564b8830bc894c89659",
+  "sim_model": "llama-3.1-8b",
+  "model_architecture": {
+    "hidden_size": 4096,
+    "intermediate_size": 14336,
+    "num_hidden_layers": 32,
+    "num_attention_heads": 32,
+    "num_key_value_heads": 8,
+    "head_dim": 128,
+    "vocab_size": 128256,
+    "tie_word_embeddings": false,
+    "attention_bias": false,
+    "use_qk_norm": false
+  },
+  "model_placement": {
+    "policy": "single_device",
+    "device_count": 1,
+    "automatic_device_map": false
+  },
+  "runtime_requirements": {
+    "compute_capability": "sm_100",
+    "minimum_package_versions": {
+      "torch": "2.7.0",
+      "transformers": "4.51.0",
+      "datasets": "3.0.0",
+      "numpy": "1.26.0",
+      "nvidia-ml-py": "13.0.0"
+    }
+  },
+  "device": "cuda:0",
+  "dtype": "bfloat16",
+  "hf_cache_dir": "/data/models",
+  "local_files_only": true,
+  "trust_remote_code": false,
+  "evaluation_data": {
+    "dataset_name": "Salesforce/wikitext",
+    "dataset_config": "wikitext-2-raw-v1",
+    "dataset_revision": "b08601e04326c79dfdd32d625aee71d232d685c3",
+    "split": "validation",
+    "text_column": "text",
+    "document_separator": "\n\n",
+    "cache_dir": "/data/datasets"
+  },
+  "executor": {
+    "sample_bundle": "workspace://inputs/llama3_1_8b_samples.json",
+    "prefill_artifact_root": "workspace://artifacts/prefill_bf16",
+    "admission_artifact_root": "workspace://artifacts/decode_admission",
+    "stack_validity_manifest": "workspace://stack_validity.json",
+    "layout_id": "packed-gqa-mlen1024-block8-native-encoding",
+    "mase_src": "../mase/src",
+    "decode_microbatch_size": {
+      "numerical_screen": 16,
+      "hardware_validation": 8
+    },
+    "max_cpu_cache_gib": 24,
+    "artifact_policy": "content_addressed_recompute_per_format",
+    "artifact_space_safety_factor": 1.05,
+    "artifact_space_reserve_gib": 8,
+    "serialize_weight_bank_builds": true
+  },
+  "phase_contract": {
+    "prefill_precision": "BF16",
+    "prefill_kv_precision": "BF16",
+    "decode_query_length": 1,
+    "first_token_owner": "prefill",
+    "decode_kv_admission": "quantize_once"
+  },
+  "output_head_contract": {
+    "headline_location": "external_bf16_service",
+    "headline_precision": "BF16",
+    "local_bf16": "sensitivity_unrankable",
+    "local_low_precision": "accuracy_only"
+  },
+  "reference_workload": {
+    "batch": 4,
+    "input_seq": 512,
+    "output_seq": 3072,
+    "hbm_gen": "HBM2",
+    "hbm_channels": 32
+  },
+  "search": {
+    "weight_w": [
+      "MXINT2",
+      "MXINT4",
+      "MXINT8",
+      "E1M2",
+      "E2M1",
+      "E3M4",
+      "E4M3",
+      "E5M2"
+    ],
+    "kv": [
+      "MXINT2",
+      "MXINT4",
+      "MXINT8",
+      "E1M2",
+      "E2M1",
+      "E3M4",
+      "E4M3",
+      "E5M2"
+    ],
+    "act_w": [
+      "MXINT2",
+      "MXINT4",
+      "MXINT8",
+      "E1M2",
+      "E2M1",
+      "E3M4",
+      "E4M3",
+      "E5M2"
+    ],
+    "block": [
+      8
+    ],
+    "mixed_weight": false,
+    "front_fp_setting": [
+      [
+        3,
+        2
+      ],
+      [
+        2,
+        3
+      ],
+      [
+        6,
+        5
+      ],
+      [
+        5,
+        6
+      ],
+      [
+        4,
+        7
+      ],
+      [
+        8,
+        5
+      ]
+    ],
+    "vector_fp": [
+      "FP_E3M2",
+      "FP_E2M3",
+      "FP_E6M5",
+      "FP_E5M6",
+      "FP_E4M7",
+      "FP_E8M5"
+    ],
+    "include_vector_bf16_controls": true,
+    "include_bf16_reference": true,
+    "expected_quantized_profiles": 3072,
+    "expected_vector_bf16_controls": 512,
+    "expected_total_profiles": 3585,
+    "fp_setting_attention": true,
+    "quant_attn_matmuls": true
+  },
+  "software_search": "deterministic_exhaustive",
+  "search_budget": 3585,
+  "sampler": "deterministic_grid",
+  "use_rotation": false,
+  "fp_ppl_tol": 0.01,
+  "gptq": {
+    "nsamples": 64,
+    "seqlen": 1024,
+    "cali_batch_size": 8
+  },
+  "refinement": {
+    "schema_version": "decode-refinement-config/v1",
+    "sample_bundle": "workspace://refinement/inputs/samples.json",
+    "prefill_artifact_root": "workspace://refinement/artifacts/prefill_bf16",
+    "admission_artifact_root": "workspace://refinement/artifacts/decode_admission",
+    "calibration_artifact": "workspace://refinement/inputs/gptq_calibration.pt",
+    "calibration_receipt": "workspace://refinement/inputs/gptq_calibration.json",
+    "checkpoint_root": "workspace://refinement/checkpoints",
+    "calibration_samples": 128,
+    "calibration_sequence_length": 2048,
+    "calibration_batch_size": 8,
+    "calibration_seed": 20260725,
+    "sample_selection_seed": 20260725,
+    "gpu_min_free_mb": 36000,
+    "max_cpu_cache_gib": 24,
+    "calibration_data": {
+      "dataset_name": "Salesforce/wikitext",
+      "dataset_config": "wikitext-2-raw-v1",
+      "dataset_revision": "b08601e04326c79dfdd32d625aee71d232d685c3",
+      "split": "train",
+      "text_column": "text",
+      "document_separator": "\n\n",
+      "cache_dir": "/data/datasets"
+    }
+  },
+  "publication": {
+    "chat_template_sha256": "e10ca381b1ccc5cf9db52e371f3b6651576caee0a630b452e2816b2d404d4b65",
+    "chat_template_asset": "decode_dse/configs/publication_chat_template_llama3_1_8b.json",
+    "benchmark_datasets": {
+      "wikitext2": {
+        "dataset_name": "Salesforce/wikitext",
+        "dataset_config": "wikitext-2-raw-v1",
+        "dataset_revision": "b08601e04326c79dfdd32d625aee71d232d685c3",
+        "split": "test",
+        "cache_dir": "/data/datasets",
+        "content_columns": [
+          "text"
+        ],
+        "id_column": null,
+        "source_item_count": 4358
+      },
+      "ifeval": {
+        "dataset_name": "google/IFEval",
+        "dataset_config": "default",
+        "dataset_revision": "39ed06ce3906b51290c6e95b7c697e928c8a7b00",
+        "split": "train",
+        "cache_dir": "/data/datasets",
+        "content_columns": [
+          "key",
+          "prompt",
+          "instruction_id_list",
+          "kwargs"
+        ],
+        "id_column": "key",
+        "source_item_count": 541
+      },
+      "gsm8k": {
+        "dataset_name": "openai/gsm8k",
+        "dataset_config": "main",
+        "dataset_revision": "e53f048856ff4f594e959d75785d2c2d37b678ee",
+        "split": "test",
+        "cache_dir": "/data/datasets",
+        "content_columns": [
+          "question",
+          "answer"
+        ],
+        "id_column": null,
+        "source_item_count": 1319
+      }
+    },
+    "thinking_mode": "disabled",
+    "enable_thinking": false,
+    "greedy": true,
+    "temperature": 0.0,
+    "token_budgets": {
+      "wikitext2": 32768,
+      "ifeval": 2048,
+      "gsm8k": 2048,
+      "ruler": 512
+    },
+    "output_head_location": "external_bf16_service",
+    "output_head_precision": "BF16"
+  },
+  "eval_ppl_nsamples": 32,
+  "eval_ppl_seqlen": 2048,
+  "tasks": [
+    "gsm8k",
+    "ifeval"
+  ],
+  "task_batch_size": 8,
+  "front_size": 6,
+  "hardware_space": {
+    "MLEN": [
+      16,
+      32,
+      64,
+      128,
+      256,
+      512,
+      1024,
+      2048,
+      4096
+    ],
+    "BLEN": [
+      2,
+      4,
+      8,
+      16,
+      32,
+      64
+    ],
+    "HLEN": [
+      16,
+      32,
+      64,
+      128
+    ],
+    "BATCH": [
+      1,
+      4,
+      8,
+      16,
+      32,
+      64,
+      128,
+      256
+    ],
+    "HBM_CHANNELS": [
+      8
+    ],
+    "HBM_GENERATION": "HBM2",
+    "CHIP_COUNT": [
+      1,
+      2,
+      4,
+      8,
+      16
+    ],
+    "TP": [
+      1,
+      2,
+      4,
+      8,
+      16
+    ],
+    "KVP": [
+      1,
+      2,
+      4,
+      8,
+      16
+    ],
+    "LINK_PORTS": [
+      1,
+      2,
+      4
+    ],
+    "SRAM_POLICY": [
+      "streaming",
+      "projection_resident",
+      "kv_resident_25",
+      "kv_resident_50",
+      "kv_resident_75",
+      "kv_resident_100"
+    ],
+    "KV_HEAD_REUSE": [
+      false,
+      true
+    ],
+    "DRAIN_OVERLAPPED": [
+      false,
+      true
+    ],
+    "FP_SRAM_DEPTH": 512,
+    "RESOURCE_BUDGET": {
+      "reference_system": "A100x4",
+      "aggregate_area_limit_mm2": 3634.4,
+      "aggregate_hbm_capacity_limit_bytes": 320000000000,
+      "aggregate_hbm_bandwidth_limit_bytes_per_s": 8156000000000.0
+    }
+  },
+  "hbm_sensitivity": {
+    "schema_version": "decode-hbm-sensitivity/v2",
+    "source_profile_count": 4,
+    "generations": [
+      "HBM2",
+      "HBM2E",
+      "HBM3",
+      "HBM3E",
+      "HBM4"
+    ],
+    "preserve_geometry_batch_channels": true,
+    "cross_generation_ranking": false
+  },
+  "gpu_baseline": {
+    "attention_implementation": "sdpa",
+    "warmup_steps": 16,
+    "measured_steps": 128,
+    "repetitions": 3,
+    "batch_sizes": [
+      1,
+      2,
+      4,
+      8,
+      16,
+      32
+    ],
+    "precision": "BF16",
+    "q_len": 1,
+    "first_gpu_only": true,
+    "energy_meter_priority": [
+      "nvml_total_energy_counter",
+      "nvml_power_trace_trapezoidal"
+    ],
+    "power_trace_sample_interval_ms": 10
+  },
+  "publication_pipeline": {
+    "schema_version": "decode-publication-pipeline",
+    "artifacts": {
+      "admission_receipt": "workspace://admission_preparation.json",
+      "timing_evidence": "workspace://external/decode_timing_evidence.json",
+      "compiler_trace_artifacts": "workspace://external/compiler_trace_artifacts.json",
+      "request_memory_calibration": "simulator://analytic_models/disagg_serve/calibration_dma_requests.csv",
+      "head_service_calibration": "workspace://external/bf16_output_head_service.json",
+      "handoff_artifact": null,
+      "power_calibration": null,
+      "area_config": null,
+      "exact_dc_anchors": null,
+      "hardware_study": "workspace://hardware/exact_hardware_study.jsonl",
+      "refined_hardware_study": "workspace://hardware/refined_hardware_study.jsonl",
+      "refinement_validity": null,
+      "refinement_schedule": "workspace://refinement/schedule.json",
+      "refinement_promotion": "workspace://refinement/source_selection.json",
+      "refinement_results": "workspace://refinement/results",
+      "publication_configurations": "workspace://publication/inputs/configurations.json",
+      "publication_benchmarks": "workspace://publication/inputs/benchmarks.json",
+      "publication_chat_template": "workspace://publication/inputs/chat_template.json",
+      "publication_contract": "workspace://publication/contract.json",
+      "publication_results": "workspace://publication/results",
+      "final_selection": "workspace://publication/final_selection.json",
+      "packedkv_evidence": null,
+      "decode_analysis": null,
+      "figures": "workspace://publication/figures"
+    },
+    "resources": {
+      "stride": 1,
+      "runtime_hbm_reserve_bytes": 8589934592,
+      "rtl_source_tree_sha256": null,
+      "refinement_enabled": true,
+      "refinement_execution": "four_logical_shards",
+      "refinement_decode_microbatch_size": 8,
+      "bootstrap_replicates": 2000,
+      "publication_enabled": true,
+      "publication_executor": "decode_dse.software.benchmark_evaluator:create_executor",
+      "publication_timing_tier": "stage_calibrated_analytic",
+      "figure_formats": [
+        "png",
+        "pdf",
+        "svg"
+      ]
+    }
+  },
+  "n_chips": 1,
+  "baseline_hbm_channels": 32,
+  "seed": 0,
+  "scratch_dir": "workspace://scratch",
+  "gpu_min_free_mb": 24000,
+  "max_parallel_points": 4,
+  "compiler_trace_preflight": {
+    "schema_version": "decode-compiler-trace-preflight/v1",
+    "max_unique_family_artifacts": 64,
+    "max_unique_lowering_instantiations": 100000,
+    "max_lazy_trace_instantiations": 25000,
+    "max_projected_trace_bytes": 68719476736,
+    "max_context_timing_resolutions": 10000000,
+    "max_joined_identities": 10000000,
+    "max_joined_bytes": 68719476736,
+    "max_digest_updates": 20000000,
+    "projected_joined_row_bytes": 4096,
+    "digest_updates_per_joined_identity": 2
+  },
+  "doomed_ppl_abs": 100.0,
+  "doomed_ppl_ratio": 3.0,
+  "reference_chip": {
+    "MLEN": 1024,
+    "BLEN": 8,
+    "VLEN": 1024,
+    "HLEN": 128
+  },
+  "bw_model": "calibrated",
+  "runtime": {
+    "persistent": true,
+    "max_attempts": 3
+  }
+}
diff --git a/decode_dse/configs/publication_chat_template.json b/decode_dse/configs/publication_chat_template.json
new file mode 100644
index 0000000..169dab8
--- /dev/null
+++ b/decode_dse/configs/publication_chat_template.json
@@ -0,0 +1,9 @@
+{
+  "schema_version": "decode-chat-template",
+  "model_name": "Qwen/Qwen3-32B",
+  "model_revision": "9216db5781bf21249d130ec9da846c4624c16137",
+  "tokenizer_revision": "9216db5781bf21249d130ec9da846c4624c16137",
+  "enable_thinking": false,
+  "chat_template_sha256": "a55ee1b1660128b7098723e0abcd92caa0788061051c62d51cbe87d9cf1974d8",
+  "chat_template": "{%- if tools %}\n    {{- '<|im_start|>system\\n' }}\n    {%- if messages[0].role == 'system' %}\n        {{- messages[0].content + '\\n\\n' }}\n    {%- endif %}\n    {{- \"# Tools\\n\\nYou may call one or more functions to assist with the user query.\\n\\nYou are provided with function signatures within <tools></tools> XML tags:\\n<tools>\" }}\n    {%- for tool in tools %}\n        {{- \"\\n\" }}\n        {{- tool | tojson }}\n    {%- endfor %}\n    {{- \"\\n</tools>\\n\\nFor each function call, return a json object with function name and arguments within <tool_call></tool_call> XML tags:\\n<tool_call>\\n{\\\"name\\\": <function-name>, \\\"arguments\\\": <args-json-object>}\\n</tool_call><|im_end|>\\n\" }}\n{%- else %}\n    {%- if messages[0].role == 'system' %}\n        {{- '<|im_start|>system\\n' + messages[0].content + '<|im_end|>\\n' }}\n    {%- endif %}\n{%- endif %}\n{%- set ns = namespace(multi_step_tool=true, last_query_index=messages|length - 1) %}\n{%- for message in messages[::-1] %}\n    {%- set index = (messages|length - 1) - loop.index0 %}\n    {%- if ns.multi_step_tool and message.role == \"user\" and message.content is string and not(message.content.startswith('<tool_response>') and message.content.endswith('</tool_response>')) %}\n        {%- set ns.multi_step_tool = false %}\n        {%- set ns.last_query_index = index %}\n    {%- endif %}\n{%- endfor %}\n{%- for message in messages %}\n    {%- if message.content is string %}\n        {%- set content = message.content %}\n    {%- else %}\n        {%- set content = '' %}\n    {%- endif %}\n    {%- if (message.role == \"user\") or (message.role == \"system\" and not loop.first) %}\n        {{- '<|im_start|>' + message.role + '\\n' + content + '<|im_end|>' + '\\n' }}\n    {%- elif message.role == \"assistant\" %}\n        {%- set reasoning_content = '' %}\n        {%- if message.reasoning_content is string %}\n            {%- set reasoning_content = message.reasoning_content %}\n        {%- else %}\n            {%- if '</think>' in content %}\n                {%- set reasoning_content = content.split('</think>')[0].rstrip('\\n').split('<think>')[-1].lstrip('\\n') %}\n                {%- set content = content.split('</think>')[-1].lstrip('\\n') %}\n            {%- endif %}\n        {%- endif %}\n        {%- if loop.index0 > ns.last_query_index %}\n            {%- if loop.last or (not loop.last and reasoning_content) %}\n                {{- '<|im_start|>' + message.role + '\\n<think>\\n' + reasoning_content.strip('\\n') + '\\n</think>\\n\\n' + content.lstrip('\\n') }}\n            {%- else %}\n                {{- '<|im_start|>' + message.role + '\\n' + content }}\n            {%- endif %}\n        {%- else %}\n            {{- '<|im_start|>' + message.role + '\\n' + content }}\n        {%- endif %}\n        {%- if message.tool_calls %}\n            {%- for tool_call in message.tool_calls %}\n                {%- if (loop.first and content) or (not loop.first) %}\n                    {{- '\\n' }}\n                {%- endif %}\n                {%- if tool_call.function %}\n                    {%- set tool_call = tool_call.function %}\n                {%- endif %}\n                {{- '<tool_call>\\n{\"name\": \"' }}\n                {{- tool_call.name }}\n                {{- '\", \"arguments\": ' }}\n                {%- if tool_call.arguments is string %}\n                    {{- tool_call.arguments }}\n                {%- else %}\n                    {{- tool_call.arguments | tojson }}\n                {%- endif %}\n                {{- '}\\n</tool_call>' }}\n            {%- endfor %}\n        {%- endif %}\n        {{- '<|im_end|>\\n' }}\n    {%- elif message.role == \"tool\" %}\n        {%- if loop.first or (messages[loop.index0 - 1].role != \"tool\") %}\n            {{- '<|im_start|>user' }}\n        {%- endif %}\n        {{- '\\n<tool_response>\\n' }}\n        {{- content }}\n        {{- '\\n</tool_response>' }}\n        {%- if loop.last or (messages[loop.index0 + 1].role != \"tool\") %}\n            {{- '<|im_end|>\\n' }}\n        {%- endif %}\n    {%- endif %}\n{%- endfor %}\n{%- if add_generation_prompt %}\n    {{- '<|im_start|>assistant\\n' }}\n    {%- if enable_thinking is defined and enable_thinking is false %}\n        {{- '<think>\\n\\n</think>\\n\\n' }}\n    {%- endif %}\n{%- endif %}"
+}
diff --git a/decode_dse/configs/publication_chat_template_llama3_1_8b.json b/decode_dse/configs/publication_chat_template_llama3_1_8b.json
new file mode 100644
index 0000000..0dbb2ef
--- /dev/null
+++ b/decode_dse/configs/publication_chat_template_llama3_1_8b.json
@@ -0,0 +1,9 @@
+{
+ "chat_template": "{{- bos_token }}\n{%- if custom_tools is defined %}\n    {%- set tools = custom_tools %}\n{%- endif %}\n{%- if not tools_in_user_message is defined %}\n    {%- set tools_in_user_message = true %}\n{%- endif %}\n{%- if not date_string is defined %}\n    {%- set date_string = \"26 Jul 2024\" %}\n{%- endif %}\n{%- if not tools is defined %}\n    {%- set tools = none %}\n{%- endif %}\n\n{#- This block extracts the system message, so we can slot it into the right place. #}\n{%- if messages[0]['role'] == 'system' %}\n    {%- set system_message = messages[0]['content']|trim %}\n    {%- set messages = messages[1:] %}\n{%- else %}\n    {%- set system_message = \"\" %}\n{%- endif %}\n\n{#- System message + builtin tools #}\n{{- \"<|start_header_id|>system<|end_header_id|>\\n\\n\" }}\n{%- if builtin_tools is defined or tools is not none %}\n    {{- \"Environment: ipython\\n\" }}\n{%- endif %}\n{%- if builtin_tools is defined %}\n    {{- \"Tools: \" + builtin_tools | reject('equalto', 'code_interpreter') | join(\", \") + \"\\n\\n\"}}\n{%- endif %}\n{{- \"Cutting Knowledge Date: December 2023\\n\" }}\n{{- \"Today Date: \" + date_string + \"\\n\\n\" }}\n{%- if tools is not none and not tools_in_user_message %}\n    {{- \"You have access to the following functions. To call a function, please respond with JSON for a function call.\" }}\n    {{- 'Respond in the format {\"name\": function name, \"parameters\": dictionary of argument name and its value}.' }}\n    {{- \"Do not use variables.\\n\\n\" }}\n    {%- for t in tools %}\n        {{- t | tojson(indent=4) }}\n        {{- \"\\n\\n\" }}\n    {%- endfor %}\n{%- endif %}\n{{- system_message }}\n{{- \"<|eot_id|>\" }}\n\n{#- Custom tools are passed in a user message with some extra guidance #}\n{%- if tools_in_user_message and not tools is none %}\n    {#- Extract the first user message so we can plug it in here #}\n    {%- if messages | length != 0 %}\n        {%- set first_user_message = messages[0]['content']|trim %}\n        {%- set messages = messages[1:] %}\n    {%- else %}\n        {{- raise_exception(\"Cannot put tools in the first user message when there's no first user message!\") }}\n{%- endif %}\n    {{- '<|start_header_id|>user<|end_header_id|>\\n\\n' -}}\n    {{- \"Given the following functions, please respond with a JSON for a function call \" }}\n    {{- \"with its proper arguments that best answers the given prompt.\\n\\n\" }}\n    {{- 'Respond in the format {\"name\": function name, \"parameters\": dictionary of argument name and its value}.' }}\n    {{- \"Do not use variables.\\n\\n\" }}\n    {%- for t in tools %}\n        {{- t | tojson(indent=4) }}\n        {{- \"\\n\\n\" }}\n    {%- endfor %}\n    {{- first_user_message + \"<|eot_id|>\"}}\n{%- endif %}\n\n{%- for message in messages %}\n    {%- if not (message.role == 'ipython' or message.role == 'tool' or 'tool_calls' in message) %}\n        {{- '<|start_header_id|>' + message['role'] + '<|end_header_id|>\\n\\n'+ message['content'] | trim + '<|eot_id|>' }}\n    {%- elif 'tool_calls' in message %}\n        {%- if not message.tool_calls|length == 1 %}\n            {{- raise_exception(\"This model only supports single tool-calls at once!\") }}\n        {%- endif %}\n        {%- set tool_call = message.tool_calls[0].function %}\n        {%- if builtin_tools is defined and tool_call.name in builtin_tools %}\n            {{- '<|start_header_id|>assistant<|end_header_id|>\\n\\n' -}}\n            {{- \"<|python_tag|>\" + tool_call.name + \".call(\" }}\n            {%- for arg_name, arg_val in tool_call.arguments | items %}\n                {{- arg_name + '=\"' + arg_val + '\"' }}\n                {%- if not loop.last %}\n                    {{- \", \" }}\n                {%- endif %}\n                {%- endfor %}\n            {{- \")\" }}\n        {%- else  %}\n            {{- '<|start_header_id|>assistant<|end_header_id|>\\n\\n' -}}\n            {{- '{\"name\": \"' + tool_call.name + '\", ' }}\n            {{- '\"parameters\": ' }}\n            {{- tool_call.arguments | tojson }}\n            {{- \"}\" }}\n        {%- endif %}\n        {%- if builtin_tools is defined %}\n            {#- This means we're in ipython mode #}\n            {{- \"<|eom_id|>\" }}\n        {%- else %}\n            {{- \"<|eot_id|>\" }}\n        {%- endif %}\n    {%- elif message.role == \"tool\" or message.role == \"ipython\" %}\n        {{- \"<|start_header_id|>ipython<|end_header_id|>\\n\\n\" }}\n        {%- if message.content is mapping or message.content is iterable %}\n            {{- message.content | tojson }}\n        {%- else %}\n            {{- message.content }}\n        {%- endif %}\n        {{- \"<|eot_id|>\" }}\n    {%- endif %}\n{%- endfor %}\n{%- if add_generation_prompt %}\n    {{- '<|start_header_id|>assistant<|end_header_id|>\\n\\n' }}\n{%- endif %}\n",
+ "chat_template_sha256": "e10ca381b1ccc5cf9db52e371f3b6651576caee0a630b452e2816b2d404d4b65",
+ "enable_thinking": false,
+ "model_name": "meta-llama/Llama-3.1-8B-Instruct",
+ "model_revision": "0e9e39f249a16976918f6564b8830bc894c89659",
+ "schema_version": "decode-chat-template",
+ "tokenizer_revision": "0e9e39f249a16976918f6564b8830bc894c89659"
+}
diff --git a/decode_dse/configs/qwen3_32b.json b/decode_dse/configs/qwen3_32b.json
new file mode 100644
index 0000000..70fd217
--- /dev/null
+++ b/decode_dse/configs/qwen3_32b.json
@@ -0,0 +1,467 @@
+{
+  "_comment": "Deterministic decode-only precision sweep for Qwen3-32B.",
+  "model_name": "Qwen/Qwen3-32B",
+  "model_revision": "9216db5781bf21249d130ec9da846c4624c16137",
+  "tokenizer_revision": "9216db5781bf21249d130ec9da846c4624c16137",
+  "sim_model": "qwen3-32b",
+  "model_architecture": {
+    "hidden_size": 5120,
+    "intermediate_size": 25600,
+    "num_hidden_layers": 64,
+    "num_attention_heads": 64,
+    "num_key_value_heads": 8,
+    "head_dim": 128,
+    "vocab_size": 151936,
+    "tie_word_embeddings": false,
+    "attention_bias": false,
+    "use_qk_norm": true
+  },
+  "model_placement": {
+    "policy": "single_device",
+    "device_count": 1,
+    "automatic_device_map": false
+  },
+  "runtime_requirements": {
+    "compute_capability": "sm_100",
+    "minimum_package_versions": {
+      "torch": "2.7.0",
+      "transformers": "4.51.0",
+      "datasets": "3.0.0",
+      "numpy": "1.26.0",
+      "nvidia-ml-py": "13.0.0"
+    }
+  },
+  "device": "cuda:0",
+  "dtype": "bfloat16",
+  "hf_cache_dir": "/data/models",
+  "local_files_only": true,
+  "trust_remote_code": false,
+  "evaluation_data": {
+    "dataset_name": "Salesforce/wikitext",
+    "dataset_config": "wikitext-2-raw-v1",
+    "dataset_revision": "b08601e04326c79dfdd32d625aee71d232d685c3",
+    "split": "validation",
+    "text_column": "text",
+    "document_separator": "\n\n",
+    "cache_dir": "/data/datasets"
+  },
+  "executor": {
+    "sample_bundle": "workspace://inputs/qwen3_32b_samples.json",
+    "prefill_artifact_root": "workspace://artifacts/prefill_bf16",
+    "admission_artifact_root": "workspace://artifacts/decode_admission",
+    "stack_validity_manifest": "workspace://stack_validity.json",
+    "layout_id": "packed-gqa-mlen1024-block8-native-encoding",
+    "mase_src": "../mase/src",
+    "decode_microbatch_size": {
+      "numerical_screen": 16,
+      "hardware_validation": 8
+    },
+    "max_cpu_cache_gib": 24,
+    "artifact_policy": "content_addressed_recompute_per_format",
+    "artifact_space_safety_factor": 1.05,
+    "artifact_space_reserve_gib": 8,
+    "serialize_weight_bank_builds": true
+  },
+  "phase_contract": {
+    "prefill_precision": "BF16",
+    "prefill_kv_precision": "BF16",
+    "decode_query_length": 1,
+    "first_token_owner": "prefill",
+    "decode_kv_admission": "quantize_once"
+  },
+  "output_head_contract": {
+    "headline_location": "external_bf16_service",
+    "headline_precision": "BF16",
+    "local_bf16": "sensitivity_unrankable",
+    "local_low_precision": "accuracy_only"
+  },
+  "reference_workload": {
+    "batch": 4,
+    "input_seq": 512,
+    "output_seq": 3072,
+    "hbm_gen": "HBM2",
+    "hbm_channels": 32
+  },
+  "search": {
+    "weight_w": [
+      "MXINT2",
+      "MXINT4",
+      "MXINT8",
+      "E1M2",
+      "E2M1",
+      "E3M4",
+      "E4M3",
+      "E5M2"
+    ],
+    "kv": [
+      "MXINT2",
+      "MXINT4",
+      "MXINT8",
+      "E1M2",
+      "E2M1",
+      "E3M4",
+      "E4M3",
+      "E5M2"
+    ],
+    "act_w": [
+      "MXINT2",
+      "MXINT4",
+      "MXINT8",
+      "E1M2",
+      "E2M1",
+      "E3M4",
+      "E4M3",
+      "E5M2"
+    ],
+    "block": [
+      8
+    ],
+    "mixed_weight": false,
+    "front_fp_setting": [
+      [
+        3,
+        2
+      ],
+      [
+        2,
+        3
+      ],
+      [
+        6,
+        5
+      ],
+      [
+        5,
+        6
+      ],
+      [
+        4,
+        7
+      ],
+      [
+        8,
+        5
+      ]
+    ],
+    "vector_fp": [
+      "FP_E3M2",
+      "FP_E2M3",
+      "FP_E6M5",
+      "FP_E5M6",
+      "FP_E4M7",
+      "FP_E8M5"
+    ],
+    "include_vector_bf16_controls": true,
+    "include_bf16_reference": true,
+    "expected_quantized_profiles": 3072,
+    "expected_vector_bf16_controls": 512,
+    "expected_total_profiles": 3585,
+    "fp_setting_attention": true,
+    "quant_attn_matmuls": true
+  },
+  "software_search": "deterministic_exhaustive",
+  "search_budget": 3585,
+  "sampler": "deterministic_grid",
+  "use_rotation": false,
+  "fp_ppl_tol": 0.01,
+  "gptq": {
+    "nsamples": 64,
+    "seqlen": 1024,
+    "cali_batch_size": 8
+  },
+  "refinement": {
+    "schema_version": "decode-refinement-config/v1",
+    "sample_bundle": "workspace://refinement/inputs/samples.json",
+    "prefill_artifact_root": "workspace://refinement/artifacts/prefill_bf16",
+    "admission_artifact_root": "workspace://refinement/artifacts/decode_admission",
+    "calibration_artifact": "workspace://refinement/inputs/gptq_calibration.pt",
+    "calibration_receipt": "workspace://refinement/inputs/gptq_calibration.json",
+    "checkpoint_root": "workspace://refinement/checkpoints",
+    "calibration_samples": 128,
+    "calibration_sequence_length": 2048,
+    "calibration_batch_size": 8,
+    "calibration_seed": 20260725,
+    "sample_selection_seed": 20260725,
+    "gpu_min_free_mb": 90000,
+    "max_cpu_cache_gib": 24,
+    "calibration_data": {
+      "dataset_name": "Salesforce/wikitext",
+      "dataset_config": "wikitext-2-raw-v1",
+      "dataset_revision": "b08601e04326c79dfdd32d625aee71d232d685c3",
+      "split": "train",
+      "text_column": "text",
+      "document_separator": "\n\n",
+      "cache_dir": "/data/datasets"
+    }
+  },
+  "publication": {
+    "chat_template_asset": "decode_dse/configs/publication_chat_template.json",
+    "chat_template_sha256": "a55ee1b1660128b7098723e0abcd92caa0788061051c62d51cbe87d9cf1974d8",
+    "benchmark_datasets": {
+      "wikitext2": {
+        "dataset_name": "Salesforce/wikitext",
+        "dataset_config": "wikitext-2-raw-v1",
+        "dataset_revision": "b08601e04326c79dfdd32d625aee71d232d685c3",
+        "split": "test",
+        "cache_dir": "/data/datasets",
+        "content_columns": [
+          "text"
+        ],
+        "id_column": null,
+        "source_item_count": 4358
+      },
+      "ifeval": {
+        "dataset_name": "google/IFEval",
+        "dataset_config": "default",
+        "dataset_revision": "39ed06ce3906b51290c6e95b7c697e928c8a7b00",
+        "split": "train",
+        "cache_dir": "/data/datasets",
+        "content_columns": [
+          "key",
+          "prompt",
+          "instruction_id_list",
+          "kwargs"
+        ],
+        "id_column": "key",
+        "source_item_count": 541
+      },
+      "gsm8k": {
+        "dataset_name": "openai/gsm8k",
+        "dataset_config": "main",
+        "dataset_revision": "e53f048856ff4f594e959d75785d2c2d37b678ee",
+        "split": "test",
+        "cache_dir": "/data/datasets",
+        "content_columns": [
+          "question",
+          "answer"
+        ],
+        "id_column": null,
+        "source_item_count": 1319
+      }
+    },
+    "thinking_mode": "disabled",
+    "enable_thinking": false,
+    "greedy": true,
+    "temperature": 0.0,
+    "token_budgets": {
+      "wikitext2": 32768,
+      "ifeval": 2048,
+      "gsm8k": 2048,
+      "ruler": 512
+    },
+    "output_head_location": "external_bf16_service",
+    "output_head_precision": "BF16"
+  },
+  "eval_ppl_nsamples": 32,
+  "eval_ppl_seqlen": 2048,
+  "tasks": [
+    "gsm8k",
+    "ifeval"
+  ],
+  "task_batch_size": 8,
+  "front_size": 6,
+  "hardware_space": {
+    "MLEN": [
+      16,
+      32,
+      64,
+      128,
+      256,
+      512,
+      1024,
+      2048,
+      4096
+    ],
+    "BLEN": [
+      2,
+      4,
+      8,
+      16,
+      32,
+      64
+    ],
+    "HLEN": [
+      16,
+      32,
+      64,
+      128
+    ],
+    "BATCH": [
+      1,
+      4,
+      8,
+      16,
+      32,
+      64,
+      128,
+      256
+    ],
+    "HBM_CHANNELS": [
+      8
+    ],
+    "HBM_GENERATION": "HBM2",
+    "CHIP_COUNT": [
+      1,
+      2,
+      4,
+      8,
+      16
+    ],
+    "TP": [
+      1,
+      2,
+      4,
+      8,
+      16
+    ],
+    "KVP": [
+      1,
+      2,
+      4,
+      8,
+      16
+    ],
+    "LINK_PORTS": [
+      1,
+      2,
+      4
+    ],
+    "SRAM_POLICY": [
+      "streaming",
+      "projection_resident",
+      "kv_resident_25",
+      "kv_resident_50",
+      "kv_resident_75",
+      "kv_resident_100"
+    ],
+    "KV_HEAD_REUSE": [
+      false,
+      true
+    ],
+    "DRAIN_OVERLAPPED": [
+      false,
+      true
+    ],
+    "FP_SRAM_DEPTH": 512,
+    "RESOURCE_BUDGET": {
+      "reference_system": "A100x4",
+      "aggregate_area_limit_mm2": 3634.4,
+      "aggregate_hbm_capacity_limit_bytes": 320000000000,
+      "aggregate_hbm_bandwidth_limit_bytes_per_s": 8156000000000.0
+    }
+  },
+  "hbm_sensitivity": {
+    "schema_version": "decode-hbm-sensitivity/v2",
+    "source_profile_count": 4,
+    "generations": [
+      "HBM2",
+      "HBM2E",
+      "HBM3",
+      "HBM3E",
+      "HBM4"
+    ],
+    "preserve_geometry_batch_channels": true,
+    "cross_generation_ranking": false
+  },
+  "gpu_baseline": {
+    "attention_implementation": "sdpa",
+    "warmup_steps": 16,
+    "measured_steps": 128,
+    "repetitions": 3,
+    "batch_sizes": [
+      1,
+      2,
+      4,
+      8,
+      16,
+      32
+    ],
+    "precision": "BF16",
+    "q_len": 1,
+    "first_gpu_only": true,
+    "energy_meter_priority": [
+      "nvml_total_energy_counter",
+      "nvml_power_trace_trapezoidal"
+    ],
+    "power_trace_sample_interval_ms": 10
+  },
+  "publication_pipeline": {
+    "schema_version": "decode-publication-pipeline",
+    "artifacts": {
+      "admission_receipt": "workspace://admission_preparation.json",
+      "timing_evidence": "workspace://external/decode_timing_evidence.json",
+      "compiler_trace_artifacts": "workspace://external/compiler_trace_artifacts.json",
+      "request_memory_calibration": "simulator://analytic_models/disagg_serve/calibration_dma_requests.csv",
+      "head_service_calibration": "workspace://external/bf16_output_head_service.json",
+      "handoff_artifact": null,
+      "power_calibration": null,
+      "area_config": null,
+      "exact_dc_anchors": null,
+      "hardware_study": "workspace://hardware/exact_hardware_study.jsonl",
+      "refined_hardware_study": "workspace://hardware/refined_hardware_study.jsonl",
+      "refinement_validity": null,
+      "refinement_schedule": "workspace://refinement/schedule.json",
+      "refinement_promotion": "workspace://refinement/source_selection.json",
+      "refinement_results": "workspace://refinement/results",
+      "publication_configurations": "workspace://publication/inputs/configurations.json",
+      "publication_benchmarks": "workspace://publication/inputs/benchmarks.json",
+      "publication_chat_template": "workspace://publication/inputs/chat_template.json",
+      "publication_contract": "workspace://publication/contract.json",
+      "publication_results": "workspace://publication/results",
+      "final_selection": "workspace://publication/final_selection.json",
+      "packedkv_evidence": null,
+      "decode_analysis": null,
+      "figures": "workspace://publication/figures"
+    },
+    "resources": {
+      "stride": 1,
+      "runtime_hbm_reserve_bytes": 8589934592,
+      "rtl_source_tree_sha256": null,
+      "refinement_enabled": true,
+      "refinement_execution": "four_logical_shards",
+      "refinement_decode_microbatch_size": 8,
+      "bootstrap_replicates": 2000,
+      "publication_enabled": true,
+      "publication_executor": "decode_dse.software.benchmark_evaluator:create_executor",
+      "publication_timing_tier": "stage_calibrated_analytic",
+      "figure_formats": [
+        "png",
+        "pdf",
+        "svg"
+      ]
+    }
+  },
+  "n_chips": 1,
+  "baseline_hbm_channels": 32,
+  "seed": 0,
+  "scratch_dir": "workspace://scratch",
+  "_scratch_comment": "Cross-process weight-bank construction locks and refinement checkpoints use this path.",
+  "gpu_min_free_mb": 70000,
+  "max_parallel_points": 2,
+  "compiler_trace_preflight": {
+    "schema_version": "decode-compiler-trace-preflight/v1",
+    "max_unique_family_artifacts": 64,
+    "max_unique_lowering_instantiations": 100000,
+    "max_lazy_trace_instantiations": 25000,
+    "max_projected_trace_bytes": 68719476736,
+    "max_context_timing_resolutions": 10000000,
+    "max_joined_identities": 10000000,
+    "max_joined_bytes": 68719476736,
+    "max_digest_updates": 20000000,
+    "projected_joined_row_bytes": 4096,
+    "digest_updates_per_joined_identity": 2
+  },
+  "doomed_ppl_abs": 100.0,
+  "doomed_ppl_ratio": 3.0,
+  "reference_chip": {
+    "MLEN": 1024,
+    "BLEN": 8,
+    "VLEN": 1024,
+    "HLEN": 128
+  },
+  "bw_model": "calibrated",
+  "runtime": {
+    "persistent": true,
+    "max_attempts": 3
+  }
+}
diff --git a/decode_dse/docs/server_setup.md b/decode_dse/docs/server_setup.md
new file mode 100644
index 0000000..6470d44
--- /dev/null
+++ b/decode_dse/docs/server_setup.md
@@ -0,0 +1,66 @@
+# Execution-host bring-up
+
+## Repository layout
+
+The four repositories are cloned side by side; the sweep plan hashes
+`PLENA_RTL/PLENA_Tools/plena_quant` as a quantizer source root and fails
+closed without it, so `PLENA_RTL` must be present even though the sweep is
+software-only.
+
+```
+<root>/PLENA_Software    branch sr1325-decode_dse
+<root>/PLENA_Simulator   branch sr1325-dev   (compiler submodule initialized)
+<root>/PLENA_RTL         branch sr1325-dev   (PLENA_Compiler submodule initialized)
+<root>/mase              branch sr1325/decode-phase-quant
+```
+
+Byte-identity invariants must hold before any run:
+`PLENA_RTL/PLENA_Compiler == PLENA_Simulator/compiler` and
+`PLENA_RTL/PLENA_Tools == PLENA_Simulator/PLENA_Tools`
+(`diff -qr … -x __pycache__ -x '*.pyc' -x .git -x .pytest_cache` is empty).
+
+## Environment
+
+All pipeline invocations go through `decode_dse/scripts/launch_pipeline.sh`,
+which exports `PLENA_SIMULATOR_PATH` and prepends
+`PLENA_Simulator/compiler` and `PLENA_Simulator/PLENA_Tools` to `PYTHONPATH`.
+These exports are required: the compiler frontend imports `asm_templates` as a
+top-level package, which the in-process `sys.path` injection does not cover.
+Do not rely on ambient shell state.
+
+Models and datasets are staged under the paths pinned in
+`decode_dse/configs/<model>.json` (`cache_dir`, `model_revision`, dataset
+revisions). The Llama tokenizer/model requires an authenticated Hugging Face
+fetch at the pinned revision.
+
+## Evidence artifacts
+
+`workspace://external/` must contain, before the pipeline's evidence gate:
+
+| file | origin |
+|---|---|
+| `decode_timing_evidence.json` | copied from `PLENA_Simulator/analytic_models/performance/evidence/`; self-labelled emulator tier |
+| `compiler_trace_artifacts.json` | written by the pipeline's first command (`sweep compiler-trace-artifacts`) |
+| `bf16_output_head_service.json` | measured on this host by `decode_dse/hardware/measure_bf16_head_service.py`, one run per model, on two idle exclusively-held GPUs |
+
+The stack-validity stage reports and calibration artifacts ship inside the
+repositories and the workspace; they are content-hash bound and must not be
+regenerated unless their bound sources changed.
+
+## Per-model launch order
+
+```
+scripts/launch_pipeline.sh inputs samples   --config <cfg> --output-dir <ws> ...
+scripts/launch_pipeline.sh stage plan       --config <cfg> --output-dir <ws> --dry-run
+scripts/launch_pipeline.sh stage plan       --config <cfg> --output-dir <ws> --prompt-manifest <ws>/prompt_manifest.json
+scripts/launch_pipeline.sh inputs prefill   --config <cfg> --output-dir <ws> ...
+scripts/launch_pipeline.sh inputs admission --config <cfg> --output-dir <ws> ...
+# stage the three external artifacts (table above)
+scripts/launch_pipeline.sh pipeline --config <cfg> --output-dir <ws> --device-label <label> --gpus 0,1 --dry-run
+scripts/launch_pipeline.sh pipeline --config <cfg> --output-dir <ws> --device-label <label> --gpus 0,1
+```
+
+The sealed plan fixes two workers, so exactly two GPU ids are passed
+regardless of the number of physical boards. Verify with NVML that both
+chosen boards are idle and hold no foreign compute processes before the
+head-service measurement and before launch.
diff --git a/decode_dse/hardware/__init__.py b/decode_dse/hardware/__init__.py
new file mode 100644
index 0000000..e298864
--- /dev/null
+++ b/decode_dse/hardware/__init__.py
@@ -0,0 +1,267 @@
+"""Deterministic hardware enumeration, calibration, and result selection."""
+
+from decode_dse.hardware.admission_cost import (
+    ADMISSION_CORRECTNESS_SCHEMA,
+    ADMISSION_CORRECTNESS_SCOPE,
+    ADMISSION_NUMERICAL_VALIDATION_SCHEMA,
+    ADMISSION_PERSISTENCE_CONTRACT,
+    ADMISSION_VALIDATION_BASIS,
+    AdmissionCorrectnessStatus,
+    admission_correctness_status_valid,
+    load_admission_correctness_evidence,
+    missing_admission_correctness_status,
+)
+from decode_dse.hardware.calibration import (
+    CalibrationGateReport,
+    CalibrationPair,
+    CalibrationThresholds,
+    validate_calibration,
+)
+from decode_dse.hardware.design_space import (
+    COMPILER_TRACE_EXECUTION_MODE,
+    COMPILER_TRACE_TIMING_SET_SCHEMA,
+    CalibratedEnergy,
+    CapacityBreakdown,
+    DECODE_EXECUTION_MODES,
+    ExactHardwareSpace,
+    ExactHardwareStudy,
+    FULL_MODEL_DECODE_SCOPE,
+    HardwareCandidate,
+    HardwareEvaluation,
+    HardwareMetrics,
+    HardwareStudyArtifact,
+    JoinedHardwareResult,
+    LEGACY_AGGREGATE_BANDWIDTH_MODE,
+    PhysicalTraffic,
+    ResourceBudget,
+    ResourceBudgetStatus,
+    StudyProvenance,
+    load_hardware_artifact,
+    physical_cost_signature,
+    physical_cost_signature_id,
+)
+from decode_dse.hardware.synthesis_anchor import (
+    EXACT_DC_ANCHOR_SCHEMA,
+    EXACT_DC_SCOPE,
+    ExactDCAnchor,
+    ExactDCAnchorIndex,
+)
+from decode_dse.hardware.lm_head_service import (
+    BF16HeadServiceCalibration,
+    BF16HeadServiceEstimate,
+    BF16HeadServiceStatus,
+    HEAD_LOGIT_MAX_ABS_ERROR,
+    HEAD_LOGIT_MEAN_ABS_ERROR,
+    HEAD_SERVICE_MODE,
+    HEAD_SERVICE_SCHEMA,
+    HEAD_TOPK_MIN_AGREEMENT,
+    HEAD_VALIDATION_TOPK,
+    HeadServiceMeasurement,
+    composite_system_calibration_id,
+    head_service_status_valid,
+    load_bf16_head_service_artifact,
+)
+from decode_dse.hardware.hbm_sensitivity import (
+    HBMOperatingPointResolver,
+    HBMSensitivityPoint,
+    HBMSensitivitySchedule,
+    HBMSensitivitySource,
+    HBM_SENSITIVITY_BASELINE,
+    HBM_SENSITIVITY_GENERATIONS,
+    HBM_SENSITIVITY_OUTPUT_HEAD,
+    HBM_SENSITIVITY_SCHEMA,
+    HBM_SENSITIVITY_SOURCE_COUNT,
+    build_hbm_sensitivity_schedule,
+    hbm_sensitivity_sources_from_hardware_rows,
+    write_hbm_sensitivity_schedule,
+)
+from decode_dse.hardware.power_model import (
+    SimulatorPowerStatus,
+    calibrated_area_from_simulator,
+    calibrated_energy_from_simulator,
+    load_simulator_power_artifact,
+    required_hardware_power_signatures,
+    required_profile_power_signatures,
+)
+from decode_dse.hardware.packedkv_claims import (
+    AblationEnvironment,
+    AttentionTopology,
+    PackedKVAblationGroup,
+    PackedKVGatePolicy,
+    PackedKVModeMeasurement,
+    PackedKVPrecision,
+    PackedKVPublicationEvidence,
+    PackedKVPublicationReport,
+    PipelineValidationEvidence,
+    SelectorSynthesisEvidence,
+    evaluate_packedkv_publication,
+    expected_packedkv_bytes,
+    load_packedkv_evidence,
+    write_packedkv_report,
+)
+from decode_dse.hardware.selection import (
+    BootstrapInterval,
+    DocumentNLL,
+    EpsilonPolicy,
+    FidelityReport,
+    FinalSelectionDecision,
+    HeadServiceEvidence,
+    PairedDocumentScore,
+    ParetoPoint,
+    PromotionResult,
+    PublicationCandidate,
+    RefinementSourceSelection,
+    clustered_nll_bootstrap,
+    epsilon_pareto_fronts,
+    evaluate_screening_fidelity,
+    paired_task_bootstrap,
+    promote_epsilon_pareto,
+    select_refinement_sources,
+    select_final_deployment,
+    write_selection_report,
+)
+
+_EXACT_EXPORTS = {
+    "DecodeSimulatorBackend",
+    "HardwareWorkload",
+    "PrefillHandoffArtifact",
+    "PrefillMeasurement",
+    "PowerOutcome",
+    "PrecisionRequest",
+    "ProductionHardwareEvaluator",
+    "SimulatorObservation",
+    "SimulatorPowerEngine",
+    "capacity_from_metrics",
+    "load_terminal_numerical_rows",
+    "physical_traffic_from_metrics",
+    "precision_request",
+    "run_exact_hardware_study",
+}
+
+
+def __getattr__(name):
+    if name in _EXACT_EXPORTS:
+        from decode_dse.hardware import evaluation
+
+        return getattr(evaluation, name)
+    raise AttributeError(name)
+
+
+__all__ = [
+    "CalibratedEnergy",
+    "AblationEnvironment",
+    "ADMISSION_CORRECTNESS_SCHEMA",
+    "ADMISSION_CORRECTNESS_SCOPE",
+    "ADMISSION_NUMERICAL_VALIDATION_SCHEMA",
+    "ADMISSION_PERSISTENCE_CONTRACT",
+    "ADMISSION_VALIDATION_BASIS",
+    "AdmissionCorrectnessStatus",
+    "AttentionTopology",
+    "BootstrapInterval",
+    "BF16HeadServiceCalibration",
+    "BF16HeadServiceEstimate",
+    "BF16HeadServiceStatus",
+    "CalibrationGateReport",
+    "CalibrationPair",
+    "CalibrationThresholds",
+    "CapacityBreakdown",
+    "COMPILER_TRACE_EXECUTION_MODE",
+    "COMPILER_TRACE_TIMING_SET_SCHEMA",
+    "DECODE_EXECUTION_MODES",
+    "DocumentNLL",
+    "DecodeSimulatorBackend",
+    "EpsilonPolicy",
+    "ExactHardwareSpace",
+    "ExactHardwareStudy",
+    "ExactDCAnchor",
+    "ExactDCAnchorIndex",
+    "EXACT_DC_ANCHOR_SCHEMA",
+    "EXACT_DC_SCOPE",
+    "FidelityReport",
+    "FinalSelectionDecision",
+    "FULL_MODEL_DECODE_SCOPE",
+    "HeadServiceEvidence",
+    "HardwareCandidate",
+    "HardwareEvaluation",
+    "HardwareMetrics",
+    "HardwareWorkload",
+    "HardwareStudyArtifact",
+    "HEAD_LOGIT_MAX_ABS_ERROR",
+    "HEAD_LOGIT_MEAN_ABS_ERROR",
+    "HEAD_SERVICE_MODE",
+    "HEAD_SERVICE_SCHEMA",
+    "HEAD_TOPK_MIN_AGREEMENT",
+    "HEAD_VALIDATION_TOPK",
+    "HeadServiceMeasurement",
+    "HBMOperatingPointResolver",
+    "HBMSensitivityPoint",
+    "HBMSensitivitySchedule",
+    "HBMSensitivitySource",
+    "HBM_SENSITIVITY_BASELINE",
+    "HBM_SENSITIVITY_GENERATIONS",
+    "HBM_SENSITIVITY_OUTPUT_HEAD",
+    "HBM_SENSITIVITY_SCHEMA",
+    "HBM_SENSITIVITY_SOURCE_COUNT",
+    "JoinedHardwareResult",
+    "LEGACY_AGGREGATE_BANDWIDTH_MODE",
+    "PairedDocumentScore",
+    "PackedKVAblationGroup",
+    "PackedKVGatePolicy",
+    "PackedKVModeMeasurement",
+    "PackedKVPrecision",
+    "PackedKVPublicationEvidence",
+    "PackedKVPublicationReport",
+    "ParetoPoint",
+    "PhysicalTraffic",
+    "PrefillHandoffArtifact",
+    "PrefillMeasurement",
+    "ResourceBudget",
+    "ResourceBudgetStatus",
+    "PowerOutcome",
+    "PrecisionRequest",
+    "ProductionHardwareEvaluator",
+    "PromotionResult",
+    "PublicationCandidate",
+    "RefinementSourceSelection",
+    "SimulatorPowerStatus",
+    "SimulatorObservation",
+    "SimulatorPowerEngine",
+    "PipelineValidationEvidence",
+    "SelectorSynthesisEvidence",
+    "StudyProvenance",
+    "calibrated_area_from_simulator",
+    "calibrated_energy_from_simulator",
+    "build_hbm_sensitivity_schedule",
+    "admission_correctness_status_valid",
+    "capacity_from_metrics",
+    "clustered_nll_bootstrap",
+    "composite_system_calibration_id",
+    "head_service_status_valid",
+    "epsilon_pareto_fronts",
+    "evaluate_screening_fidelity",
+    "evaluate_packedkv_publication",
+    "expected_packedkv_bytes",
+    "load_hardware_artifact",
+    "physical_cost_signature",
+    "physical_cost_signature_id",
+    "load_admission_correctness_evidence",
+    "load_bf16_head_service_artifact",
+    "hbm_sensitivity_sources_from_hardware_rows",
+    "load_terminal_numerical_rows",
+    "load_packedkv_evidence",
+    "load_simulator_power_artifact",
+    "paired_task_bootstrap",
+    "physical_traffic_from_metrics",
+    "promote_epsilon_pareto",
+    "select_refinement_sources",
+    "precision_request",
+    "missing_admission_correctness_status",
+    "required_hardware_power_signatures",
+    "required_profile_power_signatures",
+    "run_exact_hardware_study",
+    "select_final_deployment",
+    "validate_calibration",
+    "write_selection_report",
+    "write_packedkv_report",
+    "write_hbm_sensitivity_schedule",
+]
diff --git a/decode_dse/hardware/admission_cost.py b/decode_dse/hardware/admission_cost.py
new file mode 100644
index 0000000..a1fc9ab
--- /dev/null
+++ b/decode_dse/hardware/admission_cost.py
@@ -0,0 +1,758 @@
+"""Content-addressed numerical evidence for decode-cache admission."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from decode_dse.profiles import DECODE_FORMATS, MX_BLOCK_SIZE
+
+ADMISSION_CORRECTNESS_SCHEMA = (
+    "decode-admission-correctness-evidence"
+)
+ADMISSION_PREPARATION_SCHEMA = "decode-admission-preparation"
+ADMISSION_INDEX_SCHEMA = "decode-admission-index"
+ADMISSION_NUMERICAL_VALIDATION_SCHEMA = (
+    "decode-admission-numerical-validation"
+)
+ADMISSION_CORRECTNESS_SCOPE = "bf16_to_packedkv_numerical_correctness"
+ADMISSION_VALIDATION_BASIS = (
+    "independent_source_conversion_exact_persisted_planes"
+)
+ADMISSION_PERSISTENCE_CONTRACT = (
+    "packed_planes_plus_bf16_numerical_view"
+)
+
+
+def _canonical_bytes(value: Any) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _content_hash(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _file_sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def _is_sha256(value: Any) -> bool:
+    return (
+        isinstance(value, str)
+        and len(value) == 64
+        and all(character in "0123456789abcdef" for character in value)
+    )
+
+
+def _require_sha256(name: str, value: Any) -> str:
+    if not _is_sha256(value):
+        raise ValueError(f"{name} must be a lowercase SHA-256 digest")
+    return str(value)
+
+
+def _load_immutable_json(path: Path) -> dict[str, Any]:
+    value = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise TypeError(f"{path} must contain a JSON object")
+    body = dict(value)
+    expected = body.pop("content_hash", None)
+    if expected != _content_hash(body):
+        raise ValueError(f"immutable JSON checksum mismatch: {path}")
+    return {**body, "content_hash": expected}
+
+
+@dataclass(frozen=True)
+class AdmissionCorrectnessStatus:
+    """Fail-closed admission correctness and provenance status."""
+
+    source_path: Path | None
+    receipt_sha256: str | None
+    evidence_id: str | None
+    manifest_hash: str | None
+    run_plan_hash: str | None
+    prompt_manifest_hash: str | None
+    admission_contract_id: str | None
+    admission_index_hash: str | None
+    numerical_validation_hash: str | None
+    admission_code_revision: str | None
+    runtime_environment_fingerprint: str | None
+    sample_bundle_hash: str | None
+    layout_id: str | None
+    persistence_contract: str | None
+    formats: tuple[str, ...]
+    document_count: int
+    artifact_count: int
+    tensor_count: int
+    persisted_bytes: int
+    projected_cold_artifact_bytes: int
+    projected_numerical_view_bytes: int
+    failures: tuple[str, ...]
+
+    @property
+    def passed(self) -> bool:
+        return (
+            not self.failures
+            and self.source_path is not None
+            and self.receipt_sha256 is not None
+            and self.evidence_id is not None
+            and self.manifest_hash is not None
+            and self.run_plan_hash is not None
+            and self.prompt_manifest_hash is not None
+            and self.admission_contract_id is not None
+            and self.admission_index_hash is not None
+            and self.numerical_validation_hash is not None
+            and self.admission_code_revision is not None
+            and self.runtime_environment_fingerprint is not None
+            and self.sample_bundle_hash is not None
+            and self.layout_id is not None
+            and self.persistence_contract
+            == ADMISSION_PERSISTENCE_CONTRACT
+            and bool(self.formats)
+            and self.document_count > 0
+            and self.artifact_count > 0
+            and self.tensor_count > 0
+            and self.persisted_bytes > 0
+            and self.projected_cold_artifact_bytes >= self.persisted_bytes
+            and self.projected_numerical_view_bytes > 0
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": ADMISSION_CORRECTNESS_SCHEMA,
+            "scope": ADMISSION_CORRECTNESS_SCOPE,
+            "passed": self.passed,
+            "failures": list(self.failures),
+            "receipt_sha256": self.receipt_sha256,
+            "evidence_id": self.evidence_id,
+            "manifest_hash": self.manifest_hash,
+            "run_plan_hash": self.run_plan_hash,
+            "prompt_manifest_hash": self.prompt_manifest_hash,
+            "admission_contract_id": self.admission_contract_id,
+            "admission_index_hash": self.admission_index_hash,
+            "numerical_validation_hash": self.numerical_validation_hash,
+            "admission_code_revision": self.admission_code_revision,
+            "runtime_environment_fingerprint": (
+                self.runtime_environment_fingerprint
+            ),
+            "sample_bundle_hash": self.sample_bundle_hash,
+            "layout_id": self.layout_id,
+            "persistence_contract": self.persistence_contract,
+            "formats": list(self.formats),
+            "document_count": self.document_count,
+            "artifact_count": self.artifact_count,
+            "tensor_count": self.tensor_count,
+            "persisted_bytes": self.persisted_bytes,
+            "projected_cold_artifact_bytes": (
+                self.projected_cold_artifact_bytes
+            ),
+            "projected_numerical_view_bytes": (
+                self.projected_numerical_view_bytes
+            ),
+            "source_dtype": "BF16",
+            "block_size": MX_BLOCK_SIZE,
+            "steady_state_tpot_included": False,
+            "hardware_latency_calibrated": False,
+            "hardware_energy_calibrated": False,
+            "ttft_rankable": False,
+            "admission_energy_rankable": False,
+        }
+
+
+def missing_admission_correctness_status(
+    failure: str = "missing_admission_preparation_receipt",
+) -> AdmissionCorrectnessStatus:
+    return AdmissionCorrectnessStatus(
+        source_path=None,
+        receipt_sha256=None,
+        evidence_id=None,
+        manifest_hash=None,
+        run_plan_hash=None,
+        prompt_manifest_hash=None,
+        admission_contract_id=None,
+        admission_index_hash=None,
+        numerical_validation_hash=None,
+        admission_code_revision=None,
+        runtime_environment_fingerprint=None,
+        sample_bundle_hash=None,
+        layout_id=None,
+        persistence_contract=None,
+        formats=(),
+        document_count=0,
+        artifact_count=0,
+        tensor_count=0,
+        persisted_bytes=0,
+        projected_cold_artifact_bytes=0,
+        projected_numerical_view_bytes=0,
+        failures=(failure,),
+    )
+
+
+def _validate_records(
+    records: Sequence[Any],
+    *,
+    formats: tuple[str, ...],
+) -> dict[tuple[str, str], tuple[str, str]]:
+    if not records:
+        raise ValueError("admission index has no records")
+    allowed = set(formats) | {"BF16"}
+    observed: dict[tuple[str, str], tuple[str, str]] = {}
+    artifact_ids: set[str] = set()
+    for raw in records:
+        if not isinstance(raw, Mapping):
+            raise TypeError("admission index records must be objects")
+        format_id = str(raw.get("format_id", ""))
+        if format_id not in allowed:
+            raise ValueError("admission index contains an unsupported format")
+        document_id = str(raw.get("document_id", ""))
+        if not document_id:
+            raise ValueError("admission record document_id is empty")
+        key = (format_id, document_id)
+        if key in observed:
+            raise ValueError("admission record identity is duplicated")
+        artifact_id = _require_sha256(
+            "admission artifact_id",
+            raw.get("artifact_id"),
+        )
+        source_artifact_id = _require_sha256(
+            "admission source_artifact_id",
+            raw.get("source_artifact_id"),
+        )
+        _require_sha256("admission prompt_hash", raw.get("prompt_hash"))
+        relative_path = raw.get("relative_path")
+        if not isinstance(relative_path, str) or not relative_path:
+            raise ValueError("admission record relative_path is empty")
+        if artifact_id in artifact_ids:
+            raise ValueError("admission artifact identity is duplicated")
+        artifact_ids.add(artifact_id)
+        observed[key] = (artifact_id, source_artifact_id)
+        build_seconds = raw.get("build_seconds")
+        if (
+            isinstance(build_seconds, bool)
+            or not isinstance(build_seconds, (int, float))
+            or not math.isfinite(float(build_seconds))
+            or float(build_seconds) <= 0
+        ):
+            raise ValueError("admission record build time is invalid")
+        for name in ("payload_bytes", "persisted_bytes"):
+            value = raw.get(name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or value <= 0
+            ):
+                raise ValueError(f"admission record {name} is invalid")
+    documents = {document_id for _, document_id in observed}
+    for document_id in documents:
+        document_formats = {
+            format_id
+            for format_id, observed_document in observed
+            if observed_document == document_id
+        }
+        if document_formats != allowed:
+            raise ValueError("admission record format coverage is incomplete")
+    return observed
+
+
+def _validate_numerical_records(
+    records: Sequence[Any],
+    *,
+    indexed: Mapping[tuple[str, str], tuple[str, str]],
+) -> int:
+    if len(records) != len(indexed):
+        raise ValueError("admission numerical record count differs")
+    observed: set[tuple[str, str]] = set()
+    total_tensors = 0
+    layer_counts: set[int] = set()
+    for raw in records:
+        if not isinstance(raw, Mapping):
+            raise TypeError("admission numerical records must be objects")
+        format_id = str(raw.get("format_id", ""))
+        document_id = str(raw.get("document_id", ""))
+        key = (format_id, document_id)
+        if key not in indexed or key in observed:
+            raise ValueError("admission numerical record identity differs")
+        observed.add(key)
+        artifact_id, source_artifact_id = indexed[key]
+        if (
+            raw.get("artifact_id") != artifact_id
+            or raw.get("source_artifact_id") != source_artifact_id
+        ):
+            raise ValueError("admission numerical artifact identity differs")
+        layer_count = raw.get("layer_count")
+        tensor_count = raw.get("tensor_count")
+        checks = raw.get("tensor_checks")
+        if (
+            isinstance(layer_count, bool)
+            or not isinstance(layer_count, int)
+            or layer_count <= 0
+            or isinstance(tensor_count, bool)
+            or not isinstance(tensor_count, int)
+            or tensor_count != 2 * layer_count
+            or not isinstance(checks, list)
+            or len(checks) != tensor_count
+        ):
+            raise ValueError("admission numerical tensor coverage differs")
+        layer_counts.add(layer_count)
+        expected_keys = {
+            (layer_index, role)
+            for layer_index in range(layer_count)
+            for role in ("key", "value")
+        }
+        check_keys: set[tuple[int, str]] = set()
+        for check_raw in checks:
+            if not isinstance(check_raw, Mapping):
+                raise TypeError("admission tensor checks must be objects")
+            check = dict(check_raw)
+            check_hash = check.pop("check_hash", None)
+            if check_hash != _content_hash(check):
+                raise ValueError("admission tensor-check hash differs")
+            layer_index = check.get("layer_index")
+            role = check.get("role")
+            if (
+                isinstance(layer_index, bool)
+                or not isinstance(layer_index, int)
+                or not isinstance(role, str)
+                or (layer_index, role) not in expected_keys
+                or (layer_index, role) in check_keys
+            ):
+                raise ValueError("admission tensor-check coverage differs")
+            check_keys.add((layer_index, role))
+            if (
+                check.get("format_id") != format_id
+                or check.get("exact_match") is not True
+            ):
+                raise ValueError("admission tensor exact-match proof differs")
+            for name in (
+                "source_sha256",
+                "element_sha256",
+                "scale_sha256",
+                "numerical_view_sha256",
+                "descriptor_sha256",
+            ):
+                _require_sha256(f"admission tensor {name}", check.get(name))
+        if check_keys != expected_keys:
+            raise ValueError("admission tensor-check coverage is incomplete")
+        total_tensors += tensor_count
+    if observed != set(indexed):
+        raise ValueError("admission numerical artifact coverage is incomplete")
+    if len(layer_counts) != 1:
+        raise ValueError("admission numerical layer coverage differs")
+    return total_tensors
+
+
+def _validate_resource_projection(
+    value: Any,
+    *,
+    persisted_bytes: int,
+) -> dict[str, int | float | str]:
+    if not isinstance(value, Mapping):
+        raise TypeError("admission resource projection must be an object")
+    if value.get("persistence_contract") != ADMISSION_PERSISTENCE_CONTRACT:
+        raise ValueError("admission persistence contract differs")
+    integer_fields = (
+        "artifact_space_reserve_bytes",
+        "projected_element_plane_bytes",
+        "projected_scale_plane_bytes",
+        "projected_numerical_view_bytes",
+        "projected_metadata_reserve_bytes",
+        "projected_cold_artifact_bytes",
+        "required_cold_capacity_bytes",
+        "observed_cold_available_bytes",
+        "projected_peak_host_bytes",
+        "required_host_bytes",
+        "observed_host_available_bytes",
+    )
+    integers: dict[str, int] = {}
+    for name in integer_fields:
+        field = value.get(name)
+        if (
+            isinstance(field, bool)
+            or not isinstance(field, int)
+            or field < 0
+        ):
+            raise ValueError(f"admission resource {name} is invalid")
+        integers[name] = field
+    safety_factor = value.get("artifact_space_safety_factor")
+    if (
+        isinstance(safety_factor, bool)
+        or not isinstance(safety_factor, (int, float))
+        or not math.isfinite(float(safety_factor))
+        or float(safety_factor) < 1.0
+    ):
+        raise ValueError("admission resource safety factor is invalid")
+    projected = sum(
+        integers[name]
+        for name in (
+            "projected_element_plane_bytes",
+            "projected_scale_plane_bytes",
+            "projected_numerical_view_bytes",
+            "projected_metadata_reserve_bytes",
+        )
+    )
+    minimum_capacity = (
+        math.ceil(projected * float(safety_factor))
+        + integers["artifact_space_reserve_bytes"]
+    )
+    if (
+        projected <= 0
+        or integers["projected_numerical_view_bytes"] <= 0
+        or integers["projected_cold_artifact_bytes"] != projected
+        or integers["projected_cold_artifact_bytes"] < persisted_bytes
+        or integers["required_cold_capacity_bytes"] < minimum_capacity
+        or integers["observed_cold_available_bytes"]
+        < integers["required_cold_capacity_bytes"]
+        or integers["required_host_bytes"]
+        < integers["projected_peak_host_bytes"]
+        or integers["observed_host_available_bytes"]
+        < integers["required_host_bytes"]
+    ):
+        raise ValueError("admission resource projection is inconsistent")
+    return {
+        "persistence_contract": str(value["persistence_contract"]),
+        "artifact_space_safety_factor": float(safety_factor),
+        **integers,
+    }
+
+
+def load_admission_correctness_evidence(
+    path: str | Path,
+    *,
+    manifest_hash: str,
+    required_formats: Sequence[str] = DECODE_FORMATS,
+) -> AdmissionCorrectnessStatus:
+    """Validate one numerical admission receipt and its immutable index."""
+
+    source = Path(path).resolve()
+    receipt_sha256: str | None = None
+    try:
+        _require_sha256("manifest_hash", manifest_hash)
+        receipt_sha256 = _file_sha256(source)
+        receipt = _load_immutable_json(source)
+        if (
+            receipt.get("schema_version")
+            != ADMISSION_PREPARATION_SCHEMA
+        ):
+            raise ValueError("unsupported admission preparation schema")
+        if receipt.get("manifest_hash") != manifest_hash:
+            raise ValueError("admission receipt manifest identity mismatch")
+        formats = tuple(str(value) for value in required_formats)
+        if formats != tuple(DECODE_FORMATS):
+            raise ValueError("required admission formats are invalid")
+        run_plan_hash = _require_sha256(
+            "admission run_plan_hash",
+            receipt.get("run_plan_hash"),
+        )
+        prompt_manifest_hash = _require_sha256(
+            "admission prompt_manifest_hash",
+            receipt.get("prompt_manifest_hash"),
+        )
+        runtime_fingerprint = _require_sha256(
+            "admission runtime_environment_fingerprint",
+            receipt.get("runtime_environment_fingerprint"),
+        )
+        contract_id = str(receipt.get("admission_contract_id", ""))
+        index_hash = _require_sha256(
+            "admission_index_hash",
+            receipt.get("admission_index_hash"),
+        )
+        validation_hash = _require_sha256(
+            "numerical_validation_hash",
+            receipt.get("numerical_validation_hash"),
+        )
+        if not contract_id:
+            raise ValueError("admission receipt identities are incomplete")
+        raw_index_path = Path(
+            str(receipt.get("admission_index_path", ""))
+        )
+        index_path = (
+            raw_index_path
+            if raw_index_path.is_absolute()
+            else source.parent / raw_index_path
+        ).resolve()
+        index = _load_immutable_json(index_path)
+        if index.get("content_hash") != index_hash:
+            raise ValueError("admission index hash differs from its receipt")
+        if index.get("schema_version") != ADMISSION_INDEX_SCHEMA:
+            raise ValueError("unsupported admission index schema")
+        if index.get("admission_contract_id") != contract_id:
+            raise ValueError("admission contract identities differ")
+        admission_code_revision = _require_sha256(
+            "admission_code_revision",
+            index.get("admission_code_revision"),
+        )
+        index_runtime_fingerprint = _require_sha256(
+            "admission index runtime_environment_fingerprint",
+            index.get("runtime_environment_fingerprint"),
+        )
+        sample_bundle_hash = _require_sha256(
+            "admission sample_bundle_hash",
+            index.get("sample_bundle_hash"),
+        )
+        if index_runtime_fingerprint != runtime_fingerprint:
+            raise ValueError("admission runtime identities differ")
+        if int(index.get("block_size", -1)) != MX_BLOCK_SIZE:
+            raise ValueError("admission index uses a non-native block size")
+        if tuple(index.get("quantized_formats", ())) != formats:
+            raise ValueError("admission format coverage differs")
+        if tuple(index.get("reference_formats", ())) != ("BF16",):
+            raise ValueError("admission BF16 reference coverage differs")
+        layout_id = str(index.get("layout_id", ""))
+        if not layout_id:
+            raise ValueError("admission layout identity is empty")
+        records = index.get("records")
+        if not isinstance(records, list):
+            raise TypeError("admission index records must be a list")
+        indexed = _validate_records(records, formats=formats)
+        document_count = len(
+            {document_id for _, document_id in indexed}
+        )
+        persisted_bytes = sum(
+            int(record["persisted_bytes"]) for record in records
+        )
+        payload_bytes = sum(
+            int(record["payload_bytes"]) for record in records
+        )
+        if (
+            int(receipt.get("artifact_count", -1)) != len(records)
+            or int(index.get("artifact_count", -2)) != len(records)
+            or int(receipt.get("document_count", -1)) != document_count
+            or int(index.get("document_count", -2)) != document_count
+            or int(receipt.get("quantized_format_count", -1))
+            != len(formats)
+            or int(receipt.get("persisted_bytes", -1))
+            != persisted_bytes
+            or int(index.get("persisted_bytes", -2))
+            != persisted_bytes
+            or int(index.get("payload_bytes", -1)) != payload_bytes
+            or receipt.get("resource_projection")
+            != index.get("resource_projection")
+        ):
+            raise ValueError("admission aggregate counts differ")
+        resources = _validate_resource_projection(
+            index.get("resource_projection"),
+            persisted_bytes=persisted_bytes,
+        )
+        raw_validation_path = Path(
+            str(receipt.get("numerical_validation_path", ""))
+        )
+        validation_path = (
+            raw_validation_path
+            if raw_validation_path.is_absolute()
+            else source.parent / raw_validation_path
+        ).resolve()
+        validation = _load_immutable_json(validation_path)
+        if validation.get("content_hash") != validation_hash:
+            raise ValueError(
+                "admission numerical validation hash differs from its receipt"
+            )
+        if (
+            validation.get("schema_version")
+            != ADMISSION_NUMERICAL_VALIDATION_SCHEMA
+            or validation.get("passed") is not True
+            or validation.get("basis") != ADMISSION_VALIDATION_BASIS
+            or validation.get("admission_index_hash") != index_hash
+            or validation.get("admission_contract_id") != contract_id
+            or validation.get("admission_code_revision")
+            != admission_code_revision
+            or validation.get("runtime_environment_fingerprint")
+            != runtime_fingerprint
+            or validation.get("sample_bundle_hash") != sample_bundle_hash
+            or validation.get("layout_id") != layout_id
+            or validation.get("source_dtype") != "BF16"
+            or int(validation.get("block_size", -1)) != MX_BLOCK_SIZE
+            or tuple(validation.get("quantized_formats", ())) != formats
+            or tuple(validation.get("reference_formats", ())) != ("BF16",)
+            or validation.get("steady_state_tpot_included") is not False
+        ):
+            raise ValueError("admission numerical validation contract differs")
+        numerical_records = validation.get("records")
+        if not isinstance(numerical_records, list):
+            raise TypeError("admission numerical records must be a list")
+        tensor_count = _validate_numerical_records(
+            numerical_records,
+            indexed=indexed,
+        )
+        if (
+            int(validation.get("artifact_count", -1)) != len(indexed)
+            or int(validation.get("document_count", -1)) != document_count
+            or int(validation.get("tensor_count", -1)) != tensor_count
+        ):
+            raise ValueError("admission numerical aggregate counts differ")
+        evidence_id = "admission-correctness-" + _content_hash(
+            {
+                "receipt_sha256": receipt_sha256,
+                "receipt_content_hash": receipt["content_hash"],
+                "admission_index_hash": index_hash,
+                "numerical_validation_hash": validation_hash,
+                "manifest_hash": manifest_hash,
+                "run_plan_hash": run_plan_hash,
+                "prompt_manifest_hash": prompt_manifest_hash,
+                "admission_contract_id": contract_id,
+                "admission_code_revision": admission_code_revision,
+                "runtime_environment_fingerprint": runtime_fingerprint,
+                "sample_bundle_hash": sample_bundle_hash,
+                "layout_id": layout_id,
+                "formats": formats,
+                "document_count": document_count,
+                "artifact_count": len(indexed),
+                "tensor_count": tensor_count,
+                "persistence_contract": resources[
+                    "persistence_contract"
+                ],
+                "persisted_bytes": persisted_bytes,
+                "projected_cold_artifact_bytes": resources[
+                    "projected_cold_artifact_bytes"
+                ],
+                "projected_numerical_view_bytes": resources[
+                    "projected_numerical_view_bytes"
+                ],
+            }
+        )
+        return AdmissionCorrectnessStatus(
+            source_path=source,
+            receipt_sha256=receipt_sha256,
+            evidence_id=evidence_id,
+            manifest_hash=manifest_hash,
+            run_plan_hash=run_plan_hash,
+            prompt_manifest_hash=prompt_manifest_hash,
+            admission_contract_id=contract_id,
+            admission_index_hash=index_hash,
+            numerical_validation_hash=validation_hash,
+            admission_code_revision=admission_code_revision,
+            runtime_environment_fingerprint=runtime_fingerprint,
+            sample_bundle_hash=sample_bundle_hash,
+            layout_id=layout_id,
+            persistence_contract=str(
+                resources["persistence_contract"]
+            ),
+            formats=formats,
+            document_count=document_count,
+            artifact_count=len(indexed),
+            tensor_count=tensor_count,
+            persisted_bytes=persisted_bytes,
+            projected_cold_artifact_bytes=int(
+                resources["projected_cold_artifact_bytes"]
+            ),
+            projected_numerical_view_bytes=int(
+                resources["projected_numerical_view_bytes"]
+            ),
+            failures=(),
+        )
+    except Exception as exc:
+        return AdmissionCorrectnessStatus(
+            source_path=source,
+            receipt_sha256=receipt_sha256,
+            evidence_id=None,
+            manifest_hash=None,
+            run_plan_hash=None,
+            prompt_manifest_hash=None,
+            admission_contract_id=None,
+            admission_index_hash=None,
+            numerical_validation_hash=None,
+            admission_code_revision=None,
+            runtime_environment_fingerprint=None,
+            sample_bundle_hash=None,
+            layout_id=None,
+            persistence_contract=None,
+            formats=(),
+            document_count=0,
+            artifact_count=0,
+            tensor_count=0,
+            persisted_bytes=0,
+            projected_cold_artifact_bytes=0,
+            projected_numerical_view_bytes=0,
+            failures=(f"{type(exc).__name__}: {exc}",),
+        )
+
+
+def admission_correctness_status_valid(value: Mapping[str, Any]) -> bool:
+    """Return whether a serialized status proves numerical admission only."""
+
+    evidence_id = value.get("evidence_id")
+    formats = value.get("formats")
+    document_count = value.get("document_count")
+    artifact_count = value.get("artifact_count")
+    tensor_count = value.get("tensor_count")
+    persisted_bytes = value.get("persisted_bytes")
+    projected_bytes = value.get("projected_cold_artifact_bytes")
+    numerical_view_bytes = value.get("projected_numerical_view_bytes")
+    return (
+        value.get("schema_version")
+        == ADMISSION_CORRECTNESS_SCHEMA
+        and value.get("scope") == ADMISSION_CORRECTNESS_SCOPE
+        and value.get("passed") is True
+        and value.get("failures") == []
+        and isinstance(evidence_id, str)
+        and evidence_id.startswith("admission-correctness-")
+        and _is_sha256(evidence_id.removeprefix("admission-correctness-"))
+        and all(
+            _is_sha256(value.get(name))
+            for name in (
+                "receipt_sha256",
+                "manifest_hash",
+                "run_plan_hash",
+                "prompt_manifest_hash",
+                "admission_index_hash",
+                "numerical_validation_hash",
+                "admission_code_revision",
+                "runtime_environment_fingerprint",
+                "sample_bundle_hash",
+            )
+        )
+        and isinstance(value.get("admission_contract_id"), str)
+        and bool(value.get("admission_contract_id"))
+        and isinstance(value.get("layout_id"), str)
+        and bool(value.get("layout_id"))
+        and value.get("persistence_contract")
+        == ADMISSION_PERSISTENCE_CONTRACT
+        and formats == list(DECODE_FORMATS)
+        and isinstance(document_count, int)
+        and not isinstance(document_count, bool)
+        and document_count > 0
+        and isinstance(artifact_count, int)
+        and not isinstance(artifact_count, bool)
+        and artifact_count == document_count * (len(DECODE_FORMATS) + 1)
+        and isinstance(tensor_count, int)
+        and not isinstance(tensor_count, bool)
+        and tensor_count >= artifact_count * 2
+        and tensor_count % (artifact_count * 2) == 0
+        and isinstance(persisted_bytes, int)
+        and not isinstance(persisted_bytes, bool)
+        and persisted_bytes > 0
+        and isinstance(projected_bytes, int)
+        and not isinstance(projected_bytes, bool)
+        and projected_bytes >= persisted_bytes
+        and isinstance(numerical_view_bytes, int)
+        and not isinstance(numerical_view_bytes, bool)
+        and numerical_view_bytes > 0
+        and value.get("source_dtype") == "BF16"
+        and value.get("block_size") == MX_BLOCK_SIZE
+        and value.get("steady_state_tpot_included") is False
+        and value.get("hardware_latency_calibrated") is False
+        and value.get("hardware_energy_calibrated") is False
+        and value.get("ttft_rankable") is False
+        and value.get("admission_energy_rankable") is False
+    )
+
+
+__all__ = [
+    "ADMISSION_CORRECTNESS_SCHEMA",
+    "ADMISSION_CORRECTNESS_SCOPE",
+    "ADMISSION_NUMERICAL_VALIDATION_SCHEMA",
+    "ADMISSION_PERSISTENCE_CONTRACT",
+    "ADMISSION_VALIDATION_BASIS",
+    "AdmissionCorrectnessStatus",
+    "admission_correctness_status_valid",
+    "load_admission_correctness_evidence",
+    "missing_admission_correctness_status",
+]
diff --git a/decode_dse/hardware/calibration.py b/decode_dse/hardware/calibration.py
new file mode 100644
index 0000000..e38ab17
--- /dev/null
+++ b/decode_dse/hardware/calibration.py
@@ -0,0 +1,273 @@
+"""Holdout validation gates for calibrated area, power, and timing models."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import statistics
+from dataclasses import dataclass
+from typing import Any, Iterable, Mapping, Sequence
+
+from decode_dse.hardware.statistics import spearman_rank_correlation
+
+CALIBRATION_REPORT_SCHEMA = "decode-calibration-report"
+
+
+def _canonical_hash(value: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+@dataclass(frozen=True)
+class CalibrationPair:
+    """One positive measured/predicted holdout pair."""
+
+    label: str
+    measured: float
+    predicted: float
+
+    def __post_init__(self) -> None:
+        if not self.label:
+            raise ValueError("calibration labels must be non-empty")
+        if not math.isfinite(self.measured) or self.measured <= 0:
+            raise ValueError("measured values must be positive and finite")
+        if not math.isfinite(self.predicted) or self.predicted < 0:
+            raise ValueError("predicted values must be non-negative and finite")
+
+    @property
+    def absolute_relative_error(self) -> float:
+        return abs(self.predicted - self.measured) / self.measured
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "label": self.label,
+            "measured": self.measured,
+            "predicted": self.predicted,
+            "absolute_relative_error": self.absolute_relative_error,
+        }
+
+
+@dataclass(frozen=True)
+class CalibrationThresholds:
+    area_median_error: float = 0.10
+    area_max_error: float = 0.15
+    dynamic_power_median_error: float = 0.15
+    dynamic_power_max_error: float = 0.25
+    leakage_power_median_error: float = 0.15
+    leakage_power_max_error: float = 0.25
+    ranking_correlation: float = 0.90
+    cycle_max_error: float = 0.05
+    latency_mape: float = 0.10
+
+    def __post_init__(self) -> None:
+        for name, value in self.to_dict().items():
+            if not math.isfinite(value) or value < 0:
+                raise ValueError(f"{name} must be finite and non-negative")
+        if self.ranking_correlation > 1:
+            raise ValueError("ranking_correlation cannot exceed one")
+
+    def to_dict(self) -> dict[str, float]:
+        return {
+            "area_median_error": self.area_median_error,
+            "area_max_error": self.area_max_error,
+            "dynamic_power_median_error": self.dynamic_power_median_error,
+            "dynamic_power_max_error": self.dynamic_power_max_error,
+            "leakage_power_median_error": self.leakage_power_median_error,
+            "leakage_power_max_error": self.leakage_power_max_error,
+            "ranking_correlation": self.ranking_correlation,
+            "cycle_max_error": self.cycle_max_error,
+            "latency_mape": self.latency_mape,
+        }
+
+
+@dataclass(frozen=True)
+class CalibrationGateReport:
+    """Publication gate and its complete holdout diagnostics."""
+
+    passed: bool
+    coverage_complete: bool
+    missing_signatures: tuple[str, ...]
+    area_median_error: float | None
+    area_max_error: float | None
+    dynamic_power_median_error: float | None
+    dynamic_power_max_error: float | None
+    leakage_power_median_error: float | None
+    leakage_power_max_error: float | None
+    ranking_correlation: float | None
+    cycle_max_error: float | None
+    latency_mape: float | None
+    failures: tuple[str, ...]
+    thresholds: CalibrationThresholds
+    observations_hash: str
+    schema_version: str = CALIBRATION_REPORT_SCHEMA
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "passed": self.passed,
+            "coverage_complete": self.coverage_complete,
+            "missing_signatures": list(self.missing_signatures),
+            "area_median_error": self.area_median_error,
+            "area_max_error": self.area_max_error,
+            "dynamic_power_median_error": self.dynamic_power_median_error,
+            "dynamic_power_max_error": self.dynamic_power_max_error,
+            "leakage_power_median_error": self.leakage_power_median_error,
+            "leakage_power_max_error": self.leakage_power_max_error,
+            "ranking_correlation": self.ranking_correlation,
+            "cycle_max_error": self.cycle_max_error,
+            "latency_mape": self.latency_mape,
+            "failures": list(self.failures),
+            "thresholds": self.thresholds.to_dict(),
+            "observations_hash": self.observations_hash,
+        }
+
+    @property
+    def calibration_id(self) -> str:
+        return f"dc-cal-{_canonical_hash(self.to_dict())}"
+
+
+def _unique_pairs(
+    values: Iterable[CalibrationPair],
+    category: str,
+) -> tuple[CalibrationPair, ...]:
+    pairs = tuple(sorted(values, key=lambda pair: pair.label))
+    labels = [pair.label for pair in pairs]
+    if len(labels) != len(set(labels)):
+        raise ValueError(f"duplicate {category} holdout labels")
+    return pairs
+
+
+def _errors(
+    pairs: Sequence[CalibrationPair],
+) -> tuple[float | None, float | None]:
+    if not pairs:
+        return None, None
+    values = [pair.absolute_relative_error for pair in pairs]
+    return statistics.median(values), max(values)
+
+
+def validate_calibration(
+    *,
+    area: Iterable[CalibrationPair],
+    dynamic_power: Iterable[CalibrationPair],
+    leakage_power: Iterable[CalibrationPair],
+    cycles: Iterable[CalibrationPair],
+    latency: Iterable[CalibrationPair],
+    required_signatures: Iterable[str],
+    measured_signatures: Iterable[str],
+    thresholds: CalibrationThresholds = CalibrationThresholds(),
+) -> CalibrationGateReport:
+    """Apply all holdout and signature-coverage gates without imputation."""
+
+    area_pairs = _unique_pairs(area, "area")
+    power_pairs = _unique_pairs(dynamic_power, "dynamic power")
+    leakage_pairs = _unique_pairs(leakage_power, "leakage power")
+    cycle_pairs = _unique_pairs(cycles, "cycle")
+    latency_pairs = _unique_pairs(latency, "latency")
+    required = tuple(sorted({str(value) for value in required_signatures}))
+    measured = frozenset(str(value) for value in measured_signatures)
+    missing = tuple(value for value in required if value not in measured)
+
+    area_median, area_max = _errors(area_pairs)
+    power_median, power_max = _errors(power_pairs)
+    leakage_median, leakage_max = _errors(leakage_pairs)
+    _, cycle_max = _errors(cycle_pairs)
+    latency_mape, _ = _errors(latency_pairs)
+    rank = (
+        spearman_rank_correlation(
+            [pair.measured for pair in power_pairs],
+            [pair.predicted for pair in power_pairs],
+        )
+        if (
+            len(power_pairs) >= 2
+            and len({pair.measured for pair in power_pairs}) >= 2
+            and len({pair.predicted for pair in power_pairs}) >= 2
+        )
+        else None
+    )
+
+    failures: list[str] = []
+    if not required:
+        failures.append("signature_requirements")
+    if missing:
+        failures.append("signature_coverage")
+    for category, pairs in (
+        ("area_holdouts", area_pairs),
+        ("dynamic_power_holdouts", power_pairs),
+        ("leakage_power_holdouts", leakage_pairs),
+        ("cycle_holdouts", cycle_pairs),
+        ("latency_holdouts", latency_pairs),
+    ):
+        if len(pairs) < 2:
+            failures.append(category)
+    if area_median is not None and area_median > thresholds.area_median_error:
+        failures.append("area_median_error")
+    if area_max is not None and area_max > thresholds.area_max_error:
+        failures.append("area_max_error")
+    if (
+        power_median is not None
+        and power_median > thresholds.dynamic_power_median_error
+    ):
+        failures.append("dynamic_power_median_error")
+    if power_max is not None and power_max > thresholds.dynamic_power_max_error:
+        failures.append("dynamic_power_max_error")
+    if (
+        leakage_median is not None
+        and leakage_median > thresholds.leakage_power_median_error
+    ):
+        failures.append("leakage_power_median_error")
+    if (
+        leakage_max is not None
+        and leakage_max > thresholds.leakage_power_max_error
+    ):
+        failures.append("leakage_power_max_error")
+    if rank is None or rank < thresholds.ranking_correlation:
+        failures.append("ranking_correlation")
+    if cycle_max is not None and cycle_max > thresholds.cycle_max_error:
+        failures.append("cycle_max_error")
+    if latency_mape is not None and latency_mape > thresholds.latency_mape:
+        failures.append("latency_mape")
+
+    observation_content = {
+        "area": [pair.to_dict() for pair in area_pairs],
+        "dynamic_power": [pair.to_dict() for pair in power_pairs],
+        "leakage_power": [pair.to_dict() for pair in leakage_pairs],
+        "cycles": [pair.to_dict() for pair in cycle_pairs],
+        "latency": [pair.to_dict() for pair in latency_pairs],
+        "required_signatures": list(required),
+        "measured_signatures": sorted(measured),
+        "thresholds": thresholds.to_dict(),
+    }
+    return CalibrationGateReport(
+        passed=not failures,
+        coverage_complete=not missing,
+        missing_signatures=missing,
+        area_median_error=area_median,
+        area_max_error=area_max,
+        dynamic_power_median_error=power_median,
+        dynamic_power_max_error=power_max,
+        leakage_power_median_error=leakage_median,
+        leakage_power_max_error=leakage_max,
+        ranking_correlation=rank,
+        cycle_max_error=cycle_max,
+        latency_mape=latency_mape,
+        failures=tuple(failures),
+        thresholds=thresholds,
+        observations_hash=_canonical_hash(observation_content),
+    )
+
+
+__all__ = [
+    "CALIBRATION_REPORT_SCHEMA",
+    "CalibrationGateReport",
+    "CalibrationPair",
+    "CalibrationThresholds",
+    "validate_calibration",
+]
diff --git a/decode_dse/hardware/design_space.py b/decode_dse/hardware/design_space.py
new file mode 100644
index 0000000..940f070
--- /dev/null
+++ b/decode_dse/hardware/design_space.py
@@ -0,0 +1,5452 @@
+"""Exact, provenance-bound hardware enumeration for decode results."""
+
+from __future__ import annotations
+
+import hashlib
+import heapq
+import itertools
+import json
+import math
+import os
+import tempfile
+from dataclasses import dataclass, field, replace
+from pathlib import Path
+from typing import Any, ClassVar, Iterable, Iterator, Mapping, Protocol, Sequence
+
+from decode_dse.legality import (
+    DEFAULT_PACKED_KV_TARGET,
+    PackedKVRuntimeTarget,
+    evaluate_stack_capability,
+    scope_stack_validity,
+)
+from decode_dse.hardware.admission_cost import (
+    admission_correctness_status_valid,
+)
+from decode_dse.hardware.lm_head_service import (
+    BF16HeadServiceEstimate,
+    HEAD_SERVICE_MODE,
+    head_service_status_valid,
+)
+from decode_dse.legality import StackValidity
+from decode_dse.manifest import SweepManifest, SweepManifestEntry
+from decode_dse.profiles import (
+    PROFILE_KIND_BF16_REFERENCE,
+    VECTOR_FORMATS,
+    format_descriptor,
+)
+
+HARDWARE_STUDY_SCHEMA = "decode-hardware-study"
+HARDWARE_RESULT_SCHEMA = "decode-hardware-result"
+HARDWARE_FACTOR_RESULT_SCHEMA = "decode-hardware-factor-result"
+HARDWARE_FACTOR_BINDING_SCHEMA = "decode-hardware-factor-binding"
+HARDWARE_ARTIFACT_SCHEMA = "decode-hardware-artifact"
+HARDWARE_STORAGE_REVISION = "factorized-exact"
+LEGACY_COMPACT_STORAGE_REVISION = "compact-exact"
+HARDWARE_SCATTER_SAMPLE_LIMIT = 4096
+HARDWARE_RETENTION_LABELS = frozenset(
+    {
+        "profile_frontier",
+        "profile_fastest",
+        "profile_lowest_energy",
+        "profile_best_edp",
+        "exact_frontier",
+        "exact_fastest",
+        "exact_lowest_energy",
+        "exact_best_edp",
+        "sampled_dominated",
+        "sampled_unrankable",
+        "legacy_full_row",
+    }
+)
+PHYSICAL_TRAFFIC_KEYS = frozenset(
+    {
+        "weight_element_read_bytes",
+        "weight_scale_read_bytes",
+        "bf16_weight_read_bytes",
+        "activation_read_bytes",
+        "activation_write_bytes",
+        "kv_element_read_bytes",
+        "kv_scale_read_bytes",
+        "kv_element_write_bytes",
+        "kv_scale_write_bytes",
+    }
+)
+_VALIDITY_FIELDS = (
+    "software_valid",
+    "compiler_valid",
+    "emulator_valid",
+    "rtl_valid",
+    "dc_calibrated",
+)
+STEP_COMPOSITION = "max_compute_memory"
+COMPILER_TRACE_EXECUTION_MODE = "compiler_trace"
+LEGACY_AGGREGATE_BANDWIDTH_MODE = "legacy_aggregate_bandwidth"
+COMPILER_TRACE_TIMING_SET_SCHEMA = "plena-compiler-trace-timing-set-v1"
+FULL_MODEL_DECODE_SCOPE = (
+    "full_model_decode_step_independent_request_batch"
+)
+DECODE_EXECUTION_MODES = frozenset(
+    {
+        COMPILER_TRACE_EXECUTION_MODE,
+        LEGACY_AGGREGATE_BANDWIDTH_MODE,
+    }
+)
+COMPILER_TRACE_TIMING_TIER = "compiler_trace_request_calibrated"
+STAGE_CALIBRATED_ANALYTIC_TIMING_TIER = "stage_calibrated_analytic"
+PUBLICATION_TIMING_TIERS = frozenset(
+    {
+        COMPILER_TRACE_TIMING_TIER,
+        STAGE_CALIBRATED_ANALYTIC_TIMING_TIER,
+    }
+)
+
+CHIP_COUNTS = (1, 2, 4, 8, 16)
+SRAM_POLICIES = (
+    "streaming",
+    "projection_resident",
+    "kv_resident_25",
+    "kv_resident_50",
+    "kv_resident_75",
+    "kv_resident_100",
+)
+DEFAULT_REFERENCE_CHIP_COUNT = 4
+DEFAULT_REFERENCE_DIE_AREA_MM2 = 826.0
+DEFAULT_REFERENCE_HBM_CAPACITY_BYTES = 80_000_000_000
+DEFAULT_REFERENCE_HBM_BANDWIDTH_BYTES_PER_S = 2.039e12
+DEFAULT_AREA_MARGIN = 1.10
+DEFAULT_FP_SRAM_DEPTH = 512
+SOFTMAX_CONSTANT_SLOTS = 6
+SOFTMAX_STATE_VALUES_PER_ROW = 3
+
+def _canonical_bytes(value: Any, *, newline: bool = False) -> bytes:
+    suffix = "\n" if newline else ""
+    return (
+        json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        )
+        + suffix
+    ).encode("utf-8")
+
+
+def _content_hash(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _require_finite(name: str, value: float, *, positive: bool = False) -> None:
+    if not math.isfinite(value):
+        raise ValueError(f"{name} must be finite")
+    if positive and value <= 0:
+        raise ValueError(f"{name} must be positive")
+    if not positive and value < 0:
+        raise ValueError(f"{name} must be non-negative")
+
+
+def _canonical_trace_timing_set(
+    execution_mode: str,
+    evidence: Mapping[str, Any] | None,
+    timing_evidence_id: str | None,
+) -> dict[str, Any] | None:
+    """Validate the sealed request set carried by compiler-trace timing."""
+
+    if execution_mode not in DECODE_EXECUTION_MODES:
+        raise ValueError("unsupported decode execution mode")
+    if execution_mode == LEGACY_AGGREGATE_BANDWIDTH_MODE:
+        if evidence is not None:
+            raise ValueError("legacy timing cannot carry compiler-trace evidence")
+        return None
+    if not isinstance(evidence, Mapping):
+        raise ValueError("compiler timing requires request-set evidence")
+    canonical = json.loads(_canonical_bytes(dict(evidence)))
+    required = {
+        "schema_version",
+        "execution_mode",
+        "artifact_scope",
+        "request_count",
+        "compiler_input_descriptor_sha256",
+        "compiler_lowering_key_sha256",
+        "compiler_artifact_set_sha256",
+        "request_set_sha256",
+        "compiler_source_sha256",
+        "latency_library_sha256",
+        "request_memory_sidecar_set_sha256",
+        "request_memory_calibration_ids",
+        "step_composition",
+    }
+    if set(canonical) != required:
+        raise ValueError("compiler timing request-set fields differ from schema")
+    if canonical["schema_version"] != COMPILER_TRACE_TIMING_SET_SCHEMA:
+        raise ValueError("unsupported compiler timing request-set schema")
+    if canonical["execution_mode"] != COMPILER_TRACE_EXECUTION_MODE:
+        raise ValueError("compiler timing execution mode is inconsistent")
+    if canonical["artifact_scope"] != FULL_MODEL_DECODE_SCOPE:
+        raise ValueError("compiler timing lacks full-model decode scope")
+    request_count = canonical["request_count"]
+    if (
+        isinstance(request_count, bool)
+        or not isinstance(request_count, int)
+        or request_count <= 0
+    ):
+        raise ValueError("compiler timing request count must be positive")
+    for name in (
+        "compiler_input_descriptor_sha256",
+        "compiler_lowering_key_sha256",
+        "compiler_artifact_set_sha256",
+        "request_set_sha256",
+        "compiler_source_sha256",
+        "latency_library_sha256",
+        "request_memory_sidecar_set_sha256",
+    ):
+        value = canonical[name]
+        if (
+            not isinstance(value, str)
+            or len(value) != 64
+            or any(character not in "0123456789abcdef" for character in value)
+        ):
+            raise ValueError(f"{name} must be a lowercase SHA-256 digest")
+    calibration_ids = canonical["request_memory_calibration_ids"]
+    if (
+        not isinstance(calibration_ids, list)
+        or not calibration_ids
+        or calibration_ids != sorted(set(calibration_ids))
+        or any(
+            not isinstance(value, str)
+            or not value.startswith("request-latency-")
+            or len(value) != len("request-latency-") + 64
+            or any(
+                character not in "0123456789abcdef"
+                for character in value[len("request-latency-") :]
+            )
+            for value in calibration_ids
+        )
+    ):
+        raise ValueError("request-memory calibration identities are invalid")
+    if canonical["step_composition"] != STEP_COMPOSITION:
+        raise ValueError("compiler timing step composition is unsupported")
+    expected_id = "compiler-trace-timing-" + _content_hash(canonical)
+    if timing_evidence_id != expected_id:
+        raise ValueError("compiler timing evidence identity is inconsistent")
+    return canonical
+
+
+def _ordered_positive(values: Sequence[int], name: str) -> tuple[int, ...]:
+    ordered = tuple(sorted({int(value) for value in values}))
+    if not ordered or any(value <= 0 for value in ordered):
+        raise ValueError(f"{name} must contain positive integers")
+    return ordered
+
+
+def _positive_sequence(value: Any, name: str) -> tuple[int, ...]:
+    if isinstance(value, (int, float)) and not isinstance(value, bool):
+        value = (int(value),)
+    if isinstance(value, (str, bytes)) or not isinstance(value, Sequence):
+        raise TypeError(f"{name} must be an integer or integer sequence")
+    return _ordered_positive(value, name)
+
+
+def _boolean_sequence(value: Any, name: str) -> tuple[bool, ...]:
+    if isinstance(value, bool):
+        value = (value,)
+    if isinstance(value, (str, bytes)) or not isinstance(value, Sequence):
+        raise TypeError(f"{name} must be a boolean or boolean sequence")
+    if not value or any(not isinstance(item, bool) for item in value):
+        raise TypeError(f"{name} must contain booleans")
+    return tuple(item for item in (False, True) if item in value)
+
+
+def _normalise_sram_policy(value: str) -> str:
+    token = str(value).strip().casefold().replace("-", "_").replace("%", "")
+    aliases = {
+        "projection": "projection_resident",
+        "25": "kv_resident_25",
+        "50": "kv_resident_50",
+        "75": "kv_resident_75",
+        "100": "kv_resident_100",
+        "kv_25": "kv_resident_25",
+        "kv_50": "kv_resident_50",
+        "kv_75": "kv_resident_75",
+        "kv_100": "kv_resident_100",
+    }
+    token = aliases.get(token, token)
+    if token not in SRAM_POLICIES:
+        raise ValueError(f"unsupported SRAM policy {value!r}")
+    return token
+
+
+@dataclass(frozen=True)
+class ResourceBudget:
+    """Matched aggregate limits used by the hardware study."""
+
+    aggregate_area_limit_mm2: float = (
+        DEFAULT_REFERENCE_CHIP_COUNT
+        * DEFAULT_AREA_MARGIN
+        * DEFAULT_REFERENCE_DIE_AREA_MM2
+    )
+    aggregate_hbm_capacity_limit_bytes: int = (
+        DEFAULT_REFERENCE_CHIP_COUNT
+        * DEFAULT_REFERENCE_HBM_CAPACITY_BYTES
+    )
+    aggregate_hbm_bandwidth_limit_bytes_per_s: float = (
+        DEFAULT_REFERENCE_CHIP_COUNT
+        * DEFAULT_REFERENCE_HBM_BANDWIDTH_BYTES_PER_S
+    )
+    reference_system: str = "A100x4"
+
+    def __post_init__(self) -> None:
+        _require_finite(
+            "aggregate_area_limit_mm2",
+            float(self.aggregate_area_limit_mm2),
+            positive=True,
+        )
+        if (
+            isinstance(self.aggregate_hbm_capacity_limit_bytes, bool)
+            or not isinstance(self.aggregate_hbm_capacity_limit_bytes, int)
+            or self.aggregate_hbm_capacity_limit_bytes <= 0
+        ):
+            raise ValueError(
+                "aggregate_hbm_capacity_limit_bytes must be positive"
+            )
+        _require_finite(
+            "aggregate_hbm_bandwidth_limit_bytes_per_s",
+            float(self.aggregate_hbm_bandwidth_limit_bytes_per_s),
+            positive=True,
+        )
+        if not self.reference_system:
+            raise ValueError("reference_system must be non-empty")
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any] | None) -> "ResourceBudget":
+        raw = dict(value or {})
+        return cls(
+            aggregate_area_limit_mm2=float(
+                raw.get(
+                    "aggregate_area_limit_mm2",
+                    cls.aggregate_area_limit_mm2,
+                )
+            ),
+            aggregate_hbm_capacity_limit_bytes=int(
+                raw.get(
+                    "aggregate_hbm_capacity_limit_bytes",
+                    cls.aggregate_hbm_capacity_limit_bytes,
+                )
+            ),
+            aggregate_hbm_bandwidth_limit_bytes_per_s=float(
+                raw.get(
+                    "aggregate_hbm_bandwidth_limit_bytes_per_s",
+                    cls.aggregate_hbm_bandwidth_limit_bytes_per_s,
+                )
+            ),
+            reference_system=str(
+                raw.get("reference_system", cls.reference_system)
+            ),
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "reference_system": self.reference_system,
+            "aggregate_area_limit_mm2": self.aggregate_area_limit_mm2,
+            "aggregate_hbm_capacity_limit_bytes": (
+                self.aggregate_hbm_capacity_limit_bytes
+            ),
+            "aggregate_hbm_bandwidth_limit_bytes_per_s": (
+                self.aggregate_hbm_bandwidth_limit_bytes_per_s
+            ),
+        }
+
+
+@dataclass(frozen=True)
+class ResourceBudgetStatus:
+    """Aggregate resource use and hard-constraint outcomes."""
+
+    aggregate_area_mm2: float
+    aggregate_hbm_capacity_bytes: int
+    aggregate_hbm_bandwidth_bytes_per_s: float
+    aggregate_multiplier_count: int
+    budget: ResourceBudget = ResourceBudget()
+
+    def __post_init__(self) -> None:
+        _require_finite(
+            "aggregate_area_mm2",
+            float(self.aggregate_area_mm2),
+            positive=True,
+        )
+        if (
+            isinstance(self.aggregate_hbm_capacity_bytes, bool)
+            or not isinstance(self.aggregate_hbm_capacity_bytes, int)
+            or self.aggregate_hbm_capacity_bytes <= 0
+        ):
+            raise ValueError("aggregate_hbm_capacity_bytes must be positive")
+        _require_finite(
+            "aggregate_hbm_bandwidth_bytes_per_s",
+            float(self.aggregate_hbm_bandwidth_bytes_per_s),
+            positive=True,
+        )
+        if (
+            isinstance(self.aggregate_multiplier_count, bool)
+            or not isinstance(self.aggregate_multiplier_count, int)
+            or self.aggregate_multiplier_count <= 0
+        ):
+            raise ValueError("aggregate_multiplier_count must be positive")
+
+    @property
+    def area_feasible(self) -> bool:
+        return self.aggregate_area_mm2 <= self.budget.aggregate_area_limit_mm2
+
+    @property
+    def hbm_capacity_feasible(self) -> bool:
+        return (
+            self.aggregate_hbm_capacity_bytes
+            <= self.budget.aggregate_hbm_capacity_limit_bytes
+        )
+
+    @property
+    def hbm_bandwidth_feasible(self) -> bool:
+        return (
+            self.aggregate_hbm_bandwidth_bytes_per_s
+            <= self.budget.aggregate_hbm_bandwidth_limit_bytes_per_s
+        )
+
+    @property
+    def feasible(self) -> bool:
+        return (
+            self.area_feasible
+            and self.hbm_capacity_feasible
+            and self.hbm_bandwidth_feasible
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self.budget.to_dict(),
+            "aggregate_area_mm2": self.aggregate_area_mm2,
+            "aggregate_hbm_capacity_bytes": self.aggregate_hbm_capacity_bytes,
+            "aggregate_hbm_bandwidth_bytes_per_s": (
+                self.aggregate_hbm_bandwidth_bytes_per_s
+            ),
+            "aggregate_multiplier_count": self.aggregate_multiplier_count,
+            "area_feasible": self.area_feasible,
+            "hbm_capacity_feasible": self.hbm_capacity_feasible,
+            "hbm_bandwidth_feasible": self.hbm_bandwidth_feasible,
+            "feasible": self.feasible,
+        }
+
+
+@dataclass(frozen=True)
+class HardwareCandidate:
+    """One structurally legal decode-chip geometry and serving point."""
+
+    LEGACY_FIELDS: ClassVar[tuple[str, ...]] = (
+        "MLEN",
+        "BLEN",
+        "VLEN",
+        "HLEN",
+        "BATCH",
+        "HBM_CHANNELS",
+        "HBM_GENERATION",
+        "CHIP_COUNT",
+    )
+    PRE_E2_FIELDS: ClassVar[tuple[str, ...]] = LEGACY_FIELDS + (
+        "TP",
+        "KVP",
+        "LINK_PORTS",
+        "SRAM_POLICY",
+    )
+    E2_FIELDS: ClassVar[tuple[str, ...]] = PRE_E2_FIELDS + (
+        "KV_HEAD_REUSE",
+        "DRAIN_OVERLAPPED",
+    )
+
+    mlen: int
+    blen: int
+    vlen: int
+    hlen: int
+    batch: int
+    hbm_channels: int
+    hbm_generation: str
+    chip_count: int = 1
+    tp: int | None = None
+    kvp: int | None = None
+    link_ports: int | None = None
+    sram_policy: str = "streaming"
+    kv_head_reuse: bool | None = None
+    drain_overlapped: bool | None = None
+    _architecture_knobs_explicit: bool = field(
+        init=False,
+        repr=False,
+        compare=False,
+    )
+
+    def __post_init__(self) -> None:
+        for name in (
+            "mlen",
+            "blen",
+            "vlen",
+            "hlen",
+            "batch",
+            "hbm_channels",
+            "chip_count",
+        ):
+            value = getattr(self, name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or value <= 0
+            ):
+                raise ValueError(f"{name} must be positive")
+        tp = self.tp
+        kvp = self.kvp
+        if tp is None and kvp is None:
+            tp, kvp = self.chip_count, 1
+        elif tp is None:
+            if self.chip_count % int(kvp):
+                raise ValueError("KVP must divide CHIP_COUNT")
+            tp = self.chip_count // int(kvp)
+        elif kvp is None:
+            if self.chip_count % int(tp):
+                raise ValueError("TP must divide CHIP_COUNT")
+            kvp = self.chip_count // int(tp)
+        for name, value in (("tp", tp), ("kvp", kvp)):
+            if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+                raise ValueError(f"{name} must be positive")
+        if tp * kvp != self.chip_count:
+            raise ValueError("CHIP_COUNT must equal TP * KVP")
+        object.__setattr__(self, "tp", tp)
+        object.__setattr__(self, "kvp", kvp)
+        ports = self.link_ports
+        if ports is None:
+            ports = 0 if self.chip_count == 1 else (int(tp > 1) + int(kvp > 1))
+        if isinstance(ports, bool) or not isinstance(ports, int) or ports < 0:
+            raise ValueError("link_ports must be non-negative")
+        required_ports = int(tp > 1) + int(kvp > 1)
+        if self.chip_count == 1 and ports != 0:
+            raise ValueError("a single-chip candidate cannot have link ports")
+        if self.chip_count > 1 and ports < required_ports:
+            raise ValueError(
+                "link_ports cannot serve every active parallel dimension"
+            )
+        object.__setattr__(self, "link_ports", ports)
+        object.__setattr__(
+            self,
+            "sram_policy",
+            _normalise_sram_policy(self.sram_policy),
+        )
+        knobs_explicit = (
+            self.kv_head_reuse is not None
+            or self.drain_overlapped is not None
+        )
+        for name in ("kv_head_reuse", "drain_overlapped"):
+            value = getattr(self, name)
+            if value is None:
+                value = False
+            if not isinstance(value, bool):
+                raise TypeError(f"{name} must be boolean")
+            object.__setattr__(self, name, value)
+        object.__setattr__(
+            self,
+            "_architecture_knobs_explicit",
+            knobs_explicit,
+        )
+        if self.vlen != self.mlen:
+            raise ValueError("the decode search requires VLEN == MLEN")
+        if not self.hbm_generation:
+            raise ValueError("hbm_generation must be non-empty")
+
+    @property
+    def architecture_knobs_explicit(self) -> bool:
+        return self._architecture_knobs_explicit
+
+    def to_pre_e2_dict(self) -> dict[str, Any]:
+        """Return the topology-aware representation before E2 knobs."""
+
+        return {
+            "MLEN": self.mlen,
+            "BLEN": self.blen,
+            "VLEN": self.vlen,
+            "HLEN": self.hlen,
+            "BATCH": self.batch,
+            "HBM_CHANNELS": self.hbm_channels,
+            "HBM_GENERATION": self.hbm_generation,
+            "CHIP_COUNT": self.chip_count,
+            "TP": self.tp,
+            "KVP": self.kvp,
+            "LINK_PORTS": self.link_ports,
+            "SRAM_POLICY": self.sram_policy,
+        }
+
+    def to_dict(self) -> dict[str, Any]:
+        value = self.to_pre_e2_dict()
+        if self.architecture_knobs_explicit:
+            value.update(
+                {
+                    "KV_HEAD_REUSE": self.kv_head_reuse,
+                    "DRAIN_OVERLAPPED": self.drain_overlapped,
+                }
+            )
+        return value
+
+    def to_legacy_dict(self) -> dict[str, Any]:
+        """Return the pre-topology single-chip representation.
+
+        This exists only to validate immutable historical evidence.  New
+        candidates and result records always use :meth:`to_dict`.
+        """
+
+        if self.chip_count != 1:
+            raise ValueError(
+                "legacy multi-chip candidates used ideal, not explicit, partitioning"
+            )
+        return {
+            name: self.to_pre_e2_dict()[name]
+            for name in self.LEGACY_FIELDS
+        }
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+        *,
+        allow_legacy_single_chip: bool = False,
+    ) -> "HardwareCandidate":
+        """Parse a canonical candidate, optionally normalising old evidence."""
+
+        raw = dict(value)
+        keys = set(raw)
+        legacy = keys == set(cls.LEGACY_FIELDS)
+        pre_e2 = keys == set(cls.PRE_E2_FIELDS)
+        canonical = keys == set(cls.E2_FIELDS)
+        if not any((legacy, pre_e2, canonical)):
+            raise ValueError("hardware candidate fields differ from the schema")
+        if legacy and not allow_legacy_single_chip:
+            raise ValueError("hardware candidate is missing explicit topology")
+        if legacy and int(raw["CHIP_COUNT"]) != 1:
+            raise ValueError(
+                "legacy multi-chip evidence cannot be assigned explicit semantics"
+            )
+        if canonical and any(
+            not isinstance(raw[name], bool)
+            for name in ("KV_HEAD_REUSE", "DRAIN_OVERLAPPED")
+        ):
+            raise TypeError("architecture option fields must be boolean")
+        candidate = cls(
+            mlen=int(raw["MLEN"]),
+            blen=int(raw["BLEN"]),
+            vlen=int(raw["VLEN"]),
+            hlen=int(raw["HLEN"]),
+            batch=int(raw["BATCH"]),
+            hbm_channels=int(raw["HBM_CHANNELS"]),
+            hbm_generation=str(raw["HBM_GENERATION"]),
+            chip_count=int(raw["CHIP_COUNT"]),
+            tp=(1 if legacy else int(raw["TP"])),
+            kvp=(1 if legacy else int(raw["KVP"])),
+            link_ports=(0 if legacy else int(raw["LINK_PORTS"])),
+            sram_policy=(
+                "streaming" if legacy else str(raw["SRAM_POLICY"])
+            ),
+            kv_head_reuse=(
+                raw["KV_HEAD_REUSE"] if canonical else None
+            ),
+            drain_overlapped=(
+                raw["DRAIN_OVERLAPPED"] if canonical else None
+            ),
+        )
+        expected = candidate.to_legacy_dict() if legacy else candidate.to_dict()
+        if raw != expected:
+            raise ValueError("hardware candidate fields are not canonical")
+        return candidate
+
+    @property
+    def candidate_id(self) -> str:
+        return f"hw-{_content_hash(self.to_dict())}"
+
+
+@dataclass(frozen=True)
+class ExactHardwareSpace:
+    """Finite hardware grid enumerated in canonical lexical order."""
+
+    mlen: tuple[int, ...] = (16, 32, 64, 128, 256, 512, 1024, 2048, 4096)
+    blen: tuple[int, ...] = (2, 4, 8, 16, 32, 64)
+    hlen: tuple[int, ...] = (16, 32, 64, 128)
+    batch: tuple[int, ...] = (1, 4, 8, 16, 32, 64, 128, 256)
+    hbm_channels: tuple[int, ...] = (8, 16, 32)
+    hbm_generation: str = "HBM2"
+    chip_count: tuple[int, ...] | int = CHIP_COUNTS
+    tp: tuple[int, ...] = ()
+    kvp: tuple[int, ...] = ()
+    link_ports: tuple[int, ...] = (1, 2, 4)
+    sram_policy: tuple[str, ...] = SRAM_POLICIES
+    kv_head_reuse: tuple[bool, ...] = (False, True)
+    drain_overlapped: tuple[bool, ...] = (False, True)
+    resource_budget: ResourceBudget = ResourceBudget()
+    attention_heads: int | None = None
+    kv_heads: int | None = None
+    fp_sram_depth: int = DEFAULT_FP_SRAM_DEPTH
+
+    def __post_init__(self) -> None:
+        for name in ("mlen", "blen", "hlen", "batch", "hbm_channels"):
+            object.__setattr__(
+                self,
+                name,
+                _ordered_positive(getattr(self, name), name),
+            )
+        if not self.hbm_generation:
+            raise ValueError("hbm_generation must be non-empty")
+        object.__setattr__(
+            self,
+            "chip_count",
+            _positive_sequence(self.chip_count, "chip_count"),
+        )
+        for name in ("tp", "kvp"):
+            values = getattr(self, name)
+            object.__setattr__(
+                self,
+                name,
+                _ordered_positive(values, name) if values else (),
+            )
+        object.__setattr__(
+            self,
+            "link_ports",
+            _ordered_positive(self.link_ports, "link_ports"),
+        )
+        policies = tuple(
+            sorted({_normalise_sram_policy(value) for value in self.sram_policy})
+        )
+        if not policies:
+            raise ValueError("sram_policy must not be empty")
+        object.__setattr__(self, "sram_policy", policies)
+        for name in ("kv_head_reuse", "drain_overlapped"):
+            object.__setattr__(
+                self,
+                name,
+                _boolean_sequence(getattr(self, name), name),
+            )
+        if not isinstance(self.resource_budget, ResourceBudget):
+            raise TypeError("resource_budget must be ResourceBudget")
+        if (self.attention_heads is None) != (self.kv_heads is None):
+            raise ValueError("attention_heads and kv_heads must be paired")
+        for name in ("attention_heads", "kv_heads"):
+            value = getattr(self, name)
+            if value is not None and (
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or value <= 0
+            ):
+                raise ValueError(f"{name} must be positive")
+        if (
+            isinstance(self.fp_sram_depth, bool)
+            or not isinstance(self.fp_sram_depth, int)
+            or self.fp_sram_depth <= 0
+        ):
+            raise ValueError("fp_sram_depth must be positive")
+        if self.fp_sram_depth != DEFAULT_FP_SRAM_DEPTH:
+            raise ValueError(
+                "the search is bound to the current 512-slot FP SRAM"
+            )
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any] | None) -> "ExactHardwareSpace":
+        data = dict(value or {})
+        tp_raw = data.get("TP", data.get("tp", ()))
+        kvp_raw = data.get("KVP", data.get("kvp", ()))
+        ports_raw = data.get(
+            "LINK_PORTS",
+            data.get("link_ports", (1, 2, 4)),
+        )
+        policies_raw = data.get(
+            "SRAM_POLICY",
+            data.get("sram_policy", SRAM_POLICIES),
+        )
+        reuse_raw = data.get(
+            "KV_HEAD_REUSE",
+            data.get("kv_head_reuse", (False, True)),
+        )
+        drain_raw = data.get(
+            "DRAIN_OVERLAPPED",
+            data.get("drain_overlapped", (False, True)),
+        )
+        return cls(
+            mlen=tuple(data.get("MLEN", data.get("mlen", cls.mlen))),
+            blen=tuple(data.get("BLEN", data.get("blen", cls.blen))),
+            hlen=tuple(data.get("HLEN", data.get("hlen", cls.hlen))),
+            batch=tuple(data.get("BATCH", data.get("batch", cls.batch))),
+            hbm_channels=tuple(
+                data.get("HBM_CHANNELS", data.get("hbm_channels", cls.hbm_channels))
+            ),
+            hbm_generation=str(
+                data.get(
+                    "HBM_GENERATION",
+                    data.get("hbm_generation", cls.hbm_generation),
+                )
+            ),
+            chip_count=data.get(
+                "CHIP_COUNT",
+                data.get("chip_count", CHIP_COUNTS),
+            ),
+            tp=(() if not tp_raw else _positive_sequence(tp_raw, "tp")),
+            kvp=(() if not kvp_raw else _positive_sequence(kvp_raw, "kvp")),
+            link_ports=_positive_sequence(ports_raw, "link_ports"),
+            sram_policy=(
+                (str(policies_raw),)
+                if isinstance(policies_raw, str)
+                else tuple(policies_raw)
+            ),
+            kv_head_reuse=_boolean_sequence(
+                reuse_raw,
+                "kv_head_reuse",
+            ),
+            drain_overlapped=_boolean_sequence(
+                drain_raw,
+                "drain_overlapped",
+            ),
+            resource_budget=ResourceBudget.from_dict(
+                data.get("RESOURCE_BUDGET", data.get("resource_budget"))
+            ),
+            attention_heads=(
+                int(data["ATTENTION_HEADS"])
+                if "ATTENTION_HEADS" in data
+                else (
+                    int(data["attention_heads"])
+                    if "attention_heads" in data
+                    else None
+                )
+            ),
+            kv_heads=(
+                int(data["KV_HEADS"])
+                if "KV_HEADS" in data
+                else (
+                    int(data["kv_heads"])
+                    if "kv_heads" in data
+                    else None
+                )
+            ),
+            fp_sram_depth=int(
+                data.get(
+                    "FP_SRAM_DEPTH",
+                    data.get("fp_sram_depth", DEFAULT_FP_SRAM_DEPTH),
+                )
+            ),
+        )
+
+    @classmethod
+    def from_study_config(
+        cls,
+        config: Mapping[str, Any],
+    ) -> "ExactHardwareSpace":
+        """Load the complete hardware grid and bind model head geometry.
+
+        The model architecture is deliberately injected here instead of being
+        copied into each study configuration.  This keeps the searched PackedKV
+        legality constraints tied to the same immutable architecture used by
+        the numerical manifest.
+        """
+
+        configured = config.get("hardware_space")
+        if not isinstance(configured, Mapping):
+            raise ValueError("config is missing hardware_space")
+        raw = dict(configured)
+        aliases = {
+            "MLEN": "mlen",
+            "BLEN": "blen",
+            "HLEN": "hlen",
+            "BATCH": "batch",
+            "HBM_CHANNELS": "hbm_channels",
+        }
+        for canonical, alias in aliases.items():
+            if canonical not in raw and alias not in raw:
+                raise ValueError(f"hardware space is missing {canonical}")
+        if "hbm_gen" in raw:
+            if "HBM_GENERATION" in raw or "hbm_generation" in raw:
+                raise ValueError(
+                    "hardware space has conflicting HBM generation keys"
+                )
+            raw["HBM_GENERATION"] = raw.pop("hbm_gen")
+        if "HBM_GENERATION" not in raw and "hbm_generation" not in raw:
+            raise ValueError("hardware space is missing HBM_GENERATION")
+        if "CHIP_COUNT" not in raw and "chip_count" not in raw:
+            raw["CHIP_COUNT"] = list(CHIP_COUNTS)
+        if "RESOURCE_BUDGET" not in raw and "resource_budget" not in raw:
+            configured_budget = config.get("resource_budget")
+            if configured_budget is not None:
+                raw["RESOURCE_BUDGET"] = configured_budget
+        architecture = config.get("model_architecture")
+        if isinstance(architecture, Mapping):
+            attention_heads = architecture.get("num_attention_heads")
+            kv_heads = architecture.get("num_key_value_heads")
+            if (attention_heads is None) != (kv_heads is None):
+                raise ValueError(
+                    "model architecture must pair attention and KV heads"
+                )
+            if attention_heads is not None:
+                raw.setdefault("ATTENTION_HEADS", attention_heads)
+                raw.setdefault("KV_HEADS", kv_heads)
+        return cls.from_dict(raw)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "MLEN": list(self.mlen),
+            "BLEN": list(self.blen),
+            "HLEN": list(self.hlen),
+            "BATCH": list(self.batch),
+            "HBM_CHANNELS": list(self.hbm_channels),
+            "HBM_GENERATION": self.hbm_generation,
+            "CHIP_COUNT": list(self.chip_count),
+            "TP": list(self.tp),
+            "KVP": list(self.kvp),
+            "LINK_PORTS": list(self.link_ports),
+            "SRAM_POLICY": list(self.sram_policy),
+            "KV_HEAD_REUSE": list(self.kv_head_reuse),
+            "DRAIN_OVERLAPPED": list(self.drain_overlapped),
+            "RESOURCE_BUDGET": self.resource_budget.to_dict(),
+            "ATTENTION_HEADS": self.attention_heads,
+            "KV_HEADS": self.kv_heads,
+            "FP_SRAM_DEPTH": self.fp_sram_depth,
+        }
+
+    def _local_kv_heads(self, tp: int) -> int | None:
+        """Return the exact KV-head count owned by one tensor-parallel rank."""
+
+        if self.attention_heads is None:
+            return None
+        assert self.kv_heads is not None
+        if self.attention_heads % tp or self.kv_heads % tp:
+            return None
+        return self.kv_heads // tp
+
+    def _legal_reuse_values(
+        self,
+        *,
+        mlen: int,
+        blen: int,
+        hlen: int,
+        local_kv_heads: int | None,
+    ) -> tuple[bool, ...]:
+        """Filter the reuse knob against the storage owned by one TP rank."""
+
+        legal: list[bool] = []
+        for reuse in self.kv_head_reuse:
+            if reuse:
+                if local_kv_heads is None:
+                    continue
+                broadcast_heads = mlen // hlen
+                required_slots = (
+                    SOFTMAX_CONSTANT_SLOTS
+                    + SOFTMAX_STATE_VALUES_PER_ROW
+                    * blen
+                    * broadcast_heads
+                    * local_kv_heads
+                )
+                if (
+                    local_kv_heads > broadcast_heads
+                    or required_slots > self.fp_sram_depth
+                ):
+                    continue
+            legal.append(reuse)
+        return tuple(legal)
+
+    def iter_candidates(self, hidden_size: int) -> Iterator[HardwareCandidate]:
+        """Yield every structural candidate without sampling."""
+
+        if hidden_size <= 0:
+            raise ValueError("hidden_size must be positive")
+        for mlen, blen, hlen, batch, channels in itertools.product(
+            self.mlen,
+            self.blen,
+            self.hlen,
+            self.batch,
+            self.hbm_channels,
+        ):
+            if mlen % blen or mlen % hlen:
+                continue
+            if not blen <= hlen <= mlen:
+                continue
+            if hidden_size % mlen:
+                continue
+            for chip_count in self.chip_count:
+                for tp in range(1, chip_count + 1):
+                    if chip_count % tp:
+                        continue
+                    kvp = chip_count // tp
+                    if self.tp and tp not in self.tp:
+                        continue
+                    if self.kvp and kvp not in self.kvp:
+                        continue
+                    if hidden_size % tp:
+                        continue
+                    local_kv_heads = self._local_kv_heads(tp)
+                    if self.attention_heads is not None and local_kv_heads is None:
+                        continue
+                    reuse_values = self._legal_reuse_values(
+                        mlen=mlen,
+                        blen=blen,
+                        hlen=hlen,
+                        local_kv_heads=local_kv_heads,
+                    )
+                    if not reuse_values:
+                        continue
+                    if chip_count == 1:
+                        port_values = (0,)
+                    else:
+                        minimum_ports = int(tp > 1) + int(kvp > 1)
+                        port_values = tuple(
+                            value
+                            for value in self.link_ports
+                            if value >= minimum_ports
+                        )
+                    for ports, policy, reuse, drain in itertools.product(
+                        port_values,
+                        self.sram_policy,
+                        reuse_values,
+                        self.drain_overlapped,
+                    ):
+                        yield HardwareCandidate(
+                            mlen=mlen,
+                            blen=blen,
+                            vlen=mlen,
+                            hlen=hlen,
+                            batch=batch,
+                            hbm_channels=channels,
+                            hbm_generation=self.hbm_generation,
+                            chip_count=chip_count,
+                            tp=tp,
+                            kvp=kvp,
+                            link_ports=ports,
+                            sram_policy=policy,
+                            kv_head_reuse=reuse,
+                            drain_overlapped=drain,
+                        )
+
+    def candidate_count(self, hidden_size: int) -> int:
+        """Return the exact structural-grid size without materialising it."""
+
+        if hidden_size <= 0:
+            raise ValueError("hidden_size must be positive")
+        total = 0
+        for mlen, blen, hlen, batch, channels in itertools.product(
+            self.mlen,
+            self.blen,
+            self.hlen,
+            self.batch,
+            self.hbm_channels,
+        ):
+            if mlen % blen or mlen % hlen or not blen <= hlen <= mlen:
+                continue
+            if hidden_size % mlen:
+                continue
+            for chip_count in self.chip_count:
+                for tp in range(1, chip_count + 1):
+                    if chip_count % tp:
+                        continue
+                    kvp = chip_count // tp
+                    if self.tp and tp not in self.tp:
+                        continue
+                    if self.kvp and kvp not in self.kvp:
+                        continue
+                    if hidden_size % tp:
+                        continue
+                    local_kv_heads = self._local_kv_heads(tp)
+                    if self.attention_heads is not None and local_kv_heads is None:
+                        continue
+                    reuse_values = self._legal_reuse_values(
+                        mlen=mlen,
+                        blen=blen,
+                        hlen=hlen,
+                        local_kv_heads=local_kv_heads,
+                    )
+                    if not reuse_values:
+                        continue
+                    if chip_count == 1:
+                        port_count = 1
+                    else:
+                        minimum_ports = int(tp > 1) + int(kvp > 1)
+                        port_count = sum(
+                            value >= minimum_ports
+                            for value in self.link_ports
+                        )
+                    total += (
+                        port_count
+                        * len(self.sram_policy)
+                        * len(reuse_values)
+                        * len(self.drain_overlapped)
+                    )
+        return total
+
+    def candidates(self, hidden_size: int) -> tuple[HardwareCandidate, ...]:
+        """Return every structural candidate without sampling."""
+
+        return tuple(self.iter_candidates(hidden_size))
+
+
+@dataclass(frozen=True)
+class PhysicalTraffic:
+    """Average physical off-chip bytes per generated token."""
+
+    weight_bytes: float
+    activation_bytes: float
+    kv_read_bytes: float
+    kv_write_bytes: float
+    scale_bytes: float = 0.0
+    other_bytes: float = 0.0
+
+    def __post_init__(self) -> None:
+        for name in (
+            "weight_bytes",
+            "activation_bytes",
+            "kv_read_bytes",
+            "kv_write_bytes",
+            "scale_bytes",
+            "other_bytes",
+        ):
+            value = float(getattr(self, name))
+            if not math.isfinite(value) or value < 0:
+                raise ValueError(f"{name} must be finite and non-negative")
+            object.__setattr__(self, name, value)
+
+    @property
+    def total_bytes(self) -> float:
+        return sum(
+            (
+                self.weight_bytes,
+                self.activation_bytes,
+                self.kv_read_bytes,
+                self.kv_write_bytes,
+                self.scale_bytes,
+                self.other_bytes,
+            )
+        )
+
+    def to_dict(self) -> dict[str, float | str]:
+        return {
+            "unit": "bytes_per_generated_token",
+            "weight_bytes": self.weight_bytes,
+            "activation_bytes": self.activation_bytes,
+            "kv_read_bytes": self.kv_read_bytes,
+            "kv_write_bytes": self.kv_write_bytes,
+            "scale_bytes": self.scale_bytes,
+            "other_bytes": self.other_bytes,
+            "total_bytes": self.total_bytes,
+        }
+
+
+@dataclass(frozen=True)
+class CapacityBreakdown:
+    """Resident bytes and available physical capacity."""
+
+    weight_bytes: int
+    kv_cache_bytes: int
+    runtime_bytes: int
+    available_bytes: int
+
+    def __post_init__(self) -> None:
+        for name in (
+            "weight_bytes",
+            "kv_cache_bytes",
+            "runtime_bytes",
+            "available_bytes",
+        ):
+            value = getattr(self, name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or value < 0
+            ):
+                raise ValueError(f"{name} must be non-negative")
+
+    @property
+    def required_bytes(self) -> int:
+        return self.weight_bytes + self.kv_cache_bytes + self.runtime_bytes
+
+    @property
+    def headroom_bytes(self) -> int:
+        return self.available_bytes - self.required_bytes
+
+    @property
+    def feasible(self) -> bool:
+        return self.headroom_bytes >= 0
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "unit": "bytes",
+            "weight_bytes": self.weight_bytes,
+            "kv_cache_bytes": self.kv_cache_bytes,
+            "runtime_bytes": self.runtime_bytes,
+            "required_bytes": self.required_bytes,
+            "available_bytes": self.available_bytes,
+            "headroom_bytes": self.headroom_bytes,
+            "feasible": self.feasible,
+        }
+
+
+@dataclass(frozen=True)
+class CalibratedEnergy:
+    """Identity-bound energy components for one decoded token."""
+
+    calibration_id: str
+    compute_j: float
+    vector_j: float
+    sram_j: float
+    hbm_j: float
+    leakage_j: float
+    duration_s: float
+    unattributed_dynamic_j: float = 0.0
+    link_j: float = 0.0
+    energy_tier: str = "dc_calibrated"
+    energy_id: str | None = None
+    token_latency_s: float | None = None
+
+    def __post_init__(self) -> None:
+        if not self.calibration_id:
+            raise ValueError("calibration_id must be non-empty")
+        for name in (
+            "compute_j",
+            "vector_j",
+            "sram_j",
+            "hbm_j",
+            "leakage_j",
+            "unattributed_dynamic_j",
+            "link_j",
+        ):
+            value = float(getattr(self, name))
+            _require_finite(name, value)
+            object.__setattr__(self, name, value)
+        duration = float(self.duration_s)
+        _require_finite("duration_s", duration, positive=True)
+        object.__setattr__(self, "duration_s", duration)
+        if self.token_latency_s is not None:
+            latency = float(self.token_latency_s)
+            _require_finite("token_latency_s", latency, positive=True)
+            object.__setattr__(self, "token_latency_s", latency)
+        if self.total_j <= 0:
+            raise ValueError("total energy must be positive")
+        if self.energy_tier not in {
+            "analytic_anchored",
+            "dc_calibrated",
+        }:
+            raise ValueError("energy_tier is unsupported")
+        identity = self.energy_id or self.calibration_id
+        if not identity:
+            raise ValueError("energy_id must be non-empty")
+        object.__setattr__(self, "energy_id", identity)
+
+    @property
+    def total_j(self) -> float:
+        return (
+            self.compute_j
+            + self.vector_j
+            + self.sram_j
+            + self.hbm_j
+            + self.leakage_j
+            + self.unattributed_dynamic_j
+            + self.link_j
+        )
+
+    @property
+    def average_power_w(self) -> float:
+        return self.total_j / self.duration_s
+
+    @property
+    def energy_per_token_j(self) -> float:
+        return self.total_j
+
+    @property
+    def tokens_per_joule(self) -> float:
+        return 1.0 / self.total_j
+
+    @property
+    def edp_j_s(self) -> float:
+        latency = (
+            self.token_latency_s
+            if self.token_latency_s is not None
+            else self.duration_s
+        )
+        return self.total_j * latency
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "calibration_id": self.calibration_id,
+            "energy_id": self.energy_id,
+            "energy_tier": self.energy_tier,
+            "compute_j": self.compute_j,
+            "vector_j": self.vector_j,
+            "sram_j": self.sram_j,
+            "hbm_j": self.hbm_j,
+            "leakage_j": self.leakage_j,
+            "unattributed_dynamic_j": self.unattributed_dynamic_j,
+            "link_j": self.link_j,
+            "total_j": self.total_j,
+            "energy_per_token_j": self.energy_per_token_j,
+            "tokens_per_joule": self.tokens_per_joule,
+            "edp_j_s": self.edp_j_s,
+            "duration_s": self.duration_s,
+            "token_latency_s": self.token_latency_s,
+            "average_power_w": self.average_power_w,
+        }
+
+
+@dataclass(frozen=True)
+class HardwareMetrics:
+    """Measured or analytical outputs for one profile and hardware candidate."""
+
+    tpot_ms: float
+    tps: float
+    area_mm2: float
+    traffic: PhysicalTraffic
+    capacity: CapacityBreakdown
+    algorithmic_bottleneck: str
+    realized_bottleneck: str
+    frac_algorithmic_memory_bound: float
+    frac_realized_memory_bound: float
+    frac_serialization_bound: float
+    generated_tokens_per_step: int = 1
+    kv_layout: str = "dense_selector"
+    layout_id: str | None = None
+    capacity_model: str = "resident_weights_kv_runtime"
+    runtime_feasible: bool = True
+    max_batch: int | None = None
+    max_resident_batch: int | None = None
+    max_synchronous_batch: int | None = None
+    max_runtime_batch: int | None = None
+    fits_onchip_sram: bool | None = None
+    vector_sram_capacity_bytes: int | None = None
+    vector_sram_required_bytes: int | None = None
+    matrix_sram_capacity_bytes: int | None = None
+    matrix_sram_required_bytes: int | None = None
+    hbm_traffic_per_batch_step: tuple[tuple[str, float], ...] = ()
+    hbm_traffic_per_generated_token: tuple[tuple[str, float], ...] = ()
+    traffic_ledger_id: str | None = None
+    area_source: str = "analytical_uncalibrated"
+    energy: CalibratedEnergy | None = None
+    area_calibration_id: str | None = None
+    dc_anchor_id: str | None = None
+    dc_anchor_status: Mapping[str, Any] = field(default_factory=dict)
+    cycles: int | None = None
+    clock_hz: float | None = None
+    timing_mode: str = "rtl_serialized"
+    timing_calibrated: bool = False
+    timing_evidence_id: str | None = None
+    timing_reason: str | None = None
+    execution_mode: str = LEGACY_AGGREGATE_BANDWIDTH_MODE
+    compiler_trace_timing: Mapping[str, Any] | None = None
+    bandwidth_calibration_id: str | None = None
+    admission_correctness_status: Mapping[str, Any] = field(
+        default_factory=dict
+    )
+    service_mode: str = "unmodeled"
+    output_head_status: Mapping[str, Any] = field(default_factory=dict)
+    output_head_service: BF16HeadServiceEstimate | None = None
+    whole_model_tpot_ms: float | None = None
+    whole_model_tps: float | None = None
+    whole_model_energy: CalibratedEnergy | None = None
+    system_calibration_id: str | None = None
+    whole_model_rankable: bool = False
+    publication_timing_tier: str | None = None
+    avg_ideal_compute_seconds: float | None = None
+    avg_realized_compute_seconds: float | None = None
+    avg_memory_seconds: float | None = None
+    step_composition: str = STEP_COMPOSITION
+    classical_roofline_bottleneck: str | None = None
+    architecture_issue_bottleneck: str | None = None
+    frac_classical_memory_bound: float | None = None
+    frac_architecture_issue_memory_bound: float | None = None
+    avg_peak_compute_seconds: float | None = None
+    system_area_mm2: float | None = None
+    resource_budget: ResourceBudgetStatus | None = None
+    architecture_options: Mapping[str, Any] = field(default_factory=dict)
+    capacity_throughput_chain: Mapping[str, Any] = field(default_factory=dict)
+    handoff_analysis: Mapping[str, Any] | None = None
+
+    @property
+    def capacity_evidence_complete(self) -> bool:
+        return all(
+            value is not None
+            for value in (
+                self.max_resident_batch,
+                self.max_batch,
+                self.max_synchronous_batch,
+                self.max_runtime_batch,
+                self.fits_onchip_sram,
+                self.vector_sram_capacity_bytes,
+                self.vector_sram_required_bytes,
+                self.matrix_sram_capacity_bytes,
+                self.matrix_sram_required_bytes,
+            )
+        )
+
+    @property
+    def traffic_evidence_complete(self) -> bool:
+        return (
+            bool(self.hbm_traffic_per_batch_step)
+            and bool(self.hbm_traffic_per_generated_token)
+            and self.traffic_ledger_id is not None
+        )
+
+    @property
+    def admission_correctness_valid(self) -> bool:
+        return admission_correctness_status_valid(
+            self.admission_correctness_status
+        )
+
+    @property
+    def memory_timing_calibrated(self) -> bool:
+        """Return whether the active execution mode has memory-time evidence."""
+
+        return (
+            self.execution_mode == COMPILER_TRACE_EXECUTION_MODE
+            or bool(self.bandwidth_calibration_id)
+        )
+
+    def __post_init__(self) -> None:
+        for name in ("tpot_ms", "tps", "area_mm2"):
+            value = float(getattr(self, name))
+            _require_finite(name, value, positive=True)
+            object.__setattr__(self, name, value)
+        if self.algorithmic_bottleneck not in {"memory", "compute"}:
+            raise ValueError("algorithmic bottleneck must be memory or compute")
+        if self.realized_bottleneck not in {
+            "memory",
+            "serialization",
+            "compute",
+        }:
+            raise ValueError(
+                "realized bottleneck must be memory, serialization, or compute"
+            )
+        for name in (
+            "frac_algorithmic_memory_bound",
+            "frac_realized_memory_bound",
+            "frac_serialization_bound",
+        ):
+            value = float(getattr(self, name))
+            if not math.isfinite(value) or not 0.0 <= value <= 1.0:
+                raise ValueError(f"{name} must be in [0, 1]")
+            object.__setattr__(self, name, value)
+        for name in (
+            "frac_classical_memory_bound",
+            "frac_architecture_issue_memory_bound",
+        ):
+            value = getattr(self, name)
+            if value is None:
+                continue
+            value = float(value)
+            if not math.isfinite(value) or not 0.0 <= value <= 1.0:
+                raise ValueError(f"{name} must be in [0, 1]")
+            object.__setattr__(self, name, value)
+        for name in (
+            "classical_roofline_bottleneck",
+            "architecture_issue_bottleneck",
+        ):
+            value = getattr(self, name)
+            if value is not None and value not in {
+                "memory",
+                "compute",
+                "unavailable",
+            }:
+                raise ValueError(f"{name} is invalid")
+        if (
+            self.architecture_issue_bottleneck
+            not in {None, "unavailable", self.algorithmic_bottleneck}
+        ):
+            raise ValueError(
+                "architecture-issue and compatibility labels disagree"
+            )
+        if (
+            self.frac_architecture_issue_memory_bound is not None
+            and abs(
+                self.frac_architecture_issue_memory_bound
+                - self.frac_algorithmic_memory_bound
+            )
+            > 1e-12
+        ):
+            raise ValueError(
+                "architecture-issue and compatibility fractions disagree"
+            )
+        if (
+            isinstance(self.generated_tokens_per_step, bool)
+            or not isinstance(self.generated_tokens_per_step, int)
+            or self.generated_tokens_per_step <= 0
+        ):
+            raise ValueError("generated_tokens_per_step must be positive")
+        if not isinstance(self.runtime_feasible, bool):
+            raise TypeError("runtime_feasible must be boolean")
+        if not self.kv_layout:
+            raise ValueError("kv_layout must be non-empty")
+        if self.layout_id is not None and not self.layout_id:
+            raise ValueError("layout_id must be non-empty")
+        if not self.capacity_model:
+            raise ValueError("capacity_model must be non-empty")
+        capacity_fields = (
+            "max_batch",
+            "max_resident_batch",
+            "max_synchronous_batch",
+            "max_runtime_batch",
+            "fits_onchip_sram",
+            "vector_sram_capacity_bytes",
+            "vector_sram_required_bytes",
+            "matrix_sram_capacity_bytes",
+            "matrix_sram_required_bytes",
+        )
+        capacity_values = tuple(getattr(self, name) for name in capacity_fields)
+        if any(value is not None for value in capacity_values):
+            if any(value is None for value in capacity_values):
+                raise ValueError("runtime capacity evidence must be complete")
+            for name in capacity_fields:
+                if name == "fits_onchip_sram":
+                    if not isinstance(self.fits_onchip_sram, bool):
+                        raise TypeError(
+                            "fits_onchip_sram must be boolean"
+                        )
+                    continue
+                value = getattr(self, name)
+                if (
+                    isinstance(value, bool)
+                    or not isinstance(value, int)
+                    or value < 0
+                ):
+                    raise ValueError(f"{name} must be non-negative")
+            expected_sram_fit = (
+                self.vector_sram_required_bytes
+                <= self.vector_sram_capacity_bytes
+                and self.matrix_sram_required_bytes
+                <= self.matrix_sram_capacity_bytes
+            )
+            if self.fits_onchip_sram != expected_sram_fit:
+                raise ValueError("on-chip SRAM capacity evidence is inconsistent")
+            if self.runtime_feasible != (
+                self.capacity.feasible and self.fits_onchip_sram
+            ):
+                raise ValueError("runtime capacity evidence is inconsistent")
+            if self.max_runtime_batch > self.max_resident_batch:
+                raise ValueError(
+                    "runtime batch limit cannot exceed resident batch limit"
+                )
+            if self.max_batch != self.max_runtime_batch:
+                raise ValueError("legacy and runtime batch limits disagree")
+            if self.runtime_feasible != (
+                self.generated_tokens_per_step <= self.max_runtime_batch
+            ):
+                raise ValueError("runtime batch limit disagrees with feasibility")
+        step_traffic = tuple(self.hbm_traffic_per_batch_step)
+        token_traffic = tuple(self.hbm_traffic_per_generated_token)
+        traffic_evidence = (
+            bool(step_traffic),
+            bool(token_traffic),
+            self.traffic_ledger_id is not None,
+        )
+        if any(traffic_evidence) and not all(traffic_evidence):
+            raise ValueError("physical traffic evidence must be complete")
+        if all(traffic_evidence):
+            if not self.traffic_ledger_id:
+                raise ValueError(
+                    "physical traffic producer identity must be non-empty"
+                )
+            step_map = dict(step_traffic)
+            token_map = dict(token_traffic)
+            if (
+                len(step_map) != len(step_traffic)
+                or len(token_map) != len(token_traffic)
+            ):
+                raise ValueError("physical traffic keys must be unique")
+            if (
+                set(step_map) != PHYSICAL_TRAFFIC_KEYS
+                or set(token_map) != PHYSICAL_TRAFFIC_KEYS
+            ):
+                raise ValueError("physical traffic schema mismatch")
+            for name in PHYSICAL_TRAFFIC_KEYS:
+                step_value = float(step_map[name])
+                token_value = float(token_map[name])
+                _require_finite(name, step_value)
+                _require_finite(name, token_value)
+                expected = token_value * self.generated_tokens_per_step
+                if abs(step_value - expected) > max(
+                    1e-6,
+                    abs(expected) * 1e-9,
+                ):
+                    raise ValueError(
+                        f"physical traffic units disagree for {name}"
+                    )
+            if abs(sum(token_map.values()) - self.traffic.total_bytes) > max(
+                1e-6,
+                abs(self.traffic.total_bytes) * 1e-9,
+            ):
+                raise ValueError("physical traffic roles do not conserve bytes")
+            object.__setattr__(
+                self,
+                "hbm_traffic_per_batch_step",
+                tuple(sorted((str(key), float(value)) for key, value in step_map.items())),
+            )
+            object.__setattr__(
+                self,
+                "hbm_traffic_per_generated_token",
+                tuple(
+                    sorted(
+                        (str(key), float(value))
+                        for key, value in token_map.items()
+                    )
+                ),
+            )
+        if not self.area_source:
+            raise ValueError("area_source must be non-empty")
+        canonical_dc_anchor = json.loads(
+            _canonical_bytes(dict(self.dc_anchor_status))
+        )
+        object.__setattr__(self, "dc_anchor_status", canonical_dc_anchor)
+        if self.dc_anchor_id is not None and not self.dc_anchor_id:
+            raise ValueError("DC anchor identity must be non-empty")
+        if self.area_source == "dc_calibrated":
+            if (
+                not self.dc_anchor_id
+                or canonical_dc_anchor.get("anchor_id")
+                != self.dc_anchor_id
+            ):
+                raise ValueError(
+                    "exact DC area requires matching anchor evidence"
+                )
+        elif self.dc_anchor_id is not None or canonical_dc_anchor:
+            raise ValueError(
+                "DC anchor evidence requires exact calibrated area"
+            )
+        if self.cycles is not None and self.cycles <= 0:
+            raise ValueError("cycles must be positive")
+        if self.clock_hz is not None:
+            _require_finite("clock_hz", float(self.clock_hz), positive=True)
+        if not self.timing_mode:
+            raise ValueError("timing_mode must be non-empty")
+        if self.timing_calibrated != bool(self.timing_evidence_id):
+            raise ValueError(
+                "timing calibration requires a timing evidence identity"
+            )
+        if self.timing_reason is not None and not self.timing_reason:
+            raise ValueError("timing_reason must be non-empty")
+        trace_timing = _canonical_trace_timing_set(
+            self.execution_mode,
+            self.compiler_trace_timing,
+            self.timing_evidence_id,
+        )
+        object.__setattr__(self, "compiler_trace_timing", trace_timing)
+        if self.execution_mode == COMPILER_TRACE_EXECUTION_MODE:
+            if not self.timing_calibrated:
+                raise ValueError("compiler trace timing must be calibrated")
+            if self.bandwidth_calibration_id is not None:
+                raise ValueError(
+                    "aggregate-bandwidth evidence is inapplicable to compiler timing"
+                )
+        canonical_admission = json.loads(
+            _canonical_bytes(dict(self.admission_correctness_status))
+        )
+        if (
+            canonical_admission.get("passed") is True
+            and not admission_correctness_status_valid(canonical_admission)
+        ):
+            raise ValueError(
+                "passing admission correctness evidence is inconsistent"
+            )
+        object.__setattr__(
+            self,
+            "admission_correctness_status",
+            canonical_admission,
+        )
+        if self.energy is not None:
+            if self.energy.energy_tier == "dc_calibrated":
+                if self.area_calibration_id != self.energy.calibration_id:
+                    raise ValueError(
+                        "DC area and energy must use one calibration identity"
+                    )
+                if self.area_source not in {
+                    "dc_calibrated",
+                    "dc_calibrated_model",
+                }:
+                    raise ValueError(
+                        "DC-calibrated energy requires DC-calibrated area"
+                    )
+            elif self.area_calibration_id is not None:
+                raise ValueError(
+                    "analytic energy cannot claim a DC area calibration"
+                )
+            expected_duration = (
+                self.tpot_ms
+                / 1000.0
+                / self.generated_tokens_per_step
+            )
+            tolerance = max(1e-12, expected_duration * 1e-6)
+            if abs(self.energy.duration_s - expected_duration) > tolerance:
+                raise ValueError("energy duration must match TPOT")
+            expected_latency = self.tpot_ms / 1000.0
+            if (
+                self.energy.token_latency_s is not None
+                and abs(
+                    self.energy.token_latency_s - expected_latency
+                )
+                > max(1e-12, expected_latency * 1e-6)
+            ):
+                raise ValueError("energy token latency must match TPOT")
+        elif self.area_calibration_id is not None:
+            raise ValueError(
+                "calibrated area identity requires calibrated energy"
+            )
+        if not self.service_mode:
+            raise ValueError("service_mode must be non-empty")
+        if self.step_composition != STEP_COMPOSITION:
+            raise ValueError("decode step composition is unsupported")
+        timing_components = (
+            self.avg_ideal_compute_seconds,
+            self.avg_realized_compute_seconds,
+            self.avg_memory_seconds,
+        )
+        if any(value is not None for value in timing_components):
+            if any(value is None for value in timing_components):
+                raise ValueError("timing decomposition must be complete")
+            for name, value in zip(
+                (
+                    "avg_ideal_compute_seconds",
+                    "avg_realized_compute_seconds",
+                    "avg_memory_seconds",
+                ),
+                timing_components,
+            ):
+                if (
+                    isinstance(value, bool)
+                    or not isinstance(value, (int, float))
+                    or not math.isfinite(value)
+                    or value <= 0
+                ):
+                    raise ValueError(f"{name} must be finite and positive")
+            if (
+                self.avg_realized_compute_seconds
+                < self.avg_ideal_compute_seconds
+            ):
+                raise ValueError(
+                    "realized compute time cannot beat the ideal issue time"
+                )
+        if self.avg_peak_compute_seconds is not None:
+            peak = self.avg_peak_compute_seconds
+            if (
+                isinstance(peak, bool)
+                or not isinstance(peak, (int, float))
+                or not math.isfinite(peak)
+                or peak <= 0
+            ):
+                raise ValueError(
+                    "avg_peak_compute_seconds must be finite and positive"
+                )
+            if self.avg_ideal_compute_seconds is None:
+                raise ValueError(
+                    "peak compute requires the complete timing decomposition"
+                )
+            if peak > self.avg_ideal_compute_seconds:
+                raise ValueError(
+                    "peak compute cannot be slower than ideal issue"
+                )
+        if not isinstance(self.whole_model_rankable, bool):
+            raise TypeError("whole_model_rankable must be boolean")
+        if self.publication_timing_tier is not None and (
+            self.publication_timing_tier not in PUBLICATION_TIMING_TIERS
+        ):
+            raise ValueError(
+                "publication_timing_tier must be a declared timing tier"
+            )
+        if self.whole_model_rankable and self.publication_timing_tier is None:
+            raise ValueError(
+                "rankable whole-model metrics require a publication timing tier"
+            )
+        canonical_head_status = json.loads(
+            _canonical_bytes(dict(self.output_head_status))
+        )
+        object.__setattr__(
+            self,
+            "output_head_status",
+            canonical_head_status,
+        )
+        whole_timing = (
+            self.whole_model_tpot_ms,
+            self.whole_model_tps,
+        )
+        if self.output_head_service is not None:
+            if self.service_mode != HEAD_SERVICE_MODE:
+                raise ValueError(
+                    "head-service costs require the remote service mode"
+                )
+            if not head_service_status_valid(canonical_head_status):
+                raise ValueError(
+                    "head-service costs require passing v2 numerical evidence"
+                )
+            if canonical_head_status.get(
+                "calibration_id"
+            ) != self.output_head_service.calibration_id:
+                raise ValueError(
+                    "head-service calibration identities differ"
+                )
+            if canonical_head_status.get(
+                "provenance_id"
+            ) != self.output_head_service.provenance_id:
+                raise ValueError(
+                    "head-service provenance identities differ"
+                )
+            if canonical_head_status.get(
+                "service_location"
+            ) != self.output_head_service.service_location:
+                raise ValueError(
+                    "head-service locations differ"
+                )
+            if (
+                self.output_head_service.batch
+                != self.generated_tokens_per_step
+            ):
+                raise ValueError(
+                    "head-service and decoder batch sizes differ"
+                )
+        if self.whole_model_rankable:
+            if self.service_mode != HEAD_SERVICE_MODE:
+                raise ValueError(
+                    "rankable whole-model metrics require the remote service"
+                )
+            if self.output_head_service is None:
+                raise ValueError(
+                    "rankable whole-model metrics require head-service costs"
+                )
+            if any(value is None for value in whole_timing):
+                raise ValueError(
+                    "rankable whole-model timing must be complete"
+                )
+            expected_tpot = (
+                self.tpot_ms
+                + self.output_head_service.total_latency_s * 1000.0
+            )
+            if abs(float(self.whole_model_tpot_ms) - expected_tpot) > max(
+                1e-9,
+                expected_tpot * 1e-9,
+            ):
+                raise ValueError(
+                    "whole-model TPOT does not conserve service latency"
+                )
+            expected_tps = (
+                self.generated_tokens_per_step
+                * 1000.0
+                / expected_tpot
+            )
+            if abs(float(self.whole_model_tps) - expected_tps) > max(
+                1e-9,
+                expected_tps * 1e-9,
+            ):
+                raise ValueError(
+                    "whole-model TPOT and TPS are inconsistent"
+                )
+        else:
+            if any(value is not None for value in whole_timing):
+                raise ValueError(
+                    "unrankable whole-model timing must remain absent"
+                )
+        if self.whole_model_energy is not None:
+            if not self.whole_model_rankable or self.energy is None:
+                raise ValueError(
+                    "whole-model energy requires rankable calibrated components"
+                )
+            if (
+                not self.system_calibration_id
+                or self.whole_model_energy.calibration_id
+                != self.system_calibration_id
+            ):
+                raise ValueError(
+                    "whole-model energy calibration identity is inconsistent"
+                )
+            expected_duration = (
+                float(self.whole_model_tpot_ms)
+                / 1000.0
+                / self.generated_tokens_per_step
+            )
+            tolerance = max(1e-12, expected_duration * 1e-6)
+            if (
+                abs(
+                    self.whole_model_energy.duration_s
+                    - expected_duration
+                )
+                > tolerance
+            ):
+                raise ValueError(
+                    "whole-model energy duration must match whole TPOT"
+                )
+            expected_latency = float(self.whole_model_tpot_ms) / 1000.0
+            if (
+                self.whole_model_energy.token_latency_s is not None
+                and abs(
+                    self.whole_model_energy.token_latency_s
+                    - expected_latency
+                )
+                > max(1e-12, expected_latency * 1e-6)
+            ):
+                raise ValueError(
+                    "whole-model energy token latency must match whole TPOT"
+                )
+        elif self.system_calibration_id is not None:
+            raise ValueError(
+                "system calibration identity requires whole-model energy"
+            )
+        if (
+            self.whole_model_rankable
+            and self.energy is not None
+            and self.whole_model_energy is None
+        ):
+            raise ValueError(
+                "calibrated rankable components require whole-model energy"
+            )
+        if self.system_area_mm2 is not None:
+            _require_finite(
+                "system_area_mm2",
+                float(self.system_area_mm2),
+                positive=True,
+            )
+        if self.resource_budget is not None:
+            if not isinstance(self.resource_budget, ResourceBudgetStatus):
+                raise TypeError(
+                    "resource_budget must be ResourceBudgetStatus"
+                )
+            if self.system_area_mm2 is None:
+                raise ValueError(
+                    "resource-budget evidence requires system area"
+                )
+            if abs(
+                self.resource_budget.aggregate_area_mm2
+                - float(self.system_area_mm2)
+            ) > max(1e-9, float(self.system_area_mm2) * 1e-9):
+                raise ValueError(
+                    "system area and resource-budget evidence disagree"
+                )
+        for name in (
+            "architecture_options",
+            "capacity_throughput_chain",
+        ):
+            raw_evidence = getattr(self, name)
+            if not isinstance(raw_evidence, Mapping):
+                raise TypeError(f"{name} must be an object")
+            canonical_evidence = json.loads(
+                _canonical_bytes(dict(raw_evidence))
+            )
+            object.__setattr__(self, name, canonical_evidence)
+        if self.architecture_options:
+            required = {
+                "schema",
+                "explicit",
+                "kv_head_reuse",
+                "drain_overlapped",
+                "area",
+            }
+            if set(self.architecture_options) != required:
+                raise ValueError(
+                    "architecture-option evidence fields differ from the schema"
+                )
+            if not isinstance(self.architecture_options["explicit"], bool):
+                raise TypeError("architecture-option explicit flag must be boolean")
+        if self.capacity_throughput_chain:
+            chain = self.capacity_throughput_chain
+            if int(chain.get("evaluated_batch", -1)) != self.generated_tokens_per_step:
+                raise ValueError("capacity-throughput evaluated batch disagrees")
+            if (
+                self.max_runtime_batch is not None
+                and int(chain.get("max_feasible_batch", -1))
+                != self.max_runtime_batch
+            ):
+                raise ValueError("capacity-throughput batch ceiling disagrees")
+            if chain.get("runtime_feasible") is not self.runtime_feasible:
+                raise ValueError("capacity-throughput feasibility disagrees")
+            expected_throughput = self.tps if self.runtime_feasible else None
+            observed_throughput = chain.get(
+                "evaluated_throughput_tokens_per_second"
+            )
+            if expected_throughput is None:
+                if observed_throughput is not None:
+                    raise ValueError(
+                        "infeasible capacity cannot report evaluated throughput"
+                    )
+            elif not math.isclose(
+                float(observed_throughput),
+                expected_throughput,
+                rel_tol=1e-12,
+                abs_tol=1e-12,
+            ):
+                raise ValueError("capacity-throughput TPS disagrees")
+        if self.handoff_analysis is not None:
+            if not isinstance(self.handoff_analysis, Mapping):
+                raise TypeError("handoff_analysis must be an object")
+            handoff = json.loads(
+                _canonical_bytes(dict(self.handoff_analysis))
+            )
+            if handoff.get("schema_version") != (
+                "plena-prefill-handoff-analysis-v1"
+            ):
+                raise ValueError("unsupported prefill handoff analysis schema")
+            if handoff.get("scope") != (
+                "request_level_prefill_decode_schedule"
+            ):
+                raise ValueError("prefill handoff analysis scope is invalid")
+            if handoff.get("ordinary_decode_ranking_effect") != "none":
+                raise ValueError("handoff analysis cannot alter decode ranking")
+            if not isinstance(handoff.get("publication_rankable"), bool):
+                raise TypeError("handoff rankability must be boolean")
+            artifact_id = handoff.get("input_artifact_id")
+            if (
+                not isinstance(artifact_id, str)
+                or not artifact_id.startswith("prefill-handoff-")
+                or len(artifact_id) != len("prefill-handoff-") + 64
+                or any(
+                    character not in "0123456789abcdef"
+                    for character in artifact_id[-64:]
+                )
+            ):
+                raise ValueError("handoff input artifact identity is invalid")
+            regimes = handoff.get("regimes")
+            if not isinstance(regimes, list) or len(regimes) not in {0, 3}:
+                raise ValueError("handoff analysis must contain zero or three regimes")
+            if regimes:
+                names = [regime.get("regime") for regime in regimes]
+                if names != [
+                    "fully_pipelined",
+                    "back_pressure",
+                    "host_buffered",
+                ]:
+                    raise ValueError("handoff regime ordering is invalid")
+            if handoff["publication_rankable"]:
+                if handoff.get("unrankable_reason") is not None or not regimes:
+                    raise ValueError("rankable handoff evidence is incomplete")
+            elif not handoff.get("unrankable_reason"):
+                raise ValueError("unrankable handoff evidence requires a reason")
+            object.__setattr__(self, "handoff_analysis", handoff)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "metric_scope": "decoder_stack_only",
+            "tpot_ms": self.tpot_ms,
+            "tps": self.tps,
+            "area_mm2": self.area_mm2,
+            "area_scope": "decode_chip_only",
+            "physical_traffic": self.traffic.to_dict(),
+            "capacity": self.capacity.to_dict(),
+            "algorithmic_bottleneck": self.algorithmic_bottleneck,
+            "classical_roofline_bottleneck": (
+                self.classical_roofline_bottleneck
+            ),
+            "architecture_issue_bottleneck": (
+                self.architecture_issue_bottleneck
+                if self.architecture_issue_bottleneck is not None
+                else self.algorithmic_bottleneck
+            ),
+            "realized_bottleneck": self.realized_bottleneck,
+            "frac_classical_memory_bound": (
+                self.frac_classical_memory_bound
+            ),
+            "frac_architecture_issue_memory_bound": (
+                self.frac_architecture_issue_memory_bound
+                if self.frac_architecture_issue_memory_bound is not None
+                else self.frac_algorithmic_memory_bound
+            ),
+            "frac_algorithmic_memory_bound": (
+                self.frac_algorithmic_memory_bound
+            ),
+            "frac_realized_memory_bound": self.frac_realized_memory_bound,
+            "frac_serialization_bound": self.frac_serialization_bound,
+            "generated_tokens_per_step": self.generated_tokens_per_step,
+            "kv_layout": self.kv_layout,
+            "layout_id": self.layout_id,
+            "capacity_model": self.capacity_model,
+            "runtime_feasible": self.runtime_feasible,
+            "max_batch": self.max_batch,
+            "max_resident_batch": self.max_resident_batch,
+            "max_synchronous_batch": self.max_synchronous_batch,
+            "max_runtime_batch": self.max_runtime_batch,
+            "fits_onchip_sram": self.fits_onchip_sram,
+            "vector_sram_capacity_bytes": self.vector_sram_capacity_bytes,
+            "vector_sram_required_bytes": self.vector_sram_required_bytes,
+            "matrix_sram_capacity_bytes": self.matrix_sram_capacity_bytes,
+            "matrix_sram_required_bytes": self.matrix_sram_required_bytes,
+            "runtime_capacity_evidence": (
+                {
+                    "producer_id": self.capacity_model,
+                    "batch_unit": "active_sequences",
+                    "byte_unit": "bytes",
+                    "evaluated_batch": self.generated_tokens_per_step,
+                    "max_batch": self.max_batch,
+                    "max_resident_batch": self.max_resident_batch,
+                    "max_synchronous_batch": self.max_synchronous_batch,
+                    "max_runtime_batch": self.max_runtime_batch,
+                    "fits_hbm": self.capacity.feasible,
+                    "fits_onchip_sram": self.fits_onchip_sram,
+                    "fits_runtime": self.runtime_feasible,
+                    "vector_sram_capacity_bytes": (
+                        self.vector_sram_capacity_bytes
+                    ),
+                    "vector_sram_required_bytes": (
+                        self.vector_sram_required_bytes
+                    ),
+                    "matrix_sram_capacity_bytes": (
+                        self.matrix_sram_capacity_bytes
+                    ),
+                    "matrix_sram_required_bytes": (
+                        self.matrix_sram_required_bytes
+                    ),
+                }
+                if self.capacity_evidence_complete
+                else None
+            ),
+            "hbm_traffic_ledger": (
+                {
+                    "producer_id": self.traffic_ledger_id,
+                    "per_batch_step": {
+                        "unit": "bytes_per_batch_step",
+                        "values": dict(self.hbm_traffic_per_batch_step),
+                    },
+                    "per_generated_token": {
+                        "unit": "bytes_per_generated_token",
+                        "values": dict(
+                            self.hbm_traffic_per_generated_token
+                        ),
+                    },
+                }
+                if self.traffic_ledger_id is not None
+                else None
+            ),
+            "area_source": self.area_source,
+            "calibrated_energy": self.energy.to_dict() if self.energy else None,
+            "energy_per_token_j": (
+                self.energy.energy_per_token_j if self.energy else None
+            ),
+            "energy_tier": self.energy.energy_tier if self.energy else None,
+            "tokens_per_joule": (
+                self.energy.tokens_per_joule if self.energy else None
+            ),
+            "edp_j_s": self.energy.edp_j_s if self.energy else None,
+            "area_calibration_id": self.area_calibration_id,
+            "system_area_mm2": self.system_area_mm2,
+            "resource_budget": (
+                self.resource_budget.to_dict()
+                if self.resource_budget is not None
+                else None
+            ),
+            "architecture_options": dict(self.architecture_options),
+            "capacity_throughput_chain": dict(
+                self.capacity_throughput_chain
+            ),
+            "handoff_analysis": self.handoff_analysis,
+            "dc_anchor_id": self.dc_anchor_id,
+            "dc_anchor_status": dict(self.dc_anchor_status),
+            "cycles": self.cycles,
+            "clock_hz": self.clock_hz,
+            "timing_mode": self.timing_mode,
+            "timing_calibrated": self.timing_calibrated,
+            "timing_evidence_id": self.timing_evidence_id,
+            "timing_reason": self.timing_reason,
+            "execution_mode": self.execution_mode,
+            "compiler_trace_timing": self.compiler_trace_timing,
+            "bandwidth_calibration_id": self.bandwidth_calibration_id,
+            "memory_timing_calibrated": self.memory_timing_calibrated,
+            "admission_boundary": dict(
+                self.admission_correctness_status
+            ),
+            "timing_decomposition": (
+                {
+                    "unit": "seconds_per_batch_step",
+                    "composition": self.step_composition,
+                    **(
+                        {
+                            "peak_compute_seconds": (
+                                self.avg_peak_compute_seconds
+                            )
+                        }
+                        if self.avg_peak_compute_seconds is not None
+                        else {}
+                    ),
+                    "ideal_compute_seconds": (
+                        self.avg_ideal_compute_seconds
+                    ),
+                    "realized_compute_seconds": (
+                        self.avg_realized_compute_seconds
+                    ),
+                    "memory_seconds": self.avg_memory_seconds,
+                }
+                if self.avg_ideal_compute_seconds is not None
+                else None
+            ),
+            "decoder_stack": {
+                "scope": "decode_chip_through_final_rmsnorm",
+                "tpot_ms": self.tpot_ms,
+                "tps": self.tps,
+                "calibrated_energy": (
+                    self.energy.to_dict()
+                    if self.energy is not None
+                    else None
+                ),
+                "energy_per_token_j": (
+                    self.energy.energy_per_token_j
+                    if self.energy is not None
+                    else None
+                ),
+                "energy_tier": (
+                    self.energy.energy_tier
+                    if self.energy is not None
+                    else None
+                ),
+                "tokens_per_joule": (
+                    self.energy.tokens_per_joule
+                    if self.energy is not None
+                    else None
+                ),
+                "edp_j_s": (
+                    self.energy.edp_j_s
+                    if self.energy is not None
+                    else None
+                ),
+                "area_mm2": self.area_mm2,
+                "area_scope": "decode_chip_only",
+            },
+            "output_head_boundary": {
+                "service_mode": self.service_mode,
+                "status": dict(self.output_head_status),
+                "estimate": (
+                    self.output_head_service.to_dict()
+                    if self.output_head_service is not None
+                    else None
+                ),
+            },
+            "whole_model": {
+                "rankable": self.whole_model_rankable,
+                "publication_timing_tier": self.publication_timing_tier,
+                "tpot_ms": self.whole_model_tpot_ms,
+                "tps": self.whole_model_tps,
+                "calibrated_energy": (
+                    self.whole_model_energy.to_dict()
+                    if self.whole_model_energy is not None
+                    else None
+                ),
+                "energy_per_token_j": (
+                    self.whole_model_energy.energy_per_token_j
+                    if self.whole_model_energy is not None
+                    else None
+                ),
+                "energy_tier": (
+                    self.whole_model_energy.energy_tier
+                    if self.whole_model_energy is not None
+                    else None
+                ),
+                "tokens_per_joule": (
+                    self.whole_model_energy.tokens_per_joule
+                    if self.whole_model_energy is not None
+                    else None
+                ),
+                "edp_j_s": (
+                    self.whole_model_energy.edp_j_s
+                    if self.whole_model_energy is not None
+                    else None
+                ),
+                "system_calibration_id": self.system_calibration_id,
+            },
+        }
+
+
+@dataclass(frozen=True)
+class HardwareEvaluation:
+    """Evaluator output with independent cross-stack validity."""
+
+    metrics: HardwareMetrics | None
+    validity: StackValidity
+    error_code: str | None = None
+    error_message: str | None = None
+
+    def __post_init__(self) -> None:
+        if bool(self.error_code) != bool(self.error_message):
+            raise ValueError("error_code and error_message must be set together")
+        if self.validity.dc_calibrated is True:
+            if (
+                self.metrics is None
+                or self.metrics.energy is None
+                or self.metrics.area_source != "dc_calibrated"
+                or not self.metrics.dc_anchor_id
+            ):
+                raise ValueError(
+                    "dc_calibrated=True requires an exact DC/SAIF anchor"
+                )
+
+    @classmethod
+    def failed(
+        cls,
+        code: str,
+        message: str,
+        *,
+        validity: StackValidity = StackValidity(),
+    ) -> "HardwareEvaluation":
+        return cls(
+            metrics=None,
+            validity=validity,
+            error_code=code,
+            error_message=message,
+        )
+
+
+class HardwareEvaluator(Protocol):
+    def __call__(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        numerical_result: Mapping[str, Any],
+    ) -> HardwareEvaluation:
+        ...
+
+
+def physical_cost_signature(
+    profile: Any,
+    *,
+    exact_vector_format: bool = True,
+) -> dict[str, Any]:
+    """Return every profile field that can change hardware cost.
+
+    Numerical quality and profile identity are intentionally absent.  Exact
+    format tokens are retained for matrix roles because the calibrated area
+    model distinguishes exponent and mantissa allocation.  An evaluator that
+    uses the width-only analytical vector model may explicitly collapse vector
+    formats with the same storage width.
+    """
+
+    vector = format_descriptor(profile.vector_format)
+    return {
+        "schema": "plena-physical-cost-signature",
+        "weight_format": profile.weight_format,
+        "activation_format": profile.activation_format,
+        "key_format": profile.key_format,
+        "value_format": profile.value_format,
+        "vector_format": (
+            profile.vector_format
+            if exact_vector_format
+            else {
+                "family": vector.family,
+                "element_bits": vector.element_bits,
+            }
+        ),
+        "block_size": profile.block_size,
+        "scale_format": profile.scale_format,
+        "scale_bits": profile.scale_bits,
+        "accumulator_rule": profile.accumulator_rule,
+        "output_rule": profile.output_rule,
+        "matrix_semantics": profile.matrix_semantics.to_dict(),
+        "operator_bindings": {
+            "weight": list(profile.weight_operators),
+            "activation": list(profile.activation_operators),
+            "kv": list(profile.kv_operators),
+            "vector": list(profile.vector_operators),
+            "bf16": list(profile.bf16_operators),
+        },
+    }
+
+
+def physical_cost_signature_id(
+    profile: Any,
+    *,
+    exact_vector_format: bool = True,
+) -> str:
+    """Return the content identity used for lossless profile grouping."""
+
+    return "physical-cost-" + _content_hash(
+        physical_cost_signature(
+            profile,
+            exact_vector_format=exact_vector_format,
+        )
+    )
+
+
+def _evaluator_group_key(
+    evaluator: HardwareEvaluator,
+    method_name: str,
+    entry: SweepManifestEntry,
+    numerical: Mapping[str, Any],
+) -> str:
+    method = getattr(evaluator, method_name, None)
+    if method is None:
+        return f"profile:{entry.profile_id}"
+    value = method(entry, numerical)
+    if isinstance(value, str) and value:
+        return value
+    if not isinstance(value, Mapping):
+        raise TypeError(f"{method_name} must return a string or mapping")
+    return f"{method_name}:" + _content_hash(dict(value))
+
+
+def _mean_nll(row: Mapping[str, Any]) -> float | None:
+    if row.get("state") != "succeeded":
+        return None
+    metrics = row.get("result", row.get("metrics"))
+    if not isinstance(metrics, Mapping):
+        return None
+    value = metrics.get("mean_nll")
+    if (
+        isinstance(value, bool)
+        or not isinstance(value, (int, float))
+        or not math.isfinite(float(value))
+        or float(value) < 0
+    ):
+        return None
+    return float(value)
+
+
+def _validity_from_result(value: Mapping[str, Any]) -> StackValidity:
+    nested = value.get("validity")
+    if isinstance(nested, Mapping):
+        return StackValidity.from_dict(nested)
+    return StackValidity.from_dict(value)
+
+
+def merge_validity(*values: StackValidity) -> StackValidity:
+    """Merge observations conservatively so a measured failure dominates."""
+
+    merged: dict[str, bool | None] = {}
+    for name in _VALIDITY_FIELDS:
+        observations = [getattr(value, name) for value in values]
+        if False in observations:
+            merged[name] = False
+        elif True in observations:
+            merged[name] = True
+        else:
+            merged[name] = None
+    return StackValidity(**merged)
+
+
+def _index_numerical_results(
+    manifest: SweepManifest,
+    rows: Iterable[Mapping[str, Any]],
+) -> dict[str, Mapping[str, Any]]:
+    entries = {entry.profile_id: entry for entry in manifest.entries}
+    attempts: dict[str, dict[int, Mapping[str, Any]]] = {}
+    for raw in rows:
+        row = dict(raw)
+        profile_id = str(row.get("profile_id", ""))
+        if profile_id not in entries:
+            raise ValueError(f"numerical result references unknown profile {profile_id!r}")
+        embedded_profile = row.get("profile")
+        if embedded_profile is not None:
+            if embedded_profile != entries[profile_id].profile.to_dict():
+                raise ValueError(f"numerical profile mismatch for {profile_id}")
+        attempt = int(row.get("attempt", 1))
+        profile_attempts = attempts.setdefault(profile_id, {})
+        if attempt in profile_attempts:
+            raise ValueError(f"duplicate numerical attempt {attempt} for {profile_id}")
+        profile_attempts[attempt] = row
+    return {
+        profile_id: profile_attempts[max(profile_attempts)]
+        for profile_id, profile_attempts in attempts.items()
+    }
+
+
+def _numerical_summary(row: Mapping[str, Any]) -> dict[str, Any]:
+    metrics = row.get("result", row.get("metrics", {}))
+    scalar_metrics: dict[str, Any] = {}
+    document_hash: str | None = None
+    if isinstance(metrics, Mapping):
+        for key, value in sorted(metrics.items()):
+            if key == "documents":
+                document_hash = _content_hash(value)
+            elif value is None or isinstance(value, (bool, int, float, str)):
+                scalar_metrics[str(key)] = value
+    return {
+        "state": row.get("state"),
+        "attempt": row.get("attempt"),
+        "record_hash": row.get("record_hash"),
+        "result_path": row.get("result_path"),
+        "scalar_metrics": scalar_metrics,
+        "document_metrics_hash": document_hash,
+    }
+
+
+def _factor_join_class_id(
+    entry: SweepManifestEntry,
+    numerical: Mapping[str, Any],
+) -> str:
+    """Group members whose deployment eligibility is candidate-equivalent.
+
+    Numerical quality values deliberately do not enter this identity.  Hardware
+    retention uses only the presence of a finite NLL; the value itself remains
+    bound to each member and is consumed later by the joint precision search.
+    """
+
+    base_validity = merge_validity(
+        entry.validity,
+        _validity_from_result(numerical),
+    )
+    profile = entry.profile
+    format_families = {
+        role: format_descriptor(token).family
+        for role, token in (
+            ("weight", profile.weight_format),
+            ("activation", profile.activation_format),
+            ("key", profile.key_format),
+            ("value", profile.value_format),
+        )
+    }
+    legality_stage_signature = sorted(
+        {
+            (issue.code, tuple(sorted(issue.stages)))
+            for issue in entry.legality.issues
+        }
+    )
+    body = {
+        "profile_kind": profile.kind,
+        "hardware_candidate": entry.legality.hardware_candidate,
+        "software_supported": entry.legality.software_supported,
+        "legality_stage_signature": legality_stage_signature,
+        "block_size": profile.block_size,
+        "vector_format_supported": profile.vector_format in VECTOR_FORMATS,
+        "format_families": format_families,
+        "rtl_mxint_activation_supported": (
+            profile.activation_format in {"MXINT4", "MXINT8"}
+        ),
+        "base_validity": base_validity.to_dict(),
+        "numerical_succeeded": numerical.get("state") == "succeeded",
+        "finite_mean_nll": _mean_nll(numerical) is not None,
+    }
+    return "hardware-join-class-" + _content_hash(body)
+
+
+def _packedkv_selector_status(
+    entry: SweepManifestEntry,
+    candidate: HardwareCandidate,
+    numerical: Mapping[str, Any],
+    validity: StackValidity,
+    capability: Mapping[str, Any] | None,
+) -> tuple[bool | None, dict[str, Any]]:
+    """Bind PackedKV selector eligibility to format, target, and RTL evidence."""
+
+    profile = entry.profile
+    if profile.kind == PROFILE_KIND_BF16_REFERENCE:
+        return False, {
+            "kind": "static_capability",
+            "evidence_id": None,
+            "reason": "bf16_reference_is_not_a_packedkv_hardware_profile",
+        }
+    families = {
+        role: format_descriptor(token).family
+        for role, token in (
+            ("weight", profile.weight_format),
+            ("activation", profile.activation_format),
+            ("key", profile.key_format),
+            ("value", profile.value_format),
+        )
+    }
+    if any(family != "mxint" for family in families.values()):
+        return False, {
+            "kind": "static_capability",
+            "evidence_id": (
+                "packedkv-selector-static-"
+                + _content_hash(
+                    {
+                        "constraint": "mxint_matrix_path_only",
+                        "families": families,
+                        "profile_id": entry.profile_id,
+                        "candidate_id": candidate.candidate_id,
+                    }
+                )
+            ),
+            "reason": "selector_is_wired_only_to_the_mxint_matrix_path",
+            "format_families": families,
+        }
+    issue_codes = tuple(
+        sorted(
+            issue["code"]
+            for issue in (capability or {}).get("issues", ())
+            if "rtl" in issue.get("stages", ())
+        )
+    )
+    if issue_codes or validity.rtl_valid is False:
+        return False, {
+            "kind": "capability_or_measured_failure",
+            "evidence_id": (
+                "packedkv-selector-failure-"
+                + _content_hash(
+                    {
+                        "profile_id": entry.profile_id,
+                        "candidate_id": candidate.candidate_id,
+                        "issue_codes": issue_codes,
+                        "rtl_valid": validity.rtl_valid,
+                        "numerical_record_hash": numerical.get("record_hash"),
+                    }
+                )
+            ),
+            "reason": "selector_capability_or_validation_failed",
+            "issue_codes": list(issue_codes),
+        }
+    if validity.rtl_valid is not True:
+        return None, {
+            "kind": "unmeasured",
+            "evidence_id": None,
+            "reason": "candidate_scoped_rtl_selector_evidence_is_missing",
+        }
+    evidence_payload = {
+        "profile_id": entry.profile_id,
+        "candidate_id": candidate.candidate_id,
+        "numerical_record_hash": numerical.get("record_hash"),
+        "rtl_valid": True,
+        "capability_schema": (capability or {}).get("schema_version"),
+    }
+    return True, {
+        "kind": "candidate_scoped_rtl_validation",
+        "evidence_id": (
+            "packedkv-selector-rtl-" + _content_hash(evidence_payload)
+        ),
+        **evidence_payload,
+    }
+
+
+@dataclass(frozen=True)
+class StudyProvenance:
+    """Content hashes that bind a hardware study to all of its inputs."""
+
+    manifest_hash: str
+    numerical_results_hash: str
+    hardware_space_hash: str
+    evaluator_version: str
+    model_revision: str
+    tokenizer_revision: str
+    code_revisions: tuple[tuple[str, str], ...] = ()
+    evaluator_provenance: Mapping[str, Any] = field(default_factory=dict)
+    search_schedule: Mapping[str, Any] = field(default_factory=dict)
+    schema_version: str = HARDWARE_STUDY_SCHEMA
+
+    def __post_init__(self) -> None:
+        for name in (
+            "manifest_hash",
+            "numerical_results_hash",
+            "hardware_space_hash",
+            "evaluator_version",
+            "model_revision",
+            "tokenizer_revision",
+        ):
+            if not getattr(self, name):
+                raise ValueError(f"{name} must be non-empty")
+        object.__setattr__(
+            self,
+            "code_revisions",
+            tuple(sorted((str(key), str(value)) for key, value in self.code_revisions)),
+        )
+        canonical_evaluator = json.loads(
+            _canonical_bytes(dict(self.evaluator_provenance))
+        )
+        object.__setattr__(
+            self,
+            "evaluator_provenance",
+            canonical_evaluator,
+        )
+        object.__setattr__(
+            self,
+            "search_schedule",
+            json.loads(_canonical_bytes(dict(self.search_schedule))),
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "manifest_hash": self.manifest_hash,
+            "numerical_results_hash": self.numerical_results_hash,
+            "hardware_space_hash": self.hardware_space_hash,
+            "evaluator_version": self.evaluator_version,
+            "model_revision": self.model_revision,
+            "tokenizer_revision": self.tokenizer_revision,
+            "code_revisions": dict(self.code_revisions),
+            "evaluator_provenance": dict(self.evaluator_provenance),
+            "search_schedule": dict(self.search_schedule),
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return _content_hash(self.to_dict())
+
+    @property
+    def run_id(self) -> str:
+        return f"hwdse-{self.canonical_hash}"
+
+
+@dataclass(frozen=True)
+class JoinedHardwareResult:
+    """One exact join of numerical identity, hardware metrics, and validity."""
+
+    run_id: str
+    profile_ordinal: int
+    profile_id: str
+    profile: Mapping[str, Any]
+    legality: Mapping[str, Any]
+    numerical_result_hash: str
+    numerical_summary: Mapping[str, Any]
+    candidate: HardwareCandidate
+    validity: StackValidity
+    metrics: HardwareMetrics | None
+    capability: Mapping[str, Any] | None = None
+    packedkv_selector_valid: bool | None = None
+    packedkv_selector_evidence: Mapping[str, Any] = field(
+        default_factory=dict
+    )
+    error_code: str | None = None
+    error_message: str | None = None
+    schema_version: str = HARDWARE_RESULT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if (
+            self.packedkv_selector_valid is not None
+            and not isinstance(self.packedkv_selector_valid, bool)
+        ):
+            raise TypeError(
+                "packedkv_selector_valid must be boolean or null"
+            )
+        evidence = dict(self.packedkv_selector_evidence)
+        if not evidence:
+            raise ValueError("PackedKV selector evidence must be explicit")
+        if self.packedkv_selector_valid is True and not evidence.get(
+            "evidence_id"
+        ):
+            raise ValueError(
+                "a valid PackedKV selector requires an evidence identity"
+            )
+        object.__setattr__(
+            self,
+            "packedkv_selector_evidence",
+            json.loads(_canonical_bytes(evidence)),
+        )
+
+    @property
+    def deployment_valid(self) -> bool:
+        return (
+            self.numerical_summary.get("state") == "succeeded"
+            and
+            self.legality.get("hardware_candidate") is True
+            and all(
+                getattr(self.validity, name) is True
+                for name in _VALIDITY_FIELDS
+                if name != "dc_calibrated"
+            )
+            and self.metrics is not None
+            and self.metrics.capacity.feasible
+            and self.metrics.runtime_feasible
+            and self.metrics.capacity_evidence_complete
+            and self.metrics.traffic_evidence_complete
+            and self.packedkv_selector_valid is True
+            and self.metrics.energy is not None
+            and self.metrics.energy.energy_tier in {
+                "analytic_anchored",
+                "dc_calibrated",
+            }
+            and (
+                self.metrics.resource_budget is not None
+                and self.metrics.resource_budget.feasible
+            )
+            and bool(self.metrics.layout_id)
+            and self.metrics.memory_timing_calibrated
+            and self.metrics.admission_correctness_valid
+            and self.metrics.timing_calibrated
+            and self.metrics.whole_model_rankable
+            and self.metrics.whole_model_energy is not None
+            and bool(self.metrics.system_calibration_id)
+            and not self.error_code
+        )
+
+    def _body(self) -> dict[str, Any]:
+        validity = self.validity.to_dict()
+        return {
+            "schema_version": self.schema_version,
+            "run_id": self.run_id,
+            "profile_ordinal": self.profile_ordinal,
+            "profile_id": self.profile_id,
+            "profile": dict(self.profile),
+            "legality": dict(self.legality),
+            "numerical_result_hash": self.numerical_result_hash,
+            "numerical_summary": dict(self.numerical_summary),
+            "candidate_id": self.candidate.candidate_id,
+            "hardware": self.candidate.to_dict(),
+            "capability": dict(self.capability) if self.capability else None,
+            "packedkv_selector_valid": self.packedkv_selector_valid,
+            "packedkv_selector_evidence": dict(
+                self.packedkv_selector_evidence
+            ),
+            "validity": validity,
+            **validity,
+            "deployment_valid": self.deployment_valid,
+            "metrics": self.metrics.to_dict() if self.metrics else None,
+            "error_code": self.error_code,
+            "error_message": self.error_message,
+        }
+
+    def to_dict(self) -> dict[str, Any]:
+        body = self._body()
+        return {**body, "record_hash": _content_hash(body)}
+
+
+@dataclass(frozen=True)
+class HardwareStudyArtifact:
+    path: Path
+    metadata_path: Path
+    run_id: str
+    result_count: int
+    stored_result_count: int
+    content_hash: str
+
+
+@dataclass(frozen=True)
+class _HardwareFactorGroup:
+    """One evaluator equivalence class and its ordered profile membership."""
+
+    factor_id: str
+    physical_signature_id: str
+    preflight_group_id: str
+    evaluation_group_id: str
+    schedule_ordinal: int
+    evaluation_group_ordinal: int
+    entries: tuple[SweepManifestEntry, ...]
+    join_classes: tuple[tuple[str, tuple[SweepManifestEntry, ...]], ...]
+    candidate_mask_sha256: str
+    passing_candidate_count: int
+
+
+@dataclass(frozen=True)
+class _HardwareFactorEvaluation:
+    """One physical-signature by hardware-candidate evaluation."""
+
+    ordinal: int
+    candidate_ordinal: int
+    group: _HardwareFactorGroup
+    candidate: HardwareCandidate
+    outcome: HardwareEvaluation
+
+    def to_dict(self, run_id: str) -> dict[str, Any]:
+        body = {
+            "schema_version": HARDWARE_FACTOR_RESULT_SCHEMA,
+            "run_id": run_id,
+            "factor_id": self.group.factor_id,
+            "factor_ordinal": self.ordinal,
+            "schedule_ordinal": self.group.schedule_ordinal,
+            "evaluation_group_ordinal": self.group.evaluation_group_ordinal,
+            "candidate_ordinal": self.candidate_ordinal,
+            "candidate_id": self.candidate.candidate_id,
+            "hardware": self.candidate.to_dict(),
+            "evaluation_validity": self.outcome.validity.to_dict(),
+            "metrics": (
+                self.outcome.metrics.to_dict()
+                if self.outcome.metrics is not None
+                else None
+            ),
+            "error_code": self.outcome.error_code,
+            "error_message": self.outcome.error_message,
+        }
+        return {**body, "factor_record_hash": _content_hash(body)}
+
+
+def _sha256_path(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for block in iter(lambda: handle.read(1 << 20), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _positive_compact_metric(value: Any) -> float | None:
+    if (
+        isinstance(value, bool)
+        or not isinstance(value, (int, float))
+        or not math.isfinite(float(value))
+        or float(value) <= 0
+    ):
+        return None
+    return float(value)
+
+
+def _compact_mean_nll(row: Mapping[str, Any]) -> float | None:
+    summary = row.get("numerical_summary")
+    scalars = summary.get("scalar_metrics") if isinstance(summary, Mapping) else None
+    if not isinstance(scalars, Mapping):
+        return None
+    value = scalars.get("mean_nll")
+    if (
+        isinstance(value, bool)
+        or not isinstance(value, (int, float))
+        or not math.isfinite(float(value))
+        or float(value) < 0
+    ):
+        return None
+    return float(value)
+
+
+def _compact_energy_tier_rank(value: Any) -> int:
+    if value == "dc_calibrated":
+        return 0
+    if value == "analytic_anchored":
+        return 1
+    return 2
+
+
+def _promotion_retention_key(
+    row: Mapping[str, Any],
+) -> tuple[Any, ...] | None:
+    """Mirror the exact profile-level ordering used by refinement selection."""
+
+    metrics = row.get("metrics")
+    if not isinstance(metrics, Mapping) or row.get("error_code") is not None:
+        return None
+    whole = metrics.get("whole_model")
+    energy = whole.get("calibrated_energy") if isinstance(whole, Mapping) else None
+    output_head = metrics.get("output_head_boundary")
+    head_estimate = (
+        output_head.get("estimate") if isinstance(output_head, Mapping) else None
+    )
+    capacity = metrics.get("capacity")
+    energy_tier = energy.get("energy_tier") if isinstance(energy, Mapping) else None
+    energy_identity = (
+        energy.get("energy_id") or energy.get("calibration_id")
+        if isinstance(energy, Mapping)
+        else None
+    )
+    mean_nll = _compact_mean_nll(row)
+    tpot_ms = (
+        _positive_compact_metric(whole.get("tpot_ms"))
+        if isinstance(whole, Mapping)
+        else None
+    )
+    tps = (
+        _positive_compact_metric(whole.get("tps"))
+        if isinstance(whole, Mapping)
+        else None
+    )
+    energy_j = (
+        _positive_compact_metric(energy.get("total_j"))
+        if isinstance(energy, Mapping)
+        else None
+    )
+    area_mm2 = _positive_compact_metric(metrics.get("area_mm2"))
+    if (
+        row.get("deployment_valid") is not True
+        or not isinstance(whole, Mapping)
+        or whole.get("rankable") is not True
+        or not isinstance(energy, Mapping)
+        or energy_tier not in {"analytic_anchored", "dc_calibrated"}
+        or not isinstance(energy_identity, str)
+        or not energy_identity
+        or not isinstance(whole.get("system_calibration_id"), str)
+        or not whole.get("system_calibration_id")
+        or metrics.get("timing_calibrated") is not True
+        or metrics.get("runtime_feasible") is not True
+        or not isinstance(capacity, Mapping)
+        or capacity.get("feasible") is not True
+        or row.get("packedkv_selector_valid") is not True
+        or not isinstance(head_estimate, Mapping)
+        or not isinstance(head_estimate.get("calibration_id"), str)
+        or not head_estimate.get("calibration_id")
+        or None in (mean_nll, tpot_ms, tps, energy_j, area_mm2)
+    ):
+        return None
+    return (
+        mean_nll,
+        _compact_energy_tier_rank(energy_tier),
+        energy_j,
+        tpot_ms,
+        -tps,
+        area_mm2,
+        str(row.get("profile_id", "")),
+        str(row.get("candidate_id", "")),
+    )
+
+
+def _plot_retention_values(
+    row: Mapping[str, Any],
+) -> Mapping[str, Any] | None:
+    if row.get("deployment_valid") is not True:
+        return None
+    metrics = row.get("metrics")
+    whole = metrics.get("whole_model") if isinstance(metrics, Mapping) else None
+    capacity = (
+        metrics.get("runtime_capacity_evidence")
+        if isinstance(metrics, Mapping)
+        else None
+    )
+    hardware = row.get("hardware")
+    if (
+        not isinstance(metrics, Mapping)
+        or not isinstance(whole, Mapping)
+        or whole.get("rankable") is not True
+        or not isinstance(capacity, Mapping)
+        or not isinstance(hardware, Mapping)
+    ):
+        raise ValueError("deployment-valid row has incomplete plot metrics")
+    energy = whole.get("calibrated_energy")
+    if isinstance(energy, Mapping):
+        energy_j = _positive_compact_metric(energy.get("total_j"))
+        energy_tier = energy.get("energy_tier", whole.get("energy_tier"))
+    else:
+        energy_j = _positive_compact_metric(whole.get("energy_per_token_j"))
+        energy_tier = whole.get("energy_tier")
+    resource_budget = metrics.get("resource_budget")
+    area_value = metrics.get(
+        "system_area_mm2",
+        resource_budget.get("aggregate_area_mm2")
+        if isinstance(resource_budget, Mapping)
+        else metrics.get("area_mm2"),
+    )
+    tpot_ms = _positive_compact_metric(whole.get("tpot_ms"))
+    tps = _positive_compact_metric(whole.get("tps"))
+    area_mm2 = _positive_compact_metric(area_value)
+    if None in (tpot_ms, tps, energy_j, area_mm2):
+        raise ValueError("deployment-valid row has non-positive plot metrics")
+    return {
+        "tpot_ms": tpot_ms,
+        "tps": tps,
+        "energy_j": energy_j,
+        "area_mm2": area_mm2,
+        "edp_j_s": energy_j * tpot_ms / 1000.0,
+        "energy_tier": (
+            str(energy_tier) if energy_tier not in (None, "") else None
+        ),
+    }
+
+
+def _latency_energy_dominates(
+    left: Mapping[str, Any],
+    right: Mapping[str, Any],
+) -> bool:
+    return (
+        float(left["tpot_ms"]) <= float(right["tpot_ms"])
+        and float(left["energy_j"]) <= float(right["energy_j"])
+        and (
+            float(left["tpot_ms"]) < float(right["tpot_ms"])
+            or float(left["energy_j"]) < float(right["energy_j"])
+        )
+    )
+
+
+def _frontier_identity(row: Mapping[str, Any]) -> tuple[str, str, str]:
+    return (
+        str(row.get("profile_id", "")),
+        str(row.get("candidate_id", "")),
+        str(row.get("record_hash", "")),
+    )
+
+
+def _frontier_retention_dominates(
+    left_row: Mapping[str, Any],
+    left_values: Mapping[str, Any],
+    right_row: Mapping[str, Any],
+    right_values: Mapping[str, Any],
+) -> bool:
+    """Pareto dominance with one canonical representative for exact ties."""
+
+    if _latency_energy_dominates(left_values, right_values):
+        return True
+    return (
+        float(left_values["tpot_ms"]) == float(right_values["tpot_ms"])
+        and float(left_values["energy_j"]) == float(right_values["energy_j"])
+        and _frontier_identity(left_row) < _frontier_identity(right_row)
+    )
+
+
+def _extrema_retention_key(
+    row: Mapping[str, Any],
+    values: Mapping[str, Any],
+    metric: str,
+) -> tuple[Any, ...]:
+    return (float(values[metric]), *_frontier_identity(row))
+
+
+class _CompactHardwareReducer:
+    """Retain exact decision rows while hashing the complete joined stream."""
+
+    def __init__(
+        self,
+        *,
+        run_id: str,
+        expected_count: int,
+        sample_limit: int,
+    ) -> None:
+        self.run_id = run_id
+        self.expected_count = expected_count
+        self.sample_limit = sample_limit
+        self.sample_seed = f"{run_id}:dominated-scatter"
+        self.enumeration_digest = hashlib.sha256()
+        self.observed_count = 0
+        self.profile_aggregates: dict[str, dict[str, Any]] = {}
+        self.frontier: list[tuple[int, Mapping[str, Any], Mapping[str, Any]]] = []
+        self.extrema: dict[
+            str,
+            tuple[tuple[Any, ...], int, Mapping[str, Any], Mapping[str, Any]],
+        ] = {}
+        self.sample_heap: list[tuple[int, int, str]] = []
+        self.sample_rows: dict[
+            str, tuple[int, Mapping[str, Any], Mapping[str, Any], str]
+        ] = {}
+        self.scatter_population_count = 0
+        self.declared_scatter_population_count = 0
+        self.dominated_population_count = 0
+        self.unrankable_population_count = 0
+
+    @staticmethod
+    def _row_identity(row: Mapping[str, Any]) -> tuple[str, str]:
+        return str(row.get("profile_id", "")), str(row.get("candidate_id", ""))
+
+    def _sample(
+        self,
+        *,
+        ordinal: int,
+        row: Mapping[str, Any],
+        values: Mapping[str, Any],
+        classification: str,
+    ) -> None:
+        if self.sample_limit == 0:
+            return
+        record_hash = str(row["record_hash"])
+        score = int(
+            hashlib.sha256(
+                f"{self.sample_seed}:{record_hash}".encode("utf-8")
+            ).hexdigest(),
+            16,
+        )
+        entry = (-score, -ordinal, record_hash)
+        if len(self.sample_heap) < self.sample_limit:
+            heapq.heappush(self.sample_heap, entry)
+            self.sample_rows[record_hash] = (
+                ordinal,
+                row,
+                values,
+                classification,
+            )
+            return
+        if entry <= self.sample_heap[0]:
+            return
+        removed = heapq.heapreplace(self.sample_heap, entry)
+        self.sample_rows.pop(removed[2], None)
+        self.sample_rows[record_hash] = (
+            ordinal,
+            row,
+            values,
+            classification,
+        )
+
+    @staticmethod
+    def _update_frontier(
+        frontier: list[tuple[int, Mapping[str, Any], Mapping[str, Any]]],
+        *,
+        ordinal: int,
+        row: Mapping[str, Any],
+        values: Mapping[str, Any],
+    ) -> tuple[
+        bool,
+        tuple[tuple[int, Mapping[str, Any], Mapping[str, Any]], ...],
+    ]:
+        if any(
+            _frontier_retention_dominates(
+                existing_row,
+                existing_values,
+                row,
+                values,
+            )
+            for _, existing_row, existing_values in frontier
+        ):
+            return False, ()
+        evicted = tuple(
+            item
+            for item in frontier
+            if _frontier_retention_dominates(
+                row,
+                values,
+                item[1],
+                item[2],
+            )
+        )
+        frontier[:] = [item for item in frontier if item not in evicted]
+        frontier.append((ordinal, row, values))
+        return True, evicted
+
+    @staticmethod
+    def _update_extrema(
+        extrema: dict[
+            str, tuple[tuple[Any, ...], int, Mapping[str, Any], Mapping[str, Any]]
+        ],
+        *,
+        ordinal: int,
+        row: Mapping[str, Any],
+        values: Mapping[str, Any],
+    ) -> None:
+        for label, metric in (
+            ("fastest", "tpot_ms"),
+            ("lowest_energy", "energy_j"),
+            ("best_edp", "edp_j_s"),
+        ):
+            key = _extrema_retention_key(row, values, metric)
+            current = extrema.get(label)
+            if current is None or key < current[0]:
+                extrema[label] = (key, ordinal, row, values)
+
+    def consume(self, row_value: Mapping[str, Any]) -> None:
+        row = dict(row_value)
+        record_hash = row.get("record_hash")
+        body = dict(row)
+        body.pop("record_hash", None)
+        if record_hash != _content_hash(body):
+            raise ValueError("hardware result checksum changed before compaction")
+        if row.get("run_id") != self.run_id:
+            raise ValueError("hardware result run differs from compact artifact")
+        payload = _canonical_bytes(
+            {"record_type": "result", **row},
+            newline=True,
+        )
+        self.enumeration_digest.update(payload)
+        ordinal = self.observed_count
+        self.observed_count += 1
+        profile_id, candidate_id = self._row_identity(row)
+        if not profile_id or not candidate_id:
+            raise ValueError("hardware result identity is incomplete")
+        aggregate = self.profile_aggregates.get(profile_id)
+        if aggregate is None:
+            aggregate = {
+                "profile_id": profile_id,
+                "profile_ordinal": int(row.get("profile_ordinal", -1)),
+                "profile": row.get("profile"),
+                "numerical_result_hash": row.get("numerical_result_hash"),
+                "total_count": 0,
+                "deployment_valid_count": 0,
+                "valid_count": 0,
+                "error_count": 0,
+                "error_code_counts": {},
+                "_frontiers": {},
+                "_extrema": {},
+            }
+            self.profile_aggregates[profile_id] = aggregate
+        elif (
+            aggregate["profile"] != row.get("profile")
+            or aggregate["numerical_result_hash"]
+            != row.get("numerical_result_hash")
+            or aggregate["profile_ordinal"] != int(row.get("profile_ordinal", -1))
+        ):
+            raise ValueError("hardware profile identity changed during compaction")
+        aggregate["total_count"] += 1
+        if row.get("deployment_valid") is True:
+            aggregate["deployment_valid_count"] += 1
+        error_code = row.get("error_code")
+        if error_code is not None:
+            code = str(error_code)
+            aggregate["error_count"] += 1
+            counts = aggregate["error_code_counts"]
+            counts[code] = counts.get(code, 0) + 1
+        promotion_key = _promotion_retention_key(row)
+        if promotion_key is not None:
+            aggregate["valid_count"] += 1
+        plot_values = _plot_retention_values(row)
+        if plot_values is None:
+            return
+        self.scatter_population_count += 1
+        if plot_values["energy_tier"] is None:
+            self.unrankable_population_count += 1
+            self._sample(
+                ordinal=ordinal,
+                row=row,
+                values=plot_values,
+                classification="sampled_unrankable",
+            )
+            return
+        self.declared_scatter_population_count += 1
+        retained_globally, evicted = self._update_frontier(
+            self.frontier,
+            ordinal=ordinal,
+            row=row,
+            values=plot_values,
+        )
+        newly_dominated = evicted if retained_globally else ((ordinal, row, plot_values),)
+        for dominated_ordinal, dominated_row, dominated_values in newly_dominated:
+            self.dominated_population_count += 1
+            self._sample(
+                ordinal=dominated_ordinal,
+                row=dominated_row,
+                values=dominated_values,
+                classification="sampled_dominated",
+            )
+        self._update_extrema(
+            self.extrema,
+            ordinal=ordinal,
+            row=row,
+            values=plot_values,
+        )
+        if promotion_key is not None:
+            tier = str(plot_values["energy_tier"])
+            local_frontiers = aggregate["_frontiers"]
+            local_frontier = local_frontiers.setdefault(tier, [])
+            self._update_frontier(
+                local_frontier,
+                ordinal=ordinal,
+                row=row,
+                values=plot_values,
+            )
+            local_extrema = aggregate["_extrema"].setdefault(tier, {})
+            self._update_extrema(
+                local_extrema,
+                ordinal=ordinal,
+                row=row,
+                values=plot_values,
+            )
+
+    def finish(
+        self,
+    ) -> tuple[dict[str, Any], tuple[tuple[Mapping[str, Any], tuple[str, ...]], ...]]:
+        if self.observed_count != self.expected_count:
+            raise RuntimeError("hardware result count changed during enumeration")
+        retained: dict[str, tuple[int, Mapping[str, Any]]] = {}
+        labels: dict[str, set[str]] = {}
+
+        def retain(
+            ordinal: int,
+            row: Mapping[str, Any],
+            label: str,
+        ) -> None:
+            record_hash = str(row["record_hash"])
+            retained.setdefault(record_hash, (ordinal, row))
+            labels.setdefault(record_hash, set()).add(label)
+
+        aggregate_rows = []
+        for aggregate in sorted(
+            self.profile_aggregates.values(),
+            key=lambda item: (int(item["profile_ordinal"]), str(item["profile_id"])),
+        ):
+            local_frontiers = aggregate.pop("_frontiers")
+            local_extrema = aggregate.pop("_extrema")
+            frontier_records = []
+            for tier, frontier in sorted(local_frontiers.items()):
+                for ordinal, row, values in sorted(
+                    frontier,
+                    key=lambda item: (
+                        float(item[2]["tpot_ms"]),
+                        float(item[2]["energy_j"]),
+                        _frontier_identity(item[1]),
+                    ),
+                ):
+                    retain(ordinal, row, "profile_frontier")
+                    frontier_records.append(
+                        {
+                            "energy_tier": tier,
+                            "record_hash": row["record_hash"],
+                            "candidate_id": row["candidate_id"],
+                        }
+                    )
+            extrema_records: dict[str, list[dict[str, Any]]] = {
+                "fastest": [],
+                "lowest_energy": [],
+                "best_edp": [],
+            }
+            for tier, extrema in sorted(local_extrema.items()):
+                for name, (_, ordinal, row, _) in sorted(extrema.items()):
+                    retain(ordinal, row, f"profile_{name}")
+                    extrema_records[name].append(
+                        {
+                            "energy_tier": tier,
+                            "record_hash": row["record_hash"],
+                            "candidate_id": row["candidate_id"],
+                        }
+                    )
+            aggregate_rows.append(
+                {
+                    **aggregate,
+                    "error_code_counts": dict(
+                        sorted(aggregate["error_code_counts"].items())
+                    ),
+                    "local_frontier": frontier_records,
+                    "local_frontier_count": len(frontier_records),
+                    "local_extrema": extrema_records,
+                }
+            )
+        for ordinal, row, _ in self.frontier:
+            retain(ordinal, row, "exact_frontier")
+        for label, (_, ordinal, row, _) in self.extrema.items():
+            retain(ordinal, row, f"exact_{label}")
+        sampled_dominated_count = 0
+        sampled_unrankable_count = 0
+        for ordinal, row, _, label in self.sample_rows.values():
+            if label == "sampled_unrankable":
+                sampled_unrankable_count += 1
+            else:
+                sampled_dominated_count += 1
+            retain(ordinal, row, label)
+        stored = tuple(
+            (row, tuple(sorted(labels[record_hash])))
+            for record_hash, (ordinal, row) in sorted(
+                retained.items(),
+                key=lambda item: (item[1][0], item[0]),
+            )
+        )
+        label_counts: dict[str, int] = {}
+        for _, row_labels in stored:
+            for label in row_labels:
+                label_counts[label] = label_counts.get(label, 0) + 1
+        retention = {
+            "sample_seed": self.sample_seed,
+            "sample_limit": self.sample_limit,
+            "scatter_population_count": self.scatter_population_count,
+            "declared_scatter_population_count": (
+                self.declared_scatter_population_count
+            ),
+            "dominated_population_count": self.dominated_population_count,
+            "unrankable_population_count": self.unrankable_population_count,
+            "sampled_dominated_count": sampled_dominated_count,
+            "sampled_unrankable_count": sampled_unrankable_count,
+            "exact_frontier_count": len(self.frontier),
+            "stored_result_count": len(stored),
+            "label_counts": dict(sorted(label_counts.items())),
+            "sampling_policy": (
+                "smallest_sha256_over_exact_dominated_and_unrankable_population"
+            ),
+        }
+        summary = {
+            "observed_result_count": self.observed_count,
+            "enumeration_sha256": self.enumeration_digest.hexdigest(),
+            "profile_aggregates": aggregate_rows,
+            "retention": retention,
+        }
+        return summary, stored
+
+
+class _FactorizedHardwareReducer:
+    """Reduce physical evaluations without constructing the conceptual join."""
+
+    def __init__(self, study: "ExactHardwareStudy") -> None:
+        self.study = study
+        self.run_id = study.provenance.run_id
+        self.sample_limit = study.scatter_sample_limit
+        self.sample_seed = f"{self.run_id}:factor-dominated-scatter"
+        self.factor_digest = hashlib.sha256()
+        self.observed_factor_count = 0
+        self.rankable_factor_population_count = 0
+        self.dominated_factor_population_count = 0
+        self.unrankable_factor_population_count = 0
+        self.global_frontier: list[tuple[Any, ...]] = []
+        self.global_extrema: dict[str, tuple[Any, ...]] = {}
+        self.sample_heap: list[tuple[int, int, str]] = []
+        self.sample_factors: dict[str, tuple[Any, ...]] = {}
+        self.class_states: dict[tuple[str, str], dict[str, Any]] = {}
+        self.profile_state: dict[str, dict[str, Any]] = {}
+        for group in study._factor_memberships:
+            for class_id, entries in group.join_classes:
+                state = {
+                    "group": group,
+                    "class_id": class_id,
+                    "entries": entries,
+                    "total_count": group.passing_candidate_count,
+                    "deployment_valid_count": 0,
+                    "valid_count": 0,
+                    "error_count": 0,
+                    "error_code_counts": {},
+                    "frontiers": {},
+                    "extrema": {},
+                }
+                self.class_states[(group.factor_id, class_id)] = state
+                for entry in entries:
+                    if entry.profile_id in self.profile_state:
+                        raise ValueError(
+                            "a profile occurs in more than one factor membership"
+                        )
+                    self.profile_state[entry.profile_id] = state
+
+    @staticmethod
+    def _update_frontier(
+        frontier: list[tuple[Any, ...]],
+        item: tuple[Any, ...],
+    ) -> tuple[bool, tuple[tuple[Any, ...], ...]]:
+        row = item[2]
+        values = item[3]
+        if any(
+            _frontier_retention_dominates(
+                existing[2],
+                existing[3],
+                row,
+                values,
+            )
+            for existing in frontier
+        ):
+            return False, ()
+        evicted = tuple(
+            existing
+            for existing in frontier
+            if _frontier_retention_dominates(
+                row,
+                values,
+                existing[2],
+                existing[3],
+            )
+        )
+        frontier[:] = [existing for existing in frontier if existing not in evicted]
+        frontier.append(item)
+        return True, evicted
+
+    @staticmethod
+    def _update_extrema(
+        extrema: dict[str, tuple[Any, ...]],
+        item: tuple[Any, ...],
+    ) -> None:
+        row = item[2]
+        values = item[3]
+        for label, metric in (
+            ("fastest", "tpot_ms"),
+            ("lowest_energy", "energy_j"),
+            ("best_edp", "edp_j_s"),
+        ):
+            key = _extrema_retention_key(row, values, metric)
+            current = extrema.get(label)
+            if current is None or key < current[0]:
+                extrema[label] = (key, *item)
+
+    def _sample(self, item: tuple[Any, ...], classification: str) -> None:
+        if self.sample_limit == 0:
+            return
+        factor = item[1]
+        factor_row = factor.to_dict(self.run_id)
+        factor_hash = str(factor_row["factor_record_hash"])
+        score = int(
+            hashlib.sha256(
+                f"{self.sample_seed}:{factor_hash}".encode("utf-8")
+            ).hexdigest(),
+            16,
+        )
+        entry = (-score, -int(factor.ordinal), factor_hash)
+        if len(self.sample_heap) < self.sample_limit:
+            heapq.heappush(self.sample_heap, entry)
+            self.sample_factors[factor_hash] = (*item, classification)
+            return
+        if entry <= self.sample_heap[0]:
+            return
+        removed = heapq.heapreplace(self.sample_heap, entry)
+        self.sample_factors.pop(removed[2], None)
+        self.sample_factors[factor_hash] = (*item, classification)
+
+    def consume(self, factor: _HardwareFactorEvaluation) -> None:
+        if factor.ordinal != self.observed_factor_count:
+            raise ValueError("factor evaluation order changed during enumeration")
+        factor_row = factor.to_dict(self.run_id)
+        self.factor_digest.update(
+            _canonical_bytes(
+                {"record_type": "factor_result", **factor_row},
+                newline=True,
+            )
+        )
+        self.observed_factor_count += 1
+        class_rows = []
+        for class_id, entries in factor.group.join_classes:
+            state = self.class_states[(factor.group.factor_id, class_id)]
+            representative = min(
+                entries,
+                key=lambda entry: (entry.profile_id, entry.ordinal),
+            )
+            joined = self.study._joined_result(
+                representative,
+                factor.candidate,
+                factor.outcome,
+            ).to_dict()
+            if joined["candidate_id"] != factor_row["candidate_id"]:
+                raise ValueError("factor candidate changed during profile binding")
+            if joined["metrics"] != factor_row["metrics"]:
+                raise ValueError("factor metrics changed during profile binding")
+            if joined.get("deployment_valid") is True:
+                state["deployment_valid_count"] += 1
+            if joined.get("error_code") is not None:
+                code = str(joined["error_code"])
+                state["error_count"] += 1
+                counts = state["error_code_counts"]
+                counts[code] = counts.get(code, 0) + 1
+            promotion_key = _promotion_retention_key(joined)
+            if promotion_key is not None:
+                state["valid_count"] += 1
+            values = _plot_retention_values(joined)
+            if values is not None and promotion_key is not None:
+                tier = str(values["energy_tier"])
+                item = (
+                    factor.ordinal,
+                    factor,
+                    joined,
+                    values,
+                    representative,
+                )
+                local_frontier = state["frontiers"].setdefault(tier, [])
+                self._update_frontier(local_frontier, item)
+                local_extrema = state["extrema"].setdefault(tier, {})
+                self._update_extrema(local_extrema, item)
+            class_rows.append((entries, representative, joined, values))
+
+        rankable = [item for item in class_rows if item[3] is not None]
+        if not rankable:
+            self.unrankable_factor_population_count += 1
+            _, canonical_entry, joined, _ = min(
+                class_rows,
+                key=lambda item: (item[1].profile_id, item[1].ordinal),
+            )
+            self._sample(
+                (
+                    factor.ordinal,
+                    factor,
+                    joined,
+                    {},
+                    canonical_entry,
+                ),
+                "sampled_unrankable",
+            )
+            return
+        self.rankable_factor_population_count += 1
+        _, canonical_entry, canonical_joined, values = min(
+            rankable,
+            key=lambda item: _frontier_identity(item[2]),
+        )
+        global_item = (
+            factor.ordinal,
+            factor,
+            canonical_joined,
+            values,
+            canonical_entry,
+        )
+        retained, evicted = self._update_frontier(
+            self.global_frontier,
+            global_item,
+        )
+        newly_dominated = evicted if retained else (global_item,)
+        for item in newly_dominated:
+            self.dominated_factor_population_count += 1
+            self._sample(item, "sampled_dominated")
+        self._update_extrema(self.global_extrema, global_item)
+
+    def finish(
+        self,
+    ) -> tuple[
+        dict[str, Any],
+        tuple[Mapping[str, Any], ...],
+        tuple[Mapping[str, Any], ...],
+    ]:
+        if self.observed_factor_count != self.study.expected_factor_evaluation_count:
+            raise RuntimeError("hardware factor count changed during enumeration")
+        retained_factors: dict[str, tuple[int, Mapping[str, Any]]] = {}
+        binding_rows: dict[tuple[str, str], Mapping[str, Any]] = {}
+        binding_labels: dict[tuple[str, str], set[str]] = {}
+
+        def retain(
+            factor: _HardwareFactorEvaluation,
+            entry: SweepManifestEntry,
+            label: str,
+        ) -> Mapping[str, Any]:
+            factor_row = factor.to_dict(self.run_id)
+            factor_hash = str(factor_row["factor_record_hash"])
+            retained_factors.setdefault(
+                factor_hash,
+                (factor.ordinal, factor_row),
+            )
+            key = (factor_hash, entry.profile_id)
+            joined = binding_rows.get(key)
+            if joined is None:
+                joined = self.study._joined_result(
+                    entry,
+                    factor.candidate,
+                    factor.outcome,
+                ).to_dict()
+                if (
+                    joined["candidate_id"] != factor_row["candidate_id"]
+                    or joined["hardware"] != factor_row["hardware"]
+                    or joined["metrics"] != factor_row["metrics"]
+                    or joined["error_code"] != factor_row["error_code"]
+                    or joined["error_message"] != factor_row["error_message"]
+                ):
+                    raise ValueError("retained factor does not reconstruct its join")
+                binding_rows[key] = joined
+            binding_labels.setdefault(key, set()).add(label)
+            return joined
+
+        frontier_by_profile: dict[str, list[dict[str, Any]]] = {}
+        extrema_by_profile: dict[str, dict[str, list[dict[str, Any]]]] = {}
+        for state in self.class_states.values():
+            for entry in state["entries"]:
+                frontier_by_profile[entry.profile_id] = []
+                extrema_by_profile[entry.profile_id] = {
+                    "fastest": [],
+                    "lowest_energy": [],
+                    "best_edp": [],
+                }
+            for tier, frontier in sorted(state["frontiers"].items()):
+                ordered = sorted(
+                    frontier,
+                    key=lambda item: (
+                        float(item[3]["tpot_ms"]),
+                        float(item[3]["energy_j"]),
+                        str(item[1].candidate.candidate_id),
+                    ),
+                )
+                for item in ordered:
+                    factor = item[1]
+                    for entry in state["entries"]:
+                        joined = retain(factor, entry, "profile_frontier")
+                        frontier_by_profile[entry.profile_id].append(
+                            {
+                                "energy_tier": tier,
+                                "factor_record_hash": factor.to_dict(self.run_id)[
+                                    "factor_record_hash"
+                                ],
+                                "record_hash": joined["record_hash"],
+                                "candidate_id": joined["candidate_id"],
+                            }
+                        )
+            for tier, extrema in sorted(state["extrema"].items()):
+                for name, extremum in sorted(extrema.items()):
+                    factor = extremum[2]
+                    for entry in state["entries"]:
+                        joined = retain(factor, entry, f"profile_{name}")
+                        extrema_by_profile[entry.profile_id][name].append(
+                            {
+                                "energy_tier": tier,
+                                "factor_record_hash": factor.to_dict(self.run_id)[
+                                    "factor_record_hash"
+                                ],
+                                "record_hash": joined["record_hash"],
+                                "candidate_id": joined["candidate_id"],
+                            }
+                        )
+
+        for item in self.global_frontier:
+            retain(item[1], item[4], "exact_frontier")
+        for label, extremum in self.global_extrema.items():
+            retain(extremum[2], extremum[5], f"exact_{label}")
+        sampled_dominated_count = 0
+        sampled_unrankable_count = 0
+        for item in self.sample_factors.values():
+            label = str(item[-1])
+            if label == "sampled_unrankable":
+                sampled_unrankable_count += 1
+            else:
+                sampled_dominated_count += 1
+            retain(item[1], item[4], label)
+
+        aggregate_rows = []
+        membership_by_profile = {
+            str(member["profile_id"]): member
+            for membership in self.study.factor_membership_records()
+            for member in membership["members"]
+        }
+        for profile_id, member in sorted(
+            membership_by_profile.items(),
+            key=lambda item: (
+                int(item[1]["profile_ordinal"]),
+                item[0],
+            ),
+        ):
+            state = self.profile_state[profile_id]
+            local_frontier = frontier_by_profile[profile_id]
+            aggregate_rows.append(
+                {
+                    "profile_id": profile_id,
+                    "profile_ordinal": member["profile_ordinal"],
+                    "profile": member["profile"],
+                    "numerical_result_hash": member["numerical_result_hash"],
+                    "total_count": state["total_count"],
+                    "deployment_valid_count": state[
+                        "deployment_valid_count"
+                    ],
+                    "valid_count": state["valid_count"],
+                    "error_count": state["error_count"],
+                    "error_code_counts": dict(
+                        sorted(state["error_code_counts"].items())
+                    ),
+                    "local_frontier": local_frontier,
+                    "local_frontier_count": len(local_frontier),
+                    "local_extrema": extrema_by_profile[profile_id],
+                }
+            )
+
+        stored_bindings = []
+        factor_ordinal_by_hash = {
+            factor_hash: ordinal
+            for factor_hash, (ordinal, _) in retained_factors.items()
+        }
+        for key, joined in sorted(
+            binding_rows.items(),
+            key=lambda item: (
+                factor_ordinal_by_hash[item[0][0]],
+                int(item[1]["profile_ordinal"]),
+                item[0][1],
+            ),
+        ):
+            factor_hash, profile_id = key
+            labels = tuple(sorted(binding_labels[key]))
+            join = {
+                "capability": joined["capability"],
+                "packedkv_selector_valid": joined[
+                    "packedkv_selector_valid"
+                ],
+                "packedkv_selector_evidence": joined[
+                    "packedkv_selector_evidence"
+                ],
+                "validity": joined["validity"],
+                "deployment_valid": joined["deployment_valid"],
+                "joined_record_hash": joined["record_hash"],
+            }
+            body = {
+                "schema_version": HARDWARE_FACTOR_BINDING_SCHEMA,
+                "factor_record_hash": factor_hash,
+                "profile_id": profile_id,
+                "retention_labels": list(labels),
+                "join": join,
+            }
+            stored_bindings.append(
+                {**body, "binding_hash": _content_hash(body)}
+            )
+
+        stored_factor_rows = tuple(
+            row
+            for _, row in sorted(
+                retained_factors.values(),
+                key=lambda item: (item[0], item[1]["factor_record_hash"]),
+            )
+        )
+        label_counts: dict[str, int] = {}
+        for labels in binding_labels.values():
+            for label in labels:
+                label_counts[label] = label_counts.get(label, 0) + 1
+        retention = {
+            "sample_seed": self.sample_seed,
+            "sample_limit": self.sample_limit,
+            "factor_population_count": self.observed_factor_count,
+            "rankable_factor_population_count": (
+                self.rankable_factor_population_count
+            ),
+            "dominated_factor_population_count": (
+                self.dominated_factor_population_count
+            ),
+            "unrankable_factor_population_count": (
+                self.unrankable_factor_population_count
+            ),
+            "sampled_dominated_count": sampled_dominated_count,
+            "sampled_unrankable_count": sampled_unrankable_count,
+            "exact_frontier_count": len(self.global_frontier),
+            "stored_factor_result_count": len(stored_factor_rows),
+            "stored_result_count": len(stored_bindings),
+            "label_counts": dict(sorted(label_counts.items())),
+            "sampling_policy": (
+                "smallest_sha256_over_exact_factor_dominated_and_unrankable_population"
+            ),
+        }
+        summary = {
+            "factor_evaluation_count": self.observed_factor_count,
+            "factor_evaluation_sha256": self.factor_digest.hexdigest(),
+            "profile_aggregates": aggregate_rows,
+            "retention": retention,
+        }
+        return summary, stored_factor_rows, tuple(stored_bindings)
+
+
+class ExactHardwareStudy:
+    """Join the complete feasible precision and hardware cross-product."""
+
+    def __init__(
+        self,
+        *,
+        manifest: SweepManifest,
+        numerical_results: Iterable[Mapping[str, Any]],
+        space: ExactHardwareSpace,
+        hidden_size: int,
+        evaluator: HardwareEvaluator,
+        evaluator_version: str,
+        evaluator_provenance: Mapping[str, Any] | None = None,
+        code_revisions: Mapping[str, str] | None = None,
+        require_complete: bool = True,
+        include_numerical_only: bool = False,
+        capability_target: PackedKVRuntimeTarget | None = None,
+        relative_perplexity_limit: float | None = None,
+        scatter_sample_limit: int = HARDWARE_SCATTER_SAMPLE_LIMIT,
+    ) -> None:
+        self.manifest = manifest
+        self.space = space
+        self.hidden_size = int(hidden_size)
+        self.evaluator = evaluator
+        if (
+            isinstance(scatter_sample_limit, bool)
+            or not isinstance(scatter_sample_limit, int)
+            or scatter_sample_limit < 0
+        ):
+            raise ValueError("scatter_sample_limit must be a non-negative integer")
+        self.scatter_sample_limit = scatter_sample_limit
+        if capability_target is None:
+            architecture = manifest.model_architecture
+            capability_target = replace(
+                DEFAULT_PACKED_KV_TARGET,
+                hlen=int(architecture["head_dim"]),
+                kv_heads=int(architecture["num_key_value_heads"]),
+                head_dim=int(architecture["head_dim"]),
+            )
+        self.capability_target = capability_target
+        self._rows = _index_numerical_results(manifest, numerical_results)
+        source_entries = tuple(
+            entry
+            for entry in manifest.entries
+            if include_numerical_only or entry.legality.hardware_candidate
+        )
+        required_entries = list(source_entries)
+        reference_entry = None
+        if relative_perplexity_limit is not None:
+            if (
+                isinstance(relative_perplexity_limit, bool)
+                or not isinstance(relative_perplexity_limit, (int, float))
+                or not math.isfinite(float(relative_perplexity_limit))
+                or float(relative_perplexity_limit) <= 1.0
+            ):
+                raise ValueError(
+                    "relative_perplexity_limit must be finite and greater than one"
+                )
+            references = tuple(
+                entry
+                for entry in manifest.entries
+                if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+            )
+            if len(references) != 1:
+                raise ValueError(
+                    "the accuracy gate requires exactly one BF16 reference"
+                )
+            reference_entry = references[0]
+            if reference_entry not in required_entries:
+                required_entries.append(reference_entry)
+        if require_complete:
+            missing = [
+                entry.profile_id
+                for entry in required_entries
+                if entry.profile_id not in self._rows
+            ]
+            if missing:
+                raise ValueError(
+                    f"missing {len(missing)} hardware-relevant numerical results"
+                )
+        available_entries = tuple(
+            entry
+            for entry in source_entries
+            if entry.profile_id in self._rows
+        )
+        accuracy_threshold = None
+        reference_mean_nll = None
+        if relative_perplexity_limit is not None:
+            reference_row = self._rows.get(reference_entry.profile_id)
+            reference_mean_nll = (
+                _mean_nll(reference_row)
+                if reference_row is not None
+                else None
+            )
+            if reference_mean_nll is None:
+                raise ValueError(
+                    "the BF16 accuracy reference is missing a successful finite NLL"
+                )
+            accuracy_threshold = reference_mean_nll + math.log(
+                float(relative_perplexity_limit)
+            )
+            self._entries = tuple(
+                entry
+                for entry in available_entries
+                if (
+                    (mean_nll := _mean_nll(self._rows[entry.profile_id]))
+                    is not None
+                    and mean_nll <= accuracy_threshold
+                )
+            )
+        else:
+            self._entries = available_entries
+
+        rows_bound_to_schedule = {
+            entry.profile_id: self._rows[entry.profile_id]
+            for entry in required_entries
+            if entry.profile_id in self._rows
+        }
+        selected_rows = [
+            rows_bound_to_schedule[entry.profile_id]
+            for entry in manifest.entries
+            if entry.profile_id in rows_bound_to_schedule
+        ]
+        structural_candidate_count = space.candidate_count(self.hidden_size)
+        candidate_preflight = getattr(evaluator, "candidate_preflight", None)
+        base_candidate_mask = bytearray(structural_candidate_count)
+        base_candidate_count = 0
+        candidate_rejection_counts: dict[str, int] = {}
+        candidate_preflight_errors: dict[str, int] = {}
+        for candidate_index, candidate in enumerate(
+            space.iter_candidates(self.hidden_size)
+        ):
+            gate = None
+            if candidate_preflight is not None:
+                try:
+                    gate = candidate_preflight(candidate)
+                    if gate is not None and not isinstance(
+                        gate,
+                        HardwareEvaluation,
+                    ):
+                        raise TypeError(
+                            "candidate preflight must return HardwareEvaluation or None"
+                        )
+                    if gate is not None and (
+                        gate.metrics is not None or gate.error_code is None
+                    ):
+                        raise ValueError(
+                            "a candidate preflight rejection must be a failed evaluation"
+                        )
+                except Exception as exc:
+                    error_name = type(exc).__name__
+                    candidate_preflight_errors[error_name] = (
+                        candidate_preflight_errors.get(error_name, 0) + 1
+                    )
+                    gate = None
+            if gate is None:
+                base_candidate_mask[candidate_index] = 1
+                base_candidate_count += 1
+            else:
+                code = str(gate.error_code)
+                candidate_rejection_counts[code] = (
+                    candidate_rejection_counts.get(code, 0) + 1
+                )
+
+        physical_groups: dict[str, list[SweepManifestEntry]] = {}
+        preflight_groups: dict[str, list[SweepManifestEntry]] = {}
+        group_keys: dict[str, tuple[str, str, str]] = {}
+        for entry in self._entries:
+            numerical = self._rows[entry.profile_id]
+            physical_key = _evaluator_group_key(
+                evaluator,
+                "physical_cost_group_key",
+                entry,
+                numerical,
+            )
+            physical_groups.setdefault(physical_key, []).append(entry)
+            preflight_key = _evaluator_group_key(
+                evaluator,
+                "preflight_group_key",
+                entry,
+                numerical,
+            )
+            evaluation_key = _evaluator_group_key(
+                evaluator,
+                "evaluation_group_key",
+                entry,
+                numerical,
+            )
+            group_keys[entry.profile_id] = (
+                physical_key,
+                preflight_key,
+                evaluation_key,
+            )
+            preflight_groups.setdefault(preflight_key, []).append(entry)
+
+        for label, key_index in (("preflight", 1), ("evaluation", 2)):
+            physical_by_group: dict[str, set[str]] = {}
+            for keys in group_keys.values():
+                physical_key = keys[0]
+                group_key = keys[key_index]
+                physical_by_group.setdefault(group_key, set()).add(physical_key)
+            if any(len(keys) != 1 for keys in physical_by_group.values()):
+                raise ValueError(
+                    f"{label} equivalence merges distinct physical-cost signatures"
+                )
+        preflight_by_evaluation: dict[str, set[str]] = {}
+        for _, preflight_key, evaluation_key in group_keys.values():
+            preflight_by_evaluation.setdefault(evaluation_key, set()).add(
+                preflight_key
+            )
+        if any(len(keys) != 1 for keys in preflight_by_evaluation.values()):
+            raise ValueError(
+                "one evaluation equivalence class spans different preflight proofs"
+            )
+
+        preflight = getattr(evaluator, "preflight", None)
+        scheduled: list[
+            tuple[tuple[SweepManifestEntry, ...], bytes, int]
+        ] = []
+        rejection_counts: dict[str, int] = {}
+        preflight_error_counts: dict[str, int] = {}
+        preflight_calls = 0
+        simulator_pricing_count = 0
+        for entries in preflight_groups.values():
+            ordered_entries = tuple(sorted(entries, key=lambda item: item.ordinal))
+            representative = ordered_entries[0]
+            numerical = self._rows[representative.profile_id]
+            passing_mask = bytearray(structural_candidate_count)
+            passing_count = 0
+            for candidate_index, candidate in enumerate(
+                space.iter_candidates(self.hidden_size)
+            ):
+                if not base_candidate_mask[candidate_index]:
+                    continue
+                gate = None
+                if preflight is not None:
+                    preflight_calls += 1
+                    try:
+                        gate = preflight(representative, candidate, numerical)
+                        if gate is not None and not isinstance(
+                            gate,
+                            HardwareEvaluation,
+                        ):
+                            raise TypeError(
+                                "hardware preflight must return HardwareEvaluation or None"
+                            )
+                        if gate is not None and gate.metrics is not None:
+                            raise ValueError(
+                                "a rejected hardware preflight cannot carry metrics"
+                            )
+                        if gate is not None and gate.error_code is None:
+                            raise ValueError(
+                                "a rejected hardware preflight requires an error code"
+                            )
+                    except Exception as exc:
+                        error_name = type(exc).__name__
+                        preflight_error_counts[error_name] = (
+                            preflight_error_counts.get(error_name, 0) + 1
+                        )
+                        # A failed proof is not proof of infeasibility.  Keep
+                        # the point for the full evaluator to fail closed.
+                        gate = None
+                if gate is None:
+                    passing_mask[candidate_index] = 1
+                    passing_count += 1
+                else:
+                    code = str(gate.error_code)
+                    rejection_counts[code] = rejection_counts.get(code, 0) + 1
+            scheduled.append(
+                (ordered_entries, bytes(passing_mask), passing_count)
+            )
+            evaluation_keys = {
+                group_keys[entry.profile_id][2]
+                for entry in ordered_entries
+            }
+            simulator_pricing_count += len(evaluation_keys) * passing_count
+
+        self._schedule = tuple(
+            sorted(scheduled, key=lambda item: item[0][0].ordinal)
+        )
+        self._evaluation_group_keys = {
+            profile_id: keys[2] for profile_id, keys in group_keys.items()
+        }
+        factor_schedule = []
+        factor_memberships = []
+        for schedule_ordinal, (entries, candidate_mask, passing_count) in enumerate(
+            self._schedule
+        ):
+            evaluation_groups: dict[str, list[SweepManifestEntry]] = {}
+            for entry in entries:
+                evaluation_key = self._evaluation_group_keys[entry.profile_id]
+                evaluation_groups.setdefault(evaluation_key, []).append(entry)
+            groups = []
+            for evaluation_group_ordinal, (
+                evaluation_key,
+                grouped_entries_value,
+            ) in enumerate(evaluation_groups.items()):
+                grouped_entries = tuple(grouped_entries_value)
+                representative = grouped_entries[0]
+                physical_key, preflight_key, _ = group_keys[
+                    representative.profile_id
+                ]
+                factor_id = "hardware-factor-" + _content_hash(
+                    {
+                        "physical_signature_id": physical_key,
+                        "preflight_group_id": preflight_key,
+                        "evaluation_group_id": evaluation_key,
+                        "member_profile_ids": [
+                            entry.profile_id for entry in grouped_entries
+                        ],
+                    }
+                )
+                class_members: dict[str, list[SweepManifestEntry]] = {}
+                for entry in grouped_entries:
+                    class_id = _factor_join_class_id(
+                        entry,
+                        self._rows[entry.profile_id],
+                    )
+                    class_members.setdefault(class_id, []).append(entry)
+                join_classes = tuple(
+                    (class_id, tuple(members))
+                    for class_id, members in class_members.items()
+                )
+                group = _HardwareFactorGroup(
+                    factor_id=factor_id,
+                    physical_signature_id=physical_key,
+                    preflight_group_id=preflight_key,
+                    evaluation_group_id=evaluation_key,
+                    schedule_ordinal=schedule_ordinal,
+                    evaluation_group_ordinal=evaluation_group_ordinal,
+                    entries=grouped_entries,
+                    join_classes=join_classes,
+                    candidate_mask_sha256=hashlib.sha256(candidate_mask).hexdigest(),
+                    passing_candidate_count=passing_count,
+                )
+                groups.append(group)
+                factor_memberships.append(group)
+            factor_schedule.append((tuple(groups), candidate_mask))
+        self._factor_schedule = tuple(factor_schedule)
+        self._factor_memberships = tuple(factor_memberships)
+        self._expected_result_count = sum(
+            len(entries) * passing_count
+            for entries, _, passing_count in self._schedule
+        )
+        self._expected_factor_evaluation_count = sum(
+            group.passing_candidate_count
+            for group in self._factor_memberships
+        )
+        raw_cross_product = len(available_entries) * structural_candidate_count
+        accuracy_cross_product = len(self._entries) * structural_candidate_count
+        signature_cross_product = len(physical_groups) * base_candidate_count
+        preflight_equivalence_pairs = sum(
+            passing_count for _, _, passing_count in self._schedule
+        )
+        search_schedule = {
+            "schema": "plena-lossless-joint-search-schedule",
+            "profile_counts": {
+                "hardware_relevant_available": len(available_entries),
+                "accuracy_passing": len(self._entries),
+                "accuracy_rejected": (
+                    len(available_entries) - len(self._entries)
+                ),
+                "physical_cost_signatures": len(physical_groups),
+                "preflight_equivalence_groups": len(preflight_groups),
+            },
+            "candidate_counts": {
+                "structurally_legal": structural_candidate_count,
+                "candidate_resource_passing": base_candidate_count,
+            },
+            "cross_product_counts": {
+                "raw_hardware_relevant": raw_cross_product,
+                "after_accuracy_constraint": accuracy_cross_product,
+                "physical_signature_pairs": signature_cross_product,
+                "preflight_passing_equivalence_pairs": (
+                    preflight_equivalence_pairs
+                ),
+                "simulator_priced_pairs": simulator_pricing_count,
+                "joined_result_rows": self._expected_result_count,
+            },
+            "compact_artifact_projection": {
+                "full_joined_result_rows": self._expected_result_count,
+                "factor_evaluation_rows": self._expected_factor_evaluation_count,
+                "simulator_pricing_calls": simulator_pricing_count,
+                "profile_frontier_rows": "data_dependent",
+                "maximum_dominated_sample_rows": self.scatter_sample_limit,
+                "exact_frontier_rows": "data_dependent",
+                "materializes_dominated_rows": False,
+                "materializes_conceptual_join": False,
+            },
+            "preflight_calls": preflight_calls,
+            "candidate_preflight_rejections_by_code": dict(
+                sorted(candidate_rejection_counts.items())
+            ),
+            "candidate_preflight_errors_promoted_to_full_evaluation": dict(
+                sorted(candidate_preflight_errors.items())
+            ),
+            "preflight_rejections_by_code": dict(sorted(rejection_counts.items())),
+            "preflight_errors_promoted_to_full_evaluation": dict(
+                sorted(preflight_error_counts.items())
+            ),
+            "accuracy_constraint": {
+                "enabled": relative_perplexity_limit is not None,
+                "reference_profile_id": (
+                    reference_entry.profile_id
+                    if reference_entry is not None
+                    else None
+                ),
+                "reference_mean_nll": reference_mean_nll,
+                "relative_perplexity_limit": (
+                    float(relative_perplexity_limit)
+                    if relative_perplexity_limit is not None
+                    else None
+                ),
+                "maximum_mean_nll": accuracy_threshold,
+                "formula": (
+                    "candidate_mean_nll <= reference_mean_nll + "
+                    "log(relative_perplexity_limit)"
+                ),
+            },
+            "losslessness_proof": {
+                "accuracy": (
+                    "Only profiles violating the declared hard accuracy "
+                    "constraint are removed."
+                ),
+                "signature_cache": (
+                    "Each evaluator-declared equivalence class has identical "
+                    "physical precision, cost dependencies, and evidence scope; "
+                    "group nesting is validated once, keys are immutable for the "
+                    "run, and one result is joined back to every member."
+                ),
+                "preflight": (
+                    "Only structural legality, matched area, physical HBM/SRAM "
+                    "capacity, and aggregate resource limits may reject a pair."
+                ),
+                "performance": (
+                    "No latency estimate, bottleneck label, bandwidth demand, "
+                    "Pareto heuristic, sampling rule, or promotion limit removes "
+                    "a feasible pair before simulator pricing."
+                ),
+            },
+        }
+        self.provenance = StudyProvenance(
+            manifest_hash=manifest.canonical_hash,
+            numerical_results_hash=_content_hash(selected_rows),
+            hardware_space_hash=_content_hash(
+                {
+                    "hidden_size": self.hidden_size,
+                    "space": space.to_dict(),
+                    "include_numerical_only": include_numerical_only,
+                    "capability_target": (
+                        self.capability_target.to_dict()
+                        if self.capability_target is not None
+                        else None
+                    ),
+                }
+            ),
+            evaluator_version=evaluator_version,
+            model_revision=manifest.model_revision,
+            tokenizer_revision=str(manifest.tokenizer_revision),
+            code_revisions=tuple((code_revisions or {}).items()),
+            evaluator_provenance=dict(evaluator_provenance or {}),
+            search_schedule=search_schedule,
+        )
+
+    @property
+    def expected_result_count(self) -> int:
+        return self._expected_result_count
+
+    @property
+    def expected_factor_evaluation_count(self) -> int:
+        return self._expected_factor_evaluation_count
+
+    def factor_membership_records(self) -> tuple[dict[str, Any], ...]:
+        """Return the complete ordered map used by conceptual expansion."""
+
+        records = []
+        for group in self._factor_memberships:
+            class_by_profile = {
+                entry.profile_id: class_id
+                for class_id, entries in group.join_classes
+                for entry in entries
+            }
+            members = []
+            for member_ordinal, entry in enumerate(group.entries):
+                numerical = self._rows[entry.profile_id]
+                members.append(
+                    {
+                        "member_ordinal": member_ordinal,
+                        "join_class_id": class_by_profile[entry.profile_id],
+                        "profile_ordinal": entry.ordinal,
+                        "profile_id": entry.profile_id,
+                        "profile": entry.profile.to_dict(),
+                        "legality": entry.legality.to_dict(),
+                        "numerical_result_hash": _content_hash(numerical),
+                        "numerical_summary": _numerical_summary(numerical),
+                    }
+                )
+            records.append(
+                {
+                    "factor_id": group.factor_id,
+                    "physical_signature_id": group.physical_signature_id,
+                    "preflight_group_id": group.preflight_group_id,
+                    "evaluation_group_id": group.evaluation_group_id,
+                    "schedule_ordinal": group.schedule_ordinal,
+                    "evaluation_group_ordinal": (
+                        group.evaluation_group_ordinal
+                    ),
+                    "candidate_mask_sha256": group.candidate_mask_sha256,
+                    "passing_candidate_count": group.passing_candidate_count,
+                    "member_count": len(members),
+                    "conceptual_result_count": (
+                        group.passing_candidate_count * len(members)
+                    ),
+                    "members": members,
+                }
+            )
+        return tuple(records)
+
+    def iter_factor_evaluations(self) -> Iterator[_HardwareFactorEvaluation]:
+        """Price each evaluator-equivalent factor exactly once."""
+
+        factor_ordinal = 0
+        for groups, candidate_mask in self._factor_schedule:
+            for candidate_ordinal, candidate in enumerate(
+                self.space.iter_candidates(self.hidden_size)
+            ):
+                if not candidate_mask[candidate_ordinal]:
+                    continue
+                for group in groups:
+                    representative = group.entries[0]
+                    representative_numerical = self._rows[
+                        representative.profile_id
+                    ]
+                    try:
+                        outcome = self.evaluator(
+                            representative,
+                            candidate,
+                            representative_numerical,
+                        )
+                        if not isinstance(outcome, HardwareEvaluation):
+                            raise TypeError(
+                                "hardware evaluator must return HardwareEvaluation"
+                            )
+                    except Exception as exc:
+                        outcome = HardwareEvaluation.failed(
+                            "evaluator_exception",
+                            f"{type(exc).__name__}: {exc}",
+                        )
+                    yield _HardwareFactorEvaluation(
+                        ordinal=factor_ordinal,
+                        candidate_ordinal=candidate_ordinal,
+                        group=group,
+                        candidate=candidate,
+                        outcome=outcome,
+                    )
+                    factor_ordinal += 1
+
+    def iter_results(self) -> Iterator[JoinedHardwareResult]:
+        """Expand the factor stream in the historical canonical row order.
+
+        Production artifact writing intentionally does not call this method.  It
+        remains available for small equivalence fixtures and compatibility checks.
+        """
+
+        for factor in self.iter_factor_evaluations():
+            for entry in factor.group.entries:
+                yield self._joined_result(
+                    entry,
+                    factor.candidate,
+                    factor.outcome,
+                )
+
+    def _joined_result(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        outcome: HardwareEvaluation,
+    ) -> JoinedHardwareResult:
+        numerical = self._rows[entry.profile_id]
+        numerical_hash = _content_hash(numerical)
+        base_validity = merge_validity(
+            entry.validity,
+            _validity_from_result(numerical),
+        )
+        capability = None
+        capability_validity = StackValidity()
+        scoped_base_validity = base_validity
+        if self.capability_target is not None:
+            if self.capability_target.kv_heads % candidate.tp:
+                raise ValueError(
+                    "tensor parallelism must divide capability KV heads"
+                )
+            runtime_target = replace(
+                self.capability_target,
+                mlen=candidate.mlen,
+                blen=candidate.blen,
+                hlen=candidate.hlen,
+                batch=candidate.batch,
+                kv_heads=self.capability_target.kv_heads // candidate.tp,
+            )
+            scoped_base_validity = scope_stack_validity(
+                base_validity,
+                evidence_target=self.capability_target,
+                runtime_target=runtime_target,
+            )
+            capability_report = evaluate_stack_capability(
+                entry.profile,
+                runtime_target,
+            )
+            capability = capability_report.to_dict()
+            capability_validity = capability_report.validity_floor
+        validity = merge_validity(
+            scoped_base_validity,
+            capability_validity,
+            outcome.validity,
+        )
+        validity = replace(
+            validity,
+            dc_calibrated=outcome.validity.dc_calibrated,
+        )
+        selector_valid, selector_evidence = _packedkv_selector_status(
+            entry,
+            candidate,
+            numerical,
+            validity,
+            capability,
+        )
+        return JoinedHardwareResult(
+            run_id=self.provenance.run_id,
+            profile_ordinal=entry.ordinal,
+            profile_id=entry.profile_id,
+            profile=entry.profile.to_dict(),
+            legality=entry.legality.to_dict(),
+            numerical_result_hash=numerical_hash,
+            numerical_summary=_numerical_summary(numerical),
+            candidate=candidate,
+            validity=validity,
+            metrics=outcome.metrics,
+            capability=capability,
+            packedkv_selector_valid=selector_valid,
+            packedkv_selector_evidence=selector_evidence,
+            error_code=outcome.error_code,
+            error_message=outcome.error_message,
+        )
+
+    def write(self, path: str | os.PathLike[str]) -> HardwareStudyArtifact:
+        """Atomically seal factor evaluations and retained profile bindings."""
+
+        destination = Path(path)
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        reducer = _FactorizedHardwareReducer(self)
+        for factor in self.iter_factor_evaluations():
+            reducer.consume(factor)
+        compact_summary, stored_factors, stored_bindings = reducer.finish()
+        memberships = self.factor_membership_records()
+        membership_digest = hashlib.sha256()
+        for membership in memberships:
+            membership_digest.update(
+                _canonical_bytes(
+                    {"record_type": "factor_membership", **membership},
+                    newline=True,
+                )
+            )
+        conceptual_result_count = sum(
+            int(membership["conceptual_result_count"])
+            for membership in memberships
+        )
+        factor_evaluation_count = sum(
+            int(membership["passing_candidate_count"])
+            for membership in memberships
+        )
+        if conceptual_result_count != self.expected_result_count:
+            raise RuntimeError("factor memberships do not prove the conceptual count")
+        if factor_evaluation_count != self.expected_factor_evaluation_count:
+            raise RuntimeError("factor memberships do not prove the evaluation count")
+        expansion_contract = {
+            "schema": "decode-hardware-factor-expansion",
+            "factor_stream_order": [
+                "schedule_ordinal",
+                "candidate_ordinal",
+                "evaluation_group_ordinal",
+            ],
+            "conceptual_row_order": [
+                "schedule_ordinal",
+                "candidate_ordinal",
+                "evaluation_group_ordinal",
+                "member_ordinal",
+            ],
+            "expansion_rule": (
+                "For each factor result, join its candidate, evaluator validity, "
+                "metrics, and error fields to every ordered member using the "
+                "profile-scoped capability and PackedKV selector contracts."
+            ),
+            "factor_count_formula": (
+                "sum(factor_membership.passing_candidate_count)"
+            ),
+            "conceptual_count_formula": (
+                "sum(factor_membership.passing_candidate_count * "
+                "factor_membership.member_count)"
+            ),
+            "factor_evaluation_count": factor_evaluation_count,
+            "conceptual_result_count": conceptual_result_count,
+        }
+        expansion_contract_sha256 = _content_hash(expansion_contract)
+        header = {
+            "record_type": "study",
+            "schema_version": HARDWARE_STUDY_SCHEMA,
+            "storage_revision": HARDWARE_STORAGE_REVISION,
+            "run_id": self.provenance.run_id,
+            "provenance": self.provenance.to_dict(),
+            "expected_result_count": self.expected_result_count,
+            "conceptual_result_count": conceptual_result_count,
+            "factor_memberships": list(memberships),
+            "ordered_membership_map_sha256": membership_digest.hexdigest(),
+            "expansion_contract": expansion_contract,
+            "expansion_contract_sha256": expansion_contract_sha256,
+            **compact_summary,
+        }
+        temporary_name: str | None = None
+        digest = hashlib.sha256()
+        try:
+            with tempfile.NamedTemporaryFile(
+                mode="wb",
+                dir=destination.parent,
+                prefix=f".{destination.name}.",
+                suffix=".tmp",
+                delete=False,
+            ) as temporary:
+                temporary_name = temporary.name
+                header_payload = _canonical_bytes(header, newline=True)
+                temporary.write(header_payload)
+                digest.update(header_payload)
+                for factor in stored_factors:
+                    payload = _canonical_bytes(
+                        {"record_type": "factor_result", **factor},
+                        newline=True,
+                    )
+                    temporary.write(payload)
+                    digest.update(payload)
+                for binding in stored_bindings:
+                    payload = _canonical_bytes(
+                        {"record_type": "factor_binding", **binding},
+                        newline=True,
+                    )
+                    temporary.write(payload)
+                    digest.update(payload)
+                temporary.flush()
+                os.fsync(temporary.fileno())
+            content_hash = digest.hexdigest()
+            if destination.exists():
+                existing_hash = _sha256_path(destination)
+                if existing_hash != content_hash:
+                    raise FileExistsError(
+                        f"refusing to replace a different hardware study: {destination}"
+                    )
+            else:
+                os.chmod(temporary_name, 0o644)
+                os.link(temporary_name, destination)
+            metadata_path = destination.with_name(f"{destination.name}.meta.json")
+            metadata = {
+                "schema_version": HARDWARE_ARTIFACT_SCHEMA,
+                "storage_revision": HARDWARE_STORAGE_REVISION,
+                "run_id": self.provenance.run_id,
+                "result_count": self.expected_result_count,
+                "factor_evaluation_count": factor_evaluation_count,
+                "stored_factor_result_count": len(stored_factors),
+                "stored_result_count": len(stored_bindings),
+                "factor_evaluation_sha256": compact_summary[
+                    "factor_evaluation_sha256"
+                ],
+                "ordered_membership_map_sha256": (
+                    membership_digest.hexdigest()
+                ),
+                "expansion_contract_sha256": expansion_contract_sha256,
+                "content_sha256": content_hash,
+                "data_file": destination.name,
+                "provenance_hash": self.provenance.canonical_hash,
+            }
+            _atomic_create_or_verify(metadata_path, _canonical_bytes(metadata, newline=True))
+        finally:
+            if temporary_name and os.path.exists(temporary_name):
+                os.unlink(temporary_name)
+        return HardwareStudyArtifact(
+            path=destination,
+            metadata_path=metadata_path,
+            run_id=self.provenance.run_id,
+            result_count=self.expected_result_count,
+            stored_result_count=len(stored_bindings),
+            content_hash=content_hash,
+        )
+
+
+def _atomic_create_or_verify(path: Path, payload: bytes) -> None:
+    if path.exists():
+        if path.read_bytes() != payload:
+            raise FileExistsError(f"refusing to replace a different artifact: {path}")
+        return
+    temporary_name: str | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=path.parent,
+            prefix=f".{path.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as temporary:
+            temporary_name = temporary.name
+            temporary.write(payload)
+            temporary.flush()
+            os.fsync(temporary.fileno())
+        os.chmod(temporary_name, 0o644)
+        os.link(temporary_name, path)
+    finally:
+        if temporary_name and os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+
+
+def load_hardware_artifact(
+    path: str | os.PathLike[str],
+) -> tuple[Mapping[str, Any], tuple[Mapping[str, Any], ...]]:
+    """Stream and verify a legacy or compact hardware JSONL artifact."""
+
+    source = Path(path)
+    if not source.is_file():
+        raise FileNotFoundError(source)
+    results: list[Mapping[str, Any]] = []
+    factor_rows: list[Mapping[str, Any]] = []
+    binding_rows: list[Mapping[str, Any]] = []
+    with source.open("r", encoding="utf-8") as handle:
+        first_line = handle.readline()
+        if not first_line:
+            raise ValueError("hardware artifact is empty")
+        header = json.loads(first_line)
+        if header.get("record_type") != "study":
+            raise ValueError("hardware artifact is missing its study header")
+        run_id = header.get("run_id")
+        provenance = header.get("provenance")
+        if not isinstance(provenance, Mapping):
+            raise ValueError("hardware artifact is missing provenance")
+        if run_id != f"hwdse-{_content_hash(provenance)}":
+            raise ValueError("hardware artifact provenance hash mismatch")
+        storage_revision = header.get("storage_revision")
+        factorized = storage_revision == HARDWARE_STORAGE_REVISION
+        legacy_compact = storage_revision == LEGACY_COMPACT_STORAGE_REVISION
+        if storage_revision not in (
+            None,
+            HARDWARE_STORAGE_REVISION,
+            LEGACY_COMPACT_STORAGE_REVISION,
+        ):
+            raise ValueError("unsupported hardware artifact storage revision")
+        for line_number, line in enumerate(handle, start=2):
+            if not line.strip():
+                raise ValueError(f"blank hardware record at line {line_number}")
+            row = json.loads(line)
+            record_type = row.pop("record_type", None)
+            if factorized:
+                if record_type == "factor_result":
+                    factor_hash = row.get("factor_record_hash")
+                    body = dict(row)
+                    body.pop("factor_record_hash", None)
+                    if factor_hash != _content_hash(body):
+                        raise ValueError(
+                            f"factor checksum mismatch at line {line_number}"
+                        )
+                    if row.get("run_id") != run_id:
+                        raise ValueError(f"run mismatch at line {line_number}")
+                    factor_rows.append(row)
+                    continue
+                if record_type == "factor_binding":
+                    binding_hash = row.get("binding_hash")
+                    body = dict(row)
+                    body.pop("binding_hash", None)
+                    if binding_hash != _content_hash(body):
+                        raise ValueError(
+                            f"factor binding checksum mismatch at line {line_number}"
+                        )
+                    binding_rows.append(row)
+                    continue
+                raise ValueError(f"unexpected record type at line {line_number}")
+            if record_type != "result":
+                raise ValueError(f"unexpected record type at line {line_number}")
+            raw_labels = row.pop("retention_labels", None)
+            if legacy_compact:
+                if (
+                    not isinstance(raw_labels, list)
+                    or not raw_labels
+                    or len(raw_labels) != len(set(raw_labels))
+                    or any(label not in HARDWARE_RETENTION_LABELS for label in raw_labels)
+                    or "legacy_full_row" in raw_labels
+                ):
+                    raise ValueError(
+                        f"invalid compact retention labels at line {line_number}"
+                    )
+                retention_labels = tuple(sorted(str(label) for label in raw_labels))
+            else:
+                if raw_labels is not None:
+                    raise ValueError("legacy hardware row carries compact labels")
+                retention_labels = ("legacy_full_row",)
+            record_hash = row.pop("record_hash", None)
+            if record_hash != _content_hash(row):
+                raise ValueError(f"hardware checksum mismatch at line {line_number}")
+            if row.get("run_id") != run_id:
+                raise ValueError(f"run mismatch at line {line_number}")
+            results.append(
+                {
+                    **row,
+                    "record_hash": record_hash,
+                    "retention_labels": retention_labels,
+                }
+            )
+    metadata_path = source.with_name(f"{source.name}.meta.json")
+    metadata = json.loads(metadata_path.read_text(encoding="utf-8"))
+    if metadata.get("content_sha256") != _sha256_path(source):
+        raise ValueError("hardware artifact content hash mismatch")
+    if metadata.get("run_id") != run_id:
+        raise ValueError("hardware artifact metadata run mismatch")
+    if metadata.get("provenance_hash") != _content_hash(provenance):
+        raise ValueError("hardware artifact metadata provenance mismatch")
+    if metadata.get("data_file") != source.name:
+        raise ValueError("hardware artifact metadata file binding mismatch")
+    if factorized:
+        results = list(
+            _expand_and_validate_factorized_hardware_artifact(
+                header=header,
+                factors=factor_rows,
+                bindings=binding_rows,
+                metadata=metadata,
+            )
+        )
+    elif legacy_compact:
+        _validate_compact_hardware_artifact(
+            header=header,
+            results=results,
+            metadata=metadata,
+        )
+    else:
+        if len(results) != int(header["expected_result_count"]):
+            raise ValueError("hardware artifact result count mismatch")
+        if int(metadata["result_count"]) != len(results):
+            raise ValueError("hardware artifact metadata count mismatch")
+    return header, tuple(results)
+
+
+def _expand_and_validate_factorized_hardware_artifact(
+    *,
+    header: Mapping[str, Any],
+    factors: Sequence[Mapping[str, Any]],
+    bindings: Sequence[Mapping[str, Any]],
+    metadata: Mapping[str, Any],
+) -> tuple[Mapping[str, Any], ...]:
+    """Validate factor commitments and expand only retained bindings."""
+
+    def require_digest(name: str, value: Any) -> str:
+        if (
+            not isinstance(value, str)
+            or len(value) != 64
+            or any(character not in "0123456789abcdef" for character in value)
+        ):
+            raise ValueError(f"{name} is not a lowercase SHA-256 digest")
+        return value
+
+    run_id = str(header.get("run_id", ""))
+    memberships = header.get("factor_memberships")
+    if not isinstance(memberships, list):
+        raise ValueError("factorized hardware membership map is missing")
+    membership_digest = hashlib.sha256()
+    membership_by_factor: dict[str, Mapping[str, Any]] = {}
+    member_by_factor_profile: dict[tuple[str, str], Mapping[str, Any]] = {}
+    membership_order = []
+    conceptual_count = 0
+    factor_count = 0
+    profile_ids = set()
+    for membership in memberships:
+        if not isinstance(membership, Mapping):
+            raise TypeError("factor membership must be a mapping")
+        membership_digest.update(
+            _canonical_bytes(
+                {"record_type": "factor_membership", **membership},
+                newline=True,
+            )
+        )
+        factor_id = str(membership.get("factor_id", ""))
+        members = membership.get("members")
+        schedule_ordinal = int(membership.get("schedule_ordinal", -1))
+        group_ordinal = int(
+            membership.get("evaluation_group_ordinal", -1)
+        )
+        passing_count = int(membership.get("passing_candidate_count", -1))
+        member_count = int(membership.get("member_count", -1))
+        declared_conceptual = int(
+            membership.get("conceptual_result_count", -1)
+        )
+        if (
+            not factor_id.startswith("hardware-factor-")
+            or factor_id in membership_by_factor
+            or not isinstance(members, list)
+            or member_count <= 0
+            or len(members) != member_count
+            or passing_count < 0
+            or schedule_ordinal < 0
+            or group_ordinal < 0
+            or declared_conceptual != passing_count * member_count
+        ):
+            raise ValueError("factor membership counts or identity are invalid")
+        for name in (
+            "physical_signature_id",
+            "preflight_group_id",
+            "evaluation_group_id",
+        ):
+            if not isinstance(membership.get(name), str) or not membership[name]:
+                raise ValueError(f"factor membership {name} is missing")
+        require_digest(
+            "candidate_mask_sha256",
+            membership.get("candidate_mask_sha256"),
+        )
+        for member_ordinal, member in enumerate(members):
+            if not isinstance(member, Mapping):
+                raise TypeError("factor member must be a mapping")
+            profile_id = str(member.get("profile_id", ""))
+            if (
+                int(member.get("member_ordinal", -1)) != member_ordinal
+                or not profile_id
+                or profile_id in profile_ids
+                or not isinstance(member.get("profile"), Mapping)
+                or not isinstance(member.get("legality"), Mapping)
+                or not isinstance(member.get("numerical_summary"), Mapping)
+                or not isinstance(member.get("join_class_id"), str)
+                or not member.get("join_class_id")
+            ):
+                raise ValueError("factor member ordering or identity is invalid")
+            profile_ids.add(profile_id)
+            member_by_factor_profile[(factor_id, profile_id)] = member
+        membership_by_factor[factor_id] = membership
+        membership_order.append((schedule_ordinal, group_ordinal))
+        factor_count += passing_count
+        conceptual_count += declared_conceptual
+    if membership_order != sorted(membership_order):
+        raise ValueError("factor membership ordering is not canonical")
+    sealed_membership_digest = require_digest(
+        "ordered_membership_map_sha256",
+        header.get("ordered_membership_map_sha256"),
+    )
+    if (
+        membership_digest.hexdigest() != sealed_membership_digest
+        or metadata.get("ordered_membership_map_sha256")
+        != sealed_membership_digest
+    ):
+        raise ValueError("ordered factor membership digest differs")
+
+    expansion = header.get("expansion_contract")
+    if not isinstance(expansion, Mapping):
+        raise ValueError("factor expansion contract is missing")
+    expansion_digest = require_digest(
+        "expansion_contract_sha256",
+        header.get("expansion_contract_sha256"),
+    )
+    if (
+        _content_hash(expansion) != expansion_digest
+        or metadata.get("expansion_contract_sha256") != expansion_digest
+        or expansion.get("schema") != "decode-hardware-factor-expansion"
+        or expansion.get("factor_stream_order")
+        != [
+            "schedule_ordinal",
+            "candidate_ordinal",
+            "evaluation_group_ordinal",
+        ]
+        or expansion.get("conceptual_row_order")
+        != [
+            "schedule_ordinal",
+            "candidate_ordinal",
+            "evaluation_group_ordinal",
+            "member_ordinal",
+        ]
+        or int(expansion.get("factor_evaluation_count", -1)) != factor_count
+        or int(expansion.get("conceptual_result_count", -1))
+        != conceptual_count
+    ):
+        raise ValueError("factor expansion contract differs from the schema")
+    if (
+        int(header.get("factor_evaluation_count", -1)) != factor_count
+        or int(header.get("conceptual_result_count", -1)) != conceptual_count
+        or int(header.get("expected_result_count", -1)) != conceptual_count
+        or int(metadata.get("factor_evaluation_count", -1)) != factor_count
+        or int(metadata.get("result_count", -1)) != conceptual_count
+    ):
+        raise ValueError("factorized hardware cardinality proof differs")
+    factor_digest = require_digest(
+        "factor_evaluation_sha256",
+        header.get("factor_evaluation_sha256"),
+    )
+    if metadata.get("factor_evaluation_sha256") != factor_digest:
+        raise ValueError("factor evaluation digest differs from metadata")
+
+    factor_by_hash: dict[str, Mapping[str, Any]] = {}
+    factor_ordinals = []
+    for factor in factors:
+        factor_hash = str(factor.get("factor_record_hash", ""))
+        factor_id = str(factor.get("factor_id", ""))
+        membership = membership_by_factor.get(factor_id)
+        if (
+            factor.get("schema_version") != HARDWARE_FACTOR_RESULT_SCHEMA
+            or factor.get("run_id") != run_id
+            or not factor_hash
+            or factor_hash in factor_by_hash
+            or membership is None
+            or factor.get("schedule_ordinal")
+            != membership.get("schedule_ordinal")
+            or factor.get("evaluation_group_ordinal")
+            != membership.get("evaluation_group_ordinal")
+            or not isinstance(factor.get("hardware"), Mapping)
+            or not isinstance(factor.get("evaluation_validity"), Mapping)
+        ):
+            raise ValueError("retained factor result is invalid")
+        factor_by_hash[factor_hash] = factor
+        factor_ordinals.append(int(factor.get("factor_ordinal", -1)))
+    if factor_ordinals != sorted(factor_ordinals) or len(set(factor_ordinals)) != len(
+        factor_ordinals
+    ):
+        raise ValueError("retained factor ordering is invalid")
+
+    expanded = []
+    factor_hash_by_record_hash: dict[str, str] = {}
+    binding_keys = set()
+    for binding in bindings:
+        factor_hash = str(binding.get("factor_record_hash", ""))
+        profile_id = str(binding.get("profile_id", ""))
+        factor = factor_by_hash.get(factor_hash)
+        member = member_by_factor_profile.get(
+            (str(factor.get("factor_id", "")), profile_id)
+        ) if factor is not None else None
+        labels = binding.get("retention_labels")
+        join = binding.get("join")
+        if (
+            binding.get("schema_version") != HARDWARE_FACTOR_BINDING_SCHEMA
+            or factor is None
+            or member is None
+            or (factor_hash, profile_id) in binding_keys
+            or not isinstance(labels, list)
+            or not labels
+            or labels != sorted(set(labels))
+            or any(
+                label not in HARDWARE_RETENTION_LABELS
+                or label == "legacy_full_row"
+                for label in labels
+            )
+            or not isinstance(join, Mapping)
+            or set(join)
+            != {
+                "capability",
+                "packedkv_selector_valid",
+                "packedkv_selector_evidence",
+                "validity",
+                "deployment_valid",
+                "joined_record_hash",
+            }
+            or not isinstance(join.get("validity"), Mapping)
+            or not isinstance(join.get("packedkv_selector_evidence"), Mapping)
+            or not isinstance(join.get("deployment_valid"), bool)
+        ):
+            raise ValueError("retained factor binding is invalid")
+        binding_keys.add((factor_hash, profile_id))
+        validity = dict(join["validity"])
+        if set(validity) != set(_VALIDITY_FIELDS):
+            raise ValueError("retained binding validity fields differ")
+        body = {
+            "schema_version": HARDWARE_RESULT_SCHEMA,
+            "run_id": run_id,
+            "profile_ordinal": member["profile_ordinal"],
+            "profile_id": profile_id,
+            "profile": member["profile"],
+            "legality": member["legality"],
+            "numerical_result_hash": member["numerical_result_hash"],
+            "numerical_summary": member["numerical_summary"],
+            "candidate_id": factor["candidate_id"],
+            "hardware": factor["hardware"],
+            "capability": join["capability"],
+            "packedkv_selector_valid": join["packedkv_selector_valid"],
+            "packedkv_selector_evidence": join[
+                "packedkv_selector_evidence"
+            ],
+            "validity": validity,
+            **validity,
+            "deployment_valid": join["deployment_valid"],
+            "metrics": factor["metrics"],
+            "error_code": factor["error_code"],
+            "error_message": factor["error_message"],
+        }
+        record_hash = str(join.get("joined_record_hash", ""))
+        if not record_hash or record_hash != _content_hash(body):
+            raise ValueError("factor binding does not reconstruct its joined row")
+        if record_hash in factor_hash_by_record_hash:
+            raise ValueError("factor bindings reconstruct duplicate joined rows")
+        factor_hash_by_record_hash[record_hash] = factor_hash
+        expanded.append(
+            {
+                **body,
+                "record_hash": record_hash,
+                "retention_labels": tuple(labels),
+            }
+        )
+    if set(factor_by_hash) != {key[0] for key in binding_keys}:
+        raise ValueError("retained factors and bindings do not have exact coverage")
+
+    retention = header.get("retention")
+    aggregates = header.get("profile_aggregates")
+    if not isinstance(retention, Mapping) or not isinstance(aggregates, list):
+        raise ValueError("factorized hardware summary is incomplete")
+    if (
+        int(retention.get("stored_factor_result_count", -1)) != len(factors)
+        or int(retention.get("stored_result_count", -1)) != len(expanded)
+        or int(metadata.get("stored_factor_result_count", -1)) != len(factors)
+        or int(metadata.get("stored_result_count", -1)) != len(expanded)
+        or metadata.get("storage_revision") != HARDWARE_STORAGE_REVISION
+    ):
+        raise ValueError("factorized hardware stored counts differ")
+    labels: dict[str, int] = {}
+    result_by_hash = {}
+    for row in expanded:
+        result_by_hash[row["record_hash"]] = row
+        for label in row["retention_labels"]:
+            labels[label] = labels.get(label, 0) + 1
+    if dict(sorted(labels.items())) != retention.get("label_counts"):
+        raise ValueError("factorized hardware retention labels differ")
+    factor_population = int(retention.get("factor_population_count", -1))
+    rankable_population = int(
+        retention.get("rankable_factor_population_count", -1)
+    )
+    dominated_population = int(
+        retention.get("dominated_factor_population_count", -1)
+    )
+    unrankable_population = int(
+        retention.get("unrankable_factor_population_count", -1)
+    )
+    exact_frontier_count = int(retention.get("exact_frontier_count", -1))
+    sample_limit = int(retention.get("sample_limit", -1))
+    sampled_count = labels.get("sampled_dominated", 0) + labels.get(
+        "sampled_unrankable", 0
+    )
+    if (
+        factor_population != factor_count
+        or min(
+            rankable_population,
+            dominated_population,
+            unrankable_population,
+            exact_frontier_count,
+            sample_limit,
+        )
+        < 0
+        or rankable_population + unrankable_population != factor_population
+        or dominated_population + exact_frontier_count != rankable_population
+        or sampled_count
+        != min(
+            sample_limit,
+            dominated_population + unrankable_population,
+        )
+        or retention.get("sampling_policy")
+        != "smallest_sha256_over_exact_factor_dominated_and_unrankable_population"
+        or labels.get("exact_frontier", 0) != exact_frontier_count
+        or labels.get("sampled_dominated", 0)
+        != int(retention.get("sampled_dominated_count", -1))
+        or labels.get("sampled_unrankable", 0)
+        != int(retention.get("sampled_unrankable_count", -1))
+    ):
+        raise ValueError("factorized hardware retention populations differ")
+
+    aggregate_ids = set()
+    total_count = 0
+    frontier_hashes = set()
+    for aggregate in aggregates:
+        if not isinstance(aggregate, Mapping):
+            raise TypeError("hardware profile aggregate must be a mapping")
+        profile_id = str(aggregate.get("profile_id", ""))
+        matching_member = next(
+            (
+                (factor_id, member)
+                for (factor_id, member_profile_id), member
+                in member_by_factor_profile.items()
+                if member_profile_id == profile_id
+            ),
+            None,
+        )
+        if (
+            not profile_id
+            or profile_id in aggregate_ids
+            or matching_member is None
+        ):
+            raise ValueError("hardware profile aggregates are duplicated or unknown")
+        aggregate_ids.add(profile_id)
+        factor_id, member = matching_member
+        expected_total = int(
+            membership_by_factor[factor_id]["passing_candidate_count"]
+        )
+        total = int(aggregate.get("total_count", -1))
+        deployment_valid = int(aggregate.get("deployment_valid_count", -1))
+        valid = int(aggregate.get("valid_count", -1))
+        errors = int(aggregate.get("error_count", -1))
+        error_counts = aggregate.get("error_code_counts")
+        local_frontier = aggregate.get("local_frontier")
+        local_extrema = aggregate.get("local_extrema")
+        if (
+            total != expected_total
+            or not 0 <= valid <= deployment_valid <= total
+            or not 0 <= errors <= total
+            or not isinstance(error_counts, Mapping)
+            or sum(int(value) for value in error_counts.values()) != errors
+            or aggregate.get("profile") != member.get("profile")
+            or aggregate.get("numerical_result_hash")
+            != member.get("numerical_result_hash")
+            or not isinstance(local_frontier, list)
+            or int(aggregate.get("local_frontier_count", -1))
+            != len(local_frontier)
+            or not isinstance(local_extrema, Mapping)
+            or set(local_extrema)
+            != {"fastest", "lowest_energy", "best_edp"}
+        ):
+            raise ValueError("hardware profile aggregate counts are invalid")
+        total_count += total
+        local_hashes = set()
+        rows_by_tier: dict[str, list[Mapping[str, Any]]] = {}
+        for reference in local_frontier:
+            if not isinstance(reference, Mapping):
+                raise TypeError("hardware frontier reference must be a mapping")
+            record_hash = str(reference.get("record_hash", ""))
+            row = result_by_hash.get(record_hash)
+            tier = reference.get("energy_tier")
+            if (
+                row is None
+                or row.get("profile_id") != profile_id
+                or row.get("candidate_id") != reference.get("candidate_id")
+                or factor_hash_by_record_hash.get(record_hash)
+                != reference.get("factor_record_hash")
+                or tier not in {"analytic_anchored", "dc_calibrated"}
+                or record_hash in local_hashes
+                or "profile_frontier" not in row["retention_labels"]
+                or _promotion_retention_key(row) is None
+            ):
+                raise ValueError("hardware local frontier reference is invalid")
+            values = _plot_retention_values(row)
+            if values is None or values.get("energy_tier") != tier:
+                raise ValueError("hardware local frontier metrics are invalid")
+            local_hashes.add(record_hash)
+            frontier_hashes.add(record_hash)
+            rows_by_tier.setdefault(str(tier), []).append(row)
+        for tier_rows in rows_by_tier.values():
+            for index, left in enumerate(tier_rows):
+                left_values = _plot_retention_values(left)
+                if any(
+                    _frontier_retention_dominates(
+                        right,
+                        _plot_retention_values(right),
+                        left,
+                        left_values,
+                    )
+                    for right in tier_rows[:index] + tier_rows[index + 1 :]
+                ):
+                    raise ValueError("hardware local frontier is dominated")
+        if valid == 0:
+            if local_frontier or any(local_extrema.values()):
+                raise ValueError("zero-valid profile cannot carry a frontier")
+            continue
+        if not local_frontier:
+            raise ValueError("valid hardware profile has no local frontier")
+        for name, label in (
+            ("fastest", "profile_fastest"),
+            ("lowest_energy", "profile_lowest_energy"),
+            ("best_edp", "profile_best_edp"),
+        ):
+            references = local_extrema[name]
+            if not isinstance(references, list) or len(references) != len(
+                rows_by_tier
+            ):
+                raise ValueError("hardware local extrema are incomplete")
+            seen_tiers = set()
+            for reference in references:
+                if not isinstance(reference, Mapping):
+                    raise TypeError("hardware extremum reference must be a mapping")
+                tier = str(reference.get("energy_tier", ""))
+                record_hash = str(reference.get("record_hash", ""))
+                row = result_by_hash.get(record_hash)
+                if (
+                    tier in seen_tiers
+                    or tier not in rows_by_tier
+                    or record_hash not in local_hashes
+                    or row is None
+                    or label not in row["retention_labels"]
+                    or factor_hash_by_record_hash.get(record_hash)
+                    != reference.get("factor_record_hash")
+                ):
+                    raise ValueError("hardware local extremum is invalid")
+                seen_tiers.add(tier)
+    if aggregate_ids != profile_ids or total_count != conceptual_count:
+        raise ValueError("hardware profile aggregates do not prove cardinality")
+    if labels.get("profile_frontier", 0) != len(frontier_hashes):
+        raise ValueError("hardware profile frontier labels are inconsistent")
+    return tuple(expanded)
+
+
+def _validate_compact_hardware_artifact(
+    *,
+    header: Mapping[str, Any],
+    results: Sequence[Mapping[str, Any]],
+    metadata: Mapping[str, Any],
+) -> None:
+    expected = int(header.get("expected_result_count", -1))
+    observed = int(header.get("observed_result_count", -1))
+    if expected < 0 or observed != expected:
+        raise ValueError("compact hardware enumeration count mismatch")
+    enumeration_sha256 = header.get("enumeration_sha256")
+    if (
+        not isinstance(enumeration_sha256, str)
+        or len(enumeration_sha256) != 64
+        or any(value not in "0123456789abcdef" for value in enumeration_sha256)
+        or metadata.get("enumeration_sha256") != enumeration_sha256
+    ):
+        raise ValueError("compact hardware enumeration digest is invalid")
+    if (
+        metadata.get("storage_revision") != LEGACY_COMPACT_STORAGE_REVISION
+        or int(metadata.get("result_count", -1)) != observed
+        or int(metadata.get("stored_result_count", -1)) != len(results)
+    ):
+        raise ValueError("compact hardware metadata count mismatch")
+    retention = header.get("retention")
+    aggregates = header.get("profile_aggregates")
+    if not isinstance(retention, Mapping) or not isinstance(aggregates, list):
+        raise ValueError("compact hardware summary is incomplete")
+    if int(retention.get("stored_result_count", -1)) != len(results):
+        raise ValueError("compact hardware stored-row count mismatch")
+    if retention.get("sampling_policy") != (
+        "smallest_sha256_over_exact_dominated_and_unrankable_population"
+    ):
+        raise ValueError("compact hardware sampling policy is unsupported")
+    sample_seed = retention.get("sample_seed")
+    if not isinstance(sample_seed, str) or not sample_seed:
+        raise ValueError("compact hardware sample seed is missing")
+    labels: dict[str, int] = {}
+    result_by_hash = {}
+    for row in results:
+        record_hash = str(row["record_hash"])
+        if record_hash in result_by_hash:
+            raise ValueError("compact hardware rows contain duplicate identities")
+        result_by_hash[record_hash] = row
+        for label in row["retention_labels"]:
+            labels[label] = labels.get(label, 0) + 1
+    if dict(sorted(labels.items())) != retention.get("label_counts"):
+        raise ValueError("compact hardware retention-label counts differ")
+    sample_limit = int(retention.get("sample_limit", -1))
+    sampled_count = labels.get("sampled_dominated", 0) + labels.get(
+        "sampled_unrankable", 0
+    )
+    if sample_limit < 0 or sampled_count > sample_limit:
+        raise ValueError("compact hardware dominated sample exceeds its bound")
+    dominated_population = int(retention.get("dominated_population_count", -1))
+    unrankable_population = int(retention.get("unrankable_population_count", -1))
+    declared_population = int(
+        retention.get("declared_scatter_population_count", -1)
+    )
+    scatter_population = int(retention.get("scatter_population_count", -1))
+    if (
+        min(
+            dominated_population,
+            unrankable_population,
+            declared_population,
+            scatter_population,
+        )
+        < 0
+        or declared_population + unrankable_population != scatter_population
+        or sampled_count
+        != min(sample_limit, dominated_population + unrankable_population)
+    ):
+        raise ValueError("compact hardware sampled population is inconsistent")
+    for field, actual in (
+        ("sampled_dominated_count", labels.get("sampled_dominated", 0)),
+        ("sampled_unrankable_count", labels.get("sampled_unrankable", 0)),
+        ("exact_frontier_count", labels.get("exact_frontier", 0)),
+    ):
+        if int(retention.get(field, -1)) != actual:
+            raise ValueError(f"compact hardware {field} differs from stored labels")
+    if dominated_population < labels.get("sampled_dominated", 0):
+        raise ValueError("compact hardware dominated population is inconsistent")
+    profile_ids = set()
+    total_count = 0
+    frontier_hashes = set()
+    for aggregate in aggregates:
+        if not isinstance(aggregate, Mapping):
+            raise TypeError("compact hardware profile aggregate must be a mapping")
+        profile_id = str(aggregate.get("profile_id", ""))
+        if not profile_id or profile_id in profile_ids:
+            raise ValueError("compact hardware profile aggregates are duplicated")
+        profile_ids.add(profile_id)
+        total = int(aggregate.get("total_count", -1))
+        deployment_valid = int(aggregate.get("deployment_valid_count", -1))
+        valid = int(aggregate.get("valid_count", -1))
+        errors = int(aggregate.get("error_count", -1))
+        error_counts = aggregate.get("error_code_counts")
+        profile = aggregate.get("profile")
+        local_frontier = aggregate.get("local_frontier")
+        local_extrema = aggregate.get("local_extrema")
+        if (
+            total <= 0
+            or not 0 <= valid <= deployment_valid <= total
+            or not 0 <= errors <= total
+            or not isinstance(error_counts, Mapping)
+            or sum(int(value) for value in error_counts.values()) != errors
+            or not isinstance(profile, Mapping)
+            or not isinstance(local_frontier, list)
+            or int(aggregate.get("local_frontier_count", -1))
+            != len(local_frontier)
+            or not isinstance(local_extrema, Mapping)
+            or set(local_extrema)
+            != {"fastest", "lowest_energy", "best_edp"}
+        ):
+            raise ValueError("compact hardware profile aggregate counts are invalid")
+        total_count += total
+        local_hashes = set()
+        local_rows_by_tier: dict[str, list[Mapping[str, Any]]] = {}
+        for reference in local_frontier:
+            if not isinstance(reference, Mapping):
+                raise TypeError("compact hardware frontier reference must be a mapping")
+            tier = reference.get("energy_tier")
+            record_hash = str(reference.get("record_hash", ""))
+            candidate_id = reference.get("candidate_id")
+            row = result_by_hash.get(record_hash)
+            values = _plot_retention_values(row) if row is not None else None
+            if (
+                tier not in {"analytic_anchored", "dc_calibrated"}
+                or not record_hash
+                or record_hash in local_hashes
+                or row is None
+                or row.get("profile_id") != profile_id
+                or row.get("candidate_id") != candidate_id
+                or "profile_frontier" not in row["retention_labels"]
+                or _promotion_retention_key(row) is None
+                or values is None
+                or values.get("energy_tier") != tier
+            ):
+                raise ValueError("compact hardware local frontier is invalid")
+            local_hashes.add(record_hash)
+            frontier_hashes.add(record_hash)
+            local_rows_by_tier.setdefault(str(tier), []).append(row)
+        for tier_rows in local_rows_by_tier.values():
+            for index, left in enumerate(tier_rows):
+                left_values = _plot_retention_values(left)
+                if any(
+                    _frontier_retention_dominates(
+                        right,
+                        _plot_retention_values(right),
+                        left,
+                        left_values,
+                    )
+                    for right in tier_rows[:index] + tier_rows[index + 1 :]
+                ):
+                    raise ValueError("compact hardware local frontier is dominated")
+        if valid == 0:
+            if local_frontier or any(local_extrema.values()):
+                raise ValueError("zero-valid profile cannot carry a frontier")
+            continue
+        if not local_frontier:
+            raise ValueError("valid compact hardware profile has no local frontier")
+        for name, label in (
+            ("fastest", "profile_fastest"),
+            ("lowest_energy", "profile_lowest_energy"),
+            ("best_edp", "profile_best_edp"),
+        ):
+            references = local_extrema[name]
+            if (
+                not isinstance(references, list)
+                or len(references) != len(local_rows_by_tier)
+            ):
+                raise ValueError("compact hardware local extrema are incomplete")
+            seen_tiers = set()
+            for reference in references:
+                if not isinstance(reference, Mapping):
+                    raise TypeError(
+                        "compact hardware extremum reference must be a mapping"
+                    )
+                tier = str(reference.get("energy_tier", ""))
+                record_hash = str(reference.get("record_hash", ""))
+                row = result_by_hash.get(record_hash)
+                if (
+                    tier in seen_tiers
+                    or tier not in local_rows_by_tier
+                    or record_hash not in local_hashes
+                    or row is None
+                    or row.get("candidate_id") != reference.get("candidate_id")
+                    or label not in row["retention_labels"]
+                ):
+                    raise ValueError("compact hardware local extremum is invalid")
+                seen_tiers.add(tier)
+    if total_count != observed:
+        raise ValueError("compact hardware per-profile totals are incomplete")
+    if labels.get("profile_frontier", 0) != len(frontier_hashes):
+        raise ValueError("compact hardware frontier labels are inconsistent")
+    if declared_population - int(retention.get("exact_frontier_count", -1)) != (
+        dominated_population
+    ):
+        raise ValueError("compact hardware global frontier population differs")
+
+
+__all__ = [
+    "CHIP_COUNTS",
+    "COMPILER_TRACE_EXECUTION_MODE",
+    "COMPILER_TRACE_TIMING_SET_SCHEMA",
+    "CalibratedEnergy",
+    "CapacityBreakdown",
+    "DECODE_EXECUTION_MODES",
+    "ExactHardwareSpace",
+    "ExactHardwareStudy",
+    "HardwareCandidate",
+    "HardwareEvaluation",
+    "HardwareMetrics",
+    "HardwareStudyArtifact",
+    "FULL_MODEL_DECODE_SCOPE",
+    "HARDWARE_FACTOR_BINDING_SCHEMA",
+    "HARDWARE_FACTOR_RESULT_SCHEMA",
+    "HARDWARE_STORAGE_REVISION",
+    "JoinedHardwareResult",
+    "LEGACY_COMPACT_STORAGE_REVISION",
+    "LEGACY_AGGREGATE_BANDWIDTH_MODE",
+    "PhysicalTraffic",
+    "ResourceBudget",
+    "ResourceBudgetStatus",
+    "SRAM_POLICIES",
+    "StudyProvenance",
+    "load_hardware_artifact",
+    "merge_validity",
+    "physical_cost_signature",
+    "physical_cost_signature_id",
+]
diff --git a/decode_dse/hardware/evaluation.py b/decode_dse/hardware/evaluation.py
new file mode 100644
index 0000000..f34a3db
--- /dev/null
+++ b/decode_dse/hardware/evaluation.py
@@ -0,0 +1,4391 @@
+"""Production evaluator and CLI for the exact decode hardware study."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib
+import json
+import math
+import os
+import sys
+from dataclasses import dataclass, field, replace
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Protocol, Sequence
+
+from decode_dse.legality import (
+    PackedKVRuntimeTarget,
+    evaluate_profile_legality,
+    evaluate_stack_capability,
+)
+from decode_dse.hardware.admission_cost import (
+    AdmissionCorrectnessStatus,
+    admission_correctness_status_valid,
+    load_admission_correctness_evidence,
+    missing_admission_correctness_status,
+)
+from decode_dse.hardware.synthesis_anchor import ExactDCAnchorIndex
+from decode_dse.hardware.design_space import (
+    CalibratedEnergy,
+    CapacityBreakdown,
+    COMPILER_TRACE_EXECUTION_MODE,
+    COMPILER_TRACE_TIMING_SET_SCHEMA,
+    COMPILER_TRACE_TIMING_TIER,
+    ExactHardwareSpace,
+    ExactHardwareStudy,
+    FULL_MODEL_DECODE_SCOPE,
+    HardwareCandidate,
+    HardwareEvaluation,
+    HardwareMetrics,
+    LEGACY_AGGREGATE_BANDWIDTH_MODE,
+    PHYSICAL_TRAFFIC_KEYS,
+    PUBLICATION_TIMING_TIERS,
+    PhysicalTraffic,
+    ResourceBudget,
+    ResourceBudgetStatus,
+    STAGE_CALIBRATED_ANALYTIC_TIMING_TIER,
+    physical_cost_signature,
+)
+from decode_dse.hardware.lm_head_service import (
+    BF16HeadServiceStatus,
+    HEAD_SERVICE_MODE,
+    HEAD_SERVICE_SCHEMA,
+    composite_system_calibration_id,
+    load_bf16_head_service_artifact,
+)
+from decode_dse.hardware.power_model import (
+    calibrated_area_from_simulator,
+    calibrated_energy_from_simulator,
+    load_simulator_power_artifact,
+    required_hardware_power_signatures,
+)
+from decode_dse.hardware.power_bridge import (
+    analytic_energy_from_simulator,
+    analytic_power_provenance,
+    hbm_peak_bandwidth_bytes_per_s,
+)
+from decode_dse.hardware.workload_events import (
+    EVENT_MODEL,
+    DecodeEvent,
+    DenseDecoderShape,
+    count_decode_events,
+)
+from decode_dse.legality import StackValidity
+from decode_dse.manifest import (
+    SweepManifest,
+    SweepManifestEntry,
+    load_manifest,
+)
+from decode_dse.profiles import (
+    MXINT_FORMATS,
+    PROFILE_KIND_BF16_REFERENCE,
+    DecodePrecisionProfile,
+    format_descriptor,
+)
+
+EVALUATOR_VERSION = "plena-exact-hardware-evaluator"
+TERMINAL_RESULT_SCHEMA = "decode-sweep-result"
+KV_LAYOUT = "dense_selector"
+TRAFFIC_UNIT = "bytes_per_generated_token"
+STEP_COMPOSITION = "max_compute_memory"
+PREFILL_HANDOFF_INPUT_SCHEMA = "plena-prefill-handoff-input-v1"
+PREFILL_HANDOFF_ANALYSIS_SCHEMA = "plena-prefill-handoff-analysis-v1"
+PREFILL_MEASUREMENT_SCOPE = "full_model_bf16_prompt_encoding_to_kv_ready"
+HANDOFF_LINK_GENERATIONS = frozenset({"nvlink3", "nvlink4", "ualink", "pcie5"})
+DECODE_BF16_HEAD = "decode_bf16_unmodeled"
+EXTERNAL_BF16_HEAD = "external_bf16_service"
+_AREA_KEYS = (
+    "MATRIX_SRAM_DEPTH",
+    "VECTOR_SRAM_DEPTH",
+    "INT_SRAM_DEPTH",
+    "FP_SRAM_DEPTH",
+    "INT_DATA_WIDTH",
+    "MX_SCALE_WIDTH",
+    "BLOCK_DIM",
+)
+
+
+#: Modules whose logic can change a hardware evaluation. They are named as
+#: import paths rather than file paths so a rename fails at import time instead
+#: of silently hashing an absent or stale file.
+_PROVENANCE_MODULES = (
+    "decode_dse.legality",
+    "decode_dse.manifest",
+    "decode_dse.profiles",
+    "decode_dse.hardware.admission_cost",
+    "decode_dse.hardware.design_space",
+    "decode_dse.hardware.evaluation",
+    "decode_dse.hardware.lm_head_service",
+    "decode_dse.hardware.power_model",
+    "decode_dse.hardware.power_bridge",
+    "decode_dse.hardware.synthesis_anchor",
+    "decode_dse.hardware.workload_events",
+)
+
+#: Simulator sources whose logic can change a decode timing or traffic result,
+#: keyed by provenance field name and given relative to the simulator root.
+_SIMULATOR_SOURCES = {
+    "perf_model_sha256": "analytic_models/performance/perf_model.py",
+    "decode_timing_sha256": "analytic_models/performance/decode_timing.py",
+    "compiler_trace_timing_sha256": (
+        "analytic_models/performance/compiler_trace_timing.py"
+    ),
+    "decode_model_sha256": "analytic_models/performance/disagg_decode.py",
+    "memory_model_sha256": "analytic_models/memory/memory_model.py",
+    "llm_memory_model_sha256": "analytic_models/memory/llm_memory_model.py",
+    "utilisation_model_sha256": (
+        "analytic_models/utilisation/utilisation_model.py"
+    ),
+    "packed_kv_model_sha256": "analytic_models/disagg_serve/packed_kv.py",
+    "area_bridge_sha256": "analytic_models/disagg_serve/area.py",
+    "area_package_sha256": "analytic_models/area/__init__.py",
+    "area_sram_model_sha256": "analytic_models/area/sram.py",
+    "area_matrix_model_sha256": "analytic_models/area/matrix.py",
+    "area_evidence_model_sha256": "analytic_models/area/evidence.py",
+    "area_structural_coefficients_sha256": (
+        "analytic_models/area/calibration/"
+        "matrix_structural_coefficients.json"
+    ),
+    "area_sram_macro_table_sha256": (
+        "analytic_models/area/calibration/asap7_sram_macro_table.csv"
+    ),
+    "bandwidth_model_sha256": "analytic_models/disagg_serve/memory.py",
+    "hbm_technology_model_sha256": (
+        "analytic_models/disagg_serve/hbm_technology.py"
+    ),
+    "physical_ledger_sha256": (
+        "analytic_models/disagg_serve/physical_ledger.py"
+    ),
+    "decode_power_sha256": "analytic_models/disagg_serve/decode_power.py",
+    "handoff_model_sha256": "analytic_models/disagg_serve/handoff.py",
+}
+
+#: Bandwidth calibration tables, hashed only when calibrated bandwidth is on.
+_BANDWIDTH_CALIBRATION_SOURCES = (
+    "analytic_models/disagg_serve/calibration_bw.csv",
+    "analytic_models/disagg_serve/calibration_dma.csv",
+    "analytic_models/disagg_serve/calibration_dma_requests.csv",
+)
+
+
+def _canonical_bytes(value: Any) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _content_hash(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _file_sha256(path: str | os.PathLike[str]) -> str:
+    return hashlib.sha256(Path(path).read_bytes()).hexdigest()
+
+
+def _module_source_digests() -> dict[str, str]:
+    """Return the SHA-256 of every module listed in `_PROVENANCE_MODULES`."""
+
+    digests: dict[str, str] = {}
+    for name in _PROVENANCE_MODULES:
+        source = getattr(importlib.import_module(name), "__file__", None)
+        if source is None:
+            raise RuntimeError(f"{name} has no source file to hash")
+        digests[name] = _file_sha256(source)
+    return digests
+
+
+def simulator_root() -> Path:
+    """Return the PLENA_Simulator checkout the analytic models are read from."""
+
+    default_root = Path(__file__).resolve().parents[3] / "PLENA_Simulator"
+    return Path(os.environ.get("PLENA_SIMULATOR_PATH", default_root)).resolve()
+
+
+def _simulator_source_digests() -> dict[str, str]:
+    """Return the SHA-256 of every source listed in `_SIMULATOR_SOURCES`."""
+
+    root = simulator_root()
+    return {
+        name: _file_sha256(root / relative)
+        for name, relative in _SIMULATOR_SOURCES.items()
+    }
+
+
+def _simulator_token(token: str) -> str:
+    return token if token.startswith("MXINT") else f"MXFP_{token}"
+
+
+def _require_content_addressed_id(value: Any, name: str) -> str:
+    if not isinstance(value, str) or "-" not in value:
+        raise ValueError(f"{name} must be a content-addressed identity")
+    prefix, digest = value.rsplit("-", 1)
+    if (
+        not prefix
+        or prefix[0] not in "abcdefghijklmnopqrstuvwxyz"
+        or any(
+            character not in "abcdefghijklmnopqrstuvwxyz0123456789-"
+            for character in prefix
+        )
+        or len(digest) != 64
+        or any(character not in "0123456789abcdef" for character in digest)
+    ):
+        raise ValueError(f"{name} must be a content-addressed identity")
+    return value
+
+
+def _exact_object(
+    value: Any,
+    fields: set[str],
+    name: str,
+) -> Mapping[str, Any]:
+    if not isinstance(value, Mapping) or set(value) != fields:
+        raise ValueError(f"{name} fields differ from the schema")
+    return value
+
+
+@dataclass(frozen=True)
+class HardwareWorkload:
+    """One deterministic cached-decode timing and traffic workload."""
+
+    input_seq: int
+    output_seq: int
+    stride: int
+    runtime_hbm_reserve_bytes: int
+    kv_layout: str = KV_LAYOUT
+
+    def __post_init__(self) -> None:
+        if self.input_seq <= 0 or self.output_seq <= 0 or self.stride <= 0:
+            raise ValueError("decode workload lengths and stride must be positive")
+        if self.runtime_hbm_reserve_bytes < 0:
+            raise ValueError("runtime HBM reserve must be non-negative")
+        if self.kv_layout != KV_LAYOUT:
+            raise ValueError("the deployment study requires dense_selector PackedKV")
+
+    def to_dict(self) -> dict[str, int | str]:
+        return {
+            "scope": "steady_state_cached_q1",
+            "query_length": 1,
+            "admission_included": False,
+            "input_seq": self.input_seq,
+            "output_seq": self.output_seq,
+            "stride": self.stride,
+            "runtime_hbm_reserve_bytes": self.runtime_hbm_reserve_bytes,
+            "kv_layout": self.kv_layout,
+        }
+
+
+@dataclass(frozen=True)
+class PrefillMeasurement:
+    """Evidence-bound BF16 prefill cost for one serving batch."""
+
+    batch: int
+    latency_s: float
+    energy_j: float
+    latency_evidence_id: str
+    energy_evidence_id: str
+    evidence_tier: str
+
+    def __post_init__(self) -> None:
+        if isinstance(self.batch, bool) or not isinstance(self.batch, int):
+            raise TypeError("prefill batch must be an integer")
+        if self.batch <= 0:
+            raise ValueError("prefill batch must be positive")
+        for name in ("latency_s", "energy_j"):
+            raw = getattr(self, name)
+            if isinstance(raw, bool) or not isinstance(raw, (int, float)):
+                raise TypeError(f"prefill {name} must be numeric")
+            value = float(raw)
+            if not math.isfinite(value) or value <= 0:
+                raise ValueError(f"prefill {name} must be finite and positive")
+            object.__setattr__(self, name, value)
+        _require_content_addressed_id(
+            self.latency_evidence_id,
+            "prefill latency evidence",
+        )
+        _require_content_addressed_id(
+            self.energy_evidence_id,
+            "prefill energy evidence",
+        )
+        if not isinstance(self.evidence_tier, str) or not self.evidence_tier:
+            raise ValueError("prefill evidence tier must be non-empty")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "batch": self.batch,
+            "latency_s": self.latency_s,
+            "energy_j": self.energy_j,
+            "latency_evidence_id": self.latency_evidence_id,
+            "energy_evidence_id": self.energy_evidence_id,
+            "evidence_tier": self.evidence_tier,
+        }
+
+
+@dataclass(frozen=True)
+class PrefillHandoffArtifact:
+    """Explicit prefill, admission, and scheduling inputs for E1 analysis."""
+
+    artifact_sha256: str
+    model_name: str
+    model_revision: str
+    prompt_tokens: int
+    generation_tokens: int
+    prefill_precision: str
+    prefill_scope: str
+    measurements: tuple[PrefillMeasurement, ...]
+    decode_ready_delay_s: float
+    prefill_stall_power_w: float
+    decode_idle_power_w: float
+    direct_link_generation: str
+    host_link_generation: str
+    direct_link_energy_pj_per_bit: float
+    host_link_energy_pj_per_bit: float
+    link_evidence_id: str
+    link_evidence_tier: str
+    admission_bandwidth_bytes_per_s: float
+    admission_quantize_energy_j_per_element: float
+    admission_memory_energy_j_per_byte: float
+    admission_calibrated: bool
+    admission_calibration_id: str | None
+    admission_evidence_tier: str
+    schema_version: str = PREFILL_HANDOFF_INPUT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != PREFILL_HANDOFF_INPUT_SCHEMA:
+            raise ValueError("unsupported prefill handoff input schema")
+        if (
+            not isinstance(self.artifact_sha256, str)
+            or len(self.artifact_sha256) != 64
+            or any(
+                character not in "0123456789abcdef"
+                for character in self.artifact_sha256
+            )
+        ):
+            raise ValueError("prefill handoff artifact SHA-256 is invalid")
+        if (
+            not isinstance(self.model_name, str)
+            or not isinstance(self.model_revision, str)
+            or not self.model_name
+            or not self.model_revision
+        ):
+            raise ValueError("prefill handoff model identity must be explicit")
+        if any(
+            isinstance(value, bool)
+            or not isinstance(value, int)
+            or value <= 0
+            for value in (self.prompt_tokens, self.generation_tokens)
+        ):
+            raise ValueError("prefill handoff workload lengths must be positive")
+        if self.prefill_precision != "BF16":
+            raise ValueError("prefill handoff wire producer must use BF16")
+        if self.prefill_scope != PREFILL_MEASUREMENT_SCOPE:
+            raise ValueError("prefill handoff measurement scope is unsupported")
+        if any(
+            not isinstance(measurement, PrefillMeasurement)
+            for measurement in self.measurements
+        ):
+            raise TypeError("prefill measurements have the wrong type")
+        batches = tuple(measurement.batch for measurement in self.measurements)
+        if not batches or batches != tuple(sorted(set(batches))):
+            raise ValueError("prefill measurements must have unique sorted batches")
+        for name in (
+            "decode_ready_delay_s",
+            "prefill_stall_power_w",
+            "decode_idle_power_w",
+            "direct_link_energy_pj_per_bit",
+            "host_link_energy_pj_per_bit",
+            "admission_quantize_energy_j_per_element",
+            "admission_memory_energy_j_per_byte",
+        ):
+            raw = getattr(self, name)
+            if isinstance(raw, bool) or not isinstance(raw, (int, float)):
+                raise TypeError(f"{name} must be numeric")
+            value = float(raw)
+            if not math.isfinite(value) or value < 0:
+                raise ValueError(f"{name} must be finite and non-negative")
+            object.__setattr__(self, name, value)
+        raw_bandwidth = self.admission_bandwidth_bytes_per_s
+        if isinstance(raw_bandwidth, bool) or not isinstance(
+            raw_bandwidth,
+            (int, float),
+        ):
+            raise TypeError("admission bandwidth must be numeric")
+        bandwidth = float(raw_bandwidth)
+        if not math.isfinite(bandwidth) or bandwidth <= 0:
+            raise ValueError("admission bandwidth must be finite and positive")
+        object.__setattr__(self, "admission_bandwidth_bytes_per_s", bandwidth)
+        if (
+            self.direct_link_generation not in HANDOFF_LINK_GENERATIONS
+            or self.host_link_generation not in HANDOFF_LINK_GENERATIONS
+        ):
+            raise ValueError("handoff link generation is unsupported")
+        _require_content_addressed_id(
+            self.link_evidence_id,
+            "handoff link evidence",
+        )
+        if (
+            not isinstance(self.link_evidence_tier, str)
+            or not self.link_evidence_tier
+            or not isinstance(self.admission_evidence_tier, str)
+            or not self.admission_evidence_tier
+        ):
+            raise ValueError("handoff evidence tiers must be explicit")
+        if not isinstance(self.admission_calibrated, bool):
+            raise TypeError("admission calibrated flag must be boolean")
+        if self.admission_calibrated != bool(self.admission_calibration_id):
+            raise ValueError("admission calibration identity is inconsistent")
+        if self.admission_calibration_id is not None:
+            _require_content_addressed_id(
+                self.admission_calibration_id,
+                "admission calibration",
+            )
+            if not self.admission_calibration_id.startswith("admission-"):
+                raise ValueError("admission calibration identity has the wrong scope")
+
+    @property
+    def artifact_id(self) -> str:
+        return "prefill-handoff-" + self.artifact_sha256
+
+    @property
+    def publication_rankable(self) -> bool:
+        return self.admission_calibrated
+
+    def measurement(self, batch: int) -> PrefillMeasurement:
+        match = next(
+            (
+                measurement
+                for measurement in self.measurements
+                if measurement.batch == batch
+            ),
+            None,
+        )
+        if match is None:
+            raise ValueError(f"prefill handoff artifact lacks batch {batch}")
+        return match
+
+    def to_status(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "artifact_id": self.artifact_id,
+            "artifact_sha256": self.artifact_sha256,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "workload": {
+                "prompt_tokens": self.prompt_tokens,
+                "generation_tokens": self.generation_tokens,
+            },
+            "prefill_precision": self.prefill_precision,
+            "prefill_scope": self.prefill_scope,
+            "measurements": [
+                measurement.to_dict() for measurement in self.measurements
+            ],
+            "schedule": {
+                "decode_ready_delay_s": self.decode_ready_delay_s,
+                "prefill_stall_power_w": self.prefill_stall_power_w,
+                "decode_idle_power_w": self.decode_idle_power_w,
+            },
+            "links": {
+                "direct_generation": self.direct_link_generation,
+                "host_generation": self.host_link_generation,
+                "direct_energy_pj_per_bit": (
+                    self.direct_link_energy_pj_per_bit
+                ),
+                "host_energy_pj_per_bit": self.host_link_energy_pj_per_bit,
+                "evidence_id": self.link_evidence_id,
+                "evidence_tier": self.link_evidence_tier,
+            },
+            "admission": {
+                "bandwidth_bytes_per_s": (
+                    self.admission_bandwidth_bytes_per_s
+                ),
+                "quantize_energy_j_per_element": (
+                    self.admission_quantize_energy_j_per_element
+                ),
+                "memory_energy_j_per_byte": (
+                    self.admission_memory_energy_j_per_byte
+                ),
+                "calibrated": self.admission_calibrated,
+                "calibration_id": self.admission_calibration_id,
+                "evidence_tier": self.admission_evidence_tier,
+            },
+            "publication_rankable": self.publication_rankable,
+        }
+
+    @classmethod
+    def load(
+        cls,
+        path: str | os.PathLike[str],
+        *,
+        model_name: str,
+        model_revision: str,
+        workload: HardwareWorkload,
+        required_batches: Sequence[int],
+    ) -> "PrefillHandoffArtifact":
+        source = Path(path)
+        payload_bytes = source.read_bytes()
+        raw = json.loads(payload_bytes)
+        root = _exact_object(
+            raw,
+            {
+                "schema_version",
+                "model",
+                "workload",
+                "prefill",
+                "schedule",
+                "links",
+                "admission",
+            },
+            "prefill handoff artifact",
+        )
+        if root["schema_version"] != PREFILL_HANDOFF_INPUT_SCHEMA:
+            raise ValueError("unsupported prefill handoff input schema")
+        model = _exact_object(root["model"], {"name", "revision"}, "model")
+        declared_workload = _exact_object(
+            root["workload"],
+            {"prompt_tokens", "generation_tokens"},
+            "workload",
+        )
+        prefill = _exact_object(
+            root["prefill"],
+            {"precision", "scope", "measurements"},
+            "prefill",
+        )
+        schedule = _exact_object(
+            root["schedule"],
+            {
+                "decode_ready_delay_s",
+                "prefill_stall_power_w",
+                "decode_idle_power_w",
+            },
+            "schedule",
+        )
+        links = _exact_object(
+            root["links"],
+            {
+                "direct_generation",
+                "host_generation",
+                "direct_energy_pj_per_bit",
+                "host_energy_pj_per_bit",
+                "evidence_id",
+                "evidence_tier",
+            },
+            "links",
+        )
+        admission = _exact_object(
+            root["admission"],
+            {
+                "bandwidth_bytes_per_s",
+                "quantize_energy_j_per_element",
+                "memory_energy_j_per_byte",
+                "calibrated",
+                "calibration_id",
+                "evidence_tier",
+            },
+            "admission",
+        )
+        rows = prefill["measurements"]
+        if isinstance(rows, (str, bytes)) or not isinstance(rows, Sequence):
+            raise TypeError("prefill measurements must be a sequence")
+        measurements = []
+        for row in rows:
+            item = _exact_object(
+                row,
+                {
+                    "batch",
+                    "latency_s",
+                    "energy_j",
+                    "latency_evidence_id",
+                    "energy_evidence_id",
+                    "evidence_tier",
+                },
+                "prefill measurement",
+            )
+            measurements.append(
+                PrefillMeasurement(
+                    batch=item["batch"],
+                    latency_s=item["latency_s"],
+                    energy_j=item["energy_j"],
+                    latency_evidence_id=item["latency_evidence_id"],
+                    energy_evidence_id=item["energy_evidence_id"],
+                    evidence_tier=item["evidence_tier"],
+                )
+            )
+        artifact = cls(
+            artifact_sha256=hashlib.sha256(payload_bytes).hexdigest(),
+            model_name=model["name"],
+            model_revision=model["revision"],
+            prompt_tokens=declared_workload["prompt_tokens"],
+            generation_tokens=declared_workload["generation_tokens"],
+            prefill_precision=prefill["precision"],
+            prefill_scope=prefill["scope"],
+            measurements=tuple(sorted(measurements, key=lambda row: row.batch)),
+            decode_ready_delay_s=schedule["decode_ready_delay_s"],
+            prefill_stall_power_w=schedule["prefill_stall_power_w"],
+            decode_idle_power_w=schedule["decode_idle_power_w"],
+            direct_link_generation=links["direct_generation"],
+            host_link_generation=links["host_generation"],
+            direct_link_energy_pj_per_bit=links["direct_energy_pj_per_bit"],
+            host_link_energy_pj_per_bit=links["host_energy_pj_per_bit"],
+            link_evidence_id=links["evidence_id"],
+            link_evidence_tier=links["evidence_tier"],
+            admission_bandwidth_bytes_per_s=admission["bandwidth_bytes_per_s"],
+            admission_quantize_energy_j_per_element=(
+                admission["quantize_energy_j_per_element"]
+            ),
+            admission_memory_energy_j_per_byte=(
+                admission["memory_energy_j_per_byte"]
+            ),
+            admission_calibrated=admission["calibrated"],
+            admission_calibration_id=admission["calibration_id"],
+            admission_evidence_tier=admission["evidence_tier"],
+        )
+        if artifact.model_name != model_name or artifact.model_revision != model_revision:
+            raise ValueError("prefill handoff and decode model identities differ")
+        if (
+            artifact.prompt_tokens != workload.input_seq
+            or artifact.generation_tokens != workload.output_seq
+        ):
+            raise ValueError("prefill handoff and decode workloads differ")
+        required = tuple(sorted(set(int(batch) for batch in required_batches)))
+        available = tuple(row.batch for row in artifact.measurements)
+        missing = tuple(batch for batch in required if batch not in available)
+        if missing:
+            raise ValueError(
+                "prefill handoff artifact lacks required batches: "
+                + ",".join(str(batch) for batch in missing)
+            )
+        return artifact
+
+
+@dataclass(frozen=True)
+class PrecisionRequest:
+    """Exact role bindings consumed by DecodeSimulator.make_precision."""
+
+    weight: int | str
+    activation: int | str
+    key: int | str
+    value: int | str
+    weight_family: str
+    activation_family: str
+    key_family: str
+    value_family: str
+    block_size: int
+
+
+def precision_request(profile: DecodePrecisionProfile) -> PrecisionRequest:
+    """Map one hardware profile without reducing formats to effective bits."""
+
+    if profile.kind == PROFILE_KIND_BF16_REFERENCE:
+        raise ValueError("the BF16 split reference is not a PLENA hardware profile")
+    if profile.block_size != 8:
+        raise ValueError("the PLENA decode datapath requires MX block size 8")
+    required_bf16 = {"embedding", "lm_head"}
+    if not required_bf16.issubset(profile.bf16_operators):
+        raise ValueError("embeddings and the LM head must remain BF16")
+    quantized_coverage = (
+        profile.weight_operators
+        + profile.activation_operators
+        + profile.kv_operators
+        + profile.vector_operators
+    )
+    if required_bf16.intersection(quantized_coverage):
+        raise ValueError(
+            "embedding and LM-head quantization is accuracy-only"
+        )
+
+    def role(token: str) -> tuple[int | str, str]:
+        descriptor = format_descriptor(token)
+        if descriptor.family == "mxint":
+            if token not in MXINT_FORMATS:
+                raise ValueError(f"unsupported integer format {token!r}")
+            return descriptor.element_bits, "mxint"
+        if descriptor.family == "mxfp":
+            return token, "mxfp"
+        raise ValueError(f"unsupported matrix format {token!r}")
+
+    weight, weight_family = role(profile.weight_format)
+    activation, activation_family = role(profile.activation_format)
+    key, key_family = role(profile.key_format)
+    value, value_family = role(profile.value_format)
+    return PrecisionRequest(
+        weight=weight,
+        activation=activation,
+        key=key,
+        value=value,
+        weight_family=weight_family,
+        activation_family=activation_family,
+        key_family=key_family,
+        value_family=value_family,
+        block_size=profile.block_size,
+    )
+
+
+def physical_traffic_from_metrics(
+    metrics: Any,
+    *,
+    batch: int,
+) -> PhysicalTraffic:
+    """Convert the simulator's canonical physical ledger to per-token roles."""
+
+    if batch <= 0:
+        raise ValueError("batch must be positive")
+    raw_per_token = tuple(metrics.hbm_traffic_per_generated_token)
+    raw_per_step = tuple(metrics.hbm_traffic_per_batch_step)
+    per_token = dict(raw_per_token)
+    per_step = dict(raw_per_step)
+    if (
+        len(per_token) != len(raw_per_token)
+        or len(per_step) != len(raw_per_step)
+    ):
+        raise ValueError("simulator physical traffic keys are not unique")
+    if (
+        set(per_token) != PHYSICAL_TRAFFIC_KEYS
+        or set(per_step) != PHYSICAL_TRAFFIC_KEYS
+    ):
+        raise ValueError("simulator physical traffic schema mismatch")
+    for name in PHYSICAL_TRAFFIC_KEYS:
+        token_value = float(per_token[name])
+        step_value = float(per_step[name])
+        if (
+            not math.isfinite(token_value)
+            or not math.isfinite(step_value)
+            or token_value < 0
+            or step_value < 0
+        ):
+            raise ValueError(f"invalid physical traffic for {name}")
+        expected = token_value * batch
+        if abs(step_value - expected) > max(
+            1e-6,
+            abs(expected) * 1e-9,
+        ):
+            raise ValueError(f"physical traffic unit mismatch for {name}")
+    traffic = PhysicalTraffic(
+        weight_bytes=(
+            per_token["weight_element_read_bytes"]
+            + per_token["bf16_weight_read_bytes"]
+        ),
+        activation_bytes=(
+            per_token["activation_read_bytes"]
+            + per_token["activation_write_bytes"]
+        ),
+        kv_read_bytes=per_token["kv_element_read_bytes"],
+        kv_write_bytes=per_token["kv_element_write_bytes"],
+        scale_bytes=(
+            per_token["weight_scale_read_bytes"]
+            + per_token["kv_scale_read_bytes"]
+            + per_token["kv_scale_write_bytes"]
+        ),
+    )
+    expected_total = float(metrics.avg_hbm_bytes_per_generated_token)
+    if not math.isfinite(expected_total) or expected_total < 0:
+        raise ValueError("invalid per-token HBM traffic total")
+    if abs(traffic.total_bytes - expected_total) > max(
+        1e-6,
+        abs(expected_total) * 1e-9,
+    ):
+        raise ValueError(
+            "physical traffic differs from DecodeSimulator timing bytes"
+        )
+    expected_step = traffic.total_bytes * batch
+    observed_step = float(metrics.avg_hbm_bytes_per_batch_step)
+    if not math.isfinite(observed_step) or observed_step < 0:
+        raise ValueError("invalid per-batch-step HBM traffic total")
+    if abs(expected_step - observed_step) > max(
+        1e-6,
+        abs(expected_step) * 1e-9,
+    ):
+        raise ValueError("per-token and batch-step traffic differ")
+    return traffic
+
+
+def capacity_from_metrics(
+    metrics: Any,
+    *,
+    batch: int,
+) -> CapacityBreakdown:
+    """Convert the aligned resident planes without substituting capacity."""
+
+    if batch <= 0:
+        raise ValueError("batch must be positive")
+    integer_fields = (
+        "weight_element_plane_bytes",
+        "weight_scale_plane_bytes",
+        "weight_bf16_bytes",
+        "kv_element_plane_bytes",
+        "kv_scale_plane_bytes",
+        "runtime_hbm_reserve_bytes",
+        "hbm_capacity",
+        "max_batch",
+        "max_resident_batch",
+        "max_synchronous_batch",
+        "max_runtime_batch",
+        "vector_sram_capacity_bytes",
+        "vector_sram_required_bytes",
+        "matrix_sram_capacity_bytes",
+        "matrix_sram_required_bytes",
+    )
+    for name in integer_fields:
+        raw = getattr(metrics, name)
+        value = int(raw)
+        if isinstance(raw, bool) or value != raw or value < 0:
+            raise ValueError(f"{name} must be a non-negative integer")
+    if int(metrics.hbm_capacity) <= 0:
+        raise ValueError("hbm_capacity must be positive")
+    for name in (
+        "fits_in_hbm",
+        "fits_onchip_sram",
+        "fits_runtime",
+    ):
+        if not isinstance(getattr(metrics, name), bool):
+            raise TypeError(f"{name} must be a boolean")
+    weight_bytes = (
+        int(metrics.weight_element_plane_bytes)
+        + int(metrics.weight_scale_plane_bytes)
+        + int(metrics.weight_bf16_bytes)
+    )
+    kv_bytes = (
+        int(metrics.kv_element_plane_bytes)
+        + int(metrics.kv_scale_plane_bytes)
+    )
+    capacity = CapacityBreakdown(
+        weight_bytes=weight_bytes,
+        kv_cache_bytes=kv_bytes,
+        runtime_bytes=int(metrics.runtime_hbm_reserve_bytes),
+        available_bytes=int(metrics.hbm_capacity),
+    )
+    hbm_required = float(metrics.hbm_required)
+    if not math.isfinite(hbm_required) or hbm_required < 0:
+        raise ValueError("hbm_required must be finite and non-negative")
+    if abs(hbm_required - capacity.required_bytes) > 0.5:
+        raise ValueError("capacity accounting differs from DecodeSimulator")
+    if bool(metrics.fits_in_hbm) != capacity.feasible:
+        raise ValueError("HBM feasibility differs from resident capacity")
+    fits_sram = (
+        metrics.vector_sram_required_bytes
+        <= metrics.vector_sram_capacity_bytes
+        and metrics.matrix_sram_required_bytes
+        <= metrics.matrix_sram_capacity_bytes
+    )
+    if bool(metrics.fits_onchip_sram) != fits_sram:
+        raise ValueError("SRAM feasibility differs from physical capacity")
+    expected_runtime = capacity.feasible and fits_sram
+    if bool(metrics.fits_runtime) != expected_runtime:
+        raise ValueError("runtime feasibility differs from physical capacity")
+    if int(metrics.max_batch) != int(metrics.max_runtime_batch):
+        raise ValueError("legacy and runtime batch ceilings differ")
+    if int(metrics.max_runtime_batch) > int(metrics.max_resident_batch):
+        raise ValueError("runtime batch ceiling exceeds resident capacity")
+    if bool(metrics.fits_runtime) != (
+        batch <= int(metrics.max_runtime_batch)
+    ):
+        raise ValueError("runtime batch ceiling differs from feasibility")
+    return capacity
+
+
+@dataclass(frozen=True)
+class SimulatorObservation:
+    """Identity-bound output from one exact simulator candidate evaluation."""
+
+    profile_id: str
+    candidate_id: str
+    tpot_ms: float
+    tps: float
+    total_time_s: float
+    analytical_area_mm2: float
+    traffic: PhysicalTraffic
+    capacity: CapacityBreakdown
+    algorithmic_bottleneck: str
+    realized_bottleneck: str
+    frac_algorithmic_memory_bound: float
+    frac_realized_memory_bound: float
+    frac_serialization_bound: float
+    generated_tokens_per_step: int
+    decode_steps: int
+    timing_mode: str
+    timing_calibrated: bool
+    timing_evidence_id: str | None
+    timing_reason: str
+    execution_mode: str
+    compiler_trace_timing: Mapping[str, Any] | None
+    kv_layout: str
+    layout_id: str
+    capacity_model: str
+    runtime_feasible: bool
+    max_batch: int
+    max_resident_batch: int
+    max_synchronous_batch: int
+    max_runtime_batch: int
+    fits_onchip_sram: bool
+    vector_sram_capacity_bytes: int
+    vector_sram_required_bytes: int
+    matrix_sram_capacity_bytes: int
+    matrix_sram_required_bytes: int
+    hbm_traffic_per_batch_step: tuple[tuple[str, float], ...]
+    hbm_traffic_per_generated_token: tuple[tuple[str, float], ...]
+    traffic_ledger_id: str
+    packedkv_selector_supported: bool
+    packedkv_selector_capability_id: str
+    packedkv_selector_issue_codes: tuple[str, ...]
+    bandwidth_calibration_id: str | None
+    total_hbm_bytes: float
+    events: tuple[DecodeEvent, ...]
+    output_head_location: str
+    collective_time_s_per_step: float = 0.0
+    collective_bytes_per_generated_token: float = 0.0
+    link_generation: str = "nvlink4"
+    system_area_mm2: float | None = None
+    area_evidence_tier: str | None = None
+    logic_area_mm2: float | None = None
+    avg_ideal_compute_seconds: float | None = None
+    avg_realized_compute_seconds: float | None = None
+    avg_memory_seconds: float | None = None
+    step_composition: str = STEP_COMPOSITION
+    classical_roofline_bottleneck: str | None = None
+    architecture_issue_bottleneck: str | None = None
+    frac_classical_memory_bound: float | None = None
+    frac_architecture_issue_memory_bound: float | None = None
+    avg_peak_compute_seconds: float | None = None
+    architecture_options: Mapping[str, Any] = field(default_factory=dict)
+    capacity_throughput_chain: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        if not self.profile_id or not self.candidate_id:
+            raise ValueError("simulator identities must be non-empty")
+        for name in (
+            "tpot_ms",
+            "tps",
+            "total_time_s",
+            "analytical_area_mm2",
+            "total_hbm_bytes",
+        ):
+            value = float(getattr(self, name))
+            if not math.isfinite(value) or value <= 0:
+                raise ValueError(f"{name} must be finite and positive")
+            object.__setattr__(self, name, value)
+        for name in ("generated_tokens_per_step", "decode_steps"):
+            value = getattr(self, name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or value <= 0
+            ):
+                raise ValueError(f"{name} must be a positive integer")
+        if self.algorithmic_bottleneck not in {"memory", "compute"}:
+            raise ValueError("invalid algorithmic bottleneck")
+        for name in (
+            "classical_roofline_bottleneck",
+            "architecture_issue_bottleneck",
+        ):
+            value = getattr(self, name)
+            if value is not None and value not in {
+                "memory",
+                "compute",
+                "unavailable",
+            }:
+                raise ValueError(f"invalid {name}")
+        if (
+            self.architecture_issue_bottleneck
+            not in {None, "unavailable", self.algorithmic_bottleneck}
+        ):
+            raise ValueError(
+                "architecture-issue and compatibility labels disagree"
+            )
+        if self.realized_bottleneck not in {
+            "memory",
+            "serialization",
+            "compute",
+        }:
+            raise ValueError("invalid realized bottleneck")
+        if not isinstance(self.timing_calibrated, bool):
+            raise TypeError("timing_calibrated must be boolean")
+        if self.timing_calibrated != bool(self.timing_evidence_id):
+            raise ValueError("timing evidence identity is inconsistent")
+        if self.execution_mode not in {
+            COMPILER_TRACE_EXECUTION_MODE,
+            LEGACY_AGGREGATE_BANDWIDTH_MODE,
+        }:
+            raise ValueError("unsupported decode execution mode")
+        trace_timing = self.compiler_trace_timing
+        if self.execution_mode == COMPILER_TRACE_EXECUTION_MODE:
+            if not self.timing_calibrated or not isinstance(
+                trace_timing,
+                Mapping,
+            ):
+                raise ValueError(
+                    "compiler mode requires calibrated request-set evidence"
+                )
+            trace_timing = json.loads(_canonical_bytes(dict(trace_timing)))
+            if (
+                trace_timing.get("schema_version")
+                != COMPILER_TRACE_TIMING_SET_SCHEMA
+                or trace_timing.get("execution_mode")
+                != COMPILER_TRACE_EXECUTION_MODE
+                or trace_timing.get("artifact_scope")
+                != FULL_MODEL_DECODE_SCOPE
+            ):
+                raise ValueError("compiler timing provenance is inconsistent")
+            expected_timing_id = (
+                "compiler-trace-timing-" + _content_hash(trace_timing)
+            )
+            if self.timing_evidence_id != expected_timing_id:
+                raise ValueError("compiler timing evidence identity differs")
+            if self.bandwidth_calibration_id is not None:
+                raise ValueError(
+                    "aggregate-bandwidth evidence is inapplicable to compiler mode"
+                )
+        elif trace_timing is not None:
+            raise ValueError("legacy timing cannot carry compiler-trace evidence")
+        object.__setattr__(self, "compiler_trace_timing", trace_timing)
+        if self.kv_layout != KV_LAYOUT or not self.layout_id:
+            raise ValueError("PackedKV layout identity is invalid")
+        if self.output_head_location not in {
+            DECODE_BF16_HEAD,
+            EXTERNAL_BF16_HEAD,
+        }:
+            raise ValueError("output-head location is invalid")
+        for name in (
+            "collective_time_s_per_step",
+            "collective_bytes_per_generated_token",
+        ):
+            value = float(getattr(self, name))
+            if not math.isfinite(value) or value < 0:
+                raise ValueError(f"{name} must be finite and non-negative")
+            object.__setattr__(self, name, value)
+        if not self.link_generation:
+            raise ValueError("link_generation must be non-empty")
+        if (self.system_area_mm2 is None) != (
+            self.area_evidence_tier is None
+        ):
+            raise ValueError("system area and its evidence tier must be paired")
+        if self.system_area_mm2 is not None:
+            if (
+                not math.isfinite(float(self.system_area_mm2))
+                or float(self.system_area_mm2) <= 0
+            ):
+                raise ValueError("system_area_mm2 must be finite and positive")
+            if not self.area_evidence_tier:
+                raise ValueError("area_evidence_tier must be non-empty")
+        if self.logic_area_mm2 is not None:
+            if (
+                not math.isfinite(float(self.logic_area_mm2))
+                or float(self.logic_area_mm2) <= 0
+            ):
+                raise ValueError("logic_area_mm2 must be finite and positive")
+        if self.step_composition != STEP_COMPOSITION:
+            raise ValueError("decode step composition is unsupported")
+        for name in (
+            "frac_classical_memory_bound",
+            "frac_architecture_issue_memory_bound",
+        ):
+            value = getattr(self, name)
+            if value is None:
+                continue
+            value = float(value)
+            if not math.isfinite(value) or not 0.0 <= value <= 1.0:
+                raise ValueError(f"{name} must be in [0, 1]")
+            object.__setattr__(self, name, value)
+        if (
+            self.frac_architecture_issue_memory_bound is not None
+            and abs(
+                self.frac_architecture_issue_memory_bound
+                - self.frac_algorithmic_memory_bound
+            )
+            > 1e-12
+        ):
+            raise ValueError(
+                "architecture-issue and compatibility fractions disagree"
+            )
+        timing_components = (
+            self.avg_ideal_compute_seconds,
+            self.avg_realized_compute_seconds,
+            self.avg_memory_seconds,
+        )
+        if any(value is not None for value in timing_components):
+            if any(value is None for value in timing_components):
+                raise ValueError("timing decomposition must be complete")
+            for name, value in zip(
+                (
+                    "avg_ideal_compute_seconds",
+                    "avg_realized_compute_seconds",
+                    "avg_memory_seconds",
+                ),
+                timing_components,
+            ):
+                if (
+                    isinstance(value, bool)
+                    or not isinstance(value, (int, float))
+                    or not math.isfinite(value)
+                    or value <= 0
+                ):
+                    raise ValueError(f"{name} must be finite and positive")
+            if (
+                self.avg_realized_compute_seconds
+                < self.avg_ideal_compute_seconds
+            ):
+                raise ValueError(
+                    "realized compute time cannot beat the ideal issue time"
+                )
+        if self.avg_peak_compute_seconds is not None:
+            peak = self.avg_peak_compute_seconds
+            if (
+                isinstance(peak, bool)
+                or not isinstance(peak, (int, float))
+                or not math.isfinite(peak)
+                or peak <= 0
+            ):
+                raise ValueError(
+                    "avg_peak_compute_seconds must be finite and positive"
+                )
+            if self.avg_ideal_compute_seconds is None:
+                raise ValueError(
+                    "peak compute requires the complete timing decomposition"
+                )
+            if peak > self.avg_ideal_compute_seconds:
+                raise ValueError(
+                    "peak compute cannot be slower than ideal issue"
+                )
+        for name in (
+            "architecture_options",
+            "capacity_throughput_chain",
+        ):
+            raw_evidence = getattr(self, name)
+            if not isinstance(raw_evidence, Mapping):
+                raise TypeError(f"{name} must be an object")
+            canonical_evidence = json.loads(
+                _canonical_bytes(dict(raw_evidence))
+            )
+            object.__setattr__(self, name, canonical_evidence)
+        if self.architecture_options:
+            required = {
+                "schema",
+                "explicit",
+                "kv_head_reuse",
+                "drain_overlapped",
+                "area",
+            }
+            if set(self.architecture_options) != required:
+                raise ValueError(
+                    "architecture-option evidence fields differ from the schema"
+                )
+            if not isinstance(self.architecture_options["explicit"], bool):
+                raise TypeError("architecture-option explicit flag must be boolean")
+        if self.capacity_throughput_chain:
+            chain = self.capacity_throughput_chain
+            if int(chain.get("evaluated_batch", -1)) != self.generated_tokens_per_step:
+                raise ValueError("capacity-throughput evaluated batch disagrees")
+            if int(chain.get("max_feasible_batch", -1)) != self.max_runtime_batch:
+                raise ValueError("capacity-throughput batch ceiling disagrees")
+            if chain.get("runtime_feasible") is not self.runtime_feasible:
+                raise ValueError("capacity-throughput feasibility disagrees")
+            expected_throughput = self.tps if self.runtime_feasible else None
+            observed_throughput = chain.get(
+                "evaluated_throughput_tokens_per_second"
+            )
+            if expected_throughput is None:
+                if observed_throughput is not None:
+                    raise ValueError(
+                        "infeasible capacity cannot report evaluated throughput"
+                    )
+            elif not math.isclose(
+                float(observed_throughput),
+                expected_throughput,
+                rel_tol=1e-12,
+                abs_tol=1e-12,
+            ):
+                raise ValueError("capacity-throughput TPS disagrees")
+        has_unmodeled_head = any(
+            event.signature == "UNMODELED:LM_HEAD_BF16"
+            for event in self.events
+        )
+        if has_unmodeled_head != (
+            self.output_head_location == DECODE_BF16_HEAD
+        ):
+            raise ValueError(
+                "output-head location and event boundary disagree"
+            )
+        if not self.capacity_model:
+            raise ValueError("capacity model identity must be non-empty")
+        if not self.traffic_ledger_id:
+            raise ValueError("traffic ledger identity must be non-empty")
+        if not isinstance(self.runtime_feasible, bool):
+            raise TypeError("runtime_feasible must be boolean")
+        if not isinstance(self.fits_onchip_sram, bool):
+            raise TypeError("fits_onchip_sram must be boolean")
+        if not isinstance(self.packedkv_selector_supported, bool):
+            raise TypeError(
+                "packedkv_selector_supported must be boolean"
+            )
+        if not self.packedkv_selector_capability_id:
+            raise ValueError(
+                "selector capability identity must be non-empty"
+            )
+        if self.packedkv_selector_supported != (
+            not self.packedkv_selector_issue_codes
+        ):
+            raise ValueError("selector capability evidence is inconsistent")
+        canonical_issues = tuple(
+            sorted(set(self.packedkv_selector_issue_codes))
+        )
+        if canonical_issues != self.packedkv_selector_issue_codes:
+            raise ValueError(
+                "selector capability issues must be unique and sorted"
+            )
+        if (
+            self.bandwidth_calibration_id is not None
+            and not self.bandwidth_calibration_id
+        ):
+            raise ValueError(
+                "bandwidth calibration identity must be non-empty"
+            )
+        for name in (
+            "max_batch",
+            "max_resident_batch",
+            "max_synchronous_batch",
+            "max_runtime_batch",
+            "vector_sram_capacity_bytes",
+            "vector_sram_required_bytes",
+            "matrix_sram_capacity_bytes",
+            "matrix_sram_required_bytes",
+        ):
+            value = getattr(self, name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or value < 0
+            ):
+                raise ValueError(f"{name} must be non-negative")
+        expected_sram_fit = (
+            self.vector_sram_required_bytes
+            <= self.vector_sram_capacity_bytes
+            and self.matrix_sram_required_bytes
+            <= self.matrix_sram_capacity_bytes
+        )
+        if self.fits_onchip_sram != expected_sram_fit:
+            raise ValueError("on-chip SRAM capacity evidence is inconsistent")
+        if self.runtime_feasible != (
+            self.capacity.feasible and self.fits_onchip_sram
+        ):
+            raise ValueError("runtime capacity evidence is inconsistent")
+        if self.max_batch != self.max_runtime_batch:
+            raise ValueError("legacy and runtime batch ceilings disagree")
+        if self.max_runtime_batch > self.max_resident_batch:
+            raise ValueError(
+                "runtime batch ceiling cannot exceed resident capacity"
+            )
+        if self.runtime_feasible != (
+            self.generated_tokens_per_step <= self.max_runtime_batch
+        ):
+            raise ValueError("runtime batch ceiling disagrees with feasibility")
+        physical_traffic = HardwareMetrics(
+            tpot_ms=self.tpot_ms,
+            tps=self.tps,
+            area_mm2=self.analytical_area_mm2,
+            traffic=self.traffic,
+            capacity=self.capacity,
+            algorithmic_bottleneck=self.algorithmic_bottleneck,
+            realized_bottleneck=self.realized_bottleneck,
+            frac_algorithmic_memory_bound=self.frac_algorithmic_memory_bound,
+            frac_realized_memory_bound=self.frac_realized_memory_bound,
+            frac_serialization_bound=self.frac_serialization_bound,
+            classical_roofline_bottleneck=(
+                self.classical_roofline_bottleneck
+            ),
+            architecture_issue_bottleneck=(
+                self.architecture_issue_bottleneck
+            ),
+            frac_classical_memory_bound=(
+                self.frac_classical_memory_bound
+            ),
+            frac_architecture_issue_memory_bound=(
+                self.frac_architecture_issue_memory_bound
+            ),
+            generated_tokens_per_step=self.generated_tokens_per_step,
+            capacity_model=self.capacity_model,
+            runtime_feasible=self.runtime_feasible,
+            max_batch=self.max_batch,
+            max_resident_batch=self.max_resident_batch,
+            max_synchronous_batch=self.max_synchronous_batch,
+            max_runtime_batch=self.max_runtime_batch,
+            fits_onchip_sram=self.fits_onchip_sram,
+            vector_sram_capacity_bytes=self.vector_sram_capacity_bytes,
+            vector_sram_required_bytes=self.vector_sram_required_bytes,
+            matrix_sram_capacity_bytes=self.matrix_sram_capacity_bytes,
+            matrix_sram_required_bytes=self.matrix_sram_required_bytes,
+            hbm_traffic_per_batch_step=self.hbm_traffic_per_batch_step,
+            hbm_traffic_per_generated_token=(
+                self.hbm_traffic_per_generated_token
+            ),
+            traffic_ledger_id=self.traffic_ledger_id,
+            avg_peak_compute_seconds=self.avg_peak_compute_seconds,
+            avg_ideal_compute_seconds=self.avg_ideal_compute_seconds,
+            avg_realized_compute_seconds=self.avg_realized_compute_seconds,
+            avg_memory_seconds=self.avg_memory_seconds,
+            step_composition=self.step_composition,
+        )
+        if not physical_traffic.traffic_evidence_complete:
+            raise ValueError("physical traffic evidence is incomplete")
+        expected_hbm_bytes = (
+            self.traffic.total_bytes
+            * self.generated_tokens_per_step
+            * self.decode_steps
+        )
+        if abs(self.total_hbm_bytes - expected_hbm_bytes) > max(
+            1e-6,
+            abs(expected_hbm_bytes) * 1e-9,
+        ):
+            raise ValueError("workload HBM bytes do not conserve traffic")
+        expected_time = self.tpot_ms / 1000.0 * self.decode_steps
+        if abs(self.total_time_s - expected_time) > max(
+            1e-12,
+            expected_time * 1e-9,
+        ):
+            raise ValueError("simulator total time and TPOT are inconsistent")
+
+
+@dataclass(frozen=True)
+class SimulatorResourcePreflight:
+    """Exact capacity and structural-area facts that precede timing pricing."""
+
+    profile_id: str
+    candidate_id: str
+    analytical_area_mm2: float
+    system_area_mm2: float
+    capacity: CapacityBreakdown
+    runtime_feasible: bool
+    max_resident_batch: int
+    max_runtime_batch: int
+    vector_sram_capacity_bytes: int
+    vector_sram_required_bytes: int
+    matrix_sram_capacity_bytes: int
+    matrix_sram_required_bytes: int
+    link_area_mm2: float
+
+    def __post_init__(self) -> None:
+        if not self.profile_id or not self.candidate_id:
+            raise ValueError("preflight identities must be non-empty")
+        for name in (
+            "analytical_area_mm2",
+            "system_area_mm2",
+            "link_area_mm2",
+        ):
+            value = float(getattr(self, name))
+            if not math.isfinite(value) or value < 0:
+                raise ValueError(f"{name} must be finite and non-negative")
+            object.__setattr__(self, name, value)
+        for name in (
+            "max_resident_batch",
+            "max_runtime_batch",
+            "vector_sram_capacity_bytes",
+            "vector_sram_required_bytes",
+            "matrix_sram_capacity_bytes",
+            "matrix_sram_required_bytes",
+        ):
+            value = getattr(self, name)
+            if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+                raise ValueError(f"{name} must be a non-negative integer")
+        if not isinstance(self.runtime_feasible, bool):
+            raise TypeError("runtime_feasible must be boolean")
+
+
+@dataclass(frozen=True)
+class RankLocalAttentionGeometry:
+    """Global model heads and the exact subset owned by one TP rank."""
+
+    global_attention_heads: int
+    global_kv_heads: int
+    tensor_parallel_degree: int
+    local_attention_heads: int
+    local_kv_heads: int
+
+    @classmethod
+    def bind(
+        cls,
+        shape: DenseDecoderShape,
+        candidate: HardwareCandidate,
+    ) -> "RankLocalAttentionGeometry":
+        tp = candidate.tp
+        if shape.attention_heads % tp or shape.kv_heads % tp:
+            raise ValueError(
+                "tensor parallelism must divide attention and KV heads"
+            )
+        return cls(
+            global_attention_heads=shape.attention_heads,
+            global_kv_heads=shape.kv_heads,
+            tensor_parallel_degree=tp,
+            local_attention_heads=shape.attention_heads // tp,
+            local_kv_heads=shape.kv_heads // tp,
+        )
+
+    def to_dict(self) -> dict[str, int | str]:
+        return {
+            "partition_rule": "contiguous_head_ownership_by_tensor_parallel_rank",
+            "global_attention_heads": self.global_attention_heads,
+            "global_kv_heads": self.global_kv_heads,
+            "tensor_parallel_degree": self.tensor_parallel_degree,
+            "local_attention_heads": self.local_attention_heads,
+            "local_kv_heads": self.local_kv_heads,
+        }
+
+
+def _selector_runtime_target(
+    profile: DecodePrecisionProfile,
+    candidate: HardwareCandidate,
+    shape: DenseDecoderShape,
+) -> PackedKVRuntimeTarget:
+    partition = RankLocalAttentionGeometry.bind(shape, candidate)
+    return PackedKVRuntimeTarget(
+        mlen=candidate.mlen,
+        blen=candidate.blen,
+        hlen=candidate.hlen,
+        batch=candidate.batch,
+        kv_heads=partition.local_kv_heads,
+        head_dim=shape.head_dim,
+        block_size=profile.block_size,
+        packed_kv=True,
+        batched_attention=True,
+    )
+
+
+@dataclass(frozen=True)
+class RefinementHardwareEntry:
+    """Manifest-compatible binding for one successful refined precision."""
+
+    ordinal: int
+    source_schedule_ordinal: int
+    profile: Any
+    validity: StackValidity
+
+    @property
+    def profile_id(self) -> str:
+        return str(self.profile.profile_id)
+
+    @property
+    def legality(self) -> Any:
+        return evaluate_profile_legality(self.profile)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "ordinal": self.ordinal,
+            "source_schedule_ordinal": self.source_schedule_ordinal,
+            "profile_id": self.profile_id,
+            "profile": self.profile.to_dict(),
+            "legality": self.legality.to_dict(),
+            **self.validity.to_dict(),
+        }
+
+
+@dataclass(frozen=True)
+class RefinementHardwareManifest:
+    """Minimal immutable manifest adapter for exact refined-profile repricing."""
+
+    model_name: str
+    model_revision: str
+    tokenizer_revision: str
+    model_architecture: Mapping[str, Any]
+    entries: tuple[RefinementHardwareEntry, ...]
+    base_manifest_hash: str
+    refinement_schedule_hash: str
+    refinement_merge_content_hash: str
+
+    @property
+    def canonical_hash(self) -> str:
+        return _content_hash(
+            {
+                "schema_version": "decode-refinement-hardware-manifest",
+                "model_name": self.model_name,
+                "model_revision": self.model_revision,
+                "tokenizer_revision": self.tokenizer_revision,
+                "model_architecture": dict(self.model_architecture),
+                "base_manifest_hash": self.base_manifest_hash,
+                "refinement_schedule_hash": self.refinement_schedule_hash,
+                "refinement_merge_content_hash": (
+                    self.refinement_merge_content_hash
+                ),
+                "entries": [entry.to_dict() for entry in self.entries],
+            }
+        )
+
+
+def _refinement_hardware_inputs(
+    base_manifest: SweepManifest,
+    schedule_path: str | os.PathLike[str],
+    merge_receipt_path: str | os.PathLike[str],
+    results_path: str | os.PathLike[str] | None,
+) -> tuple[RefinementHardwareManifest, tuple[Mapping[str, Any], ...]]:
+    from decode_dse.software.refinement_runner import (
+        load_refinement_merged_results,
+    )
+    from decode_dse.software.refinement_schedule import (
+        load_refinement_schedule,
+    )
+
+    schedule = load_refinement_schedule(schedule_path)
+    merged = load_refinement_merged_results(
+        schedule,
+        merge_receipt_path,
+        results_path=results_path,
+    )
+    selected = []
+    rows = []
+    for schedule_entry, row in zip(schedule.entries, merged.terminal_rows):
+        legality = evaluate_profile_legality(schedule_entry.profile)
+        if (
+            row.get("state") != "succeeded"
+            or not legality.hardware_candidate
+            or any(
+                getattr(schedule_entry.validity, name) is not True
+                for name in (
+                    "software_valid",
+                    "compiler_valid",
+                    "emulator_valid",
+                    "rtl_valid",
+                )
+            )
+        ):
+            continue
+        selected.append(
+            RefinementHardwareEntry(
+                ordinal=len(selected),
+                source_schedule_ordinal=schedule_entry.ordinal,
+                profile=schedule_entry.profile,
+                validity=schedule_entry.validity,
+            )
+        )
+        rows.append(row)
+    if not selected:
+        raise ValueError(
+            "refined hardware repricing has no successful fully measured profiles"
+        )
+    adapter = RefinementHardwareManifest(
+        model_name=base_manifest.model_name,
+        model_revision=base_manifest.model_revision,
+        tokenizer_revision=str(base_manifest.tokenizer_revision),
+        model_architecture=base_manifest.model_architecture,
+        entries=tuple(selected),
+        base_manifest_hash=base_manifest.canonical_hash,
+        refinement_schedule_hash=schedule.canonical_hash,
+        refinement_merge_content_hash=str(merged.receipt["content_hash"]),
+    )
+    return adapter, tuple(rows)
+
+
+class SimulatorBackend(Protocol):
+    """Backend boundary used by dependency-light evaluator tests."""
+
+    @property
+    def provenance(self) -> Mapping[str, Any]:
+        ...
+
+    def evaluate(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        workload: HardwareWorkload,
+    ) -> SimulatorObservation:
+        ...
+
+    def evaluate_handoff(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        workload: HardwareWorkload,
+        artifact: PrefillHandoffArtifact,
+        *,
+        decode_tpot_s: float,
+        decode_energy_per_token_j: float,
+        decode_energy_tier: str,
+        decode_timing_evidence_id: str,
+        system_calibration_id: str,
+    ) -> Mapping[str, Any]:
+        ...
+
+
+@dataclass(frozen=True)
+class PowerOutcome:
+    area_mm2: float
+    energy: CalibratedEnergy
+    calibration_id: str
+
+
+class PowerEngine(Protocol):
+    @property
+    def provenance(self) -> Mapping[str, Any]:
+        ...
+
+    def evaluate(
+        self,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+        observation: SimulatorObservation,
+    ) -> PowerOutcome:
+        ...
+
+    def hbm_energy_per_token(
+        self,
+        observation: SimulatorObservation,
+    ) -> tuple[float, str]:
+        ...
+
+    def anchor_prediction(
+        self,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+        observation: SimulatorObservation,
+    ) -> Mapping[str, Any]:
+        ...
+
+
+def _whole_model_energy(
+    decoder: CalibratedEnergy,
+    head,
+    *,
+    decoder_tpot_ms: float,
+    batch: int,
+) -> tuple[CalibratedEnergy, str]:
+    """Compose two dedicated chips over the serialized decode dependency."""
+
+    decoder_duration = decoder_tpot_ms / 1000.0 / batch
+    if abs(decoder.duration_s - decoder_duration) > max(
+        1e-12,
+        decoder_duration * 1e-6,
+    ):
+        raise ValueError("decoder energy duration differs from decoder TPOT")
+    whole_duration = (
+        decoder_tpot_ms / 1000.0 + head.total_latency_s
+    ) / batch
+    decoder_leakage_power = decoder.leakage_j / decoder.duration_s
+    system_id = composite_system_calibration_id(
+        decoder.calibration_id,
+        head.calibration_id,
+        head.provenance_id,
+        service_mode=head.service_mode,
+    )
+    combined = CalibratedEnergy(
+        calibration_id=system_id,
+        energy_id=system_id,
+        energy_tier=decoder.energy_tier,
+        compute_j=(
+            decoder.compute_j
+            + head.mac_dynamic_energy_j / batch
+        ),
+        vector_j=(
+            decoder.vector_j
+            + head.selection_dynamic_energy_j / batch
+        ),
+        sram_j=decoder.sram_j,
+        hbm_j=(
+            decoder.hbm_j
+            + head.memory_dynamic_energy_j / batch
+        ),
+        leakage_j=(
+            decoder_leakage_power + head.leakage_power_w
+        ) * whole_duration,
+        unattributed_dynamic_j=(
+            decoder.unattributed_dynamic_j
+            + head.fixed_dynamic_energy_j / batch
+        ),
+        link_j=(
+            decoder.link_j
+            + head.link_dynamic_energy_j / batch
+        ),
+        duration_s=whole_duration,
+        token_latency_s=(
+            decoder_tpot_ms / 1000.0 + head.total_latency_s
+        ),
+    )
+    return combined, system_id
+
+
+def _terminal_files(paths: Sequence[str | os.PathLike[str]]) -> tuple[Path, ...]:
+    files: list[Path] = []
+    for raw in paths:
+        path = Path(raw)
+        if path.is_dir():
+            shard_root = path / "shards" if (path / "shards").is_dir() else path
+            files.extend(sorted(shard_root.glob("*.jsonl")))
+        elif path.is_file():
+            files.append(path)
+        else:
+            raise FileNotFoundError(path)
+    ordered = tuple(sorted({path.resolve() for path in files}, key=str))
+    if not ordered:
+        raise ValueError("no numerical JSONL files were found")
+    return ordered
+
+
+def load_terminal_numerical_rows(
+    paths: Sequence[str | os.PathLike[str]],
+    manifest: SweepManifest,
+    *,
+    require_complete: bool = True,
+) -> tuple[Mapping[str, Any], ...]:
+    """Verify checksums and return the last terminal attempt per profile."""
+
+    entries = {entry.profile_id: entry for entry in manifest.entries}
+    attempts: dict[tuple[str, int], Mapping[str, Any]] = {}
+    for path in _terminal_files(paths):
+        with path.open("r", encoding="utf-8") as handle:
+            for line_number, line in enumerate(handle, start=1):
+                if not line.strip():
+                    continue
+                raw = json.loads(line)
+                if not isinstance(raw, Mapping):
+                    raise TypeError(f"numerical row is not an object at {path}:{line_number}")
+                row = dict(raw)
+                record_hash = row.pop("record_hash", None)
+                if record_hash != _content_hash(row):
+                    raise ValueError(
+                        f"numerical checksum mismatch at {path}:{line_number}"
+                    )
+                if row.get("schema_version") != TERMINAL_RESULT_SCHEMA:
+                    raise ValueError(
+                        f"numerical schema mismatch at {path}:{line_number}"
+                    )
+                if row.get("manifest_hash") != manifest.canonical_hash:
+                    raise ValueError(
+                        f"numerical manifest mismatch at {path}:{line_number}"
+                    )
+                profile_id = str(row.get("profile_id", ""))
+                entry = entries.get(profile_id)
+                if entry is None:
+                    raise ValueError(
+                        f"unknown numerical profile at {path}:{line_number}"
+                    )
+                if int(row.get("ordinal", -1)) != entry.ordinal:
+                    raise ValueError(
+                        f"numerical ordinal mismatch at {path}:{line_number}"
+                    )
+                if row.get("profile") != entry.profile.to_dict():
+                    raise ValueError(
+                        f"numerical profile mismatch at {path}:{line_number}"
+                    )
+                if row.get("weight_format") != entry.profile.weight_format:
+                    raise ValueError(
+                        f"numerical weight binding mismatch at {path}:{line_number}"
+                    )
+                if row.get("state") not in {"succeeded", "failed"}:
+                    raise ValueError(
+                        f"numerical row is not terminal at {path}:{line_number}"
+                    )
+                attempt = int(row.get("attempt", 0))
+                if attempt <= 0:
+                    raise ValueError(
+                        f"numerical attempt is invalid at {path}:{line_number}"
+                    )
+                StackValidity.from_dict(row.get("validity"))
+                runtime_seconds = row.get("runtime_seconds")
+                if (
+                    isinstance(runtime_seconds, bool)
+                    or not isinstance(runtime_seconds, (int, float))
+                    or not math.isfinite(runtime_seconds)
+                    or runtime_seconds < 0
+                ):
+                    raise ValueError(
+                        f"numerical runtime is invalid at {path}:{line_number}"
+                    )
+                if row["state"] == "succeeded":
+                    result = row.get("result")
+                    if not isinstance(result, Mapping):
+                        raise ValueError(
+                            f"successful numerical result is missing at "
+                            f"{path}:{line_number}"
+                        )
+                    mean_nll = result.get("mean_nll")
+                    mean_token_nll = result.get(
+                        "mean_token_nll",
+                        mean_nll,
+                    )
+                    token_count = result.get("token_count")
+                    if (
+                        isinstance(mean_nll, bool)
+                        or not isinstance(mean_nll, (int, float))
+                        or not math.isfinite(mean_nll)
+                        or mean_nll < 0
+                        or isinstance(mean_token_nll, bool)
+                        or not isinstance(mean_token_nll, (int, float))
+                        or not math.isfinite(mean_token_nll)
+                        or not math.isclose(
+                            mean_nll,
+                            mean_token_nll,
+                            rel_tol=1e-12,
+                            abs_tol=1e-12,
+                        )
+                        or isinstance(token_count, bool)
+                        or not isinstance(token_count, int)
+                        or token_count <= 0
+                    ):
+                        raise ValueError(
+                            f"successful numerical metrics are invalid at "
+                            f"{path}:{line_number}"
+                        )
+                key = profile_id, attempt
+                if key in attempts:
+                    raise ValueError(
+                        f"duplicate numerical attempt at {path}:{line_number}"
+                    )
+                attempts[key] = {**row, "record_hash": record_hash}
+    selected = {
+        profile_id: max(
+            (
+                row
+                for (candidate_profile, _), row in attempts.items()
+                if candidate_profile == profile_id
+            ),
+            key=lambda row: int(row["attempt"]),
+            default=None,
+        )
+        for profile_id in entries
+    }
+    if require_complete:
+        missing = [
+            profile_id for profile_id, row in selected.items() if row is None
+        ]
+        if missing:
+            raise ValueError(
+                f"missing {len(missing)} terminal numerical profiles"
+            )
+    return tuple(
+        selected[entry.profile_id]
+        for entry in manifest.entries
+        if selected[entry.profile_id] is not None
+    )
+
+class DecodeSimulatorBackend:
+    """Real adapter from canonical profiles to DecodeSimulator."""
+
+    def __init__(
+        self,
+        *,
+        model: str,
+        model_lib: str | os.PathLike[str] | None,
+        settings_toml: str | os.PathLike[str] | None,
+        isa_path: str | os.PathLike[str] | None,
+        timing_evidence: str | os.PathLike[str],
+        calibrated_bandwidth: bool,
+        execution_mode: str,
+        compiler_trace_artifacts: str | os.PathLike[str] | None = None,
+        request_memory_calibration: str | os.PathLike[str] | None = None,
+        head_service_artifact: str | os.PathLike[str] | None = None,
+        model_name: str | None = None,
+        model_revision: str | None = None,
+        required_batches: Sequence[int] = (),
+    ) -> None:
+        from decode_dse.simulator_bridge import DecodeSimulator
+
+        _validate_execution_launch(
+            execution_mode=execution_mode,
+            compiler_trace_artifacts=compiler_trace_artifacts,
+            publication_timing_tier=(
+                COMPILER_TRACE_TIMING_TIER
+                if execution_mode == COMPILER_TRACE_EXECUTION_MODE
+                else STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+            ),
+        )
+        if (
+            execution_mode == COMPILER_TRACE_EXECUTION_MODE
+            and calibrated_bandwidth
+        ):
+            raise ValueError(
+                "compiler-trace execution cannot enable aggregate-bandwidth timing"
+            )
+        self.sim = DecodeSimulator(
+            model,
+            model_lib=model_lib,
+            settings_toml=settings_toml,
+            isa_path=isa_path,
+            timing_mode="rtl_serialized",
+            timing_evidence=timing_evidence,
+        )
+        self.requested_execution_mode = execution_mode
+        self.calibrated_bandwidth = bool(calibrated_bandwidth)
+        self.compiler_trace_runtime: Any | None = None
+        self.compiler_trace_artifact_path: Path | None = None
+        self.request_memory_calibration_path: Path | None = None
+        self.head_service_status: BF16HeadServiceStatus | None = None
+        if head_service_artifact is not None:
+            if not model_name or not model_revision or not required_batches:
+                raise ValueError(
+                    "head-service validation requires model identity and batches"
+                )
+            self.head_service_status = load_bf16_head_service_artifact(
+                head_service_artifact,
+                model_name=model_name,
+                model_revision=model_revision,
+                hidden_size=int(self.sim.dims["hidden"]),
+                vocab_size=int(self.sim.dims["vocab"]),
+                tie_embeddings=bool(
+                    self.sim.dims.get("tie_embeddings", False)
+                ),
+                required_batches=required_batches,
+            )
+        self.output_head_location = (
+            EXTERNAL_BF16_HEAD
+            if (
+                self.head_service_status is not None
+                and self.head_service_status.passed
+            )
+            else DECODE_BF16_HEAD
+        )
+        if execution_mode == COMPILER_TRACE_EXECUTION_MODE:
+            from compiler_trace_timing import (
+                DEFAULT_REQUEST_CALIBRATION,
+                create_full_model_decode_artifact_runtime,
+            )
+
+            artifact_path = Path(compiler_trace_artifacts).resolve()
+            calibration_path = Path(
+                request_memory_calibration or DEFAULT_REQUEST_CALIBRATION
+            ).resolve()
+            runtime = create_full_model_decode_artifact_runtime(
+                artifact_path,
+                latency_library_path=self.sim.isa_path,
+                request_calibration_path=calibration_path,
+            )
+            self.compiler_trace_runtime = runtime
+            self.compiler_trace_artifact_path = artifact_path
+            self.request_memory_calibration_path = calibration_path
+            self.sim.use_compiler_trace_timing(
+                runtime.provider,
+                runtime.binder,
+            )
+        elif self.calibrated_bandwidth:
+            self.sim.use_calibrated_bandwidth()
+        root = simulator_root()
+        paths = {
+            "model_json_sha256": _file_sha256(self.sim.model_json),
+            "settings_sha256": _file_sha256(self.sim.settings_toml),
+            "isa_sha256": _file_sha256(self.sim.isa_path),
+            "timing_evidence_sha256": _file_sha256(timing_evidence),
+            "simulator_bridge_sha256": _file_sha256(
+                importlib.import_module(
+                    "decode_dse.simulator_bridge"
+                ).__file__
+            ),
+            "head_service_model_sha256": _file_sha256(
+                importlib.import_module(
+                    "decode_dse.hardware.lm_head_service"
+                ).__file__
+            ),
+            **_simulator_source_digests(),
+        }
+        if self.calibrated_bandwidth:
+            for relative in _BANDWIDTH_CALIBRATION_SOURCES:
+                name = Path(relative).name
+                paths[f"{name}_sha256"] = _file_sha256(root / relative)
+        if self.compiler_trace_runtime is not None:
+            paths["compiler_trace_artifacts_sha256"] = _file_sha256(
+                self.compiler_trace_artifact_path
+            )
+            paths["request_memory_calibration_sha256"] = _file_sha256(
+                self.request_memory_calibration_path
+            )
+        self._provenance = {
+            "backend": "DecodeSimulator",
+            "timing_mode": "rtl_serialized",
+            "timing_evidence_tier": (
+                self.sim.timing_evidence.evidence_tier
+                if self.sim.timing_evidence is not None
+                else None
+            ),
+            "calibrated_bandwidth": self.calibrated_bandwidth,
+            "requested_execution_mode": self.requested_execution_mode,
+            "compiler_trace_artifact_set_id": (
+                self.compiler_trace_runtime.artifact_set.artifact_set_id
+                if self.compiler_trace_runtime is not None
+                else None
+            ),
+            "compiler_trace_artifact_record_count": (
+                len(self.compiler_trace_runtime.artifact_set.records)
+                if self.compiler_trace_runtime is not None
+                else 0
+            ),
+            "output_head_location": self.output_head_location,
+            "head_service_status": (
+                self.head_service_status.to_dict()
+                if self.head_service_status is not None
+                else {
+                    "schema_version": HEAD_SERVICE_SCHEMA,
+                    "artifact_sha256": None,
+                    "passed": False,
+                    "failures": ["missing_head_service_artifact"],
+                    "calibration_id": None,
+                    "provenance_id": None,
+                    "service_mode": "unmodeled",
+                    "service_location": None,
+                    "required_batches": [],
+                }
+            ),
+            **paths,
+        }
+        if self.calibrated_bandwidth and not getattr(
+            self.sim._bw_model,
+            "calibration_id",
+            None,
+        ):
+            raise ValueError("calibrated bandwidth has no artifact identity")
+        self.capacity_model_id = "decode-capacity-" + _content_hash(
+            {
+                "version": "resident-weights-packedkv-workspace",
+                "model_json_sha256": paths["model_json_sha256"],
+                "settings_sha256": paths["settings_sha256"],
+                "physical_ledger_sha256": paths["physical_ledger_sha256"],
+                "simulator_bridge_sha256": paths[
+                    "simulator_bridge_sha256"
+                ],
+                "kv_layout": KV_LAYOUT,
+                "output_head_location": self.output_head_location,
+            }
+        )
+        self.traffic_ledger_id = "decode-traffic-" + _content_hash(
+            {
+                "version": "physical-decode-step-traffic",
+                "model_json_sha256": paths["model_json_sha256"],
+                "settings_sha256": paths["settings_sha256"],
+                "physical_ledger_sha256": paths["physical_ledger_sha256"],
+                "decode_model_sha256": paths["decode_model_sha256"],
+                "memory_model_sha256": paths["memory_model_sha256"],
+                "llm_memory_model_sha256": paths[
+                    "llm_memory_model_sha256"
+                ],
+                "packed_kv_model_sha256": paths[
+                    "packed_kv_model_sha256"
+                ],
+                "simulator_bridge_sha256": paths[
+                    "simulator_bridge_sha256"
+                ],
+                "kv_layout": KV_LAYOUT,
+                "output_head_location": self.output_head_location,
+            }
+        )
+        self._provenance["capacity_model_id"] = self.capacity_model_id
+        self._provenance["traffic_ledger_id"] = self.traffic_ledger_id
+        self._resource_ledger_cache: dict[tuple[Any, ...], Any] = {}
+        self._resource_area_cache: dict[tuple[Any, ...], Mapping[str, Any]] = {}
+
+    def use_compiler_trace_timing(
+        self,
+        provider: Any,
+        request_binder: Any,
+    ) -> None:
+        """Enable an injected full-model compiler-trace timing runtime."""
+
+        self.sim.use_compiler_trace_timing(provider, request_binder)
+
+    @property
+    def provenance(self) -> Mapping[str, Any]:
+        execution_mode = str(self.sim.execution_mode)
+        binder = self.sim.trace_request_binder
+        return {
+            **self._provenance,
+            "execution_mode": execution_mode,
+            "compiler_trace_artifact_scope": getattr(
+                self.sim.trace_timing_provider,
+                "artifact_scope",
+                None,
+            ),
+            "compiler_trace_request_binder": (
+                f"{type(binder).__module__}.{type(binder).__qualname__}"
+                if binder is not None
+                else None
+            ),
+            "aggregate_bandwidth_timing_used": (
+                execution_mode == LEGACY_AGGREGATE_BANDWIDTH_MODE
+                and self.calibrated_bandwidth
+            ),
+        }
+
+    def evaluate_handoff(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        workload: HardwareWorkload,
+        artifact: PrefillHandoffArtifact,
+        *,
+        decode_tpot_s: float,
+        decode_energy_per_token_j: float,
+        decode_energy_tier: str,
+        decode_timing_evidence_id: str,
+        system_calibration_id: str,
+    ) -> Mapping[str, Any]:
+        """Evaluate E1 schedules from explicit prefill and decode evidence."""
+
+        root = simulator_root()
+        if str(root) not in sys.path:
+            sys.path.insert(0, str(root))
+        from analytic_models.disagg_serve.handoff import (
+            AdmissionModel,
+            evaluate_handoff_regimes,
+            handoff_time,
+        )
+
+        request = precision_request(entry.profile)
+        precision = self.sim.make_precision(
+            attn_w=request.weight,
+            ffn_w=request.weight,
+            key=request.key,
+            value=request.value,
+            w_fmt=request.weight_family,
+            key_fmt=request.key_family,
+            value_fmt=request.value_family,
+            block=request.block_size,
+            act_w=request.activation,
+            act_fmt=request.activation_family,
+        )
+        measurement = artifact.measurement(candidate.batch)
+        admission = AdmissionModel(
+            bandwidth_bytes_per_s=artifact.admission_bandwidth_bytes_per_s,
+            quantize_energy_j_per_element=(
+                artifact.admission_quantize_energy_j_per_element
+            ),
+            memory_energy_j_per_byte=(
+                artifact.admission_memory_energy_j_per_byte
+            ),
+            calibrated=artifact.admission_calibrated,
+            calibration_id=artifact.admission_calibration_id,
+        )
+        handoff = handoff_time(
+            self.sim.dims,
+            precision.spec,
+            workload.input_seq,
+            candidate.batch,
+            link_gen=artifact.direct_link_generation,
+            admission=admission,
+        )
+        energy_tier = (
+            f"prefill:{measurement.evidence_tier};"
+            f"decode:{decode_energy_tier};"
+            f"admission:{artifact.admission_evidence_tier};"
+            f"links:{artifact.link_evidence_tier}"
+        )
+        regimes = evaluate_handoff_regimes(
+            handoff,
+            prompt_tokens=workload.input_seq,
+            generation_tokens=workload.output_seq,
+            precision=(
+                f"W={entry.profile.weight_format};"
+                f"A={entry.profile.activation_format};"
+                f"K={entry.profile.key_format};"
+                f"V={entry.profile.value_format}"
+            ),
+            prefill_latency_s=measurement.latency_s,
+            decode_tpot_s=decode_tpot_s,
+            decode_ready_delay_s=artifact.decode_ready_delay_s,
+            prefill_energy_j=measurement.energy_j,
+            decode_energy_per_token_j=decode_energy_per_token_j,
+            prefill_stall_power_w=artifact.prefill_stall_power_w,
+            decode_idle_power_w=artifact.decode_idle_power_w,
+            direct_link_generation=artifact.direct_link_generation,
+            host_link_generation=artifact.host_link_generation,
+            direct_link_energy_pj_per_bit=(
+                artifact.direct_link_energy_pj_per_bit
+            ),
+            host_link_energy_pj_per_bit=artifact.host_link_energy_pj_per_bit,
+            energy_tier=energy_tier,
+        )
+        return {
+            "schema_version": PREFILL_HANDOFF_ANALYSIS_SCHEMA,
+            "scope": "request_level_prefill_decode_schedule",
+            "input_artifact_id": artifact.artifact_id,
+            "publication_rankable": artifact.publication_rankable,
+            "unrankable_reason": (
+                None
+                if artifact.publication_rankable
+                else "admission_cost_uncalibrated"
+            ),
+            "ordinary_decode_ranking_effect": "none",
+            "physical_precision_signature": physical_cost_signature(
+                entry.profile,
+                exact_vector_format=True,
+            ),
+            "candidate_id": candidate.candidate_id,
+            "batch": candidate.batch,
+            "prefill": {
+                "scope": artifact.prefill_scope,
+                **measurement.to_dict(),
+            },
+            "decode": {
+                "tpot_s": decode_tpot_s,
+                "energy_per_token_j": decode_energy_per_token_j,
+                "energy_tier": decode_energy_tier,
+                "timing_evidence_id": decode_timing_evidence_id,
+                "system_calibration_id": system_calibration_id,
+            },
+            "handoff": {
+                "wire_bytes": handoff.wire_bytes,
+                "decode_cache_bytes": handoff.decode_cache_bytes,
+                "transfer_bulk_s": handoff.transfer_bulk_s,
+                "transfer_streamed_s": handoff.transfer_streamed_s,
+                "admission_s": handoff.admission_s,
+                "admission_energy_j": handoff.admission_energy_j,
+                "admission_calibrated": handoff.admission_calibrated,
+                "admission_calibration_id": (
+                    handoff.admission_calibration_id
+                ),
+                "direct_link_generation": artifact.direct_link_generation,
+                "host_link_generation": artifact.host_link_generation,
+                "link_evidence_id": artifact.link_evidence_id,
+                "link_evidence_tier": artifact.link_evidence_tier,
+            },
+            "regimes": [regime.to_dict() for regime in regimes],
+        }
+
+    def resource_preflight(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        workload: HardwareWorkload,
+    ) -> SimulatorResourcePreflight:
+        """Price exact storage and structural area without running decode time."""
+
+        request = precision_request(entry.profile)
+        precision = self.sim.make_precision(
+            attn_w=request.weight,
+            ffn_w=request.weight,
+            key=request.key,
+            value=request.value,
+            w_fmt=request.weight_family,
+            key_fmt=request.key_family,
+            value_fmt=request.value_family,
+            block=request.block_size,
+            act_w=request.activation,
+            act_fmt=request.activation_family,
+        )
+        hbm = self.sim.hbm_overrides(
+            candidate.hbm_generation,
+            candidate.hbm_channels,
+        )
+        override = {
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "VLEN": candidate.vlen,
+            "HLEN": candidate.hlen,
+            "TP": candidate.tp,
+            "KVP": candidate.kvp,
+            "LINK_PORTS": candidate.link_ports,
+            "SRAM_POLICY": candidate.sram_policy,
+            "LINK_GENERATION": "nvlink4",
+            **hbm,
+        }
+        if candidate.architecture_knobs_explicit:
+            override.update(
+                {
+                    "KV_HEAD_REUSE": candidate.kv_head_reuse,
+                    "DRAIN_OVERLAPPED": candidate.drain_overlapped,
+                }
+            )
+        hardware = self.sim.base_hw.model_copy(update=override)
+        memory = self.sim.base_mem.model_copy(
+            update={
+                "weight_bits": precision.spec["ffn_bits"],
+                "activation_bits": 16,
+                "kv_cache_bits": precision.spec["kv_bits"],
+                **override,
+            }
+        )
+        hbm_per_chip = int(memory.HBM_SIZE)
+        precision_id = _content_hash(precision.spec)
+        ledger_key = (
+            precision_id,
+            candidate.mlen,
+            candidate.blen,
+            candidate.hlen,
+            candidate.batch,
+            candidate.hbm_channels,
+            candidate.chip_count,
+            candidate.tp,
+            candidate.kvp,
+            candidate.sram_policy,
+        )
+        ledger = self._resource_ledger_cache.get(ledger_key)
+        if ledger is None:
+            ledger = self.sim._dd.build_physical_decode_ledger(
+                self.sim.dims,
+                precision.spec,
+                hardware,
+                context=workload.input_seq + workload.output_seq,
+                batch=candidate.batch,
+                hbm_capacity_bytes=hbm_per_chip,
+                runtime_hbm_reserve_bytes=workload.runtime_hbm_reserve_bytes,
+                kv_layout=workload.kv_layout,
+                include_lm_head=(
+                    self.output_head_location == DECODE_BF16_HEAD
+                ),
+            )
+            ledger = self.sim._dd._partition_physical_ledger(
+                ledger,
+                tp=int(candidate.tp),
+                kvp=int(candidate.kvp),
+                hbm_per_chip=hbm_per_chip,
+                sram_policy=candidate.sram_policy,
+                batch=candidate.batch,
+            )
+            if len(self._resource_ledger_cache) >= 4096:
+                self._resource_ledger_cache.clear()
+            self._resource_ledger_cache[ledger_key] = ledger
+        capacity = CapacityBreakdown(
+            weight_bytes=int(ledger.weights.resident.total_aligned),
+            kv_cache_bytes=int(ledger.kv.total_bytes),
+            runtime_bytes=int(ledger.runtime_hbm_reserve_bytes),
+            available_bytes=int(ledger.hbm_capacity_bytes),
+        )
+        sram = ledger.sram
+        runtime_feasible = (
+            capacity.feasible
+            and sram.vector_required_bytes <= sram.vector_capacity_bytes
+            and sram.matrix_required_bytes <= sram.matrix_capacity_bytes
+            and candidate.batch <= int(ledger.max_runtime_batch)
+        )
+        shape = DenseDecoderShape.from_mapping(self.sim.dims)
+        attention_partition = RankLocalAttentionGeometry.bind(shape, candidate)
+        if candidate.kv_head_reuse:
+            reuse = self.sim._dd.kv_head_reuse_status(
+                enabled=True,
+                mlen=candidate.mlen,
+                hlen=candidate.hlen,
+                blen=candidate.blen,
+                kv_heads=attention_partition.local_kv_heads,
+                fp_sram_depth=int(getattr(hardware, "FP_SRAM_DEPTH", 512)),
+            )
+            if not bool(reuse["supported"]):
+                raise ValueError(
+                    "KV_HEAD_REUSE exceeds FP-SRAM/head-broadcast capacity"
+                )
+        self.sim._dd.set_area_model("calibrated", precision.spec)
+        area_key = (
+            precision_id,
+            candidate.mlen,
+            candidate.blen,
+            candidate.hlen,
+            candidate.hbm_channels,
+            candidate.chip_count,
+            candidate.link_ports,
+            candidate.kv_head_reuse,
+            candidate.drain_overlapped,
+            attention_partition.local_kv_heads,
+        )
+        area = self._resource_area_cache.get(area_key)
+        if area is None:
+            area = self.sim._dd.system_area(
+                hardware,
+                precision.spec,
+                chip_count=candidate.chip_count,
+                link_ports=candidate.link_ports,
+                link_generation="nvlink4",
+                kv_head_reuse=candidate.kv_head_reuse,
+                drain_overlapped=candidate.drain_overlapped,
+                kv_heads=attention_partition.local_kv_heads,
+            )
+            if len(self._resource_area_cache) >= 4096:
+                self._resource_area_cache.clear()
+            self._resource_area_cache[area_key] = area
+        chip_area = float(area["chip_area_mm2"])
+        system_area = float(area["area_mm2"])
+        link_area = system_area - chip_area * candidate.chip_count
+        if link_area < -1e-9:
+            raise ValueError("system area is smaller than its decode chips")
+        return SimulatorResourcePreflight(
+            profile_id=entry.profile_id,
+            candidate_id=candidate.candidate_id,
+            analytical_area_mm2=chip_area,
+            system_area_mm2=system_area,
+            capacity=capacity,
+            runtime_feasible=runtime_feasible,
+            max_resident_batch=int(ledger.max_resident_batch),
+            max_runtime_batch=int(ledger.max_runtime_batch),
+            vector_sram_capacity_bytes=int(sram.vector_capacity_bytes),
+            vector_sram_required_bytes=int(sram.vector_required_bytes),
+            matrix_sram_capacity_bytes=int(sram.matrix_capacity_bytes),
+            matrix_sram_required_bytes=int(sram.matrix_required_bytes),
+            link_area_mm2=max(0.0, link_area),
+        )
+
+    def evaluate(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        workload: HardwareWorkload,
+    ) -> SimulatorObservation:
+        request = precision_request(entry.profile)
+        precision = self.sim.make_precision(
+            attn_w=request.weight,
+            ffn_w=request.weight,
+            key=request.key,
+            value=request.value,
+            w_fmt=request.weight_family,
+            key_fmt=request.key_family,
+            value_fmt=request.value_family,
+            block=request.block_size,
+            act_w=request.activation,
+            act_fmt=request.activation_family,
+        )
+        hbm = self.sim.hbm_overrides(
+            candidate.hbm_generation,
+            candidate.hbm_channels,
+        )
+        override = {
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "VLEN": candidate.vlen,
+            "HLEN": candidate.hlen,
+            "TP": candidate.tp,
+            "KVP": candidate.kvp,
+            "LINK_PORTS": candidate.link_ports,
+            "SRAM_POLICY": candidate.sram_policy,
+            "LINK_GENERATION": "nvlink4",
+            **hbm,
+        }
+        if candidate.architecture_knobs_explicit:
+            override.update(
+                {
+                    "KV_HEAD_REUSE": candidate.kv_head_reuse,
+                    "DRAIN_OVERLAPPED": candidate.drain_overlapped,
+                }
+            )
+        self.sim._dd.set_area_model("calibrated", precision.spec)
+        metrics = self.sim.evaluate(
+            precision,
+            batch=candidate.batch,
+            input_seq=workload.input_seq,
+            output_seq=workload.output_seq,
+            hw_over=override,
+            n_chips=candidate.chip_count,
+            stride=workload.stride,
+            hbm_gen=candidate.hbm_generation,
+            hbm_channels=candidate.hbm_channels,
+            kv_layout=workload.kv_layout,
+            runtime_hbm_reserve_bytes=workload.runtime_hbm_reserve_bytes,
+            output_head_location=self.output_head_location,
+        )
+        if metrics.n_chips != candidate.chip_count:
+            raise ValueError("simulator changed the fixed chip count")
+        if (
+            self.calibrated_bandwidth
+            and not metrics.bandwidth_calibration_id
+        ):
+            raise ValueError("simulator omitted the bandwidth calibration identity")
+        traffic = physical_traffic_from_metrics(
+            metrics,
+            batch=candidate.batch,
+        )
+        total_hbm_bytes = (
+            metrics.avg_hbm_bytes_per_batch_step
+            * workload.output_seq
+        )
+        capacity = capacity_from_metrics(
+            metrics,
+            batch=candidate.batch,
+        )
+
+        shape = DenseDecoderShape.from_mapping(self.sim.dims)
+        attention_partition = RankLocalAttentionGeometry.bind(shape, candidate)
+        profile = entry.profile
+        selector_capability = evaluate_stack_capability(
+            profile,
+            _selector_runtime_target(profile, candidate, shape),
+        )
+        selector_issue_codes = tuple(
+            sorted(
+                issue.code
+                for issue in selector_capability.issues
+                if "rtl" in issue.stages
+            )
+        )
+        selector_capability_id = (
+            "packedkv-selector-capability-"
+            + _content_hash(selector_capability.to_dict())
+        )
+        events = count_decode_events(
+            shape,
+            input_seq=workload.input_seq,
+            output_seq=workload.output_seq,
+            batch=candidate.batch,
+            mlen=candidate.mlen,
+            blen=candidate.blen,
+            hlen=candidate.hlen,
+            linear_signature=(
+                f"LINEAR:{_simulator_token(profile.weight_format)}"
+                f"x{_simulator_token(profile.activation_format)}"
+            ),
+            qk_signature=(
+                f"QK:{_simulator_token(profile.key_format)}"
+                f"x{_simulator_token(profile.activation_format)}"
+            ),
+            pv_signature=(
+                f"PV:{_simulator_token(profile.value_format)}"
+                f"x{_simulator_token(profile.activation_format)}"
+            ),
+            vector_signature=f"VECTOR:{profile.vector_format}",
+            stride=workload.stride,
+            include_output_head=(
+                self.output_head_location == DECODE_BF16_HEAD
+            ),
+        )
+        architecture_issue = (
+            "memory"
+            if metrics.frac_architecture_issue_mem_bound >= 0.5
+            else "compute"
+        )
+        collective = self.sim._dd.collective_cost_per_step(
+            self.sim.dims,
+            batch=candidate.batch,
+            tp=candidate.tp,
+            kvp=candidate.kvp,
+            link_ports=candidate.link_ports,
+            link_generation="nvlink4",
+        )
+        area_status = self.sim._dd.system_area(
+            self.sim.base_hw.model_copy(update=override),
+            precision.spec,
+            chip_count=candidate.chip_count,
+            link_ports=candidate.link_ports,
+            link_generation="nvlink4",
+            kv_head_reuse=(
+                candidate.kv_head_reuse
+                if candidate.architecture_knobs_explicit
+                else False
+            ),
+            drain_overlapped=(
+                candidate.drain_overlapped
+                if candidate.architecture_knobs_explicit
+                else False
+            ),
+            kv_heads=attention_partition.local_kv_heads,
+        )
+        chip_area_status = area_status.get("chip")
+        if not isinstance(chip_area_status, Mapping):
+            raise ValueError("full-chip area ledger omitted its chip breakdown")
+        logic_area_mm2 = float(chip_area_status["logic_area"]) / 1e6
+        fp_sram_depth = int(
+            getattr(
+                self.sim.base_hw.model_copy(update=override),
+                "FP_SRAM_DEPTH",
+                512,
+            )
+        )
+        reuse_status = self.sim._dd.kv_head_reuse_status(
+            enabled=(
+                candidate.kv_head_reuse
+                if candidate.architecture_knobs_explicit
+                else True
+            ),
+            mlen=candidate.mlen,
+            hlen=candidate.hlen,
+            blen=candidate.blen,
+            kv_heads=attention_partition.local_kv_heads,
+            fp_sram_depth=fp_sram_depth,
+        )
+        reuse_status = {
+            **reuse_status,
+            "requested": (
+                candidate.kv_head_reuse
+                if candidate.architecture_knobs_explicit
+                else None
+            ),
+            "legacy_implicit_default": (
+                not candidate.architecture_knobs_explicit
+            ),
+            "legality_enforced": candidate.architecture_knobs_explicit,
+        }
+        drain_status = {
+            "requested": (
+                candidate.drain_overlapped
+                if candidate.architecture_knobs_explicit
+                else None
+            ),
+            "enabled": (
+                candidate.drain_overlapped
+                if candidate.architecture_knobs_explicit
+                else metrics.timing_mode == "drain_overlapped"
+            ),
+            "timing_mode": metrics.timing_mode,
+            "timing_calibrated": metrics.timing_calibrated,
+            "timing_evidence_id": metrics.timing_evidence_id,
+            "timing_evidence_tier": metrics.timing_evidence_tier,
+            "timing_reason": metrics.timing_reason,
+            "second_accumulator_bank_bytes_per_chip": (
+                self.sim._dd.DRAIN_ACCUMULATOR_BYTES_PER_CHIP
+                if (
+                    candidate.architecture_knobs_explicit
+                    and candidate.drain_overlapped
+                )
+                else 0
+            ),
+            "evidence_tier": (
+                "not_applicable"
+                if not (
+                    candidate.drain_overlapped
+                    if candidate.architecture_knobs_explicit
+                    else metrics.timing_mode == "drain_overlapped"
+                )
+                else (
+                    (
+                        "compiler_trace_request_calibrated"
+                        if metrics.execution_mode
+                        == COMPILER_TRACE_EXECUTION_MODE
+                        else (
+                            "matched_analytic_emulator_timing"
+                            if metrics.timing_evidence_tier == "emulator"
+                            else "matched_emulator_rtl_timing"
+                        )
+                    )
+                    if metrics.timing_calibrated
+                    else "analytic_codesign_unrankable"
+                )
+            ),
+        }
+        architecture_options = {
+            "schema": "plena-decode-architecture-options",
+            "explicit": candidate.architecture_knobs_explicit,
+            "attention_partition": attention_partition.to_dict(),
+            "kv_head_reuse": reuse_status,
+            "drain_overlapped": drain_status,
+            "area": dict(area_status["architecture_options"]),
+        }
+        token_traffic = dict(metrics.hbm_traffic_per_generated_token)
+        context_tokens = workload.input_seq + workload.output_seq
+        kv_storage_per_sequence = (
+            capacity.kv_cache_bytes / candidate.batch
+        )
+        capacity_throughput_chain = {
+            "schema": "plena-kv-capacity-throughput-chain",
+            "kv_storage_bytes_per_active_sequence": kv_storage_per_sequence,
+            "kv_storage_bytes_per_sequence_context_token": (
+                kv_storage_per_sequence / context_tokens
+            ),
+            "kv_read_bytes_per_generated_token": (
+                token_traffic["kv_element_read_bytes"]
+                + token_traffic["kv_scale_read_bytes"]
+            ),
+            "kv_write_bytes_per_generated_token": (
+                token_traffic["kv_element_write_bytes"]
+                + token_traffic["kv_scale_write_bytes"]
+            ),
+            "max_feasible_batch": metrics.max_runtime_batch,
+            "evaluated_batch": candidate.batch,
+            "capacity_binding": (
+                candidate.batch == metrics.max_runtime_batch
+            ),
+            "runtime_feasible": metrics.fits_runtime,
+            "evaluated_throughput_tokens_per_second": (
+                metrics.tps if metrics.fits_runtime else None
+            ),
+            "throughput_semantics": (
+                "measured_at_evaluated_batch_no_capacity_extrapolation"
+            ),
+            "byte_unit": "physical_bytes",
+            "batch_unit": "active_sequences",
+        }
+        return SimulatorObservation(
+            profile_id=entry.profile_id,
+            candidate_id=candidate.candidate_id,
+            tpot_ms=metrics.tpot * 1000.0,
+            tps=metrics.tps,
+            total_time_s=metrics.total_time,
+            analytical_area_mm2=float(area_status["chip_area_mm2"]),
+            traffic=traffic,
+            capacity=capacity,
+            algorithmic_bottleneck=architecture_issue,
+            realized_bottleneck=metrics.bottleneck,
+            frac_algorithmic_memory_bound=metrics.frac_algorithmic_mem_bound,
+            frac_realized_memory_bound=metrics.frac_mem_bound,
+            frac_serialization_bound=metrics.frac_serialization_bound,
+            generated_tokens_per_step=candidate.batch,
+            decode_steps=workload.output_seq,
+            timing_mode=metrics.timing_mode,
+            timing_calibrated=metrics.timing_calibrated,
+            timing_evidence_id=metrics.timing_evidence_id,
+            timing_reason=metrics.timing_reason,
+            execution_mode=metrics.execution_mode,
+            compiler_trace_timing=metrics.compiler_trace_timing,
+            kv_layout=metrics.kv_layout,
+            layout_id=metrics.kv_layout_id,
+            capacity_model=self.capacity_model_id,
+            runtime_feasible=metrics.fits_runtime,
+            max_batch=metrics.max_batch,
+            max_resident_batch=metrics.max_resident_batch,
+            max_synchronous_batch=metrics.max_synchronous_batch,
+            max_runtime_batch=metrics.max_runtime_batch,
+            fits_onchip_sram=metrics.fits_onchip_sram,
+            vector_sram_capacity_bytes=metrics.vector_sram_capacity_bytes,
+            vector_sram_required_bytes=metrics.vector_sram_required_bytes,
+            matrix_sram_capacity_bytes=metrics.matrix_sram_capacity_bytes,
+            matrix_sram_required_bytes=metrics.matrix_sram_required_bytes,
+            hbm_traffic_per_batch_step=(
+                metrics.hbm_traffic_per_batch_step
+            ),
+            hbm_traffic_per_generated_token=(
+                metrics.hbm_traffic_per_generated_token
+            ),
+            traffic_ledger_id=self.traffic_ledger_id,
+            packedkv_selector_supported=not selector_issue_codes,
+            packedkv_selector_capability_id=selector_capability_id,
+            packedkv_selector_issue_codes=selector_issue_codes,
+            bandwidth_calibration_id=metrics.bandwidth_calibration_id,
+            total_hbm_bytes=total_hbm_bytes,
+            events=events,
+            output_head_location=metrics.output_head_location,
+            collective_time_s_per_step=float(collective["time_s"]),
+            collective_bytes_per_generated_token=(
+                float(collective["total_bytes"]) / candidate.batch
+            ),
+            link_generation="nvlink4",
+            system_area_mm2=float(area_status["area_mm2"]),
+            area_evidence_tier=str(area_status["evidence_tier"]),
+            logic_area_mm2=logic_area_mm2,
+            classical_roofline_bottleneck=(
+                metrics.classical_roofline_bottleneck
+            ),
+            architecture_issue_bottleneck=(
+                metrics.architecture_issue_bottleneck
+            ),
+            frac_classical_memory_bound=(
+                metrics.frac_classical_mem_bound
+            ),
+            frac_architecture_issue_memory_bound=(
+                metrics.frac_architecture_issue_mem_bound
+            ),
+            avg_peak_compute_seconds=(
+                metrics.avg_peak_compute_seconds
+            ),
+            avg_ideal_compute_seconds=(
+                metrics.avg_ideal_compute_seconds
+            ),
+            avg_realized_compute_seconds=(
+                metrics.avg_realized_compute_seconds
+            ),
+            avg_memory_seconds=metrics.avg_memory_seconds,
+            step_composition=metrics.step_composition,
+            architecture_options=architecture_options,
+            capacity_throughput_chain=capacity_throughput_chain,
+        )
+
+
+class SimulatorPowerEngine:
+    """Validated simulator power model with independent bridge checks."""
+
+    def __init__(
+        self,
+        calibration_path: str | os.PathLike[str],
+        area_config: Mapping[str, Any],
+    ) -> None:
+        source = Path(calibration_path).resolve()
+        self.status = load_simulator_power_artifact(
+            source,
+            required_signatures=required_hardware_power_signatures(),
+        )
+        root = simulator_root()
+        analytic = root / "analytic_models"
+        if str(analytic) not in sys.path:
+            sys.path.insert(0, str(analytic))
+        from power.model import PowerCalibration
+
+        self.calibration = PowerCalibration.load(source)
+        canonical_config = {
+            str(key): int(value) for key, value in area_config.items()
+        }
+        missing = [key for key in _AREA_KEYS if key not in canonical_config]
+        if missing:
+            raise ValueError(
+                "area configuration is missing " + ", ".join(missing)
+            )
+        if any(canonical_config[key] <= 0 for key in _AREA_KEYS):
+            raise ValueError("area configuration values must be positive")
+        if canonical_config["BLOCK_DIM"] != 8:
+            raise ValueError("area configuration must use MX block size 8")
+        self.area_config = canonical_config
+        calibration_status = self.status.to_dict()
+        calibration_status.pop("source_path", None)
+        self._provenance = {
+            "engine": "PowerCalibration/estimate_power",
+            "calibration_status": calibration_status,
+            "area_config": dict(sorted(self.area_config.items())),
+        }
+
+    @property
+    def provenance(self) -> Mapping[str, Any]:
+        return self._provenance
+
+    def area_mm2(
+        self,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+        events: Iterable[DecodeEvent],
+    ) -> float:
+        """Evaluate the calibrated chip area without timing or traffic pricing."""
+
+        from power.model import EventCount, estimate_power
+
+        area_config = {
+            **self.area_config,
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "VLEN": candidate.vlen,
+        }
+        estimate = estimate_power(
+            self.calibration,
+            (
+                EventCount(
+                    event.signature,
+                    event.count,
+                    event.mlen,
+                    event.blen,
+                )
+                for event in events
+            ),
+            elapsed_s=1.0,
+            hbm_bytes=0.0,
+            vector_fp=profile.vector_format,
+            area_config=area_config,
+            selector_enabled=True,
+        )
+        if not estimate.rankable:
+            missing = ",".join(estimate.missing_signatures)
+            raise ValueError(f"area estimate is non-rankable: {missing}")
+        area = calibrated_area_from_simulator(
+            self.status,
+            estimate.to_dict(),
+        )
+        if area is None:
+            raise ValueError("power bridge rejected the calibrated area")
+        return area
+
+    def evaluate(
+        self,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+        observation: SimulatorObservation,
+    ) -> PowerOutcome:
+        from power.model import EventCount, estimate_power
+
+        if not observation.packedkv_selector_supported:
+            raise ValueError(
+                "selector power cannot rank an unsupported PackedKV path"
+            )
+        area_config = {
+            **self.area_config,
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "VLEN": candidate.vlen,
+        }
+        estimate = estimate_power(
+            self.calibration,
+            (
+                EventCount(
+                    event.signature,
+                    event.count,
+                    event.mlen,
+                    event.blen,
+                )
+                for event in observation.events
+            ),
+            elapsed_s=observation.total_time_s,
+            hbm_bytes=observation.total_hbm_bytes,
+            vector_fp=profile.vector_format,
+            area_config=area_config,
+            selector_enabled=True,
+        )
+        estimate_dict = estimate.to_dict()
+        if not estimate.rankable:
+            missing = ",".join(estimate.missing_signatures)
+            raise ValueError(f"power estimate is non-rankable: {missing}")
+        area = calibrated_area_from_simulator(self.status, estimate_dict)
+        total_energy = calibrated_energy_from_simulator(
+            self.status,
+            estimate_dict,
+            duration_s=observation.total_time_s,
+        )
+        if area is None or total_energy is None:
+            raise ValueError("power bridge rejected the calibrated estimate")
+        generated_tokens = (
+            observation.generated_tokens_per_step
+            * observation.decode_steps
+        )
+        if generated_tokens <= 0:
+            raise ValueError("power normalization token count is invalid")
+        energy = CalibratedEnergy(
+            calibration_id=total_energy.calibration_id,
+            compute_j=total_energy.compute_j / generated_tokens,
+            vector_j=total_energy.vector_j / generated_tokens,
+            sram_j=total_energy.sram_j / generated_tokens,
+            hbm_j=total_energy.hbm_j / generated_tokens,
+            leakage_j=total_energy.leakage_j / generated_tokens,
+            unattributed_dynamic_j=(
+                total_energy.unattributed_dynamic_j / generated_tokens
+            ),
+            duration_s=total_energy.duration_s / generated_tokens,
+        )
+        return PowerOutcome(
+            area_mm2=area,
+            energy=energy,
+            calibration_id=self.status.calibration_id,
+        )
+
+    def hbm_energy_per_token(
+        self,
+        observation: SimulatorObservation,
+    ) -> tuple[float, str]:
+        """Return only independently sourced HBM energy for an exact anchor."""
+
+        if not self.status.passed:
+            raise ValueError("HBM energy requires a passing power artifact")
+        generated_tokens = (
+            observation.generated_tokens_per_step
+            * observation.decode_steps
+        )
+        if generated_tokens <= 0:
+            raise ValueError("power normalization token count is invalid")
+        coefficient = float(self.status.raw["hbm_energy_j_per_byte"])
+        if not math.isfinite(coefficient) or coefficient <= 0:
+            raise ValueError("HBM energy coefficient is invalid")
+        return (
+            observation.total_hbm_bytes
+            * coefficient
+            / generated_tokens,
+            self.status.calibration_id,
+        )
+
+    def anchor_prediction(
+        self,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+        observation: SimulatorObservation,
+    ) -> Mapping[str, Any]:
+        """Evaluate the model at an exact-anchor point without ranking it."""
+
+        from power.model import EventCount, estimate_power
+
+        area_config = {
+            **self.area_config,
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "VLEN": candidate.vlen,
+        }
+        estimate = estimate_power(
+            self.calibration,
+            (
+                EventCount(
+                    event.signature,
+                    event.count,
+                    event.mlen,
+                    event.blen,
+                )
+                for event in observation.events
+            ),
+            elapsed_s=observation.total_time_s,
+            hbm_bytes=observation.total_hbm_bytes,
+            vector_fp=profile.vector_format,
+            area_config=area_config,
+            selector_enabled=True,
+        )
+        if not estimate.calibrated or estimate.missing_signatures:
+            raise ValueError(
+                "exact-anchor prediction lacks calibrated event coverage"
+            )
+        hbm_j, hbm_calibration_id = self.hbm_energy_per_token(
+            observation
+        )
+        return {
+            "profile_id": profile.profile_id,
+            "candidate_id": candidate.candidate_id,
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "selector_enabled": estimate.selector_enabled,
+            "area_mm2": estimate.area_mm2,
+            "dynamic_power_w": (
+                estimate.dynamic_energy_j / observation.total_time_s
+            ),
+            "leakage_power_w": estimate.leakage_power_w,
+            "hbm_j_per_token": hbm_j,
+            "hbm_calibration_id": hbm_calibration_id,
+            "prediction_calibration_id": self.status.calibration_id,
+            "synthesis_context": dict(
+                self.status.raw["synthesis_context"]
+            ),
+            "model_rankable_without_anchor": estimate.rankable,
+            "extrapolation_reasons": list(
+                estimate.extrapolation_reasons
+            ),
+        }
+
+
+class ProductionHardwareEvaluator:
+    """Fail-closed evaluator injected into ExactHardwareStudy."""
+
+    def __init__(
+        self,
+        backend: SimulatorBackend,
+        workload: HardwareWorkload,
+        *,
+        power_engine: PowerEngine | None = None,
+        dc_anchor_index: ExactDCAnchorIndex | None = None,
+        head_service_status: BF16HeadServiceStatus | None = None,
+        admission_correctness_status: AdmissionCorrectnessStatus | None = None,
+        handoff_artifact: PrefillHandoffArtifact | None = None,
+        resource_budget: ResourceBudget = ResourceBudget(),
+        publication_timing_tier: str = COMPILER_TRACE_TIMING_TIER,
+    ) -> None:
+        self.backend = backend
+        self.workload = workload
+        self.power_engine = power_engine
+        self.dc_anchor_index = dc_anchor_index
+        if publication_timing_tier not in PUBLICATION_TIMING_TIERS:
+            raise ValueError(
+                "publication_timing_tier must be a declared timing tier"
+            )
+        self.publication_timing_tier = publication_timing_tier
+        if handoff_artifact is not None and not isinstance(
+            handoff_artifact,
+            PrefillHandoffArtifact,
+        ):
+            raise TypeError("handoff_artifact must be PrefillHandoffArtifact")
+        if handoff_artifact is not None and not callable(
+            getattr(backend, "evaluate_handoff", None)
+        ):
+            raise ValueError(
+                "the selected backend cannot evaluate the handoff artifact"
+            )
+        self.handoff_artifact = handoff_artifact
+        if not isinstance(resource_budget, ResourceBudget):
+            raise TypeError("resource_budget must be ResourceBudget")
+        self.resource_budget = resource_budget
+        if dc_anchor_index is not None and power_engine is None:
+            raise ValueError(
+                "exact DC anchors require calibrated HBM transfer energy"
+            )
+        self.head_service_status = (
+            head_service_status
+            if head_service_status is not None
+            else getattr(backend, "head_service_status", None)
+        )
+        self.head_service_calibration = (
+            self.head_service_status.calibration
+            if (
+                self.head_service_status is not None
+                and self.head_service_status.passed
+            )
+            else None
+        )
+        admission_status = (
+            admission_correctness_status
+            if admission_correctness_status is not None
+            else missing_admission_correctness_status()
+        )
+        if (
+            admission_status.passed
+            and not admission_correctness_status_valid(
+                admission_status.to_dict()
+            )
+        ):
+            admission_status = missing_admission_correctness_status(
+                "invalid_admission_correctness_status"
+            )
+        self.admission_correctness_status = admission_status
+        self.admission_correctness_valid = (
+            admission_correctness_status_valid(
+                self.admission_correctness_status.to_dict()
+            )
+        )
+        expected_head_location = (
+            EXTERNAL_BF16_HEAD
+            if self.head_service_calibration is not None
+            else DECODE_BF16_HEAD
+        )
+        backend_location = backend.provenance.get(
+            "output_head_location"
+        )
+        if (
+            backend_location is not None
+            and backend_location != expected_head_location
+        ):
+            raise ValueError(
+                "backend and head-service artifact boundaries differ"
+            )
+        self.output_head_location = expected_head_location
+        self.output_head_status = (
+            self.head_service_status.to_dict()
+            if self.head_service_status is not None
+            else {
+                "schema_version": HEAD_SERVICE_SCHEMA,
+                "artifact_sha256": None,
+                "passed": False,
+                "failures": ["missing_head_service_artifact"],
+                "calibration_id": None,
+                "provenance_id": None,
+                "service_mode": "unmodeled",
+                "service_location": None,
+                "required_batches": [],
+            }
+        )
+        payload = {
+            "version": EVALUATOR_VERSION,
+            "event_model": EVENT_MODEL,
+            "software_source_sha256": _module_source_digests(),
+            "workload": workload.to_dict(),
+            "backend": dict(backend.provenance),
+            "power": (
+                dict(power_engine.provenance)
+                if power_engine is not None
+                else None
+            ),
+            "analytic_power": analytic_power_provenance(),
+            "resource_budget": self.resource_budget.to_dict(),
+            "exact_dc_anchors": (
+                dc_anchor_index.to_status()
+                if dc_anchor_index is not None
+                else None
+            ),
+            "traffic_unit": TRAFFIC_UNIT,
+            "output_head_location": self.output_head_location,
+            "head_service_status": dict(self.output_head_status),
+            "admission_correctness_status": (
+                self.admission_correctness_status.to_dict()
+            ),
+            "prefill_handoff_input": (
+                handoff_artifact.to_status()
+                if handoff_artifact is not None
+                else None
+            ),
+        }
+        self.provenance = payload
+        self.evaluator_id = (
+            f"{EVALUATOR_VERSION}:{_content_hash(payload)}"
+        )
+
+    def physical_cost_group_key(
+        self,
+        entry: SweepManifestEntry,
+        numerical_result: Mapping[str, Any],
+    ) -> Mapping[str, Any]:
+        """Declare the complete profile-side cost equivalence relation."""
+
+        return physical_cost_signature(
+            entry.profile,
+            exact_vector_format=True,
+        )
+
+    def candidate_preflight(
+        self,
+        candidate: HardwareCandidate,
+    ) -> HardwareEvaluation | None:
+        """Apply precision-independent aggregate HBM resource limits."""
+
+        simulator = getattr(self.backend, "sim", None)
+        hbm_overrides = getattr(simulator, "hbm_overrides", None)
+        if hbm_overrides is None:
+            return None
+        try:
+            hbm = hbm_overrides(
+                candidate.hbm_generation,
+                candidate.hbm_channels,
+            )
+            capacity = int(hbm["HBM_SIZE"]) * candidate.chip_count
+            bandwidth = (
+                hbm_peak_bandwidth_bytes_per_s(
+                    candidate.hbm_generation,
+                    candidate.hbm_channels,
+                )
+                * candidate.chip_count
+            )
+        except Exception:
+            return None
+        failed = []
+        if capacity > self.resource_budget.aggregate_hbm_capacity_limit_bytes:
+            failed.append("hbm_capacity")
+        if (
+            bandwidth
+            > self.resource_budget.aggregate_hbm_bandwidth_limit_bytes_per_s
+        ):
+            failed.append("hbm_bandwidth")
+        if failed:
+            return HardwareEvaluation.failed(
+                "candidate_resource_budget_exceeded",
+                "aggregate " + ",".join(failed) + " budget exceeded",
+            )
+        return None
+
+    def preflight_group_key(
+        self,
+        entry: SweepManifestEntry,
+        numerical_result: Mapping[str, Any],
+    ) -> Mapping[str, Any] | str:
+        """Keep profile-scoped exact anchors out of shared gate decisions."""
+
+        if self.dc_anchor_index is not None:
+            return f"exact-anchor-profile:{entry.profile_id}"
+        return self.physical_cost_group_key(entry, numerical_result)
+
+    def evaluation_group_key(
+        self,
+        entry: SweepManifestEntry,
+        numerical_result: Mapping[str, Any],
+    ) -> Mapping[str, Any] | str:
+        """Declare when one priced result can be joined to several rows."""
+
+        if self.dc_anchor_index is not None:
+            return f"exact-anchor-profile:{entry.profile_id}"
+        return self.physical_cost_group_key(entry, numerical_result)
+
+    def _area_events(
+        self,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+    ) -> tuple[DecodeEvent, ...]:
+        simulator = getattr(self.backend, "sim", None)
+        dimensions = getattr(simulator, "dims", None)
+        if not isinstance(dimensions, Mapping):
+            raise TypeError("area preflight requires simulator dimensions")
+        shape = DenseDecoderShape.from_mapping(dimensions)
+        return count_decode_events(
+            shape,
+            input_seq=self.workload.input_seq,
+            output_seq=self.workload.output_seq,
+            batch=candidate.batch,
+            mlen=candidate.mlen,
+            blen=candidate.blen,
+            hlen=candidate.hlen,
+            linear_signature=(
+                f"LINEAR:{_simulator_token(profile.weight_format)}"
+                f"x{_simulator_token(profile.activation_format)}"
+            ),
+            qk_signature=(
+                f"QK:{_simulator_token(profile.key_format)}"
+                f"x{_simulator_token(profile.activation_format)}"
+            ),
+            pv_signature=(
+                f"PV:{_simulator_token(profile.value_format)}"
+                f"x{_simulator_token(profile.activation_format)}"
+            ),
+            vector_signature=f"VECTOR:{profile.vector_format}",
+            stride=self.workload.stride,
+            include_output_head=(
+                self.output_head_location == DECODE_BF16_HEAD
+            ),
+        )
+
+    def preflight(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        numerical_result: Mapping[str, Any],
+    ) -> HardwareEvaluation | None:
+        """Reject only exact hard-constraint failures before timing pricing."""
+
+        simulator = getattr(self.backend, "sim", None)
+        dimensions = getattr(simulator, "dims", None)
+        if isinstance(dimensions, Mapping):
+            try:
+                shape = DenseDecoderShape.from_mapping(dimensions)
+                partition = RankLocalAttentionGeometry.bind(shape, candidate)
+                capability = evaluate_stack_capability(
+                    entry.profile,
+                    _selector_runtime_target(entry.profile, candidate, shape),
+                )
+            except Exception:
+                # A malformed proof cannot reject a point before the full
+                # fail-closed evaluator has recorded the failure.
+                capability = None
+                partition = None
+                shape = None
+            if capability is not None and partition is not None and shape is not None:
+                geometry_codes = {
+                    issue.code
+                    for issue in capability.issues
+                    if "compiler" in issue.stages
+                    and issue.code
+                    in {
+                        "packedkv_block_alignment",
+                        "packedkv_hlen_tiling",
+                        "packedkv_selector_stride",
+                        "packedkv_row_overflow",
+                        "packedkv_head_slots",
+                        "packedkv_selector_encoding",
+                    }
+                }
+                if (
+                    partition.local_attention_heads
+                    // partition.local_kv_heads
+                    > candidate.mlen // candidate.hlen
+                ):
+                    geometry_codes.add("packed_attention_gqa_broadcast")
+                if geometry_codes:
+                    return HardwareEvaluation.failed(
+                        "native_compiler_geometry_unsupported",
+                        "exact rank-local geometry: "
+                        + ",".join(sorted(geometry_codes)),
+                    )
+
+        resource_preflight = getattr(self.backend, "resource_preflight", None)
+        if resource_preflight is None:
+            return None
+        try:
+            status = resource_preflight(entry, candidate, self.workload)
+            if not isinstance(status, SimulatorResourcePreflight):
+                raise TypeError(
+                    "simulator resource preflight returned an invalid status"
+                )
+            if status.profile_id != entry.profile_id:
+                raise ValueError("preflight profile identity mismatch")
+            if status.candidate_id != candidate.candidate_id:
+                raise ValueError("preflight candidate identity mismatch")
+        except Exception:
+            # A preflight computation failure is not evidence that the point
+            # is infeasible.  Preserve it for the full fail-closed evaluator.
+            return None
+        if not status.runtime_feasible:
+            failures = []
+            if not status.capacity.feasible:
+                failures.append("hbm_capacity")
+            if (
+                status.vector_sram_required_bytes
+                > status.vector_sram_capacity_bytes
+            ):
+                failures.append("vector_sram_capacity")
+            if (
+                status.matrix_sram_required_bytes
+                > status.matrix_sram_capacity_bytes
+            ):
+                failures.append("matrix_sram_capacity")
+            return HardwareEvaluation.failed(
+                "runtime_capacity_exceeded",
+                "physical " + ",".join(failures or ("batch_capacity",))
+                + " exceeded",
+            )
+
+        per_chip_area = status.analytical_area_mm2
+        exact_anchor = (
+            self.dc_anchor_index.get(entry.profile_id, candidate)
+            if self.dc_anchor_index is not None
+            else None
+        )
+        if exact_anchor is not None:
+            per_chip_area = float(exact_anchor.area_mm2)
+        elif self.power_engine is not None:
+            area_method = getattr(self.power_engine, "area_mm2", None)
+            if area_method is None:
+                per_chip_area = None
+            else:
+                try:
+                    per_chip_area = float(
+                        area_method(
+                            entry.profile,
+                            candidate,
+                            self._area_events(entry.profile, candidate),
+                        )
+                    )
+                except Exception:
+                    per_chip_area = None
+        aggregate_bandwidth = (
+            hbm_peak_bandwidth_bytes_per_s(
+                candidate.hbm_generation,
+                candidate.hbm_channels,
+            )
+            * candidate.chip_count
+        )
+        failed = []
+        if per_chip_area is not None:
+            aggregate_area = (
+                per_chip_area * candidate.chip_count
+                + status.link_area_mm2
+            )
+            if aggregate_area > self.resource_budget.aggregate_area_limit_mm2:
+                failed.append("area")
+        if (
+            status.capacity.available_bytes
+            > self.resource_budget.aggregate_hbm_capacity_limit_bytes
+        ):
+            failed.append("hbm_capacity")
+        if (
+            aggregate_bandwidth
+            > self.resource_budget.aggregate_hbm_bandwidth_limit_bytes_per_s
+        ):
+            failed.append("hbm_bandwidth")
+        if failed:
+            return HardwareEvaluation.failed(
+                "resource_budget_exceeded",
+                "aggregate " + ",".join(failed) + " budget exceeded",
+            )
+        return None
+
+    def __call__(
+        self,
+        entry: SweepManifestEntry,
+        candidate: HardwareCandidate,
+        numerical_result: Mapping[str, Any],
+    ) -> HardwareEvaluation:
+        if numerical_result.get("state") != "succeeded":
+            return HardwareEvaluation.failed(
+                "numerical_not_succeeded",
+                f"numerical state is {numerical_result.get('state')!r}",
+            )
+        numerical_metrics = numerical_result.get("result")
+        if not isinstance(numerical_metrics, Mapping):
+            return HardwareEvaluation.failed(
+                "numerical_metrics_invalid",
+                "successful numerical result is missing",
+            )
+        mean_nll = numerical_metrics.get("mean_nll")
+        token_count = numerical_metrics.get("token_count")
+        if (
+            isinstance(mean_nll, bool)
+            or not isinstance(mean_nll, (int, float))
+            or not math.isfinite(mean_nll)
+            or mean_nll < 0
+            or isinstance(token_count, bool)
+            or not isinstance(token_count, int)
+            or token_count <= 0
+        ):
+            return HardwareEvaluation.failed(
+                "numerical_metrics_invalid",
+                "successful numerical NLL or token count is invalid",
+            )
+        try:
+            precision_request(entry.profile)
+            observation = self.backend.evaluate(
+                entry,
+                candidate,
+                self.workload,
+            )
+            if observation.profile_id != entry.profile_id:
+                raise ValueError("simulator profile identity mismatch")
+            if observation.candidate_id != candidate.candidate_id:
+                raise ValueError("simulator candidate identity mismatch")
+            if observation.kv_layout != self.workload.kv_layout:
+                raise ValueError("simulator layout identity mismatch")
+            if (
+                observation.output_head_location
+                != self.output_head_location
+            ):
+                raise ValueError("simulator output-head boundary mismatch")
+            expected_tps = (
+                observation.generated_tokens_per_step
+                * 1000.0
+                / observation.tpot_ms
+            )
+            if abs(observation.tps - expected_tps) > max(
+                1e-9,
+                expected_tps * 1e-9,
+            ):
+                raise ValueError("simulator TPOT and TPS are inconsistent")
+        except Exception as exc:
+            return HardwareEvaluation.failed(
+                "simulator_evaluation_failed",
+                f"{type(exc).__name__}: {exc}",
+            )
+
+        error_code: str | None = None
+        error_message: str | None = None
+        area = observation.analytical_area_mm2
+        area_source = "analytical_uncalibrated"
+        area_calibration_id: str | None = None
+        energy: CalibratedEnergy | None = None
+        whole_energy: CalibratedEnergy | None = None
+        system_calibration_id: str | None = None
+        dc_valid: bool | None = None
+        dc_anchor_id: str | None = None
+        dc_anchor_status: Mapping[str, Any] = {}
+        head_estimate = None
+        head_estimate_error: str | None = None
+        if self.head_service_calibration is not None:
+            try:
+                head_estimate = self.head_service_calibration.estimate(
+                    candidate.batch
+                )
+            except Exception as exc:
+                head_estimate_error = f"{type(exc).__name__}: {exc}"
+        resolved_timing_tier: str | None = None
+        if (
+            self.publication_timing_tier == COMPILER_TRACE_TIMING_TIER
+            and observation.execution_mode == COMPILER_TRACE_EXECUTION_MODE
+        ):
+            resolved_timing_tier = COMPILER_TRACE_TIMING_TIER
+        elif (
+            self.publication_timing_tier
+            == STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+            and observation.execution_mode == LEGACY_AGGREGATE_BANDWIDTH_MODE
+            and observation.timing_calibrated
+            and observation.timing_evidence_id is not None
+            and observation.bandwidth_calibration_id is not None
+        ):
+            resolved_timing_tier = STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+        whole_rankable = (
+            head_estimate is not None
+            and observation.output_head_location == EXTERNAL_BF16_HEAD
+            and observation.runtime_feasible
+            and observation.timing_calibrated
+            and resolved_timing_tier is not None
+            and self.admission_correctness_valid
+        )
+        whole_tpot_ms = (
+            observation.tpot_ms
+            + head_estimate.total_latency_s * 1000.0
+            if whole_rankable and head_estimate is not None
+            else None
+        )
+        whole_tps = (
+            candidate.batch * 1000.0 / whole_tpot_ms
+            if whole_tpot_ms is not None
+            else None
+        )
+        if not observation.runtime_feasible:
+            error_code = "runtime_infeasible"
+            error_message = "candidate exceeds physical HBM or on-chip SRAM"
+        elif not observation.timing_calibrated:
+            error_code = "timing_uncalibrated"
+            error_message = observation.timing_reason
+        elif (
+            observation.execution_mode == LEGACY_AGGREGATE_BANDWIDTH_MODE
+            and resolved_timing_tier is None
+        ):
+            error_code = "legacy_timing_sensitivity_unrankable"
+            error_message = (
+                "aggregate-bandwidth timing is rankable only at the "
+                "explicitly requested stage_calibrated_analytic tier with "
+                "calibrated bandwidth and timing evidence"
+            )
+        elif not observation.packedkv_selector_supported:
+            error_code = "packedkv_selector_unsupported"
+            error_message = (
+                "PackedKV selector capability failed: "
+                + ",".join(observation.packedkv_selector_issue_codes)
+            )
+        elif head_estimate_error is not None:
+            error_code = "head_service_evaluation_failed"
+            error_message = head_estimate_error
+        elif head_estimate is None:
+            error_code = "output_head_unmodeled"
+            error_message = (
+                "UNMODELED:LM_HEAD_BF16; a passing remote BF16 "
+                "head-service artifact is required"
+            )
+        elif not self.admission_correctness_valid:
+            error_code = "admission_correctness_unverified"
+            error_message = ",".join(
+                self.admission_correctness_status.failures
+            )
+        if error_code is None:
+            try:
+                if observation.logic_area_mm2 is None:
+                    raise ValueError(
+                        "simulator omitted the non-SRAM logic-area ledger"
+                    )
+                mac_bits = max(
+                    format_descriptor(token).element_bits
+                    for token in (
+                        entry.profile.weight_format,
+                        entry.profile.activation_format,
+                        entry.profile.key_format,
+                        entry.profile.value_format,
+                    )
+                )
+                energy = analytic_energy_from_simulator(
+                    candidate=candidate,
+                    observation=observation,
+                    mac_bits=mac_bits,
+                    per_chip_logic_area_mm2=observation.logic_area_mm2,
+                    collective_bytes_per_generated_token=(
+                        observation.collective_bytes_per_generated_token
+                    ),
+                    link_generation=observation.link_generation,
+                )
+                area_source = "analytic_full_chip"
+                if whole_rankable and head_estimate is not None:
+                    whole_energy, system_calibration_id = (
+                        _whole_model_energy(
+                            energy,
+                            head_estimate,
+                            decoder_tpot_ms=observation.tpot_ms,
+                            batch=candidate.batch,
+                        )
+                    )
+            except Exception as exc:
+                error_code = "analytic_power_failed"
+                error_message = f"{type(exc).__name__}: {exc}"
+        exact_anchor = (
+            self.dc_anchor_index.get(entry.profile_id, candidate)
+            if self.dc_anchor_index is not None
+            else None
+        )
+        if error_code is None and exact_anchor is not None:
+            try:
+                exact_anchor.match(
+                    profile=entry.profile,
+                    candidate=candidate,
+                    observation=observation,
+                )
+                if self.power_engine is None:
+                    raise ValueError(
+                        "exact DC anchor is missing HBM calibration"
+                    )
+                prediction = self.power_engine.anchor_prediction(
+                    entry.profile,
+                    candidate,
+                    observation,
+                )
+                prediction_status = exact_anchor.validate_prediction(
+                    prediction
+                )
+                duration_s = (
+                    observation.tpot_ms
+                    / 1000.0
+                    / observation.generated_tokens_per_step
+                )
+                energy = exact_anchor.energy(
+                    duration_s=duration_s,
+                    hbm_j=float(
+                        prediction_status["hbm_j_per_token"]
+                    ),
+                    hbm_calibration_id=str(
+                        prediction_status["hbm_calibration_id"]
+                    ),
+                )
+                area = exact_anchor.area_mm2
+                area_source = "dc_calibrated"
+                area_calibration_id = energy.calibration_id
+                dc_anchor_id = exact_anchor.anchor_id
+                dc_anchor_status = exact_anchor.to_status(
+                    prediction_status
+                )
+                dc_valid = True
+                if whole_rankable and head_estimate is not None:
+                    whole_energy, system_calibration_id = (
+                        _whole_model_energy(
+                            energy,
+                            head_estimate,
+                            decoder_tpot_ms=observation.tpot_ms,
+                            batch=candidate.batch,
+                        )
+                    )
+            except Exception as exc:
+                dc_valid = False
+                error_code = "exact_dc_anchor_failed"
+                error_message = f"{type(exc).__name__}: {exc}"
+        elif error_code is None and self.power_engine is not None:
+            try:
+                power = self.power_engine.evaluate(
+                    entry.profile,
+                    candidate,
+                    observation,
+                )
+                if power.energy.calibration_id != power.calibration_id:
+                    raise ValueError("power calibration identity mismatch")
+                area = power.area_mm2
+                area_source = "dc_calibrated_model"
+                area_calibration_id = power.calibration_id
+                energy = power.energy
+                if whole_rankable and head_estimate is not None:
+                    whole_energy, system_calibration_id = (
+                        _whole_model_energy(
+                            energy,
+                            head_estimate,
+                            decoder_tpot_ms=observation.tpot_ms,
+                            batch=candidate.batch,
+                        )
+                    )
+                dc_valid = None
+            except Exception as exc:
+                dc_valid = None
+                error_code = "power_calibration_failed"
+                error_message = f"{type(exc).__name__}: {exc}"
+
+        if energy is not None and energy.token_latency_s is None:
+            energy = replace(
+                energy,
+                token_latency_s=observation.tpot_ms / 1000.0,
+            )
+
+        if observation.system_area_mm2 is None:
+            raise ValueError("simulator omitted full system area")
+        analytic_link_area = (
+            observation.system_area_mm2
+            - observation.analytical_area_mm2 * candidate.chip_count
+        )
+        if analytic_link_area < -1e-9:
+            raise ValueError("system area is smaller than its decode chips")
+        system_area = (
+            area * candidate.chip_count + max(0.0, analytic_link_area)
+        )
+        resource_status = ResourceBudgetStatus(
+            aggregate_area_mm2=system_area,
+            aggregate_hbm_capacity_bytes=(
+                observation.capacity.available_bytes
+            ),
+            aggregate_hbm_bandwidth_bytes_per_s=(
+                hbm_peak_bandwidth_bytes_per_s(
+                    candidate.hbm_generation,
+                    candidate.hbm_channels,
+                )
+                * candidate.chip_count
+            ),
+            aggregate_multiplier_count=(
+                candidate.mlen
+                * candidate.blen
+                * candidate.chip_count
+            ),
+            budget=self.resource_budget,
+        )
+        if error_code is None and not resource_status.feasible:
+            error_code = "resource_budget_exceeded"
+            failed = [
+                name
+                for name, passed in (
+                    ("area", resource_status.area_feasible),
+                    ("hbm_capacity", resource_status.hbm_capacity_feasible),
+                    ("hbm_bandwidth", resource_status.hbm_bandwidth_feasible),
+                )
+                if not passed
+            ]
+            error_message = "aggregate " + ",".join(failed) + " budget exceeded"
+
+        handoff_analysis: Mapping[str, Any] | None = None
+        if self.handoff_artifact is not None:
+            handoff_unavailable_reason = error_code
+            if (
+                handoff_unavailable_reason is None
+                and (
+                    not whole_rankable
+                    or whole_tpot_ms is None
+                    or whole_energy is None
+                    or system_calibration_id is None
+                    or observation.timing_evidence_id is None
+                )
+            ):
+                handoff_unavailable_reason = (
+                    "decode_whole_model_evidence_incomplete"
+                )
+            if handoff_unavailable_reason is None:
+                try:
+                    handoff_analysis = self.backend.evaluate_handoff(
+                        entry,
+                        candidate,
+                        self.workload,
+                        self.handoff_artifact,
+                        decode_tpot_s=float(whole_tpot_ms) / 1000.0,
+                        decode_energy_per_token_j=(
+                            whole_energy.energy_per_token_j
+                        ),
+                        decode_energy_tier=whole_energy.energy_tier,
+                        decode_timing_evidence_id=(
+                            observation.timing_evidence_id
+                        ),
+                        system_calibration_id=system_calibration_id,
+                    )
+                except Exception as exc:
+                    handoff_unavailable_reason = (
+                        "handoff_evaluation_failed:"
+                        f"{type(exc).__name__}:{exc}"
+                    )
+            if handoff_analysis is None:
+                handoff_analysis = {
+                    "schema_version": PREFILL_HANDOFF_ANALYSIS_SCHEMA,
+                    "scope": "request_level_prefill_decode_schedule",
+                    "input_artifact_id": self.handoff_artifact.artifact_id,
+                    "publication_rankable": False,
+                    "unrankable_reason": handoff_unavailable_reason,
+                    "ordinary_decode_ranking_effect": "none",
+                    "physical_precision_signature": physical_cost_signature(
+                        entry.profile,
+                        exact_vector_format=True,
+                    ),
+                    "candidate_id": candidate.candidate_id,
+                    "batch": candidate.batch,
+                    "regimes": [],
+                }
+
+        metrics = HardwareMetrics(
+            tpot_ms=observation.tpot_ms,
+            tps=observation.tps,
+            area_mm2=area,
+            traffic=observation.traffic,
+            capacity=observation.capacity,
+            algorithmic_bottleneck=observation.algorithmic_bottleneck,
+            realized_bottleneck=observation.realized_bottleneck,
+            frac_algorithmic_memory_bound=(
+                observation.frac_algorithmic_memory_bound
+            ),
+            frac_realized_memory_bound=(
+                observation.frac_realized_memory_bound
+            ),
+            frac_serialization_bound=observation.frac_serialization_bound,
+            classical_roofline_bottleneck=(
+                observation.classical_roofline_bottleneck
+            ),
+            architecture_issue_bottleneck=(
+                observation.architecture_issue_bottleneck
+            ),
+            frac_classical_memory_bound=(
+                observation.frac_classical_memory_bound
+            ),
+            frac_architecture_issue_memory_bound=(
+                observation.frac_architecture_issue_memory_bound
+            ),
+            generated_tokens_per_step=observation.generated_tokens_per_step,
+            kv_layout=observation.kv_layout,
+            layout_id=observation.layout_id,
+            capacity_model=observation.capacity_model,
+            runtime_feasible=observation.runtime_feasible,
+            max_batch=observation.max_batch,
+            max_resident_batch=observation.max_resident_batch,
+            max_synchronous_batch=observation.max_synchronous_batch,
+            max_runtime_batch=observation.max_runtime_batch,
+            fits_onchip_sram=observation.fits_onchip_sram,
+            vector_sram_capacity_bytes=(
+                observation.vector_sram_capacity_bytes
+            ),
+            vector_sram_required_bytes=(
+                observation.vector_sram_required_bytes
+            ),
+            matrix_sram_capacity_bytes=(
+                observation.matrix_sram_capacity_bytes
+            ),
+            matrix_sram_required_bytes=(
+                observation.matrix_sram_required_bytes
+            ),
+            hbm_traffic_per_batch_step=(
+                observation.hbm_traffic_per_batch_step
+            ),
+            hbm_traffic_per_generated_token=(
+                observation.hbm_traffic_per_generated_token
+            ),
+            traffic_ledger_id=observation.traffic_ledger_id,
+            area_source=area_source,
+            energy=energy,
+            area_calibration_id=area_calibration_id,
+            dc_anchor_id=dc_anchor_id,
+            dc_anchor_status=dc_anchor_status,
+            timing_mode=observation.timing_mode,
+            timing_calibrated=observation.timing_calibrated,
+            timing_evidence_id=observation.timing_evidence_id,
+            timing_reason=observation.timing_reason,
+            execution_mode=observation.execution_mode,
+            compiler_trace_timing=observation.compiler_trace_timing,
+            bandwidth_calibration_id=(
+                observation.bandwidth_calibration_id
+            ),
+            admission_correctness_status=(
+                self.admission_correctness_status.to_dict()
+            ),
+            service_mode=(
+                HEAD_SERVICE_MODE
+                if self.head_service_calibration is not None
+                else "unmodeled"
+            ),
+            output_head_status=self.output_head_status,
+            output_head_service=head_estimate,
+            whole_model_tpot_ms=whole_tpot_ms,
+            whole_model_tps=whole_tps,
+            whole_model_energy=whole_energy,
+            system_calibration_id=system_calibration_id,
+            whole_model_rankable=whole_rankable,
+            publication_timing_tier=(
+                resolved_timing_tier if whole_rankable else None
+            ),
+            avg_peak_compute_seconds=(
+                observation.avg_peak_compute_seconds
+            ),
+            avg_ideal_compute_seconds=(
+                observation.avg_ideal_compute_seconds
+            ),
+            avg_realized_compute_seconds=(
+                observation.avg_realized_compute_seconds
+            ),
+            avg_memory_seconds=observation.avg_memory_seconds,
+            step_composition=observation.step_composition,
+            system_area_mm2=system_area,
+            resource_budget=resource_status,
+            architecture_options=observation.architecture_options,
+            capacity_throughput_chain=(
+                observation.capacity_throughput_chain
+            ),
+            handoff_analysis=handoff_analysis,
+        )
+        return HardwareEvaluation(
+            metrics=metrics,
+            validity=StackValidity(dc_calibrated=dc_valid),
+            error_code=error_code,
+            error_message=error_message,
+        )
+
+
+def _load_json_object(path: str | os.PathLike[str]) -> dict[str, Any]:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise TypeError(f"{path} must contain a JSON object")
+    return dict(value)
+
+
+def _validate_system_boundary_config(config: Mapping[str, Any]) -> None:
+    output_head = config.get("output_head_contract")
+    if output_head is not None:
+        expected_head = {
+            "headline_location": EXTERNAL_BF16_HEAD,
+            "headline_precision": "BF16",
+            "local_bf16": "sensitivity_unrankable",
+            "local_low_precision": "accuracy_only",
+        }
+        if output_head != expected_head:
+            raise ValueError("output_head_contract differs from the evaluator")
+    hbm = config.get("hbm_sensitivity")
+    if hbm is not None:
+        expected_hbm = {
+            "schema_version": "decode-hbm-sensitivity",
+            "source_profile_count": 4,
+            "generations": [
+                "HBM2",
+                "HBM2E",
+                "HBM3",
+                "HBM3E",
+                "HBM4",
+            ],
+            "preserve_geometry_batch_channels": True,
+            "cross_generation_ranking": False,
+        }
+        if hbm != expected_hbm:
+            raise ValueError("hbm_sensitivity differs from the evaluator")
+
+
+def _hardware_space(config: Mapping[str, Any]) -> ExactHardwareSpace:
+    return ExactHardwareSpace.from_study_config(config)
+
+
+def _relative_perplexity_limit(config: Mapping[str, Any]) -> float:
+    """Translate the configured fractional PPL tolerance into a hard limit."""
+
+    tolerance = config.get("fp_ppl_tol")
+    if (
+        isinstance(tolerance, bool)
+        or not isinstance(tolerance, (int, float))
+        or not math.isfinite(float(tolerance))
+        or float(tolerance) <= 0
+    ):
+        raise ValueError("fp_ppl_tol must be finite and positive")
+    return 1.0 + float(tolerance)
+
+
+def _code_revisions(values: Iterable[str]) -> dict[str, str]:
+    revisions: dict[str, str] = {}
+    for value in values:
+        try:
+            name, revision = value.split("=", 1)
+        except ValueError as exc:
+            raise ValueError("code revisions must use NAME=REVISION") from exc
+        if not name or not revision or name in revisions:
+            raise ValueError(f"invalid code revision {value!r}")
+        revisions[name] = revision
+    return revisions
+
+
+def run_exact_hardware_study(
+    *,
+    manifest: SweepManifest,
+    numerical_rows: Iterable[Mapping[str, Any]],
+    space: ExactHardwareSpace,
+    hidden_size: int,
+    evaluator: ProductionHardwareEvaluator,
+    output: str | os.PathLike[str],
+    code_revisions: Mapping[str, str] | None = None,
+    require_complete: bool = True,
+    relative_perplexity_limit: float | None = None,
+) -> Mapping[str, Any]:
+    """Execute and atomically write one provenance-bound study."""
+
+    study = ExactHardwareStudy(
+        manifest=manifest,
+        numerical_results=numerical_rows,
+        space=space,
+        hidden_size=hidden_size,
+        evaluator=evaluator,
+        evaluator_version=evaluator.evaluator_id,
+        evaluator_provenance=evaluator.provenance,
+        code_revisions=code_revisions,
+        require_complete=require_complete,
+        relative_perplexity_limit=relative_perplexity_limit,
+    )
+    artifact = study.write(output)
+    return {
+        "run_id": artifact.run_id,
+        "path": str(artifact.path),
+        "metadata_path": str(artifact.metadata_path),
+        "result_count": artifact.result_count,
+        "content_sha256": artifact.content_hash,
+        "evaluator_id": evaluator.evaluator_id,
+    }
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Run the exact decode hardware study."
+    )
+    parser.add_argument("--manifest", required=True)
+    parser.add_argument(
+        "--numerical-jsonl",
+        action="append",
+        help="terminal result JSONL or a directory containing result shards",
+    )
+    parser.add_argument(
+        "--refinement-schedule",
+        help="immutable refinement schedule for refined-profile repricing",
+    )
+    parser.add_argument(
+        "--refinement-merge",
+        help="immutable four-shard merge receipt for refined-profile repricing",
+    )
+    parser.add_argument(
+        "--refinement-results",
+        help="optional relocated merged refinement JSONL with the sealed identity",
+    )
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--timing-evidence", required=True)
+    parser.add_argument(
+        "--execution-mode",
+        choices=(
+            COMPILER_TRACE_EXECUTION_MODE,
+            LEGACY_AGGREGATE_BANDWIDTH_MODE,
+        ),
+        required=True,
+        help=(
+            "compiler_trace prices from full-model traces; "
+            "legacy_aggregate_bandwidth prices from the stage-calibrated "
+            "analytic model"
+        ),
+    )
+    parser.add_argument(
+        "--publication-timing-tier",
+        choices=sorted(PUBLICATION_TIMING_TIERS),
+        required=True,
+        help=(
+            "declared timing tier of every rankable row; must match the "
+            "execution mode and is stamped on the study output"
+        ),
+    )
+    parser.add_argument(
+        "--compiler-trace-artifacts",
+        help="content-addressed full-model compiler artifact set",
+    )
+    parser.add_argument(
+        "--request-memory-calibration",
+        help="structured HBM request-latency calibration CSV",
+    )
+    parser.add_argument("--stride", type=int, required=True)
+    parser.add_argument(
+        "--runtime-hbm-reserve-bytes",
+        type=int,
+        required=True,
+    )
+    parser.add_argument("--power-calibration")
+    parser.add_argument("--area-config")
+    parser.add_argument("--exact-dc-anchors")
+    parser.add_argument("--rtl-source-tree-sha256")
+    parser.add_argument("--head-service-calibration")
+    parser.add_argument("--admission-receipt", required=True)
+    parser.add_argument(
+        "--handoff-artifact",
+        help=(
+            "optional evidence-bound BF16 prefill/admission artifact for "
+            "prefill-to-decode schedule analysis"
+        ),
+    )
+    parser.add_argument(
+        "--local-bf16-head-sensitivity",
+        action="store_true",
+        help=(
+            "run an explicitly unrankable local-BF16-head sensitivity "
+            "instead of the calibrated remote service"
+        ),
+    )
+    parser.add_argument("--settings-toml")
+    parser.add_argument("--isa-path")
+    parser.add_argument("--output", required=True)
+    parser.add_argument("--code-revision", action="append", default=[])
+    parser.add_argument("--allow-incomplete", action="store_true")
+    return parser
+
+
+def _validate_execution_launch(
+    *,
+    execution_mode: str,
+    compiler_trace_artifacts: str | os.PathLike[str] | None,
+    publication_timing_tier: str,
+) -> None:
+    if execution_mode not in {
+        COMPILER_TRACE_EXECUTION_MODE,
+        LEGACY_AGGREGATE_BANDWIDTH_MODE,
+    }:
+        raise ValueError("unsupported decode execution mode")
+    if publication_timing_tier not in PUBLICATION_TIMING_TIERS:
+        raise ValueError("unsupported publication timing tier")
+    expected_tier = (
+        COMPILER_TRACE_TIMING_TIER
+        if execution_mode == COMPILER_TRACE_EXECUTION_MODE
+        else STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+    )
+    if publication_timing_tier != expected_tier:
+        raise ValueError(
+            "publication timing tier differs from the execution mode: "
+            f"{execution_mode} prices at {expected_tier}"
+        )
+    if execution_mode == COMPILER_TRACE_EXECUTION_MODE:
+        if compiler_trace_artifacts is None or not os.fspath(
+            compiler_trace_artifacts
+        ).strip():
+            raise ValueError(
+                "compiler_trace requires --compiler-trace-artifacts"
+            )
+    elif compiler_trace_artifacts is not None:
+        raise ValueError(
+            "legacy timing cannot consume compiler-trace artifacts"
+        )
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = _parser().parse_args(argv)
+    refinement_mode = any(
+        value is not None
+        for value in (
+            args.refinement_schedule,
+            args.refinement_merge,
+            args.refinement_results,
+        )
+    )
+    if refinement_mode:
+        if (
+            args.refinement_schedule is None
+            or args.refinement_merge is None
+            or args.numerical_jsonl
+            or args.allow_incomplete
+        ):
+            raise ValueError(
+                "refined hardware repricing requires schedule and merge, "
+                "and forbids base numerical inputs or incomplete coverage"
+            )
+    elif not args.numerical_jsonl:
+        raise ValueError(
+            "base hardware evaluation requires --numerical-jsonl"
+        )
+    _validate_execution_launch(
+        execution_mode=args.execution_mode,
+        compiler_trace_artifacts=args.compiler_trace_artifacts,
+        publication_timing_tier=args.publication_timing_tier,
+    )
+    if (
+        args.publication_timing_tier == STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+        and args.local_bf16_head_sensitivity
+    ):
+        raise ValueError(
+            "the analytic publication tier requires the remote head service"
+        )
+    if (
+        args.execution_mode == LEGACY_AGGREGATE_BANDWIDTH_MODE
+        and args.request_memory_calibration is not None
+    ):
+        raise ValueError(
+            "legacy timing cannot consume request-memory calibration"
+        )
+    if bool(args.power_calibration) != bool(args.area_config):
+        raise ValueError(
+            "--power-calibration and --area-config must be supplied together"
+        )
+    if args.exact_dc_anchors and not args.power_calibration:
+        raise ValueError(
+            "--exact-dc-anchors requires --power-calibration"
+        )
+    if bool(args.exact_dc_anchors) != bool(
+        args.rtl_source_tree_sha256
+    ):
+        raise ValueError(
+            "--exact-dc-anchors and --rtl-source-tree-sha256 "
+            "must be supplied together"
+        )
+    if args.local_bf16_head_sensitivity:
+        if args.head_service_calibration:
+            raise ValueError(
+                "local head sensitivity cannot use a remote head artifact"
+            )
+    elif not args.head_service_calibration:
+        raise ValueError(
+            "the headline study requires --head-service-calibration"
+        )
+    base_manifest = load_manifest(args.manifest)
+    config = _load_json_object(args.config)
+    _validate_system_boundary_config(config)
+    if config.get("model_name") != base_manifest.model_name:
+        raise ValueError("config and manifest model names differ")
+    if config.get("model_revision") != base_manifest.model_revision:
+        raise ValueError("config and manifest model revisions differ")
+    if str(config.get("tokenizer_revision")) != str(
+        base_manifest.tokenizer_revision
+    ):
+        raise ValueError("config and manifest tokenizer revisions differ")
+    admission_status = load_admission_correctness_evidence(
+        args.admission_receipt,
+        manifest_hash=base_manifest.canonical_hash,
+    )
+    if not admission_status.passed:
+        raise ValueError(
+            "decode admission correctness evidence failed: "
+            + ",".join(admission_status.failures)
+        )
+    if refinement_mode:
+        manifest, rows = _refinement_hardware_inputs(
+            base_manifest,
+            args.refinement_schedule,
+            args.refinement_merge,
+            args.refinement_results,
+        )
+    else:
+        manifest = base_manifest
+        rows = load_terminal_numerical_rows(
+            args.numerical_jsonl,
+            base_manifest,
+            require_complete=not args.allow_incomplete,
+        )
+    reference = config.get("reference_workload")
+    if not isinstance(reference, Mapping):
+        raise ValueError("config is missing reference_workload")
+    workload = HardwareWorkload(
+        input_seq=int(reference["input_seq"]),
+        output_seq=int(reference["output_seq"]),
+        stride=args.stride,
+        runtime_hbm_reserve_bytes=args.runtime_hbm_reserve_bytes,
+    )
+    space = _hardware_space(config)
+    handoff_artifact = (
+        PrefillHandoffArtifact.load(
+            args.handoff_artifact,
+            model_name=manifest.model_name,
+            model_revision=manifest.model_revision,
+            workload=workload,
+            required_batches=space.batch,
+        )
+        if args.handoff_artifact is not None
+        else None
+    )
+    backend = DecodeSimulatorBackend(
+        model=str(config["sim_model"]),
+        model_lib=config.get("model_lib"),
+        settings_toml=args.settings_toml,
+        isa_path=args.isa_path,
+        timing_evidence=args.timing_evidence,
+        calibrated_bandwidth=(
+            args.execution_mode == LEGACY_AGGREGATE_BANDWIDTH_MODE
+            and config.get("bw_model") == "calibrated"
+        ),
+        execution_mode=args.execution_mode,
+        compiler_trace_artifacts=args.compiler_trace_artifacts,
+        request_memory_calibration=args.request_memory_calibration,
+        head_service_artifact=args.head_service_calibration,
+        model_name=manifest.model_name,
+        model_revision=manifest.model_revision,
+        required_batches=space.batch,
+    )
+    if (
+        not args.local_bf16_head_sensitivity
+        and backend.output_head_location != EXTERNAL_BF16_HEAD
+    ):
+        failures = (
+            backend.head_service_status.failures
+            if backend.head_service_status is not None
+            else ("missing_head_service_artifact",)
+        )
+        raise ValueError(
+            "the remote BF16 output-head service is not rankable: "
+            + ",".join(failures)
+        )
+    if (
+        args.publication_timing_tier == STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+        and not backend.calibrated_bandwidth
+    ):
+        raise ValueError(
+            "the stage_calibrated_analytic tier requires "
+            "config.bw_model == 'calibrated'"
+        )
+    if backend.calibrated_bandwidth:
+        backend.sim.validate_calibrated_hardware_space(
+            space.hbm_generation,
+            space.hbm_channels,
+        )
+    power_engine = (
+        SimulatorPowerEngine(
+            args.power_calibration,
+            _load_json_object(args.area_config),
+        )
+        if args.power_calibration
+        else None
+    )
+    dc_anchor_index = (
+        ExactDCAnchorIndex.load(
+            args.exact_dc_anchors,
+            model_name=manifest.model_name,
+            model_revision=manifest.model_revision,
+            workload=workload.to_dict(),
+            rtl_source_tree_sha256=args.rtl_source_tree_sha256,
+        )
+        if args.exact_dc_anchors
+        else None
+    )
+    if refinement_mode and dc_anchor_index is not None:
+        refined_ids = {entry.profile_id for entry in manifest.entries}
+        if not any(anchor.profile_id in refined_ids for anchor in dc_anchor_index.anchors):
+            raise ValueError(
+                "refined hardware repricing cannot inherit base-profile DC anchors"
+            )
+    evaluator = ProductionHardwareEvaluator(
+        backend,
+        workload,
+        power_engine=power_engine,
+        dc_anchor_index=dc_anchor_index,
+        head_service_status=backend.head_service_status,
+        admission_correctness_status=admission_status,
+        handoff_artifact=handoff_artifact,
+        resource_budget=space.resource_budget,
+        publication_timing_tier=args.publication_timing_tier,
+    )
+    result = run_exact_hardware_study(
+        manifest=manifest,
+        numerical_rows=rows,
+        space=space,
+        hidden_size=int(backend.sim.dims["hidden"]),
+        evaluator=evaluator,
+        output=args.output,
+        code_revisions=_code_revisions(args.code_revision),
+        require_complete=not args.allow_incomplete,
+        relative_perplexity_limit=(
+            None if refinement_mode else _relative_perplexity_limit(config)
+        ),
+    )
+    print(json.dumps(result, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+
+
+__all__ = [
+    "DecodeSimulatorBackend",
+    "EVALUATOR_VERSION",
+    "HardwareWorkload",
+    "PowerEngine",
+    "PowerOutcome",
+    "PREFILL_HANDOFF_ANALYSIS_SCHEMA",
+    "PREFILL_HANDOFF_INPUT_SCHEMA",
+    "PREFILL_MEASUREMENT_SCOPE",
+    "PrefillHandoffArtifact",
+    "PrefillMeasurement",
+    "PrecisionRequest",
+    "ProductionHardwareEvaluator",
+    "RankLocalAttentionGeometry",
+    "RefinementHardwareEntry",
+    "RefinementHardwareManifest",
+    "SimulatorBackend",
+    "SimulatorObservation",
+    "SimulatorPowerEngine",
+    "capacity_from_metrics",
+    "load_terminal_numerical_rows",
+    "main",
+    "physical_traffic_from_metrics",
+    "precision_request",
+    "run_exact_hardware_study",
+]
diff --git a/decode_dse/hardware/hbm_sensitivity.py b/decode_dse/hardware/hbm_sensitivity.py
new file mode 100644
index 0000000..8d3bdfe
--- /dev/null
+++ b/decode_dse/hardware/hbm_sensitivity.py
@@ -0,0 +1,542 @@
+"""Controlled post-selection HBM technology sensitivity schedule."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Protocol, Sequence
+
+from decode_dse.hardware.admission_cost import (
+    admission_correctness_status_valid,
+)
+from decode_dse.hardware.design_space import HardwareCandidate
+from decode_dse.hardware.lm_head_service import (
+    HEAD_SERVICE_MODE,
+    composite_system_calibration_id,
+    head_service_status_valid,
+    require_content_addressed_id,
+)
+from decode_dse.profiles import (
+    MX_BLOCK_SIZE,
+    PROFILE_KIND_QUANTIZED,
+    DecodePrecisionProfile,
+)
+from decode_dse.simulator_bridge import HBMOperatingPointStatus
+
+HBM_SENSITIVITY_SCHEMA = "decode-hbm-sensitivity"
+HBM_SENSITIVITY_GENERATIONS = (
+    "HBM2",
+    "HBM2E",
+    "HBM3",
+    "HBM3E",
+    "HBM4",
+)
+HBM_SENSITIVITY_SOURCE_COUNT = 4
+HBM_SENSITIVITY_BASELINE = "HBM2"
+HBM_SENSITIVITY_OUTPUT_HEAD = "external_bf16_service"
+
+
+def _canonical_bytes(value: Mapping[str, Any]) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _require_sha256(name: str, value: str) -> None:
+    if len(value) != 64 or any(
+        character not in "0123456789abcdef" for character in value
+    ):
+        raise ValueError(f"{name} must be a lowercase SHA-256 digest")
+
+
+class HBMOperatingPointResolver(Protocol):
+    def hbm_operating_point(
+        self,
+        generation: str,
+        channels: int,
+    ) -> HBMOperatingPointStatus:
+        ...
+
+
+@dataclass(frozen=True)
+class HBMSensitivitySource:
+    """One selected native-datapath profile and its fixed hardware point."""
+
+    profile: DecodePrecisionProfile
+    candidate: HardwareCandidate
+    numerical_result_hash: str
+    hardware_result_hash: str
+    head_service_artifact_sha256: str
+    head_service_calibration_id: str
+    head_service_provenance_id: str
+    system_calibration_id: str
+    timing_evidence_id: str
+    baseline_bandwidth_calibration_id: str
+    admission_correctness_evidence_id: str
+    admission_validation_hash: str
+
+    def __post_init__(self) -> None:
+        if self.profile.kind != PROFILE_KIND_QUANTIZED:
+            raise ValueError("HBM sensitivity requires quantized hardware profiles")
+        if self.profile.block_size != MX_BLOCK_SIZE:
+            raise ValueError("HBM sensitivity requires the native block size")
+        if self.candidate.hbm_generation != HBM_SENSITIVITY_BASELINE:
+            raise ValueError("HBM sensitivity sources must use the HBM2 anchor")
+        _require_sha256("numerical_result_hash", self.numerical_result_hash)
+        _require_sha256("hardware_result_hash", self.hardware_result_hash)
+        _require_sha256(
+            "head_service_artifact_sha256",
+            self.head_service_artifact_sha256,
+        )
+        require_content_addressed_id(
+            "head_service_calibration_id",
+            self.head_service_calibration_id,
+            prefix="bf16-head-service-",
+        )
+        require_content_addressed_id(
+            "head_service_provenance_id",
+            self.head_service_provenance_id,
+            prefix="bf16-head-provenance-",
+        )
+        require_content_addressed_id(
+            "system_calibration_id",
+            self.system_calibration_id,
+            prefix="decode-head-system-",
+        )
+        require_content_addressed_id(
+            "timing_evidence_id",
+            self.timing_evidence_id,
+            prefix="timing-",
+        )
+        require_content_addressed_id(
+            "baseline_bandwidth_calibration_id",
+            self.baseline_bandwidth_calibration_id,
+            prefix="bandwidth-operating-point-",
+        )
+        require_content_addressed_id(
+            "admission_correctness_evidence_id",
+            self.admission_correctness_evidence_id,
+            prefix="admission-correctness-",
+        )
+        _require_sha256(
+            "admission_validation_hash",
+            self.admission_validation_hash,
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "profile_id": self.profile.profile_id,
+            "profile": self.profile.to_dict(),
+            "candidate_id": self.candidate.candidate_id,
+            "candidate": self.candidate.to_dict(),
+            "numerical_result_hash": self.numerical_result_hash,
+            "hardware_result_hash": self.hardware_result_hash,
+            "output_head_location": HBM_SENSITIVITY_OUTPUT_HEAD,
+            "head_service_artifact_sha256": (
+                self.head_service_artifact_sha256
+            ),
+            "head_service_calibration_id": self.head_service_calibration_id,
+            "head_service_provenance_id": self.head_service_provenance_id,
+            "system_calibration_id": self.system_calibration_id,
+            "timing_evidence_id": self.timing_evidence_id,
+            "baseline_bandwidth_calibration_id": (
+                self.baseline_bandwidth_calibration_id
+            ),
+            "admission_correctness_evidence_id": (
+                self.admission_correctness_evidence_id
+            ),
+            "admission_validation_hash": self.admission_validation_hash,
+        }
+
+    @property
+    def source_id(self) -> str:
+        return "hbm-source-" + _content_hash(self.to_dict())
+
+
+@dataclass(frozen=True)
+class HBMSensitivityPoint:
+    """One fixed-design rerun at an explicit HBM operating point."""
+
+    source: HBMSensitivitySource
+    generation: str
+    operating_point: HBMOperatingPointStatus
+    schema_version: str = HBM_SENSITIVITY_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != HBM_SENSITIVITY_SCHEMA:
+            raise ValueError("unsupported HBM sensitivity schema")
+        if self.generation not in HBM_SENSITIVITY_GENERATIONS:
+            raise ValueError("unsupported HBM sensitivity generation")
+        if self.operating_point.generation != self.generation:
+            raise ValueError("HBM technology identity differs from the point")
+        if (
+            self.operating_point.interface_units
+            != self.source.candidate.hbm_channels
+        ):
+            raise ValueError("HBM sensitivity changed the interface-unit count")
+        if (
+            self.generation == HBM_SENSITIVITY_BASELINE
+            and self.operating_point.calibration_id
+            != self.source.baseline_bandwidth_calibration_id
+        ):
+            raise ValueError(
+                "HBM2 anchor differs from the selected hardware evidence"
+            )
+
+    @property
+    def candidate(self) -> HardwareCandidate:
+        return replace(
+            self.source.candidate,
+            hbm_generation=self.generation,
+        )
+
+    @property
+    def executable(self) -> bool:
+        return self.operating_point.reason not in {
+            "calibrated_traffic_class_missing",
+            "channel_count_outside_calibration",
+        }
+
+    @property
+    def cost_class(self) -> str:
+        if self.operating_point.rankable:
+            return "calibrated_anchor"
+        return "technology_peak_sensitivity"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "source_id": self.source.source_id,
+            "source_profile_id": self.source.profile.profile_id,
+            "source_candidate_id": self.source.candidate.candidate_id,
+            "candidate_id": self.candidate.candidate_id,
+            "candidate": self.candidate.to_dict(),
+            "generation": self.generation,
+            "operating_point": self.operating_point.to_dict(),
+            "analytical_executable": self.executable,
+            "emulator_calibrated": self.operating_point.rankable,
+            "cost_class": self.cost_class,
+            "cross_generation_rankable": False,
+            "deployment_candidate": False,
+        }
+
+    @property
+    def point_id(self) -> str:
+        return "hbm-sensitivity-" + _content_hash(self.to_dict())
+
+
+@dataclass(frozen=True)
+class HBMSensitivitySchedule:
+    """The exact four-profile post-selection technology experiment."""
+
+    sources: tuple[HBMSensitivitySource, ...]
+    points: tuple[HBMSensitivityPoint, ...]
+
+    def __post_init__(self) -> None:
+        if len(self.sources) != HBM_SENSITIVITY_SOURCE_COUNT:
+            raise ValueError("HBM sensitivity requires four source profiles")
+        source_ids = tuple(source.source_id for source in self.sources)
+        if len(source_ids) != len(set(source_ids)):
+            raise ValueError("HBM sensitivity source identities must be unique")
+        profile_ids = tuple(source.profile.profile_id for source in self.sources)
+        if len(profile_ids) != len(set(profile_ids)):
+            raise ValueError("HBM sensitivity profiles must be unique")
+        if tuple(sorted(profile_ids)) != profile_ids:
+            raise ValueError("HBM sensitivity sources are not canonically ordered")
+        expected = len(self.sources) * len(HBM_SENSITIVITY_GENERATIONS)
+        if len(self.points) != expected:
+            raise ValueError(f"HBM sensitivity requires {expected} points")
+        expected_pairs = tuple(
+            (source.source_id, generation)
+            for source in self.sources
+            for generation in HBM_SENSITIVITY_GENERATIONS
+        )
+        observed_pairs = tuple(
+            (point.source.source_id, point.generation)
+            for point in self.points
+        )
+        if observed_pairs != expected_pairs:
+            raise ValueError("HBM sensitivity points are not canonically ordered")
+        point_ids = tuple(point.point_id for point in self.points)
+        if len(point_ids) != len(set(point_ids)):
+            raise ValueError("HBM sensitivity point identities must be unique")
+        for field in (
+            "head_service_artifact_sha256",
+            "head_service_calibration_id",
+            "head_service_provenance_id",
+            "system_calibration_id",
+            "timing_evidence_id",
+            "baseline_bandwidth_calibration_id",
+            "admission_correctness_evidence_id",
+            "admission_validation_hash",
+        ):
+            identities = {getattr(source, field) for source in self.sources}
+            if len(identities) != 1:
+                raise ValueError(
+                    f"HBM sensitivity sources have inconsistent {field}"
+                )
+
+    def to_dict(self) -> dict[str, Any]:
+        body = {
+            "schema_version": HBM_SENSITIVITY_SCHEMA,
+            "baseline_generation": HBM_SENSITIVITY_BASELINE,
+            "generations": list(HBM_SENSITIVITY_GENERATIONS),
+            "source_profile_count": len(self.sources),
+            "point_count": len(self.points),
+            "numerical_manifest_points_added": 0,
+            "varied_fields": ["HBM_GENERATION"],
+            "preserved_fields": [
+                "PROFILE_ID",
+                "PRECISION_PROFILE",
+                "MLEN",
+                "BLEN",
+                "VLEN",
+                "HLEN",
+                "BATCH",
+                "HBM_CHANNELS",
+                "CHIP_COUNT",
+                "OUTPUT_HEAD_SERVICE",
+                "TIMING_EVIDENCE",
+                "ADMISSION_CORRECTNESS_EVIDENCE",
+            ],
+            "cross_generation_ranking": False,
+            "sources": [
+                {
+                    "ordinal": ordinal,
+                    "source_id": source.source_id,
+                    **source.to_dict(),
+                }
+                for ordinal, source in enumerate(self.sources)
+            ],
+            "points": [
+                {
+                    "ordinal": ordinal,
+                    "point_id": point.point_id,
+                    **point.to_dict(),
+                }
+                for ordinal, point in enumerate(self.points)
+            ],
+        }
+        return {**body, "schedule_hash": _content_hash(body)}
+
+    @property
+    def canonical_hash(self) -> str:
+        return str(self.to_dict()["schedule_hash"])
+
+
+def build_hbm_sensitivity_schedule(
+    selected: Sequence[HBMSensitivitySource],
+    resolver: HBMOperatingPointResolver,
+) -> HBMSensitivitySchedule:
+    """Build post-selection technology points without numerical expansion."""
+
+    sources = tuple(
+        sorted(selected, key=lambda source: source.profile.profile_id)
+    )
+    if len(sources) != HBM_SENSITIVITY_SOURCE_COUNT:
+        raise ValueError("exactly four selected hardware profiles are required")
+    points = tuple(
+        HBMSensitivityPoint(
+            source=source,
+            generation=generation,
+            operating_point=resolver.hbm_operating_point(
+                generation,
+                source.candidate.hbm_channels,
+            ),
+        )
+        for source in sources
+        for generation in HBM_SENSITIVITY_GENERATIONS
+    )
+    return HBMSensitivitySchedule(sources=sources, points=points)
+
+
+def hbm_sensitivity_sources_from_hardware_rows(
+    rows: Iterable[Mapping[str, Any]],
+) -> tuple[HBMSensitivitySource, ...]:
+    """Extract four remote-head deployment points from verified hardware rows."""
+
+    values = tuple(rows)
+    if len(values) != HBM_SENSITIVITY_SOURCE_COUNT:
+        raise ValueError("exactly four hardware result rows are required")
+    sources: list[HBMSensitivitySource] = []
+    for raw in values:
+        row = dict(raw)
+        record_hash = str(row.pop("record_hash", ""))
+        _require_sha256("hardware result hash", record_hash)
+        if _content_hash(row) != record_hash:
+            raise ValueError("hardware result checksum mismatch")
+        if row.get("deployment_valid") is not True:
+            raise ValueError("HBM sensitivity requires deployment-valid sources")
+        profile = DecodePrecisionProfile.from_dict(row["profile"])
+        if row.get("profile_id") != profile.profile_id:
+            raise ValueError("hardware row profile identity mismatch")
+        hardware = row["hardware"]
+        if not isinstance(hardware, Mapping):
+            raise TypeError("hardware candidate must be an object")
+        candidate = HardwareCandidate.from_dict(
+            hardware,
+            allow_legacy_single_chip=True,
+        )
+        candidate_ids = {candidate.candidate_id}
+        if set(hardware) == set(HardwareCandidate.LEGACY_FIELDS):
+            candidate_ids.add(
+                "hw-" + _content_hash(candidate.to_legacy_dict())
+            )
+        if row.get("candidate_id") not in candidate_ids:
+            raise ValueError("hardware row candidate identity mismatch")
+        metrics = row.get("metrics")
+        if not isinstance(metrics, Mapping):
+            raise TypeError("hardware row metrics must be an object")
+        admission = metrics.get("admission_boundary")
+        if (
+            not isinstance(admission, Mapping)
+            or not admission_correctness_status_valid(admission)
+        ):
+            raise ValueError(
+                "HBM sensitivity requires verified decode admission"
+            )
+        whole_model = metrics.get("whole_model")
+        output_head = metrics.get("output_head_boundary")
+        if not isinstance(whole_model, Mapping) or not isinstance(
+            output_head,
+            Mapping,
+        ):
+            raise ValueError("hardware row system boundary is incomplete")
+        status = output_head.get("status")
+        estimate = output_head.get("estimate")
+        decoder_stack = metrics.get("decoder_stack")
+        decoder_energy = (
+            decoder_stack.get("calibrated_energy")
+            if isinstance(decoder_stack, Mapping)
+            else None
+        )
+        whole_energy = whole_model.get("calibrated_energy")
+        if (
+            whole_model.get("rankable") is not True
+            or output_head.get("service_mode")
+            != HEAD_SERVICE_MODE
+            or not isinstance(status, Mapping)
+            or not isinstance(estimate, Mapping)
+            or not head_service_status_valid(status)
+            or status.get("service_location") != "prefill_chip"
+            or estimate.get("service_mode") != HEAD_SERVICE_MODE
+            or estimate.get("service_location") != "prefill_chip"
+            or not isinstance(decoder_energy, Mapping)
+            or not isinstance(whole_energy, Mapping)
+        ):
+            raise ValueError(
+                "HBM sensitivity requires the calibrated remote BF16 head"
+            )
+        head_calibration_id = str(status.get("calibration_id", ""))
+        head_provenance_id = str(status.get("provenance_id", ""))
+        if (
+            estimate.get("calibration_id") != head_calibration_id
+            or estimate.get("provenance_id") != head_provenance_id
+        ):
+            raise ValueError("remote-head estimate identity mismatch")
+        decoder_calibration_id = str(
+            decoder_energy.get("calibration_id", "")
+        )
+        system_calibration_id = composite_system_calibration_id(
+            decoder_calibration_id,
+            head_calibration_id,
+            head_provenance_id,
+        )
+        if (
+            whole_model.get("system_calibration_id")
+            != system_calibration_id
+            or whole_energy.get("calibration_id")
+            != system_calibration_id
+        ):
+            raise ValueError("whole-model calibration identity mismatch")
+        if metrics.get("timing_calibrated") is not True:
+            raise ValueError("HBM sensitivity requires calibrated timing")
+        timing = metrics.get("timing_decomposition")
+        if (
+            not isinstance(timing, Mapping)
+            or timing.get("composition") != "max_compute_memory"
+            or timing.get("unit") != "seconds_per_batch_step"
+        ):
+            raise ValueError("HBM sensitivity requires timing decomposition")
+        for name in (
+            "ideal_compute_seconds",
+            "realized_compute_seconds",
+            "memory_seconds",
+        ):
+            value = timing.get(name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, (int, float))
+                or not math.isfinite(float(value))
+                or float(value) <= 0
+            ):
+                raise ValueError("HBM timing decomposition is invalid")
+        if float(timing["realized_compute_seconds"]) < float(
+            timing["ideal_compute_seconds"]
+        ):
+            raise ValueError("HBM timing decomposition is inconsistent")
+        sources.append(
+            HBMSensitivitySource(
+                profile=profile,
+                candidate=candidate,
+                numerical_result_hash=str(row["numerical_result_hash"]),
+                hardware_result_hash=record_hash,
+                head_service_artifact_sha256=str(
+                    status.get("artifact_sha256", "")
+                ),
+                head_service_calibration_id=head_calibration_id,
+                head_service_provenance_id=head_provenance_id,
+                system_calibration_id=system_calibration_id,
+                timing_evidence_id=str(metrics["timing_evidence_id"]),
+                baseline_bandwidth_calibration_id=str(
+                    metrics["bandwidth_calibration_id"]
+                ),
+                admission_correctness_evidence_id=str(
+                    admission["evidence_id"]
+                ),
+                admission_validation_hash=str(
+                    admission["numerical_validation_hash"]
+                ),
+            )
+        )
+    return tuple(
+        sorted(sources, key=lambda source: source.profile.profile_id)
+    )
+
+
+def write_hbm_sensitivity_schedule(
+    path: str | Path,
+    schedule: HBMSensitivitySchedule,
+) -> Path:
+    """Write one immutable content-addressed schedule."""
+
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    return write_immutable_json(path, schedule.to_dict())
+
+
+__all__ = [
+    "HBMOperatingPointResolver",
+    "HBMSensitivityPoint",
+    "HBMSensitivitySchedule",
+    "HBMSensitivitySource",
+    "HBM_SENSITIVITY_BASELINE",
+    "HBM_SENSITIVITY_GENERATIONS",
+    "HBM_SENSITIVITY_OUTPUT_HEAD",
+    "HBM_SENSITIVITY_SCHEMA",
+    "HBM_SENSITIVITY_SOURCE_COUNT",
+    "build_hbm_sensitivity_schedule",
+    "hbm_sensitivity_sources_from_hardware_rows",
+    "write_hbm_sensitivity_schedule",
+]
diff --git a/decode_dse/hardware/lm_head_service.py b/decode_dse/hardware/lm_head_service.py
new file mode 100644
index 0000000..f56b9f0
--- /dev/null
+++ b/decode_dse/hardware/lm_head_service.py
@@ -0,0 +1,1472 @@
+"""Validated BF16 output-head service boundary for cached decode."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import re
+from dataclasses import dataclass, replace
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from decode_dse.hardware.statistics import (
+    percentile,
+    spearman_rank_correlation,
+)
+
+HEAD_SERVICE_SCHEMA = "bf16-output-head-service"
+HEAD_SERVICE_MODE = "remote_bf16_head_dedicated"
+HEAD_LOGIT_MAX_ABS_ERROR = 0.25
+HEAD_LOGIT_MEAN_ABS_ERROR = 0.02
+HEAD_TOPK_MIN_AGREEMENT = 0.90
+HEAD_VALIDATION_TOPK = 10
+_SHA256 = re.compile(r"^[0-9a-f]{64}$")
+_CONTENT_ADDRESSED_ID = re.compile(
+    r"^[a-z][a-z0-9]*(?:-[a-z0-9]+)*-[0-9a-f]{64}$"
+)
+_MODEL_FIELDS = {
+    "model_name",
+    "model_revision",
+    "hidden_size",
+    "vocab_size",
+    "tie_embeddings",
+}
+_PROTOCOL_FIELDS = {
+    "hidden_dtype",
+    "hidden_element_bytes",
+    "token_id_dtype",
+    "token_id_bytes",
+    "request_fixed_bytes",
+    "request_metadata_bytes_per_sequence",
+    "response_fixed_bytes",
+    "response_metadata_bytes_per_sequence",
+    "request_bandwidth_bytes_s",
+    "response_bandwidth_bytes_s",
+    "request_fixed_latency_s",
+    "response_fixed_latency_s",
+    "link_energy_j_per_byte",
+    "duplex_schedule",
+}
+_SERVICE_FIELDS = {
+    "service_mode",
+    "service_location",
+    "service_instances",
+    "weight_dtype",
+    "weight_alignment_bytes",
+    "head_weight_bytes",
+    "head_weight_sha256",
+    "head_weight_layout",
+    "head_weight_capacity_bytes",
+    "mac_input_dtype",
+    "accumulator_dtype",
+    "logit_dtype",
+    "logits_boundary",
+    "selection_policy",
+    "validation_topk",
+    "bf16_mac_per_s",
+    "bf16_mac_energy_j",
+    "memory_bandwidth_bytes_s",
+    "memory_energy_j_per_byte",
+    "selection_latency_s_per_element",
+    "selection_energy_j_per_element",
+    "fixed_latency_s",
+    "fixed_dynamic_energy_j",
+    "leakage_power_w",
+}
+_MEASUREMENT_FIELDS = {
+    "measurement_id",
+    "split",
+    "batch",
+    "repeat",
+    "hidden_bf16_sha256",
+    "reference_logits_bf16_sha256",
+    "service_logits_bf16_sha256",
+    "reference_token_ids_sha256",
+    "service_token_ids_sha256",
+    "reference_logits_finite",
+    "service_logits_finite",
+    "logit_max_abs_error",
+    "logit_mean_abs_error",
+    "topk_set_agreement",
+    "selected_tokens_equal",
+    "request_bytes",
+    "response_bytes",
+    "head_weight_bytes",
+    "head_memory_bytes",
+    "bf16_macs",
+    "selection_elements",
+    "request_latency_s",
+    "head_latency_s",
+    "queue_delay_s",
+    "response_latency_s",
+    "link_dynamic_energy_j",
+    "mac_dynamic_energy_j",
+    "memory_dynamic_energy_j",
+    "selection_dynamic_energy_j",
+    "fixed_dynamic_energy_j",
+    "dynamic_energy_j",
+    "leakage_power_w",
+}
+_PROVENANCE_FIELDS = {
+    "repository",
+    "revision",
+    "source_tree_sha256",
+    "command",
+    "toolchain",
+    "environment_sha256",
+    "link_id",
+    "head_service_id",
+    "process_corner",
+    "measured_at_utc",
+    "measurement_resolution",
+}
+
+
+def _canonical_bytes(value: Any) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _content_hash(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def require_content_addressed_id(
+    name: str,
+    value: Any,
+    *,
+    prefix: str | None = None,
+) -> str:
+    """Return a named SHA-256 identity or reject an unbound label."""
+
+    if not isinstance(value, str) or not _CONTENT_ADDRESSED_ID.fullmatch(value):
+        raise ValueError(f"{name} must be a content-addressed identity")
+    if prefix is not None and not value.startswith(prefix):
+        raise ValueError(f"{name} must use the {prefix} identity family")
+    return value
+
+
+def _reject_duplicate_pairs(pairs: Sequence[tuple[str, Any]]) -> dict[str, Any]:
+    value: dict[str, Any] = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError(f"duplicate JSON field {key!r}")
+        value[key] = item
+    return value
+
+
+def composite_system_calibration_id(
+    decoder_calibration_id: str,
+    head_calibration_id: str,
+    head_provenance_id: str,
+    *,
+    service_mode: str = HEAD_SERVICE_MODE,
+) -> str:
+    """Bind decoder and remote-head calibrations into one system identity."""
+
+    decoder_calibration_id = require_content_addressed_id(
+        "decoder calibration",
+        decoder_calibration_id,
+    )
+    head_calibration_id = require_content_addressed_id(
+        "head calibration",
+        head_calibration_id,
+        prefix="bf16-head-service-",
+    )
+    head_provenance_id = require_content_addressed_id(
+        "head provenance",
+        head_provenance_id,
+        prefix="bf16-head-provenance-",
+    )
+    if service_mode != HEAD_SERVICE_MODE:
+        raise ValueError("system calibration requires the remote head service")
+    return "decode-head-system-" + _content_hash(
+        {
+            "decoder_calibration_id": decoder_calibration_id,
+            "head_calibration_id": head_calibration_id,
+            "head_provenance_id": head_provenance_id,
+            "service_mode": service_mode,
+        }
+    )
+
+
+def _positive_float(value: Any, name: str) -> float:
+    if isinstance(value, bool):
+        raise TypeError(f"{name} must be numeric")
+    result = float(value)
+    if not math.isfinite(result) or result <= 0:
+        raise ValueError(f"{name} must be finite and positive")
+    return result
+
+
+def _nonnegative_float(value: Any, name: str) -> float:
+    if isinstance(value, bool):
+        raise TypeError(f"{name} must be numeric")
+    result = float(value)
+    if not math.isfinite(result) or result < 0:
+        raise ValueError(f"{name} must be finite and non-negative")
+    return result
+
+
+def _positive_int(value: Any, name: str) -> int:
+    if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+        raise TypeError(f"{name} must be a positive integer")
+    return value
+
+
+def _nonnegative_int(value: Any, name: str) -> int:
+    if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+        raise TypeError(f"{name} must be a non-negative integer")
+    return value
+
+
+def _align(value: int, alignment: int) -> int:
+    return ((value + alignment - 1) // alignment) * alignment
+
+
+def _relative_error(measured: float, predicted: float) -> float:
+    if measured <= 0:
+        raise ValueError("measured values must be positive")
+    return abs(predicted - measured) / measured
+
+
+def _coefficient_of_variation(values: Sequence[float]) -> float:
+    if len(values) < 2:
+        raise ValueError("repeat variation requires two or more values")
+    mean = sum(values) / len(values)
+    if mean <= 0:
+        raise ValueError("repeat measurements must be positive")
+    variance = sum((value - mean) ** 2 for value in values) / len(values)
+    return math.sqrt(variance) / mean
+
+
+@dataclass(frozen=True)
+class HeadServiceMeasurement:
+    """One dimensional and measured head-service observation."""
+
+    measurement_id: str
+    split: str
+    batch: int
+    repeat: int
+    hidden_bf16_sha256: str
+    reference_logits_bf16_sha256: str
+    service_logits_bf16_sha256: str
+    reference_token_ids_sha256: str
+    service_token_ids_sha256: str
+    reference_logits_finite: bool
+    service_logits_finite: bool
+    logit_max_abs_error: float
+    logit_mean_abs_error: float
+    topk_set_agreement: float
+    selected_tokens_equal: bool
+    request_bytes: int
+    response_bytes: int
+    head_weight_bytes: int
+    head_memory_bytes: int
+    bf16_macs: int
+    selection_elements: int
+    request_latency_s: float
+    head_latency_s: float
+    queue_delay_s: float
+    response_latency_s: float
+    link_dynamic_energy_j: float
+    mac_dynamic_energy_j: float
+    memory_dynamic_energy_j: float
+    selection_dynamic_energy_j: float
+    fixed_dynamic_energy_j: float
+    dynamic_energy_j: float
+    leakage_power_w: float
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "HeadServiceMeasurement":
+        if set(value) != _MEASUREMENT_FIELDS:
+            raise ValueError("head-service measurement fields differ")
+        measurement_id = str(value["measurement_id"])
+        if not measurement_id:
+            raise ValueError("measurement_id must be non-empty")
+        split = str(value["split"])
+        if split not in {"repeat", "holdout"}:
+            raise ValueError("measurement split must be repeat or holdout")
+        hashes = {}
+        for name in (
+            "hidden_bf16_sha256",
+            "reference_logits_bf16_sha256",
+            "service_logits_bf16_sha256",
+            "reference_token_ids_sha256",
+            "service_token_ids_sha256",
+        ):
+            item = str(value[name])
+            if not _SHA256.fullmatch(item):
+                raise ValueError(f"measurement {name} is invalid")
+            hashes[name] = item
+        for name in (
+            "reference_logits_finite",
+            "service_logits_finite",
+            "selected_tokens_equal",
+        ):
+            if not isinstance(value[name], bool):
+                raise TypeError(f"measurement {name} must be boolean")
+        logit_max_abs_error = _nonnegative_float(
+            value["logit_max_abs_error"],
+            "measurement.logit_max_abs_error",
+        )
+        logit_mean_abs_error = _nonnegative_float(
+            value["logit_mean_abs_error"],
+            "measurement.logit_mean_abs_error",
+        )
+        if logit_mean_abs_error > logit_max_abs_error:
+            raise ValueError("mean logit error cannot exceed maximum error")
+        topk_set_agreement = _nonnegative_float(
+            value["topk_set_agreement"],
+            "measurement.topk_set_agreement",
+        )
+        if topk_set_agreement > 1:
+            raise ValueError("top-k agreement cannot exceed one")
+        return cls(
+            measurement_id=measurement_id,
+            split=split,
+            batch=_positive_int(value["batch"], "measurement.batch"),
+            repeat=_nonnegative_int(value["repeat"], "measurement.repeat"),
+            hidden_bf16_sha256=hashes["hidden_bf16_sha256"],
+            reference_logits_bf16_sha256=hashes[
+                "reference_logits_bf16_sha256"
+            ],
+            service_logits_bf16_sha256=hashes[
+                "service_logits_bf16_sha256"
+            ],
+            reference_token_ids_sha256=hashes[
+                "reference_token_ids_sha256"
+            ],
+            service_token_ids_sha256=hashes[
+                "service_token_ids_sha256"
+            ],
+            reference_logits_finite=value["reference_logits_finite"],
+            service_logits_finite=value["service_logits_finite"],
+            logit_max_abs_error=logit_max_abs_error,
+            logit_mean_abs_error=logit_mean_abs_error,
+            topk_set_agreement=topk_set_agreement,
+            selected_tokens_equal=value["selected_tokens_equal"],
+            request_bytes=_positive_int(
+                value["request_bytes"],
+                "measurement.request_bytes",
+            ),
+            response_bytes=_positive_int(
+                value["response_bytes"],
+                "measurement.response_bytes",
+            ),
+            head_weight_bytes=_positive_int(
+                value["head_weight_bytes"],
+                "measurement.head_weight_bytes",
+            ),
+            head_memory_bytes=_positive_int(
+                value["head_memory_bytes"],
+                "measurement.head_memory_bytes",
+            ),
+            bf16_macs=_positive_int(
+                value["bf16_macs"],
+                "measurement.bf16_macs",
+            ),
+            selection_elements=_positive_int(
+                value["selection_elements"],
+                "measurement.selection_elements",
+            ),
+            request_latency_s=_positive_float(
+                value["request_latency_s"],
+                "measurement.request_latency_s",
+            ),
+            head_latency_s=_positive_float(
+                value["head_latency_s"],
+                "measurement.head_latency_s",
+            ),
+            queue_delay_s=_nonnegative_float(
+                value["queue_delay_s"],
+                "measurement.queue_delay_s",
+            ),
+            response_latency_s=_positive_float(
+                value["response_latency_s"],
+                "measurement.response_latency_s",
+            ),
+            link_dynamic_energy_j=_positive_float(
+                value["link_dynamic_energy_j"],
+                "measurement.link_dynamic_energy_j",
+            ),
+            mac_dynamic_energy_j=_positive_float(
+                value["mac_dynamic_energy_j"],
+                "measurement.mac_dynamic_energy_j",
+            ),
+            memory_dynamic_energy_j=_positive_float(
+                value["memory_dynamic_energy_j"],
+                "measurement.memory_dynamic_energy_j",
+            ),
+            selection_dynamic_energy_j=_positive_float(
+                value["selection_dynamic_energy_j"],
+                "measurement.selection_dynamic_energy_j",
+            ),
+            fixed_dynamic_energy_j=_positive_float(
+                value["fixed_dynamic_energy_j"],
+                "measurement.fixed_dynamic_energy_j",
+            ),
+            dynamic_energy_j=_positive_float(
+                value["dynamic_energy_j"],
+                "measurement.dynamic_energy_j",
+            ),
+            leakage_power_w=_positive_float(
+                value["leakage_power_w"],
+                "measurement.leakage_power_w",
+            ),
+        )
+
+    @property
+    def total_latency_s(self) -> float:
+        return (
+            self.request_latency_s
+            + self.head_latency_s
+            + self.queue_delay_s
+            + self.response_latency_s
+        )
+
+    @property
+    def component_dynamic_energy_j(self) -> float:
+        return (
+            self.link_dynamic_energy_j
+            + self.mac_dynamic_energy_j
+            + self.memory_dynamic_energy_j
+            + self.selection_dynamic_energy_j
+            + self.fixed_dynamic_energy_j
+        )
+
+
+@dataclass(frozen=True)
+class BF16HeadServiceEstimate:
+    """Calibrated remote-head cost for one batch decode step."""
+
+    calibration_id: str
+    service_mode: str
+    service_location: str
+    provenance_id: str
+    batch: int
+    hidden_size: int
+    vocab_size: int
+    request_bytes: int
+    response_bytes: int
+    head_weight_bytes: int
+    head_weight_capacity_bytes: int
+    head_memory_bytes: int
+    bf16_macs: int
+    selection_elements: int
+    request_latency_s: float
+    head_latency_s: float
+    queue_delay_s: float
+    response_latency_s: float
+    link_dynamic_energy_j: float
+    mac_dynamic_energy_j: float
+    memory_dynamic_energy_j: float
+    selection_dynamic_energy_j: float
+    fixed_dynamic_energy_j: float
+    leakage_power_w: float
+
+    def __post_init__(self) -> None:
+        require_content_addressed_id(
+            "calibration_id",
+            self.calibration_id,
+            prefix="bf16-head-service-",
+        )
+        require_content_addressed_id(
+            "provenance_id",
+            self.provenance_id,
+            prefix="bf16-head-provenance-",
+        )
+        for name in ("service_mode", "service_location"):
+            if not isinstance(getattr(self, name), str) or not getattr(
+                self,
+                name,
+            ):
+                raise ValueError(f"{name} must be non-empty")
+        if self.service_mode != HEAD_SERVICE_MODE:
+            raise ValueError("head-service estimate mode is unsupported")
+        if self.service_location != "prefill_chip":
+            raise ValueError("head-service estimate location is unsupported")
+        for name in (
+            "batch",
+            "hidden_size",
+            "vocab_size",
+            "request_bytes",
+            "response_bytes",
+            "head_weight_bytes",
+            "head_weight_capacity_bytes",
+            "head_memory_bytes",
+            "bf16_macs",
+            "selection_elements",
+        ):
+            _positive_int(getattr(self, name), name)
+        if not self.head_capacity_feasible:
+            raise ValueError("head-service estimate exceeds weight capacity")
+        for name in (
+            "request_latency_s",
+            "head_latency_s",
+            "response_latency_s",
+            "leakage_power_w",
+        ):
+            _positive_float(getattr(self, name), name)
+        if _nonnegative_float(
+            self.queue_delay_s,
+            "queue_delay_s",
+        ) != 0:
+            raise ValueError("dedicated head service cannot queue")
+        for name in (
+            "link_dynamic_energy_j",
+            "mac_dynamic_energy_j",
+            "memory_dynamic_energy_j",
+            "selection_dynamic_energy_j",
+            "fixed_dynamic_energy_j",
+        ):
+            _nonnegative_float(getattr(self, name), name)
+        if self.dynamic_energy_j <= 0:
+            raise ValueError("head-service dynamic energy must be positive")
+
+    @property
+    def total_latency_s(self) -> float:
+        return (
+            self.request_latency_s
+            + self.head_latency_s
+            + self.queue_delay_s
+            + self.response_latency_s
+        )
+
+    @property
+    def dynamic_energy_j(self) -> float:
+        return (
+            self.link_dynamic_energy_j
+            + self.mac_dynamic_energy_j
+            + self.memory_dynamic_energy_j
+            + self.selection_dynamic_energy_j
+            + self.fixed_dynamic_energy_j
+        )
+
+    @property
+    def head_capacity_feasible(self) -> bool:
+        return self.head_weight_bytes <= self.head_weight_capacity_bytes
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "calibration_id": self.calibration_id,
+            "service_mode": self.service_mode,
+            "service_location": self.service_location,
+            "provenance_id": self.provenance_id,
+            "batch": self.batch,
+            "hidden_size": self.hidden_size,
+            "vocab_size": self.vocab_size,
+            "request": {
+                "unit": "bytes_per_batch_step",
+                "bytes": self.request_bytes,
+                "latency_s": self.request_latency_s,
+            },
+            "response": {
+                "unit": "bytes_per_batch_step",
+                "bytes": self.response_bytes,
+                "latency_s": self.response_latency_s,
+            },
+            "head_weight": {
+                "unit": "bytes",
+                "required_bytes": self.head_weight_bytes,
+                "capacity_bytes": self.head_weight_capacity_bytes,
+                "feasible": self.head_capacity_feasible,
+            },
+            "head_memory_bytes_per_batch_step": self.head_memory_bytes,
+            "bf16_macs_per_batch_step": self.bf16_macs,
+            "selection_elements_per_batch_step": self.selection_elements,
+            "head_latency_s": self.head_latency_s,
+            "queue_delay_s": self.queue_delay_s,
+            "total_latency_s": self.total_latency_s,
+            "dynamic_energy_j_per_batch_step": {
+                "link": self.link_dynamic_energy_j,
+                "bf16_mac": self.mac_dynamic_energy_j,
+                "head_memory": self.memory_dynamic_energy_j,
+                "selection": self.selection_dynamic_energy_j,
+                "fixed": self.fixed_dynamic_energy_j,
+                "total": self.dynamic_energy_j,
+            },
+            "leakage_power_w": self.leakage_power_w,
+        }
+
+
+@dataclass(frozen=True)
+class BF16HeadServiceCalibration:
+    """Validated coefficients and identities for one dedicated head service."""
+
+    artifact_sha256: str
+    content_hash: str
+    model_name: str
+    model_revision: str
+    hidden_size: int
+    vocab_size: int
+    tie_embeddings: bool
+    required_batches: tuple[int, ...]
+    protocol: Mapping[str, Any]
+    service: Mapping[str, Any]
+    provenance: Mapping[str, Any]
+    validation: Mapping[str, float | int]
+
+    @property
+    def calibration_id(self) -> str:
+        return "bf16-head-service-" + _content_hash(
+            {
+                "artifact_sha256": self.artifact_sha256,
+                "content_hash": self.content_hash,
+                "model_revision": self.model_revision,
+                "required_batches": self.required_batches,
+            }
+        )
+
+    @property
+    def provenance_id(self) -> str:
+        return "bf16-head-provenance-" + _content_hash(self.provenance)
+
+    def _request_bytes(self, batch: int) -> int:
+        return int(self.protocol["request_fixed_bytes"]) + batch * (
+            self.hidden_size * int(self.protocol["hidden_element_bytes"])
+            + int(self.protocol["request_metadata_bytes_per_sequence"])
+        )
+
+    def _response_bytes(self, batch: int) -> int:
+        return int(self.protocol["response_fixed_bytes"]) + batch * (
+            int(self.protocol["token_id_bytes"])
+            + int(self.protocol["response_metadata_bytes_per_sequence"])
+        )
+
+    def _dimensions(self, batch: int) -> tuple[int, int, int]:
+        weight = int(self.service["head_weight_bytes"])
+        memory = weight + batch * self.hidden_size * 2
+        macs = batch * self.hidden_size * self.vocab_size
+        selection = batch * self.vocab_size
+        return memory, macs, selection
+
+    def estimate(self, batch: int) -> BF16HeadServiceEstimate:
+        if batch not in self.required_batches:
+            raise ValueError(
+                f"batch {batch} is outside calibrated head-service scope"
+            )
+        request_bytes = self._request_bytes(batch)
+        response_bytes = self._response_bytes(batch)
+        memory_bytes, macs, selection = self._dimensions(batch)
+        request_latency = (
+            float(self.protocol["request_fixed_latency_s"])
+            + request_bytes
+            / float(self.protocol["request_bandwidth_bytes_s"])
+        )
+        response_latency = (
+            float(self.protocol["response_fixed_latency_s"])
+            + response_bytes
+            / float(self.protocol["response_bandwidth_bytes_s"])
+        )
+        compute_latency = macs / float(self.service["bf16_mac_per_s"])
+        memory_latency = (
+            memory_bytes / float(self.service["memory_bandwidth_bytes_s"])
+        )
+        head_latency = (
+            float(self.service["fixed_latency_s"])
+            + max(compute_latency, memory_latency)
+            + selection
+            * float(self.service["selection_latency_s_per_element"])
+        )
+        link_energy = (
+            request_bytes + response_bytes
+        ) * float(self.protocol["link_energy_j_per_byte"])
+        return BF16HeadServiceEstimate(
+            calibration_id=self.calibration_id,
+            service_mode=HEAD_SERVICE_MODE,
+            service_location="prefill_chip",
+            provenance_id=self.provenance_id,
+            batch=batch,
+            hidden_size=self.hidden_size,
+            vocab_size=self.vocab_size,
+            request_bytes=request_bytes,
+            response_bytes=response_bytes,
+            head_weight_bytes=int(self.service["head_weight_bytes"]),
+            head_weight_capacity_bytes=int(
+                self.service["head_weight_capacity_bytes"]
+            ),
+            head_memory_bytes=memory_bytes,
+            bf16_macs=macs,
+            selection_elements=selection,
+            request_latency_s=request_latency,
+            head_latency_s=head_latency,
+            queue_delay_s=0.0,
+            response_latency_s=response_latency,
+            link_dynamic_energy_j=link_energy,
+            mac_dynamic_energy_j=(
+                macs * float(self.service["bf16_mac_energy_j"])
+            ),
+            memory_dynamic_energy_j=(
+                memory_bytes
+                * float(self.service["memory_energy_j_per_byte"])
+            ),
+            selection_dynamic_energy_j=(
+                selection
+                * float(self.service["selection_energy_j_per_element"])
+            ),
+            fixed_dynamic_energy_j=float(
+                self.service["fixed_dynamic_energy_j"]
+            ),
+            leakage_power_w=float(self.service["leakage_power_w"]),
+        )
+
+
+@dataclass(frozen=True)
+class BF16HeadServiceStatus:
+    """Fail-closed result of validating one service artifact."""
+
+    source_path: Path
+    artifact_sha256: str
+    failures: tuple[str, ...]
+    calibration: BF16HeadServiceCalibration | None
+
+    @property
+    def passed(self) -> bool:
+        return not self.failures and self.calibration is not None
+
+    @property
+    def calibration_id(self) -> str | None:
+        return (
+            self.calibration.calibration_id
+            if self.calibration is not None
+            else None
+        )
+
+    @property
+    def provenance_id(self) -> str | None:
+        return (
+            self.calibration.provenance_id
+            if self.calibration is not None
+            else None
+        )
+
+    @property
+    def service_mode(self) -> str:
+        return HEAD_SERVICE_MODE if self.passed else "unmodeled"
+
+    def to_dict(self) -> dict[str, Any]:
+        calibration = self.calibration
+        return {
+            "schema_version": HEAD_SERVICE_SCHEMA,
+            "artifact_sha256": self.artifact_sha256,
+            "passed": self.passed,
+            "failures": list(self.failures),
+            "calibration_id": self.calibration_id,
+            "provenance_id": self.provenance_id,
+            "service_mode": (
+                HEAD_SERVICE_MODE if self.passed else "unmodeled"
+            ),
+            "service_location": (
+                "prefill_chip" if self.passed else None
+            ),
+            "required_batches": (
+                list(calibration.required_batches)
+                if calibration is not None
+                else []
+            ),
+            "head_weight_sha256": (
+                str(calibration.service["head_weight_sha256"])
+                if calibration is not None
+                else None
+            ),
+            "numerical_policy": (
+                {
+                    "mac_input_dtype": calibration.service[
+                        "mac_input_dtype"
+                    ],
+                    "accumulator_dtype": calibration.service[
+                        "accumulator_dtype"
+                    ],
+                    "logit_dtype": calibration.service["logit_dtype"],
+                    "selection_policy": calibration.service[
+                        "selection_policy"
+                    ],
+                    "validation_topk": calibration.service[
+                        "validation_topk"
+                    ],
+                    "logit_max_abs_error_limit": (
+                        HEAD_LOGIT_MAX_ABS_ERROR
+                    ),
+                    "logit_mean_abs_error_limit": (
+                        HEAD_LOGIT_MEAN_ABS_ERROR
+                    ),
+                    "topk_set_agreement_min": (
+                        HEAD_TOPK_MIN_AGREEMENT
+                    ),
+                }
+                if calibration is not None
+                else None
+            ),
+            "numerical_validation": (
+                dict(calibration.validation)
+                if calibration is not None
+                else None
+            ),
+        }
+
+
+def head_service_status_valid(value: Mapping[str, Any]) -> bool:
+    """Return whether a serialized status carries passing v2 evidence."""
+
+    try:
+        if (
+            value.get("schema_version") != HEAD_SERVICE_SCHEMA
+            or value.get("passed") is not True
+            or value.get("failures") != []
+            or value.get("service_mode") != HEAD_SERVICE_MODE
+            or value.get("service_location") != "prefill_chip"
+            or not _SHA256.fullmatch(str(value.get("artifact_sha256", "")))
+            or not _SHA256.fullmatch(
+                str(value.get("head_weight_sha256", ""))
+            )
+        ):
+            return False
+        require_content_addressed_id(
+            "head calibration",
+            value.get("calibration_id"),
+            prefix="bf16-head-service-",
+        )
+        require_content_addressed_id(
+            "head provenance",
+            value.get("provenance_id"),
+            prefix="bf16-head-provenance-",
+        )
+        batches = value.get("required_batches")
+        if (
+            not isinstance(batches, list)
+            or len(batches) < 3
+            or any(
+                isinstance(batch, bool)
+                or not isinstance(batch, int)
+                or batch <= 0
+                for batch in batches
+            )
+            or batches != sorted(set(batches))
+        ):
+            return False
+        policy = value.get("numerical_policy")
+        expected_policy = {
+            "mac_input_dtype": "BF16",
+            "accumulator_dtype": "FP32",
+            "logit_dtype": "BF16",
+            "selection_policy": "argmax_lowest_token_id_on_tie",
+            "validation_topk": HEAD_VALIDATION_TOPK,
+            "logit_max_abs_error_limit": HEAD_LOGIT_MAX_ABS_ERROR,
+            "logit_mean_abs_error_limit": HEAD_LOGIT_MEAN_ABS_ERROR,
+            "topk_set_agreement_min": HEAD_TOPK_MIN_AGREEMENT,
+        }
+        if policy != expected_policy:
+            return False
+        validation = value.get("numerical_validation")
+        if not isinstance(validation, Mapping):
+            return False
+        measurement_count = _positive_int(
+            validation.get("measurement_count"),
+            "measurement_count",
+        )
+        sample_count = _positive_int(
+            validation.get("numerical_sample_count"),
+            "numerical_sample_count",
+        )
+        holdout_count = _positive_int(
+            validation.get("holdout_count"),
+            "holdout_count",
+        )
+        exact_match_count = _positive_int(
+            validation.get("selected_token_exact_match_count"),
+            "selected_token_exact_match_count",
+        )
+        if (
+            measurement_count != sample_count
+            or exact_match_count != sample_count
+            or measurement_count < 4 * len(batches)
+            or holdout_count < len(batches)
+        ):
+            return False
+        max_error = _nonnegative_float(
+            validation.get("sampled_logit_max_abs_error"),
+            "sampled_logit_max_abs_error",
+        )
+        mean_error = _nonnegative_float(
+            validation.get("sampled_logit_mean_abs_error_max"),
+            "sampled_logit_mean_abs_error_max",
+        )
+        topk_agreement = _nonnegative_float(
+            validation.get("sampled_topk_set_agreement_min"),
+            "sampled_topk_set_agreement_min",
+        )
+        if (
+            max_error > HEAD_LOGIT_MAX_ABS_ERROR
+            or mean_error > HEAD_LOGIT_MEAN_ABS_ERROR
+            or mean_error > max_error
+            or topk_agreement < HEAD_TOPK_MIN_AGREEMENT
+            or topk_agreement > 1
+        ):
+            return False
+        return True
+    except (KeyError, TypeError, ValueError):
+        return False
+
+
+def _parse_calibration(
+    raw: Mapping[str, Any],
+    *,
+    artifact_sha256: str,
+    model_name: str,
+    model_revision: str,
+    hidden_size: int,
+    vocab_size: int,
+    tie_embeddings: bool,
+    required_batches: tuple[int, ...],
+) -> BF16HeadServiceCalibration:
+    body = dict(raw)
+    content_hash = str(body.pop("content_hash", ""))
+    if content_hash != _content_hash(body):
+        raise ValueError("head-service content hash mismatch")
+    if set(body) != {
+        "schema_version",
+        "model",
+        "protocol",
+        "service",
+        "required_batch_scope",
+        "measurements",
+        "provenance",
+    }:
+        raise ValueError("head-service artifact fields differ")
+    if body["schema_version"] != HEAD_SERVICE_SCHEMA:
+        raise ValueError("unsupported head-service schema")
+
+    model = body["model"]
+    if not isinstance(model, Mapping) or set(model) != _MODEL_FIELDS:
+        raise ValueError("head-service model identity fields differ")
+    expected_model = {
+        "model_name": model_name,
+        "model_revision": model_revision,
+        "hidden_size": hidden_size,
+        "vocab_size": vocab_size,
+        "tie_embeddings": tie_embeddings,
+    }
+    if dict(model) != expected_model:
+        raise ValueError("head-service model identity mismatch")
+
+    protocol = body["protocol"]
+    if not isinstance(protocol, Mapping) or set(protocol) != _PROTOCOL_FIELDS:
+        raise ValueError("head-service protocol fields differ")
+    if protocol["hidden_dtype"] != "BF16":
+        raise ValueError("head-service hidden payload must be BF16")
+    if protocol["token_id_dtype"] != "UINT32":
+        raise ValueError("head-service response must use UINT32 token IDs")
+    if protocol["duplex_schedule"] != "serialized_request_service_response":
+        raise ValueError("head-service duplex schedule is unsupported")
+    if _positive_int(
+        protocol["hidden_element_bytes"],
+        "hidden_element_bytes",
+    ) != 2:
+        raise ValueError("BF16 hidden elements must occupy two bytes")
+    if _positive_int(protocol["token_id_bytes"], "token_id_bytes") != 4:
+        raise ValueError("UINT32 token IDs must occupy four bytes")
+    for name in (
+        "request_fixed_bytes",
+        "request_metadata_bytes_per_sequence",
+        "response_fixed_bytes",
+        "response_metadata_bytes_per_sequence",
+    ):
+        _nonnegative_int(protocol[name], name)
+    for name in (
+        "request_bandwidth_bytes_s",
+        "response_bandwidth_bytes_s",
+        "link_energy_j_per_byte",
+    ):
+        _positive_float(protocol[name], name)
+    for name in ("request_fixed_latency_s", "response_fixed_latency_s"):
+        _nonnegative_float(protocol[name], name)
+
+    service = body["service"]
+    if not isinstance(service, Mapping) or set(service) != _SERVICE_FIELDS:
+        raise ValueError("head-service coefficient fields differ")
+    if service["service_mode"] != HEAD_SERVICE_MODE:
+        raise ValueError("head-service mode must be dedicated and queue-free")
+    if service["service_location"] != "prefill_chip":
+        raise ValueError("output-head service must run on the prefill chip")
+    if _positive_int(service["service_instances"], "service_instances") != 1:
+        raise ValueError("one dedicated service instance is required")
+    if service["weight_dtype"] != "BF16":
+        raise ValueError("output-head weights must be BF16")
+    if not _SHA256.fullmatch(str(service["head_weight_sha256"])):
+        raise ValueError("output-head weight checksum is invalid")
+    if service["head_weight_layout"] != "vocab_by_hidden_row_major_bf16_le":
+        raise ValueError("output-head weight layout is unsupported")
+    if service["mac_input_dtype"] != "BF16":
+        raise ValueError("output-head MAC inputs must be BF16")
+    if service["accumulator_dtype"] != "FP32":
+        raise ValueError("output-head accumulation must be FP32")
+    if service["logit_dtype"] != "BF16":
+        raise ValueError("output-head validation logits must be BF16")
+    if service["logits_boundary"] != "fused_selection_token_ids":
+        raise ValueError("output-head service must return token IDs only")
+    if service["selection_policy"] != "argmax_lowest_token_id_on_tie":
+        raise ValueError("output-head selection policy is unsupported")
+    if (
+        _positive_int(service["validation_topk"], "validation_topk")
+        != HEAD_VALIDATION_TOPK
+    ):
+        raise ValueError("output-head validation top-k differs")
+    alignment = _positive_int(
+        service["weight_alignment_bytes"],
+        "weight_alignment_bytes",
+    )
+    expected_weight = _align(hidden_size * vocab_size * 2, alignment)
+    if _positive_int(
+        service["head_weight_bytes"],
+        "head_weight_bytes",
+    ) != expected_weight:
+        raise ValueError("head-service BF16 weight size is inconsistent")
+    if _positive_int(
+        service["head_weight_capacity_bytes"],
+        "head_weight_capacity_bytes",
+    ) < expected_weight:
+        raise ValueError("head-service weight capacity is insufficient")
+    for name in (
+        "bf16_mac_per_s",
+        "bf16_mac_energy_j",
+        "memory_bandwidth_bytes_s",
+        "memory_energy_j_per_byte",
+        "selection_latency_s_per_element",
+        "selection_energy_j_per_element",
+        "fixed_dynamic_energy_j",
+        "leakage_power_w",
+    ):
+        _positive_float(service[name], name)
+    _nonnegative_float(service["fixed_latency_s"], "fixed_latency_s")
+
+    batch_scope = body["required_batch_scope"]
+    if (
+        not isinstance(batch_scope, list)
+        or any(
+            isinstance(value, bool) or not isinstance(value, int)
+            for value in batch_scope
+        )
+        or tuple(batch_scope) != required_batches
+    ):
+        raise ValueError("head-service batch scope mismatch")
+    if len(required_batches) < 3:
+        raise ValueError(
+            "head-service calibration requires at least three batch points"
+        )
+
+    provenance = body["provenance"]
+    if (
+        not isinstance(provenance, Mapping)
+        or set(provenance) != _PROVENANCE_FIELDS
+    ):
+        raise ValueError("head-service provenance fields differ")
+    for name in (
+        "repository",
+        "revision",
+        "link_id",
+        "head_service_id",
+        "process_corner",
+    ):
+        if not isinstance(provenance[name], str) or not provenance[name]:
+            raise ValueError(f"head-service provenance {name} is empty")
+    measured_at = provenance["measured_at_utc"]
+    if not isinstance(measured_at, str) or not measured_at.endswith("Z"):
+        raise ValueError("head-service measurement time must be UTC")
+    try:
+        parsed_time = datetime.fromisoformat(
+            measured_at[:-1] + "+00:00"
+        )
+    except ValueError as exc:
+        raise ValueError("head-service measurement time is invalid") from exc
+    if parsed_time.tzinfo != timezone.utc:
+        raise ValueError("head-service measurement time must be UTC")
+    for name in ("source_tree_sha256", "environment_sha256"):
+        if not _SHA256.fullmatch(str(provenance[name])):
+            raise ValueError(f"head-service provenance {name} is invalid")
+    command = provenance["command"]
+    if (
+        not isinstance(command, list)
+        or not command
+        or any(not isinstance(value, str) or not value for value in command)
+    ):
+        raise ValueError("head-service measurement command is invalid")
+    toolchain = provenance["toolchain"]
+    if (
+        not isinstance(toolchain, Mapping)
+        or not toolchain
+        or any(
+            not isinstance(key, str)
+            or not key
+            or not isinstance(value, str)
+            or not value
+            for key, value in toolchain.items()
+        )
+    ):
+        raise ValueError("head-service toolchain provenance is invalid")
+
+    raw_measurements = body["measurements"]
+    if not isinstance(raw_measurements, list):
+        raise ValueError("head-service measurements must be a list")
+    measurements = tuple(
+        HeadServiceMeasurement.from_dict(value)
+        for value in raw_measurements
+    )
+    measurement_ids = tuple(value.measurement_id for value in measurements)
+    if len(measurement_ids) != len(set(measurement_ids)):
+        raise ValueError("head-service measurement IDs repeat")
+
+    provisional = BF16HeadServiceCalibration(
+        artifact_sha256=artifact_sha256,
+        content_hash=content_hash,
+        model_name=model_name,
+        model_revision=model_revision,
+        hidden_size=hidden_size,
+        vocab_size=vocab_size,
+        tie_embeddings=tie_embeddings,
+        required_batches=required_batches,
+        protocol=dict(protocol),
+        service=dict(service),
+        provenance=dict(provenance),
+        validation={},
+    )
+    repeats_by_batch: dict[int, list[HeadServiceMeasurement]] = {
+        batch: [] for batch in required_batches
+    }
+    holdouts: list[HeadServiceMeasurement] = []
+    for measurement in measurements:
+        if measurement.batch not in repeats_by_batch:
+            raise ValueError("measurement batch is outside required scope")
+        estimate = provisional.estimate(measurement.batch)
+        expected_dimensions = (
+            estimate.request_bytes,
+            estimate.response_bytes,
+            estimate.head_weight_bytes,
+            estimate.head_memory_bytes,
+            estimate.bf16_macs,
+            estimate.selection_elements,
+        )
+        measured_dimensions = (
+            measurement.request_bytes,
+            measurement.response_bytes,
+            measurement.head_weight_bytes,
+            measurement.head_memory_bytes,
+            measurement.bf16_macs,
+            measurement.selection_elements,
+        )
+        if measured_dimensions != expected_dimensions:
+            raise ValueError("head-service measurement dimensions differ")
+        if measurement.queue_delay_s != 0:
+            raise ValueError("dedicated head service cannot report queue delay")
+        if (
+            not measurement.reference_logits_finite
+            or not measurement.service_logits_finite
+        ):
+            raise ValueError("head-service logits must be finite")
+        if (
+            not measurement.selected_tokens_equal
+            or measurement.reference_token_ids_sha256
+            != measurement.service_token_ids_sha256
+        ):
+            raise ValueError(
+                "head-service selected tokens differ from the BF16 reference"
+            )
+        if measurement.logit_max_abs_error > HEAD_LOGIT_MAX_ABS_ERROR:
+            raise ValueError("head-service maximum logit error exceeds limit")
+        if measurement.logit_mean_abs_error > HEAD_LOGIT_MEAN_ABS_ERROR:
+            raise ValueError("head-service mean logit error exceeds limit")
+        if measurement.topk_set_agreement < HEAD_TOPK_MIN_AGREEMENT:
+            raise ValueError("head-service top-k agreement is below limit")
+        if not math.isclose(
+            measurement.component_dynamic_energy_j,
+            measurement.dynamic_energy_j,
+            rel_tol=1e-9,
+            abs_tol=1e-15,
+        ):
+            raise ValueError(
+                "head-service dynamic energy components do not conserve"
+            )
+        if measurement.split == "repeat":
+            repeats_by_batch[measurement.batch].append(measurement)
+        else:
+            holdouts.append(measurement)
+
+    repeat_hidden_hashes: set[str] = set()
+    for batch, values in repeats_by_batch.items():
+        numerical_identities = {
+            (
+                value.hidden_bf16_sha256,
+                value.reference_logits_bf16_sha256,
+                value.service_logits_bf16_sha256,
+                value.reference_token_ids_sha256,
+                value.service_token_ids_sha256,
+            )
+            for value in values
+        }
+        if len(numerical_identities) != 1:
+            raise ValueError(
+                f"batch {batch} repeat measurements changed numerical input"
+            )
+        repeat_hidden_hashes.add(values[0].hidden_bf16_sha256)
+    if len(repeat_hidden_hashes) != len(required_batches):
+        raise ValueError("repeat batches must use distinct hidden payloads")
+    holdout_hidden_hashes = {
+        value.hidden_bf16_sha256 for value in holdouts
+    }
+    if len(holdout_hidden_hashes) != len(holdouts):
+        raise ValueError("holdout hidden payloads must be distinct")
+    if repeat_hidden_hashes & holdout_hidden_hashes:
+        raise ValueError("repeat and holdout hidden payloads must be disjoint")
+
+    repeat_latency_cv: list[float] = []
+    repeat_energy_cv: list[float] = []
+    repeat_leakage_cv: list[float] = []
+    for batch, values in repeats_by_batch.items():
+        if len(values) < 3:
+            raise ValueError(
+                f"batch {batch} requires at least three repeat measurements"
+            )
+        repeat_ids = tuple(value.repeat for value in values)
+        if len(repeat_ids) != len(set(repeat_ids)):
+            raise ValueError(f"batch {batch} repeats a repeat index")
+        repeat_latency_cv.append(
+            _coefficient_of_variation(
+                [value.total_latency_s for value in values]
+            )
+        )
+        repeat_energy_cv.append(
+            _coefficient_of_variation(
+                [value.dynamic_energy_j for value in values]
+            )
+        )
+        repeat_leakage_cv.append(
+            _coefficient_of_variation(
+                [value.leakage_power_w for value in values]
+            )
+        )
+    if max(repeat_latency_cv) > 0.05:
+        raise ValueError("head-service repeat latency CV exceeds 5%")
+    if max(repeat_energy_cv) > 0.10:
+        raise ValueError("head-service repeat energy CV exceeds 10%")
+    if max(repeat_leakage_cv) > 0.10:
+        raise ValueError("head-service repeat leakage CV exceeds 10%")
+
+    holdouts_by_batch = {
+        batch: [value for value in holdouts if value.batch == batch]
+        for batch in required_batches
+    }
+    if any(not values for values in holdouts_by_batch.values()):
+        raise ValueError("every required batch needs a holdout measurement")
+    latency_errors: list[float] = []
+    dynamic_errors: list[float] = []
+    leakage_errors: list[float] = []
+    component_errors: list[float] = []
+    dynamic_component_errors: list[float] = []
+    for measurement in holdouts:
+        estimate = provisional.estimate(measurement.batch)
+        predicted_components = (
+            estimate.request_latency_s,
+            estimate.head_latency_s,
+            estimate.response_latency_s,
+        )
+        measured_components = (
+            measurement.request_latency_s,
+            measurement.head_latency_s,
+            measurement.response_latency_s,
+        )
+        component_errors.extend(
+            _relative_error(measured, predicted)
+            for measured, predicted in zip(
+                measured_components,
+                predicted_components,
+            )
+        )
+        predicted_dynamic_components = (
+            estimate.link_dynamic_energy_j,
+            estimate.mac_dynamic_energy_j,
+            estimate.memory_dynamic_energy_j,
+            estimate.selection_dynamic_energy_j,
+            estimate.fixed_dynamic_energy_j,
+        )
+        measured_dynamic_components = (
+            measurement.link_dynamic_energy_j,
+            measurement.mac_dynamic_energy_j,
+            measurement.memory_dynamic_energy_j,
+            measurement.selection_dynamic_energy_j,
+            measurement.fixed_dynamic_energy_j,
+        )
+        dynamic_component_errors.extend(
+            _relative_error(measured, predicted)
+            for measured, predicted in zip(
+                measured_dynamic_components,
+                predicted_dynamic_components,
+            )
+        )
+        latency_errors.append(
+            _relative_error(
+                measurement.total_latency_s,
+                estimate.total_latency_s,
+            )
+        )
+        dynamic_errors.append(
+            _relative_error(
+                measurement.dynamic_energy_j,
+                estimate.dynamic_energy_j,
+            )
+        )
+        leakage_errors.append(
+            _relative_error(
+                measurement.leakage_power_w,
+                float(service["leakage_power_w"]),
+            )
+        )
+    if max(component_errors) > 0.15:
+        raise ValueError("head-service component latency error exceeds 15%")
+    if max(dynamic_component_errors) > 0.25:
+        raise ValueError(
+            "head-service component dynamic-energy error exceeds 25%"
+        )
+    if percentile(latency_errors, 0.5) > 0.10 or max(latency_errors) > 0.15:
+        raise ValueError("head-service latency holdout gate failed")
+    if percentile(dynamic_errors, 0.5) > 0.15 or max(dynamic_errors) > 0.25:
+        raise ValueError("head-service dynamic-energy holdout gate failed")
+    if percentile(leakage_errors, 0.5) > 0.15 or max(leakage_errors) > 0.25:
+        raise ValueError("head-service leakage holdout gate failed")
+    latency_measured = [
+        sum(value.total_latency_s for value in holdouts_by_batch[batch])
+        / len(holdouts_by_batch[batch])
+        for batch in required_batches
+    ]
+    latency_predicted = [
+        provisional.estimate(batch).total_latency_s
+        for batch in required_batches
+    ]
+    dynamic_measured = [
+        sum(value.dynamic_energy_j for value in holdouts_by_batch[batch])
+        / len(holdouts_by_batch[batch])
+        for batch in required_batches
+    ]
+    dynamic_predicted = [
+        provisional.estimate(batch).dynamic_energy_j
+        for batch in required_batches
+    ]
+    latency_rank = spearman_rank_correlation(
+        latency_measured,
+        latency_predicted,
+    )
+    energy_rank = spearman_rank_correlation(
+        dynamic_measured,
+        dynamic_predicted,
+    )
+    if latency_rank < 0.90:
+        raise ValueError("head-service latency rank gate failed")
+    if energy_rank < 0.90:
+        raise ValueError("head-service energy rank gate failed")
+
+    validation = {
+        "repeat_latency_cv_max": max(repeat_latency_cv),
+        "repeat_dynamic_energy_cv_max": max(repeat_energy_cv),
+        "repeat_leakage_cv_max": max(repeat_leakage_cv),
+        "holdout_latency_median_error": percentile(latency_errors, 0.5),
+        "holdout_latency_max_error": max(latency_errors),
+        "holdout_dynamic_energy_median_error": percentile(
+            dynamic_errors,
+            0.5,
+        ),
+        "holdout_dynamic_energy_max_error": max(dynamic_errors),
+        "holdout_dynamic_component_max_error": max(
+            dynamic_component_errors
+        ),
+        "holdout_leakage_median_error": percentile(
+            leakage_errors,
+            0.5,
+        ),
+        "holdout_leakage_max_error": max(leakage_errors),
+        "holdout_latency_rank_correlation": latency_rank,
+        "holdout_dynamic_energy_rank_correlation": energy_rank,
+        "sampled_logit_max_abs_error": max(
+            value.logit_max_abs_error for value in measurements
+        ),
+        "sampled_logit_mean_abs_error_max": max(
+            value.logit_mean_abs_error for value in measurements
+        ),
+        "sampled_topk_set_agreement_min": min(
+            value.topk_set_agreement for value in measurements
+        ),
+        "selected_token_exact_match_count": len(measurements),
+        "numerical_sample_count": len(measurements),
+        "holdout_count": len(holdouts),
+        "measurement_count": len(measurements),
+    }
+    return replace(provisional, validation=validation)
+
+
+def load_bf16_head_service_artifact(
+    path: str | Path,
+    *,
+    model_name: str,
+    model_revision: str,
+    hidden_size: int,
+    vocab_size: int,
+    tie_embeddings: bool,
+    required_batches: Sequence[int],
+) -> BF16HeadServiceStatus:
+    """Load and validate one exact remote-head calibration artifact."""
+
+    source = Path(path).resolve()
+    payload = b""
+    artifact_sha256 = ""
+    failures: list[str] = []
+    calibration: BF16HeadServiceCalibration | None = None
+    try:
+        payload = source.read_bytes()
+        artifact_sha256 = hashlib.sha256(payload).hexdigest()
+        raw = json.loads(payload, object_pairs_hook=_reject_duplicate_pairs)
+        if not isinstance(raw, Mapping):
+            raise TypeError("head-service artifact root must be an object")
+        batches = tuple(sorted({_positive_int(value, "batch") for value in required_batches}))
+        if not batches:
+            raise ValueError("required batch scope must be non-empty")
+        calibration = _parse_calibration(
+            raw,
+            artifact_sha256=artifact_sha256,
+            model_name=model_name,
+            model_revision=model_revision,
+            hidden_size=_positive_int(hidden_size, "hidden_size"),
+            vocab_size=_positive_int(vocab_size, "vocab_size"),
+            tie_embeddings=bool(tie_embeddings),
+            required_batches=batches,
+        )
+    except Exception as exc:
+        failures.append(f"{type(exc).__name__}: {exc}")
+    return BF16HeadServiceStatus(
+        source_path=source,
+        artifact_sha256=artifact_sha256,
+        failures=tuple(failures),
+        calibration=calibration,
+    )
+
+
+__all__ = [
+    "BF16HeadServiceCalibration",
+    "BF16HeadServiceEstimate",
+    "BF16HeadServiceStatus",
+    "HEAD_LOGIT_MAX_ABS_ERROR",
+    "HEAD_LOGIT_MEAN_ABS_ERROR",
+    "HEAD_SERVICE_MODE",
+    "HEAD_SERVICE_SCHEMA",
+    "HEAD_TOPK_MIN_AGREEMENT",
+    "HEAD_VALIDATION_TOPK",
+    "HeadServiceMeasurement",
+    "composite_system_calibration_id",
+    "head_service_status_valid",
+    "load_bf16_head_service_artifact",
+    "require_content_addressed_id",
+]
diff --git a/decode_dse/hardware/measure_bf16_head_service.py b/decode_dse/hardware/measure_bf16_head_service.py
new file mode 100644
index 0000000..d60616f
--- /dev/null
+++ b/decode_dse/hardware/measure_bf16_head_service.py
@@ -0,0 +1,1342 @@
+"""Measure and seal the dedicated BF16 output-head service artifact.
+
+The decode ledger stops after final RMSNorm; the BF16 LM head runs as a
+dedicated remote service. This tool measures that service on real hardware:
+an endpoint process pinned to one CUDA device holds the exported BF16 head
+weight and serves argmax token ids, while the driver on a second device sends
+BF16 hidden payloads over the physical inter-device link. Request transfer,
+head compute (BF16 MACs, FP32 accumulation), selection, and response transfer
+are timed as separate phases; per-phase dynamic energy comes from NVML board
+meters (total-energy counter, with a sampled power-trace fallback) bound to
+the devices by UUID, amplified over an inner iteration loop that scales until
+the counter delta clears its resolution floor, and leakage from an idle-power
+window. Both devices must be held exclusively by this process, and every
+phase delta must be positive and plausible against the boards' enforced
+power limits; corrupted or foreign-load readings fail the measurement
+instead of being clamped.
+
+Protocol and service coefficients are fitted from the repeat measurements by
+non-negative least squares. The MAC and memory shares of the jointly measured
+head-compute phase are attributed through the fitted coefficients and scaled
+so components conserve the measured phase energy exactly; the fixed dynamic
+term is the fitted per-invocation constant. The tool self-validates by
+loading the assembled document through ``load_bf16_head_service_artifact``
+and refuses to write unless every gate passes.
+
+Run once per model on the serving host, before the sweep pipeline:
+
+    python -m decode_dse.hardware.measure_bf16_head_service \
+        --config decode_dse/configs/llama3_1_8b.json \
+        --driver-device cuda:0 --endpoint-device cuda:1 \
+        --out <workspace>/external/bf16_output_head_service.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import math
+import os
+import subprocess
+import sys
+import threading
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from decode_dse.hardware.lm_head_service import (
+    HEAD_SERVICE_MODE,
+    HEAD_SERVICE_SCHEMA,
+    HEAD_VALIDATION_TOPK,
+    load_bf16_head_service_artifact,
+)
+
+WEIGHT_ALIGNMENT_BYTES = 64
+REQUEST_METADATA_BYTES_PER_SEQUENCE = 8
+REQUEST_FIXED_BYTES = 64
+RESPONSE_METADATA_BYTES_PER_SEQUENCE = 4
+RESPONSE_FIXED_BYTES = 64
+REPEATS_PER_BATCH = 3
+HOLDOUTS_PER_BATCH = 2
+INNER_ITERATIONS = 200
+MAX_INNER_ITERATIONS = 2_097_152
+MIN_ACTIVE_WINDOW_S = 0.5
+COUNTER_TICK_ALIGN_TIMEOUT_S = 1.0
+WARMUP_ITERATIONS = 20
+IDLE_WINDOW_SECONDS = 1.0
+IDLE_WINDOW_COUNT = 3
+COUNTER_QUANTUM_J = 0.001
+MIN_COUNTER_DELTA_J = 0.1
+POWER_PLAUSIBILITY_MARGIN = 1.2
+IDLE_POWER_LIMIT_FRACTION = 0.25
+RESOLUTION_NOISE_FRACTION = 0.05
+POWER_TRACE_SAMPLE_INTERVAL_S = 0.01
+NVML_TOTAL_ENERGY_METHOD = "nvml_total_energy_counter"
+NVML_POWER_TRACE_METHOD = "nvml_power_trace_trapezoidal"
+ENERGY_METER_PRIORITY = (
+    NVML_TOTAL_ENERGY_METHOD,
+    NVML_POWER_TRACE_METHOD,
+)
+
+
+def _align(value: int, alignment: int) -> int:
+    return ((value + alignment - 1) // alignment) * alignment
+
+
+def _content_hash(value: Any) -> str:
+    encoded = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def closed_form_dimensions(
+    *, batch: int, hidden_size: int, vocab_size: int
+) -> dict[str, int]:
+    """Dimensional quantities the loader recomputes and compares exactly."""
+
+    head_weight_bytes = _align(
+        hidden_size * vocab_size * 2, WEIGHT_ALIGNMENT_BYTES
+    )
+    return {
+        "request_bytes": REQUEST_FIXED_BYTES
+        + batch * (hidden_size * 2 + REQUEST_METADATA_BYTES_PER_SEQUENCE),
+        "response_bytes": RESPONSE_FIXED_BYTES
+        + batch * (4 + RESPONSE_METADATA_BYTES_PER_SEQUENCE),
+        "head_weight_bytes": head_weight_bytes,
+        "head_memory_bytes": head_weight_bytes + batch * hidden_size * 2,
+        "bf16_macs": batch * hidden_size * vocab_size,
+        "selection_elements": batch * vocab_size,
+    }
+
+
+def _nonnegative_line_fit(
+    xs: Sequence[float], ys: Sequence[float]
+) -> tuple[float, float]:
+    """Least-squares slope/intercept with both terms kept non-negative.
+
+    When the per-unit contribution sits below measurement noise the phase is
+    fixed-cost dominated; the fit then attributes the mean to the intercept
+    and keeps a rate small enough to contribute at most one percent at the
+    largest measured size, so predictions stay accurate and positive.
+    """
+
+    count = len(xs)
+    mean_x = sum(xs) / count
+    mean_y = sum(ys) / count
+    if mean_y <= 0:
+        raise ValueError("phase fit requires positive measurements")
+    denominator = sum((x - mean_x) ** 2 for x in xs)
+    if denominator == 0:
+        raise ValueError("phase fit requires varying batch dimensions")
+    slope = sum(
+        (x - mean_x) * (y - mean_y) for x, y in zip(xs, ys)
+    ) / denominator
+    intercept = mean_y - slope * mean_x
+    if intercept < 0:
+        intercept = 0.0
+        slope = sum(x * y for x, y in zip(xs, ys)) / sum(x * x for x in xs)
+    if slope <= 0:
+        slope = 0.01 * mean_y / max(xs)
+        intercept = max(mean_y - slope * mean_x, 0.0)
+    return slope, intercept
+
+
+def _two_term_nonnegative_fit(
+    a: Sequence[float], b: Sequence[float], ys: Sequence[float]
+) -> tuple[float, float]:
+    """Fit ``y = ca*a + cb*b`` with both coefficients kept positive."""
+
+    saa = sum(x * x for x in a)
+    sbb = sum(x * x for x in b)
+    sab = sum(x * y for x, y in zip(a, b))
+    say = sum(x * y for x, y in zip(a, ys))
+    sby = sum(x * y for x, y in zip(b, ys))
+    determinant = saa * sbb - sab * sab
+    if determinant > 0:
+        ca = (say * sbb - sby * sab) / determinant
+        cb = (sby * saa - say * sab) / determinant
+        if ca > 0 and cb > 0:
+            return ca, cb
+    total = sum(ys)
+    weight = sum(a) + sum(b)
+    fallback = total / weight if weight > 0 else 0.0
+    if fallback <= 0:
+        raise ValueError("energy fit produced non-positive coefficients")
+    return fallback, fallback
+
+
+class PhaseSample:
+    """Mean per-invocation phase timings and energies for one payload."""
+
+    def __init__(
+        self,
+        *,
+        batch: int,
+        request_latency_s: float,
+        head_compute_latency_s: float,
+        selection_latency_s: float,
+        response_latency_s: float,
+        link_energy_j: float,
+        head_compute_energy_j: float,
+        selection_energy_j: float,
+        leakage_power_w: float,
+        hidden_sha256: str,
+        reference_logits_sha256: str,
+        service_logits_sha256: str,
+        reference_token_ids_sha256: str,
+        service_token_ids_sha256: str,
+        logit_max_abs_error: float,
+        logit_mean_abs_error: float,
+        topk_set_agreement: float,
+        selected_tokens_equal: bool,
+    ) -> None:
+        self.batch = batch
+        self.request_latency_s = request_latency_s
+        self.head_compute_latency_s = head_compute_latency_s
+        self.selection_latency_s = selection_latency_s
+        self.response_latency_s = response_latency_s
+        self.link_energy_j = link_energy_j
+        self.head_compute_energy_j = head_compute_energy_j
+        self.selection_energy_j = selection_energy_j
+        self.leakage_power_w = leakage_power_w
+        self.hidden_sha256 = hidden_sha256
+        self.reference_logits_sha256 = reference_logits_sha256
+        self.service_logits_sha256 = service_logits_sha256
+        self.reference_token_ids_sha256 = reference_token_ids_sha256
+        self.service_token_ids_sha256 = service_token_ids_sha256
+        self.logit_max_abs_error = logit_max_abs_error
+        self.logit_mean_abs_error = logit_mean_abs_error
+        self.topk_set_agreement = topk_set_agreement
+        self.selected_tokens_equal = selected_tokens_equal
+
+    @property
+    def head_latency_s(self) -> float:
+        return self.head_compute_latency_s + self.selection_latency_s
+
+    @property
+    def total_dynamic_energy_j(self) -> float:
+        return (
+            self.link_energy_j
+            + self.head_compute_energy_j
+            + self.selection_energy_j
+        )
+
+
+def _median(values: Sequence[float]) -> float:
+    ordered = sorted(values)
+    middle = len(ordered) // 2
+    if len(ordered) % 2:
+        return ordered[middle]
+    return (ordered[middle - 1] + ordered[middle]) / 2
+
+
+def fit_service_coefficients(
+    samples: Sequence[PhaseSample],
+    *,
+    hidden_size: int,
+    vocab_size: int,
+    measured_bf16_mac_per_s: float,
+) -> tuple[dict[str, Any], dict[str, Any]]:
+    """Fit protocol and service coefficient blocks from repeat samples.
+
+    ``measured_bf16_mac_per_s`` comes from a compute-saturated GEMM
+    microbenchmark on the endpoint device and bounds the fitted head MAC
+    rate from above; the rate itself is identified from the top-batch head
+    latency once compute exceeds the weight-streaming plateau, so every
+    coefficient is anchored in the composed phase the estimator prices.
+    The fixed dynamic energy is the measured intercept of total dynamic
+    energy against batch — the per-invocation overhead at zero payload.
+    """
+
+    dimensions = {
+        sample.batch: closed_form_dimensions(
+            batch=sample.batch,
+            hidden_size=hidden_size,
+            vocab_size=vocab_size,
+        )
+        for sample in samples
+    }
+    request_rate, request_fixed = _nonnegative_line_fit(
+        [dimensions[s.batch]["request_bytes"] for s in samples],
+        [s.request_latency_s for s in samples],
+    )
+    response_rate, response_fixed = _nonnegative_line_fit(
+        [dimensions[s.batch]["response_bytes"] for s in samples],
+        [s.response_latency_s for s in samples],
+    )
+    # The head phase (compute + selection) follows the estimator's roofline:
+    # fixed + max(macs/rate, bytes/bandwidth) + selection_elements * rate.
+    # Batches below the top ride the weight-streaming plateau, so an affine
+    # fit there identifies the per-batch selection slope and the plateau;
+    # the MAC branch is pinned at the top batch where compute exceeds it.
+    top_batch = max(sample.batch for sample in samples)
+    plateau_samples = [s for s in samples if s.batch < top_batch]
+    head_sel_slope, head_plateau_intercept = _nonnegative_line_fit(
+        [float(s.batch) for s in plateau_samples],
+        [s.head_latency_s for s in plateau_samples],
+    )
+    selection_rate = head_sel_slope / float(vocab_size)
+    fixed_latency = 0.05 * head_plateau_intercept
+    plateau = head_plateau_intercept - fixed_latency
+    weight_bytes_constant = dimensions[top_batch]["head_weight_bytes"]
+    memory_bandwidth = weight_bytes_constant / plateau
+    top_head_latency = _median(
+        [s.head_latency_s for s in samples if s.batch == top_batch]
+    )
+    mac_term_top = (
+        top_head_latency - fixed_latency - head_sel_slope * top_batch
+    )
+    if mac_term_top > plateau:
+        bf16_mac_per_s = dimensions[top_batch]["bf16_macs"] / mac_term_top
+    else:
+        bf16_mac_per_s = measured_bf16_mac_per_s
+    if bf16_mac_per_s > measured_bf16_mac_per_s:
+        raise ValueError(
+            "fitted head MAC rate exceeds the compute-saturated silicon rate"
+        )
+
+    link_energy_rate, _link_energy_fixed = _nonnegative_line_fit(
+        [
+            dimensions[s.batch]["request_bytes"]
+            + dimensions[s.batch]["response_bytes"]
+            for s in samples
+        ],
+        [s.link_energy_j for s in samples],
+    )
+    mac_energy, memory_energy = _two_term_nonnegative_fit(
+        [float(dimensions[s.batch]["bf16_macs"]) for s in samples],
+        [float(dimensions[s.batch]["head_memory_bytes"]) for s in samples],
+        [s.head_compute_energy_j for s in samples],
+    )
+    selection_energy_rate, _selection_energy_fixed = _nonnegative_line_fit(
+        [float(dimensions[s.batch]["selection_elements"]) for s in samples],
+        [s.selection_energy_j for s in samples],
+    )
+    _energy_slope, energy_intercept = _nonnegative_line_fit(
+        [float(s.batch) for s in samples],
+        [s.total_dynamic_energy_j for s in samples],
+    )
+    # The batch intercept of the measured total already contains the
+    # weight-streaming constant that the memory component carries, so the
+    # fixed component is the remainder — components partition the measured
+    # total instead of double-counting the per-invocation constant.
+    weight_energy_constant = weight_bytes_constant * memory_energy
+    smallest_total = min(s.total_dynamic_energy_j for s in samples)
+    fixed_dynamic = max(
+        energy_intercept - weight_energy_constant,
+        0.001 * smallest_total,
+    )
+    if fixed_dynamic <= 0:
+        raise ValueError("fixed dynamic energy must be positive")
+    leakage = _median([s.leakage_power_w for s in samples])
+
+    head_weight_bytes = closed_form_dimensions(
+        batch=1, hidden_size=hidden_size, vocab_size=vocab_size
+    )["head_weight_bytes"]
+    protocol = {
+        "hidden_dtype": "BF16",
+        "hidden_element_bytes": 2,
+        "token_id_dtype": "UINT32",
+        "token_id_bytes": 4,
+        "request_fixed_bytes": REQUEST_FIXED_BYTES,
+        "request_metadata_bytes_per_sequence": (
+            REQUEST_METADATA_BYTES_PER_SEQUENCE
+        ),
+        "response_fixed_bytes": RESPONSE_FIXED_BYTES,
+        "response_metadata_bytes_per_sequence": (
+            RESPONSE_METADATA_BYTES_PER_SEQUENCE
+        ),
+        "request_bandwidth_bytes_s": 1.0 / request_rate,
+        "response_bandwidth_bytes_s": 1.0 / response_rate,
+        "request_fixed_latency_s": request_fixed,
+        "response_fixed_latency_s": response_fixed,
+        "link_energy_j_per_byte": link_energy_rate,
+        "duplex_schedule": "serialized_request_service_response",
+    }
+    service = {
+        "service_mode": HEAD_SERVICE_MODE,
+        "service_location": "prefill_chip",
+        "service_instances": 1,
+        "weight_dtype": "BF16",
+        "weight_alignment_bytes": WEIGHT_ALIGNMENT_BYTES,
+        "head_weight_bytes": head_weight_bytes,
+        "head_weight_sha256": "",
+        "head_weight_layout": "vocab_by_hidden_row_major_bf16_le",
+        "head_weight_capacity_bytes": head_weight_bytes,
+        "mac_input_dtype": "BF16",
+        "accumulator_dtype": "FP32",
+        "logit_dtype": "BF16",
+        "logits_boundary": "fused_selection_token_ids",
+        "selection_policy": "argmax_lowest_token_id_on_tie",
+        "validation_topk": HEAD_VALIDATION_TOPK,
+        "bf16_mac_per_s": bf16_mac_per_s,
+        "bf16_mac_energy_j": mac_energy,
+        "memory_bandwidth_bytes_s": memory_bandwidth,
+        "memory_energy_j_per_byte": memory_energy,
+        "selection_latency_s_per_element": selection_rate,
+        "selection_energy_j_per_element": selection_energy_rate,
+        "fixed_latency_s": fixed_latency,
+        "fixed_dynamic_energy_j": fixed_dynamic,
+        "leakage_power_w": leakage,
+    }
+    return protocol, service
+
+
+def measurement_record(
+    sample: PhaseSample,
+    *,
+    measurement_id: str,
+    split: str,
+    repeat: int,
+    hidden_size: int,
+    vocab_size: int,
+    protocol: Mapping[str, Any],
+    service: Mapping[str, Any],
+) -> dict[str, Any]:
+    """Assemble one loader-shaped measurement from measured phases.
+
+    Board-level metering resolves the payload's total dynamic energy, not
+    the per-component split: several components sit orders of magnitude
+    below meter resolution at small batches. Components are therefore
+    attributed through the fitted coefficients and rescaled by one factor so
+    they sum to the measured total exactly — the totals are measured, the
+    split is the declared model attribution, and every component's error
+    against the estimator is the total-fit error at that payload.
+    """
+
+    dims = closed_form_dimensions(
+        batch=sample.batch, hidden_size=hidden_size, vocab_size=vocab_size
+    )
+    predicted = {
+        "link": (dims["request_bytes"] + dims["response_bytes"])
+        * float(protocol["link_energy_j_per_byte"]),
+        "mac": dims["bf16_macs"] * float(service["bf16_mac_energy_j"]),
+        "memory": dims["head_memory_bytes"]
+        * float(service["memory_energy_j_per_byte"]),
+        "selection": dims["selection_elements"]
+        * float(service["selection_energy_j_per_element"]),
+        "fixed": float(service["fixed_dynamic_energy_j"]),
+    }
+    predicted_total = sum(predicted.values())
+    if predicted_total <= 0:
+        raise ValueError("fitted energy attribution must be positive")
+    measured_total = sample.total_dynamic_energy_j
+    scale = measured_total / predicted_total
+    link_component = predicted["link"] * scale
+    mac_component = predicted["mac"] * scale
+    memory_component = predicted["memory"] * scale
+    selection_component = predicted["selection"] * scale
+    fixed_component = predicted["fixed"] * scale
+    dynamic_total = measured_total
+    return {
+        "measurement_id": measurement_id,
+        "split": split,
+        "batch": sample.batch,
+        "repeat": repeat,
+        "hidden_bf16_sha256": sample.hidden_sha256,
+        "reference_logits_bf16_sha256": sample.reference_logits_sha256,
+        "service_logits_bf16_sha256": sample.service_logits_sha256,
+        "reference_token_ids_sha256": sample.reference_token_ids_sha256,
+        "service_token_ids_sha256": sample.service_token_ids_sha256,
+        "reference_logits_finite": True,
+        "service_logits_finite": True,
+        "logit_max_abs_error": sample.logit_max_abs_error,
+        "logit_mean_abs_error": sample.logit_mean_abs_error,
+        "topk_set_agreement": sample.topk_set_agreement,
+        "selected_tokens_equal": sample.selected_tokens_equal,
+        "request_bytes": dims["request_bytes"],
+        "response_bytes": dims["response_bytes"],
+        "head_weight_bytes": dims["head_weight_bytes"],
+        "head_memory_bytes": dims["head_memory_bytes"],
+        "bf16_macs": dims["bf16_macs"],
+        "selection_elements": dims["selection_elements"],
+        "request_latency_s": sample.request_latency_s,
+        "head_latency_s": sample.head_latency_s,
+        "queue_delay_s": 0.0,
+        "response_latency_s": sample.response_latency_s,
+        "link_dynamic_energy_j": link_component,
+        "mac_dynamic_energy_j": mac_component,
+        "memory_dynamic_energy_j": memory_component,
+        "selection_dynamic_energy_j": selection_component,
+        "fixed_dynamic_energy_j": fixed_component,
+        "dynamic_energy_j": dynamic_total,
+        "leakage_power_w": sample.leakage_power_w,
+    }
+
+
+def assemble_artifact(
+    *,
+    model: Mapping[str, Any],
+    protocol: Mapping[str, Any],
+    service: Mapping[str, Any],
+    required_batches: Sequence[int],
+    measurements: Sequence[Mapping[str, Any]],
+    provenance: Mapping[str, Any],
+) -> dict[str, Any]:
+    body = {
+        "schema_version": HEAD_SERVICE_SCHEMA,
+        "model": dict(model),
+        "protocol": dict(protocol),
+        "service": dict(service),
+        "required_batch_scope": [int(batch) for batch in required_batches],
+        "measurements": [dict(value) for value in measurements],
+        "provenance": dict(provenance),
+    }
+    return body | {"content_hash": _content_hash(body)}
+
+
+def seal_artifact(
+    document: Mapping[str, Any],
+    *,
+    destination: Path,
+    model: Mapping[str, Any],
+    required_batches: Sequence[int],
+) -> None:
+    """Self-validate through the exact loader, then write atomically."""
+
+    staging = destination.with_name(destination.name + ".staging")
+    staging.write_text(
+        json.dumps(document, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    status = load_bf16_head_service_artifact(
+        staging,
+        model_name=str(model["model_name"]),
+        model_revision=str(model["model_revision"]),
+        hidden_size=int(model["hidden_size"]),
+        vocab_size=int(model["vocab_size"]),
+        tie_embeddings=bool(model["tie_embeddings"]),
+        required_batches=tuple(required_batches),
+    )
+    if not status.passed:
+        rejected = destination.with_name(destination.name + ".rejected")
+        staging.replace(rejected)
+        for record in document.get("measurements", ()):
+            print(
+                f"  {record['measurement_id']}: "
+                f"request={record['request_latency_s']:.3e}s "
+                f"head={record['head_latency_s']:.3e}s "
+                f"response={record['response_latency_s']:.3e}s "
+                f"dynamic={record['dynamic_energy_j']:.3e}J",
+                file=sys.stderr,
+            )
+        raise SystemExit(
+            "head-service artifact failed its own validation gates "
+            f"(rejected document kept at {rejected}):\n"
+            + "\n".join(status.failures)
+        )
+    staging.replace(destination)
+    print(f"sealed {destination}")
+    print(f"calibration_id: {status.calibration_id}")
+    print(f"provenance_id: {status.provenance_id}")
+
+
+def _source_tree_sha256(root: Path) -> str:
+    entries = []
+    for path in sorted(root.rglob("*.py")):
+        if "__pycache__" in path.parts:
+            continue
+        entries.append(
+            [
+                path.relative_to(root).as_posix(),
+                hashlib.sha256(path.read_bytes()).hexdigest(),
+            ]
+        )
+    return _content_hash(entries)
+
+
+def _tensor_sha256(tensor: Any) -> str:
+    import torch
+
+    data = tensor.detach().contiguous().cpu().view(torch.uint8)
+    return hashlib.sha256(bytes(data.numpy().tobytes())).hexdigest()
+
+
+def _load_head_weight(config: Mapping[str, Any]) -> Any:
+    """Load the LM-head weight (vocab x hidden, BF16) from the pinned snapshot."""
+
+    import torch
+    from safetensors import safe_open
+
+    cache = Path(str(config["hf_cache_dir"]))
+    repo = str(config["model_name"]).replace("/", "--")
+    snapshot = (
+        cache / f"models--{repo}" / "snapshots" / str(config["model_revision"])
+    )
+    index_path = snapshot / "model.safetensors.index.json"
+    architecture = config["model_architecture"]
+    tied = bool(architecture["tie_word_embeddings"])
+    tensor_name = "model.embed_tokens.weight" if tied else "lm_head.weight"
+    if index_path.is_file():
+        index = json.loads(index_path.read_text(encoding="utf-8"))
+        shard = index["weight_map"][tensor_name]
+    else:
+        shard = "model.safetensors"
+    with safe_open(str(snapshot / shard), framework="pt") as handle:
+        weight = handle.get_tensor(tensor_name)
+    expected = (
+        int(architecture["vocab_size"]),
+        int(architecture["hidden_size"]),
+    )
+    if tuple(weight.shape) != expected:
+        raise SystemExit(
+            f"head weight shape {tuple(weight.shape)} differs from {expected}"
+        )
+    return weight.to(torch.bfloat16)
+
+
+def _normalized_gpu_uuid(value: Any) -> str:
+    text = value.decode("utf-8") if isinstance(value, bytes) else str(value)
+    text = text.strip().lower()
+    return text[4:] if text.startswith("gpu-") else text
+
+
+def _bind_nvml_handle_by_uuid(nvml: Any, device_uuid: str) -> Any:
+    """Bind an NVML handle by UUID and require a matching read-back."""
+
+    normalized = _normalized_gpu_uuid(device_uuid)
+    handle = nvml.nvmlDeviceGetHandleByUUID(f"GPU-{normalized}")
+    observed = _normalized_gpu_uuid(nvml.nvmlDeviceGetUUID(handle))
+    if observed != normalized:
+        raise RuntimeError(
+            f"NVML handle resolved to a different GPU UUID: {observed} "
+            f"differs from {normalized}"
+        )
+    return handle
+
+
+def _require_exclusive_compute(nvml: Any, handle: Any, label: str) -> None:
+    """Require that only this process holds compute contexts on the board."""
+
+    processes = nvml.nvmlDeviceGetComputeRunningProcesses(handle)
+    foreign = sorted(
+        int(process.pid)
+        for process in processes
+        if int(process.pid) != os.getpid()
+    )
+    if foreign:
+        raise SystemExit(
+            f"{label} carries foreign compute processes (pids "
+            f"{', '.join(str(pid) for pid in foreign)}); the measurement "
+            "requires exclusively held boards"
+        )
+
+
+def _enforced_power_limit_w(nvml: Any, handle: Any) -> float:
+    limit_w = float(nvml.nvmlDeviceGetEnforcedPowerLimit(handle)) / 1000.0
+    if not math.isfinite(limit_w) or limit_w <= 0:
+        raise RuntimeError("NVML enforced power limit must be positive")
+    return limit_w
+
+
+def _check_phase_energy(
+    *,
+    delta_j: float,
+    wall_s: float,
+    power_ceiling_w: float,
+    label: str,
+) -> None:
+    """Reject corrupted or physically implausible phase energy.
+
+    A zero delta is not corruption: over short windows the total-energy
+    counter may simply not tick, which the caller's adaptive iteration
+    scaling resolves. Only a negative delta (counter went backwards) or an
+    implausibly high implied power rejects here.
+    """
+
+    if not math.isfinite(delta_j) or delta_j < 0:
+        raise RuntimeError(
+            f"{label} board-energy delta is negative ({delta_j!r} J); "
+            "the meter window is corrupted"
+        )
+    if not math.isfinite(wall_s) or wall_s <= 0:
+        raise RuntimeError(f"{label} wall time is invalid ({wall_s!r} s)")
+    if not _phase_delta_sufficient(delta_j):
+        # Below the resolution floor a single coarse counter tick dominates
+        # the window, so implied power is meaningless; the adaptive loop
+        # widens the window until the floor is cleared.
+        return
+    implied_w = delta_j / wall_s
+    if implied_w > power_ceiling_w:
+        raise RuntimeError(
+            f"{label} implies {implied_w:.1f} W board power against a "
+            f"{power_ceiling_w:.1f} W plausibility ceiling; a foreign load "
+            "or meter fault corrupted the reading"
+        )
+
+
+def _phase_delta_sufficient(delta_j: float) -> bool:
+    return delta_j >= max(MIN_COUNTER_DELTA_J, 20.0 * COUNTER_QUANTUM_J)
+
+
+def _resolved_dynamic_energy(
+    *,
+    dynamic_total_j: float,
+    idle_energy_j: float,
+    label: str,
+) -> tuple[float, bool]:
+    """Resolve a phase's total dynamic energy against measurement resolution.
+
+    Board-level metering cannot distinguish a near-idle phase's dynamic
+    energy from zero: after leakage subtraction the residual sits inside the
+    idle-drift noise band. Within that quantified band, the declared value is
+    the band itself — an explicit upper bound at measurement resolution,
+    flagged so the artifact records that the true value is below it. A
+    negative residual beyond the band is genuine corruption and rejects.
+    """
+
+    if not math.isfinite(dynamic_total_j):
+        raise RuntimeError(f"{label} dynamic energy is not finite")
+    noise_band_j = RESOLUTION_NOISE_FRACTION * idle_energy_j
+    if dynamic_total_j > 0:
+        return dynamic_total_j, False
+    if -dynamic_total_j <= noise_band_j:
+        return noise_band_j, True
+    raise RuntimeError(
+        f"{label} dynamic energy is {dynamic_total_j:.6f} J, below the "
+        f"-{noise_band_j:.6f} J idle-drift noise band; the leakage window "
+        "or the phase reading is corrupted"
+    )
+
+
+class _BoardEnergyMeter:
+    """Per-board energy meter with probe-then-commit method selection."""
+
+    def __init__(self, nvml: Any, handle: Any, label: str) -> None:
+        self._nvml = nvml
+        self._handle = handle
+        self.label = label
+        self.method: str | None = None
+        failures: list[str] = []
+        for method in ENERGY_METER_PRIORITY:
+            try:
+                if method == NVML_TOTAL_ENERGY_METHOD:
+                    int(nvml.nvmlDeviceGetTotalEnergyConsumption(handle))
+                elif method == NVML_POWER_TRACE_METHOD:
+                    if int(nvml.nvmlDeviceGetPowerUsage(handle)) <= 0:
+                        raise RuntimeError(
+                            "NVML returned non-positive board power"
+                        )
+                else:
+                    raise ValueError(f"unsupported energy meter {method!r}")
+            except Exception as error:
+                failures.append(f"{method}: {type(error).__name__}: {error}")
+                continue
+            self.method = method
+            break
+        if self.method is None:
+            raise RuntimeError(
+                f"{label} has no usable NVML board-energy meter; "
+                + "; ".join(failures)
+            )
+        self._counter_start_j: float | None = None
+        self._window_start: float = 0.0
+        self._trace: list[tuple[int, int]] = []
+        self._trace_stop: threading.Event | None = None
+        self._trace_thread: threading.Thread | None = None
+
+    def _counter_j(self) -> float:
+        return (
+            float(self._nvml.nvmlDeviceGetTotalEnergyConsumption(self._handle))
+            / 1000.0
+        )
+
+    def _trace_worker(self) -> None:
+        assert self._trace_stop is not None
+        while not self._trace_stop.is_set():
+            self._trace.append(
+                (
+                    time.monotonic_ns(),
+                    int(self._nvml.nvmlDeviceGetPowerUsage(self._handle)),
+                )
+            )
+            self._trace_stop.wait(POWER_TRACE_SAMPLE_INTERVAL_S)
+
+    def begin(self) -> None:
+        if self.method == NVML_TOTAL_ENERGY_METHOD:
+            # Align the window start to a counter update so a stale reading
+            # cannot attribute a whole update period's energy to the window.
+            # A counter that updates continuously simply times out the spin.
+            initial = self._counter_j()
+            deadline = time.monotonic() + COUNTER_TICK_ALIGN_TIMEOUT_S
+            current = initial
+            while current == initial and time.monotonic() < deadline:
+                time.sleep(0.001)
+                current = self._counter_j()
+            self._counter_start_j = current
+            self._window_start = time.monotonic()
+            return
+        self._trace = []
+        self._trace_stop = threading.Event()
+        self._trace_thread = threading.Thread(
+            target=self._trace_worker,
+            daemon=True,
+        )
+        self._trace_thread.start()
+        self._window_start = time.monotonic()
+
+    def end(self) -> tuple[float, float]:
+        """Return (delta_j, window_s) for this board's own meter window."""
+
+        if self.method == NVML_TOTAL_ENERGY_METHOD:
+            if self._counter_start_j is None:
+                raise RuntimeError("meter end() without begin()")
+            delta = self._counter_j() - self._counter_start_j
+            window = time.monotonic() - self._window_start
+            self._counter_start_j = None
+            return delta, window
+        if self._trace_stop is None or self._trace_thread is None:
+            raise RuntimeError("meter end() without begin()")
+        self._trace.append(
+            (
+                time.monotonic_ns(),
+                int(self._nvml.nvmlDeviceGetPowerUsage(self._handle)),
+            )
+        )
+        self._trace_stop.set()
+        self._trace_thread.join(timeout=5.0)
+        samples = self._trace
+        self._trace_stop = None
+        self._trace_thread = None
+        if len(samples) < 2:
+            raise RuntimeError(
+                "power-trace integration requires at least two samples"
+            )
+        if any(
+            right[0] <= left[0] for left, right in zip(samples, samples[1:])
+        ):
+            raise RuntimeError("power-trace timestamps must increase strictly")
+        energy_j = 0.0
+        for left, right in zip(samples, samples[1:]):
+            duration_s = (right[0] - left[0]) / 1_000_000_000.0
+            mean_power_w = (left[1] + right[1]) / 2000.0
+            energy_j += mean_power_w * duration_s
+        return energy_j, time.monotonic() - self._window_start
+
+
+def _measure_idle_power_w(
+    meters: Sequence[_BoardEnergyMeter],
+) -> tuple[float, ...]:
+    """Per-board idle draw as the minimum over several windows.
+
+    Idle power is a floor, so the minimum is the estimator that background
+    activity cannot inflate; an inflated leakage estimate would push small
+    phase dynamics negative and fail the measurement spuriously. Leakage is
+    kept per board because each meter's window spans that board's own
+    alignment and synchronization overhead.
+    """
+
+    samples: list[list[float]] = [[] for _ in meters]
+    for _ in range(IDLE_WINDOW_COUNT):
+        for meter in meters:
+            meter.begin()
+        time.sleep(IDLE_WINDOW_SECONDS)
+        for index, meter in enumerate(meters):
+            delta, window = meter.end()
+            samples[index].append(delta / window)
+    return tuple(min(values) for values in samples)
+
+
+def _measure_mac_rate(device: str) -> float:
+    """Compute-saturated BF16 GEMM rate (MAC/s) on the endpoint device.
+
+    Timed with the host clock between full device synchronizations; CUDA
+    events would need the endpoint device current to record on its stream,
+    and a mis-scoped event times kernel enqueue instead of execution.
+    """
+
+    import torch
+
+    size = 8192
+    left = torch.randn(size, size, dtype=torch.bfloat16, device=device)
+    right = torch.randn(size, size, dtype=torch.bfloat16, device=device)
+    for _ in range(3):
+        torch.matmul(left, right)
+    torch.cuda.synchronize(device)
+    iterations = 50
+    started = time.monotonic()
+    for _ in range(iterations):
+        torch.matmul(left, right)
+    torch.cuda.synchronize(device)
+    seconds = (time.monotonic() - started) / iterations
+    return size * size * size / seconds
+
+
+def _numerical_outcome(
+    *,
+    batch: int,
+    seed: int,
+    hidden_size: int,
+    driver_device: str,
+    endpoint_device: str,
+    weight_driver: Any,
+    weight_endpoint: Any,
+) -> dict[str, Any]:
+    """Compute the deterministic numerical outcome for one payload.
+
+    Computed once per payload so every repeat measurement of the same hidden
+    input carries the identical numerical identity the loader requires. The
+    driver-side reference and the endpoint service both apply the declared
+    policy: BF16 MAC inputs, FP32 accumulation, BF16 logits, argmax with the
+    lowest token id winning ties.
+    """
+
+    import torch
+
+    torch.backends.cuda.matmul.allow_bf16_reduced_precision_reduction = False
+    generator = torch.Generator(device="cpu").manual_seed(seed)
+    hidden_cpu = (
+        torch.randn(
+            batch, hidden_size, generator=generator, dtype=torch.float32
+        )
+        * 0.5
+    ).to(torch.bfloat16)
+    hidden_driver = hidden_cpu.to(driver_device)
+    reference_logits = torch.matmul(hidden_driver, weight_driver.T)
+    reference_tokens = torch.argmax(
+        reference_logits.to(torch.float32), dim=-1
+    ).to(torch.uint32)
+
+    hidden_endpoint = hidden_driver.to(endpoint_device)
+    service_logits_endpoint = torch.matmul(hidden_endpoint, weight_endpoint.T)
+    service_tokens_endpoint = torch.argmax(
+        service_logits_endpoint.to(torch.float32), dim=-1
+    ).to(torch.uint32)
+    service_logits = service_logits_endpoint.to(driver_device)
+    service_tokens = service_tokens_endpoint.to(driver_device)
+
+    difference = (
+        service_logits.to(torch.float32) - reference_logits.to(torch.float32)
+    ).abs()
+    reference_topk = torch.topk(
+        reference_logits.to(torch.float32), HEAD_VALIDATION_TOPK, dim=-1
+    ).indices
+    service_topk = torch.topk(
+        service_logits.to(torch.float32), HEAD_VALIDATION_TOPK, dim=-1
+    ).indices
+    agreements = []
+    for row in range(batch):
+        reference_set = set(reference_topk[row].tolist())
+        service_set = set(service_topk[row].tolist())
+        agreements.append(
+            len(reference_set & service_set) / HEAD_VALIDATION_TOPK
+        )
+    return {
+        "hidden_cpu": hidden_cpu,
+        "hidden_driver": hidden_driver,
+        "hidden_sha256": _tensor_sha256(hidden_cpu),
+        "reference_logits_sha256": _tensor_sha256(reference_logits),
+        "service_logits_sha256": _tensor_sha256(service_logits),
+        "reference_token_ids_sha256": _tensor_sha256(reference_tokens),
+        "service_token_ids_sha256": _tensor_sha256(service_tokens),
+        "logit_max_abs_error": float(difference.max()),
+        "logit_mean_abs_error": float(difference.mean()),
+        "topk_set_agreement": min(agreements),
+        "selected_tokens_equal": bool(
+            torch.equal(reference_tokens, service_tokens)
+        ),
+    }
+
+
+def _measure_payload(
+    *,
+    numerical: Mapping[str, Any],
+    batch: int,
+    driver_device: str,
+    endpoint_device: str,
+    weight_endpoint: Any,
+    meters: Sequence[_BoardEnergyMeter],
+    board_limits_w: Sequence[float],
+    leakages_w: Sequence[float],
+) -> tuple[PhaseSample, dict[str, dict[str, float]]]:
+    """Time and meter one payload across the serialized service phases.
+
+    Each board's meter window spans its own alignment and synchronization
+    overhead, so plausibility and leakage subtraction are per board over
+    that board's own window; per-iteration latency comes from CUDA events.
+    """
+
+    import torch
+
+    hidden_driver = numerical["hidden_driver"]
+    resolution: dict[str, dict[str, float]] = {}
+
+    def phase(operation: Any, label: str) -> tuple[float, float]:
+        iterations = INNER_ITERATIONS
+        while True:
+            for _ in range(WARMUP_ITERATIONS):
+                operation()
+            torch.cuda.synchronize(driver_device)
+            torch.cuda.synchronize(endpoint_device)
+            for meter in meters:
+                meter.begin()
+            # Host clock between full synchronizations: the amplified window
+            # is long enough that host-timer precision is ample, and it times
+            # execution across both devices rather than one stream's enqueue.
+            started = time.monotonic()
+            for _ in range(iterations):
+                operation()
+            torch.cuda.synchronize(driver_device)
+            torch.cuda.synchronize(endpoint_device)
+            wall = time.monotonic() - started
+            readings = [meter.end() for meter in meters]
+            for meter, (delta, window), limit in zip(
+                meters, readings, board_limits_w
+            ):
+                _check_phase_energy(
+                    delta_j=delta,
+                    wall_s=window,
+                    power_ceiling_w=POWER_PLAUSIBILITY_MARGIN * limit,
+                    label=f"{label} phase (batch {batch}) on {meter.label}",
+                )
+            delta_sum = sum(delta for delta, _ in readings)
+            seconds = wall / iterations
+            # The active window must span many counter update periods AND
+            # the summed delta must clear the resolution floor before the
+            # energy reading is trustworthy.
+            if wall >= MIN_ACTIVE_WINDOW_S and _phase_delta_sufficient(
+                delta_sum
+            ):
+                break
+            if iterations >= MAX_INNER_ITERATIONS:
+                raise RuntimeError(
+                    f"{label} phase (batch {batch}) cannot reach a "
+                    f"{MIN_ACTIVE_WINDOW_S} s window above the "
+                    f"{MIN_COUNTER_DELTA_J} J resolution floor at "
+                    f"{iterations} iterations (delta {delta_sum:.6f} J, "
+                    f"wall {wall:.6f} s)"
+                )
+            scale_target = max(
+                iterations * 2,
+                math.ceil(iterations * MIN_ACTIVE_WINDOW_S / max(wall, 1e-9)),
+            )
+            iterations = min(MAX_INNER_ITERATIONS, scale_target)
+        dynamic_total = sum(
+            delta - leakage * window
+            for (delta, window), leakage in zip(readings, leakages_w)
+        )
+        idle_energy = sum(
+            leakage * window
+            for (_, window), leakage in zip(readings, leakages_w)
+        )
+        resolved_total, below_resolution = _resolved_dynamic_energy(
+            dynamic_total_j=dynamic_total,
+            idle_energy_j=idle_energy,
+            label=f"{label} phase (batch {batch})",
+        )
+        dynamic = resolved_total / iterations
+        resolution[label] = {
+            "inner_iterations": float(iterations),
+            "counter_delta_j": float(delta_sum),
+            "meter_window_s": float(max(window for _, window in readings)),
+            "active_wall_s": float(wall),
+            "raw_dynamic_energy_j": float(dynamic_total),
+            "below_measurement_resolution": float(below_resolution),
+        }
+        return seconds, dynamic
+
+    request_latency, request_energy = phase(
+        lambda: hidden_driver.to(endpoint_device), "request"
+    )
+    hidden_endpoint = hidden_driver.to(endpoint_device)
+
+    def head_compute() -> Any:
+        return torch.matmul(hidden_endpoint, weight_endpoint.T)
+
+    head_latency, head_energy = phase(head_compute, "head_compute")
+    logits_endpoint = head_compute()
+
+    def selection() -> Any:
+        return torch.argmax(logits_endpoint.to(torch.float32), dim=-1)
+
+    selection_latency, selection_energy = phase(selection, "selection")
+    service_tokens_endpoint = selection().to(torch.uint32)
+
+    response_latency, response_energy = phase(
+        lambda: service_tokens_endpoint.to(driver_device), "response"
+    )
+
+    return PhaseSample(
+        batch=batch,
+        request_latency_s=request_latency,
+        head_compute_latency_s=head_latency,
+        selection_latency_s=selection_latency,
+        response_latency_s=response_latency,
+        link_energy_j=request_energy + response_energy,
+        head_compute_energy_j=head_energy,
+        selection_energy_j=selection_energy,
+        leakage_power_w=sum(leakages_w),
+        hidden_sha256=numerical["hidden_sha256"],
+        reference_logits_sha256=numerical["reference_logits_sha256"],
+        service_logits_sha256=numerical["service_logits_sha256"],
+        reference_token_ids_sha256=numerical["reference_token_ids_sha256"],
+        service_token_ids_sha256=numerical["service_token_ids_sha256"],
+        logit_max_abs_error=numerical["logit_max_abs_error"],
+        logit_mean_abs_error=numerical["logit_mean_abs_error"],
+        topk_set_agreement=numerical["topk_set_agreement"],
+        selected_tokens_equal=numerical["selected_tokens_equal"],
+    ), resolution
+
+
+def run_measurement(args: argparse.Namespace) -> int:
+    import pynvml
+    import torch
+
+    config = json.loads(Path(args.config).read_text(encoding="utf-8"))
+    architecture = config["model_architecture"]
+    hidden_size = int(architecture["hidden_size"])
+    vocab_size = int(architecture["vocab_size"])
+    required_batches = tuple(
+        sorted({int(value) for value in config["hardware_space"]["BATCH"]})
+    )
+    model = {
+        "model_name": str(config["model_name"]),
+        "model_revision": str(config["model_revision"]),
+        "hidden_size": hidden_size,
+        "vocab_size": vocab_size,
+        "tie_embeddings": bool(architecture["tie_word_embeddings"]),
+    }
+
+    if not torch.cuda.is_available() or torch.cuda.device_count() < 2:
+        raise SystemExit(
+            "the head-service measurement requires two CUDA devices: a "
+            "driver and a dedicated endpoint"
+        )
+    driver_index = int(args.driver_device.split(":")[1])
+    endpoint_index = int(args.endpoint_device.split(":")[1])
+    pynvml.nvmlInit()
+    driver_uuid_torch = str(
+        torch.cuda.get_device_properties(driver_index).uuid
+    )
+    endpoint_uuid_torch = str(
+        torch.cuda.get_device_properties(endpoint_index).uuid
+    )
+    driver_handle = _bind_nvml_handle_by_uuid(pynvml, driver_uuid_torch)
+    endpoint_handle = _bind_nvml_handle_by_uuid(pynvml, endpoint_uuid_torch)
+    board_limits_w = (
+        _enforced_power_limit_w(pynvml, driver_handle),
+        _enforced_power_limit_w(pynvml, endpoint_handle),
+    )
+
+    weight = _load_head_weight(config)
+    weight_sha256 = _tensor_sha256(weight)
+    weight_driver = weight.to(args.driver_device)
+    weight_endpoint = weight.to(args.endpoint_device)
+    torch.cuda.synchronize(args.driver_device)
+    torch.cuda.synchronize(args.endpoint_device)
+
+    _require_exclusive_compute(
+        pynvml, driver_handle, f"driver {args.driver_device}"
+    )
+    _require_exclusive_compute(
+        pynvml, endpoint_handle, f"endpoint {args.endpoint_device}"
+    )
+    meters = (
+        _BoardEnergyMeter(pynvml, driver_handle, f"driver {args.driver_device}"),
+        _BoardEnergyMeter(
+            pynvml, endpoint_handle, f"endpoint {args.endpoint_device}"
+        ),
+    )
+
+    leakages_w = _measure_idle_power_w(meters)
+    leakage = sum(leakages_w)
+    if leakage <= 0 or leakage > (
+        sum(board_limits_w) * IDLE_POWER_LIMIT_FRACTION
+    ):
+        raise SystemExit(
+            f"idle draw {leakage:.1f} W is outside the plausible idle band "
+            "for exclusively held boards; another workload is running or "
+            "the meter is faulty"
+        )
+    mac_rate = _measure_mac_rate(args.endpoint_device)
+
+    repeat_samples: list[PhaseSample] = []
+    holdout_samples: list[tuple[int, PhaseSample]] = []
+    phase_resolutions: dict[str, dict[str, dict[str, float]]] = {}
+    for batch in required_batches:
+        repeat_numerical = _numerical_outcome(
+            batch=batch,
+            seed=1_000 + batch,
+            hidden_size=hidden_size,
+            driver_device=args.driver_device,
+            endpoint_device=args.endpoint_device,
+            weight_driver=weight_driver,
+            weight_endpoint=weight_endpoint,
+        )
+        for repeat in range(REPEATS_PER_BATCH):
+            sample, resolution = _measure_payload(
+                numerical=repeat_numerical,
+                batch=batch,
+                driver_device=args.driver_device,
+                endpoint_device=args.endpoint_device,
+                weight_endpoint=weight_endpoint,
+                meters=meters,
+                board_limits_w=board_limits_w,
+                leakages_w=leakages_w,
+            )
+            repeat_samples.append(sample)
+            phase_resolutions[f"repeat-b{batch}-r{repeat}"] = resolution
+        for holdout in range(HOLDOUTS_PER_BATCH):
+            holdout_numerical = _numerical_outcome(
+                batch=batch,
+                seed=2_000_000 + batch * 100 + holdout,
+                hidden_size=hidden_size,
+                driver_device=args.driver_device,
+                endpoint_device=args.endpoint_device,
+                weight_driver=weight_driver,
+                weight_endpoint=weight_endpoint,
+            )
+            sample, resolution = _measure_payload(
+                numerical=holdout_numerical,
+                batch=batch,
+                driver_device=args.driver_device,
+                endpoint_device=args.endpoint_device,
+                weight_endpoint=weight_endpoint,
+                meters=meters,
+                board_limits_w=board_limits_w,
+                leakages_w=leakages_w,
+            )
+            holdout_samples.append((holdout, sample))
+            phase_resolutions[f"holdout-b{batch}-h{holdout}"] = resolution
+
+    protocol, service = fit_service_coefficients(
+        repeat_samples,
+        hidden_size=hidden_size,
+        vocab_size=vocab_size,
+        measured_bf16_mac_per_s=mac_rate,
+    )
+    service["head_weight_sha256"] = weight_sha256
+
+    measurements: list[dict[str, Any]] = []
+    repeat_counters: dict[int, int] = {}
+    for sample in repeat_samples:
+        index = repeat_counters.get(sample.batch, 0)
+        repeat_counters[sample.batch] = index + 1
+        measurements.append(
+            measurement_record(
+                sample,
+                measurement_id=f"repeat-b{sample.batch}-r{index}",
+                split="repeat",
+                repeat=index,
+                hidden_size=hidden_size,
+                vocab_size=vocab_size,
+                protocol=protocol,
+                service=service,
+            )
+        )
+    for holdout, sample in holdout_samples:
+        measurements.append(
+            measurement_record(
+                sample,
+                measurement_id=f"holdout-b{sample.batch}-h{holdout}",
+                split="holdout",
+                repeat=holdout,
+                hidden_size=hidden_size,
+                vocab_size=vocab_size,
+                protocol=protocol,
+                service=service,
+            )
+        )
+
+    repository = Path(__file__).resolve().parents[2]
+    try:
+        revision = subprocess.run(
+            ["git", "-C", str(repository), "rev-parse", "HEAD"],
+            capture_output=True,
+            text=True,
+            check=True,
+        ).stdout.strip()
+    except (OSError, subprocess.CalledProcessError):
+        revision = "unversioned-working-tree"
+    driver_name = pynvml.nvmlDeviceGetName(driver_handle)
+    endpoint_name = pynvml.nvmlDeviceGetName(endpoint_handle)
+    driver_uuid = pynvml.nvmlDeviceGetUUID(driver_handle)
+    endpoint_uuid = pynvml.nvmlDeviceGetUUID(endpoint_handle)
+    toolchain = {
+        "python": sys.version.split()[0],
+        "torch": torch.__version__,
+        "cuda": str(torch.version.cuda),
+        "driver": pynvml.nvmlSystemGetDriverVersion(),
+    }
+    provenance = {
+        "repository": "PLENA_Software",
+        "revision": revision,
+        "source_tree_sha256": _source_tree_sha256(
+            repository / "decode_dse" / "hardware"
+        ),
+        "command": [Path(sys.argv[0]).name, *sys.argv[1:]],
+        "toolchain": toolchain,
+        "environment_sha256": _content_hash(toolchain),
+        "link_id": f"{driver_name}:{driver_uuid}->" f"{endpoint_uuid}",
+        "head_service_id": f"{endpoint_name}:{endpoint_uuid}",
+        "process_corner": "measured_silicon",
+        "measured_at_utc": datetime.now(timezone.utc)
+        .isoformat()
+        .replace("+00:00", "Z"),
+        "measurement_resolution": {
+            "meter_methods": {
+                "driver": meters[0].method,
+                "endpoint": meters[1].method,
+            },
+            "board_power_limits_w": {
+                "driver": board_limits_w[0],
+                "endpoint": board_limits_w[1],
+            },
+            "power_plausibility_margin": POWER_PLAUSIBILITY_MARGIN,
+            "min_counter_delta_j": MIN_COUNTER_DELTA_J,
+            "min_active_window_s": MIN_ACTIVE_WINDOW_S,
+            "idle_power_w": {
+                "driver": leakages_w[0],
+                "endpoint": leakages_w[1],
+                "total": leakage,
+            },
+            "phase_windows": phase_resolutions,
+        },
+    }
+
+    document = assemble_artifact(
+        model=model,
+        protocol=protocol,
+        service=service,
+        required_batches=required_batches,
+        measurements=measurements,
+        provenance=provenance,
+    )
+    destination = Path(args.out).resolve()
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    seal_artifact(
+        document,
+        destination=destination,
+        model=model,
+        required_batches=required_batches,
+    )
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--driver-device", default="cuda:0")
+    parser.add_argument("--endpoint-device", default="cuda:1")
+    parser.add_argument("--out", required=True)
+    return parser
+
+
+def main() -> int:
+    args = build_parser().parse_args()
+    if args.driver_device == args.endpoint_device:
+        raise SystemExit(
+            "driver and endpoint must be distinct physical devices"
+        )
+    return run_measurement(args)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/decode_dse/hardware/packedkv_claims.py b/decode_dse/hardware/packedkv_claims.py
new file mode 100644
index 0000000..ada96cd
--- /dev/null
+++ b/decode_dse/hardware/packedkv_claims.py
@@ -0,0 +1,1658 @@
+"""Fail-closed publication gate for the PackedKV causal ablation."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import math
+import os
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+
+from decode_dse.hardware.lm_head_service import (
+    HEAD_SERVICE_MODE,
+    require_content_addressed_id,
+)
+
+PADDED_PER_HEAD = "padded_per_head"
+DENSE_COMPILER = "dense_compiler"
+DENSE_SELECTOR = "dense_selector"
+IDEAL_TRAFFIC = "ideal_traffic"
+PACKEDKV_MODES = (
+    PADDED_PER_HEAD,
+    DENSE_COMPILER,
+    DENSE_SELECTOR,
+    IDEAL_TRAFFIC,
+)
+REALIZED_BOTTLENECKS = ("memory", "serialization", "compute")
+ALGORITHMIC_BOTTLENECKS = ("memory", "compute")
+PRECISION_ROLES = ("i8", "i4", "selected")
+TOPOLOGY_ROLES = ("gqa1", "gqa4", "gqa8", "mqa")
+REQUIRED_PROVENANCE = (
+    "software",
+    "compiler",
+    "emulator",
+    "rtl",
+    "analytical",
+    "synthesis",
+)
+STEP_COMPOSITION = "max_compute_memory"
+TPOT_SCOPE = "whole_model_remote_bf16_head"
+CAPACITY_LIMITERS = ("hbm", "matrix_sram", "vector_sram", "isa_batch")
+CAPACITY_THROUGHPUT_SCOPES = (
+    "cross_stack_measured",
+    "analytical_projection",
+)
+EVIDENCE_SCHEMA = "packedkv-publication-evidence"
+REPORT_SCHEMA = "packedkv-publication-report"
+
+
+def _require_positive(name: str, value: float) -> None:
+    if not math.isfinite(value) or value <= 0:
+        raise ValueError(f"{name} must be positive and finite")
+
+
+def _require_nonnegative(name: str, value: float) -> None:
+    if not math.isfinite(value) or value < 0:
+        raise ValueError(f"{name} must be non-negative and finite")
+
+
+def _canonical_hash(value: Any) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _require_sha256(name: str, value: str) -> None:
+    if len(value) != 64 or any(
+        character not in "0123456789abcdef" for character in value
+    ):
+        raise ValueError(f"{name} must be a lowercase SHA-256 digest")
+
+
+def _close(left: float, right: float) -> bool:
+    return math.isclose(left, right, rel_tol=1e-9, abs_tol=1e-9)
+
+
+def _require_fields(
+    value: Mapping[str, Any],
+    expected: set[str],
+    name: str,
+) -> None:
+    if set(value) != expected:
+        raise ValueError(f"{name} fields differ")
+
+
+def _reject_duplicate_pairs(
+    pairs: Sequence[tuple[str, Any]],
+) -> dict[str, Any]:
+    value: dict[str, Any] = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError(f"duplicate JSON field {key!r}")
+        value[key] = item
+    return value
+
+
+def _aligned_bytes(bits: int, alignment_bytes: int) -> int:
+    raw_bytes = math.ceil(bits / 8)
+    return math.ceil(raw_bytes / alignment_bytes) * alignment_bytes
+
+
+def _unique_pairs(
+    values: Iterable[Sequence[str]],
+    *,
+    field_name: str,
+) -> tuple[tuple[str, str], ...]:
+    pairs = tuple(sorted((str(pair[0]), str(pair[1])) for pair in values))
+    if any(not key or not value for key, value in pairs):
+        raise ValueError(f"{field_name} keys and values must be non-empty")
+    if len({key for key, _ in pairs}) != len(pairs):
+        raise ValueError(f"{field_name} contains duplicate keys")
+    return pairs
+
+
+@dataclass(frozen=True)
+class PackedKVPrecision:
+    """One precision role and its physical element/scale representation."""
+
+    role: str
+    format_id: str
+    element_bits: int
+    scale_bits: int = 8
+    block_size: int = 8
+
+    def __post_init__(self) -> None:
+        if self.role not in PRECISION_ROLES:
+            raise ValueError(f"unknown precision role {self.role!r}")
+        if not self.format_id:
+            raise ValueError("format_id must be non-empty")
+        if self.element_bits <= 0 or self.scale_bits < 0 or self.block_size <= 0:
+            raise ValueError("precision widths and block size are invalid")
+        if self.block_size != 8:
+            raise ValueError(
+                "deployment evidence requires the native block size of eight"
+            )
+        if (
+            self.format_id.upper().startswith("MXINT")
+            and self.element_bits not in {2, 4, 8}
+        ):
+            raise ValueError("MXINT deployment evidence requires 2, 4, or 8 bits")
+        if self.role == "i8" and self.element_bits != 8:
+            raise ValueError("the i8 control must use eight element bits")
+        if self.role == "i4" and self.element_bits != 4:
+            raise ValueError("the i4 control must use four element bits")
+
+    @property
+    def effective_bits(self) -> float:
+        return self.element_bits + self.scale_bits / self.block_size
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "role": self.role,
+            "format_id": self.format_id,
+            "element_bits": self.element_bits,
+            "scale_bits": self.scale_bits,
+            "block_size": self.block_size,
+            "effective_bits": self.effective_bits,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PackedKVPrecision":
+        _require_fields(
+            value,
+            {
+                "role",
+                "format_id",
+                "element_bits",
+                "scale_bits",
+                "block_size",
+                "effective_bits",
+            },
+            "PackedKV precision",
+        )
+        result = cls(
+            role=str(value["role"]),
+            format_id=str(value["format_id"]),
+            element_bits=int(value["element_bits"]),
+            scale_bits=int(value.get("scale_bits", 8)),
+            block_size=int(value.get("block_size", 8)),
+        )
+        if not _close(result.effective_bits, float(value["effective_bits"])):
+            raise ValueError("PackedKV effective bits are inconsistent")
+        return result
+
+
+@dataclass(frozen=True)
+class AttentionTopology:
+    """One attention topology in the fixed PackedKV geometry."""
+
+    role: str
+    query_heads: int
+    kv_heads: int
+    head_dim: int
+    mlen: int = 1024
+
+    def __post_init__(self) -> None:
+        if self.role not in TOPOLOGY_ROLES:
+            raise ValueError(f"unknown topology role {self.role!r}")
+        for name in ("query_heads", "kv_heads", "head_dim", "mlen"):
+            if getattr(self, name) <= 0:
+                raise ValueError(f"{name} must be positive")
+        if self.query_heads % self.kv_heads:
+            raise ValueError("query heads must contain complete KV groups")
+        if self.head_dim > self.mlen or self.mlen % self.head_dim:
+            raise ValueError("MLEN must contain complete KV heads")
+        ratio = self.query_heads // self.kv_heads
+        expected_ratio = {"gqa1": 1, "gqa4": 4, "gqa8": 8}
+        if self.role in expected_ratio and ratio != expected_ratio[self.role]:
+            raise ValueError(f"{self.role} requires a {expected_ratio[self.role]}:1 ratio")
+        if self.role == "mqa" and (self.kv_heads != 1 or self.query_heads <= 1):
+            raise ValueError("mqa requires one KV head and multiple query heads")
+
+    @property
+    def active_elements(self) -> int:
+        return self.kv_heads * self.head_dim
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "role": self.role,
+            "query_heads": self.query_heads,
+            "kv_heads": self.kv_heads,
+            "head_dim": self.head_dim,
+            "mlen": self.mlen,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "AttentionTopology":
+        _require_fields(
+            value,
+            {"role", "query_heads", "kv_heads", "head_dim", "mlen"},
+            "attention topology",
+        )
+        return cls(
+            role=str(value["role"]),
+            query_heads=int(value["query_heads"]),
+            kv_heads=int(value["kv_heads"]),
+            head_dim=int(value["head_dim"]),
+            mlen=int(value.get("mlen", 1024)),
+        )
+
+
+@dataclass(frozen=True)
+class AblationEnvironment:
+    """Fields held constant across the causal layout comparison."""
+
+    model_id: str
+    model_revision: str
+    workload_id: str
+    geometry_id: str
+    numerical_reference_id: str
+    capacity_model_id: str
+    capacity_model_validated: bool
+    output_head_artifact_sha256: str
+    output_head_service_id: str
+    output_head_provenance_id: str
+    output_head_mode: str
+    tpot_scope: str
+    serving_execution_evidence_id: str
+    executable_batches: tuple[int, ...]
+    sequence_length: int
+    latency_batch: int
+    clock_hz: float
+    hbm_bandwidth_bytes_per_s: float
+    hbm_capacity_bytes: int
+    alignment_bytes: int = 64
+
+    def __post_init__(self) -> None:
+        for name in (
+            "model_id",
+            "model_revision",
+            "workload_id",
+            "geometry_id",
+            "numerical_reference_id",
+            "capacity_model_id",
+            "output_head_artifact_sha256",
+            "output_head_service_id",
+            "output_head_provenance_id",
+            "output_head_mode",
+            "tpot_scope",
+            "serving_execution_evidence_id",
+        ):
+            if not getattr(self, name):
+                raise ValueError(f"{name} must be non-empty")
+        require_content_addressed_id(
+            "numerical_reference_id",
+            self.numerical_reference_id,
+        )
+        require_content_addressed_id(
+            "capacity_model_id",
+            self.capacity_model_id,
+        )
+        _require_sha256(
+            "output_head_artifact_sha256",
+            self.output_head_artifact_sha256,
+        )
+        require_content_addressed_id(
+            "output_head_service_id",
+            self.output_head_service_id,
+            prefix="bf16-head-service-",
+        )
+        require_content_addressed_id(
+            "output_head_provenance_id",
+            self.output_head_provenance_id,
+            prefix="bf16-head-provenance-",
+        )
+        if self.output_head_mode != HEAD_SERVICE_MODE:
+            raise ValueError("PackedKV evidence requires the remote BF16 head")
+        if self.tpot_scope != TPOT_SCOPE:
+            raise ValueError("PackedKV TPOT must use the whole-model boundary")
+        if not isinstance(self.capacity_model_validated, bool):
+            raise TypeError("capacity_model_validated must be boolean")
+        require_content_addressed_id(
+            "serving_execution_evidence_id",
+            self.serving_execution_evidence_id,
+        )
+        batches = tuple(sorted(set(self.executable_batches)))
+        if (
+            not batches
+            or any(
+                isinstance(batch, bool)
+                or not isinstance(batch, int)
+                or batch <= 0
+                for batch in batches
+            )
+        ):
+            raise ValueError("executable_batches must be positive integers")
+        if self.latency_batch not in batches:
+            raise ValueError(
+                "fixed-batch TPOT requires cross-stack execution evidence"
+            )
+        object.__setattr__(self, "executable_batches", batches)
+        for name in (
+            "sequence_length",
+            "latency_batch",
+            "hbm_capacity_bytes",
+            "alignment_bytes",
+        ):
+            if getattr(self, name) <= 0:
+                raise ValueError(f"{name} must be positive")
+        _require_positive("clock_hz", self.clock_hz)
+        _require_positive(
+            "hbm_bandwidth_bytes_per_s",
+            self.hbm_bandwidth_bytes_per_s,
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "model_id": self.model_id,
+            "model_revision": self.model_revision,
+            "workload_id": self.workload_id,
+            "geometry_id": self.geometry_id,
+            "numerical_reference_id": self.numerical_reference_id,
+            "capacity_model_id": self.capacity_model_id,
+            "capacity_model_validated": self.capacity_model_validated,
+            "output_head_artifact_sha256": (
+                self.output_head_artifact_sha256
+            ),
+            "output_head_service_id": self.output_head_service_id,
+            "output_head_provenance_id": self.output_head_provenance_id,
+            "output_head_mode": self.output_head_mode,
+            "tpot_scope": self.tpot_scope,
+            "serving_execution_evidence_id": (
+                self.serving_execution_evidence_id
+            ),
+            "executable_batches": list(self.executable_batches),
+            "sequence_length": self.sequence_length,
+            "latency_batch": self.latency_batch,
+            "clock_hz": self.clock_hz,
+            "hbm_bandwidth_bytes_per_s": self.hbm_bandwidth_bytes_per_s,
+            "hbm_capacity_bytes": self.hbm_capacity_bytes,
+            "alignment_bytes": self.alignment_bytes,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "AblationEnvironment":
+        _require_fields(
+            value,
+            {
+                "model_id",
+                "model_revision",
+                "workload_id",
+                "geometry_id",
+                "numerical_reference_id",
+                "capacity_model_id",
+                "capacity_model_validated",
+                "output_head_artifact_sha256",
+                "output_head_service_id",
+                "output_head_provenance_id",
+                "output_head_mode",
+                "tpot_scope",
+                "serving_execution_evidence_id",
+                "executable_batches",
+                "sequence_length",
+                "latency_batch",
+                "clock_hz",
+                "hbm_bandwidth_bytes_per_s",
+                "hbm_capacity_bytes",
+                "alignment_bytes",
+            },
+            "ablation environment",
+        )
+        return cls(
+            model_id=str(value["model_id"]),
+            model_revision=str(value["model_revision"]),
+            workload_id=str(value["workload_id"]),
+            geometry_id=str(value["geometry_id"]),
+            numerical_reference_id=str(value["numerical_reference_id"]),
+            capacity_model_id=str(value["capacity_model_id"]),
+            capacity_model_validated=value["capacity_model_validated"],
+            output_head_artifact_sha256=str(
+                value["output_head_artifact_sha256"]
+            ),
+            output_head_service_id=str(value["output_head_service_id"]),
+            output_head_provenance_id=str(
+                value["output_head_provenance_id"]
+            ),
+            output_head_mode=str(value["output_head_mode"]),
+            tpot_scope=str(value["tpot_scope"]),
+            serving_execution_evidence_id=str(
+                value["serving_execution_evidence_id"]
+            ),
+            executable_batches=tuple(
+                int(batch) for batch in value["executable_batches"]
+            ),
+            sequence_length=int(value["sequence_length"]),
+            latency_batch=int(value["latency_batch"]),
+            clock_hz=float(value["clock_hz"]),
+            hbm_bandwidth_bytes_per_s=float(
+                value["hbm_bandwidth_bytes_per_s"]
+            ),
+            hbm_capacity_bytes=int(value["hbm_capacity_bytes"]),
+            alignment_bytes=int(value.get("alignment_bytes", 64)),
+        )
+
+
+@dataclass(frozen=True)
+class PackedKVModeMeasurement:
+    """Physical, numerical, and serving observations for one layout mode."""
+
+    mode: str
+    storage_bytes_per_sequence_token: int
+    read_bytes_per_sequence_token: int
+    write_bytes_per_appended_token: int
+    feasible_batch: int
+    tpot_ms: float
+    decoder_tpot_ms: float
+    head_service_tpot_ms: float
+    peak_compute_ms: float
+    ideal_compute_ms: float
+    realized_compute_ms: float
+    memory_ms: float
+    capacity_limited_tpot_ms: float
+    capacity_limited_tokens_per_s: float
+    capacity_limiter: str
+    capacity_throughput_scope: str
+    max_abs_error: float
+    max_rel_error: float
+    compared_values: int
+    numerical_evidence_id: str
+    timing_evidence_id: str
+    capacity_evidence_id: str
+    bottleneck: str
+    classical_roofline_bottleneck: str
+    architecture_issue_bottleneck: str
+    algorithmic_bottleneck: str
+    step_composition: str = STEP_COMPOSITION
+
+    def __post_init__(self) -> None:
+        if self.mode not in PACKEDKV_MODES:
+            raise ValueError(f"unknown PackedKV mode {self.mode!r}")
+        for name in (
+            "storage_bytes_per_sequence_token",
+            "read_bytes_per_sequence_token",
+            "write_bytes_per_appended_token",
+            "feasible_batch",
+            "compared_values",
+        ):
+            if getattr(self, name) <= 0:
+                raise ValueError(f"{name} must be positive")
+        _require_positive("tpot_ms", self.tpot_ms)
+        _require_positive("decoder_tpot_ms", self.decoder_tpot_ms)
+        _require_positive("head_service_tpot_ms", self.head_service_tpot_ms)
+        _require_positive("peak_compute_ms", self.peak_compute_ms)
+        _require_positive("ideal_compute_ms", self.ideal_compute_ms)
+        _require_positive("realized_compute_ms", self.realized_compute_ms)
+        _require_positive("memory_ms", self.memory_ms)
+        _require_positive(
+            "capacity_limited_tpot_ms",
+            self.capacity_limited_tpot_ms,
+        )
+        _require_positive(
+            "capacity_limited_tokens_per_s",
+            self.capacity_limited_tokens_per_s,
+        )
+        _require_nonnegative("max_abs_error", self.max_abs_error)
+        _require_nonnegative("max_rel_error", self.max_rel_error)
+        require_content_addressed_id(
+            "numerical_evidence_id",
+            self.numerical_evidence_id,
+        )
+        require_content_addressed_id(
+            "timing_evidence_id",
+            self.timing_evidence_id,
+            prefix="timing-",
+        )
+        require_content_addressed_id(
+            "capacity_evidence_id",
+            self.capacity_evidence_id,
+        )
+        if self.step_composition != STEP_COMPOSITION:
+            raise ValueError("PackedKV timing composition is unsupported")
+        if self.ideal_compute_ms < self.peak_compute_ms:
+            raise ValueError("ideal issue cannot beat the compute ceiling")
+        if self.realized_compute_ms < self.ideal_compute_ms:
+            raise ValueError("realized compute cannot beat the ideal issue time")
+        expected_decoder_tpot = max(
+            self.realized_compute_ms,
+            self.memory_ms,
+        )
+        if not _close(self.decoder_tpot_ms, expected_decoder_tpot):
+            raise ValueError("decoder TPOT differs from max(compute, memory)")
+        if not _close(
+            self.tpot_ms,
+            self.decoder_tpot_ms + self.head_service_tpot_ms,
+        ):
+            raise ValueError("whole-model TPOT omits the remote-head boundary")
+        expected_capacity_tps = (
+            self.feasible_batch * 1000.0 / self.capacity_limited_tpot_ms
+        )
+        if not _close(
+            self.capacity_limited_tokens_per_s,
+            expected_capacity_tps,
+        ):
+            raise ValueError("capacity throughput differs from batch/TPOT")
+        if self.capacity_limiter not in CAPACITY_LIMITERS:
+            raise ValueError("capacity_limiter is unsupported")
+        if self.capacity_throughput_scope not in CAPACITY_THROUGHPUT_SCOPES:
+            raise ValueError("capacity_throughput_scope is unsupported")
+        if self.bottleneck not in REALIZED_BOTTLENECKS:
+            raise ValueError(
+                f"unknown realized bottleneck {self.bottleneck!r}"
+            )
+        if self.algorithmic_bottleneck not in ALGORITHMIC_BOTTLENECKS:
+            raise ValueError(
+                "algorithmic bottleneck must be memory or compute"
+            )
+        if self.classical_roofline_bottleneck not in ALGORITHMIC_BOTTLENECKS:
+            raise ValueError(
+                "classical roofline bottleneck must be memory or compute"
+            )
+        if self.architecture_issue_bottleneck not in ALGORITHMIC_BOTTLENECKS:
+            raise ValueError(
+                "architecture issue bottleneck must be memory or compute"
+            )
+        expected_classical = (
+            "memory"
+            if self.memory_ms >= self.peak_compute_ms
+            else "compute"
+        )
+        expected_architecture = (
+            "memory"
+            if self.memory_ms >= self.ideal_compute_ms
+            else "compute"
+        )
+        expected_realized = (
+            "memory"
+            if self.memory_ms >= self.realized_compute_ms
+            else "serialization"
+            if (
+                expected_architecture == "memory"
+                and self.realized_compute_ms > self.ideal_compute_ms
+            )
+            else "compute"
+        )
+        if self.classical_roofline_bottleneck != expected_classical:
+            raise ValueError("classical roofline bottleneck differs from timing")
+        if self.architecture_issue_bottleneck != expected_architecture:
+            raise ValueError("architecture issue bottleneck differs from timing")
+        if self.algorithmic_bottleneck != expected_architecture:
+            raise ValueError("algorithmic bottleneck differs from timing")
+        if self.bottleneck != expected_realized:
+            raise ValueError("realized bottleneck differs from timing")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "mode": self.mode,
+            "storage_bytes_per_sequence_token": (
+                self.storage_bytes_per_sequence_token
+            ),
+            "read_bytes_per_sequence_token": self.read_bytes_per_sequence_token,
+            "write_bytes_per_appended_token": self.write_bytes_per_appended_token,
+            "feasible_batch": self.feasible_batch,
+            "tpot_ms": self.tpot_ms,
+            "decoder_tpot_ms": self.decoder_tpot_ms,
+            "head_service_tpot_ms": self.head_service_tpot_ms,
+            "peak_compute_ms": self.peak_compute_ms,
+            "ideal_compute_ms": self.ideal_compute_ms,
+            "realized_compute_ms": self.realized_compute_ms,
+            "memory_ms": self.memory_ms,
+            "step_composition": self.step_composition,
+            "capacity_limited_tpot_ms": self.capacity_limited_tpot_ms,
+            "capacity_limited_tokens_per_s": self.capacity_limited_tokens_per_s,
+            "capacity_limiter": self.capacity_limiter,
+            "capacity_throughput_scope": self.capacity_throughput_scope,
+            "max_abs_error": self.max_abs_error,
+            "max_rel_error": self.max_rel_error,
+            "compared_values": self.compared_values,
+            "numerical_evidence_id": self.numerical_evidence_id,
+            "timing_evidence_id": self.timing_evidence_id,
+            "capacity_evidence_id": self.capacity_evidence_id,
+            "bottleneck": self.bottleneck,
+            "classical_roofline_bottleneck": (
+                self.classical_roofline_bottleneck
+            ),
+            "architecture_issue_bottleneck": (
+                self.architecture_issue_bottleneck
+            ),
+            "algorithmic_bottleneck": self.algorithmic_bottleneck,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PackedKVModeMeasurement":
+        _require_fields(
+            value,
+            {
+                "mode",
+                "storage_bytes_per_sequence_token",
+                "read_bytes_per_sequence_token",
+                "write_bytes_per_appended_token",
+                "feasible_batch",
+                "tpot_ms",
+                "decoder_tpot_ms",
+                "head_service_tpot_ms",
+                "peak_compute_ms",
+                "ideal_compute_ms",
+                "realized_compute_ms",
+                "memory_ms",
+                "step_composition",
+                "capacity_limited_tpot_ms",
+                "capacity_limited_tokens_per_s",
+                "capacity_limiter",
+                "capacity_throughput_scope",
+                "max_abs_error",
+                "max_rel_error",
+                "compared_values",
+                "numerical_evidence_id",
+                "timing_evidence_id",
+                "capacity_evidence_id",
+                "bottleneck",
+                "classical_roofline_bottleneck",
+                "architecture_issue_bottleneck",
+                "algorithmic_bottleneck",
+            },
+            "PackedKV measurement",
+        )
+        return cls(
+            mode=str(value["mode"]),
+            storage_bytes_per_sequence_token=int(
+                value["storage_bytes_per_sequence_token"]
+            ),
+            read_bytes_per_sequence_token=int(
+                value["read_bytes_per_sequence_token"]
+            ),
+            write_bytes_per_appended_token=int(
+                value["write_bytes_per_appended_token"]
+            ),
+            feasible_batch=int(value["feasible_batch"]),
+            tpot_ms=float(value["tpot_ms"]),
+            decoder_tpot_ms=float(value["decoder_tpot_ms"]),
+            head_service_tpot_ms=float(value["head_service_tpot_ms"]),
+            peak_compute_ms=float(value["peak_compute_ms"]),
+            ideal_compute_ms=float(value["ideal_compute_ms"]),
+            realized_compute_ms=float(value["realized_compute_ms"]),
+            memory_ms=float(value["memory_ms"]),
+            step_composition=str(value["step_composition"]),
+            capacity_limited_tpot_ms=float(
+                value["capacity_limited_tpot_ms"]
+            ),
+            capacity_limited_tokens_per_s=float(
+                value["capacity_limited_tokens_per_s"]
+            ),
+            capacity_limiter=str(value["capacity_limiter"]),
+            capacity_throughput_scope=str(
+                value["capacity_throughput_scope"]
+            ),
+            max_abs_error=float(value["max_abs_error"]),
+            max_rel_error=float(value["max_rel_error"]),
+            compared_values=int(value["compared_values"]),
+            numerical_evidence_id=str(value["numerical_evidence_id"]),
+            timing_evidence_id=str(value["timing_evidence_id"]),
+            capacity_evidence_id=str(value["capacity_evidence_id"]),
+            bottleneck=str(value["bottleneck"]),
+            classical_roofline_bottleneck=str(
+                value["classical_roofline_bottleneck"]
+            ),
+            architecture_issue_bottleneck=str(
+                value["architecture_issue_bottleneck"]
+            ),
+            algorithmic_bottleneck=str(value["algorithmic_bottleneck"]),
+        )
+
+
+@dataclass(frozen=True)
+class PackedKVAblationGroup:
+    """The four causal modes for one precision and attention topology."""
+
+    precision: PackedKVPrecision
+    topology: AttentionTopology
+    measurements: tuple[PackedKVModeMeasurement, ...]
+
+    def __post_init__(self) -> None:
+        modes = [measurement.mode for measurement in self.measurements]
+        if len(modes) != len(set(modes)):
+            raise ValueError("an ablation group contains duplicate modes")
+
+    @property
+    def key(self) -> tuple[str, str]:
+        return self.precision.role, self.topology.role
+
+    def by_mode(self) -> dict[str, PackedKVModeMeasurement]:
+        return {measurement.mode: measurement for measurement in self.measurements}
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "precision": self.precision.to_dict(),
+            "topology": self.topology.to_dict(),
+            "measurements": [
+                measurement.to_dict() for measurement in self.measurements
+            ],
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PackedKVAblationGroup":
+        _require_fields(
+            value,
+            {"precision", "topology", "measurements"},
+            "PackedKV ablation group",
+        )
+        return cls(
+            precision=PackedKVPrecision.from_dict(value["precision"]),
+            topology=AttentionTopology.from_dict(value["topology"]),
+            measurements=tuple(
+                PackedKVModeMeasurement.from_dict(measurement)
+                for measurement in value["measurements"]
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class SelectorSynthesisEvidence:
+    """Common-corner selector-off/on synthesis comparison."""
+
+    baseline_area_mm2: float
+    selector_area_mm2: float
+    baseline_fmax_hz: float
+    selector_fmax_hz: float
+    constraint_ns: float
+    tool_id: str
+    library_id: str
+    process_corner: str
+    selector_off_report_hash: str
+    selector_on_report_hash: str
+    calibrated: bool
+
+    def __post_init__(self) -> None:
+        for name in (
+            "baseline_area_mm2",
+            "selector_area_mm2",
+            "baseline_fmax_hz",
+            "selector_fmax_hz",
+            "constraint_ns",
+        ):
+            _require_positive(name, float(getattr(self, name)))
+        for name in (
+            "tool_id",
+            "library_id",
+            "process_corner",
+        ):
+            if not getattr(self, name):
+                raise ValueError(f"{name} must be non-empty")
+        _require_sha256(
+            "selector_off_report_hash",
+            self.selector_off_report_hash,
+        )
+        _require_sha256(
+            "selector_on_report_hash",
+            self.selector_on_report_hash,
+        )
+        if self.selector_off_report_hash == self.selector_on_report_hash:
+            raise ValueError("selector-off/on synthesis reports must be distinct")
+        if not isinstance(self.calibrated, bool):
+            raise TypeError("selector calibration state must be boolean")
+
+    @property
+    def area_overhead(self) -> float:
+        return (self.selector_area_mm2 - self.baseline_area_mm2) / self.baseline_area_mm2
+
+    @property
+    def fmax_loss(self) -> float:
+        return (self.baseline_fmax_hz - self.selector_fmax_hz) / self.baseline_fmax_hz
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "baseline_area_mm2": self.baseline_area_mm2,
+            "selector_area_mm2": self.selector_area_mm2,
+            "baseline_fmax_hz": self.baseline_fmax_hz,
+            "selector_fmax_hz": self.selector_fmax_hz,
+            "constraint_ns": self.constraint_ns,
+            "tool_id": self.tool_id,
+            "library_id": self.library_id,
+            "process_corner": self.process_corner,
+            "selector_off_report_hash": self.selector_off_report_hash,
+            "selector_on_report_hash": self.selector_on_report_hash,
+            "calibrated": self.calibrated,
+            "area_overhead": self.area_overhead,
+            "fmax_loss": self.fmax_loss,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "SelectorSynthesisEvidence":
+        _require_fields(
+            value,
+            {
+                "baseline_area_mm2",
+                "selector_area_mm2",
+                "baseline_fmax_hz",
+                "selector_fmax_hz",
+                "constraint_ns",
+                "tool_id",
+                "library_id",
+                "process_corner",
+                "selector_off_report_hash",
+                "selector_on_report_hash",
+                "calibrated",
+                "area_overhead",
+                "fmax_loss",
+            },
+            "selector synthesis",
+        )
+        result = cls(
+            baseline_area_mm2=float(value["baseline_area_mm2"]),
+            selector_area_mm2=float(value["selector_area_mm2"]),
+            baseline_fmax_hz=float(value["baseline_fmax_hz"]),
+            selector_fmax_hz=float(value["selector_fmax_hz"]),
+            constraint_ns=float(value["constraint_ns"]),
+            tool_id=str(value["tool_id"]),
+            library_id=str(value["library_id"]),
+            process_corner=str(value["process_corner"]),
+            selector_off_report_hash=str(value["selector_off_report_hash"]),
+            selector_on_report_hash=str(value["selector_on_report_hash"]),
+            calibrated=value["calibrated"],
+        )
+        if not _close(result.area_overhead, float(value["area_overhead"])):
+            raise ValueError("selector area overhead is inconsistent")
+        if not _close(result.fmax_loss, float(value["fmax_loss"])):
+            raise ValueError("selector Fmax loss is inconsistent")
+        return result
+
+
+@dataclass(frozen=True)
+class PipelineValidationEvidence:
+    """Trace evidence required before TPOT is a headline outcome."""
+
+    overlap_validated: bool
+    compiler_trace_hash: str = ""
+    emulator_trace_hash: str = ""
+    rtl_trace_hash: str = ""
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.overlap_validated, bool):
+            raise TypeError("overlap_validated must be boolean")
+        traces = (
+            self.compiler_trace_hash,
+            self.emulator_trace_hash,
+            self.rtl_trace_hash,
+        )
+        if self.overlap_validated:
+            for name, value in zip(
+                (
+                    "compiler_trace_hash",
+                    "emulator_trace_hash",
+                    "rtl_trace_hash",
+                ),
+                traces,
+            ):
+                _require_sha256(name, value)
+        elif any(traces):
+            raise ValueError("unvalidated overlap cannot retain trace evidence")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "overlap_validated": self.overlap_validated,
+            "compiler_trace_hash": self.compiler_trace_hash,
+            "emulator_trace_hash": self.emulator_trace_hash,
+            "rtl_trace_hash": self.rtl_trace_hash,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PipelineValidationEvidence":
+        _require_fields(
+            value,
+            {
+                "overlap_validated",
+                "compiler_trace_hash",
+                "emulator_trace_hash",
+                "rtl_trace_hash",
+            },
+            "pipeline validation",
+        )
+        return cls(
+            overlap_validated=value["overlap_validated"],
+            compiler_trace_hash=str(value.get("compiler_trace_hash", "")),
+            emulator_trace_hash=str(value.get("emulator_trace_hash", "")),
+            rtl_trace_hash=str(value.get("rtl_trace_hash", "")),
+        )
+
+
+@dataclass(frozen=True)
+class PackedKVPublicationEvidence:
+    """Complete evidence bundle for one fixed causal ablation."""
+
+    environment: AblationEnvironment
+    groups: tuple[PackedKVAblationGroup, ...]
+    selector_synthesis: SelectorSynthesisEvidence
+    pipeline_validation: PipelineValidationEvidence
+    provenance: tuple[tuple[str, str], ...]
+    schema_version: str = EVIDENCE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != EVIDENCE_SCHEMA:
+            raise ValueError(f"unsupported evidence schema {self.schema_version!r}")
+        object.__setattr__(
+            self,
+            "provenance",
+            _unique_pairs(self.provenance, field_name="provenance"),
+        )
+        keys = [group.key for group in self.groups]
+        if len(keys) != len(set(keys)):
+            raise ValueError("evidence contains duplicate precision/topology groups")
+        for key, digest in self.provenance:
+            if key in REQUIRED_PROVENANCE:
+                _require_sha256(f"provenance.{key}", digest)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "environment": self.environment.to_dict(),
+            "groups": [group.to_dict() for group in self.groups],
+            "selector_synthesis": self.selector_synthesis.to_dict(),
+            "pipeline_validation": self.pipeline_validation.to_dict(),
+            "provenance": dict(self.provenance),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PackedKVPublicationEvidence":
+        _require_fields(
+            value,
+            {
+                "schema_version",
+                "environment",
+                "groups",
+                "selector_synthesis",
+                "pipeline_validation",
+                "provenance",
+            },
+            "PackedKV publication evidence",
+        )
+        provenance = value.get("provenance", {})
+        if not isinstance(provenance, Mapping):
+            raise ValueError("provenance must be an object")
+        return cls(
+            schema_version=str(value.get("schema_version", "")),
+            environment=AblationEnvironment.from_dict(value["environment"]),
+            groups=tuple(
+                PackedKVAblationGroup.from_dict(group)
+                for group in value["groups"]
+            ),
+            selector_synthesis=SelectorSynthesisEvidence.from_dict(
+                value["selector_synthesis"]
+            ),
+            pipeline_validation=PipelineValidationEvidence.from_dict(
+                value.get("pipeline_validation", {})
+            ),
+            provenance=tuple(
+                (str(key), str(item)) for key, item in provenance.items()
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class PackedKVGatePolicy:
+    """Thresholds for accepting a PackedKV publication claim."""
+
+    absolute_tolerance: float = 1e-5
+    relative_tolerance: float = 1e-5
+    byte_reduction: float = 7.5
+    selector_area_overhead: float = 0.01
+    selector_fmax_loss: float = 0.03
+    capacity_improvement: float = 2.0
+    tpot_improvement: float = 0.15
+    max_workload_regression: float = 0.02
+
+    def __post_init__(self) -> None:
+        for name, value in self.to_dict().items():
+            _require_nonnegative(name, value)
+        if self.byte_reduction < 1 or self.capacity_improvement < 1:
+            raise ValueError("reduction and capacity thresholds must be at least one")
+
+    def to_dict(self) -> dict[str, float]:
+        return {
+            "absolute_tolerance": self.absolute_tolerance,
+            "relative_tolerance": self.relative_tolerance,
+            "byte_reduction": self.byte_reduction,
+            "selector_area_overhead": self.selector_area_overhead,
+            "selector_fmax_loss": self.selector_fmax_loss,
+            "capacity_improvement": self.capacity_improvement,
+            "tpot_improvement": self.tpot_improvement,
+            "max_workload_regression": self.max_workload_regression,
+        }
+
+
+@dataclass(frozen=True)
+class PackedKVGateCheck:
+    name: str
+    passed: bool
+    observed: Any
+    requirement: str
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "passed": self.passed,
+            "observed": self.observed,
+            "requirement": self.requirement,
+        }
+
+
+@dataclass(frozen=True)
+class PackedKVPublicationReport:
+    """Derived headline outcome and every fail-closed gate."""
+
+    passed: bool
+    headline_outcome: str | None
+    checks: tuple[PackedKVGateCheck, ...]
+    evidence_hash: str
+    policy: PackedKVGatePolicy
+    reduction_by_precision: tuple[tuple[str, float], ...]
+    selected_capacity_improvement: float | None
+    selected_capacity_throughput_improvement: float | None
+    selected_capacity_throughput_scope: str | None
+    selected_tpot_improvement: float | None
+    maximum_regression: float | None
+    bottleneck_counts: tuple[tuple[str, int], ...]
+    classical_roofline_bottleneck_counts: tuple[tuple[str, int], ...]
+    architecture_issue_bottleneck_counts: tuple[tuple[str, int], ...]
+    algorithmic_bottleneck_counts: tuple[tuple[str, int], ...]
+    schema_version: str = REPORT_SCHEMA
+
+    @property
+    def failures(self) -> tuple[str, ...]:
+        return tuple(check.name for check in self.checks if not check.passed)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "passed": self.passed,
+            "headline_outcome": self.headline_outcome,
+            "checks": [check.to_dict() for check in self.checks],
+            "failures": list(self.failures),
+            "evidence_hash": self.evidence_hash,
+            "policy": self.policy.to_dict(),
+            "reduction_by_precision": dict(
+                self.reduction_by_precision
+            ),
+            "selected_capacity_improvement": self.selected_capacity_improvement,
+            "selected_capacity_throughput_improvement": (
+                self.selected_capacity_throughput_improvement
+            ),
+            "selected_capacity_throughput_scope": (
+                self.selected_capacity_throughput_scope
+            ),
+            "selected_tpot_improvement": self.selected_tpot_improvement,
+            "maximum_regression": self.maximum_regression,
+            "bottleneck_counts": dict(self.bottleneck_counts),
+            "classical_roofline_bottleneck_counts": dict(
+                self.classical_roofline_bottleneck_counts
+            ),
+            "architecture_issue_bottleneck_counts": dict(
+                self.architecture_issue_bottleneck_counts
+            ),
+            "algorithmic_bottleneck_counts": dict(
+                self.algorithmic_bottleneck_counts
+            ),
+            "report_id": self.report_id,
+        }
+
+    @property
+    def report_id(self) -> str:
+        content = {
+            "schema_version": self.schema_version,
+            "passed": self.passed,
+            "headline_outcome": self.headline_outcome,
+            "checks": [check.to_dict() for check in self.checks],
+            "evidence_hash": self.evidence_hash,
+            "policy": self.policy.to_dict(),
+        }
+        return f"packedkv-report-{_canonical_hash(content)}"
+
+
+def expected_packedkv_bytes(
+    precision: PackedKVPrecision,
+    topology: AttentionTopology,
+    alignment_bytes: int,
+    mode: str,
+) -> tuple[int, int, int]:
+    if topology.head_dim % precision.block_size:
+        raise ValueError("KV head dimension must contain complete precision blocks")
+    element_bytes = _aligned_bytes(
+        topology.mlen * precision.element_bits,
+        alignment_bytes,
+    )
+    scale_bytes = (
+        _aligned_bytes(
+            topology.mlen // precision.block_size * precision.scale_bits,
+            alignment_bytes,
+        )
+        if precision.scale_bits
+        else 0
+    )
+    row_bytes = element_bytes + scale_bytes
+    dense_rows = math.ceil(topology.active_elements / topology.mlen)
+    ideal_one_plane = math.ceil(
+        topology.active_elements * precision.effective_bits / 8
+    )
+    if mode == PADDED_PER_HEAD:
+        storage = topology.kv_heads * row_bytes
+        read = storage
+    elif mode == DENSE_COMPILER:
+        storage = dense_rows * row_bytes
+        read = topology.kv_heads * row_bytes
+    elif mode == DENSE_SELECTOR:
+        storage = dense_rows * row_bytes
+        read = storage
+    elif mode == IDEAL_TRAFFIC:
+        storage = ideal_one_plane
+        read = storage
+    else:
+        raise ValueError(f"unknown PackedKV mode {mode!r}")
+    # K and V occupy separate planes with identical layout.
+    return 2 * storage, 2 * read, 2 * storage
+
+
+def _geometric_mean(values: Sequence[float]) -> float | None:
+    if not values:
+        return None
+    if any(value <= 0 or not math.isfinite(value) for value in values):
+        return None
+    return math.exp(sum(math.log(value) for value in values) / len(values))
+
+
+def evaluate_packedkv_publication(
+    evidence: PackedKVPublicationEvidence,
+    policy: PackedKVGatePolicy = PackedKVGatePolicy(),
+) -> PackedKVPublicationReport:
+    """Validate the complete causal grid without inferring missing evidence."""
+
+    expected_keys = {
+        (precision, topology)
+        for precision in PRECISION_ROLES
+        for topology in TOPOLOGY_ROLES
+    }
+    groups = {group.key: group for group in evidence.groups}
+    grid_complete = set(groups) == expected_keys and all(
+        set(group.by_mode()) == set(PACKEDKV_MODES)
+        for group in evidence.groups
+    )
+
+    precision_definitions: dict[str, set[tuple[Any, ...]]] = {
+        role: set() for role in PRECISION_ROLES
+    }
+    topology_definitions: dict[str, set[tuple[Any, ...]]] = {
+        role: set() for role in TOPOLOGY_ROLES
+    }
+    for group in evidence.groups:
+        precision_definitions[group.precision.role].add(
+            (
+                group.precision.format_id,
+                group.precision.element_bits,
+                group.precision.scale_bits,
+                group.precision.block_size,
+            )
+        )
+        topology_definitions[group.topology.role].add(
+            (
+                group.topology.query_heads,
+                group.topology.kv_heads,
+                group.topology.head_dim,
+                group.topology.mlen,
+            )
+        )
+    definitions_consistent = (
+        all(len(values) == 1 for values in precision_definitions.values())
+        and all(len(values) == 1 for values in topology_definitions.values())
+    )
+    topology_values = [
+        next(iter(values))
+        for values in topology_definitions.values()
+        if values
+    ]
+    topology_sweep_consistent = bool(topology_values) and len(
+        {(value[0], value[2], value[3]) for value in topology_values}
+    ) == 1
+
+    byte_failures: list[str] = []
+    numerical_failures: list[str] = []
+    regressions: list[float] = []
+    bottlenecks: dict[str, int] = {}
+    classical_bottlenecks: dict[str, int] = {}
+    architecture_bottlenecks: dict[str, int] = {}
+    algorithmic_bottlenecks: dict[str, int] = {}
+    head_service_tpots: set[float] = set()
+    capacity_scope_failures: list[str] = []
+    for group in evidence.groups:
+        modes = group.by_mode()
+        for mode, measurement in modes.items():
+            expected = expected_packedkv_bytes(
+                group.precision,
+                group.topology,
+                evidence.environment.alignment_bytes,
+                mode,
+            )
+            observed = (
+                measurement.storage_bytes_per_sequence_token,
+                measurement.read_bytes_per_sequence_token,
+                measurement.write_bytes_per_appended_token,
+            )
+            if observed != expected:
+                byte_failures.append(
+                    f"{group.precision.role}/{group.topology.role}/{mode}"
+                )
+            if (
+                measurement.max_abs_error > policy.absolute_tolerance
+                or measurement.max_rel_error > policy.relative_tolerance
+            ):
+                numerical_failures.append(
+                    f"{group.precision.role}/{group.topology.role}/{mode}"
+                )
+            bottlenecks[measurement.bottleneck] = (
+                bottlenecks.get(measurement.bottleneck, 0) + 1
+            )
+            classical_bottlenecks[
+                measurement.classical_roofline_bottleneck
+            ] = (
+                classical_bottlenecks.get(
+                    measurement.classical_roofline_bottleneck,
+                    0,
+                )
+                + 1
+            )
+            architecture_bottlenecks[
+                measurement.architecture_issue_bottleneck
+            ] = (
+                architecture_bottlenecks.get(
+                    measurement.architecture_issue_bottleneck,
+                    0,
+                )
+                + 1
+            )
+            algorithmic_bottlenecks[measurement.algorithmic_bottleneck] = (
+                algorithmic_bottlenecks.get(
+                    measurement.algorithmic_bottleneck,
+                    0,
+                )
+                + 1
+            )
+            head_service_tpots.add(measurement.head_service_tpot_ms)
+            expected_scope = (
+                "cross_stack_measured"
+                if measurement.feasible_batch
+                in evidence.environment.executable_batches
+                else "analytical_projection"
+            )
+            if measurement.capacity_throughput_scope != expected_scope:
+                capacity_scope_failures.append(
+                    f"{group.precision.role}/{group.topology.role}/{mode}"
+                )
+        if PADDED_PER_HEAD in modes and DENSE_SELECTOR in modes:
+            regressions.append(
+                modes[DENSE_SELECTOR].tpot_ms / modes[PADDED_PER_HEAD].tpot_ms - 1
+            )
+
+    reductions: dict[str, float] = {}
+    for precision_role in PRECISION_ROLES:
+        group = groups.get((precision_role, "gqa8"))
+        if group is None:
+            continue
+        modes = group.by_mode()
+        if PADDED_PER_HEAD not in modes or DENSE_SELECTOR not in modes:
+            continue
+        padded = modes[PADDED_PER_HEAD]
+        selector = modes[DENSE_SELECTOR]
+        reductions[precision_role] = min(
+            padded.storage_bytes_per_sequence_token
+            / selector.storage_bytes_per_sequence_token,
+            padded.read_bytes_per_sequence_token
+            / selector.read_bytes_per_sequence_token,
+        )
+
+    selected_capacity: float | None = None
+    selected_capacity_tps: float | None = None
+    selected_capacity_tps_scope: str | None = None
+    capacity_group = groups.get(("selected", "gqa8"))
+    if capacity_group is not None:
+        modes = capacity_group.by_mode()
+        if PADDED_PER_HEAD in modes and DENSE_SELECTOR in modes:
+            selected_capacity = (
+                modes[DENSE_SELECTOR].feasible_batch
+                / modes[PADDED_PER_HEAD].feasible_batch
+            )
+            selected_capacity_tps = (
+                modes[DENSE_SELECTOR].capacity_limited_tokens_per_s
+                / modes[PADDED_PER_HEAD].capacity_limited_tokens_per_s
+            )
+            selected_capacity_tps_scope = (
+                "cross_stack_measured"
+                if (
+                    modes[PADDED_PER_HEAD].capacity_throughput_scope
+                    == "cross_stack_measured"
+                    and modes[DENSE_SELECTOR].capacity_throughput_scope
+                    == "cross_stack_measured"
+                )
+                else "analytical_projection"
+            )
+
+    selected_tpot_ratios: list[float] = []
+    for topology_role in TOPOLOGY_ROLES:
+        group = groups.get(("selected", topology_role))
+        if group is None:
+            continue
+        modes = group.by_mode()
+        if PADDED_PER_HEAD in modes and DENSE_SELECTOR in modes:
+            selected_tpot_ratios.append(
+                modes[DENSE_SELECTOR].tpot_ms / modes[PADDED_PER_HEAD].tpot_ms
+            )
+    tpot_ratio = _geometric_mean(selected_tpot_ratios)
+    selected_tpot = None if tpot_ratio is None else 1 - tpot_ratio
+    max_regression = max(regressions) if regressions else None
+
+    provenance = dict(evidence.provenance)
+    missing_provenance = tuple(
+        key for key in REQUIRED_PROVENANCE if not provenance.get(key)
+    )
+    area_overhead = evidence.selector_synthesis.area_overhead
+    fmax_loss = evidence.selector_synthesis.fmax_loss
+    capacity_feasibility_passed = (
+        evidence.environment.capacity_model_validated
+        and selected_capacity is not None
+        and selected_capacity >= policy.capacity_improvement
+        and capacity_group is not None
+        and capacity_group.by_mode()[PADDED_PER_HEAD].capacity_limiter == "hbm"
+    )
+    capacity_throughput_passed = (
+        capacity_feasibility_passed
+        and selected_capacity_tps_scope == "cross_stack_measured"
+        and selected_capacity_tps is not None
+        and selected_capacity_tps > 1.0
+    )
+    tpot_passed = (
+        evidence.pipeline_validation.overlap_validated
+        and selected_tpot is not None
+        and selected_tpot >= policy.tpot_improvement
+    )
+    candidate_headline = (
+        "capacity_throughput"
+        if capacity_throughput_passed
+        else "analytical_capacity"
+        if capacity_feasibility_passed
+        else "trace_validated_tpot"
+        if tpot_passed
+        else None
+    )
+
+    checks = (
+        PackedKVGateCheck(
+            "fixed_remote_head_boundary",
+            len(head_service_tpots) == 1
+            and evidence.environment.output_head_mode == HEAD_SERVICE_MODE
+            and evidence.environment.tpot_scope == TPOT_SCOPE,
+            {
+                "service_mode": evidence.environment.output_head_mode,
+                "scope": evidence.environment.tpot_scope,
+                "fixed_batch_head_tpot_ms": sorted(head_service_tpots),
+            },
+            "all fixed-batch layout points use one calibrated remote BF16 head",
+        ),
+        PackedKVGateCheck(
+            "capacity_throughput_scope",
+            not capacity_scope_failures,
+            {
+                "executable_batches": list(
+                    evidence.environment.executable_batches
+                ),
+                "mismatches": capacity_scope_failures,
+            },
+            (
+                "throughput is measured only at compiler/emulator/RTL "
+                "validated serving batches"
+            ),
+        ),
+        PackedKVGateCheck(
+            "complete_causal_grid",
+            grid_complete,
+            {
+                "groups": len(groups),
+                "measurements": sum(
+                    len(group.measurements) for group in evidence.groups
+                ),
+                "missing_groups": [
+                    f"{precision}/{topology}"
+                    for precision, topology in sorted(expected_keys - set(groups))
+                ],
+            },
+            "three precision roles × four topologies × four modes",
+        ),
+        PackedKVGateCheck(
+            "fixed_precision_and_topology_definitions",
+            definitions_consistent and topology_sweep_consistent,
+            {
+                "precision_consistent": definitions_consistent,
+                "query_head_dimension_mlen_fixed": topology_sweep_consistent,
+            },
+            "each role is immutable and only the KV-head count changes",
+        ),
+        PackedKVGateCheck(
+            "physical_byte_accounting",
+            not byte_failures,
+            {"mismatches": byte_failures},
+            "element and scale planes match aligned physical bytes exactly",
+        ),
+        PackedKVGateCheck(
+            "numerical_equivalence",
+            not numerical_failures and grid_complete,
+            {"mismatches": numerical_failures},
+            (
+                f"absolute error <= {policy.absolute_tolerance:g} and "
+                f"relative error <= {policy.relative_tolerance:g}"
+            ),
+        ),
+        PackedKVGateCheck(
+            "capacity_model_validated",
+            evidence.environment.capacity_model_validated,
+            {
+                "validated": evidence.environment.capacity_model_validated,
+                "model_id": evidence.environment.capacity_model_id,
+            },
+            "feasible-batch evidence comes from a validated physical-capacity model",
+        ),
+        PackedKVGateCheck(
+            "byte_reduction",
+            set(reductions) == set(PRECISION_ROLES)
+            and all(
+                reduction >= policy.byte_reduction
+                for reduction in reductions.values()
+            ),
+            reductions,
+            (
+                f"storage and read reduction >= {policy.byte_reduction:g}x "
+                "for the declared GQA8 evidence topology"
+            ),
+        ),
+        PackedKVGateCheck(
+            "selector_synthesis_calibrated",
+            evidence.selector_synthesis.calibrated,
+            evidence.selector_synthesis.calibrated,
+            "selector-off/on reports use the declared common synthesis setup",
+        ),
+        PackedKVGateCheck(
+            "selector_area_overhead",
+            area_overhead < policy.selector_area_overhead,
+            area_overhead,
+            f"area overhead < {policy.selector_area_overhead:.1%}",
+        ),
+        PackedKVGateCheck(
+            "selector_fmax_loss",
+            fmax_loss < policy.selector_fmax_loss,
+            fmax_loss,
+            f"Fmax loss < {policy.selector_fmax_loss:.1%}",
+        ),
+        PackedKVGateCheck(
+            "no_workload_regression",
+            max_regression is not None
+            and max_regression <= policy.max_workload_regression,
+            max_regression,
+            f"selector TPOT regression <= {policy.max_workload_regression:.1%}",
+        ),
+        PackedKVGateCheck(
+            "headline_serving_outcome",
+            candidate_headline is not None,
+            {
+                "outcome": candidate_headline,
+                "capacity_improvement": selected_capacity,
+                "capacity_limited_tps_improvement": selected_capacity_tps,
+                "capacity_throughput_scope": selected_capacity_tps_scope,
+                "tpot_improvement": selected_tpot,
+                "pipeline_overlap_validated": (
+                    evidence.pipeline_validation.overlap_validated
+                ),
+            },
+            (
+                f"capacity >= {policy.capacity_improvement:g}x with higher "
+                "cross-stack capacity throughput from an HBM-limited "
+                "baseline, an explicitly analytical capacity-only result, "
+                "or TPOT improves >= "
+                f"{policy.tpot_improvement:.1%} with cross-stack overlap traces"
+            ),
+        ),
+        PackedKVGateCheck(
+            "complete_provenance",
+            not missing_provenance
+            and set(provenance) == set(REQUIRED_PROVENANCE),
+            {
+                "missing": list(missing_provenance),
+                "unexpected": sorted(
+                    set(provenance) - set(REQUIRED_PROVENANCE)
+                ),
+            },
+            "all implementation, model, and synthesis inputs are content-addressed",
+        ),
+    )
+    evidence_hash = _canonical_hash(evidence.to_dict())
+    passed = all(check.passed for check in checks)
+    return PackedKVPublicationReport(
+        passed=passed,
+        headline_outcome=candidate_headline if passed else None,
+        checks=checks,
+        evidence_hash=evidence_hash,
+        policy=policy,
+        reduction_by_precision=tuple(sorted(reductions.items())),
+        selected_capacity_improvement=selected_capacity,
+        selected_capacity_throughput_improvement=selected_capacity_tps,
+        selected_capacity_throughput_scope=selected_capacity_tps_scope,
+        selected_tpot_improvement=selected_tpot,
+        maximum_regression=max_regression,
+        bottleneck_counts=tuple(sorted(bottlenecks.items())),
+        classical_roofline_bottleneck_counts=tuple(
+            sorted(classical_bottlenecks.items())
+        ),
+        architecture_issue_bottleneck_counts=tuple(
+            sorted(architecture_bottlenecks.items())
+        ),
+        algorithmic_bottleneck_counts=tuple(
+            sorted(algorithmic_bottlenecks.items())
+        ),
+    )
+
+
+def load_packedkv_evidence(path: Path | str) -> PackedKVPublicationEvidence:
+    value = json.loads(
+        Path(path).read_text(encoding="utf-8"),
+        object_pairs_hook=_reject_duplicate_pairs,
+    )
+    if not isinstance(value, Mapping):
+        raise ValueError("PackedKV evidence must be a JSON object")
+    return PackedKVPublicationEvidence.from_dict(value)
+
+
+def write_packedkv_report(
+    report: PackedKVPublicationReport,
+    path: Path | str,
+) -> None:
+    """Write a report atomically so interrupted validation cannot look complete."""
+
+    target = Path(path)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary_name = tempfile.mkstemp(
+        prefix=f".{target.name}.",
+        suffix=".tmp",
+        dir=target.parent,
+    )
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            json.dump(
+                report.to_dict(),
+                handle,
+                sort_keys=True,
+                indent=2,
+                allow_nan=False,
+            )
+            handle.write("\n")
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temporary_name, target)
+    except BaseException:
+        try:
+            os.unlink(temporary_name)
+        except FileNotFoundError:
+            pass
+        raise
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Validate a complete PackedKV causal-ablation artifact."
+    )
+    parser.add_argument("--evidence", required=True, type=Path)
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args(argv)
+    report = evaluate_packedkv_publication(load_packedkv_evidence(args.evidence))
+    write_packedkv_report(report, args.output)
+    print(
+        json.dumps(
+            {
+                "passed": report.passed,
+                "headline_outcome": report.headline_outcome,
+                "failures": report.failures,
+                "report_id": report.report_id,
+            },
+            sort_keys=True,
+        )
+    )
+    return 0 if report.passed else 2
+
+
+__all__ = [
+    "AblationEnvironment",
+    "AttentionTopology",
+    "DENSE_COMPILER",
+    "DENSE_SELECTOR",
+    "EVIDENCE_SCHEMA",
+    "IDEAL_TRAFFIC",
+    "PACKEDKV_MODES",
+    "PADDED_PER_HEAD",
+    "PackedKVAblationGroup",
+    "PackedKVGateCheck",
+    "PackedKVGatePolicy",
+    "PackedKVModeMeasurement",
+    "PackedKVPrecision",
+    "PackedKVPublicationEvidence",
+    "PackedKVPublicationReport",
+    "PipelineValidationEvidence",
+    "SelectorSynthesisEvidence",
+    "evaluate_packedkv_publication",
+    "expected_packedkv_bytes",
+    "load_packedkv_evidence",
+    "write_packedkv_report",
+]
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/decode_dse/hardware/power_bridge.py b/decode_dse/hardware/power_bridge.py
new file mode 100644
index 0000000..ad71ba1
--- /dev/null
+++ b/decode_dse/hardware/power_bridge.py
@@ -0,0 +1,184 @@
+"""Bridge simulator traffic and timing into the analytic decode-energy model."""
+
+from __future__ import annotations
+
+import importlib
+import math
+import os
+import sys
+from pathlib import Path
+from typing import Any, Mapping
+
+from decode_dse.hardware.design_space import CalibratedEnergy, HardwareCandidate
+
+
+def _simulator_module(name: str):
+    default_root = Path(__file__).resolve().parents[3] / "PLENA_Simulator"
+    root = Path(os.environ.get("PLENA_SIMULATOR_PATH", default_root)).resolve()
+    source = root / "analytic_models" / "disagg_serve"
+    if not source.is_dir():
+        raise FileNotFoundError(f"simulator energy models are missing: {source}")
+    token = str(root)
+    if token not in sys.path:
+        sys.path.insert(0, token)
+    return importlib.import_module(f"analytic_models.disagg_serve.{name}")
+
+
+def analytic_power_provenance() -> dict[str, Any]:
+    """Return the coefficient identity and declared evidence scopes."""
+
+    model = _simulator_module("decode_power")
+    return {
+        "engine": "decode_analytic_power_bridge",
+        "energy_tier": model.ANALYTIC_ENERGY_TIER,
+        "energy_id": model.analytic_energy_identity(),
+        "sram": dict(model.SRAM_ENERGY_SOURCE),
+        "leakage": dict(model.LEAKAGE_SOURCE),
+        "link": dict(model.LINK_ENERGY_SOURCE),
+        "sram_access_accounting": (
+            "HBM fills plus four vector-workspace reads and one write per step"
+        ),
+    }
+
+
+def hbm_peak_bandwidth_bytes_per_s(
+    generation: str,
+    interface_units: int,
+) -> float:
+    """Return peak bandwidth for the versioned HBM operating point."""
+
+    if interface_units <= 0:
+        raise ValueError("interface_units must be positive")
+    technology = _simulator_module("hbm_technology").hbm_technology(
+        generation
+    )
+    return (
+        interface_units
+        * 64.0
+        * float(technology.pin_rate_gbps)
+        * 1e9
+        / 8.0
+    )
+
+
+def _traffic_rates(
+    observation: Any,
+) -> tuple[float, float]:
+    values = dict(observation.hbm_traffic_per_generated_token)
+    if not values:
+        raise ValueError("analytic energy requires physical HBM traffic")
+    read_per_token = sum(
+        float(value)
+        for name, value in values.items()
+        if name.endswith("_read_bytes")
+    )
+    write_per_token = sum(
+        float(value)
+        for name, value in values.items()
+        if name.endswith("_write_bytes")
+    )
+    if min(read_per_token, write_per_token) < 0:
+        raise ValueError("physical HBM traffic must be non-negative")
+    return (
+        read_per_token * float(observation.tps),
+        write_per_token * float(observation.tps),
+    )
+
+
+def analytic_energy_from_simulator(
+    *,
+    candidate: HardwareCandidate,
+    observation: Any,
+    mac_bits: int,
+    per_chip_logic_area_mm2: float,
+    collective_bytes_per_generated_token: float,
+    link_generation: str = "nvlink4",
+) -> CalibratedEnergy:
+    """Return rankable analytic energy per generated token.
+
+    HBM and link traffic are aggregate-system values.  Logic geometry, SRAM
+    traffic and HBM capacity are converted to per-chip inputs before the power
+    model applies ``chip_count`` exactly once.
+    """
+
+    model = _simulator_module("decode_power")
+    hbm = _simulator_module("hbm_technology")
+    if mac_bits <= 0:
+        raise ValueError("mac_bits must be positive")
+    if per_chip_logic_area_mm2 <= 0 or not math.isfinite(
+        per_chip_logic_area_mm2
+    ):
+        raise ValueError("per-chip logic area must be finite and positive")
+    if (
+        collective_bytes_per_generated_token < 0
+        or not math.isfinite(collective_bytes_per_generated_token)
+    ):
+        raise ValueError("collective bytes must be finite and non-negative")
+    read_rate, write_rate = _traffic_rates(observation)
+    chip_count = candidate.chip_count
+    step_rate = float(observation.tps) / candidate.batch
+    vector_workspace_rate = (
+        float(observation.vector_sram_required_bytes) * step_rate
+    )
+    sram_read_rate_per_chip = (
+        read_rate + 4.0 * vector_workspace_rate
+    ) / chip_count
+    sram_write_rate_per_chip = (
+        read_rate + write_rate + vector_workspace_rate
+    ) / chip_count
+    active_fraction = min(
+        1.0,
+        float(observation.avg_realized_compute_seconds)
+        / (float(observation.tpot_ms) / 1000.0),
+    )
+    estimate = model.decode_power(
+        hbm.hbm_technology(candidate.hbm_generation),
+        capacity_bytes=(
+            float(observation.capacity.available_bytes) / chip_count
+        ),
+        read_bytes_per_second=read_rate / chip_count,
+        write_bytes_per_second=write_rate / chip_count,
+        multipliers=candidate.mlen * candidate.blen,
+        clock_hz=1.0e9,
+        mac_bits=mac_bits,
+        array_active_fraction=active_fraction,
+        tokens_per_second=float(observation.tps),
+        chip_count=chip_count,
+        sram_read_bytes_per_second=sram_read_rate_per_chip,
+        sram_write_bytes_per_second=sram_write_rate_per_chip,
+        logic_area_mm2=per_chip_logic_area_mm2,
+        link_bytes_per_second=(
+            collective_bytes_per_generated_token
+            * float(observation.tps)
+        ),
+        link_generation=link_generation,
+        token_latency_s=float(observation.tpot_ms) / 1000.0,
+    )
+    if estimate.tokens_per_second <= 0:
+        raise ValueError("analytic energy requires positive throughput")
+    per_token = 1.0 / estimate.tokens_per_second
+    duration = (
+        float(observation.tpot_ms)
+        / 1000.0
+        / int(observation.generated_tokens_per_step)
+    )
+    return CalibratedEnergy(
+        calibration_id=str(estimate.energy_id),
+        energy_id=str(estimate.energy_id),
+        energy_tier=str(estimate.energy_tier),
+        compute_j=estimate.compute_watts * per_token,
+        vector_j=0.0,
+        sram_j=estimate.sram_watts * per_token,
+        hbm_j=estimate.memory_watts * per_token,
+        leakage_j=estimate.leakage_watts * per_token,
+        link_j=estimate.link_watts * per_token,
+        duration_s=duration,
+        token_latency_s=float(observation.tpot_ms) / 1000.0,
+    )
+
+
+__all__ = [
+    "analytic_energy_from_simulator",
+    "analytic_power_provenance",
+    "hbm_peak_bandwidth_bytes_per_s",
+]
diff --git a/decode_dse/hardware/power_model.py b/decode_dse/hardware/power_model.py
new file mode 100644
index 0000000..40a56d9
--- /dev/null
+++ b/decode_dse/hardware/power_model.py
@@ -0,0 +1,1104 @@
+"""Schema-checked bridge to calibrated simulator power artifacts."""
+
+from __future__ import annotations
+
+import hashlib
+import itertools
+import json
+import math
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+from decode_dse.hardware.design_space import CalibratedEnergy
+from decode_dse.profiles import DecodePrecisionProfile
+
+SUPPORTED_POWER_MODEL_VERSIONS = ("plena-event-power-v4",)
+EXPECTED_CALIBRATION_MANIFEST_HASH = (
+    "baad3cf6e7648069f2121b06475eda40000cd6c9a069c6534c3137a00b0eb241"
+)
+EXPECTED_POWER_INTERPOLATION_DOMAIN = {
+    "mlen_min": 16,
+    "mlen_max": 64,
+    "blen_min": 4,
+    "blen_max": 16,
+}
+EXPECTED_HARDWARE_FP_BINDING = "FP_E6M5"
+EXPECTED_FIT_SUMMARY = {
+    "complete_rows": 502,
+    "train_rows": 332,
+    "holdout_rows": 170,
+    "signature_count": 80,
+    "structural_area_signature_count": 72,
+    "vector_area_signature_count": 7,
+    "coverage_failures": 0,
+}
+SELECTOR_SIGNATURE = "SELECTOR:PACKED_KV"
+STRUCTURAL_AREA_SCHEMA = "plena-structural-area-evidence"
+STRUCTURAL_AREA_MODEL_VERSION = "matrix_structural_census"
+STRUCTURAL_FEATURES = (
+    "pe_tl",
+    "pe_sum",
+    "pe_0",
+    "reduce",
+    "scale",
+    "out",
+    "fixed",
+    "const",
+)
+REQUIRED_STRUCTURAL_AREA_SOURCES = frozenset(
+    {
+        "matrix_structural_coefficients.json",
+        "asap7_sram_macro_table.csv",
+        "matrix_machine_mxint.csv",
+        "matrix_machine_mxfp.csv",
+    }
+)
+MXINT_WEIGHT_FORMATS = ("MXINT4", "MXINT8")
+MXINT_OPERAND_FORMATS = ("MXINT2", "MXINT4", "MXINT8")
+MXFP_HARDWARE_FORMATS = ("E1M2", "E2M1", "E4M3", "E5M2")
+VECTOR_HARDWARE_FORMATS = (
+    "FP_E3M2",
+    "FP_E2M3",
+    "FP_E6M5",
+    "FP_E5M6",
+    "FP_E4M7",
+    "FP_E8M5",
+    "BF16",
+)
+
+
+def _simulator_token(token: str) -> str:
+    if token.startswith("MXINT"):
+        return token
+    if token.startswith("E"):
+        return f"MXFP_{token}"
+    return token
+
+
+def required_profile_power_signatures(
+    profile: DecodePrecisionProfile,
+) -> tuple[str, ...]:
+    """Return the calibrated operation signatures used by one profile."""
+
+    weight = _simulator_token(profile.weight_format)
+    activation = _simulator_token(profile.activation_format)
+    key = _simulator_token(profile.key_format)
+    value = _simulator_token(profile.value_format)
+    return tuple(
+        sorted(
+            {
+                f"LINEAR:{weight}x{activation}",
+                f"QK:{key}x{activation}",
+                f"PV:{value}x{activation}",
+                f"VECTOR:{profile.vector_format}",
+                SELECTOR_SIGNATURE,
+            }
+        )
+    )
+
+
+def required_hardware_power_signatures() -> tuple[str, ...]:
+    """Return complete matrix and vector calibration coverage."""
+
+    linear = {
+        f"LINEAR:{weight}x{activation}"
+        for weight, activation in itertools.product(
+            MXINT_WEIGHT_FORMATS,
+            MXINT_OPERAND_FORMATS,
+        )
+    }
+    qk = {
+        f"QK:{kv}x{activation}"
+        for kv, activation in itertools.product(
+            MXINT_OPERAND_FORMATS,
+            MXINT_OPERAND_FORMATS,
+        )
+    }
+    pv = {
+        f"PV:{kv}x{activation}"
+        for kv, activation in itertools.product(
+            MXINT_OPERAND_FORMATS,
+            MXINT_OPERAND_FORMATS,
+        )
+    }
+    mxfp = tuple(_simulator_token(token) for token in MXFP_HARDWARE_FORMATS)
+    linear.update(
+        f"LINEAR:{weight}x{activation}"
+        for weight, activation in itertools.product(mxfp, mxfp)
+    )
+    qk.update(
+        f"QK:{kv}x{activation}"
+        for kv, activation in itertools.product(mxfp, mxfp)
+    )
+    pv.update(
+        f"PV:{kv}x{activation}"
+        for kv, activation in itertools.product(mxfp, mxfp)
+    )
+    vector = {f"VECTOR:{token}" for token in VECTOR_HARDWARE_FORMATS}
+    return tuple(sorted(linear | qk | pv | vector | {SELECTOR_SIGNATURE}))
+
+
+@dataclass(frozen=True)
+class SimulatorPowerStatus:
+    """Validated state of one simulator power-calibration artifact."""
+
+    source_path: Path
+    source_sha256: str
+    model_version: str
+    provenance_hash: str
+    required_signatures: tuple[str, ...]
+    available_signatures: tuple[str, ...]
+    missing_signatures: tuple[str, ...]
+    failures: tuple[str, ...]
+    raw: Mapping[str, Any]
+
+    @property
+    def passed(self) -> bool:
+        return not self.failures and not self.missing_signatures
+
+    @property
+    def calibration_id(self) -> str:
+        content = (
+            f"{self.model_version}:{self.provenance_hash}:"
+            f"{self.source_sha256}:"
+            f"{','.join(self.required_signatures)}"
+        ).encode("utf-8")
+        return f"sim-power-{hashlib.sha256(content).hexdigest()}"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "source_path": str(self.source_path),
+            "source_sha256": self.source_sha256,
+            "model_version": self.model_version,
+            "provenance_hash": self.provenance_hash,
+            "required_signatures": list(self.required_signatures),
+            "available_signatures": list(self.available_signatures),
+            "missing_signatures": list(self.missing_signatures),
+            "failures": list(self.failures),
+            "passed": self.passed,
+            "calibration_id": self.calibration_id,
+        }
+
+
+def _finite_metric(
+    validation: Mapping[str, Any],
+    key: str,
+    failures: list[str],
+    *,
+    minimum: float | None = 0.0,
+    maximum: float | None = None,
+) -> float | None:
+    raw = validation.get(key)
+    if raw is None:
+        failures.append(f"validation_missing:{key}")
+        return None
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        failures.append(f"validation_invalid:{key}")
+        return None
+    if not math.isfinite(value):
+        failures.append(f"validation_nonfinite:{key}")
+        return None
+    if minimum is not None and value < minimum:
+        failures.append(f"validation_range:{key}")
+        return None
+    if maximum is not None and value > maximum:
+        failures.append(f"validation_range:{key}")
+        return None
+    return value
+
+
+def _valid_area_coefficients(coefficients: Any) -> bool:
+    if not isinstance(coefficients, (Mapping, list, tuple)):
+        return False
+    raw_values = (
+        coefficients.values() if isinstance(coefficients, Mapping) else coefficients
+    )
+    try:
+        values = tuple(float(value) for value in raw_values)
+    except (TypeError, ValueError):
+        return False
+    return len(values) == 3 and all(
+        math.isfinite(value) and value >= 0 for value in values
+    ) and any(
+        value > 0 for value in values
+    )
+
+
+def _is_sha256(value: object) -> bool:
+    token = str(value)
+    return len(token) == 64 and all(
+        character in "0123456789abcdef" for character in token
+    )
+
+
+def _structural_features(
+    mlen: int,
+    blen: int,
+    t_width: int,
+    l_width: int,
+    scale_width: int,
+) -> dict[str, float]:
+    if mlen <= 0 or blen <= 0 or mlen % blen:
+        raise ValueError("structural area geometry is invalid")
+    return {
+        "pe_tl": float(mlen * blen * t_width * l_width),
+        "pe_sum": float(mlen * blen * (t_width + l_width)),
+        "pe_0": float(mlen * blen),
+        "reduce": float(blen * (mlen - blen)),
+        "scale": float(mlen * scale_width),
+        "out": float(blen * blen),
+        "fixed": float(mlen // blen),
+        "const": 1.0,
+    }
+
+
+def _format_width(token: str) -> tuple[str, int]:
+    value = token.strip().upper()
+    if value.startswith("MXINT"):
+        bits = int(value.removeprefix("MXINT").lstrip("_"))
+        if bits not in {2, 4, 8}:
+            raise ValueError(f"unsupported structural format {token!r}")
+        return "mxint", bits
+    if value.startswith("MXFP_E") and "M" in value:
+        exp, mant = value.removeprefix("MXFP_E").split("M", 1)
+        pair = int(exp), int(mant)
+        if pair not in {(1, 2), (2, 1), (4, 3), (5, 2)}:
+            raise ValueError(f"unsupported structural format {token!r}")
+        return "mxfp", 1 + pair[0] + pair[1]
+    raise ValueError(f"unsupported structural format {token!r}")
+
+
+def _matrix_operands(signature: str) -> tuple[str, str, str]:
+    try:
+        operation, operands = signature.split(":", 1)
+        left, right = operands.split("x", 1)
+    except ValueError as exc:
+        raise ValueError(f"invalid matrix signature {signature!r}") from exc
+    if operation not in {"LINEAR", "QK", "PV"}:
+        raise ValueError(f"invalid matrix operation {operation!r}")
+    return operation, left, right
+
+
+def _structural_matrix_mm2(
+    raw: Mapping[str, Any],
+    signature: str,
+    *,
+    mlen: int,
+    blen: int,
+    reference_corner: bool,
+    scale_width: int = 8,
+) -> float:
+    _, left, right = _matrix_operands(signature)
+    left_family, left_width = _format_width(left)
+    right_family, right_width = _format_width(right)
+    if left_family != right_family:
+        raise ValueError("mixed-family structural area is unsupported")
+    coefficients = raw["coefficients"][left_family]
+    features = _structural_features(
+        mlen,
+        blen,
+        left_width,
+        right_width,
+        scale_width,
+    )
+    area = sum(
+        float(coefficients[name]) * features[name]
+        for name in STRUCTURAL_FEATURES
+    )
+    if reference_corner:
+        area *= float(raw["pdk_scale_reference"])
+    if not math.isfinite(area) or area <= 0:
+        raise ValueError("structural matrix area must be positive and finite")
+    return area / 1e6
+
+
+def _structural_failures(raw: object) -> tuple[str, ...]:
+    if not isinstance(raw, Mapping):
+        return ("structural_area_schema",)
+    failures: list[str] = []
+    if raw.get("schema_version") != STRUCTURAL_AREA_SCHEMA:
+        failures.append("structural_area_schema")
+    if raw.get("model_version") != STRUCTURAL_AREA_MODEL_VERSION:
+        failures.append("structural_area_model_version")
+    sources = raw.get("source_sha256", {})
+    if (
+        not isinstance(sources, Mapping)
+        or set(sources) != REQUIRED_STRUCTURAL_AREA_SOURCES
+    ):
+        failures.append("structural_area_sources")
+    elif any(not name or not _is_sha256(value) for name, value in sources.items()):
+        failures.append("structural_area_sources")
+    coefficients = raw.get("coefficients", {})
+    if not isinstance(coefficients, Mapping):
+        failures.append("structural_area_coefficients")
+    else:
+        for family in ("mxint", "mxfp"):
+            model = coefficients.get(family, {})
+            if not isinstance(model, Mapping) or set(model) != set(
+                STRUCTURAL_FEATURES
+            ):
+                failures.append(f"structural_area_coefficients:{family}")
+                continue
+            try:
+                values = tuple(
+                    float(model[name]) for name in STRUCTURAL_FEATURES
+                )
+            except (TypeError, ValueError):
+                failures.append(f"structural_area_coefficients:{family}")
+                continue
+            if any(
+                not math.isfinite(value) or value < 0 for value in values
+            ) or not any(value > 0 for value in values):
+                failures.append(f"structural_area_coefficients:{family}")
+    try:
+        pdk_scale = float(raw["pdk_scale_reference"])
+        reference_anchor = float(raw["reference_anchor_um2"])
+    except (KeyError, TypeError, ValueError):
+        failures.append("structural_area_reference")
+        pdk_scale, reference_anchor = 0.0, 0.0
+    if (
+        not math.isfinite(pdk_scale)
+        or pdk_scale <= 0
+        or not math.isfinite(reference_anchor)
+        or reference_anchor <= 0
+    ):
+        failures.append("structural_area_reference")
+    holdouts = raw.get("holdout_mape_pct", {})
+    if not isinstance(holdouts, Mapping):
+        failures.append("structural_area_holdout")
+    else:
+        for family in ("mxint", "mxfp"):
+            try:
+                value = float(holdouts[family])
+            except (KeyError, TypeError, ValueError):
+                failures.append(f"structural_area_holdout:{family}")
+                continue
+            if not math.isfinite(value) or value < 0 or value > 10.0:
+                failures.append(f"structural_area_holdout:{family}")
+    macros = raw.get("sram_macros", ())
+    if (
+        not isinstance(macros, list)
+        or not macros
+        or any(
+            not isinstance(macro, Mapping)
+            or not str(macro.get("macro", "")).strip()
+            for macro in macros
+        )
+    ):
+        failures.append("structural_area_sram_macros")
+    else:
+        for index, macro in enumerate(macros):
+            try:
+                depth = int(macro["depth"])
+                width = int(macro["width"])
+                area = float(macro["area_um2"])
+            except (KeyError, TypeError, ValueError):
+                failures.append(f"structural_area_sram_macro:{index}")
+                continue
+            if (
+                depth <= 0
+                or width <= 0
+                or not math.isfinite(area)
+                or area <= 0
+            ):
+                failures.append(f"structural_area_sram_macro:{index}")
+    if not failures:
+        try:
+            anchor = (
+                _structural_matrix_mm2(
+                    raw,
+                    "LINEAR:MXINT4xMXINT4",
+                    mlen=1024,
+                    blen=4,
+                    reference_corner=True,
+                )
+                * 1e6
+            )
+            if abs(anchor - reference_anchor) / reference_anchor * 100.0 > 1.0:
+                failures.append("structural_area_anchor")
+            shapes = ((16, 4), (32, 4), (64, 8), (256, 8), (1024, 4))
+            areas = [
+                _structural_matrix_mm2(
+                    raw,
+                    "LINEAR:MXINT4xMXINT4",
+                    mlen=mlen,
+                    blen=blen,
+                    reference_corner=False,
+                )
+                for mlen, blen in shapes
+            ]
+            if any(right <= left for left, right in zip(areas, areas[1:])):
+                failures.append("structural_area_monotonicity")
+            precision = [
+                _structural_matrix_mm2(
+                    raw,
+                    signature,
+                    mlen=1024,
+                    blen=4,
+                    reference_corner=False,
+                )
+                for signature in (
+                    "LINEAR:MXINT4xMXINT2",
+                    "LINEAR:MXINT4xMXINT4",
+                    "LINEAR:MXINT8xMXINT8",
+                )
+            ]
+            if not precision[0] < precision[1] < precision[2]:
+                failures.append("structural_area_precision_order")
+        except (KeyError, TypeError, ValueError):
+            failures.append("structural_area_evaluation")
+    return tuple(sorted(set(failures)))
+
+
+def _structural_area_id(raw: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        raw,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return f"structural-area-{hashlib.sha256(payload).hexdigest()}"
+
+
+def _fp_width(vector_fp: str) -> int:
+    token = vector_fp.strip().upper().removeprefix("FP_")
+    if token == "BF16":
+        return 16
+    if not token.startswith("E") or "M" not in token:
+        raise ValueError(f"unsupported vector format {vector_fp!r}")
+    exp, mant = token[1:].split("M", 1)
+    return 1 + int(exp) + int(mant)
+
+
+def _tile_area_um2(
+    depth: int,
+    width: int,
+    ports: int,
+    macros: Iterable[Mapping[str, Any]],
+) -> float:
+    values = tuple(macros)
+    if depth <= 0 or width <= 0 or ports <= 0 or not values:
+        raise ValueError("invalid SRAM tiling inputs")
+    return min(
+        math.ceil(depth / int(macro["depth"]))
+        * math.ceil(width / int(macro["width"]))
+        * ports
+        * float(macro["area_um2"])
+        for macro in values
+    )
+
+
+def _structural_sram_mm2(
+    raw: Mapping[str, Any],
+    signatures: Iterable[str],
+    *,
+    vector_fp: str,
+    area_config: Mapping[str, Any],
+    mlen: int,
+    blen: int,
+) -> float:
+    required = (
+        "MLEN",
+        "BLEN",
+        "VLEN",
+        "MATRIX_SRAM_DEPTH",
+        "VECTOR_SRAM_DEPTH",
+        "INT_SRAM_DEPTH",
+        "FP_SRAM_DEPTH",
+        "INT_DATA_WIDTH",
+        "MX_SCALE_WIDTH",
+        "BLOCK_DIM",
+    )
+    if any(name not in area_config for name in required):
+        raise ValueError("simulator area config is incomplete")
+    config = {name: int(area_config[name]) for name in required}
+    if any(value <= 0 for value in config.values()):
+        raise ValueError("simulator area config values must be positive")
+    if config["MLEN"] != mlen or config["BLEN"] != blen:
+        raise ValueError("simulator area config geometry mismatch")
+    if config["VLEN"] != config["MLEN"]:
+        raise ValueError("simulator area config requires VLEN == MLEN")
+    if config["BLOCK_DIM"] != 8:
+        raise ValueError("simulator area config requires native MX block size 8")
+    roles: dict[str, str] = {}
+    activations: set[str] = set()
+    for signature in signatures:
+        operation, left, right = _matrix_operands(signature)
+        activations.add(right)
+        roles[{"LINEAR": "weight", "QK": "key", "PV": "value"}[operation]] = left
+    if set(roles) != {"weight", "key", "value"} or len(activations) != 1:
+        raise ValueError("simulator area signatures are incomplete")
+    tokens = (
+        roles["weight"],
+        next(iter(activations)),
+        roles["key"],
+        roles["value"],
+    )
+    formats = [_format_width(token) for token in tokens]
+    if len({family for family, _ in formats}) != 1:
+        raise ValueError("mixed-family structural SRAM area is unsupported")
+    t_width = max(formats[index][1] for index in (0, 2, 3))
+    act_width = formats[1][1]
+    kv_width = max(formats[2][1], formats[3][1])
+    scale = config["MX_SCALE_WIDTH"]
+    matrix_width = mlen * (t_width + scale)
+    vector_width = (
+        config["VLEN"] * (_fp_width(vector_fp) + act_width + kv_width)
+        + 2 * scale * max(1, config["VLEN"] // config["BLOCK_DIM"])
+    )
+    macros = raw["sram_macros"]
+    return (
+        _tile_area_um2(
+            config["MATRIX_SRAM_DEPTH"],
+            matrix_width,
+            2,
+            macros,
+        )
+        + _tile_area_um2(
+            config["VECTOR_SRAM_DEPTH"],
+            vector_width,
+            2,
+            macros,
+        )
+        + _tile_area_um2(
+            config["INT_SRAM_DEPTH"],
+            config["INT_DATA_WIDTH"],
+            1,
+            macros,
+        )
+        + _tile_area_um2(
+            config["FP_SRAM_DEPTH"],
+            _fp_width(vector_fp),
+            1,
+            macros,
+        )
+    ) / 1e6
+
+
+def load_simulator_power_artifact(
+    path: str | Path,
+    *,
+    required_signatures: Iterable[str] | None = None,
+) -> SimulatorPowerStatus:
+    """Load an artifact without making unvalidated coefficients rankable."""
+
+    source = Path(path).resolve()
+    payload = source.read_bytes()
+    raw = json.loads(payload)
+    if not isinstance(raw, Mapping):
+        raise TypeError("power artifact root must be an object")
+    failures: list[str] = []
+    model_version = str(raw.get("model_version", ""))
+    if model_version not in SUPPORTED_POWER_MODEL_VERSIONS:
+        failures.append("model_version")
+    provenance_hash = str(raw.get("provenance_hash", ""))
+    if not _is_sha256(provenance_hash):
+        failures.append("provenance_hash")
+    if not _is_sha256(raw.get("activity_provenance_hash", "")):
+        failures.append("activity_provenance_hash")
+    if not _is_sha256(raw.get("artifact_catalog_sha256", "")):
+        failures.append("artifact_catalog_sha256")
+    manifest_hash = str(raw.get("calibration_manifest_hash", ""))
+    if manifest_hash != EXPECTED_CALIBRATION_MANIFEST_HASH:
+        failures.append("calibration_manifest_hash")
+    if not str(raw.get("hbm_energy_source", "")).strip():
+        failures.append("hbm_energy_source")
+    fit_summary = raw.get("fit_summary", {})
+    if not isinstance(fit_summary, Mapping):
+        failures.append("fit_summary_schema")
+    else:
+        for name, expected in EXPECTED_FIT_SUMMARY.items():
+            try:
+                observed = int(fit_summary.get(name))
+            except (TypeError, ValueError):
+                failures.append(f"fit_summary_missing:{name}")
+                continue
+            if observed != expected:
+                failures.append(f"fit_summary_mismatch:{name}")
+    synthesis_context = raw.get("synthesis_context", {})
+    if not isinstance(synthesis_context, Mapping):
+        failures.append("synthesis_context_schema")
+    else:
+        for name in (
+            "dc_tool_version",
+            "library_id",
+            "process_corner",
+            "mx_block_size",
+            "hardware_fp_binding",
+            "activity_generator",
+        ):
+            if not str(synthesis_context.get(name, "")).strip():
+                failures.append(f"synthesis_context_missing:{name}")
+        if str(synthesis_context.get("mx_block_size", "")) != "8":
+            failures.append("synthesis_context_gate:mx_block_size")
+        if (
+            str(synthesis_context.get("hardware_fp_binding", ""))
+            != EXPECTED_HARDWARE_FP_BINDING
+        ):
+            failures.append(
+                "synthesis_context_gate:hardware_fp_binding"
+            )
+    models_raw = raw.get("event_energy_models", {})
+    if not isinstance(models_raw, Mapping):
+        raise TypeError("event_energy_models must be an object")
+    available: list[str] = []
+    for signature, coefficients in models_raw.items():
+        try:
+            values = tuple(float(value) for value in coefficients)
+        except (TypeError, ValueError):
+            failures.append(f"coefficient_schema:{signature}")
+            continue
+        if len(values) != 3 or any(
+            not math.isfinite(value) or value < 0 for value in values
+        ) or not any(value > 0 for value in values):
+            failures.append(f"coefficient_schema:{signature}")
+            continue
+        available.append(str(signature))
+    required = tuple(
+        sorted(
+            {
+                str(signature)
+                for signature in (
+                    required_signatures
+                    if required_signatures is not None
+                    else required_hardware_power_signatures()
+                )
+            }
+        )
+    )
+    available_set = frozenset(available)
+    missing = tuple(
+        signature for signature in required if signature not in available_set
+    )
+
+    validation = raw.get("validation", {})
+    if not isinstance(validation, Mapping):
+        raise TypeError("validation must be an object")
+    if validation.get("passed") is not True:
+        failures.append("validation_passed")
+    if tuple(validation.get("missing_fields", ())):
+        failures.append("validation_missing_fields")
+    limits = {
+        "area_median_pct": 10.0,
+        "area_max_pct": 15.0,
+        "dynamic_median_pct": 15.0,
+        "dynamic_max_pct": 25.0,
+        "leakage_median_pct": 15.0,
+        "leakage_max_pct": 25.0,
+        "cycle_error_pct": 5.0,
+        "latency_mape_pct": 10.0,
+    }
+    for name, limit in limits.items():
+        value = _finite_metric(validation, name, failures)
+        if value is not None and value > limit:
+            failures.append(f"validation_gate:{name}")
+    rank = _finite_metric(
+        validation,
+        "rank_correlation",
+        failures,
+        minimum=-1.0,
+        maximum=1.0,
+    )
+    if rank is not None and rank < 0.90:
+        failures.append("validation_gate:rank_correlation")
+
+    scalar_coefficients: dict[str, float] = {}
+    for name in (
+        "hbm_energy_j_per_byte",
+        "fixed_area_mm2",
+    ):
+        try:
+            value = float(raw.get(name))
+        except (TypeError, ValueError):
+            failures.append(f"coefficient_missing:{name}")
+            continue
+        if not math.isfinite(value) or value < 0:
+            failures.append(f"coefficient_invalid:{name}")
+        else:
+            scalar_coefficients[name] = value
+    for name in (
+        "hbm_energy_j_per_byte",
+        "fixed_area_mm2",
+    ):
+        if scalar_coefficients.get(name, 0.0) <= 0:
+            failures.append(f"coefficient_missing:{name}")
+    if not _valid_area_coefficients(raw.get("leakage_power_model")):
+        failures.append("leakage_power_model")
+    if not _valid_area_coefficients(raw.get("selector_area_model")):
+        failures.append("selector_area_model")
+    vector_area = raw.get("vector_area_models", {})
+    if not isinstance(vector_area, Mapping):
+        failures.append("vector_area_models_schema")
+    else:
+        for vector_format in VECTOR_HARDWARE_FORMATS:
+            if not _valid_area_coefficients(vector_area.get(vector_format)):
+                failures.append(f"vector_area_model:{vector_format}")
+    structural_area = raw.get("structural_area_model", {})
+    failures.extend(_structural_failures(structural_area))
+    required_matrix_signatures = tuple(
+        signature
+        for signature in required
+        if signature.startswith(("LINEAR:", "QK:", "PV:"))
+    )
+    if isinstance(structural_area, Mapping) and not _structural_failures(
+        structural_area
+    ):
+        for signature in required_matrix_signatures:
+            try:
+                _structural_matrix_mm2(
+                    structural_area,
+                    signature,
+                    mlen=16,
+                    blen=4,
+                    reference_corner=True,
+                )
+            except (KeyError, TypeError, ValueError):
+                failures.append(f"structural_area_signature:{signature}")
+
+    return SimulatorPowerStatus(
+        source_path=source,
+        source_sha256=hashlib.sha256(payload).hexdigest(),
+        model_version=model_version,
+        provenance_hash=provenance_hash,
+        required_signatures=required,
+        available_signatures=tuple(sorted(available_set)),
+        missing_signatures=missing,
+        failures=tuple(sorted(set(failures))),
+        raw=dict(raw),
+    )
+
+
+def _estimate_matches_status(
+    status: SimulatorPowerStatus,
+    estimate: Mapping[str, Any],
+) -> bool:
+    if estimate.get("calibration_source_sha256") != status.source_sha256:
+        return False
+    if estimate.get("calibration_provenance_hash") != status.provenance_hash:
+        return False
+    if (
+        estimate.get("calibration_activity_provenance_hash")
+        != status.raw.get("activity_provenance_hash")
+    ):
+        return False
+    structural = status.raw.get("structural_area_model", {})
+    if not isinstance(structural, Mapping):
+        return False
+    if estimate.get("structural_area_id") != _structural_area_id(structural):
+        return False
+    return True
+
+
+def _estimate_within_calibration_domain(
+    status: SimulatorPowerStatus,
+    estimate: Mapping[str, Any],
+) -> bool:
+    if estimate.get("calibration_domain") != EXPECTED_POWER_INTERPOLATION_DOMAIN:
+        return False
+    if estimate.get("extrapolated") is not False:
+        return False
+    if tuple(estimate.get("extrapolation_reasons", ())):
+        return False
+    try:
+        mlen = int(estimate["MLEN"])
+        blen = int(estimate["BLEN"])
+    except (KeyError, TypeError, ValueError):
+        return False
+    domain = EXPECTED_POWER_INTERPOLATION_DOMAIN
+    if not (
+        domain["mlen_min"] <= mlen <= domain["mlen_max"]
+        and domain["blen_min"] <= blen <= domain["blen_max"]
+    ):
+        return False
+    context = status.raw.get("synthesis_context", {})
+    if not isinstance(context, Mapping):
+        return False
+    return (
+        estimate.get("vector_fp")
+        == context.get("hardware_fp_binding")
+        == EXPECTED_HARDWARE_FP_BINDING
+    )
+
+
+def calibrated_energy_from_simulator(
+    status: SimulatorPowerStatus,
+    estimate: Mapping[str, Any],
+    *,
+    duration_s: float,
+) -> CalibratedEnergy | None:
+    """Convert only a rankable simulator estimate into calibrated energy."""
+
+    if not status.passed:
+        return None
+    if not _estimate_matches_status(status, estimate):
+        return None
+    if estimate.get("calibrated") is not True or estimate.get("rankable") is not True:
+        return None
+    if not _estimate_within_calibration_domain(status, estimate):
+        return None
+    if tuple(estimate.get("missing_signatures", ())):
+        return None
+    if not math.isfinite(duration_s) or duration_s <= 0:
+        raise ValueError("duration_s must be positive and finite")
+    event_rows = estimate.get("events")
+    if not isinstance(event_rows, list) or not event_rows:
+        raise ValueError("simulator energy needs explicit event counts")
+    expected_compute = 0.0
+    expected_vector = 0.0
+    expected_selector = 0.0
+    geometries: set[tuple[int, int]] = set()
+    operation_signatures = {
+        operation: set() for operation in ("LINEAR", "QK", "PV")
+    }
+    vector_fp = str(estimate["vector_fp"])
+    vector_events = 0
+    selector_events = 0
+    models = status.raw["event_energy_models"]
+    for row in event_rows:
+        if not isinstance(row, Mapping):
+            raise ValueError("simulator event rows must be objects")
+        signature = str(row["signature"])
+        count = int(row["count"])
+        mlen = int(row["MLEN"])
+        blen = int(row["BLEN"])
+        if count < 0 or mlen <= 0 or blen <= 0 or mlen % blen:
+            raise ValueError("simulator event row is invalid")
+        geometries.add((mlen, blen))
+        try:
+            coefficients = tuple(float(value) for value in models[signature])
+        except (KeyError, TypeError, ValueError) as exc:
+            raise ValueError(f"uncalibrated simulator event {signature!r}") from exc
+        event_energy = (
+            coefficients[0]
+            + coefficients[1] * mlen * blen
+            + coefficients[2] * (mlen + blen)
+        ) * count
+        if signature.startswith(("LINEAR:", "QK:", "PV:")):
+            expected_compute += event_energy
+            operation_signatures[signature.split(":", 1)[0]].add(signature)
+        elif signature.startswith("VECTOR:"):
+            expected_vector += event_energy
+            if signature == f"VECTOR:{vector_fp}":
+                vector_events += count
+        elif signature == SELECTOR_SIGNATURE:
+            expected_selector += event_energy
+            selector_events += count
+        else:
+            raise ValueError(f"unsupported simulator event {signature!r}")
+    if len(geometries) != 1:
+        raise ValueError("simulator events must use one geometry")
+    if any(len(values) != 1 for values in operation_signatures.values()):
+        raise ValueError("simulator events need one LINEAR, QK, and PV signature")
+    if vector_events <= 0:
+        raise ValueError("simulator events are missing the selected vector format")
+    selector_enabled = estimate.get("selector_enabled")
+    if not isinstance(selector_enabled, bool):
+        raise ValueError("selector_enabled must be boolean")
+    if selector_enabled != (selector_events > 0):
+        raise ValueError("selector state and selector events are inconsistent")
+    expected_dynamic = expected_compute + expected_vector + expected_selector
+    dynamic = float(estimate["dynamic_energy_j"])
+    compute = float(estimate["compute_dynamic_energy_j"])
+    vector = float(estimate["vector_dynamic_energy_j"])
+    selector = float(estimate["selector_dynamic_energy_j"])
+    leakage = float(estimate["leakage_energy_j"])
+    leakage_power = float(estimate["leakage_power_w"])
+    hbm = float(estimate["hbm_energy_j"])
+    total = float(estimate["total_energy_j"])
+    average_power = float(estimate["average_power_w"])
+    if any(
+        not math.isfinite(value) or value < 0
+        for value in (
+            dynamic,
+            compute,
+            vector,
+            selector,
+            leakage,
+            leakage_power,
+            hbm,
+            total,
+            average_power,
+        )
+    ):
+        raise ValueError("simulator energy values must be finite and non-negative")
+    mlen = int(estimate["MLEN"])
+    blen = int(estimate["BLEN"])
+    if mlen <= 0 or blen <= 0 or mlen % blen:
+        raise ValueError("simulator leakage geometry is invalid")
+    if geometries != {(mlen, blen)}:
+        raise ValueError("simulator estimate and event geometries differ")
+    for name, observed, expected in (
+        ("compute dynamic", compute, expected_compute),
+        ("vector dynamic", vector, expected_vector),
+        ("selector dynamic", selector, expected_selector),
+        ("total dynamic", dynamic, expected_dynamic),
+    ):
+        if abs(observed - expected) > max(1e-15, abs(expected) * 1e-9):
+            raise ValueError(f"simulator {name} energy is inconsistent with calibration")
+    coefficients = tuple(
+        float(value) for value in status.raw["leakage_power_model"]
+    )
+    expected_leakage_power = (
+        coefficients[0]
+        + coefficients[1] * mlen * blen
+        + coefficients[2] * (mlen + blen)
+    )
+    if abs(leakage_power - expected_leakage_power) > max(
+        1e-12,
+        abs(expected_leakage_power) * 1e-9,
+    ):
+        raise ValueError("simulator leakage power is inconsistent with calibration")
+    if abs(leakage - leakage_power * duration_s) > max(
+        1e-15,
+        abs(leakage) * 1e-9,
+    ):
+        raise ValueError("simulator leakage energy is inconsistent with elapsed time")
+    hbm_bytes = float(estimate["hbm_bytes"])
+    if not math.isfinite(hbm_bytes) or hbm_bytes < 0:
+        raise ValueError("simulator HBM bytes must be finite and non-negative")
+    expected_hbm = hbm_bytes * float(status.raw["hbm_energy_j_per_byte"])
+    if abs(hbm - expected_hbm) > max(1e-15, abs(expected_hbm) * 1e-9):
+        raise ValueError("simulator HBM energy is inconsistent with calibration")
+    expected_total = dynamic + leakage + hbm
+    tolerance = max(1e-15, abs(total) * 1e-9)
+    if abs(total - expected_total) > tolerance:
+        raise ValueError("simulator energy components do not sum to total")
+    if abs(average_power - total / duration_s) > max(
+        1e-12,
+        abs(average_power) * 1e-9,
+    ):
+        raise ValueError("simulator average power is inconsistent with elapsed time")
+    return CalibratedEnergy(
+        calibration_id=status.calibration_id,
+        compute_j=compute,
+        vector_j=vector,
+        sram_j=0.0,
+        hbm_j=hbm,
+        leakage_j=leakage,
+        duration_s=duration_s,
+        unattributed_dynamic_j=selector,
+    )
+
+
+def calibrated_area_from_simulator(
+    status: SimulatorPowerStatus,
+    estimate: Mapping[str, Any],
+) -> float | None:
+    """Return area only when its artifact and estimate are fully rankable."""
+
+    if not status.passed:
+        return None
+    if not _estimate_matches_status(status, estimate):
+        return None
+    if estimate.get("calibrated") is not True or estimate.get("rankable") is not True:
+        return None
+    if not _estimate_within_calibration_domain(status, estimate):
+        return None
+    if tuple(estimate.get("missing_signatures", ())):
+        return None
+    area = float(estimate["area_mm2"])
+    if not math.isfinite(area) or area <= 0:
+        raise ValueError("simulator area must be positive and finite")
+    mlen = int(estimate["MLEN"])
+    blen = int(estimate["BLEN"])
+    if mlen <= 0 or blen <= 0 or mlen % blen:
+        raise ValueError("simulator area geometry is invalid")
+    signatures = tuple(sorted({str(value) for value in estimate["array_signatures"]}))
+    if not signatures:
+        raise ValueError("simulator area needs operation signatures")
+    structural = status.raw["structural_area_model"]
+    scale_width = int(estimate["area_config"]["MX_SCALE_WIDTH"])
+    matrix_areas = [
+        _structural_matrix_mm2(
+            structural,
+            signature,
+            mlen=mlen,
+            blen=blen,
+            reference_corner=True,
+            scale_width=scale_width,
+        )
+        for signature in signatures
+    ]
+    expected_matrix = max(matrix_areas)
+    observed_matrix = float(estimate["matrix_area_mm2"])
+    if abs(observed_matrix - expected_matrix) > max(
+        1e-12,
+        abs(expected_matrix) * 1e-9,
+    ):
+        raise ValueError("simulator matrix area is inconsistent with calibration")
+    vector_fp = str(estimate["vector_fp"])
+    pdk_scale = float(structural["pdk_scale_reference"])
+    vector_coefficients = tuple(
+        float(value)
+        for value in status.raw["vector_area_models"][vector_fp]
+    )
+    expected_vector = (
+        vector_coefficients[0]
+        + vector_coefficients[1] * mlen * blen
+        + vector_coefficients[2] * (mlen + blen)
+    ) * pdk_scale
+    selector_enabled = estimate["selector_enabled"]
+    if not isinstance(selector_enabled, bool):
+        raise ValueError("selector_enabled must be boolean")
+    selector_coefficients = tuple(
+        float(value) for value in status.raw["selector_area_model"]
+    )
+    expected_selector = (
+        (
+            selector_coefficients[0]
+            + selector_coefficients[1] * mlen * blen
+            + selector_coefficients[2] * (mlen + blen)
+        )
+        * pdk_scale
+        if selector_enabled
+        else 0.0
+    )
+    expected_fixed = float(status.raw["fixed_area_mm2"]) * pdk_scale
+    expected_sram = _structural_sram_mm2(
+        structural,
+        signatures,
+        vector_fp=vector_fp,
+        area_config=estimate["area_config"],
+        mlen=mlen,
+        blen=blen,
+    )
+    for name, observed, expected in (
+        ("SRAM", float(estimate["sram_area_mm2"]), expected_sram),
+        ("fixed", float(estimate["fixed_area_mm2"]), expected_fixed),
+        ("vector", float(estimate["vector_area_mm2"]), expected_vector),
+        ("selector", float(estimate["selector_area_mm2"]), expected_selector),
+    ):
+        if not math.isfinite(observed) or observed < 0:
+            raise ValueError(f"simulator {name} area is invalid")
+        if abs(observed - expected) > max(1e-12, abs(expected) * 1e-9):
+            raise ValueError(
+                f"simulator {name} area is inconsistent with calibration"
+            )
+    expected_area = (
+        expected_fixed
+        + expected_matrix
+        + expected_vector
+        + expected_sram
+        + expected_selector
+    )
+    if abs(area - expected_area) > max(1e-12, abs(expected_area) * 1e-9):
+        raise ValueError("simulator area is inconsistent with calibration")
+    return expected_area
+
+
+__all__ = [
+    "SUPPORTED_POWER_MODEL_VERSIONS",
+    "EXPECTED_CALIBRATION_MANIFEST_HASH",
+    "EXPECTED_FIT_SUMMARY",
+    "SELECTOR_SIGNATURE",
+    "SimulatorPowerStatus",
+    "calibrated_area_from_simulator",
+    "calibrated_energy_from_simulator",
+    "load_simulator_power_artifact",
+    "required_hardware_power_signatures",
+    "required_profile_power_signatures",
+]
diff --git a/decode_dse/hardware/selection.py b/decode_dse/hardware/selection.py
new file mode 100644
index 0000000..fd2bf43
--- /dev/null
+++ b/decode_dse/hardware/selection.py
@@ -0,0 +1,1648 @@
+"""Accuracy, fidelity, uncertainty, and deployment selection gates."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import os
+import random
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Protocol, Sequence
+
+from decode_dse.hardware.statistics import percentile, spearman_rank_correlation
+from decode_dse.hardware.lm_head_service import (
+    HEAD_SERVICE_MODE,
+    composite_system_calibration_id,
+    require_content_addressed_id,
+)
+from decode_dse.legality import StackValidity
+from decode_dse.profiles import (
+    PROFILE_KIND_BF16_REFERENCE,
+    PROFILE_KIND_QUANTIZED,
+    PROFILE_KIND_VECTOR_BF16_CONTROL,
+    DecodePrecisionProfile,
+    format_descriptor,
+)
+
+SELECTION_REPORT_SCHEMA = "decode-selection-report"
+DEFAULT_REQUIRED_TASKS = ("gsm8k", "ifeval")
+DEFAULT_RULER_LENGTHS = (4096, 8192, 16384, 32768)
+BF16_REFERENCE_SCOPE = "split_execution_software_accuracy"
+ENERGY_TIERS = frozenset({"analytic_anchored", "dc_calibrated"})
+
+
+def _energy_tier_rank(value: str | None) -> int:
+    if value == "dc_calibrated":
+        return 0
+    if value == "analytic_anchored":
+        return 1
+    return 2
+
+
+class CalibrationEvidence(Protocol):
+    passed: bool
+
+    @property
+    def calibration_id(self) -> str:
+        ...
+
+
+class TimingCalibrationEvidence(Protocol):
+    passed: bool
+    mode: str
+
+    @property
+    def evidence_id(self) -> str:
+        ...
+
+
+class HeadServiceEvidence(Protocol):
+    passed: bool
+    service_mode: str
+
+    @property
+    def calibration_id(self) -> str | None:
+        ...
+
+    @property
+    def provenance_id(self) -> str | None:
+        ...
+
+
+def _canonical_bytes(value: Any, *, newline: bool = False) -> bytes:
+    return (
+        json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        )
+        + ("\n" if newline else "")
+    ).encode("utf-8")
+
+
+def _hash(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _finite_optional(name: str, value: float | None, *, positive: bool = False) -> None:
+    if value is None:
+        return
+    if not math.isfinite(value):
+        raise ValueError(f"{name} must be finite")
+    if positive and value <= 0:
+        raise ValueError(f"{name} must be positive")
+
+
+@dataclass(frozen=True)
+class ParetoPoint:
+    """One profile-level point used for validation fidelity and refinement."""
+
+    profile: DecodePrecisionProfile
+    mean_nll: float
+    tpot_ms: float | None
+    tps: float | None
+    energy_per_token_j: float | None
+    area_mm2: float | None
+    candidate_id: str | None = None
+    power_calibration_id: str | None = None
+    cost_scope: str | None = None
+    system_calibration_id: str | None = None
+    head_service_calibration_id: str | None = None
+    whole_model_rankable: bool = False
+    energy_tier: str | None = None
+    publication_timing_tier: str | None = None
+
+    def __post_init__(self) -> None:
+        _finite_optional("mean_nll", self.mean_nll)
+        for name in ("tpot_ms", "tps", "energy_per_token_j", "area_mm2"):
+            _finite_optional(name, getattr(self, name), positive=True)
+        if self.publication_timing_tier is not None:
+            from decode_dse.hardware.design_space import (
+                PUBLICATION_TIMING_TIERS,
+            )
+
+            if self.publication_timing_tier not in PUBLICATION_TIMING_TIERS:
+                raise ValueError("publication_timing_tier is unsupported")
+        if self.whole_model_rankable and self.publication_timing_tier is None:
+            raise ValueError(
+                "rankable points require a publication timing tier"
+            )
+        has_power_cost = (
+            self.energy_per_token_j is not None or self.area_mm2 is not None
+        )
+        if has_power_cost != bool(self.power_calibration_id):
+            raise ValueError(
+                "energy or area costs require one power calibration identity"
+            )
+        tier = self.energy_tier
+        if has_power_cost and tier is None:
+            tier = "dc_calibrated"
+            object.__setattr__(self, "energy_tier", tier)
+        if tier is not None and tier not in ENERGY_TIERS:
+            raise ValueError("energy_tier is unsupported")
+        if not has_power_cost and tier is not None:
+            raise ValueError("energy_tier requires serving costs")
+        has_system_cost = any(
+            value is not None
+            for value in (
+                self.tpot_ms,
+                self.tps,
+                self.energy_per_token_j,
+            )
+        )
+        if has_system_cost:
+            if (
+                not self.whole_model_rankable
+                or self.cost_scope != "whole_model"
+                or not self.system_calibration_id
+                or not self.head_service_calibration_id
+            ):
+                raise ValueError(
+                    "serving costs require a calibrated whole-model boundary"
+                )
+        elif any(
+            (
+                self.whole_model_rankable,
+                self.cost_scope is not None,
+                self.system_calibration_id is not None,
+                self.head_service_calibration_id is not None,
+            )
+        ):
+            raise ValueError(
+                "whole-model identities require serving costs"
+            )
+
+    @property
+    def profile_id(self) -> str:
+        return self.profile.profile_id
+
+    @property
+    def tokens_per_joule(self) -> float | None:
+        if self.energy_per_token_j is None:
+            return None
+        return 1.0 / self.energy_per_token_j
+
+    @property
+    def edp_j_s(self) -> float | None:
+        if self.energy_per_token_j is None or self.tpot_ms is None:
+            return None
+        return self.energy_per_token_j * self.tpot_ms / 1000.0
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "profile_id": self.profile_id,
+            "profile": self.profile.to_dict(),
+            "mean_nll": self.mean_nll,
+            "tpot_ms": self.tpot_ms,
+            "tps": self.tps,
+            "energy_per_token_j": self.energy_per_token_j,
+            "energy_tier": self.energy_tier,
+            "tokens_per_joule": self.tokens_per_joule,
+            "edp_j_s": self.edp_j_s,
+            "area_mm2": self.area_mm2,
+            "candidate_id": self.candidate_id,
+            "power_calibration_id": self.power_calibration_id,
+            "cost_scope": self.cost_scope,
+            "system_calibration_id": self.system_calibration_id,
+            "head_service_calibration_id": (
+                self.head_service_calibration_id
+            ),
+            "whole_model_rankable": self.whole_model_rankable,
+        }
+
+
+@dataclass(frozen=True)
+class EpsilonPolicy:
+    """Additive tolerances for the five promotion objectives."""
+
+    mean_nll: float = 0.0
+    tpot_ms: float = 0.0
+    tps: float = 0.0
+    energy_per_token_j: float = 0.0
+    area_mm2: float = 0.0
+
+    def __post_init__(self) -> None:
+        for name, value in self.to_dict().items():
+            if not math.isfinite(value) or value < 0:
+                raise ValueError(f"{name} epsilon must be finite and non-negative")
+
+    def to_dict(self) -> dict[str, float]:
+        return {
+            "mean_nll": self.mean_nll,
+            "tpot_ms": self.tpot_ms,
+            "tps": self.tps,
+            "energy_per_token_j": self.energy_per_token_j,
+            "area_mm2": self.area_mm2,
+        }
+
+
+def _min_value(value: float | None) -> float:
+    return float("inf") if value is None else value
+
+
+def _max_value(value: float | None) -> float:
+    return float("-inf") if value is None else value
+
+
+def epsilon_dominates(
+    left: ParetoPoint,
+    right: ParetoPoint,
+    epsilon: EpsilonPolicy,
+) -> bool:
+    """Return whether left additively epsilon-dominates right."""
+
+    left_min = (
+        left.mean_nll,
+        _min_value(left.tpot_ms),
+        _min_value(left.energy_per_token_j),
+        _min_value(left.area_mm2),
+    )
+    right_min = (
+        right.mean_nll,
+        _min_value(right.tpot_ms),
+        _min_value(right.energy_per_token_j),
+        _min_value(right.area_mm2),
+    )
+    min_eps = (
+        epsilon.mean_nll,
+        epsilon.tpot_ms,
+        epsilon.energy_per_token_j,
+        epsilon.area_mm2,
+    )
+    weak_min = all(
+        left_value <= right_value + tolerance
+        for left_value, right_value, tolerance in zip(left_min, right_min, min_eps)
+    )
+    strict_min = any(
+        left_value < right_value - tolerance
+        for left_value, right_value, tolerance in zip(left_min, right_min, min_eps)
+    )
+    left_tps = _max_value(left.tps)
+    right_tps = _max_value(right.tps)
+    weak_tps = left_tps >= right_tps - epsilon.tps
+    strict_tps = left_tps > right_tps + epsilon.tps
+    return weak_min and weak_tps and (strict_min or strict_tps)
+
+
+def epsilon_pareto_fronts(
+    points: Iterable[ParetoPoint],
+    epsilon: EpsilonPolicy = EpsilonPolicy(),
+) -> tuple[tuple[ParetoPoint, ...], ...]:
+    """Return deterministic candidate-level fronts without stochastic ranking."""
+
+    remaining = sorted(tuple(points), key=_point_order)
+    identities = tuple(_point_identity(point) for point in remaining)
+    if len(identities) != len(set(identities)):
+        raise ValueError("Pareto points contain duplicate candidate identities")
+    fronts: list[tuple[ParetoPoint, ...]] = []
+    while remaining:
+        front = tuple(
+            point
+            for point in remaining
+            if not any(
+                _point_identity(other) != _point_identity(point)
+                and epsilon_dominates(other, point, epsilon)
+                for other in remaining
+            )
+        )
+        if not front:
+            raise RuntimeError("epsilon dominance did not produce a front")
+        fronts.append(tuple(sorted(front, key=_point_order)))
+        front_ids = {_point_identity(point) for point in front}
+        remaining = [
+            point for point in remaining if _point_identity(point) not in front_ids
+        ]
+    return tuple(fronts)
+
+
+def _point_order(point: ParetoPoint) -> tuple[Any, ...]:
+    return (
+        point.mean_nll,
+        _energy_tier_rank(point.energy_tier),
+        _min_value(point.energy_per_token_j),
+        _min_value(point.tpot_ms),
+        -_max_value(point.tps),
+        _min_value(point.area_mm2),
+        point.profile_id,
+        point.candidate_id or "",
+    )
+
+
+def _point_identity(point: ParetoPoint) -> tuple[str, str]:
+    return point.profile_id, point.candidate_id or ""
+
+
+def _deduplicate_profile_points(
+    points: Iterable[ParetoPoint],
+) -> dict[str, ParetoPoint]:
+    selected: dict[str, ParetoPoint] = {}
+    for point in points:
+        current = selected.get(point.profile_id)
+        if current is None or _point_order(point) < _point_order(current):
+            selected[point.profile_id] = point
+    return selected
+
+
+def _hardware_frontier(points: Iterable[ParetoPoint]) -> tuple[ParetoPoint, ...]:
+    """Keep every exact per-profile latency-energy tradeoff, per evidence tier."""
+
+    grouped: dict[tuple[str, str | None], list[ParetoPoint]] = {}
+    for point in points:
+        if (
+            point.candidate_id is None
+            or point.tpot_ms is None
+            or point.energy_per_token_j is None
+        ):
+            continue
+        grouped.setdefault((point.profile_id, point.energy_tier), []).append(point)
+    retained = []
+    for values in grouped.values():
+        identities = tuple(_point_identity(point) for point in values)
+        if len(identities) != len(set(identities)):
+            raise ValueError("hardware points contain duplicate candidate identities")
+        for point in values:
+            dominated = False
+            for other in values:
+                if _point_identity(other) == _point_identity(point):
+                    continue
+                weak = (
+                    float(other.tpot_ms) <= float(point.tpot_ms)
+                    and float(other.energy_per_token_j)
+                    <= float(point.energy_per_token_j)
+                )
+                strict = (
+                    float(other.tpot_ms) < float(point.tpot_ms)
+                    or float(other.energy_per_token_j)
+                    < float(point.energy_per_token_j)
+                )
+                exact_tie = (
+                    float(other.tpot_ms) == float(point.tpot_ms)
+                    and float(other.energy_per_token_j)
+                    == float(point.energy_per_token_j)
+                    and _point_identity(other) < _point_identity(point)
+                )
+                if weak and (strict or exact_tie):
+                    dominated = True
+                    break
+            if not dominated:
+                retained.append(point)
+    return tuple(sorted(retained, key=_point_order))
+
+
+def _families(point: ParetoPoint) -> set[str]:
+    return {
+        format_descriptor(token).family
+        for token in (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        )
+        if token != "BF16"
+    }
+
+
+def _best_matching(
+    points: Sequence[ParetoPoint],
+    predicate,
+) -> ParetoPoint | None:
+    matched = [point for point in points if predicate(point)]
+    return min(matched, key=_point_order) if matched else None
+
+
+@dataclass(frozen=True)
+class PromotionResult:
+    """Promoted profiles and the control category assigned to each."""
+
+    points: tuple[ParetoPoint, ...]
+    vector_controls: tuple[ParetoPoint, ...]
+    controls: tuple[tuple[str, str], ...]
+    missing_controls: tuple[str, ...]
+    missing_vector_controls: tuple[str, ...]
+    epsilon: EpsilonPolicy
+    hardware_alternatives: tuple[ParetoPoint, ...] = ()
+
+    @property
+    def controls_complete(self) -> bool:
+        return not self.missing_controls and not self.missing_vector_controls
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "points": [point.to_dict() for point in self.points],
+            "vector_controls": [
+                point.to_dict() for point in self.vector_controls
+            ],
+            "controls": dict(self.controls),
+            "missing_controls": list(self.missing_controls),
+            "missing_vector_controls": list(self.missing_vector_controls),
+            "controls_complete": self.controls_complete,
+            "epsilon": self.epsilon.to_dict(),
+            "hardware_alternatives": [
+                point.to_dict() for point in self.hardware_alternatives
+            ],
+        }
+
+
+REFINEMENT_SOURCE_ROLES = (
+    "uniform_mxint8",
+    "uniform_mxint4",
+    "mxint_kv2",
+    "accuracy_constrained_deployment",
+)
+
+
+@dataclass(frozen=True)
+class RefinementSourceSelection:
+    """Four deterministic, measured sources for precision refinement."""
+
+    promotion: PromotionResult
+    source_roles: tuple[tuple[str, str], ...]
+    reference_mean_nll: float
+    relative_perplexity_limit: float
+    deployment_accuracy_gate_passed: bool
+    deployment_fallback_reason: str | None = None
+
+    def __post_init__(self) -> None:
+        if tuple(role for role, _ in self.source_roles) != REFINEMENT_SOURCE_ROLES:
+            raise ValueError("refinement source roles differ from the fixed policy")
+        profile_ids = tuple(profile_id for _, profile_id in self.source_roles)
+        if len(profile_ids) != 4 or len(set(profile_ids)) != 4:
+            raise ValueError("refinement selection requires four distinct sources")
+        if tuple(point.profile_id for point in self.promotion.points) != profile_ids:
+            raise ValueError("refinement promotion order differs from its source roles")
+        if not self.promotion.controls_complete:
+            raise ValueError("refinement source controls are incomplete")
+        if not math.isfinite(self.reference_mean_nll) or self.reference_mean_nll < 0:
+            raise ValueError("reference_mean_nll must be finite and non-negative")
+        if (
+            not math.isfinite(self.relative_perplexity_limit)
+            or self.relative_perplexity_limit <= 1.0
+        ):
+            raise ValueError(
+                "relative_perplexity_limit must be finite and greater than one"
+            )
+        if self.deployment_accuracy_gate_passed:
+            if self.deployment_fallback_reason is not None:
+                raise ValueError("a passed accuracy gate cannot carry a fallback reason")
+        elif not self.deployment_fallback_reason:
+            raise ValueError("a failed accuracy gate requires a fallback reason")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "policy": "four_measured_decode_sources/v1",
+            "source_roles": dict(self.source_roles),
+            "reference_mean_nll": self.reference_mean_nll,
+            "relative_perplexity_limit": self.relative_perplexity_limit,
+            "maximum_mean_nll": (
+                self.reference_mean_nll
+                + math.log(self.relative_perplexity_limit)
+            ),
+            "deployment_accuracy_gate_passed": (
+                self.deployment_accuracy_gate_passed
+            ),
+            "deployment_fallback_reason": self.deployment_fallback_reason,
+            "promotion": self.promotion.to_dict(),
+        }
+
+
+def _uniform_mxint(point: ParetoPoint, bits: int) -> bool:
+    token = f"MXINT{bits}"
+    return (
+        point.profile.kind == PROFILE_KIND_QUANTIZED
+        and (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        )
+        == (token, token, token)
+    )
+
+
+def _deployment_order(point: ParetoPoint) -> tuple[Any, ...]:
+    return (
+        _energy_tier_rank(point.energy_tier),
+        _min_value(point.energy_per_token_j),
+        _min_value(point.tpot_ms),
+        -_max_value(point.tps),
+        _min_value(point.area_mm2),
+        point.mean_nll,
+        point.profile_id,
+        point.candidate_id or "",
+    )
+
+
+def select_refinement_sources(
+    points: Iterable[ParetoPoint],
+    *,
+    reference_mean_nll: float,
+    relative_perplexity_limit: float = 1.01,
+    epsilon: EpsilonPolicy = EpsilonPolicy(),
+) -> RefinementSourceSelection:
+    """Select four distinct, hardware-measured refinement sources."""
+
+    if not math.isfinite(reference_mean_nll) or reference_mean_nll < 0:
+        raise ValueError("reference_mean_nll must be finite and non-negative")
+    if (
+        not math.isfinite(relative_perplexity_limit)
+        or relative_perplexity_limit <= 1.0
+    ):
+        raise ValueError(
+            "relative_perplexity_limit must be finite and greater than one"
+        )
+    values = tuple(points)
+    identities = tuple(_point_identity(point) for point in values)
+    if len(identities) != len(set(identities)):
+        raise ValueError("refinement points contain duplicate candidate identities")
+    quantized = tuple(
+        point
+        for point in values
+        if point.profile.kind == PROFILE_KIND_QUANTIZED
+        and point.whole_model_rankable
+        and all(
+            value is not None
+            for value in (
+                point.tpot_ms,
+                point.tps,
+                point.energy_per_token_j,
+                point.area_mm2,
+            )
+        )
+    )
+    uniform_i8 = _best_matching(
+        quantized,
+        lambda point: _uniform_mxint(point, 8),
+    )
+    uniform_i4 = _best_matching(
+        quantized,
+        lambda point: _uniform_mxint(point, 4),
+    )
+    kv2 = _best_matching(
+        quantized,
+        lambda point: (
+            point.profile.kv_format == "MXINT2"
+            and point.profile.weight_format in {"MXINT4", "MXINT8"}
+            and point.profile.activation_format in {"MXINT4", "MXINT8"}
+        ),
+    )
+    required = {
+        "uniform_mxint8": uniform_i8,
+        "uniform_mxint4": uniform_i4,
+        "mxint_kv2": kv2,
+    }
+    missing = tuple(name for name, point in required.items() if point is None)
+    if missing:
+        raise ValueError(f"required refinement sources are missing: {missing}")
+    selected = tuple(point for point in required.values() if point is not None)
+    selected_ids = {point.profile_id for point in selected}
+    remaining = tuple(
+        point for point in quantized if point.profile_id not in selected_ids
+    )
+    if not remaining:
+        raise ValueError("no distinct deployment source remains after controls")
+    pareto = epsilon_pareto_fronts(remaining, epsilon)[0]
+    maximum_nll = reference_mean_nll + math.log(relative_perplexity_limit)
+    accurate = tuple(point for point in pareto if point.mean_nll <= maximum_nll)
+    if accurate:
+        deployment = min(accurate, key=_deployment_order)
+        gate_passed = True
+        fallback_reason = None
+    else:
+        deployment = min(pareto, key=_point_order)
+        gate_passed = False
+        fallback_reason = "no_distinct_pareto_source_met_relative_perplexity_limit"
+    sources = selected + (deployment,)
+    roles = tuple(
+        (role, point.profile_id)
+        for role, point in zip(REFINEMENT_SOURCE_ROLES, sources)
+    )
+    vector_controls: list[ParetoPoint] = []
+    missing_vector: list[str] = []
+    seen_triples: set[tuple[str, str, str]] = set()
+    for point in sources:
+        triple = (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        )
+        if triple in seen_triples:
+            continue
+        seen_triples.add(triple)
+        control = _best_matching(
+            tuple(
+                candidate
+                for candidate in values
+                if candidate.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+            ),
+            lambda candidate, expected=triple: (
+                candidate.profile.weight_format,
+                candidate.profile.activation_format,
+                candidate.profile.kv_format,
+            )
+            == expected,
+        )
+        if control is None:
+            missing_vector.append("/".join(triple))
+        else:
+            vector_controls.append(control)
+    promotion = PromotionResult(
+        points=sources,
+        vector_controls=tuple(vector_controls),
+        controls=roles,
+        missing_controls=(),
+        missing_vector_controls=tuple(missing_vector),
+        epsilon=epsilon,
+        hardware_alternatives=_hardware_frontier(
+            point for point in quantized if point.profile_id in selected_ids | {deployment.profile_id}
+        ),
+    )
+    if not promotion.controls_complete:
+        raise ValueError(
+            "vector-BF16 controls are missing for selected refinement sources: "
+            f"{promotion.missing_vector_controls}"
+        )
+    return RefinementSourceSelection(
+        promotion=promotion,
+        source_roles=roles,
+        reference_mean_nll=reference_mean_nll,
+        relative_perplexity_limit=relative_perplexity_limit,
+        deployment_accuracy_gate_passed=gate_passed,
+        deployment_fallback_reason=fallback_reason,
+    )
+
+
+def promote_epsilon_pareto(
+    points: Iterable[ParetoPoint],
+    *,
+    limit: int = 24,
+    epsilon: EpsilonPolicy = EpsilonPolicy(),
+    preserve_controls: bool = True,
+) -> PromotionResult:
+    """Promote epsilon fronts while retaining the required attribution points."""
+
+    if limit <= 0:
+        raise ValueError("promotion limit must be positive")
+    values = tuple(points)
+    identities = tuple(_point_identity(point) for point in values)
+    if len(identities) != len(set(identities)):
+        raise ValueError("promotion points contain duplicate candidate identities")
+    quantized = tuple(
+        point for point in values if point.profile.kind == PROFILE_KIND_QUANTIZED
+    )
+    ranked_candidates = quantized or unique
+    ranked = tuple(
+        point
+        for front in epsilon_pareto_fronts(ranked_candidates, epsilon)
+        for point in front
+    )
+    control_points: dict[str, ParetoPoint | None] = {}
+    if preserve_controls:
+        control_points = {
+            "uniform_i8": _best_matching(
+                quantized,
+                lambda point: all(
+                    token == "MXINT8"
+                    for token in (
+                        point.profile.weight_format,
+                        point.profile.activation_format,
+                        point.profile.kv_format,
+                    )
+                ),
+            ),
+            "uniform_i4": _best_matching(
+                quantized,
+                lambda point: all(
+                    token == "MXINT4"
+                    for token in (
+                        point.profile.weight_format,
+                        point.profile.activation_format,
+                        point.profile.kv_format,
+                    )
+                ),
+            ),
+            "all_mxfp": _best_matching(
+                quantized,
+                lambda point: _families(point) == {"mxfp"},
+            ),
+            "mixed_family_oracle": _best_matching(
+                quantized,
+                lambda point: len(_families(point)) > 1,
+            ),
+        }
+        for bits in (2, 4, 8):
+            control_points[f"kv{bits}"] = _best_matching(
+                quantized,
+                lambda point, expected=bits: (
+                    format_descriptor(point.profile.kv_format).element_bits == expected
+                ),
+            )
+
+    missing = tuple(
+        name for name, point in sorted(control_points.items()) if point is None
+    )
+    controls = tuple(
+        (name, point.profile_id)
+        for name, point in sorted(control_points.items())
+        if point is not None
+    )
+    promoted: list[ParetoPoint] = []
+    promoted_ids: set[str] = set()
+    for _, profile_id in controls:
+        point = min(
+            (point for point in values if point.profile_id == profile_id),
+            key=_point_order,
+        )
+        if profile_id not in promoted_ids:
+            promoted.append(point)
+            promoted_ids.add(profile_id)
+    if len(promoted) > limit:
+        raise ValueError("promotion limit is smaller than the unique control set")
+    for point in ranked:
+        if len(promoted) >= limit:
+            break
+        if point.profile_id not in promoted_ids:
+            promoted.append(point)
+            promoted_ids.add(point.profile_id)
+    vector_controls: list[ParetoPoint] = []
+    missing_vector: list[str] = []
+    seen_triples: set[tuple[str, str, str]] = set()
+    for point in promoted:
+        if point.profile.kind != PROFILE_KIND_QUANTIZED:
+            continue
+        triple = (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        )
+        if triple in seen_triples:
+            continue
+        seen_triples.add(triple)
+        control = _best_matching(
+            tuple(
+                candidate
+                for candidate in values
+                if candidate.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+            ),
+            lambda candidate, expected=triple: (
+                candidate.profile.weight_format,
+                candidate.profile.activation_format,
+                candidate.profile.kv_format,
+            )
+            == expected,
+        )
+        if control is None:
+            missing_vector.append("/".join(triple))
+        else:
+            vector_controls.append(control)
+    return PromotionResult(
+        points=tuple(promoted),
+        vector_controls=tuple(vector_controls),
+        controls=controls,
+        missing_controls=missing,
+        missing_vector_controls=tuple(missing_vector),
+        epsilon=epsilon,
+        hardware_alternatives=_hardware_frontier(
+            point for point in quantized if point.profile_id in promoted_ids
+        ),
+    )
+
+
+@dataclass(frozen=True)
+class FidelityReport:
+    """Numerical-screen to hardware-validation ranking and recovery gates."""
+
+    spearman: float
+    top_k_recall: float
+    common_profiles: int
+    top_k: int
+    spearman_threshold: float
+    recall_threshold: float
+    numerical_screen_top_ids: tuple[str, ...]
+    hardware_validation_top_ids: tuple[str, ...]
+
+    @property
+    def passed(self) -> bool:
+        return (
+            self.spearman >= self.spearman_threshold
+            and self.top_k_recall >= self.recall_threshold
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "passed": self.passed,
+            "spearman": self.spearman,
+            "top_k_recall": self.top_k_recall,
+            "common_profiles": self.common_profiles,
+            "top_k": self.top_k,
+            "spearman_threshold": self.spearman_threshold,
+            "recall_threshold": self.recall_threshold,
+            "numerical_screen_top_ids": list(self.numerical_screen_top_ids),
+            "hardware_validation_top_ids": list(self.hardware_validation_top_ids),
+        }
+
+
+def evaluate_screening_fidelity(
+    numerical_screen_points: Iterable[ParetoPoint],
+    hardware_validation_points: Iterable[ParetoPoint],
+    *,
+    top_k: int = 24,
+    epsilon: EpsilonPolicy = EpsilonPolicy(),
+    spearman_threshold: float = 0.90,
+    recall_threshold: float = 0.90,
+) -> FidelityReport:
+    """Compare common-profile NLL ranks and epsilon-Pareto top-set recall."""
+
+    if top_k <= 0:
+        raise ValueError("top_k must be positive")
+    if not 0.0 <= spearman_threshold <= 1.0:
+        raise ValueError("spearman_threshold must be in [0, 1]")
+    if not 0.0 <= recall_threshold <= 1.0:
+        raise ValueError("recall_threshold must be in [0, 1]")
+    numerical_screen_all = _deduplicate_profile_points(numerical_screen_points)
+    hardware_validation_all = _deduplicate_profile_points(hardware_validation_points)
+    numerical_screen_quantized = {
+        profile_id: point
+        for profile_id, point in numerical_screen_all.items()
+        if point.profile.kind == PROFILE_KIND_QUANTIZED
+    }
+    hardware_validation_quantized = {
+        profile_id: point
+        for profile_id, point in hardware_validation_all.items()
+        if point.profile.kind == PROFILE_KIND_QUANTIZED
+    }
+    numerical_screen = numerical_screen_quantized or numerical_screen_all
+    hardware_validation = hardware_validation_quantized or hardware_validation_all
+    common = tuple(sorted(set(numerical_screen) & set(hardware_validation)))
+    if len(common) < 2:
+        raise ValueError("fidelity requires at least two common profiles")
+    correlation = spearman_rank_correlation(
+        [numerical_screen[profile_id].mean_nll for profile_id in common],
+        [hardware_validation[profile_id].mean_nll for profile_id in common],
+    )
+    numerical_screen_ranked = [
+        point
+        for front in epsilon_pareto_fronts(numerical_screen.values(), epsilon)
+        for point in front
+    ]
+    hardware_validation_ranked = [
+        point
+        for front in epsilon_pareto_fronts(hardware_validation.values(), epsilon)
+        for point in front
+    ]
+    numerical_screen_top = tuple(point.profile_id for point in numerical_screen_ranked[:top_k])
+    hardware_validation_top = tuple(point.profile_id for point in hardware_validation_ranked[:top_k])
+    denominator = len(hardware_validation_top)
+    recall = len(set(numerical_screen_top) & set(hardware_validation_top)) / denominator if denominator else 0.0
+    return FidelityReport(
+        spearman=correlation,
+        top_k_recall=recall,
+        common_profiles=len(common),
+        top_k=top_k,
+        spearman_threshold=spearman_threshold,
+        recall_threshold=recall_threshold,
+        numerical_screen_top_ids=numerical_screen_top,
+        hardware_validation_top_ids=hardware_validation_top,
+    )
+
+
+@dataclass(frozen=True)
+class DocumentNLL:
+    document_id: str
+    nll_sum: float
+    token_count: int
+
+    def __post_init__(self) -> None:
+        if not self.document_id:
+            raise ValueError("document_id must be non-empty")
+        if not math.isfinite(self.nll_sum) or self.nll_sum < 0:
+            raise ValueError("nll_sum must be finite and non-negative")
+        if self.token_count <= 0:
+            raise ValueError("token_count must be positive")
+
+
+@dataclass(frozen=True)
+class PairedDocumentScore:
+    document_id: str
+    reference_score: float
+    candidate_score: float
+
+    def __post_init__(self) -> None:
+        if not self.document_id:
+            raise ValueError("document_id must be non-empty")
+        if not all(
+            math.isfinite(value)
+            for value in (self.reference_score, self.candidate_score)
+        ):
+            raise ValueError("paired scores must be finite")
+
+
+@dataclass(frozen=True)
+class BootstrapInterval:
+    estimate: float
+    lower: float
+    upper: float
+    confidence: float
+    samples: int
+    seed: int
+    cluster_count: int
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "estimate": self.estimate,
+            "lower": self.lower,
+            "upper": self.upper,
+            "confidence": self.confidence,
+            "samples": self.samples,
+            "seed": self.seed,
+            "cluster_count": self.cluster_count,
+        }
+
+
+def _validate_bootstrap(
+    count: int,
+    samples: int,
+    confidence: float,
+) -> None:
+    if count < 2:
+        raise ValueError("at least two document clusters are required")
+    if samples <= 0:
+        raise ValueError("bootstrap samples must be positive")
+    if not 0.0 < confidence < 1.0:
+        raise ValueError("confidence must be in (0, 1)")
+
+
+def clustered_nll_bootstrap(
+    documents: Iterable[DocumentNLL],
+    *,
+    samples: int = 2000,
+    confidence: float = 0.95,
+    seed: int = 0,
+) -> BootstrapInterval:
+    """Bootstrap micro-average NLL by resampling whole documents."""
+
+    values = tuple(sorted(documents, key=lambda value: value.document_id))
+    if len({value.document_id for value in values}) != len(values):
+        raise ValueError("document IDs must be unique")
+    _validate_bootstrap(len(values), samples, confidence)
+    estimate = sum(value.nll_sum for value in values) / sum(
+        value.token_count for value in values
+    )
+    generator = random.Random(seed)
+    replicates: list[float] = []
+    for _ in range(samples):
+        selected = [values[generator.randrange(len(values))] for _ in values]
+        replicates.append(
+            sum(value.nll_sum for value in selected)
+            / sum(value.token_count for value in selected)
+        )
+    alpha = (1.0 - confidence) / 2.0
+    return BootstrapInterval(
+        estimate=estimate,
+        lower=percentile(replicates, alpha),
+        upper=percentile(replicates, 1.0 - alpha),
+        confidence=confidence,
+        samples=samples,
+        seed=seed,
+        cluster_count=len(values),
+    )
+
+
+def paired_task_bootstrap(
+    documents: Iterable[PairedDocumentScore],
+    *,
+    samples: int = 2000,
+    confidence: float = 0.95,
+    seed: int = 0,
+) -> BootstrapInterval:
+    """Bootstrap paired candidate-minus-reference score differences by document."""
+
+    values = tuple(sorted(documents, key=lambda value: value.document_id))
+    if len({value.document_id for value in values}) != len(values):
+        raise ValueError("document IDs must be unique")
+    _validate_bootstrap(len(values), samples, confidence)
+    differences = [
+        value.candidate_score - value.reference_score for value in values
+    ]
+    estimate = sum(differences) / len(differences)
+    generator = random.Random(seed)
+    replicates = [
+        sum(differences[generator.randrange(len(differences))] for _ in differences)
+        / len(differences)
+        for _ in range(samples)
+    ]
+    alpha = (1.0 - confidence) / 2.0
+    return BootstrapInterval(
+        estimate=estimate,
+        lower=percentile(replicates, alpha),
+        upper=percentile(replicates, 1.0 - alpha),
+        confidence=confidence,
+        samples=samples,
+        seed=seed,
+        cluster_count=len(values),
+    )
+
+
+@dataclass(frozen=True)
+class PublicationCandidate:
+    """Full-evaluation row used by the final deployment gate."""
+
+    evaluation_class: str
+    profile_id: str
+    candidate_id: str
+    profile_kind: str
+    perplexity: float
+    tpot_ms: float | None
+    energy_per_token_j: float | None
+    validity: StackValidity
+    hardware_candidate: bool = True
+    power_calibration_id: str | None = None
+    cost_scope: str | None = None
+    system_calibration_id: str | None = None
+    head_service_calibration_id: str | None = None
+    whole_model_rankable: bool = False
+    timing_mode: str = "rtl_serialized"
+    timing_calibrated: bool = False
+    timing_evidence_id: str | None = None
+    task_delta_lower_ci: tuple[tuple[str, float], ...] = ()
+    ruler_scores: tuple[tuple[int, float, float], ...] = ()
+    energy_tier: str | None = None
+
+    def __post_init__(self) -> None:
+        if not self.evaluation_class or not self.profile_id or not self.candidate_id:
+            raise ValueError("publication candidate identities must be non-empty")
+        _finite_optional("perplexity", self.perplexity, positive=True)
+        _finite_optional("tpot_ms", self.tpot_ms, positive=True)
+        _finite_optional(
+            "energy_per_token_j",
+            self.energy_per_token_j,
+            positive=True,
+        )
+        if (self.energy_per_token_j is not None) != bool(
+            self.power_calibration_id
+        ):
+            raise ValueError(
+                "energy requires one power calibration identity"
+            )
+        tier = self.energy_tier
+        if self.energy_per_token_j is not None and tier is None:
+            tier = "dc_calibrated"
+            object.__setattr__(self, "energy_tier", tier)
+        if tier is not None and tier not in ENERGY_TIERS:
+            raise ValueError("energy_tier is unsupported")
+        if self.energy_per_token_j is None and tier is not None:
+            raise ValueError("energy_tier requires energy")
+        has_serving_cost = (
+            self.tpot_ms is not None
+            or self.energy_per_token_j is not None
+        )
+        if has_serving_cost:
+            if (
+                not self.whole_model_rankable
+                or self.cost_scope != "whole_model"
+                or not self.system_calibration_id
+                or not self.head_service_calibration_id
+            ):
+                raise ValueError(
+                    "deployment costs require a calibrated whole-model boundary"
+                )
+        elif any(
+            (
+                self.whole_model_rankable,
+                self.cost_scope is not None,
+                self.system_calibration_id is not None,
+                self.head_service_calibration_id is not None,
+            )
+        ):
+            raise ValueError(
+                "whole-model identities require deployment costs"
+            )
+        is_reference_class = self.evaluation_class == "bf16_reference"
+        is_reference_kind = self.profile_kind == PROFILE_KIND_BF16_REFERENCE
+        if is_reference_class != is_reference_kind:
+            raise ValueError("BF16 reference class and profile kind must match")
+        if is_reference_class:
+            if self.hardware_candidate:
+                raise ValueError("the BF16 reference is not a PLENA candidate")
+            if (
+                self.tpot_ms is not None
+                or self.energy_per_token_j is not None
+                or self.power_calibration_id is not None
+                or self.cost_scope is not None
+                or self.system_calibration_id is not None
+                or self.head_service_calibration_id is not None
+                or self.whole_model_rankable
+                or self.energy_tier is not None
+                or self.timing_calibrated
+                or self.timing_evidence_id is not None
+            ):
+                raise ValueError(
+                    "the BF16 accuracy reference cannot carry PLENA cost evidence"
+                )
+        if not self.timing_mode:
+            raise ValueError("timing_mode must be non-empty")
+        if self.timing_calibrated != bool(self.timing_evidence_id):
+            raise ValueError(
+                "timing calibration requires a timing evidence identity"
+            )
+        tasks = tuple(sorted((str(name), float(value)) for name, value in self.task_delta_lower_ci))
+        if len({name for name, _ in tasks}) != len(tasks):
+            raise ValueError("task confidence bounds must have unique names")
+        if not all(math.isfinite(value) for _, value in tasks):
+            raise ValueError("task confidence bounds must be finite")
+        ruler = tuple(
+            sorted(
+                (int(length), float(candidate), float(reference))
+                for length, candidate, reference in self.ruler_scores
+            )
+        )
+        if len({length for length, _, _ in ruler}) != len(ruler):
+            raise ValueError("RULER lengths must be unique")
+        if any(
+            length <= 0
+            or not math.isfinite(candidate)
+            or not math.isfinite(reference)
+            or reference <= 0
+            for length, candidate, reference in ruler
+        ):
+            raise ValueError("RULER scores and lengths must be valid")
+        object.__setattr__(self, "task_delta_lower_ci", tasks)
+        object.__setattr__(self, "ruler_scores", ruler)
+
+    @property
+    def fully_hardware_valid(self) -> bool:
+        stack_fields = (
+            "software_valid",
+            "compiler_valid",
+            "emulator_valid",
+            "rtl_valid",
+        )
+        return (
+            self.timing_calibrated
+            and self.power_calibration_id is not None
+            and self.energy_tier in ENERGY_TIERS
+            and self.whole_model_rankable
+            and self.cost_scope == "whole_model"
+            and self.system_calibration_id is not None
+            and self.head_service_calibration_id is not None
+            and all(getattr(self.validity, field) is True for field in stack_fields)
+            and (
+                self.energy_tier != "dc_calibrated"
+                or self.validity.dc_calibrated is True
+            )
+        )
+
+    @property
+    def tokens_per_joule(self) -> float | None:
+        if self.energy_per_token_j is None:
+            return None
+        return 1.0 / self.energy_per_token_j
+
+    @property
+    def edp_j_s(self) -> float | None:
+        if self.energy_per_token_j is None or self.tpot_ms is None:
+            return None
+        return self.energy_per_token_j * self.tpot_ms / 1000.0
+
+    @property
+    def reference_scope(self) -> str | None:
+        if self.evaluation_class == "bf16_reference":
+            return BF16_REFERENCE_SCOPE
+        return None
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "evaluation_class": self.evaluation_class,
+            "profile_id": self.profile_id,
+            "candidate_id": self.candidate_id,
+            "profile_kind": self.profile_kind,
+            "perplexity": self.perplexity,
+            "tpot_ms": self.tpot_ms,
+            "energy_per_token_j": self.energy_per_token_j,
+            "energy_tier": self.energy_tier,
+            "tokens_per_joule": self.tokens_per_joule,
+            "edp_j_s": self.edp_j_s,
+            "validity": self.validity.to_dict(),
+            "hardware_candidate": self.hardware_candidate,
+            "reference_scope": self.reference_scope,
+            "power_calibration_id": self.power_calibration_id,
+            "cost_scope": self.cost_scope,
+            "system_calibration_id": self.system_calibration_id,
+            "head_service_calibration_id": (
+                self.head_service_calibration_id
+            ),
+            "whole_model_rankable": self.whole_model_rankable,
+            "timing_mode": self.timing_mode,
+            "timing_calibrated": self.timing_calibrated,
+            "timing_evidence_id": self.timing_evidence_id,
+            "task_delta_lower_ci": dict(self.task_delta_lower_ci),
+            "ruler_scores": [
+                {
+                    "length": length,
+                    "candidate_score": candidate,
+                    "reference_score": reference,
+                    "retention": candidate / reference,
+                }
+                for length, candidate, reference in self.ruler_scores
+            ],
+        }
+
+
+@dataclass(frozen=True)
+class FinalSelectionDecision:
+    """Selection result with explicit global and per-candidate failures."""
+
+    selected: PublicationCandidate | None
+    calibration_id: str | None
+    timing_evidence_id: str | None
+    timing_mode: str | None
+    head_service_calibration_id: str | None
+    system_calibration_id: str | None
+    global_failures: tuple[str, ...]
+    candidate_failures: tuple[tuple[str, tuple[str, ...]], ...]
+    relative_ppl_limit: float
+    task_margin_points: float
+    ruler_retention: float
+    energy_tier: str | None = None
+    bf16_reference_scope: str = BF16_REFERENCE_SCOPE
+    schema_version: str = SELECTION_REPORT_SCHEMA
+
+    @property
+    def selected_profile_id(self) -> str | None:
+        return self.selected.profile_id if self.selected else None
+
+    def to_dict(self) -> dict[str, Any]:
+        body = {
+            "schema_version": self.schema_version,
+            "selected": self.selected.to_dict() if self.selected else None,
+            "calibration_id": self.calibration_id,
+            "timing_evidence_id": self.timing_evidence_id,
+            "timing_mode": self.timing_mode,
+            "head_service_calibration_id": (
+                self.head_service_calibration_id
+            ),
+            "system_calibration_id": self.system_calibration_id,
+            "energy_tier": self.energy_tier,
+            "global_failures": list(self.global_failures),
+            "candidate_failures": {
+                key: list(value) for key, value in self.candidate_failures
+            },
+            "relative_ppl_limit": self.relative_ppl_limit,
+            "task_margin_points": self.task_margin_points,
+            "ruler_retention": self.ruler_retention,
+            "bf16_reference_scope": self.bf16_reference_scope,
+            "cost_scope": "whole_model",
+            "objective": ["energy_per_token_j", "tpot_ms"],
+        }
+        return {**body, "decision_hash": _hash(body)}
+
+
+def select_final_deployment(
+    candidates: Iterable[PublicationCandidate],
+    *,
+    calibration: CalibrationEvidence | None,
+    timing_evidence: TimingCalibrationEvidence | None,
+    head_service_evidence: HeadServiceEvidence | None = None,
+    relative_ppl_limit: float = 0.01,
+    task_margin_points: float = 2.0,
+    ruler_retention: float = 0.98,
+    required_tasks: Sequence[str] = DEFAULT_REQUIRED_TASKS,
+    required_ruler_lengths: Sequence[int] = DEFAULT_RULER_LENGTHS,
+) -> FinalSelectionDecision:
+    """Select the strongest available energy tier, then energy and TPOT."""
+
+    if relative_ppl_limit < 0 or not math.isfinite(relative_ppl_limit):
+        raise ValueError("relative_ppl_limit must be finite and non-negative")
+    if task_margin_points < 0 or not math.isfinite(task_margin_points):
+        raise ValueError("task_margin_points must be finite and non-negative")
+    if not 0.0 < ruler_retention <= 1.0:
+        raise ValueError("ruler_retention must be in (0, 1]")
+    values = tuple(candidates)
+    identities = [(value.profile_id, value.candidate_id) for value in values]
+    if len(identities) != len(set(identities)):
+        raise ValueError("publication configurations must be distinct")
+    global_failures: list[str] = []
+    calibration_passed = False
+    calibration_id = None
+    if calibration is not None:
+        candidate_calibration_id = calibration.calibration_id
+        try:
+            calibration_id = require_content_addressed_id(
+                "power calibration",
+                candidate_calibration_id,
+            )
+        except ValueError:
+            calibration_id = None
+        calibration_passed = bool(calibration.passed and calibration_id)
+    if timing_evidence is None:
+        global_failures.append("timing_evidence_missing")
+        timing_evidence_id = None
+        timing_mode = None
+    else:
+        timing_evidence_id = timing_evidence.evidence_id
+        timing_mode = timing_evidence.mode
+        try:
+            timing_evidence_id = require_content_addressed_id(
+                "timing evidence",
+                timing_evidence_id,
+                prefix="timing-",
+            )
+        except ValueError:
+            global_failures.append("timing_evidence_identity")
+            timing_evidence_id = None
+        if not timing_mode:
+            global_failures.append("timing_evidence_mode")
+        if not timing_evidence.passed:
+            global_failures.append("timing_evidence_gate")
+    if head_service_evidence is None:
+        global_failures.append("head_service_evidence_missing")
+        head_service_calibration_id = None
+        head_service_provenance_id = None
+    else:
+        head_service_calibration_id = (
+            head_service_evidence.calibration_id
+        )
+        try:
+            head_service_calibration_id = require_content_addressed_id(
+                "head-service calibration",
+                head_service_calibration_id,
+                prefix="bf16-head-service-",
+            )
+        except ValueError:
+            global_failures.append("head_service_evidence_identity")
+            head_service_calibration_id = None
+        head_service_provenance_id = (
+            head_service_evidence.provenance_id
+        )
+        try:
+            head_service_provenance_id = require_content_addressed_id(
+                "head-service provenance",
+                head_service_provenance_id,
+                prefix="bf16-head-provenance-",
+            )
+        except ValueError:
+            global_failures.append("head_service_provenance_identity")
+            head_service_provenance_id = None
+        if head_service_evidence.service_mode != HEAD_SERVICE_MODE:
+            global_failures.append("head_service_mode")
+        if not head_service_evidence.passed:
+            global_failures.append("head_service_evidence_gate")
+    if (
+        not head_service_calibration_id
+        or not head_service_provenance_id
+        or (
+            head_service_evidence is not None
+            and head_service_evidence.service_mode != HEAD_SERVICE_MODE
+        )
+    ):
+        system_calibration_id = None
+    else:
+        system_calibration_id = None
+    def bound_system_identity(value: PublicationCandidate) -> bool:
+        if (
+            not value.power_calibration_id
+            or not head_service_calibration_id
+            or not head_service_provenance_id
+        ):
+            return False
+        try:
+            power_id = require_content_addressed_id(
+                "candidate energy",
+                value.power_calibration_id,
+            )
+            expected = composite_system_calibration_id(
+                power_id,
+                head_service_calibration_id,
+                head_service_provenance_id,
+            )
+        except ValueError:
+            return False
+        if value.system_calibration_id != expected:
+            return False
+        if value.energy_tier == "dc_calibrated":
+            return calibration_passed and power_id == calibration_id
+        return value.energy_tier == "analytic_anchored"
+
+    by_class = {value.evaluation_class for value in values}
+    reference_rows = [
+        value for value in values if value.evaluation_class == "bf16_reference"
+    ]
+    if len(reference_rows) != 1:
+        if not reference_rows:
+            global_failures.append("missing_bf16_reference")
+        else:
+            global_failures.append("count_bf16_reference")
+    else:
+        reference = reference_rows[0]
+        if (
+            reference.hardware_candidate
+            or reference.validity.software_valid is not True
+            or reference.reference_scope != BF16_REFERENCE_SCOPE
+        ):
+            global_failures.append("invalid_bf16_accuracy_reference")
+    for required_class in (
+        "uniform_i8",
+        "uniform_i4",
+        "pareto_candidate",
+    ):
+        if required_class not in by_class:
+            global_failures.append(f"missing_{required_class}")
+        elif sum(
+            value.evaluation_class == required_class for value in values
+        ) != 1:
+            global_failures.append(f"count_{required_class}")
+        elif not any(
+            value.evaluation_class == required_class
+            and value.hardware_candidate
+            and value.fully_hardware_valid
+            and bound_system_identity(value)
+            and value.head_service_calibration_id
+            == head_service_calibration_id
+            and value.timing_evidence_id == timing_evidence_id
+            and value.timing_mode == timing_mode
+            for value in values
+        ):
+            global_failures.append(f"invalid_{required_class}")
+    references = [
+        value
+        for value in values
+        if value.evaluation_class == "bf16_reference"
+        and value.profile_kind == PROFILE_KIND_BF16_REFERENCE
+    ]
+    if len(references) != 1:
+        global_failures.append("bf16_reference_count")
+        reference_ppl = None
+    else:
+        reference_ppl = references[0].perplexity
+
+    required_task_set = frozenset(str(value) for value in required_tasks)
+    required_length_set = frozenset(int(value) for value in required_ruler_lengths)
+    if not required_task_set:
+        raise ValueError("at least one required task is needed")
+    if not required_length_set or any(length <= 0 for length in required_length_set):
+        raise ValueError("required RULER lengths must be positive")
+    failures_by_candidate: list[tuple[str, tuple[str, ...]]] = []
+    eligible: list[PublicationCandidate] = []
+    for value in values:
+        if value in references:
+            continue
+        failures: list[str] = []
+        if not value.hardware_candidate:
+            failures.append("static_hardware_legality")
+        if not value.fully_hardware_valid:
+            failures.append("cross_stack_validity")
+        if value.energy_per_token_j is None or value.tpot_ms is None:
+            failures.append("calibrated_cost_missing")
+        if value.energy_tier not in ENERGY_TIERS:
+            failures.append("energy_tier")
+        if not bound_system_identity(value):
+            if value.energy_tier == "dc_calibrated":
+                if not calibration_passed:
+                    failures.append("power_calibration_gate")
+                elif value.power_calibration_id != calibration_id:
+                    failures.append("power_calibration_identity")
+            else:
+                failures.append("energy_identity")
+        if (
+            value.head_service_calibration_id
+            != head_service_calibration_id
+        ):
+            failures.append("head_service_calibration_identity")
+        if not bound_system_identity(value):
+            failures.append("system_calibration_identity")
+        if (
+            value.timing_evidence_id != timing_evidence_id
+            or value.timing_mode != timing_mode
+        ):
+            failures.append("timing_evidence_identity")
+        if reference_ppl is None:
+            failures.append("bf16_perplexity_missing")
+        elif value.perplexity / reference_ppl - 1.0 > relative_ppl_limit:
+            failures.append("relative_perplexity")
+        task_bounds = dict(value.task_delta_lower_ci)
+        if not required_task_set.issubset(task_bounds):
+            failures.append("task_confidence_missing")
+        elif any(
+            task_bounds[name] < -task_margin_points for name in required_task_set
+        ):
+            failures.append("task_confidence")
+        ruler = {
+            length: candidate / reference
+            for length, candidate, reference in value.ruler_scores
+        }
+        if not required_length_set.issubset(ruler):
+            failures.append("ruler_lengths_missing")
+        elif any(ruler[length] < ruler_retention for length in required_length_set):
+            failures.append("ruler_retention")
+        key = f"{value.profile_id}/{value.candidate_id}"
+        failures_by_candidate.append((key, tuple(failures)))
+        if not failures:
+            eligible.append(value)
+    selected = None
+    if not global_failures and eligible:
+        selected = min(
+            eligible,
+            key=lambda value: (
+                _energy_tier_rank(value.energy_tier),
+                float(value.energy_per_token_j),
+                float(value.tpot_ms),
+                value.profile_id,
+                value.candidate_id,
+            ),
+        )
+    selected_calibration_id = (
+        selected.power_calibration_id if selected is not None else calibration_id
+    )
+    selected_system_id = (
+        selected.system_calibration_id if selected is not None else None
+    )
+    return FinalSelectionDecision(
+        selected=selected,
+        calibration_id=selected_calibration_id,
+        timing_evidence_id=timing_evidence_id,
+        timing_mode=timing_mode,
+        head_service_calibration_id=head_service_calibration_id,
+        system_calibration_id=selected_system_id,
+        global_failures=tuple(global_failures),
+        candidate_failures=tuple(failures_by_candidate),
+        relative_ppl_limit=relative_ppl_limit,
+        task_margin_points=task_margin_points,
+        ruler_retention=ruler_retention,
+        energy_tier=(selected.energy_tier if selected is not None else None),
+    )
+
+
+def write_selection_report(
+    path: str | os.PathLike[str],
+    decision: FinalSelectionDecision,
+    *,
+    provenance_hashes: Mapping[str, str],
+) -> Path:
+    """Atomically create an immutable selection report."""
+
+    destination = Path(path)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    body = {
+        "schema_version": SELECTION_REPORT_SCHEMA,
+        "provenance_hashes": dict(sorted(provenance_hashes.items())),
+        "decision": decision.to_dict(),
+    }
+    payload = _canonical_bytes(
+        {**body, "report_hash": _hash(body)},
+        newline=True,
+    )
+    if destination.exists():
+        if destination.read_bytes() != payload:
+            raise FileExistsError(
+                f"refusing to replace a different selection report: {destination}"
+            )
+        return destination
+    temporary_name: str | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=destination.parent,
+            prefix=f".{destination.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as temporary:
+            temporary_name = temporary.name
+            temporary.write(payload)
+            temporary.flush()
+            os.fsync(temporary.fileno())
+        os.chmod(temporary_name, 0o644)
+        os.link(temporary_name, destination)
+    finally:
+        if temporary_name and os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return destination
+
+
+__all__ = [
+    "BF16_REFERENCE_SCOPE",
+    "BootstrapInterval",
+    "DEFAULT_REQUIRED_TASKS",
+    "DEFAULT_RULER_LENGTHS",
+    "DocumentNLL",
+    "EpsilonPolicy",
+    "FidelityReport",
+    "FinalSelectionDecision",
+    "HeadServiceEvidence",
+    "PairedDocumentScore",
+    "ParetoPoint",
+    "PromotionResult",
+    "PublicationCandidate",
+    "REFINEMENT_SOURCE_ROLES",
+    "RefinementSourceSelection",
+    "clustered_nll_bootstrap",
+    "epsilon_dominates",
+    "epsilon_pareto_fronts",
+    "evaluate_screening_fidelity",
+    "paired_task_bootstrap",
+    "promote_epsilon_pareto",
+    "select_refinement_sources",
+    "select_final_deployment",
+    "write_selection_report",
+]
diff --git a/decode_dse/hardware/statistics.py b/decode_dse/hardware/statistics.py
new file mode 100644
index 0000000..ad9b633
--- /dev/null
+++ b/decode_dse/hardware/statistics.py
@@ -0,0 +1,74 @@
+"""Deterministic statistical helpers used by hardware result gates."""
+
+from __future__ import annotations
+
+import math
+from typing import Sequence
+
+
+def _average_ranks(values: Sequence[float]) -> list[float]:
+    indexed = sorted(enumerate(values), key=lambda item: (item[1], item[0]))
+    ranks = [0.0] * len(values)
+    start = 0
+    while start < len(indexed):
+        end = start + 1
+        while end < len(indexed) and indexed[end][1] == indexed[start][1]:
+            end += 1
+        rank = (start + 1 + end) / 2.0
+        for index, _ in indexed[start:end]:
+            ranks[index] = rank
+        start = end
+    return ranks
+
+
+def spearman_rank_correlation(
+    first: Sequence[float],
+    second: Sequence[float],
+) -> float:
+    """Return tie-aware Spearman correlation for aligned finite observations."""
+
+    if len(first) != len(second):
+        raise ValueError("rank vectors must have equal length")
+    if len(first) < 2:
+        raise ValueError("at least two observations are required")
+    left = [float(value) for value in first]
+    right = [float(value) for value in second]
+    if not all(math.isfinite(value) for value in (*left, *right)):
+        raise ValueError("rank observations must be finite")
+    left_rank = _average_ranks(left)
+    right_rank = _average_ranks(right)
+    left_mean = sum(left_rank) / len(left_rank)
+    right_mean = sum(right_rank) / len(right_rank)
+    numerator = sum(
+        (left_value - left_mean) * (right_value - right_mean)
+        for left_value, right_value in zip(left_rank, right_rank)
+    )
+    left_norm = sum((value - left_mean) ** 2 for value in left_rank)
+    right_norm = sum((value - right_mean) ** 2 for value in right_rank)
+    if left_norm == 0.0 and right_norm == 0.0:
+        return 1.0
+    if left_norm == 0.0 or right_norm == 0.0:
+        return 0.0
+    return numerator / math.sqrt(left_norm * right_norm)
+
+
+def percentile(values: Sequence[float], probability: float) -> float:
+    """Return a linearly interpolated percentile from finite values."""
+
+    if not values:
+        raise ValueError("percentile requires at least one value")
+    if not 0.0 <= probability <= 1.0:
+        raise ValueError("probability must be in [0, 1]")
+    ordered = sorted(float(value) for value in values)
+    if not all(math.isfinite(value) for value in ordered):
+        raise ValueError("percentile values must be finite")
+    position = probability * (len(ordered) - 1)
+    lower = math.floor(position)
+    upper = math.ceil(position)
+    if lower == upper:
+        return ordered[lower]
+    fraction = position - lower
+    return ordered[lower] * (1.0 - fraction) + ordered[upper] * fraction
+
+
+__all__ = ["percentile", "spearman_rank_correlation"]
diff --git a/decode_dse/hardware/synthesis_anchor.py b/decode_dse/hardware/synthesis_anchor.py
new file mode 100644
index 0000000..f677f68
--- /dev/null
+++ b/decode_dse/hardware/synthesis_anchor.py
@@ -0,0 +1,1035 @@
+"""Content-addressed full-chip DC/SAIF anchors for selected candidates."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping
+
+from decode_dse.hardware.design_space import (
+    CalibratedEnergy,
+    HardwareCandidate,
+)
+from decode_dse.profiles import DecodePrecisionProfile, format_descriptor
+
+EXACT_DC_ANCHOR_SCHEMA = "decode-exact-dc-anchor-index"
+EXACT_DC_SCOPE = "decode_chip_through_final_rmsnorm"
+REQUIRED_ACTIVITY = frozenset({"linear", "qk", "pv", "vector", "selector"})
+REQUIRED_ARTIFACT_KINDS = frozenset(
+    {
+        "area_report",
+        "compiler_precision_binding",
+        "constraints",
+        "decode_trace",
+        "library_manifest",
+        "power_report",
+        "rtl_source_manifest",
+        "rtl_specialization",
+        "saif",
+        "synthesis_log",
+        "synthesized_netlist",
+        "timing_report",
+    }
+)
+RTL_SOURCE_MANIFEST_SCHEMA = "decode-rtl-source-manifest"
+RTL_SPECIALIZATION_SCHEMA = "decode-rtl-dc-specialization"
+COMPILER_BINDING_SCHEMA = "plena-compiler-precision-binding"
+_NUMBER = r"([0-9]+(?:\.[0-9]*)?(?:[eE][+-]?[0-9]+)?)"
+_POWER_SCALE = {
+    "W": 1.0,
+    "mW": 1e-3,
+    "uW": 1e-6,
+    "nW": 1e-9,
+}
+ANCHOR_ERROR_LIMITS_PCT = {
+    "area": 15.0,
+    "dynamic_power": 25.0,
+    "leakage_power": 25.0,
+}
+
+
+def _canonical_bytes(value: object) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _content_hash(value: object) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _resolve_confined(base: Path, raw: object) -> Path:
+    relative = Path(str(raw))
+    if relative.is_absolute() or ".." in relative.parts:
+        raise ValueError("DC anchor paths must be confined and relative")
+    resolved = (base / relative).resolve()
+    try:
+        resolved.relative_to(base.resolve())
+    except ValueError as exc:
+        raise ValueError("DC anchor path escapes its artifact root") from exc
+    return resolved
+
+
+def _one_match(pattern: str, text: str, label: str) -> tuple[str, ...]:
+    matches = re.findall(pattern, text, flags=re.MULTILINE)
+    if len(matches) != 1:
+        raise ValueError(f"{label} report field must occur exactly once")
+    value = matches[0]
+    return (value,) if isinstance(value, str) else tuple(value)
+
+
+def _parse_area(path: Path) -> float:
+    text = path.read_text(encoding="utf-8", errors="strict")
+    value = float(
+        _one_match(
+            rf"^\s*Total\s+cell\s+area\s*:\s*{_NUMBER}\s*$",
+            text,
+            "area",
+        )[0]
+    )
+    if not math.isfinite(value) or value <= 0:
+        raise ValueError("area report value must be finite and positive")
+    return value / 1e6
+
+
+def _parse_power(path: Path) -> tuple[float, float]:
+    text = path.read_text(encoding="utf-8", errors="strict")
+    dynamic_value, dynamic_unit = _one_match(
+        rf"^\s*Total\s+Dynamic\s+Power\s*=\s*{_NUMBER}\s*"
+        rf"(W|mW|uW|nW)(?:\s+\([^)]*\))?\s*$",
+        text,
+        "dynamic power",
+    )
+    leakage_value, leakage_unit = _one_match(
+        rf"^\s*Cell\s+Leakage\s+Power\s*=\s*{_NUMBER}\s*"
+        rf"(W|mW|uW|nW)(?:\s+\([^)]*\))?\s*$",
+        text,
+        "leakage power",
+    )
+    dynamic = float(dynamic_value) * _POWER_SCALE[dynamic_unit]
+    leakage = float(leakage_value) * _POWER_SCALE[leakage_unit]
+    if any(
+        not math.isfinite(value) or value <= 0
+        for value in (dynamic, leakage)
+    ):
+        raise ValueError("power report values must be finite and positive")
+    return dynamic, leakage
+
+
+def _parse_timing(path: Path) -> tuple[float, float]:
+    text = path.read_text(encoding="utf-8", errors="strict")
+    period = float(
+        _one_match(
+            rf"^\s*Clock\s+period\s*:\s*{_NUMBER}\s*ns\s*$",
+            text,
+            "clock period",
+        )[0]
+    )
+    slack = float(
+        _one_match(
+            rf"^\s*slack\s+\(MET\)\s+{_NUMBER}\s*$",
+            text,
+            "timing slack",
+        )[0]
+    )
+    if (
+        not math.isfinite(period)
+        or period <= 0
+        or not math.isfinite(slack)
+        or slack < 0
+    ):
+        raise ValueError("timing report must meet a positive clock constraint")
+    return period, slack
+
+
+def _load_artifacts(
+    raw: object,
+    *,
+    root: Path,
+) -> dict[str, tuple[Path, str]]:
+    if not isinstance(raw, list):
+        raise TypeError("DC anchor artifacts must be a list")
+    artifacts: dict[str, tuple[Path, str]] = {}
+    for item in raw:
+        if not isinstance(item, Mapping) or set(item) != {
+            "kind",
+            "path",
+            "sha256",
+            "size_bytes",
+        }:
+            raise ValueError("DC anchor artifact fields differ from the schema")
+        kind = str(item["kind"])
+        if kind in artifacts:
+            raise ValueError(f"DC anchor repeats artifact kind {kind}")
+        path = _resolve_confined(root, item["path"])
+        if not path.is_file():
+            raise FileNotFoundError(f"DC anchor artifact is missing: {path}")
+        size = item["size_bytes"]
+        if (
+            isinstance(size, bool)
+            or not isinstance(size, int)
+            or size <= 0
+            or path.stat().st_size != size
+        ):
+            raise ValueError(f"DC anchor artifact size mismatch: {path}")
+        digest = str(item["sha256"])
+        if _sha256_file(path) != digest:
+            raise ValueError(f"DC anchor artifact checksum mismatch: {path}")
+        artifacts[kind] = (path, digest)
+    if set(artifacts) != REQUIRED_ARTIFACT_KINDS:
+        raise ValueError("DC anchor artifact coverage is incomplete")
+    return artifacts
+
+
+def _load_hashed_json(path: Path, schema_version: str) -> dict[str, Any]:
+    raw = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(raw, Mapping):
+        raise TypeError(f"{path} must contain a JSON object")
+    body = dict(raw)
+    content_hash = str(body.pop("content_hash", ""))
+    if body.get("schema_version") != schema_version:
+        raise ValueError(f"{path} uses an unsupported schema")
+    if _content_hash(body) != content_hash:
+        raise ValueError(f"{path} content hash mismatch")
+    return {**body, "content_hash": content_hash}
+
+
+def _load_source_manifest(path: Path) -> dict[str, Any]:
+    value = _load_hashed_json(path, RTL_SOURCE_MANIFEST_SCHEMA)
+    if set(value) != {
+        "schema_version",
+        "files",
+        "source_tree_sha256",
+        "content_hash",
+    }:
+        raise ValueError("RTL source manifest fields differ from the schema")
+    files = value["files"]
+    if not isinstance(files, Mapping) or not files:
+        raise ValueError("RTL source manifest file hashes are invalid")
+    canonical_files: dict[str, str] = {}
+    for raw_name, raw_digest in files.items():
+        name = str(raw_name)
+        digest = str(raw_digest)
+        relative = Path(name)
+        if (
+            not name
+            or relative.is_absolute()
+            or ".." in relative.parts
+            or relative.as_posix() != name
+            or len(digest) != 64
+            or any(
+                character not in "0123456789abcdef"
+                for character in digest
+            )
+        ):
+            raise ValueError("RTL source manifest file hashes are invalid")
+        canonical_files[name] = digest
+    expected = _content_hash({"files": dict(sorted(canonical_files.items()))})
+    if value["source_tree_sha256"] != expected:
+        raise ValueError("RTL source-tree hash mismatch")
+    return value
+
+
+def _load_compiler_binding(
+    path: Path,
+    *,
+    profile_id: str,
+    candidate: HardwareCandidate,
+) -> dict[str, Any]:
+    value = _load_hashed_json(path, COMPILER_BINDING_SCHEMA)
+    if set(value) != {
+        "schema_version",
+        "profile_id",
+        "profile",
+        "target",
+        "evidence_target",
+        "matrix_binding_mode",
+        "format_descriptors",
+        "format_binding_ids",
+        "runtime_precision_contract",
+        "binding_id",
+        "content_hash",
+    }:
+        raise ValueError("compiler precision binding fields differ from the schema")
+    binding_body = {
+        key: value[key]
+        for key in value
+        if key not in {"binding_id", "content_hash"}
+    }
+    expected_binding_id = "cpb-" + _content_hash(binding_body)
+    if value["binding_id"] != expected_binding_id:
+        raise ValueError("compiler precision binding identity mismatch")
+    if value["profile_id"] != profile_id:
+        raise ValueError("compiler precision binding profile mismatch")
+    profile = value["profile"]
+    if (
+        not isinstance(profile, Mapping)
+        or "schema_version" not in profile
+        or profile_id != "dqp-" + _content_hash(profile)
+    ):
+        raise ValueError("compiler precision profile identity mismatch")
+    target = value["target"]
+    if not isinstance(target, Mapping) or set(target) != {
+        "mlen",
+        "blen",
+        "hlen",
+        "batch",
+        "kv_heads",
+        "head_dim",
+        "block_size",
+        "selector_bits",
+        "packed_kv",
+        "batched_attention",
+    }:
+        raise ValueError("compiler precision target fields differ from the schema")
+    integer_target = {
+        name: target[name]
+        for name in (
+            "mlen",
+            "blen",
+            "hlen",
+            "batch",
+            "kv_heads",
+            "head_dim",
+            "block_size",
+            "selector_bits",
+        )
+    }
+    if any(
+        isinstance(raw, bool) or not isinstance(raw, int) or raw <= 0
+        for raw in integer_target.values()
+    ):
+        raise ValueError("compiler precision target dimensions are invalid")
+    if (
+        target["mlen"] != candidate.mlen
+        or target["blen"] != candidate.blen
+        or target["hlen"] != candidate.hlen
+        or target["batch"] != 1
+        or target["block_size"] != 8
+        or target["kv_heads"] * target["head_dim"] != target["mlen"]
+        or target["head_dim"] != target["hlen"]
+        or 2 ** target["selector_bits"] < target["kv_heads"]
+        or target["packed_kv"] is not True
+        or target["batched_attention"] is not True
+    ):
+        raise ValueError("compiler precision target does not bind the anchor")
+    evidence_target = value["evidence_target"]
+    if not isinstance(evidence_target, Mapping) or set(evidence_target) != {
+        "schema_version",
+        "target_mode",
+        "capability_scope",
+        "source_tree_sha256",
+        "mxint2_activation_scope",
+        "rtl_deployment_supports_mxint2_activation",
+        "common_deployment_valid",
+    }:
+        raise ValueError("compiler evidence target fields differ from the schema")
+    compiler_source_hash = str(evidence_target["source_tree_sha256"])
+    if len(compiler_source_hash) != 64 or any(
+        character not in "0123456789abcdef"
+        for character in compiler_source_hash
+    ):
+        raise ValueError("compiler source-tree identity is invalid")
+    if (
+        evidence_target["schema_version"] != "plena-evidence-target"
+        or evidence_target["target_mode"]
+        != "simulator_compiler_emulator"
+        or evidence_target["capability_scope"] != "numerical_and_emulator"
+        or evidence_target["mxint2_activation_scope"] != "emulator_only"
+        or evidence_target[
+            "rtl_deployment_supports_mxint2_activation"
+        ]
+        is not False
+        or evidence_target["common_deployment_valid"] is not False
+    ):
+        raise ValueError("compiler evidence target is unsupported")
+    role_tokens = {
+        "weight": profile.get("weight_format"),
+        "activation": profile.get("activation_format"),
+        "key": profile.get("key_format"),
+        "value": profile.get("value_format"),
+        "vector": profile.get("vector_format"),
+    }
+    expected_descriptors: dict[str, dict[str, Any]] = {}
+    for role, token in role_tokens.items():
+        descriptor = format_descriptor(str(token))
+        expected_descriptors[role] = {
+            "token": descriptor.token,
+            "family": descriptor.family,
+            "element_bits": descriptor.element_bits,
+            "exponent_bits": descriptor.exponent_bits,
+            "mantissa_bits": descriptor.mantissa_bits,
+            "signed": descriptor.signed,
+            "block_scaled": descriptor.block_scaled,
+        }
+    if value["format_descriptors"] != expected_descriptors:
+        raise ValueError("compiler format descriptors do not bind the profile")
+    expected_format_ids = {
+        role: "fmt-" + _content_hash(descriptor)
+        for role, descriptor in expected_descriptors.items()
+    }
+    if value["format_binding_ids"] != expected_format_ids:
+        raise ValueError("compiler format-binding identities mismatch")
+    if value["matrix_binding_mode"] != "static_hardware_signature":
+        raise ValueError("compiler precision binding mode is unsupported")
+    runtime = value["runtime_precision_contract"]
+    if not isinstance(runtime, Mapping):
+        raise ValueError("compiler runtime precision contract is missing")
+    runtime_body = dict(runtime)
+    runtime_hash = str(runtime_body.pop("content_hash", ""))
+    if _content_hash(runtime_body) != runtime_hash:
+        raise ValueError("compiler runtime precision contract hash mismatch")
+    parameters = runtime.get("rtl_precision_parameters")
+    semantics = runtime.get("matrix_semantics")
+    if not isinstance(parameters, Mapping) or not isinstance(
+        semantics, Mapping
+    ):
+        raise ValueError("compiler runtime precision bindings are incomplete")
+    semantics_body = dict(semantics)
+    semantics_hash = str(semantics_body.pop("content_hash", ""))
+    if _content_hash(semantics_body) != semantics_hash:
+        raise ValueError("compiler matrix semantics hash mismatch")
+    return value
+
+
+def _load_specialization(
+    path: Path,
+    *,
+    profile_id: str,
+    candidate: HardwareCandidate,
+    artifacts: Mapping[str, tuple[Path, str]],
+    source_manifest: Mapping[str, Any],
+    compiler_binding: Mapping[str, Any],
+) -> dict[str, Any]:
+    value = _load_hashed_json(path, RTL_SPECIALIZATION_SCHEMA)
+    if set(value) != {
+        "schema_version",
+        "profile_id",
+        "binding_id",
+        "target",
+        "format_bindings",
+        "rtl_precision_parameters",
+        "matrix_semantics_sha256",
+        "rtl_source_tree_sha256",
+        "artifact_sha256",
+        "build_command",
+        "selector_enabled",
+        "specialization_id",
+        "content_hash",
+    }:
+        raise ValueError("RTL specialization fields differ from the schema")
+    if value["profile_id"] != profile_id:
+        raise ValueError("RTL specialization profile mismatch")
+    if value["binding_id"] != compiler_binding["binding_id"]:
+        raise ValueError("RTL specialization compiler binding mismatch")
+    if value["target"] != candidate.to_dict():
+        raise ValueError("RTL specialization target mismatch")
+    if value["selector_enabled"] is not True:
+        raise ValueError("RTL specialization must enable PackedKV selection")
+    bindings = value["format_bindings"]
+    if not isinstance(bindings, Mapping) or set(bindings) != {
+        "weight",
+        "activation",
+        "key",
+        "value",
+        "vector",
+    }:
+        raise ValueError("RTL specialization format bindings are invalid")
+    parameters = value["rtl_precision_parameters"]
+    if (
+        not isinstance(parameters, Mapping)
+        or any(
+            not isinstance(name, str)
+            or not name
+            or isinstance(raw, bool)
+            or not isinstance(raw, int)
+            or raw < 0
+            for name, raw in parameters.items()
+        )
+    ):
+        raise ValueError("RTL specialization parameter map is invalid")
+    if value["rtl_source_tree_sha256"] != source_manifest[
+        "source_tree_sha256"
+    ]:
+        raise ValueError("RTL specialization source tree mismatch")
+    hashes = value["artifact_sha256"]
+    expected_hashes = {
+        kind: artifacts[kind][1]
+        for kind in (
+            "compiler_precision_binding",
+            "constraints",
+            "decode_trace",
+            "library_manifest",
+            "saif",
+            "synthesis_log",
+            "synthesized_netlist",
+        )
+    }
+    if hashes != expected_hashes:
+        raise ValueError("RTL specialization artifact hashes mismatch")
+    command = value["build_command"]
+    if (
+        not isinstance(command, list)
+        or not command
+        or any(not isinstance(item, str) or not item for item in command)
+    ):
+        raise ValueError("RTL specialization build command is invalid")
+    semantics = str(value["matrix_semantics_sha256"])
+    if len(semantics) != 64 or any(
+        character not in "0123456789abcdef" for character in semantics
+    ):
+        raise ValueError("RTL specialization matrix semantics hash is invalid")
+    runtime = compiler_binding["runtime_precision_contract"]
+    compiler_semantics = runtime["matrix_semantics"]["content_hash"]
+    if semantics != compiler_semantics:
+        raise ValueError("RTL specialization matrix semantics mismatch")
+    if value["rtl_precision_parameters"] != runtime[
+        "rtl_precision_parameters"
+    ]:
+        raise ValueError("RTL specialization parameter map differs from compiler")
+    specialization_body = {
+        key: value[key]
+        for key in value
+        if key not in {"content_hash", "specialization_id"}
+    }
+    expected_id = "rtl-specialization-" + _content_hash(
+        specialization_body
+    )
+    if value["specialization_id"] != expected_id:
+        raise ValueError("RTL specialization identity mismatch")
+    return value
+
+
+def _validate_synthesis_log_bindings(
+    path: Path,
+    *,
+    artifacts: Mapping[str, tuple[Path, str]],
+    source_tree_sha256: str,
+) -> None:
+    text = path.read_text(encoding="utf-8", errors="strict")
+    expected = {
+        "RTL_SOURCE_TREE_SHA256": source_tree_sha256,
+        "COMPILER_BINDING_SHA256": artifacts[
+            "compiler_precision_binding"
+        ][1],
+        "CONSTRAINTS_SHA256": artifacts["constraints"][1],
+        "LIBRARY_MANIFEST_SHA256": artifacts["library_manifest"][1],
+        "SAIF_SHA256": artifacts["saif"][1],
+        "DECODE_TRACE_SHA256": artifacts["decode_trace"][1],
+        "NETLIST_SHA256": artifacts["synthesized_netlist"][1],
+    }
+    for label, digest in expected.items():
+        observed = _one_match(
+            rf"^\s*{label}\s*:\s*([0-9a-f]{{64}})\s*$",
+            text,
+            label,
+        )[0]
+        if observed != digest:
+            raise ValueError(f"synthesis log binding mismatch: {label}")
+
+
+@dataclass(frozen=True)
+class ExactDCAnchor:
+    """One measured full-chip implementation and decode activity point."""
+
+    profile_id: str
+    candidate: HardwareCandidate
+    workload: Mapping[str, Any]
+    timing_evidence_id: str
+    layout_id: str
+    traffic_ledger_id: str
+    area_mm2: float
+    dynamic_power_w: float
+    leakage_power_w: float
+    clock_period_ns: float
+    worst_slack_ns: float
+    record_hash: str
+    artifact_sha256: tuple[tuple[str, str], ...]
+    synthesis_context: Mapping[str, Any]
+    specialization: Mapping[str, Any]
+    compiler_binding: Mapping[str, Any]
+
+    @property
+    def candidate_id(self) -> str:
+        return self.candidate.candidate_id
+
+    @property
+    def anchor_id(self) -> str:
+        return f"exact-dc-{self.record_hash}"
+
+    def match(
+        self,
+        *,
+        profile: DecodePrecisionProfile,
+        candidate: HardwareCandidate,
+        observation: Any,
+    ) -> None:
+        if profile.profile_id != self.profile_id:
+            raise ValueError("DC anchor profile identity mismatch")
+        if candidate.to_dict() != self.candidate.to_dict():
+            raise ValueError("DC anchor hardware candidate mismatch")
+        if observation.timing_evidence_id != self.timing_evidence_id:
+            raise ValueError("DC anchor timing evidence mismatch")
+        if observation.layout_id != self.layout_id:
+            raise ValueError("DC anchor PackedKV layout mismatch")
+        if observation.traffic_ledger_id != self.traffic_ledger_id:
+            raise ValueError("DC anchor traffic ledger mismatch")
+        bindings = self.specialization.get("format_bindings")
+        expected_bindings = {
+            "weight": profile.weight_format,
+            "activation": profile.activation_format,
+            "key": profile.key_format,
+            "value": profile.value_format,
+            "vector": profile.vector_format,
+        }
+        if bindings != expected_bindings:
+            raise ValueError("DC anchor precision format binding mismatch")
+        if self.compiler_binding.get("profile") != profile.to_dict():
+            raise ValueError("DC anchor compiler profile binding mismatch")
+        if self.compiler_binding.get("binding_id") != self.specialization.get(
+            "binding_id"
+        ):
+            raise ValueError("DC anchor compiler/RTL binding mismatch")
+        expected_parameters = {
+            "BLOCK_DIM": profile.block_size,
+            "MX_SCALE_WIDTH": profile.scale_bits,
+        }
+        for prefix, token in (
+            ("WT", profile.weight_format),
+            ("ACT", profile.activation_format),
+            ("KV", profile.key_format),
+        ):
+            descriptor = format_descriptor(token)
+            if descriptor.family == "mxint":
+                expected_parameters[f"{prefix}_MX_INT_ENABLE"] = 1
+                expected_parameters[f"{prefix}_MX_INT_WIDTH"] = (
+                    descriptor.element_bits
+                )
+            else:
+                expected_parameters[f"{prefix}_MX_INT_ENABLE"] = 0
+                expected_parameters[f"{prefix}_MX_EXP_WIDTH"] = (
+                    descriptor.exponent_bits
+                )
+                expected_parameters[f"{prefix}_MX_MANT_WIDTH"] = (
+                    descriptor.mantissa_bits
+                )
+        vector = format_descriptor(profile.vector_format)
+        for prefix in ("V_FP", "M_FP", "S_FP"):
+            expected_parameters[f"{prefix}_EXP_WIDTH"] = vector.exponent_bits
+            expected_parameters[f"{prefix}_MANT_WIDTH"] = vector.mantissa_bits
+        if self.specialization.get("rtl_precision_parameters") != dict(
+            sorted(expected_parameters.items())
+        ):
+            raise ValueError("DC anchor RTL precision parameters mismatch")
+        runtime = self.compiler_binding["runtime_precision_contract"]
+        if runtime.get("rtl_precision_parameters") != dict(
+            sorted(expected_parameters.items())
+        ):
+            raise ValueError("DC anchor compiler RTL parameters mismatch")
+        if (
+            runtime["matrix_semantics"]["content_hash"]
+            != self.specialization["matrix_semantics_sha256"]
+        ):
+            raise ValueError("DC anchor compiler matrix semantics mismatch")
+
+    def validate_prediction(
+        self,
+        prediction: Mapping[str, Any],
+    ) -> dict[str, Any]:
+        """Apply selected-point prediction-versus-DC publication gates."""
+
+        if prediction.get("profile_id") != self.profile_id:
+            raise ValueError("DC prediction profile identity mismatch")
+        if prediction.get("candidate_id") != self.candidate_id:
+            raise ValueError("DC prediction candidate identity mismatch")
+        if prediction.get("selector_enabled") is not True:
+            raise ValueError("DC prediction omits the PackedKV selector")
+        if (
+            int(prediction.get("MLEN", 0)) != self.candidate.mlen
+            or int(prediction.get("BLEN", 0)) != self.candidate.blen
+        ):
+            raise ValueError("DC prediction geometry mismatch")
+        context = prediction.get("synthesis_context")
+        if not isinstance(context, Mapping):
+            raise ValueError("DC prediction synthesis context is missing")
+        for field in ("dc_tool_version", "library_id", "process_corner"):
+            if context.get(field) != self.synthesis_context.get(field):
+                raise ValueError(
+                    f"DC prediction synthesis context mismatch: {field}"
+                )
+        comparisons = {
+            "area": (
+                float(prediction["area_mm2"]),
+                self.area_mm2,
+            ),
+            "dynamic_power": (
+                float(prediction["dynamic_power_w"]),
+                self.dynamic_power_w,
+            ),
+            "leakage_power": (
+                float(prediction["leakage_power_w"]),
+                self.leakage_power_w,
+            ),
+        }
+        errors: dict[str, float] = {}
+        for name, (predicted, measured) in comparisons.items():
+            if (
+                not math.isfinite(predicted)
+                or predicted <= 0
+                or not math.isfinite(measured)
+                or measured <= 0
+            ):
+                raise ValueError(f"DC {name} comparison is invalid")
+            error = abs(predicted - measured) / measured * 100.0
+            errors[name] = error
+            if error > ANCHOR_ERROR_LIMITS_PCT[name]:
+                raise ValueError(
+                    f"DC {name} anchor error exceeds publication gate"
+                )
+        hbm_j = float(prediction["hbm_j_per_token"])
+        hbm_calibration_id = str(prediction["hbm_calibration_id"])
+        if not math.isfinite(hbm_j) or hbm_j < 0 or not hbm_calibration_id:
+            raise ValueError("DC prediction HBM attribution is invalid")
+        return {
+            "passed": True,
+            "limits_pct": dict(ANCHOR_ERROR_LIMITS_PCT),
+            "errors_pct": dict(sorted(errors.items())),
+            "prediction_calibration_id": str(
+                prediction["prediction_calibration_id"]
+            ),
+            "hbm_j_per_token": hbm_j,
+            "hbm_calibration_id": hbm_calibration_id,
+        }
+
+    def energy(
+        self,
+        *,
+        duration_s: float,
+        hbm_j: float,
+        hbm_calibration_id: str,
+    ) -> CalibratedEnergy:
+        if (
+            not math.isfinite(duration_s)
+            or duration_s <= 0
+            or not math.isfinite(hbm_j)
+            or hbm_j < 0
+            or not hbm_calibration_id
+        ):
+            raise ValueError("DC anchor energy inputs are invalid")
+        calibration_id = "exact-dc-system-" + _content_hash(
+            {
+                "anchor_id": self.anchor_id,
+                "hbm_calibration_id": hbm_calibration_id,
+            }
+        )
+        return CalibratedEnergy(
+            calibration_id=calibration_id,
+            compute_j=0.0,
+            vector_j=0.0,
+            sram_j=0.0,
+            hbm_j=hbm_j,
+            leakage_j=self.leakage_power_w * duration_s,
+            unattributed_dynamic_j=self.dynamic_power_w * duration_s,
+            duration_s=duration_s,
+        )
+
+    def to_status(
+        self,
+        prediction_status: Mapping[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        status = {
+            "schema_version": EXACT_DC_ANCHOR_SCHEMA,
+            "anchor_id": self.anchor_id,
+            "profile_id": self.profile_id,
+            "candidate_id": self.candidate_id,
+            "metric_scope": EXACT_DC_SCOPE,
+            "area_mm2": self.area_mm2,
+            "dynamic_power_w": self.dynamic_power_w,
+            "leakage_power_w": self.leakage_power_w,
+            "clock_period_ns": self.clock_period_ns,
+            "worst_slack_ns": self.worst_slack_ns,
+            "record_hash": self.record_hash,
+            "artifact_sha256": dict(self.artifact_sha256),
+            "compiler_binding_id": self.compiler_binding["binding_id"],
+            "specialization_id": self.specialization["specialization_id"],
+            "prediction_validation": (
+                dict(prediction_status)
+                if prediction_status is not None
+                else None
+            ),
+        }
+        return status
+
+
+@dataclass(frozen=True)
+class ExactDCAnchorIndex:
+    source_path: Path
+    source_sha256: str
+    model_name: str
+    model_revision: str
+    rtl_source_tree_sha256: str
+    workload: Mapping[str, Any]
+    synthesis_context: Mapping[str, Any]
+    anchors: tuple[ExactDCAnchor, ...]
+
+    @classmethod
+    def load(
+        cls,
+        path: str | Path,
+        *,
+        model_name: str,
+        model_revision: str,
+        workload: Mapping[str, Any],
+        rtl_source_tree_sha256: str,
+    ) -> "ExactDCAnchorIndex":
+        source = Path(path).resolve()
+        payload = source.read_bytes()
+        raw = json.loads(payload)
+        if not isinstance(raw, Mapping):
+            raise TypeError("DC anchor index root must be an object")
+        body = dict(raw)
+        content_hash = str(body.pop("content_hash", ""))
+        if _content_hash(body) != content_hash:
+            raise ValueError("DC anchor index content hash mismatch")
+        if set(body) != {
+            "schema_version",
+            "model_name",
+            "model_revision",
+            "rtl_source_tree_sha256",
+            "metric_scope",
+            "workload",
+            "synthesis_context",
+            "records",
+        }:
+            raise ValueError("DC anchor index fields differ from the schema")
+        if body["schema_version"] != EXACT_DC_ANCHOR_SCHEMA:
+            raise ValueError("unsupported DC anchor index schema")
+        if body["model_name"] != model_name:
+            raise ValueError("DC anchor model name mismatch")
+        if body["model_revision"] != model_revision:
+            raise ValueError("DC anchor model revision mismatch")
+        if (
+            body["rtl_source_tree_sha256"] != rtl_source_tree_sha256
+            or len(rtl_source_tree_sha256) != 64
+            or any(
+                character not in "0123456789abcdef"
+                for character in rtl_source_tree_sha256
+            )
+        ):
+            raise ValueError("DC anchor RTL source-tree identity mismatch")
+        if body["metric_scope"] != EXACT_DC_SCOPE:
+            raise ValueError("DC anchor metric scope mismatch")
+        if body["workload"] != dict(workload):
+            raise ValueError("DC anchor workload mismatch")
+        if (
+            body["workload"].get("scope") != "steady_state_cached_q1"
+            or body["workload"].get("query_length") != 1
+            or body["workload"].get("admission_included") is not False
+        ):
+            raise ValueError("DC anchor must exclude decode admission")
+        context = body["synthesis_context"]
+        if not isinstance(context, Mapping) or set(context) != {
+            "dc_tool_version",
+            "library_id",
+            "process_corner",
+            "clock_period_ns",
+            "mx_block_size",
+            "power_analysis_mode",
+            "area_unit",
+        }:
+            raise ValueError("DC anchor synthesis context differs from the schema")
+        if any(
+            not str(context[name]).strip()
+            for name in ("dc_tool_version", "library_id", "process_corner")
+        ):
+            raise ValueError("DC anchor synthesis context is incomplete")
+        if (
+            float(context["clock_period_ns"]) != 1.0
+            or int(context["mx_block_size"]) != 8
+            or context["power_analysis_mode"] != "saif_annotated"
+            or context["area_unit"] != "um2"
+        ):
+            raise ValueError("DC anchor synthesis context is unsupported")
+        records = body["records"]
+        if not isinstance(records, list) or not records:
+            raise ValueError("DC anchor index must contain measured records")
+        anchors: list[ExactDCAnchor] = []
+        keys: set[tuple[str, str]] = set()
+        for raw_record in records:
+            if not isinstance(raw_record, Mapping):
+                raise TypeError("DC anchor records must be objects")
+            record_body = dict(raw_record)
+            record_hash = str(record_body.pop("record_hash", ""))
+            if _content_hash(record_body) != record_hash:
+                raise ValueError("DC anchor record hash mismatch")
+            if set(record_body) != {
+                "profile_id",
+                "candidate",
+                "workload",
+                "timing_evidence_id",
+                "layout_id",
+                "traffic_ledger_id",
+                "activity_coverage",
+                "artifacts",
+            }:
+                raise ValueError("DC anchor record fields differ from the schema")
+            candidate_raw = record_body["candidate"]
+            if not isinstance(candidate_raw, Mapping):
+                raise TypeError("DC anchor candidate must be an object")
+            candidate = HardwareCandidate.from_dict(
+                candidate_raw,
+                allow_legacy_single_chip=True,
+            )
+            if record_body["workload"] != body["workload"]:
+                raise ValueError("DC anchor record workload mismatch")
+            coverage = record_body["activity_coverage"]
+            if (
+                not isinstance(coverage, list)
+                or frozenset(coverage) != REQUIRED_ACTIVITY
+                or len(coverage) != len(REQUIRED_ACTIVITY)
+            ):
+                raise ValueError("DC anchor activity coverage is incomplete")
+            artifacts = _load_artifacts(
+                record_body["artifacts"],
+                root=source.parent,
+            )
+            source_manifest = _load_source_manifest(
+                artifacts["rtl_source_manifest"][0]
+            )
+            if (
+                source_manifest["source_tree_sha256"]
+                != rtl_source_tree_sha256
+            ):
+                raise ValueError(
+                    "DC anchor record uses another RTL source tree"
+                )
+            compiler_binding = _load_compiler_binding(
+                artifacts["compiler_precision_binding"][0],
+                profile_id=str(record_body["profile_id"]),
+                candidate=candidate,
+            )
+            specialization = _load_specialization(
+                artifacts["rtl_specialization"][0],
+                profile_id=str(record_body["profile_id"]),
+                candidate=candidate,
+                artifacts=artifacts,
+                source_manifest=source_manifest,
+                compiler_binding=compiler_binding,
+            )
+            _validate_synthesis_log_bindings(
+                artifacts["synthesis_log"][0],
+                artifacts=artifacts,
+                source_tree_sha256=source_manifest[
+                    "source_tree_sha256"
+                ],
+            )
+            area = _parse_area(artifacts["area_report"][0])
+            dynamic, leakage = _parse_power(
+                artifacts["power_report"][0]
+            )
+            period, slack = _parse_timing(
+                artifacts["timing_report"][0]
+            )
+            if abs(period - float(context["clock_period_ns"])) > 1e-12:
+                raise ValueError("DC anchor report clock differs from context")
+            anchor = ExactDCAnchor(
+                profile_id=str(record_body["profile_id"]),
+                candidate=candidate,
+                workload=dict(body["workload"]),
+                timing_evidence_id=str(record_body["timing_evidence_id"]),
+                layout_id=str(record_body["layout_id"]),
+                traffic_ledger_id=str(record_body["traffic_ledger_id"]),
+                area_mm2=area,
+                dynamic_power_w=dynamic,
+                leakage_power_w=leakage,
+                clock_period_ns=period,
+                worst_slack_ns=slack,
+                record_hash=record_hash,
+                artifact_sha256=tuple(
+                    sorted(
+                        (kind, digest)
+                        for kind, (_, digest) in artifacts.items()
+                    )
+                ),
+                synthesis_context=dict(context),
+                specialization=specialization,
+                compiler_binding=compiler_binding,
+            )
+            if any(
+                not value
+                for value in (
+                    anchor.profile_id,
+                    anchor.timing_evidence_id,
+                    anchor.layout_id,
+                    anchor.traffic_ledger_id,
+                )
+            ):
+                raise ValueError("DC anchor identities must be non-empty")
+            key = (anchor.profile_id, anchor.candidate_id)
+            if key in keys:
+                raise ValueError("DC anchor index repeats a candidate profile")
+            keys.add(key)
+            anchors.append(anchor)
+        return cls(
+            source_path=source,
+            source_sha256=hashlib.sha256(payload).hexdigest(),
+            model_name=model_name,
+            model_revision=model_revision,
+            rtl_source_tree_sha256=rtl_source_tree_sha256,
+            workload=dict(workload),
+            synthesis_context=dict(context),
+            anchors=tuple(anchors),
+        )
+
+    def get(
+        self,
+        profile_id: str,
+        candidate: HardwareCandidate,
+    ) -> ExactDCAnchor | None:
+        key = (profile_id, candidate.candidate_id)
+        return next(
+            (
+                anchor
+                for anchor in self.anchors
+                if (anchor.profile_id, anchor.candidate_id) == key
+            ),
+            None,
+        )
+
+    def to_status(self) -> dict[str, Any]:
+        return {
+            "schema_version": EXACT_DC_ANCHOR_SCHEMA,
+            "source_sha256": self.source_sha256,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "rtl_source_tree_sha256": self.rtl_source_tree_sha256,
+            "record_count": len(self.anchors),
+            "anchor_ids": sorted(anchor.anchor_id for anchor in self.anchors),
+            "synthesis_context": dict(self.synthesis_context),
+        }
+
+
+__all__ = [
+    "EXACT_DC_ANCHOR_SCHEMA",
+    "EXACT_DC_SCOPE",
+    "ExactDCAnchor",
+    "ExactDCAnchorIndex",
+    "REQUIRED_ACTIVITY",
+    "REQUIRED_ARTIFACT_KINDS",
+]
diff --git a/decode_dse/hardware/test_evaluation_contracts.py b/decode_dse/hardware/test_evaluation_contracts.py
new file mode 100644
index 0000000..c67c157
--- /dev/null
+++ b/decode_dse/hardware/test_evaluation_contracts.py
@@ -0,0 +1,2371 @@
+"""Contracts that must hold before a hardware study is launched remotely.
+
+Every source the evaluator hashes into its identity has to exist and resolve on
+the host that will run the sweep. A rename that leaves one of these dangling
+raises `FileNotFoundError` inside `ExactHardwareEvaluator.__init__`, which
+otherwise surfaces only once the study starts.
+"""
+
+from __future__ import annotations
+
+import importlib
+import hashlib
+import json
+import math
+import re
+import sys
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from decode_dse.hardware import evaluation
+from decode_dse.hardware.design_space import (
+    COMPILER_TRACE_EXECUTION_MODE,
+    COMPILER_TRACE_TIMING_SET_SCHEMA,
+    FULL_MODEL_DECODE_SCOPE,
+    LEGACY_AGGREGATE_BANDWIDTH_MODE,
+    CapacityBreakdown,
+    ExactHardwareSpace,
+    ExactHardwareStudy,
+    HardwareCandidate,
+    HardwareEvaluation,
+    HardwareMetrics,
+    PhysicalTraffic,
+    ResourceBudget,
+    ResourceBudgetStatus,
+    _HardwareFactorEvaluation,
+    _HardwareFactorGroup,
+    _FactorizedHardwareReducer,
+    _content_hash,
+    _factor_join_class_id,
+    load_hardware_artifact,
+)
+from decode_dse.hardware.lm_head_service import (
+    HEAD_SERVICE_MODE,
+    composite_system_calibration_id,
+    load_bf16_head_service_artifact,
+)
+from decode_dse.hardware.packedkv_claims import AttentionTopology
+from decode_dse.hardware.power_bridge import analytic_energy_from_simulator
+from decode_dse.hardware.selection import (
+    PublicationCandidate,
+    select_refinement_sources,
+    select_final_deployment,
+)
+from decode_dse.legality import (
+    PackedKVRuntimeTarget,
+    StackValidity,
+    evaluate_stack_capability,
+    scope_stack_validity,
+)
+from decode_dse.manifest import (
+    QuantizerProvenance,
+    QuantizerSource,
+    ResolvedImportOrigin,
+    build_exhaustive_manifest,
+)
+from decode_dse.profiles import (
+    PROFILE_KIND_BF16_REFERENCE,
+    PROFILE_KIND_QUANTIZED,
+    DecodePrecisionProfile,
+)
+from decode_dse.software.refinement_schedule import _hardware_point
+from decode_dse.simulator_bridge import DecodeSimulator
+
+SHA256 = re.compile(r"^[0-9a-f]{64}$")
+
+
+def test_hardware_launch_requires_mode_appropriate_timing_artifacts() -> None:
+    with pytest.raises(ValueError, match="requires --compiler-trace-artifacts"):
+        evaluation._validate_execution_launch(
+            execution_mode=COMPILER_TRACE_EXECUTION_MODE,
+            compiler_trace_artifacts=None,
+            publication_timing_tier="compiler_trace_request_calibrated",
+        )
+    with pytest.raises(ValueError, match="cannot consume compiler-trace"):
+        evaluation._validate_execution_launch(
+            execution_mode=LEGACY_AGGREGATE_BANDWIDTH_MODE,
+            compiler_trace_artifacts="artifacts.json",
+            publication_timing_tier="stage_calibrated_analytic",
+        )
+    with pytest.raises(ValueError, match="tier differs from the execution mode"):
+        evaluation._validate_execution_launch(
+            execution_mode=COMPILER_TRACE_EXECUTION_MODE,
+            compiler_trace_artifacts="artifacts.json",
+            publication_timing_tier="stage_calibrated_analytic",
+        )
+    with pytest.raises(ValueError, match="tier differs from the execution mode"):
+        evaluation._validate_execution_launch(
+            execution_mode=LEGACY_AGGREGATE_BANDWIDTH_MODE,
+            compiler_trace_artifacts=None,
+            publication_timing_tier="compiler_trace_request_calibrated",
+        )
+    with pytest.raises(ValueError, match="unsupported publication timing tier"):
+        evaluation._validate_execution_launch(
+            execution_mode=LEGACY_AGGREGATE_BANDWIDTH_MODE,
+            compiler_trace_artifacts=None,
+            publication_timing_tier="uncalibrated",
+        )
+
+    evaluation._validate_execution_launch(
+        execution_mode=COMPILER_TRACE_EXECUTION_MODE,
+        compiler_trace_artifacts="artifacts.json",
+        publication_timing_tier="compiler_trace_request_calibrated",
+    )
+    evaluation._validate_execution_launch(
+        execution_mode=LEGACY_AGGREGATE_BANDWIDTH_MODE,
+        compiler_trace_artifacts=None,
+        publication_timing_tier="stage_calibrated_analytic",
+    )
+
+
+def test_compiler_and_emulator_validity_remain_exact_batch_scoped() -> None:
+    observed = StackValidity(True, True, True, True, True)
+    evidence_target = PackedKVRuntimeTarget(batch=1)
+    identity = scope_stack_validity(
+        observed,
+        evidence_target=evidence_target,
+        runtime_target=PackedKVRuntimeTarget(batch=1),
+    )
+    another_batch = scope_stack_validity(
+        observed,
+        evidence_target=evidence_target,
+        runtime_target=PackedKVRuntimeTarget(batch=2),
+    )
+    assert identity.compiler_valid is identity.emulator_valid is True
+    assert identity.rtl_valid is True
+    assert another_batch.compiler_valid is None
+    assert another_batch.emulator_valid is None
+    assert another_batch.rtl_valid is None
+    assert another_batch.dc_calibrated is True
+
+
+@pytest.mark.parametrize("batch", (8, 256))
+def test_exact_record_batches_have_no_frontend_capability_blocker(batch: int) -> None:
+    profile = DecodePrecisionProfile.quantized(
+        "MXINT4",
+        "MXINT4",
+        "MXINT4",
+        "FP_E3M2",
+    )
+    capability = evaluate_stack_capability(
+        profile,
+        PackedKVRuntimeTarget(
+            mlen=128,
+            blen=2,
+            hlen=16,
+            batch=batch,
+            kv_heads=2,
+            head_dim=16,
+            block_size=8,
+        ),
+    )
+
+    assert all(
+        issue.code != "packedkv_frontend_batch_unsupported"
+        for issue in capability.issues
+    )
+    assert capability.stage_support["compiler"] is True
+
+
+def _compiler_trace_set() -> dict[str, object]:
+    return {
+        "schema_version": COMPILER_TRACE_TIMING_SET_SCHEMA,
+        "execution_mode": COMPILER_TRACE_EXECUTION_MODE,
+        "artifact_scope": FULL_MODEL_DECODE_SCOPE,
+        "request_count": 2,
+        "compiler_input_descriptor_sha256": "0" * 64,
+        "compiler_lowering_key_sha256": "6" * 64,
+        "compiler_artifact_set_sha256": "7" * 64,
+        "request_set_sha256": "1" * 64,
+        "compiler_source_sha256": "2" * 64,
+        "latency_library_sha256": "3" * 64,
+        "request_memory_sidecar_set_sha256": "4" * 64,
+        "request_memory_calibration_ids": [
+            "request-latency-" + "5" * 64
+        ],
+        "step_composition": "max_compute_memory",
+    }
+
+
+def test_hardware_metrics_seal_full_model_compiler_trace_evidence() -> None:
+    evidence = _compiler_trace_set()
+    evidence_id = "compiler-trace-timing-" + hashlib.sha256(
+        json.dumps(
+            evidence,
+            sort_keys=True,
+            separators=(",", ":"),
+        ).encode("utf-8")
+    ).hexdigest()
+    metrics = HardwareMetrics(
+        tpot_ms=1.0,
+        tps=1_000.0,
+        area_mm2=1.0,
+        traffic=PhysicalTraffic(1.0, 0.0, 0.0, 0.0),
+        capacity=CapacityBreakdown(1, 0, 0, 2),
+        algorithmic_bottleneck="compute",
+        realized_bottleneck="compute",
+        frac_algorithmic_memory_bound=0.0,
+        frac_realized_memory_bound=0.0,
+        frac_serialization_bound=0.0,
+        timing_calibrated=True,
+        timing_evidence_id=evidence_id,
+        timing_reason="compiler_trace_timing_validated",
+        execution_mode=COMPILER_TRACE_EXECUTION_MODE,
+        compiler_trace_timing=evidence,
+    )
+    serialized = metrics.to_dict()
+    assert serialized["execution_mode"] == COMPILER_TRACE_EXECUTION_MODE
+    assert serialized["compiler_trace_timing"] == evidence
+    assert serialized["bandwidth_calibration_id"] is None
+    assert serialized["memory_timing_calibrated"] is True
+
+
+def test_compiler_trace_request_is_immutably_bound_to_one_dse_point() -> None:
+    simulator = DecodeSimulator("qwen3-32b")
+    precision = simulator.make_precision(
+        attn_w=4,
+        ffn_w=4,
+        kv=4,
+        act_w=4,
+    )
+    overrides = {
+        "MLEN": 128,
+        "BLEN": 2,
+        "VLEN": 128,
+        "HLEN": 16,
+        "TP": 1,
+        "KVP": 1,
+        "LINK_PORTS": 0,
+        "SRAM_POLICY": "streaming",
+        "KV_HEAD_REUSE": False,
+        "DRAIN_OVERLAPPED": False,
+        **simulator.hbm_overrides("HBM2", 8),
+    }
+    hardware = simulator.base_hw.model_copy(update=overrides)
+    point = simulator.compiler_trace_point(
+        precision,
+        hardware=hardware,
+        overrides=overrides,
+        batch=1,
+        input_seq=16,
+        output_seq=2,
+        stride=1,
+        n_chips=1,
+        hbm_gen="HBM2",
+        hbm_channels=8,
+        kv_layout="dense_selector",
+        runtime_hbm_reserve_bytes=0,
+        output_head_location="external_bf16_service",
+    )
+    descriptor = point.to_dict()
+    assert descriptor["model"]["layer_scope"] == "all_decoder_layers"
+    assert descriptor["hardware"]["array_geometry"] == {
+        "mlen": 128,
+        "blen": 2,
+        "vlen": 128,
+        "hlen": 16,
+    }
+    assert descriptor["hardware"]["topology"]["chip_count"] == 1
+    assert descriptor["precision"]["specification"] == precision.spec
+
+    # `to_dict` returns a copy, so caller mutation cannot change the key.
+    original_digest = point.descriptor_sha256
+    descriptor["serving"]["batch"] = 99
+    assert point.descriptor_sha256 == original_digest
+
+    from compiler_trace_timing import (
+        ArrayGeometry,
+        CompilerTraceTimingRequest,
+        HBMOperatingPoint,
+    )
+
+    class Binder:
+        def bind(self, bound_point):
+            inputs = bound_point.to_dict()
+            geometry = ArrayGeometry(
+                **inputs["hardware"]["array_geometry"]
+            )
+            hbm = HBMOperatingPoint(
+                **inputs["hardware"]["hbm_timing_geometry"]
+            )
+
+            def request(context_tokens):
+                return CompilerTraceTimingRequest(
+                    compiler_inputs_sha256=bound_point.descriptor_sha256,
+                    compiler_source_sha256="a" * 64,
+                    context_tokens=context_tokens,
+                    batch=inputs["serving"]["batch"],
+                    geometry=geometry,
+                    hbm=hbm,
+                    frequency_hz=inputs["compiler"]["frequency_hz"],
+                )
+
+            return request
+
+    simulator.trace_request_binder = Binder()
+    request_factory = simulator._bind_trace_request_factory(point)
+    request = request_factory(16)
+    assert request.compiler_inputs_sha256 == original_digest
+    assert request.context_tokens == 16
+
+
+def test_provenance_modules_import_and_hash() -> None:
+    digests = evaluation._module_source_digests()
+    assert set(digests) == set(evaluation._PROVENANCE_MODULES)
+    for name, digest in digests.items():
+        assert SHA256.fullmatch(digest), name
+
+
+def test_lazy_exact_hardware_exports_resolve() -> None:
+    import decode_dse.hardware as hardware
+
+    for name in hardware._EXACT_EXPORTS:
+        assert getattr(hardware, name) is getattr(evaluation, name)
+
+
+def _handoff_payload() -> dict[str, object]:
+    return {
+        "schema_version": evaluation.PREFILL_HANDOFF_INPUT_SCHEMA,
+        "model": {"name": "synthetic/model", "revision": "a" * 40},
+        "workload": {"prompt_tokens": 16, "generation_tokens": 2},
+        "prefill": {
+            "precision": "BF16",
+            "scope": evaluation.PREFILL_MEASUREMENT_SCOPE,
+            "measurements": [
+                {
+                    "batch": batch,
+                    "latency_s": 0.01 * batch,
+                    "energy_j": 0.1 * batch,
+                    "latency_evidence_id": (
+                        "prefill-latency-" + f"{batch:064x}"
+                    ),
+                    "energy_evidence_id": (
+                        "prefill-energy-" + f"{batch + 8:064x}"
+                    ),
+                    "evidence_tier": "measured",
+                }
+                for batch in (1, 4)
+            ],
+        },
+        "schedule": {
+            "decode_ready_delay_s": 0.02,
+            "prefill_stall_power_w": 50.0,
+            "decode_idle_power_w": 20.0,
+        },
+        "links": {
+            "direct_generation": "nvlink4",
+            "host_generation": "pcie5",
+            "direct_energy_pj_per_bit": 1.5,
+            "host_energy_pj_per_bit": 10.0,
+            "evidence_id": "link-energy-" + "b" * 64,
+            "evidence_tier": "declared_sensitivity",
+        },
+        "admission": {
+            "bandwidth_bytes_per_s": 900e9,
+            "quantize_energy_j_per_element": 1e-12,
+            "memory_energy_j_per_byte": 2e-12,
+            "calibrated": True,
+            "calibration_id": "admission-" + "c" * 64,
+            "evidence_tier": "emulator_measured",
+        },
+    }
+
+
+def test_prefill_handoff_artifact_is_explicit_and_batch_complete(tmp_path) -> None:
+    source = tmp_path / "prefill_handoff.json"
+    source.write_text(json.dumps(_handoff_payload()), encoding="utf-8")
+    workload = evaluation.HardwareWorkload(16, 2, 1, 0)
+
+    artifact = evaluation.PrefillHandoffArtifact.load(
+        source,
+        model_name="synthetic/model",
+        model_revision="a" * 40,
+        workload=workload,
+        required_batches=(1, 4),
+    )
+    assert artifact.publication_rankable is True
+    assert artifact.measurement(4).latency_s == pytest.approx(0.04)
+    assert artifact.to_status()["artifact_id"] == artifact.artifact_id
+    assert "source_path" not in artifact.to_status()
+
+    with pytest.raises(ValueError, match="lacks required batches: 8"):
+        evaluation.PrefillHandoffArtifact.load(
+            source,
+            model_name="synthetic/model",
+            model_revision="a" * 40,
+            workload=workload,
+            required_batches=(1, 4, 8),
+        )
+
+
+def test_provenance_modules_are_the_evaluator_dependencies() -> None:
+    """The hashed set must cover every decode_dse module the evaluator imports.
+
+    A new dependency that is not hashed would let a logic change alter results
+    without changing the evaluator identity.
+    """
+
+    imported = {
+        f"decode_dse.{name}"
+        for name in ("legality", "manifest", "profiles", "simulator_bridge")
+    } | {
+        f"decode_dse.hardware.{name}"
+        for name in (
+            "admission_cost",
+            "design_space",
+            "evaluation",
+            "lm_head_service",
+            "power_model",
+            "synthesis_anchor",
+            "workload_events",
+        )
+    }
+    hashed = set(evaluation._PROVENANCE_MODULES)
+    # simulator_bridge is hashed in the backend provenance, not the evaluator's.
+    assert imported - hashed == {"decode_dse.simulator_bridge"}
+
+
+def test_simulator_sources_resolve() -> None:
+    root = evaluation.simulator_root()
+    missing = [
+        relative
+        for relative in evaluation._SIMULATOR_SOURCES.values()
+        if not (root / relative).is_file()
+    ]
+    assert not missing, f"missing simulator sources under {root}: {missing}"
+
+    digests = evaluation._simulator_source_digests()
+    assert set(digests) == set(evaluation._SIMULATOR_SOURCES)
+    for name, digest in digests.items():
+        assert SHA256.fullmatch(digest), name
+
+
+def test_bandwidth_calibration_sources_resolve() -> None:
+    root = evaluation.simulator_root()
+    missing = [
+        relative
+        for relative in evaluation._BANDWIDTH_CALIBRATION_SOURCES
+        if not (root / relative).is_file()
+    ]
+    assert not missing, f"missing calibration tables under {root}: {missing}"
+
+
+def test_backend_provenance_field_names_are_unique() -> None:
+    """Backend provenance flattens several sources into one dict."""
+
+    reserved = {
+        "model_json_sha256",
+        "settings_sha256",
+        "isa_sha256",
+        "timing_evidence_sha256",
+        "simulator_bridge_sha256",
+        "head_service_model_sha256",
+    }
+    assert not reserved & set(evaluation._SIMULATOR_SOURCES)
+
+
+def test_multichip_space_emits_only_legal_factorizations() -> None:
+    space = ExactHardwareSpace(
+        mlen=(128,),
+        blen=(4,),
+        hlen=(128,),
+        batch=(1,),
+        hbm_channels=(8,),
+        chip_count=(1, 4),
+        link_ports=(1, 2),
+        sram_policy=("streaming",),
+        attention_heads=32,
+        kv_heads=8,
+    )
+    candidates = space.candidates(4096)
+    assert candidates
+    assert all(point.tp * point.kvp == point.chip_count for point in candidates)
+    assert all(
+        point.link_ports >= int(point.tp > 1) + int(point.kvp > 1)
+        for point in candidates
+        if point.chip_count > 1
+    )
+    assert all(32 % point.tp == 0 and 8 % point.tp == 0 for point in candidates)
+
+
+def test_resource_budget_enforces_all_aggregate_limits() -> None:
+    budget = ResourceBudget(
+        aggregate_area_limit_mm2=100.0,
+        aggregate_hbm_capacity_limit_bytes=1_000,
+        aggregate_hbm_bandwidth_limit_bytes_per_s=2_000.0,
+        reference_system="test-reference",
+    )
+    status = ResourceBudgetStatus(
+        aggregate_area_mm2=99.0,
+        aggregate_hbm_capacity_bytes=1_001,
+        aggregate_hbm_bandwidth_bytes_per_s=1_999.0,
+        aggregate_multiplier_count=4096,
+        budget=budget,
+    )
+    assert status.area_feasible
+    assert not status.hbm_capacity_feasible
+    assert status.hbm_bandwidth_feasible
+    assert not status.feasible
+
+
+def test_legacy_candidate_evidence_normalises_without_rewriting_raw_identity() -> None:
+    raw = {
+        "MLEN": 128,
+        "BLEN": 4,
+        "VLEN": 128,
+        "HLEN": 128,
+        "BATCH": 1,
+        "HBM_CHANNELS": 8,
+        "HBM_GENERATION": "HBM2",
+        "CHIP_COUNT": 1,
+    }
+    candidate = HardwareCandidate.from_dict(
+        raw,
+        allow_legacy_single_chip=True,
+    )
+    assert candidate.to_legacy_dict() == raw
+    assert candidate.tp == candidate.kvp == 1
+    assert candidate.link_ports == 0
+    assert candidate.sram_policy == "streaming"
+    assert candidate.to_dict() == {
+        **raw,
+        "TP": 1,
+        "KVP": 1,
+        "LINK_PORTS": 0,
+        "SRAM_POLICY": "streaming",
+    }
+
+
+def test_legacy_multichip_evidence_is_not_given_new_partition_semantics() -> None:
+    raw = {
+        "MLEN": 128,
+        "BLEN": 4,
+        "VLEN": 128,
+        "HLEN": 128,
+        "BATCH": 1,
+        "HBM_CHANNELS": 8,
+        "HBM_GENERATION": "HBM2",
+        "CHIP_COUNT": 2,
+    }
+    with pytest.raises(ValueError, match="legacy multi-chip"):
+        HardwareCandidate.from_dict(raw, allow_legacy_single_chip=True)
+
+
+def test_pre_e2_candidate_identity_is_stable_and_explicit_false_is_distinct() -> None:
+    pre_e2 = HardwareCandidate(
+        mlen=1024,
+        blen=2,
+        vlen=1024,
+        hlen=128,
+        batch=4,
+        hbm_channels=8,
+        hbm_generation="HBM2",
+        chip_count=1,
+        tp=1,
+        kvp=1,
+        link_ports=0,
+        sram_policy="streaming",
+    )
+    raw = pre_e2.to_dict()
+    expected_id = "hw-" + hashlib.sha256(
+        json.dumps(
+            raw,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        ).encode("utf-8")
+    ).hexdigest()
+    restored = HardwareCandidate.from_dict(raw)
+    explicit_false = HardwareCandidate(
+        mlen=pre_e2.mlen,
+        blen=pre_e2.blen,
+        vlen=pre_e2.vlen,
+        hlen=pre_e2.hlen,
+        batch=pre_e2.batch,
+        hbm_channels=pre_e2.hbm_channels,
+        hbm_generation=pre_e2.hbm_generation,
+        chip_count=pre_e2.chip_count,
+        tp=pre_e2.tp,
+        kvp=pre_e2.kvp,
+        link_ports=pre_e2.link_ports,
+        sram_policy=pre_e2.sram_policy,
+        kv_head_reuse=False,
+        drain_overlapped=False,
+    )
+    assert restored.to_dict() == raw
+    assert restored.candidate_id == pre_e2.candidate_id == expected_id
+    assert explicit_false.to_dict() == {
+        **raw,
+        "KV_HEAD_REUSE": False,
+        "DRAIN_OVERLAPPED": False,
+    }
+    assert explicit_false.candidate_id != pre_e2.candidate_id
+    invalid = dict(explicit_false.to_dict())
+    invalid["KV_HEAD_REUSE"] = 1
+    with pytest.raises(TypeError, match="must be boolean"):
+        HardwareCandidate.from_dict(invalid)
+
+
+def test_reuse_search_enumerates_only_fp_sram_legal_geometries() -> None:
+    space = ExactHardwareSpace(
+        mlen=(1024,),
+        blen=(2, 4),
+        hlen=(128,),
+        batch=(4,),
+        hbm_channels=(8,),
+        chip_count=(1,),
+        sram_policy=("streaming",),
+        kv_head_reuse=(True,),
+        drain_overlapped=(False,),
+        attention_heads=64,
+        kv_heads=8,
+        fp_sram_depth=512,
+    )
+    candidates = space.candidates(4096)
+    assert candidates
+    assert {candidate.blen for candidate in candidates} == {2}
+    assert all(candidate.kv_head_reuse for candidate in candidates)
+    assert all(candidate.architecture_knobs_explicit for candidate in candidates)
+
+
+def test_reuse_legality_is_rank_local_and_count_matches_iterator() -> None:
+    space = ExactHardwareSpace(
+        mlen=(1024,),
+        blen=(4,),
+        hlen=(128,),
+        batch=(4,),
+        hbm_channels=(8,),
+        chip_count=(1, 2, 4, 8),
+        tp=(1, 2, 4, 8),
+        link_ports=(2,),
+        sram_policy=("streaming",),
+        kv_head_reuse=(False, True),
+        drain_overlapped=(False,),
+        attention_heads=64,
+        kv_heads=8,
+        fp_sram_depth=512,
+    )
+    candidates = space.candidates(4096)
+    assert space.candidate_count(4096) == len(candidates)
+    by_tp = {
+        tp: tuple(candidate for candidate in candidates if candidate.tp == tp)
+        for tp in (1, 2, 4, 8)
+    }
+    assert all(by_tp.values())
+    assert not any(candidate.kv_head_reuse for candidate in by_tp[1])
+    assert all(
+        {candidate.kv_head_reuse for candidate in by_tp[tp]} == {False, True}
+        for tp in (2, 4, 8)
+    )
+    for candidate in candidates:
+        local_kv_heads = 8 // candidate.tp
+        if candidate.kv_head_reuse:
+            assert local_kv_heads <= candidate.mlen // candidate.hlen
+            assert (
+                6
+                + 3
+                * candidate.blen
+                * (candidate.mlen // candidate.hlen)
+                * local_kv_heads
+                <= space.fp_sram_depth
+            )
+
+
+def test_rank_local_heads_bind_selector_capability_and_reuse_area() -> None:
+    simulator = evaluation.simulator_root()
+    if str(simulator) not in sys.path:
+        sys.path.insert(0, str(simulator))
+    from analytic_models.disagg_serve.packed_kv import (
+        architecture_option_area_mm2,
+        kv_head_reuse_status,
+    )
+
+    shape = evaluation.DenseDecoderShape(
+        hidden_size=4096,
+        intermediate_size=11008,
+        attention_heads=64,
+        kv_heads=8,
+        head_dim=64,
+        layers=32,
+        vocab_size=32000,
+    )
+    profile = DecodePrecisionProfile.quantized(
+        "MXINT8", "MXINT8", "MXINT8", "FP_E3M2"
+    )
+    areas = {}
+    for tp in (1, 2, 4, 8):
+        candidate = HardwareCandidate(
+            mlen=1024,
+            blen=4,
+            vlen=1024,
+            hlen=128,
+            batch=4,
+            hbm_channels=8,
+            hbm_generation="HBM2",
+            chip_count=tp,
+            tp=tp,
+            kvp=1,
+            link_ports=(0 if tp == 1 else 1),
+            sram_policy="streaming",
+            kv_head_reuse=True,
+            drain_overlapped=False,
+        )
+        partition = evaluation.RankLocalAttentionGeometry.bind(shape, candidate)
+        assert partition.local_attention_heads == 64 // tp
+        assert partition.local_kv_heads == 8 // tp
+        assert partition.global_kv_heads == 8
+        target = evaluation._selector_runtime_target(profile, candidate, shape)
+        assert target.kv_heads == 8 // tp
+        reuse = kv_head_reuse_status(
+            enabled=True,
+            mlen=candidate.mlen,
+            hlen=candidate.hlen,
+            blen=candidate.blen,
+            kv_heads=partition.local_kv_heads,
+        )
+        assert reuse["kv_heads"] == 8 // tp
+        assert reuse["supported"] is (tp > 1)
+        areas[tp] = architecture_option_area_mm2(
+            mlen=candidate.mlen,
+            hlen=candidate.hlen,
+            kv_heads=partition.local_kv_heads,
+            kv_head_reuse=True,
+            drain_overlapped=False,
+        )["area_mm2_per_chip"]
+    assert areas[1] > areas[2] > areas[4]
+    assert areas[4] == areas[8]
+
+
+def test_exact_search_knob_choice_respects_area_and_capacity_tradeoffs() -> None:
+    simulator = evaluation.simulator_root()
+    if str(simulator) not in sys.path:
+        sys.path.insert(0, str(simulator))
+    from analytic_models.disagg_serve.packed_kv import (
+        architecture_option_area_mm2,
+    )
+
+    space = ExactHardwareSpace(
+        mlen=(1024,),
+        blen=(2,),
+        hlen=(128,),
+        batch=(4, 8),
+        hbm_channels=(8,),
+        chip_count=(1,),
+        sram_policy=("streaming",),
+        kv_head_reuse=(False, True),
+        drain_overlapped=(False,),
+        attention_heads=64,
+        kv_heads=8,
+    )
+    candidates = space.candidates(4096)
+    base_area = 100.0
+
+    def aggregate_area(candidate: HardwareCandidate) -> float:
+        option = architecture_option_area_mm2(
+            mlen=candidate.mlen,
+            hlen=candidate.hlen,
+            kv_heads=8,
+            kv_head_reuse=candidate.kv_head_reuse,
+            drain_overlapped=candidate.drain_overlapped,
+        )
+        return base_area + float(option["area_mm2_per_chip"])
+
+    reuse_addition = min(
+        aggregate_area(candidate) - base_area
+        for candidate in candidates
+        if candidate.kv_head_reuse
+    )
+    assert reuse_addition > 0
+
+    def choose(area_limit: float) -> HardwareCandidate:
+        feasible = []
+        for candidate in candidates:
+            capacity_feasible = candidate.batch <= 4
+            area_status = ResourceBudgetStatus(
+                aggregate_area_mm2=aggregate_area(candidate),
+                aggregate_hbm_capacity_bytes=1_000,
+                aggregate_hbm_bandwidth_bytes_per_s=1_000.0,
+                aggregate_multiplier_count=(
+                    candidate.mlen * candidate.blen
+                ),
+                budget=ResourceBudget(
+                    aggregate_area_limit_mm2=area_limit,
+                    aggregate_hbm_capacity_limit_bytes=1_000,
+                    aggregate_hbm_bandwidth_limit_bytes_per_s=1_000.0,
+                    reference_system="focused-search",
+                ),
+            )
+            if capacity_feasible and area_status.feasible:
+                feasible.append(candidate)
+        return max(
+            feasible,
+            key=lambda candidate: (
+                candidate.batch * (8 if candidate.kv_head_reuse else 1),
+                candidate.candidate_id,
+            ),
+        )
+
+    loose = choose(base_area + reuse_addition)
+    tight = choose(base_area + reuse_addition / 2)
+    assert loose.batch == tight.batch == 4
+    assert loose.kv_head_reuse is True
+    assert tight.kv_head_reuse is False
+    assert all(candidate.batch == 8 for candidate in candidates if candidate.batch > 4)
+
+
+def test_full_model_spaces_have_exact_bounded_structural_counts() -> None:
+    repository = Path(__file__).resolve().parents[2]
+    expected = {
+        "qwen3_32b": 471_072,
+        "llama3_1_8b": 616_032,
+    }
+    for name, count in expected.items():
+        config = json.loads(
+            (repository / "decode_dse" / "configs" / f"{name}.json")
+            .read_text(encoding="utf-8")
+        )
+        space = ExactHardwareSpace.from_study_config(config)
+        hidden = int(config["model_architecture"]["hidden_size"])
+        assert space.candidate_count(hidden) == count
+        assert count < 2_000_000
+
+
+def _synthetic_manifest():
+    provenance = QuantizerProvenance(
+        sources=(
+            QuantizerSource(
+                component="synthetic",
+                path="decode_dse/profiles.py",
+                sha256="a" * 64,
+            ),
+        ),
+        resolved_imports=(
+            ResolvedImportOrigin(
+                module="chop.nn.quantizers.mxint.fake",
+                path="mase/src/chop/nn/quantizers/mxint/fake.py",
+            ),
+        ),
+    )
+    return build_exhaustive_manifest(
+        "synthetic-model",
+        "b" * 40,
+        {
+            "hidden_size": 128,
+            "intermediate_size": 256,
+            "num_hidden_layers": 2,
+            "num_attention_heads": 8,
+            "num_key_value_heads": 2,
+            "head_dim": 16,
+            "vocab_size": 256,
+            "tie_word_embeddings": False,
+            "attention_bias": False,
+            "use_qk_norm": False,
+        },
+        provenance,
+        "c" * 40,
+    )
+
+
+def _numerical_row(entry, mean_nll: float) -> dict[str, object]:
+    return {
+        "profile_id": entry.profile_id,
+        "state": "succeeded",
+        "attempt": 1,
+        "result": {"mean_nll": mean_nll, "token_count": 32},
+    }
+
+
+def test_e1_handoff_analysis_uses_explicit_artifact_and_decode_costs(
+    tmp_path,
+) -> None:
+    source = tmp_path / "prefill_handoff.json"
+    source.write_text(json.dumps(_handoff_payload()), encoding="utf-8")
+    workload = evaluation.HardwareWorkload(16, 2, 1, 0)
+    artifact = evaluation.PrefillHandoffArtifact.load(
+        source,
+        model_name="synthetic/model",
+        model_revision="a" * 40,
+        workload=workload,
+        required_batches=(1,),
+    )
+    entry = next(
+        row
+        for row in _synthetic_manifest().entries
+        if (
+            row.profile.kind == PROFILE_KIND_QUANTIZED
+            and row.legality.hardware_candidate
+        )
+    )
+    candidate = HardwareCandidate(
+        mlen=128,
+        blen=2,
+        vlen=128,
+        hlen=16,
+        batch=1,
+        hbm_channels=8,
+        hbm_generation="HBM2",
+        chip_count=1,
+        tp=1,
+        kvp=1,
+        link_ports=0,
+        sram_policy="streaming",
+    )
+
+    class Simulator:
+        dims = {
+            "hidden": 128,
+            "intermediate": 256,
+            "layers": 2,
+            "heads": 8,
+            "kv_heads": 2,
+            "head_dim": 16,
+            "vocab": 256,
+        }
+
+        @staticmethod
+        def make_precision(**_kwargs):
+            return SimpleNamespace(spec={"kv_bits": 4.0})
+
+    backend = object.__new__(evaluation.DecodeSimulatorBackend)
+    backend.sim = Simulator()
+    analysis = backend.evaluate_handoff(
+        entry,
+        candidate,
+        workload,
+        artifact,
+        decode_tpot_s=0.002,
+        decode_energy_per_token_j=0.08,
+        decode_energy_tier="analytic_anchored",
+        decode_timing_evidence_id="timing-" + "d" * 64,
+        system_calibration_id="system-" + "e" * 64,
+    )
+
+    assert analysis["ordinary_decode_ranking_effect"] == "none"
+    assert analysis["publication_rankable"] is True
+    assert analysis["handoff"]["wire_bytes"] > (
+        analysis["handoff"]["decode_cache_bytes"]
+    )
+    assert [row["regime"] for row in analysis["regimes"]] == [
+        "fully_pipelined",
+        "back_pressure",
+        "host_buffered",
+    ]
+    assert all(row["prefill_decode_ratio"] > 0 for row in analysis["regimes"])
+
+
+def test_lossless_schedule_filters_only_hard_gates_and_joins_cached_rows(
+    tmp_path: Path,
+) -> None:
+    manifest = _synthetic_manifest()
+    reference = next(
+        entry
+        for entry in manifest.entries
+        if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+    )
+    quantized = tuple(
+        entry
+        for entry in manifest.entries
+        if (
+            entry.profile.kind == PROFILE_KIND_QUANTIZED
+            and entry.legality.hardware_candidate
+        )
+    )[:3]
+    rows = (
+        _numerical_row(reference, 1.0),
+        _numerical_row(quantized[0], 1.001),
+        _numerical_row(quantized[1], 1.005),
+        _numerical_row(quantized[2], 1.02),
+    )
+
+    class Evaluator:
+        def __init__(self) -> None:
+            self.calls: list[tuple[str, int]] = []
+
+        def physical_cost_group_key(self, entry, numerical):
+            return {"synthetic_cost": "identical"}
+
+        def preflight_group_key(self, entry, numerical):
+            return {"synthetic_cost": "identical"}
+
+        def evaluation_group_key(self, entry, numerical):
+            return {"synthetic_cost": "identical"}
+
+        def preflight(self, entry, candidate, numerical):
+            if candidate.batch > 4:
+                return HardwareEvaluation.failed(
+                    "runtime_capacity_exceeded",
+                    "synthetic physical capacity exceeded",
+                )
+            return None
+
+        def __call__(self, entry, candidate, numerical):
+            self.calls.append((entry.profile_id, candidate.batch))
+            return HardwareEvaluation.failed(
+                "synthetic_unrankable",
+                "cost invocation recorded",
+            )
+
+    evaluator = Evaluator()
+    space = ExactHardwareSpace(
+        mlen=(128,),
+        blen=(2,),
+        hlen=(16,),
+        batch=(1, 4, 8),
+        hbm_channels=(8,),
+        chip_count=(1,),
+        sram_policy=("streaming",),
+        kv_head_reuse=(False,),
+        drain_overlapped=(False,),
+        attention_heads=8,
+        kv_heads=2,
+    )
+    study = ExactHardwareStudy(
+        manifest=manifest,
+        numerical_results=rows,
+        space=space,
+        hidden_size=128,
+        evaluator=evaluator,
+        evaluator_version="synthetic-evaluator",
+        require_complete=False,
+        relative_perplexity_limit=1.01,
+    )
+    assert study.capability_target is not None
+    assert study.capability_target.kv_heads == 2
+    assert study.capability_target.head_dim == 16
+    assert study.capability_target.hlen == 16
+    results = tuple(study.iter_results())
+    schedule = study.provenance.search_schedule
+    assert schedule["profile_counts"] == {
+        "hardware_relevant_available": 3,
+        "accuracy_passing": 2,
+        "accuracy_rejected": 1,
+        "physical_cost_signatures": 1,
+        "preflight_equivalence_groups": 1,
+    }
+    assert schedule["cross_product_counts"] == {
+        "raw_hardware_relevant": 9,
+        "after_accuracy_constraint": 6,
+        "physical_signature_pairs": 3,
+        "preflight_passing_equivalence_pairs": 2,
+        "simulator_priced_pairs": 2,
+        "joined_result_rows": 4,
+    }
+    assert schedule["preflight_rejections_by_code"] == {
+        "runtime_capacity_exceeded": 1,
+    }
+    assert len(results) == study.expected_result_count == 4
+    assert {result.profile_id for result in results} == {
+        quantized[0].profile_id,
+        quantized[1].profile_id,
+    }
+    assert {result.candidate.batch for result in results} == {1, 4}
+    assert len(evaluator.calls) == 2
+
+    # Every hard-feasible candidate is still priced, so an arbitrary TPOT or
+    # energy objective has the same optimum as an exhaustive feasible scan.
+    priced_batches = {batch for _, batch in evaluator.calls}
+    exhaustive_feasible = {
+        candidate.batch
+        for candidate in space.candidates(128)
+        if candidate.batch <= 4
+    }
+    assert priced_batches == exhaustive_feasible
+    synthetic_tpot = {1: 4.0, 4: 1.0}
+    assert min(priced_batches, key=synthetic_tpot.get) == min(
+        exhaustive_feasible,
+        key=synthetic_tpot.get,
+    )
+    assert schedule["accuracy_constraint"]["maximum_mean_nll"] == pytest.approx(
+        1.0 + math.log(1.01)
+    )
+
+    legacy_evaluator = Evaluator()
+    legacy_study = ExactHardwareStudy(
+        manifest=manifest,
+        numerical_results=rows,
+        space=space,
+        hidden_size=128,
+        evaluator=legacy_evaluator,
+        evaluator_version="synthetic-evaluator",
+        require_complete=False,
+        relative_perplexity_limit=1.01,
+    )
+    legacy_rows = []
+    for entries, candidate_mask, _ in legacy_study._schedule:
+        for candidate_index, candidate in enumerate(
+            space.iter_candidates(128)
+        ):
+            if not candidate_mask[candidate_index]:
+                continue
+            evaluation_groups = {}
+            for entry in entries:
+                key = legacy_study._evaluation_group_keys[entry.profile_id]
+                evaluation_groups.setdefault(key, []).append(entry)
+            for grouped_entries in evaluation_groups.values():
+                representative = grouped_entries[0]
+                outcome = legacy_evaluator(
+                    representative,
+                    candidate,
+                    legacy_study._rows[representative.profile_id],
+                )
+                legacy_rows.extend(
+                    legacy_study._joined_result(
+                        entry,
+                        candidate,
+                        outcome,
+                    ).to_dict()
+                    for entry in grouped_entries
+                )
+    factorized_bytes = json.dumps(
+        [result.to_dict() for result in results],
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    legacy_bytes = json.dumps(
+        legacy_rows,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    assert factorized_bytes == legacy_bytes
+    assert len(legacy_evaluator.calls) == 2
+
+    study.iter_results = lambda: (_ for _ in ()).throw(
+        AssertionError("production artifact writing cannot expand conceptual rows")
+    )
+    artifact = study.write(tmp_path / "factorized_hardware.jsonl")
+    factorized_header, _ = load_hardware_artifact(artifact.path)
+    assert factorized_header["factor_evaluation_count"] == 2
+    assert factorized_header["conceptual_result_count"] == 4
+    assert [
+        membership["member_count"]
+        for membership in factorized_header["factor_memberships"]
+    ] == [2]
+
+
+def _compact_publication_profiles() -> tuple[DecodePrecisionProfile, ...]:
+    quantized = (
+        DecodePrecisionProfile.quantized(
+            "MXINT8", "MXINT8", "MXINT8", "FP_E3M2"
+        ),
+        DecodePrecisionProfile.quantized(
+            "MXINT4", "MXINT4", "MXINT4", "FP_E3M2"
+        ),
+        DecodePrecisionProfile.quantized(
+            "MXINT8", "MXINT4", "MXINT2", "FP_E3M2"
+        ),
+        DecodePrecisionProfile.quantized(
+            "MXINT4", "MXINT8", "MXINT8", "FP_E2M3"
+        ),
+    )
+    controls = tuple(
+        DecodePrecisionProfile.vector_bf16_control(
+            profile.weight_format,
+            profile.activation_format,
+            profile.kv_format,
+        )
+        for profile in quantized
+    )
+    return quantized + controls
+
+
+def test_factor_reduction_cost_is_independent_of_alias_membership() -> None:
+    manifest = _synthetic_manifest()
+    aliases = tuple(
+        entry
+        for entry in manifest.entries
+        if (
+            entry.profile.kind == PROFILE_KIND_QUANTIZED
+            and entry.profile.weight_format == "MXINT8"
+            and entry.profile.activation_format == "MXINT8"
+            and entry.profile.key_format == "MXINT8"
+            and entry.profile.value_format == "MXINT8"
+        )
+    )
+    assert len(aliases) == 6
+    numerical = {
+        entry.profile_id: _numerical_row(entry, 1.0)
+        for entry in aliases
+    }
+    join_class_ids = {
+        _factor_join_class_id(entry, numerical[entry.profile_id])
+        for entry in aliases
+    }
+    assert len(join_class_ids) == 1
+    join_class_id = next(iter(join_class_ids))
+
+    provenance_body = {"fixture": "alias-factor-reduction"}
+    provenance_hash = _content_hash(provenance_body)
+    run_id = f"hwdse-{provenance_hash}"
+    group = _HardwareFactorGroup(
+        factor_id=f"hardware-factor-{'1' * 64}",
+        physical_signature_id="physical-alias-group",
+        preflight_group_id="preflight-alias-group",
+        evaluation_group_id="evaluation-alias-group",
+        schedule_ordinal=0,
+        evaluation_group_ordinal=0,
+        entries=aliases,
+        join_classes=((join_class_id, aliases),),
+        candidate_mask_sha256=hashlib.sha256(b"\x01\x01").hexdigest(),
+        passing_candidate_count=2,
+    )
+    factors = []
+    joined_rows = {}
+    for candidate_ordinal, (suffix, tpot_ms, energy_j) in enumerate(
+        (("fast", 1.0, 2.0), ("efficient", 2.0, 1.0))
+    ):
+        candidate_id = f"candidate-{suffix}"
+        hardware = {
+            "CHIP_COUNT": 1,
+            "TP": 1,
+            "KVP": 1,
+            "fixture_variant": suffix,
+        }
+        candidate = SimpleNamespace(
+            candidate_id=candidate_id,
+            to_dict=lambda hardware=hardware: hardware,
+        )
+        common = _compact_hardware_row(
+            run_id=run_id,
+            profile=aliases[0].profile,
+            profile_ordinal=aliases[0].ordinal,
+            candidate_suffix=suffix,
+            mean_nll=1.0,
+            tpot_ms=tpot_ms,
+            energy_j=energy_j,
+        )
+        common_metrics = common["metrics"]
+        outcome = SimpleNamespace(
+            metrics=SimpleNamespace(
+                to_dict=lambda metrics=common_metrics: metrics
+            ),
+            validity=StackValidity(True, True, True, True, True),
+            error_code=None,
+            error_message=None,
+        )
+        factors.append(
+            _HardwareFactorEvaluation(
+                ordinal=candidate_ordinal,
+                candidate_ordinal=candidate_ordinal,
+                group=group,
+                candidate=candidate,
+                outcome=outcome,
+            )
+        )
+        for entry in aliases:
+            row = _compact_hardware_row(
+                run_id=run_id,
+                profile=entry.profile,
+                profile_ordinal=entry.ordinal,
+                candidate_suffix=suffix,
+                mean_nll=1.0,
+                tpot_ms=tpot_ms,
+                energy_j=energy_j,
+            )
+            row.pop("record_hash")
+            row["candidate_id"] = candidate_id
+            row["hardware"] = hardware
+            row["metrics"] = common_metrics
+            joined_rows[(entry.profile_id, candidate_id)] = {
+                **row,
+                "record_hash": _content_hash(row),
+            }
+
+    membership = {
+        "factor_id": group.factor_id,
+        "physical_signature_id": group.physical_signature_id,
+        "preflight_group_id": group.preflight_group_id,
+        "evaluation_group_id": group.evaluation_group_id,
+        "schedule_ordinal": 0,
+        "evaluation_group_ordinal": 0,
+        "candidate_mask_sha256": group.candidate_mask_sha256,
+        "passing_candidate_count": 2,
+        "member_count": len(aliases),
+        "conceptual_result_count": 2 * len(aliases),
+        "members": [
+            {
+                "member_ordinal": member_ordinal,
+                "join_class_id": join_class_id,
+                "profile_ordinal": entry.ordinal,
+                "profile_id": entry.profile_id,
+                "profile": entry.profile.to_dict(),
+                "legality": entry.legality.to_dict(),
+                "numerical_result_hash": _content_hash(
+                    numerical[entry.profile_id]
+                ),
+                "numerical_summary": {
+                    "state": "succeeded",
+                    "attempt": 1,
+                    "record_hash": None,
+                    "result_path": None,
+                    "scalar_metrics": {"mean_nll": 1.0},
+                    "document_metrics_hash": None,
+                },
+            }
+            for member_ordinal, entry in enumerate(aliases)
+        ],
+    }
+    join_calls = []
+
+    def joined_result(entry, candidate, outcome):
+        join_calls.append((entry.profile_id, candidate.candidate_id))
+        row = joined_rows[(entry.profile_id, candidate.candidate_id)]
+        return SimpleNamespace(to_dict=lambda row=row: row)
+
+    study = SimpleNamespace(
+        provenance=SimpleNamespace(run_id=run_id),
+        scatter_sample_limit=0,
+        expected_factor_evaluation_count=2,
+        _factor_memberships=(group,),
+        factor_membership_records=lambda: (membership,),
+        _joined_result=joined_result,
+    )
+    reducer = _FactorizedHardwareReducer(study)
+    for factor in factors:
+        reducer.consume(factor)
+    assert len(join_calls) == 2
+    summary, stored_factors, stored_bindings = reducer.finish()
+    assert len(stored_factors) == 2
+    assert len(stored_bindings) == 2 * len(aliases)
+    assert len(join_calls) == 2 + 2 * len(aliases)
+    assert all(
+        aggregate["local_frontier_count"] == 2
+        for aggregate in summary["profile_aggregates"]
+    )
+
+
+def _compact_hardware_row(
+    *,
+    run_id: str,
+    profile: DecodePrecisionProfile,
+    profile_ordinal: int,
+    candidate_suffix: str,
+    mean_nll: float,
+    tpot_ms: float,
+    energy_j: float,
+) -> dict[str, object]:
+    candidate_id = f"candidate-{profile_ordinal:02d}-{candidate_suffix}"
+    area_mm2 = 300.0 + profile_ordinal
+    body = {
+        "schema_version": "decode-hardware-result",
+        "run_id": run_id,
+        "profile_ordinal": profile_ordinal,
+        "profile_id": profile.profile_id,
+        "profile": profile.to_dict(),
+        "legality": {},
+        "numerical_result_hash": _content_hash(
+            {"profile_id": profile.profile_id, "mean_nll": mean_nll}
+        ),
+        "numerical_summary": {
+            "state": "succeeded",
+            "attempt": 1,
+            "record_hash": "numerical-record",
+            "result_path": "fixture.json",
+            "scalar_metrics": {"mean_nll": mean_nll},
+            "document_metrics_hash": None,
+        },
+        "candidate_id": candidate_id,
+        "hardware": {
+            "CHIP_COUNT": 1,
+            "TP": 1,
+            "KVP": 1,
+        },
+        "capability": {},
+        "packedkv_selector_valid": True,
+        "packedkv_selector_evidence": {},
+        "validity": StackValidity(True, True, True, True, True).to_dict(),
+        "software_valid": True,
+        "compiler_valid": True,
+        "emulator_valid": True,
+        "rtl_valid": True,
+        "dc_calibrated": True,
+        "deployment_valid": True,
+        "metrics": {
+            "whole_model": {
+                "rankable": True,
+                "publication_timing_tier": "stage_calibrated_analytic",
+                "tpot_ms": tpot_ms,
+                "tps": 1000.0 / tpot_ms,
+                "system_calibration_id": "system-calibration",
+                "calibrated_energy": {
+                    "total_j": energy_j,
+                    "energy_tier": "dc_calibrated",
+                    "energy_id": "power-calibration",
+                },
+            },
+            "output_head_boundary": {
+                "estimate": {"calibration_id": "head-calibration"}
+            },
+            "capacity": {"feasible": True},
+            "runtime_capacity_evidence": {"max_runtime_batch": 256},
+            "timing_calibrated": True,
+            "runtime_feasible": True,
+            "area_mm2": area_mm2,
+            "system_area_mm2": area_mm2,
+            "resource_budget": {
+                "aggregate_area_mm2": area_mm2,
+                "aggregate_area_limit_mm2": 1000.0,
+            },
+        },
+        "error_code": None,
+        "error_message": None,
+    }
+    return {**body, "record_hash": _content_hash(body)}
+
+
+def _write_compact_fixture(path: Path, *, sample_limit: int = 2):
+    provenance_body = {"fixture": "compact-hardware-artifact"}
+    provenance_hash = _content_hash(provenance_body)
+    run_id = f"hwdse-{provenance_hash}"
+    profiles = _compact_publication_profiles()
+    failed_profile = DecodePrecisionProfile.quantized(
+        "MXINT8", "MXINT8", "MXINT4", "FP_E3M2"
+    )
+    rows = []
+    mean_nll_by_profile = {}
+    for profile_ordinal, profile in enumerate(profiles):
+        mean_nll = 1.001 + profile_ordinal * 0.0005
+        mean_nll_by_profile[profile.profile_id] = mean_nll
+        best_tpot = 1.0 + profile_ordinal * 0.1
+        best_energy = 0.2 + profile_ordinal * 0.02
+        if profile_ordinal == 3:
+            rows.extend(
+                (
+                    _compact_hardware_row(
+                        run_id=run_id,
+                        profile=profile,
+                        profile_ordinal=profile_ordinal,
+                        candidate_suffix="lowest-energy",
+                        mean_nll=mean_nll,
+                        tpot_ms=best_tpot + 5.0,
+                        energy_j=best_energy,
+                    ),
+                    _compact_hardware_row(
+                        run_id=run_id,
+                        profile=profile,
+                        profile_ordinal=profile_ordinal,
+                        candidate_suffix="fastest",
+                        mean_nll=mean_nll,
+                        tpot_ms=best_tpot,
+                        energy_j=best_energy + 1.0,
+                    ),
+                )
+            )
+        else:
+            rows.extend((
+                _compact_hardware_row(
+                    run_id=run_id,
+                    profile=profile,
+                    profile_ordinal=profile_ordinal,
+                    candidate_suffix="dominated",
+                    mean_nll=mean_nll,
+                    tpot_ms=best_tpot + 5.0,
+                    energy_j=best_energy + 1.0,
+                ),
+                _compact_hardware_row(
+                    run_id=run_id,
+                    profile=profile,
+                    profile_ordinal=profile_ordinal,
+                    candidate_suffix="winner",
+                    mean_nll=mean_nll,
+                    tpot_ms=best_tpot,
+                    energy_j=best_energy,
+                ),
+            ))
+    failed_ordinal = len(profiles)
+    failed_mean_nll = 1.02
+    mean_nll_by_profile[failed_profile.profile_id] = failed_mean_nll
+    for suffix in ("compiler", "timing"):
+        failed = _compact_hardware_row(
+            run_id=run_id,
+            profile=failed_profile,
+            profile_ordinal=failed_ordinal,
+            candidate_suffix=suffix,
+            mean_nll=failed_mean_nll,
+            tpot_ms=10.0,
+            energy_j=2.0,
+        )
+        failed.pop("record_hash")
+        failed.update(
+            {
+                "validity": StackValidity(
+                    True,
+                    False,
+                    False,
+                    False,
+                    False,
+                ).to_dict(),
+                "compiler_valid": False,
+                "emulator_valid": False,
+                "rtl_valid": False,
+                "dc_calibrated": False,
+                "deployment_valid": False,
+                "metrics": None,
+                "error_code": f"{suffix}_failed",
+                "error_message": f"synthetic {suffix} failure",
+            }
+        )
+        rows.append({**failed, "record_hash": _content_hash(failed)})
+    provenance = SimpleNamespace(
+        run_id=run_id,
+        canonical_hash=provenance_hash,
+        to_dict=lambda: provenance_body,
+    )
+    groups = []
+    factors = []
+    membership_records = []
+    factor_ordinal = 0
+    rows_by_identity = {
+        (str(row["profile_id"]), str(row["candidate_id"])): row
+        for row in rows
+    }
+    for profile_ordinal, profile in enumerate(profiles + (failed_profile,)):
+        profile_rows = tuple(
+            row for row in rows if row["profile_id"] == profile.profile_id
+        )
+        entry = SimpleNamespace(
+            ordinal=profile_ordinal,
+            profile_id=profile.profile_id,
+        )
+        factor_id = f"hardware-factor-{profile_ordinal:064x}"
+        join_class_id = f"hardware-join-class-{profile_ordinal:064x}"
+        group = _HardwareFactorGroup(
+            factor_id=factor_id,
+            physical_signature_id=f"physical-{profile_ordinal}",
+            preflight_group_id=f"preflight-{profile_ordinal}",
+            evaluation_group_id=f"evaluation-{profile_ordinal}",
+            schedule_ordinal=profile_ordinal,
+            evaluation_group_ordinal=0,
+            entries=(entry,),
+            join_classes=((join_class_id, (entry,)),),
+            candidate_mask_sha256=hashlib.sha256(
+                bytes([1] * len(profile_rows))
+            ).hexdigest(),
+            passing_candidate_count=len(profile_rows),
+        )
+        groups.append(group)
+        first = profile_rows[0]
+        membership_records.append(
+            {
+                "factor_id": factor_id,
+                "physical_signature_id": group.physical_signature_id,
+                "preflight_group_id": group.preflight_group_id,
+                "evaluation_group_id": group.evaluation_group_id,
+                "schedule_ordinal": profile_ordinal,
+                "evaluation_group_ordinal": 0,
+                "candidate_mask_sha256": group.candidate_mask_sha256,
+                "passing_candidate_count": len(profile_rows),
+                "member_count": 1,
+                "conceptual_result_count": len(profile_rows),
+                "members": [
+                    {
+                        "member_ordinal": 0,
+                        "join_class_id": join_class_id,
+                        "profile_ordinal": profile_ordinal,
+                        "profile_id": profile.profile_id,
+                        "profile": profile.to_dict(),
+                        "legality": first["legality"],
+                        "numerical_result_hash": first[
+                            "numerical_result_hash"
+                        ],
+                        "numerical_summary": first["numerical_summary"],
+                    }
+                ],
+            }
+        )
+        for candidate_ordinal, row in enumerate(profile_rows):
+            candidate = SimpleNamespace(
+                candidate_id=row["candidate_id"],
+                to_dict=lambda row=row: row["hardware"],
+            )
+            metrics = (
+                SimpleNamespace(to_dict=lambda row=row: row["metrics"])
+                if row["metrics"] is not None
+                else None
+            )
+            outcome = SimpleNamespace(
+                metrics=metrics,
+                validity=StackValidity.from_dict(row["validity"]),
+                error_code=row["error_code"],
+                error_message=row["error_message"],
+            )
+            factors.append(
+                _HardwareFactorEvaluation(
+                    ordinal=factor_ordinal,
+                    candidate_ordinal=candidate_ordinal,
+                    group=group,
+                    candidate=candidate,
+                    outcome=outcome,
+                )
+            )
+            factor_ordinal += 1
+
+    def joined_result(entry, candidate, outcome):
+        row = rows_by_identity[(entry.profile_id, candidate.candidate_id)]
+        return SimpleNamespace(to_dict=lambda row=row: row)
+
+    study = SimpleNamespace(
+        provenance=provenance,
+        expected_result_count=len(rows),
+        expected_factor_evaluation_count=len(factors),
+        scatter_sample_limit=sample_limit,
+        _factor_memberships=tuple(groups),
+        factor_membership_records=lambda: tuple(membership_records),
+        iter_factor_evaluations=lambda: iter(factors),
+        _joined_result=joined_result,
+    )
+    artifact = ExactHardwareStudy.write(study, path)
+    return artifact, profiles + (failed_profile,), rows, mean_nll_by_profile
+
+
+def test_compact_hardware_artifact_preserves_promotion_and_streams(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    artifact, profiles, full_rows, mean_nll = _write_compact_fixture(
+        tmp_path / "hardware.jsonl",
+        sample_limit=2,
+    )
+    header, compact_rows = load_hardware_artifact(artifact.path)
+    assert header["storage_revision"] == "factorized-exact"
+    assert header["expected_result_count"] == len(full_rows) == 18
+    assert header["conceptual_result_count"] == 18
+    assert header["factor_evaluation_count"] == 18
+    assert artifact.result_count == 18
+    assert artifact.stored_result_count == len(compact_rows) < 18
+    assert header["retention"]["sampled_dominated_count"] <= 2
+    assert header["retention"]["sample_limit"] == 2
+    failed_aggregate = header["profile_aggregates"][-1]
+    assert failed_aggregate["valid_count"] == 0
+    assert failed_aggregate["error_count"] == 2
+    assert failed_aggregate["local_frontier"] == []
+    assert all(
+        aggregate["valid_count"] == 2
+        for aggregate in header["profile_aggregates"][:-1]
+    )
+
+    profile_by_id = {profile.profile_id: profile for profile in profiles}
+    full_points = tuple(
+        _hardware_point(
+            row,
+            profile=profile_by_id[str(row["profile_id"])],
+            mean_nll=mean_nll[str(row["profile_id"])],
+        )
+        for row in full_rows
+    )
+    compact_points = tuple(
+        _hardware_point(
+            row,
+            profile=profile_by_id[str(row["profile_id"])],
+            mean_nll=mean_nll[str(row["profile_id"])],
+        )
+        for row in compact_rows
+        if "profile_frontier" in row["retention_labels"]
+    )
+    assert all(point is not None for point in compact_points)
+    full_selection = select_refinement_sources(
+        (point for point in full_points if point is not None),
+        reference_mean_nll=1.0,
+    )
+    compact_selection = select_refinement_sources(
+        (point for point in compact_points if point is not None),
+        reference_mean_nll=1.0,
+    )
+    assert compact_selection.to_dict() == full_selection.to_dict()
+    deployment_profile_id = profiles[3].profile_id
+    deployment_alternatives = tuple(
+        point
+        for point in compact_selection.promotion.hardware_alternatives
+        if point.profile_id == deployment_profile_id
+    )
+    assert len(deployment_alternatives) == 2
+    assert {point.candidate_id for point in deployment_alternatives} == {
+        "candidate-03-lowest-energy",
+        "candidate-03-fastest",
+    }
+
+    original_read_text = Path.read_text
+    original_read_bytes = Path.read_bytes
+    with monkeypatch.context() as patch:
+        patch.setattr(
+            Path,
+            "read_text",
+            lambda self, *args, **kwargs: (
+                (_ for _ in ()).throw(AssertionError("data read_text is forbidden"))
+                if self.resolve() == artifact.path.resolve()
+                else original_read_text(self, *args, **kwargs)
+            ),
+        )
+        patch.setattr(
+            Path,
+            "read_bytes",
+            lambda self, *args, **kwargs: (
+                (_ for _ in ()).throw(AssertionError("data read_bytes is forbidden"))
+                if self.resolve() == artifact.path.resolve()
+                else original_read_bytes(self, *args, **kwargs)
+            ),
+        )
+        streamed_header, streamed_rows = load_hardware_artifact(artifact.path)
+    assert streamed_header["factor_evaluation_sha256"] == header[
+        "factor_evaluation_sha256"
+    ]
+    assert streamed_rows == compact_rows
+
+
+def test_compact_hardware_artifact_detects_digest_and_count_tampering(
+    tmp_path: Path,
+) -> None:
+    artifact, _, _, _ = _write_compact_fixture(tmp_path / "hardware.jsonl")
+    original_data = artifact.path.read_bytes()
+    original_metadata = artifact.metadata_path.read_bytes()
+    lines = artifact.path.read_text(encoding="utf-8").splitlines()
+    header = json.loads(lines[0])
+    header["factor_evaluation_sha256"] = "0" * 64
+    lines[0] = json.dumps(header, sort_keys=True, separators=(",", ":"))
+    artifact.path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="content hash|enumeration digest"):
+        load_hardware_artifact(artifact.path)
+
+    artifact.path.write_bytes(original_data)
+    artifact.metadata_path.write_bytes(original_metadata)
+    lines = artifact.path.read_text(encoding="utf-8").splitlines()
+    header = json.loads(lines[0])
+    header["conceptual_result_count"] += 1
+    lines[0] = json.dumps(header, sort_keys=True, separators=(",", ":"))
+    artifact.path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    metadata = json.loads(artifact.metadata_path.read_text(encoding="utf-8"))
+    metadata["content_sha256"] = hashlib.sha256(
+        artifact.path.read_bytes()
+    ).hexdigest()
+    artifact.metadata_path.write_text(
+        json.dumps(metadata, sort_keys=True, separators=(",", ":")) + "\n",
+        encoding="utf-8",
+    )
+    with pytest.raises(ValueError, match="cardinality|expansion contract"):
+        load_hardware_artifact(artifact.path)
+
+
+def test_gqa_topology_roles_are_model_general() -> None:
+    topology = AttentionTopology(
+        role="gqa8",
+        query_heads=32,
+        kv_heads=4,
+        head_dim=64,
+        mlen=512,
+    )
+    assert topology.query_heads // topology.kv_heads == 8
+
+
+def test_lossless_schedule_rejects_unsafe_equivalence_nesting() -> None:
+    manifest = _synthetic_manifest()
+    quantized = tuple(
+        entry
+        for entry in manifest.entries
+        if (
+            entry.profile.kind == PROFILE_KIND_QUANTIZED
+            and entry.legality.hardware_candidate
+        )
+    )[:2]
+    rows = tuple(_numerical_row(entry, 1.0) for entry in quantized)
+
+    class UnsafeEvaluator:
+        @staticmethod
+        def physical_cost_group_key(entry, numerical):
+            return entry.profile_id
+
+        @staticmethod
+        def preflight_group_key(entry, numerical):
+            return "incorrectly_merged"
+
+        @staticmethod
+        def evaluation_group_key(entry, numerical):
+            return entry.profile_id
+
+        def __call__(self, entry, candidate, numerical):  # pragma: no cover
+            raise AssertionError("unsafe schedule must fail before evaluation")
+
+    space = ExactHardwareSpace(
+        mlen=(128,),
+        blen=(2,),
+        hlen=(16,),
+        batch=(1,),
+        hbm_channels=(8,),
+        chip_count=(1,),
+        sram_policy=("streaming",),
+        kv_head_reuse=(False,),
+        drain_overlapped=(False,),
+        attention_heads=8,
+        kv_heads=2,
+    )
+    with pytest.raises(
+        ValueError,
+        match="preflight equivalence merges distinct physical-cost signatures",
+    ):
+        ExactHardwareStudy(
+            manifest=manifest,
+            numerical_results=rows,
+            space=space,
+            hidden_size=128,
+            evaluator=UnsafeEvaluator(),
+            evaluator_version="unsafe",
+            require_complete=False,
+        )
+
+
+def test_analytic_power_bridge_reports_every_structural_energy_term() -> None:
+    candidate = HardwareCandidate(
+        mlen=128,
+        blen=4,
+        vlen=128,
+        hlen=128,
+        batch=4,
+        hbm_channels=8,
+        hbm_generation="HBM2",
+        chip_count=2,
+        tp=2,
+        kvp=1,
+        link_ports=1,
+    )
+    traffic = {
+        "weight_element_read_bytes": 1_000.0,
+        "weight_scale_read_bytes": 100.0,
+        "bf16_weight_read_bytes": 200.0,
+        "activation_read_bytes": 0.0,
+        "activation_write_bytes": 0.0,
+        "kv_element_read_bytes": 500.0,
+        "kv_scale_read_bytes": 50.0,
+        "kv_element_write_bytes": 20.0,
+        "kv_scale_write_bytes": 2.0,
+    }
+    observation = SimpleNamespace(
+        hbm_traffic_per_generated_token=tuple(traffic.items()),
+        tps=1_000.0,
+        vector_sram_required_bytes=64_000,
+        avg_realized_compute_seconds=0.001,
+        tpot_ms=4.0,
+        capacity=SimpleNamespace(available_bytes=32_000_000_000),
+        generated_tokens_per_step=4,
+    )
+    energy = analytic_energy_from_simulator(
+        candidate=candidate,
+        observation=observation,
+        mac_bits=4,
+        per_chip_logic_area_mm2=10.0,
+        collective_bytes_per_generated_token=1_024.0,
+    )
+    assert energy.energy_tier == "analytic_anchored"
+    assert energy.compute_j > 0
+    assert energy.sram_j > 0
+    assert energy.hbm_j > 0
+    assert energy.leakage_j > 0
+    assert energy.link_j > 0
+    assert energy.tokens_per_joule == pytest.approx(1.0 / energy.total_j)
+    assert energy.edp_j_s == pytest.approx(energy.total_j * 0.004)
+
+
+@dataclass(frozen=True)
+class _TimingEvidence:
+    evidence_id: str
+    mode: str = "rtl_serialized"
+    passed: bool = True
+
+
+@dataclass(frozen=True)
+class _HeadEvidence:
+    calibration_id: str
+    provenance_id: str
+    service_mode: str = HEAD_SERVICE_MODE
+    passed: bool = True
+
+
+@dataclass(frozen=True)
+class _PowerCalibration:
+    calibration_id: str
+    passed: bool = True
+
+
+def test_selection_accepts_analytic_energy_and_prefers_dc() -> None:
+    suffix = "a" * 64
+    analytic_id = f"analytic-decode-energy-{suffix}"
+    dc_id = f"exact-dc-power-{'b' * 64}"
+    head_id = f"bf16-head-service-{'c' * 64}"
+    head_provenance = f"bf16-head-provenance-{'d' * 64}"
+    timing = _TimingEvidence(f"timing-{'e' * 64}")
+    head = _HeadEvidence(head_id, head_provenance)
+    validity = StackValidity(
+        software_valid=True,
+        compiler_valid=True,
+        emulator_valid=True,
+        rtl_valid=True,
+    )
+
+    def candidate(role: str, index: int, tier: str, energy: float):
+        power_id = dc_id if tier == "dc_calibrated" else analytic_id
+        system_id = composite_system_calibration_id(
+            power_id,
+            head_id,
+            head_provenance,
+        )
+        return PublicationCandidate(
+            evaluation_class=role,
+            profile_id=f"profile-{index}",
+            candidate_id=f"candidate-{index}",
+            profile_kind="quantized",
+            perplexity=10.0,
+            tpot_ms=2.0,
+            energy_per_token_j=energy,
+            energy_tier=tier,
+            validity=(
+                StackValidity(
+                    software_valid=True,
+                    compiler_valid=True,
+                    emulator_valid=True,
+                    rtl_valid=True,
+                    dc_calibrated=True,
+                )
+                if tier == "dc_calibrated"
+                else validity
+            ),
+            power_calibration_id=power_id,
+            cost_scope="whole_model",
+            system_calibration_id=system_id,
+            head_service_calibration_id=head_id,
+            whole_model_rankable=True,
+            timing_calibrated=True,
+            timing_evidence_id=timing.evidence_id,
+            task_delta_lower_ci=(("gsm8k", 0.0), ("ifeval", 0.0)),
+            ruler_scores=tuple(
+                (length, 1.0, 1.0)
+                for length in (4096, 8192, 16384, 32768)
+            ),
+        )
+
+    reference = PublicationCandidate(
+        evaluation_class="bf16_reference",
+        profile_id="reference",
+        candidate_id="accuracy-only",
+        profile_kind=PROFILE_KIND_BF16_REFERENCE,
+        perplexity=10.0,
+        tpot_ms=None,
+        energy_per_token_j=None,
+        validity=StackValidity(software_valid=True),
+        hardware_candidate=False,
+    )
+    values = (
+        reference,
+        candidate("uniform_i8", 1, "analytic_anchored", 0.5),
+        candidate("uniform_i4", 2, "analytic_anchored", 0.4),
+        candidate("pareto_candidate", 3, "dc_calibrated", 0.8),
+    )
+    decision = select_final_deployment(
+        values,
+        calibration=_PowerCalibration(dc_id),
+        timing_evidence=timing,
+        head_service_evidence=head,
+    )
+    assert decision.selected is values[-1]
+    assert decision.energy_tier == "dc_calibrated"
+
+    analytic_values = (
+        reference,
+        candidate("uniform_i8", 11, "analytic_anchored", 0.5),
+        candidate("uniform_i4", 12, "analytic_anchored", 0.4),
+        candidate("pareto_candidate", 13, "analytic_anchored", 0.3),
+    )
+    analytic_decision = select_final_deployment(
+        analytic_values,
+        calibration=None,
+        timing_evidence=timing,
+        head_service_evidence=head,
+    )
+    assert analytic_decision.selected is analytic_values[-1]
+    assert analytic_decision.energy_tier == "analytic_anchored"
+
+
+@pytest.mark.parametrize("name", evaluation._PROVENANCE_MODULES)
+def test_provenance_module_has_a_source_file(name: str) -> None:
+    assert getattr(importlib.import_module(name), "__file__", None)
+
+
+def _synthetic_head_phase_samples() -> tuple[list, list, dict]:
+    """Generate phase samples from a known linear service ground truth."""
+
+    import random
+
+    from decode_dse.hardware.measure_bf16_head_service import (
+        PhaseSample,
+        closed_form_dimensions,
+    )
+
+    hidden_size, vocab_size = 64, 256
+    batches = (1, 4, 8)
+    truth = {
+        "request_bw": 4.0e11,
+        "request_fixed": 2.0e-6,
+        "response_bw": 4.0e11,
+        "response_fixed": 1.5e-6,
+        "mac_per_s": 1.0e15,
+        "memory_bw": 8.0e12,
+        "selection_rate": 1.0e-9,
+        "head_fixed": 3.0e-6,
+        "link_energy": 5.0e-12,
+        "mac_energy": 1.0e-12,
+        "memory_energy": 5.0e-12,
+        "selection_energy": 1.0e-11,
+        "leakage_w": 80.0,
+    }
+    rng = random.Random(7)
+
+    def sample(batch: int, noise: float, hidden_tag: str) -> PhaseSample:
+        dims = closed_form_dimensions(
+            batch=batch, hidden_size=hidden_size, vocab_size=vocab_size
+        )
+        jitter = lambda value: value * (1 + rng.uniform(-noise, noise))
+        head_compute = truth["head_fixed"] + max(
+            dims["bf16_macs"] / truth["mac_per_s"],
+            dims["head_memory_bytes"] / truth["memory_bw"],
+        )
+        digest = lambda tag: hashlib.sha256(tag.encode()).hexdigest()
+        return PhaseSample(
+            batch=batch,
+            request_latency_s=jitter(
+                truth["request_fixed"]
+                + dims["request_bytes"] / truth["request_bw"]
+            ),
+            head_compute_latency_s=jitter(head_compute),
+            selection_latency_s=jitter(
+                dims["selection_elements"] * truth["selection_rate"]
+            ),
+            response_latency_s=jitter(
+                truth["response_fixed"]
+                + dims["response_bytes"] / truth["response_bw"]
+            ),
+            link_energy_j=jitter(
+                (dims["request_bytes"] + dims["response_bytes"])
+                * truth["link_energy"]
+            ),
+            head_compute_energy_j=jitter(
+                dims["bf16_macs"] * truth["mac_energy"]
+                + dims["head_memory_bytes"] * truth["memory_energy"]
+            ),
+            selection_energy_j=jitter(
+                dims["selection_elements"] * truth["selection_energy"]
+            ),
+            leakage_power_w=jitter(truth["leakage_w"]),
+            hidden_sha256=digest(f"hidden-{hidden_tag}"),
+            reference_logits_sha256=digest(f"ref-logits-{hidden_tag}"),
+            service_logits_sha256=digest(f"svc-logits-{hidden_tag}"),
+            reference_token_ids_sha256=digest(f"tokens-{hidden_tag}"),
+            service_token_ids_sha256=digest(f"tokens-{hidden_tag}"),
+            logit_max_abs_error=0.0,
+            logit_mean_abs_error=0.0,
+            topk_set_agreement=1.0,
+            selected_tokens_equal=True,
+        )
+
+    repeats = []
+    holdouts = []
+    for batch in batches:
+        for _ in range(3):
+            repeats.append(sample(batch, 0.01, f"repeat-b{batch}"))
+        for holdout in range(2):
+            holdouts.append(
+                (holdout, sample(batch, 0.02, f"holdout-b{batch}-h{holdout}"))
+            )
+    return repeats, holdouts, {
+        "hidden_size": hidden_size,
+        "vocab_size": vocab_size,
+        "batches": batches,
+        "mac_per_s": truth["mac_per_s"],
+    }
+
+
+def _assembled_synthetic_head_artifact(tmp_path: Path) -> tuple[Path, dict]:
+    from decode_dse.hardware.measure_bf16_head_service import (
+        assemble_artifact,
+        fit_service_coefficients,
+        measurement_record,
+    )
+
+    repeats, holdouts, scope = _synthetic_head_phase_samples()
+    protocol, service = fit_service_coefficients(
+        repeats,
+        hidden_size=scope["hidden_size"],
+        vocab_size=scope["vocab_size"],
+        measured_bf16_mac_per_s=scope["mac_per_s"],
+    )
+    service["head_weight_sha256"] = "a" * 64
+    measurements = []
+    counters: dict[int, int] = {}
+    for sample in repeats:
+        index = counters.get(sample.batch, 0)
+        counters[sample.batch] = index + 1
+        measurements.append(
+            measurement_record(
+                sample,
+                measurement_id=f"repeat-b{sample.batch}-r{index}",
+                split="repeat",
+                repeat=index,
+                hidden_size=scope["hidden_size"],
+                vocab_size=scope["vocab_size"],
+                protocol=protocol,
+                service=service,
+            )
+        )
+    for holdout, sample in holdouts:
+        measurements.append(
+            measurement_record(
+                sample,
+                measurement_id=f"holdout-b{sample.batch}-h{holdout}",
+                split="holdout",
+                repeat=holdout,
+                hidden_size=scope["hidden_size"],
+                vocab_size=scope["vocab_size"],
+                protocol=protocol,
+                service=service,
+            )
+        )
+    model = {
+        "model_name": "synthetic/decode-head",
+        "model_revision": "0" * 40,
+        "hidden_size": scope["hidden_size"],
+        "vocab_size": scope["vocab_size"],
+        "tie_embeddings": False,
+    }
+    provenance = {
+        "repository": "PLENA_Software",
+        "revision": "b" * 40,
+        "source_tree_sha256": "c" * 64,
+        "command": ["measure_bf16_head_service", "--config", "synthetic"],
+        "toolchain": {"torch": "2.7.0", "cuda": "12.8"},
+        "environment_sha256": "d" * 64,
+        "link_id": "driver->endpoint",
+        "head_service_id": "endpoint",
+        "process_corner": "measured_silicon",
+        "measured_at_utc": "2026-08-03T12:00:00Z",
+        "measurement_resolution": {
+            "meter_methods": {
+                "driver": "nvml_total_energy_counter",
+                "endpoint": "nvml_total_energy_counter",
+            },
+            "power_plausibility_ceiling_w": 2400.0,
+            "min_counter_delta_j": 0.1,
+            "idle_power_w": 270.0,
+            "phase_windows": {},
+        },
+    }
+    document = assemble_artifact(
+        model=model,
+        protocol=protocol,
+        service=service,
+        required_batches=scope["batches"],
+        measurements=measurements,
+        provenance=provenance,
+    )
+    path = tmp_path / "bf16_output_head_service.json"
+    path.write_text(json.dumps(document, indent=2) + "\n", encoding="utf-8")
+    return path, model
+
+
+def test_head_service_fit_and_assembly_pass_the_exact_loader(
+    tmp_path: Path,
+) -> None:
+    """Synthetic linear-service phases must seal into a passing artifact."""
+
+    path, model = _assembled_synthetic_head_artifact(tmp_path)
+    status = load_bf16_head_service_artifact(
+        path,
+        model_name=model["model_name"],
+        model_revision=model["model_revision"],
+        hidden_size=model["hidden_size"],
+        vocab_size=model["vocab_size"],
+        tie_embeddings=model["tie_embeddings"],
+        required_batches=(1, 4, 8),
+    )
+    assert status.passed, status.failures
+    assert status.calibration_id.startswith("bf16-head-service-")
+    assert status.provenance_id.startswith("bf16-head-provenance-")
+    estimate = status.calibration.estimate(4)
+    assert estimate.queue_delay_s == 0.0
+    assert estimate.dynamic_energy_j > 0
+
+
+def test_head_service_loader_rejects_a_corrupted_measurement(
+    tmp_path: Path,
+) -> None:
+    path, model = _assembled_synthetic_head_artifact(tmp_path)
+    document = json.loads(path.read_text(encoding="utf-8"))
+    document["measurements"][0]["bf16_macs"] += 1
+    corrupted = tmp_path / "corrupted.json"
+    corrupted.write_text(json.dumps(document) + "\n", encoding="utf-8")
+    status = load_bf16_head_service_artifact(
+        corrupted,
+        model_name=model["model_name"],
+        model_revision=model["model_revision"],
+        hidden_size=model["hidden_size"],
+        vocab_size=model["vocab_size"],
+        tie_embeddings=model["tie_embeddings"],
+        required_batches=(1, 4, 8),
+    )
+    assert not status.passed
+
+
+class _FakeNVMLProcess:
+    def __init__(self, pid: int) -> None:
+        self.pid = pid
+
+
+class _FakeNVML:
+    """Deterministic NVML stand-in for the head-service meter tests."""
+
+    def __init__(
+        self,
+        *,
+        uuid: str = "GPU-aaaa",
+        counter_deltas_mj: list[int] | None = None,
+        counter_available: bool = True,
+        power_mw: int = 400_000,
+        power_available: bool = True,
+        compute_pids: list[int] | None = None,
+        enforced_limit_mw: int = 1_000_000,
+    ) -> None:
+        self.uuid = uuid
+        self.counter_available = counter_available
+        self.power_mw = power_mw
+        self.power_available = power_available
+        self.compute_pids = list(compute_pids or [])
+        self.enforced_limit_mw = enforced_limit_mw
+        self._counter_mj = 1_000_000
+        self._pending_deltas = list(counter_deltas_mj or [])
+
+    def nvmlDeviceGetHandleByUUID(self, uuid: str):
+        if uuid.lower() != self.uuid.lower():
+            raise RuntimeError("uuid not found")
+        return "handle"
+
+    def nvmlDeviceGetUUID(self, handle):
+        return self.uuid
+
+    def nvmlDeviceGetTotalEnergyConsumption(self, handle) -> int:
+        if not self.counter_available:
+            raise RuntimeError("counter unsupported")
+        if self._pending_deltas:
+            self._counter_mj += self._pending_deltas.pop(0)
+        return self._counter_mj
+
+    def nvmlDeviceGetPowerUsage(self, handle) -> int:
+        if not self.power_available:
+            raise RuntimeError("power unsupported")
+        return self.power_mw
+
+    def nvmlDeviceGetComputeRunningProcesses(self, handle):
+        return [_FakeNVMLProcess(pid) for pid in self.compute_pids]
+
+    def nvmlDeviceGetEnforcedPowerLimit(self, handle) -> int:
+        return self.enforced_limit_mw
+
+
+def test_head_meter_uuid_binding_rejects_mismatched_handle() -> None:
+    from decode_dse.hardware import measure_bf16_head_service as measure
+
+    nvml = _FakeNVML(uuid="GPU-aaaa")
+    handle = measure._bind_nvml_handle_by_uuid(nvml, "aaaa")
+    assert handle == "handle"
+    nvml.nvmlDeviceGetUUID = lambda handle: "GPU-bbbb"
+    with pytest.raises(RuntimeError, match="different GPU UUID"):
+        measure._bind_nvml_handle_by_uuid(nvml, "aaaa")
+
+
+def test_head_meter_exclusivity_gate_rejects_foreign_processes() -> None:
+    import os
+
+    from decode_dse.hardware import measure_bf16_head_service as measure
+
+    own = _FakeNVML(compute_pids=[os.getpid()])
+    measure._require_exclusive_compute(own, "handle", "driver cuda:0")
+    foreign = _FakeNVML(compute_pids=[os.getpid(), 4242])
+    with pytest.raises(SystemExit, match="foreign compute processes"):
+        measure._require_exclusive_compute(foreign, "handle", "driver cuda:0")
+
+
+def test_head_phase_energy_rejects_corrupted_and_implausible() -> None:
+    from decode_dse.hardware import measure_bf16_head_service as measure
+
+    measure._check_phase_energy(
+        delta_j=1.0, wall_s=0.01, power_ceiling_w=2400.0, label="head"
+    )
+    # zero is a quantization outcome the adaptive loop escalates, not an error
+    measure._check_phase_energy(
+        delta_j=0.0, wall_s=0.01, power_ceiling_w=2400.0, label="head"
+    )
+    with pytest.raises(RuntimeError, match="negative"):
+        measure._check_phase_energy(
+            delta_j=-0.001, wall_s=0.01, power_ceiling_w=2400.0, label="head"
+        )
+    with pytest.raises(RuntimeError, match="plausibility ceiling"):
+        measure._check_phase_energy(
+            delta_j=9.243, wall_s=0.003265, power_ceiling_w=2400.0, label="head"
+        )
+
+
+def test_head_phase_resolution_floor_drives_adaptive_iterations() -> None:
+    from decode_dse.hardware import measure_bf16_head_service as measure
+
+    assert not measure._phase_delta_sufficient(0.0009)
+    assert not measure._phase_delta_sufficient(0.05)
+    assert measure._phase_delta_sufficient(0.1)
+    assert measure._phase_delta_sufficient(1.0)
+
+
+def test_head_meter_probes_counter_then_falls_back_to_power_trace() -> None:
+    from decode_dse.hardware import measure_bf16_head_service as measure
+
+    # deltas consumed by: constructor probe, begin() alignment reads, end()
+    counter = _FakeNVML(counter_deltas_mj=[0, 0, 100, 500])
+    meter = measure._BoardEnergyMeter(counter, "handle", "driver")
+    assert meter.method == measure.NVML_TOTAL_ENERGY_METHOD
+    meter.begin()
+    delta, window = meter.end()
+    assert delta == pytest.approx(0.5)
+    assert window > 0
+
+    fallback = _FakeNVML(counter_available=False, power_mw=200_000)
+    meter = measure._BoardEnergyMeter(fallback, "handle", "driver")
+    assert meter.method == measure.NVML_POWER_TRACE_METHOD
+    meter.begin()
+    time.sleep(0.05)
+    energy, window = meter.end()
+    assert energy > 0
+    assert energy == pytest.approx(200.0 * 0.05, rel=0.5)
+    assert window == pytest.approx(0.05, rel=0.5)
+
+    dead = _FakeNVML(counter_available=False, power_available=False)
+    with pytest.raises(RuntimeError, match="no usable NVML board-energy meter"):
+        measure._BoardEnergyMeter(dead, "handle", "driver")
+
+
+def test_head_dynamic_energy_resolution_policy() -> None:
+    from decode_dse.hardware import measure_bf16_head_service as measure
+
+    # positive measurements pass through untouched
+    value, below = measure._resolved_dynamic_energy(
+        dynamic_total_j=1.5, idle_energy_j=280.0, label="head"
+    )
+    assert value == 1.5 and below is False
+
+    # a residual inside the idle-drift band becomes the declared bound
+    value, below = measure._resolved_dynamic_energy(
+        dynamic_total_j=-6.2, idle_energy_j=280.0, label="response"
+    )
+    assert value == pytest.approx(0.05 * 280.0)
+    assert below is True
+
+    # beyond the band is corruption
+    with pytest.raises(RuntimeError, match="noise band"):
+        measure._resolved_dynamic_energy(
+            dynamic_total_j=-20.0, idle_energy_j=280.0, label="response"
+        )
diff --git a/decode_dse/hardware/workload_events.py b/decode_dse/hardware/workload_events.py
new file mode 100644
index 0000000..3195441
--- /dev/null
+++ b/decode_dse/hardware/workload_events.py
@@ -0,0 +1,321 @@
+"""Deterministic decode event counts for dense transformer decoder models."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Iterable, Mapping
+
+EVENT_MODEL = "dense-decode-events"
+SELECTOR_SIGNATURE = "SELECTOR:PACKED_KV"
+
+
+@dataclass(frozen=True)
+class DenseDecoderShape:
+    """Dimensions needed to count one cached q_len=1 decode workload."""
+
+    hidden_size: int
+    intermediate_size: int
+    attention_heads: int
+    kv_heads: int
+    head_dim: int
+    layers: int
+    vocab_size: int
+
+    def __post_init__(self) -> None:
+        values = (
+            self.hidden_size,
+            self.intermediate_size,
+            self.attention_heads,
+            self.kv_heads,
+            self.head_dim,
+            self.layers,
+            self.vocab_size,
+        )
+        if any(value <= 0 for value in values):
+            raise ValueError("decoder dimensions must be positive")
+        if self.attention_heads % self.kv_heads:
+            raise ValueError("attention heads must be divisible by KV heads")
+        if self.attention_heads * self.head_dim < self.hidden_size:
+            raise ValueError("attention width cannot be narrower than hidden size")
+
+    @classmethod
+    def from_mapping(cls, value: Mapping[str, int]) -> "DenseDecoderShape":
+        return cls(
+            hidden_size=int(value["hidden"]),
+            intermediate_size=int(value["inter"]),
+            attention_heads=int(value["heads"]),
+            kv_heads=int(value["kv_heads"]),
+            head_dim=int(value["head_dim"]),
+            layers=int(value["layers"]),
+            vocab_size=int(value["vocab"]),
+        )
+
+    def to_dict(self) -> dict[str, int]:
+        return {
+            "hidden_size": self.hidden_size,
+            "intermediate_size": self.intermediate_size,
+            "attention_heads": self.attention_heads,
+            "kv_heads": self.kv_heads,
+            "head_dim": self.head_dim,
+            "layers": self.layers,
+            "vocab_size": self.vocab_size,
+        }
+
+
+@dataclass(frozen=True)
+class DecodeEvent:
+    """One operation signature and its complete workload count."""
+
+    signature: str
+    count: int
+    mlen: int
+    blen: int
+
+    def __post_init__(self) -> None:
+        if not self.signature:
+            raise ValueError("event signature must be non-empty")
+        if self.count < 0:
+            raise ValueError("event count must be non-negative")
+        if self.mlen <= 0 or self.blen <= 0 or self.mlen % self.blen:
+            raise ValueError("event geometry is invalid")
+
+    def to_dict(self) -> dict[str, int | str]:
+        return {
+            "signature": self.signature,
+            "count": self.count,
+            "MLEN": self.mlen,
+            "BLEN": self.blen,
+        }
+
+
+def _ceil_div(numerator: int, denominator: int) -> int:
+    return (numerator + denominator - 1) // denominator
+
+
+def _projection_events(
+    shape: DenseDecoderShape,
+    *,
+    batch: int,
+    mlen: int,
+    blen: int,
+) -> int:
+    row_tiles = _ceil_div(batch, blen)
+    reduction_tiles = _ceil_div(shape.hidden_size, mlen)
+    query_width = shape.attention_heads * shape.head_dim
+    kv_width = shape.kv_heads * shape.head_dim
+    return row_tiles * reduction_tiles * (
+        _ceil_div(query_width, blen) + 2 * _ceil_div(kv_width, blen)
+    )
+
+
+def _linear_events(
+    shape: DenseDecoderShape,
+    *,
+    batch: int,
+    mlen: int,
+    blen: int,
+) -> tuple[int, int]:
+    rows = _ceil_div(batch, blen)
+    attention_width = shape.attention_heads * shape.head_dim
+    projection = _projection_events(
+        shape,
+        batch=batch,
+        mlen=mlen,
+        blen=blen,
+    )
+    output = (
+        rows
+        * _ceil_div(attention_width, mlen)
+        * _ceil_div(shape.hidden_size, blen)
+    )
+    ffn = rows * (
+        2
+        * _ceil_div(shape.hidden_size, mlen)
+        * _ceil_div(shape.intermediate_size, blen)
+        + _ceil_div(shape.intermediate_size, mlen)
+        * _ceil_div(shape.hidden_size, blen)
+    )
+    decoder = shape.layers * (projection + output + ffn)
+    lm_head = (
+        rows
+        * _ceil_div(shape.hidden_size, mlen)
+        * _ceil_div(shape.vocab_size, blen)
+    )
+    return decoder, lm_head
+
+
+def _attention_events(
+    shape: DenseDecoderShape,
+    *,
+    context: int,
+    batch: int,
+    mlen: int,
+    blen: int,
+    hlen: int,
+) -> tuple[int, int]:
+    if hlen <= 0 or mlen % hlen:
+        raise ValueError("MLEN must be divisible by HLEN")
+    query_group = shape.attention_heads // shape.kv_heads
+    context_tiles = _ceil_div(context, mlen)
+    selected_groups = _ceil_div(query_group, mlen // hlen)
+    common = context_tiles * shape.kv_heads * batch * shape.layers
+    qk = common * selected_groups
+    pv = common * query_group * _ceil_div(shape.head_dim, blen)
+    return qk, pv
+
+
+def _vector_events(
+    shape: DenseDecoderShape,
+    *,
+    context: int,
+    batch: int,
+    mlen: int,
+    include_vocab_selection: bool,
+) -> int:
+    hidden_chunks = _ceil_div(shape.hidden_size, mlen)
+    head_chunks = _ceil_div(shape.head_dim, mlen)
+    intermediate_chunks = _ceil_div(shape.intermediate_size, mlen)
+    vocab_chunks = _ceil_div(shape.vocab_size, mlen)
+    query_group = shape.attention_heads // shape.kv_heads
+    context_tiles = _ceil_div(context, mlen)
+
+    rmsnorm = (2 * shape.layers + 1) * batch * hidden_chunks * 8
+    qk_norm = (
+        shape.layers
+        * batch
+        * (shape.attention_heads + shape.kv_heads)
+        * head_chunks
+        * 8
+    )
+    rope = (
+        shape.layers
+        * batch
+        * (shape.attention_heads + shape.kv_heads)
+        * head_chunks
+    )
+    attention = (
+        shape.layers
+        * batch
+        * shape.kv_heads
+        * query_group
+        * context_tiles
+        * 6
+    )
+    silu_gate = (
+        shape.layers * batch * intermediate_chunks * 6
+    )
+    residual = shape.layers * batch * hidden_chunks * 2
+    vocab_softmax = (
+        batch * vocab_chunks * 6
+        if include_vocab_selection
+        else 0
+    )
+    return (
+        rmsnorm
+        + qk_norm
+        + rope
+        + attention
+        + silu_gate
+        + residual
+        + vocab_softmax
+    )
+
+
+def count_decode_events(
+    shape: DenseDecoderShape,
+    *,
+    input_seq: int,
+    output_seq: int,
+    batch: int,
+    mlen: int,
+    blen: int,
+    hlen: int,
+    linear_signature: str,
+    qk_signature: str,
+    pv_signature: str,
+    vector_signature: str,
+    stride: int = 1,
+    lm_head_signature: str = "UNMODELED:LM_HEAD_BF16",
+    include_output_head: bool = True,
+) -> tuple[DecodeEvent, ...]:
+    """Count the same strided q_len=1 workload used by the timing model."""
+
+    positive = (input_seq, output_seq, batch, mlen, blen, hlen, stride)
+    if any(value <= 0 for value in positive):
+        raise ValueError("workload and geometry values must be positive")
+    if mlen % blen:
+        raise ValueError("MLEN must be divisible by BLEN")
+    signatures = [
+        linear_signature,
+        qk_signature,
+        pv_signature,
+        vector_signature,
+    ]
+    if include_output_head:
+        signatures.append(lm_head_signature)
+    if any(not signature for signature in signatures):
+        raise ValueError("event signatures must be non-empty")
+
+    decoder_linear, lm_head = _linear_events(
+        shape,
+        batch=batch,
+        mlen=mlen,
+        blen=blen,
+    )
+    counts = {
+        linear_signature: 0,
+        qk_signature: 0,
+        pv_signature: 0,
+        vector_signature: 0,
+        SELECTOR_SIGNATURE: 0,
+    }
+    if include_output_head:
+        counts[lm_head_signature] = 0
+    position = 0
+    while position < output_seq:
+        span = min(stride, output_seq - position)
+        context = input_seq + position
+        qk, pv = _attention_events(
+            shape,
+            context=context,
+            batch=batch,
+            mlen=mlen,
+            blen=blen,
+            hlen=hlen,
+        )
+        vector = _vector_events(
+            shape,
+            context=context,
+            batch=batch,
+            mlen=mlen,
+            include_vocab_selection=include_output_head,
+        )
+        counts[linear_signature] += decoder_linear * span
+        if include_output_head:
+            counts[lm_head_signature] += lm_head * span
+        counts[qk_signature] += qk * span
+        counts[pv_signature] += pv * span
+        counts[vector_signature] += vector * span
+        counts[SELECTOR_SIGNATURE] += (qk + pv) * span
+        position += stride
+    return tuple(
+        DecodeEvent(signature, count, mlen, blen)
+        for signature, count in sorted(counts.items())
+        if count
+    )
+
+
+def event_count_total(events: Iterable[DecodeEvent]) -> int:
+    """Return a stable aggregate used by tests and diagnostics."""
+
+    return sum(event.count for event in events)
+
+
+__all__ = [
+    "DecodeEvent",
+    "DenseDecoderShape",
+    "EVENT_MODEL",
+    "SELECTOR_SIGNATURE",
+    "count_decode_events",
+    "event_count_total",
+]
diff --git a/decode_dse/legality.py b/decode_dse/legality.py
new file mode 100644
index 0000000..22061af
--- /dev/null
+++ b/decode_dse/legality.py
@@ -0,0 +1,898 @@
+"""Static legality and cross-stack capability contracts for decode profiles.
+
+Legality answers whether a precision profile can run at all; capability adds
+the PackedKV runtime geometry each implementation layer requires.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from decode_dse.profiles import (
+    ACCUMULATOR_RULE,
+    VECTOR_FORMATS,
+    FIXED_ACCUMULATOR_FRACTION_BITS,
+    FIXED_ACCUMULATOR_INTEGER_BITS,
+    MATRIX_SEMANTICS,
+    MIXED_MATRIX_RULE,
+    MX_BLOCK_SIZE,
+    MXFP_MATRIX_RULE,
+    MXINT_MATRIX_RULE,
+    MX_SCALE_BITS,
+    MX_SCALE_FORMAT,
+    OUTPUT_RULE,
+    PROFILE_KIND_BF16_REFERENCE,
+    DecodePrecisionProfile,
+    format_descriptor,
+)
+
+HARDWARE_MXINT_WEIGHT_FORMATS = ("MXINT4", "MXINT8")
+HARDWARE_MXINT_OPERAND_FORMATS = ("MXINT2", "MXINT4", "MXINT8")
+HARDWARE_MXFP_FORMATS = ("E1M2", "E2M1", "E4M3", "E5M2")
+
+
+@dataclass(frozen=True)
+class StackValidity:
+    """Measured validity is independent for each implementation layer."""
+
+    software_valid: bool | None = None
+    compiler_valid: bool | None = None
+    emulator_valid: bool | None = None
+    rtl_valid: bool | None = None
+    dc_calibrated: bool | None = None
+
+    def __post_init__(self) -> None:
+        for value in self.to_dict().values():
+            _optional_bool(value)
+
+    def to_dict(self) -> dict[str, bool | None]:
+        return {
+            "software_valid": self.software_valid,
+            "compiler_valid": self.compiler_valid,
+            "emulator_valid": self.emulator_valid,
+            "rtl_valid": self.rtl_valid,
+            "dc_calibrated": self.dc_calibrated,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any] | None) -> "StackValidity":
+        data = value or {}
+        return cls(
+            software_valid=_optional_bool(data.get("software_valid")),
+            compiler_valid=_optional_bool(data.get("compiler_valid")),
+            emulator_valid=_optional_bool(data.get("emulator_valid")),
+            rtl_valid=_optional_bool(data.get("rtl_valid")),
+            dc_calibrated=_optional_bool(data.get("dc_calibrated")),
+        )
+
+    def updated(self, **values: bool | None) -> "StackValidity":
+        unknown = set(values) - set(self.to_dict())
+        if unknown:
+            raise ValueError(f"unknown validity fields: {sorted(unknown)}")
+        return replace(self, **values)
+
+
+def _optional_bool(value: Any) -> bool | None:
+    if value is None or isinstance(value, bool):
+        return value
+    raise TypeError(f"validity values must be bool or None, got {value!r}")
+
+
+@dataclass(frozen=True)
+class LegalityIssue:
+    code: str
+    message: str
+    stages: tuple[str, ...]
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "code": self.code,
+            "message": self.message,
+            "stages": list(self.stages),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "LegalityIssue":
+        return cls(
+            code=str(value["code"]),
+            message=str(value["message"]),
+            stages=tuple(str(stage) for stage in value["stages"]),
+        )
+
+
+@dataclass(frozen=True)
+class ProfileLegality:
+    """Static eligibility does not claim that a stack validation has run."""
+
+    software_supported: bool
+    hardware_candidate: bool
+    issues: tuple[LegalityIssue, ...] = ()
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "software_supported": self.software_supported,
+            "hardware_candidate": self.hardware_candidate,
+            "issues": [issue.to_dict() for issue in self.issues],
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ProfileLegality":
+        software_supported = value["software_supported"]
+        hardware_candidate = value["hardware_candidate"]
+        if not isinstance(software_supported, bool) or not isinstance(
+            hardware_candidate, bool
+        ):
+            raise TypeError("legality flags must be booleans")
+        return cls(
+            software_supported=software_supported,
+            hardware_candidate=hardware_candidate,
+            issues=tuple(
+                LegalityIssue.from_dict(issue) for issue in value.get("issues", ())
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class MatrixSemanticsBinding:
+    """Structural arithmetic binding for one matrix operand pair."""
+
+    operation: str
+    left_role: str
+    right_role: str
+    family: str
+    rule: str
+    structurally_supported: bool
+    numerical_trace_conformant: bool | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "operation": self.operation,
+            "left_role": self.left_role,
+            "right_role": self.right_role,
+            "family": self.family,
+            "rule": self.rule,
+            "structurally_supported": self.structurally_supported,
+            "numerical_trace_conformant": self.numerical_trace_conformant,
+        }
+
+
+def matrix_semantics_bindings(
+    profile: DecodePrecisionProfile,
+) -> tuple[MatrixSemanticsBinding, ...]:
+    """Resolve matrix rules without treating structural support as trace evidence."""
+
+    operation_roles = (
+        ("linear", "activation", "weight"),
+        ("qk", "activation", "key"),
+        ("pv", "activation", "value"),
+    )
+    role_formats = {
+        "weight": profile.weight_format,
+        "activation": profile.activation_format,
+        "key": profile.key_format,
+        "value": profile.value_format,
+    }
+    bindings: list[MatrixSemanticsBinding] = []
+    for operation, left_role, right_role in operation_roles:
+        left_family = format_descriptor(role_formats[left_role]).family
+        right_family = format_descriptor(role_formats[right_role]).family
+        if left_family == right_family == "mxint":
+            family = "mxint"
+            rule = MXINT_MATRIX_RULE
+            structurally_supported = True
+        elif left_family == right_family == "mxfp":
+            family = "mxfp"
+            rule = MXFP_MATRIX_RULE
+            structurally_supported = True
+        else:
+            family = "mixed"
+            rule = MIXED_MATRIX_RULE
+            structurally_supported = False
+        bindings.append(
+            MatrixSemanticsBinding(
+                operation=operation,
+                left_role=left_role,
+                right_role=right_role,
+                family=family,
+                rule=rule,
+                structurally_supported=structurally_supported,
+            )
+        )
+    return tuple(bindings)
+
+
+def evaluate_profile_legality(profile: DecodePrecisionProfile) -> ProfileLegality:
+    """Apply the conservative PLENA hardware-candidate policy."""
+
+    issues: list[LegalityIssue] = []
+    if profile.kind == PROFILE_KIND_BF16_REFERENCE:
+        issues.append(
+            LegalityIssue(
+                "reference_only",
+                "The BF16 point is a numerical reference, not a deployment candidate.",
+                ("compiler", "emulator", "rtl", "dc"),
+            )
+        )
+        return ProfileLegality(True, False, tuple(issues))
+
+    if (
+        profile.matrix_semantics != MATRIX_SEMANTICS
+        or profile.accumulator_rule != ACCUMULATOR_RULE
+        or profile.output_rule != OUTPUT_RULE
+    ):
+        issues.append(
+            LegalityIssue(
+                "unsupported_matrix_semantics",
+                "The matrix arithmetic contract does not match the PLENA datapath.",
+                ("compiler", "emulator", "rtl", "dc"),
+            )
+        )
+
+    descriptors = tuple(
+        format_descriptor(token)
+        for token in (
+            profile.weight_format,
+            profile.activation_format,
+            profile.key_format,
+            profile.value_format,
+        )
+    )
+    families = {descriptor.family for descriptor in descriptors}
+    if len(families) != 1:
+        issues.append(
+            LegalityIssue(
+                "mixed_mx_families",
+                "The matrix datapath requires one MX family across W, A, K, and V.",
+                ("compiler", "emulator", "rtl", "dc"),
+            )
+        )
+    elif families == {"mxint"}:
+        if profile.weight_format not in HARDWARE_MXINT_WEIGHT_FORMATS:
+            issues.append(
+                LegalityIssue(
+                    "unsupported_mxint_weight",
+                    f"{profile.weight_format} is numerical-only for decoder weights.",
+                    ("compiler", "emulator", "rtl", "dc"),
+                )
+            )
+        for role, token in (
+            ("activation", profile.activation_format),
+            ("key", profile.key_format),
+            ("value", profile.value_format),
+        ):
+            if token not in HARDWARE_MXINT_OPERAND_FORMATS:
+                issues.append(
+                    LegalityIssue(
+                        "unsupported_mxint_operand",
+                        f"{token} is numerical-only for the {role} operand.",
+                        ("compiler", "emulator", "rtl", "dc"),
+                    )
+                )
+    elif families == {"mxfp"}:
+        for role, token in (
+            ("weight", profile.weight_format),
+            ("activation", profile.activation_format),
+            ("key", profile.key_format),
+            ("value", profile.value_format),
+        ):
+            if token not in HARDWARE_MXFP_FORMATS:
+                issues.append(
+                    LegalityIssue(
+                        "unsupported_mxfp_operand",
+                        f"{token} is numerical-only for the {role} operand.",
+                        ("compiler", "emulator", "rtl", "dc"),
+                    )
+                )
+
+    if profile.block_size != MX_BLOCK_SIZE:
+        issues.append(
+            LegalityIssue(
+                "unsupported_block_size",
+                f"The matrix datapath requires block size {MX_BLOCK_SIZE}.",
+                ("compiler", "emulator", "rtl", "dc"),
+            )
+        )
+    if profile.scale_format != MX_SCALE_FORMAT or profile.scale_bits != MX_SCALE_BITS:
+        issues.append(
+            LegalityIssue(
+                "unsupported_scale",
+                "Quantized hardware profiles require an 8-bit E8M0 scale.",
+                ("compiler", "emulator", "rtl", "dc"),
+            )
+        )
+    return ProfileLegality(True, not issues, tuple(issues))
+
+
+@dataclass(frozen=True)
+class TensorPackingContract:
+    """Physical constraints for one packed element and scale-plane transfer."""
+
+    role: str
+    element_count: int
+    base_address_bytes: int
+    scale_base_address_bytes: int
+    hbm_bus_bits: int
+    hbm_alignment_bytes: int
+    require_full_blocks: bool = True
+
+    def __post_init__(self) -> None:
+        if self.role not in {"weight", "activation", "key", "value"}:
+            raise ValueError(f"unsupported tensor role {self.role!r}")
+        if self.element_count <= 0:
+            raise ValueError("element_count must be positive")
+        if self.base_address_bytes < 0 or self.scale_base_address_bytes < 0:
+            raise ValueError("base addresses must be non-negative")
+        if self.hbm_bus_bits <= 0 or self.hbm_bus_bits % 8:
+            raise ValueError("hbm_bus_bits must be a positive whole-byte width")
+        if self.hbm_alignment_bytes <= 0:
+            raise ValueError("hbm_alignment_bytes must be positive")
+
+
+def _role_format(profile: DecodePrecisionProfile, role: str) -> str:
+    return {
+        "weight": profile.weight_format,
+        "activation": profile.activation_format,
+        "key": profile.key_format,
+        "value": profile.value_format,
+    }[role]
+
+
+def validate_tensor_packing(
+    profile: DecodePrecisionProfile,
+    contract: TensorPackingContract,
+) -> tuple[LegalityIssue, ...]:
+    """Validate block packing, plane sizes, addresses, and HBM bus width."""
+
+    issues: list[LegalityIssue] = []
+    descriptor = format_descriptor(_role_format(profile, contract.role))
+    if descriptor.token == "BF16":
+        block_count = 0
+        scale_bits = 0
+    else:
+        block_count = math.ceil(contract.element_count / profile.block_size)
+        scale_bits = block_count * profile.scale_bits
+        if contract.require_full_blocks and contract.element_count % profile.block_size:
+            issues.append(
+                LegalityIssue(
+                    "partial_mx_block",
+                    f"{contract.role} length is not divisible by block size {profile.block_size}.",
+                    ("compiler", "emulator", "rtl"),
+                )
+            )
+
+    element_bits = descriptor.element_bits * contract.element_count
+    if element_bits % 8 or scale_bits % 8:
+        issues.append(
+            LegalityIssue(
+                "non_byte_aligned_plane",
+                "Element and scale planes must each occupy a whole number of bytes.",
+                ("compiler", "emulator", "rtl"),
+            )
+        )
+    planes = [("element", contract.base_address_bytes)]
+    if scale_bits:
+        planes.append(("scale", contract.scale_base_address_bytes))
+    for plane, address in planes:
+        if address % contract.hbm_alignment_bytes:
+            issues.append(
+                LegalityIssue(
+                    "misaligned_hbm_base",
+                    f"The {contract.role} {plane} plane is not HBM aligned.",
+                    ("compiler", "emulator", "rtl"),
+                )
+            )
+    if contract.hbm_bus_bits < descriptor.element_bits * profile.block_size:
+        issues.append(
+            LegalityIssue(
+                "hbm_bus_too_narrow",
+                f"The HBM bus cannot transfer one {contract.role} MX block per beat.",
+                ("compiler", "emulator", "rtl"),
+            )
+        )
+    return tuple(issues)
+
+
+def required_accumulator_bits(
+    left_format: str,
+    right_format: str,
+    reduction_depth: int,
+) -> int:
+    """Return the required fixed-bank width for one PLENA matrix reduction."""
+
+    if reduction_depth <= 0:
+        raise ValueError("reduction_depth must be positive")
+    left = format_descriptor(left_format)
+    right = format_descriptor(right_format)
+    if left.family != "mxint" or right.family != "mxint":
+        return (
+            FIXED_ACCUMULATOR_INTEGER_BITS
+            + FIXED_ACCUMULATOR_FRACTION_BITS
+        )
+    block_depth = min(reduction_depth, MX_BLOCK_SIZE)
+    widened_mac_bits = (
+        left.element_bits
+        + right.element_bits
+        + math.ceil(math.log2(block_depth))
+    )
+    return max(
+        widened_mac_bits,
+        FIXED_ACCUMULATOR_INTEGER_BITS + FIXED_ACCUMULATOR_FRACTION_BITS,
+    )
+
+
+def validate_accumulator_width(
+    profile: DecodePrecisionProfile,
+    accumulator_bits: int,
+    reduction_depth: int,
+) -> tuple[LegalityIssue, ...]:
+    """Check both W×A and KV×A accumulator width requirements."""
+
+    if accumulator_bits <= 0:
+        raise ValueError("accumulator_bits must be positive")
+    required = max(
+        required_accumulator_bits(
+            profile.weight_format,
+            profile.activation_format,
+            reduction_depth,
+        ),
+        required_accumulator_bits(
+            profile.key_format,
+            profile.activation_format,
+            reduction_depth,
+        ),
+        required_accumulator_bits(
+            profile.value_format,
+            profile.activation_format,
+            reduction_depth,
+        ),
+    )
+    if accumulator_bits >= required:
+        return ()
+    return (
+        LegalityIssue(
+            "accumulator_too_narrow",
+            f"{accumulator_bits}-bit accumulation is below the required {required} bits.",
+            ("compiler", "emulator", "rtl", "dc"),
+        ),
+    )
+
+
+
+CAPABILITY_STAGES = ("software", "compiler", "emulator", "rtl", "dc")
+RTL_MXINT_ACTIVATION_FORMATS = ("MXINT4", "MXINT8")
+
+
+@dataclass(frozen=True)
+class PackedKVRuntimeTarget:
+    """Geometry and ISA fields required by one PackedKV realization."""
+
+    mlen: int = 1024
+    blen: int = 8
+    hlen: int = 128
+    batch: int = 1
+    kv_heads: int = 8
+    head_dim: int = 128
+    block_size: int = 8
+    selector_bits: int = 4
+    packed_kv: bool = True
+    batched_attention: bool = True
+
+    def __post_init__(self) -> None:
+        for name in (
+            "mlen",
+            "blen",
+            "hlen",
+            "batch",
+            "kv_heads",
+            "head_dim",
+            "block_size",
+            "selector_bits",
+        ):
+            if getattr(self, name) <= 0:
+                raise ValueError(f"{name} must be positive")
+
+    def to_dict(self) -> dict[str, int | bool]:
+        return {
+            "mlen": self.mlen,
+            "blen": self.blen,
+            "hlen": self.hlen,
+            "batch": self.batch,
+            "kv_heads": self.kv_heads,
+            "head_dim": self.head_dim,
+            "block_size": self.block_size,
+            "selector_bits": self.selector_bits,
+            "packed_kv": self.packed_kv,
+            "batched_attention": self.batched_attention,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PackedKVRuntimeTarget":
+        return cls(
+            mlen=int(value["mlen"]),
+            blen=int(value.get("blen", 8)),
+            hlen=int(value["hlen"]),
+            batch=int(value.get("batch", 1)),
+            kv_heads=int(value["kv_heads"]),
+            head_dim=int(value["head_dim"]),
+            block_size=int(value["block_size"]),
+            selector_bits=int(value["selector_bits"]),
+            packed_kv=bool(value["packed_kv"]),
+            batched_attention=bool(value["batched_attention"]),
+        )
+
+
+DEFAULT_PACKED_KV_TARGET = PackedKVRuntimeTarget()
+
+
+@dataclass(frozen=True)
+class CrossStackCapability:
+    """Structural support is distinct from completed runtime validation."""
+
+    profile_id: str
+    target: PackedKVRuntimeTarget
+    issues: tuple[LegalityIssue, ...]
+
+    def __post_init__(self) -> None:
+        if not self.profile_id:
+            raise ValueError("profile_id must be non-empty")
+
+    def stage_supported(self, stage: str) -> bool:
+        if stage not in CAPABILITY_STAGES:
+            raise ValueError(f"unknown capability stage {stage!r}")
+        return not any(stage in issue.stages for issue in self.issues)
+
+    @property
+    def stage_support(self) -> dict[str, bool]:
+        return {
+            stage: self.stage_supported(stage)
+            for stage in CAPABILITY_STAGES
+        }
+
+    @property
+    def validity_floor(self) -> StackValidity:
+        support = self.stage_support
+        return StackValidity(
+            software_valid=None if support["software"] else False,
+            compiler_valid=None if support["compiler"] else False,
+            emulator_valid=None if support["emulator"] else False,
+            rtl_valid=None if support["rtl"] else False,
+            dc_calibrated=None if support["dc"] else False,
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "profile_id": self.profile_id,
+            "target": self.target.to_dict(),
+            "stage_support": self.stage_support,
+            "validity_floor": self.validity_floor.to_dict(),
+            "issues": [issue.to_dict() for issue in self.issues],
+        }
+
+
+def _append_issue(
+    issues: list[LegalityIssue],
+    code: str,
+    message: str,
+    stages: tuple[str, ...],
+) -> None:
+    issue = LegalityIssue(code=code, message=message, stages=stages)
+    if issue not in issues:
+        issues.append(issue)
+
+
+def _validate_packed_geometry(
+    profile: DecodePrecisionProfile,
+    target: PackedKVRuntimeTarget,
+    issues: list[LegalityIssue],
+) -> None:
+    runtime_stages = ("compiler", "emulator", "rtl")
+    if profile.block_size != target.block_size:
+        _append_issue(
+            issues,
+            "runtime_block_mismatch",
+            "The runtime MX block size does not match the precision profile.",
+            runtime_stages + ("dc",),
+        )
+    if not target.packed_kv:
+        return
+    if target.mlen % target.block_size or target.head_dim % target.block_size:
+        _append_issue(
+            issues,
+            "packedkv_block_alignment",
+            "PackedKV rows and head groups must contain complete MX blocks.",
+            runtime_stages,
+        )
+    if target.mlen % target.hlen:
+        _append_issue(
+            issues,
+            "packedkv_hlen_tiling",
+            "MLEN must contain an integral number of HLEN groups.",
+            runtime_stages,
+        )
+    if target.head_dim != target.hlen:
+        _append_issue(
+            issues,
+            "packedkv_selector_stride",
+            "The selector stride is HLEN and must equal the KV head dimension.",
+            runtime_stages,
+        )
+    if target.kv_heads * target.head_dim > target.mlen:
+        _append_issue(
+            issues,
+            "packedkv_row_overflow",
+            "The active KV heads do not fit in one packed MLEN row.",
+            runtime_stages,
+        )
+    if target.mlen % target.head_dim:
+        _append_issue(
+            issues,
+            "packedkv_head_slots",
+            "MLEN must contain an integral number of KV head slots.",
+            runtime_stages,
+        )
+    if target.kv_heads > 1 << target.selector_bits:
+        _append_issue(
+            issues,
+            "packedkv_selector_encoding",
+            "The instruction selector field cannot encode every KV head.",
+            runtime_stages,
+        )
+
+
+def evaluate_stack_capability(
+    profile: DecodePrecisionProfile,
+    target: PackedKVRuntimeTarget = DEFAULT_PACKED_KV_TARGET,
+) -> CrossStackCapability:
+    """Return structural capability without claiming any validation passed."""
+
+    issues: list[LegalityIssue] = []
+    legality = evaluate_profile_legality(profile)
+    if not legality.software_supported:
+        _append_issue(
+            issues,
+            "software_profile_unsupported",
+            "The numerical profile is outside the software implementation.",
+            CAPABILITY_STAGES,
+        )
+    if not legality.hardware_candidate:
+        for issue in legality.issues:
+            _append_issue(issues, issue.code, issue.message, issue.stages)
+
+    if profile.vector_format not in VECTOR_FORMATS:
+        _append_issue(
+            issues,
+            "vector_format_unsupported",
+            f"{profile.vector_format} is not a configured vector format.",
+            ("compiler", "emulator", "rtl", "dc"),
+        )
+
+    _validate_packed_geometry(profile, target, issues)
+
+    if profile.kind != PROFILE_KIND_BF16_REFERENCE and legality.hardware_candidate:
+        descriptors = {
+            role: format_descriptor(token)
+            for role, token in (
+                ("weight", profile.weight_format),
+                ("activation", profile.activation_format),
+                ("key", profile.key_format),
+                ("value", profile.value_format),
+            )
+        }
+        if target.packed_kv and target.batched_attention and any(
+            descriptor.family != "mxint"
+            for descriptor in descriptors.values()
+        ):
+            _append_issue(
+                issues,
+                "rtl_batched_mxfp_unsupported",
+                "The packed batched attention selector is implemented only on the MXINT matrix path.",
+                ("rtl",),
+            )
+        if (
+            target.packed_kv
+            and target.batched_attention
+            and all(
+                descriptor.family == "mxint"
+                for descriptor in descriptors.values()
+            )
+            and target.block_size % target.blen != 0
+        ):
+            _append_issue(
+                issues,
+                "rtl_mxint_scale_segment_mismatch",
+                "The MXINT MCU requires BLEN to divide the MX block size.",
+                ("rtl",),
+            )
+        if (
+            all(
+                descriptor.family == "mxint"
+                for descriptor in descriptors.values()
+            )
+            and profile.activation_format not in RTL_MXINT_ACTIVATION_FORMATS
+        ):
+            _append_issue(
+                issues,
+                "rtl_mxint_activation_requant_unvalidated",
+                "The RTL FP-to-MXINT activation path is validated for MXINT4 and MXINT8.",
+                ("rtl",),
+            )
+
+    return CrossStackCapability(
+        profile_id=profile.profile_id,
+        target=target,
+        issues=tuple(issues),
+    )
+
+
+def merge_stack_validity(*values: StackValidity) -> StackValidity:
+    """Merge observations so any unsupported or failed stage remains false."""
+
+    fields = tuple(StackValidity().to_dict())
+    merged: dict[str, bool | None] = {}
+    for field in fields:
+        observations = tuple(getattr(value, field) for value in values)
+        if False in observations:
+            merged[field] = False
+        elif True in observations:
+            merged[field] = True
+        else:
+            merged[field] = None
+    return StackValidity(**merged)
+
+
+def constrain_stack_validity(
+    profile: DecodePrecisionProfile,
+    observed: StackValidity,
+    target: PackedKVRuntimeTarget = DEFAULT_PACKED_KV_TARGET,
+) -> StackValidity:
+    """Apply structural capability as a false-only floor to observations."""
+
+    capability = evaluate_stack_capability(profile, target)
+    return merge_stack_validity(capability.validity_floor, observed)
+
+
+def scope_stack_validity(
+    observed: StackValidity,
+    *,
+    evidence_target: PackedKVRuntimeTarget,
+    runtime_target: PackedKVRuntimeTarget,
+) -> StackValidity:
+    """Retain successful hardware evidence only on its measured target."""
+
+    runtime_fields = (
+        "mlen",
+        "blen",
+        "hlen",
+        "batch",
+        "kv_heads",
+        "head_dim",
+        "block_size",
+        "selector_bits",
+        "packed_kv",
+        "batched_attention",
+    )
+    dc_fields = tuple(field for field in runtime_fields if field != "batch")
+    exact_runtime_match = all(
+        getattr(evidence_target, field) == getattr(runtime_target, field)
+        for field in runtime_fields
+    )
+    compiler_emulator_match = exact_runtime_match
+    dc_match = all(
+        getattr(evidence_target, field) == getattr(runtime_target, field)
+        for field in dc_fields
+    )
+
+    def scoped(value: bool | None, matches: bool) -> bool | None:
+        if value is False:
+            return False
+        if value is True and not matches:
+            return None
+        return value
+
+    return StackValidity(
+        software_valid=observed.software_valid,
+        compiler_valid=scoped(
+            observed.compiler_valid,
+            compiler_emulator_match,
+        ),
+        emulator_valid=scoped(
+            observed.emulator_valid,
+            compiler_emulator_match,
+        ),
+        rtl_valid=scoped(observed.rtl_valid, exact_runtime_match),
+        dc_calibrated=scoped(observed.dc_calibrated, dc_match),
+    )
+
+
+def load_stack_validity(
+    path: str | Path,
+    *,
+    scope_profile_ids: Sequence[str] | None = None,
+    required_stages: Sequence[str] = (),
+    run_plan_hash: str | None = None,
+    manifest: Any | None = None,
+    scope_name: str = "stack-validity",
+) -> dict[str, StackValidity]:
+    """Load measured per-profile validity and enforce the required stages.
+
+    The file records one validity object per profile plus the run-plan and
+    manifest hashes it was measured under; a hash mismatch means the
+    measurements describe a different sweep and must not be reused. When a
+    manifest is supplied it must expose ``canonical_hash``.
+    """
+
+    document = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(document, Mapping):
+        raise TypeError(f"{scope_name} file must contain a JSON object")
+    recorded_hash = document.get("run_plan_hash")
+    if run_plan_hash is not None and recorded_hash != run_plan_hash:
+        raise ValueError(f"{scope_name} was measured under a different run plan")
+    if manifest is not None:
+        recorded_manifest_hash = document.get("manifest_hash")
+        if recorded_manifest_hash != manifest.canonical_hash:
+            raise ValueError(
+                f"{scope_name} was measured under a different sweep manifest"
+            )
+    records = document.get("profiles", document)
+    if not isinstance(records, Mapping):
+        raise TypeError(f"{scope_name} profiles must be a JSON object")
+
+    validity = {
+        str(profile_id): StackValidity.from_dict(record)
+        for profile_id, record in records.items()
+    }
+    if scope_profile_ids is not None:
+        scope = set(scope_profile_ids)
+        unknown = sorted(set(validity) - scope)
+        if unknown:
+            raise ValueError(
+                f"{scope_name} covers {len(unknown)} profiles outside its scope"
+            )
+        validity = {key: value for key, value in validity.items() if key in scope}
+
+    unsupported = sorted(set(required_stages) - set(CAPABILITY_STAGES))
+    if unsupported:
+        raise ValueError(f"unknown validity stages: {unsupported}")
+    for profile_id, measured in sorted(validity.items()):
+        for stage in required_stages:
+            if getattr(measured, f"{stage}_valid") is not True:
+                raise ValueError(
+                    f"{scope_name} profile {profile_id} has no passing {stage} stage"
+                )
+    return validity
+
+
+# Retained call-site name for the sweep and executor entry points.
+load_built_stack_validity = load_stack_validity
+
+
+__all__ = [
+    "CAPABILITY_STAGES",
+    "DEFAULT_PACKED_KV_TARGET",
+    "HARDWARE_MXFP_FORMATS",
+    "HARDWARE_MXINT_OPERAND_FORMATS",
+    "HARDWARE_MXINT_WEIGHT_FORMATS",
+    "RTL_MXINT_ACTIVATION_FORMATS",
+    "CrossStackCapability",
+    "LegalityIssue",
+    "MatrixSemanticsBinding",
+    "PackedKVRuntimeTarget",
+    "ProfileLegality",
+    "StackValidity",
+    "TensorPackingContract",
+    "constrain_stack_validity",
+    "evaluate_profile_legality",
+    "evaluate_stack_capability",
+    "load_built_stack_validity",
+    "load_stack_validity",
+    "matrix_semantics_bindings",
+    "merge_stack_validity",
+    "required_accumulator_bits",
+    "scope_stack_validity",
+    "validate_accumulator_width",
+    "validate_tensor_packing",
+]
diff --git a/decode_dse/manifest.py b/decode_dse/manifest.py
new file mode 100644
index 0000000..b175bc6
--- /dev/null
+++ b/decode_dse/manifest.py
@@ -0,0 +1,820 @@
+"""Deterministic manifests and restartable status journals for decode sweeps."""
+
+from __future__ import annotations
+
+import argparse
+import fcntl
+import hashlib
+import json
+import os
+import re
+import tempfile
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Iterable, Mapping
+
+from decode_dse.legality import (
+    constrain_stack_validity,
+    evaluate_stack_capability,
+)
+from decode_dse.legality import (
+    ProfileLegality,
+    StackValidity,
+    evaluate_profile_legality,
+)
+from decode_dse.profiles import (
+    PROFILE_KIND_BF16_REFERENCE,
+    PROFILE_KIND_QUANTIZED,
+    PROFILE_KIND_VECTOR_BF16_CONTROL,
+    DecodePrecisionProfile,
+    enumerate_decode_profiles,
+)
+
+MANIFEST_SCHEMA = "decode-sweep-manifest"
+STATUS_SCHEMA = "decode-sweep-status"
+EXPECTED_QUANTIZED_PROFILES = 3072
+EXPECTED_VECTOR_CONTROLS = 512
+EXPECTED_BF16_REFERENCES = 1
+EXPECTED_TOTAL_PROFILES = 3585
+STATUS_STATES = ("pending", "running", "succeeded", "failed")
+_IMMUTABLE_REVISION_RE = re.compile(r"^[0-9a-f]{40,64}$")
+_SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
+
+
+def _canonical_json(value: Mapping[str, Any]) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
+
+
+@dataclass(frozen=True)
+class QuantizerSource:
+    """One source file whose exact bytes can affect decode arithmetic."""
+
+    component: str
+    path: str
+    sha256: str
+
+    def __post_init__(self) -> None:
+        if not self.component or not self.path:
+            raise ValueError("quantizer sources require component and path")
+        if Path(self.path).is_absolute() or ".." in Path(self.path).parts:
+            raise ValueError("quantizer source paths must be workspace-relative")
+        if not _SHA256_RE.fullmatch(self.sha256):
+            raise ValueError("quantizer source hashes must be lowercase SHA-256")
+
+    def to_dict(self) -> dict[str, str]:
+        return {
+            "component": self.component,
+            "path": self.path,
+            "sha256": self.sha256,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "QuantizerSource":
+        return cls(
+            component=str(value["component"]),
+            path=str(value["path"]),
+            sha256=str(value["sha256"]),
+        )
+
+
+@dataclass(frozen=True)
+class ResolvedImportOrigin:
+    """Resolved source origin for a numerically significant import."""
+
+    module: str
+    path: str
+
+    def __post_init__(self) -> None:
+        if not self.module or not self.path:
+            raise ValueError("resolved imports require module and path")
+        if Path(self.path).is_absolute() or ".." in Path(self.path).parts:
+            raise ValueError("resolved import paths must be workspace-relative")
+
+    def to_dict(self) -> dict[str, str]:
+        return {"module": self.module, "path": self.path}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ResolvedImportOrigin":
+        return cls(module=str(value["module"]), path=str(value["path"]))
+
+
+@dataclass(frozen=True)
+class QuantizerProvenance:
+    """Ordered, content-addressed identity of the sweep's arithmetic stack."""
+
+    sources: tuple[QuantizerSource, ...]
+    resolved_imports: tuple[ResolvedImportOrigin, ...]
+    schema_version: str = "decode-quantizer-provenance"
+
+    def __post_init__(self) -> None:
+        if self.schema_version != "decode-quantizer-provenance":
+            raise ValueError("unsupported quantizer-provenance schema")
+        if not self.sources or not self.resolved_imports:
+            raise ValueError("quantizer provenance must identify sources and imports")
+        source_keys = tuple((item.component, item.path) for item in self.sources)
+        if source_keys != tuple(sorted(source_keys)) or len(source_keys) != len(
+            set(source_keys)
+        ):
+            raise ValueError("quantizer sources must be unique and canonically ordered")
+        import_keys = tuple((item.module, item.path) for item in self.resolved_imports)
+        if import_keys != tuple(sorted(import_keys)) or len(import_keys) != len(
+            set(import_keys)
+        ):
+            raise ValueError("resolved imports must be unique and canonically ordered")
+        origins = {item.module: item.path for item in self.resolved_imports}
+        mxint_origin = origins.get("chop.nn.quantizers.mxint.fake", "")
+        if not mxint_origin.endswith("/chop/nn/quantizers/mxint/fake.py"):
+            raise ValueError(
+                "decode MXINT must resolve to chop.nn.quantizers.mxint.fake"
+            )
+        if "mxint_hardware.py" in mxint_origin:
+            raise ValueError(
+                "decode MXINT resolved to the incompatible hardware helper"
+            )
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "sources": [source.to_dict() for source in self.sources],
+            "resolved_imports": [origin.to_dict() for origin in self.resolved_imports],
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return hashlib.sha256(
+            _canonical_json(self._content_dict()).encode("utf-8")
+        ).hexdigest()
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"quantizer_provenance_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "QuantizerProvenance":
+        provenance = cls(
+            schema_version=str(value["schema_version"]),
+            sources=tuple(
+                QuantizerSource.from_dict(source) for source in value["sources"]
+            ),
+            resolved_imports=tuple(
+                ResolvedImportOrigin.from_dict(origin)
+                for origin in value["resolved_imports"]
+            ),
+        )
+        if value.get("quantizer_provenance_hash") != provenance.canonical_hash:
+            raise ValueError("quantizer-provenance content hash mismatch")
+        return provenance
+
+
+@dataclass(frozen=True)
+class SweepManifestEntry:
+    ordinal: int
+    profile: DecodePrecisionProfile
+    legality: ProfileLegality
+    validity: StackValidity = StackValidity()
+
+    def __post_init__(self) -> None:
+        if self.ordinal < 0:
+            raise ValueError("manifest ordinals must be non-negative")
+        object.__setattr__(
+            self,
+            "validity",
+            constrain_stack_validity(self.profile, self.validity),
+        )
+
+    @property
+    def profile_id(self) -> str:
+        return self.profile.profile_id
+
+    def to_dict(self) -> dict[str, Any]:
+        capability = evaluate_stack_capability(self.profile)
+        return {
+            "ordinal": self.ordinal,
+            "profile_id": self.profile_id,
+            "profile": self.profile.to_dict(),
+            "legality": self.legality.to_dict(),
+            "capability": capability.to_dict(),
+            **self.validity.to_dict(),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "SweepManifestEntry":
+        profile = DecodePrecisionProfile.from_dict(value["profile"])
+        if value["profile_id"] != profile.profile_id:
+            raise ValueError(f"profile hash mismatch at ordinal {value['ordinal']}")
+        legality = ProfileLegality.from_dict(value["legality"])
+        if legality != evaluate_profile_legality(profile):
+            raise ValueError(f"legality mismatch at ordinal {value['ordinal']}")
+        capability = evaluate_stack_capability(profile)
+        stored_capability = value.get("capability")
+        if stored_capability is not None and stored_capability != capability.to_dict():
+            raise ValueError(f"capability mismatch at ordinal {value['ordinal']}")
+        return cls(
+            ordinal=int(value["ordinal"]),
+            profile=profile,
+            legality=legality,
+            validity=StackValidity.from_dict(value),
+        )
+
+
+@dataclass(frozen=True)
+class SweepManifest:
+    model_name: str
+    model_revision: str
+    model_architecture: Mapping[str, Any]
+    entries: tuple[SweepManifestEntry, ...]
+    quantizer_provenance: QuantizerProvenance
+    tokenizer_revision: str | None = None
+    schema_version: str = MANIFEST_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != MANIFEST_SCHEMA:
+            raise ValueError(f"unsupported manifest schema {self.schema_version!r}")
+        if not self.model_name:
+            raise ValueError("model_name must be non-empty")
+        if not self.model_revision:
+            raise ValueError("model_revision must be pinned")
+        architecture = dict(self.model_architecture)
+        required_architecture = {
+            "hidden_size",
+            "intermediate_size",
+            "num_hidden_layers",
+            "num_attention_heads",
+            "num_key_value_heads",
+            "head_dim",
+            "vocab_size",
+            "tie_word_embeddings",
+            "attention_bias",
+            "use_qk_norm",
+        }
+        if set(architecture) != required_architecture:
+            raise ValueError("manifest model architecture is incomplete")
+        object.__setattr__(
+            self,
+            "model_architecture",
+            {key: architecture[key] for key in sorted(architecture)},
+        )
+        if self.tokenizer_revision is None:
+            object.__setattr__(self, "tokenizer_revision", self.model_revision)
+        if not self.tokenizer_revision:
+            raise ValueError("tokenizer_revision must be pinned")
+        ordinals = tuple(entry.ordinal for entry in self.entries)
+        if ordinals != tuple(range(len(self.entries))):
+            raise ValueError("manifest ordinals must be contiguous and ordered")
+        profile_ids = tuple(entry.profile_id for entry in self.entries)
+        if len(profile_ids) != len(set(profile_ids)):
+            raise ValueError("manifest contains duplicate profile IDs")
+
+    @property
+    def counts(self) -> dict[str, int]:
+        counts = {
+            PROFILE_KIND_QUANTIZED: 0,
+            PROFILE_KIND_VECTOR_BF16_CONTROL: 0,
+            PROFILE_KIND_BF16_REFERENCE: 0,
+            "total": len(self.entries),
+        }
+        for entry in self.entries:
+            counts[entry.profile.kind] += 1
+        return counts
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "model_architecture": dict(self.model_architecture),
+            "tokenizer_revision": self.tokenizer_revision,
+            "quantizer_provenance": self.quantizer_provenance.to_dict(),
+            "counts": self.counts,
+            "entries": [entry.to_dict() for entry in self.entries],
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        content = _canonical_json(self._content_dict()).encode("utf-8")
+        return hashlib.sha256(content).hexdigest()
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self._content_dict(),
+            "manifest_hash": self.canonical_hash,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "SweepManifest":
+        tokenizer_revision = value.get("tokenizer_revision") or value["model_revision"]
+        manifest = cls(
+            schema_version=str(value["schema_version"]),
+            model_name=str(value["model_name"]),
+            model_revision=str(value["model_revision"]),
+            model_architecture=dict(value["model_architecture"]),
+            tokenizer_revision=str(tokenizer_revision),
+            quantizer_provenance=QuantizerProvenance.from_dict(
+                value["quantizer_provenance"]
+            ),
+            entries=tuple(
+                SweepManifestEntry.from_dict(entry) for entry in value["entries"]
+            ),
+        )
+        expected_counts = value.get("counts")
+        if expected_counts is not None and dict(expected_counts) != manifest.counts:
+            raise ValueError("manifest count metadata does not match its entries")
+        expected_hash = value.get("manifest_hash")
+        if expected_hash is not None and expected_hash != manifest.canonical_hash:
+            raise ValueError("manifest content hash mismatch")
+        return manifest
+
+
+def build_exhaustive_manifest(
+    model_name: str,
+    model_revision: str,
+    model_architecture: Mapping[str, Any],
+    quantizer_provenance: QuantizerProvenance,
+    tokenizer_revision: str | None = None,
+) -> SweepManifest:
+    """Build the exact quantized, vector-control, and BF16 reference schedule."""
+
+    profiles = enumerate_decode_profiles()
+    entries = tuple(
+        SweepManifestEntry(
+            ordinal=ordinal,
+            profile=profile,
+            legality=evaluate_profile_legality(profile),
+        )
+        for ordinal, profile in enumerate(profiles)
+    )
+    manifest = SweepManifest(
+        model_name=model_name,
+        model_revision=model_revision,
+        model_architecture=model_architecture,
+        tokenizer_revision=tokenizer_revision,
+        quantizer_provenance=quantizer_provenance,
+        entries=entries,
+    )
+    expected = {
+        "quantized": EXPECTED_QUANTIZED_PROFILES,
+        "vector_bf16_control": EXPECTED_VECTOR_CONTROLS,
+        "bf16_reference": EXPECTED_BF16_REFERENCES,
+        "total": EXPECTED_TOTAL_PROFILES,
+    }
+    if manifest.counts != expected:
+        raise AssertionError(
+            f"unexpected exhaustive manifest counts: {manifest.counts}"
+        )
+    return manifest
+
+
+def write_manifest(path: str | os.PathLike[str], manifest: SweepManifest) -> Path:
+    """Atomically create an immutable manifest or verify an identical one."""
+
+    destination = Path(path)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    if destination.exists():
+        existing = load_manifest(destination)
+        if existing.canonical_hash != manifest.canonical_hash:
+            raise FileExistsError(
+                f"refusing to replace a different manifest: {destination}"
+            )
+        return destination
+
+    payload = json.dumps(manifest.to_dict(), indent=2, sort_keys=True) + "\n"
+    temporary_name: str | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            dir=destination.parent,
+            prefix=f".{destination.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as temporary:
+            temporary_name = temporary.name
+            temporary.write(payload)
+            temporary.flush()
+            os.fsync(temporary.fileno())
+        os.chmod(temporary_name, 0o644)
+        os.replace(temporary_name, destination)
+    finally:
+        if temporary_name and os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return destination
+
+
+def load_manifest(path: str | os.PathLike[str]) -> SweepManifest:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    return SweepManifest.from_dict(value)
+
+
+@dataclass(frozen=True)
+class StatusRecord:
+    profile_id: str
+    state: str
+    attempt: int
+    updated_at: str
+    validity: StackValidity = StackValidity()
+    error_class: str | None = None
+    error_message: str | None = None
+    result_path: str | None = None
+    schema_version: str = STATUS_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != STATUS_SCHEMA:
+            raise ValueError(f"unsupported status schema {self.schema_version!r}")
+        if not self.profile_id:
+            raise ValueError("profile_id must be non-empty")
+        if self.state not in STATUS_STATES:
+            raise ValueError(f"unsupported status state {self.state!r}")
+        if self.attempt < 0:
+            raise ValueError("attempt must be non-negative")
+        if self.state in {"running", "succeeded", "failed"} and self.attempt < 1:
+            raise ValueError(f"{self.state} records require a positive attempt")
+        if self.state == "failed" and not self.error_message:
+            raise ValueError("failed records require an error message")
+        if self.state != "failed" and (self.error_class or self.error_message):
+            raise ValueError("only failed records may carry error details")
+
+    @classmethod
+    def create(
+        cls,
+        profile_id: str,
+        state: str,
+        attempt: int,
+        *,
+        validity: StackValidity | None = None,
+        error_class: str | None = None,
+        error_message: str | None = None,
+        result_path: str | None = None,
+    ) -> "StatusRecord":
+        timestamp = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+        return cls(
+            profile_id=profile_id,
+            state=state,
+            attempt=attempt,
+            updated_at=timestamp,
+            validity=validity or StackValidity(),
+            error_class=error_class,
+            error_message=error_message,
+            result_path=result_path,
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "profile_id": self.profile_id,
+            "state": self.state,
+            "attempt": self.attempt,
+            "updated_at": self.updated_at,
+            **self.validity.to_dict(),
+            "error_class": self.error_class,
+            "error_message": self.error_message,
+            "result_path": self.result_path,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "StatusRecord":
+        return cls(
+            schema_version=str(value["schema_version"]),
+            profile_id=str(value["profile_id"]),
+            state=str(value["state"]),
+            attempt=int(value["attempt"]),
+            updated_at=str(value["updated_at"]),
+            validity=StackValidity.from_dict(value),
+            error_class=value.get("error_class"),
+            error_message=value.get("error_message"),
+            result_path=value.get("result_path"),
+        )
+
+
+class StatusJournal:
+    """Append-only status storage with deterministic resume selection."""
+
+    def __init__(
+        self,
+        path: str | os.PathLike[str],
+        manifest: SweepManifest,
+    ) -> None:
+        self.path = Path(path)
+        self.manifest = manifest
+        self._profile_ids = frozenset(entry.profile_id for entry in manifest.entries)
+
+    def append(self, record: StatusRecord) -> None:
+        if record.profile_id not in self._profile_ids:
+            raise ValueError(
+                f"status references an unknown profile: {record.profile_id}"
+            )
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        payload = (_canonical_json(record.to_dict()) + "\n").encode("utf-8")
+        descriptor = os.open(
+            self.path,
+            os.O_APPEND | os.O_CREAT | os.O_RDWR,
+            0o644,
+        )
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            end = os.lseek(descriptor, 0, os.SEEK_END)
+            if end and os.pread(descriptor, 1, end - 1) != b"\n":
+                cursor = end
+                last_newline = -1
+                while cursor and last_newline < 0:
+                    start = max(0, cursor - 65536)
+                    chunk = os.pread(descriptor, cursor - start, start)
+                    offset = chunk.rfind(b"\n")
+                    if offset >= 0:
+                        last_newline = start + offset
+                    cursor = start
+                os.ftruncate(
+                    descriptor,
+                    0 if last_newline < 0 else last_newline + 1,
+                )
+            written = os.write(descriptor, payload)
+            if written != len(payload):
+                raise OSError("incomplete status journal append")
+            os.fsync(descriptor)
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def records(self) -> tuple[StatusRecord, ...]:
+        if not self.path.exists():
+            return ()
+        payload = self.path.read_bytes()
+        lines = payload.splitlines(keepends=True)
+        records: list[StatusRecord] = []
+        for index, line in enumerate(lines):
+            if not line.endswith(b"\n"):
+                if index == len(lines) - 1:
+                    break
+                raise ValueError(f"incomplete journal record at line {index + 1}")
+            value = json.loads(line)
+            record = StatusRecord.from_dict(value)
+            if record.profile_id not in self._profile_ids:
+                raise ValueError(
+                    f"journal references an unknown profile at line {index + 1}"
+                )
+            records.append(record)
+        return tuple(records)
+
+    def latest(self) -> dict[str, StatusRecord]:
+        latest: dict[str, StatusRecord] = {}
+        for record in self.records():
+            previous = latest.get(record.profile_id)
+            if previous is not None and record.attempt < previous.attempt:
+                raise ValueError(
+                    f"attempt counter moved backward for {record.profile_id}"
+                )
+            latest[record.profile_id] = record
+        return latest
+
+    def next_entries(
+        self,
+        *,
+        max_attempts: int = 3,
+        limit: int | None = None,
+    ) -> tuple[SweepManifestEntry, ...]:
+        if max_attempts < 1:
+            raise ValueError("max_attempts must be positive")
+        if limit is not None and limit < 0:
+            raise ValueError("limit must be non-negative")
+        if limit == 0:
+            return ()
+        latest = self.latest()
+        pending: list[SweepManifestEntry] = []
+        for entry in self.manifest.entries:
+            record = latest.get(entry.profile_id)
+            if record is not None and (
+                record.state == "succeeded" or record.attempt >= max_attempts
+            ):
+                continue
+            pending.append(entry)
+            if limit is not None and len(pending) >= limit:
+                break
+        return tuple(pending)
+
+    def begin(self, profile_id: str) -> StatusRecord:
+        previous = self.latest().get(profile_id)
+        if previous is not None and previous.state == "succeeded":
+            raise ValueError(f"profile already succeeded: {profile_id}")
+        attempt = 1 if previous is None else previous.attempt + 1
+        record = StatusRecord.create(profile_id, "running", attempt)
+        self.append(record)
+        return record
+
+    def complete(
+        self,
+        profile_id: str,
+        *,
+        validity: StackValidity,
+        result_path: str,
+    ) -> StatusRecord:
+        previous = self.latest().get(profile_id)
+        if previous is None or previous.state != "running":
+            raise ValueError(f"profile is not running: {profile_id}")
+        record = StatusRecord.create(
+            profile_id,
+            "succeeded",
+            previous.attempt,
+            validity=validity,
+            result_path=result_path,
+        )
+        self.append(record)
+        return record
+
+    def fail(
+        self,
+        profile_id: str,
+        *,
+        error: BaseException | str,
+        validity: StackValidity | None = None,
+    ) -> StatusRecord:
+        previous = self.latest().get(profile_id)
+        if previous is None or previous.state != "running":
+            raise ValueError(f"profile is not running: {profile_id}")
+        if isinstance(error, BaseException):
+            error_class = type(error).__name__
+            error_message = str(error)
+        else:
+            error_class = "Error"
+            error_message = str(error)
+        record = StatusRecord.create(
+            profile_id,
+            "failed",
+            previous.attempt,
+            validity=validity,
+            error_class=error_class,
+            error_message=error_message or error_class,
+        )
+        self.append(record)
+        return record
+
+
+def _load_config(path: str | os.PathLike[str]) -> dict[str, Any]:
+    return json.loads(Path(path).read_text(encoding="utf-8"))
+
+
+def validate_sweep_config(config: Mapping[str, Any]) -> None:
+    """Reject configuration drift from the canonical exhaustive schedule."""
+
+    from decode_dse.profiles import DECODE_FORMATS, VECTOR_FP_FORMATS
+
+    search = config.get("search", {})
+    expected: tuple[tuple[str, Any, Any], ...] = (
+        ("search.weight_w", tuple(search.get("weight_w", ())), DECODE_FORMATS),
+        ("search.act_w", tuple(search.get("act_w", ())), DECODE_FORMATS),
+        ("search.kv", tuple(search.get("kv", ())), DECODE_FORMATS),
+        ("search.vector_fp", tuple(search.get("vector_fp", ())), VECTOR_FP_FORMATS),
+        ("search.block", tuple(search.get("block", ())), (8,)),
+        ("search.mixed_weight", search.get("mixed_weight"), False),
+        (
+            "search.include_vector_bf16_controls",
+            search.get("include_vector_bf16_controls"),
+            True,
+        ),
+        ("search.include_bf16_reference", search.get("include_bf16_reference"), True),
+        (
+            "search.expected_quantized_profiles",
+            search.get("expected_quantized_profiles"),
+            EXPECTED_QUANTIZED_PROFILES,
+        ),
+        (
+            "search.expected_vector_bf16_controls",
+            search.get("expected_vector_bf16_controls"),
+            EXPECTED_VECTOR_CONTROLS,
+        ),
+        (
+            "search.expected_total_profiles",
+            search.get("expected_total_profiles"),
+            EXPECTED_TOTAL_PROFILES,
+        ),
+        ("software_search", config.get("software_search"), "deterministic_exhaustive"),
+        ("search_budget", config.get("search_budget"), EXPECTED_TOTAL_PROFILES),
+        ("sampler", config.get("sampler"), "deterministic_grid"),
+        ("use_rotation", config.get("use_rotation"), False),
+    )
+    mismatches = [
+        f"{name}: expected {required!r}, got {actual!r}"
+        for name, actual, required in expected
+        if actual != required
+    ]
+    fp_pairs = tuple(tuple(value) for value in search.get("front_fp_setting", ()))
+    required_pairs = tuple(
+        (
+            int(token.removeprefix("FP_E").split("M")[0]),
+            int(token.split("M")[1]),
+        )
+        for token in VECTOR_FP_FORMATS
+    )
+    if fp_pairs != required_pairs:
+        mismatches.append(
+            f"search.front_fp_setting: expected {required_pairs!r}, got {fp_pairs!r}"
+        )
+    required_gpu_baseline = {
+        "attention_implementation": "sdpa",
+        "warmup_steps": 16,
+        "measured_steps": 128,
+        "repetitions": 3,
+        "batch_sizes": [1, 2, 4, 8, 16, 32],
+        "precision": "BF16",
+        "q_len": 1,
+        "first_gpu_only": True,
+        "energy_meter_priority": [
+            "nvml_total_energy_counter",
+            "nvml_power_trace_trapezoidal",
+        ],
+        "power_trace_sample_interval_ms": 10,
+    }
+    gpu_baseline = config.get("gpu_baseline")
+    if not isinstance(gpu_baseline, Mapping):
+        mismatches.append("gpu_baseline must be an explicit object")
+    else:
+        actual_fields = set(gpu_baseline)
+        required_fields = set(required_gpu_baseline)
+        if actual_fields != required_fields:
+            mismatches.append(
+                "gpu_baseline fields: expected "
+                f"{sorted(required_fields)!r}, got {sorted(actual_fields)!r}"
+            )
+        for name, required in required_gpu_baseline.items():
+            actual = gpu_baseline.get(name)
+            if type(actual) is not type(required) or actual != required:
+                mismatches.append(
+                    f"gpu_baseline.{name}: expected {required!r}, got {actual!r}"
+                )
+    revision_fields = (
+        ("model_revision", config.get("model_revision")),
+        ("tokenizer_revision", config.get("tokenizer_revision")),
+        (
+            "evaluation_data.dataset_revision",
+            (
+                config.get("evaluation_data", {}).get("dataset_revision")
+                if isinstance(config.get("evaluation_data"), Mapping)
+                else None
+            ),
+        ),
+    )
+    for name, revision in revision_fields:
+        if not isinstance(revision, str) or not _IMMUTABLE_REVISION_RE.fullmatch(
+            revision
+        ):
+            mismatches.append(
+                f"{name} must be an immutable 40-64 digit hexadecimal revision"
+            )
+    if mismatches:
+        raise ValueError(
+            "invalid exhaustive sweep configuration:\n" + "\n".join(mismatches)
+        )
+
+
+def main(argv: Iterable[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--output", required=True)
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    config = _load_config(args.config)
+    validate_sweep_config(config)
+    from decode_dse.software.sweep_plan import build_quantizer_provenance
+
+    repository = Path(__file__).resolve().parents[1]
+    manifest = build_exhaustive_manifest(
+        str(config["model_name"]),
+        str(config["model_revision"]),
+        dict(config["model_architecture"]),
+        build_quantizer_provenance(repository, config),
+        str(config["tokenizer_revision"]),
+    )
+    output = write_manifest(args.output, manifest)
+    print(
+        json.dumps(
+            {
+                "path": str(output),
+                "manifest_hash": manifest.canonical_hash,
+                "counts": manifest.counts,
+            },
+            sort_keys=True,
+        )
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+
+
+__all__ = [
+    "EXPECTED_BF16_REFERENCES",
+    "EXPECTED_QUANTIZED_PROFILES",
+    "EXPECTED_TOTAL_PROFILES",
+    "EXPECTED_VECTOR_CONTROLS",
+    "MANIFEST_SCHEMA",
+    "QuantizerProvenance",
+    "QuantizerSource",
+    "ResolvedImportOrigin",
+    "STATUS_SCHEMA",
+    "StatusJournal",
+    "StatusRecord",
+    "SweepManifest",
+    "SweepManifestEntry",
+    "build_exhaustive_manifest",
+    "load_manifest",
+    "validate_sweep_config",
+    "write_manifest",
+]
diff --git a/decode_dse/plots.py b/decode_dse/plots.py
new file mode 100644
index 0000000..13a2612
--- /dev/null
+++ b/decode_dse/plots.py
@@ -0,0 +1,3171 @@
+"""Render checksum-verified publication figures from decode artifacts."""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import hashlib
+import json
+import math
+import os
+import sys
+import tempfile
+from collections import Counter
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+
+import matplotlib
+
+matplotlib.use("Agg")
+import matplotlib.pyplot as plt  # noqa: E402
+import numpy as np  # noqa: E402
+from matplotlib.colors import SymLogNorm  # noqa: E402
+from matplotlib.lines import Line2D  # noqa: E402
+
+from decode_dse.hardware.evaluation import (  # noqa: E402
+    load_terminal_numerical_rows,
+)
+from decode_dse.hardware.design_space import load_hardware_artifact  # noqa: E402
+from decode_dse.hardware.packedkv_claims import (  # noqa: E402
+    PACKEDKV_MODES,
+    PRECISION_ROLES,
+    evaluate_packedkv_publication,
+    load_packedkv_evidence,
+)
+from decode_dse.manifest import load_manifest  # noqa: E402
+from decode_dse.profiles import (  # noqa: E402
+    DECODE_FORMATS,
+    PROFILE_KIND_BF16_REFERENCE,
+    PROFILE_KIND_QUANTIZED,
+    PROFILE_KIND_VECTOR_BF16_CONTROL,
+    VECTOR_FORMATS,
+    DecodePrecisionProfile,
+)
+from decode_dse.software.sweep_plan import load_immutable_json  # noqa: E402
+
+INK = "#1A1A1A"
+MUTED = "#666666"
+GRID = "#D9D9D9"
+SURFACE = "#FFFFFF"
+BLUE = "#0072B2"
+ORANGE = "#E69F00"
+GREEN = "#009E73"
+RED = "#D55E00"
+PURPLE = "#CC79A7"
+SKY = "#56B4E9"
+YELLOW = "#F0E442"
+GREY = "#8A8A8A"
+FAMILY_COLOURS = {"mxint": BLUE, "mxfp": ORANGE, "bf16": GREY}
+MODE_COLOURS = (GREY, SKY, BLUE, GREEN)
+FIGURE_SCHEMA = "decode-publication-figures"
+FINAL_PUBLICATION_SELECTION_SCHEMA = "decode-final-publication-selection"
+RESULTS_PROVENANCE_SCHEMA = "decode-sweep-results-provenance"
+ANALYSIS_SCHEMA = "decode-publication-analysis"
+PORTABLE_WORKSPACE_PROVENANCE = "workspace_provenance.json"
+FIGURE_DPI = 600
+
+
+@dataclass(frozen=True)
+class NumericalPoint:
+    ordinal: int
+    profile: DecodePrecisionProfile
+    mean_nll: float
+    runtime_seconds: float
+
+    @property
+    def profile_id(self) -> str:
+        return self.profile.profile_id
+
+
+@dataclass(frozen=True)
+class HardwarePoint:
+    profile: DecodePrecisionProfile
+    candidate_id: str
+    delta_nll: float
+    relative_perplexity_percent: float
+    tpot_ms: float
+    tps: float
+    energy_j: float
+    area_mm2: float
+    max_runtime_batch: int
+    chip_count: int = 1
+    tp: int = 1
+    kvp: int = 1
+    energy_tier: str | None = None
+    area_budget_mm2: float | None = None
+    retention_labels: tuple[str, ...] = ("legacy_full_row",)
+    sample_seed: str | None = None
+    sample_limit: int | None = None
+    scatter_population_count: int | None = None
+    dominated_population_count: int | None = None
+
+    @property
+    def tokens_per_j(self) -> float:
+        return 1.0 / self.energy_j
+
+    @property
+    def edp_j_s(self) -> float:
+        return self.energy_j * self.tpot_ms / 1_000.0
+
+
+def _load_selected_publication_rows(
+    *,
+    config_path: Path,
+    manifest: Any,
+    gpu_baseline_report_path: Path,
+    gpu_baseline_receipt_path: Path,
+    publication_contract_path: Path,
+    publication_report_path: Path,
+    final_selection_path: Path,
+    refined_hardware_artifact_path: Path,
+) -> tuple[tuple[dict[str, Any], ...], dict[str, Any]]:
+    """Validate and join the measured GPU baseline to the final exact row."""
+
+    from decode_dse.hardware.design_space import HARDWARE_STORAGE_REVISION
+    from decode_dse.software.benchmark_runner import (
+        PUBLICATION_REPORT_SCHEMA,
+        PublicationContract,
+    )
+    from decode_dse.software.gpu_baseline import (
+        MEASURED_EVIDENCE_TIER,
+        gpu_baseline_energy_evidence,
+        gpu_baseline_throughput_evidence,
+        validate_gpu_baseline_report,
+        validate_gpu_baseline_stage_receipt,
+    )
+
+    config = json.loads(config_path.read_text(encoding="utf-8"))
+    if not isinstance(config, Mapping):
+        raise TypeError("publication configuration must contain an object")
+    if any(
+        config.get(name) != getattr(manifest, name)
+        for name in ("model_name", "model_revision", "tokenizer_revision")
+    ):
+        raise ValueError("publication configuration differs from the sweep manifest")
+    hardware_space = config.get("hardware_space")
+    resource_budget = (
+        hardware_space.get("RESOURCE_BUDGET")
+        if isinstance(hardware_space, Mapping)
+        else None
+    )
+    if not isinstance(resource_budget, Mapping):
+        raise ValueError("publication comparison requires a resource budget")
+
+    baseline_report = load_immutable_json(gpu_baseline_report_path)
+    baseline_receipt = load_immutable_json(gpu_baseline_receipt_path)
+    baseline_contract, rebuilt_baseline = validate_gpu_baseline_report(
+        baseline_report
+    )
+    validate_gpu_baseline_stage_receipt(rebuilt_baseline, baseline_receipt)
+    if (
+        baseline_contract.model_name != manifest.model_name
+        or baseline_contract.model_revision != manifest.model_revision
+        or baseline_contract.tokenizer_revision != manifest.tokenizer_revision
+        or baseline_contract.workspace_binding.manifest_hash
+        != manifest.canonical_hash
+    ):
+        raise ValueError("measured GPU baseline differs from the sweep manifest")
+    if len(baseline_contract.planned_device_labels) != 1:
+        raise ValueError("publication comparison requires one measured GPU label")
+    device_label = baseline_contract.planned_device_labels[0]
+    gpu_throughput = gpu_baseline_throughput_evidence(
+        rebuilt_baseline,
+        stage_receipt=baseline_receipt,
+        device_label=device_label,
+        resource_budget=resource_budget,
+    )
+    best_by_device = rebuilt_baseline.get("best_measured_by_device")
+    best_rows = tuple(
+        row
+        for row in best_by_device.values()
+        if isinstance(best_by_device, Mapping)
+        and isinstance(row, Mapping)
+        and row.get("device_label") == device_label
+    ) if isinstance(best_by_device, Mapping) else ()
+    if len(best_rows) != 1:
+        raise ValueError("measured GPU baseline has no unique selected row")
+    best_gpu = best_rows[0]
+    gpu_energy_value = best_gpu.get("energy")
+    if not isinstance(gpu_energy_value, Mapping):
+        raise ValueError("measured GPU baseline lacks energy status")
+    gpu_energy_j: float | str = ""
+    gpu_tokens_per_joule: float | str = ""
+    gpu_energy_tier = "unavailable"
+    gpu_energy_status = str(
+        gpu_energy_value.get("unavailable_reason") or "unavailable"
+    )
+    if gpu_energy_value.get("available") is True:
+        gpu_energy = gpu_baseline_energy_evidence(
+            rebuilt_baseline,
+            stage_receipt=baseline_receipt,
+            device_label=device_label,
+            resource_budget=resource_budget,
+        )
+        gpu_energy_j = gpu_energy.energy_per_token_j
+        gpu_tokens_per_joule = gpu_energy.tokens_per_joule
+        gpu_energy_tier = gpu_energy.evidence_tier
+        gpu_energy_status = "measured"
+
+    contract_value = load_immutable_json(publication_contract_path)
+    contract_value.pop("content_hash", None)
+    contract = PublicationContract.from_dict(contract_value)
+    if (
+        contract.protocol.model_name != manifest.model_name
+        or contract.protocol.model_revision != manifest.model_revision
+        or contract.protocol.tokenizer_revision != manifest.tokenizer_revision
+    ):
+        raise ValueError("publication contract differs from the sweep manifest")
+    publication_report = load_immutable_json(publication_report_path)
+    if (
+        publication_report.get("schema_version") != PUBLICATION_REPORT_SCHEMA
+        or publication_report.get("contract_hash") != contract.canonical_hash
+    ):
+        raise ValueError("publication benchmark report differs from its contract")
+    report_selection = publication_report.get("selection")
+    passing_ids = (
+        report_selection.get("accuracy_configuration_ids")
+        if isinstance(report_selection, Mapping)
+        else None
+    )
+    if (
+        not isinstance(report_selection, Mapping)
+        or report_selection.get("selected") is not True
+        or not isinstance(passing_ids, list)
+        or not passing_ids
+    ):
+        raise ValueError("publication accuracy gates selected no configuration")
+
+    final_selection = load_immutable_json(final_selection_path)
+    if (
+        final_selection.get("schema_version")
+        != FINAL_PUBLICATION_SELECTION_SCHEMA
+        or final_selection.get("contract_hash") != contract.canonical_hash
+        or final_selection.get("contract_sha256")
+        != _sha256(publication_contract_path)
+        or final_selection.get("benchmark_report_sha256")
+        != _sha256(publication_report_path)
+        or final_selection.get("accuracy_pass_configuration_ids") != passing_ids
+    ):
+        raise ValueError("final publication selection provenance differs")
+    selected = final_selection.get("selection")
+    if not isinstance(selected, Mapping):
+        raise ValueError("final publication selection is missing")
+    configuration_by_id = {
+        item.configuration_id: item for item in contract.configurations
+    }
+    selected_configuration = configuration_by_id.get(
+        str(selected.get("configuration_id", ""))
+    )
+    if (
+        selected_configuration is None
+        or selected_configuration.role == "bf16"
+        or selected_configuration.configuration_id not in passing_ids
+        or selected.get("role") != selected_configuration.role
+        or selected.get("profile_id")
+        != selected_configuration.profile.profile_id
+    ):
+        raise ValueError("selected deployment differs from accuracy gates")
+    matching_alternatives = tuple(
+        alternative
+        for alternative in contract.hardware_alternatives
+        if alternative.alternative_id == selected.get("alternative_id")
+    )
+    if len(matching_alternatives) != 1:
+        raise ValueError("selected hardware alternative is absent from contract")
+    alternative = matching_alternatives[0]
+    if (
+        alternative.configuration_id
+        != selected_configuration.configuration_id
+        or alternative.profile_id != selected_configuration.profile.profile_id
+        or alternative.candidate_id != selected.get("candidate_id")
+        or alternative.record_hash != selected.get("hardware_record_hash")
+    ):
+        raise ValueError("selected hardware alternative binding differs")
+
+    refined_hardware_sha256 = _sha256(refined_hardware_artifact_path)
+    declared_artifacts = final_selection.get("hardware_artifacts")
+    if (
+        alternative.hardware_artifact_sha256 != refined_hardware_sha256
+        or selected.get("hardware_artifact_sha256") != refined_hardware_sha256
+        or not isinstance(declared_artifacts, list)
+        or refined_hardware_sha256
+        not in {
+            item.get("sha256")
+            for item in declared_artifacts
+            if isinstance(item, Mapping)
+        }
+    ):
+        raise ValueError("selected refined hardware artifact identity differs")
+    hardware_header, hardware_rows = load_hardware_artifact(
+        refined_hardware_artifact_path
+    )
+    provenance = hardware_header.get("provenance")
+    if (
+        hardware_header.get("storage_revision") != HARDWARE_STORAGE_REVISION
+        or not isinstance(provenance, Mapping)
+        or provenance.get("model_revision") != manifest.model_revision
+        or provenance.get("tokenizer_revision") != manifest.tokenizer_revision
+    ):
+        raise ValueError("refined hardware artifact provenance differs")
+    matched_rows = tuple(
+        row
+        for row in hardware_rows
+        if row.get("record_hash") == selected.get("hardware_record_hash")
+    )
+    if len(matched_rows) != 1:
+        raise ValueError("selected refined hardware row is missing or duplicated")
+    hardware_row = matched_rows[0]
+    metrics = hardware_row.get("metrics")
+    whole_model = metrics.get("whole_model") if isinstance(metrics, Mapping) else None
+    energy = (
+        whole_model.get("calibrated_energy")
+        if isinstance(whole_model, Mapping)
+        else None
+    )
+    hardware = hardware_row.get("hardware")
+    timing_tier_by_mode = {
+        "compiler_trace": "compiler_trace_request_calibrated",
+        "legacy_aggregate_bandwidth": "stage_calibrated_analytic",
+    }
+    selected_timing_tier = (
+        whole_model.get("publication_timing_tier")
+        if isinstance(whole_model, Mapping)
+        else None
+    )
+    if (
+        hardware_row.get("deployment_valid") is not True
+        or hardware_row.get("profile_id") != alternative.profile_id
+        or hardware_row.get("candidate_id") != alternative.candidate_id
+        or not isinstance(metrics, Mapping)
+        or timing_tier_by_mode.get(str(metrics.get("execution_mode")))
+        != selected_timing_tier
+        or metrics.get("timing_calibrated") is not True
+        or not metrics.get("timing_evidence_id")
+        or not isinstance(whole_model, Mapping)
+        or whole_model.get("rankable") is not True
+        or not isinstance(energy, Mapping)
+        or not isinstance(hardware, Mapping)
+    ):
+        raise ValueError("selected refined hardware evidence is not rankable")
+    plena_tps = _finite(whole_model.get("tps"), "selected whole-model TPS")
+    plena_tpot_ms = _finite(
+        whole_model.get("tpot_ms"), "selected whole-model TPOT"
+    )
+    plena_energy_j = _finite(energy.get("total_j"), "selected whole-model energy")
+    if (
+        plena_tps <= 0
+        or plena_tpot_ms <= 0
+        or plena_energy_j <= 0
+        or not math.isclose(
+            plena_tpot_ms,
+            alternative.tpot_ms,
+            rel_tol=1e-12,
+            abs_tol=0.0,
+        )
+        or not math.isclose(
+            plena_energy_j,
+            alternative.energy_per_token_j,
+            rel_tol=1e-12,
+            abs_tol=0.0,
+        )
+    ):
+        raise ValueError("selected refined hardware metrics differ from contract")
+
+    identities = {
+        "gpu_baseline_report_sha256": _sha256(gpu_baseline_report_path),
+        "gpu_baseline_receipt_sha256": _sha256(gpu_baseline_receipt_path),
+        "publication_contract_sha256": _sha256(publication_contract_path),
+        "publication_report_sha256": _sha256(publication_report_path),
+        "final_selection_sha256": _sha256(final_selection_path),
+        "refined_hardware_artifact_sha256": refined_hardware_sha256,
+    }
+    common = {
+        "headline_ratio_permitted": False,
+        "ratio_block_reason": "throughput_evidence_tiers_differ",
+        "throughput_ratio": "",
+        "peak_roofline_row": False,
+        "peak_roofline_ratio_permitted": False,
+        "accuracy_pass_configuration_ids": ";".join(passing_ids),
+        **identities,
+    }
+    rows = (
+        {
+            "system_role": "selected_plena_deployment",
+            "system_name": "PLENA decode with dedicated BF16 output head",
+            "configuration_role": selected_configuration.role,
+            "configuration_id": selected_configuration.configuration_id,
+            "profile_id": alternative.profile_id,
+            "candidate_id": alternative.candidate_id,
+            "batch_size": int(hardware["BATCH"]),
+            "tpot_ms": plena_tpot_ms,
+            "tokens_per_second": plena_tps,
+            "throughput_evidence_tier": str(selected_timing_tier),
+            "energy_per_token_j": plena_energy_j,
+            "tokens_per_joule": 1.0 / plena_energy_j,
+            "energy_evidence_tier": alternative.energy_tier,
+            "energy_status": "rankable",
+            "accuracy_gate_passed": True,
+            "selected_deployment": True,
+            **common,
+        },
+        {
+            "system_role": "measured_gpu_baseline",
+            "system_name": gpu_throughput.system_name,
+            "configuration_role": "bf16",
+            "configuration_id": "",
+            "profile_id": "",
+            "candidate_id": "",
+            "batch_size": gpu_throughput.batch_size,
+            "tpot_ms": _finite(
+                best_gpu.get("mean_batch_step_ms"),
+                "measured GPU batch-step latency",
+            ),
+            "tokens_per_second": gpu_throughput.tokens_per_second,
+            "throughput_evidence_tier": gpu_throughput.evidence_tier,
+            "energy_per_token_j": gpu_energy_j,
+            "tokens_per_joule": gpu_tokens_per_joule,
+            "energy_evidence_tier": gpu_energy_tier,
+            "energy_status": gpu_energy_status,
+            "accuracy_gate_passed": "reference",
+            "selected_deployment": False,
+            **common,
+        },
+    )
+    if gpu_throughput.evidence_tier != MEASURED_EVIDENCE_TIER:
+        raise ValueError("GPU baseline throughput is not measured evidence")
+    return rows, {
+        "accuracy_pass_configuration_ids": list(passing_ids),
+        "selected_configuration_id": selected_configuration.configuration_id,
+        "selected_alternative_id": alternative.alternative_id,
+        "headline_ratio_permitted": False,
+        "ratio_block_reason": "throughput_evidence_tiers_differ",
+        "peak_roofline_ratio_permitted": False,
+        "peak_roofline_status": "not_part_of_headline_comparison",
+        "sources": identities,
+    }
+
+
+def plot_selected_deployment_evidence(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    """Show selected and measured systems without a cross-tier ratio."""
+
+    ordered = tuple(rows)
+    if tuple(row.get("system_role") for row in ordered) != (
+        "selected_plena_deployment",
+        "measured_gpu_baseline",
+    ):
+        raise ValueError("selected-deployment comparison rows are incomplete")
+    labels = ("Selected PLENA", "Measured GPU")
+    colours = (BLUE, GREY)
+    throughput = [
+        _finite(row.get("tokens_per_second"), "comparison throughput")
+        for row in ordered
+    ]
+    if any(value <= 0 for value in throughput):
+        raise ValueError("comparison throughput must be positive")
+    fig, (throughput_ax, energy_ax) = plt.subplots(
+        1,
+        2,
+        figsize=(9.2, 4.1),
+        constrained_layout=True,
+    )
+    x = np.arange(len(ordered))
+    bars = throughput_ax.bar(x, throughput, color=colours, width=0.62)
+    throughput_ax.bar_label(bars, fmt="%.1f", padding=3, fontsize=8)
+    throughput_ax.set_xticks(x, labels)
+    throughput_ax.set_ylabel("Whole-model throughput (tokens/s)")
+    for index, row in enumerate(ordered):
+        throughput_ax.text(
+            index,
+            throughput[index] * 0.04,
+            str(row["throughput_evidence_tier"]),
+            rotation=90,
+            ha="center",
+            va="bottom",
+            color=SURFACE,
+            fontsize=7.2,
+        )
+    _set_title(
+        throughput_ax,
+        "Selected deployment and measured GPU baseline",
+        f"{model_name} · evidence tiers differ, so no throughput ratio is reported",
+    )
+
+    energy_values = []
+    energy_positions = []
+    energy_colours = []
+    for index, row in enumerate(ordered):
+        value = row.get("energy_per_token_j")
+        if value in (None, ""):
+            continue
+        numeric = _finite(value, "comparison energy")
+        if numeric <= 0:
+            raise ValueError("comparison energy must be positive")
+        energy_positions.append(index)
+        energy_values.append(numeric)
+        energy_colours.append(colours[index])
+    if energy_values:
+        energy_bars = energy_ax.bar(
+            energy_positions,
+            energy_values,
+            color=energy_colours,
+            width=0.62,
+        )
+        energy_ax.bar_label(energy_bars, fmt="%.4g", padding=3, fontsize=8)
+    energy_ax.set_xticks(x, labels)
+    energy_ax.set_ylabel("Energy per generated token (J)")
+    for index, row in enumerate(ordered):
+        if row.get("energy_per_token_j") in (None, ""):
+            energy_ax.text(
+                index,
+                0.02,
+                "Unavailable",
+                transform=energy_ax.get_xaxis_transform(),
+                ha="center",
+                va="bottom",
+                color=MUTED,
+                fontsize=8,
+            )
+    _set_title(
+        energy_ax,
+        "Energy evidence",
+        "Tiers remain explicit; unavailable GPU board energy is not substituted",
+    )
+    return _save(
+        fig,
+        stem="12_selected_deployment",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for block in iter(lambda: handle.read(1 << 20), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _finite(value: Any, label: str) -> float:
+    if isinstance(value, bool) or not isinstance(value, (int, float)):
+        raise TypeError(f"{label} must be numeric")
+    result = float(value)
+    if not math.isfinite(result):
+        raise ValueError(f"{label} must be finite")
+    return result
+
+
+def _configure_style() -> None:
+    plt.rcParams.update(
+        {
+            "figure.facecolor": SURFACE,
+            "axes.facecolor": SURFACE,
+            "savefig.facecolor": SURFACE,
+            "font.family": "sans-serif",
+            "font.sans-serif": ("Arial", "Liberation Sans", "DejaVu Sans"),
+            "font.size": 9.5,
+            "axes.titlesize": 11.0,
+            "axes.titleweight": "semibold",
+            "axes.labelsize": 10.0,
+            "axes.labelcolor": INK,
+            "axes.edgecolor": INK,
+            "axes.linewidth": 0.8,
+            "axes.spines.top": False,
+            "axes.spines.right": False,
+            "axes.grid": True,
+            "axes.axisbelow": True,
+            "grid.color": GRID,
+            "grid.linewidth": 0.55,
+            "grid.alpha": 0.75,
+            "xtick.color": INK,
+            "ytick.color": INK,
+            "xtick.labelsize": 8.7,
+            "ytick.labelsize": 8.7,
+            "legend.frameon": False,
+            "legend.fontsize": 8.5,
+            "lines.linewidth": 1.6,
+            "pdf.fonttype": 42,
+            "ps.fonttype": 42,
+            "svg.fonttype": "none",
+        }
+    )
+
+
+def _set_title(ax: Any, title: str, subtitle: str) -> None:
+    # The subtitle is offset in points, matching the units of the title pad, so
+    # the gap between the two is fixed. An axes-relative offset scales with axes
+    # height and lets the subtitle ride up into the title on tall panels.
+    ax.set_title(title, loc="left", color=INK, pad=13)
+    ax.annotate(
+        subtitle,
+        xy=(0.0, 1.0),
+        xycoords="axes fraction",
+        xytext=(0.0, 2.5),
+        textcoords="offset points",
+        ha="left",
+        va="bottom",
+        color=MUTED,
+        fontsize=8.3,
+        annotation_clip=False,
+    )
+
+
+def _save(
+    fig: Any,
+    *,
+    stem: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    paths = []
+    for suffix in formats:
+        path = output_dir / f"{stem}.{suffix}"
+        options: dict[str, Any] = {
+            "bbox_inches": "tight",
+            "pad_inches": 0.12,
+        }
+        if suffix == "png":
+            options["dpi"] = FIGURE_DPI
+        fig.savefig(path, **options)
+        paths.append(path)
+    plt.close(fig)
+    return tuple(paths)
+
+
+def _write_csv(
+    path: Path,
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    fieldnames: Sequence[str],
+) -> Path:
+    """Write one deterministic figure-data table atomically."""
+
+    path.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary_name = tempfile.mkstemp(
+        dir=path.parent,
+        prefix=f".{path.name}.",
+        suffix=".tmp",
+        text=True,
+    )
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8", newline="") as handle:
+            writer = csv.DictWriter(
+                handle,
+                fieldnames=tuple(fieldnames),
+                extrasaction="raise",
+                lineterminator="\n",
+            )
+            writer.writeheader()
+            writer.writerows(rows)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temporary_name, path)
+    finally:
+        if os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return path
+
+
+def _write_json(path: Path, value: Mapping[str, Any]) -> Path:
+    """Write a deterministic JSON receipt atomically."""
+
+    payload = (
+        json.dumps(value, indent=2, sort_keys=True, allow_nan=False) + "\n"
+    ).encode("utf-8")
+    descriptor, temporary_name = tempfile.mkstemp(
+        dir=path.parent,
+        prefix=f".{path.name}.",
+        suffix=".tmp",
+    )
+    try:
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(temporary_name, path)
+    finally:
+        if os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return path
+
+
+def _load_sweep_provenance(path: Path, manifest: Any) -> Mapping[str, Any]:
+    if not path.is_file():
+        raise FileNotFoundError(
+            f"publication CSVs require the workspace provenance sidecar: {path}"
+        )
+    value = json.loads(path.read_text(encoding="utf-8"))
+    content_hash = value.pop("content_hash", None)
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    if content_hash != hashlib.sha256(payload).hexdigest():
+        raise ValueError("workspace provenance content hash mismatch")
+    if (
+        value.get("schema_version") != "decode-sweep-provenance"
+        or value.get("manifest_hash") != manifest.canonical_hash
+        or value.get("quantizer_provenance_hash")
+        != manifest.quantizer_provenance.canonical_hash
+        or not value.get("run_plan_hash")
+        or not value.get("created_at_utc")
+    ):
+        raise ValueError("workspace provenance does not bind this sweep manifest")
+    return value | {"content_hash": content_hash}
+
+
+def _copy_sweep_provenance(
+    source: Path,
+    output_dir: Path,
+    *,
+    expected_content_hash: str,
+) -> Path:
+    """Copy validated provenance bytes into a self-contained export."""
+
+    payload = source.read_bytes()
+    value = json.loads(payload)
+    recorded_hash = value.pop("content_hash", None)
+    canonical = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    if (
+        recorded_hash != expected_content_hash
+        or hashlib.sha256(canonical).hexdigest() != expected_content_hash
+    ):
+        raise ValueError("workspace provenance changed after validation")
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+    destination = output_dir / PORTABLE_WORKSPACE_PROVENANCE
+    if destination.exists():
+        if (
+            destination.is_symlink()
+            or not destination.is_file()
+            or destination.read_bytes() != payload
+        ):
+            raise FileExistsError(
+                f"existing portable provenance differs: {destination}"
+            )
+        return destination
+
+    descriptor, temporary_name = tempfile.mkstemp(
+        dir=output_dir,
+        prefix=f".{PORTABLE_WORKSPACE_PROVENANCE}.",
+        suffix=".tmp",
+    )
+    try:
+        with os.fdopen(descriptor, "wb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        try:
+            os.link(temporary_name, destination)
+        except FileExistsError:
+            if (
+                destination.is_symlink()
+                or not destination.is_file()
+                or destination.read_bytes() != payload
+            ):
+                raise FileExistsError(
+                    f"existing portable provenance differs: {destination}"
+                )
+    finally:
+        if os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return destination
+
+
+def _build_results_provenance(
+    *,
+    sweep_provenance_path: Path,
+    sweep_provenance: Mapping[str, Any],
+    manifest: Any,
+    data_tables: Sequence[Path],
+    created_at_utc: str | None = None,
+) -> dict[str, Any]:
+    if sweep_provenance_path.name != PORTABLE_WORKSPACE_PROVENANCE:
+        raise ValueError("results must bind the portable workspace provenance")
+    portable = _load_sweep_provenance(sweep_provenance_path, manifest)
+    if portable["content_hash"] != sweep_provenance["content_hash"]:
+        raise ValueError("portable workspace provenance identity differs")
+    if any(path.parent != sweep_provenance_path.parent for path in data_tables):
+        raise ValueError("publication tables and provenance must share a directory")
+    body = {
+        "schema_version": RESULTS_PROVENANCE_SCHEMA,
+        "created_at_utc": created_at_utc
+        or datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+        "model": sweep_provenance["model"],
+        "datasets": sweep_provenance["datasets"],
+        "manifest_hash": manifest.canonical_hash,
+        "run_plan_hash": sweep_provenance["run_plan_hash"],
+        "quantizer_provenance_hash": sweep_provenance[
+            "quantizer_provenance_hash"
+        ],
+        "workspace_provenance": {
+            "path": sweep_provenance_path.name,
+            "content_hash": sweep_provenance["content_hash"],
+        },
+        "tables": [
+            {
+                "filename": path.name,
+                "sha256": _sha256(path),
+                "size_bytes": path.stat().st_size,
+            }
+            for path in data_tables
+        ],
+    }
+    return body | {
+        "content_hash": hashlib.sha256(
+            json.dumps(
+                body,
+                sort_keys=True,
+                separators=(",", ":"),
+                ensure_ascii=True,
+                allow_nan=False,
+            ).encode("utf-8")
+        ).hexdigest()
+    }
+
+
+def _source_files(path: Path) -> tuple[Path, ...]:
+    """Resolve only the immutable result shards consumed by a loader."""
+
+    if path.is_file():
+        return (path,)
+    if not path.is_dir():
+        raise FileNotFoundError(path)
+    shard_root = path / "shards" if (path / "shards").is_dir() else path
+    files = tuple(sorted(shard_root.glob("*.jsonl")))
+    if not files:
+        raise ValueError(f"no result shards found under {path}")
+    return files
+
+
+def _load_numerical_points(
+    manifest_path: Path,
+    result_paths: Sequence[Path],
+    *,
+    require_complete: bool,
+    stage: str | None = None,
+) -> tuple[Any, tuple[NumericalPoint, ...], tuple[Mapping[str, Any], ...]]:
+    manifest = load_manifest(manifest_path)
+    invocation_paths = tuple(
+        invocation
+        for path in result_paths
+        if path.is_dir()
+        for invocation in path.rglob("invocation.json")
+    )
+    if invocation_paths:
+        if stage not in {"numerical-screen", "hardware-validation"}:
+            raise ValueError("sharded numerical inputs require their stage identity")
+        from decode_dse.software.refinement_schedule import (
+            _load_sharded_stage_rows,
+        )
+        from decode_dse.software.sweep_plan import (
+            SweepRunPlan,
+            load_immutable_json,
+        )
+
+        plan_value = load_immutable_json(manifest_path.parent / "run_plan.json")
+        plan_value.pop("content_hash", None)
+        plan = SweepRunPlan.from_dict(plan_value)
+        profile_ids = (
+            plan.numerical_screen_profile_ids
+            if stage == "numerical-screen"
+            else plan.hardware_validation_profile_ids
+        )
+        rows, _ = _load_sharded_stage_rows(
+            result_paths,
+            manifest=manifest,
+            plan=plan,
+            stage=stage,
+            profile_ids=profile_ids,
+        )
+    else:
+        rows = load_terminal_numerical_rows(
+            result_paths,
+            manifest,
+            require_complete=require_complete,
+        )
+    points = []
+    for row in rows:
+        if row["state"] != "succeeded":
+            continue
+        result = row.get("result")
+        if not isinstance(result, Mapping):
+            raise ValueError("successful numerical row has no metric object")
+        points.append(
+            NumericalPoint(
+                ordinal=int(row["ordinal"]),
+                profile=DecodePrecisionProfile.from_dict(row["profile"]),
+                mean_nll=_finite(result.get("mean_nll"), "mean_nll"),
+                runtime_seconds=_finite(
+                    row.get("runtime_seconds"),
+                    "runtime_seconds",
+                ),
+            )
+        )
+    if not points:
+        raise ValueError("numerical artifact contains no successful profiles")
+    return manifest, tuple(points), rows
+
+
+def _reference_nll(points: Sequence[NumericalPoint]) -> float:
+    references = [
+        point.mean_nll
+        for point in points
+        if point.profile.kind == PROFILE_KIND_BF16_REFERENCE
+    ]
+    if len(references) != 1:
+        raise ValueError("figures require exactly one successful BF16 reference")
+    return references[0]
+
+
+def _family(format_id: str) -> str:
+    if format_id.startswith("MXINT"):
+        return "mxint"
+    if format_id.startswith("E"):
+        return "mxfp"
+    return "bf16"
+
+
+def _jitter(count: int, ordinal: int) -> np.ndarray:
+    if count <= 1:
+        return np.zeros(count)
+    phase = (ordinal % 97) / 97.0
+    return np.linspace(-0.19, 0.19, count) + (phase - 0.5) * 0.01
+
+
+def plot_completion_matrix(
+    manifest: Any,
+    terminal_rows: Sequence[Mapping[str, Any]],
+    *,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    """Show complete, failed, and pending profiles without dropping failures."""
+
+    row_by_id = {str(row["profile_id"]): row for row in terminal_rows}
+    totals = np.zeros((len(DECODE_FORMATS), len(DECODE_FORMATS)), dtype=int)
+    succeeded = np.zeros_like(totals)
+    format_index = {format_id: index for index, format_id in enumerate(DECODE_FORMATS)}
+    states: Counter[str] = Counter()
+    failure_classes: Counter[str] = Counter()
+    for entry in manifest.entries:
+        profile = entry.profile
+        row = row_by_id.get(entry.profile_id)
+        state = str(row["state"]) if row is not None else "pending"
+        states[state] += 1
+        if state == "failed":
+            failure_classes[str(row.get("error_class") or "unclassified")] += 1
+        if profile.kind == PROFILE_KIND_BF16_REFERENCE:
+            continue
+        row_index = format_index[profile.weight_format]
+        column_index = format_index[profile.kv_format]
+        totals[row_index, column_index] += 1
+        if state == "succeeded":
+            succeeded[row_index, column_index] += 1
+    if np.any(totals == 0):
+        raise ValueError("completion matrix has incomplete manifest coverage")
+    completion = np.divide(
+        succeeded,
+        totals,
+        out=np.zeros_like(succeeded, dtype=float),
+        where=totals > 0,
+    )
+    fig, (matrix_ax, status_ax) = plt.subplots(
+        1,
+        2,
+        figsize=(9.4, 5.15),
+        gridspec_kw={"width_ratios": (3.5, 1.0)},
+        constrained_layout=True,
+    )
+    image = matrix_ax.imshow(
+        completion,
+        cmap="Blues",
+        vmin=0.0,
+        vmax=1.0,
+        origin="upper",
+        aspect="equal",
+    )
+    matrix_ax.set_xticks(np.arange(len(DECODE_FORMATS)))
+    matrix_ax.set_xticklabels(DECODE_FORMATS, rotation=35, ha="right")
+    matrix_ax.set_yticks(np.arange(len(DECODE_FORMATS)))
+    matrix_ax.set_yticklabels(DECODE_FORMATS)
+    matrix_ax.set_xlabel("KV-cache format")
+    matrix_ax.set_ylabel("Weight format")
+    matrix_ax.grid(False)
+    for row_index in range(totals.shape[0]):
+        for column_index in range(totals.shape[1]):
+            fraction = completion[row_index, column_index]
+            matrix_ax.text(
+                column_index,
+                row_index,
+                f"{succeeded[row_index, column_index]}/"
+                f"{totals[row_index, column_index]}",
+                ha="center",
+                va="center",
+                fontsize=6.8,
+                color=SURFACE if fraction >= 0.65 else INK,
+            )
+    colourbar = fig.colorbar(image, ax=matrix_ax, shrink=0.82, pad=0.03)
+    colourbar.set_label("Successful terminal fraction")
+    _set_title(
+        matrix_ax,
+        "Numerical sweep completion",
+        f"{model_name} · cells retain all activation and vector settings",
+    )
+
+    state_order = ("succeeded", "failed", "pending")
+    state_colours = (GREEN, RED, GREY)
+    values = [states[state] for state in state_order]
+    bars = status_ax.bar(
+        np.arange(len(state_order)),
+        values,
+        color=state_colours,
+        width=0.62,
+    )
+    status_ax.bar_label(bars, padding=3, fontsize=8)
+    status_ax.set_xticks(np.arange(len(state_order)))
+    status_ax.set_xticklabels(
+        ("Succeeded", "Failed", "Pending"),
+        rotation=30,
+        ha="right",
+    )
+    status_ax.set_ylabel("Profiles")
+    status_ax.set_ylim(0, max(values + [1]) * 1.15)
+    failure_note = "No terminal failures"
+    if failure_classes:
+        failure_note = ", ".join(
+            f"{name}: {count}" for name, count in failure_classes.most_common(3)
+        )
+    _set_title(
+        status_ax,
+        "Terminal states",
+        failure_note,
+    )
+    return _save(
+        fig,
+        stem="00_numerical_completion",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def plot_accuracy_by_weight(
+    points: Sequence[NumericalPoint],
+    *,
+    reference_nll: float,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    groups = [
+        [
+            point.mean_nll - reference_nll
+            for point in points
+            if point.profile.weight_format == format_id
+            and point.profile.kind != PROFILE_KIND_BF16_REFERENCE
+        ]
+        for format_id in DECODE_FORMATS
+    ]
+    if any(not group for group in groups):
+        raise ValueError("weight-format accuracy figure has incomplete coverage")
+    fig, ax = plt.subplots(figsize=(7.25, 4.15), constrained_layout=True)
+    box = ax.boxplot(
+        groups,
+        positions=np.arange(len(groups)),
+        widths=0.55,
+        whis=(5, 95),
+        showfliers=False,
+        patch_artist=True,
+        medianprops={"color": INK, "linewidth": 1.3},
+        whiskerprops={"color": MUTED, "linewidth": 0.8},
+        capprops={"color": MUTED, "linewidth": 0.8},
+        boxprops={"edgecolor": INK, "linewidth": 0.7},
+    )
+    for patch, format_id in zip(box["boxes"], DECODE_FORMATS):
+        patch.set_facecolor(FAMILY_COLOURS[_family(format_id)])
+        patch.set_alpha(0.55)
+    for index, (values, format_id) in enumerate(zip(groups, DECODE_FORMATS)):
+        ordered = np.asarray(sorted(values), dtype=float)
+        ax.scatter(
+            index + _jitter(len(ordered), index),
+            ordered,
+            s=7,
+            alpha=0.12,
+            color=FAMILY_COLOURS[_family(format_id)],
+            edgecolors="none",
+            rasterized=True,
+        )
+    ax.axhline(0.0, color=INK, linewidth=0.9)
+    ax.set_yscale("symlog", linthresh=0.01, linscale=0.8)
+    ax.set_xticks(np.arange(len(DECODE_FORMATS)))
+    ax.set_xticklabels(DECODE_FORMATS, rotation=30, ha="right")
+    ax.set_ylabel("Δ NLL from BF16 (nats/token, symlog)")
+    ax.set_xlabel("Weight format")
+    _set_title(
+        ax,
+        "Decode accuracy sensitivity across weight formats",
+        f"{model_name} · distributions span every activation, KV, and vector setting",
+    )
+    return _save(
+        fig,
+        stem="01_accuracy_by_weight",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def plot_accuracy_landscape(
+    points: Sequence[NumericalPoint],
+    *,
+    reference_nll: float,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    matrix = np.full((len(DECODE_FORMATS), len(DECODE_FORMATS)), np.nan)
+    for row, weight_format in enumerate(DECODE_FORMATS):
+        for column, kv_format in enumerate(DECODE_FORMATS):
+            values = [
+                point.mean_nll - reference_nll
+                for point in points
+                if point.profile.weight_format == weight_format
+                and point.profile.kv_format == kv_format
+                and point.profile.kind != PROFILE_KIND_BF16_REFERENCE
+            ]
+            if values:
+                matrix[row, column] = min(values)
+    if np.isnan(matrix).any():
+        raise ValueError("accuracy landscape has incomplete W/KV coverage")
+    magnitude = max(float(np.max(np.abs(matrix))), 0.01)
+    norm = SymLogNorm(
+        linthresh=0.01,
+        linscale=0.8,
+        vmin=-magnitude,
+        vmax=magnitude,
+    )
+    fig, ax = plt.subplots(figsize=(7.0, 5.4), constrained_layout=True)
+    image = ax.imshow(
+        matrix,
+        cmap="RdYlBu_r",
+        norm=norm,
+        origin="upper",
+        aspect="equal",
+    )
+    ax.set_xticks(np.arange(len(DECODE_FORMATS)))
+    ax.set_xticklabels(DECODE_FORMATS, rotation=35, ha="right")
+    ax.set_yticks(np.arange(len(DECODE_FORMATS)))
+    ax.set_yticklabels(DECODE_FORMATS)
+    ax.set_xlabel("KV-cache format")
+    ax.set_ylabel("Weight format")
+    ax.grid(False)
+    for row in range(matrix.shape[0]):
+        for column in range(matrix.shape[1]):
+            value = matrix[row, column]
+            rgba = image.cmap(image.norm(value))
+            luminance = 0.2126 * rgba[0] + 0.7152 * rgba[1] + 0.0722 * rgba[2]
+            label = f"{value:.3f}" if abs(value) < 10 else f"{value:.1f}"
+            ax.text(
+                column,
+                row,
+                label,
+                ha="center",
+                va="center",
+                fontsize=7.2,
+                color=INK if luminance > 0.58 else SURFACE,
+            )
+    colourbar = fig.colorbar(image, ax=ax, shrink=0.82, pad=0.03)
+    colourbar.set_label("Best Δ NLL from BF16 (nats/token)")
+    _set_title(
+        ax,
+        "Weight–KV accuracy landscape",
+        f"{model_name} · best observed activation/vector setting in each cell",
+    )
+    return _save(
+        fig,
+        stem="02_weight_kv_accuracy_landscape",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def plot_vector_sensitivity(
+    points: Sequence[NumericalPoint],
+    *,
+    reference_nll: float,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    control_by_matrix_profile = {
+        (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        ): point.mean_nll
+        for point in points
+        if point.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+    }
+    groups = [
+        [
+            (
+                point.mean_nll
+                - control_by_matrix_profile[
+                    (
+                        point.profile.weight_format,
+                        point.profile.activation_format,
+                        point.profile.kv_format,
+                    )
+                ]
+            )
+            for point in points
+            if point.profile.vector_format == vector_format
+            and point.profile.kind != PROFILE_KIND_BF16_REFERENCE
+            and (
+                point.profile.weight_format,
+                point.profile.activation_format,
+                point.profile.kv_format,
+            )
+            in control_by_matrix_profile
+        ]
+        for vector_format in VECTOR_FORMATS
+    ]
+    if any(not group for group in groups):
+        raise ValueError("vector-format figure has incomplete coverage")
+    fig, ax = plt.subplots(figsize=(7.25, 4.15), constrained_layout=True)
+    violin = ax.violinplot(
+        groups,
+        positions=np.arange(len(groups)),
+        widths=0.75,
+        showmeans=False,
+        showmedians=True,
+        showextrema=False,
+        points=120,
+    )
+    for body, vector_format in zip(violin["bodies"], VECTOR_FORMATS):
+        body.set_facecolor(GREY if vector_format == "BF16" else PURPLE)
+        body.set_edgecolor(INK)
+        body.set_alpha(0.55)
+        body.set_linewidth(0.6)
+    violin["cmedians"].set_color(INK)
+    violin["cmedians"].set_linewidth(1.4)
+    ax.axhline(0.0, color=INK, linewidth=0.9)
+    ax.set_yscale("symlog", linthresh=0.01, linscale=0.8)
+    ax.set_xticks(np.arange(len(VECTOR_FORMATS)))
+    ax.set_xticklabels(VECTOR_FORMATS, rotation=30, ha="right")
+    ax.set_ylabel("Paired Δ NLL vs vector-BF16 (nats/token, symlog)")
+    ax.set_xlabel("Vector-datapath format")
+    _set_title(
+        ax,
+        "Paired vector precision attribution",
+        f"{model_name} · each point holds W, A, and KV formats fixed",
+    )
+    return _save(
+        fig,
+        stem="03_vector_precision_sensitivity",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _relative_perplexity_percent(delta_nll: float) -> float:
+    if delta_nll > math.log(float.fromhex("0x1.fffffffffffffp+1023")):
+        return math.inf
+    return math.expm1(delta_nll) * 100.0
+
+
+def _average_ranks(values: Sequence[float]) -> np.ndarray:
+    """Return deterministic one-based average ranks for tied values."""
+
+    array = np.asarray(values, dtype=float)
+    order = np.argsort(array, kind="mergesort")
+    ranks = np.empty(len(array), dtype=float)
+    start = 0
+    while start < len(order):
+        end = start + 1
+        while end < len(order) and array[order[end]] == array[order[start]]:
+            end += 1
+        ranks[order[start:end]] = (start + 1 + end) / 2.0
+        start = end
+    return ranks
+
+
+def plot_screening_fidelity(
+    screening_points: Sequence[NumericalPoint],
+    validation_points: Sequence[NumericalPoint],
+    *,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[tuple[Path, ...], dict[str, Any]]:
+    """Compare the two measured fidelities only on identical profile IDs."""
+
+    screening = {
+        point.profile_id: point
+        for point in screening_points
+        if point.profile.kind == PROFILE_KIND_QUANTIZED
+    }
+    validation = {
+        point.profile_id: point
+        for point in validation_points
+        if point.profile.kind == PROFILE_KIND_QUANTIZED
+    }
+    common = tuple(sorted(set(screening) & set(validation)))
+    if len(common) < 2:
+        raise ValueError("fidelity figure requires at least two common profiles")
+    screen_nll = np.asarray(
+        [screening[profile_id].mean_nll for profile_id in common],
+        dtype=float,
+    )
+    validation_nll = np.asarray(
+        [validation[profile_id].mean_nll for profile_id in common],
+        dtype=float,
+    )
+    screen_ranks = _average_ranks(screen_nll)
+    validation_ranks = _average_ranks(validation_nll)
+    spearman = float(np.corrcoef(screen_ranks, validation_ranks)[0, 1])
+    if not math.isfinite(spearman):
+        raise ValueError("fidelity rank correlation is non-finite")
+    top_k = min(24, len(common))
+    screen_top = {
+        common[index] for index in np.argsort(screen_nll, kind="mergesort")[:top_k]
+    }
+    validation_top = {
+        common[index] for index in np.argsort(validation_nll, kind="mergesort")[:top_k]
+    }
+    recall = len(screen_top & validation_top) / top_k
+    fig, ax = plt.subplots(figsize=(5.0, 4.5), constrained_layout=True)
+    colours = [
+        FAMILY_COLOURS[_family(screening[profile_id].profile.weight_format)]
+        for profile_id in common
+    ]
+    ax.scatter(
+        screen_ranks,
+        validation_ranks,
+        c=colours,
+        s=20,
+        alpha=0.55,
+        edgecolors="none",
+        rasterized=True,
+    )
+    ax.plot(
+        (1, len(common)),
+        (1, len(common)),
+        color=INK,
+        linestyle="--",
+        linewidth=0.9,
+        label="Equal rank",
+    )
+    ax.set_xlim(1, len(common))
+    ax.set_ylim(1, len(common))
+    ax.set_xlabel("Numerical-screen NLL rank (lower is better)")
+    ax.set_ylabel("Hardware-validation NLL rank (lower is better)")
+    ax.legend(loc="best")
+    gate = spearman >= 0.90 and recall >= 0.90
+    _set_title(
+        ax,
+        "Screening fidelity on shared profiles",
+        (
+            f"{model_name} · Spearman ρ={spearman:.3f}; "
+            f"top-{top_k} NLL recall={recall:.1%}; "
+            f"gate {'passed' if gate else 'not passed'}"
+        ),
+    )
+    paths = _save(
+        fig,
+        stem="04_screening_fidelity",
+        output_dir=output_dir,
+        formats=formats,
+    )
+    return paths, {
+        "common_profiles": len(common),
+        "spearman": spearman,
+        "top_k": top_k,
+        "top_k_nll_recall": recall,
+        "passed": gate,
+    }
+
+
+def _load_hardware_points(
+    path: Path,
+    *,
+    profile_by_id: Mapping[str, DecodePrecisionProfile],
+    nll_by_id: Mapping[str, float],
+    reference_nll: float,
+) -> tuple[HardwarePoint, ...]:
+    header, rows = load_hardware_artifact(path)
+    retention = header.get("retention")
+    retention = retention if isinstance(retention, Mapping) else {}
+    points = []
+    for row in rows:
+        if row.get("deployment_valid") is not True:
+            continue
+        profile_id = str(row["profile_id"])
+        profile = profile_by_id.get(profile_id)
+        if profile is None or profile_id not in nll_by_id:
+            raise ValueError("hardware artifact references an unknown profile")
+        metrics = row.get("metrics")
+        if not isinstance(metrics, Mapping):
+            raise ValueError("deployment-valid row has no hardware metrics")
+        whole = metrics.get("whole_model")
+        capacity = metrics.get("runtime_capacity_evidence")
+        if not isinstance(whole, Mapping) or whole.get("rankable") is not True:
+            raise ValueError("deployment-valid row has no rankable system metrics")
+        energy = whole.get("calibrated_energy")
+        if not isinstance(capacity, Mapping):
+            raise ValueError("deployment-valid row lacks energy or capacity")
+        if isinstance(energy, Mapping):
+            energy_j = _finite(energy.get("total_j"), "energy.total_j")
+            energy_tier_raw = energy.get("energy_tier", whole.get("energy_tier"))
+        else:
+            energy_j = _finite(
+                whole.get("energy_per_token_j"),
+                "whole_model.energy_per_token_j",
+            )
+            energy_tier_raw = whole.get("energy_tier")
+        energy_tier = (
+            str(energy_tier_raw) if energy_tier_raw not in (None, "") else None
+        )
+        hardware = row.get("hardware")
+        if not isinstance(hardware, Mapping):
+            raise ValueError("deployment-valid row has no hardware identity")
+        resource_budget = metrics.get("resource_budget")
+        area_budget = None
+        if isinstance(resource_budget, Mapping):
+            raw_budget = resource_budget.get(
+                "aggregate_area_limit_mm2",
+                resource_budget.get("area_budget_mm2"),
+            )
+            if raw_budget is not None:
+                area_budget = _finite(raw_budget, "resource_budget.area_budget_mm2")
+        delta_nll = nll_by_id[profile_id] - reference_nll
+        points.append(
+            HardwarePoint(
+                profile=profile,
+                candidate_id=str(row["candidate_id"]),
+                delta_nll=delta_nll,
+                relative_perplexity_percent=_relative_perplexity_percent(delta_nll),
+                tpot_ms=_finite(whole.get("tpot_ms"), "whole_model.tpot_ms"),
+                tps=_finite(whole.get("tps"), "whole_model.tps"),
+                energy_j=energy_j,
+                area_mm2=_finite(
+                    metrics.get(
+                        "system_area_mm2",
+                        resource_budget.get("aggregate_area_mm2")
+                        if isinstance(resource_budget, Mapping)
+                        else metrics.get("area_mm2"),
+                    ),
+                    "area_mm2",
+                ),
+                max_runtime_batch=int(capacity["max_runtime_batch"]),
+                chip_count=int(hardware.get("CHIP_COUNT", 1)),
+                tp=int(hardware.get("TP", 1)),
+                kvp=int(hardware.get("KVP", 1)),
+                energy_tier=energy_tier,
+                area_budget_mm2=area_budget,
+                retention_labels=tuple(row.get("retention_labels", ())),
+                sample_seed=(
+                    str(retention["sample_seed"])
+                    if retention.get("sample_seed") is not None
+                    else None
+                ),
+                sample_limit=(
+                    int(retention["sample_limit"])
+                    if retention.get("sample_limit") is not None
+                    else None
+                ),
+                scatter_population_count=(
+                    int(retention["scatter_population_count"])
+                    if retention.get("scatter_population_count") is not None
+                    else None
+                ),
+                dominated_population_count=(
+                    int(retention["dominated_population_count"])
+                    if retention.get("dominated_population_count") is not None
+                    else None
+                ),
+            )
+        )
+    if not points:
+        raise ValueError(
+            "hardware figure requires at least one deployment-valid energy-ranked row"
+        )
+    return tuple(points)
+
+
+def _pareto_indices(
+    points: Sequence[HardwarePoint],
+    x: str,
+    y: str,
+) -> tuple[int, ...]:
+    result = []
+    for index, point in enumerate(points):
+        x_value = float(getattr(point, x))
+        y_value = float(getattr(point, y))
+        dominated = False
+        for other_index, other in enumerate(points):
+            if other_index == index:
+                continue
+            other_x = float(getattr(other, x))
+            other_y = float(getattr(other, y))
+            if (
+                other_x <= x_value
+                and other_y <= y_value
+                and (other_x < x_value or other_y < y_value)
+            ):
+                dominated = True
+                break
+        if not dominated:
+            result.append(index)
+    return tuple(result)
+
+
+def plot_hardware_pareto(
+    points: Sequence[HardwarePoint],
+    *,
+    model_name: str,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    finite = [
+        point
+        for point in points
+        if all(
+            math.isfinite(value) and value > 0.0
+            for value in (point.tpot_ms, point.energy_j, point.area_mm2, point.tps)
+        )
+    ]
+    if not finite:
+        raise ValueError("hardware Pareto has no finite positive cost points")
+    areas = np.asarray([point.area_mm2 for point in finite], dtype=float)
+    if float(np.max(areas)) == float(np.min(areas)):
+        marker_sizes = np.full(len(areas), 46.0)
+    else:
+        marker_sizes = 28.0 + 70.0 * (
+            (areas - float(np.min(areas)))
+            / (float(np.max(areas)) - float(np.min(areas)))
+        )
+    chip_counts = tuple(sorted({point.chip_count for point in finite}))
+    palette = (BLUE, ORANGE, GREEN, PURPLE, SKY, RED, GREY)
+    chip_colours = {
+        chip_count: palette[index % len(palette)]
+        for index, chip_count in enumerate(chip_counts)
+    }
+    family_markers = {"mxint": "o", "mxfp": "s", "bf16": "D"}
+    declared = [point for point in finite if point.energy_tier]
+    frontier_source = declared
+    sampled_count = sum(
+        bool(
+            {"sampled_dominated", "sampled_unrankable"}
+            & set(point.retention_labels)
+        )
+        for point in finite
+    )
+
+    fig, (latency_ax, area_ax) = plt.subplots(
+        1,
+        2,
+        figsize=(10.8, 4.35),
+        constrained_layout=True,
+    )
+    for point, marker_size in zip(finite, marker_sizes):
+        family = _family(point.profile.weight_format)
+        sampled = bool(
+            {"sampled_dominated", "sampled_unrankable"}
+            & set(point.retention_labels)
+        )
+        latency_ax.scatter(
+            point.tpot_ms,
+            point.energy_j,
+            color=chip_colours[point.chip_count],
+            marker=family_markers.get(family, "X"),
+            s=float(marker_size),
+            alpha=(0.34 if sampled else 0.72) if point.energy_tier else 0.22,
+            edgecolors=INK if point.energy_tier else RED,
+            linewidths=0.45 if point.energy_tier else 1.0,
+            rasterized=True,
+        )
+        area_ax.scatter(
+            point.tps,
+            point.area_mm2,
+            color=chip_colours[point.chip_count],
+            marker=family_markers.get(family, "X"),
+            s=float(marker_size),
+            alpha=(0.34 if sampled else 0.72) if point.energy_tier else 0.22,
+            edgecolors=INK if point.energy_tier else RED,
+            linewidths=0.45 if point.energy_tier else 1.0,
+            rasterized=True,
+        )
+
+    front = []
+    if frontier_source:
+        front = sorted(
+            (
+                frontier_source[index]
+                for index in _pareto_indices(
+                    frontier_source,
+                    "tpot_ms",
+                    "energy_j",
+                )
+            ),
+            key=lambda point: point.tpot_ms,
+        )
+        latency_ax.plot(
+            [point.tpot_ms for point in front],
+            [point.energy_j for point in front],
+            color=INK,
+            marker="o",
+            markerfacecolor=SURFACE,
+            markersize=4.0,
+            linewidth=1.35,
+            label="Latency–energy Pareto front",
+            zorder=5,
+        )
+
+        callouts: dict[str, tuple[HardwarePoint, list[str]]] = {}
+        for label, point in (
+            ("Fastest", min(frontier_source, key=lambda item: item.tpot_ms)),
+            ("Lowest energy", min(frontier_source, key=lambda item: item.energy_j)),
+            ("Best EDP", min(frontier_source, key=lambda item: item.edp_j_s)),
+        ):
+            entry = callouts.setdefault(point.candidate_id, (point, []))
+            entry[1].append(label)
+        offsets = ((10, 12), (10, 10), (-68, 12))
+        for ordinal, (_, (point, labels)) in enumerate(sorted(callouts.items())):
+            latency_ax.annotate(
+                " / ".join(labels),
+                xy=(point.tpot_ms, point.energy_j),
+                xytext=offsets[ordinal % len(offsets)],
+                textcoords="offset points",
+                fontsize=7.8,
+                color=INK,
+                arrowprops={"arrowstyle": "-", "color": MUTED, "lw": 0.7},
+                zorder=6,
+            )
+
+    latency_ax.set_xscale("log")
+    latency_ax.set_yscale("log")
+    latency_ax.set_xlabel("Whole-model TPOT (ms/token, log)")
+    latency_ax.set_ylabel("Energy per generated token (J, log)")
+    _set_title(
+        latency_ax,
+        "Latency–energy co-design frontier",
+        (
+            f"{model_name} · area sets marker size · "
+            f"exact decision/frontier rows + {sampled_count} deterministic "
+            "sampled dominated row(s)"
+        ),
+    )
+
+    # The frontier is the lower-left envelope, so the region below it holds
+    # no points; the full-space inset lives at the lower left, and the y
+    # floor extends until the inset rectangle is verifiably point-free.
+    _INSET_RECT = (0.06, 0.08, 0.40, 0.36)
+    full_ax = latency_ax.inset_axes(_INSET_RECT)
+    for point, marker_size in zip(finite, marker_sizes):
+        full_ax.scatter(
+            point.tpot_ms,
+            point.energy_j,
+            color=chip_colours[point.chip_count],
+            marker=family_markers.get(_family(point.profile.weight_format), "X"),
+            s=max(8.0, float(marker_size) * 0.25),
+            alpha=0.55,
+            edgecolors="none",
+            rasterized=True,
+        )
+    full_ax.set_xscale("log")
+    full_ax.set_yscale("log")
+    full_ax.set_title(
+        "Full sampled design space",
+        fontsize=7.2,
+        loc="left",
+        pad=2,
+    )
+    full_ax.tick_params(labelsize=6.2, length=2)
+    full_ax.grid(True, linewidth=0.35)
+
+    if front:
+        front_x = [point.tpot_ms for point in front]
+        front_y = [point.energy_j for point in front]
+
+        def padded_limits(values: Sequence[float]) -> tuple[float, float]:
+            low, high = min(values), max(values)
+            if low == high:
+                return low / 1.8, high * 1.8
+            return low / 1.25, high * 1.25
+
+        x_low, x_high = padded_limits(front_x)
+        y_low, y_high = padded_limits(front_y)
+        latency_ax.set_xlim(x_low, x_high)
+        inset_x0, inset_y0, inset_w, inset_h = _INSET_RECT
+        for _ in range(8):
+            latency_ax.set_ylim(y_low, y_high)
+            to_axes = (
+                latency_ax.transData + latency_ax.transAxes.inverted()
+            ).transform
+            occupied = any(
+                inset_x0 <= x <= inset_x0 + inset_w
+                and inset_y0 <= y <= inset_y0 + inset_h
+                for x, y in to_axes(
+                    [
+                        (point.tpot_ms, point.energy_j)
+                        for point in frontier_source
+                    ]
+                )
+            )
+            if not occupied:
+                break
+            y_low /= 1.6
+
+    budgets = sorted(
+        {point.area_budget_mm2 for point in finite if point.area_budget_mm2 is not None}
+    )
+    if len(budgets) > 1:
+        raise ValueError("hardware rows declare inconsistent aggregate area budgets")
+    if budgets:
+        area_ax.axhline(
+            budgets[0],
+            color=RED,
+            linestyle="--",
+            linewidth=1.1,
+        )
+        area_ax.annotate(
+            f"Area budget ({budgets[0]:g} mm²)",
+            xy=(0.02, budgets[0]),
+            xycoords=("axes fraction", "data"),
+            xytext=(0, -11),
+            textcoords="offset points",
+            fontsize=7.8,
+            color=RED,
+            va="top",
+        )
+    area_ax.set_xscale("log")
+    area_ax.set_xlabel("Whole-model throughput (tokens/s, log)")
+    area_ax.set_ylabel("Aggregate silicon area (mm²)")
+    _set_title(
+        area_ax,
+        "Resource envelope",
+        "Only like-for-like aggregate silicon budgets define eligibility",
+    )
+
+    chip_handles = [
+        Line2D(
+            (),
+            (),
+            marker="o",
+            linestyle="none",
+            markerfacecolor=chip_colours[chip_count],
+            markeredgecolor="none",
+            label=f"{chip_count} chip{'s' if chip_count != 1 else ''}",
+        )
+        for chip_count in chip_counts
+    ]
+    family_handles = [
+        Line2D(
+            (),
+            (),
+            marker=marker,
+            linestyle="none",
+            markerfacecolor=GREY,
+            markeredgecolor=INK,
+            label=family.upper(),
+        )
+        for family, marker in family_markers.items()
+        if any(_family(point.profile.weight_format) == family for point in finite)
+    ]
+    fig.legend(
+        handles=[*chip_handles, *family_handles],
+        loc="outside lower center",
+        ncols=min(6, len(chip_handles) + len(family_handles)),
+    )
+    return _save(
+        fig,
+        stem="05_hardware_pareto",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def plot_packedkv_ablation(
+    evidence_path: Path,
+    *,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    evidence = load_packedkv_evidence(evidence_path)
+    report = evaluate_packedkv_publication(evidence)
+    groups = [group for group in evidence.groups if group.topology.role == "gqa8"]
+    groups = sorted(
+        groups,
+        key=lambda group: PRECISION_ROLES.index(group.precision.role),
+    )
+    if tuple(group.precision.role for group in groups) != PRECISION_ROLES:
+        raise ValueError("PackedKV evidence lacks the three Qwen GQA-8 controls")
+    precision_order = [
+        f"{group.precision.role.upper()}\n({group.precision.format_id})"
+        for group in groups
+    ]
+    mode_order = tuple(PACKEDKV_MODES)
+    x = np.arange(len(precision_order), dtype=float)
+    width = 0.19
+    fig, axes = plt.subplots(
+        1,
+        3,
+        figsize=(11.0, 3.9),
+        constrained_layout=True,
+    )
+    fields = (
+        ("read_bytes_per_sequence_token", "HBM read bytes/token", True),
+        ("feasible_batch", "Maximum feasible batch", False),
+        ("capacity_limited_tokens_per_s", "Capacity-limited tokens/s", False),
+    )
+    for axis, (field, label, normalize) in zip(axes, fields):
+        for mode_index, mode in enumerate(mode_order):
+            values = []
+            for group in groups:
+                measurement = group.by_mode()[mode]
+                value = float(getattr(measurement, field))
+                if normalize:
+                    baseline = float(getattr(group.by_mode()[mode_order[0]], field))
+                    value /= baseline
+                values.append(value)
+            axis.bar(
+                x + (mode_index - 1.5) * width,
+                values,
+                width,
+                color=MODE_COLOURS[mode_index],
+                label=mode.replace("_", " ").title(),
+            )
+        axis.set_xticks(x)
+        axis.set_xticklabels(precision_order, rotation=25, ha="right")
+        axis.set_ylabel("Normalized HBM reads (baseline = 1.0)" if normalize else label)
+        axis.set_xlabel("Precision role")
+    _set_title(
+        axes[0],
+        "PackedKV physical traffic",
+        "Qwen GQA-8 · fixed precision, geometry, clock, and HBM",
+    )
+    _set_title(
+        axes[1],
+        "PackedKV capacity",
+        "Maximum batch under the identical physical-capacity model",
+    )
+    _set_title(
+        axes[2],
+        "PackedKV serving throughput",
+        f"Gate status: {'passed' if report.passed else 'not passed'}",
+    )
+    handles, labels = axes[0].get_legend_handles_labels()
+    fig.legend(
+        handles,
+        labels,
+        loc="outside lower center",
+        ncols=len(mode_order),
+    )
+    return _save(
+        fig,
+        stem="06_packedkv_causal_ablation",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _model_validation_table(
+    rows: Sequence[Mapping[str, Any]],
+) -> tuple[dict[str, Any], ...]:
+    """Aggregate validation observations without combining evidence tiers."""
+
+    grouped: dict[tuple[str, str, str], list[tuple[float, float]]] = {}
+    for row in rows:
+        model = str(row.get("model", "")).strip()
+        component = str(row.get("component", "")).strip().lower()
+        tier = str(row.get("evidence_tier", "")).strip()
+        if not model or component not in {"compute", "memory", "area", "power"}:
+            raise ValueError("model-validation rows require a model and known component")
+        if not tier:
+            raise ValueError("model-validation rows require an evidence tier")
+        error = abs(_finite(row.get("relative_error_percent"), "relative error"))
+        elapsed = _finite(row.get("evaluation_seconds"), "evaluation seconds")
+        if elapsed < 0:
+            raise ValueError("evaluation seconds must be non-negative")
+        grouped.setdefault((model, component, tier), []).append((error, elapsed))
+    if not grouped:
+        raise ValueError("model validation requires at least one observation")
+    result = []
+    for (model, component, tier), observations in sorted(grouped.items()):
+        errors = np.asarray([value[0] for value in observations], dtype=float)
+        elapsed = np.asarray([value[1] for value in observations], dtype=float)
+        result.append(
+            {
+                "model": model,
+                "component": component,
+                "evidence_tier": tier,
+                "sample_count": len(observations),
+                "median_absolute_error_percent": float(np.median(errors)),
+                "p95_absolute_error_percent": float(np.percentile(errors, 95)),
+                "average_evaluation_seconds": float(np.mean(elapsed)),
+            }
+        )
+    return tuple(result)
+
+
+def plot_model_validation(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    summary = _model_validation_table(rows)
+    labels = [f"{row['model']}\n{str(row['component']).title()}" for row in summary]
+    # The evidence tier rides in the tick label so it never crosses a bar.
+    tier_labels = [
+        f"{label}\n({str(row['evidence_tier']).replace('_', ' ')})"
+        for label, row in zip(labels, summary)
+    ]
+    x = np.arange(len(summary), dtype=float)
+    median = [float(row["median_absolute_error_percent"]) for row in summary]
+    p95 = [float(row["p95_absolute_error_percent"]) for row in summary]
+    elapsed = [float(row["average_evaluation_seconds"]) for row in summary]
+    width = 0.36
+    fig, (error_ax, time_ax) = plt.subplots(
+        1,
+        2,
+        figsize=(10.8, 4.1),
+        constrained_layout=True,
+        gridspec_kw={"width_ratios": (2.1, 1.0)},
+    )
+    error_ax.bar(x - width / 2, median, width, color=BLUE, label="Median")
+    error_ax.bar(x + width / 2, p95, width, color=ORANGE, label="P95")
+    error_ax.set_xticks(x)
+    error_ax.set_xticklabels(tier_labels, rotation=25, ha="right", fontsize=7.6)
+    error_ax.set_ylabel("Absolute error against reference (%)")
+    error_ax.legend(loc="upper left")
+    _set_title(
+        error_ax,
+        "Analytic-model validation",
+        "Errors remain separated by model, component, and evidence tier",
+    )
+    time_ax.barh(np.arange(len(summary)), elapsed, color=GREEN)
+    time_ax.set_yticks(np.arange(len(summary)))
+    time_ax.set_yticklabels(labels)
+    time_ax.invert_yaxis()
+    time_ax.set_xlabel("Average evaluation time (s)")
+    _set_title(
+        time_ax,
+        "Evaluation cost",
+        "Mean wall time per validation observation",
+    )
+    return _save(
+        fig,
+        stem="07_model_validation",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _stage_breakdown_table(
+    rows: Sequence[Mapping[str, Any]],
+) -> tuple[dict[str, Any], ...]:
+    components = ("matrix_cycles", "vector_cycles", "scalar_cycles", "control_cycles")
+    normalized: dict[tuple[str, str], dict[str, Any]] = {}
+    for row in rows:
+        stage = str(row.get("stage", "")).strip()
+        variant = str(row.get("variant", "")).strip().lower()
+        if not stage or variant not in {"baseline", "enhanced"}:
+            raise ValueError("stage rows require a stage and baseline/enhanced variant")
+        key = (stage, variant)
+        if key in normalized:
+            raise ValueError("stage breakdown contains duplicate stage variants")
+        item: dict[str, Any] = {"stage": stage, "variant": variant}
+        for component in components:
+            value = _finite(row.get(component), component)
+            if value < 0:
+                raise ValueError("cycle counts must be non-negative")
+            item[component] = value
+        item["total_cycles"] = sum(float(item[name]) for name in components)
+        normalized[key] = item
+    # Stages render in decode pipeline order; any stage outside the canonical
+    # pipeline keeps its first-seen position after the known ones.
+    pipeline_order = (
+        "RMSNorm",
+        "QKV projection",
+        "Flash attention",
+        "Residual",
+        "FFN",
+        "LM head",
+    )
+    seen = tuple(dict.fromkeys(stage for stage, _ in normalized))
+    stages = tuple(
+        sorted(
+            seen,
+            key=lambda stage: (
+                pipeline_order.index(stage)
+                if stage in pipeline_order
+                else len(pipeline_order) + seen.index(stage)
+            ),
+        )
+    )
+    if not stages:
+        raise ValueError("stage breakdown requires at least one stage")
+    for stage in stages:
+        if (stage, "baseline") not in normalized or (stage, "enhanced") not in normalized:
+            raise ValueError("every stage requires baseline and enhanced observations")
+        baseline = float(normalized[(stage, "baseline")]["total_cycles"])
+        if baseline <= 0:
+            raise ValueError("baseline stage totals must be positive")
+        for variant in ("baseline", "enhanced"):
+            total = float(normalized[(stage, variant)]["total_cycles"])
+            normalized[(stage, variant)]["delta_from_baseline_percent"] = (
+                100.0 * (total - baseline) / baseline
+            )
+    return tuple(
+        normalized[(stage, variant)]
+        for stage in stages
+        for variant in ("baseline", "enhanced")
+    )
+
+
+def plot_stage_breakdown(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    table = _stage_breakdown_table(rows)
+    by_key = {(str(row["stage"]), str(row["variant"])): row for row in table}
+    stages = tuple(dict.fromkeys(str(row["stage"]) for row in table))
+    x = np.arange(len(stages), dtype=float)
+    width = 0.36
+    component_style = (
+        ("matrix_cycles", "Matrix", BLUE),
+        ("vector_cycles", "Vector", ORANGE),
+        ("scalar_cycles", "Scalar", GREEN),
+        ("control_cycles", "Control", PURPLE),
+    )
+    fig, ax = plt.subplots(figsize=(max(8.5, 1.15 * len(stages)), 4.5), constrained_layout=True)
+    for variant_index, variant in enumerate(("baseline", "enhanced")):
+        bottom = np.zeros(len(stages), dtype=float)
+        offset = (-0.5 if variant == "baseline" else 0.5) * width
+        for component, label, colour in component_style:
+            values = np.asarray(
+                [float(by_key[(stage, variant)][component]) for stage in stages],
+                dtype=float,
+            )
+            ax.bar(
+                x + offset,
+                values,
+                width,
+                bottom=bottom,
+                color=colour,
+                alpha=0.48 if variant == "baseline" else 0.92,
+                label=label if variant == "enhanced" else None,
+            )
+            bottom += values
+        if variant == "enhanced":
+            for index, stage in enumerate(stages):
+                delta = float(by_key[(stage, variant)]["delta_from_baseline_percent"])
+                ax.text(
+                    x[index] + offset,
+                    bottom[index],
+                    f"{delta:+.1f}%",
+                    ha="center",
+                    va="bottom",
+                    fontsize=7.3,
+                    color=INK,
+                )
+    ax.set_xticks(x)
+    ax.set_xticklabels(stages, rotation=25, ha="right")
+    ax.set_ylabel("Cycles")
+    ax.set_xlabel("Decode stage (left bar baseline, right bar enhanced)")
+    fig.legend(loc="outside upper right", ncols=4)
+    _set_title(
+        ax,
+        "Decode-stage cycle composition",
+        "Opaque bars are enhanced RTL; percentage labels report total-cycle change",
+    )
+    return _save(
+        fig,
+        stem="08_decode_stage_breakdown",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _capacity_table(
+    rows: Sequence[Mapping[str, Any]],
+) -> tuple[dict[str, Any], ...]:
+    normalized = []
+    identities: set[tuple[str, int]] = set()
+    for row in rows:
+        kv_format = str(row.get("kv_format", "")).strip()
+        context = int(row.get("context_tokens", 0))
+        if not kv_format or context <= 0:
+            raise ValueError("capacity rows require a KV format and positive context")
+        identity = (kv_format, context)
+        if identity in identities:
+            raise ValueError("capacity rows contain duplicate format/context points")
+        identities.add(identity)
+        item = {
+            "kv_format": kv_format,
+            "context_tokens": context,
+            "kv_bytes_per_token": _finite(row.get("kv_bytes_per_token"), "KV bytes/token"),
+            "feasible_batch": int(row.get("feasible_batch", 0)),
+            "tpot_ms": _finite(row.get("tpot_ms"), "TPOT"),
+        }
+        if any(float(item[name]) <= 0 for name in ("kv_bytes_per_token", "feasible_batch", "tpot_ms")):
+            raise ValueError("capacity metrics must be positive")
+        normalized.append(item)
+    if not normalized:
+        raise ValueError("capacity figure requires at least one row")
+    return tuple(sorted(normalized, key=lambda item: (str(item["kv_format"]), int(item["context_tokens"]))))
+
+
+def plot_decode_capacity(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    table = _capacity_table(rows)
+    formats_present = tuple(sorted({str(row["kv_format"]) for row in table}))
+    fig, (latency_ax, batch_ax, chain_ax) = plt.subplots(
+        1,
+        3,
+        figsize=(12.6, 4.0),
+        constrained_layout=True,
+    )
+    palette = (BLUE, ORANGE, GREEN, PURPLE, SKY, RED, GREY)
+    for index, kv_format in enumerate(formats_present):
+        subset = [row for row in table if row["kv_format"] == kv_format]
+        current = palette[index % len(palette)]
+        contexts = [int(row["context_tokens"]) for row in subset]
+        latency_ax.plot(contexts, [float(row["tpot_ms"]) for row in subset], marker="o", color=current, label=kv_format)
+        batch_ax.plot(contexts, [int(row["feasible_batch"]) for row in subset], marker="o", color=current, label=kv_format)
+        chain_ax.plot(
+            [float(row["kv_bytes_per_token"]) for row in subset],
+            [int(row["feasible_batch"]) for row in subset],
+            marker="o",
+            color=current,
+            label=kv_format,
+        )
+    for axis in (latency_ax, batch_ax):
+        axis.set_xscale("log", base=2)
+        axis.set_xlabel("Context length (tokens, log₂)")
+    latency_ax.set_yscale("log")
+    latency_ax.set_ylabel("TPOT (ms/token, log)")
+    _set_title(latency_ax, "Decode capacity wall", "Latency rises as resident KV traffic grows")
+    batch_ax.set_yscale("log", base=2)
+    batch_ax.set_ylabel("Maximum feasible batch (log₂)")
+    _set_title(batch_ax, "Capacity-enabled batch", "Physical capacity is enforced before throughput ranking")
+    chain_ax.set_xscale("log", base=2)
+    chain_ax.set_yscale("log", base=2)
+    chain_ax.set_xlabel("KV bytes per sequence token (log₂)")
+    chain_ax.set_ylabel("Maximum feasible batch (log₂)")
+    _set_title(chain_ax, "PackedKV causal chain", "KV bytes/token ↓ → feasible batch ↑")
+    handles, labels = latency_ax.get_legend_handles_labels()
+    fig.legend(handles, labels, loc="outside lower center", ncols=max(1, len(labels)))
+    return _save(
+        fig,
+        stem="09_decode_capacity",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _handoff_table(
+    rows: Sequence[Mapping[str, Any]],
+) -> tuple[dict[str, Any], ...]:
+    segments = ("prefill_s", "transfer_s", "admission_s", "wait_s", "host_spill_s")
+    normalized = []
+    regimes: set[str] = set()
+    for row in rows:
+        regime = str(row.get("regime", "")).strip()
+        if not regime or regime in regimes:
+            raise ValueError("handoff rows require unique named regimes")
+        regimes.add(regime)
+        item: dict[str, Any] = {"regime": regime}
+        for name in segments:
+            value = _finite(row.get(name, 0.0), name)
+            if value < 0:
+                raise ValueError("handoff timeline durations must be non-negative")
+            item[name] = value
+        for name in ("ttft_s", "energy_j", "prefill_utilization", "prefill_decode_ratio"):
+            value = _finite(row.get(name), name)
+            if value < 0:
+                raise ValueError("handoff metrics must be non-negative")
+            item[name] = value
+        item["prompt_tokens"] = int(row.get("prompt_tokens", 0))
+        item["generation_tokens"] = int(row.get("generation_tokens", 0))
+        item["precision"] = str(row.get("precision", ""))
+        normalized.append(item)
+    if not normalized:
+        raise ValueError("handoff figure requires at least one row")
+    return tuple(normalized)
+
+
+def plot_handoff_regimes(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    table = _handoff_table(rows)
+    regimes = [str(row["regime"]).replace("_", " ").title() for row in table]
+    y = np.arange(len(table), dtype=float)
+    fig, (timeline_ax, ttft_ax, energy_ax, balance_ax) = plt.subplots(
+        1,
+        4,
+        figsize=(13.6, 4.1),
+        constrained_layout=True,
+        gridspec_kw={"width_ratios": (1.9, 0.8, 0.8, 1.0)},
+    )
+    segment_style = (
+        ("prefill_s", "Prefill", BLUE),
+        ("transfer_s", "KV transfer", ORANGE),
+        ("admission_s", "Admission", GREEN),
+        ("wait_s", "Decode wait", RED),
+        ("host_spill_s", "Host spill", PURPLE),
+    )
+    left = np.zeros(len(table), dtype=float)
+    for name, label, colour in segment_style:
+        values = np.asarray([float(row[name]) for row in table], dtype=float)
+        timeline_ax.barh(y, values, left=left, color=colour, label=label)
+        left += values
+    timeline_ax.set_yticks(y)
+    timeline_ax.set_yticklabels(regimes)
+    timeline_ax.invert_yaxis()
+    timeline_ax.set_xlabel("Critical-path time (s)")
+    # The first (shortest) schedule leaves the upper right of the panel empty.
+    timeline_ax.legend(loc="upper right", ncols=1, fontsize=7.2)
+    _set_title(timeline_ax, "Prefill→decode schedules", "Timeline exposes stalls and PCIe host-spill penalties")
+
+    # TTFT and energy carry different units, so each keeps its own panel and
+    # single axis rather than sharing a dual-scale chart.
+    x = np.arange(len(table), dtype=float)
+    ttft_ax.bar(x, [float(row["ttft_s"]) for row in table], 0.62, color=BLUE)
+    ttft_ax.set_xticks(x)
+    ttft_ax.set_xticklabels(regimes, rotation=30, ha="right")
+    ttft_ax.set_ylabel("TTFT (s)")
+    _set_title(ttft_ax, "Request TTFT", "Critical-path time to first token")
+    energy_ax.bar(
+        x, [float(row["energy_j"]) for row in table], 0.62, color=ORANGE
+    )
+    energy_ax.set_xticks(x)
+    energy_ax.set_xticklabels(regimes, rotation=30, ha="right")
+    energy_ax.set_ylabel("Request energy (J)")
+    _set_title(energy_ax, "Request energy", "Includes spill write and read")
+
+    balance_ax.scatter(
+        [float(row["prefill_decode_ratio"]) for row in table],
+        [100.0 * float(row["prefill_utilization"]) for row in table],
+        c=[
+            (BLUE, ORANGE, GREEN, PURPLE, SKY, RED, GREY)[index % 7]
+            for index in range(len(table))
+        ],
+        s=52,
+    )
+    label_offsets = ((6, 6), (6, -11), (-6, 6))
+    label_alignment = ("left", "left", "right")
+    for index, label in enumerate(regimes):
+        balance_ax.annotate(
+            label,
+            xy=(float(table[index]["prefill_decode_ratio"]), 100.0 * float(table[index]["prefill_utilization"])),
+            xytext=label_offsets[index % len(label_offsets)],
+            textcoords="offset points",
+            ha=label_alignment[index % len(label_alignment)],
+            fontsize=7.0,
+        )
+    balance_ax.set_xlabel("Balanced prefill : decode chip ratio")
+    balance_ax.set_ylabel("Prefill utilisation (%)")
+    balance_ax.set_ylim(0, 105)
+    _set_title(balance_ax, "Pipeline balance", "Ratio, utilisation, prompt, generation, and precision are recorded")
+    return _save(
+        fig,
+        stem="10_handoff_regimes",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _multichip_table(
+    rows: Sequence[Mapping[str, Any]],
+) -> tuple[dict[str, Any], ...]:
+    normalized = []
+    identities: set[tuple[int, int, int]] = set()
+    for row in rows:
+        chips = int(row.get("chip_count", 0))
+        tp = int(row.get("tp", 0))
+        kvp = int(row.get("kvp", 0))
+        if chips <= 0 or tp <= 0 or kvp <= 0 or chips != tp * kvp:
+            raise ValueError("multi-chip rows require CHIP_COUNT = TP × KVP")
+        identity = (chips, tp, kvp)
+        if identity in identities:
+            raise ValueError("multi-chip rows contain duplicate topologies")
+        identities.add(identity)
+        tps = _finite(row.get("tps"), "TPS")
+        energy_j = _finite(row.get("energy_per_token_j"), "energy/token")
+        if tps <= 0 or energy_j <= 0:
+            raise ValueError("multi-chip throughput and energy must be positive")
+        tier_raw = row.get("energy_tier")
+        normalized.append(
+            {
+                "chip_count": chips,
+                "tp": tp,
+                "kvp": kvp,
+                "parallelism": "TP" if kvp == 1 else ("KVP" if tp == 1 else "TP+KVP"),
+                "tps": tps,
+                "energy_per_token_j": energy_j,
+                "tokens_per_joule": 1.0 / energy_j,
+                "energy_tier": str(tier_raw) if tier_raw not in (None, "") else "",
+            }
+        )
+    if not normalized:
+        raise ValueError("multi-chip scaling requires at least one row")
+    return tuple(sorted(normalized, key=lambda item: (int(item["chip_count"]), int(item["tp"]), int(item["kvp"]))))
+
+
+def plot_multichip_scaling(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    output_dir: Path,
+    formats: Sequence[str],
+) -> tuple[Path, ...]:
+    table = _multichip_table(rows)
+    fig, (throughput_ax, efficiency_ax) = plt.subplots(1, 2, figsize=(9.5, 4.0), constrained_layout=True)
+    styles = {
+        "TP": (BLUE, "o"),
+        "KVP": (ORANGE, "s"),
+        "TP+KVP": (GREEN, "D"),
+    }
+    for mode, (colour, marker) in styles.items():
+        subset = [row for row in table if row["parallelism"] == mode]
+        if not subset:
+            continue
+        x = [int(row["chip_count"]) for row in subset]
+        throughput_ax.plot(x, [float(row["tps"]) for row in subset], color=colour, marker=marker, label=mode)
+        efficiency_ax.plot(x, [float(row["tokens_per_joule"]) for row in subset], color=colour, marker=marker, label=mode)
+        for axis, field in ((throughput_ax, "tps"), (efficiency_ax, "tokens_per_joule")):
+            for row in subset:
+                if not row["energy_tier"]:
+                    axis.scatter(int(row["chip_count"]), float(row[field]), facecolors="none", edgecolors=RED, marker=marker, s=70, linewidths=1.1)
+    for axis in (throughput_ax, efficiency_ax):
+        axis.set_xscale("log", base=2)
+        axis.set_xticks(sorted({int(row["chip_count"]) for row in table}))
+        axis.get_xaxis().set_major_formatter(matplotlib.ticker.ScalarFormatter())
+        axis.set_xlabel("Decode chips")
+    throughput_ax.set_ylabel("Throughput (tokens/s)")
+    _set_title(throughput_ax, "Multi-chip throughput", "TP and KVP are explicit rather than an ideal chip-count divider")
+    efficiency_ax.set_ylabel("Energy efficiency (tokens/J)")
+    _set_title(efficiency_ax, "Multi-chip energy efficiency", "Tier-undeclared points are outlined in red")
+    handles, labels = throughput_ax.get_legend_handles_labels()
+    fig.legend(handles, labels, loc="outside lower center", ncols=max(1, len(labels)))
+    return _save(
+        fig,
+        stem="11_multichip_scaling",
+        output_dir=output_dir,
+        formats=formats,
+    )
+
+
+def _load_decode_analysis(path: Path) -> Mapping[str, Any]:
+    """Load the compact artifact that drives decode-specific figures."""
+
+    value = json.loads(path.read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise TypeError("decode analysis must be a JSON object")
+    sections = {
+        "model_validation",
+        "stage_breakdown",
+        "capacity",
+        "handoff",
+        "multichip",
+    }
+    allowed = {"schema_version", "model_name", *sections}
+    if set(value) - allowed:
+        raise ValueError("decode analysis contains unknown fields")
+    if value.get("schema_version") != ANALYSIS_SCHEMA:
+        raise ValueError("decode analysis schema is unsupported")
+    model_name = str(value.get("model_name", "")).strip()
+    if not model_name:
+        raise ValueError("decode analysis requires a model name")
+    normalized: dict[str, Any] = {
+        "schema_version": ANALYSIS_SCHEMA,
+        "model_name": model_name,
+    }
+    for section in sections:
+        rows = value.get(section, [])
+        if not isinstance(rows, list) or any(
+            not isinstance(row, Mapping) for row in rows
+        ):
+            raise TypeError(f"decode analysis section {section!r} must be an object list")
+        normalized[section] = tuple(dict(row) for row in rows)
+    return normalized
+
+
+def _numerical_table(
+    manifest: Any,
+    terminal_rows: Sequence[Mapping[str, Any]],
+    *,
+    reference_nll: float,
+) -> tuple[dict[str, Any], ...]:
+    row_by_id = {str(row["profile_id"]): row for row in terminal_rows}
+    result = []
+    for entry in manifest.entries:
+        profile = entry.profile
+        row = row_by_id.get(entry.profile_id)
+        metrics = row.get("result") if row is not None else None
+        mean_nll = (
+            _finite(metrics.get("mean_nll"), "mean_nll")
+            if isinstance(metrics, Mapping) and row["state"] == "succeeded"
+            else None
+        )
+        result.append(
+            {
+                "ordinal": entry.ordinal,
+                "profile_id": entry.profile_id,
+                "kind": profile.kind,
+                "weight_format": profile.weight_format,
+                "activation_format": profile.activation_format,
+                "key_format": profile.key_format,
+                "value_format": profile.value_format,
+                "vector_format": profile.vector_format,
+                "state": str(row["state"]) if row is not None else "pending",
+                "attempt": int(row["attempt"]) if row is not None else "",
+                "runtime_seconds": (
+                    float(row["runtime_seconds"]) if row is not None else ""
+                ),
+                "mean_nll": mean_nll if mean_nll is not None else "",
+                "delta_nll_from_bf16": (
+                    mean_nll - reference_nll if mean_nll is not None else ""
+                ),
+                "error_class": (
+                    str(row.get("error_class") or "") if row is not None else ""
+                ),
+                "error_message": (
+                    str(row.get("error_message") or "") if row is not None else ""
+                ),
+                "validity_json": (
+                    json.dumps(
+                        row.get("validity"),
+                        sort_keys=True,
+                        separators=(",", ":"),
+                    )
+                    if row is not None
+                    else ""
+                ),
+                "record_hash": (
+                    str(row.get("record_hash") or "") if row is not None else ""
+                ),
+            }
+        )
+    return tuple(result)
+
+
+def _landscape_table(
+    points: Sequence[NumericalPoint],
+    *,
+    reference_nll: float,
+) -> tuple[dict[str, Any], ...]:
+    rows = []
+    for weight_format in DECODE_FORMATS:
+        for kv_format in DECODE_FORMATS:
+            candidates = [
+                point
+                for point in points
+                if point.profile.weight_format == weight_format
+                and point.profile.kv_format == kv_format
+                and point.profile.kind != PROFILE_KIND_BF16_REFERENCE
+            ]
+            if not candidates:
+                raise ValueError("landscape table has incomplete format coverage")
+            best = min(candidates, key=lambda point: (point.mean_nll, point.profile_id))
+            rows.append(
+                {
+                    "weight_format": weight_format,
+                    "kv_format": kv_format,
+                    "best_profile_id": best.profile_id,
+                    "best_activation_format": best.profile.activation_format,
+                    "best_vector_format": best.profile.vector_format,
+                    "best_mean_nll": best.mean_nll,
+                    "best_delta_nll_from_bf16": best.mean_nll - reference_nll,
+                }
+            )
+    return tuple(rows)
+
+
+def _vector_table(
+    points: Sequence[NumericalPoint],
+) -> tuple[dict[str, Any], ...]:
+    controls = {
+        (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        ): point
+        for point in points
+        if point.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+    }
+    rows = []
+    for point in points:
+        if point.profile.kind == PROFILE_KIND_BF16_REFERENCE:
+            continue
+        key = (
+            point.profile.weight_format,
+            point.profile.activation_format,
+            point.profile.kv_format,
+        )
+        control = controls.get(key)
+        if control is None:
+            continue
+        rows.append(
+            {
+                "profile_id": point.profile_id,
+                "control_profile_id": control.profile_id,
+                "weight_format": key[0],
+                "activation_format": key[1],
+                "kv_format": key[2],
+                "vector_format": point.profile.vector_format,
+                "mean_nll": point.mean_nll,
+                "control_mean_nll": control.mean_nll,
+                "paired_delta_nll": point.mean_nll - control.mean_nll,
+            }
+        )
+    return tuple(rows)
+
+
+def _hardware_table(
+    points: Sequence[HardwarePoint],
+) -> tuple[dict[str, Any], ...]:
+    return tuple(
+        {
+            "profile_id": point.profile.profile_id,
+            "candidate_id": point.candidate_id,
+            "weight_format": point.profile.weight_format,
+            "activation_format": point.profile.activation_format,
+            "kv_format": point.profile.kv_format,
+            "vector_format": point.profile.vector_format,
+            "delta_nll": point.delta_nll,
+            "relative_perplexity_increase_percent": (point.relative_perplexity_percent),
+            "whole_model_tpot_ms": point.tpot_ms,
+            "whole_model_tps": point.tps,
+            "energy_j_per_generated_token": point.energy_j,
+            "tokens_per_joule": point.tokens_per_j,
+            "edp_j_s": point.edp_j_s,
+            "energy_tier": point.energy_tier or "",
+            "aggregate_area_mm2": point.area_mm2,
+            "aggregate_area_budget_mm2": point.area_budget_mm2 or "",
+            "max_runtime_batch": point.max_runtime_batch,
+            "chip_count": point.chip_count,
+            "tp": point.tp,
+            "kvp": point.kvp,
+            "retention_labels": ";".join(point.retention_labels),
+            "sample_seed": point.sample_seed or "",
+            "sample_limit": (
+                point.sample_limit if point.sample_limit is not None else ""
+            ),
+            "scatter_population_count": (
+                point.scatter_population_count
+                if point.scatter_population_count is not None
+                else ""
+            ),
+            "dominated_population_count": (
+                point.dominated_population_count
+                if point.dominated_population_count is not None
+                else ""
+            ),
+        }
+        for point in points
+    )
+
+
+def _packedkv_table(evidence: Any) -> tuple[dict[str, Any], ...]:
+    rows = []
+    for group in sorted(evidence.groups, key=lambda item: item.key):
+        for mode in PACKEDKV_MODES:
+            measurement = group.by_mode()[mode]
+            rows.append(
+                {
+                    "precision_role": group.precision.role,
+                    "precision_format": group.precision.format_id,
+                    "topology_role": group.topology.role,
+                    "mode": mode,
+                    "read_bytes_per_sequence_token": (
+                        measurement.read_bytes_per_sequence_token
+                    ),
+                    "feasible_batch": measurement.feasible_batch,
+                    "capacity_limited_tokens_per_s": (
+                        measurement.capacity_limited_tokens_per_s
+                    ),
+                    "tpot_ms": measurement.tpot_ms,
+                }
+            )
+    return tuple(rows)
+
+
+def render(args: argparse.Namespace) -> dict[str, Any]:
+    _configure_style()
+    manifest_path = Path(args.manifest).resolve()
+    numerical_paths = tuple(Path(path).resolve() for path in args.numerical)
+    output_dir = Path(args.output_dir).resolve()
+    output_dir.mkdir(parents=True, exist_ok=True)
+    formats = tuple(args.formats)
+    manifest, points, terminal_rows = _load_numerical_points(
+        manifest_path,
+        numerical_paths,
+        require_complete=not args.allow_incomplete,
+        stage="numerical-screen",
+    )
+    sweep_provenance_path = manifest_path.parent / "provenance.json"
+    sweep_provenance = _load_sweep_provenance(
+        sweep_provenance_path,
+        manifest,
+    )
+    portable_provenance_path = _copy_sweep_provenance(
+        sweep_provenance_path,
+        output_dir,
+        expected_content_hash=str(sweep_provenance["content_hash"]),
+    )
+    reference_nll = _reference_nll(points)
+    outputs: list[Path] = []
+    data_tables: list[Path] = []
+    omitted_figures: list[dict[str, str]] = []
+    outputs.extend(
+        plot_completion_matrix(
+            manifest,
+            terminal_rows,
+            model_name=manifest.model_name,
+            output_dir=output_dir,
+            formats=formats,
+        )
+    )
+    numerical_table = _numerical_table(
+        manifest,
+        terminal_rows,
+        reference_nll=reference_nll,
+    )
+    data_tables.append(
+        _write_csv(
+            output_dir / "00_numerical_completion_data.csv",
+            numerical_table,
+            fieldnames=tuple(numerical_table[0]),
+        )
+    )
+
+    def render_numerical_figure(name: str, callback: Any) -> None:
+        try:
+            outputs.extend(callback())
+        except ValueError as exc:
+            if not args.allow_incomplete:
+                raise
+            omitted_figures.append({"figure": name, "reason": str(exc)})
+
+    render_numerical_figure(
+        "accuracy_by_weight",
+        lambda: plot_accuracy_by_weight(
+            points,
+            reference_nll=reference_nll,
+            model_name=manifest.model_name,
+            output_dir=output_dir,
+            formats=formats,
+        ),
+    )
+    weight_rows = tuple(
+        row
+        for row in numerical_table
+        if row["state"] == "succeeded" and row["kind"] != PROFILE_KIND_BF16_REFERENCE
+    )
+    if weight_rows:
+        data_tables.append(
+            _write_csv(
+                output_dir / "01_accuracy_by_weight_data.csv",
+                weight_rows,
+                fieldnames=tuple(weight_rows[0]),
+            )
+        )
+    render_numerical_figure(
+        "weight_kv_accuracy_landscape",
+        lambda: plot_accuracy_landscape(
+            points,
+            reference_nll=reference_nll,
+            model_name=manifest.model_name,
+            output_dir=output_dir,
+            formats=formats,
+        ),
+    )
+    try:
+        landscape_rows = _landscape_table(
+            points,
+            reference_nll=reference_nll,
+        )
+    except ValueError:
+        if not args.allow_incomplete:
+            raise
+    else:
+        data_tables.append(
+            _write_csv(
+                output_dir / "02_weight_kv_accuracy_landscape_data.csv",
+                landscape_rows,
+                fieldnames=tuple(landscape_rows[0]),
+            )
+        )
+    render_numerical_figure(
+        "vector_precision_sensitivity",
+        lambda: plot_vector_sensitivity(
+            points,
+            reference_nll=reference_nll,
+            model_name=manifest.model_name,
+            output_dir=output_dir,
+            formats=formats,
+        ),
+    )
+    vector_rows = _vector_table(points)
+    if vector_rows:
+        data_tables.append(
+            _write_csv(
+                output_dir / "03_vector_precision_sensitivity_data.csv",
+                vector_rows,
+                fieldnames=tuple(vector_rows[0]),
+            )
+        )
+
+    fidelity: dict[str, Any] | None = None
+    publication_selection: dict[str, Any] | None = None
+    source_paths = [manifest_path, *numerical_paths]
+    if args.validation_numerical:
+        validation_paths = tuple(
+            Path(path).resolve() for path in args.validation_numerical
+        )
+        (
+            validation_manifest,
+            validation_points,
+            _,
+        ) = _load_numerical_points(
+            manifest_path,
+            validation_paths,
+            require_complete=False,
+            stage="hardware-validation",
+        )
+        if validation_manifest.canonical_hash != manifest.canonical_hash:
+            raise ValueError("validation results use a different manifest")
+        fidelity_outputs, fidelity = plot_screening_fidelity(
+            points,
+            validation_points,
+            model_name=manifest.model_name,
+            output_dir=output_dir,
+            formats=formats,
+        )
+        outputs.extend(fidelity_outputs)
+        screening_by_id = {point.profile_id: point for point in points}
+        validation_by_id = {point.profile_id: point for point in validation_points}
+        common_ids = tuple(sorted(set(screening_by_id) & set(validation_by_id)))
+        screen_ranks = _average_ranks(
+            [screening_by_id[profile_id].mean_nll for profile_id in common_ids]
+        )
+        validation_ranks = _average_ranks(
+            [validation_by_id[profile_id].mean_nll for profile_id in common_ids]
+        )
+        fidelity_rows = tuple(
+            {
+                "profile_id": profile_id,
+                "weight_format": screening_by_id[profile_id].profile.weight_format,
+                "activation_format": screening_by_id[
+                    profile_id
+                ].profile.activation_format,
+                "kv_format": screening_by_id[profile_id].profile.kv_format,
+                "vector_format": screening_by_id[profile_id].profile.vector_format,
+                "numerical_screen_mean_nll": screening_by_id[profile_id].mean_nll,
+                "hardware_validation_mean_nll": validation_by_id[profile_id].mean_nll,
+                "numerical_screen_rank": float(screen_ranks[index]),
+                "hardware_validation_rank": float(validation_ranks[index]),
+            }
+            for index, profile_id in enumerate(common_ids)
+        )
+        data_tables.append(
+            _write_csv(
+                output_dir / "04_screening_fidelity_data.csv",
+                fidelity_rows,
+                fieldnames=tuple(fidelity_rows[0]),
+            )
+        )
+        source_paths.extend(validation_paths)
+
+    profile_by_id = {point.profile_id: point.profile for point in points}
+    nll_by_id = {point.profile_id: point.mean_nll for point in points}
+    if args.hardware_artifact:
+        raw_hardware_paths = (
+            (args.hardware_artifact,)
+            if isinstance(args.hardware_artifact, (str, Path))
+            else tuple(args.hardware_artifact)
+        )
+        hardware_paths = tuple(
+            Path(path).resolve() for path in raw_hardware_paths
+        )
+        hardware_points = tuple(
+            point
+            for hardware_path in hardware_paths
+            for point in _load_hardware_points(
+                hardware_path,
+                profile_by_id=profile_by_id,
+                nll_by_id=nll_by_id,
+                reference_nll=reference_nll,
+            )
+        )
+        hardware_identities = tuple(
+            (point.profile_id, point.candidate_id) for point in hardware_points
+        )
+        if len(hardware_identities) != len(set(hardware_identities)):
+            raise ValueError("hardware artifact partitions overlap")
+        outputs.extend(
+            plot_hardware_pareto(
+                hardware_points,
+                model_name=manifest.model_name,
+                output_dir=output_dir,
+                formats=formats,
+            )
+        )
+        hardware_rows = _hardware_table(hardware_points)
+        data_tables.append(
+            _write_csv(
+                output_dir / "05_hardware_pareto_data.csv",
+                hardware_rows,
+                fieldnames=tuple(hardware_rows[0]),
+            )
+        )
+        for hardware_path in hardware_paths:
+            source_paths.append(hardware_path)
+            metadata_path = hardware_path.with_name(
+                f"{hardware_path.name}.meta.json"
+            )
+            if metadata_path.is_file():
+                source_paths.append(metadata_path)
+    if args.packedkv_evidence:
+        packedkv_path = Path(args.packedkv_evidence).resolve()
+        packedkv_evidence = load_packedkv_evidence(packedkv_path)
+        outputs.extend(
+            plot_packedkv_ablation(
+                packedkv_path,
+                output_dir=output_dir,
+                formats=formats,
+            )
+        )
+        packedkv_rows = _packedkv_table(packedkv_evidence)
+        data_tables.append(
+            _write_csv(
+                output_dir / "06_packedkv_causal_ablation_data.csv",
+                packedkv_rows,
+                fieldnames=tuple(packedkv_rows[0]),
+            )
+        )
+        source_paths.append(packedkv_path)
+    if args.decode_analysis:
+        analysis_path = Path(args.decode_analysis).resolve()
+        analysis = _load_decode_analysis(analysis_path)
+        if analysis["model_name"] != manifest.model_name:
+            raise ValueError("decode analysis uses a different model")
+        analysis_specs = (
+            (
+                "model_validation",
+                plot_model_validation,
+                _model_validation_table,
+                "07_model_validation_data.csv",
+            ),
+            (
+                "stage_breakdown",
+                plot_stage_breakdown,
+                _stage_breakdown_table,
+                "08_decode_stage_breakdown_data.csv",
+            ),
+            (
+                "capacity",
+                plot_decode_capacity,
+                _capacity_table,
+                "09_decode_capacity_data.csv",
+            ),
+            (
+                "handoff",
+                plot_handoff_regimes,
+                _handoff_table,
+                "10_handoff_regimes_data.csv",
+            ),
+            (
+                "multichip",
+                plot_multichip_scaling,
+                _multichip_table,
+                "11_multichip_scaling_data.csv",
+            ),
+        )
+        for section, plotter, table_builder, filename in analysis_specs:
+            rows = analysis[section]
+            if not rows:
+                continue
+            outputs.extend(
+                plotter(rows, output_dir=output_dir, formats=formats)
+            )
+            table = table_builder(rows)
+            data_tables.append(
+                _write_csv(
+                    output_dir / filename,
+                    table,
+                    fieldnames=tuple(table[0]),
+                )
+            )
+        source_paths.append(analysis_path)
+
+    publication_inputs = {
+        "config": getattr(args, "config", None),
+        "gpu_baseline_report": getattr(args, "gpu_baseline_report", None),
+        "gpu_baseline_receipt": getattr(args, "gpu_baseline_receipt", None),
+        "publication_contract": getattr(args, "publication_contract", None),
+        "publication_report": getattr(args, "publication_report", None),
+        "final_selection": getattr(args, "final_selection", None),
+        "refined_hardware_artifact": getattr(
+            args,
+            "refined_hardware_artifact",
+            None,
+        ),
+    }
+    supplied_publication_inputs = {
+        name: value
+        for name, value in publication_inputs.items()
+        if value is not None
+    }
+    if supplied_publication_inputs and len(supplied_publication_inputs) != len(
+        publication_inputs
+    ):
+        missing = sorted(set(publication_inputs) - set(supplied_publication_inputs))
+        raise ValueError(
+            "selected-deployment rendering requires all publication inputs; "
+            "missing " + ", ".join(missing)
+        )
+    if supplied_publication_inputs:
+        publication_paths = {
+            name: Path(str(value)).resolve()
+            for name, value in publication_inputs.items()
+        }
+        selected_rows, publication_selection = _load_selected_publication_rows(
+            config_path=publication_paths["config"],
+            manifest=manifest,
+            gpu_baseline_report_path=publication_paths[
+                "gpu_baseline_report"
+            ],
+            gpu_baseline_receipt_path=publication_paths[
+                "gpu_baseline_receipt"
+            ],
+            publication_contract_path=publication_paths[
+                "publication_contract"
+            ],
+            publication_report_path=publication_paths["publication_report"],
+            final_selection_path=publication_paths["final_selection"],
+            refined_hardware_artifact_path=publication_paths[
+                "refined_hardware_artifact"
+            ],
+        )
+        outputs.extend(
+            plot_selected_deployment_evidence(
+                selected_rows,
+                model_name=manifest.model_name,
+                output_dir=output_dir,
+                formats=formats,
+            )
+        )
+        data_tables.append(
+            _write_csv(
+                output_dir / "12_selected_deployment_data.csv",
+                selected_rows,
+                fieldnames=tuple(selected_rows[0]),
+            )
+        )
+        source_paths.extend(publication_paths.values())
+        refined_metadata = publication_paths[
+            "refined_hardware_artifact"
+        ].with_name(
+            f"{publication_paths['refined_hardware_artifact'].name}.meta.json"
+        )
+        if refined_metadata.is_file():
+            source_paths.append(refined_metadata)
+
+    terminal_counts: dict[str, int] = {}
+    for row in terminal_rows:
+        state = str(row["state"])
+        terminal_counts[state] = terminal_counts.get(state, 0) + 1
+    resolved_sources = tuple(
+        sorted(
+            {
+                source_file.resolve()
+                for path in source_paths
+                for source_file in _source_files(path)
+            },
+            key=str,
+        )
+    )
+    generator_path = Path(__file__).resolve()
+    receipt = {
+        "schema_version": FIGURE_SCHEMA,
+        "manifest_hash": manifest.canonical_hash,
+        "model_name": manifest.model_name,
+        "reference_mean_nll": reference_nll,
+        "allow_incomplete": bool(args.allow_incomplete),
+        "command": [sys.executable, "-m", "decode_dse.plots", *sys.argv[1:]],
+        "generator": {
+            "path": str(generator_path),
+            "sha256": _sha256(generator_path),
+        },
+        "rendering": {
+            "png_dpi": FIGURE_DPI,
+            "formats": list(formats),
+            "font_embedding": {
+                "pdf_fonttype": 42,
+                "svg_fonttype": "none",
+            },
+        },
+        "selection_policy": {
+            "accuracy": "successful numerical rows only; exact format IDs",
+            "vector_attribution": (
+                "paired to the vector-BF16 control with identical W/A/KV"
+            ),
+            "hardware": (
+                "deployment_valid rows with rankable whole-model timing and "
+                "explicit analytic-anchored or DC-calibrated energy"
+            ),
+            "packedkv": "checksum-valid packedkv-publication-evidence/v4",
+            "decode_analysis": ANALYSIS_SCHEMA,
+            "selected_deployment": (
+                "post-accuracy exact refined-hardware join with a separately "
+                "validated measured GPU denominator"
+            ),
+            "cross_tier_ratio": "forbidden",
+            "peak_roofline": "separate from the headline comparison",
+        },
+        "terminal_counts": terminal_counts,
+        "fidelity": fidelity,
+        "publication_selection": publication_selection,
+        "omitted_figures": omitted_figures,
+        "sources": [
+            {
+                "path": str(path),
+                "sha256": _sha256(path),
+                "size_bytes": path.stat().st_size,
+            }
+            for path in resolved_sources
+        ],
+        "figures": [
+            {
+                "path": str(path),
+                "sha256": _sha256(path),
+                "size_bytes": path.stat().st_size,
+            }
+            for path in outputs
+        ],
+        "data_tables": [
+            {
+                "path": str(path),
+                "sha256": _sha256(path),
+                "size_bytes": path.stat().st_size,
+            }
+            for path in data_tables
+        ],
+    }
+    results_provenance = _build_results_provenance(
+        sweep_provenance_path=portable_provenance_path,
+        sweep_provenance=sweep_provenance,
+        manifest=manifest,
+        data_tables=data_tables,
+    )
+    results_provenance_path = output_dir / "sweep_results_provenance.json"
+    _write_json(results_provenance_path, results_provenance)
+    receipt["results_provenance"] = {
+        "path": str(results_provenance_path),
+        "content_hash": results_provenance["content_hash"],
+        "schema_version": RESULTS_PROVENANCE_SCHEMA,
+    }
+    receipt_path = output_dir / "figure_manifest.json"
+    _write_json(receipt_path, receipt)
+    return receipt | {"receipt_path": str(receipt_path)}
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description=(
+            "Render publication figures from checksum-verified numerical and "
+            "hardware artifacts."
+        )
+    )
+    parser.add_argument("--manifest", required=True)
+    parser.add_argument(
+        "--numerical",
+        action="append",
+        required=True,
+        help=(
+            "Numerical-screen result directory or JSONL file; repeat for "
+            "multiple shards."
+        ),
+    )
+    parser.add_argument(
+        "--validation-numerical",
+        action="append",
+        help=(
+            "Higher-fidelity result directory or JSONL file; repeat for "
+            "multiple shards to render the screening-fidelity figure."
+        ),
+    )
+    parser.add_argument(
+        "--hardware-artifact",
+        action="append",
+        help="Checksum-verified hardware partition; repeat for sharded studies.",
+    )
+    parser.add_argument("--config")
+    parser.add_argument("--gpu-baseline-report")
+    parser.add_argument("--gpu-baseline-receipt")
+    parser.add_argument("--publication-contract")
+    parser.add_argument("--publication-report")
+    parser.add_argument("--final-selection")
+    parser.add_argument("--refined-hardware-artifact")
+    parser.add_argument("--packedkv-evidence")
+    parser.add_argument(
+        "--decode-analysis",
+        help=(
+            "Compact JSON artifact for validation, stage, capacity, handoff, "
+            "and multi-chip figures."
+        ),
+    )
+    parser.add_argument("--output-dir", required=True)
+    parser.add_argument(
+        "--formats",
+        nargs="+",
+        choices=("png", "pdf", "svg"),
+        default=("png", "pdf", "svg"),
+    )
+    parser.add_argument(
+        "--allow-incomplete",
+        action="store_true",
+        help="Render diagnostics from a partial numerical run.",
+    )
+    return parser
+
+
+def main(argv: Iterable[str] | None = None) -> int:
+    args = _parser().parse_args(tuple(argv) if argv is not None else None)
+    receipt = render(args)
+    print(json.dumps(receipt, indent=2, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/decode_dse/profiles.py b/decode_dse/profiles.py
new file mode 100644
index 0000000..69b6bd0
--- /dev/null
+++ b/decode_dse/profiles.py
@@ -0,0 +1,589 @@
+"""Canonical precision profiles for the exhaustive decode sweep."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from dataclasses import dataclass
+from types import MappingProxyType
+from typing import Any, Iterable, Mapping
+
+PROFILE_SCHEMA = "decode-precision-profile"
+MATRIX_SEMANTICS_SCHEMA = "plena-matrix-semantics"
+MX_BLOCK_SIZE = 8
+MX_SCALE_FORMAT = "E8M0"
+MX_SCALE_BITS = 8
+MXINT_MATRIX_RULE = "block8_range_safe_scale_widened_mac_max_shift16_rne_vector"
+MXFP_MATRIX_RULE = "product_cast_to_m_fp_then_fixed16_16_bank"
+MIXED_MATRIX_RULE = "deployment_unsupported_without_trace_evidence"
+ACCUMULATOR_RULE = "plena_fixed16_16_accumulate_truncate"
+OUTPUT_RULE = "truncate_to_vector_format"
+MXINT_MAX_SHIFT = 16
+FIXED_ACCUMULATOR_INTEGER_BITS = 16
+FIXED_ACCUMULATOR_FRACTION_BITS = 16
+M_FP_FORMAT_BINDING = "profile.vector_format"
+MATRIX_STORAGE_FP_BINDING = "profile.vector_format"
+MATRIX_INSTRUCTION_K_PARTITION = "MLEN"
+QK_LOGICAL_K_PARTITION = "HLEN"
+MXINT_PARTIAL_CONVERSION = "per_mm_ic_integer_reduction_to_vector_storage_fp"
+MXINT_CROSS_INSTRUCTION_ACCUMULATION = "signed_fixed16_16_wraparound"
+
+MXINT_FORMATS = ("MXINT2", "MXINT4", "MXINT8")
+MXFP_FORMATS = ("E1M2", "E2M1", "E3M4", "E4M3", "E5M2")
+DECODE_FORMATS = MXINT_FORMATS + MXFP_FORMATS
+VECTOR_FP_FORMATS = (
+    "FP_E3M2",
+    "FP_E2M3",
+    "FP_E6M5",
+    "FP_E5M6",
+    "FP_E4M7",
+    "FP_E8M5",
+)
+VECTOR_FORMATS = VECTOR_FP_FORMATS + ("BF16",)
+
+PROFILE_KIND_QUANTIZED = "quantized"
+PROFILE_KIND_VECTOR_BF16_CONTROL = "vector_bf16_control"
+PROFILE_KIND_BF16_REFERENCE = "bf16_reference"
+PROFILE_KINDS = (
+    PROFILE_KIND_QUANTIZED,
+    PROFILE_KIND_VECTOR_BF16_CONTROL,
+    PROFILE_KIND_BF16_REFERENCE,
+)
+
+DEFAULT_WEIGHT_OPERATORS = (
+    "attention_linear",
+    "ffn_linear",
+)
+DEFAULT_ACTIVATION_OPERATORS = (
+    "attention_linear",
+    "ffn_linear",
+    "qk_matmul",
+    "pv_matmul",
+)
+DEFAULT_KV_OPERATORS = (
+    "kv_cache",
+    "qk_matmul",
+    "pv_matmul",
+)
+DEFAULT_VECTOR_OPERATORS = (
+    "input_rmsnorm",
+    "post_attention_rmsnorm",
+    "q_norm",
+    "k_norm",
+    "rope",
+    "softmax",
+    "silu_gate",
+    "residual",
+    "final_rmsnorm",
+)
+DEFAULT_BF16_OPERATORS = (
+    "embedding",
+    "lm_head",
+)
+
+
+@dataclass(frozen=True)
+class FormatDescriptor:
+    """Structural properties of one canonical numeric format."""
+
+    token: str
+    family: str
+    element_bits: int
+    exponent_bits: int | None = None
+    mantissa_bits: int | None = None
+    signed: bool = True
+    block_scaled: bool = False
+
+
+def _make_descriptors() -> dict[str, FormatDescriptor]:
+    descriptors: dict[str, FormatDescriptor] = {}
+    for token in MXINT_FORMATS:
+        width = int(token.removeprefix("MXINT"))
+        descriptors[token] = FormatDescriptor(
+            token=token,
+            family="mxint",
+            element_bits=width,
+            signed=True,
+            block_scaled=True,
+        )
+    for token in MXFP_FORMATS:
+        exponent, mantissa = token.removeprefix("E").split("M")
+        descriptors[token] = FormatDescriptor(
+            token=token,
+            family="mxfp",
+            element_bits=1 + int(exponent) + int(mantissa),
+            exponent_bits=int(exponent),
+            mantissa_bits=int(mantissa),
+            signed=True,
+            block_scaled=True,
+        )
+    for token in VECTOR_FP_FORMATS:
+        exponent, mantissa = token.removeprefix("FP_E").split("M")
+        descriptors[token] = FormatDescriptor(
+            token=token,
+            family="fp",
+            element_bits=1 + int(exponent) + int(mantissa),
+            exponent_bits=int(exponent),
+            mantissa_bits=int(mantissa),
+            signed=True,
+            block_scaled=False,
+        )
+    descriptors["BF16"] = FormatDescriptor(
+        token="BF16",
+        family="bf16",
+        element_bits=16,
+        exponent_bits=8,
+        mantissa_bits=7,
+        signed=True,
+        block_scaled=False,
+    )
+    return descriptors
+
+
+FORMAT_DESCRIPTORS: Mapping[str, FormatDescriptor] = MappingProxyType(
+    _make_descriptors()
+)
+
+
+def format_descriptor(token: str) -> FormatDescriptor:
+    """Return format metadata without converting formats to effective bits."""
+
+    canonical = str(token).upper()
+    if canonical in MXFP_FORMATS or canonical in MXINT_FORMATS or canonical == "BF16":
+        pass
+    elif canonical.startswith("FP_"):
+        pass
+    elif canonical in {token.removeprefix("FP_") for token in VECTOR_FP_FORMATS}:
+        canonical = f"FP_{canonical}"
+    try:
+        return FORMAT_DESCRIPTORS[canonical]
+    except KeyError as exc:
+        raise ValueError(f"unsupported precision format {token!r}") from exc
+
+
+def _canonical_json(value: Mapping[str, Any]) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
+
+
+@dataclass(frozen=True)
+class MatrixSemanticsContract:
+    """Versioned matrix arithmetic rules implemented by the PLENA datapath."""
+
+    schema_version: str = MATRIX_SEMANTICS_SCHEMA
+    block_size: int = MX_BLOCK_SIZE
+    mxint_rule: str = MXINT_MATRIX_RULE
+    mxint_max_shift: int = MXINT_MAX_SHIFT
+    mxint_vector_rounding: str = "round_to_nearest_even"
+    mxint_partial_conversion: str = MXINT_PARTIAL_CONVERSION
+    mxint_cross_instruction_accumulation: str = (
+        MXINT_CROSS_INSTRUCTION_ACCUMULATION
+    )
+    mxfp_rule: str = MXFP_MATRIX_RULE
+    m_fp_format_binding: str = M_FP_FORMAT_BINDING
+    matrix_storage_fp_binding: str = MATRIX_STORAGE_FP_BINDING
+    matrix_instruction_k_partition: str = MATRIX_INSTRUCTION_K_PARTITION
+    qk_logical_k_partition: str = QK_LOGICAL_K_PARTITION
+    fixed_accumulator_integer_bits: int = FIXED_ACCUMULATOR_INTEGER_BITS
+    fixed_accumulator_fraction_bits: int = FIXED_ACCUMULATOR_FRACTION_BITS
+    accumulator_rule: str = ACCUMULATOR_RULE
+    output_rule: str = OUTPUT_RULE
+    mixed_family_rule: str = MIXED_MATRIX_RULE
+    mixed_family_deployment_supported: bool = False
+
+    def __post_init__(self) -> None:
+        expected = {
+            "schema_version": MATRIX_SEMANTICS_SCHEMA,
+            "block_size": MX_BLOCK_SIZE,
+            "mxint_rule": MXINT_MATRIX_RULE,
+            "mxint_max_shift": MXINT_MAX_SHIFT,
+            "mxint_vector_rounding": "round_to_nearest_even",
+            "mxint_partial_conversion": MXINT_PARTIAL_CONVERSION,
+            "mxint_cross_instruction_accumulation": (
+                MXINT_CROSS_INSTRUCTION_ACCUMULATION
+            ),
+            "mxfp_rule": MXFP_MATRIX_RULE,
+            "m_fp_format_binding": M_FP_FORMAT_BINDING,
+            "matrix_storage_fp_binding": MATRIX_STORAGE_FP_BINDING,
+            "matrix_instruction_k_partition": MATRIX_INSTRUCTION_K_PARTITION,
+            "qk_logical_k_partition": QK_LOGICAL_K_PARTITION,
+            "fixed_accumulator_integer_bits": FIXED_ACCUMULATOR_INTEGER_BITS,
+            "fixed_accumulator_fraction_bits": FIXED_ACCUMULATOR_FRACTION_BITS,
+            "accumulator_rule": ACCUMULATOR_RULE,
+            "output_rule": OUTPUT_RULE,
+            "mixed_family_rule": MIXED_MATRIX_RULE,
+            "mixed_family_deployment_supported": False,
+        }
+        for field, required in expected.items():
+            if getattr(self, field) != required:
+                raise ValueError(
+                    f"unsupported matrix semantics field {field!r}: "
+                    f"{getattr(self, field)!r}"
+                )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "block_size": self.block_size,
+            "mxint_rule": self.mxint_rule,
+            "mxint_max_shift": self.mxint_max_shift,
+            "mxint_vector_rounding": self.mxint_vector_rounding,
+            "mxint_partial_conversion": self.mxint_partial_conversion,
+            "mxint_cross_instruction_accumulation": (
+                self.mxint_cross_instruction_accumulation
+            ),
+            "mxfp_rule": self.mxfp_rule,
+            "m_fp_format_binding": self.m_fp_format_binding,
+            "matrix_storage_fp_binding": self.matrix_storage_fp_binding,
+            "matrix_instruction_k_partition": (
+                self.matrix_instruction_k_partition
+            ),
+            "qk_logical_k_partition": self.qk_logical_k_partition,
+            "fixed_accumulator_integer_bits": self.fixed_accumulator_integer_bits,
+            "fixed_accumulator_fraction_bits": self.fixed_accumulator_fraction_bits,
+            "accumulator_rule": self.accumulator_rule,
+            "output_rule": self.output_rule,
+            "mixed_family_rule": self.mixed_family_rule,
+            "mixed_family_deployment_supported": (
+                self.mixed_family_deployment_supported
+            ),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "MatrixSemanticsContract":
+        expected_fields = set(cls().to_dict())
+        if set(value) != expected_fields:
+            raise ValueError("matrix semantics fields differ from the schema")
+        deployment_supported = value["mixed_family_deployment_supported"]
+        if not isinstance(deployment_supported, bool):
+            raise TypeError("mixed_family_deployment_supported must be boolean")
+        return cls(
+            schema_version=str(value["schema_version"]),
+            block_size=int(value["block_size"]),
+            mxint_rule=str(value["mxint_rule"]),
+            mxint_max_shift=int(value["mxint_max_shift"]),
+            mxint_vector_rounding=str(value["mxint_vector_rounding"]),
+            mxint_partial_conversion=str(value["mxint_partial_conversion"]),
+            mxint_cross_instruction_accumulation=str(
+                value["mxint_cross_instruction_accumulation"]
+            ),
+            mxfp_rule=str(value["mxfp_rule"]),
+            m_fp_format_binding=str(value["m_fp_format_binding"]),
+            matrix_storage_fp_binding=str(
+                value["matrix_storage_fp_binding"]
+            ),
+            matrix_instruction_k_partition=str(
+                value["matrix_instruction_k_partition"]
+            ),
+            qk_logical_k_partition=str(value["qk_logical_k_partition"]),
+            fixed_accumulator_integer_bits=int(
+                value["fixed_accumulator_integer_bits"]
+            ),
+            fixed_accumulator_fraction_bits=int(
+                value["fixed_accumulator_fraction_bits"]
+            ),
+            accumulator_rule=str(value["accumulator_rule"]),
+            output_rule=str(value["output_rule"]),
+            mixed_family_rule=str(value["mixed_family_rule"]),
+            mixed_family_deployment_supported=deployment_supported,
+        )
+
+
+MATRIX_SEMANTICS = MatrixSemanticsContract()
+
+
+@dataclass(frozen=True)
+class DecodePrecisionProfile:
+    """Immutable numerical contract shared by every decode subsystem."""
+
+    kind: str
+    weight_format: str
+    activation_format: str
+    key_format: str
+    value_format: str
+    vector_format: str
+    block_size: int = MX_BLOCK_SIZE
+    scale_format: str = MX_SCALE_FORMAT
+    scale_bits: int = MX_SCALE_BITS
+    accumulator_rule: str = ACCUMULATOR_RULE
+    output_rule: str = OUTPUT_RULE
+    matrix_semantics: MatrixSemanticsContract = MATRIX_SEMANTICS
+    method: str = "rtn"
+    weight_operators: tuple[str, ...] = DEFAULT_WEIGHT_OPERATORS
+    activation_operators: tuple[str, ...] = DEFAULT_ACTIVATION_OPERATORS
+    kv_operators: tuple[str, ...] = DEFAULT_KV_OPERATORS
+    vector_operators: tuple[str, ...] = DEFAULT_VECTOR_OPERATORS
+    bf16_operators: tuple[str, ...] = DEFAULT_BF16_OPERATORS
+    schema_version: str = PROFILE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != PROFILE_SCHEMA:
+            raise ValueError(f"unsupported profile schema {self.schema_version!r}")
+        if self.kind not in PROFILE_KINDS:
+            raise ValueError(f"unsupported profile kind {self.kind!r}")
+        if self.block_size != MX_BLOCK_SIZE:
+            raise ValueError(f"decode sweep requires block size {MX_BLOCK_SIZE}")
+        if self.method != "rtn":
+            raise ValueError("the exhaustive sweep foundation requires RTN")
+        if self.key_format != self.value_format:
+            raise ValueError("K and V must use the same storage format")
+        if self.accumulator_rule != ACCUMULATOR_RULE:
+            raise ValueError(f"unsupported accumulator rule {self.accumulator_rule!r}")
+        if self.output_rule != OUTPUT_RULE:
+            raise ValueError(f"unsupported output rule {self.output_rule!r}")
+        if self.matrix_semantics != MATRIX_SEMANTICS:
+            raise ValueError("unsupported matrix semantics contract")
+        if self.matrix_semantics.block_size != self.block_size:
+            raise ValueError("profile and matrix-semantics block sizes differ")
+        if self.matrix_semantics.accumulator_rule != self.accumulator_rule:
+            raise ValueError("profile and matrix-semantics accumulator rules differ")
+        if self.matrix_semantics.output_rule != self.output_rule:
+            raise ValueError("profile and matrix-semantics output rules differ")
+
+        if self.kind == PROFILE_KIND_BF16_REFERENCE:
+            if any(
+                token != "BF16"
+                for token in (
+                    self.weight_format,
+                    self.activation_format,
+                    self.key_format,
+                    self.value_format,
+                    self.vector_format,
+                )
+            ):
+                raise ValueError("the BF16 reference must use BF16 for every role")
+            if self.scale_format != "NONE" or self.scale_bits != 0:
+                raise ValueError("the BF16 reference has no shared MX scale")
+            return
+
+        for role, token in (
+            ("weight", self.weight_format),
+            ("activation", self.activation_format),
+            ("key", self.key_format),
+            ("value", self.value_format),
+        ):
+            if token not in DECODE_FORMATS:
+                raise ValueError(f"{role} format {token!r} is outside the decode sweep")
+        if self.scale_format != MX_SCALE_FORMAT or self.scale_bits != MX_SCALE_BITS:
+            raise ValueError("quantized profiles require an 8-bit E8M0 shared scale")
+        if self.kind == PROFILE_KIND_QUANTIZED and self.vector_format not in VECTOR_FP_FORMATS:
+            raise ValueError("quantized profiles require one canonical vector FP setting")
+        if self.kind == PROFILE_KIND_VECTOR_BF16_CONTROL and self.vector_format != "BF16":
+            raise ValueError("vector controls must keep vector operations in BF16")
+
+    @classmethod
+    def quantized(
+        cls,
+        weight_format: str,
+        activation_format: str,
+        kv_format: str,
+        vector_format: str,
+    ) -> "DecodePrecisionProfile":
+        return cls(
+            kind=PROFILE_KIND_QUANTIZED,
+            weight_format=weight_format,
+            activation_format=activation_format,
+            key_format=kv_format,
+            value_format=kv_format,
+            vector_format=vector_format,
+        )
+
+    @classmethod
+    def vector_bf16_control(
+        cls,
+        weight_format: str,
+        activation_format: str,
+        kv_format: str,
+    ) -> "DecodePrecisionProfile":
+        return cls(
+            kind=PROFILE_KIND_VECTOR_BF16_CONTROL,
+            weight_format=weight_format,
+            activation_format=activation_format,
+            key_format=kv_format,
+            value_format=kv_format,
+            vector_format="BF16",
+        )
+
+    @classmethod
+    def bf16_reference(cls) -> "DecodePrecisionProfile":
+        return cls(
+            kind=PROFILE_KIND_BF16_REFERENCE,
+            weight_format="BF16",
+            activation_format="BF16",
+            key_format="BF16",
+            value_format="BF16",
+            vector_format="BF16",
+            scale_format="NONE",
+            scale_bits=0,
+        )
+
+    @property
+    def kv_format(self) -> str:
+        return self.key_format
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "kind": self.kind,
+            "weight_format": self.weight_format,
+            "activation_format": self.activation_format,
+            "key_format": self.key_format,
+            "value_format": self.value_format,
+            "vector_format": self.vector_format,
+            "block_size": self.block_size,
+            "scale_format": self.scale_format,
+            "scale_bits": self.scale_bits,
+            "accumulator_rule": self.accumulator_rule,
+            "output_rule": self.output_rule,
+            "matrix_semantics": self.matrix_semantics.to_dict(),
+            "method": self.method,
+            "operator_coverage": {
+                "weight": list(self.weight_operators),
+                "activation": list(self.activation_operators),
+                "kv": list(self.kv_operators),
+                "vector": list(self.vector_operators),
+                "bf16": list(self.bf16_operators),
+            },
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DecodePrecisionProfile":
+        expected_fields = set(cls.quantized(
+            "MXINT4", "MXINT4", "MXINT4", "FP_E3M2"
+        ).to_dict())
+        if set(value) != expected_fields:
+            raise ValueError("profile fields differ from the schema")
+        if value["schema_version"] != PROFILE_SCHEMA:
+            raise ValueError(f"unsupported profile schema {value['schema_version']!r}")
+        coverage = value["operator_coverage"]
+        if not isinstance(coverage, Mapping) or set(coverage) != {
+            "weight",
+            "activation",
+            "kv",
+            "vector",
+            "bf16",
+        }:
+            raise ValueError("operator_coverage fields differ from the schema")
+
+        def operators(field: str) -> tuple[str, ...]:
+            items = coverage[field]
+            if (
+                not isinstance(items, list)
+                or not items
+                or any(not isinstance(item, str) or not item for item in items)
+            ):
+                raise TypeError(f"operator_coverage.{field} must be a string list")
+            return tuple(items)
+
+        return cls(
+            schema_version=str(value["schema_version"]),
+            kind=str(value["kind"]),
+            weight_format=str(value["weight_format"]),
+            activation_format=str(value["activation_format"]),
+            key_format=str(value["key_format"]),
+            value_format=str(value["value_format"]),
+            vector_format=str(value["vector_format"]),
+            block_size=int(value["block_size"]),
+            scale_format=str(value["scale_format"]),
+            scale_bits=int(value["scale_bits"]),
+            accumulator_rule=str(value["accumulator_rule"]),
+            output_rule=str(value["output_rule"]),
+            matrix_semantics=MatrixSemanticsContract.from_dict(
+                value["matrix_semantics"]
+            ),
+            method=str(value["method"]),
+            weight_operators=operators("weight"),
+            activation_operators=operators("activation"),
+            kv_operators=operators("kv"),
+            vector_operators=operators("vector"),
+            bf16_operators=operators("bf16"),
+        )
+
+    @property
+    def canonical_json(self) -> str:
+        return _canonical_json(self.to_dict())
+
+    @property
+    def canonical_hash(self) -> str:
+        return hashlib.sha256(self.canonical_json.encode("utf-8")).hexdigest()
+
+    @property
+    def profile_id(self) -> str:
+        return f"dqp-{self.canonical_hash}"
+
+
+def iter_quantized_profiles() -> Iterable[DecodePrecisionProfile]:
+    """Yield all 3,072 quantized profiles in canonical nested-loop order."""
+
+    for weight_format in DECODE_FORMATS:
+        for activation_format in DECODE_FORMATS:
+            for kv_format in DECODE_FORMATS:
+                for vector_format in VECTOR_FP_FORMATS:
+                    yield DecodePrecisionProfile.quantized(
+                        weight_format,
+                        activation_format,
+                        kv_format,
+                        vector_format,
+                    )
+
+
+def iter_vector_bf16_controls() -> Iterable[DecodePrecisionProfile]:
+    """Yield one BF16-vector control for every W/A/KV triple."""
+
+    for weight_format in DECODE_FORMATS:
+        for activation_format in DECODE_FORMATS:
+            for kv_format in DECODE_FORMATS:
+                yield DecodePrecisionProfile.vector_bf16_control(
+                    weight_format,
+                    activation_format,
+                    kv_format,
+                )
+
+
+def enumerate_decode_profiles() -> tuple[DecodePrecisionProfile, ...]:
+    """Return the deterministic 3,585-point numerical sweep."""
+
+    return (
+        *iter_quantized_profiles(),
+        *iter_vector_bf16_controls(),
+        DecodePrecisionProfile.bf16_reference(),
+    )
+
+
+__all__ = [
+    "DECODE_FORMATS",
+    "ACCUMULATOR_RULE",
+    "FIXED_ACCUMULATOR_FRACTION_BITS",
+    "FIXED_ACCUMULATOR_INTEGER_BITS",
+    "FORMAT_DESCRIPTORS",
+    "MATRIX_SEMANTICS",
+    "MATRIX_SEMANTICS_SCHEMA",
+    "MIXED_MATRIX_RULE",
+    "M_FP_FORMAT_BINDING",
+    "MATRIX_STORAGE_FP_BINDING",
+    "MATRIX_INSTRUCTION_K_PARTITION",
+    "QK_LOGICAL_K_PARTITION",
+    "MXINT_PARTIAL_CONVERSION",
+    "MXINT_CROSS_INSTRUCTION_ACCUMULATION",
+    "MX_BLOCK_SIZE",
+    "MXFP_MATRIX_RULE",
+    "MXINT_MATRIX_RULE",
+    "MXINT_MAX_SHIFT",
+    "MX_SCALE_BITS",
+    "MX_SCALE_FORMAT",
+    "MXFP_FORMATS",
+    "MXINT_FORMATS",
+    "PROFILE_KIND_BF16_REFERENCE",
+    "PROFILE_KIND_QUANTIZED",
+    "PROFILE_KIND_VECTOR_BF16_CONTROL",
+    "PROFILE_SCHEMA",
+    "VECTOR_FORMATS",
+    "VECTOR_FP_FORMATS",
+    "DecodePrecisionProfile",
+    "FormatDescriptor",
+    "MatrixSemanticsContract",
+    "OUTPUT_RULE",
+    "enumerate_decode_profiles",
+    "format_descriptor",
+    "iter_quantized_profiles",
+    "iter_vector_bf16_controls",
+]
diff --git a/decode_dse/scripts/launch_pipeline.sh b/decode_dse/scripts/launch_pipeline.sh
new file mode 100644
index 0000000..665d411
--- /dev/null
+++ b/decode_dse/scripts/launch_pipeline.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Publication pipeline launcher.
+#
+# The lazy compiler-trace path imports `asm_templates` as a top-level package
+# (compiler frontend), which requires PLENA_Simulator/compiler and
+# PLENA_Simulator/PLENA_Tools on PYTHONPATH; the in-process sys.path injection
+# covers only the simulator root and analytic_models/performance. Launching
+# through this script makes runs independent of ambient shell state.
+set -euo pipefail
+
+SOFTWARE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SIMULATOR_ROOT="${PLENA_SIMULATOR_PATH:-$(dirname "$SOFTWARE_ROOT")/PLENA_Simulator}"
+
+if [[ ! -d "$SIMULATOR_ROOT/analytic_models/performance" ]]; then
+    echo "PLENA_Simulator not found at $SIMULATOR_ROOT; set PLENA_SIMULATOR_PATH" >&2
+    exit 2
+fi
+
+export PLENA_SIMULATOR_PATH="$SIMULATOR_ROOT"
+export PYTHONPATH="$SIMULATOR_ROOT/compiler:$SIMULATOR_ROOT/PLENA_Tools${PYTHONPATH:+:$PYTHONPATH}"
+
+cd "$SOFTWARE_ROOT"
+exec "$SOFTWARE_ROOT/.venv/bin/python" -m decode_dse.software.sweep "$@"
diff --git a/decode_dse/simulator_bridge.py b/decode_dse/simulator_bridge.py
new file mode 100644
index 0000000..6da42ca
--- /dev/null
+++ b/decode_dse/simulator_bridge.py
@@ -0,0 +1,1147 @@
+"""In-process bridge to the PLENA decode-chip analytic model.
+
+The analytic model (`analytic_models/performance/disagg_decode.py`) uses
+script-style imports and ships no installable package, so it can't be
+pip-imported. This module is the only place that reaches into it: it adds the
+performance directory to `sys.path` once, imports the helpers, and re-exports a
+small typed surface (`Precision`, `DecodeMetrics`, `DecodeSimulator`). Everything
+else in the DSE imports from here, so if the simulator becomes a real package
+only this file changes.
+
+Set ``PLENA_SIMULATOR_PATH`` to the simulator checkout; the default is the
+``PLENA_Simulator`` checkout beside this repository.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import sys
+from dataclasses import dataclass
+from functools import lru_cache
+from pathlib import Path
+from typing import Any, Callable, Iterable, Protocol
+
+_DEFAULT_SIM_ROOT = str(
+    Path(__file__).resolve().parents[2] / "PLENA_Simulator"
+)
+_BANDWIDTH_TRAFFIC_CLASSES = ("weights_kv", "activations", "writeback")
+STEP_COMPOSITION = "max_compute_memory"
+COMPILER_TRACE_POINT_SCHEMA = "plena-compiler-trace-point-v1"
+FULL_MODEL_DECODE_SCOPE = "full_model_decode_step_independent_request_batch"
+_CONTENT_ADDRESSED_ID = re.compile(
+    r"^[a-z][a-z0-9]*(?:-[a-z0-9]+)*-[0-9a-f]{64}$"
+)
+
+
+def _require_content_addressed_id(
+    name: str,
+    value: str,
+    prefix: str,
+) -> None:
+    if (
+        not isinstance(value, str)
+        or not _CONTENT_ADDRESSED_ID.fullmatch(value)
+        or not value.startswith(prefix)
+    ):
+        raise ValueError(f"{name} must be a content-addressed identity")
+
+
+def _canonical_json(value: Any) -> str:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    )
+
+
+def _sha256_file(path: str | os.PathLike[str]) -> str:
+    return hashlib.sha256(Path(path).read_bytes()).hexdigest()
+
+
+def _model_mapping(value: Any) -> dict[str, Any]:
+    if hasattr(value, "model_dump"):
+        result = value.model_dump(mode="json")
+    elif hasattr(value, "dict"):
+        result = value.dict()
+    else:
+        raise TypeError("simulator configuration is not serializable")
+    if not isinstance(result, dict):
+        raise TypeError("simulator configuration must serialize to an object")
+    return result
+
+
+def _sim_root() -> Path:
+    root = Path(os.environ.get("PLENA_SIMULATOR_PATH", _DEFAULT_SIM_ROOT)).expanduser()
+    perf = root / "analytic_models" / "performance"
+    if not perf.exists():
+        raise FileNotFoundError(
+            f"PLENA_Simulator not found at {root} (missing {perf}). Clone it or set "
+            f"PLENA_SIMULATOR_PATH to the checkout root."
+        )
+    return root
+
+
+@lru_cache(maxsize=1)
+def _disagg():
+    """Import and return the disagg_decode module, injecting sys.path once."""
+    root = _sim_root()
+    perf = root / "analytic_models" / "performance"
+    if str(root) not in sys.path:
+        # Compiler-trace timing imports the simulator packages by qualified
+        # name, while the historical analytic model uses script-style imports.
+        sys.path.insert(0, str(root))
+    if str(perf) not in sys.path:
+        # Importing the module also puts memory/utilisation/roofline on sys.path.
+        sys.path.insert(0, str(perf))
+    import disagg_decode  # noqa: E402  (import deferred until path is set)
+
+    return disagg_decode
+
+
+def default_model_lib() -> Path:
+    return _sim_root() / "compiler" / "doc" / "Model_Lib"
+
+
+def resolve_model_json(model: str, model_lib: str | os.PathLike | None = None) -> str:
+    """Accept either a full path to a model JSON or a bare name in the Model_Lib."""
+    p = Path(model)
+    if p.suffix == ".json" and p.exists():
+        return str(p.resolve())
+    lib = Path(model_lib) if model_lib else default_model_lib()
+    candidate = lib / (model if model.endswith(".json") else f"{model}.json")
+    if not candidate.exists():
+        raise FileNotFoundError(f"model config {candidate} not found (model={model!r}).")
+    return str(candidate.resolve())
+
+
+# ---------------------------------------------------------------------------
+# Typed surface
+# ---------------------------------------------------------------------------
+@dataclass(frozen=True)
+class Precision:
+    """A decode precision point in the analytic model's native shape.
+
+    `spec` is the dict `disagg_decode.evaluate` consumes; the scalar fields are
+    kept alongside it for logging and for the software-DSE CSV bridge.
+    """
+
+    spec: dict[str, Any]
+    w_fmt: str
+    kv_fmt: str
+    attn_w: Any
+    ffn_w: Any
+    kv: Any
+    block: int
+    m_bits: int
+    key_fmt: str | None = None
+    value_fmt: str | None = None
+    key: Any = None
+    value: Any = None
+
+    @property
+    def attn_eff_bits(self) -> float:
+        return self.spec["attn_bits"]
+
+    @property
+    def ffn_eff_bits(self) -> float:
+        return self.spec["ffn_bits"]
+
+    @property
+    def kv_eff_bits(self) -> float:
+        return self.spec["kv_bits"]
+
+    @property
+    def key_eff_bits(self) -> float:
+        return self.spec.get("key_bits", self.spec["kv_bits"])
+
+    @property
+    def value_eff_bits(self) -> float:
+        return self.spec.get("value_bits", self.spec["kv_bits"])
+
+    @property
+    def stream_bits(self) -> int:
+        return _disagg().stream_bits(self.spec)
+
+    @property
+    def tag(self) -> str:
+        a = self.spec["attn_label"]
+        f = self.spec["ffn_label"]
+        k = self.spec.get("key_label", self.spec["kv_label"])
+        v = self.spec.get("value_label", self.spec["kv_label"])
+        m = f"_M{self.m_bits}" if self.m_bits else ""
+        return f"attn-{a}__ffn-{f}__key-{k}__value-{v}{m}"
+
+
+@dataclass(frozen=True)
+class CompilerTracePointDescriptor:
+    """Immutable lowering and timing inputs for one exact DSE point."""
+
+    canonical_json: str
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.canonical_json, str):
+            raise TypeError("compiler trace point must use canonical JSON")
+        value = json.loads(self.canonical_json)
+        if not isinstance(value, dict):
+            raise TypeError("compiler trace point must be an object")
+        if value.get("schema_version") != COMPILER_TRACE_POINT_SCHEMA:
+            raise ValueError("unsupported compiler trace point schema")
+        if value.get("artifact_scope") != FULL_MODEL_DECODE_SCOPE:
+            raise ValueError("compiler trace point lacks full-model decode scope")
+        if self.canonical_json != _canonical_json(value):
+            raise ValueError("compiler trace point JSON is not canonical")
+
+    @classmethod
+    def from_mapping(
+        cls,
+        value: dict[str, Any],
+    ) -> "CompilerTracePointDescriptor":
+        return cls(_canonical_json(value))
+
+    @property
+    def descriptor_sha256(self) -> str:
+        return hashlib.sha256(self.canonical_json.encode("utf-8")).hexdigest()
+
+    def to_dict(self) -> dict[str, Any]:
+        return json.loads(self.canonical_json)
+
+
+class CompilerTraceRequestBinder(Protocol):
+    """Bind a fresh context-request factory to one immutable DSE point."""
+
+    def bind(
+        self,
+        point: CompilerTracePointDescriptor,
+    ) -> Callable[[int], Any]:
+        ...
+
+
+@dataclass(frozen=True)
+class DecodeMetrics:
+    """The subset of `disagg_decode.evaluate` output the DSE optimises on.
+
+    ``n_chips`` is the chip count the point was evaluated at. With ``n_chips=0``
+    (auto) the model adds chips until the footprint fits, so ``fits_in_hbm`` is
+    always true — a search that wants the HBM-fit constraint to bind must pin
+    ``n_chips`` (the co-design pins 1).
+    """
+
+    tps: float
+    tpot: float
+    total_time: float
+    first_step: float
+    frac_mem_bound: float
+    frac_classical_mem_bound: float
+    frac_architecture_issue_mem_bound: float
+    frac_algorithmic_mem_bound: float
+    frac_serialization_bound: float
+    fits_in_hbm: bool
+    hbm_required: float
+    area_mm2: float
+    # Legacy alias for bytes per batch decode step.
+    avg_bytes_per_token: float
+    # A batch step emits one token for each active sequence.
+    avg_hbm_bytes_per_batch_step: float
+    avg_hbm_bytes_per_generated_token: float
+    hbm_traffic_per_batch_step: tuple[tuple[str, float], ...]
+    hbm_traffic_per_generated_token: tuple[tuple[str, float], ...]
+    mem_bound: bool
+    bottleneck: str
+    classical_roofline_bottleneck: str
+    architecture_issue_bottleneck: str
+    n_chips: int
+    # Largest batch whose weights+KV fit the evaluated HBM capacity. KV precision
+    # moves this smoothly, so it stays a throughput signal even when a compute
+    # ceiling flattens per-batch TPS.
+    max_batch: int = 0
+    max_resident_batch: int = 0
+    max_synchronous_batch: int = 0
+    max_runtime_batch: int = 0
+    fits_onchip_sram: bool = False
+    fits_runtime: bool = False
+    hbm_capacity: int = 0
+    runtime_hbm_reserve_bytes: int = 0
+    weight_element_plane_bytes: int = 0
+    weight_scale_plane_bytes: int = 0
+    weight_bf16_bytes: int = 0
+    kv_element_plane_bytes: int = 0
+    kv_scale_plane_bytes: int = 0
+    vector_sram_capacity_bytes: int = 0
+    vector_sram_required_bytes: int = 0
+    matrix_sram_capacity_bytes: int = 0
+    matrix_sram_required_bytes: int = 0
+    timing_mode: str = "rtl_serialized"
+    timing_calibrated: bool = False
+    timing_reason: str = "missing_timing_evidence"
+    timing_evidence_id: str | None = None
+    timing_evidence_tier: str | None = None
+    packed_q1_timing_validated: bool = False
+    packed_q1_timing_reason: str = "missing_packed_q1_timing_contract"
+    packed_q1_timing_contract_id: str | None = None
+    bandwidth_calibration_id: str | None = None
+    kv_layout: str = "dense_selector"
+    kv_layout_id: str = ""
+    output_head_location: str = "decode_bf16_unmodeled"
+    avg_peak_compute_seconds: float | None = None
+    avg_ideal_compute_seconds: float | None = None
+    avg_realized_compute_seconds: float | None = None
+    avg_memory_seconds: float | None = None
+    step_composition: str = STEP_COMPOSITION
+    execution_mode: str = "legacy_aggregate_bandwidth"
+    compiler_trace_timing: dict[str, Any] | None = None
+
+
+@dataclass(frozen=True)
+class HBMOperatingPointStatus:
+    """Calibration support for one generation, rate, and interface-unit count."""
+
+    generation: str
+    interface_units: int
+    pin_rate_gbps: float
+    technology_schema: str
+    source_url: str
+    source_label: str
+    emulator_generation: str | None
+    emulator_pin_rate_gbps: float | None
+    hbm_width_bits: int
+    hbm_capacity_bytes: int
+    calibration_id: str | None
+    calibrated_channel_min: int | None
+    calibrated_channel_max: int | None
+    rankable: bool
+    reason: str
+
+    def __post_init__(self) -> None:
+        if not self.generation:
+            raise ValueError("HBM generation must be non-empty")
+        if self.interface_units <= 0:
+            raise ValueError("HBM interface-unit count must be positive")
+        if self.pin_rate_gbps <= 0:
+            raise ValueError("HBM pin rate must be positive")
+        if (
+            not self.technology_schema
+            or not self.source_url
+            or not self.source_label
+        ):
+            raise ValueError("HBM technology provenance must be non-empty")
+        if (self.emulator_generation is None) != (
+            self.emulator_pin_rate_gbps is None
+        ):
+            raise ValueError("HBM emulator identity and rate must be paired")
+        if (
+            self.emulator_pin_rate_gbps is not None
+            and self.emulator_pin_rate_gbps <= 0
+        ):
+            raise ValueError("HBM emulator rate must be positive")
+        if self.hbm_width_bits <= 0 or self.hbm_width_bits % 8:
+            raise ValueError("HBM width must be a positive whole-byte value")
+        if self.hbm_capacity_bytes <= 0:
+            raise ValueError("HBM capacity must be positive")
+        bounds = (
+            self.calibrated_channel_min,
+            self.calibrated_channel_max,
+        )
+        if (bounds[0] is None) != (bounds[1] is None):
+            raise ValueError("HBM calibration bounds must be paired")
+        if (
+            bounds[0] is not None
+            and (bounds[0] <= 0 or bounds[1] < bounds[0])
+        ):
+            raise ValueError("HBM calibration bounds are invalid")
+        if self.rankable != bool(self.calibration_id):
+            raise ValueError("rankable HBM points require a calibration identity")
+        if self.calibration_id is not None:
+            _require_content_addressed_id(
+                "HBM calibration",
+                self.calibration_id,
+                "bandwidth-operating-point-",
+            )
+        if not self.reason:
+            raise ValueError("HBM operating-point reason must be non-empty")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "generation": self.generation,
+            "interface_unit_bits": 64,
+            "interface_units": self.interface_units,
+            "pin_rate_gbps": self.pin_rate_gbps,
+            "technology_schema": self.technology_schema,
+            "source_url": self.source_url,
+            "source_label": self.source_label,
+            "emulator_generation": self.emulator_generation,
+            "emulator_pin_rate_gbps": self.emulator_pin_rate_gbps,
+            "hbm_width_bits": self.hbm_width_bits,
+            "hbm_capacity_bytes": self.hbm_capacity_bytes,
+            "calibration_id": self.calibration_id,
+            "calibrated_channel_min": self.calibrated_channel_min,
+            "calibrated_channel_max": self.calibrated_channel_max,
+            "rankable": self.rankable,
+            "reason": self.reason,
+        }
+
+
+class DecodeSimulator:
+    """Evaluator for one model: loads dims / base hardware / base memory once,
+    then evaluates (precision, hardware, batch) points cheaply.
+
+    All config parsing happens in ``__init__``, so an Optuna loop calling
+    :meth:`evaluate` thousands of times pays only the per-point arithmetic.
+    """
+
+    def __init__(
+        self,
+        model: str,
+        *,
+        model_lib: str | os.PathLike | None = None,
+        settings_toml: str | os.PathLike | None = None,
+        isa_path: str | os.PathLike | None = None,
+        timing_mode: str = "rtl_serialized",
+        timing_evidence: str | os.PathLike | None = None,
+        packed_q1_timing_contract: str | os.PathLike | None = None,
+    ):
+        dd = _disagg()
+        root = _sim_root()
+        self._dd = dd
+        self.model = model
+        self.model_json = resolve_model_json(model, model_lib)
+        self.settings_toml = str(
+            Path(settings_toml) if settings_toml else root / "plena_settings.toml"
+        )
+        self.isa_path = str(
+            Path(isa_path)
+            if isa_path
+            else root / "analytic_models" / "performance" / "customISA_lib.json"
+        )
+        self.dims = dd.load_model_dims(self.model_json)
+        self.base_hw = dd.load_hardware_config_from_toml(self.settings_toml)
+        self.base_mem = dd.load_memory_config_from_toml(self.settings_toml)
+        self.timing_mode = timing_mode
+        self.timing_evidence = (
+            dd.TimingEvidence.load(timing_evidence)
+            if timing_evidence is not None
+            else None
+        )
+        self.packed_q1_timing_contract = (
+            dd.PackedQ1TimingContract.load(packed_q1_timing_contract)
+            if packed_q1_timing_contract is not None
+            else None
+        )
+        self.execution_mode = dd.LEGACY_AGGREGATE_BANDWIDTH
+        self.trace_timing_provider = None
+        self.trace_request_binder = None
+
+    # -- precision construction ---------------------------------------------
+    #
+    # Two compute widths:
+    #   N — the HBM stream widths (attnW / ffnW / KV). Set memory time and the
+    #       MLEN bandwidth cap.
+    #   M — the MAC operand width. The array multiplies weight x activation (FFN)
+    #       and KV x activation (attention), and activations are computed at low
+    #       precision inside the array (stored bf16 on-chip), so M must cover
+    #       max(weights, KV, activation), not just the widest weight.
+    #   density_exp — iso-area density exponent k: an M-bit array fits (4/M)^k x
+    #       the reference multipliers. Default 0.0 assumes narrow operands are
+    #       upcast back to full compute, which fits a memory-bound decode chip
+    #       whose gain comes from effective bandwidth. Set k=2.0 to enable the
+    #       density layer once a Synopsys-DC sweep calibrates it.
+    DENSITY_EXP: float = 0.0
+
+    def make_precision(
+        self,
+        *,
+        attn_w: Any,
+        ffn_w: Any,
+        kv: Any = None,
+        key: Any = None,
+        value: Any = None,
+        w_fmt: str = "mxint",
+        kv_fmt: str = "mxint",
+        key_fmt: str | None = None,
+        value_fmt: str | None = None,
+        block: int = 8,
+        act_w: Any = None,
+        act_fmt: str = "mxint",
+        m_bits: int = 0,
+        density_exp: float | None = None,
+    ) -> Precision:
+        """Build a decode precision from per-component widths.
+
+        Widths are ints for MXINT (e.g. 4) and (exp, frac) tuples or "E2M1"
+        tokens for MXFP. attn and ffn share the weight format with independent
+        widths; KV has its own, so MXINT weights + MXFP KV is expressible.
+        ``act_w`` is the activation compute width (a MAC operand; stored bf16
+        on-chip, never in HBM). ``m_bits`` overrides M (0 = max operand width,
+        activations included).
+        """
+        dd = self._dd
+
+        def _w(fmt: str, tok: Any):
+            if fmt == "mxint":
+                return int(tok)
+            return dd.MXFP_FORMATS[tok] if isinstance(tok, str) else tuple(tok)
+
+        if key is None and value is None:
+            if kv is None:
+                raise ValueError("precision requires KV or distinct key/value widths")
+            key = value = kv
+        elif key is None or value is None or kv is not None:
+            raise ValueError("key and value widths must be supplied together without KV")
+        key_fmt = kv_fmt if key_fmt is None else key_fmt
+        value_fmt = kv_fmt if value_fmt is None else value_fmt
+        aw, fw = _w(w_fmt, attn_w), _w(w_fmt, ffn_w)
+        key_width = _w(key_fmt, key)
+        value_width = _w(value_fmt, value)
+        elems = [dd.element_bits(w_fmt, aw), dd.element_bits(w_fmt, fw),
+                 dd.element_bits(key_fmt, key_width),
+                 dd.element_bits(value_fmt, value_width)]
+        if act_w is not None:
+            elems.append(dd.element_bits(act_fmt, _w(act_fmt, act_w)))
+        spec = dd.precision_from_components(
+            dd.effective_bits(w_fmt, aw, block),
+            dd.effective_bits(w_fmt, fw, block),
+            (
+                dd.effective_bits(key_fmt, key_width, block)
+                + dd.effective_bits(value_fmt, value_width, block)
+            )
+            / 2.0,
+            dd.width_label(w_fmt, aw),
+            dd.width_label(w_fmt, fw),
+            (
+                dd.width_label(key_fmt, key_width)
+                if key_fmt == value_fmt and key_width == value_width
+                else (
+                    f"K_{dd.width_label(key_fmt, key_width)}__"
+                    f"V_{dd.width_label(value_fmt, value_width)}"
+                )
+            ),
+            attn_elem=elems[0],
+            ffn_elem=elems[1],
+            kv_elem=max(elems[2:4]),
+            key_bits=dd.effective_bits(key_fmt, key_width, block),
+            value_bits=dd.effective_bits(value_fmt, value_width, block),
+            key_label=dd.width_label(key_fmt, key_width),
+            value_label=dd.width_label(value_fmt, value_width),
+            key_elem=elems[2],
+            value_elem=elems[3],
+            m_bits=m_bits or max(elems),
+            density_exp=self.DENSITY_EXP if density_exp is None else density_exp,
+            block_size=block,
+        )
+        return Precision(
+            spec,
+            w_fmt,
+            key_fmt if key_fmt == value_fmt else "split",
+            aw,
+            fw,
+            key_width if key_width == value_width else (key_width, value_width),
+            block,
+            spec["m_bits"],
+            key_fmt,
+            value_fmt,
+            key_width,
+            value_width,
+        )
+
+    def precision_from_eff_bits(
+        self,
+        attn_bits: float,
+        ffn_bits: float,
+        kv_bits: float,
+        *,
+        act_bits: float | None = None,
+        block: int = 8,
+        m_bits: int = 0,
+        density_exp: float | None = None,
+    ) -> Precision:
+        """Rebuild a precision from effective-bit numbers (the software-DSE CSV
+        columns).
+
+        Element widths subtract the per-block scale share before rounding.
+        ``act_bits`` is the activation compute width; it joins the operand max
+        for M but never the HBM stream."""
+        dd = self._dd
+        scale_share = dd.SCALE_BITS / block
+
+        def _elem(bits: float) -> int:
+            return max(1, round(float(bits) - scale_share))
+
+        elems = [_elem(attn_bits), _elem(ffn_bits), _elem(kv_bits)]
+        if act_bits is not None:
+            elems.append(_elem(act_bits))
+        spec = dd.precision_from_components(
+            attn_bits, ffn_bits, kv_bits,
+            attn_elem=elems[0], ffn_elem=elems[1], kv_elem=elems[2],
+            m_bits=m_bits or max(elems),
+            density_exp=self.DENSITY_EXP if density_exp is None else density_exp,
+            block_size=block,
+        )
+        return Precision(
+            spec, "mxint", "mxint",
+            spec["attn_elem"], spec["ffn_elem"], spec["kv_elem"], block, spec["m_bits"],
+        )
+
+    def precision_from_row(self, row: dict[str, Any], **kw) -> Precision:
+        """Precision for one software-DSE CSV row (as parsed by
+        ``attn_bits``, ``ffn_bits``, ``kv_bits``, and ``act_bits`` fields."""
+        return self.precision_from_eff_bits(
+            row["attn_bits"], row["ffn_bits"], row["kv_bits"],
+            act_bits=row.get("act_bits"), block=int(row.get("block") or 8), **kw,
+        )
+
+    # -- hardware helpers ----------------------------------------------------
+    def hbm_overrides(self, gen: str, channels: int = 0) -> dict[str, int]:
+        """HBM_WIDTH + HBM_SIZE for an HBM generation x channel count.
+
+        HBM is fixed technology: bandwidth and capacity move together, so this
+        is the only sanctioned way to change either.
+        """
+        if channels < 0:
+            raise ValueError("HBM channels must be non-negative")
+        if gen not in self._dd.HBM_GENS:
+            raise ValueError(f"unsupported HBM generation {gen!r}")
+        ov = self._dd.hbm_overrides(gen, channels)
+        return {"HBM_WIDTH": ov["HBM_WIDTH"], "HBM_SIZE": ov["HBM_SIZE"]}
+
+    def hbm_operating_point(
+        self,
+        gen: str,
+        channels: int,
+    ) -> HBMOperatingPointStatus:
+        """Return exact calibration scope without extrapolating channel counts."""
+
+        if channels <= 0:
+            raise ValueError("HBM interface-unit count must be positive")
+        technology = self._dd.hbm_technology(gen)
+        overrides = self.hbm_overrides(gen, channels)
+        bw_model = getattr(self, "_bw_model", None)
+        if bw_model is None:
+            return HBMOperatingPointStatus(
+                generation=technology.generation,
+                interface_units=channels,
+                pin_rate_gbps=technology.pin_rate_gbps,
+                technology_schema=technology.schema_version,
+                source_url=technology.source_url,
+                source_label=technology.source_label,
+                emulator_generation=technology.emulator_generation,
+                emulator_pin_rate_gbps=technology.emulator_pin_rate_gbps,
+                hbm_width_bits=overrides["HBM_WIDTH"],
+                hbm_capacity_bytes=overrides["HBM_SIZE"],
+                calibration_id=None,
+                calibrated_channel_min=None,
+                calibrated_channel_max=None,
+                rankable=False,
+                reason="peak_bandwidth_sensitivity",
+            )
+
+        calibration_id = bw_model.operating_point_calibration_id(
+            technology.generation,
+            technology.pin_rate_gbps,
+        )
+        if calibration_id is None:
+            return HBMOperatingPointStatus(
+                generation=technology.generation,
+                interface_units=channels,
+                pin_rate_gbps=technology.pin_rate_gbps,
+                technology_schema=technology.schema_version,
+                source_url=technology.source_url,
+                source_label=technology.source_label,
+                emulator_generation=technology.emulator_generation,
+                emulator_pin_rate_gbps=technology.emulator_pin_rate_gbps,
+                hbm_width_bits=overrides["HBM_WIDTH"],
+                hbm_capacity_bytes=overrides["HBM_SIZE"],
+                calibration_id=None,
+                calibrated_channel_min=None,
+                calibrated_channel_max=None,
+                rankable=False,
+                reason="generation_rate_not_calibrated",
+            )
+
+        channel_sets = [
+            tuple(bw_model.channel_counts(name, technology.generation))
+            for name in _BANDWIDTH_TRAFFIC_CLASSES
+        ]
+        size_model = getattr(bw_model, "size_model", None)
+        if size_model is not None:
+            channel_sets.append(
+                tuple(size_model.channel_counts(technology.generation))
+            )
+        if not channel_sets or any(not values for values in channel_sets):
+            return HBMOperatingPointStatus(
+                generation=technology.generation,
+                interface_units=channels,
+                pin_rate_gbps=technology.pin_rate_gbps,
+                technology_schema=technology.schema_version,
+                source_url=technology.source_url,
+                source_label=technology.source_label,
+                emulator_generation=technology.emulator_generation,
+                emulator_pin_rate_gbps=technology.emulator_pin_rate_gbps,
+                hbm_width_bits=overrides["HBM_WIDTH"],
+                hbm_capacity_bytes=overrides["HBM_SIZE"],
+                calibration_id=None,
+                calibrated_channel_min=None,
+                calibrated_channel_max=None,
+                rankable=False,
+                reason="calibrated_traffic_class_missing",
+            )
+        lower = max(min(values) for values in channel_sets)
+        upper = min(max(values) for values in channel_sets)
+        supported = lower <= channels <= upper
+        return HBMOperatingPointStatus(
+            generation=technology.generation,
+            interface_units=channels,
+            pin_rate_gbps=technology.pin_rate_gbps,
+            technology_schema=technology.schema_version,
+            source_url=technology.source_url,
+            source_label=technology.source_label,
+            emulator_generation=technology.emulator_generation,
+            emulator_pin_rate_gbps=technology.emulator_pin_rate_gbps,
+            hbm_width_bits=overrides["HBM_WIDTH"],
+            hbm_capacity_bytes=overrides["HBM_SIZE"],
+            calibration_id=calibration_id if supported else None,
+            calibrated_channel_min=lower,
+            calibrated_channel_max=upper,
+            rankable=supported,
+            reason=(
+                "emulator_dma_calibrated"
+                if supported
+                else "channel_count_outside_calibration"
+            ),
+        )
+
+    def validate_calibrated_hardware_space(
+        self,
+        generation: str,
+        channels: Iterable[int],
+    ) -> tuple[HBMOperatingPointStatus, ...]:
+        """Require every headline HBM point to have measured calibration support."""
+
+        values = tuple(
+            self.hbm_operating_point(generation, int(channel))
+            for channel in channels
+        )
+        unsupported = [
+            status
+            for status in values
+            if not status.rankable
+        ]
+        if unsupported:
+            details = ", ".join(
+                f"{status.generation}/{status.interface_units}:"
+                f"{status.reason}"
+                for status in unsupported
+            )
+            raise ValueError(
+                "uncalibrated headline HBM operating points: " + details
+            )
+        return values
+
+    def mlen_cap(self, precision: Precision, hw_over: dict | None = None) -> int:
+        """Largest MLEN this precision's stream width lets the HBM feed per cycle."""
+        hw = self.base_hw.model_copy(update=hw_over) if hw_over else self.base_hw
+        return self._dd.mlen_bandwidth_cap(hw, precision.spec)
+
+    def shipped_over(self, precision: Precision, hbm_over: dict | None = None) -> dict[str, int]:
+        """Feasible overrides for the shipped (un-searched) chip at a precision.
+
+        The shipped TOML geometry can break the bandwidth bound for wide streams
+        (e.g. MLEN=1024 at FP16 needs 16384 bits/cycle), so MLEN is clamped to the
+        largest power of two within the bandwidth cap, VLEN follows MLEN (compiler
+        requires MLEN == VLEN), HLEN is clamped under MLEN, and the prefetch
+        follows MLEN. This baseline chip obeys the same rules as the co-design
+        search, so it is a legal design point too.
+        """
+        hbm = dict(hbm_over or {})
+        cap = self.mlen_cap(precision, hw_over=hbm)
+        mlen = min(self.base_hw.MLEN, 1 << max(0, cap.bit_length() - 1))
+        hlen = min(self.base_hw.HLEN, mlen)
+        return {"MLEN": mlen, "VLEN": mlen, "HLEN": hlen,
+                "HBM_M_Prefetch_Amount": mlen, **hbm}
+
+    # -- evaluation ----------------------------------------------------------
+    def use_calibrated_bandwidth(self) -> None:
+        """Price memory at the emulator-measured effective bandwidth instead
+        of the aggregate peak (disagg_serve.memory calibration table)."""
+        root = _sim_root()
+        sys.path.insert(0, str(root))
+        from analytic_models.disagg_serve.memory import CalibratedBandwidth
+
+        self._bw_model = CalibratedBandwidth.load()
+
+    def use_compiler_trace_timing(
+        self,
+        provider: Any,
+        request_binder: CompilerTraceRequestBinder,
+    ) -> None:
+        """Select full-model trace timing with immutable point binding."""
+
+        if getattr(provider, "artifact_scope", None) != (
+            self._dd.FULL_MODEL_DECODE_SCOPE
+        ):
+            raise ValueError(
+                "compiler trace provider lacks full-model decode scope"
+            )
+        if not callable(getattr(request_binder, "bind", None)):
+            raise TypeError(
+                "compiler trace request binder must provide bind(point)"
+            )
+        self.execution_mode = self._dd.COMPILER_TRACE
+        self.trace_timing_provider = provider
+        self.trace_request_binder = request_binder
+
+    def compiler_trace_point(
+        self,
+        precision: Precision,
+        *,
+        hardware: Any,
+        overrides: dict[str, Any],
+        batch: int,
+        input_seq: int,
+        output_seq: int,
+        stride: int,
+        n_chips: int,
+        hbm_gen: str,
+        hbm_channels: int,
+        kv_layout: str,
+        runtime_hbm_reserve_bytes: int,
+        output_head_location: str,
+    ) -> CompilerTracePointDescriptor:
+        """Seal every lowering and timing determinant except context length."""
+
+        dd = self._dd
+        if n_chips <= 0:
+            raise ValueError(
+                "compiler trace timing requires an explicit chip count"
+            )
+        topology = dd._parallel_topology(overrides, n_chips)
+        if not topology["explicit_topology"]:
+            raise ValueError(
+                "compiler trace timing requires explicit TP/KVP topology"
+            )
+        resolved_timing_mode = (
+            (
+                dd.DRAIN_OVERLAPPED
+                if bool(topology["drain_overlapped"])
+                else dd.RTL_SERIALIZED
+            )
+            if bool(topology["architecture_knobs_explicit"])
+            else self.timing_mode
+        )
+        memory = self.base_mem.model_copy(
+            update={
+                "weight_bits": precision.spec["ffn_bits"],
+                "activation_bits": dd.ACT_BITS,
+                "kv_cache_bits": precision.spec["kv_bits"],
+                **overrides,
+            }
+        )
+        from compiler_trace_timing import HBMOperatingPoint
+
+        hbm = HBMOperatingPoint(
+            generation=hbm_gen,
+            channels=hbm_channels,
+            pin_rate_gbps=dd.hbm_technology(hbm_gen).pin_rate_gbps,
+        )
+        return CompilerTracePointDescriptor.from_mapping(
+            {
+                "schema_version": COMPILER_TRACE_POINT_SCHEMA,
+                "artifact_scope": FULL_MODEL_DECODE_SCOPE,
+                "model": {
+                    "model_json_sha256": _sha256_file(self.model_json),
+                    "dimensions": dict(self.dims),
+                    "layer_scope": "all_decoder_layers",
+                    "output_head_location": output_head_location,
+                },
+                "precision": {
+                    "specification": dict(precision.spec),
+                    "weight_format": precision.w_fmt,
+                    "kv_format": precision.kv_fmt,
+                    "key_format": precision.key_fmt or precision.kv_fmt,
+                    "value_format": precision.value_fmt or precision.kv_fmt,
+                    "block_size": precision.block,
+                    "mac_bits": precision.m_bits,
+                },
+                "hardware": {
+                    "array_geometry": {
+                        "mlen": int(hardware.MLEN),
+                        "blen": int(hardware.BLEN),
+                        "vlen": int(hardware.VLEN),
+                        "hlen": int(hardware.HLEN),
+                    },
+                    "hbm_timing_geometry": hbm.to_dict(),
+                    "configuration": _model_mapping(hardware),
+                    "memory_configuration": _model_mapping(memory),
+                    "overrides": dict(overrides),
+                    "topology": dict(topology),
+                },
+                "serving": {
+                    "batch": batch,
+                    "input_tokens": input_seq,
+                    "generation_tokens": output_seq,
+                    "sample_stride": stride,
+                    "kv_layout": kv_layout,
+                    "runtime_hbm_reserve_bytes": runtime_hbm_reserve_bytes,
+                },
+                "compiler": {
+                    "settings_sha256": _sha256_file(self.settings_toml),
+                    "latency_library_sha256": _sha256_file(self.isa_path),
+                    "timing_mode": resolved_timing_mode,
+                    "frequency_hz": dd.FREQ_HZ,
+                },
+            }
+        )
+
+    def _bind_trace_request_factory(
+        self,
+        point: CompilerTracePointDescriptor,
+    ):
+        binder = self.trace_request_binder
+        if binder is None:
+            raise RuntimeError("compiler trace request binder is missing")
+        bound = binder.bind(point)
+        if not callable(bound):
+            raise TypeError("compiler trace binder must return a callable")
+        descriptor = point.to_dict()
+        expected_batch = int(descriptor["serving"]["batch"])
+        expected_geometry = descriptor["hardware"]["array_geometry"]
+        expected_hbm = descriptor["hardware"]["hbm_timing_geometry"]
+        expected_frequency = float(descriptor["compiler"]["frequency_hz"])
+
+        def request_for_context(context_tokens: int):
+            request = bound(context_tokens)
+            if getattr(request, "compiler_inputs_sha256", None) != (
+                point.descriptor_sha256
+            ):
+                raise ValueError(
+                    "compiler timing request differs from its point descriptor"
+                )
+            if getattr(request, "context_tokens", None) != context_tokens:
+                raise ValueError("compiler timing request context is inconsistent")
+            if getattr(request, "batch", None) != expected_batch:
+                raise ValueError("compiler timing request batch is inconsistent")
+            geometry = getattr(request, "geometry", None)
+            if not callable(getattr(geometry, "to_dict", None)) or (
+                geometry.to_dict() != expected_geometry
+            ):
+                raise ValueError("compiler timing request geometry is inconsistent")
+            hbm = getattr(request, "hbm", None)
+            if not callable(getattr(hbm, "to_dict", None)) or (
+                hbm.to_dict() != expected_hbm
+            ):
+                raise ValueError("compiler timing request HBM geometry is inconsistent")
+            if float(getattr(request, "frequency_hz", 0.0)) != expected_frequency:
+                raise ValueError("compiler timing request frequency is inconsistent")
+            return request
+
+        return request_for_context
+
+    def evaluate(
+        self,
+        precision: Precision,
+        *,
+        batch: int,
+        input_seq: int,
+        output_seq: int,
+        hw_over: dict | None = None,
+        n_chips: int = 0,
+        stride: int | None = None,
+        hbm_gen: str = "HBM2",
+        hbm_channels: int = 8,
+        kv_layout: str = "dense_selector",
+        runtime_hbm_reserve_bytes: int = 0,
+        output_head_location: str = "decode_bf16_unmodeled",
+    ) -> DecodeMetrics:
+        """Evaluate one (precision, hardware, batch) point.
+
+        `hw_over` overrides HardwareConfig fields on top of the base config
+        (MLEN/BLEN/VLEN/HLEN and, via :meth:`hbm_overrides`, HBM_WIDTH/HBM_SIZE).
+        It is applied to both the compute config (peak bandwidth, MLEN cap) and
+        the memory config (capacity, traffic) so the two agree. `hbm_gen`/
+        `hbm_channels` key the calibrated bandwidth lookup when
+        :meth:`use_calibrated_bandwidth` is on; otherwise memory uses peak.
+        """
+        dd = self._dd
+        over = dict(hw_over or {})
+        # Matrix prefetch tracks MLEN so a searched MLEN incurs no wasted reads.
+        if "MLEN" in over:
+            over.setdefault("HBM_M_Prefetch_Amount", over["MLEN"])
+        hw_cfg = self.base_hw.model_copy(update=over) if over else self.base_hw
+        if runtime_hbm_reserve_bytes < 0:
+            raise ValueError("runtime_hbm_reserve_bytes must be non-negative")
+        bw_model = (
+            getattr(self, "_bw_model", None)
+            if self.execution_mode == dd.LEGACY_AGGREGATE_BANDWIDTH
+            else None
+        )
+        if bw_model is not None:
+            operating_point = self.hbm_operating_point(
+                hbm_gen,
+                hbm_channels,
+            )
+            if (
+                operating_point.reason
+                in {
+                    "calibrated_traffic_class_missing",
+                    "channel_count_outside_calibration",
+                }
+            ):
+                raise ValueError(
+                    f"unsupported calibrated HBM operating point "
+                    f"{hbm_gen}/{hbm_channels}: {operating_point.reason}"
+                )
+            expected = self.hbm_overrides(hbm_gen, hbm_channels)
+            for field in ("HBM_WIDTH", "HBM_SIZE"):
+                actual = int(getattr(hw_cfg, field))
+                if actual != expected[field]:
+                    raise ValueError(
+                        f"calibrated {hbm_gen}/{hbm_channels} expects "
+                        f"{field}={expected[field]}, got {actual}"
+                    )
+
+        if stride is None:
+            stride = max(1, output_seq // 24)  # subsample the growing-context loop
+
+        trace_point = None
+        trace_request_factory = None
+        if self.execution_mode == dd.COMPILER_TRACE:
+            trace_point = self.compiler_trace_point(
+                precision,
+                hardware=hw_cfg,
+                overrides=over,
+                batch=batch,
+                input_seq=input_seq,
+                output_seq=output_seq,
+                stride=stride,
+                n_chips=n_chips,
+                hbm_gen=hbm_gen,
+                hbm_channels=hbm_channels,
+                kv_layout=kv_layout,
+                runtime_hbm_reserve_bytes=runtime_hbm_reserve_bytes,
+                output_head_location=output_head_location,
+            )
+            trace_request_factory = self._bind_trace_request_factory(
+                trace_point
+            )
+
+        loop = dd.evaluate(
+            self.model_json, self.dims, hw_cfg, self.isa_path, self.base_mem,
+            precision.spec, batch, input_seq, output_seq,
+            hw_over=over, stride=stride, n_chips=n_chips,
+            bw_model=bw_model,
+            hbm_gen=hbm_gen, hbm_channels=hbm_channels,
+            kv_layout=kv_layout,
+            timing_mode=self.timing_mode,
+            timing_evidence=self.timing_evidence,
+            packed_q1_timing_contract=self.packed_q1_timing_contract,
+            runtime_hbm_reserve_bytes=runtime_hbm_reserve_bytes,
+            output_head_location=output_head_location,
+            execution_mode=self.execution_mode,
+            trace_timing_provider=self.trace_timing_provider,
+            trace_request_factory=trace_request_factory,
+        )
+        if trace_point is not None:
+            trace_evidence = loop.get("compiler_trace_timing")
+            if not isinstance(trace_evidence, dict) or (
+                trace_evidence.get("compiler_input_descriptor_sha256")
+                != trace_point.descriptor_sha256
+            ):
+                raise ValueError(
+                    "compiler trace evidence differs from the bound DSE point"
+                )
+        ledger = loop["physical_ledger"]
+        quantized_weights = ledger.weights.attention + ledger.weights.ffn_resident
+        sram = ledger.sram
+        return DecodeMetrics(
+            tps=float(loop["tps"]),
+            tpot=float(loop["tpot"]),
+            total_time=float(loop["total_time"]),
+            first_step=float(loop["first_step"]),
+            frac_mem_bound=float(loop["frac_mem_bound"]),
+            frac_classical_mem_bound=float(
+                loop["frac_classical_mem_bound"]
+            ),
+            frac_architecture_issue_mem_bound=float(
+                loop["frac_architecture_issue_mem_bound"]
+            ),
+            frac_algorithmic_mem_bound=float(
+                loop.get("frac_algorithmic_mem_bound", loop["frac_mem_bound"])
+            ),
+            frac_serialization_bound=float(loop.get("frac_serialization_bound", 0.0)),
+            fits_in_hbm=bool(loop["fits_in_hbm"]),
+            hbm_required=float(loop["hbm_required"]),
+            area_mm2=float(dd.area_mm2(hw_cfg)),
+            avg_bytes_per_token=float(loop.get("avg_bytes_per_token", 0.0)),
+            avg_hbm_bytes_per_batch_step=float(loop["avg_bytes_per_batch_step"]),
+            avg_hbm_bytes_per_generated_token=float(
+                loop["avg_bytes_per_generated_token"]
+            ),
+            hbm_traffic_per_batch_step=tuple(
+                sorted(loop["traffic_breakdown_per_batch_step"].items())
+            ),
+            hbm_traffic_per_generated_token=tuple(
+                sorted(loop["traffic_breakdown_per_generated_token"].items())
+            ),
+            mem_bound=float(loop["frac_mem_bound"]) >= 0.5,
+            bottleneck=str(dd.decode_bound_label(loop)),
+            classical_roofline_bottleneck=str(
+                dd.classical_roofline_bound_label(loop)
+            ),
+            architecture_issue_bottleneck=str(
+                dd.architecture_issue_bound_label(loop)
+            ),
+            n_chips=int(loop["n_chips"]),
+            max_batch=int(dd.max_batch_capacity(loop, batch)),
+            max_resident_batch=int(loop["max_resident_batch"]),
+            max_synchronous_batch=int(loop["max_synchronous_batch"]),
+            max_runtime_batch=int(loop["max_runtime_batch"]),
+            fits_onchip_sram=bool(loop["fits_onchip_sram"]),
+            fits_runtime=bool(loop["fits_runtime"]),
+            hbm_capacity=int(loop["hbm_capacity"]),
+            runtime_hbm_reserve_bytes=int(loop["runtime_hbm_reserve_bytes"]),
+            weight_element_plane_bytes=int(quantized_weights.element_aligned),
+            weight_scale_plane_bytes=int(quantized_weights.scale_aligned),
+            weight_bf16_bytes=int(ledger.weights.bf16_resident.total_aligned),
+            kv_element_plane_bytes=int(ledger.kv.element_bytes),
+            kv_scale_plane_bytes=int(ledger.kv.scale_bytes),
+            vector_sram_capacity_bytes=int(sram.vector_capacity_bytes),
+            vector_sram_required_bytes=int(sram.vector_required_bytes),
+            matrix_sram_capacity_bytes=int(sram.matrix_capacity_bytes),
+            matrix_sram_required_bytes=int(sram.matrix_required_bytes),
+            timing_mode=str(loop["timing_mode"]),
+            timing_calibrated=bool(loop["timing_calibrated"]),
+            timing_reason=str(loop["timing_reason"]),
+            timing_evidence_id=loop.get("timing_evidence_id"),
+            timing_evidence_tier=loop.get("timing_evidence_tier"),
+            packed_q1_timing_validated=bool(
+                loop["packed_q1_timing_validated"]
+            ),
+            packed_q1_timing_reason=str(loop["packed_q1_timing_reason"]),
+            packed_q1_timing_contract_id=loop.get(
+                "packed_q1_timing_contract_id"
+            ),
+            bandwidth_calibration_id=loop.get("bandwidth_calibration_id"),
+            kv_layout=str(loop["kv_layout"]),
+            kv_layout_id=str(ledger.kv.layout_id),
+            output_head_location=str(loop["output_head_location"]),
+            avg_peak_compute_seconds=float(
+                loop["avg_peak_compute_seconds"]
+            ),
+            avg_ideal_compute_seconds=float(
+                loop["avg_ideal_compute_seconds"]
+            ),
+            avg_realized_compute_seconds=float(
+                loop["avg_realized_compute_seconds"]
+            ),
+            avg_memory_seconds=float(loop["avg_memory_seconds"]),
+            step_composition=str(loop["step_composition"]),
+            execution_mode=str(loop["execution_mode"]),
+            compiler_trace_timing=(
+                dict(loop["compiler_trace_timing"])
+                if loop.get("compiler_trace_timing") is not None
+                else None
+            ),
+        )
diff --git a/decode_dse/software/__init__.py b/decode_dse/software/__init__.py
new file mode 100644
index 0000000..b15ded6
--- /dev/null
+++ b/decode_dse/software/__init__.py
@@ -0,0 +1,183 @@
+"""Decode precision bindings, cache artifacts, and cached evaluation."""
+
+from decode_dse.software.block_size_sensitivity import (
+    BlockSensitivityObservation,
+    BlockSensitivityPoint,
+    BlockSensitivitySchedule,
+    block_sensitivity_to_decode_quant_spec,
+    build_block_sensitivity_report,
+    build_block_sensitivity_schedule,
+    write_block_sensitivity_schedule,
+)
+from decode_dse.software.cached_decode import (
+    ContinuationExample,
+    CorpusNLL,
+    DocumentNLL,
+    TorchHFCachedDecodeBackend,
+    capture_bf16_prefill,
+    evaluate_cached_documents,
+    evaluate_teacher_forced_cached,
+)
+from decode_dse.software.precision_bindings import (
+    DecodeQuantSpec,
+    build_decode_pass_args,
+    gptq_cache_key,
+)
+from decode_dse.software.sweep_runner import (
+    EvaluationOutcome,
+    ExhaustiveSweepRunner,
+    SweepRunSummary,
+)
+from decode_dse.software.token_samples import (
+    DecodeTokenSample,
+    RefinementSampleBundle,
+    SourceTokenSpan,
+    TokenSampleBundle,
+    TokenizedSourceDocument,
+    build_bundle_from_documents,
+    build_bundle_from_token_stream,
+    build_refinement_bundle_from_documents,
+    build_refinement_bundle_from_token_stream,
+    load_refinement_sample_bundle,
+    load_sample_bundle,
+    save_refinement_sample_bundle,
+    save_sample_bundle,
+)
+from decode_dse.software.refinement_schedule import (
+    DecodeRefinementProfile,
+    DoomedGatePolicy,
+    RefinementAccuracyEvidence,
+    RefinementSchedule,
+    RefinementShardPlan,
+    RefinementValidityManifest,
+    RefinementValidityRecord,
+    attach_refinement_validity,
+    build_refinement_schedule_from_promotion,
+    build_refinement_schedule,
+    build_refinement_shard_plans,
+    build_selective_rotation_schedule,
+    load_refinement_schedule,
+    load_refinement_shard_plan,
+    load_refinement_validity,
+    refinement_profile_to_decode_quant_spec,
+    write_refinement_schedule,
+    write_refinement_shard_plan,
+    write_refinement_validity,
+)
+from decode_dse.software.refinement_runner import (
+    RefinementBankSpec,
+    RefinementMergeSummary,
+    RefinementRunner,
+    build_refinement_bank_specs,
+    merge_refinement_shards,
+)
+from decode_dse.software.benchmark_runner import (
+    PublicationContract,
+    PublicationRunner,
+)
+from decode_dse.software.cache_artifacts import (
+    ArtifactProvenance,
+    BF16CacheConverter,
+    DecodeCacheArtifact,
+    PrefillArtifact,
+    SplitCacheConverter,
+    admit_prefill_cache,
+    admit_prefill_cache_split,
+    load_decode_cache_artifact,
+    load_prefill_artifact,
+    save_decode_cache_artifact,
+    save_prefill_artifact,
+)
+from decode_dse.software.sweep_plan import (
+    PreflightEvidence,
+    PreflightGateReport,
+    PromptManifest,
+    RuntimeRebindingSample,
+    SweepRunPlan,
+    WeightBankBuildSample,
+    build_run_plan,
+    evaluate_preflight_gates,
+    select_preflight_entries,
+)
+
+__all__ = [
+    "ArtifactProvenance",
+    "BF16CacheConverter",
+    "BlockSensitivityObservation",
+    "BlockSensitivityPoint",
+    "BlockSensitivitySchedule",
+    "ContinuationExample",
+    "CorpusNLL",
+    "DecodeCacheArtifact",
+    "DecodeQuantSpec",
+    "DecodeRefinementProfile",
+    "DecodeTokenSample",
+    "DocumentNLL",
+    "EvaluationOutcome",
+    "ExhaustiveSweepRunner",
+    "PreflightEvidence",
+    "PreflightGateReport",
+    "PrefillArtifact",
+    "PromptManifest",
+    "TokenSampleBundle",
+    "SourceTokenSpan",
+    "DoomedGatePolicy",
+    "RefinementAccuracyEvidence",
+    "RefinementSchedule",
+    "RefinementShardPlan",
+    "RefinementValidityManifest",
+    "RefinementValidityRecord",
+    "RefinementBankSpec",
+    "RefinementMergeSummary",
+    "RefinementRunner",
+    "RefinementSampleBundle",
+    "PublicationContract",
+    "PublicationRunner",
+    "RuntimeRebindingSample",
+    "SplitCacheConverter",
+    "SweepRunPlan",
+    "SweepRunSummary",
+    "TorchHFCachedDecodeBackend",
+    "TokenizedSourceDocument",
+    "WeightBankBuildSample",
+    "admit_prefill_cache",
+    "admit_prefill_cache_split",
+    "build_decode_pass_args",
+    "block_sensitivity_to_decode_quant_spec",
+    "build_block_sensitivity_report",
+    "build_block_sensitivity_schedule",
+    "build_bundle_from_token_stream",
+    "build_bundle_from_documents",
+    "build_run_plan",
+    "build_refinement_schedule_from_promotion",
+    "build_refinement_schedule",
+    "build_refinement_shard_plans",
+    "build_selective_rotation_schedule",
+    "build_refinement_bank_specs",
+    "build_refinement_bundle_from_token_stream",
+    "build_refinement_bundle_from_documents",
+    "capture_bf16_prefill",
+    "evaluate_cached_documents",
+    "evaluate_preflight_gates",
+    "evaluate_teacher_forced_cached",
+    "gptq_cache_key",
+    "load_decode_cache_artifact",
+    "load_refinement_schedule",
+    "load_refinement_shard_plan",
+    "load_refinement_validity",
+    "load_prefill_artifact",
+    "load_sample_bundle",
+    "load_refinement_sample_bundle",
+    "save_decode_cache_artifact",
+    "save_prefill_artifact",
+    "save_sample_bundle",
+    "save_refinement_sample_bundle",
+    "select_preflight_entries",
+    "refinement_profile_to_decode_quant_spec",
+    "merge_refinement_shards",
+    "write_refinement_schedule",
+    "write_refinement_shard_plan",
+    "write_refinement_validity",
+    "attach_refinement_validity",
+    "write_block_sensitivity_schedule",
+]
diff --git a/decode_dse/software/benchmark_evaluator.py b/decode_dse/software/benchmark_evaluator.py
new file mode 100644
index 0000000..2161ee0
--- /dev/null
+++ b/decode_dse/software/benchmark_evaluator.py
@@ -0,0 +1,625 @@
+"""Evaluate published benchmark suites over the split-cached decode path."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import subprocess
+from contextlib import contextmanager
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterator, Mapping, Sequence
+
+from decode_dse.software.benchmark_runner import (
+    PublicationBenchmark,
+    PublicationConfiguration,
+    PublicationContract,
+    PublicationEvaluation,
+    PublicationItemMetric,
+    PublicationProtocol,
+    PublicationSplitEvidence,
+    POST_HANDOFF_METRIC_ID,
+    PUBLICATION_ROLES,
+    STANDARD_WIKITEXT2_METRIC_ID,
+    TASK_METRIC_ID,
+)
+from decode_dse.software.sweep_plan import (
+    load_immutable_json,
+    write_immutable_json,
+)
+
+PUBLICATION_INPUT_SCHEMA = "decode-publication-inputs"
+PUBLICATION_DRIVER_REQUEST_SCHEMA = "decode-publication-driver-request"
+PUBLICATION_DRIVER_RESULT_SCHEMA = "decode-publication-driver-result"
+_SHA256 = re.compile(r"^[0-9a-f]{64}$")
+_REVISION = re.compile(r"^[0-9a-f]{40,64}$")
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        while block := handle.read(1 << 20):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _sha256_tree(path: Path) -> str:
+    digest = hashlib.sha256()
+    files = tuple(sorted(value for value in path.rglob("*") if value.is_file()))
+    if not files:
+        raise ValueError(f"publication bank is empty: {path}")
+    for value in files:
+        name = value.relative_to(path).as_posix().encode("utf-8")
+        digest.update(len(name).to_bytes(8, "little"))
+        digest.update(name)
+        payload = value.read_bytes()
+        digest.update(len(payload).to_bytes(8, "little"))
+        digest.update(payload)
+    return digest.hexdigest()
+
+
+def _path_identity(path: Path) -> tuple[str, str]:
+    if path.is_file():
+        return "file", _sha256_file(path)
+    if path.is_dir():
+        return "directory", _sha256_tree(path)
+    raise ValueError(f"publication path does not exist: {path}")
+
+
+def _confined(root: Path, value: str) -> Path:
+    path = (root / value).resolve()
+    if path != root and root not in path.parents:
+        raise ValueError("publication driver artifact escapes its output directory")
+    return path
+
+
+def _content_hash(value: Any) -> str:
+    return hashlib.sha256(
+        json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            allow_nan=False,
+        ).encode("utf-8")
+    ).hexdigest()
+
+
+def _validate_dependency_identities(
+    value: Any,
+    *,
+    benchmark_names: Sequence[str],
+) -> None:
+    if not isinstance(value, Mapping):
+        raise ValueError("publication dependency identities are incomplete")
+    required = {"transformers", "datasets", "ifeval", "gsm8k"}
+    if "ruler" in benchmark_names:
+        required.add("ruler")
+    if set(value) != required:
+        raise ValueError("publication dependency identities are incomplete")
+    for name, identity in value.items():
+        if not isinstance(identity, Mapping):
+            raise TypeError("publication dependency identity must be a mapping")
+        if name in {"transformers", "datasets"}:
+            if (
+                set(identity) != {"kind", "version", "distribution_sha256"}
+                or identity.get("kind") != "package"
+                or not str(identity.get("version", ""))
+                or str(identity.get("version", "")).casefold()
+                in {"main", "master", "latest"}
+                or not _SHA256.fullmatch(str(identity.get("distribution_sha256", "")))
+            ):
+                raise ValueError("publication package identity is mutable")
+        elif (
+            set(identity) != {"kind", "revision", "tree_sha256"}
+            or identity.get("kind") != "source"
+            or not _REVISION.fullmatch(str(identity.get("revision", "")))
+            or not _SHA256.fullmatch(str(identity.get("tree_sha256", "")))
+        ):
+            raise ValueError("publication source identity is mutable")
+
+
+@dataclass(frozen=True)
+class PublicationBankHandle:
+    configuration_id: str
+    bank_path: str
+    bank_kind: str
+    bank_sha256: str
+
+
+class BenchmarkEvaluator:
+    """Execute an audited external driver against immutable split artifacts."""
+
+    def __init__(
+        self,
+        *,
+        config: Mapping[str, Any],
+        contract: PublicationContract,
+    ) -> None:
+        if contract.protocol.model_name != str(config.get("model_name", "")):
+            raise ValueError("publication contract model differs from config")
+        value = config.get("publication")
+        if not isinstance(value, Mapping):
+            raise ValueError(
+                "config.publication is required; publication evaluation is not prepared"
+            )
+        self.config = dict(config)
+        self.settings = dict(value)
+        self.contract = contract
+        self.input_manifest_path = Path(
+            str(self.settings.get("input_manifest", ""))
+        ).resolve()
+        self.prefill_root = Path(
+            str(self.settings.get("prefill_artifact_root", ""))
+        ).resolve()
+        self.output_root = Path(
+            str(self.settings.get("driver_output_root", ""))
+        ).resolve()
+        self.input_manifest = self._validate_inputs()
+        self.command, self.driver_identity, self.timeout_seconds = (
+            self._validate_driver()
+        )
+        self.banks = self._validate_banks()
+
+    def _validate_inputs(self) -> Mapping[str, Any]:
+        if not self.input_manifest_path.is_file():
+            raise ValueError(
+                "full benchmark input manifest is missing; run publication evaluation preparation"
+            )
+        if not self.prefill_root.is_dir():
+            raise ValueError("full benchmark BF16 prefill artifacts are missing")
+        value = load_immutable_json(self.input_manifest_path)
+        if value.get("schema_version") != PUBLICATION_INPUT_SCHEMA:
+            raise ValueError("unsupported publication input manifest")
+        if value.get("contract_hash") != self.contract.canonical_hash:
+            raise ValueError("publication input manifest contract mismatch")
+        if value.get("model_revision") != self.contract.protocol.model_revision:
+            raise ValueError("publication input model revision mismatch")
+        if value.get("tokenizer_revision") != self.contract.protocol.tokenizer_revision:
+            raise ValueError("publication input tokenizer revision mismatch")
+        if value.get("prefill_precision") != "BF16":
+            raise ValueError("publication inputs require BF16 prefill")
+        records = value.get("records")
+        if not isinstance(records, list):
+            raise ValueError("publication input records are missing")
+        expected = {
+            (benchmark.benchmark_id, item_id)
+            for benchmark in self.contract.benchmarks
+            for item_id in benchmark.item_ids
+        }
+        actual = {
+            (str(record.get("benchmark_id")), str(record.get("item_id")))
+            for record in records
+        }
+        if actual != expected or len(records) != len(expected):
+            raise ValueError("publication input coverage is not full")
+        benchmark_names = {
+            benchmark.benchmark_id: benchmark.name
+            for benchmark in self.contract.benchmarks
+        }
+        for record in records:
+            if (
+                record.get("prefill_precision") != "BF16"
+                or record.get("first_token_owner") != "prefill"
+                or not record.get("prompt_hash")
+                or not record.get("prefill_artifact_id")
+                or not _SHA256.fullmatch(str(record.get("prefill_tree_sha256", "")))
+                or int(record.get("prefill_file_count", 0)) <= 0
+                or int(record.get("prefill_size_bytes", 0)) <= 0
+            ):
+                raise ValueError("publication prefill record is incomplete")
+            path = _confined(
+                self.prefill_root,
+                str(record.get("prefill_relative_path", "")),
+            )
+            manifest_path = path / "manifest.json"
+            if not manifest_path.is_file():
+                raise ValueError("publication prefill artifact is missing")
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+            first_token = manifest.get("first_token", {})
+            greedy_token_id = record.get("prefill_greedy_handoff_token_id")
+            ground_truth_token_id = record.get("ground_truth_handoff_token_id")
+            benchmark_name = benchmark_names[str(record["benchmark_id"])]
+            if (
+                manifest.get("schema") != "plena.prefill"
+                or manifest.get("artifact_id") != record["prefill_artifact_id"]
+                or manifest.get("prompt_hash") != record["prompt_hash"]
+                or manifest.get("model_revision")
+                != self.contract.protocol.model_revision
+                or manifest.get("tokenizer_revision")
+                != self.contract.protocol.tokenizer_revision
+                or len(manifest.get("layers", ()))
+                != int(self.config["model_architecture"]["num_hidden_layers"])
+                or first_token.get("selection") != "greedy"
+                or first_token.get("token_ids") != [greedy_token_id]
+                or isinstance(greedy_token_id, bool)
+                or not isinstance(greedy_token_id, int)
+                or greedy_token_id < 0
+                or (
+                    benchmark_name == "wikitext2"
+                    and (
+                        isinstance(ground_truth_token_id, bool)
+                        or not isinstance(ground_truth_token_id, int)
+                        or ground_truth_token_id < 0
+                    )
+                )
+                or (benchmark_name != "wikitext2" and ground_truth_token_id is not None)
+            ):
+                raise ValueError("publication prefill artifact identity mismatch")
+            architecture = self.config["model_architecture"]
+            expected_kv_heads = int(architecture["num_key_value_heads"])
+            expected_head_dim = int(architecture["head_dim"])
+            for layer in manifest["layers"]:
+                for role in ("key", "value"):
+                    tensor = layer[role]
+                    shape = tuple(int(item) for item in tensor["shape"])
+                    if (
+                        tensor.get("dtype") != "bfloat16"
+                        or len(shape) != 4
+                        or shape[0] != 1
+                        or shape[1] != expected_kv_heads
+                        or shape[3] != expected_head_dim
+                    ):
+                        raise ValueError(
+                            "publication prefill cache geometry is invalid"
+                        )
+        prefill_set_hash = _content_hash(
+            [
+                {
+                    "benchmark_id": record["benchmark_id"],
+                    "item_id": record["item_id"],
+                    "prefill_artifact_id": record["prefill_artifact_id"],
+                    "prefill_tree_sha256": record["prefill_tree_sha256"],
+                }
+                for record in records
+            ]
+        )
+        if value.get("prefill_set_sha256") != prefill_set_hash:
+            raise ValueError("publication prefill-set identity mismatch")
+        _validate_dependency_identities(
+            value.get("dependencies"),
+            benchmark_names=tuple(
+                benchmark.name for benchmark in self.contract.benchmarks
+            ),
+        )
+        return value
+
+    def _validate_driver(self) -> tuple[tuple[str, ...], dict[str, Any], float]:
+        driver = self.settings.get("driver")
+        if not isinstance(driver, Mapping):
+            raise ValueError("config.publication.driver is required")
+        command = driver.get("command")
+        if (
+            not isinstance(command, Sequence)
+            or isinstance(command, (str, bytes))
+            or not command
+        ):
+            raise TypeError("publication driver command must be an argument vector")
+        command = tuple(str(item) for item in command)
+        for token in ("{request}", "{result}", "{artifact_dir}"):
+            if command.count(token) != 1:
+                raise ValueError(
+                    f"publication driver command requires one literal {token}"
+                )
+        source_root = Path(str(driver.get("source_root", ""))).resolve()
+        if not source_root.is_dir():
+            raise ValueError("publication driver source root is missing")
+        if self.output_root == source_root or source_root in self.output_root.parents:
+            raise ValueError(
+                "publication outputs must be outside the driver source tree"
+            )
+        expected_tree_hash = str(driver.get("source_tree_sha256", ""))
+        actual_tree_hash = _sha256_tree(source_root)
+        if actual_tree_hash != expected_tree_hash:
+            raise ValueError("publication driver source tree hash mismatch")
+        source_path = Path(str(driver.get("source_path", ""))).resolve()
+        if (
+            not source_path.is_file()
+            or source_path != source_root
+            and source_root not in source_path.parents
+        ):
+            raise ValueError("publication driver source is missing")
+        expected_hash = str(driver.get("source_sha256", ""))
+        actual_hash = _sha256_file(source_path)
+        if actual_hash != expected_hash:
+            raise ValueError("publication driver source hash mismatch")
+        executable = Path(str(driver.get("executable_path", ""))).resolve()
+        if (
+            not executable.is_file()
+            or command[0] != str(executable)
+            or _sha256_file(executable) != str(driver.get("executable_sha256", ""))
+        ):
+            raise ValueError("publication driver executable identity mismatch")
+        runtime_path = Path(str(driver.get("runtime_receipt_path", ""))).resolve()
+        if not runtime_path.is_file() or _sha256_file(runtime_path) != str(
+            driver.get("runtime_receipt_sha256", "")
+        ):
+            raise ValueError("publication driver runtime receipt mismatch")
+        runtime = json.loads(runtime_path.read_text(encoding="utf-8"))
+        if (
+            not isinstance(runtime, Mapping)
+            or runtime.get("schema_version") != "decode-publication-runtime"
+            or runtime.get("interpreter_path") != str(executable)
+            or runtime.get("interpreter_sha256") != _sha256_file(executable)
+            or not str(runtime.get("python_version", ""))
+            or not str(runtime.get("platform", ""))
+        ):
+            raise ValueError("publication driver runtime identity is invalid")
+        packages = runtime.get("packages")
+        if not isinstance(packages, Mapping) or not {
+            "torch",
+            "transformers",
+            "datasets",
+        }.issubset(packages):
+            raise ValueError("publication driver runtime packages are incomplete")
+        for identity in packages.values():
+            if (
+                not isinstance(identity, Mapping)
+                or set(identity) != {"version", "source_sha256"}
+                or not str(identity["version"])
+                or not _SHA256.fullmatch(str(identity["source_sha256"]))
+            ):
+                raise ValueError("publication runtime package identity is mutable")
+        for name in ("transformers", "datasets"):
+            dependency = self.input_manifest["dependencies"][name]
+            if (
+                packages[name]["version"] != dependency["version"]
+                or packages[name]["source_sha256"] != dependency["distribution_sha256"]
+            ):
+                raise ValueError(
+                    "publication runtime differs from the sealed package identity"
+                )
+        timeout = float(driver.get("timeout_seconds", 0))
+        if timeout <= 0:
+            raise ValueError("publication driver timeout must be positive")
+        tool_revision = str(driver.get("tool_revision", ""))
+        if not _REVISION.fullmatch(tool_revision):
+            raise ValueError("publication driver revision must be immutable")
+        return (
+            command,
+            {
+                "source_root": str(source_root),
+                "source_tree_sha256": actual_tree_hash,
+                "source_path": str(source_path),
+                "source_sha256": actual_hash,
+                "executable_path": str(executable),
+                "executable_sha256": _sha256_file(executable),
+                "runtime_receipt_path": str(runtime_path),
+                "runtime_receipt_sha256": _sha256_file(runtime_path),
+                "runtime_fingerprint_sha256": _content_hash(dict(runtime)),
+                "tool_revision": tool_revision,
+            },
+            timeout,
+        )
+
+    def _validate_banks(self) -> dict[str, PublicationBankHandle]:
+        values = self.settings.get("decode_banks")
+        if not isinstance(values, Mapping):
+            raise ValueError("config.publication.decode_banks is required")
+        if set(values) != set(PUBLICATION_ROLES):
+            raise ValueError("publication decode banks must cover all four roles")
+        result = {}
+        for configuration in self.contract.configurations:
+            value = values[configuration.role]
+            if not isinstance(value, Mapping):
+                raise TypeError("publication bank binding must be a mapping")
+            if value.get("profile_id") != configuration.profile.profile_id:
+                raise ValueError("publication bank profile mismatch")
+            path = Path(str(value.get("path", ""))).resolve()
+            kind, digest = _path_identity(path)
+            if value.get("sha256") != digest or value.get("kind") != kind:
+                raise ValueError("publication bank file identity mismatch")
+            result[configuration.configuration_id] = PublicationBankHandle(
+                configuration_id=configuration.configuration_id,
+                bank_path=str(path),
+                bank_kind=kind,
+                bank_sha256=digest,
+            )
+        return result
+
+    @contextmanager
+    def open_configuration(
+        self,
+        configuration: PublicationConfiguration,
+        protocol: PublicationProtocol,
+    ) -> Iterator[PublicationBankHandle]:
+        if protocol != self.contract.protocol:
+            raise ValueError("publication protocol changed")
+        handle = self.banks.get(configuration.configuration_id)
+        if handle is None:
+            raise ValueError("publication configuration has no decode bank")
+        path = Path(handle.bank_path)
+        kind, digest = _path_identity(path)
+        if kind != handle.bank_kind or digest != handle.bank_sha256:
+            raise ValueError("publication decode bank changed before execution")
+        yield handle
+
+    def _records_for(
+        self,
+        benchmark: PublicationBenchmark,
+    ) -> tuple[Mapping[str, Any], ...]:
+        records = tuple(
+            record
+            for record in self.input_manifest["records"]
+            if record["benchmark_id"] == benchmark.benchmark_id
+        )
+        if tuple(record["item_id"] for record in records) != benchmark.item_ids:
+            raise ValueError("publication input record order differs from contract")
+        return records
+
+    def evaluate(
+        self,
+        configuration: PublicationConfiguration,
+        benchmark: PublicationBenchmark,
+        protocol: PublicationProtocol,
+        *,
+        configuration_handle: Any,
+    ) -> PublicationEvaluation:
+        if not isinstance(configuration_handle, PublicationBankHandle):
+            raise TypeError("publication configuration handle is invalid")
+        if configuration_handle.configuration_id != configuration.configuration_id:
+            raise ValueError("publication driver received the wrong decode bank")
+        benchmark_root = (
+            self.output_root / configuration.configuration_id / benchmark.benchmark_id
+        )
+        benchmark_root.mkdir(parents=True, exist_ok=True)
+        attempts = tuple(
+            int(path.name.split("-", 1)[1])
+            for path in benchmark_root.glob("attempt-*")
+            if path.is_dir() and path.name.split("-", 1)[1].isdigit()
+        )
+        artifact_dir = benchmark_root / f"attempt-{max(attempts, default=0) + 1:03d}"
+        artifact_dir.mkdir(parents=True, exist_ok=True)
+        request_body = {
+            "schema_version": PUBLICATION_DRIVER_REQUEST_SCHEMA,
+            "contract_hash": self.contract.canonical_hash,
+            "configuration": configuration.to_dict(),
+            "benchmark": benchmark.to_dict(),
+            "protocol": protocol.to_dict(),
+            "decode_bank": configuration_handle.__dict__,
+            "input_manifest_path": str(self.input_manifest_path),
+            "input_manifest_hash": self.input_manifest["content_hash"],
+            "prefill_set_sha256": self.input_manifest["prefill_set_sha256"],
+            "prefill_artifact_root": str(self.prefill_root),
+            "records": [dict(record) for record in self._records_for(benchmark)],
+            "driver": self.driver_identity,
+            "required_execution": {
+                "prefill_model_loaded_during_decode": False,
+                "decode_query_length": 1,
+                "cache_free_calls": 0,
+                "prefill_precision": "BF16",
+                "transferred_kv_precision": "BF16",
+                "benchmark_metric_id": (
+                    STANDARD_WIKITEXT2_METRIC_ID
+                    if benchmark.name == "wikitext2"
+                    else TASK_METRIC_ID
+                ),
+                "standard_handoff_token_source": (
+                    "ground_truth" if benchmark.name == "wikitext2" else None
+                ),
+                "post_handoff_metric_id": (
+                    POST_HANDOFF_METRIC_ID if benchmark.name == "wikitext2" else None
+                ),
+                "post_handoff_token_source": (
+                    "prefill_greedy" if benchmark.name == "wikitext2" else None
+                ),
+            },
+        }
+        request_path = artifact_dir / "request.json"
+        write_immutable_json(request_path, request_body)
+        request = load_immutable_json(request_path)
+        result_path = artifact_dir / "result.json"
+        command = tuple(
+            (
+                str(request_path)
+                if token == "{request}"
+                else (
+                    str(result_path)
+                    if token == "{result}"
+                    else str(artifact_dir) if token == "{artifact_dir}" else token
+                )
+            )
+            for token in self.command
+        )
+        completed = subprocess.run(
+            command,
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=self.timeout_seconds,
+            shell=False,
+        )
+        process_path = artifact_dir / "process.json"
+        write_immutable_json(
+            process_path,
+            {
+                "schema_version": "decode-publication-driver-process",
+                "request_hash": request["content_hash"],
+                "command": list(command),
+                "returncode": completed.returncode,
+                "stdout": completed.stdout,
+                "stderr": completed.stderr,
+            },
+        )
+        if completed.returncode != 0:
+            raise RuntimeError(
+                f"publication driver failed with exit {completed.returncode}"
+            )
+        if not result_path.is_file():
+            raise ValueError("publication driver produced no result")
+        result = load_immutable_json(result_path)
+        if result.get("schema_version") != PUBLICATION_DRIVER_RESULT_SCHEMA:
+            raise ValueError("unsupported publication driver result")
+        if (
+            result.get("request_hash") != request["content_hash"]
+            or result.get("configuration_id") != configuration.configuration_id
+            or result.get("benchmark_id") != benchmark.benchmark_id
+        ):
+            raise ValueError("publication driver result binding mismatch")
+        items = tuple(PublicationItemMetric.from_dict(item) for item in result["items"])
+        evidence = PublicationSplitEvidence.from_dict(result["split_execution"])
+        post_handoff_raw = result.get("post_handoff_split_execution")
+        post_handoff_evidence = (
+            PublicationSplitEvidence.from_dict(post_handoff_raw)
+            if isinstance(post_handoff_raw, Mapping)
+            else None
+        )
+        expected_audit = {
+            "input_manifest_hash": self.input_manifest["content_hash"],
+            "prefill_set_sha256": self.input_manifest["prefill_set_sha256"],
+            "decode_bank_sha256": configuration_handle.bank_sha256,
+            "driver_source_tree_sha256": self.driver_identity["source_tree_sha256"],
+            "runtime_fingerprint_sha256": self.driver_identity[
+                "runtime_fingerprint_sha256"
+            ],
+            "enumeration_receipt_sha256": (benchmark.enumeration_receipt_sha256),
+            "evaluated_item_count": benchmark.source_item_count,
+            "score_mode": (
+                "standard_teacher_forced_nll_plus_post_handoff_greedy_nll"
+                if benchmark.name == "wikitext2"
+                else "official_task_score"
+            ),
+        }
+        if result.get("semantic_audit") != expected_audit:
+            raise ValueError("publication driver semantic audit is incomplete")
+        artifact_values = result.get("artifacts")
+        if not isinstance(artifact_values, list) or not artifact_values:
+            raise ValueError("publication driver returned no trace artifacts")
+        artifacts = [str(request_path), str(result_path), str(process_path)]
+        for value in artifact_values:
+            if not isinstance(value, Mapping):
+                raise TypeError("publication driver artifact is malformed")
+            path = _confined(artifact_dir, str(value.get("relative_path", "")))
+            if (
+                not path.is_file()
+                or path.stat().st_size <= 0
+                or _sha256_file(path) != value.get("sha256")
+            ):
+                raise ValueError("publication driver artifact identity mismatch")
+            artifacts.append(str(path))
+        return PublicationEvaluation(
+            items=items,
+            evidence=evidence,
+            artifacts=tuple(artifacts),
+            post_handoff_evidence=post_handoff_evidence,
+        )
+
+
+def create_executor(
+    *,
+    config: Mapping[str, Any],
+    contract: PublicationContract,
+) -> BenchmarkEvaluator:
+    """Create the built-in fail-closed publication bridge."""
+
+    return BenchmarkEvaluator(config=config, contract=contract)
+
+
+__all__ = [
+    "PUBLICATION_DRIVER_REQUEST_SCHEMA",
+    "PUBLICATION_DRIVER_RESULT_SCHEMA",
+    "PUBLICATION_INPUT_SCHEMA",
+    "PublicationBankHandle",
+    "BenchmarkEvaluator",
+    "create_executor",
+]
diff --git a/decode_dse/software/benchmark_runner.py b/decode_dse/software/benchmark_runner.py
new file mode 100644
index 0000000..a07a647
--- /dev/null
+++ b/decode_dse/software/benchmark_runner.py
@@ -0,0 +1,2607 @@
+"""Execute publication benchmarks with fail-closed paired gates."""
+
+from __future__ import annotations
+
+import argparse
+import fcntl
+import hashlib
+import importlib
+import json
+import math
+import os
+import random
+import re
+import time
+import traceback
+from contextlib import AbstractContextManager, contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+import sys
+from typing import Any, Callable, Iterable, Mapping, Protocol, Sequence
+
+from decode_dse.hardware.statistics import percentile
+from decode_dse.legality import StackValidity
+from decode_dse.profiles import DecodePrecisionProfile
+from decode_dse.software.refinement_schedule import DecodeRefinementProfile
+from decode_dse.software.sweep_plan import load_immutable_json, write_immutable_json
+
+
+PUBLICATION_CONTRACT_SCHEMA = "decode-publication-contract"
+PUBLICATION_CONFIGURATION_MANIFEST_SCHEMA = "decode-publication-configurations"
+PUBLICATION_BENCHMARK_MANIFEST_SCHEMA = "decode-publication-benchmark-manifest"
+PUBLICATION_CHAT_TEMPLATE_SCHEMA = "decode-chat-template"
+PUBLICATION_RESULT_SCHEMA = "decode-publication-result"
+PUBLICATION_REPORT_SCHEMA = "decode-publication-report"
+PUBLICATION_ROLES = ("bf16", "uniform_i8", "uniform_i4", "pareto")
+PUBLICATION_BENCHMARKS = ("wikitext2", "ifeval", "gsm8k", "ruler")
+RULER_LENGTHS = (4096, 8192, 16384, 32768)
+STANDARD_WIKITEXT2_METRIC_ID = (
+    "standard_cached_teacher_forced_wikitext2_nll/v1"
+)
+POST_HANDOFF_METRIC_ID = "post_handoff_greedy_conditioned_nll/v1"
+TASK_METRIC_ID = "cached_greedy_official_task_score/v1"
+_IMMUTABLE_REVISION = re.compile(r"^[0-9a-f]{40,64}$")
+
+
+def _timestamp() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _canonical_json(value: Mapping[str, Any]) -> str:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    )
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(_canonical_json(value).encode("utf-8")).hexdigest()
+
+
+def _sha256(value: str, label: str) -> None:
+    if len(value) != 64 or any(character not in "0123456789abcdef" for character in value):
+        raise ValueError(f"{label} must be a lowercase SHA-256")
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for block in iter(lambda: handle.read(1 << 20), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _strict_bool(value: Any, label: str) -> bool:
+    if not isinstance(value, bool):
+        raise TypeError(f"{label} must be a boolean")
+    return value
+
+
+def _artifact(path_value: str) -> dict[str, Any]:
+    path = Path(path_value).resolve()
+    if not path.is_file() or path.stat().st_size <= 0:
+        raise ValueError(f"publication artifact is missing or empty: {path}")
+    payload = path.read_bytes()
+    return {
+        "path": str(path),
+        "size_bytes": len(payload),
+        "sha256": hashlib.sha256(payload).hexdigest(),
+    }
+
+
+@dataclass(frozen=True)
+class PublicationConfiguration:
+    """One precision evaluated once, independently of hardware geometry."""
+
+    role: str
+    profile: DecodePrecisionProfile | DecodeRefinementProfile
+    validity: StackValidity
+
+    def __post_init__(self) -> None:
+        if self.role not in PUBLICATION_ROLES:
+            raise ValueError(f"unsupported publication role {self.role!r}")
+        if self.role == "bf16":
+            if (
+                not isinstance(self.profile, DecodePrecisionProfile)
+                or self.profile.kind != "bf16_reference"
+            ):
+                raise ValueError("the BF16 role requires the split BF16 reference")
+        else:
+            expected = {
+                "uniform_i8": "MXINT8",
+                "uniform_i4": "MXINT4",
+            }.get(self.role)
+            source_profile = (
+                self.profile.source_profile
+                if isinstance(self.profile, DecodeRefinementProfile)
+                else self.profile
+            )
+            if expected is not None and (
+                source_profile.weight_format,
+                source_profile.activation_format,
+                source_profile.key_format,
+                source_profile.value_format,
+            ) != (expected, expected, expected, expected):
+                raise ValueError(
+                    f"{self.role} does not descend from its uniform source"
+                )
+            if any(
+                value is not True
+                for value in (
+                    self.validity.software_valid,
+                    self.validity.compiler_valid,
+                    self.validity.emulator_valid,
+                    self.validity.rtl_valid,
+                )
+            ):
+                raise ValueError(
+                    f"{self.role} requires measured end-to-end hardware validity"
+                )
+
+    @property
+    def configuration_id(self) -> str:
+        body = {
+            "role": self.role,
+            "profile_id": self.profile.profile_id,
+            "validity": self.validity.to_dict(),
+        }
+        return f"pub-{_content_hash(body)}"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "role": self.role,
+            "configuration_id": self.configuration_id,
+            "profile_type": (
+                "refinement"
+                if isinstance(self.profile, DecodeRefinementProfile)
+                else "base"
+            ),
+            "profile": self.profile.to_dict(),
+            "profile_id": self.profile.profile_id,
+            "validity": self.validity.to_dict(),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PublicationConfiguration":
+        profile_type = str(value.get("profile_type", "base"))
+        if profile_type == "base":
+            profile = DecodePrecisionProfile.from_dict(value["profile"])
+        elif profile_type == "refinement":
+            profile = DecodeRefinementProfile.from_dict(value["profile"])
+        else:
+            raise ValueError("publication profile type is unsupported")
+        item = cls(
+            role=str(value["role"]),
+            profile=profile,
+            validity=StackValidity.from_dict(value["validity"]),
+        )
+        if value.get("profile_id") != item.profile.profile_id:
+            raise ValueError("publication profile identity mismatch")
+        if value.get("configuration_id") != item.configuration_id:
+            raise ValueError("publication configuration identity mismatch")
+        return item
+
+
+@dataclass(frozen=True)
+class PublicationHardwareAlternative:
+    """One exact repriced geometry joined only after accuracy evaluation."""
+
+    configuration_id: str
+    profile_id: str
+    source_profile_id: str
+    candidate_id: str
+    record_hash: str
+    hardware_artifact_sha256: str
+    tpot_ms: float
+    energy_per_token_j: float
+    energy_tier: str
+
+    def __post_init__(self) -> None:
+        for label, value in (
+            ("configuration_id", self.configuration_id),
+            ("profile_id", self.profile_id),
+            ("source_profile_id", self.source_profile_id),
+            ("candidate_id", self.candidate_id),
+        ):
+            if not value:
+                raise ValueError(f"publication hardware {label} is required")
+        _sha256(self.record_hash, "record_hash")
+        _sha256(self.hardware_artifact_sha256, "hardware_artifact_sha256")
+        for label, value in (
+            ("tpot_ms", self.tpot_ms),
+            ("energy_per_token_j", self.energy_per_token_j),
+        ):
+            if not math.isfinite(float(value)) or float(value) <= 0:
+                raise ValueError(f"publication hardware {label} must be positive")
+        if self.energy_tier not in {"analytic_anchored", "dc_calibrated"}:
+            raise ValueError("publication hardware energy tier is unsupported")
+
+    @property
+    def alternative_id(self) -> str:
+        return "pubhw-" + _content_hash(
+            {
+                "configuration_id": self.configuration_id,
+                "profile_id": self.profile_id,
+                "source_profile_id": self.source_profile_id,
+                "candidate_id": self.candidate_id,
+                "record_hash": self.record_hash,
+                "hardware_artifact_sha256": self.hardware_artifact_sha256,
+                "tpot_ms": self.tpot_ms,
+                "energy_per_token_j": self.energy_per_token_j,
+                "energy_tier": self.energy_tier,
+            }
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "alternative_id": self.alternative_id,
+            "configuration_id": self.configuration_id,
+            "profile_id": self.profile_id,
+            "source_profile_id": self.source_profile_id,
+            "candidate_id": self.candidate_id,
+            "record_hash": self.record_hash,
+            "hardware_artifact_sha256": self.hardware_artifact_sha256,
+            "tpot_ms": self.tpot_ms,
+            "energy_per_token_j": self.energy_per_token_j,
+            "energy_tier": self.energy_tier,
+        }
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "PublicationHardwareAlternative":
+        item = cls(
+            configuration_id=str(value["configuration_id"]),
+            profile_id=str(value["profile_id"]),
+            source_profile_id=str(value["source_profile_id"]),
+            candidate_id=str(value["candidate_id"]),
+            record_hash=str(value["record_hash"]),
+            hardware_artifact_sha256=str(value["hardware_artifact_sha256"]),
+            tpot_ms=float(value["tpot_ms"]),
+            energy_per_token_j=float(value["energy_per_token_j"]),
+            energy_tier=str(value["energy_tier"]),
+        )
+        if value.get("alternative_id") != item.alternative_id:
+            raise ValueError("publication hardware alternative identity mismatch")
+        return item
+
+
+@dataclass(frozen=True)
+class PublicationBenchmark:
+    """An immutable full-suite item manifest."""
+
+    name: str
+    dataset_name: str
+    dataset_config: str
+    dataset_revision: str
+    split: str
+    item_ids: tuple[str, ...]
+    source_item_count: int
+    item_order_sha256: str
+    item_content_sha256: str
+    dataset_tree_sha256: str
+    enumeration_receipt_sha256: str
+    context_length: int | None = None
+    full_evaluation: bool = True
+
+    def __post_init__(self) -> None:
+        if self.name not in PUBLICATION_BENCHMARKS:
+            raise ValueError(f"unsupported benchmark {self.name!r}")
+        if (
+            not self.dataset_name
+            or not self.dataset_config
+            or not self.dataset_revision
+            or not self.split
+        ):
+            raise ValueError("publication datasets must be pinned")
+        if not _IMMUTABLE_REVISION.fullmatch(self.dataset_revision):
+            raise ValueError("publication dataset revision must be an immutable hash")
+        if not self.full_evaluation:
+            raise ValueError("publication evaluation does not permit benchmark subsets")
+        ids = tuple(map(str, self.item_ids))
+        if not ids or len(ids) != len(set(ids)):
+            raise ValueError("benchmark item IDs must be non-empty and unique")
+        if self.source_item_count != len(ids):
+            raise ValueError("benchmark IDs do not cover the sealed source count")
+        _sha256(self.item_order_sha256, "item_order_sha256")
+        _sha256(self.item_content_sha256, "item_content_sha256")
+        _sha256(self.dataset_tree_sha256, "dataset_tree_sha256")
+        _sha256(
+            self.enumeration_receipt_sha256,
+            "enumeration_receipt_sha256",
+        )
+        expected_order = _content_hash({"item_ids": list(ids)})
+        if self.item_order_sha256 != expected_order:
+            raise ValueError("benchmark item order differs from its receipt")
+        if self.name == "ruler":
+            if self.context_length not in RULER_LENGTHS:
+                raise ValueError("RULER context length is outside the publication evaluation contract")
+        elif self.context_length is not None:
+            raise ValueError("only RULER carries a context length")
+        object.__setattr__(self, "item_ids", ids)
+        receipt_body = {
+            "name": self.name,
+            "dataset_name": self.dataset_name,
+            "dataset_config": self.dataset_config,
+            "dataset_revision": self.dataset_revision,
+            "split": self.split,
+            "context_length": self.context_length,
+            "source_item_count": self.source_item_count,
+            "item_order_sha256": self.item_order_sha256,
+            "item_content_sha256": self.item_content_sha256,
+            "dataset_tree_sha256": self.dataset_tree_sha256,
+        }
+        if self.enumeration_receipt_sha256 != _content_hash(receipt_body):
+            raise ValueError("benchmark enumeration receipt identity mismatch")
+
+    @property
+    def benchmark_id(self) -> str:
+        return f"bench-{_content_hash(self._content_dict())}"
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "dataset_name": self.dataset_name,
+            "dataset_config": self.dataset_config,
+            "dataset_revision": self.dataset_revision,
+            "split": self.split,
+            "item_ids": list(self.item_ids),
+            "source_item_count": self.source_item_count,
+            "item_order_sha256": self.item_order_sha256,
+            "item_content_sha256": self.item_content_sha256,
+            "dataset_tree_sha256": self.dataset_tree_sha256,
+            "enumeration_receipt_sha256": self.enumeration_receipt_sha256,
+            "context_length": self.context_length,
+            "full_evaluation": self.full_evaluation,
+        }
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"benchmark_id": self.benchmark_id}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PublicationBenchmark":
+        benchmark = cls(
+            name=str(value["name"]),
+            dataset_name=str(value["dataset_name"]),
+            dataset_config=str(value["dataset_config"]),
+            dataset_revision=str(value["dataset_revision"]),
+            split=str(value["split"]),
+            item_ids=tuple(value["item_ids"]),
+            source_item_count=int(value["source_item_count"]),
+            item_order_sha256=str(value["item_order_sha256"]),
+            item_content_sha256=str(value["item_content_sha256"]),
+            dataset_tree_sha256=str(value["dataset_tree_sha256"]),
+            enumeration_receipt_sha256=str(
+                value["enumeration_receipt_sha256"]
+            ),
+            context_length=(
+                None
+                if value.get("context_length") is None
+                else int(value["context_length"])
+            ),
+            full_evaluation=_strict_bool(
+                value["full_evaluation"], "full_evaluation"
+            ),
+        )
+        if value.get("benchmark_id") != benchmark.benchmark_id:
+            raise ValueError("publication benchmark identity mismatch")
+        return benchmark
+
+
+@dataclass(frozen=True)
+class LocalDatasetSnapshot:
+    """Rows and local cache files returned by the offline dataset loader."""
+
+    records: tuple[Mapping[str, Any], ...]
+    source_files: tuple[Path, ...]
+
+    def __post_init__(self) -> None:
+        if not self.records:
+            raise ValueError("publication dataset snapshot is empty")
+        if not self.source_files:
+            raise ValueError("publication dataset snapshot has no local source files")
+
+
+@contextmanager
+def _huggingface_offline_environment():
+    """Prevent dataset preparation from consulting a remote Hub endpoint."""
+
+    names = ("HF_HUB_OFFLINE", "HF_DATASETS_OFFLINE")
+    previous = {name: os.environ.get(name) for name in names}
+    os.environ.update({name: "1" for name in names})
+    try:
+        yield
+    finally:
+        for name, value in previous.items():
+            if value is None:
+                os.environ.pop(name, None)
+            else:
+                os.environ[name] = value
+
+
+def _load_local_huggingface_snapshot(
+    specification: Mapping[str, Any],
+) -> LocalDatasetSnapshot:
+    """Read a prepared Arrow snapshot without invoking a Hub-aware loader."""
+
+    try:
+        from datasets import Dataset, concatenate_datasets
+    except ImportError as error:
+        raise RuntimeError(
+            "the pinned datasets package is required to enumerate publication inputs"
+        ) from error
+
+    cache_root = Path(str(specification["cache_dir"])).resolve()
+    if not cache_root.is_dir():
+        raise FileNotFoundError(
+            f"publication dataset cache does not exist: {cache_root}"
+        )
+    dataset_name = str(specification["dataset_name"])
+    dataset_config = str(specification["dataset_config"])
+    dataset_revision = str(specification["dataset_revision"])
+    split = str(specification["split"])
+    snapshot_roots = []
+    for candidate in cache_root.glob(f"*/*/*/{dataset_revision}"):
+        info_path = candidate / "dataset_info.json"
+        if not info_path.is_file():
+            continue
+        try:
+            info = json.loads(info_path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as error:
+            raise ValueError(
+                f"publication dataset metadata is unreadable: {info_path}"
+            ) from error
+        checksums = info.get("download_checksums")
+        splits = info.get("splits")
+        source_prefix = f"hf://datasets/{dataset_name}@{dataset_revision}/"
+        if (
+            info.get("config_name") != dataset_config
+            or not isinstance(checksums, Mapping)
+            or not any(str(value).startswith(source_prefix) for value in checksums)
+            or not isinstance(splits, Mapping)
+            or split not in splits
+        ):
+            continue
+        snapshot_roots.append((candidate.resolve(), info, info_path.resolve()))
+    if len(snapshot_roots) != 1:
+        raise FileNotFoundError(
+            "expected exactly one prepared local dataset snapshot for "
+            f"{dataset_name}/{dataset_config}@{dataset_revision}:{split}; "
+            f"found {len(snapshot_roots)}"
+        )
+    snapshot_root, info, info_path = snapshot_roots[0]
+    dataset_file_prefix = f"{info.get('dataset_name')}-{split}"
+    arrow_files = tuple(
+        sorted(
+            path.resolve()
+            for path in snapshot_root.glob(f"{dataset_file_prefix}*.arrow")
+            if path.name == f"{dataset_file_prefix}.arrow"
+            or path.name.startswith(f"{dataset_file_prefix}-")
+        )
+    )
+    if not arrow_files:
+        raise FileNotFoundError(
+            f"prepared publication split has no Arrow files: {snapshot_root}"
+        )
+    with _huggingface_offline_environment():
+        shards = tuple(Dataset.from_file(str(path)) for path in arrow_files)
+        dataset = shards[0] if len(shards) == 1 else concatenate_datasets(shards)
+    split_info = info["splits"][split]
+    expected_rows = (
+        split_info.get("num_examples")
+        if isinstance(split_info, Mapping)
+        else None
+    )
+    if expected_rows != len(dataset):
+        raise ValueError("prepared publication split differs from dataset metadata")
+    return LocalDatasetSnapshot(
+        records=tuple(dict(record) for record in dataset),
+        source_files=(info_path, *arrow_files),
+    )
+
+
+def _canonical_dataset_value(value: Any) -> Any:
+    if value is None or isinstance(value, (str, bool, int)):
+        return value
+    if isinstance(value, float):
+        if not math.isfinite(value):
+            raise ValueError("publication dataset contains a non-finite number")
+        return value
+    if isinstance(value, Mapping):
+        return {
+            str(key): _canonical_dataset_value(item)
+            for key, item in sorted(value.items(), key=lambda pair: str(pair[0]))
+        }
+    if isinstance(value, (list, tuple)):
+        return [_canonical_dataset_value(item) for item in value]
+    scalar = getattr(value, "item", None)
+    if callable(scalar):
+        return _canonical_dataset_value(scalar())
+    raise TypeError(
+        f"publication dataset contains unsupported value {type(value).__name__}"
+    )
+
+
+def _publication_dataset_specification(
+    name: str,
+    value: Any,
+) -> dict[str, Any]:
+    if not isinstance(value, Mapping):
+        raise TypeError(f"publication dataset {name} must be a mapping")
+    required = {
+        "dataset_name",
+        "dataset_config",
+        "dataset_revision",
+        "split",
+        "cache_dir",
+        "content_columns",
+        "id_column",
+        "source_item_count",
+    }
+    optional = {"context_length"}
+    if set(value) - required - optional or not required.issubset(value):
+        raise ValueError(
+            f"publication dataset {name} declaration has missing or unknown fields"
+        )
+    specification = dict(value)
+    for field in ("dataset_name", "dataset_config", "split", "cache_dir"):
+        if not isinstance(specification[field], str) or not specification[field]:
+            raise ValueError(f"publication dataset {name}.{field} is required")
+    revision = str(specification["dataset_revision"])
+    if not _IMMUTABLE_REVISION.fullmatch(revision):
+        raise ValueError(
+            f"publication dataset {name}.dataset_revision must be an immutable hash"
+        )
+    columns = specification["content_columns"]
+    if (
+        not isinstance(columns, list)
+        or not columns
+        or any(not isinstance(column, str) or not column for column in columns)
+        or len(columns) != len(set(columns))
+    ):
+        raise ValueError(
+            f"publication dataset {name}.content_columns must be unique strings"
+        )
+    id_column = specification["id_column"]
+    if id_column is not None and (
+        not isinstance(id_column, str) or not id_column
+    ):
+        raise ValueError(
+            f"publication dataset {name}.id_column must be null or a string"
+        )
+    count = specification["source_item_count"]
+    if isinstance(count, bool) or not isinstance(count, int) or count <= 0:
+        raise ValueError(
+            f"publication dataset {name}.source_item_count must be positive"
+        )
+    context_length = specification.get("context_length")
+    if name == "ruler":
+        if context_length not in RULER_LENGTHS:
+            raise ValueError("RULER dataset context length is not canonical")
+    elif context_length is not None:
+        raise ValueError("only RULER dataset declarations carry context_length")
+    return specification
+
+
+def _publication_dataset_tree_identity(
+    *,
+    cache_root: Path,
+    source_files: Sequence[Path],
+) -> str:
+    identities = []
+    for path in sorted(Path(value).resolve() for value in source_files):
+        if path != cache_root and cache_root not in path.parents:
+            raise ValueError("publication dataset source escapes its cache root")
+        if not path.is_file() or path.stat().st_size <= 0:
+            raise ValueError(f"publication dataset source is missing or empty: {path}")
+        identities.append(
+            {
+                "path": path.relative_to(cache_root).as_posix(),
+                "size_bytes": path.stat().st_size,
+                "sha256": _sha256_file(path),
+            }
+        )
+    if not identities or len({item["path"] for item in identities}) != len(
+        identities
+    ):
+        raise ValueError("publication dataset source-file identity is incomplete")
+    return _content_hash({"files": identities})
+
+
+def _build_publication_benchmark(
+    name: str,
+    specification: Mapping[str, Any],
+    *,
+    load_snapshot: Callable[[Mapping[str, Any]], LocalDatasetSnapshot],
+) -> PublicationBenchmark:
+    snapshot = load_snapshot(specification)
+    if len(snapshot.records) != int(specification["source_item_count"]):
+        raise ValueError(
+            f"publication dataset {name} contains {len(snapshot.records)} rows; "
+            f"expected {specification['source_item_count']}"
+        )
+    columns = tuple(str(value) for value in specification["content_columns"])
+    id_column = specification["id_column"]
+    item_ids = []
+    canonical_records = []
+    for ordinal, record in enumerate(snapshot.records):
+        if not isinstance(record, Mapping):
+            raise TypeError(f"publication dataset {name} row is not a mapping")
+        required_columns = set(columns)
+        if id_column is not None:
+            required_columns.add(str(id_column))
+        missing = required_columns - set(record)
+        if missing:
+            raise ValueError(
+                f"publication dataset {name} row is missing {sorted(missing)}"
+            )
+        content = {
+            column: _canonical_dataset_value(record[column])
+            for column in columns
+        }
+        row_hash = _content_hash(content)
+        if id_column is None:
+            item_id = f"{ordinal:08d}-{row_hash[:16]}"
+        else:
+            item_id = str(_canonical_dataset_value(record[str(id_column)]))
+            if not item_id:
+                raise ValueError(f"publication dataset {name} has an empty item ID")
+        item_ids.append(item_id)
+        canonical_records.append({"item_id": item_id, "content": content})
+    if len(item_ids) != len(set(item_ids)):
+        raise ValueError(f"publication dataset {name} item IDs are not unique")
+    item_order_sha256 = _content_hash({"item_ids": item_ids})
+    item_content_sha256 = _content_hash({"records": canonical_records})
+    cache_root = Path(str(specification["cache_dir"])).resolve()
+    dataset_tree_sha256 = _publication_dataset_tree_identity(
+        cache_root=cache_root,
+        source_files=snapshot.source_files,
+    )
+    receipt_body = {
+        "name": name,
+        "dataset_name": str(specification["dataset_name"]),
+        "dataset_config": str(specification["dataset_config"]),
+        "dataset_revision": str(specification["dataset_revision"]),
+        "split": str(specification["split"]),
+        "context_length": specification.get("context_length"),
+        "source_item_count": len(item_ids),
+        "item_order_sha256": item_order_sha256,
+        "item_content_sha256": item_content_sha256,
+        "dataset_tree_sha256": dataset_tree_sha256,
+    }
+    return PublicationBenchmark(
+        name=name,
+        dataset_name=str(specification["dataset_name"]),
+        dataset_config=str(specification["dataset_config"]),
+        dataset_revision=str(specification["dataset_revision"]),
+        split=str(specification["split"]),
+        item_ids=tuple(item_ids),
+        source_item_count=len(item_ids),
+        item_order_sha256=item_order_sha256,
+        item_content_sha256=item_content_sha256,
+        dataset_tree_sha256=dataset_tree_sha256,
+        enumeration_receipt_sha256=_content_hash(receipt_body),
+        context_length=specification.get("context_length"),
+    )
+
+
+def build_publication_benchmark_manifest(
+    config: Mapping[str, Any],
+    *,
+    load_snapshot: Callable[[Mapping[str, Any]], LocalDatasetSnapshot]
+    | None = None,
+) -> dict[str, Any]:
+    """Enumerate complete benchmark splits from immutable local snapshots."""
+
+    publication = config.get("publication")
+    if not isinstance(publication, Mapping):
+        raise ValueError("config.publication is required")
+    declared = publication.get("benchmark_datasets")
+    if not isinstance(declared, Mapping):
+        raise ValueError("config.publication.benchmark_datasets is required")
+    required = {"wikitext2", "ifeval", "gsm8k"}
+    if not required.issubset(declared) or set(declared) - set(
+        PUBLICATION_BENCHMARKS
+    ):
+        raise ValueError(
+            "publication datasets require WikiText-2, IFEval, and GSM8K; "
+            "RULER is optional"
+        )
+    loader = _load_local_huggingface_snapshot if load_snapshot is None else load_snapshot
+    benchmarks = []
+    for name in PUBLICATION_BENCHMARKS:
+        raw = declared.get(name)
+        if raw is None:
+            continue
+        values = raw if name == "ruler" and isinstance(raw, list) else [raw]
+        for value in values:
+            specification = _publication_dataset_specification(name, value)
+            benchmarks.append(
+                _build_publication_benchmark(
+                    name,
+                    specification,
+                    load_snapshot=loader,
+                )
+            )
+    ruler_lengths = sorted(
+        benchmark.context_length
+        for benchmark in benchmarks
+        if benchmark.name == "ruler"
+    )
+    if ruler_lengths not in ([], list(RULER_LENGTHS)):
+        raise ValueError("RULER must be omitted or declared at every canonical length")
+    body = {
+        "schema_version": PUBLICATION_BENCHMARK_MANIFEST_SCHEMA,
+        "benchmarks": [benchmark.to_dict() for benchmark in benchmarks],
+    }
+    return body | {"manifest_hash": _content_hash(body)}
+
+
+def load_publication_benchmark_manifest(
+    path: str | Path,
+) -> tuple[PublicationBenchmark, ...]:
+    value = load_immutable_json(path)
+    value.pop("content_hash", None)
+    if value.get("schema_version") != PUBLICATION_BENCHMARK_MANIFEST_SCHEMA:
+        raise ValueError("unsupported publication benchmark manifest")
+    manifest_hash = value.pop("manifest_hash", None)
+    if manifest_hash != _content_hash(value):
+        raise ValueError("publication benchmark manifest identity mismatch")
+    records = value.get("benchmarks")
+    if not isinstance(records, list):
+        raise ValueError("publication benchmark manifest records are missing")
+    return tuple(PublicationBenchmark.from_dict(record) for record in records)
+
+
+@dataclass(frozen=True)
+class PublicationProtocol:
+    model_name: str
+    model_revision: str
+    tokenizer_revision: str
+    chat_template_sha256: str
+    thinking_mode: str
+    enable_thinking: bool
+    greedy: bool
+    temperature: float
+    token_budgets: tuple[tuple[str, int], ...]
+    output_head_location: str = "external_bf16_service"
+    output_head_precision: str = "BF16"
+
+    def __post_init__(self) -> None:
+        for label, value in (
+            ("model_name", self.model_name),
+            ("model_revision", self.model_revision),
+            ("tokenizer_revision", self.tokenizer_revision),
+            ("thinking_mode", self.thinking_mode),
+        ):
+            if not value:
+                raise ValueError(f"{label} must be pinned")
+        for label, value in (
+            ("model_revision", self.model_revision),
+            ("tokenizer_revision", self.tokenizer_revision),
+        ):
+            if not _IMMUTABLE_REVISION.fullmatch(value):
+                raise ValueError(f"{label} must be an immutable hash")
+        if self.thinking_mode != "disabled" or self.enable_thinking is not False:
+            raise ValueError(
+                "publication evaluation requires thinking to be disabled"
+            )
+        _sha256(self.chat_template_sha256, "chat_template_sha256")
+        if not self.greedy or self.temperature != 0.0:
+            raise ValueError("publication evaluation generation must be greedy with temperature zero")
+        budgets = tuple((str(name), int(value)) for name, value in self.token_budgets)
+        if {name for name, _ in budgets} != set(PUBLICATION_BENCHMARKS):
+            raise ValueError("token budgets must cover every publication evaluation benchmark")
+        if len(budgets) != len(set(name for name, _ in budgets)):
+            raise ValueError("token budgets contain duplicates")
+        if any(value <= 0 for _, value in budgets):
+            raise ValueError("token budgets must be positive")
+        if (
+            self.output_head_location != "external_bf16_service"
+            or self.output_head_precision != "BF16"
+        ):
+            raise ValueError(
+                "headline publication evaluation requires the remote BF16 head"
+            )
+        object.__setattr__(self, "token_budgets", tuple(sorted(budgets)))
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "tokenizer_revision": self.tokenizer_revision,
+            "chat_template_sha256": self.chat_template_sha256,
+            "thinking_mode": self.thinking_mode,
+            "enable_thinking": self.enable_thinking,
+            "greedy": self.greedy,
+            "temperature": self.temperature,
+            "token_budgets": dict(self.token_budgets),
+            "output_head_location": self.output_head_location,
+            "output_head_precision": self.output_head_precision,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PublicationProtocol":
+        budgets = value["token_budgets"]
+        if not isinstance(budgets, Mapping):
+            raise TypeError("token_budgets must be a mapping")
+        return cls(
+            model_name=str(value["model_name"]),
+            model_revision=str(value["model_revision"]),
+            tokenizer_revision=str(value["tokenizer_revision"]),
+            chat_template_sha256=str(value["chat_template_sha256"]),
+            thinking_mode=str(value["thinking_mode"]),
+            enable_thinking=_strict_bool(
+                value["enable_thinking"], "enable_thinking"
+            ),
+            greedy=_strict_bool(value["greedy"], "greedy"),
+            temperature=float(value["temperature"]),
+            token_budgets=tuple(
+                (str(name), int(budget)) for name, budget in budgets.items()
+            ),
+            output_head_location=str(value["output_head_location"]),
+            output_head_precision=str(value["output_head_precision"]),
+        )
+
+
+@dataclass(frozen=True)
+class PublicationContract:
+    configurations: tuple[PublicationConfiguration, ...]
+    hardware_alternatives: tuple[PublicationHardwareAlternative, ...]
+    benchmarks: tuple[PublicationBenchmark, ...]
+    protocol: PublicationProtocol
+    schema_version: str = PUBLICATION_CONTRACT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != PUBLICATION_CONTRACT_SCHEMA:
+            raise ValueError("unsupported publication contract schema")
+        configurations = tuple(self.configurations)
+        if tuple(item.role for item in configurations) != PUBLICATION_ROLES:
+            raise ValueError("publication evaluation configurations must be BF16/I8/I4/Pareto in order")
+        ids = tuple(item.configuration_id for item in configurations)
+        profile_ids = tuple(item.profile.profile_id for item in configurations)
+        if len(ids) != len(set(ids)) or len(profile_ids) != len(set(profile_ids)):
+            raise ValueError("publication evaluation configurations must be distinct")
+        configuration_by_id = {
+            item.configuration_id: item for item in configurations
+        }
+        alternatives = tuple(self.hardware_alternatives)
+        identities = tuple(
+            (item.configuration_id, item.candidate_id) for item in alternatives
+        )
+        if len(identities) != len(set(identities)):
+            raise ValueError("publication hardware alternatives must be distinct")
+        alternatives_by_configuration: dict[
+            str, list[PublicationHardwareAlternative]
+        ] = {}
+        for alternative in alternatives:
+            configuration = configuration_by_id.get(
+                alternative.configuration_id
+            )
+            if (
+                configuration is None
+                or configuration.role == "bf16"
+                or alternative.profile_id != configuration.profile.profile_id
+            ):
+                raise ValueError(
+                    "publication hardware alternative differs from its accuracy configuration"
+                )
+            alternatives_by_configuration.setdefault(
+                alternative.configuration_id,
+                [],
+            ).append(alternative)
+        for configuration in configurations:
+            count = len(
+                alternatives_by_configuration.get(
+                    configuration.configuration_id,
+                    (),
+                )
+            )
+            if (configuration.role == "bf16" and count) or (
+                configuration.role != "bf16" and not count
+            ):
+                raise ValueError(
+                    "publication hardware coverage differs from accuracy configurations"
+                )
+        benchmarks = tuple(self.benchmarks)
+        names = [item.name for item in benchmarks]
+        if names.count("wikitext2") != 1 or names.count("ifeval") != 1 or names.count("gsm8k") != 1:
+            raise ValueError("publication evaluation requires one full WikiText-2, IFEval, and GSM8K")
+        ruler = sorted(
+            item.context_length for item in benchmarks if item.name == "ruler"
+        )
+        if ruler not in ([], list(RULER_LENGTHS)):
+            raise ValueError(
+                "publication evaluation requires either no RULER study or "
+                "RULER at 4K/8K/16K/32K"
+            )
+        benchmark_ids = tuple(item.benchmark_id for item in benchmarks)
+        if len(benchmark_ids) != len(set(benchmark_ids)):
+            raise ValueError("publication evaluation benchmark identities must be unique")
+        object.__setattr__(self, "configurations", configurations)
+        object.__setattr__(self, "hardware_alternatives", alternatives)
+        object.__setattr__(self, "benchmarks", benchmarks)
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "configurations": [item.to_dict() for item in self.configurations],
+            "hardware_alternatives": [
+                item.to_dict() for item in self.hardware_alternatives
+            ],
+            "benchmarks": [item.to_dict() for item in self.benchmarks],
+            "protocol": self.protocol.to_dict(),
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return _content_hash(self._content_dict())
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"contract_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PublicationContract":
+        contract = cls(
+            configurations=tuple(
+                PublicationConfiguration.from_dict(item)
+                for item in value["configurations"]
+            ),
+            hardware_alternatives=tuple(
+                PublicationHardwareAlternative.from_dict(item)
+                for item in value["hardware_alternatives"]
+            ),
+            benchmarks=tuple(
+                PublicationBenchmark.from_dict(item)
+                for item in value["benchmarks"]
+            ),
+            protocol=PublicationProtocol.from_dict(value["protocol"]),
+            schema_version=str(value["schema_version"]),
+        )
+        if value.get("contract_hash") != contract.canonical_hash:
+            raise ValueError("publication contract identity mismatch")
+        return contract
+
+
+@dataclass(frozen=True)
+class PublicationItemMetric:
+    item_id: str
+    score: float | None = None
+    nll_sum: float | None = None
+    token_count: int | None = None
+    post_handoff_nll_sum: float | None = None
+    post_handoff_token_count: int | None = None
+
+    def __post_init__(self) -> None:
+        if not self.item_id:
+            raise ValueError("publication item ID is required")
+        score_mode = self.score is not None
+        nll_mode = self.nll_sum is not None or self.token_count is not None
+        post_handoff_mode = (
+            self.post_handoff_nll_sum is not None
+            or self.post_handoff_token_count is not None
+        )
+        if score_mode == nll_mode:
+            raise ValueError("item result must contain either score or NLL")
+        if score_mode and post_handoff_mode:
+            raise ValueError("task scores cannot carry WikiText-2 NLL")
+        if nll_mode != post_handoff_mode:
+            raise ValueError(
+                "WikiText-2 requires standard and split-boundary NLL"
+            )
+        if score_mode and (
+            not math.isfinite(float(self.score)) or not 0 <= float(self.score) <= 100
+        ):
+            raise ValueError("task score must be finite and in percentage points")
+        if nll_mode and (
+            self.nll_sum is None
+            or self.token_count is None
+            or not math.isfinite(self.nll_sum)
+            or self.nll_sum < 0
+            or self.token_count <= 0
+        ):
+            raise ValueError("NLL result is invalid")
+        if post_handoff_mode and (
+            self.post_handoff_nll_sum is None
+            or self.post_handoff_token_count is None
+            or not math.isfinite(self.post_handoff_nll_sum)
+            or self.post_handoff_nll_sum < 0
+            or self.post_handoff_token_count <= 0
+        ):
+            raise ValueError("post-handoff NLL result is invalid")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "item_id": self.item_id,
+            "score": self.score,
+            "score_unit": "percentage_points" if self.score is not None else None,
+            "nll_sum": self.nll_sum,
+            "token_count": self.token_count,
+            "post_handoff_nll_sum": self.post_handoff_nll_sum,
+            "post_handoff_token_count": self.post_handoff_token_count,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PublicationItemMetric":
+        if value.get("score") is not None and value.get("score_unit") not in {
+            None,
+            "percentage_points",
+        }:
+            raise ValueError("publication task-score unit mismatch")
+        return cls(
+            item_id=str(value["item_id"]),
+            score=None if value.get("score") is None else float(value["score"]),
+            nll_sum=(
+                None if value.get("nll_sum") is None else float(value["nll_sum"])
+            ),
+            token_count=(
+                None
+                if value.get("token_count") is None
+                else int(value["token_count"])
+            ),
+            post_handoff_nll_sum=(
+                None
+                if value.get("post_handoff_nll_sum") is None
+                else float(value["post_handoff_nll_sum"])
+            ),
+            post_handoff_token_count=(
+                None
+                if value.get("post_handoff_token_count") is None
+                else int(value["post_handoff_token_count"])
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class PublicationSplitEvidence:
+    mode: str
+    metric_id: str
+    handoff_token_source: str
+    prefill_precision: str
+    transferred_kv_precision: str
+    first_token_owner: str
+    decode_q_lengths: tuple[int, ...]
+    exact_cache_positions: bool
+    exact_one_entry_growth: bool
+    independent_caches: bool
+    admission_count_per_prompt: int
+    cache_free_calls: int
+    full_item_coverage: bool
+
+    def __post_init__(self) -> None:
+        expected = {
+            "teacher_forced_cached": (
+                STANDARD_WIKITEXT2_METRIC_ID,
+                "ground_truth",
+                "teacher_forced_reference",
+            ),
+            "greedy_conditioned_cached_nll": (
+                POST_HANDOFF_METRIC_ID,
+                "prefill_greedy",
+                "prefill",
+            ),
+            "greedy_cached_generation": (
+                TASK_METRIC_ID,
+                "prefill_greedy",
+                "prefill",
+            ),
+        }
+        if self.mode not in expected:
+            raise ValueError("unsupported publication evaluation decode mode")
+        if (
+            self.metric_id,
+            self.handoff_token_source,
+            self.first_token_owner,
+        ) != expected[self.mode]:
+            raise ValueError("publication evaluation handoff metric contract is invalid")
+        if (
+            self.prefill_precision != "BF16"
+            or self.transferred_kv_precision != "BF16"
+        ):
+            raise ValueError("publication evaluation split-prefill contract is invalid")
+        if self.decode_q_lengths != (1,):
+            raise ValueError("publication evaluation may contain only cached q_len=1 decode")
+        if not all(
+            (
+                self.exact_cache_positions,
+                self.exact_one_entry_growth,
+                self.independent_caches,
+                self.full_item_coverage,
+            )
+        ):
+            raise ValueError("publication evaluation cached-decode evidence is incomplete")
+        if self.admission_count_per_prompt != 1 or self.cache_free_calls != 0:
+            raise ValueError("publication evaluation admission/cache-free accounting is invalid")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "mode": self.mode,
+            "metric_id": self.metric_id,
+            "handoff_token_source": self.handoff_token_source,
+            "prefill_precision": self.prefill_precision,
+            "transferred_kv_precision": self.transferred_kv_precision,
+            "first_token_owner": self.first_token_owner,
+            "decode_q_lengths": list(self.decode_q_lengths),
+            "exact_cache_positions": self.exact_cache_positions,
+            "exact_one_entry_growth": self.exact_one_entry_growth,
+            "independent_caches": self.independent_caches,
+            "admission_count_per_prompt": self.admission_count_per_prompt,
+            "cache_free_calls": self.cache_free_calls,
+            "full_item_coverage": self.full_item_coverage,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PublicationSplitEvidence":
+        return cls(
+            mode=str(value["mode"]),
+            metric_id=str(value["metric_id"]),
+            handoff_token_source=str(value["handoff_token_source"]),
+            prefill_precision=str(value["prefill_precision"]),
+            transferred_kv_precision=str(value["transferred_kv_precision"]),
+            first_token_owner=str(value["first_token_owner"]),
+            decode_q_lengths=tuple(int(item) for item in value["decode_q_lengths"]),
+            exact_cache_positions=_strict_bool(
+                value["exact_cache_positions"], "exact_cache_positions"
+            ),
+            exact_one_entry_growth=_strict_bool(
+                value["exact_one_entry_growth"], "exact_one_entry_growth"
+            ),
+            independent_caches=_strict_bool(
+                value["independent_caches"], "independent_caches"
+            ),
+            admission_count_per_prompt=int(value["admission_count_per_prompt"]),
+            cache_free_calls=int(value["cache_free_calls"]),
+            full_item_coverage=_strict_bool(
+                value["full_item_coverage"], "full_item_coverage"
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class PublicationEvaluation:
+    items: tuple[PublicationItemMetric, ...]
+    evidence: PublicationSplitEvidence
+    artifacts: tuple[str, ...]
+    post_handoff_evidence: PublicationSplitEvidence | None = None
+
+    def __post_init__(self) -> None:
+        if not self.items:
+            raise ValueError("publication evaluation returned no items")
+        if not self.artifacts:
+            raise ValueError("publication evaluation returned no artifacts")
+        if self.evidence.metric_id == STANDARD_WIKITEXT2_METRIC_ID:
+            if (
+                self.post_handoff_evidence is None
+                or self.post_handoff_evidence.metric_id
+                != POST_HANDOFF_METRIC_ID
+            ):
+                raise ValueError(
+                    "WikiText-2 requires split-boundary metric evidence"
+                )
+        elif self.post_handoff_evidence is not None:
+            raise ValueError(
+                "task suites cannot carry split-boundary NLL evidence"
+            )
+
+
+class PublicationExecutor(Protocol):
+    def open_configuration(
+        self,
+        configuration: PublicationConfiguration,
+        protocol: PublicationProtocol,
+    ) -> AbstractContextManager[Any]:
+        ...
+
+    def evaluate(
+        self,
+        configuration: PublicationConfiguration,
+        benchmark: PublicationBenchmark,
+        protocol: PublicationProtocol,
+        *,
+        configuration_handle: Any,
+    ) -> PublicationEvaluation:
+        ...
+
+
+def load_publication_executor(
+    factory_spec: str,
+    *,
+    config: Mapping[str, Any],
+    contract: PublicationContract,
+) -> PublicationExecutor:
+    """Load an explicit external adapter; no legacy evaluator is accepted."""
+
+    module_name, separator, function_name = factory_spec.partition(":")
+    if not separator or not module_name or not function_name:
+        raise ValueError("executor factory must use module:function syntax")
+    factory = getattr(importlib.import_module(module_name), function_name)
+    executor = factory(config=config, contract=contract)
+    for name in ("open_configuration", "evaluate"):
+        if not callable(getattr(executor, name, None)):
+            raise TypeError(f"publication executor lacks {name}")
+    return executor
+
+
+def _paired_bootstrap(
+    reference: Sequence[float],
+    candidate: Sequence[float],
+    *,
+    seed: int,
+    replicates: int,
+    mode: str,
+) -> dict[str, Any]:
+    if len(reference) != len(candidate) or len(reference) < 2:
+        raise ValueError("paired bootstrap requires aligned observations")
+    rng = random.Random(seed)
+    values = []
+    count = len(reference)
+    for _ in range(replicates):
+        indices = [rng.randrange(count) for _ in range(count)]
+        left = sum(reference[index] for index in indices) / count
+        right = sum(candidate[index] for index in indices) / count
+        values.append(right - left if mode == "difference" else right / left)
+    left = sum(reference) / count
+    right = sum(candidate) / count
+    estimate = right - left if mode == "difference" else right / left
+    return {
+        "method": "paired_item_bootstrap",
+        "mode": mode,
+        "replicates": replicates,
+        "seed": seed,
+        "estimate": estimate,
+        "ci95_low": percentile(values, 0.025),
+        "ci95_high": percentile(values, 0.975),
+    }
+
+
+def _paired_document_nll_bootstrap(
+    reference: Sequence[tuple[float, int]],
+    candidate: Sequence[tuple[float, int]],
+    *,
+    seed: int,
+    replicates: int,
+) -> dict[str, Any]:
+    if len(reference) != len(candidate) or len(reference) < 2:
+        raise ValueError("paired NLL bootstrap requires aligned documents")
+    if any(left[1] != right[1] for left, right in zip(reference, candidate)):
+        raise ValueError("paired NLL documents have different token counts")
+    rng = random.Random(seed)
+    count = len(reference)
+    ratios = []
+    for _ in range(replicates):
+        indices = [rng.randrange(count) for _ in range(count)]
+        ref_nll = sum(reference[index][0] for index in indices)
+        cand_nll = sum(candidate[index][0] for index in indices)
+        tokens = sum(reference[index][1] for index in indices)
+        ratios.append(math.exp((cand_nll - ref_nll) / tokens))
+    reference_nll = sum(value for value, _ in reference)
+    candidate_nll = sum(value for value, _ in candidate)
+    tokens = sum(value for _, value in reference)
+    return {
+        "method": "paired_document_cluster_bootstrap",
+        "mode": "perplexity_ratio",
+        "replicates": replicates,
+        "seed": seed,
+        "estimate": math.exp((candidate_nll - reference_nll) / tokens),
+        "ci95_low": percentile(ratios, 0.025),
+        "ci95_high": percentile(ratios, 0.975),
+    }
+
+
+class _PublicationStore:
+    def __init__(self, root: Path, contract: PublicationContract) -> None:
+        self.root = root
+        self.contract = contract
+        self.path = root / "results.jsonl"
+        root.mkdir(parents=True, exist_ok=True)
+        self.records: dict[tuple[str, str, int], dict[str, Any]] = {}
+        self._load()
+
+    def _load(self) -> None:
+        if not self.path.exists():
+            return
+        payload = self.path.read_bytes()
+        if payload and not payload.endswith(b"\n"):
+            payload = payload[: payload.rfind(b"\n") + 1]
+            descriptor = os.open(self.path, os.O_WRONLY | os.O_TRUNC)
+            try:
+                os.write(descriptor, payload)
+                os.fsync(descriptor)
+            finally:
+                os.close(descriptor)
+        configurations = {
+            item.configuration_id: item for item in self.contract.configurations
+        }
+        benchmarks = {
+            item.benchmark_id: item for item in self.contract.benchmarks
+        }
+        for line_number, line in enumerate(payload.splitlines(), start=1):
+            value = json.loads(line)
+            record_hash = value.pop("record_hash", None)
+            if record_hash != _content_hash(value):
+                raise ValueError(
+                    f"publication result checksum mismatch at line {line_number}"
+                )
+            if value.get("contract_hash") != self.contract.canonical_hash:
+                raise ValueError("publication result contract mismatch")
+            if value.get("schema_version") != PUBLICATION_RESULT_SCHEMA:
+                raise ValueError("publication result schema mismatch")
+            attempt = value.get("attempt")
+            runtime_seconds = value.get("runtime_seconds")
+            if (
+                isinstance(attempt, bool)
+                or not isinstance(attempt, int)
+                or not 1 <= attempt <= 3
+                or isinstance(runtime_seconds, bool)
+                or not isinstance(runtime_seconds, (int, float))
+                or not math.isfinite(runtime_seconds)
+                or runtime_seconds < 0
+                or value.get("state") not in {"succeeded", "failed"}
+            ):
+                raise ValueError("publication result terminal fields are invalid")
+            configuration = configurations.get(value.get("configuration_id"))
+            benchmark = benchmarks.get(value.get("benchmark_id"))
+            if (
+                configuration is None
+                or benchmark is None
+                or value.get("configuration") != configuration.to_dict()
+                or value.get("benchmark") != benchmark.to_dict()
+            ):
+                raise ValueError("publication result binding mismatch")
+            key = (
+                configuration.configuration_id,
+                benchmark.benchmark_id,
+                attempt,
+            )
+            if key in self.records:
+                raise ValueError("duplicate publication result attempt")
+            if value.get("state") == "succeeded":
+                if (
+                    not isinstance(value.get("result"), Mapping)
+                    or value.get("error_class") is not None
+                    or value.get("error_message") is not None
+                ):
+                    raise ValueError("successful publication result is malformed")
+                artifacts = value.get("artifacts")
+                if not isinstance(artifacts, list) or not artifacts:
+                    raise ValueError("successful publication result has no artifacts")
+                if any(_artifact(item["path"]) != item for item in artifacts):
+                    raise ValueError("publication artifact identity changed")
+            elif (
+                value.get("result") is not None
+                or not value.get("error_class")
+                or value.get("error_message") is None
+            ):
+                raise ValueError("failed publication result is malformed")
+            self.records[key] = value | {"record_hash": record_hash}
+
+    def latest(self, configuration_id: str, benchmark_id: str) -> dict[str, Any] | None:
+        rows = [
+            value
+            for (left, right, _), value in self.records.items()
+            if left == configuration_id and right == benchmark_id
+        ]
+        return max(rows, key=lambda value: value["attempt"], default=None)
+
+    def append(
+        self,
+        configuration: PublicationConfiguration,
+        benchmark: PublicationBenchmark,
+        *,
+        attempt: int,
+        state: str,
+        result: Mapping[str, Any] | None,
+        artifacts: Sequence[Mapping[str, Any]],
+        runtime_seconds: float,
+        error: BaseException | None = None,
+    ) -> None:
+        body = {
+            "schema_version": PUBLICATION_RESULT_SCHEMA,
+            "contract_hash": self.contract.canonical_hash,
+            "configuration_id": configuration.configuration_id,
+            "configuration": configuration.to_dict(),
+            "benchmark_id": benchmark.benchmark_id,
+            "benchmark": benchmark.to_dict(),
+            "attempt": attempt,
+            "state": state,
+            "result": result,
+            "artifacts": [dict(item) for item in artifacts],
+            "error_class": type(error).__name__ if error else None,
+            "error_message": str(error) if error else None,
+            "traceback": traceback.format_exc() if error else None,
+            "runtime_seconds": runtime_seconds,
+            "completed_at": _timestamp(),
+        }
+        record = body | {"record_hash": _content_hash(body)}
+        key = (
+            configuration.configuration_id,
+            benchmark.benchmark_id,
+            attempt,
+        )
+        if key in self.records:
+            raise ValueError("publication result attempt already exists")
+        payload = (_canonical_json(record) + "\n").encode("utf-8")
+        descriptor = os.open(
+            self.path,
+            os.O_APPEND | os.O_CREAT | os.O_WRONLY,
+            0o644,
+        )
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            os.write(descriptor, payload)
+            os.fsync(descriptor)
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+        self.records[key] = record
+
+
+@dataclass(frozen=True)
+class PublicationRunSummary:
+    succeeded: int
+    failed_terminal: int
+    pending: int
+    report_path: str | None
+
+
+class PublicationRunner:
+    """Run every configuration/benchmark pair and seal selection gates."""
+
+    def __init__(
+        self,
+        *,
+        contract: PublicationContract,
+        executor: PublicationExecutor,
+        output_dir: str | Path,
+        bootstrap_replicates: int = 2000,
+        max_attempts: int = 3,
+    ) -> None:
+        if bootstrap_replicates < 100:
+            raise ValueError("publication bootstrap requires at least 100 replicates")
+        if max_attempts != 3:
+            raise ValueError("publication execution requires three attempts")
+        self.contract = contract
+        self.executor = executor
+        self.output_dir = Path(output_dir)
+        self.bootstrap_replicates = bootstrap_replicates
+        self.max_attempts = max_attempts
+
+    @contextmanager
+    def _lock(self):
+        self.output_dir.mkdir(parents=True, exist_ok=True)
+        descriptor = os.open(
+            self.output_dir / ".run.lock",
+            os.O_CREAT | os.O_RDWR,
+            0o644,
+        )
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            yield
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    @staticmethod
+    def _validate_evaluation(
+        benchmark: PublicationBenchmark,
+        evaluation: PublicationEvaluation,
+    ) -> dict[str, Any]:
+        items = tuple(evaluation.items)
+        if tuple(item.item_id for item in items) != benchmark.item_ids:
+            raise ValueError("publication item coverage/order differs from contract")
+        if benchmark.name == "wikitext2":
+            if (
+                evaluation.evidence.metric_id
+                != STANDARD_WIKITEXT2_METRIC_ID
+                or evaluation.evidence.mode != "teacher_forced_cached"
+                or evaluation.post_handoff_evidence is None
+                or evaluation.post_handoff_evidence.metric_id
+                != POST_HANDOFF_METRIC_ID
+            ):
+                raise ValueError(
+                    "WikiText-2 requires standard and split-boundary evidence"
+                )
+            if any(
+                item.nll_sum is None
+                or item.post_handoff_nll_sum is None
+                for item in items
+            ):
+                raise ValueError("WikiText-2 returned incomplete NLL metrics")
+            nll_sum = sum(float(item.nll_sum) for item in items)
+            token_count = sum(int(item.token_count) for item in items)
+            post_handoff_nll_sum = sum(
+                float(item.post_handoff_nll_sum) for item in items
+            )
+            post_handoff_token_count = sum(
+                int(item.post_handoff_token_count) for item in items
+            )
+            result = {
+                "metric_id": STANDARD_WIKITEXT2_METRIC_ID,
+                "nll_sum": nll_sum,
+                "token_count": token_count,
+                "mean_token_nll": nll_sum / token_count,
+                "perplexity": math.exp(nll_sum / token_count),
+                "post_handoff_metric_id": POST_HANDOFF_METRIC_ID,
+                "post_handoff_nll_sum": post_handoff_nll_sum,
+                "post_handoff_token_count": post_handoff_token_count,
+                "post_handoff_greedy_conditioned_nll": (
+                    post_handoff_nll_sum / post_handoff_token_count
+                ),
+                "post_handoff_greedy_conditioned_exp_nll": math.exp(
+                    post_handoff_nll_sum / post_handoff_token_count
+                ),
+            }
+        else:
+            if (
+                evaluation.evidence.mode != "greedy_cached_generation"
+                or evaluation.evidence.metric_id != TASK_METRIC_ID
+            ):
+                raise ValueError("task suites require cached greedy generation")
+            if any(item.score is None for item in items):
+                raise ValueError("task suite returned NLL instead of scores")
+            result = {
+                "metric_id": TASK_METRIC_ID,
+                "score": sum(float(item.score) for item in items) / len(items),
+                "score_unit": "percentage_points",
+            }
+        return {
+            **result,
+            "items": [item.to_dict() for item in items],
+            "split_execution": evaluation.evidence.to_dict(),
+            "post_handoff_split_execution": (
+                evaluation.post_handoff_evidence.to_dict()
+                if evaluation.post_handoff_evidence is not None
+                else None
+            ),
+        }
+
+    def _report(self, store: _PublicationStore) -> dict[str, Any]:
+        rows: dict[tuple[str, str], Mapping[str, Any]] = {}
+        for configuration in self.contract.configurations:
+            for benchmark in self.contract.benchmarks:
+                latest = store.latest(
+                    configuration.configuration_id,
+                    benchmark.benchmark_id,
+                )
+                if latest is None or latest["state"] != "succeeded":
+                    raise ValueError("publication report requires every successful result")
+                rows[(configuration.role, benchmark.benchmark_id)] = latest["result"]
+        reference_role = "bf16"
+        gates = {}
+        split_boundary_comparisons = {}
+        for configuration in self.contract.configurations[1:]:
+            role = configuration.role
+            role_gates: dict[str, Any] = {}
+            for benchmark in self.contract.benchmarks:
+                reference = rows[(reference_role, benchmark.benchmark_id)]
+                candidate = rows[(role, benchmark.benchmark_id)]
+                reference_items = reference["items"]
+                candidate_items = candidate["items"]
+                seed = int(
+                    hashlib.sha256(
+                        f"{configuration.configuration_id}:{benchmark.benchmark_id}".encode()
+                    ).hexdigest()[:16],
+                    16,
+                )
+                if benchmark.name == "wikitext2":
+                    ref_values = [
+                        (float(item["nll_sum"]), int(item["token_count"]))
+                        for item in reference_items
+                    ]
+                    cand_values = [
+                        (float(item["nll_sum"]), int(item["token_count"]))
+                        for item in candidate_items
+                    ]
+                    comparison = _paired_document_nll_bootstrap(
+                        ref_values,
+                        cand_values,
+                        seed=seed,
+                        replicates=self.bootstrap_replicates,
+                    )
+                    perplexity_ratio = comparison["estimate"]
+                    role_gates["wikitext2"] = {
+                        "relative_perplexity_ratio": perplexity_ratio,
+                        "paired_document_bootstrap": comparison,
+                        "passed": perplexity_ratio <= 1.01,
+                    }
+                    split_reference_values = [
+                        (
+                            float(item["post_handoff_nll_sum"]),
+                            int(item["post_handoff_token_count"]),
+                        )
+                        for item in reference_items
+                    ]
+                    split_candidate_values = [
+                        (
+                            float(item["post_handoff_nll_sum"]),
+                            int(item["post_handoff_token_count"]),
+                        )
+                        for item in candidate_items
+                    ]
+                    split_boundary_comparisons[role] = {
+                        "metric_id": POST_HANDOFF_METRIC_ID,
+                        "selection_gate": False,
+                        "paired_document_exp_nll_ratio": (
+                            _paired_document_nll_bootstrap(
+                                split_reference_values,
+                                split_candidate_values,
+                                seed=seed,
+                                replicates=self.bootstrap_replicates,
+                            )
+                        ),
+                    }
+                else:
+                    ref_scores = [float(item["score"]) for item in reference_items]
+                    cand_scores = [float(item["score"]) for item in candidate_items]
+                    comparison = _paired_bootstrap(
+                        ref_scores,
+                        cand_scores,
+                        seed=seed,
+                        replicates=self.bootstrap_replicates,
+                        mode="difference",
+                    )
+                    if benchmark.name == "ruler":
+                        ref_mean = sum(ref_scores) / len(ref_scores)
+                        cand_mean = sum(cand_scores) / len(cand_scores)
+                        retention = cand_mean / ref_mean if ref_mean > 0 else (
+                            1.0 if cand_mean == 0 else math.inf
+                        )
+                        passed = retention >= 0.98
+                        role_gates[f"ruler_{benchmark.context_length}"] = {
+                            "score_retention": retention,
+                            "paired_bootstrap": comparison,
+                            "passed": passed,
+                        }
+                    else:
+                        role_gates[benchmark.name] = {
+                            "paired_score_difference": comparison,
+                            "score_unit": "percentage_points",
+                            "passed": comparison["ci95_low"] >= -2.0,
+                        }
+            role_gates["all_accuracy_gates_passed"] = all(
+                value["passed"]
+                for key, value in role_gates.items()
+                if key != "all_accuracy_gates_passed"
+            )
+            gates[role] = role_gates
+        passing = tuple(
+            configuration
+            for configuration in self.contract.configurations
+            if configuration.role != "bf16"
+            and gates[configuration.role]["all_accuracy_gates_passed"]
+        )
+        selected = bool(passing)
+        return {
+            "schema_version": PUBLICATION_REPORT_SCHEMA,
+            "contract_hash": self.contract.canonical_hash,
+            "bootstrap_replicates": self.bootstrap_replicates,
+            "accuracy_gates": gates,
+            "split_boundary_metrics": split_boundary_comparisons,
+            "selection": {
+                "accuracy_configuration_ids": [
+                    configuration.configuration_id
+                    for configuration in passing
+                ],
+                "selected": selected,
+                "failure_action": (
+                    None if selected else "report_pareto_frontier_without_near_lossless_claim"
+                ),
+            },
+        }
+
+    def _run_round(self, store: _PublicationStore) -> bool:
+        attempted = False
+        for configuration in self.contract.configurations:
+            pending = [
+                benchmark
+                for benchmark in self.contract.benchmarks
+                if (
+                    (latest := store.latest(
+                        configuration.configuration_id,
+                        benchmark.benchmark_id,
+                    ))
+                    is None
+                    or (
+                        latest["state"] == "failed"
+                        and int(latest["attempt"]) < self.max_attempts
+                    )
+                )
+            ]
+            if not pending:
+                continue
+            attempted = True
+            try:
+                manager = self.executor.open_configuration(
+                    configuration,
+                    self.contract.protocol,
+                )
+                with manager as handle:
+                    for benchmark in pending:
+                        latest = store.latest(
+                            configuration.configuration_id,
+                            benchmark.benchmark_id,
+                        )
+                        attempt = (
+                            1 if latest is None else int(latest["attempt"]) + 1
+                        )
+                        started = time.monotonic()
+                        try:
+                            evaluation = self.executor.evaluate(
+                                configuration,
+                                benchmark,
+                                self.contract.protocol,
+                                configuration_handle=handle,
+                            )
+                            result = self._validate_evaluation(
+                                benchmark, evaluation
+                            )
+                            artifacts = tuple(
+                                _artifact(path) for path in evaluation.artifacts
+                            )
+                            store.append(
+                                configuration,
+                                benchmark,
+                                attempt=attempt,
+                                state="succeeded",
+                                result=result,
+                                artifacts=artifacts,
+                                runtime_seconds=time.monotonic() - started,
+                            )
+                        except Exception as error:
+                            latest_after = store.latest(
+                                configuration.configuration_id,
+                                benchmark.benchmark_id,
+                            )
+                            if (
+                                latest_after is not None
+                                and int(latest_after["attempt"]) == attempt
+                                and latest_after["state"] == "succeeded"
+                            ):
+                                raise
+                            store.append(
+                                configuration,
+                                benchmark,
+                                attempt=attempt,
+                                state="failed",
+                                result=None,
+                                artifacts=(),
+                                runtime_seconds=time.monotonic() - started,
+                                error=error,
+                            )
+            except Exception as error:
+                for benchmark in pending:
+                    latest = store.latest(
+                        configuration.configuration_id,
+                        benchmark.benchmark_id,
+                    )
+                    if latest is not None and latest["state"] == "succeeded":
+                        continue
+                    attempt = (
+                        1 if latest is None else int(latest["attempt"]) + 1
+                    )
+                    if attempt > self.max_attempts:
+                        continue
+                    store.append(
+                        configuration,
+                        benchmark,
+                        attempt=attempt,
+                        state="failed",
+                        result=None,
+                        artifacts=(),
+                        runtime_seconds=0.0,
+                        error=error,
+                    )
+        return attempted
+
+    def run(self) -> PublicationRunSummary:
+        with self._lock():
+            write_immutable_json(
+                self.output_dir / "contract.json",
+                self.contract.to_dict(),
+            )
+            store = _PublicationStore(self.output_dir, self.contract)
+            while self._run_round(store):
+                pass
+            succeeded = 0
+            failed_terminal = 0
+            pending_count = 0
+            for configuration in self.contract.configurations:
+                for benchmark in self.contract.benchmarks:
+                    latest = store.latest(
+                        configuration.configuration_id,
+                        benchmark.benchmark_id,
+                    )
+                    if latest is not None and latest["state"] == "succeeded":
+                        succeeded += 1
+                    elif latest is not None and int(latest["attempt"]) >= 3:
+                        failed_terminal += 1
+                    else:
+                        pending_count += 1
+            report_path = None
+            expected = len(self.contract.configurations) * len(
+                self.contract.benchmarks
+            )
+            if succeeded == expected:
+                report = self._report(store)
+                path = self.output_dir / "publication_report.json"
+                write_immutable_json(path, report)
+                report_path = str(path)
+            return PublicationRunSummary(
+                succeeded=succeeded,
+                failed_terminal=failed_terminal,
+                pending=pending_count,
+                report_path=report_path,
+            )
+
+
+# ---------------------------------------------------------------------------
+# Run command
+# ---------------------------------------------------------------------------
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--contract", required=True)
+    parser.add_argument(
+        "--executor",
+        default="decode_dse.software.benchmark_evaluator:create_executor",
+    )
+    parser.add_argument("--output-dir", required=True)
+    parser.add_argument("--bootstrap-replicates", type=int, default=2000)
+    return parser
+
+
+def main(argv: Iterable[str] | None = None) -> int:
+    args = _parser().parse_args(tuple(argv) if argv is not None else None)
+    config: Any = json.loads(Path(args.config).read_text(encoding="utf-8"))
+    if not isinstance(config, dict):
+        raise ValueError("config must contain a JSON object")
+    value = load_immutable_json(args.contract)
+    value.pop("content_hash", None)
+    contract = PublicationContract.from_dict(value)
+    if contract.protocol.model_name != str(config["model_name"]):
+        raise ValueError("publication model differs from execution config")
+    if contract.protocol.model_revision != str(config["model_revision"]):
+        raise ValueError("publication model revision mismatch")
+    if contract.protocol.tokenizer_revision != str(
+        config["tokenizer_revision"]
+    ):
+        raise ValueError("publication tokenizer revision mismatch")
+    executor = load_publication_executor(
+        args.executor,
+        config=config,
+        contract=contract,
+    )
+    summary = PublicationRunner(
+        contract=contract,
+        executor=executor,
+        output_dir=args.output_dir,
+        bootstrap_replicates=args.bootstrap_replicates,
+    ).run()
+    print(json.dumps(summary.__dict__, indent=2, sort_keys=True))
+    return 0 if summary.report_path is not None else 2
+
+
+# ---------------------------------------------------------------------------
+# Contract construction command
+# ---------------------------------------------------------------------------
+def build_contract_load_json(path: str | Path) -> Any:
+    return json.loads(Path(path).read_text(encoding="utf-8"))
+
+
+def build_benchmark_manifest_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Seal full publication benchmark splits from local caches."
+    )
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--output", required=True)
+    return parser
+
+
+def build_benchmark_manifest_main(
+    argv: Iterable[str] | None = None,
+) -> int:
+    args = build_benchmark_manifest_parser().parse_args(
+        tuple(argv) if argv is not None else None
+    )
+    config = build_contract_load_json(args.config)
+    if not isinstance(config, Mapping):
+        raise ValueError("config must contain a JSON object")
+    manifest = build_publication_benchmark_manifest(config)
+    output = write_immutable_json(args.output, manifest)
+    load_publication_benchmark_manifest(output)
+    print(
+        json.dumps(
+            load_immutable_json(output),
+            indent=2,
+            sort_keys=True,
+        )
+    )
+    return 0
+
+
+def _load_source_selection(
+    path: str | Path,
+    *,
+    manifest_hash: str,
+    schedule_hash: str,
+) -> tuple[dict[str, str], dict[str, Any]]:
+    value = load_immutable_json(path)
+    if (
+        value.get("schema_version") != "decode-refinement-source-selection"
+        or value.get("manifest_hash") != manifest_hash
+        or value.get("schedule_hash") != schedule_hash
+    ):
+        raise ValueError("refinement source selection provenance differs")
+    selection = value.get("source_selection")
+    roles = selection.get("source_roles") if isinstance(selection, Mapping) else None
+    expected = {
+        "uniform_mxint8",
+        "uniform_mxint4",
+        "mxint_kv2",
+        "accuracy_constrained_deployment",
+    }
+    if (
+        not isinstance(roles, Mapping)
+        or set(roles) != expected
+        or any(not isinstance(profile_id, str) or not profile_id for profile_id in roles.values())
+        or len(set(roles.values())) != len(expected)
+    ):
+        raise ValueError("refinement source roles are incomplete or duplicated")
+    return {str(role): str(profile_id) for role, profile_id in roles.items()}, value
+
+
+def _hardware_alternatives_for_configuration(
+    configuration: PublicationConfiguration,
+    *,
+    source_profile_id: str,
+    hardware_artifacts: Sequence[str | Path],
+    model_revision: str,
+    tokenizer_revision: str,
+) -> tuple[PublicationHardwareAlternative, ...]:
+    from decode_dse.hardware.design_space import (
+        HARDWARE_STORAGE_REVISION,
+        load_hardware_artifact,
+    )
+
+    alternatives = []
+    identities: set[tuple[str, str]] = set()
+    for raw_path in hardware_artifacts:
+        path = Path(raw_path).resolve()
+        artifact_sha256 = _sha256_file(path)
+        header, rows = load_hardware_artifact(path)
+        provenance = header.get("provenance")
+        if (
+            header.get("storage_revision") != HARDWARE_STORAGE_REVISION
+            or not isinstance(provenance, Mapping)
+            or provenance.get("model_revision") != model_revision
+            or provenance.get("tokenizer_revision") != tokenizer_revision
+        ):
+            raise ValueError("refined hardware artifact provenance differs")
+        for row in rows:
+            if row.get("profile_id") != configuration.profile.profile_id:
+                continue
+            if row.get("profile") != configuration.profile.to_dict():
+                raise ValueError("refined hardware profile binding differs")
+            labels = row.get("retention_labels")
+            if not isinstance(labels, list) or "profile_frontier" not in labels:
+                continue
+            validity = row.get("validity")
+            metrics = row.get("metrics")
+            whole = metrics.get("whole_model") if isinstance(metrics, Mapping) else None
+            energy = (
+                whole.get("calibrated_energy")
+                if isinstance(whole, Mapping)
+                else None
+            )
+            if (
+                row.get("deployment_valid") is not True
+                or not isinstance(validity, Mapping)
+                or any(
+                    validity.get(name) is not True
+                    for name in (
+                        "software_valid",
+                        "compiler_valid",
+                        "emulator_valid",
+                        "rtl_valid",
+                    )
+                )
+                or not isinstance(whole, Mapping)
+                or whole.get("rankable") is not True
+                or not isinstance(energy, Mapping)
+            ):
+                raise ValueError(
+                    "retained refined hardware frontier row is not deployable"
+                )
+            alternative = PublicationHardwareAlternative(
+                configuration_id=configuration.configuration_id,
+                profile_id=configuration.profile.profile_id,
+                source_profile_id=source_profile_id,
+                candidate_id=str(row["candidate_id"]),
+                record_hash=str(row["record_hash"]),
+                hardware_artifact_sha256=artifact_sha256,
+                tpot_ms=float(whole["tpot_ms"]),
+                energy_per_token_j=float(energy["total_j"]),
+                energy_tier=str(energy["energy_tier"]),
+            )
+            identity = alternative.configuration_id, alternative.candidate_id
+            if identity in identities:
+                raise ValueError(
+                    "refined hardware artifacts contain a duplicate candidate"
+                )
+            identities.add(identity)
+            alternatives.append(alternative)
+    if not alternatives:
+        raise ValueError(
+            f"no exact repriced hardware frontier covers {configuration.role}"
+        )
+    return tuple(
+        sorted(
+            alternatives,
+            key=lambda item: (
+                0 if item.energy_tier == "dc_calibrated" else 1,
+                item.energy_per_token_j,
+                item.tpot_ms,
+                item.candidate_id,
+                item.record_hash,
+            ),
+        )
+    )
+
+
+def build_publication_configuration_manifest(
+    *,
+    manifest_path: str | Path,
+    schedule_path: str | Path,
+    source_selection_path: str | Path,
+    merge_receipt_path: str | Path,
+    hardware_artifacts: Sequence[str | Path],
+    merged_results_path: str | Path | None = None,
+) -> dict[str, Any]:
+    """Select accuracy configurations once and retain every hardware option."""
+
+    from decode_dse.manifest import load_manifest
+    from decode_dse.software.refinement_runner import (
+        load_refinement_merged_results,
+    )
+    from decode_dse.software.refinement_schedule import load_refinement_schedule
+
+    manifest = load_manifest(manifest_path)
+    schedule = load_refinement_schedule(schedule_path)
+    roles, source_selection = _load_source_selection(
+        source_selection_path,
+        manifest_hash=manifest.canonical_hash,
+        schedule_hash=schedule.canonical_hash,
+    )
+    merge = load_refinement_merged_results(
+        schedule,
+        merge_receipt_path,
+        results_path=merged_results_path,
+    )
+    terminal_by_profile = {
+        str(row["profile_id"]): row for row in merge.terminal_rows
+    }
+    schedule_by_source: dict[str, list[Any]] = {}
+    for entry in schedule.entries:
+        schedule_by_source.setdefault(
+            entry.profile.source_profile.profile_id,
+            [],
+        ).append(entry)
+
+    bf16_entries = tuple(
+        entry for entry in manifest.entries if entry.profile.kind == "bf16_reference"
+    )
+    if len(bf16_entries) != 1:
+        raise ValueError("publication accuracy requires exactly one BF16 reference")
+    configurations = [
+        PublicationConfiguration(
+            role="bf16",
+            profile=bf16_entries[0].profile,
+            validity=bf16_entries[0].validity,
+        )
+    ]
+    selected_receipts = []
+    role_sources = (
+        ("uniform_i8", roles["uniform_mxint8"]),
+        ("uniform_i4", roles["uniform_mxint4"]),
+        ("pareto", roles["accuracy_constrained_deployment"]),
+    )
+    for role, source_profile_id in role_sources:
+        candidates = []
+        for entry in schedule_by_source.get(source_profile_id, ()):
+            row = terminal_by_profile[entry.profile_id]
+            result = row.get("result")
+            if row.get("state") != "succeeded" or not isinstance(result, Mapping):
+                continue
+            if any(
+                getattr(entry.validity, name) is not True
+                for name in (
+                    "software_valid",
+                    "compiler_valid",
+                    "emulator_valid",
+                    "rtl_valid",
+                )
+            ):
+                continue
+            candidates.append(
+                (
+                    float(result["mean_token_nll"]),
+                    entry.profile_id,
+                    entry,
+                    row,
+                )
+            )
+        if not candidates:
+            raise ValueError(
+                f"no successful fully measured refinement covers {role}"
+            )
+        mean_nll, _, entry, row = min(candidates)
+        configuration = PublicationConfiguration(
+            role=role,
+            profile=entry.profile,
+            validity=entry.validity,
+        )
+        configurations.append(configuration)
+        selected_receipts.append(
+            {
+                "role": role,
+                "configuration_id": configuration.configuration_id,
+                "profile_id": entry.profile_id,
+                "source_profile_id": source_profile_id,
+                "mean_token_nll": mean_nll,
+                "terminal_record_hash": row["record_hash"],
+                "selection_rule": (
+                    "minimum_successful_mean_token_nll_then_profile_id"
+                ),
+            }
+        )
+
+    alternatives = []
+    for configuration, (_, source_profile_id) in zip(
+        configurations[1:], role_sources
+    ):
+        alternatives.extend(
+            _hardware_alternatives_for_configuration(
+                configuration,
+                source_profile_id=source_profile_id,
+                hardware_artifacts=hardware_artifacts,
+                model_revision=manifest.model_revision,
+                tokenizer_revision=str(manifest.tokenizer_revision),
+            )
+        )
+    artifact_receipts = [
+        {
+            "path": str(Path(path).resolve()),
+            "size_bytes": Path(path).resolve().stat().st_size,
+            "sha256": _sha256_file(Path(path).resolve()),
+        }
+        for path in hardware_artifacts
+    ]
+    body = {
+        "schema_version": PUBLICATION_CONFIGURATION_MANIFEST_SCHEMA,
+        "model_name": manifest.model_name,
+        "model_revision": manifest.model_revision,
+        "tokenizer_revision": manifest.tokenizer_revision,
+        "base_manifest_hash": manifest.canonical_hash,
+        "refinement_schedule_hash": schedule.canonical_hash,
+        "source_selection_content_hash": source_selection["content_hash"],
+        "refinement_merge_content_hash": merge.receipt["content_hash"],
+        "merged_results_sha256": merge.results_sha256,
+        "selection_semantics": {
+            "accuracy_evaluations_per_configuration": 1,
+            "hardware_join_stage": "after_publication_accuracy_gates",
+            "hardware_frontier_policy": (
+                "all_exact_profile_frontier_rows_per_energy_tier"
+            ),
+            "source_hardware_costs_inherited": False,
+            "control_source_excluded": "mxint_kv2",
+        },
+        "selected_refinements": selected_receipts,
+        "hardware_artifacts": artifact_receipts,
+        "configurations": [item.to_dict() for item in configurations],
+        "hardware_alternatives": [item.to_dict() for item in alternatives],
+    }
+    return body | {"manifest_hash": _content_hash(body)}
+
+
+def load_publication_configuration_manifest(
+    path: str | Path,
+) -> dict[str, Any]:
+    value = load_immutable_json(path)
+    content_hash = value.pop("content_hash")
+    manifest_hash = value.pop("manifest_hash", None)
+    if (
+        value.get("schema_version") != PUBLICATION_CONFIGURATION_MANIFEST_SCHEMA
+        or manifest_hash != _content_hash(value)
+        or not isinstance(value.get("configurations"), list)
+        or not isinstance(value.get("hardware_alternatives"), list)
+    ):
+        raise ValueError("publication configuration manifest is invalid")
+    configurations = tuple(
+        PublicationConfiguration.from_dict(item)
+        for item in value["configurations"]
+    )
+    alternatives = tuple(
+        PublicationHardwareAlternative.from_dict(item)
+        for item in value["hardware_alternatives"]
+    )
+    if tuple(item.role for item in configurations) != PUBLICATION_ROLES:
+        raise ValueError("publication configuration roles are incomplete or reordered")
+    configuration_by_id = {
+        item.configuration_id: item for item in configurations
+    }
+    if len(configuration_by_id) != len(configurations):
+        raise ValueError("publication configurations are duplicated")
+    coverage = {item.configuration_id: 0 for item in configurations}
+    seen = set()
+    for alternative in alternatives:
+        identity = alternative.configuration_id, alternative.candidate_id
+        configuration = configuration_by_id.get(alternative.configuration_id)
+        if (
+            identity in seen
+            or configuration is None
+            or configuration.role == "bf16"
+            or alternative.profile_id != configuration.profile.profile_id
+        ):
+            raise ValueError("publication hardware coverage is inconsistent")
+        seen.add(identity)
+        coverage[alternative.configuration_id] += 1
+    if coverage[configurations[0].configuration_id] != 0 or any(
+        coverage[item.configuration_id] == 0 for item in configurations[1:]
+    ):
+        raise ValueError("publication hardware coverage is incomplete")
+    return {
+        **value,
+        "manifest_hash": manifest_hash,
+        "content_hash": content_hash,
+    }
+
+
+def _resolve_config_asset(
+    value: str,
+    *,
+    config_path: str | Path | None,
+) -> Path:
+    raw = Path(value)
+    if raw.is_absolute():
+        return raw.resolve()
+    roots = [Path.cwd()]
+    if config_path is not None:
+        source = Path(config_path).resolve()
+        roots.extend((source.parent, *source.parents))
+    for root in roots:
+        candidate = (root / raw).resolve()
+        if candidate.is_file():
+            return candidate
+    raise FileNotFoundError(f"configured chat-template asset is missing: {value}")
+
+
+def seal_publication_chat_template(
+    config: Mapping[str, Any],
+    *,
+    config_path: str | Path | None = None,
+    tokenizer_loader: Callable[..., Any] | None = None,
+) -> dict[str, Any]:
+    """Seal an exact pinned template without inventing or downloading one."""
+
+    publication = config.get("publication")
+    if not isinstance(publication, Mapping):
+        raise ValueError("config.publication is required")
+    if publication.get("enable_thinking") is not False:
+        raise ValueError("publication chat template requires thinking disabled")
+    model_name = str(config.get("model_name", ""))
+    model_revision = str(config.get("model_revision", ""))
+    tokenizer_revision = str(config.get("tokenizer_revision", ""))
+    if (
+        not model_name
+        or not _IMMUTABLE_REVISION.fullmatch(model_revision)
+        or not _IMMUTABLE_REVISION.fullmatch(tokenizer_revision)
+    ):
+        raise ValueError("chat-template model and tokenizer must be pinned")
+
+    configured_asset = publication.get("chat_template_asset")
+    if configured_asset is not None:
+        if not isinstance(configured_asset, str) or not configured_asset:
+            raise ValueError("publication.chat_template_asset is invalid")
+        source_path = _resolve_config_asset(
+            configured_asset,
+            config_path=config_path,
+        )
+        source = json.loads(source_path.read_text(encoding="utf-8"))
+        if (
+            not isinstance(source, Mapping)
+            or source.get("schema_version") != PUBLICATION_CHAT_TEMPLATE_SCHEMA
+            or source.get("model_name") != model_name
+            or source.get("model_revision") != model_revision
+            or source.get("tokenizer_revision") != tokenizer_revision
+            or source.get("enable_thinking") is not False
+            or not isinstance(source.get("chat_template"), str)
+            or not source.get("chat_template")
+        ):
+            raise ValueError("configured chat-template asset contract differs")
+        template = str(source["chat_template"])
+        template_hash = hashlib.sha256(template.encode("utf-8")).hexdigest()
+        if source.get("chat_template_sha256") != template_hash:
+            raise ValueError("configured chat-template content hash differs")
+        source_receipt = {
+            "kind": "pinned_local_asset",
+            "path": str(source_path),
+            "size_bytes": source_path.stat().st_size,
+            "sha256": _sha256_file(source_path),
+        }
+    else:
+        if tokenizer_loader is None:
+            try:
+                from transformers import AutoTokenizer
+            except ImportError as exc:
+                raise RuntimeError(
+                    "transformers is required to extract the pinned local tokenizer template"
+                ) from exc
+            tokenizer_loader = AutoTokenizer.from_pretrained
+        try:
+            tokenizer = tokenizer_loader(
+                model_name,
+                revision=tokenizer_revision,
+                local_files_only=True,
+                trust_remote_code=False,
+            )
+            template = tokenizer.get_chat_template()
+        except Exception as exc:
+            raise RuntimeError(
+                "the pinned tokenizer is unavailable locally or has no unambiguous chat template"
+            ) from exc
+        if not isinstance(template, str) or not template:
+            raise ValueError("the pinned tokenizer returned an empty chat template")
+        template_hash = hashlib.sha256(template.encode("utf-8")).hexdigest()
+        source_receipt = {
+            "kind": "pinned_local_tokenizer_execution",
+            "loader": "transformers.AutoTokenizer.from_pretrained",
+            "local_files_only": True,
+            "trust_remote_code": False,
+        }
+    configured_hash = publication.get("chat_template_sha256")
+    if configured_hash is not None and configured_hash != template_hash:
+        raise ValueError("chat template hash differs from config.publication")
+    return {
+        "schema_version": PUBLICATION_CHAT_TEMPLATE_SCHEMA,
+        "model_name": model_name,
+        "model_revision": model_revision,
+        "tokenizer_revision": tokenizer_revision,
+        "enable_thinking": False,
+        "chat_template_sha256": template_hash,
+        "chat_template": template,
+        "source": source_receipt,
+    }
+
+
+def build_configurations_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Build accuracy-only publication configurations and hardware alternatives."
+    )
+    parser.add_argument("--manifest", required=True)
+    parser.add_argument("--refinement-schedule", required=True)
+    parser.add_argument("--source-selection", required=True)
+    parser.add_argument("--refinement-merge", required=True)
+    parser.add_argument("--refinement-results")
+    parser.add_argument(
+        "--hardware-artifact",
+        action="append",
+        required=True,
+    )
+    parser.add_argument("--output", required=True)
+    return parser
+
+
+def build_configurations_main(argv: Iterable[str] | None = None) -> int:
+    args = build_configurations_parser().parse_args(
+        tuple(argv) if argv is not None else None
+    )
+    manifest = build_publication_configuration_manifest(
+        manifest_path=args.manifest,
+        schedule_path=args.refinement_schedule,
+        source_selection_path=args.source_selection,
+        merge_receipt_path=args.refinement_merge,
+        merged_results_path=args.refinement_results,
+        hardware_artifacts=tuple(args.hardware_artifact),
+    )
+    output = write_immutable_json(args.output, manifest)
+    load_publication_configuration_manifest(output)
+    print(json.dumps(load_immutable_json(output), indent=2, sort_keys=True))
+    return 0
+
+
+def build_chat_template_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Seal the exact publication chat template from pinned local inputs."
+    )
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--output", required=True)
+    return parser
+
+
+def build_chat_template_main(argv: Iterable[str] | None = None) -> int:
+    args = build_chat_template_parser().parse_args(
+        tuple(argv) if argv is not None else None
+    )
+    config = build_contract_load_json(args.config)
+    if not isinstance(config, Mapping):
+        raise ValueError("config must contain a JSON object")
+    asset = seal_publication_chat_template(
+        config,
+        config_path=args.config,
+    )
+    output = write_immutable_json(args.output, asset)
+    print(json.dumps(load_immutable_json(output), indent=2, sort_keys=True))
+    return 0
+
+
+
+def build_publication_contract(
+    *,
+    config: Mapping[str, Any],
+    configurations: Iterable[Mapping[str, Any]],
+    hardware_alternatives: Iterable[Mapping[str, Any]],
+    benchmarks: Iterable[Mapping[str, Any]],
+    chat_template_path: str | Path,
+) -> PublicationContract:
+    """Bind exact items, precisions, hardware evidence, and generation settings."""
+
+    settings = config.get("publication")
+    if not isinstance(settings, Mapping):
+        raise ValueError("config.publication is required")
+    template_path = Path(chat_template_path).resolve()
+    if not template_path.is_file() or template_path.stat().st_size <= 0:
+        raise ValueError("the pinned chat template is missing")
+    template_asset = build_contract_load_json(template_path)
+    if (
+        not isinstance(template_asset, Mapping)
+        or template_asset.get("schema_version") != PUBLICATION_CHAT_TEMPLATE_SCHEMA
+        or template_asset.get("model_name") != config.get("model_name")
+        or template_asset.get("model_revision") != config.get("model_revision")
+        or template_asset.get("tokenizer_revision")
+        != config.get("tokenizer_revision")
+        or template_asset.get("enable_thinking") is not False
+        or not isinstance(template_asset.get("chat_template"), str)
+        or not isinstance(template_asset.get("source"), Mapping)
+    ):
+        raise ValueError("the pinned chat-template asset is invalid")
+    template_hash = hashlib.sha256(
+        template_asset["chat_template"].encode("utf-8")
+    ).hexdigest()
+    if template_asset.get("chat_template_sha256") != template_hash:
+        raise ValueError("the chat-template asset hash is invalid")
+    expected_template_hash = settings.get("chat_template_sha256")
+    if (
+        expected_template_hash is not None
+        and expected_template_hash != template_hash
+    ):
+        raise ValueError("chat template hash differs from config.publication")
+    token_budgets = settings.get("token_budgets")
+    if not isinstance(token_budgets, Mapping):
+        raise ValueError("config.publication.token_budgets is required")
+    contract = PublicationContract(
+        configurations=tuple(
+            PublicationConfiguration.from_dict(value)
+            for value in configurations
+        ),
+        hardware_alternatives=tuple(
+            PublicationHardwareAlternative.from_dict(value)
+            for value in hardware_alternatives
+        ),
+        benchmarks=tuple(
+            PublicationBenchmark.from_dict(value) for value in benchmarks
+        ),
+        protocol=PublicationProtocol(
+            model_name=str(config["model_name"]),
+            model_revision=str(config["model_revision"]),
+            tokenizer_revision=str(config["tokenizer_revision"]),
+            chat_template_sha256=template_hash,
+            thinking_mode=str(settings.get("thinking_mode", "")),
+            enable_thinking=settings.get("enable_thinking"),
+            greedy=settings.get("greedy"),
+            temperature=float(settings.get("temperature", math.nan)),
+            token_budgets=tuple(
+                (str(name), int(value)) for name, value in token_budgets.items()
+            ),
+            output_head_location=str(
+                settings.get("output_head_location", "")
+            ),
+            output_head_precision=str(
+                settings.get("output_head_precision", "")
+            ),
+        ),
+    )
+    return contract
+
+
+def build_contract_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--configurations", required=True)
+    parser.add_argument("--benchmarks", required=True)
+    parser.add_argument("--chat-template", required=True)
+    parser.add_argument("--output", required=True)
+    return parser
+
+
+def build_contract_main(argv: Iterable[str] | None = None) -> int:
+    args = build_contract_parser().parse_args(tuple(argv) if argv is not None else None)
+    config = build_contract_load_json(args.config)
+    configuration_manifest = load_publication_configuration_manifest(
+        args.configurations
+    )
+    benchmarks = load_publication_benchmark_manifest(args.benchmarks)
+    if not isinstance(config, dict):
+        raise ValueError("config must contain a JSON object")
+    if any(
+        configuration_manifest.get(name) != config.get(name)
+        for name in ("model_name", "model_revision", "tokenizer_revision")
+    ):
+        raise ValueError("publication configuration manifest model differs")
+    contract = build_publication_contract(
+        config=config,
+        configurations=configuration_manifest["configurations"],
+        hardware_alternatives=configuration_manifest["hardware_alternatives"],
+        benchmarks=(benchmark.to_dict() for benchmark in benchmarks),
+        chat_template_path=args.chat_template,
+    )
+    write_immutable_json(args.output, contract.to_dict())
+    print(json.dumps(contract.to_dict(), indent=2, sort_keys=True))
+    return 0
+
+
+__all__ = [
+    "PUBLICATION_BENCHMARKS",
+    "PUBLICATION_BENCHMARK_MANIFEST_SCHEMA",
+    "PUBLICATION_CHAT_TEMPLATE_SCHEMA",
+    "PUBLICATION_CONFIGURATION_MANIFEST_SCHEMA",
+    "PUBLICATION_CONTRACT_SCHEMA",
+    "PUBLICATION_REPORT_SCHEMA",
+    "PUBLICATION_RESULT_SCHEMA",
+    "PUBLICATION_ROLES",
+    "POST_HANDOFF_METRIC_ID",
+    "RULER_LENGTHS",
+    "STANDARD_WIKITEXT2_METRIC_ID",
+    "TASK_METRIC_ID",
+    "PublicationBenchmark",
+    "PublicationConfiguration",
+    "PublicationContract",
+    "PublicationHardwareAlternative",
+    "PublicationEvaluation",
+    "PublicationExecutor",
+    "PublicationItemMetric",
+    "PublicationProtocol",
+    "PublicationRunSummary",
+    "PublicationRunner",
+    "PublicationSplitEvidence",
+    "LocalDatasetSnapshot",
+    "build_publication_benchmark_manifest",
+    "build_publication_configuration_manifest",
+    "load_publication_configuration_manifest",
+    "load_publication_benchmark_manifest",
+    "load_publication_executor",
+    "seal_publication_chat_template",
+]
+
+def dispatch(argv: Sequence[str] | None = None) -> int:
+    """Route to one of this module's commands."""
+
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    commands = {
+        "run": main,
+        "contract": build_contract_main,
+        "manifest": build_benchmark_manifest_main,
+        "configurations": build_configurations_main,
+        "chat-template": build_chat_template_main,
+    }
+    if arguments and arguments[0] in commands:
+        return commands[arguments[0]](arguments[1:])
+    return main(arguments)
+
+
+if __name__ == "__main__":
+    raise SystemExit(dispatch())
diff --git a/decode_dse/software/block_size_sensitivity.py b/decode_dse/software/block_size_sensitivity.py
new file mode 100644
index 0000000..a7b3410
--- /dev/null
+++ b/decode_dse/software/block_size_sensitivity.py
@@ -0,0 +1,323 @@
+"""Controlled block-size sensitivity for selected decode profiles."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+
+from decode_dse.profiles import (
+    MX_BLOCK_SIZE,
+    PROFILE_KIND_QUANTIZED,
+    DecodePrecisionProfile,
+    format_descriptor,
+)
+
+BLOCK_SENSITIVITY_SCHEMA = "decode-block-sensitivity"
+BLOCK_SENSITIVITY_REPORT_SCHEMA = "decode-block-sensitivity-report"
+BLOCK_SENSITIVITY_BLOCKS = (8, 16, 32)
+BLOCK_SENSITIVITY_SOURCE_COUNT = 4
+
+
+def _canonical_json(value: Mapping[str, Any]) -> str:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    )
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(_canonical_json(value).encode("utf-8")).hexdigest()
+
+
+@dataclass(frozen=True)
+class BlockSensitivityPoint:
+    """One numerical block-size variant of a canonical block-8 profile."""
+
+    source_profile: DecodePrecisionProfile
+    block_size: int
+    schema_version: str = BLOCK_SENSITIVITY_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != BLOCK_SENSITIVITY_SCHEMA:
+            raise ValueError(
+                f"unsupported block-sensitivity schema {self.schema_version!r}"
+            )
+        if self.source_profile.kind != PROFILE_KIND_QUANTIZED:
+            raise ValueError("block sensitivity requires a quantized source profile")
+        if self.source_profile.block_size != MX_BLOCK_SIZE:
+            raise ValueError("the source profile must use the native block size")
+        if self.block_size not in BLOCK_SENSITIVITY_BLOCKS:
+            raise ValueError(
+                f"block_size must be one of {BLOCK_SENSITIVITY_BLOCKS}"
+            )
+
+    @property
+    def native_datapath(self) -> bool:
+        return self.block_size == MX_BLOCK_SIZE
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "source_profile_id": self.source_profile.profile_id,
+            "source_profile": self.source_profile.to_dict(),
+            "block_size": self.block_size,
+            "native_datapath": self.native_datapath,
+        }
+
+    @property
+    def point_id(self) -> str:
+        return "dbs-" + _content_hash(self.to_dict())
+
+
+@dataclass(frozen=True)
+class BlockSensitivitySchedule:
+    points: tuple[BlockSensitivityPoint, ...]
+
+    def __post_init__(self) -> None:
+        expected = BLOCK_SENSITIVITY_SOURCE_COUNT * len(
+            BLOCK_SENSITIVITY_BLOCKS
+        )
+        if len(self.points) != expected:
+            raise ValueError(f"block-sensitivity schedule requires {expected} points")
+        point_ids = tuple(point.point_id for point in self.points)
+        if len(point_ids) != len(set(point_ids)):
+            raise ValueError("block-sensitivity schedule contains duplicate points")
+        source_ids = tuple(
+            dict.fromkeys(point.source_profile.profile_id for point in self.points)
+        )
+        if len(source_ids) != BLOCK_SENSITIVITY_SOURCE_COUNT:
+            raise ValueError(
+                "block-sensitivity schedule requires four source profiles"
+            )
+        expected_pairs = tuple(
+            (source_id, block_size)
+            for source_id in source_ids
+            for block_size in BLOCK_SENSITIVITY_BLOCKS
+        )
+        observed_pairs = tuple(
+            (point.source_profile.profile_id, point.block_size)
+            for point in self.points
+        )
+        if observed_pairs != expected_pairs:
+            raise ValueError("block-sensitivity points are not canonically ordered")
+
+    @property
+    def source_profile_ids(self) -> tuple[str, ...]:
+        return tuple(
+            dict.fromkeys(point.source_profile.profile_id for point in self.points)
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        body = {
+            "schema_version": BLOCK_SENSITIVITY_SCHEMA,
+            "blocks": list(BLOCK_SENSITIVITY_BLOCKS),
+            "native_block": MX_BLOCK_SIZE,
+            "source_profile_ids": list(self.source_profile_ids),
+            "point_count": len(self.points),
+            "points": [
+                {
+                    "ordinal": ordinal,
+                    "point_id": point.point_id,
+                    **point.to_dict(),
+                }
+                for ordinal, point in enumerate(self.points)
+            ],
+        }
+        return {**body, "schedule_hash": _content_hash(body)}
+
+    @property
+    def canonical_hash(self) -> str:
+        return str(self.to_dict()["schedule_hash"])
+
+
+def build_block_sensitivity_schedule(
+    selected_profiles: Sequence[DecodePrecisionProfile],
+) -> BlockSensitivitySchedule:
+    """Create the fixed 4-by-3 post-selection numerical experiment."""
+
+    sources = tuple(sorted(selected_profiles, key=lambda profile: profile.profile_id))
+    if len(sources) != BLOCK_SENSITIVITY_SOURCE_COUNT:
+        raise ValueError("exactly four selected profiles are required")
+    source_ids = tuple(profile.profile_id for profile in sources)
+    if len(source_ids) != len(set(source_ids)):
+        raise ValueError("selected profiles must be unique")
+    return BlockSensitivitySchedule(
+        points=tuple(
+            BlockSensitivityPoint(source_profile=profile, block_size=block_size)
+            for profile in sources
+            for block_size in BLOCK_SENSITIVITY_BLOCKS
+        )
+    )
+
+
+def block_sensitivity_to_decode_quant_spec(
+    point: BlockSensitivityPoint,
+) -> Any:
+    """Map one sensitivity point to an isolated MASE quantization build."""
+
+    from decode_dse.software.precision_bindings import DecodeQuantSpec
+
+    def operand(token: str) -> tuple[str, Any]:
+        descriptor = format_descriptor(token)
+        if descriptor.family == "mxint":
+            return descriptor.family, descriptor.element_bits
+        return descriptor.family, (
+            descriptor.exponent_bits,
+            descriptor.mantissa_bits,
+        )
+
+    profile = point.source_profile
+    weight_family, weight_width = operand(profile.weight_format)
+    activation_family, activation_width = operand(profile.activation_format)
+    kv_family, kv_width = operand(profile.kv_format)
+    return DecodeQuantSpec(
+        attn_w=weight_width,
+        ffn_w=weight_width,
+        kv=kv_width,
+        w_fmt=weight_family,
+        kv_fmt=kv_family,
+        weight_block=point.block_size,
+        kv_block=point.block_size,
+        act_w=activation_width,
+        act_fmt=activation_family,
+        act_block=point.block_size,
+        use_gptq=False,
+        use_rotation=False,
+        fp_setting=profile.vector_format,
+        fp_setting_attention=True,
+        quant_attn_internals=True,
+    )
+
+
+@dataclass(frozen=True)
+class BlockSensitivityObservation:
+    point_id: str
+    state: str
+    mean_token_nll: float | None = None
+    error_class: str | None = None
+    error_message: str | None = None
+
+    def __post_init__(self) -> None:
+        if not self.point_id:
+            raise ValueError("point_id is required")
+        if self.state not in {"succeeded", "failed", "oom"}:
+            raise ValueError(f"unsupported observation state {self.state!r}")
+        if self.state == "succeeded":
+            if (
+                self.mean_token_nll is None
+                or not math.isfinite(self.mean_token_nll)
+                or self.mean_token_nll < 0
+            ):
+                raise ValueError("successful observation requires finite NLL")
+            if self.error_class is not None or self.error_message is not None:
+                raise ValueError("successful observation cannot carry an error")
+        else:
+            if self.mean_token_nll is not None:
+                raise ValueError("failed observation cannot carry NLL")
+            if not self.error_class:
+                raise ValueError("failed observation requires error_class")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "point_id": self.point_id,
+            "state": self.state,
+            "mean_token_nll": self.mean_token_nll,
+            "error_class": self.error_class,
+            "error_message": self.error_message,
+        }
+
+
+def build_block_sensitivity_report(
+    schedule: BlockSensitivitySchedule,
+    observations: Iterable[BlockSensitivityObservation],
+) -> dict[str, Any]:
+    """Join exact terminal observations without converting failures to scores."""
+
+    indexed: dict[str, BlockSensitivityObservation] = {}
+    for observation in observations:
+        if observation.point_id in indexed:
+            raise ValueError(
+                f"duplicate block-sensitivity observation {observation.point_id}"
+            )
+        indexed[observation.point_id] = observation
+    expected_ids = {point.point_id for point in schedule.points}
+    unknown = sorted(set(indexed) - expected_ids)
+    missing = sorted(expected_ids - set(indexed))
+    if unknown:
+        raise ValueError(f"unknown block-sensitivity points: {unknown}")
+
+    baselines = {
+        point.source_profile.profile_id: indexed.get(point.point_id)
+        for point in schedule.points
+        if point.native_datapath
+    }
+    rows: list[dict[str, Any]] = []
+    comparable = not missing
+    for ordinal, point in enumerate(schedule.points):
+        observation = indexed.get(point.point_id)
+        baseline = baselines[point.source_profile.profile_id]
+        delta = None
+        if (
+            observation is not None
+            and observation.state == "succeeded"
+            and baseline is not None
+            and baseline.state == "succeeded"
+        ):
+            delta = observation.mean_token_nll - baseline.mean_token_nll
+        else:
+            comparable = False
+        rows.append(
+            {
+                "ordinal": ordinal,
+                "point_id": point.point_id,
+                "source_profile_id": point.source_profile.profile_id,
+                "block_size": point.block_size,
+                "native_datapath": point.native_datapath,
+                "deployment_candidate": point.native_datapath,
+                "observation": (
+                    observation.to_dict() if observation is not None else None
+                ),
+                "nll_delta_from_block8": delta,
+            }
+        )
+
+    body = {
+        "schema_version": BLOCK_SENSITIVITY_REPORT_SCHEMA,
+        "schedule_hash": schedule.canonical_hash,
+        "complete": not missing,
+        "comparable": comparable,
+        "missing_point_ids": missing,
+        "rows": rows,
+    }
+    return {**body, "report_hash": _content_hash(body)}
+
+
+def write_block_sensitivity_schedule(
+    path: str | Path,
+    schedule: BlockSensitivitySchedule,
+) -> Path:
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    return write_immutable_json(path, schedule.to_dict())
+
+
+__all__ = [
+    "BLOCK_SENSITIVITY_BLOCKS",
+    "BLOCK_SENSITIVITY_REPORT_SCHEMA",
+    "BLOCK_SENSITIVITY_SCHEMA",
+    "BLOCK_SENSITIVITY_SOURCE_COUNT",
+    "BlockSensitivityObservation",
+    "BlockSensitivityPoint",
+    "BlockSensitivitySchedule",
+    "block_sensitivity_to_decode_quant_spec",
+    "build_block_sensitivity_report",
+    "build_block_sensitivity_schedule",
+    "write_block_sensitivity_schedule",
+]
diff --git a/decode_dse/software/cache_artifacts.py b/decode_dse/software/cache_artifacts.py
new file mode 100644
index 0000000..a0ae3d2
--- /dev/null
+++ b/decode_dse/software/cache_artifacts.py
@@ -0,0 +1,836 @@
+"""Content-addressed artifacts for the prefill-to-decode boundary."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shutil
+import tempfile
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Callable, Literal, Protocol, Sequence
+
+
+_PREFILL_SCHEMA = 1
+_DECODE_CACHE_SCHEMA = 2
+_TENSOR_BYTES = {
+    "bfloat16": 2,
+    "float16": 2,
+    "float32": 4,
+    "int8": 1,
+    "uint8": 1,
+    "int16": 2,
+    "int32": 4,
+    "int64": 8,
+}
+
+
+def _canonical_json(value: Any) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _sha256(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def _freeze_rows(rows: Sequence[Sequence[int]], name: str) -> tuple[tuple[int, ...], ...]:
+    frozen = tuple(tuple(int(value) for value in row) for row in rows)
+    if not frozen or any(not row for row in frozen):
+        raise ValueError(f"{name} must contain at least one non-empty row")
+    width = len(frozen[0])
+    if any(len(row) != width for row in frozen):
+        raise ValueError(f"{name} must be rectangular")
+    return frozen
+
+
+def _freeze_metadata(
+    metadata: Sequence[tuple[str, str]] | dict[str, str] | None,
+) -> tuple[tuple[str, str], ...]:
+    items = metadata.items() if isinstance(metadata, dict) else metadata or ()
+    frozen = tuple(sorted((str(key), str(value)) for key, value in items))
+    if len({key for key, _ in frozen}) != len(frozen):
+        raise ValueError("metadata keys must be unique")
+    return frozen
+
+
+def compute_prompt_hash(
+    input_ids: Sequence[Sequence[int]],
+    attention_mask: Sequence[Sequence[int]],
+    position_ids: Sequence[Sequence[int]],
+) -> str:
+    """Return the canonical identity of the tokenized prompt batch."""
+    payload = {
+        "input_ids": [list(row) for row in input_ids],
+        "attention_mask": [list(row) for row in attention_mask],
+        "position_ids": [list(row) for row in position_ids],
+    }
+    return _sha256(_canonical_json(payload))
+
+
+@dataclass(frozen=True)
+class ArtifactProvenance:
+    """Reproducibility fields embedded in an artifact identity."""
+
+    producer: str
+    code_revision: str
+    created_at_utc: str
+    parameters: tuple[tuple[str, str], ...] = ()
+
+    def __post_init__(self) -> None:
+        if not self.producer or not self.code_revision or not self.created_at_utc:
+            raise ValueError("producer, code_revision, and created_at_utc are required")
+        object.__setattr__(self, "parameters", _freeze_metadata(self.parameters))
+
+    def descriptor(self) -> dict[str, Any]:
+        return {
+            "producer": self.producer,
+            "code_revision": self.code_revision,
+            "created_at_utc": self.created_at_utc,
+            "parameters": dict(self.parameters),
+        }
+
+
+@dataclass(frozen=True)
+class TensorPayload:
+    """An immutable tensor encoded as contiguous little-endian bytes."""
+
+    dtype: str
+    shape: tuple[int, ...]
+    data: bytes = field(repr=False)
+    sha256: str = field(init=False)
+
+    def __post_init__(self) -> None:
+        shape = tuple(int(size) for size in self.shape)
+        if any(size < 0 for size in shape):
+            raise ValueError("tensor dimensions must be non-negative")
+        if self.dtype not in _TENSOR_BYTES:
+            raise ValueError(f"unsupported tensor dtype {self.dtype!r}")
+        data = bytes(self.data)
+        elements = 1
+        for size in shape:
+            elements *= size
+        expected = elements * _TENSOR_BYTES[self.dtype]
+        if len(data) != expected:
+            raise ValueError(
+                f"{self.dtype}{shape} requires {expected} bytes, received {len(data)}"
+            )
+        object.__setattr__(self, "shape", shape)
+        object.__setattr__(self, "data", data)
+        object.__setattr__(self, "sha256", _sha256(data))
+
+    @classmethod
+    def from_torch(cls, tensor: Any, *, dtype: str | None = None) -> "TensorPayload":
+        """Copy a torch tensor into a framework-independent payload."""
+        import torch
+
+        dtype_name = dtype or str(tensor.dtype).removeprefix("torch.")
+        torch_dtype = {
+            "bfloat16": torch.bfloat16,
+            "float16": torch.float16,
+            "float32": torch.float32,
+            "int8": torch.int8,
+            "uint8": torch.uint8,
+            "int16": torch.int16,
+            "int32": torch.int32,
+            "int64": torch.int64,
+        }.get(dtype_name)
+        if torch_dtype is None:
+            raise ValueError(f"unsupported torch dtype {dtype_name!r}")
+        value = tensor.detach().to(device="cpu", dtype=torch_dtype).contiguous()
+        raw = value.view(torch.uint8).numpy().tobytes(order="C")
+        return cls(dtype=dtype_name, shape=tuple(value.shape), data=raw)
+
+    def to_torch(self, device: str | Any = "cpu") -> Any:
+        """Materialize a writable torch tensor with independent storage."""
+        import torch
+
+        torch_dtype = {
+            "bfloat16": torch.bfloat16,
+            "float16": torch.float16,
+            "float32": torch.float32,
+            "int8": torch.int8,
+            "uint8": torch.uint8,
+            "int16": torch.int16,
+            "int32": torch.int32,
+            "int64": torch.int64,
+        }[self.dtype]
+        raw = torch.frombuffer(bytearray(self.data), dtype=torch.uint8)
+        return raw.view(torch_dtype).reshape(self.shape).to(device=device)
+
+    def descriptor(self) -> dict[str, Any]:
+        return {"dtype": self.dtype, "shape": list(self.shape), "sha256": self.sha256}
+
+
+@dataclass(frozen=True)
+class KVLayerPayload:
+    """The BF16 K/V state for one decoder layer."""
+
+    key: TensorPayload
+    value: TensorPayload
+
+    def __post_init__(self) -> None:
+        if self.key.dtype != "bfloat16" or self.value.dtype != "bfloat16":
+            raise ValueError("prefill K/V tensors must be stored as bfloat16")
+        if self.key.shape != self.value.shape:
+            raise ValueError("key and value tensors must have identical shapes")
+        if len(self.key.shape) != 4:
+            raise ValueError("K/V tensors must use [batch, heads, sequence, head_dim]")
+
+    def descriptor(self) -> dict[str, Any]:
+        return {"key": self.key.descriptor(), "value": self.value.descriptor()}
+
+
+@dataclass(frozen=True)
+class FirstTokenResult:
+    """The token selected by prefill and its optional log probability."""
+
+    token_ids: tuple[int, ...]
+    selection: Literal["greedy", "teacher_forced"]
+    log_probabilities: tuple[float, ...] | None = None
+
+    def __post_init__(self) -> None:
+        tokens = tuple(int(token) for token in self.token_ids)
+        if not tokens:
+            raise ValueError("first-token result cannot be empty")
+        object.__setattr__(self, "token_ids", tokens)
+        if self.log_probabilities is not None:
+            log_probs = tuple(float(value) for value in self.log_probabilities)
+            if len(log_probs) != len(tokens):
+                raise ValueError("first-token log probabilities must match the batch")
+            object.__setattr__(self, "log_probabilities", log_probs)
+
+    def descriptor(self) -> dict[str, Any]:
+        return {
+            "token_ids": list(self.token_ids),
+            "selection": self.selection,
+            "log_probabilities": (
+                list(self.log_probabilities)
+                if self.log_probabilities is not None
+                else None
+            ),
+        }
+
+
+@dataclass(frozen=True)
+class PrefillArtifact:
+    """Immutable BF16 output of a prefill-chip invocation."""
+
+    model_revision: str
+    tokenizer_revision: str
+    input_ids: tuple[tuple[int, ...], ...]
+    attention_mask: tuple[tuple[int, ...], ...]
+    position_ids: tuple[tuple[int, ...], ...]
+    prompt_hash: str
+    first_token: FirstTokenResult
+    layers: tuple[KVLayerPayload, ...]
+    provenance: ArtifactProvenance
+    metadata: tuple[tuple[str, str], ...] = ()
+    schema_version: int = _PREFILL_SCHEMA
+    artifact_id: str = field(init=False)
+
+    def __post_init__(self) -> None:
+        input_ids = _freeze_rows(self.input_ids, "input_ids")
+        attention_mask = _freeze_rows(self.attention_mask, "attention_mask")
+        position_ids = _freeze_rows(self.position_ids, "position_ids")
+        if not (len(input_ids) == len(attention_mask) == len(position_ids)):
+            raise ValueError("prompt tensors must have the same batch size")
+        if any(
+            len(ids) != len(mask) or len(ids) != len(pos)
+            for ids, mask, pos in zip(input_ids, attention_mask, position_ids)
+        ):
+            raise ValueError("prompt tensors must have identical sequence lengths")
+        if any(value not in (0, 1) for row in attention_mask for value in row):
+            raise ValueError("attention_mask values must be 0 or 1")
+        if len(self.first_token.token_ids) != len(input_ids):
+            raise ValueError("first-token batch size does not match the prompt")
+        layers = tuple(self.layers)
+        if not layers:
+            raise ValueError("prefill artifact must contain at least one K/V layer")
+        batch_size = len(input_ids)
+        cache_length = len(input_ids[0])
+        for layer in layers:
+            if layer.key.shape[0] != batch_size or layer.key.shape[-2] != cache_length:
+                raise ValueError("K/V shape does not match the prompt batch")
+        expected_prompt_hash = compute_prompt_hash(input_ids, attention_mask, position_ids)
+        if self.prompt_hash != expected_prompt_hash:
+            raise ValueError("prompt_hash does not match the tokenized prompt")
+        if self.schema_version != _PREFILL_SCHEMA:
+            raise ValueError(f"unsupported prefill schema {self.schema_version}")
+        object.__setattr__(self, "input_ids", input_ids)
+        object.__setattr__(self, "attention_mask", attention_mask)
+        object.__setattr__(self, "position_ids", position_ids)
+        object.__setattr__(self, "layers", layers)
+        object.__setattr__(self, "metadata", _freeze_metadata(self.metadata))
+        object.__setattr__(self, "artifact_id", _sha256(_canonical_json(self.descriptor())))
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        model_revision: str,
+        tokenizer_revision: str,
+        input_ids: Sequence[Sequence[int]],
+        attention_mask: Sequence[Sequence[int]],
+        position_ids: Sequence[Sequence[int]],
+        first_token: FirstTokenResult,
+        layers: Sequence[KVLayerPayload],
+        provenance: ArtifactProvenance,
+        metadata: Sequence[tuple[str, str]] | dict[str, str] | None = None,
+    ) -> "PrefillArtifact":
+        frozen_ids = _freeze_rows(input_ids, "input_ids")
+        frozen_mask = _freeze_rows(attention_mask, "attention_mask")
+        frozen_positions = _freeze_rows(position_ids, "position_ids")
+        return cls(
+            model_revision=model_revision,
+            tokenizer_revision=tokenizer_revision,
+            input_ids=frozen_ids,
+            attention_mask=frozen_mask,
+            position_ids=frozen_positions,
+            prompt_hash=compute_prompt_hash(
+                frozen_ids, frozen_mask, frozen_positions
+            ),
+            first_token=first_token,
+            layers=tuple(layers),
+            provenance=provenance,
+            metadata=_freeze_metadata(metadata),
+        )
+
+    @property
+    def batch_size(self) -> int:
+        return len(self.input_ids)
+
+    @property
+    def cache_length(self) -> int:
+        return len(self.input_ids[0])
+
+    def descriptor(self) -> dict[str, Any]:
+        return {
+            "schema": "plena.prefill",
+            "schema_version": self.schema_version,
+            "model_revision": self.model_revision,
+            "tokenizer_revision": self.tokenizer_revision,
+            "prompt_hash": self.prompt_hash,
+            "input_ids": [list(row) for row in self.input_ids],
+            "attention_mask": [list(row) for row in self.attention_mask],
+            "position_ids": [list(row) for row in self.position_ids],
+            "first_token": self.first_token.descriptor(),
+            "layers": [layer.descriptor() for layer in self.layers],
+            "provenance": self.provenance.descriptor(),
+            "metadata": dict(self.metadata),
+        }
+
+
+@dataclass(frozen=True)
+class QuantizedTensorPayload:
+    """Physical cache planes and the corresponding numerical tensor."""
+
+    format_id: str
+    block_size: int
+    element_bits: int
+    logical_shape: tuple[int, ...]
+    element_plane: bytes = field(repr=False)
+    scale_plane: bytes = field(repr=False)
+    numerical_view: TensorPayload = field(repr=False)
+    element_encoding: str
+    scale_encoding: str
+    element_sha256: str = field(init=False)
+    scale_sha256: str = field(init=False)
+
+    def __post_init__(self) -> None:
+        logical_shape = tuple(int(size) for size in self.logical_shape)
+        if not self.format_id:
+            raise ValueError("format_id is required")
+        if not self.element_encoding or not self.scale_encoding:
+            raise ValueError("element and scale encodings are required")
+        if self.block_size <= 0 or self.element_bits <= 0:
+            raise ValueError("block_size and element_bits must be positive")
+        if logical_shape != self.numerical_view.shape:
+            raise ValueError("numerical view must match the logical cache shape")
+        if len(logical_shape) != 4:
+            raise ValueError("cache tensors must use [batch, heads, sequence, head_dim]")
+        element_plane = bytes(self.element_plane)
+        scale_plane = bytes(self.scale_plane)
+        if not element_plane:
+            raise ValueError("element_plane cannot be empty")
+        object.__setattr__(self, "logical_shape", logical_shape)
+        object.__setattr__(self, "element_plane", element_plane)
+        object.__setattr__(self, "scale_plane", scale_plane)
+        object.__setattr__(self, "element_sha256", _sha256(element_plane))
+        object.__setattr__(self, "scale_sha256", _sha256(scale_plane))
+
+    def descriptor(self) -> dict[str, Any]:
+        return {
+            "format_id": self.format_id,
+            "block_size": self.block_size,
+            "element_bits": self.element_bits,
+            "element_encoding": self.element_encoding,
+            "scale_encoding": self.scale_encoding,
+            "logical_shape": list(self.logical_shape),
+            "element_plane": {
+                "bytes": len(self.element_plane),
+                "sha256": self.element_sha256,
+            },
+            "scale_plane": {
+                "bytes": len(self.scale_plane),
+                "sha256": self.scale_sha256,
+            },
+            "numerical_view": self.numerical_view.descriptor(),
+        }
+
+
+def _quantized_signature(
+    tensor: QuantizedTensorPayload,
+) -> tuple[str, int, int, str, str]:
+    return (
+        tensor.format_id,
+        tensor.block_size,
+        tensor.element_bits,
+        tensor.element_encoding,
+        tensor.scale_encoding,
+    )
+
+
+@dataclass(frozen=True)
+class DecodeKVLayerPayload:
+    """The admitted K/V cache representation for one layer."""
+
+    key: QuantizedTensorPayload
+    value: QuantizedTensorPayload
+
+    def __post_init__(self) -> None:
+        if self.key.logical_shape != self.value.logical_shape:
+            raise ValueError("decode key and value shapes must match")
+
+    def descriptor(self) -> dict[str, Any]:
+        return {"key": self.key.descriptor(), "value": self.value.descriptor()}
+
+
+@dataclass(frozen=True)
+class DecodeCacheArtifact:
+    """Immutable decode-ingress cache derived from one prefill artifact."""
+
+    source_artifact_id: str
+    precision_id: str
+    layout_id: str
+    layers: tuple[DecodeKVLayerPayload, ...]
+    provenance: ArtifactProvenance
+    metadata: tuple[tuple[str, str], ...] = ()
+    schema_version: int = _DECODE_CACHE_SCHEMA
+    artifact_id: str = field(init=False)
+
+    def __post_init__(self) -> None:
+        if not self.source_artifact_id or not self.precision_id or not self.layout_id:
+            raise ValueError("source, precision, and layout identities are required")
+        layers = tuple(self.layers)
+        if not layers:
+            raise ValueError("decode cache must contain at least one K/V layer")
+        reference_shape = layers[0].key.logical_shape
+        key_signature = _quantized_signature(layers[0].key)
+        value_signature = _quantized_signature(layers[0].value)
+        for layer in layers:
+            if layer.key.logical_shape[:1] != reference_shape[:1]:
+                raise ValueError("decode cache layers must have a common batch size")
+            if layer.key.logical_shape[-2] != reference_shape[-2]:
+                raise ValueError("decode cache layers must have a common sequence length")
+            if _quantized_signature(layer.key) != key_signature:
+                raise ValueError("decode key format must be uniform across layers")
+            if _quantized_signature(layer.value) != value_signature:
+                raise ValueError("decode value format must be uniform across layers")
+        if self.schema_version != _DECODE_CACHE_SCHEMA:
+            raise ValueError(f"unsupported decode-cache schema {self.schema_version}")
+        object.__setattr__(self, "layers", layers)
+        object.__setattr__(self, "metadata", _freeze_metadata(self.metadata))
+        object.__setattr__(self, "artifact_id", _sha256(_canonical_json(self.descriptor())))
+
+    @property
+    def batch_size(self) -> int:
+        return self.layers[0].key.logical_shape[0]
+
+    @property
+    def cache_length(self) -> int:
+        return self.layers[0].key.logical_shape[-2]
+
+    @property
+    def key_format(self) -> str:
+        return self.layers[0].key.format_id
+
+    @property
+    def value_format(self) -> str:
+        return self.layers[0].value.format_id
+
+    @property
+    def split_kv(self) -> bool:
+        return _quantized_signature(self.layers[0].key) != _quantized_signature(
+            self.layers[0].value
+        )
+
+    def descriptor(self) -> dict[str, Any]:
+        return {
+            "schema": "plena.decode_cache",
+            "schema_version": self.schema_version,
+            "source_artifact_id": self.source_artifact_id,
+            "precision_id": self.precision_id,
+            "layout_id": self.layout_id,
+            "layers": [layer.descriptor() for layer in self.layers],
+            "provenance": self.provenance.descriptor(),
+            "metadata": dict(self.metadata),
+        }
+
+
+class CacheTensorConverter(Protocol):
+    """Convert one BF16 K/V tensor to its physical decode representation."""
+
+    def convert(
+        self,
+        tensor: TensorPayload,
+        *,
+        role: Literal["key", "value"],
+        layer_index: int,
+        precision_id: str,
+        layout_id: str,
+    ) -> QuantizedTensorPayload:
+        ...
+
+
+@dataclass(frozen=True)
+class FunctionalCacheConverter:
+    """Adapter for a quantize-and-pack function used during cache admission."""
+
+    function: Callable[
+        [TensorPayload, Literal["key", "value"], int, str, str],
+        QuantizedTensorPayload,
+    ]
+
+    def convert(
+        self,
+        tensor: TensorPayload,
+        *,
+        role: Literal["key", "value"],
+        layer_index: int,
+        precision_id: str,
+        layout_id: str,
+    ) -> QuantizedTensorPayload:
+        return self.function(tensor, role, layer_index, precision_id, layout_id)
+
+
+@dataclass(frozen=True)
+class SplitCacheConverter:
+    """Dispatch admission conversion independently for K and V."""
+
+    key_converter: CacheTensorConverter
+    value_converter: CacheTensorConverter
+
+    def convert(
+        self,
+        tensor: TensorPayload,
+        *,
+        role: Literal["key", "value"],
+        layer_index: int,
+        precision_id: str,
+        layout_id: str,
+    ) -> QuantizedTensorPayload:
+        converter = (
+            self.key_converter if role == "key" else self.value_converter
+        )
+        return converter.convert(
+            tensor,
+            role=role,
+            layer_index=layer_index,
+            precision_id=precision_id,
+            layout_id=layout_id,
+        )
+
+
+@dataclass(frozen=True)
+class BF16CacheConverter:
+    """Lossless baseline converter with BF16 values as the element plane."""
+
+    def convert(
+        self,
+        tensor: TensorPayload,
+        *,
+        role: Literal["key", "value"],
+        layer_index: int,
+        precision_id: str,
+        layout_id: str,
+    ) -> QuantizedTensorPayload:
+        del role, layer_index, precision_id, layout_id
+        return QuantizedTensorPayload(
+            format_id="BF16",
+            block_size=1,
+            element_bits=16,
+            logical_shape=tensor.shape,
+            element_plane=tensor.data,
+            scale_plane=b"",
+            numerical_view=tensor,
+            element_encoding="BF16_LE",
+            scale_encoding="NONE",
+        )
+
+
+def admit_prefill_cache(
+    prefill: PrefillArtifact,
+    *,
+    precision_id: str,
+    layout_id: str,
+    converter: CacheTensorConverter,
+    provenance: ArtifactProvenance,
+    metadata: Sequence[tuple[str, str]] | dict[str, str] | None = None,
+) -> DecodeCacheArtifact:
+    """Quantize and pack an immutable BF16 cache exactly once at admission."""
+    layers: list[DecodeKVLayerPayload] = []
+    for layer_index, layer in enumerate(prefill.layers):
+        key = converter.convert(
+            layer.key,
+            role="key",
+            layer_index=layer_index,
+            precision_id=precision_id,
+            layout_id=layout_id,
+        )
+        value = converter.convert(
+            layer.value,
+            role="value",
+            layer_index=layer_index,
+            precision_id=precision_id,
+            layout_id=layout_id,
+        )
+        layers.append(DecodeKVLayerPayload(key=key, value=value))
+    admitted = DecodeCacheArtifact(
+        source_artifact_id=prefill.artifact_id,
+        precision_id=precision_id,
+        layout_id=layout_id,
+        layers=tuple(layers),
+        provenance=provenance,
+        metadata=_freeze_metadata(metadata),
+    )
+    if admitted.batch_size != prefill.batch_size:
+        raise ValueError("admission changed the cache batch size")
+    if admitted.cache_length != prefill.cache_length:
+        raise ValueError("admission changed the cache sequence length")
+    return admitted
+
+
+def admit_prefill_cache_split(
+    prefill: PrefillArtifact,
+    *,
+    precision_id: str,
+    layout_id: str,
+    key_converter: CacheTensorConverter,
+    value_converter: CacheTensorConverter,
+    provenance: ArtifactProvenance,
+    key_format: str,
+    value_format: str,
+    metadata: Sequence[tuple[str, str]] | dict[str, str] | None = None,
+) -> DecodeCacheArtifact:
+    """Admit BF16 prompt K/V into independently declared cache formats."""
+
+    artifact = admit_prefill_cache(
+        prefill,
+        precision_id=precision_id,
+        layout_id=layout_id,
+        converter=SplitCacheConverter(key_converter, value_converter),
+        provenance=provenance,
+        metadata=metadata,
+    )
+    if artifact.key_format != key_format:
+        raise ValueError("admitted key format differs from the refinement profile")
+    if artifact.value_format != value_format:
+        raise ValueError("admitted value format differs from the refinement profile")
+    return artifact
+
+
+def _write_bytes(path: Path, data: bytes) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("xb") as handle:
+        handle.write(data)
+        handle.flush()
+        os.fsync(handle.fileno())
+
+
+def _atomic_directory_write(path: Path, writer: Callable[[Path], None]) -> None:
+    path = path.resolve()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.exists():
+        raise FileExistsError(f"artifact path already exists: {path}")
+    temporary = Path(tempfile.mkdtemp(prefix=f".{path.name}.", dir=path.parent))
+    try:
+        writer(temporary)
+        os.replace(temporary, path)
+    except BaseException:
+        shutil.rmtree(temporary, ignore_errors=True)
+        raise
+
+
+def save_prefill_artifact(artifact: PrefillArtifact, path: str | Path) -> None:
+    """Write a prefill artifact atomically without pickle serialization."""
+    destination = Path(path)
+
+    def writer(root: Path) -> None:
+        for index, layer in enumerate(artifact.layers):
+            _write_bytes(root / "layers" / f"{index:04d}.key.bin", layer.key.data)
+            _write_bytes(root / "layers" / f"{index:04d}.value.bin", layer.value.data)
+        manifest = artifact.descriptor() | {"artifact_id": artifact.artifact_id}
+        _write_bytes(root / "manifest.json", _canonical_json(manifest))
+
+    _atomic_directory_write(destination, writer)
+
+
+def _load_json(path: Path) -> dict[str, Any]:
+    with path.open("rb") as handle:
+        value = json.load(handle)
+    if not isinstance(value, dict):
+        raise ValueError(f"{path} must contain a JSON object")
+    return value
+
+
+def _load_tensor(descriptor: dict[str, Any], path: Path) -> TensorPayload:
+    payload = TensorPayload(
+        dtype=descriptor["dtype"],
+        shape=tuple(descriptor["shape"]),
+        data=path.read_bytes(),
+    )
+    if payload.sha256 != descriptor["sha256"]:
+        raise ValueError(f"tensor checksum mismatch: {path}")
+    return payload
+
+
+def _load_provenance(value: dict[str, Any]) -> ArtifactProvenance:
+    return ArtifactProvenance(
+        producer=value["producer"],
+        code_revision=value["code_revision"],
+        created_at_utc=value["created_at_utc"],
+        parameters=value.get("parameters", {}),
+    )
+
+
+def load_prefill_artifact(path: str | Path) -> PrefillArtifact:
+    """Load and verify a prefill artifact and all tensor checksums."""
+    root = Path(path)
+    manifest = _load_json(root / "manifest.json")
+    if manifest.get("schema") != "plena.prefill":
+        raise ValueError("not a PLENA prefill artifact")
+    layers = []
+    for index, layer_desc in enumerate(manifest["layers"]):
+        layers.append(
+            KVLayerPayload(
+                key=_load_tensor(
+                    layer_desc["key"], root / "layers" / f"{index:04d}.key.bin"
+                ),
+                value=_load_tensor(
+                    layer_desc["value"], root / "layers" / f"{index:04d}.value.bin"
+                ),
+            )
+        )
+    first_desc = manifest["first_token"]
+    artifact = PrefillArtifact(
+        model_revision=manifest["model_revision"],
+        tokenizer_revision=manifest["tokenizer_revision"],
+        input_ids=tuple(tuple(row) for row in manifest["input_ids"]),
+        attention_mask=tuple(tuple(row) for row in manifest["attention_mask"]),
+        position_ids=tuple(tuple(row) for row in manifest["position_ids"]),
+        prompt_hash=manifest["prompt_hash"],
+        first_token=FirstTokenResult(
+            token_ids=tuple(first_desc["token_ids"]),
+            selection=first_desc["selection"],
+            log_probabilities=(
+                tuple(first_desc["log_probabilities"])
+                if first_desc["log_probabilities"] is not None
+                else None
+            ),
+        ),
+        layers=tuple(layers),
+        provenance=_load_provenance(manifest["provenance"]),
+        metadata=manifest.get("metadata", {}),
+        schema_version=manifest["schema_version"],
+    )
+    if artifact.artifact_id != manifest["artifact_id"]:
+        raise ValueError("prefill artifact identity mismatch")
+    return artifact
+
+
+def save_decode_cache_artifact(
+    artifact: DecodeCacheArtifact, path: str | Path
+) -> None:
+    """Write a decode-cache artifact atomically without pickle serialization."""
+    destination = Path(path)
+
+    def writer(root: Path) -> None:
+        for index, layer in enumerate(artifact.layers):
+            for role, tensor in (("key", layer.key), ("value", layer.value)):
+                prefix = root / "layers" / f"{index:04d}.{role}"
+                _write_bytes(Path(f"{prefix}.elements.bin"), tensor.element_plane)
+                _write_bytes(Path(f"{prefix}.scales.bin"), tensor.scale_plane)
+                _write_bytes(
+                    Path(f"{prefix}.numerical.bin"), tensor.numerical_view.data
+                )
+        manifest = artifact.descriptor() | {"artifact_id": artifact.artifact_id}
+        _write_bytes(root / "manifest.json", _canonical_json(manifest))
+
+    _atomic_directory_write(destination, writer)
+
+
+def _load_quantized_tensor(
+    descriptor: dict[str, Any], root: Path, index: int, role: str
+) -> QuantizedTensorPayload:
+    prefix = root / "layers" / f"{index:04d}.{role}"
+    elements = Path(f"{prefix}.elements.bin").read_bytes()
+    scales = Path(f"{prefix}.scales.bin").read_bytes()
+    if len(elements) != descriptor["element_plane"]["bytes"]:
+        raise ValueError(f"element-plane length mismatch at layer {index} {role}")
+    if len(scales) != descriptor["scale_plane"]["bytes"]:
+        raise ValueError(f"scale-plane length mismatch at layer {index} {role}")
+    if _sha256(elements) != descriptor["element_plane"]["sha256"]:
+        raise ValueError(f"element-plane checksum mismatch at layer {index} {role}")
+    if _sha256(scales) != descriptor["scale_plane"]["sha256"]:
+        raise ValueError(f"scale-plane checksum mismatch at layer {index} {role}")
+    numerical = _load_tensor(
+        descriptor["numerical_view"], Path(f"{prefix}.numerical.bin")
+    )
+    return QuantizedTensorPayload(
+        format_id=descriptor["format_id"],
+        block_size=descriptor["block_size"],
+        element_bits=descriptor["element_bits"],
+        logical_shape=tuple(descriptor["logical_shape"]),
+        element_plane=elements,
+        scale_plane=scales,
+        numerical_view=numerical,
+        element_encoding=descriptor["element_encoding"],
+        scale_encoding=descriptor["scale_encoding"],
+    )
+
+
+def load_decode_cache_artifact(path: str | Path) -> DecodeCacheArtifact:
+    """Load and verify a decode-cache artifact and all physical planes."""
+    root = Path(path)
+    manifest = _load_json(root / "manifest.json")
+    if manifest.get("schema") != "plena.decode_cache":
+        raise ValueError("not a PLENA decode-cache artifact")
+    layers = []
+    for index, layer_desc in enumerate(manifest["layers"]):
+        layers.append(
+            DecodeKVLayerPayload(
+                key=_load_quantized_tensor(layer_desc["key"], root, index, "key"),
+                value=_load_quantized_tensor(
+                    layer_desc["value"], root, index, "value"
+                ),
+            )
+        )
+    artifact = DecodeCacheArtifact(
+        source_artifact_id=manifest["source_artifact_id"],
+        precision_id=manifest["precision_id"],
+        layout_id=manifest["layout_id"],
+        layers=tuple(layers),
+        provenance=_load_provenance(manifest["provenance"]),
+        metadata=manifest.get("metadata", {}),
+        schema_version=manifest["schema_version"],
+    )
+    if artifact.artifact_id != manifest["artifact_id"]:
+        raise ValueError("decode-cache artifact identity mismatch")
+    return artifact
diff --git a/decode_dse/software/cached_decode.py b/decode_dse/software/cached_decode.py
new file mode 100644
index 0000000..2954ecc
--- /dev/null
+++ b/decode_dse/software/cached_decode.py
@@ -0,0 +1,848 @@
+"""Split-prefill capture and exact cached one-token decode scoring."""
+
+from __future__ import annotations
+
+import math
+from dataclasses import dataclass
+from typing import Any, Callable, Protocol, Sequence
+
+from decode_dse.software.cache_artifacts import (
+    ArtifactProvenance,
+    DecodeCacheArtifact,
+    FirstTokenResult,
+    KVLayerPayload,
+    PrefillArtifact,
+    TensorPayload,
+)
+
+
+@dataclass(frozen=True)
+class ContinuationExample:
+    """One independently cached document and its teacher-forced continuation."""
+
+    document_id: str
+    prefill: PrefillArtifact
+    decode_cache: DecodeCacheArtifact
+    continuation_ids: tuple[int, ...]
+
+    def __post_init__(self) -> None:
+        continuation = tuple(int(token) for token in self.continuation_ids)
+        if not self.document_id:
+            raise ValueError("document_id is required")
+        if self.prefill.batch_size != 1 or self.decode_cache.batch_size != 1:
+            raise ValueError("each continuation must own a batch-one cache")
+        if any(mask != 1 for mask in self.prefill.attention_mask[0]):
+            raise ValueError("cached documents must be stored without prompt padding")
+        if self.decode_cache.source_artifact_id != self.prefill.artifact_id:
+            raise ValueError("decode cache was not derived from this prefill artifact")
+        if len(continuation) < 2:
+            raise ValueError("at least two continuation tokens are required")
+        if continuation[0] != self.prefill.first_token.token_ids[0]:
+            raise ValueError("continuation must begin with the token selected by prefill")
+        object.__setattr__(self, "continuation_ids", continuation)
+
+
+@dataclass(frozen=True)
+class DecodeStep:
+    """Backend output for one cache-mutating model invocation."""
+
+    logits: Any
+    cache: Any
+
+
+@dataclass(frozen=True)
+class DocumentNLL:
+    """Per-document likelihood result with first-token attribution explicit."""
+
+    document_id: str
+    nll_sum: float
+    token_count: int
+    per_token_nll: tuple[float, ...]
+    first_token_id: int
+    scored_token_ids: tuple[int, ...]
+    initial_cache_length: int
+    final_cache_length: int
+
+    @property
+    def mean_nll(self) -> float:
+        return self.nll_sum / self.token_count
+
+    @property
+    def perplexity(self) -> float:
+        return math.exp(self.mean_nll)
+
+
+@dataclass(frozen=True)
+class CorpusNLL:
+    """Token-weighted aggregate retaining every document result."""
+
+    documents: tuple[DocumentNLL, ...]
+
+    def __post_init__(self) -> None:
+        documents = tuple(self.documents)
+        if not documents:
+            raise ValueError("at least one document result is required")
+        ids = [document.document_id for document in documents]
+        if len(set(ids)) != len(ids):
+            raise ValueError("document IDs must be unique")
+        object.__setattr__(self, "documents", documents)
+
+    @property
+    def nll_sum(self) -> float:
+        return sum(document.nll_sum for document in self.documents)
+
+    @property
+    def token_count(self) -> int:
+        return sum(document.token_count for document in self.documents)
+
+    @property
+    def mean_nll(self) -> float:
+        return self.nll_sum / self.token_count
+
+    @property
+    def perplexity(self) -> float:
+        return math.exp(self.mean_nll)
+
+
+class CachedDecodeBackend(Protocol):
+    """Execution operations required by the phase-independent evaluator."""
+
+    def materialize_cache(self, artifact: DecodeCacheArtifact) -> Any:
+        ...
+
+    def cache_length(self, cache: Any) -> int:
+        ...
+
+    def cache_batch_size(self, cache: Any) -> int:
+        ...
+
+    def decode_step(
+        self,
+        model: Any,
+        *,
+        input_token_id: int,
+        cache: Any,
+        attention_mask: tuple[int, ...],
+        position_id: int,
+        cache_position: int,
+    ) -> DecodeStep:
+        ...
+
+    def commit_append(
+        self,
+        cache: Any,
+        *,
+        previous_length: int,
+        artifact: DecodeCacheArtifact,
+    ) -> Any:
+        ...
+
+    def token_nll(self, logits: Any, target_token_id: int) -> float:
+        ...
+
+
+def evaluate_teacher_forced_cached(
+    model: Any,
+    example: ContinuationExample,
+    backend: CachedDecodeBackend,
+) -> DocumentNLL:
+    """Score only tokens predicted by sequential cached ``q_len=1`` calls."""
+    cache = backend.materialize_cache(example.decode_cache)
+    initial_length = example.prefill.cache_length
+    if example.decode_cache.cache_length != initial_length:
+        raise AssertionError("decode admission changed the cache length")
+    if backend.cache_batch_size(cache) != 1:
+        raise AssertionError("a document must have an independent batch-one cache")
+    if backend.cache_length(cache) != initial_length:
+        raise AssertionError("materialized cache length does not match prefill")
+
+    attention_mask = example.prefill.attention_mask[0]
+    next_position = example.prefill.position_ids[0][-1] + 1
+    losses: list[float] = []
+    for step_index, target_token in enumerate(example.continuation_ids[1:]):
+        input_token = example.continuation_ids[step_index]
+        previous_length = backend.cache_length(cache)
+        expected_length = initial_length + step_index
+        if previous_length != expected_length:
+            raise AssertionError(
+                f"cache length before step {step_index} is {previous_length}, "
+                f"expected {expected_length}"
+            )
+        step_mask = attention_mask + (1,) * (step_index + 1)
+        result = backend.decode_step(
+            model,
+            input_token_id=input_token,
+            cache=cache,
+            attention_mask=step_mask,
+            position_id=next_position + step_index,
+            cache_position=previous_length,
+        )
+        grown_length = backend.cache_length(result.cache)
+        if grown_length != previous_length + 1:
+            raise AssertionError(
+                f"q_len=1 must grow the cache by one, observed "
+                f"{previous_length}->{grown_length}"
+            )
+        cache = backend.commit_append(
+            result.cache,
+            previous_length=previous_length,
+            artifact=example.decode_cache,
+        )
+        if backend.cache_length(cache) != grown_length:
+            raise AssertionError("append conversion changed the logical cache length")
+        loss = float(backend.token_nll(result.logits, target_token))
+        if not math.isfinite(loss):
+            raise FloatingPointError(
+                f"non-finite NLL for document {example.document_id!r}, "
+                f"decode step {step_index}"
+            )
+        losses.append(loss)
+
+    return DocumentNLL(
+        document_id=example.document_id,
+        nll_sum=sum(losses),
+        token_count=len(losses),
+        per_token_nll=tuple(losses),
+        first_token_id=example.continuation_ids[0],
+        scored_token_ids=example.continuation_ids[1:],
+        initial_cache_length=initial_length,
+        final_cache_length=backend.cache_length(cache),
+    )
+
+
+def evaluate_teacher_forced_cached_batched(
+    model: Any,
+    examples: Sequence[ContinuationExample],
+    backend: Any,
+) -> tuple[DocumentNLL, ...]:
+    """Score independent equal-length caches in q_len=1 microbatches."""
+
+    examples = tuple(examples)
+    if not examples:
+        raise ValueError("at least one cached document is required")
+    document_ids = tuple(example.document_id for example in examples)
+    if len(document_ids) != len(set(document_ids)):
+        raise ValueError("document IDs must be unique within a microbatch")
+    initial_lengths = {example.prefill.cache_length for example in examples}
+    step_counts = {len(example.continuation_ids) - 1 for example in examples}
+    next_positions = {
+        example.prefill.position_ids[0][-1] + 1 for example in examples
+    }
+    if len(initial_lengths) != 1:
+        raise ValueError("microbatched caches must have equal prompt lengths")
+    if len(step_counts) != 1:
+        raise ValueError("microbatched continuations must have equal lengths")
+    if len(next_positions) != 1:
+        raise ValueError("microbatched caches must share the next position")
+    initial_length = next(iter(initial_lengths))
+    step_count = next(iter(step_counts))
+    if any(
+        example.decode_cache.cache_length != initial_length
+        for example in examples
+    ):
+        raise AssertionError("decode admission changed a cache length")
+
+    artifacts = tuple(example.decode_cache for example in examples)
+    cache = backend.materialize_cache_batch(artifacts)
+    if backend.cache_batch_size(cache) != len(examples):
+        raise AssertionError("materialized cache batch size is inconsistent")
+    if backend.cache_length(cache) != initial_length:
+        raise AssertionError("materialized cache length does not match prefill")
+
+    losses: list[list[float]] = [[] for _ in examples]
+    next_position = next(iter(next_positions))
+    for step_index in range(step_count):
+        previous_length = backend.cache_length(cache)
+        expected_length = initial_length + step_index
+        if previous_length != expected_length:
+            raise AssertionError(
+                f"cache length before step {step_index} is {previous_length}, "
+                f"expected {expected_length}"
+            )
+        masks = tuple(
+            example.prefill.attention_mask[0] + (1,) * (step_index + 1)
+            for example in examples
+        )
+        result = backend.decode_step_batch(
+            model,
+            input_token_ids=tuple(
+                example.continuation_ids[step_index] for example in examples
+            ),
+            cache=cache,
+            attention_masks=masks,
+            position_ids=(next_position + step_index,) * len(examples),
+            cache_position=previous_length,
+        )
+        grown_length = backend.cache_length(result.cache)
+        if grown_length != previous_length + 1:
+            raise AssertionError(
+                "a q_len=1 microbatch must grow every cache by one entry"
+            )
+        cache = backend.commit_append_batch(
+            result.cache,
+            previous_length=previous_length,
+            artifacts=artifacts,
+        )
+        if backend.cache_length(cache) != grown_length:
+            raise AssertionError("append conversion changed the logical cache length")
+        step_losses = backend.token_nll_batch(
+            result.logits,
+            tuple(
+                example.continuation_ids[step_index + 1]
+                for example in examples
+            ),
+        )
+        if len(step_losses) != len(examples):
+            raise AssertionError("backend returned the wrong number of token losses")
+        for index, loss in enumerate(step_losses):
+            value = float(loss)
+            if not math.isfinite(value):
+                raise FloatingPointError(
+                    f"non-finite NLL for document {document_ids[index]!r}, "
+                    f"decode step {step_index}"
+                )
+            losses[index].append(value)
+
+    final_length = backend.cache_length(cache)
+    return tuple(
+        DocumentNLL(
+            document_id=example.document_id,
+            nll_sum=sum(document_losses),
+            token_count=len(document_losses),
+            per_token_nll=tuple(document_losses),
+            first_token_id=example.continuation_ids[0],
+            scored_token_ids=example.continuation_ids[1:],
+            initial_cache_length=initial_length,
+            final_cache_length=final_length,
+        )
+        for example, document_losses in zip(examples, losses)
+    )
+
+
+def evaluate_cached_documents(
+    model: Any,
+    examples: Sequence[ContinuationExample],
+    backend: CachedDecodeBackend,
+) -> CorpusNLL:
+    """Evaluate documents independently and aggregate by scored-token count."""
+    examples = tuple(examples)
+    ids = [example.document_id for example in examples]
+    if len(set(ids)) != len(ids):
+        raise ValueError("document IDs must be unique")
+    return CorpusNLL(
+        tuple(
+            evaluate_teacher_forced_cached(model, example, backend)
+            for example in examples
+        )
+    )
+
+
+def _cache_from_layers(legacy: tuple[tuple[Any, Any], ...]) -> Any:
+    """Build a transformers Cache from per-layer (key, value) pairs.
+
+    ``DynamicCache.from_legacy_cache`` no longer exists on current
+    transformers; layer-wise ``update`` is the stable construction API.
+    """
+
+    from transformers import DynamicCache
+
+    cache = DynamicCache()
+    for layer_idx, (key, value) in enumerate(legacy):
+        cache.update(key, value, layer_idx)
+    return cache
+
+
+def _legacy_cache_layers(cache: Any) -> tuple[tuple[Any, Any], ...]:
+    if hasattr(cache, "to_legacy_cache"):
+        cache = cache.to_legacy_cache()
+    elif hasattr(cache, "key_cache") and hasattr(cache, "value_cache"):
+        cache = tuple(zip(cache.key_cache, cache.value_cache))
+    layers = tuple(cache)
+    if not layers or any(len(layer) < 2 for layer in layers):
+        raise ValueError("past_key_values does not contain K/V layers")
+    return tuple((layer[0], layer[1]) for layer in layers)
+
+
+def capture_bf16_prefill(
+    model: Any,
+    *,
+    input_ids: Any,
+    attention_mask: Any,
+    model_revision: str,
+    tokenizer_revision: str,
+    provenance: ArtifactProvenance,
+    expected_first_token_ids: Any | None = None,
+    position_ids: Any | None = None,
+    metadata: Sequence[tuple[str, str]] | dict[str, str] | None = None,
+) -> PrefillArtifact:
+    """Run one untouched BF16 prefill and capture its reusable cache."""
+    import torch
+
+    if input_ids.ndim != 2 or attention_mask.shape != input_ids.shape:
+        raise ValueError("input_ids and attention_mask must have shape [batch, sequence]")
+    if input_ids.shape[1] <= 1:
+        raise ValueError("prefill requires a prompt longer than one token")
+    if position_ids is None:
+        position_ids = attention_mask.to(torch.long).cumsum(dim=-1) - 1
+        position_ids = position_ids.clamp_min(0)
+    if position_ids.shape != input_ids.shape:
+        raise ValueError("position_ids must match input_ids")
+    device = input_ids.device
+    cache_position = torch.arange(input_ids.shape[1], device=device)
+    model.eval()
+    with torch.no_grad():
+        output = model(
+            input_ids=input_ids,
+            attention_mask=attention_mask,
+            position_ids=position_ids,
+            cache_position=cache_position,
+            use_cache=True,
+        )
+    logits = output.logits
+    if logits.ndim != 3 or logits.shape[:2] != input_ids.shape:
+        raise AssertionError("prefill logits must have shape [batch, sequence, vocabulary]")
+
+    token_offsets = torch.arange(input_ids.shape[1], device=device)[None, :]
+    last_indices = torch.where(
+        attention_mask.to(torch.bool), token_offsets, torch.full_like(token_offsets, -1)
+    ).amax(dim=-1)
+    if torch.any(last_indices < 0):
+        raise ValueError("each prompt must contain at least one active token")
+    batch_indices = torch.arange(input_ids.shape[0], device=device)
+    last_logits = logits[batch_indices, last_indices]
+    selection = "greedy"
+    if expected_first_token_ids is None:
+        first_tokens = last_logits.argmax(dim=-1)
+    else:
+        first_tokens = torch.as_tensor(
+            expected_first_token_ids, dtype=torch.long, device=device
+        ).reshape(-1)
+        if first_tokens.shape[0] != input_ids.shape[0]:
+            raise ValueError("expected_first_token_ids must match the prompt batch")
+        selection = "teacher_forced"
+    first_log_probs = torch.log_softmax(last_logits.float(), dim=-1).gather(
+        -1, first_tokens[:, None]
+    )
+
+    layers = []
+    for key, value in _legacy_cache_layers(output.past_key_values):
+        if key.dtype != torch.bfloat16 or value.dtype != torch.bfloat16:
+            raise TypeError("prefill model must emit BF16 K/V tensors")
+        layers.append(
+            KVLayerPayload(
+                key=TensorPayload.from_torch(key),
+                value=TensorPayload.from_torch(value),
+            )
+        )
+    expected_cache_length = input_ids.shape[1]
+    if any(layer.key.shape[-2] != expected_cache_length for layer in layers):
+        raise AssertionError("prefill cache length does not match the prompt")
+
+    def rows(tensor: Any) -> tuple[tuple[int, ...], ...]:
+        return tuple(
+            tuple(int(value) for value in row)
+            for row in tensor.detach().to("cpu").tolist()
+        )
+
+    return PrefillArtifact.create(
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        input_ids=rows(input_ids),
+        attention_mask=rows(attention_mask),
+        position_ids=rows(position_ids),
+        first_token=FirstTokenResult(
+            token_ids=tuple(
+                int(value) for value in first_tokens.detach().to("cpu").tolist()
+            ),
+            selection=selection,
+            log_probabilities=tuple(
+                float(value)
+                for value in first_log_probs[:, 0].detach().to("cpu").tolist()
+            ),
+        ),
+        layers=layers,
+        provenance=provenance,
+        metadata=metadata,
+    )
+
+
+AppendTransform = Callable[[Any, int, int, DecodeCacheArtifact], Any]
+AppendValidator = Callable[[Any, int, int, DecodeCacheArtifact], None]
+
+
+class TorchHFCachedDecodeBackend:
+    """Torch/Hugging Face backend with explicit cache-append conversion."""
+
+    def __init__(
+        self,
+        *,
+        device: str | Any,
+        cache_factory: Callable[[tuple[tuple[Any, Any], ...]], Any] | None = None,
+        append_transform: AppendTransform | None = None,
+        append_validator: AppendValidator | None = None,
+        native_append_format: bool = False,
+        execution_batch_width: int | None = None,
+    ) -> None:
+        # GPU GEMM kernel selection depends on the total batch count, so the
+        # same lane rounds differently at different batch sizes. Padding every
+        # forward to one fixed width keeps kernel dispatch identical across
+        # microbatch sizes; lane isolation keeps pad lanes from affecting real
+        # lanes. Only the plain-cache path supports it: append transforms and
+        # cache factories assume the cache holds exactly the real lanes.
+        if execution_batch_width is not None:
+            if int(execution_batch_width) < 1:
+                raise ValueError("execution_batch_width must be positive")
+            if (
+                cache_factory is not None
+                or append_transform is not None
+                or append_validator is not None
+            ):
+                raise ValueError(
+                    "execution_batch_width requires the plain cache-append path"
+                )
+        self.device = device
+        self.cache_factory = cache_factory
+        self.append_transform = append_transform
+        self.append_validator = append_validator
+        self.native_append_format = native_append_format
+        self.execution_batch_width = (
+            None if execution_batch_width is None else int(execution_batch_width)
+        )
+
+    def _padded_legacy(
+        self,
+        legacy: tuple[tuple[Any, Any], ...],
+        logical_batch: int,
+    ) -> tuple[tuple[Any, Any], ...]:
+        import torch
+
+        width = self.execution_batch_width
+        if width is None or width == logical_batch:
+            return legacy
+        if logical_batch > width:
+            raise ValueError(
+                f"cache batch {logical_batch} exceeds execution width {width}"
+            )
+        pad = width - logical_batch
+        return tuple(
+            (
+                torch.cat((key, *(key[:1],) * pad), dim=0),
+                torch.cat((value, *(value[:1],) * pad), dim=0),
+            )
+            for key, value in legacy
+        )
+
+    def _tag_logical_batch(self, cache: Any, logical_batch: int) -> Any:
+        if self.execution_batch_width is not None:
+            cache._decode_logical_batch = int(logical_batch)
+        return cache
+
+    def adopt_cache(self, cache: Any, *, logical_batch: int = 1) -> Any:
+        """Pad a live model cache to the execution width for decode stepping."""
+        if self.execution_batch_width is None:
+            return cache
+        legacy = self._padded_legacy(_legacy_cache_layers(cache), logical_batch)
+        return self._tag_logical_batch(_cache_from_layers(legacy), logical_batch)
+
+    def materialize_cache(self, artifact: DecodeCacheArtifact) -> Any:
+        legacy = tuple(
+            (
+                layer.key.numerical_view.to_torch(self.device),
+                layer.value.numerical_view.to_torch(self.device),
+            )
+            for layer in artifact.layers
+        )
+        if self.cache_factory is not None:
+            return self.cache_factory(legacy)
+        legacy = self._padded_legacy(legacy, 1)
+        return self._tag_logical_batch(_cache_from_layers(legacy), 1)
+
+    def materialize_cache_batch(
+        self,
+        artifacts: Sequence[DecodeCacheArtifact],
+    ) -> Any:
+        import torch
+
+        artifacts = tuple(artifacts)
+        if not artifacts:
+            raise ValueError("at least one cache artifact is required")
+        layer_count = len(artifacts[0].layers)
+        reference = artifacts[0]
+        for artifact in artifacts:
+            if artifact.batch_size != 1:
+                raise ValueError("microbatch inputs must be batch-one artifacts")
+            if len(artifact.layers) != layer_count:
+                raise ValueError("cache artifacts have different layer counts")
+            if (
+                artifact.cache_length != reference.cache_length
+                or artifact.layout_id != reference.layout_id
+                or artifact.key_format != reference.key_format
+                or artifact.value_format != reference.value_format
+            ):
+                raise ValueError("cache artifacts have incompatible contracts")
+        legacy = tuple(
+            (
+                torch.cat(
+                    tuple(
+                        artifact.layers[index].key.numerical_view.to_torch(
+                            self.device
+                        )
+                        for artifact in artifacts
+                    ),
+                    dim=0,
+                ),
+                torch.cat(
+                    tuple(
+                        artifact.layers[index].value.numerical_view.to_torch(
+                            self.device
+                        )
+                        for artifact in artifacts
+                    ),
+                    dim=0,
+                ),
+            )
+            for index in range(layer_count)
+        )
+        if self.cache_factory is not None:
+            return self.cache_factory(legacy)
+        logical_batch = len(artifacts)
+        legacy = self._padded_legacy(legacy, logical_batch)
+        return self._tag_logical_batch(_cache_from_layers(legacy), logical_batch)
+
+    def _first_key(self, cache: Any) -> Any:
+        return _legacy_cache_layers(cache)[0][0]
+
+    def cache_length(self, cache: Any) -> int:
+        if hasattr(cache, "get_seq_length"):
+            length = cache.get_seq_length()
+            return int(length.item() if hasattr(length, "item") else length)
+        return int(self._first_key(cache).shape[-2])
+
+    def cache_batch_size(self, cache: Any) -> int:
+        logical = getattr(cache, "_decode_logical_batch", None)
+        if logical is not None:
+            return int(logical)
+        return int(self._first_key(cache).shape[0])
+
+    def decode_step(
+        self,
+        model: Any,
+        *,
+        input_token_id: int,
+        cache: Any,
+        attention_mask: tuple[int, ...],
+        position_id: int,
+        cache_position: int,
+    ) -> DecodeStep:
+        import torch
+
+        width = self.execution_batch_width or 1
+        input_ids = torch.tensor(
+            [[input_token_id]] * width, dtype=torch.long, device=self.device
+        )
+        if input_ids.shape[1] != 1:
+            raise AssertionError("decode input must have q_len=1")
+        mask = torch.tensor(
+            [attention_mask] * width, dtype=torch.long, device=self.device
+        )
+        positions = torch.tensor(
+            [[position_id]] * width, dtype=torch.long, device=self.device
+        )
+        cache_positions = torch.tensor(
+            [cache_position], dtype=torch.long, device=self.device
+        )
+        model.eval()
+        with torch.no_grad():
+            output = model(
+                input_ids=input_ids,
+                attention_mask=mask,
+                position_ids=positions,
+                cache_position=cache_positions,
+                past_key_values=cache,
+                use_cache=True,
+            )
+        if output.logits.ndim != 3 or output.logits.shape[:2] != (width, 1):
+            raise AssertionError("decode logits must have shape [1, 1, vocabulary]")
+        cache = self._tag_logical_batch(output.past_key_values, 1)
+        return DecodeStep(logits=output.logits[:1], cache=cache)
+
+    def decode_step_batch(
+        self,
+        model: Any,
+        *,
+        input_token_ids: Sequence[int],
+        cache: Any,
+        attention_masks: Sequence[Sequence[int]],
+        position_ids: Sequence[int],
+        cache_position: int,
+    ) -> DecodeStep:
+        import torch
+
+        tokens = tuple(int(token) for token in input_token_ids)
+        masks = tuple(tuple(int(value) for value in row) for row in attention_masks)
+        positions_values = tuple(int(value) for value in position_ids)
+        batch = len(tokens)
+        if (
+            batch == 0
+            or len(masks) != batch
+            or len(positions_values) != batch
+        ):
+            raise ValueError("batched decode inputs have inconsistent batch sizes")
+        if len({len(row) for row in masks}) != 1:
+            raise ValueError("batched attention masks must have equal lengths")
+        width = batch
+        if self.execution_batch_width is not None:
+            width = self.execution_batch_width
+            if batch > width:
+                raise ValueError(
+                    f"decode batch {batch} exceeds execution width {width}"
+                )
+            pad = width - batch
+            tokens = tokens + (tokens[0],) * pad
+            masks = masks + (masks[0],) * pad
+            positions_values = positions_values + (positions_values[0],) * pad
+        input_ids = torch.tensor(
+            tokens,
+            dtype=torch.long,
+            device=self.device,
+        )[:, None]
+        if input_ids.shape[1] != 1:
+            raise AssertionError("decode input must have q_len=1")
+        mask = torch.tensor(masks, dtype=torch.long, device=self.device)
+        positions = torch.tensor(
+            positions_values,
+            dtype=torch.long,
+            device=self.device,
+        )[:, None]
+        cache_positions = torch.tensor(
+            [cache_position],
+            dtype=torch.long,
+            device=self.device,
+        )
+        model.eval()
+        with torch.no_grad():
+            output = model(
+                input_ids=input_ids,
+                attention_mask=mask,
+                position_ids=positions,
+                cache_position=cache_positions,
+                past_key_values=cache,
+                use_cache=True,
+            )
+        if output.logits.ndim != 3 or output.logits.shape[:2] != (width, 1):
+            raise AssertionError(
+                "decode logits must have shape [batch, 1, vocabulary]"
+            )
+        cache = self._tag_logical_batch(output.past_key_values, batch)
+        return DecodeStep(logits=output.logits[:batch], cache=cache)
+
+    def commit_append(
+        self,
+        cache: Any,
+        *,
+        previous_length: int,
+        artifact: DecodeCacheArtifact,
+    ) -> Any:
+        if self.append_validator is not None:
+            self.append_validator(
+                cache,
+                previous_length,
+                previous_length + 1,
+                artifact,
+            )
+        if self.append_transform is not None:
+            return self.append_transform(
+                cache, previous_length, previous_length + 1, artifact
+            )
+        baseline = all(
+            layer.key.format_id == "BF16" and layer.value.format_id == "BF16"
+            for layer in artifact.layers
+        )
+        if not baseline and not self.native_append_format:
+            raise RuntimeError(
+                "quantized decode requires append_transform or native_append_format=True"
+            )
+        return cache
+
+    def commit_append_batch(
+        self,
+        cache: Any,
+        *,
+        previous_length: int,
+        artifacts: Sequence[DecodeCacheArtifact],
+    ) -> Any:
+        artifacts = tuple(artifacts)
+        if not artifacts:
+            raise ValueError("at least one cache artifact is required")
+        reference = artifacts[0]
+        if any(
+            (
+                artifact.layout_id,
+                artifact.key_format,
+                artifact.value_format,
+            )
+            != (
+                reference.layout_id,
+                reference.key_format,
+                reference.value_format,
+            )
+            for artifact in artifacts
+        ):
+            raise ValueError("append artifacts have incompatible contracts")
+        if self.append_validator is not None:
+            self.append_validator(
+                cache,
+                previous_length,
+                previous_length + 1,
+                reference,
+            )
+        if self.append_transform is not None:
+            raise RuntimeError(
+                "batched append_transform requires a role-aware implementation"
+            )
+        baseline = all(
+            layer.key.format_id == "BF16" and layer.value.format_id == "BF16"
+            for layer in reference.layers
+        )
+        if not baseline and not self.native_append_format:
+            raise RuntimeError(
+                "quantized decode requires native_append_format=True"
+            )
+        return cache
+
+    def token_nll(self, logits: Any, target_token_id: int) -> float:
+        import torch
+
+        vocabulary = logits.shape[-1]
+        if not 0 <= target_token_id < vocabulary:
+            raise ValueError(
+                f"target token {target_token_id} is outside vocabulary {vocabulary}"
+            )
+        value = -torch.log_softmax(logits[0, 0].float(), dim=-1)[target_token_id]
+        return float(value.detach().to("cpu"))
+
+    def token_nll_batch(
+        self,
+        logits: Any,
+        target_token_ids: Sequence[int],
+    ) -> tuple[float, ...]:
+        import torch
+
+        targets = torch.tensor(
+            tuple(int(token) for token in target_token_ids),
+            dtype=torch.long,
+            device=logits.device,
+        )
+        if targets.shape != (logits.shape[0],):
+            raise ValueError("target batch size differs from logits")
+        vocabulary = logits.shape[-1]
+        if torch.any((targets < 0) | (targets >= vocabulary)):
+            raise ValueError("a target token is outside the vocabulary")
+        values = -torch.log_softmax(logits[:, 0].float(), dim=-1).gather(
+            -1,
+            targets[:, None],
+        )[:, 0]
+        return tuple(
+            float(value)
+            for value in values.detach().to("cpu").tolist()
+        )
diff --git a/decode_dse/software/decode_evaluator.py b/decode_dse/software/decode_evaluator.py
new file mode 100644
index 0000000..534b24f
--- /dev/null
+++ b/decode_dse/software/decode_evaluator.py
@@ -0,0 +1,3339 @@
+"""Evaluate one decode precision profile with a cached one-token loop."""
+
+from __future__ import annotations
+
+import fcntl
+import gc
+import hashlib
+import importlib.util
+import json
+import math
+import os
+import re
+import shutil
+import sys
+import tempfile
+import time
+from collections import OrderedDict
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Iterator, Mapping, Sequence
+
+from decode_dse.legality import (
+    constrain_stack_validity,
+    merge_stack_validity,
+)
+from decode_dse.legality import StackValidity
+from decode_dse.manifest import SweepManifestEntry
+from decode_dse.profiles import (
+    DECODE_FORMATS,
+    PROFILE_KIND_BF16_REFERENCE,
+    DecodePrecisionProfile,
+    format_descriptor,
+)
+from decode_dse.software.cached_decode import (
+    ContinuationExample,
+    TorchHFCachedDecodeBackend,
+    _legacy_cache_layers,
+    evaluate_teacher_forced_cached_batched,
+)
+from decode_dse.software.sweep_runner import EvaluationOutcome
+from decode_dse.software.sweep_plan import (
+    ExecutorContext,
+    _mase_tree_hash,
+    _software_tree_hash,
+    profile_to_decode_quant_spec,
+)
+from decode_dse.software.token_samples import (
+    DecodeTokenSample,
+    load_sample_bundle,
+)
+from decode_dse.software.runtime_environment import (
+    RuntimeEnvironment,
+    capture_runtime_environment,
+    estimate_artifact_footprint,
+    initialize_numerical_runtime,
+    require_runtime_environment,
+    seal_runtime_environment,
+)
+from decode_dse.software.cache_artifacts import (
+    ArtifactProvenance,
+    BF16CacheConverter,
+    DecodeCacheArtifact,
+    FunctionalCacheConverter,
+    QuantizedTensorPayload,
+    TensorPayload,
+    admit_prefill_cache,
+    admit_prefill_cache_split,
+    load_decode_cache_artifact,
+    load_prefill_artifact,
+    save_decode_cache_artifact,
+)
+from decode_dse.legality import (
+    load_built_stack_validity,
+)
+from decode_dse.software.sweep_plan import (
+    load_immutable_json,
+    resolve_bound_path,
+    write_immutable_json,
+)
+
+PACKED_CACHE_LAYOUT = "packed-gqa-mlen1024-block8-native-encoding"
+_PACKED_CACHE_LAYOUT_RE = re.compile(
+    r"^packed-gqa-mlen(?P<row_elements>[0-9]+)-block8-native-encoding$"
+)
+ADMISSION_CONVERTER_SCHEMA = "packedkv-admission"
+ADMISSION_INDEX_SCHEMA = "decode-admission-index"
+ADMISSION_PREPARATION_SCHEMA = "decode-admission-preparation"
+ADMISSION_NUMERICAL_VALIDATION_SCHEMA = "decode-admission-numerical-validation"
+E8M0_SCALE_BIAS = 127
+
+
+def _repository_root() -> Path:
+    return Path(__file__).resolve().parents[2]
+
+
+def _resolve_path(
+    value: str | os.PathLike[str],
+    *,
+    workspace_root: str | os.PathLike[str] | None = None,
+) -> Path:
+    return resolve_bound_path(
+        value,
+        repository_root=_repository_root(),
+        workspace_root=workspace_root,
+    )
+
+
+def _document_token(document_id: str) -> str:
+    return hashlib.sha256(document_id.encode("utf-8")).hexdigest()
+
+
+def _prefill_path(root: Path, document_id: str) -> Path:
+    return root / _document_token(document_id)
+
+
+def _decode_cache_path(
+    root: Path,
+    key_format: str,
+    document_id: str,
+    value_format: str | None = None,
+    contract_id: str | None = None,
+) -> Path:
+    value = key_format if value_format is None else value_format
+    precision_path = key_format if key_format == value else f"K-{key_format}__V-{value}"
+    namespace = root if contract_id is None else root / contract_id
+    return namespace / precision_path / _document_token(document_id)
+
+
+def _kv_precision_id(key_format: str, value_format: str) -> str:
+    return (
+        key_format if key_format == value_format else f"K={key_format};V={value_format}"
+    )
+
+
+def _artifact_bytes(artifact: DecodeCacheArtifact) -> int:
+    return sum(
+        len(tensor.element_plane)
+        + len(tensor.scale_plane)
+        + len(tensor.numerical_view.data)
+        for layer in artifact.layers
+        for tensor in (layer.key, layer.value)
+    )
+
+
+def _directory_bytes(path: Path) -> int:
+    return sum(value.stat().st_size for value in path.rglob("*") if value.is_file())
+
+
+def _mapping_sha256(value: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _available_host_bytes() -> int:
+    value = Path("/proc/meminfo")
+    if not value.is_file():
+        raise RuntimeError("host-memory availability cannot be measured")
+    for line in value.read_text(encoding="utf-8").splitlines():
+        name, separator, payload = line.partition(":")
+        if name == "MemAvailable" and separator:
+            amount, unit = payload.strip().split()
+            if unit != "kB":
+                break
+            return int(amount) * 1024
+    raise RuntimeError("MemAvailable is missing from /proc/meminfo")
+
+
+def _packed_tensor_disk_components(
+    element_count: int,
+    format_id: str,
+) -> dict[str, int]:
+    """Return exact persisted planes for one logical cache tensor set."""
+
+    if element_count <= 0:
+        raise ValueError("element_count must be positive")
+    descriptor = format_descriptor(format_id)
+    if descriptor.family == "bf16":
+        element_bytes = 2 * element_count
+        scale_bytes = 0
+    else:
+        if element_count % 8:
+            raise ValueError("native PackedKV tensors must be block-8 divisible")
+        element_bytes = math.ceil(element_count * descriptor.element_bits / 8)
+        scale_bytes = element_count // 8
+    return {
+        "element_plane_bytes": element_bytes,
+        "scale_plane_bytes": scale_bytes,
+        "numerical_view_bytes": 2 * element_count,
+    }
+
+
+def _packed_tensor_disk_bytes(element_count: int, format_id: str) -> int:
+    """Return persisted element, scale, and BF16 numerical-view bytes."""
+
+    return sum(_packed_tensor_disk_components(element_count, format_id).values())
+
+
+def _validate_admission_resource_projection(
+    value: Any,
+) -> dict[str, int | float | str]:
+    if not isinstance(value, Mapping):
+        raise TypeError("admission resource projection must be an object")
+    if value.get("persistence_contract") != "packed_planes_plus_bf16_numerical_view":
+        raise ValueError("admission persistence contract differs")
+    integer_fields = (
+        "artifact_space_reserve_bytes",
+        "projected_element_plane_bytes",
+        "projected_scale_plane_bytes",
+        "projected_numerical_view_bytes",
+        "projected_metadata_reserve_bytes",
+        "projected_cold_artifact_bytes",
+        "required_cold_capacity_bytes",
+        "observed_cold_available_bytes",
+        "projected_peak_host_bytes",
+        "required_host_bytes",
+        "observed_host_available_bytes",
+    )
+    integers: dict[str, int] = {}
+    for name in integer_fields:
+        field = value.get(name)
+        if isinstance(field, bool) or not isinstance(field, int) or field < 0:
+            raise ValueError(f"admission resource {name} is invalid")
+        integers[name] = field
+    safety_factor = value.get("artifact_space_safety_factor")
+    if (
+        isinstance(safety_factor, bool)
+        or not isinstance(safety_factor, (int, float))
+        or not math.isfinite(float(safety_factor))
+        or float(safety_factor) < 1.0
+    ):
+        raise ValueError("admission resource safety factor is invalid")
+    projected = sum(
+        integers[name]
+        for name in (
+            "projected_element_plane_bytes",
+            "projected_scale_plane_bytes",
+            "projected_numerical_view_bytes",
+            "projected_metadata_reserve_bytes",
+        )
+    )
+    minimum_capacity = (
+        math.ceil(projected * float(safety_factor))
+        + integers["artifact_space_reserve_bytes"]
+    )
+    if (
+        projected <= 0
+        or integers["projected_numerical_view_bytes"] <= 0
+        or integers["projected_cold_artifact_bytes"] != projected
+        or integers["required_cold_capacity_bytes"] < minimum_capacity
+        or integers["observed_cold_available_bytes"]
+        < integers["required_cold_capacity_bytes"]
+        or integers["required_host_bytes"] < integers["projected_peak_host_bytes"]
+        or integers["observed_host_available_bytes"] < integers["required_host_bytes"]
+    ):
+        raise ValueError("admission resource projection is inconsistent")
+    return {
+        "persistence_contract": str(value["persistence_contract"]),
+        "artifact_space_safety_factor": float(safety_factor),
+        **integers,
+    }
+
+
+def _pack_tensor_codes(codes: Any, width: int) -> bytes:
+    """Pack unsigned fixed-width codes in flattened LSB-first order."""
+
+    import torch
+
+    if width <= 0 or width > 8:
+        raise ValueError("element width must be in [1, 8]")
+    values = codes.detach().to(device="cpu", dtype=torch.int64).reshape(-1)
+    if values.numel() == 0:
+        return b""
+    mask = (1 << width) - 1
+    if torch.any((values < 0) | (values > mask)):
+        raise ValueError("element code is outside its declared width")
+    positions = torch.arange(values.numel(), dtype=torch.int64) * width
+    byte_indices = torch.div(positions, 8, rounding_mode="floor")
+    shifts = positions.remainder(8)
+    byte_count = math.ceil(values.numel() * width / 8)
+    packed = torch.zeros(byte_count, dtype=torch.int64)
+    packed.scatter_add_(
+        0,
+        byte_indices,
+        (values << shifts).bitwise_and(0xFF),
+    )
+    spills = shifts + width > 8
+    if torch.any(spills):
+        packed.scatter_add_(
+            0,
+            byte_indices[spills] + 1,
+            values[spills] >> (8 - shifts[spills]),
+        )
+    return packed.to(torch.uint8).numpy().tobytes(order="C")
+
+
+def _uint8_bytes(values: Any) -> bytes:
+    import torch
+
+    return (
+        values.detach()
+        .to(device="cpu", dtype=torch.int64)
+        .bitwise_and(0xFF)
+        .to(torch.uint8)
+        .reshape(-1)
+        .numpy()
+        .tobytes(order="C")
+    )
+
+
+class MaseMXCacheConverter:
+    """Create physical MX planes and the exact MASE numerical cache view."""
+
+    def __init__(self, format_id: str, block_size: int = 8) -> None:
+        descriptor = format_descriptor(format_id)
+        if descriptor.family not in {"mxint", "mxfp"}:
+            raise ValueError(f"{format_id!r} is not an MX cache format")
+        self.format_id = descriptor.token
+        self.descriptor = descriptor
+        self.block_size = int(block_size)
+        if self.block_size != 8:
+            raise ValueError("the exhaustive sweep requires block size 8")
+
+    def convert(
+        self,
+        tensor: TensorPayload,
+        role: str,
+        layer_index: int,
+        precision_id: str,
+        layout_id: str,
+    ) -> QuantizedTensorPayload:
+        del role, layer_index, precision_id
+        layout = _PACKED_CACHE_LAYOUT_RE.fullmatch(layout_id)
+        if layout is None:
+            raise ValueError(f"unsupported numerical cache layout {layout_id!r}")
+        import torch
+
+        source = tensor.to_torch("cpu").contiguous()
+        if source.dtype != torch.bfloat16:
+            raise TypeError("decode admission requires a BF16 source tensor")
+        row_elements = int(layout.group("row_elements"))
+        if source.shape[1] * source.shape[3] != row_elements:
+            raise ValueError("packed KV row width differs from the declared layout")
+        if source.shape[-1] % self.block_size:
+            raise ValueError("cache head dimension is not block divisible")
+        physical = source.permute(0, 2, 1, 3).contiguous()
+        blocks = physical.reshape(-1, self.block_size)
+
+        if self.descriptor.family == "mxint":
+            from chop.nn.quantizers.mxint.fake import (
+                compose_mxint_tensor,
+                extract_mxint_components,
+                mxint_sign_magnitude_codes,
+            )
+            from chop.nn.quantizers.mxint.meta import MXIntMeta
+
+            meta = MXIntMeta(
+                block_size=self.block_size,
+                scale_bits=8,
+                element_bits=self.descriptor.element_bits,
+            )
+            scales, elements = extract_mxint_components(blocks, meta)
+            numerical = compose_mxint_tensor(scales, elements, meta).reshape(
+                physical.shape
+            )
+            element_codes = mxint_sign_magnitude_codes(
+                elements,
+                self.descriptor.element_bits,
+            )
+            element_plane = _pack_tensor_codes(
+                element_codes,
+                self.descriptor.element_bits,
+            )
+            scale_plane = _uint8_bytes(scales)
+            element_encoding = "MXINT_SIGN_MAGNITUDE_LSB"
+        else:
+            from chop.nn.quantizers._minifloat_mx import (
+                extract_minifloat_component,
+            )
+            from chop.nn.quantizers.mxfp.fake import (
+                compose_mxfp_tensor,
+                extract_mxfp_components,
+            )
+            from chop.nn.quantizers.mxfp.meta import MXFPMeta
+
+            meta = MXFPMeta(
+                block_size=self.block_size,
+                scale_exp_bits=8,
+                element_exp_bits=int(self.descriptor.exponent_bits),
+                element_frac_bits=int(self.descriptor.mantissa_bits),
+                element_is_finite=self.descriptor.exponent_bits == 1,
+                round_mode="rn",
+            )
+            scales, elements = extract_mxfp_components(blocks, meta)
+            numerical = compose_mxfp_tensor(
+                scales,
+                elements,
+                meta,
+                output_dtype=torch.float32,
+            ).reshape(physical.shape)
+            element_codes = extract_minifloat_component(
+                elements,
+                meta.element_meta,
+            )
+            element_plane = _pack_tensor_codes(
+                element_codes,
+                self.descriptor.element_bits,
+            )
+            biased_scales = scales.to(torch.int64) + E8M0_SCALE_BIAS
+            if torch.any((biased_scales < 0) | (biased_scales > 0xFF)):
+                raise ValueError("MXFP shared exponent is outside E8M0 range")
+            scale_plane = _uint8_bytes(biased_scales)
+            element_encoding = "MXFP_IEEE_LSB"
+
+        numerical_payload = TensorPayload.from_torch(
+            numerical.permute(0, 2, 1, 3).contiguous().to(torch.bfloat16),
+            dtype="bfloat16",
+        )
+        return QuantizedTensorPayload(
+            format_id=self.format_id,
+            block_size=self.block_size,
+            element_bits=self.descriptor.element_bits,
+            logical_shape=tensor.shape,
+            element_plane=element_plane,
+            scale_plane=scale_plane,
+            numerical_view=numerical_payload,
+            element_encoding=element_encoding,
+            scale_encoding="E8M0_BIAS127_U8",
+        )
+
+
+@dataclass(frozen=True)
+class AdmissionCacheHandle:
+    kv_format: str
+    paths: Mapping[str, Path]
+    value_format: str | None = None
+
+    @property
+    def key_format(self) -> str:
+        return self.kv_format
+
+    @property
+    def resolved_value_format(self) -> str:
+        return self.kv_format if self.value_format is None else self.value_format
+
+    @property
+    def split_kv(self) -> bool:
+        return self.key_format != self.resolved_value_format
+
+
+@dataclass(frozen=True)
+class DecodeWeightBank:
+    model: Any
+    device: Any
+    weight_format: str
+    binding_plan: "DecodeBindingPlan"
+    identity_guard: "DecodeWeightBankIdentity"
+    quantization_guard: "DecodeWeightQuantizationGuard"
+    build_seconds: float
+    weight_method: str = "rtn"
+
+
+@dataclass(frozen=True)
+class DecodeBindingTarget:
+    pattern_index: int
+    name: str
+    module: Any
+
+
+@dataclass(frozen=True)
+class DecodeBindingPlan:
+    """Cache the modules selected by each quantization regex."""
+
+    patterns: tuple[str, ...]
+    targets: tuple[DecodeBindingTarget, ...]
+
+    def resolve(
+        self,
+        pass_args: Mapping[str, Any],
+    ) -> tuple[tuple[DecodeBindingTarget, Mapping[str, Any]], ...]:
+        configs = _binding_configs(pass_args)
+        actual_patterns = tuple(pattern for pattern, _ in configs)
+        if actual_patterns != self.patterns:
+            raise RuntimeError("decode binding patterns changed within a weight bank")
+        return tuple(
+            (target, configs[target.pattern_index][1]) for target in self.targets
+        )
+
+
+@dataclass(frozen=True)
+class WeightQuantizationIdentity:
+    name: str
+    module: Any
+    object_id: int
+    events: int
+
+
+@dataclass(frozen=True)
+class DecodeWeightQuantizationGuard:
+    """Seal decode linears and detect any later weight-bank reconstruction."""
+
+    modules: tuple[WeightQuantizationIdentity, ...]
+
+    @classmethod
+    def capture(
+        cls,
+        binding_plan: DecodeBindingPlan,
+        *,
+        expected_modules: int,
+    ) -> "DecodeWeightQuantizationGuard":
+        records = []
+        seen: set[int] = set()
+        for target in binding_plan.targets:
+            module = target.module
+            seal = getattr(module, "seal_decode_weight_bank", None)
+            if not callable(seal):
+                continue
+            if id(module) in seen:
+                raise RuntimeError("decode binding plan repeats a weight module")
+            seen.add(id(module))
+            records.append(
+                WeightQuantizationIdentity(
+                    name=target.name,
+                    module=module,
+                    object_id=id(module),
+                    events=int(seal()),
+                )
+            )
+        if len(records) != expected_modules:
+            raise RuntimeError(
+                "decode weight-bank seal coverage mismatch: "
+                f"{len(records)} != {expected_modules}"
+            )
+        return cls(modules=tuple(records))
+
+    def verify(self) -> int:
+        total = 0
+        for record in self.modules:
+            module = record.module
+            if id(module) != record.object_id:
+                raise RuntimeError(f"decode weight module was replaced: {record.name}")
+            if not bool(getattr(module, "_decode_bank_sealed", False)):
+                raise RuntimeError(f"decode weight bank was unsealed: {record.name}")
+            events = int(getattr(module, "_weight_quantization_events", -1))
+            if events != record.events:
+                raise RuntimeError(f"decode weight bank was requantized: {record.name}")
+            total += events
+        return total
+
+
+@dataclass(frozen=True)
+class WeightParameterIdentity:
+    name: str
+    object_id: int
+    data_pointer: int | None
+    version: int | None
+    shape: tuple[int, ...]
+    dtype: str
+    device: str
+    requires_grad: bool
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "object_id": self.object_id,
+            "data_pointer": self.data_pointer,
+            "version": self.version,
+            "shape": list(self.shape),
+            "dtype": self.dtype,
+            "device": self.device,
+            "requires_grad": self.requires_grad,
+        }
+
+
+@dataclass(frozen=True)
+class DecodeWeightBankIdentity:
+    """Detect parameter replacement, relocation, or in-place modification."""
+
+    parameters: tuple[WeightParameterIdentity, ...]
+    fingerprint: str
+    structure_fingerprint: str
+
+    @classmethod
+    def capture(cls, model: Any) -> "DecodeWeightBankIdentity":
+        parameters = tuple(
+            _parameter_identity(name, parameter)
+            for name, parameter in model.named_parameters()
+        )
+        if not parameters:
+            raise RuntimeError("decode weight bank contains no parameters")
+        names = tuple(parameter.name for parameter in parameters)
+        if len(names) != len(set(names)):
+            raise RuntimeError("decode weight bank contains duplicate parameter names")
+        return cls(
+            parameters=parameters,
+            fingerprint=_identity_fingerprint(parameters, structural=False),
+            structure_fingerprint=_identity_fingerprint(
+                parameters,
+                structural=True,
+            ),
+        )
+
+    def verify(self, model: Any) -> str:
+        current = tuple(
+            _parameter_identity(name, parameter)
+            for name, parameter in model.named_parameters()
+        )
+        fingerprint = _identity_fingerprint(current, structural=False)
+        if current != self.parameters or fingerprint != self.fingerprint:
+            mismatch = next(
+                (
+                    expected.name
+                    for expected, actual in zip(self.parameters, current)
+                    if expected != actual
+                ),
+                (
+                    "<parameter-count>"
+                    if len(current) != len(self.parameters)
+                    else "<fingerprint>"
+                ),
+            )
+            raise RuntimeError(
+                f"decode weight bank changed during runtime rebinding: {mismatch}"
+            )
+        return fingerprint
+
+
+@dataclass(frozen=True)
+class BindingMeasurement:
+    performed: bool
+    seconds: float
+    target_count: int
+    used_cached_targets: bool
+    weight_requantizations: int
+    sealed_weight_modules: int
+    weight_quantization_events_before: int
+    weight_quantization_events_after: int
+    identity_before: str
+    identity_after: str
+    structure_fingerprint: str
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "performed": self.performed,
+            "seconds": self.seconds,
+            "target_count": self.target_count,
+            "used_cached_targets": self.used_cached_targets,
+            "weight_requantizations": self.weight_requantizations,
+            "sealed_weight_modules": self.sealed_weight_modules,
+            "weight_quantization_events_before": (
+                self.weight_quantization_events_before
+            ),
+            "weight_quantization_events_after": (self.weight_quantization_events_after),
+            "weight_identity_before": self.identity_before,
+            "weight_identity_after": self.identity_after,
+            "weight_structure_fingerprint": self.structure_fingerprint,
+        }
+
+
+def _parameter_identity(name: str, parameter: Any) -> WeightParameterIdentity:
+    pointer: int | None
+    data_ptr = getattr(parameter, "data_ptr", None)
+    try:
+        pointer = int(data_ptr()) if callable(data_ptr) else None
+    except (RuntimeError, TypeError, ValueError):
+        pointer = None
+    version_value = getattr(parameter, "_version", None)
+    version = int(version_value) if version_value is not None else None
+    return WeightParameterIdentity(
+        name=str(name),
+        object_id=id(parameter),
+        data_pointer=pointer,
+        version=version,
+        shape=tuple(int(value) for value in parameter.shape),
+        dtype=str(parameter.dtype),
+        device=str(parameter.device),
+        requires_grad=bool(parameter.requires_grad),
+    )
+
+
+def _identity_fingerprint(
+    parameters: Sequence[WeightParameterIdentity],
+    *,
+    structural: bool,
+) -> str:
+    if structural:
+        payload = [
+            {
+                "name": parameter.name,
+                "shape": list(parameter.shape),
+                "dtype": parameter.dtype,
+                "requires_grad": parameter.requires_grad,
+            }
+            for parameter in parameters
+        ]
+    else:
+        payload = [parameter.to_dict() for parameter in parameters]
+    encoded = json.dumps(
+        payload,
+        sort_keys=True,
+        separators=(",", ":"),
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def _binding_configs(
+    pass_args: Mapping[str, Any],
+) -> tuple[tuple[str, Mapping[str, Any]], ...]:
+    configs: list[tuple[str, Mapping[str, Any]]] = []
+    for pattern, payload in pass_args.items():
+        if pattern in {
+            "by",
+            "gptq",
+            "rotation_search",
+            "collapse_decode_banks",
+        }:
+            continue
+        if not isinstance(payload, Mapping) or not isinstance(
+            payload.get("config"), Mapping
+        ):
+            raise TypeError(f"invalid decode binding payload for {pattern!r}")
+        configs.append((str(pattern), payload["config"]))
+    if not configs:
+        raise RuntimeError("decode profile contains no runtime bindings")
+    return tuple(configs)
+
+
+def build_decode_binding_plan(
+    model: Any,
+    pass_args: Mapping[str, Any],
+) -> DecodeBindingPlan:
+    """Resolve quantization regexes once for a reusable weight bank."""
+
+    configs = _binding_configs(pass_args)
+    compiled = tuple(re.compile(pattern) for pattern, _ in configs)
+    matched = [0] * len(compiled)
+    targets: list[DecodeBindingTarget] = []
+    for name, module in model.named_modules():
+        pattern_index = next(
+            (
+                index
+                for index, pattern in enumerate(compiled)
+                if pattern.fullmatch(name)
+            ),
+            None,
+        )
+        if pattern_index is None:
+            continue
+        matched[pattern_index] += 1
+        targets.append(
+            DecodeBindingTarget(
+                pattern_index=pattern_index,
+                name=str(name),
+                module=module,
+            )
+        )
+    missing = tuple(
+        configs[index][0] for index, count in enumerate(matched) if count == 0
+    )
+    if missing:
+        raise RuntimeError(f"decode profile patterns matched no modules: {missing}")
+    return DecodeBindingPlan(
+        patterns=tuple(pattern for pattern, _ in configs),
+        targets=tuple(targets),
+    )
+
+
+def _validate_bank_structure(
+    model: Any,
+    binding_plan: DecodeBindingPlan,
+    collapsed_linears: int,
+    model_architecture: Mapping[str, Any],
+) -> None:
+    layers = int(model_architecture["num_hidden_layers"])
+    qk_norm = bool(model_architecture.get("use_qk_norm", False))
+    rmsnorms = layers * (4 if qk_norm else 2) + 1
+    expected_pattern_counts = (
+        layers,
+        4 * layers,
+        3 * layers,
+        layers,
+        layers,
+        rmsnorms,
+    )
+    pattern_counts = tuple(
+        sum(target.pattern_index == index for target in binding_plan.targets)
+        for index in range(len(binding_plan.patterns))
+    )
+    if pattern_counts != expected_pattern_counts:
+        raise RuntimeError(
+            "decode binding coverage mismatch: "
+            f"{pattern_counts} != {expected_pattern_counts}"
+        )
+    expected_bindings = sum(expected_pattern_counts)
+    expected_linears = 7 * layers
+    if len(binding_plan.targets) != expected_bindings:
+        raise RuntimeError(
+            f"model requires exactly {expected_bindings} runtime bindings"
+        )
+    if collapsed_linears != expected_linears:
+        raise RuntimeError(
+            f"model requires exactly {expected_linears} collapsed linears"
+        )
+    layer_indices = {
+        int(match.group(1))
+        for target in binding_plan.targets
+        if (match := re.fullmatch(r"model\.layers\.(\d+)", target.name))
+    }
+    if layer_indices != set(range(layers)):
+        raise RuntimeError("decoder-layer coverage is incomplete")
+    for name in ("model.embed_tokens", "lm_head"):
+        module = model.get_submodule(name)
+        weight = getattr(module, "weight", None)
+        if weight is None or str(weight.dtype) != "torch.bfloat16":
+            raise RuntimeError(f"{name} must remain a BF16 weight module")
+        if hasattr(module, "phase_q_config"):
+            raise RuntimeError(f"{name} must remain outside decode quantization")
+
+
+class _DecodeCacheLRU:
+    def __init__(self, capacity_bytes: int) -> None:
+        if capacity_bytes <= 0:
+            raise ValueError("decode-cache LRU capacity must be positive")
+        self.capacity_bytes = capacity_bytes
+        self.total_bytes = 0
+        self.values: OrderedDict[Path, tuple[DecodeCacheArtifact, int]] = OrderedDict()
+
+    def get(self, path: Path) -> DecodeCacheArtifact:
+        cached = self.values.pop(path, None)
+        if cached is not None:
+            self.values[path] = cached
+            return cached[0]
+        artifact = load_decode_cache_artifact(path)
+        size = _artifact_bytes(artifact)
+        while self.values and self.total_bytes + size > self.capacity_bytes:
+            _, (_, removed) = self.values.popitem(last=False)
+            self.total_bytes -= removed
+        if size <= self.capacity_bytes:
+            self.values[path] = (artifact, size)
+            self.total_bytes += size
+        return artifact
+
+    def clear(self) -> None:
+        self.values.clear()
+        self.total_bytes = 0
+
+
+def _load_stack_validity(
+    path: Path,
+    context: ExecutorContext,
+) -> dict[str, StackValidity]:
+    required_stages = (
+        ("compiler", "emulator") if context.sample_contract.compiler_required else ()
+    )
+    result = load_built_stack_validity(
+        path,
+        manifest=context.master_manifest,
+        scope_profile_ids=context.run_plan.hardware_validation_profile_ids,
+        required_stages=required_stages,
+        scope_name="hardware-validation",
+        run_plan_hash=context.run_plan.canonical_hash,
+    )
+    required = {entry.profile_id for entry in context.stage_manifest.entries}
+    if context.sample_contract.compiler_required:
+        missing = sorted(required - set(result))
+        if missing:
+            raise ValueError(
+                f"stack-validity manifest misses {len(missing)} stage profiles"
+            )
+        unchecked = sorted(
+            profile_id
+            for profile_id in required
+            if result[profile_id].compiler_valid is None
+            or result[profile_id].emulator_valid is None
+        )
+        if unchecked:
+            raise ValueError(
+                f"compiler/emulator checks are missing for {len(unchecked)} profiles"
+            )
+    return result
+
+
+class DecodeEvaluator:
+    """Evaluate fixed split-prefill artifacts with one reusable bank per W."""
+
+    def _initialize_model_contract(self) -> None:
+        architecture = self.config.get("model_architecture")
+        if not isinstance(architecture, Mapping):
+            raise ValueError("config.model_architecture is required")
+        required = {
+            "hidden_size",
+            "num_hidden_layers",
+            "num_attention_heads",
+            "num_key_value_heads",
+            "head_dim",
+            "use_qk_norm",
+        }
+        missing = sorted(required - set(architecture))
+        if missing:
+            raise ValueError("model architecture is incomplete: " + ", ".join(missing))
+        self.model_architecture = dict(architecture)
+        self.cache_row_elements = int(architecture["num_key_value_heads"]) * int(
+            architecture["head_dim"]
+        )
+        layout = _PACKED_CACHE_LAYOUT_RE.fullmatch(
+            str(self.executor_config.get("layout_id", ""))
+        )
+        if layout is None:
+            raise ValueError("executor.layout_id is not a native PackedKV layout")
+        if int(layout.group("row_elements")) != self.cache_row_elements:
+            raise ValueError(
+                "executor.layout_id row width differs from model_architecture"
+            )
+        model_name = str(self.config.get("model_name", "")).lower()
+        if "qwen3" in model_name:
+            self.model_family = "qwen3"
+        elif "llama" in model_name:
+            self.model_family = "llama"
+        else:
+            raise ValueError(
+                "the decode executor supports dense Qwen3 and Llama models"
+            )
+
+        placement = self.config.get("model_placement")
+        if not isinstance(placement, Mapping):
+            raise ValueError("config.model_placement is required")
+        if (
+            placement.get("policy") != "single_device"
+            or int(placement.get("device_count", 0)) != 1
+            or placement.get("automatic_device_map") is not False
+        ):
+            raise ValueError(
+                "the executor requires explicit single-device placement with "
+                "automatic_device_map disabled"
+            )
+        self.model_placement = dict(placement)
+
+    def _initialize_admission_resources(
+        self,
+        *,
+        workspace_root: str | os.PathLike[str],
+    ) -> None:
+        executor_config = self.executor_config
+        self.device = str(self.config.get("device", "cuda:0"))
+        self.runtime_seed = int(self.config.get("seed", 0))
+        initialize_numerical_runtime(self.runtime_seed)
+        self.runtime_environment = capture_runtime_environment(
+            self.device,
+            seed=self.runtime_seed,
+        )
+        self.sample_bundle_path = _resolve_path(
+            str(executor_config["sample_bundle"]),
+            workspace_root=workspace_root,
+        )
+        self.prefill_root = _resolve_path(
+            str(executor_config["prefill_artifact_root"]),
+            workspace_root=workspace_root,
+        )
+        self.admission_root = _resolve_path(
+            str(executor_config["admission_artifact_root"]),
+            workspace_root=workspace_root,
+        )
+        self.layout_id = str(executor_config.get("layout_id", PACKED_CACHE_LAYOUT))
+        if _PACKED_CACHE_LAYOUT_RE.fullmatch(self.layout_id) is None:
+            raise ValueError(f"unsupported layout_id {self.layout_id!r}")
+        self._configure_mase_path()
+        repository = _repository_root()
+        admission_identity = {
+            "schema_version": ADMISSION_CONVERTER_SCHEMA,
+            "software_tree_sha256": _software_tree_hash(repository),
+            "mase_tree_sha256": _mase_tree_hash(repository, self.config),
+            "runtime_environment_fingerprint": (
+                self.runtime_environment.logical_fingerprint
+            ),
+            "layout_id": self.layout_id,
+            "block_size": 8,
+            "scale_format": "E8M0",
+            "scale_encoding": "bias127",
+            "mxint_element_encoding": "sign_magnitude_lsb",
+            "mxfp_element_encoding": "ieee_lsb",
+            "plane_order": "row_major_lsb_first",
+        }
+        self.admission_code_revision = hashlib.sha256(
+            json.dumps(
+                admission_identity,
+                sort_keys=True,
+                separators=(",", ":"),
+            ).encode("utf-8")
+        ).hexdigest()
+        self.admission_contract_id = (
+            f"{ADMISSION_CONVERTER_SCHEMA.rsplit('/', 1)[-1]}-"
+            f"{self.admission_code_revision[:16]}"
+        )
+        self.bundle = load_sample_bundle(self.sample_bundle_path)
+
+    def __init__(self, context: ExecutorContext) -> None:
+        self.context = context
+        self.config = context.config
+        executor_config = self.config.get("executor")
+        if not isinstance(executor_config, Mapping):
+            raise ValueError("config.executor is required")
+        self.executor_config = executor_config
+        self._initialize_model_contract()
+        self._initialize_admission_resources(
+            workspace_root=self.context.workspace_root,
+        )
+        self._validate_bundle()
+        self.samples = self.bundle.samples_for_prompt_set(
+            context.sample_contract.prompt_set
+        )
+        contract_stage = context.sample_contract.name
+        self.decode_microbatch_size = int(
+            context.run_plan.numerical_screen_microbatch_size
+            if contract_stage == "numerical-screen"
+            else context.run_plan.hardware_validation_microbatch_size
+        )
+        if self.decode_microbatch_size <= 0:
+            raise ValueError("decode_microbatch_size must be positive")
+        self.deep_append_validation = context.stage in {
+            "preflight",
+            "validation-pilot",
+        }
+        self._validate_prefill_index()
+        self._validate_workspace_runtime_environment()
+        self.admission_catalog = self._validate_admission_preparation()
+        self._validate_host_resources()
+        capacity_gib = float(executor_config.get("max_cpu_cache_gib", 24.0))
+        self.cache_lru = _DecodeCacheLRU(int(capacity_gib * (1 << 30)))
+        validity_path = executor_config.get("stack_validity_manifest")
+        resolved_validity = (
+            _resolve_path(
+                str(validity_path),
+                workspace_root=self.context.workspace_root,
+            )
+            if validity_path
+            else None
+        )
+        self.stack_validity = (
+            _load_stack_validity(resolved_validity, context)
+            if resolved_validity is not None and resolved_validity.is_file()
+            else {}
+        )
+        if context.sample_contract.compiler_required and not self.stack_validity:
+            raise ValueError(
+                "hardware validation requires a measured executor.stack_validity_manifest"
+            )
+
+    def _validate_host_resources(self) -> None:
+        projected_bytes = self._projected_new_admission_bytes()
+        if projected_bytes:
+            raise RuntimeError(
+                "sealed admission preparation is missing required artifacts"
+            )
+        safety_factor = float(
+            self.executor_config.get("artifact_space_safety_factor", 1.05)
+        )
+        reserve_gib = float(self.executor_config.get("artifact_space_reserve_gib", 8.0))
+        if not math.isfinite(safety_factor) or safety_factor < 1.0:
+            raise ValueError("artifact_space_safety_factor must be at least one")
+        if not math.isfinite(reserve_gib) or reserve_gib < 0:
+            raise ValueError("artifact_space_reserve_gib must be non-negative")
+        if (
+            self.executor_config.get("artifact_policy")
+            == "content_addressed_recompute_per_format"
+        ):
+            footprint = estimate_artifact_footprint(
+                self.config,
+                self.model_architecture,
+            )
+            required_artifact_bytes = footprint.required_workspace_bytes
+        else:
+            required_artifact_bytes = int(reserve_gib * (1 << 30))
+        artifact_gib = required_artifact_bytes / float(1 << 30)
+        probe = self.admission_root
+        while not probe.exists() and probe != probe.parent:
+            probe = probe.parent
+        free_gib = shutil.disk_usage(probe).free / float(1 << 30)
+        if free_gib < artifact_gib:
+            raise RuntimeError(
+                f"artifact filesystem has {free_gib:.1f} GiB free; "
+                f"{artifact_gib:.1f} GiB is required"
+            )
+        self.resource_projection = {
+            "projected_new_admission_bytes": projected_bytes,
+            "safety_factor": safety_factor,
+            "reserve_bytes": int(reserve_gib * (1 << 30)),
+            "required_free_bytes": required_artifact_bytes,
+            "observed_free_bytes": int(free_gib * (1 << 30)),
+        }
+
+        host_gib = float(self.executor_config.get("min_available_host_gib", 0))
+        if not math.isfinite(host_gib) or host_gib < 0:
+            raise ValueError("min_available_host_gib must be finite and non-negative")
+        if host_gib == 0:
+            return
+        meminfo = Path("/proc/meminfo")
+        if not meminfo.is_file():
+            raise RuntimeError("host-memory availability cannot be measured")
+        fields = {}
+        for line in meminfo.read_text(encoding="utf-8").splitlines():
+            name, separator, value = line.partition(":")
+            if separator:
+                fields[name] = value.strip()
+        available = fields.get("MemAvailable", "")
+        if not available.endswith(" kB"):
+            raise RuntimeError("MemAvailable is missing from /proc/meminfo")
+        available_gib = int(available.removesuffix(" kB")) * 1024 / float(1 << 30)
+        if available_gib < host_gib:
+            raise RuntimeError(
+                f"host has {available_gib:.1f} GiB available; "
+                f"{host_gib:.1f} GiB is required"
+            )
+
+    def _projected_new_admission_bytes(self) -> int:
+        if (
+            self.executor_config.get("artifact_policy")
+            == "content_addressed_recompute_per_format"
+        ):
+            return 0
+        if not all(
+            hasattr(self, name)
+            for name in (
+                "context",
+                "samples",
+                "prefill_root",
+                "admission_root",
+                "admission_contract_id",
+            )
+        ):
+            return 0
+        formats = tuple(
+            sorted(
+                {
+                    entry.profile.kv_format
+                    for entry in self.context.stage_manifest.entries
+                }
+            )
+        )
+        projected = 0
+        for sample in self.samples:
+            manifest_path = (
+                _prefill_path(self.prefill_root, sample.document_id) / "manifest.json"
+            )
+            value = json.loads(manifest_path.read_text(encoding="utf-8"))
+            if value.get("schema") != "plena.prefill":
+                raise ValueError(f"invalid prefill manifest: {manifest_path}")
+            tensor_elements = 0
+            layers = value.get("layers")
+            if not isinstance(layers, list) or not layers:
+                raise ValueError(f"prefill manifest has no layers: {manifest_path}")
+            for layer in layers:
+                for role in ("key", "value"):
+                    tensor = layer.get(role)
+                    if not isinstance(tensor, Mapping):
+                        raise ValueError(
+                            f"prefill manifest lacks {role}: {manifest_path}"
+                        )
+                    if tensor.get("dtype") != "bfloat16":
+                        raise ValueError("prefill cache storage must be BF16")
+                    shape = tuple(int(size) for size in tensor.get("shape", ()))
+                    if (
+                        len(shape) != 4
+                        or shape[0] != 1
+                        or shape[1] * shape[3] != self.cache_row_elements
+                        or shape[-2] != 512
+                    ):
+                        raise ValueError(
+                            "prefill cache geometry differs from the model contract"
+                        )
+                    elements = math.prod(shape)
+                    if elements * 2 <= 0:
+                        raise ValueError("prefill tensor is empty")
+                    tensor_elements += elements
+            for format_id in formats:
+                path = _decode_cache_path(
+                    self.admission_root,
+                    format_id,
+                    sample.document_id,
+                    contract_id=self.admission_contract_id,
+                )
+                if path.exists():
+                    continue
+                projected += _packed_tensor_disk_bytes(
+                    tensor_elements,
+                    format_id,
+                )
+                projected += 1 << 20
+        return projected
+
+    def _configure_mase_path(self) -> None:
+        value = self.executor_config.get("mase_src")
+        if value is None:
+            raise ValueError("executor.mase_src is required")
+        resolved = _resolve_path(str(value))
+        if not resolved.is_dir():
+            raise ValueError(f"MASE source tree does not exist: {resolved}")
+        path = str(resolved)
+        if path not in sys.path:
+            sys.path.insert(0, path)
+        spec = importlib.util.find_spec("chop")
+        if spec is None or spec.origin is None:
+            raise RuntimeError("the configured MASE source does not provide chop")
+        origin = Path(spec.origin).resolve()
+        expected = (resolved / "chop").resolve()
+        if expected not in (origin, *origin.parents):
+            raise RuntimeError(
+                f"chop resolved outside configured MASE source: {origin}"
+            )
+        self.mase_source_root = resolved
+
+    def _validate_bundle(self) -> None:
+        if self.bundle.model_revision != str(self.config["model_revision"]):
+            raise ValueError("sample bundle model revision mismatch")
+        if self.bundle.tokenizer_revision != str(self.config["tokenizer_revision"]):
+            raise ValueError("sample bundle tokenizer revision mismatch")
+        if self.bundle.prompt_manifest() != self.context.prompts:
+            raise ValueError("sample bundle differs from the workspace prompts")
+        expected_count = self.context.sample_contract.prompt_count
+        samples = self.bundle.samples_for_prompt_set(
+            self.context.sample_contract.prompt_set
+        )
+        if len(samples) != expected_count:
+            raise ValueError("sample count differs from the stage contract")
+        steps = self.context.sample_contract.decode_steps
+        if any(len(sample.decode_target_ids) < steps for sample in samples):
+            raise ValueError("sample bundle lacks stage decode targets")
+
+    def _validate_prefill_index(self) -> None:
+        value = load_immutable_json(self.prefill_root / "index.json")
+        if value.get("schema_version") != "decode-prefill-index":
+            raise ValueError("unsupported prefill index schema")
+        if value.get("model_revision") != self.bundle.model_revision:
+            raise ValueError("prefill index model revision mismatch")
+        if value.get("tokenizer_revision") != self.bundle.tokenizer_revision:
+            raise ValueError("prefill index tokenizer revision mismatch")
+        if value.get("sample_bundle_hash") != self.bundle.canonical_hash:
+            raise ValueError("prefill index sample-bundle mismatch")
+        current_code_revision = _software_tree_hash(_repository_root())
+        if value.get("code_revision") != current_code_revision:
+            raise ValueError("prefill index source-tree mismatch")
+        recorded_runtime = RuntimeEnvironment.from_dict(
+            value.get("runtime_environment", {})
+        )
+        if (
+            recorded_runtime.logical_fingerprint
+            != self.runtime_environment.logical_fingerprint
+        ):
+            raise ValueError("prefill index runtime-environment mismatch")
+        records = {
+            str(record["document_id"]): record for record in value.get("records", ())
+        }
+        expected = {
+            sample.document_id
+            for sample in self.bundle.numerical_screen + self.bundle.hardware_validation
+        }
+        if set(records) != expected:
+            raise ValueError("prefill index document coverage mismatch")
+        for sample in self.samples:
+            path = _prefill_path(self.prefill_root, sample.document_id)
+            if not path.is_dir():
+                raise ValueError(f"missing prefill artifact for {sample.document_id}")
+            record = records[sample.document_id]
+            if record.get("prompt_hash") != sample.prompt_hash:
+                raise ValueError("prefill index prompt hash mismatch")
+            if (
+                record.get("relative_path")
+                != path.relative_to(self.prefill_root).as_posix()
+            ):
+                raise ValueError("prefill index path mismatch")
+            manifest = json.loads((path / "manifest.json").read_text(encoding="utf-8"))
+            if (
+                manifest.get("artifact_id") != record.get("artifact_id")
+                or manifest.get("prompt_hash") != sample.prompt_hash
+                or manifest.get("provenance", {}).get("code_revision")
+                != current_code_revision
+                or manifest.get("provenance", {})
+                .get("parameters", {})
+                .get("runtime_environment_fingerprint")
+                != self.runtime_environment.logical_fingerprint
+                or manifest.get("metadata", {}).get("preparation_device_uuid")
+                != record.get("preparation_device", {}).get("device_uuid")
+            ):
+                raise ValueError("prefill artifact identity differs from its index")
+
+    def seal_workspace_runtime_environment(
+        self,
+        workspace_root: str | Path,
+    ) -> Mapping[str, Any]:
+        """Bind admission and later shards to one numerical stack."""
+
+        return seal_runtime_environment(
+            Path(workspace_root).resolve() / "runtime_environment.json",
+            self.runtime_environment,
+        )
+
+    def _validate_workspace_runtime_environment(self) -> None:
+        require_runtime_environment(
+            self.context.workspace_root / "runtime_environment.json",
+            self.runtime_environment,
+        )
+
+    def _capture_current_runtime_environment(self) -> RuntimeEnvironment:
+        current = capture_runtime_environment(
+            self.device,
+            seed=self.runtime_seed,
+        )
+        if current.logical_fingerprint != self.runtime_environment.logical_fingerprint:
+            raise RuntimeError("numerical runtime changed during execution")
+        return current
+
+    @classmethod
+    def for_admission_preparation(
+        cls,
+        config: Mapping[str, Any],
+        *,
+        workspace_root: str | os.PathLike[str],
+    ) -> "DecodeEvaluator":
+        """Construct the artifact-only admission path without loading weights."""
+
+        self = cls.__new__(cls)
+        self.config = config
+        executor_config = config.get("executor")
+        if not isinstance(executor_config, Mapping):
+            raise ValueError("config.executor is required")
+        self.executor_config = executor_config
+        self._initialize_model_contract()
+        self._initialize_admission_resources(workspace_root=workspace_root)
+        if self.bundle.model_revision != str(config["model_revision"]):
+            raise ValueError("sample bundle model revision mismatch")
+        if self.bundle.tokenizer_revision != str(config["tokenizer_revision"]):
+            raise ValueError("sample bundle tokenizer revision mismatch")
+        self.samples = self.bundle.numerical_screen + self.bundle.hardware_validation
+        self._validate_prefill_index()
+        return self
+
+    @property
+    def admission_index_path(self) -> Path:
+        return self.admission_root / self.admission_contract_id / "index.json"
+
+    @staticmethod
+    def _admission_timing_path(path: Path) -> Path:
+        return path.parent / ".timings" / f"{path.name}.json"
+
+    def _admission_record_keys(self) -> set[tuple[str, str]]:
+        formats = DECODE_FORMATS + ("BF16",)
+        return {
+            (format_id, sample.document_id)
+            for format_id in formats
+            for sample in self.bundle.numerical_screen + self.bundle.hardware_validation
+        }
+
+    def _validate_admission_catalog(
+        self,
+        value: Mapping[str, Any],
+        *,
+        deep: bool,
+    ) -> tuple[
+        dict[tuple[str, str], Path],
+        tuple[dict[str, Any], ...],
+    ]:
+        if value.get("schema_version") != ADMISSION_INDEX_SCHEMA:
+            raise ValueError("unsupported admission index schema")
+        if value.get("admission_contract_id") != self.admission_contract_id:
+            raise ValueError("admission index contract mismatch")
+        if value.get("admission_code_revision") != self.admission_code_revision:
+            raise ValueError("admission index source-tree mismatch")
+        if (
+            value.get("runtime_environment_fingerprint")
+            != self.runtime_environment.logical_fingerprint
+        ):
+            raise ValueError("admission index runtime-environment mismatch")
+        if value.get("sample_bundle_hash") != self.bundle.canonical_hash:
+            raise ValueError("admission index sample-bundle mismatch")
+        if tuple(value.get("quantized_formats", ())) != DECODE_FORMATS:
+            raise ValueError("admission index quantized-format coverage mismatch")
+        if tuple(value.get("reference_formats", ())) != ("BF16",):
+            raise ValueError("admission index reference coverage mismatch")
+        records = tuple(value.get("records", ()))
+        expected_keys = self._admission_record_keys()
+        if len(records) != len(expected_keys):
+            raise ValueError("admission index record count mismatch")
+        paths: dict[tuple[str, str], Path] = {}
+        samples = {
+            sample.document_id: sample
+            for sample in self.bundle.numerical_screen + self.bundle.hardware_validation
+        }
+        ordered_records = sorted(
+            records,
+            key=lambda record: (
+                str(record["document_id"]),
+                str(record["format_id"]),
+            ),
+        )
+        deep_document_id: str | None = None
+        deep_prefill: Any | None = None
+        numerical_records: list[dict[str, Any]] = []
+        for record in ordered_records:
+            key = (str(record["format_id"]), str(record["document_id"]))
+            if key in paths or key not in expected_keys:
+                raise ValueError("admission index contains an invalid record key")
+            format_id, document_id = key
+            sample = samples[document_id]
+            expected_path = _decode_cache_path(
+                self.admission_root,
+                format_id,
+                document_id,
+                contract_id=self.admission_contract_id,
+            )
+            relative = expected_path.relative_to(self.admission_root).as_posix()
+            if (
+                record.get("relative_path") != relative
+                or record.get("prompt_hash") != sample.prompt_hash
+            ):
+                raise ValueError("admission index record binding mismatch")
+            manifest_path = expected_path / "manifest.json"
+            if not manifest_path.is_file():
+                raise FileNotFoundError(
+                    f"missing admitted cache manifest: {manifest_path}"
+                )
+            manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+            expected_precision = _kv_precision_id(format_id, format_id)
+            if (
+                manifest.get("schema") != "plena.decode_cache"
+                or manifest.get("artifact_id") != record.get("artifact_id")
+                or manifest.get("source_artifact_id")
+                != record.get("source_artifact_id")
+                or manifest.get("precision_id") != expected_precision
+                or manifest.get("layout_id") != self.layout_id
+            ):
+                raise ValueError("admitted cache manifest differs from its index")
+            if int(record.get("persisted_bytes", -1)) != _directory_bytes(
+                expected_path
+            ):
+                raise ValueError("admitted cache persisted-byte count mismatch")
+            timing_path = self._admission_timing_path(expected_path)
+            timing = load_immutable_json(timing_path)
+            if (
+                timing.get("schema_version") != "decode-admission-timing"
+                or timing.get("artifact_id") != record.get("artifact_id")
+                or timing.get("format_id") != format_id
+                or timing.get("document_id") != document_id
+                or timing.get("admission_contract_id") != self.admission_contract_id
+                or timing.get("basis") != "conversion_persistence_and_deep_validation"
+                or float(timing.get("build_seconds", -1.0)) <= 0
+                or float(timing.get("build_seconds", -1.0))
+                != float(record.get("build_seconds", -2.0))
+            ):
+                raise ValueError("admission timing record mismatch")
+            if deep:
+                artifact = load_decode_cache_artifact(expected_path)
+                if deep_document_id != document_id:
+                    deep_prefill = load_prefill_artifact(
+                        _prefill_path(self.prefill_root, document_id)
+                    )
+                    deep_document_id = document_id
+                if deep_prefill is None:
+                    raise AssertionError("deep prefill cache was not loaded")
+                self._validate_admitted(
+                    artifact,
+                    prefill=deep_prefill,
+                    sample=sample,
+                    key_format=format_id,
+                    value_format=format_id,
+                    provenance=self._admission_provenance(
+                        format_id,
+                        format_id,
+                    ),
+                )
+                numerical_records.append(
+                    self._validate_admitted_numerical(
+                        artifact,
+                        prefill=deep_prefill,
+                        document_id=document_id,
+                    )
+                )
+            paths[key] = expected_path
+        if set(paths) != expected_keys:
+            raise ValueError("admission index coverage is incomplete")
+        artifact_seconds = sum(float(record["build_seconds"]) for record in records)
+        quantized_seconds = sum(
+            float(record["build_seconds"])
+            for record in records
+            if record["format_id"] in DECODE_FORMATS
+        )
+        reference_seconds = sum(
+            float(record["build_seconds"])
+            for record in records
+            if record["format_id"] == "BF16"
+        )
+        prefill_seconds = float(value.get("prefill_read_seconds", -1.0))
+        cold_seconds = float(value.get("cold_build_seconds", -1.0))
+        persisted_bytes = sum(int(record["persisted_bytes"]) for record in records)
+        payload_bytes = sum(int(record["payload_bytes"]) for record in records)
+        resources = _validate_admission_resource_projection(
+            value.get("resource_projection")
+        )
+        if (
+            int(value.get("document_count", -1))
+            != len(self.bundle.numerical_screen + self.bundle.hardware_validation)
+            or int(value.get("artifact_count", -1)) != len(records)
+            or not math.isclose(
+                float(value.get("artifact_build_seconds", -1.0)),
+                artifact_seconds,
+                rel_tol=1e-12,
+                abs_tol=1e-9,
+            )
+            or not math.isclose(
+                float(value.get("quantized_build_seconds", -1.0)),
+                quantized_seconds,
+                rel_tol=1e-12,
+                abs_tol=1e-9,
+            )
+            or not math.isclose(
+                float(value.get("reference_build_seconds", -1.0)),
+                reference_seconds,
+                rel_tol=1e-12,
+                abs_tol=1e-9,
+            )
+            or prefill_seconds <= 0
+            or not math.isclose(
+                cold_seconds,
+                artifact_seconds + prefill_seconds,
+                rel_tol=1e-12,
+                abs_tol=1e-9,
+            )
+            or int(value.get("persisted_bytes", -1)) != persisted_bytes
+            or int(value.get("payload_bytes", -1)) != payload_bytes
+            or int(resources.get("projected_cold_artifact_bytes", -1)) < persisted_bytes
+        ):
+            raise ValueError("admission index aggregate accounting mismatch")
+        return paths, tuple(numerical_records)
+
+    def _validate_admission_preparation(self) -> Mapping[str, Any]:
+        catalog = load_immutable_json(self.admission_index_path)
+        if (
+            catalog.get("persistence_policy")
+            == "content_addressed_recompute_per_format"
+        ):
+            records = self._validate_recomputable_admission_catalog(catalog)
+            receipt = load_immutable_json(
+                self.context.workspace_root / "admission_preparation.json"
+            )
+            validation_path = Path(str(receipt.get("numerical_validation_path", "")))
+            validation = (
+                load_immutable_json(validation_path)
+                if validation_path.is_file()
+                else {}
+            )
+            if (
+                receipt.get("schema_version") != ADMISSION_PREPARATION_SCHEMA
+                or receipt.get("persistence_policy")
+                != "content_addressed_recompute_per_format"
+                or receipt.get("manifest_hash")
+                != self.context.master_manifest.canonical_hash
+                or receipt.get("run_plan_hash") != self.context.run_plan.canonical_hash
+                or receipt.get("prompt_manifest_hash")
+                != self.context.prompts.canonical_hash
+                or receipt.get("admission_index_hash") != catalog.get("content_hash")
+                or receipt.get("admission_contract_id") != self.admission_contract_id
+                or receipt.get("runtime_environment_fingerprint")
+                != self.runtime_environment.logical_fingerprint
+                or receipt.get("numerical_validation_hash")
+                != validation.get("content_hash")
+                or validation.get("schema_version")
+                != ADMISSION_NUMERICAL_VALIDATION_SCHEMA
+                or validation.get("passed") is not True
+                or validation.get("admission_index_hash") != catalog.get("content_hash")
+                or int(validation.get("artifact_count", -1)) != len(records)
+                or int(receipt.get("persisted_bytes", -1)) != 0
+            ):
+                raise ValueError(
+                    "recomputable admission preparation is not workspace-valid"
+                )
+            self.admission_records = records
+            self.admission_paths = {}
+            return catalog
+        paths, _ = self._validate_admission_catalog(catalog, deep=False)
+        receipt_path = self.context.workspace_root / "admission_preparation.json"
+        receipt = load_immutable_json(receipt_path)
+        validation_path = Path(str(receipt.get("numerical_validation_path", "")))
+        validation = (
+            load_immutable_json(validation_path) if validation_path.is_file() else {}
+        )
+        if (
+            receipt.get("schema_version") != ADMISSION_PREPARATION_SCHEMA
+            or receipt.get("manifest_hash")
+            != self.context.master_manifest.canonical_hash
+            or receipt.get("run_plan_hash") != self.context.run_plan.canonical_hash
+            or receipt.get("prompt_manifest_hash")
+            != self.context.prompts.canonical_hash
+            or receipt.get("admission_index_hash") != catalog.get("content_hash")
+            or receipt.get("admission_contract_id") != self.admission_contract_id
+            or receipt.get("runtime_environment_fingerprint")
+            != self.runtime_environment.logical_fingerprint
+            or receipt.get("numerical_validation_hash")
+            != validation.get("content_hash")
+            or validation.get("schema_version") != ADMISSION_NUMERICAL_VALIDATION_SCHEMA
+            or validation.get("passed") is not True
+            or validation.get("admission_index_hash") != catalog.get("content_hash")
+            or validation.get("admission_contract_id") != self.admission_contract_id
+            or validation.get("admission_code_revision") != self.admission_code_revision
+            or validation.get("runtime_environment_fingerprint")
+            != self.runtime_environment.logical_fingerprint
+            or validation.get("sample_bundle_hash") != self.bundle.canonical_hash
+            or validation.get("layout_id") != self.layout_id
+            or int(validation.get("block_size", -1)) != 8
+            or tuple(validation.get("quantized_formats", ())) != DECODE_FORMATS
+            or tuple(validation.get("reference_formats", ())) != ("BF16",)
+            or int(validation.get("artifact_count", -1))
+            != int(catalog.get("artifact_count", -2))
+            or int(validation.get("document_count", -1))
+            != int(catalog.get("document_count", -2))
+            or int(validation.get("tensor_count", -1))
+            != sum(
+                int(record.get("tensor_count", -2))
+                for record in validation.get("records", ())
+            )
+        ):
+            raise ValueError("admission preparation receipt is not workspace-valid")
+        self.admission_paths = paths
+        return catalog
+
+    def _admission_cold_resource_projection(self) -> Mapping[str, Any]:
+        self.admission_root.mkdir(parents=True, exist_ok=True)
+        projected_bytes = 0
+        projected_element_bytes = 0
+        projected_scale_bytes = 0
+        projected_numerical_view_bytes = 0
+        projected_metadata_reserve_bytes = 0
+        existing_bytes = 0
+        max_prefill_bytes = 0
+        max_artifact_bytes = 0
+        formats = DECODE_FORMATS + ("BF16",)
+        for sample in self.samples:
+            prefill_path = _prefill_path(
+                self.prefill_root,
+                sample.document_id,
+            )
+            max_prefill_bytes = max(
+                max_prefill_bytes,
+                _directory_bytes(prefill_path),
+            )
+            manifest = json.loads(
+                (prefill_path / "manifest.json").read_text(encoding="utf-8")
+            )
+            tensor_elements = sum(
+                math.prod(tuple(int(size) for size in layer[role]["shape"]))
+                for layer in manifest["layers"]
+                for role in ("key", "value")
+            )
+            for format_id in formats:
+                components = _packed_tensor_disk_components(
+                    tensor_elements,
+                    format_id,
+                )
+                metadata_reserve = 1 << 20
+                estimate = sum(components.values()) + metadata_reserve
+                projected_bytes += estimate
+                projected_element_bytes += components["element_plane_bytes"]
+                projected_scale_bytes += components["scale_plane_bytes"]
+                projected_numerical_view_bytes += components["numerical_view_bytes"]
+                projected_metadata_reserve_bytes += metadata_reserve
+                max_artifact_bytes = max(max_artifact_bytes, estimate)
+                path = _decode_cache_path(
+                    self.admission_root,
+                    format_id,
+                    sample.document_id,
+                    contract_id=self.admission_contract_id,
+                )
+                if path.exists():
+                    existing_bytes += _directory_bytes(path)
+        safety_factor = float(
+            self.executor_config.get(
+                "artifact_space_safety_factor",
+                1.05,
+            )
+        )
+        reserve_bytes = int(
+            float(
+                self.executor_config.get(
+                    "artifact_space_reserve_gib",
+                    8.0,
+                )
+            )
+            * (1 << 30)
+        )
+        configured_artifact_gib = float(
+            self.executor_config.get("min_free_artifact_gib", 0.0)
+        )
+        if (
+            not math.isfinite(safety_factor)
+            or safety_factor < 1.0
+            or reserve_bytes < 0
+            or not math.isfinite(configured_artifact_gib)
+            or configured_artifact_gib < 0
+        ):
+            raise ValueError("invalid admission resource configuration")
+        required_capacity = max(
+            math.ceil(projected_bytes * safety_factor) + reserve_bytes,
+            int(configured_artifact_gib * (1 << 30)),
+        )
+        disk = shutil.disk_usage(self.admission_root)
+        observed_cold_available = min(
+            disk.total,
+            disk.free + existing_bytes,
+        )
+        configured_host_gib = float(
+            self.executor_config.get(
+                "min_available_host_gib",
+                0.0,
+            )
+        )
+        if not math.isfinite(configured_host_gib) or configured_host_gib < 0:
+            raise ValueError("min_available_host_gib must be non-negative")
+        configured_host_bytes = int(configured_host_gib * (1 << 30))
+        projected_peak_host = max_prefill_bytes + 2 * max_artifact_bytes
+        required_host = max(projected_peak_host, configured_host_bytes)
+        observed_host = _available_host_bytes()
+        if observed_cold_available < required_capacity:
+            raise RuntimeError("artifact filesystem cannot hold the cold admission set")
+        if observed_host < required_host:
+            raise RuntimeError(
+                "host memory is below the admission preparation requirement"
+            )
+        if projected_bytes != sum(
+            (
+                projected_element_bytes,
+                projected_scale_bytes,
+                projected_numerical_view_bytes,
+                projected_metadata_reserve_bytes,
+            )
+        ):
+            raise AssertionError("admission storage projection is inconsistent")
+        return {
+            "persistence_contract": ("packed_planes_plus_bf16_numerical_view"),
+            "artifact_space_safety_factor": safety_factor,
+            "artifact_space_reserve_bytes": reserve_bytes,
+            "projected_element_plane_bytes": projected_element_bytes,
+            "projected_scale_plane_bytes": projected_scale_bytes,
+            "projected_numerical_view_bytes": (projected_numerical_view_bytes),
+            "projected_metadata_reserve_bytes": (projected_metadata_reserve_bytes),
+            "projected_cold_artifact_bytes": projected_bytes,
+            "required_cold_capacity_bytes": required_capacity,
+            "observed_cold_available_bytes": observed_cold_available,
+            "projected_peak_host_bytes": projected_peak_host,
+            "required_host_bytes": required_host,
+            "observed_host_available_bytes": observed_host,
+        }
+
+    def _load_model(self) -> Any:
+        try:
+            import torch
+            from transformers import AutoModelForCausalLM
+        except ImportError as exc:
+            raise RuntimeError(
+                "decode execution requires torch and transformers"
+            ) from exc
+        if str(self.config.get("dtype", "bfloat16")).lower() != "bfloat16":
+            raise ValueError("decode execution requires bfloat16 storage")
+        model = AutoModelForCausalLM.from_pretrained(
+            str(self.config["model_name"]),
+            revision=str(self.config["model_revision"]),
+            torch_dtype=torch.bfloat16,
+            cache_dir=self.config.get("hf_cache_dir"),
+            local_files_only=bool(self.config.get("local_files_only", True)),
+            trust_remote_code=bool(self.config.get("trust_remote_code", False)),
+            attn_implementation="eager",
+            low_cpu_mem_usage=True,
+        )
+        return model.eval()
+
+    def _validate_device_label(self) -> None:
+        import torch
+
+        if not self.device.startswith("cuda"):
+            if self.context.device_label.lower() != "cpu":
+                raise ValueError("CPU execution requires device label CPU")
+            return
+        if not torch.cuda.is_available():
+            raise RuntimeError("CUDA execution requested but CUDA is unavailable")
+        index = torch.device(self.device).index
+        name = torch.cuda.get_device_name(index or 0).lower()
+        label = self.context.device_label.lower()
+        if label not in name:
+            raise ValueError(
+                f"planned device {self.context.device_label!r} does not match {name!r}"
+            )
+        minimum_mb = int(self.config.get("gpu_min_free_mb", 0))
+        if minimum_mb < 0:
+            raise ValueError("gpu_min_free_mb must be non-negative")
+        free_bytes, _ = torch.cuda.mem_get_info(index or 0)
+        free_mb = free_bytes / float(1 << 20)
+        if free_mb < minimum_mb:
+            raise RuntimeError(
+                f"GPU has {free_mb:.0f} MiB free; {minimum_mb} MiB is required"
+            )
+
+    @contextmanager
+    def open_weight_bank(
+        self,
+        weight_format: str,
+        entries: tuple[SweepManifestEntry, ...],
+    ) -> Iterator[DecodeWeightBank]:
+        import torch
+
+        if not entries or any(
+            entry.profile.weight_format != weight_format for entry in entries
+        ):
+            raise ValueError("weight-bank group is empty or inconsistent")
+        self.cache_lru.clear()
+        gc.collect()
+        build_started = time.perf_counter()
+        initialize_numerical_runtime(self.runtime_seed)
+        self._capture_current_runtime_environment()
+        self._validate_device_label()
+        model = None
+        try:
+            with self._weight_bank_build_lock():
+                model = self._load_model()
+                if weight_format != "BF16":
+                    from chop.passes.module.transforms.quantize.quantize import (
+                        install_phase_context_pre_hooks,
+                        quantize_module_transform_pass,
+                    )
+                    from decode_dse.software.precision_bindings import (
+                        build_decode_pass_args,
+                    )
+
+                    representative = profile_to_decode_quant_spec(entries[0].profile)
+                    if representative is None:
+                        raise ValueError("quantized weight group has a BF16 profile")
+                    pass_args = build_decode_pass_args(
+                        str(self.config["model_name"]),
+                        self.device,
+                        representative,
+                    )
+                    pass_args["collapse_decode_banks"] = True
+                    bank_device_variable = "MASE_PHASE_BANK_DEVICE"
+                    previous_bank_device = os.environ.get(bank_device_variable)
+                    try:
+                        if self.device.startswith("cuda"):
+                            os.environ[bank_device_variable] = self.device
+                        else:
+                            os.environ.pop(bank_device_variable, None)
+                        model, _ = quantize_module_transform_pass(
+                            model,
+                            pass_args,
+                        )
+                    finally:
+                        if previous_bank_device is None:
+                            os.environ.pop(bank_device_variable, None)
+                        else:
+                            os.environ[bank_device_variable] = previous_bank_device
+                    model = model.to(self.device).eval()
+                    install_phase_context_pre_hooks(model)
+                    binding_plan = build_decode_binding_plan(model, pass_args)
+                    quantization_guard = DecodeWeightQuantizationGuard.capture(
+                        binding_plan,
+                        expected_modules=(
+                            7 * int(self.model_architecture["num_hidden_layers"])
+                        ),
+                    )
+                    _validate_bank_structure(
+                        model,
+                        binding_plan,
+                        len(quantization_guard.modules),
+                        self.model_architecture,
+                    )
+                else:
+                    if any(
+                        entry.profile.kind != PROFILE_KIND_BF16_REFERENCE
+                        for entry in entries
+                    ):
+                        raise ValueError(
+                            "BF16 weight bank contains a quantized profile"
+                        )
+                    model = model.to(self.device).eval()
+                    binding_plan = DecodeBindingPlan(patterns=(), targets=())
+                    quantization_guard = DecodeWeightQuantizationGuard.capture(
+                        binding_plan,
+                        expected_modules=0,
+                    )
+            identity_guard = DecodeWeightBankIdentity.capture(model)
+            yield DecodeWeightBank(
+                model=model,
+                device=torch.device(self.device),
+                weight_format=weight_format,
+                binding_plan=binding_plan,
+                identity_guard=identity_guard,
+                quantization_guard=quantization_guard,
+                build_seconds=time.perf_counter() - build_started,
+            )
+        finally:
+            del model
+            gc.collect()
+            if torch.cuda.is_available():
+                torch.cuda.empty_cache()
+
+    @contextmanager
+    def _weight_bank_build_lock(self) -> Iterator[None]:
+        if not bool(self.executor_config.get("serialize_weight_bank_builds", True)):
+            yield
+            return
+        scratch = _resolve_path(
+            str(self.config.get("scratch_dir", "results/decode_dse_scratch")),
+            workspace_root=self.context.workspace_root,
+        )
+        lock_root = scratch / ".locks"
+        lock_root.mkdir(parents=True, exist_ok=True)
+        model_token = hashlib.sha256(
+            str(self.config["model_name"]).encode("utf-8")
+        ).hexdigest()[:16]
+        lock_path = lock_root / f"{model_token}-weight-bank-build.lock"
+        descriptor = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o644)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            yield
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def _admission_provenance(
+        self,
+        key_format: str,
+        value_format: str,
+    ) -> ArtifactProvenance:
+        created_at = getattr(self, "admission_provenance_created_at", None)
+        if created_at is None:
+            created_at = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+            self.admission_provenance_created_at = created_at
+        return ArtifactProvenance(
+            producer="packedkv-decode-admission",
+            code_revision=self.admission_code_revision,
+            created_at_utc=str(created_at),
+            parameters=(
+                ("key_format", key_format),
+                ("value_format", value_format),
+                ("layout_id", self.layout_id),
+                ("block_size", "8"),
+                ("converter_schema", ADMISSION_CONVERTER_SCHEMA),
+                (
+                    "element_encoding",
+                    "MXINT_SIGN_MAGNITUDE_OR_MXFP_IEEE_LSB",
+                ),
+                ("scale_encoding", "E8M0_bias127"),
+                ("sample_bundle_hash", self.bundle.canonical_hash),
+                (
+                    "runtime_environment_fingerprint",
+                    self.runtime_environment.logical_fingerprint,
+                ),
+            ),
+        )
+
+    @contextmanager
+    def _artifact_lock(self, path: Path) -> Iterator[None]:
+        lock_root = self.admission_root / ".locks"
+        lock_root.mkdir(parents=True, exist_ok=True)
+        lock_path = lock_root / f"{hashlib.sha256(str(path).encode()).hexdigest()}.lock"
+        descriptor = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o644)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            yield
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def _validate_admitted(
+        self,
+        artifact: DecodeCacheArtifact,
+        *,
+        prefill: Any,
+        sample: DecodeTokenSample,
+        key_format: str,
+        value_format: str,
+        provenance: ArtifactProvenance,
+    ) -> None:
+        if artifact.source_artifact_id != prefill.artifact_id:
+            raise ValueError("admitted cache source mismatch")
+        if artifact.precision_id != _kv_precision_id(
+            key_format,
+            value_format,
+        ):
+            raise ValueError("admitted cache precision mismatch")
+        if artifact.key_format != key_format:
+            raise ValueError("admitted cache key-format mismatch")
+        if artifact.value_format != value_format:
+            raise ValueError("admitted cache value-format mismatch")
+        if artifact.layout_id != self.layout_id:
+            raise ValueError("admitted cache layout mismatch")
+        if artifact.provenance.producer != provenance.producer:
+            raise ValueError("admitted cache producer mismatch")
+        if artifact.provenance.code_revision != provenance.code_revision:
+            raise ValueError("admitted cache source-tree mismatch")
+        if artifact.provenance.parameters != provenance.parameters:
+            raise ValueError("admitted cache conversion-contract mismatch")
+        metadata = dict(artifact.metadata)
+        if metadata.get("document_id") != sample.document_id:
+            raise ValueError("admitted cache document mismatch")
+        if metadata.get("sample_bundle_hash") != self.bundle.canonical_hash:
+            raise ValueError("admitted cache sample-bundle mismatch")
+        if metadata.get("admission_contract_id") != self.admission_contract_id:
+            raise ValueError("admitted cache contract identity mismatch")
+        if len(artifact.layers) != len(prefill.layers):
+            raise ValueError("admitted cache layer count mismatch")
+        for layer_index, (admitted_layer, prefill_layer) in enumerate(
+            zip(artifact.layers, prefill.layers)
+        ):
+            for role, payload, source, format_id in (
+                ("key", admitted_layer.key, prefill_layer.key, key_format),
+                ("value", admitted_layer.value, prefill_layer.value, value_format),
+            ):
+                descriptor = format_descriptor(format_id)
+                expected_block = 1 if descriptor.family == "bf16" else 8
+                elements = math.prod(source.shape)
+                expected_element_bytes = math.ceil(
+                    elements * descriptor.element_bits / 8
+                )
+                expected_scale_bytes = (
+                    0 if descriptor.family == "bf16" else elements // 8
+                )
+                expected_element_encoding = {
+                    "bf16": "BF16_LE",
+                    "mxint": "MXINT_SIGN_MAGNITUDE_LSB",
+                    "mxfp": "MXFP_IEEE_LSB",
+                }[descriptor.family]
+                expected_scale_encoding = (
+                    "NONE" if descriptor.family == "bf16" else "E8M0_BIAS127_U8"
+                )
+                if (
+                    payload.logical_shape != source.shape
+                    or payload.format_id != descriptor.token
+                    or payload.block_size != expected_block
+                    or payload.element_bits != descriptor.element_bits
+                    or payload.element_encoding != expected_element_encoding
+                    or payload.scale_encoding != expected_scale_encoding
+                    or len(payload.element_plane) != expected_element_bytes
+                    or len(payload.scale_plane) != expected_scale_bytes
+                    or payload.numerical_view.dtype != "bfloat16"
+                ):
+                    raise ValueError(
+                        f"admitted layer {layer_index} {role} plane contract mismatch"
+                    )
+
+    def _validate_admitted_numerical(
+        self,
+        artifact: DecodeCacheArtifact,
+        *,
+        prefill: Any,
+        document_id: str,
+    ) -> dict[str, Any]:
+        """Rebuild every tensor and require exact persisted admission bytes."""
+
+        checks: list[dict[str, Any]] = []
+        for layer_index, (admitted_layer, prefill_layer) in enumerate(
+            zip(artifact.layers, prefill.layers)
+        ):
+            for role, observed, source in (
+                ("key", admitted_layer.key, prefill_layer.key),
+                ("value", admitted_layer.value, prefill_layer.value),
+            ):
+                converter: Any = (
+                    BF16CacheConverter()
+                    if observed.format_id == "BF16"
+                    else MaseMXCacheConverter(
+                        observed.format_id,
+                        block_size=observed.block_size,
+                    )
+                )
+                rebuilt = converter.convert(
+                    source,
+                    role=role,
+                    layer_index=layer_index,
+                    precision_id=artifact.precision_id,
+                    layout_id=artifact.layout_id,
+                )
+                exact = (
+                    rebuilt.descriptor() == observed.descriptor()
+                    and rebuilt.element_plane == observed.element_plane
+                    and rebuilt.scale_plane == observed.scale_plane
+                    and rebuilt.numerical_view.data == observed.numerical_view.data
+                )
+                if not exact:
+                    raise ValueError(
+                        f"admitted layer {layer_index} {role} differs "
+                        "from source conversion"
+                    )
+                check = {
+                    "layer_index": layer_index,
+                    "role": role,
+                    "format_id": observed.format_id,
+                    "source_sha256": source.sha256,
+                    "element_sha256": observed.element_sha256,
+                    "scale_sha256": observed.scale_sha256,
+                    "numerical_view_sha256": (observed.numerical_view.sha256),
+                    "descriptor_sha256": _mapping_sha256(observed.descriptor()),
+                    "exact_match": True,
+                }
+                checks.append({**check, "check_hash": _mapping_sha256(check)})
+        return {
+            "document_id": document_id,
+            "format_id": artifact.key_format,
+            "source_artifact_id": artifact.source_artifact_id,
+            "artifact_id": artifact.artifact_id,
+            "layer_count": len(artifact.layers),
+            "tensor_count": len(checks),
+            "tensor_checks": checks,
+        }
+
+    def _validate_native_append(
+        self,
+        cache: Any,
+        start: int,
+        end: int,
+        artifact: DecodeCacheArtifact,
+    ) -> None:
+        import torch
+
+        started = time.perf_counter()
+        tensor_checks = 0
+        quantized_tensor_checks = 0
+        try:
+            if end != start + 1:
+                raise AssertionError("decode append validation requires one token")
+            layers = _legacy_cache_layers(cache)
+            if len(layers) != len(artifact.layers):
+                raise AssertionError("runtime cache layer count changed")
+            for layer_index, ((key, value), payload) in enumerate(
+                zip(layers, artifact.layers)
+            ):
+                for role, runtime, expected_payload in (
+                    ("key", key, payload.key),
+                    ("value", value, payload.value),
+                ):
+                    appended = runtime[..., start:end, :]
+                    if appended.shape[-2] != 1:
+                        raise AssertionError("runtime cache append is not q_len=1")
+                    tensor_checks += 1
+                    if expected_payload.format_id == "BF16":
+                        if appended.dtype != torch.bfloat16:
+                            raise TypeError("BF16 cache append changed storage dtype")
+                        continue
+                    source = TensorPayload.from_torch(
+                        appended.detach().to("cpu", dtype=torch.bfloat16),
+                        dtype="bfloat16",
+                    )
+                    converted = MaseMXCacheConverter(
+                        expected_payload.format_id,
+                        block_size=expected_payload.block_size,
+                    ).convert(
+                        source,
+                        role,
+                        layer_index,
+                        artifact.precision_id,
+                        artifact.layout_id,
+                    )
+                    expected = converted.numerical_view.to_torch(appended.device)
+                    if appended.dtype != torch.bfloat16 or not torch.equal(
+                        appended,
+                        expected,
+                    ):
+                        raise AssertionError(
+                            f"layer {layer_index} {role} append is outside "
+                            f"{expected_payload.format_id}"
+                        )
+                    quantized_tensor_checks += 1
+            self._native_append_validation_calls += 1
+            self._native_append_tensor_checks += tensor_checks
+            self._native_append_quantized_tensor_checks += quantized_tensor_checks
+        finally:
+            self._native_append_validation_seconds += time.perf_counter() - started
+
+    def _load_or_create_admitted(
+        self,
+        sample: DecodeTokenSample,
+        key_format: str,
+        value_format: str,
+        provenance: ArtifactProvenance,
+        prefill: Any | None = None,
+        artifact_root: Path | None = None,
+    ) -> tuple[Path, DecodeCacheArtifact, Any]:
+        root = self.admission_root if artifact_root is None else artifact_root
+        path = _decode_cache_path(
+            root,
+            key_format,
+            sample.document_id,
+            value_format,
+            contract_id=self.admission_contract_id,
+        )
+        with self._artifact_lock(path):
+            if prefill is None:
+                prefill = load_prefill_artifact(
+                    _prefill_path(self.prefill_root, sample.document_id)
+                )
+            if prefill.prompt_hash != sample.prompt_hash:
+                raise ValueError("prefill artifact prompt hash mismatch")
+            if path.exists():
+                artifact = load_decode_cache_artifact(path)
+                self._validate_admitted(
+                    artifact,
+                    prefill=prefill,
+                    sample=sample,
+                    key_format=key_format,
+                    value_format=value_format,
+                    provenance=provenance,
+                )
+                return path, artifact, prefill
+            if key_format == value_format == "BF16":
+                converter: Any = BF16CacheConverter()
+                artifact = admit_prefill_cache(
+                    prefill,
+                    precision_id="BF16",
+                    layout_id=self.layout_id,
+                    converter=converter,
+                    provenance=provenance,
+                    metadata={
+                        "document_id": sample.document_id,
+                        "sample_bundle_hash": self.bundle.canonical_hash,
+                        "admission_contract_id": self.admission_contract_id,
+                    },
+                )
+            else:
+                if "BF16" in {key_format, value_format}:
+                    raise ValueError("split refinement cannot mix BF16 and MX cache")
+                key_converter = MaseMXCacheConverter(key_format, block_size=8)
+                value_converter = MaseMXCacheConverter(value_format, block_size=8)
+                artifact = admit_prefill_cache_split(
+                    prefill,
+                    precision_id=_kv_precision_id(key_format, value_format),
+                    layout_id=self.layout_id,
+                    key_converter=FunctionalCacheConverter(key_converter.convert),
+                    value_converter=FunctionalCacheConverter(value_converter.convert),
+                    key_format=key_format,
+                    value_format=value_format,
+                    provenance=provenance,
+                    metadata={
+                        "document_id": sample.document_id,
+                        "sample_bundle_hash": self.bundle.canonical_hash,
+                        "admission_contract_id": self.admission_contract_id,
+                    },
+                )
+            self._validate_admitted(
+                artifact,
+                prefill=prefill,
+                sample=sample,
+                key_format=key_format,
+                value_format=value_format,
+                provenance=provenance,
+            )
+            save_decode_cache_artifact(artifact, path)
+            del artifact
+            persisted = load_decode_cache_artifact(path)
+            self._validate_admitted(
+                persisted,
+                prefill=prefill,
+                sample=sample,
+                key_format=key_format,
+                value_format=value_format,
+                provenance=provenance,
+            )
+            return path, persisted, prefill
+
+    def _ensure_admitted(
+        self,
+        sample: DecodeTokenSample,
+        key_format: str,
+        value_format: str,
+        provenance: ArtifactProvenance,
+    ) -> Path:
+        return self._load_or_create_admitted(
+            sample,
+            key_format,
+            value_format,
+            provenance,
+        )[0]
+
+    def _validate_recomputable_admission_catalog(
+        self,
+        value: Mapping[str, Any],
+    ) -> dict[tuple[str, str], Mapping[str, Any]]:
+        """Validate content identities without requiring retained tensors."""
+
+        if (
+            value.get("schema_version") != ADMISSION_INDEX_SCHEMA
+            or value.get("persistence_policy")
+            != "content_addressed_recompute_per_format"
+            or value.get("admission_contract_id") != self.admission_contract_id
+            or value.get("admission_code_revision") != self.admission_code_revision
+            or value.get("runtime_environment_fingerprint")
+            != self.runtime_environment.logical_fingerprint
+            or value.get("sample_bundle_hash") != self.bundle.canonical_hash
+            or value.get("layout_id") != self.layout_id
+            or tuple(value.get("quantized_formats", ())) != DECODE_FORMATS
+            or tuple(value.get("reference_formats", ())) != ("BF16",)
+        ):
+            raise ValueError("recomputable admission catalog identity mismatch")
+        created_at = value.get("admission_provenance_created_at")
+        if not isinstance(created_at, str) or not created_at.endswith("Z"):
+            raise ValueError("admission catalog lacks a provenance timestamp")
+        self.admission_provenance_created_at = created_at
+        expected = self._admission_record_keys()
+        samples = {
+            sample.document_id: sample
+            for sample in self.bundle.numerical_screen + self.bundle.hardware_validation
+        }
+        records: dict[tuple[str, str], Mapping[str, Any]] = {}
+        sha256 = re.compile(r"^[0-9a-f]{64}$")
+        for record in value.get("records", ()):
+            if not isinstance(record, Mapping):
+                raise TypeError("admission catalog records must be objects")
+            key = (str(record.get("format_id")), str(record.get("document_id")))
+            if key in records or key not in expected:
+                raise ValueError("admission catalog contains an invalid record key")
+            format_id, document_id = key
+            expected_relative = _decode_cache_path(
+                Path("."),
+                format_id,
+                document_id,
+                contract_id=self.admission_contract_id,
+            ).as_posix()
+            if (
+                record.get("prompt_hash") != samples[document_id].prompt_hash
+                or record.get("relative_path") != expected_relative
+                or not sha256.fullmatch(str(record.get("artifact_id", "")))
+                or not sha256.fullmatch(str(record.get("source_artifact_id", "")))
+                or int(record.get("persisted_bytes", 0)) <= 0
+                or int(record.get("payload_bytes", 0)) <= 0
+                or float(record.get("build_seconds", 0.0)) <= 0.0
+            ):
+                raise ValueError("admission catalog record is incomplete")
+            records[key] = dict(record)
+        if set(records) != expected:
+            raise ValueError("admission catalog coverage is incomplete")
+        logical_bytes = sum(
+            int(record["persisted_bytes"]) for record in records.values()
+        )
+        by_format = {
+            format_id: sum(
+                int(record["persisted_bytes"])
+                for (candidate, _), record in records.items()
+                if candidate == format_id
+            )
+            for format_id in DECODE_FORMATS + ("BF16",)
+        }
+        resources = value.get("resource_projection")
+        if (
+            not isinstance(resources, Mapping)
+            or resources.get("policy") != "content_addressed_recompute_per_format"
+            or int(resources.get("logical_total_bytes", -1)) != logical_bytes
+            or int(resources.get("runtime_peak_format_bytes", -1))
+            != max(by_format.values())
+            or int(resources.get("persisted_after_preparation_bytes", -1)) != 0
+            or int(resources.get("required_cold_capacity_bytes", 0)) <= 0
+            or int(resources.get("observed_cold_available_bytes", -1))
+            < int(resources.get("required_cold_capacity_bytes", 0))
+            or int(resources.get("required_host_bytes", 0)) <= 0
+            or int(resources.get("observed_host_available_bytes", -1))
+            < int(resources.get("required_host_bytes", 0))
+            or int(value.get("artifact_count", -1)) != len(records)
+            or int(value.get("document_count", -1)) != len(samples)
+            or int(value.get("logical_artifact_bytes", -1)) != logical_bytes
+            or int(value.get("persisted_bytes", -1)) != 0
+        ):
+            raise ValueError("admission catalog resource accounting mismatch")
+        return records
+
+    def _prepare_recomputable_admission_catalog(
+        self,
+        *,
+        workspace_root: Path,
+        workspace_identity: Mapping[str, str],
+    ) -> Mapping[str, Any]:
+        """Validate every conversion once and retain only its content identity."""
+
+        required_identity = {
+            "manifest_hash",
+            "run_plan_hash",
+            "prompt_manifest_hash",
+        }
+        if set(workspace_identity) != required_identity or any(
+            not str(workspace_identity[key]) for key in required_identity
+        ):
+            raise ValueError("workspace identity is incomplete")
+        self.admission_root.mkdir(parents=True, exist_ok=True)
+        validation_path = self.admission_index_path.with_name(
+            "numerical_validation.json"
+        )
+        if self.admission_index_path.exists():
+            catalog = load_immutable_json(self.admission_index_path)
+            records = self._validate_recomputable_admission_catalog(catalog)
+            validation = load_immutable_json(validation_path)
+        else:
+            self.admission_provenance_created_at = (
+                datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+            )
+            formats = DECODE_FORMATS + ("BF16",)
+            provenances = {
+                format_id: self._admission_provenance(format_id, format_id)
+                for format_id in formats
+            }
+            records_list: list[dict[str, Any]] = []
+            numerical_records: list[dict[str, Any]] = []
+            format_bytes = {format_id: 0 for format_id in formats}
+            max_prefill_bytes = 0
+            max_artifact_bytes = 0
+            temporary_parent = self.admission_root / ".preparation"
+            temporary_parent.mkdir(parents=True, exist_ok=True)
+            temporary_root = Path(
+                tempfile.mkdtemp(
+                    prefix="admission-",
+                    dir=temporary_parent,
+                )
+            )
+            try:
+                for sample in self.samples:
+                    prefill = load_prefill_artifact(
+                        _prefill_path(self.prefill_root, sample.document_id)
+                    )
+                    max_prefill_bytes = max(
+                        max_prefill_bytes,
+                        _directory_bytes(
+                            _prefill_path(
+                                self.prefill_root,
+                                sample.document_id,
+                            )
+                        ),
+                    )
+                    for format_id in formats:
+                        started = time.perf_counter()
+                        path, artifact, _ = self._load_or_create_admitted(
+                            sample,
+                            format_id,
+                            format_id,
+                            provenances[format_id],
+                            prefill=prefill,
+                            artifact_root=temporary_root,
+                        )
+                        elapsed = time.perf_counter() - started
+                        persisted_bytes = _directory_bytes(path)
+                        max_artifact_bytes = max(
+                            max_artifact_bytes,
+                            persisted_bytes,
+                        )
+                        format_bytes[format_id] += persisted_bytes
+                        numerical_records.append(
+                            self._validate_admitted_numerical(
+                                artifact,
+                                prefill=prefill,
+                                document_id=sample.document_id,
+                            )
+                        )
+                        records_list.append(
+                            {
+                                "format_id": format_id,
+                                "document_id": sample.document_id,
+                                "prompt_hash": sample.prompt_hash,
+                                "source_artifact_id": prefill.artifact_id,
+                                "artifact_id": artifact.artifact_id,
+                                "relative_path": _decode_cache_path(
+                                    Path("."),
+                                    format_id,
+                                    sample.document_id,
+                                    contract_id=self.admission_contract_id,
+                                ).as_posix(),
+                                "persisted_bytes": persisted_bytes,
+                                "payload_bytes": _artifact_bytes(artifact),
+                                "build_seconds": elapsed,
+                            }
+                        )
+                        shutil.rmtree(path)
+            finally:
+                shutil.rmtree(temporary_root, ignore_errors=True)
+            records_list.sort(
+                key=lambda record: (
+                    str(record["document_id"]),
+                    str(record["format_id"]),
+                )
+            )
+            logical_bytes = sum(
+                int(record["persisted_bytes"]) for record in records_list
+            )
+            footprint = estimate_artifact_footprint(
+                self.config,
+                self.model_architecture,
+            )
+            observed_cold = shutil.disk_usage(self.admission_root).free
+            required_host = max(
+                1,
+                max_prefill_bytes + 2 * max_artifact_bytes,
+            )
+            observed_host = _available_host_bytes()
+            catalog_body = {
+                "schema_version": ADMISSION_INDEX_SCHEMA,
+                "persistence_policy": "content_addressed_recompute_per_format",
+                "admission_contract_id": self.admission_contract_id,
+                "admission_code_revision": self.admission_code_revision,
+                "admission_provenance_created_at": (
+                    self.admission_provenance_created_at
+                ),
+                "runtime_environment_fingerprint": (
+                    self.runtime_environment.logical_fingerprint
+                ),
+                "sample_bundle_hash": self.bundle.canonical_hash,
+                "layout_id": self.layout_id,
+                "block_size": 8,
+                "quantized_formats": list(DECODE_FORMATS),
+                "reference_formats": ["BF16"],
+                "document_count": len(self.samples),
+                "artifact_count": len(records_list),
+                "records": records_list,
+                "logical_artifact_bytes": logical_bytes,
+                "persisted_bytes": 0,
+                "resource_projection": {
+                    "policy": "content_addressed_recompute_per_format",
+                    "logical_total_bytes": logical_bytes,
+                    "runtime_peak_format_bytes": max(format_bytes.values()),
+                    "persisted_after_preparation_bytes": 0,
+                    "required_cold_capacity_bytes": (
+                        footprint.required_workspace_bytes
+                    ),
+                    "observed_cold_available_bytes": observed_cold,
+                    "required_host_bytes": required_host,
+                    "observed_host_available_bytes": observed_host,
+                },
+            }
+            write_immutable_json(self.admission_index_path, catalog_body)
+            catalog = load_immutable_json(self.admission_index_path)
+            records = self._validate_recomputable_admission_catalog(catalog)
+            tensor_count = sum(
+                int(record["tensor_count"]) for record in numerical_records
+            )
+            write_immutable_json(
+                validation_path,
+                {
+                    "schema_version": ADMISSION_NUMERICAL_VALIDATION_SCHEMA,
+                    "passed": True,
+                    "basis": "independent_source_recompute_exact_planes",
+                    "admission_index_hash": str(catalog["content_hash"]),
+                    "admission_contract_id": self.admission_contract_id,
+                    "admission_code_revision": self.admission_code_revision,
+                    "runtime_environment_fingerprint": (
+                        self.runtime_environment.logical_fingerprint
+                    ),
+                    "sample_bundle_hash": self.bundle.canonical_hash,
+                    "layout_id": self.layout_id,
+                    "source_dtype": "BF16",
+                    "block_size": 8,
+                    "quantized_formats": list(DECODE_FORMATS),
+                    "reference_formats": ["BF16"],
+                    "document_count": len(self.samples),
+                    "artifact_count": len(numerical_records),
+                    "tensor_count": tensor_count,
+                    "records": numerical_records,
+                    "steady_state_tpot_included": False,
+                },
+            )
+            validation = load_immutable_json(validation_path)
+        if (
+            validation.get("schema_version") != ADMISSION_NUMERICAL_VALIDATION_SCHEMA
+            or validation.get("passed") is not True
+            or validation.get("admission_index_hash") != catalog.get("content_hash")
+            or int(validation.get("artifact_count", -1)) != len(records)
+        ):
+            raise ValueError("admission numerical validation is not catalog-bound")
+        receipt = {
+            "schema_version": ADMISSION_PREPARATION_SCHEMA,
+            **{key: str(workspace_identity[key]) for key in required_identity},
+            "persistence_policy": "content_addressed_recompute_per_format",
+            "admission_contract_id": self.admission_contract_id,
+            "runtime_environment_fingerprint": (
+                self.runtime_environment.logical_fingerprint
+            ),
+            "admission_index_path": str(self.admission_index_path),
+            "admission_index_hash": str(catalog["content_hash"]),
+            "numerical_validation_path": str(validation_path),
+            "numerical_validation_hash": str(validation["content_hash"]),
+            "quantized_format_count": len(DECODE_FORMATS),
+            "document_count": int(catalog["document_count"]),
+            "artifact_count": int(catalog["artifact_count"]),
+            "cold_build_seconds": sum(
+                float(record["build_seconds"]) for record in catalog["records"]
+            ),
+            "logical_artifact_bytes": int(catalog["logical_artifact_bytes"]),
+            "persisted_bytes": 0,
+            "resource_projection": dict(catalog["resource_projection"]),
+        }
+        write_immutable_json(
+            workspace_root / "admission_preparation.json",
+            receipt,
+        )
+        return load_immutable_json(workspace_root / "admission_preparation.json")
+
+    def prepare_admission_catalog(
+        self,
+        *,
+        workspace_root: Path,
+        workspace_identity: Mapping[str, str],
+    ) -> Mapping[str, Any]:
+        """Build all prompt admissions before any profile evaluation starts."""
+
+        if (
+            self.executor_config.get("artifact_policy")
+            == "content_addressed_recompute_per_format"
+        ):
+            return self._prepare_recomputable_admission_catalog(
+                workspace_root=workspace_root,
+                workspace_identity=workspace_identity,
+            )
+
+        required_identity = {
+            "manifest_hash",
+            "run_plan_hash",
+            "prompt_manifest_hash",
+        }
+        if set(workspace_identity) != required_identity or any(
+            not str(workspace_identity[key]) for key in required_identity
+        ):
+            raise ValueError("workspace identity is incomplete")
+        workspace_root = workspace_root.resolve()
+        if self.admission_index_path.exists():
+            catalog = load_immutable_json(self.admission_index_path)
+        else:
+            resource_projection = self._admission_cold_resource_projection()
+            records = []
+            prefill_read_seconds = 0.0
+            formats = DECODE_FORMATS + ("BF16",)
+            provenances = {
+                format_id: self._admission_provenance(
+                    format_id,
+                    format_id,
+                )
+                for format_id in formats
+            }
+            for sample in self.samples:
+                prefill_started = time.perf_counter()
+                source_prefill = load_prefill_artifact(
+                    _prefill_path(self.prefill_root, sample.document_id)
+                )
+                prefill_read_seconds += time.perf_counter() - prefill_started
+                for format_id in formats:
+                    provenance = provenances[format_id]
+                    path = _decode_cache_path(
+                        self.admission_root,
+                        format_id,
+                        sample.document_id,
+                        contract_id=self.admission_contract_id,
+                    )
+                    timing_path = self._admission_timing_path(path)
+                    existed = path.exists()
+                    started = time.perf_counter()
+                    admitted_path, artifact, prefill = self._load_or_create_admitted(
+                        sample,
+                        format_id,
+                        format_id,
+                        provenance,
+                        prefill=source_prefill,
+                    )
+                    elapsed = time.perf_counter() - started
+                    if not timing_path.exists():
+                        if existed:
+                            raise RuntimeError(
+                                "admitted cache has no measured build-time record"
+                            )
+                        write_immutable_json(
+                            timing_path,
+                            {
+                                "schema_version": "decode-admission-timing",
+                                "admission_contract_id": (self.admission_contract_id),
+                                "format_id": format_id,
+                                "document_id": sample.document_id,
+                                "artifact_id": artifact.artifact_id,
+                                "build_seconds": elapsed,
+                                "basis": ("conversion_persistence_and_deep_validation"),
+                            },
+                        )
+                    timing = load_immutable_json(timing_path)
+                    if (
+                        timing.get("artifact_id") != artifact.artifact_id
+                        or timing.get("basis")
+                        != "conversion_persistence_and_deep_validation"
+                    ):
+                        raise ValueError("invalid admission build-time record")
+                    records.append(
+                        {
+                            "format_id": format_id,
+                            "document_id": sample.document_id,
+                            "prompt_hash": sample.prompt_hash,
+                            "source_artifact_id": prefill.artifact_id,
+                            "artifact_id": artifact.artifact_id,
+                            "relative_path": admitted_path.relative_to(
+                                self.admission_root
+                            ).as_posix(),
+                            "persisted_bytes": _directory_bytes(admitted_path),
+                            "payload_bytes": _artifact_bytes(artifact),
+                            "build_seconds": float(timing["build_seconds"]),
+                        }
+                    )
+            persisted_bytes = sum(int(record["persisted_bytes"]) for record in records)
+            payload_bytes = sum(int(record["payload_bytes"]) for record in records)
+            artifact_build_seconds = sum(
+                float(record["build_seconds"]) for record in records
+            )
+            build_seconds = artifact_build_seconds + prefill_read_seconds
+            if persisted_bytes > int(
+                resource_projection["projected_cold_artifact_bytes"]
+            ):
+                raise RuntimeError(
+                    "admission storage exceeds its cold resource projection"
+                )
+            catalog_body = {
+                "schema_version": ADMISSION_INDEX_SCHEMA,
+                "admission_contract_id": self.admission_contract_id,
+                "admission_code_revision": self.admission_code_revision,
+                "runtime_environment_fingerprint": (
+                    self.runtime_environment.logical_fingerprint
+                ),
+                "sample_bundle_hash": self.bundle.canonical_hash,
+                "layout_id": self.layout_id,
+                "block_size": 8,
+                "quantized_formats": list(DECODE_FORMATS),
+                "reference_formats": ["BF16"],
+                "document_count": len(self.samples),
+                "artifact_count": len(records),
+                "records": records,
+                "cold_build_seconds": build_seconds,
+                "prefill_read_seconds": prefill_read_seconds,
+                "artifact_build_seconds": artifact_build_seconds,
+                "quantized_build_seconds": sum(
+                    float(record["build_seconds"])
+                    for record in records
+                    if record["format_id"] in DECODE_FORMATS
+                ),
+                "reference_build_seconds": sum(
+                    float(record["build_seconds"])
+                    for record in records
+                    if record["format_id"] == "BF16"
+                ),
+                "persisted_bytes": persisted_bytes,
+                "payload_bytes": payload_bytes,
+                "resource_projection": dict(resource_projection),
+            }
+            write_immutable_json(self.admission_index_path, catalog_body)
+            catalog = load_immutable_json(self.admission_index_path)
+
+        _, numerical_records = self._validate_admission_catalog(
+            catalog,
+            deep=True,
+        )
+        tensor_count = sum(int(record["tensor_count"]) for record in numerical_records)
+        validation_path = self.admission_index_path.with_name(
+            "numerical_validation.json"
+        )
+        write_immutable_json(
+            validation_path,
+            {
+                "schema_version": (ADMISSION_NUMERICAL_VALIDATION_SCHEMA),
+                "passed": True,
+                "basis": ("independent_source_conversion_exact_persisted_planes"),
+                "admission_index_hash": str(catalog["content_hash"]),
+                "admission_contract_id": self.admission_contract_id,
+                "admission_code_revision": self.admission_code_revision,
+                "runtime_environment_fingerprint": (
+                    self.runtime_environment.logical_fingerprint
+                ),
+                "sample_bundle_hash": self.bundle.canonical_hash,
+                "layout_id": self.layout_id,
+                "source_dtype": "BF16",
+                "block_size": 8,
+                "quantized_formats": list(DECODE_FORMATS),
+                "reference_formats": ["BF16"],
+                "document_count": int(catalog["document_count"]),
+                "artifact_count": len(numerical_records),
+                "tensor_count": tensor_count,
+                "records": list(numerical_records),
+                "steady_state_tpot_included": False,
+            },
+        )
+        validation = load_immutable_json(validation_path)
+
+        receipt = {
+            "schema_version": ADMISSION_PREPARATION_SCHEMA,
+            **{key: str(workspace_identity[key]) for key in required_identity},
+            "admission_contract_id": self.admission_contract_id,
+            "runtime_environment_fingerprint": (
+                self.runtime_environment.logical_fingerprint
+            ),
+            "admission_index_path": str(self.admission_index_path),
+            "admission_index_hash": str(catalog["content_hash"]),
+            "numerical_validation_path": str(validation_path),
+            "numerical_validation_hash": str(validation["content_hash"]),
+            "quantized_format_count": len(DECODE_FORMATS),
+            "document_count": int(catalog["document_count"]),
+            "artifact_count": int(catalog["artifact_count"]),
+            "cold_build_seconds": float(catalog["cold_build_seconds"]),
+            "persisted_bytes": int(catalog["persisted_bytes"]),
+            "resource_projection": dict(catalog["resource_projection"]),
+        }
+        write_immutable_json(
+            workspace_root / "admission_preparation.json",
+            receipt,
+        )
+        return load_immutable_json(workspace_root / "admission_preparation.json")
+
+    @contextmanager
+    def open_kv_admission_cache(
+        self,
+        kv_format: str,
+    ) -> Iterator[AdmissionCacheHandle]:
+        descriptor = format_descriptor(kv_format)
+        if descriptor.family not in {"mxint", "mxfp", "bf16"}:
+            raise ValueError(f"unsupported KV format {kv_format!r}")
+        if kv_format == "BF16" and any(
+            entry.profile.kind != PROFILE_KIND_BF16_REFERENCE
+            for entry in self.context.stage_manifest.entries
+            if entry.profile.kv_format == kv_format
+        ):
+            raise ValueError("only the BF16 reference may use BF16 KV")
+        if (
+            self.executor_config.get("artifact_policy")
+            == "content_addressed_recompute_per_format"
+        ):
+            runtime_parent = self.admission_root / ".runtime"
+            runtime_parent.mkdir(parents=True, exist_ok=True)
+            runtime_root = Path(
+                tempfile.mkdtemp(
+                    prefix=f"{kv_format.lower()}-",
+                    dir=runtime_parent,
+                )
+            )
+            provenance = self._admission_provenance(kv_format, kv_format)
+            paths: dict[str, Path] = {}
+            try:
+                for sample in self.samples:
+                    path, artifact, _ = self._load_or_create_admitted(
+                        sample,
+                        kv_format,
+                        kv_format,
+                        provenance,
+                        artifact_root=runtime_root,
+                    )
+                    record = self.admission_records[(kv_format, sample.document_id)]
+                    if (
+                        artifact.artifact_id != record.get("artifact_id")
+                        or artifact.source_artifact_id
+                        != record.get("source_artifact_id")
+                        or _artifact_bytes(artifact)
+                        != int(record.get("payload_bytes", -1))
+                        or _directory_bytes(path)
+                        != int(record.get("persisted_bytes", -1))
+                    ):
+                        raise ValueError(
+                            "recomputed admission differs from its content identity"
+                        )
+                    paths[sample.document_id] = path
+                yield AdmissionCacheHandle(
+                    kv_format=kv_format,
+                    paths=paths,
+                )
+            finally:
+                self.cache_lru.clear()
+                shutil.rmtree(runtime_root, ignore_errors=True)
+            return
+        paths = {
+            sample.document_id: self.admission_paths[(kv_format, sample.document_id)]
+            for sample in self.samples
+        }
+        yield AdmissionCacheHandle(kv_format=kv_format, paths=paths)
+
+    @contextmanager
+    def open_split_kv_admission_cache(
+        self,
+        key_format: str,
+        value_format: str,
+    ) -> Iterator[AdmissionCacheHandle]:
+        """Open cached prompt admissions for one refinement K/V pair."""
+
+        for role, token in (("key", key_format), ("value", value_format)):
+            if format_descriptor(token).family not in {"mxint", "mxfp"}:
+                raise ValueError(f"unsupported {role} cache format {token!r}")
+        provenance = self._admission_provenance(key_format, value_format)
+        if (
+            self.executor_config.get("artifact_policy")
+            == "content_addressed_recompute_per_format"
+        ):
+            runtime_parent = self.admission_root / ".runtime"
+            runtime_parent.mkdir(parents=True, exist_ok=True)
+            runtime_root = Path(
+                tempfile.mkdtemp(
+                    prefix=f"k-{key_format.lower()}-v-{value_format.lower()}-",
+                    dir=runtime_parent,
+                )
+            )
+            try:
+                paths = {
+                    sample.document_id: self._load_or_create_admitted(
+                        sample,
+                        key_format,
+                        value_format,
+                        provenance,
+                        artifact_root=runtime_root,
+                    )[0]
+                    for sample in self.samples
+                }
+                yield AdmissionCacheHandle(
+                    kv_format=key_format,
+                    value_format=value_format,
+                    paths=paths,
+                )
+            finally:
+                self.cache_lru.clear()
+                shutil.rmtree(runtime_root, ignore_errors=True)
+            return
+        paths = {
+            sample.document_id: self._ensure_admitted(
+                sample,
+                key_format,
+                value_format,
+                provenance,
+            )
+            for sample in self.samples
+        }
+        yield AdmissionCacheHandle(
+            kv_format=key_format,
+            value_format=value_format,
+            paths=paths,
+        )
+
+    def _bind_profile(
+        self,
+        weight_bank: DecodeWeightBank,
+        profile: DecodePrecisionProfile,
+    ) -> BindingMeasurement:
+        return self._bind_precision_spec(
+            weight_bank,
+            profile_to_decode_quant_spec(profile),
+        )
+
+    def bind_refinement_profile(
+        self,
+        weight_bank: DecodeWeightBank,
+        profile: Any,
+    ) -> BindingMeasurement:
+        """Rebind one refinement profile without requantizing weights."""
+
+        from decode_dse.software.refinement_schedule import (
+            DecodeRefinementProfile,
+            refinement_profile_to_decode_quant_spec,
+        )
+
+        if not isinstance(profile, DecodeRefinementProfile):
+            raise TypeError("profile must be a DecodeRefinementProfile")
+        if profile.weight_format != weight_bank.weight_format:
+            raise ValueError("refinement profile does not match the weight bank")
+        if profile.weight_method != weight_bank.weight_method:
+            raise ValueError(
+                "refinement weight method does not match the open weight bank"
+            )
+        return self._bind_precision_spec(
+            weight_bank,
+            refinement_profile_to_decode_quant_spec(profile),
+        )
+
+    def _bind_precision_spec(
+        self,
+        weight_bank: DecodeWeightBank,
+        spec: Any | None,
+    ) -> BindingMeasurement:
+        identity_before = weight_bank.identity_guard.verify(weight_bank.model)
+        quantization_before = weight_bank.quantization_guard.verify()
+        started = time.perf_counter()
+        if spec is None:
+            identity_after = weight_bank.identity_guard.verify(weight_bank.model)
+            quantization_after = weight_bank.quantization_guard.verify()
+            return BindingMeasurement(
+                performed=False,
+                seconds=time.perf_counter() - started,
+                target_count=0,
+                used_cached_targets=True,
+                weight_requantizations=(quantization_after - quantization_before),
+                sealed_weight_modules=len(weight_bank.quantization_guard.modules),
+                weight_quantization_events_before=quantization_before,
+                weight_quantization_events_after=quantization_after,
+                identity_before=identity_before,
+                identity_after=identity_after,
+                structure_fingerprint=(
+                    weight_bank.identity_guard.structure_fingerprint
+                ),
+            )
+        from chop.nn.quantized.functional.vector import VectorRoundingPolicy
+        from chop.nn.quantized.modules.llama.rms_norm import (
+            build_vector_phase_policies,
+        )
+        from chop.nn.quantized.modules.phase_config import (
+            normalize_phase_q_config,
+            resolve_module_phase_config,
+        )
+        from chop.nn.quantized.modules.llama import (
+            LlamaAttentionMXFP,
+            LlamaAttentionMXInt,
+        )
+        from chop.nn.quantized.modules.qwen3 import (
+            Qwen3AttentionMXFP,
+            Qwen3AttentionMXInt,
+        )
+        from decode_dse.software.precision_bindings import build_decode_pass_args
+
+        pass_args = build_decode_pass_args(
+            str(self.config["model_name"]),
+            self.device,
+            spec,
+        )
+        resolved = weight_bank.binding_plan.resolve(pass_args)
+        for target, config in resolved:
+            module = target.module
+            phase = normalize_phase_q_config(config)
+            decode = resolve_module_phase_config(phase, "decode")
+
+            if hasattr(module, "_init_phase_state"):
+                module._init_phase_state(config)
+            elif hasattr(module, "_init_phase_attention_config"):
+                attention_classes = {
+                    ("llama", "mxint"): LlamaAttentionMXInt,
+                    ("llama", "mxfp"): LlamaAttentionMXFP,
+                    ("qwen3", "mxint"): Qwen3AttentionMXInt,
+                    ("qwen3", "mxfp"): Qwen3AttentionMXFP,
+                }
+                attention_class = attention_classes[(self.model_family, spec.act_fmt)]
+                if module.__class__ is not attention_class:
+                    module.__class__ = attention_class
+                module._init_phase_attention_config(config)
+            elif hasattr(module, "_init_phase_mlp_config"):
+                module._init_phase_mlp_config(
+                    getattr(module, "layer_idx", None),
+                    config,
+                )
+            elif hasattr(module, "_phase_policies") and hasattr(
+                module, "variance_epsilon"
+            ):
+                module.q_config = config
+                module.phase_q_config = phase
+                module.decode_policy = phase["decode_policy"]
+                module._phase_policies = {
+                    key: build_vector_phase_policies(
+                        resolve_module_phase_config(phase, key)
+                    )
+                    for key in ("prefill", "decode")
+                }
+                module.bypass = decode.get("bypass", False)
+            elif hasattr(module, "_phase_policies"):
+                module.q_config = config
+                module.phase_q_config = phase
+                module.decode_policy = phase["decode_policy"]
+                module._phase_policies = {
+                    key: VectorRoundingPolicy.from_config(
+                        resolve_module_phase_config(phase, key)
+                    )
+                    for key in ("prefill", "decode")
+                }
+                module.bypass = not module._phase_policies["decode"].enabled
+            else:
+                raise RuntimeError(
+                    f"cannot bind decode precision to module {target.name}"
+                )
+        identity_after = weight_bank.identity_guard.verify(weight_bank.model)
+        quantization_after = weight_bank.quantization_guard.verify()
+        return BindingMeasurement(
+            performed=True,
+            seconds=time.perf_counter() - started,
+            target_count=len(resolved),
+            used_cached_targets=True,
+            weight_requantizations=(quantization_after - quantization_before),
+            sealed_weight_modules=len(weight_bank.quantization_guard.modules),
+            weight_quantization_events_before=quantization_before,
+            weight_quantization_events_after=quantization_after,
+            identity_before=identity_before,
+            identity_after=identity_after,
+            structure_fingerprint=(weight_bank.identity_guard.structure_fingerprint),
+        )
+
+    def _validity_for(self, entry: SweepManifestEntry) -> StackValidity:
+        measured = self.stack_validity.get(entry.profile_id, entry.validity)
+        return constrain_stack_validity(
+            entry.profile,
+            merge_stack_validity(
+                measured,
+                StackValidity(software_valid=True),
+            ),
+        )
+
+    def evaluate(
+        self,
+        entry: SweepManifestEntry,
+        *,
+        weight_bank: DecodeWeightBank,
+        kv_admission_cache: AdmissionCacheHandle,
+    ) -> EvaluationOutcome:
+        import torch
+
+        if entry.profile.weight_format != weight_bank.weight_format:
+            raise ValueError("profile does not match the open weight bank")
+        if entry.profile.kv_format != kv_admission_cache.kv_format:
+            raise ValueError("profile does not match the admitted KV cache")
+        self._native_append_validation_calls = 0
+        self._native_append_tensor_checks = 0
+        self._native_append_quantized_tensor_checks = 0
+        self._native_append_validation_seconds = 0.0
+        binding = self._bind_profile(weight_bank, entry.profile)
+        cuda_device = weight_bank.device if weight_bank.device.type == "cuda" else None
+        if cuda_device is not None:
+            torch.cuda.reset_peak_memory_stats(cuda_device)
+
+        from chop.nn.quantized.modules.phase_context import force_runtime_phase
+
+        backend = TorchHFCachedDecodeBackend(
+            device=weight_bank.device,
+            append_validator=(
+                self._validate_native_append if self.deep_append_validation else None
+            ),
+            native_append_format=True,
+        )
+        documents = []
+        steps = self.context.sample_contract.decode_steps
+        with force_runtime_phase("decode"):
+            for offset in range(0, len(self.samples), self.decode_microbatch_size):
+                batch_samples = self.samples[
+                    offset : offset + self.decode_microbatch_size
+                ]
+                examples = []
+                for sample in batch_samples:
+                    prefill = load_prefill_artifact(
+                        _prefill_path(self.prefill_root, sample.document_id)
+                    )
+                    admitted = self.cache_lru.get(
+                        kv_admission_cache.paths[sample.document_id]
+                    )
+                    first_token = prefill.first_token.token_ids[0]
+                    examples.append(
+                        ContinuationExample(
+                            document_id=sample.document_id,
+                            prefill=prefill,
+                            decode_cache=admitted,
+                            continuation_ids=(
+                                first_token,
+                                *sample.decode_target_ids[:steps],
+                            ),
+                        )
+                    )
+                documents.extend(
+                    evaluate_teacher_forced_cached_batched(
+                        weight_bank.model,
+                        examples,
+                        backend,
+                    )
+                )
+                del examples
+
+        expected_append_calls = (
+            math.ceil(len(self.samples) / self.decode_microbatch_size) * steps
+            if self.deep_append_validation
+            else 0
+        )
+        expected_tensor_checks = (
+            expected_append_calls
+            * int(self.model_architecture["num_hidden_layers"])
+            * 2
+        )
+        expected_quantized_tensor_checks = (
+            0
+            if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+            else expected_tensor_checks
+        )
+        observed_append_validation = (
+            self._native_append_validation_calls,
+            self._native_append_tensor_checks,
+            self._native_append_quantized_tensor_checks,
+        )
+        expected_append_validation = (
+            expected_append_calls,
+            expected_tensor_checks,
+            expected_quantized_tensor_checks,
+        )
+        if observed_append_validation != expected_append_validation:
+            raise AssertionError(
+                "native append oracle coverage differs from the stage contract"
+            )
+
+        nll_sum = sum(document.nll_sum for document in documents)
+        token_count = sum(document.token_count for document in documents)
+        if token_count != len(self.samples) * steps:
+            raise AssertionError("decode token count differs from the stage contract")
+        cluster_by_document = {
+            sample.document_id: sample.source_cluster_id for sample in self.samples
+        }
+        weight_bank.identity_guard.verify(weight_bank.model)
+        weight_bank.quantization_guard.verify()
+        current_runtime = self._capture_current_runtime_environment()
+        mean_nll = nll_sum / token_count
+        perplexity = (
+            math.exp(mean_nll) if mean_nll <= math.log(sys.float_info.max) else None
+        )
+        gpu_memory = None
+        runtime_environment = {
+            **dict(current_runtime.logical),
+            **dict(current_runtime.observation),
+            "logical_fingerprint": (current_runtime.logical_fingerprint),
+            "mase_tree_sha256": _mase_tree_hash(
+                _repository_root(),
+                self.config,
+            ),
+        }
+        if cuda_device is not None:
+            properties = torch.cuda.get_device_properties(cuda_device)
+            total_bytes = int(properties.total_memory)
+            peak_allocated = int(torch.cuda.max_memory_allocated(cuda_device))
+            peak_reserved = int(torch.cuda.max_memory_reserved(cuda_device))
+            gpu_memory = {
+                "microbatch_size": self.decode_microbatch_size,
+                "peak_allocated_bytes": peak_allocated,
+                "peak_reserved_bytes": peak_reserved,
+                "total_device_bytes": total_bytes,
+                "peak_reserved_fraction": peak_reserved / total_bytes,
+            }
+            runtime_environment.update(
+                {
+                    "device_name": str(properties.name),
+                    "device_uuid": str(getattr(properties, "uuid", "unavailable")),
+                }
+            )
+        metrics = {
+            "nll_sum": nll_sum,
+            "token_count": token_count,
+            "mean_nll": mean_nll,
+            "mean_token_nll": mean_nll,
+            "post_handoff_greedy_conditioned_nll": mean_nll,
+            "post_handoff_greedy_conditioned_exp_nll": perplexity,
+            "metric_id": "post_handoff_greedy_conditioned_nll/v1",
+            "metric_definition": (
+                "prefill-greedy handoff token is unscored; subsequent "
+                "dataset tokens use cached q_len=1 teacher forcing"
+            ),
+            "runtime_rebinding": binding.to_dict(),
+            "native_append_validation": {
+                "mode": (
+                    "deep_oracle" if self.deep_append_validation else "preflight_gated"
+                ),
+                "deep_oracle_enabled": self.deep_append_validation,
+                "calls": self._native_append_validation_calls,
+                "expected_calls": expected_append_calls,
+                "tensor_checks": self._native_append_tensor_checks,
+                "expected_tensor_checks": expected_tensor_checks,
+                "quantized_tensor_checks": (
+                    self._native_append_quantized_tensor_checks
+                ),
+                "expected_quantized_tensor_checks": (expected_quantized_tensor_checks),
+                "oracle_seconds": self._native_append_validation_seconds,
+                "q_len": 1,
+                "layout_id": self.layout_id,
+            },
+            "admission_accounting": {
+                "prepared_before_profile_execution": True,
+                "included_in_steady_state_decode_runtime": False,
+                "preparation_receipt": str(
+                    self.context.workspace_root / "admission_preparation.json"
+                ),
+            },
+            "decode_microbatch": {
+                "configured_size": self.decode_microbatch_size,
+                "independent_cache_count": len(self.samples),
+                "equal_length_required": True,
+            },
+            "gpu_memory": gpu_memory,
+            "runtime_environment": runtime_environment,
+            "weight_bank": {
+                "weight_format": weight_bank.weight_format,
+                "weight_method": weight_bank.weight_method,
+                "build_seconds": weight_bank.build_seconds,
+                "parameter_count": len(weight_bank.identity_guard.parameters),
+                "identity_fingerprint": weight_bank.identity_guard.fingerprint,
+                "structure_fingerprint": (
+                    weight_bank.identity_guard.structure_fingerprint
+                ),
+            },
+            "sample_contract": self.context.sample_contract.to_dict(),
+            "source_cluster_count": len(set(cluster_by_document.values())),
+            "documents": [
+                {
+                    "document_id": document.document_id,
+                    "source_cluster_id": cluster_by_document[document.document_id],
+                    "nll_sum": document.nll_sum,
+                    "token_count": document.token_count,
+                    "mean_token_nll": document.mean_nll,
+                    "first_token_id": document.first_token_id,
+                    "initial_cache_length": document.initial_cache_length,
+                    "final_cache_length": document.final_cache_length,
+                }
+                for document in documents
+            ],
+        }
+        return EvaluationOutcome(
+            metrics=metrics,
+            validity=self._validity_for(entry),
+            artifacts=(
+                str(self.sample_bundle_path),
+                str(self.prefill_root / "index.json"),
+                str(self.admission_index_path),
+                str(self.context.workspace_root / "admission_preparation.json"),
+            ),
+        )
+
+
+def create_executor(context: ExecutorContext) -> DecodeEvaluator:
+    """Build the configured dense-decoder exhaustive executor."""
+
+    return DecodeEvaluator(context)
+
+
+__all__ = [
+    "AdmissionCacheHandle",
+    "ADMISSION_INDEX_SCHEMA",
+    "ADMISSION_PREPARATION_SCHEMA",
+    "BindingMeasurement",
+    "DecodeBindingPlan",
+    "DecodeBindingTarget",
+    "DecodeWeightBank",
+    "DecodeWeightBankIdentity",
+    "MaseMXCacheConverter",
+    "PACKED_CACHE_LAYOUT",
+    "DecodeEvaluator",
+    "WeightParameterIdentity",
+    "build_decode_binding_plan",
+    "create_executor",
+]
diff --git a/decode_dse/software/gpu_baseline.py b/decode_dse/software/gpu_baseline.py
new file mode 100644
index 0000000..838f79d
--- /dev/null
+++ b/decode_dse/software/gpu_baseline.py
@@ -0,0 +1,3366 @@
+"""Measured BF16 GPU decode baseline with raw, provenance-bound samples."""
+
+from __future__ import annotations
+
+import argparse
+import csv
+import gc
+import hashlib
+import importlib
+import importlib.metadata
+import json
+import math
+import random
+import statistics
+import subprocess
+import sys
+import threading
+import time
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+
+from decode_dse.software.token_samples import (
+    TokenSampleBundle,
+    load_sample_bundle,
+)
+from decode_dse.software.runtime_environment import (
+    RuntimeEnvironment,
+    capture_runtime_environment,
+)
+from decode_dse.software.sweep_plan import (
+    HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    load_immutable_json,
+    write_immutable_json,
+)
+
+GPU_BASELINE_CONTRACT_SCHEMA = "decode-gpu-baseline-contract"
+GPU_BASELINE_RESULT_SCHEMA = "decode-gpu-baseline-result"
+GPU_BASELINE_REPORT_SCHEMA = "decode-gpu-baseline-report"
+GPU_BASELINE_STAGE_RECEIPT_SCHEMA = "decode-gpu-baseline-stage-receipt"
+GPU_BASELINE_WORKSPACE_BINDING_SCHEMA = "decode-gpu-baseline-workspace-binding"
+GPU_ENERGY_MEASUREMENT_SCHEMA = "decode-gpu-energy-measurement"
+ENERGY_EVIDENCE_SCHEMA = "decode-energy-evidence"
+ENERGY_COMPARISON_SCHEMA = "decode-energy-comparison"
+THROUGHPUT_EVIDENCE_SCHEMA = "decode-throughput-evidence"
+THROUGHPUT_COMPARISON_SCHEMA = "decode-throughput-comparison"
+GPU_BASELINE_SCOPE = "bf16_aggregated_gpu_cached_q1"
+GPU_BASELINE_ENERGY_SOURCE = "bf16_aggregated_gpu_cached_q1_measured_board_energy"
+GPU_BASELINE_EXECUTION_MODE = "hf_uncompiled_dynamic_cache"
+GPU_BASELINE_TIMING_SCOPE = (
+    "cuda_event_causal_lm_forward_with_bf16_head_and_greedy_selection"
+)
+GPU_BASELINE_ENERGY_SCOPE = (
+    "synchronized_board_energy_for_measured_decode_only_excluding_warmup"
+)
+# Every decode step visits a cache length the process has not executed before,
+# so the first pass through the shape sequence pays per-shape kernel selection.
+# One discarded warmup repetition replays the identical sequence; the measured
+# repetitions must then agree within this fraction of their median.
+GPU_BASELINE_REPETITION_SPREAD_LIMIT = 0.10
+NVML_TOTAL_ENERGY_METHOD = "nvml_total_energy_counter"
+NVML_POWER_TRACE_METHOD = "nvml_power_trace_trapezoidal"
+ENERGY_UNAVAILABLE_METHOD = "unavailable"
+GPU_BASELINE_ENERGY_METER_PRIORITY = (
+    NVML_TOTAL_ENERGY_METHOD,
+    NVML_POWER_TRACE_METHOD,
+)
+NVIDIA_SMI_QUERY_FIELDS = (
+    "timestamp",
+    "driver_version",
+    "name",
+    "uuid",
+    "pci.bus_id",
+    "pstate",
+    "memory.total",
+    "memory.used",
+    "temperature.gpu",
+    "power.draw",
+    "power.limit",
+    "clocks.current.graphics",
+    "clocks.current.sm",
+    "clocks.current.memory",
+    "mig.mode.current",
+)
+SWEEP_PROVENANCE_SCHEMA = "decode-sweep-provenance"
+MEASURED_EVIDENCE_TIER = "measured"
+PEAK_ROOFLINE_EVIDENCE_TIER = "peak_roofline"
+
+
+def _canonical_hash(value: Any) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _sha256_file(path: str | Path) -> str:
+    digest = hashlib.sha256()
+    with Path(path).open("rb") as handle:
+        while block := handle.read(1 << 20):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _require_sha256(value: str, label: str) -> None:
+    if len(value) != 64 or any(
+        character not in "0123456789abcdef" for character in value
+    ):
+        raise ValueError(f"{label} must be a lowercase SHA-256")
+
+
+def _require_git_commit(value: str, label: str) -> None:
+    if len(value) != 40 or any(
+        character not in "0123456789abcdef" for character in value
+    ):
+        raise ValueError(f"{label} must be a pinned lowercase Git commit")
+
+
+def _require_positive_int(value: Any, label: str) -> int:
+    if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+        raise ValueError(f"{label} must be a positive integer")
+    return value
+
+
+def _require_nonnegative_finite(value: Any, label: str) -> float:
+    if (
+        isinstance(value, bool)
+        or not isinstance(value, (int, float))
+        or not math.isfinite(value)
+        or value < 0
+    ):
+        raise ValueError(f"{label} must be finite and non-negative")
+    return float(value)
+
+
+def _require_utc_timestamp(value: str, label: str) -> None:
+    if not value or not value.endswith("Z"):
+        raise ValueError(f"{label} must be an ISO-8601 UTC timestamp")
+    try:
+        parsed = datetime.fromisoformat(f"{value[:-1]}+00:00")
+    except ValueError as exc:
+        raise ValueError(
+            f"{label} must be an ISO-8601 UTC timestamp"
+        ) from exc
+    if parsed.utcoffset() != timezone.utc.utcoffset(parsed):
+        raise ValueError(f"{label} must be an ISO-8601 UTC timestamp")
+
+
+def _normalized_label(value: str) -> str:
+    return value.lower().replace("-", "").replace("_", "").replace(" ", "")
+
+
+def _source_tree_hash() -> str:
+    root = Path(__file__).resolve().parents[2]
+    digest = hashlib.sha256()
+    for path in sorted((root / "decode_dse").rglob("*")):
+        if (
+            not path.is_file()
+            or "__pycache__" in path.parts
+            or path.suffix not in {".py", ".json", ".md"}
+        ):
+            continue
+        relative = path.relative_to(root).as_posix().encode("utf-8")
+        payload = path.read_bytes()
+        digest.update(len(relative).to_bytes(8, "little"))
+        digest.update(relative)
+        digest.update(len(payload).to_bytes(8, "little"))
+        digest.update(payload)
+    return digest.hexdigest()
+
+
+def _percentile(values: Sequence[float], quantile: float) -> float:
+    ordered = tuple(sorted(float(value) for value in values))
+    if not ordered:
+        raise ValueError("percentile requires at least one sample")
+    if not 0 <= quantile <= 1:
+        raise ValueError("quantile must be in [0, 1]")
+    rank = quantile * (len(ordered) - 1)
+    lower = int(math.floor(rank))
+    upper = int(math.ceil(rank))
+    if lower == upper:
+        return ordered[lower]
+    weight = rank - lower
+    return ordered[lower] * (1 - weight) + ordered[upper] * weight
+
+
+@dataclass(frozen=True)
+class GPUBaselineWorkspaceBinding:
+    """Hashes that bind the measured baseline to one immutable sweep workspace."""
+
+    manifest_hash: str
+    run_plan_hash: str
+    prompt_manifest_hash: str
+    sweep_provenance_sha256: str
+    schema_version: str = GPU_BASELINE_WORKSPACE_BINDING_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != GPU_BASELINE_WORKSPACE_BINDING_SCHEMA:
+            raise ValueError("unsupported GPU baseline workspace-binding schema")
+        for label in (
+            "manifest_hash",
+            "run_plan_hash",
+            "prompt_manifest_hash",
+            "sweep_provenance_sha256",
+        ):
+            _require_sha256(str(getattr(self, label)), label)
+
+    def _body(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "manifest_hash": self.manifest_hash,
+            "run_plan_hash": self.run_plan_hash,
+            "prompt_manifest_hash": self.prompt_manifest_hash,
+            "sweep_provenance_sha256": self.sweep_provenance_sha256,
+        }
+
+    @property
+    def binding_hash(self) -> str:
+        return _canonical_hash(self._body())
+
+    def to_dict(self) -> dict[str, Any]:
+        return {**self._body(), "binding_hash": self.binding_hash}
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "GPUBaselineWorkspaceBinding":
+        binding = cls(
+            schema_version=str(value["schema_version"]),
+            manifest_hash=str(value["manifest_hash"]),
+            run_plan_hash=str(value["run_plan_hash"]),
+            prompt_manifest_hash=str(value["prompt_manifest_hash"]),
+            sweep_provenance_sha256=str(value["sweep_provenance_sha256"]),
+        )
+        if value.get("binding_hash") != binding.binding_hash:
+            raise ValueError("GPU baseline workspace-binding hash mismatch")
+        return binding
+
+
+def load_gpu_baseline_workspace_binding(
+    provenance_path: str | Path,
+    bundle: TokenSampleBundle,
+) -> GPUBaselineWorkspaceBinding:
+    """Bind a baseline to the validated sweep provenance and prompt identity."""
+
+    path = Path(provenance_path).resolve()
+    provenance = load_immutable_json(path)
+    if provenance.get("schema_version") != SWEEP_PROVENANCE_SCHEMA:
+        raise ValueError("GPU baseline requires sweep workspace provenance")
+    prompt_manifest_hash = bundle.prompt_manifest().canonical_hash
+    if provenance.get("prompt_manifest_hash") != prompt_manifest_hash:
+        raise ValueError("GPU baseline prompts differ from sweep provenance")
+    model = provenance.get("model")
+    if (
+        not isinstance(model, Mapping)
+        or model.get("revision") != bundle.model_revision
+        or model.get("tokenizer_revision") != bundle.tokenizer_revision
+    ):
+        raise ValueError("GPU baseline model differs from sweep provenance")
+    return GPUBaselineWorkspaceBinding(
+        manifest_hash=str(provenance.get("manifest_hash", "")),
+        run_plan_hash=str(provenance.get("run_plan_hash", "")),
+        prompt_manifest_hash=prompt_manifest_hash,
+        sweep_provenance_sha256=_sha256_file(path),
+    )
+
+
+@dataclass(frozen=True)
+class GPUBaselinePrompt:
+    """One fixed prompt available to every measured device."""
+
+    document_id: str
+    prompt_hash: str
+    token_count: int
+
+    def __post_init__(self) -> None:
+        if not self.document_id:
+            raise ValueError("baseline document_id must be non-empty")
+        _require_sha256(self.prompt_hash, "prompt_hash")
+        _require_positive_int(self.token_count, "token_count")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "document_id": self.document_id,
+            "prompt_hash": self.prompt_hash,
+            "token_count": self.token_count,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUBaselinePrompt":
+        return cls(
+            document_id=str(value["document_id"]),
+            prompt_hash=str(value["prompt_hash"]),
+            token_count=int(value["token_count"]),
+        )
+
+
+@dataclass(frozen=True)
+class GPUBaselineContract:
+    """Immutable workload and execution policy shared across GPU runs."""
+
+    model_name: str
+    model_revision: str
+    tokenizer_revision: str
+    sample_bundle_hash: str
+    workspace_binding: GPUBaselineWorkspaceBinding
+    prompts: tuple[GPUBaselinePrompt, ...]
+    attention_implementation: str
+    warmup_steps: int
+    measured_steps: int
+    repetitions: int
+    planned_device_labels: tuple[str, ...]
+    planned_batch_sizes: tuple[int, ...]
+    seed: int
+    source_tree_sha256: str
+    energy_meter_priority: tuple[str, ...] = GPU_BASELINE_ENERGY_METER_PRIORITY
+    power_trace_sample_interval_ms: int = 10
+    precision: str = "BF16"
+    q_len: int = 1
+    first_token_owner: str = "prefill"
+    prefill_logits_to_keep: int = 1
+    execution_mode: str = GPU_BASELINE_EXECUTION_MODE
+    timing_scope: str = GPU_BASELINE_TIMING_SCOPE
+    energy_scope: str = GPU_BASELINE_ENERGY_SCOPE
+    require_mig_disabled: bool = True
+    scope: str = GPU_BASELINE_SCOPE
+    schema_version: str = GPU_BASELINE_CONTRACT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != GPU_BASELINE_CONTRACT_SCHEMA:
+            raise ValueError("unsupported GPU baseline contract schema")
+        if not self.model_name or not self.model_revision:
+            raise ValueError("baseline model identity must be pinned")
+        if not self.tokenizer_revision:
+            raise ValueError("baseline tokenizer revision must be pinned")
+        _require_git_commit(self.model_revision, "model_revision")
+        _require_git_commit(self.tokenizer_revision, "tokenizer_revision")
+        _require_sha256(self.sample_bundle_hash, "sample_bundle_hash")
+        if not isinstance(self.workspace_binding, GPUBaselineWorkspaceBinding):
+            raise TypeError("GPU baseline requires an immutable workspace binding")
+        _require_sha256(self.source_tree_sha256, "source_tree_sha256")
+        if self.precision != "BF16":
+            raise ValueError("the measured GPU reference must use BF16")
+        if self.q_len != 1 or self.first_token_owner != "prefill":
+            raise ValueError("baseline must use the split cached-q1 boundary")
+        if self.scope != GPU_BASELINE_SCOPE:
+            raise ValueError("unsupported GPU baseline scope")
+        if self.attention_implementation != "sdpa":
+            raise ValueError("GPU baseline attention implementation must be sdpa")
+        if self.energy_meter_priority != GPU_BASELINE_ENERGY_METER_PRIORITY:
+            raise ValueError("GPU baseline energy-meter priority is not canonical")
+        if (
+            isinstance(self.power_trace_sample_interval_ms, bool)
+            or not isinstance(self.power_trace_sample_interval_ms, int)
+            or not 1 <= self.power_trace_sample_interval_ms <= 1000
+        ):
+            raise ValueError("power-trace sample interval must be in [1, 1000] ms")
+        _require_positive_int(self.warmup_steps, "warmup_steps")
+        _require_positive_int(self.measured_steps, "measured_steps")
+        _require_positive_int(self.repetitions, "repetitions")
+        if self.repetitions < 3:
+            raise ValueError("GPU baselines require at least three repetitions")
+        if isinstance(self.seed, bool) or not isinstance(self.seed, int):
+            raise ValueError("GPU baseline seed must be an integer")
+        if self.seed < 0:
+            raise ValueError("GPU baseline seed must be non-negative")
+        labels = tuple(self.planned_device_labels)
+        if not labels or any(not _normalized_label(label) for label in labels):
+            raise ValueError("GPU baseline requires planned device labels")
+        normalized_labels = tuple(_normalized_label(label) for label in labels)
+        if len(normalized_labels) != len(set(normalized_labels)):
+            raise ValueError("planned GPU device labels must be unique")
+        batches = tuple(self.planned_batch_sizes)
+        if not batches:
+            raise ValueError("GPU baseline requires planned batch sizes")
+        for batch_size in batches:
+            _require_positive_int(batch_size, "planned batch size")
+        if batches != tuple(sorted(set(batches))):
+            raise ValueError(
+                "planned GPU batch sizes must be unique and increasing"
+            )
+        if not self.prompts:
+            raise ValueError("GPU baseline contract requires prompts")
+        ids = tuple(prompt.document_id for prompt in self.prompts)
+        if len(ids) != len(set(ids)):
+            raise ValueError("GPU baseline prompt IDs must be unique")
+        lengths = {prompt.token_count for prompt in self.prompts}
+        if len(lengths) != 1:
+            raise ValueError("GPU baseline prompts must have one context length")
+        if batches[-1] > len(self.prompts):
+            raise ValueError(
+                "planned GPU batch size exceeds the contracted prompt set"
+            )
+        if self.prefill_logits_to_keep != 1:
+            raise ValueError("GPU prefill must materialize only final-position logits")
+        if self.execution_mode != GPU_BASELINE_EXECUTION_MODE:
+            raise ValueError("unsupported GPU baseline execution mode")
+        if self.timing_scope != GPU_BASELINE_TIMING_SCOPE:
+            raise ValueError("unsupported GPU baseline timing scope")
+        if self.energy_scope != GPU_BASELINE_ENERGY_SCOPE:
+            raise ValueError("unsupported GPU baseline energy scope")
+        if self.require_mig_disabled is not True:
+            raise ValueError("publication GPU baselines require a full GPU")
+
+    @property
+    def context_length(self) -> int:
+        return self.prompts[0].token_count
+
+    def _body(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "tokenizer_revision": self.tokenizer_revision,
+            "sample_bundle_hash": self.sample_bundle_hash,
+            "workspace_binding": self.workspace_binding.to_dict(),
+            "prompts": [prompt.to_dict() for prompt in self.prompts],
+            "attention_implementation": self.attention_implementation,
+            "warmup_steps": self.warmup_steps,
+            "measured_steps": self.measured_steps,
+            "repetitions": self.repetitions,
+            "planned_device_labels": list(self.planned_device_labels),
+            "planned_batch_sizes": list(self.planned_batch_sizes),
+            "seed": self.seed,
+            "source_tree_sha256": self.source_tree_sha256,
+            "energy_meter_priority": list(self.energy_meter_priority),
+            "power_trace_sample_interval_ms": self.power_trace_sample_interval_ms,
+            "precision": self.precision,
+            "q_len": self.q_len,
+            "first_token_owner": self.first_token_owner,
+            "prefill_logits_to_keep": self.prefill_logits_to_keep,
+            "execution_mode": self.execution_mode,
+            "timing_scope": self.timing_scope,
+            "energy_scope": self.energy_scope,
+            "require_mig_disabled": self.require_mig_disabled,
+            "scope": self.scope,
+        }
+
+    @property
+    def contract_hash(self) -> str:
+        return _canonical_hash(self._body())
+
+    def to_dict(self) -> dict[str, Any]:
+        return {**self._body(), "contract_hash": self.contract_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUBaselineContract":
+        contract = cls(
+            schema_version=str(value["schema_version"]),
+            model_name=str(value["model_name"]),
+            model_revision=str(value["model_revision"]),
+            tokenizer_revision=str(value["tokenizer_revision"]),
+            sample_bundle_hash=str(value["sample_bundle_hash"]),
+            workspace_binding=GPUBaselineWorkspaceBinding.from_dict(
+                value["workspace_binding"]
+            ),
+            prompts=tuple(
+                GPUBaselinePrompt.from_dict(item)
+                for item in value["prompts"]
+            ),
+            attention_implementation=str(value["attention_implementation"]),
+            warmup_steps=int(value["warmup_steps"]),
+            measured_steps=int(value["measured_steps"]),
+            repetitions=int(value["repetitions"]),
+            planned_device_labels=tuple(
+                str(label) for label in value["planned_device_labels"]
+            ),
+            planned_batch_sizes=tuple(
+                int(batch_size) for batch_size in value["planned_batch_sizes"]
+            ),
+            seed=int(value["seed"]),
+            source_tree_sha256=str(value["source_tree_sha256"]),
+            energy_meter_priority=tuple(
+                str(item) for item in value["energy_meter_priority"]
+            ),
+            power_trace_sample_interval_ms=int(
+                value["power_trace_sample_interval_ms"]
+            ),
+            precision=str(value["precision"]),
+            q_len=int(value["q_len"]),
+            first_token_owner=str(value["first_token_owner"]),
+            prefill_logits_to_keep=int(value["prefill_logits_to_keep"]),
+            execution_mode=str(value["execution_mode"]),
+            timing_scope=str(value["timing_scope"]),
+            energy_scope=str(value["energy_scope"]),
+            require_mig_disabled=value["require_mig_disabled"],
+            scope=str(value["scope"]),
+        )
+        if value.get("contract_hash") != contract.contract_hash:
+            raise ValueError("GPU baseline contract hash mismatch")
+        return contract
+
+
+def build_gpu_baseline_contract(
+    config: Mapping[str, Any],
+    bundle: TokenSampleBundle,
+    workspace_binding: GPUBaselineWorkspaceBinding,
+    *,
+    attention_implementation: str,
+    warmup_steps: int,
+    measured_steps: int,
+    repetitions: int,
+    planned_device_labels: Sequence[str],
+    planned_batch_sizes: Sequence[int],
+    energy_meter_priority: Sequence[str],
+    power_trace_sample_interval_ms: int,
+) -> GPUBaselineContract:
+    """Bind the hardware validation prompts and explicit BF16 execution policy."""
+
+    baseline_policy = config.get("gpu_baseline")
+    if not isinstance(baseline_policy, Mapping):
+        raise ValueError("GPU baseline config requires an explicit policy")
+    expected_policy = {
+        "attention_implementation": attention_implementation,
+        "warmup_steps": warmup_steps,
+        "measured_steps": measured_steps,
+        "repetitions": repetitions,
+        "batch_sizes": [int(value) for value in planned_batch_sizes],
+        "precision": "BF16",
+        "q_len": 1,
+        "first_gpu_only": True,
+        "energy_meter_priority": [str(value) for value in energy_meter_priority],
+        "power_trace_sample_interval_ms": power_trace_sample_interval_ms,
+    }
+    if dict(baseline_policy) != expected_policy:
+        raise ValueError("GPU baseline launch policy differs from the config")
+    if bundle.model_revision != str(config["model_revision"]):
+        raise ValueError("baseline sample model revision differs from config")
+    if bundle.tokenizer_revision != str(config["tokenizer_revision"]):
+        raise ValueError("baseline tokenizer revision differs from config")
+    if workspace_binding.prompt_manifest_hash != bundle.prompt_manifest().canonical_hash:
+        raise ValueError("baseline sample bundle differs from its workspace binding")
+    expected_prompts = HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+    expected_prefill = HARDWARE_VALIDATION_SAMPLE_CONTRACT.prefill_tokens
+    if len(bundle.hardware_validation) != expected_prompts:
+        raise ValueError(
+            f"GPU baseline requires the complete {expected_prompts}-prompt "
+            "hardware-validation set"
+        )
+    if any(
+        len(sample.prompt_token_ids) != expected_prefill
+        for sample in bundle.hardware_validation
+    ):
+        raise ValueError(
+            f"GPU baseline requires {expected_prefill}-token "
+            "hardware-validation prompts"
+        )
+    phase = dict(config.get("phase_contract", {}))
+    if (
+        str(config.get("dtype")) != "bfloat16"
+        or bool(config.get("trust_remote_code", False))
+        or phase.get("prefill_precision") != "BF16"
+        or phase.get("decode_query_length") != 1
+        or phase.get("first_token_owner") != "prefill"
+    ):
+        raise ValueError("GPU baseline config violates the BF16 cached-q1 boundary")
+    prompts = tuple(
+        GPUBaselinePrompt(
+            document_id=sample.document_id,
+            prompt_hash=sample.prompt_hash,
+            token_count=len(sample.prompt_token_ids),
+        )
+        for sample in bundle.hardware_validation
+    )
+    return GPUBaselineContract(
+        model_name=str(config["model_name"]),
+        model_revision=bundle.model_revision,
+        tokenizer_revision=bundle.tokenizer_revision,
+        sample_bundle_hash=bundle.canonical_hash,
+        workspace_binding=workspace_binding,
+        prompts=prompts,
+        attention_implementation=attention_implementation,
+        warmup_steps=warmup_steps,
+        measured_steps=measured_steps,
+        repetitions=repetitions,
+        planned_device_labels=tuple(
+            str(value) for value in planned_device_labels
+        ),
+        planned_batch_sizes=tuple(int(value) for value in planned_batch_sizes),
+        energy_meter_priority=tuple(str(value) for value in energy_meter_priority),
+        power_trace_sample_interval_ms=power_trace_sample_interval_ms,
+        seed=int(config.get("seed", 0)),
+        source_tree_sha256=_source_tree_hash(),
+    )
+
+
+@dataclass(frozen=True)
+class GPUHardwareStateSnapshot:
+    """Raw NVIDIA device state captured at one benchmark boundary."""
+
+    phase: str
+    captured_at_utc: str
+    raw_query_line: str
+    raw_query_sha256: str
+    values: tuple[str, ...]
+
+    def __post_init__(self) -> None:
+        repetition_phase = self.phase.split("_")
+        valid_repetition_phase = (
+            len(repetition_phase) == 3
+            and repetition_phase[0] == "repetition"
+            and repetition_phase[1].isdigit()
+            and repetition_phase[2] in {"start", "end"}
+        )
+        if (
+            self.phase != "run_start"
+            and self.phase != "run_end"
+            and not valid_repetition_phase
+        ):
+            raise ValueError("unsupported GPU hardware-state phase")
+        _require_utc_timestamp(self.captured_at_utc, "captured_at_utc")
+        expected_hash = hashlib.sha256(
+            self.raw_query_line.encode("utf-8")
+        ).hexdigest()
+        if self.raw_query_sha256 != expected_hash:
+            raise ValueError("GPU hardware-state raw-query hash mismatch")
+        parsed = tuple(
+            field.strip()
+            for field in next(csv.reader([self.raw_query_line]))
+        )
+        if parsed != self.values:
+            raise ValueError("GPU hardware-state values differ from raw query")
+        if len(self.values) != len(NVIDIA_SMI_QUERY_FIELDS):
+            raise ValueError("GPU hardware-state query has missing fields")
+        if any(not value for value in self.values):
+            raise ValueError("GPU hardware-state fields must be non-empty")
+
+    @property
+    def fields(self) -> Mapping[str, str]:
+        return dict(zip(NVIDIA_SMI_QUERY_FIELDS, self.values))
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "phase": self.phase,
+            "captured_at_utc": self.captured_at_utc,
+            "query_fields": list(NVIDIA_SMI_QUERY_FIELDS),
+            "raw_query_line": self.raw_query_line,
+            "raw_query_sha256": self.raw_query_sha256,
+            "values": list(self.values),
+        }
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "GPUHardwareStateSnapshot":
+        if tuple(value["query_fields"]) != NVIDIA_SMI_QUERY_FIELDS:
+            raise ValueError("GPU hardware-state query fields differ")
+        return cls(
+            phase=str(value["phase"]),
+            captured_at_utc=str(value["captured_at_utc"]),
+            raw_query_line=str(value["raw_query_line"]),
+            raw_query_sha256=str(value["raw_query_sha256"]),
+            values=tuple(str(item) for item in value["values"]),
+        )
+
+
+@dataclass(frozen=True)
+class GPUPowerTraceSample:
+    """One raw NVML board-power sample on the monotonic host clock."""
+
+    timestamp_monotonic_ns: int
+    power_mw: int
+
+    def __post_init__(self) -> None:
+        if (
+            isinstance(self.timestamp_monotonic_ns, bool)
+            or not isinstance(self.timestamp_monotonic_ns, int)
+            or self.timestamp_monotonic_ns <= 0
+        ):
+            raise ValueError("power-trace timestamp must be a positive integer")
+        if (
+            isinstance(self.power_mw, bool)
+            or not isinstance(self.power_mw, int)
+            or self.power_mw <= 0
+        ):
+            raise ValueError("NVML board-power samples must be positive milliwatts")
+
+    def to_dict(self) -> dict[str, int]:
+        return {
+            "timestamp_monotonic_ns": self.timestamp_monotonic_ns,
+            "power_mw": self.power_mw,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUPowerTraceSample":
+        return cls(
+            timestamp_monotonic_ns=int(value["timestamp_monotonic_ns"]),
+            power_mw=int(value["power_mw"]),
+        )
+
+
+def _integrate_power_trace(samples: Sequence[GPUPowerTraceSample]) -> float:
+    if len(samples) < 2:
+        raise ValueError("power-trace integration requires at least two samples")
+    timestamps = tuple(sample.timestamp_monotonic_ns for sample in samples)
+    if any(right <= left for left, right in zip(timestamps, timestamps[1:])):
+        raise ValueError("power-trace timestamps must increase strictly")
+    energy_j = 0.0
+    for left, right in zip(samples, samples[1:]):
+        duration_s = (
+            right.timestamp_monotonic_ns - left.timestamp_monotonic_ns
+        ) / 1_000_000_000.0
+        mean_power_w = (left.power_mw + right.power_mw) / 2000.0
+        energy_j += mean_power_w * duration_s
+    if not math.isfinite(energy_j) or energy_j <= 0:
+        raise ValueError("integrated NVML board energy must be positive")
+    return energy_j
+
+
+@dataclass(frozen=True)
+class GPUDeviceEnergyMeasurement:
+    """Raw board-energy evidence for one device and measured decode region."""
+
+    device_uuid: str
+    meter_method: str
+    measurement_status: str
+    started_at_monotonic_ns: int
+    ended_at_monotonic_ns: int
+    energy_j: float | None
+    counter_start_mj: int | None
+    counter_end_mj: int | None
+    power_trace: tuple[GPUPowerTraceSample, ...]
+    requested_power_sample_interval_ms: int
+    unavailable_reason: str | None
+    scope: str = GPU_BASELINE_ENERGY_SCOPE
+    schema_version: str = GPU_ENERGY_MEASUREMENT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != GPU_ENERGY_MEASUREMENT_SCHEMA:
+            raise ValueError("unsupported GPU energy-measurement schema")
+        if not self.device_uuid or self.device_uuid.lower() == "unavailable":
+            raise ValueError("GPU energy measurement requires a device UUID")
+        if self.meter_method not in {
+            *GPU_BASELINE_ENERGY_METER_PRIORITY,
+            ENERGY_UNAVAILABLE_METHOD,
+        }:
+            raise ValueError("unsupported GPU board-energy meter")
+        if self.measurement_status not in {"measured", "unavailable"}:
+            raise ValueError("unsupported GPU energy-measurement status")
+        if self.scope != GPU_BASELINE_ENERGY_SCOPE:
+            raise ValueError("unsupported GPU energy-measurement scope")
+        if (
+            isinstance(self.started_at_monotonic_ns, bool)
+            or isinstance(self.ended_at_monotonic_ns, bool)
+            or not isinstance(self.started_at_monotonic_ns, int)
+            or not isinstance(self.ended_at_monotonic_ns, int)
+            or self.started_at_monotonic_ns <= 0
+            or self.ended_at_monotonic_ns <= self.started_at_monotonic_ns
+        ):
+            raise ValueError("GPU energy interval must increase on the monotonic clock")
+        if (
+            isinstance(self.requested_power_sample_interval_ms, bool)
+            or not isinstance(self.requested_power_sample_interval_ms, int)
+            or not 1 <= self.requested_power_sample_interval_ms <= 1000
+        ):
+            raise ValueError("power sample interval must be in [1, 1000] ms")
+        if self.measurement_status == "unavailable":
+            if self.energy_j is not None or not self.unavailable_reason:
+                raise ValueError("unavailable energy requires a reason and no joule claim")
+            if (
+                self.counter_start_mj is not None
+                or self.counter_end_mj is not None
+                or self.power_trace
+            ):
+                raise ValueError("unavailable energy cannot retain partial measurements")
+            return
+        if self.unavailable_reason is not None or self.energy_j is None:
+            raise ValueError("measured energy requires joules and no unavailable reason")
+        energy_j = _require_nonnegative_finite(self.energy_j, "energy_j")
+        if energy_j <= 0:
+            raise ValueError("measured board energy must be positive")
+        if self.meter_method == NVML_TOTAL_ENERGY_METHOD:
+            if (
+                isinstance(self.counter_start_mj, bool)
+                or isinstance(self.counter_end_mj, bool)
+                or not isinstance(self.counter_start_mj, int)
+                or not isinstance(self.counter_end_mj, int)
+                or self.counter_start_mj < 0
+                or self.counter_end_mj <= self.counter_start_mj
+                or self.power_trace
+            ):
+                raise ValueError("invalid cumulative NVML energy-counter evidence")
+            expected_j = (self.counter_end_mj - self.counter_start_mj) / 1000.0
+        elif self.meter_method == NVML_POWER_TRACE_METHOD:
+            if self.counter_start_mj is not None or self.counter_end_mj is not None:
+                raise ValueError("NVML power traces cannot contain energy counters")
+            expected_j = _integrate_power_trace(self.power_trace)
+            if (
+                self.power_trace[0].timestamp_monotonic_ns
+                < self.started_at_monotonic_ns
+                or self.power_trace[-1].timestamp_monotonic_ns
+                > self.ended_at_monotonic_ns
+            ):
+                raise ValueError("NVML power samples fall outside the measured interval")
+        else:
+            raise ValueError("unavailable meter cannot claim measured energy")
+        if not math.isclose(energy_j, expected_j, rel_tol=1e-12, abs_tol=1e-12):
+            raise ValueError("board-energy joules differ from raw NVML evidence")
+        object.__setattr__(self, "energy_j", energy_j)
+
+    @property
+    def duration_ms(self) -> float:
+        return (
+            self.ended_at_monotonic_ns - self.started_at_monotonic_ns
+        ) / 1_000_000.0
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "device_uuid": self.device_uuid,
+            "meter_method": self.meter_method,
+            "measurement_status": self.measurement_status,
+            "scope": self.scope,
+            "started_at_monotonic_ns": self.started_at_monotonic_ns,
+            "ended_at_monotonic_ns": self.ended_at_monotonic_ns,
+            "duration_ms": self.duration_ms,
+            "energy_j": self.energy_j,
+            "counter_start_mj": self.counter_start_mj,
+            "counter_end_mj": self.counter_end_mj,
+            "power_trace": [sample.to_dict() for sample in self.power_trace],
+            "power_trace_sample_count": len(self.power_trace),
+            "requested_power_sample_interval_ms": (
+                self.requested_power_sample_interval_ms
+            ),
+            "unavailable_reason": self.unavailable_reason,
+        }
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "GPUDeviceEnergyMeasurement":
+        measurement = cls(
+            schema_version=str(value["schema_version"]),
+            device_uuid=str(value["device_uuid"]),
+            meter_method=str(value["meter_method"]),
+            measurement_status=str(value["measurement_status"]),
+            scope=str(value["scope"]),
+            started_at_monotonic_ns=int(value["started_at_monotonic_ns"]),
+            ended_at_monotonic_ns=int(value["ended_at_monotonic_ns"]),
+            energy_j=(
+                None if value.get("energy_j") is None else float(value["energy_j"])
+            ),
+            counter_start_mj=(
+                None
+                if value.get("counter_start_mj") is None
+                else int(value["counter_start_mj"])
+            ),
+            counter_end_mj=(
+                None
+                if value.get("counter_end_mj") is None
+                else int(value["counter_end_mj"])
+            ),
+            power_trace=tuple(
+                GPUPowerTraceSample.from_dict(item)
+                for item in value.get("power_trace", ())
+            ),
+            requested_power_sample_interval_ms=int(
+                value["requested_power_sample_interval_ms"]
+            ),
+            unavailable_reason=(
+                None
+                if value.get("unavailable_reason") is None
+                else str(value["unavailable_reason"])
+            ),
+        )
+        if value.get("duration_ms") != measurement.duration_ms:
+            raise ValueError("GPU energy duration differs from its raw timestamps")
+        if value.get("power_trace_sample_count") != len(measurement.power_trace):
+            raise ValueError("GPU energy trace sample count mismatch")
+        return measurement
+
+
+@dataclass(frozen=True)
+class GPUEnergyMeasurement:
+    """Aggregate measured-region energy, retaining every device contribution."""
+
+    repetition: int
+    generated_tokens: int
+    devices: tuple[GPUDeviceEnergyMeasurement, ...]
+
+    def __post_init__(self) -> None:
+        if (
+            isinstance(self.repetition, bool)
+            or not isinstance(self.repetition, int)
+            or self.repetition < 0
+        ):
+            raise ValueError("energy repetition index must be non-negative")
+        _require_positive_int(self.generated_tokens, "generated_tokens")
+        if not self.devices:
+            raise ValueError("GPU energy measurement requires selected devices")
+        uuids = tuple(device.device_uuid for device in self.devices)
+        if len(uuids) != len(set(uuids)):
+            raise ValueError("GPU energy measurement repeats a device UUID")
+        if len({device.meter_method for device in self.devices}) != 1:
+            raise ValueError("one energy row cannot mix NVML meter methods")
+        if len({device.measurement_status for device in self.devices}) != 1:
+            raise ValueError("one energy row cannot mix availability states")
+
+    @property
+    def available(self) -> bool:
+        return all(
+            device.measurement_status == "measured" for device in self.devices
+        )
+
+    @property
+    def meter_method(self) -> str:
+        return self.devices[0].meter_method
+
+    @property
+    def total_energy_j(self) -> float | None:
+        if not self.available:
+            return None
+        return sum(float(device.energy_j) for device in self.devices)
+
+    @property
+    def energy_per_token_j(self) -> float | None:
+        energy = self.total_energy_j
+        return None if energy is None else energy / self.generated_tokens
+
+    @property
+    def tokens_per_joule(self) -> float | None:
+        energy = self.total_energy_j
+        return None if energy is None else self.generated_tokens / energy
+
+    @property
+    def unavailable_reason(self) -> str | None:
+        if self.available:
+            return None
+        return "; ".join(
+            f"{device.device_uuid}: {device.unavailable_reason}"
+            for device in self.devices
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "repetition": self.repetition,
+            "generated_tokens": self.generated_tokens,
+            "devices": [device.to_dict() for device in self.devices],
+            "available": self.available,
+            "meter_method": self.meter_method,
+            "total_energy_j": self.total_energy_j,
+            "energy_per_token_j": self.energy_per_token_j,
+            "tokens_per_joule": self.tokens_per_joule,
+            "unavailable_reason": self.unavailable_reason,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUEnergyMeasurement":
+        measurement = cls(
+            repetition=int(value["repetition"]),
+            generated_tokens=int(value["generated_tokens"]),
+            devices=tuple(
+                GPUDeviceEnergyMeasurement.from_dict(item)
+                for item in value["devices"]
+            ),
+        )
+        if measurement.to_dict() != dict(value):
+            raise ValueError("aggregate GPU energy summary mismatch")
+        return measurement
+
+
+@dataclass(frozen=True)
+class GPUBaselineRepetition:
+    """Raw timing samples and execution invariants for one fresh prefill."""
+
+    repetition: int
+    document_ids: tuple[str, ...]
+    prefill_ms: float
+    decode_step_ms: tuple[float, ...]
+    q_len_one_calls: int
+    cache_growth_checks: int
+    first_token_count: int
+    generated_token_sha256: str
+    peak_allocated_bytes: int
+    peak_reserved_bytes: int
+    energy_measurement: GPUEnergyMeasurement
+
+    def __post_init__(self) -> None:
+        if self.repetition < 0:
+            raise ValueError("repetition index must be non-negative")
+        if not self.document_ids or len(self.document_ids) != len(
+            set(self.document_ids)
+        ):
+            raise ValueError("repetition document IDs must be unique")
+        _require_nonnegative_finite(self.prefill_ms, "prefill_ms")
+        if not self.decode_step_ms:
+            raise ValueError("repetition requires raw decode timings")
+        for value in self.decode_step_ms:
+            _require_nonnegative_finite(value, "decode_step_ms")
+            if value == 0:
+                raise ValueError("decode timing samples must be positive")
+        _require_positive_int(self.q_len_one_calls, "q_len_one_calls")
+        _require_positive_int(self.cache_growth_checks, "cache_growth_checks")
+        if self.q_len_one_calls != self.cache_growth_checks:
+            raise ValueError("every cached-q1 call requires a growth check")
+        if self.first_token_count != len(self.document_ids):
+            raise ValueError("prefill must produce one first token per sequence")
+        _require_sha256(
+            self.generated_token_sha256,
+            "generated_token_sha256",
+        )
+        if self.peak_allocated_bytes <= 0 or self.peak_reserved_bytes <= 0:
+            raise ValueError("successful runs require measured CUDA memory")
+        if self.peak_reserved_bytes < self.peak_allocated_bytes:
+            raise ValueError("reserved CUDA memory cannot be below allocated")
+        if self.energy_measurement.repetition != self.repetition:
+            raise ValueError("energy repetition index differs from timing evidence")
+        if self.energy_measurement.generated_tokens != (
+            len(self.document_ids) * len(self.decode_step_ms)
+        ):
+            raise ValueError("energy token count differs from measured decode timing")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "repetition": self.repetition,
+            "document_ids": list(self.document_ids),
+            "prefill_ms": self.prefill_ms,
+            "decode_step_ms": list(self.decode_step_ms),
+            "q_len_one_calls": self.q_len_one_calls,
+            "cache_growth_checks": self.cache_growth_checks,
+            "first_token_count": self.first_token_count,
+            "generated_token_sha256": self.generated_token_sha256,
+            "peak_allocated_bytes": self.peak_allocated_bytes,
+            "peak_reserved_bytes": self.peak_reserved_bytes,
+            "energy_measurement": self.energy_measurement.to_dict(),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUBaselineRepetition":
+        return cls(
+            repetition=int(value["repetition"]),
+            document_ids=tuple(map(str, value["document_ids"])),
+            prefill_ms=float(value["prefill_ms"]),
+            decode_step_ms=tuple(map(float, value["decode_step_ms"])),
+            q_len_one_calls=int(value["q_len_one_calls"]),
+            cache_growth_checks=int(value["cache_growth_checks"]),
+            first_token_count=int(value["first_token_count"]),
+            generated_token_sha256=str(value["generated_token_sha256"]),
+            peak_allocated_bytes=int(value["peak_allocated_bytes"]),
+            peak_reserved_bytes=int(value["peak_reserved_bytes"]),
+            energy_measurement=GPUEnergyMeasurement.from_dict(
+                value["energy_measurement"]
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class GPUBaselineResult:
+    """One terminal batch-size measurement; failures remain explicit."""
+
+    contract_hash: str
+    device_label: str
+    device_name: str
+    device_uuid: str
+    runtime_environment: RuntimeEnvironment
+    batch_size: int
+    state: str
+    repetitions: tuple[GPUBaselineRepetition, ...]
+    hardware_state_snapshots: tuple[GPUHardwareStateSnapshot, ...]
+    error_class: str | None
+    error_message: str | None
+    created_at_utc: str
+    schema_version: str = GPU_BASELINE_RESULT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != GPU_BASELINE_RESULT_SCHEMA:
+            raise ValueError("unsupported GPU baseline result schema")
+        _require_sha256(self.contract_hash, "contract_hash")
+        if not self.device_label or not self.device_name or not self.device_uuid:
+            raise ValueError("GPU baseline device identity must be complete")
+        _require_positive_int(self.batch_size, "batch_size")
+        if self.state not in {"succeeded", "oom", "failed"}:
+            raise ValueError("unsupported GPU baseline terminal state")
+        _require_utc_timestamp(self.created_at_utc, "created_at_utc")
+        observed = self.runtime_environment.observation
+        logical = self.runtime_environment.logical
+        if str(logical.get("device_name")) != self.device_name:
+            raise ValueError("result device name differs from runtime receipt")
+        if str(observed.get("device_uuid")) != self.device_uuid:
+            raise ValueError("result device UUID differs from runtime receipt")
+        if self.device_uuid.lower() == "unavailable":
+            raise ValueError("GPU baseline requires a physical device UUID")
+        for snapshot in self.hardware_state_snapshots:
+            fields = snapshot.fields
+            if _nvidia_smi_device_id(fields["uuid"]) != _nvidia_smi_device_id(
+                self.device_uuid
+            ):
+                raise ValueError(
+                    "GPU hardware-state UUID differs from runtime receipt"
+                )
+        if self.state == "succeeded":
+            if len(self.repetitions) < 3:
+                raise ValueError("successful GPU result requires three repeats")
+            if self.error_class is not None or self.error_message is not None:
+                raise ValueError("successful GPU result cannot contain an error")
+            indices = tuple(item.repetition for item in self.repetitions)
+            if indices != tuple(range(len(self.repetitions))):
+                raise ValueError("GPU repetition indices must be contiguous")
+            repetition_means = tuple(
+                statistics.mean(item.decode_step_ms)
+                for item in self.repetitions
+                if item.decode_step_ms
+            )
+            if len(repetition_means) != len(self.repetitions):
+                raise ValueError("GPU repetition is missing decode-step timings")
+            reference = statistics.median(repetition_means)
+            if reference <= 0.0:
+                raise ValueError("GPU repetition mean decode step must be positive")
+            spread = max(
+                abs(value - reference) / reference for value in repetition_means
+            )
+            if spread > GPU_BASELINE_REPETITION_SPREAD_LIMIT:
+                raise ValueError(
+                    "GPU repetition decode timings are not steady state: "
+                    f"spread {spread:.4f} exceeds "
+                    f"{GPU_BASELINE_REPETITION_SPREAD_LIMIT:.4f}"
+                )
+            if any(
+                len(item.document_ids) != self.batch_size
+                for item in self.repetitions
+            ):
+                raise ValueError("GPU repetition batch size mismatch")
+            energy_measurements = tuple(
+                item.energy_measurement for item in self.repetitions
+            )
+            if any(
+                tuple(device.device_uuid for device in measurement.devices)
+                != (self.device_uuid,)
+                for measurement in energy_measurements
+            ):
+                raise ValueError("GPU energy evidence differs from the selected device")
+            if len(
+                {measurement.meter_method for measurement in energy_measurements}
+            ) != 1:
+                raise ValueError("one GPU result cannot mix energy-meter methods")
+            lengths = {len(item.decode_step_ms) for item in self.repetitions}
+            if len(lengths) != 1:
+                raise ValueError("GPU repetitions have different sample counts")
+            expected_phases = ["run_start"]
+            for repetition in range(len(self.repetitions)):
+                expected_phases.extend(
+                    (
+                        f"repetition_{repetition}_start",
+                        f"repetition_{repetition}_end",
+                    )
+                )
+            expected_phases.append("run_end")
+            observed_phases = [
+                snapshot.phase
+                for snapshot in self.hardware_state_snapshots
+            ]
+            if observed_phases != expected_phases:
+                raise ValueError(
+                    "successful GPU result lacks hardware-state coverage"
+                )
+            if any(
+                snapshot.fields["mig.mode.current"].lower() != "disabled"
+                for snapshot in self.hardware_state_snapshots
+            ):
+                raise ValueError("GPU baseline requires MIG to be disabled")
+            required_fields = (
+                "driver_version",
+                "pstate",
+                "temperature.gpu",
+                "power.draw",
+                "power.limit",
+                "clocks.current.graphics",
+                "clocks.current.sm",
+                "clocks.current.memory",
+            )
+            if any(
+                snapshot.fields[field].lower() in {"n/a", "[n/a]"}
+                for snapshot in self.hardware_state_snapshots
+                for field in required_fields
+            ):
+                raise ValueError(
+                    "successful GPU result has unavailable hardware state"
+                )
+            numeric_fields = (
+                "memory.total",
+                "memory.used",
+                "temperature.gpu",
+                "power.draw",
+                "power.limit",
+                "clocks.current.graphics",
+                "clocks.current.sm",
+                "clocks.current.memory",
+            )
+            for snapshot in self.hardware_state_snapshots:
+                for field in numeric_fields:
+                    _require_nonnegative_finite(
+                        float(snapshot.fields[field]),
+                        f"hardware state {field}",
+                    )
+            if len(
+                {
+                    snapshot.fields["driver_version"]
+                    for snapshot in self.hardware_state_snapshots
+                }
+            ) != 1:
+                raise ValueError("GPU driver changed during the baseline")
+            stable_fields = (
+                "driver_version",
+                "name",
+                "uuid",
+                "pci.bus_id",
+                "memory.total",
+                "power.limit",
+                "mig.mode.current",
+            )
+            for field in stable_fields:
+                if len(
+                    {
+                        snapshot.fields[field]
+                        for snapshot in self.hardware_state_snapshots
+                    }
+                ) != 1:
+                    raise ValueError(
+                        f"GPU hardware field {field} changed during the baseline"
+                    )
+        else:
+            if self.repetitions:
+                raise ValueError("failed GPU result cannot claim repetitions")
+            if not self.error_class or not self.error_message:
+                raise ValueError("failed GPU result requires an error receipt")
+
+    @property
+    def result_id(self) -> str:
+        return f"gpu-baseline-{_canonical_hash(self._body())}"
+
+    def _body(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "contract_hash": self.contract_hash,
+            "device_label": self.device_label,
+            "device_name": self.device_name,
+            "device_uuid": self.device_uuid,
+            "runtime_environment": self.runtime_environment.to_dict(),
+            "batch_size": self.batch_size,
+            "state": self.state,
+            "repetitions": [
+                repetition.to_dict() for repetition in self.repetitions
+            ],
+            "hardware_state_snapshots": [
+                snapshot.to_dict()
+                for snapshot in self.hardware_state_snapshots
+            ],
+            "error_class": self.error_class,
+            "error_message": self.error_message,
+            "created_at_utc": self.created_at_utc,
+        }
+
+    @property
+    def summary(self) -> Mapping[str, Any] | None:
+        if self.state != "succeeded":
+            return None
+        samples = tuple(
+            sample
+            for repetition in self.repetitions
+            for sample in repetition.decode_step_ms
+        )
+        mean_ms = statistics.fmean(samples)
+        repetition_mean_ms = tuple(
+            statistics.fmean(repetition.decode_step_ms)
+            for repetition in self.repetitions
+        )
+        energy_measurements = tuple(
+            repetition.energy_measurement for repetition in self.repetitions
+        )
+        energy_available = all(
+            measurement.available for measurement in energy_measurements
+        )
+        energy_j = (
+            sum(
+                float(measurement.total_energy_j)
+                for measurement in energy_measurements
+            )
+            if energy_available
+            else None
+        )
+        generated_tokens = sum(
+            measurement.generated_tokens for measurement in energy_measurements
+        )
+        energy_per_token_j = (
+            energy_j / generated_tokens if energy_j is not None else None
+        )
+        tokens_per_joule = (
+            generated_tokens / energy_j if energy_j is not None else None
+        )
+        energy_delay_product_j_s = (
+            energy_per_token_j * mean_ms / 1000.0
+            if energy_per_token_j is not None
+            else None
+        )
+        hardware_fields = tuple(
+            snapshot.fields for snapshot in self.hardware_state_snapshots
+        )
+        return {
+            "raw_decode_step_sample_count": len(samples),
+            "mean_batch_step_ms": mean_ms,
+            "median_batch_step_ms": statistics.median(samples),
+            "p95_batch_step_ms": _percentile(samples, 0.95),
+            "tokens_per_second": self.batch_size * 1000.0 / mean_ms,
+            "mean_batch_step_ms_by_repetition": list(
+                repetition_mean_ms
+            ),
+            "tokens_per_second_by_repetition": [
+                self.batch_size * 1000.0 / value
+                for value in repetition_mean_ms
+            ],
+            "repeat_mean_step_cv": (
+                statistics.pstdev(repetition_mean_ms)
+                / statistics.fmean(repetition_mean_ms)
+            ),
+            "mean_prefill_ms": statistics.fmean(
+                repetition.prefill_ms for repetition in self.repetitions
+            ),
+            "energy": {
+                "available": energy_available,
+                "scope": GPU_BASELINE_ENERGY_SCOPE,
+                "meter_method": energy_measurements[0].meter_method,
+                "device_uuids": [self.device_uuid],
+                "measured_repetitions": (
+                    len(energy_measurements) if energy_available else 0
+                ),
+                "generated_tokens": generated_tokens,
+                "total_energy_j": energy_j,
+                "energy_per_token_j": energy_per_token_j,
+                "tokens_per_joule": tokens_per_joule,
+                "energy_delay_product_j_s": energy_delay_product_j_s,
+                "unavailable_reason": (
+                    None
+                    if energy_available
+                    else "; ".join(
+                        str(measurement.unavailable_reason)
+                        for measurement in energy_measurements
+                        if not measurement.available
+                    )
+                ),
+            },
+            "max_peak_allocated_bytes": max(
+                repetition.peak_allocated_bytes
+                for repetition in self.repetitions
+            ),
+            "max_peak_reserved_bytes": max(
+                repetition.peak_reserved_bytes
+                for repetition in self.repetitions
+            ),
+            "hardware_state": {
+                "driver_version": hardware_fields[0]["driver_version"],
+                "mig_mode": hardware_fields[0]["mig.mode.current"],
+                "observed_pstates": sorted(
+                    {fields["pstate"] for fields in hardware_fields}
+                ),
+                "sm_clock_mhz_min": min(
+                    float(fields["clocks.current.sm"])
+                    for fields in hardware_fields
+                ),
+                "sm_clock_mhz_max": max(
+                    float(fields["clocks.current.sm"])
+                    for fields in hardware_fields
+                ),
+                "memory_clock_mhz_min": min(
+                    float(fields["clocks.current.memory"])
+                    for fields in hardware_fields
+                ),
+                "memory_clock_mhz_max": max(
+                    float(fields["clocks.current.memory"])
+                    for fields in hardware_fields
+                ),
+                "power_draw_w_max": max(
+                    float(fields["power.draw"])
+                    for fields in hardware_fields
+                ),
+                "power_limit_w": float(
+                    hardware_fields[0]["power.limit"]
+                ),
+                "temperature_c_max": max(
+                    float(fields["temperature.gpu"])
+                    for fields in hardware_fields
+                ),
+            },
+        }
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            **self._body(),
+            "result_id": self.result_id,
+            "summary": self.summary,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUBaselineResult":
+        environment_value = dict(value["runtime_environment"])
+        result = cls(
+            schema_version=str(value["schema_version"]),
+            contract_hash=str(value["contract_hash"]),
+            device_label=str(value["device_label"]),
+            device_name=str(value["device_name"]),
+            device_uuid=str(value["device_uuid"]),
+            runtime_environment=RuntimeEnvironment.from_dict(
+                environment_value
+            ),
+            batch_size=int(value["batch_size"]),
+            state=str(value["state"]),
+            repetitions=tuple(
+                GPUBaselineRepetition.from_dict(item)
+                for item in value["repetitions"]
+            ),
+            hardware_state_snapshots=tuple(
+                GPUHardwareStateSnapshot.from_dict(item)
+                for item in value["hardware_state_snapshots"]
+            ),
+            error_class=(
+                None
+                if value.get("error_class") is None
+                else str(value["error_class"])
+            ),
+            error_message=(
+                None
+                if value.get("error_message") is None
+                else str(value["error_message"])
+            ),
+            created_at_utc=str(value["created_at_utc"]),
+        )
+        if value.get("result_id") != result.result_id:
+            raise ValueError("GPU baseline result identity mismatch")
+        if value.get("summary") != result.summary:
+            raise ValueError("GPU baseline summary mismatch")
+        return result
+
+
+def _cache_length(cache: Any) -> int:
+    if hasattr(cache, "get_seq_length"):
+        value = cache.get_seq_length()
+        return int(value.item() if hasattr(value, "item") else value)
+    if hasattr(cache, "to_legacy_cache"):
+        cache = cache.to_legacy_cache()
+    elif hasattr(cache, "key_cache"):
+        cache = tuple(zip(cache.key_cache, cache.value_cache))
+    layers = tuple(cache)
+    if not layers:
+        raise ValueError("model returned an empty decode cache")
+    return int(layers[0][0].shape[-2])
+
+
+def _cache_layers(cache: Any) -> tuple[tuple[Any, Any], ...]:
+    if hasattr(cache, "to_legacy_cache"):
+        cache = cache.to_legacy_cache()
+    elif hasattr(cache, "key_cache") and hasattr(cache, "value_cache"):
+        cache = tuple(zip(cache.key_cache, cache.value_cache))
+    layers = tuple(cache)
+    if not layers or any(len(layer) < 2 for layer in layers):
+        raise ValueError("model returned an invalid decode cache")
+    return tuple((layer[0], layer[1]) for layer in layers)
+
+
+def _assert_bf16_cache(cache: Any, torch: Any) -> None:
+    for key, value in _cache_layers(cache):
+        if key.dtype != torch.bfloat16 or value.dtype != torch.bfloat16:
+            raise TypeError("GPU baseline cache must remain BF16")
+
+
+def _timed_cuda_call(
+    torch: Any,
+    callable_: Any,
+    *,
+    device: str,
+) -> tuple[Any, float]:
+    with torch.cuda.device(torch.device(device)):
+        start = torch.cuda.Event(enable_timing=True)
+        end = torch.cuda.Event(enable_timing=True)
+        torch.cuda.synchronize()
+        start.record()
+        value = callable_()
+        end.record()
+        end.synchronize()
+    elapsed = float(start.elapsed_time(end))
+    if not math.isfinite(elapsed) or elapsed <= 0:
+        raise RuntimeError("CUDA event produced an invalid timing")
+    return value, elapsed
+
+
+def _select_repeat_samples(
+    bundle: TokenSampleBundle,
+    *,
+    repetition: int,
+    batch_size: int,
+) -> tuple[Any, ...]:
+    samples = tuple(bundle.hardware_validation)
+    if batch_size > len(samples):
+        raise ValueError("batch size exceeds the fixed hardware validation prompt set")
+    start = (repetition * batch_size) % len(samples)
+    indices = tuple((start + offset) % len(samples) for offset in range(batch_size))
+    if len(set(indices)) != len(indices):
+        raise AssertionError("baseline repeat selected a duplicate prompt")
+    return tuple(samples[index] for index in indices)
+
+
+def _package_version(distribution: str) -> str:
+    try:
+        return importlib.metadata.version(distribution)
+    except importlib.metadata.PackageNotFoundError:
+        return "unavailable"
+
+
+def _cuda_driver_version(torch: Any) -> str:
+    candidates = (
+        getattr(torch.cuda, "driver_version", None),
+        getattr(torch._C, "_cuda_getDriverVersion", None),
+    )
+    for candidate in candidates:
+        if candidate is None:
+            continue
+        try:
+            value = candidate() if callable(candidate) else candidate
+        except (RuntimeError, TypeError):
+            continue
+        if value is not None:
+            return str(value)
+    return "unavailable"
+
+
+def _capture_baseline_runtime(
+    device: str,
+    *,
+    seed: int,
+    attention_implementation: str,
+    torch: Any,
+) -> RuntimeEnvironment:
+    base = capture_runtime_environment(device, seed=seed)
+    logical = dict(base.logical)
+    logical.update(
+        {
+            "attention_implementation": attention_implementation,
+            "execution_mode": GPU_BASELINE_EXECUTION_MODE,
+            "timing_scope": GPU_BASELINE_TIMING_SCOPE,
+            "cuda_driver_version": _cuda_driver_version(torch),
+            "accelerate": _package_version("accelerate"),
+            "safetensors": _package_version("safetensors"),
+            "tokenizers": _package_version("tokenizers"),
+            "nvidia_ml_py": _package_version("nvidia-ml-py"),
+            "flash_attn": (
+                _package_version("flash_attn")
+                if attention_implementation == "flash_attention_2"
+                else "not_applicable"
+            ),
+        }
+    )
+    return RuntimeEnvironment(
+        logical=logical,
+        observation=dict(base.observation),
+    )
+
+
+def _nvidia_smi_device_id(device_uuid: str) -> str:
+    """Return the UUID in the ``GPU-`` form nvidia-smi selects devices by.
+
+    Torch reports the bare UUID, which is the form persisted in every
+    artifact; nvidia-smi matches no device without the prefix.
+    """
+    identifier = device_uuid.strip()
+    return identifier if identifier.startswith("GPU-") else f"GPU-{identifier}"
+
+
+def _capture_hardware_state(
+    *,
+    device_uuid: str,
+    phase: str,
+) -> GPUHardwareStateSnapshot:
+    command = (
+        "nvidia-smi",
+        f"--id={_nvidia_smi_device_id(device_uuid)}",
+        f"--query-gpu={','.join(NVIDIA_SMI_QUERY_FIELDS)}",
+        "--format=csv,noheader,nounits",
+    )
+    try:
+        completed = subprocess.run(
+            command,
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=15,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        raise RuntimeError("failed to capture NVIDIA hardware state") from exc
+    if completed.returncode != 0:
+        detail = completed.stderr.strip() or "nvidia-smi query failed"
+        raise RuntimeError(detail)
+    lines = tuple(
+        line.strip()
+        for line in completed.stdout.splitlines()
+        if line.strip()
+    )
+    if len(lines) != 1:
+        raise RuntimeError(
+            "NVIDIA hardware-state query did not identify one physical GPU"
+        )
+    raw_line = lines[0]
+    values = tuple(field.strip() for field in next(csv.reader([raw_line])))
+    captured_at = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+    return GPUHardwareStateSnapshot(
+        phase=phase,
+        captured_at_utc=captured_at,
+        raw_query_line=raw_line,
+        raw_query_sha256=hashlib.sha256(
+            raw_line.encode("utf-8")
+        ).hexdigest(),
+        values=values,
+    )
+
+
+def _meter_error_text(error: BaseException) -> str:
+    detail = " ".join(str(error).split())
+    return type(error).__name__ + (f": {detail}" if detail else "")
+
+
+class _NVMLBoardEnergyMeter:
+    """Select and operate one provenance-recorded NVML board-energy meter."""
+
+    def __init__(
+        self,
+        *,
+        device_uuid: str,
+        method_priority: Sequence[str],
+        power_trace_sample_interval_ms: int,
+    ) -> None:
+        if tuple(method_priority) != GPU_BASELINE_ENERGY_METER_PRIORITY:
+            raise ValueError("GPU energy-meter priority differs from the contract")
+        if not 1 <= power_trace_sample_interval_ms <= 1000:
+            raise ValueError("power-trace sample interval must be in [1, 1000] ms")
+        self.device_uuid = device_uuid
+        self.power_trace_sample_interval_ms = power_trace_sample_interval_ms
+        self.method = ENERGY_UNAVAILABLE_METHOD
+        self.unavailable_reason = "NVML board-energy meter was not initialized"
+        self._module: Any | None = None
+        self._handle: Any | None = None
+        self._initialized = False
+        self._active = False
+        self._started_at_ns: int | None = None
+        self._counter_start_mj: int | None = None
+        self._trace_samples: list[GPUPowerTraceSample] = []
+        self._trace_error: str | None = None
+        self._trace_stop: threading.Event | None = None
+        self._trace_thread: threading.Thread | None = None
+        self._initialize(method_priority)
+
+    def _initialize(self, method_priority: Sequence[str]) -> None:
+        failures: list[str] = []
+        try:
+            module = importlib.import_module("pynvml")
+            module.nvmlInit()
+            self._initialized = True
+            self._module = module
+            handle = module.nvmlDeviceGetHandleByUUID(
+                _nvidia_smi_device_id(self.device_uuid)
+            )
+            observed_uuid = module.nvmlDeviceGetUUID(handle)
+            if isinstance(observed_uuid, bytes):
+                observed_uuid = observed_uuid.decode("utf-8")
+            if (
+                _nvidia_smi_device_id(str(observed_uuid)).lower()
+                != _nvidia_smi_device_id(self.device_uuid).lower()
+            ):
+                raise RuntimeError("NVML handle resolved to a different GPU UUID")
+            self._handle = handle
+        except Exception as error:
+            self.unavailable_reason = (
+                "NVML initialization or UUID binding failed: "
+                + _meter_error_text(error)
+            )
+            return
+        for method in method_priority:
+            try:
+                if method == NVML_TOTAL_ENERGY_METHOD:
+                    int(self._module.nvmlDeviceGetTotalEnergyConsumption(self._handle))
+                elif method == NVML_POWER_TRACE_METHOD:
+                    power_mw = int(self._module.nvmlDeviceGetPowerUsage(self._handle))
+                    if power_mw <= 0:
+                        raise RuntimeError("NVML returned non-positive board power")
+                else:
+                    raise ValueError(f"unsupported energy meter {method!r}")
+            except Exception as error:
+                failures.append(f"{method}: {_meter_error_text(error)}")
+                continue
+            self.method = method
+            self.unavailable_reason = None
+            return
+        self.unavailable_reason = "no supported NVML board-energy meter; " + "; ".join(
+            failures
+        )
+
+    def _read_power_sample(self) -> GPUPowerTraceSample:
+        power_mw = int(self._module.nvmlDeviceGetPowerUsage(self._handle))
+        return GPUPowerTraceSample(
+            timestamp_monotonic_ns=time.monotonic_ns(),
+            power_mw=power_mw,
+        )
+
+    def _trace_worker(self) -> None:
+        if self._trace_stop is None:
+            return
+        interval_s = self.power_trace_sample_interval_ms / 1000.0
+        while not self._trace_stop.wait(interval_s):
+            try:
+                self._trace_samples.append(self._read_power_sample())
+            except Exception as error:
+                self._trace_error = _meter_error_text(error)
+                self._trace_stop.set()
+                return
+
+    def begin(self, torch: Any, *, device: str) -> None:
+        if self._active:
+            raise RuntimeError("GPU energy meter already has an active interval")
+        torch.cuda.synchronize(torch.device(device))
+        self._active = True
+        self._counter_start_mj = None
+        self._trace_samples = []
+        self._trace_error = None
+        self._trace_stop = None
+        self._trace_thread = None
+        if self.method == NVML_TOTAL_ENERGY_METHOD:
+            try:
+                self._counter_start_mj = int(
+                    self._module.nvmlDeviceGetTotalEnergyConsumption(self._handle)
+                )
+                self._started_at_ns = time.monotonic_ns()
+            except Exception as error:
+                self.method = ENERGY_UNAVAILABLE_METHOD
+                self.unavailable_reason = (
+                    "NVML cumulative energy counter failed at region start: "
+                    + _meter_error_text(error)
+                )
+                self._started_at_ns = time.monotonic_ns()
+        elif self.method == NVML_POWER_TRACE_METHOD:
+            try:
+                initial = self._read_power_sample()
+                self._trace_samples.append(initial)
+                self._started_at_ns = initial.timestamp_monotonic_ns
+                self._trace_stop = threading.Event()
+                self._trace_thread = threading.Thread(
+                    target=self._trace_worker,
+                    name="gpu-board-power-trace",
+                    daemon=True,
+                )
+                self._trace_thread.start()
+            except Exception as error:
+                self.method = ENERGY_UNAVAILABLE_METHOD
+                self.unavailable_reason = (
+                    "NVML power trace failed at region start: "
+                    + _meter_error_text(error)
+                )
+                self._trace_samples = []
+                self._started_at_ns = time.monotonic_ns()
+        else:
+            self._started_at_ns = time.monotonic_ns()
+
+    def _stop_trace(self) -> None:
+        if self._trace_stop is not None:
+            self._trace_stop.set()
+        if self._trace_thread is not None:
+            self._trace_thread.join(timeout=5.0)
+            if self._trace_thread.is_alive():
+                self._trace_error = "power-trace sampler did not terminate"
+        self._trace_stop = None
+        self._trace_thread = None
+
+    def end(
+        self,
+        torch: Any,
+        *,
+        device: str,
+        repetition: int,
+        generated_tokens: int,
+    ) -> GPUEnergyMeasurement:
+        if not self._active or self._started_at_ns is None:
+            raise RuntimeError("GPU energy meter has no active interval")
+        torch.cuda.synchronize(torch.device(device))
+        method = self.method
+        started_at_ns = self._started_at_ns
+        ended_at_ns = time.monotonic_ns()
+        counter_end_mj: int | None = None
+        energy_j: float | None = None
+        unavailable_reason = self.unavailable_reason
+        try:
+            if method == NVML_TOTAL_ENERGY_METHOD:
+                counter_end_mj = int(
+                    self._module.nvmlDeviceGetTotalEnergyConsumption(self._handle)
+                )
+                ended_at_ns = time.monotonic_ns()
+                if self._counter_start_mj is None:
+                    raise RuntimeError("cumulative energy counter lacks a start value")
+                energy_j = (counter_end_mj - self._counter_start_mj) / 1000.0
+                if energy_j <= 0:
+                    raise RuntimeError(
+                        "cumulative energy counter did not increase"
+                    )
+            elif method == NVML_POWER_TRACE_METHOD:
+                self._stop_trace()
+                final = self._read_power_sample()
+                self._trace_samples.append(final)
+                ended_at_ns = final.timestamp_monotonic_ns
+                if self._trace_error is not None:
+                    raise RuntimeError(self._trace_error)
+                energy_j = _integrate_power_trace(self._trace_samples)
+            else:
+                unavailable_reason = unavailable_reason or (
+                    "no supported NVML board-energy meter"
+                )
+        except Exception as error:
+            unavailable_reason = (
+                f"{method} failed for the measured decode region: "
+                + _meter_error_text(error)
+            )
+            energy_j = None
+            counter_end_mj = None
+            self._trace_samples = []
+        finally:
+            self._stop_trace()
+            self._active = False
+            self._started_at_ns = None
+        status = "measured" if energy_j is not None else "unavailable"
+        device_measurement = GPUDeviceEnergyMeasurement(
+            device_uuid=self.device_uuid,
+            meter_method=method,
+            measurement_status=status,
+            started_at_monotonic_ns=started_at_ns,
+            ended_at_monotonic_ns=max(ended_at_ns, started_at_ns + 1),
+            energy_j=energy_j,
+            counter_start_mj=(
+                self._counter_start_mj if status == "measured" else None
+            ),
+            counter_end_mj=(counter_end_mj if status == "measured" else None),
+            power_trace=(
+                tuple(self._trace_samples)
+                if status == "measured" and method == NVML_POWER_TRACE_METHOD
+                else ()
+            ),
+            requested_power_sample_interval_ms=(
+                self.power_trace_sample_interval_ms
+            ),
+            unavailable_reason=(None if status == "measured" else unavailable_reason),
+        )
+        self._counter_start_mj = None
+        self._trace_samples = []
+        return GPUEnergyMeasurement(
+            repetition=repetition,
+            generated_tokens=generated_tokens,
+            devices=(device_measurement,),
+        )
+
+    def abort(self) -> None:
+        self._stop_trace()
+        self._active = False
+        self._started_at_ns = None
+        self._counter_start_mj = None
+        self._trace_samples = []
+
+    def close(self) -> None:
+        self.abort()
+        if self._initialized and self._module is not None:
+            try:
+                self._module.nvmlShutdown()
+            except Exception:
+                pass
+            self._initialized = False
+
+
+def _run_repetition(
+    model: Any,
+    torch: Any,
+    samples: Sequence[Any],
+    energy_meter: _NVMLBoardEnergyMeter,
+    *,
+    device: str,
+    warmup_steps: int,
+    measured_steps: int,
+    repetition: int,
+) -> GPUBaselineRepetition:
+    batch_size = len(samples)
+    prompt_length = len(samples[0].prompt_token_ids)
+    total_steps = warmup_steps + measured_steps
+    input_ids = torch.tensor(
+        [sample.prompt_token_ids for sample in samples],
+        dtype=torch.long,
+        device=device,
+    )
+    full_attention_mask = torch.ones(
+        (batch_size, prompt_length + total_steps),
+        dtype=torch.long,
+        device=device,
+    )
+    attention_mask = full_attention_mask[:, :prompt_length]
+    position_ids = (
+        torch.arange(prompt_length, device=device)
+        .unsqueeze(0)
+        .expand(batch_size, -1)
+    )
+    cache_position = torch.arange(prompt_length, device=device)
+    decode_position_ids = (
+        torch.arange(
+            prompt_length,
+            prompt_length + total_steps,
+            dtype=torch.long,
+            device=device,
+        )
+        .unsqueeze(0)
+        .expand(batch_size, -1)
+    )
+    decode_cache_positions = torch.arange(
+        prompt_length,
+        prompt_length + total_steps,
+        dtype=torch.long,
+        device=device,
+    )
+    torch.cuda.reset_peak_memory_stats(torch.device(device))
+
+    energy_region_started = False
+    energy_measurement: GPUEnergyMeasurement | None = None
+    try:
+        with torch.inference_mode():
+            def prefill_call() -> tuple[Any, Any]:
+                result = model(
+                    input_ids=input_ids,
+                    attention_mask=attention_mask,
+                    position_ids=position_ids,
+                    cache_position=cache_position,
+                    use_cache=True,
+                    logits_to_keep=1,
+                )
+                selected_tokens = result.logits[:, -1, :].argmax(dim=-1)
+                return result, selected_tokens
+
+            (output, next_tokens), prefill_ms = _timed_cuda_call(
+                torch,
+                prefill_call,
+                device=device,
+            )
+            if output.logits.shape[:2] != (batch_size, 1):
+                raise AssertionError("prefill logits have an invalid shape")
+            if output.logits.dtype != torch.bfloat16:
+                raise TypeError("GPU baseline output head must emit BF16 logits")
+            cache = output.past_key_values
+            if _cache_length(cache) != prompt_length:
+                raise AssertionError("prefill cache length mismatch")
+            _assert_bf16_cache(cache, torch)
+            generated = [next_tokens.detach().clone()]
+            del output
+            timings: list[float] = []
+            q_len_one_calls = 0
+            growth_checks = 0
+            for step in range(total_steps):
+                if step == warmup_steps:
+                    energy_meter.begin(torch, device=device)
+                    energy_region_started = True
+                previous_length = _cache_length(cache)
+                if previous_length != prompt_length + step:
+                    raise AssertionError("decode cache position is not sequential")
+                if next_tokens.shape != (batch_size,):
+                    raise AssertionError("decode tokens must have shape [batch]")
+                step_attention_mask = full_attention_mask[
+                    :, : previous_length + 1
+                ]
+                positions = decode_position_ids[:, step : step + 1]
+                cache_positions = decode_cache_positions[step : step + 1]
+
+                def decode_call() -> tuple[Any, Any]:
+                    result = model(
+                        input_ids=next_tokens[:, None],
+                        attention_mask=step_attention_mask,
+                        position_ids=positions,
+                        cache_position=cache_positions,
+                        past_key_values=cache,
+                        use_cache=True,
+                        logits_to_keep=1,
+                    )
+                    selected_tokens = result.logits[:, -1, :].argmax(dim=-1)
+                    return result, selected_tokens
+
+                (decoded, selected_tokens), elapsed_ms = _timed_cuda_call(
+                    torch,
+                    decode_call,
+                    device=device,
+                )
+                q_len_one_calls += 1
+                cache = decoded.past_key_values
+                if _cache_length(cache) != previous_length + 1:
+                    raise AssertionError("decode cache did not grow by one entry")
+                growth_checks += 1
+                if decoded.logits.shape[:2] != (batch_size, 1):
+                    raise AssertionError("decode logits have an invalid shape")
+                if decoded.logits.dtype != torch.bfloat16:
+                    raise TypeError("GPU baseline output head must emit BF16 logits")
+                next_tokens = selected_tokens
+                generated.append(next_tokens.detach().clone())
+                del decoded
+                if step >= warmup_steps:
+                    timings.append(elapsed_ms)
+            energy_measurement = energy_meter.end(
+                torch,
+                device=device,
+                repetition=repetition,
+                generated_tokens=batch_size * measured_steps,
+            )
+            energy_region_started = False
+    finally:
+        if energy_region_started:
+            energy_meter.abort()
+
+    if energy_measurement is None:
+        raise RuntimeError("GPU energy measurement did not reach a terminal state")
+
+    generated_token_ids = torch.stack(generated).to("cpu").tolist()
+    token_hash = _canonical_hash(
+        {"generated_token_ids": generated_token_ids}
+    )
+    return GPUBaselineRepetition(
+        repetition=repetition,
+        document_ids=tuple(sample.document_id for sample in samples),
+        prefill_ms=prefill_ms,
+        decode_step_ms=tuple(timings),
+        q_len_one_calls=q_len_one_calls,
+        cache_growth_checks=growth_checks,
+        first_token_count=batch_size,
+        generated_token_sha256=token_hash,
+        peak_allocated_bytes=int(torch.cuda.max_memory_allocated(device)),
+        peak_reserved_bytes=int(torch.cuda.max_memory_reserved(device)),
+        energy_measurement=energy_measurement,
+    )
+
+
+def run_gpu_baseline(
+    config: Mapping[str, Any],
+    bundle: TokenSampleBundle,
+    contract: GPUBaselineContract,
+    *,
+    device: str,
+    device_label: str,
+    batch_size: int,
+) -> GPUBaselineResult:
+    """Measure one GPU and retain OOM separately from execution failures."""
+
+    try:
+        import torch
+        from transformers import AutoModelForCausalLM
+    except ImportError as exc:
+        raise RuntimeError(
+            "GPU baseline execution requires torch and transformers"
+        ) from exc
+
+    if contract.sample_bundle_hash != bundle.canonical_hash:
+        raise ValueError("GPU baseline contract differs from the sample bundle")
+    if (
+        contract.workspace_binding.prompt_manifest_hash
+        != bundle.prompt_manifest().canonical_hash
+    ):
+        raise ValueError("GPU baseline workspace binding differs from the sample bundle")
+    if contract.source_tree_sha256 != _source_tree_hash():
+        raise ValueError("GPU baseline source tree differs from the contract")
+    if (
+        str(config.get("model_name")) != contract.model_name
+        or str(config.get("model_revision")) != contract.model_revision
+        or str(config.get("tokenizer_revision"))
+        != contract.tokenizer_revision
+        or int(config.get("seed", 0)) != contract.seed
+        or bool(config.get("trust_remote_code", False))
+    ):
+        raise ValueError("GPU baseline config differs from the contract")
+    baseline_policy = config.get("gpu_baseline")
+    expected_baseline_policy = {
+        "attention_implementation": contract.attention_implementation,
+        "warmup_steps": contract.warmup_steps,
+        "measured_steps": contract.measured_steps,
+        "repetitions": contract.repetitions,
+        "batch_sizes": list(contract.planned_batch_sizes),
+        "precision": contract.precision,
+        "q_len": contract.q_len,
+        "first_gpu_only": True,
+        "energy_meter_priority": list(contract.energy_meter_priority),
+        "power_trace_sample_interval_ms": (
+            contract.power_trace_sample_interval_ms
+        ),
+    }
+    if (
+        not isinstance(baseline_policy, Mapping)
+        or dict(baseline_policy) != expected_baseline_policy
+    ):
+        raise ValueError("GPU baseline config policy differs from the contract")
+    _require_positive_int(batch_size, "batch_size")
+    if batch_size not in contract.planned_batch_sizes:
+        raise ValueError("batch size is not in the contracted baseline plan")
+    planned_labels = {
+        _normalized_label(label): label
+        for label in contract.planned_device_labels
+    }
+    normalized_requested_label = _normalized_label(device_label)
+    if normalized_requested_label not in planned_labels:
+        raise ValueError("device label is not in the contracted baseline plan")
+    canonical_device_label = planned_labels[normalized_requested_label]
+    selected = torch.device(device)
+    if (
+        selected.type != "cuda"
+        or selected.index is None
+        or not torch.cuda.is_available()
+    ):
+        raise RuntimeError(
+            "GPU baseline execution requires an explicit CUDA device index"
+        )
+    torch.cuda.set_device(selected)
+    random.seed(contract.seed)
+    torch.manual_seed(contract.seed)
+    torch.cuda.manual_seed_all(contract.seed)
+    torch.set_float32_matmul_precision("high")
+    runtime = _capture_baseline_runtime(
+        device,
+        seed=contract.seed,
+        attention_implementation=contract.attention_implementation,
+        torch=torch,
+    )
+    device_name = str(runtime.logical["device_name"])
+    device_uuid = str(runtime.observation["device_uuid"])
+    normalized_label = _normalized_label(canonical_device_label)
+    normalized_name = _normalized_label(device_name)
+    if normalized_label not in normalized_name:
+        raise ValueError(
+            "device label is not present in the measured CUDA device name"
+        )
+    energy_meter = _NVMLBoardEnergyMeter(
+        device_uuid=device_uuid,
+        method_priority=contract.energy_meter_priority,
+        power_trace_sample_interval_ms=(
+            contract.power_trace_sample_interval_ms
+        ),
+    )
+    created_at = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+    repetitions: list[GPUBaselineRepetition] = []
+    hardware_state_snapshots: list[GPUHardwareStateSnapshot] = []
+    model = None
+    state = "succeeded"
+    error_class = None
+    error_message = None
+    try:
+        hardware_state_snapshots.append(
+            _capture_hardware_state(
+                device_uuid=device_uuid,
+                phase="run_start",
+            )
+        )
+        if (
+            hardware_state_snapshots[-1]
+            .fields["mig.mode.current"]
+            .lower()
+            != "disabled"
+        ):
+            raise RuntimeError("GPU baseline requires MIG to be disabled")
+        model = AutoModelForCausalLM.from_pretrained(
+            contract.model_name,
+            revision=contract.model_revision,
+            torch_dtype=torch.bfloat16,
+            cache_dir=config.get("hf_cache_dir"),
+            local_files_only=bool(config.get("local_files_only", True)),
+            trust_remote_code=bool(config.get("trust_remote_code", False)),
+            attn_implementation=contract.attention_implementation,
+            low_cpu_mem_usage=True,
+        )
+        model = model.to(device).eval()
+        effective_attention = getattr(
+            model.config,
+            "_attn_implementation",
+            None,
+        )
+        if effective_attention != contract.attention_implementation:
+            raise RuntimeError(
+                "loaded model did not retain the contracted attention "
+                "implementation"
+            )
+        parameter_dtypes = {
+            parameter.dtype
+            for parameter in model.parameters()
+            if parameter.is_floating_point()
+        }
+        if parameter_dtypes != {torch.bfloat16}:
+            raise TypeError("GPU baseline model parameters must all be BF16")
+        _run_repetition(
+            model,
+            torch,
+            _select_repeat_samples(bundle, repetition=0, batch_size=batch_size),
+            energy_meter,
+            device=device,
+            warmup_steps=contract.warmup_steps,
+            measured_steps=contract.measured_steps,
+            repetition=0,
+        )
+        for repetition in range(contract.repetitions):
+            hardware_state_snapshots.append(
+                _capture_hardware_state(
+                    device_uuid=device_uuid,
+                    phase=f"repetition_{repetition}_start",
+                )
+            )
+            samples = _select_repeat_samples(
+                bundle,
+                repetition=repetition,
+                batch_size=batch_size,
+            )
+            repetitions.append(
+                _run_repetition(
+                    model,
+                    torch,
+                    samples,
+                    energy_meter,
+                    device=device,
+                    warmup_steps=contract.warmup_steps,
+                    measured_steps=contract.measured_steps,
+                    repetition=repetition,
+                )
+            )
+            hardware_state_snapshots.append(
+                _capture_hardware_state(
+                    device_uuid=device_uuid,
+                    phase=f"repetition_{repetition}_end",
+                )
+            )
+    except Exception as error:
+        is_oom = isinstance(error, torch.cuda.OutOfMemoryError) or (
+            "cuda out of memory" in str(error).lower()
+            or "cuda error: out of memory" in str(error).lower()
+        )
+        state = "oom" if is_oom else "failed"
+        error_class = type(error).__name__
+        error_message = str(error) or repr(error)
+        repetitions.clear()
+    finally:
+        try:
+            hardware_state_snapshots.append(
+                _capture_hardware_state(
+                    device_uuid=device_uuid,
+                    phase="run_end",
+                )
+            )
+        except Exception as snapshot_error:
+            if state == "succeeded":
+                state = "failed"
+                error_class = type(snapshot_error).__name__
+                error_message = str(snapshot_error) or repr(snapshot_error)
+                repetitions.clear()
+        if model is not None:
+            del model
+        energy_meter.close()
+        gc.collect()
+        with torch.cuda.device(selected):
+            torch.cuda.empty_cache()
+
+    result_arguments = {
+        "contract_hash": contract.contract_hash,
+        "device_label": canonical_device_label,
+        "device_name": device_name,
+        "device_uuid": device_uuid,
+        "runtime_environment": runtime,
+        "batch_size": batch_size,
+        "state": state,
+        "repetitions": tuple(repetitions),
+        "hardware_state_snapshots": tuple(hardware_state_snapshots),
+        "error_class": error_class,
+        "error_message": error_message,
+        "created_at_utc": created_at,
+    }
+    try:
+        return GPUBaselineResult(**result_arguments)
+    except (TypeError, ValueError) as validation_error:
+        if state != "succeeded":
+            raise
+        return GPUBaselineResult(
+            **{
+                **result_arguments,
+                "state": "failed",
+                "repetitions": (),
+                "error_class": type(validation_error).__name__,
+                "error_message": (
+                    str(validation_error) or repr(validation_error)
+                ),
+            }
+        )
+
+
+def build_gpu_baseline_report(
+    contract: GPUBaselineContract,
+    results: Sequence[GPUBaselineResult],
+) -> Mapping[str, Any]:
+    """Join raw device results without extrapolating across devices or batches."""
+
+    rows = tuple(
+        sorted(
+            results,
+            key=lambda row: (
+                row.device_label,
+                row.device_uuid,
+                row.batch_size,
+                row.result_id,
+            ),
+        )
+    )
+    if not rows:
+        raise ValueError("GPU baseline report requires results")
+    if any(row.contract_hash != contract.contract_hash for row in rows):
+        raise ValueError("GPU baseline results use different contracts")
+    keys = tuple(
+        (row.device_uuid, row.batch_size) for row in rows
+    )
+    if len(keys) != len(set(keys)):
+        raise ValueError("GPU baseline report contains duplicate device batches")
+    planned_batches = set(contract.planned_batch_sizes)
+    if any(row.batch_size not in planned_batches for row in rows):
+        raise ValueError("GPU baseline report contains an unplanned batch")
+    planned_labels = set(contract.planned_device_labels)
+    if any(row.device_label not in planned_labels for row in rows):
+        raise ValueError("GPU baseline report contains an unplanned device")
+    for device_label in planned_labels:
+        label_uuids = {
+            row.device_uuid
+            for row in rows
+            if row.device_label == device_label
+        }
+        if len(label_uuids) > 1:
+            raise ValueError(
+                "one planned GPU label maps to multiple physical devices"
+            )
+    logical_hardware_keys = {"device_name", "compute_capability"}
+    software_environments = {
+        _canonical_hash(
+            {
+                key: value
+                for key, value in row.runtime_environment.logical.items()
+                if key not in logical_hardware_keys
+            }
+        )
+        for row in rows
+    }
+    if len(software_environments) != 1:
+        raise ValueError(
+            "GPU baseline results use incompatible software environments"
+        )
+    observed_driver_versions = {
+        snapshot.fields["driver_version"]
+        for row in rows
+        for snapshot in row.hardware_state_snapshots
+    }
+    if len(observed_driver_versions) > 1:
+        raise ValueError("GPU baseline results use different driver versions")
+    for device_uuid in {row.device_uuid for row in rows}:
+        device_rows = tuple(
+            row for row in rows if row.device_uuid == device_uuid
+        )
+        if len({row.device_label for row in device_rows}) != 1:
+            raise ValueError("one GPU UUID has conflicting device labels")
+        if len({row.device_name for row in device_rows}) != 1:
+            raise ValueError("one GPU UUID has conflicting device names")
+        if len(
+            {
+                row.runtime_environment.logical_fingerprint
+                for row in device_rows
+            }
+        ) != 1:
+            raise ValueError(
+                "one GPU was measured under different runtime environments"
+            )
+        if len(
+            {
+                row.runtime_environment.observation.get(
+                    "total_memory_bytes"
+                )
+                for row in device_rows
+            }
+        ) != 1:
+            raise ValueError("one GPU UUID has conflicting memory capacity")
+    prompt_ids = tuple(prompt.document_id for prompt in contract.prompts)
+    for row in rows:
+        if row.state != "succeeded":
+            continue
+        if len(row.repetitions) != contract.repetitions:
+            raise ValueError("GPU result repetition count differs from contract")
+        for repetition in row.repetitions:
+            if len(repetition.decode_step_ms) != contract.measured_steps:
+                raise ValueError(
+                    "GPU result measured-step count differs from contract"
+                )
+            expected_calls = contract.warmup_steps + contract.measured_steps
+            if (
+                repetition.q_len_one_calls != expected_calls
+                or repetition.cache_growth_checks != expected_calls
+            ):
+                raise ValueError(
+                    "GPU result cached-q1 evidence differs from contract"
+                )
+            start = (
+                repetition.repetition * row.batch_size
+            ) % len(prompt_ids)
+            expected_ids = tuple(
+                prompt_ids[(start + offset) % len(prompt_ids)]
+                for offset in range(row.batch_size)
+            )
+            if repetition.document_ids != expected_ids:
+                raise ValueError(
+                    "GPU result prompt selection differs from contract"
+                )
+            if any(
+                device.requested_power_sample_interval_ms
+                != contract.power_trace_sample_interval_ms
+                for device in repetition.energy_measurement.devices
+            ):
+                raise ValueError(
+                    "GPU energy sample interval differs from the contract"
+                )
+    trajectories: dict[
+        tuple[int, int, tuple[str, ...]],
+        str,
+    ] = {}
+    for row in rows:
+        if row.state != "succeeded":
+            continue
+        for repetition in row.repetitions:
+            key = (
+                row.batch_size,
+                repetition.repetition,
+                repetition.document_ids,
+            )
+            previous_hash = trajectories.setdefault(
+                key,
+                repetition.generated_token_sha256,
+            )
+            if previous_hash != repetition.generated_token_sha256:
+                raise ValueError(
+                    "GPU devices followed different generated-token "
+                    "trajectories"
+                )
+    succeeded = tuple(row for row in rows if row.state == "succeeded")
+    completion_by_device: dict[str, Mapping[str, Any]] = {}
+    completion_by_device_label: dict[str, Mapping[str, Any]] = {}
+    complete_devices: set[str] = set()
+    for device_uuid in sorted({row.device_uuid for row in rows}):
+        device_rows = tuple(
+            row for row in rows if row.device_uuid == device_uuid
+        )
+        observed_batches = {row.batch_size for row in device_rows}
+        missing_batches = tuple(sorted(planned_batches - observed_batches))
+        failed_batches = tuple(
+            sorted(
+                row.batch_size
+                for row in device_rows
+                if row.state == "failed"
+            )
+        )
+        complete = not missing_batches and not failed_batches
+        if complete:
+            complete_devices.add(device_uuid)
+        completion_by_device[device_uuid] = {
+            "complete": complete,
+            "missing_batch_sizes": list(missing_batches),
+            "failed_batch_sizes": list(failed_batches),
+        }
+    for device_label in contract.planned_device_labels:
+        label_rows = tuple(
+            row for row in rows if row.device_label == device_label
+        )
+        observed_batches = {row.batch_size for row in label_rows}
+        missing_batches = tuple(sorted(planned_batches - observed_batches))
+        failed_batches = tuple(
+            sorted(
+                row.batch_size
+                for row in label_rows
+                if row.state == "failed"
+            )
+        )
+        uuids = sorted({row.device_uuid for row in label_rows})
+        completion_by_device_label[device_label] = {
+            "complete": (
+                len(uuids) == 1
+                and not missing_batches
+                and not failed_batches
+            ),
+            "device_uuid": uuids[0] if len(uuids) == 1 else None,
+            "missing_batch_sizes": list(missing_batches),
+            "failed_batch_sizes": list(failed_batches),
+        }
+    best_by_device: dict[str, Mapping[str, Any]] = {}
+    for device_uuid in sorted(complete_devices):
+        candidates = tuple(
+            row
+            for row in succeeded
+            if row.device_uuid == device_uuid
+        )
+        if not candidates:
+            continue
+        best = max(
+            candidates,
+            key=lambda row: float(row.summary["tokens_per_second"]),
+        )
+        best_by_device[device_uuid] = {
+            "device_label": best.device_label,
+            "device_name": best.device_name,
+            "batch_size": best.batch_size,
+            "result_id": best.result_id,
+            "tokens_per_second": best.summary["tokens_per_second"],
+            "mean_batch_step_ms": best.summary["mean_batch_step_ms"],
+            "energy": best.summary["energy"],
+            "selection_scope": "measured_batches_only",
+        }
+    energy_availability_by_device_label: dict[str, Mapping[str, Any]] = {}
+    for device_label in contract.planned_device_labels:
+        successful_rows = tuple(
+            row
+            for row in succeeded
+            if row.device_label == device_label
+        )
+        energy_availability_by_device_label[device_label] = {
+            "available_batch_sizes": [
+                row.batch_size
+                for row in successful_rows
+                if bool(row.summary["energy"]["available"])
+            ],
+            "unavailable_by_batch_size": {
+                str(row.batch_size): row.summary["energy"]["unavailable_reason"]
+                for row in successful_rows
+                if not bool(row.summary["energy"]["available"])
+            },
+            "meter_methods": sorted(
+                {
+                    str(row.summary["energy"]["meter_method"])
+                    for row in successful_rows
+                }
+            ),
+        }
+    body = {
+        "schema_version": GPU_BASELINE_REPORT_SCHEMA,
+        "contract": contract.to_dict(),
+        "results": [row.to_dict() for row in rows],
+        "completion_by_device": completion_by_device,
+        "completion_by_device_label": completion_by_device_label,
+        "best_measured_by_device": best_by_device,
+        "energy_availability_by_device_label": (
+            energy_availability_by_device_label
+        ),
+        "measurement_scope": "single_gpu_no_extrapolation",
+        "timing_scope": contract.timing_scope,
+        "energy_scope": contract.energy_scope,
+        "energy_meter_priority": list(contract.energy_meter_priority),
+        "complete": all(
+            record["complete"]
+            for record in completion_by_device_label.values()
+        ),
+    }
+    return {**body, "report_hash": _canonical_hash(body)}
+
+
+@dataclass(frozen=True)
+class ThroughputEvidenceRow:
+    """One provenance-bound throughput observation with an explicit evidence tier."""
+
+    system_name: str
+    model_name: str
+    model_revision: str
+    context_length: int
+    batch_size: int
+    tokens_per_second: float
+    evidence_tier: str
+    evidence_source: str
+    resource_budget_hash: str
+    artifact_hash: str
+    workspace_provenance_sha256: str | None
+    q_len: int = 1
+    schema_version: str = THROUGHPUT_EVIDENCE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != THROUGHPUT_EVIDENCE_SCHEMA:
+            raise ValueError("unsupported throughput-evidence schema")
+        if not self.system_name or not self.model_name or not self.evidence_source:
+            raise ValueError("throughput evidence identity must be complete")
+        _require_git_commit(self.model_revision, "model_revision")
+        _require_positive_int(self.context_length, "context_length")
+        _require_positive_int(self.batch_size, "batch_size")
+        if self.q_len != 1:
+            raise ValueError("throughput evidence must use cached q_len=1 decode")
+        throughput = _require_nonnegative_finite(
+            self.tokens_per_second,
+            "tokens_per_second",
+        )
+        if throughput <= 0:
+            raise ValueError("tokens_per_second must be positive")
+        object.__setattr__(self, "tokens_per_second", throughput)
+        if self.evidence_tier not in {
+            MEASURED_EVIDENCE_TIER,
+            PEAK_ROOFLINE_EVIDENCE_TIER,
+        }:
+            raise ValueError("unsupported throughput evidence tier")
+        _require_sha256(self.resource_budget_hash, "resource_budget_hash")
+        _require_sha256(self.artifact_hash, "artifact_hash")
+        if self.evidence_tier == MEASURED_EVIDENCE_TIER:
+            if self.workspace_provenance_sha256 is None:
+                raise ValueError("measured throughput requires workspace provenance")
+            _require_sha256(
+                self.workspace_provenance_sha256,
+                "workspace_provenance_sha256",
+            )
+        elif self.workspace_provenance_sha256 is not None:
+            _require_sha256(
+                self.workspace_provenance_sha256,
+                "workspace_provenance_sha256",
+            )
+
+    def _body(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "system_name": self.system_name,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "context_length": self.context_length,
+            "batch_size": self.batch_size,
+            "q_len": self.q_len,
+            "tokens_per_second": self.tokens_per_second,
+            "evidence_tier": self.evidence_tier,
+            "evidence_source": self.evidence_source,
+            "resource_budget_hash": self.resource_budget_hash,
+            "artifact_hash": self.artifact_hash,
+            "workspace_provenance_sha256": self.workspace_provenance_sha256,
+        }
+
+    @property
+    def evidence_id(self) -> str:
+        return f"throughput-{_canonical_hash(self._body())}"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {**self._body(), "evidence_id": self.evidence_id}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ThroughputEvidenceRow":
+        row = cls(
+            schema_version=str(value["schema_version"]),
+            system_name=str(value["system_name"]),
+            model_name=str(value["model_name"]),
+            model_revision=str(value["model_revision"]),
+            context_length=int(value["context_length"]),
+            batch_size=int(value["batch_size"]),
+            q_len=int(value["q_len"]),
+            tokens_per_second=float(value["tokens_per_second"]),
+            evidence_tier=str(value["evidence_tier"]),
+            evidence_source=str(value["evidence_source"]),
+            resource_budget_hash=str(value["resource_budget_hash"]),
+            artifact_hash=str(value["artifact_hash"]),
+            workspace_provenance_sha256=(
+                None
+                if value.get("workspace_provenance_sha256") is None
+                else str(value["workspace_provenance_sha256"])
+            ),
+        )
+        if value.get("evidence_id") != row.evidence_id:
+            raise ValueError("throughput-evidence identity mismatch")
+        return row
+
+
+@dataclass(frozen=True)
+class EnergyEvidenceRow:
+    """One measured energy-efficiency observation with raw-artifact identity."""
+
+    system_name: str
+    model_name: str
+    model_revision: str
+    context_length: int
+    batch_size: int
+    energy_per_token_j: float
+    mean_decode_step_s: float
+    meter_method: str
+    device_ids: tuple[str, ...]
+    evidence_source: str
+    resource_budget_hash: str
+    artifact_hash: str
+    workspace_provenance_sha256: str
+    q_len: int = 1
+    evidence_tier: str = MEASURED_EVIDENCE_TIER
+    schema_version: str = ENERGY_EVIDENCE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != ENERGY_EVIDENCE_SCHEMA:
+            raise ValueError("unsupported energy-evidence schema")
+        if self.evidence_tier != MEASURED_EVIDENCE_TIER:
+            raise ValueError("headline energy evidence must be measured")
+        if (
+            not self.system_name
+            or not self.model_name
+            or not self.meter_method
+            or not self.evidence_source
+        ):
+            raise ValueError("energy evidence identity must be complete")
+        _require_git_commit(self.model_revision, "model_revision")
+        _require_positive_int(self.context_length, "context_length")
+        _require_positive_int(self.batch_size, "batch_size")
+        if self.q_len != 1:
+            raise ValueError("energy evidence must use cached q_len=1 decode")
+        energy = _require_nonnegative_finite(
+            self.energy_per_token_j,
+            "energy_per_token_j",
+        )
+        delay = _require_nonnegative_finite(
+            self.mean_decode_step_s,
+            "mean_decode_step_s",
+        )
+        if energy <= 0 or delay <= 0:
+            raise ValueError("measured energy and decode delay must be positive")
+        object.__setattr__(self, "energy_per_token_j", energy)
+        object.__setattr__(self, "mean_decode_step_s", delay)
+        if not self.device_ids or any(not value for value in self.device_ids):
+            raise ValueError("energy evidence requires measurement device identities")
+        if len(self.device_ids) != len(set(self.device_ids)):
+            raise ValueError("energy evidence repeats a measurement device")
+        for name in (
+            "resource_budget_hash",
+            "artifact_hash",
+            "workspace_provenance_sha256",
+        ):
+            _require_sha256(str(getattr(self, name)), name)
+
+    @property
+    def tokens_per_joule(self) -> float:
+        return 1.0 / self.energy_per_token_j
+
+    @property
+    def energy_delay_product_j_s(self) -> float:
+        return self.energy_per_token_j * self.mean_decode_step_s
+
+    def _body(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "system_name": self.system_name,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "context_length": self.context_length,
+            "batch_size": self.batch_size,
+            "q_len": self.q_len,
+            "energy_per_token_j": self.energy_per_token_j,
+            "tokens_per_joule": self.tokens_per_joule,
+            "mean_decode_step_s": self.mean_decode_step_s,
+            "energy_delay_product_j_s": self.energy_delay_product_j_s,
+            "meter_method": self.meter_method,
+            "device_ids": list(self.device_ids),
+            "evidence_tier": self.evidence_tier,
+            "evidence_source": self.evidence_source,
+            "resource_budget_hash": self.resource_budget_hash,
+            "artifact_hash": self.artifact_hash,
+            "workspace_provenance_sha256": self.workspace_provenance_sha256,
+        }
+
+    @property
+    def evidence_id(self) -> str:
+        return f"energy-{_canonical_hash(self._body())}"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {**self._body(), "evidence_id": self.evidence_id}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "EnergyEvidenceRow":
+        row = cls(
+            schema_version=str(value["schema_version"]),
+            system_name=str(value["system_name"]),
+            model_name=str(value["model_name"]),
+            model_revision=str(value["model_revision"]),
+            context_length=int(value["context_length"]),
+            batch_size=int(value["batch_size"]),
+            q_len=int(value["q_len"]),
+            energy_per_token_j=float(value["energy_per_token_j"]),
+            mean_decode_step_s=float(value["mean_decode_step_s"]),
+            meter_method=str(value["meter_method"]),
+            device_ids=tuple(str(item) for item in value["device_ids"]),
+            evidence_tier=str(value["evidence_tier"]),
+            evidence_source=str(value["evidence_source"]),
+            resource_budget_hash=str(value["resource_budget_hash"]),
+            artifact_hash=str(value["artifact_hash"]),
+            workspace_provenance_sha256=str(
+                value["workspace_provenance_sha256"]
+            ),
+        )
+        if value.get("tokens_per_joule") != row.tokens_per_joule:
+            raise ValueError("energy evidence tokens/J mismatch")
+        if (
+            value.get("energy_delay_product_j_s")
+            != row.energy_delay_product_j_s
+        ):
+            raise ValueError("energy evidence EDP mismatch")
+        if value.get("evidence_id") != row.evidence_id:
+            raise ValueError("energy-evidence identity mismatch")
+        return row
+
+
+def _resource_budget_hash(resource_budget: Mapping[str, Any]) -> str:
+    required = {
+        "reference_system",
+        "aggregate_area_limit_mm2",
+        "aggregate_hbm_capacity_limit_bytes",
+        "aggregate_hbm_bandwidth_limit_bytes_per_s",
+    }
+    if set(resource_budget) != required:
+        raise ValueError("resource budget fields differ from the comparison contract")
+    if not str(resource_budget["reference_system"]):
+        raise ValueError("resource budget reference system must be non-empty")
+    for field in (
+        "aggregate_area_limit_mm2",
+        "aggregate_hbm_capacity_limit_bytes",
+        "aggregate_hbm_bandwidth_limit_bytes_per_s",
+    ):
+        value = _require_nonnegative_finite(resource_budget[field], field)
+        if value <= 0:
+            raise ValueError(f"resource budget {field} must be positive")
+    return _canonical_hash(dict(resource_budget))
+
+
+def validate_gpu_baseline_report(
+    report: Mapping[str, Any],
+) -> tuple[GPUBaselineContract, Mapping[str, Any]]:
+    """Rebuild a baseline report from terminal rows and require exact identity."""
+
+    if report.get("schema_version") != GPU_BASELINE_REPORT_SCHEMA:
+        raise ValueError("unsupported GPU baseline report schema")
+    contract_value = report.get("contract")
+    if not isinstance(contract_value, Mapping):
+        raise ValueError("GPU baseline report lacks its contract")
+    contract = GPUBaselineContract.from_dict(contract_value)
+    results_value = report.get("results")
+    if not isinstance(results_value, Sequence) or isinstance(
+        results_value,
+        (str, bytes),
+    ):
+        raise ValueError("GPU baseline report lacks result rows")
+    results = tuple(
+        GPUBaselineResult.from_dict(row)
+        for row in results_value
+        if isinstance(row, Mapping)
+    )
+    if len(results) != len(results_value):
+        raise ValueError("GPU baseline report contains a malformed result row")
+    rebuilt = build_gpu_baseline_report(contract, results)
+    provided = {key: value for key, value in report.items() if key != "content_hash"}
+    if provided != rebuilt:
+        raise ValueError("GPU baseline report differs from its measured results")
+    return contract, rebuilt
+
+
+def build_gpu_baseline_stage_receipt(
+    report: Mapping[str, Any],
+    *,
+    provenance_path: str | Path,
+) -> Mapping[str, Any]:
+    """Bind all terminal baseline work units to the sweep provenance receipt."""
+
+    contract, rebuilt = validate_gpu_baseline_report(report)
+    if rebuilt["complete"] is not True:
+        raise ValueError("GPU baseline stage cannot seal an incomplete report")
+    path = Path(provenance_path).resolve()
+    provenance = load_immutable_json(path)
+    binding = contract.workspace_binding
+    if (
+        provenance.get("schema_version") != SWEEP_PROVENANCE_SCHEMA
+        or provenance.get("manifest_hash") != binding.manifest_hash
+        or provenance.get("run_plan_hash") != binding.run_plan_hash
+        or provenance.get("prompt_manifest_hash") != binding.prompt_manifest_hash
+        or _sha256_file(path) != binding.sweep_provenance_sha256
+    ):
+        raise ValueError("GPU baseline report differs from sweep provenance")
+    results = tuple(
+        GPUBaselineResult.from_dict(value) for value in rebuilt["results"]
+    )
+    body = {
+        "schema_version": GPU_BASELINE_STAGE_RECEIPT_SCHEMA,
+        "workspace_binding": binding.to_dict(),
+        "contract_hash": contract.contract_hash,
+        "report_hash": rebuilt["report_hash"],
+        "work_units": [
+            {
+                "device_label": label,
+                "batch_size": batch_size,
+                "first_gpu_only": True,
+            }
+            for label in contract.planned_device_labels
+            for batch_size in contract.planned_batch_sizes
+        ],
+        "terminal_result_ids": [result.result_id for result in results],
+        "energy_scope": contract.energy_scope,
+        "energy_availability_by_device_label": rebuilt[
+            "energy_availability_by_device_label"
+        ],
+        "complete": True,
+    }
+    return {**body, "receipt_hash": _canonical_hash(body)}
+
+
+def validate_gpu_baseline_stage_receipt(
+    report: Mapping[str, Any],
+    receipt: Mapping[str, Any],
+) -> Mapping[str, Any]:
+    """Require a sealed stage receipt for the exact terminal baseline report."""
+
+    contract, rebuilt = validate_gpu_baseline_report(report)
+    if rebuilt["complete"] is not True:
+        raise ValueError("GPU baseline stage receipt cannot cover an incomplete report")
+    results = tuple(
+        GPUBaselineResult.from_dict(value) for value in rebuilt["results"]
+    )
+    body = {
+        "schema_version": GPU_BASELINE_STAGE_RECEIPT_SCHEMA,
+        "workspace_binding": contract.workspace_binding.to_dict(),
+        "contract_hash": contract.contract_hash,
+        "report_hash": rebuilt["report_hash"],
+        "work_units": [
+            {
+                "device_label": label,
+                "batch_size": batch_size,
+                "first_gpu_only": True,
+            }
+            for label in contract.planned_device_labels
+            for batch_size in contract.planned_batch_sizes
+        ],
+        "terminal_result_ids": [result.result_id for result in results],
+        "energy_scope": contract.energy_scope,
+        "energy_availability_by_device_label": rebuilt[
+            "energy_availability_by_device_label"
+        ],
+        "complete": True,
+    }
+    expected = {**body, "receipt_hash": _canonical_hash(body)}
+    provided = {key: value for key, value in receipt.items() if key != "content_hash"}
+    if provided != expected:
+        raise ValueError("GPU baseline stage receipt differs from its report")
+    return expected
+
+
+def gpu_baseline_throughput_evidence(
+    report: Mapping[str, Any],
+    *,
+    stage_receipt: Mapping[str, Any],
+    device_label: str,
+    resource_budget: Mapping[str, Any],
+) -> ThroughputEvidenceRow:
+    """Select the best measured batch for one contracted GPU device label."""
+
+    contract, rebuilt = validate_gpu_baseline_report(report)
+    validate_gpu_baseline_stage_receipt(rebuilt, stage_receipt)
+    report_hash = str(rebuilt["report_hash"])
+    if rebuilt["complete"] is not True:
+        raise ValueError("headline GPU baseline report must be complete")
+    best_by_device = rebuilt.get("best_measured_by_device")
+    if not isinstance(best_by_device, Mapping):
+        raise ValueError("GPU baseline report lacks best measured results")
+    matches = tuple(
+        row
+        for row in best_by_device.values()
+        if isinstance(row, Mapping) and row.get("device_label") == device_label
+    )
+    if len(matches) != 1:
+        raise ValueError("GPU baseline device label lacks one best measured result")
+    best = matches[0]
+    return ThroughputEvidenceRow(
+        system_name=str(best["device_name"]),
+        model_name=contract.model_name,
+        model_revision=contract.model_revision,
+        context_length=contract.context_length,
+        batch_size=int(best["batch_size"]),
+        q_len=contract.q_len,
+        tokens_per_second=float(best["tokens_per_second"]),
+        evidence_tier=MEASURED_EVIDENCE_TIER,
+        evidence_source=GPU_BASELINE_SCOPE,
+        resource_budget_hash=_resource_budget_hash(resource_budget),
+        artifact_hash=report_hash,
+        workspace_provenance_sha256=(
+            contract.workspace_binding.sweep_provenance_sha256
+        ),
+    )
+
+
+def gpu_baseline_energy_evidence(
+    report: Mapping[str, Any],
+    *,
+    stage_receipt: Mapping[str, Any],
+    device_label: str,
+    resource_budget: Mapping[str, Any],
+) -> EnergyEvidenceRow:
+    """Build measured GPU energy evidence or fail with the recorded reason."""
+
+    contract, rebuilt = validate_gpu_baseline_report(report)
+    validate_gpu_baseline_stage_receipt(rebuilt, stage_receipt)
+    if rebuilt["complete"] is not True:
+        raise ValueError("headline GPU energy report must be complete")
+    best_by_device = rebuilt.get("best_measured_by_device")
+    if not isinstance(best_by_device, Mapping):
+        raise ValueError("GPU baseline report lacks best measured results")
+    matches = tuple(
+        row
+        for row in best_by_device.values()
+        if isinstance(row, Mapping) and row.get("device_label") == device_label
+    )
+    if len(matches) != 1:
+        raise ValueError("GPU baseline device label lacks one measured result")
+    best = matches[0]
+    energy = best.get("energy")
+    if not isinstance(energy, Mapping):
+        raise ValueError("GPU baseline result lacks board-energy evidence")
+    if energy.get("available") is not True:
+        reason = str(
+            energy.get("unavailable_reason")
+            or "no supported measured board-energy meter"
+        )
+        raise ValueError(f"measured GPU energy is unavailable: {reason}")
+    meter_method = str(energy.get("meter_method", ""))
+    if meter_method not in GPU_BASELINE_ENERGY_METER_PRIORITY:
+        raise ValueError("GPU energy evidence does not use a contracted NVML meter")
+    device_ids = tuple(str(item) for item in energy.get("device_uuids", ()))
+    energy_per_token = energy.get("energy_per_token_j")
+    mean_step_ms = best.get("mean_batch_step_ms")
+    if energy_per_token is None or mean_step_ms is None:
+        raise ValueError("GPU energy evidence lacks measured joules or delay")
+    return EnergyEvidenceRow(
+        system_name=str(best["device_name"]),
+        model_name=contract.model_name,
+        model_revision=contract.model_revision,
+        context_length=contract.context_length,
+        batch_size=int(best["batch_size"]),
+        q_len=contract.q_len,
+        energy_per_token_j=float(energy_per_token),
+        mean_decode_step_s=float(mean_step_ms) / 1000.0,
+        meter_method=meter_method,
+        device_ids=device_ids,
+        evidence_source=GPU_BASELINE_ENERGY_SOURCE,
+        resource_budget_hash=_resource_budget_hash(resource_budget),
+        artifact_hash=str(rebuilt["report_hash"]),
+        workspace_provenance_sha256=(
+            contract.workspace_binding.sweep_provenance_sha256
+        ),
+    )
+
+
+def build_headline_energy_comparison(
+    *,
+    plena_measurement: EnergyEvidenceRow,
+    gpu_measurement: EnergyEvidenceRow,
+    resource_budget: Mapping[str, Any],
+) -> Mapping[str, Any]:
+    """Compare measured tokens/J and EDP without an analytic substitute."""
+
+    budget_hash = _resource_budget_hash(resource_budget)
+    rows = (plena_measurement, gpu_measurement)
+    if any(row.evidence_tier != MEASURED_EVIDENCE_TIER for row in rows):
+        raise ValueError("headline energy ratios require measured evidence")
+    if gpu_measurement.evidence_source != GPU_BASELINE_ENERGY_SOURCE:
+        raise ValueError("headline energy denominator must be measured GPU board energy")
+    if plena_measurement.evidence_source == GPU_BASELINE_ENERGY_SOURCE:
+        raise ValueError("headline energy numerator must be a measured PLENA result")
+    for field in (
+        "model_name",
+        "model_revision",
+        "context_length",
+        "q_len",
+        "resource_budget_hash",
+        "workspace_provenance_sha256",
+    ):
+        if len({getattr(row, field) for row in rows}) != 1:
+            raise ValueError(f"headline energy evidence differs on {field}")
+    if plena_measurement.resource_budget_hash != budget_hash:
+        raise ValueError("headline energy evidence uses a different resource budget")
+    body = {
+        "schema_version": ENERGY_COMPARISON_SCHEMA,
+        "evidence_tier": MEASURED_EVIDENCE_TIER,
+        "resource_budget": dict(resource_budget),
+        "resource_budget_hash": budget_hash,
+        "numerator": plena_measurement.to_dict(),
+        "denominator": gpu_measurement.to_dict(),
+        "tokens_per_joule_ratio": (
+            plena_measurement.tokens_per_joule
+            / gpu_measurement.tokens_per_joule
+        ),
+        "energy_per_token_improvement": (
+            gpu_measurement.energy_per_token_j
+            / plena_measurement.energy_per_token_j
+        ),
+        "energy_delay_product_improvement": (
+            gpu_measurement.energy_delay_product_j_s
+            / plena_measurement.energy_delay_product_j_s
+        ),
+        "ratio_semantics": "measured_plena_over_measured_gpu_efficiency",
+        "analytic_substitution_permitted": False,
+    }
+    return {**body, "comparison_hash": _canonical_hash(body)}
+
+
+def build_headline_throughput_comparison(
+    *,
+    plena_measurement: ThroughputEvidenceRow,
+    gpu_measurement: ThroughputEvidenceRow,
+    peak_roofline_rows: Sequence[ThroughputEvidenceRow],
+    resource_budget: Mapping[str, Any],
+) -> Mapping[str, Any]:
+    """Build a measured-only headline ratio and a separate peak-bound table."""
+
+    budget_hash = _resource_budget_hash(resource_budget)
+    headline_rows = (plena_measurement, gpu_measurement)
+    if any(row.evidence_tier != MEASURED_EVIDENCE_TIER for row in headline_rows):
+        raise ValueError("headline throughput ratios require measured evidence on both sides")
+    if gpu_measurement.evidence_source != GPU_BASELINE_SCOPE:
+        raise ValueError("headline denominator must be the measured cached-q1 GPU baseline")
+    if plena_measurement.evidence_source == GPU_BASELINE_SCOPE:
+        raise ValueError("headline numerator must be a measured PLENA result")
+    matched_fields = (
+        "model_name",
+        "model_revision",
+        "context_length",
+        "q_len",
+        "resource_budget_hash",
+        "workspace_provenance_sha256",
+    )
+    for field in matched_fields:
+        values = {getattr(row, field) for row in headline_rows}
+        if len(values) != 1:
+            raise ValueError(f"headline throughput evidence differs on {field}")
+    if plena_measurement.resource_budget_hash != budget_hash:
+        raise ValueError("headline throughput evidence uses a different resource budget")
+    peaks = tuple(peak_roofline_rows)
+    if not peaks:
+        raise ValueError("comparison requires a separately labelled peak-roofline table")
+    for row in peaks:
+        if row.evidence_tier != PEAK_ROOFLINE_EVIDENCE_TIER:
+            raise ValueError("peak-roofline table contains non-peak evidence")
+        if (
+            row.model_name != plena_measurement.model_name
+            or row.model_revision != plena_measurement.model_revision
+            or row.context_length != plena_measurement.context_length
+            or row.q_len != 1
+        ):
+            raise ValueError("peak-roofline row uses a different model workload")
+    headline = {
+        "evidence_tier": MEASURED_EVIDENCE_TIER,
+        "numerator": plena_measurement.to_dict(),
+        "denominator": gpu_measurement.to_dict(),
+        "throughput_ratio": (
+            plena_measurement.tokens_per_second
+            / gpu_measurement.tokens_per_second
+        ),
+        "ratio_semantics": "measured_plena_over_measured_gpu",
+    }
+    body = {
+        "schema_version": THROUGHPUT_COMPARISON_SCHEMA,
+        "resource_budget": dict(resource_budget),
+        "resource_budget_hash": budget_hash,
+        "headline": headline,
+        "peak_roofline_table": [row.to_dict() for row in peaks],
+        "peak_roofline_ratio_permitted": False,
+    }
+    return {**body, "comparison_hash": _canonical_hash(body)}
+
+
+def _load_config(path: str | Path) -> Mapping[str, Any]:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise ValueError("GPU baseline config must contain an object")
+    return value
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+
+    prepare = commands.add_parser("prepare")
+    prepare.add_argument("--config", required=True)
+    prepare.add_argument("--sample-bundle", required=True)
+    prepare.add_argument("--provenance", required=True)
+    prepare.add_argument("--output", required=True)
+    prepare.add_argument(
+        "--attention-implementation",
+        default="sdpa",
+    )
+    prepare.add_argument("--warmup-steps", type=int, default=16)
+    prepare.add_argument("--measured-steps", type=int, default=128)
+    prepare.add_argument("--repetitions", type=int, default=3)
+    prepare.add_argument(
+        "--device-labels",
+        nargs="+",
+        default=("A100", "H100"),
+    )
+    prepare.add_argument(
+        "--batch-sizes",
+        type=int,
+        nargs="+",
+        default=(1, 2, 4, 8),
+    )
+    prepare.add_argument(
+        "--energy-meter-priority",
+        nargs="+",
+        default=GPU_BASELINE_ENERGY_METER_PRIORITY,
+    )
+    prepare.add_argument(
+        "--power-trace-sample-interval-ms",
+        type=int,
+        default=10,
+    )
+
+    run = commands.add_parser("run")
+    run.add_argument("--config", required=True)
+    run.add_argument("--sample-bundle", required=True)
+    run.add_argument("--contract", required=True)
+    run.add_argument("--device", required=True)
+    run.add_argument("--device-label", required=True)
+    run.add_argument("--batch-size", type=int, required=True)
+    run.add_argument("--output", required=True)
+
+    merge = commands.add_parser("merge")
+    merge.add_argument("--contract", required=True)
+    merge.add_argument("--results", nargs="+", required=True)
+    merge.add_argument("--output", required=True)
+
+    receipt = commands.add_parser("receipt")
+    receipt.add_argument("--report", required=True)
+    receipt.add_argument("--provenance", required=True)
+    receipt.add_argument("--output", required=True)
+    return parser
+
+
+def main(argv: Iterable[str] | None = None) -> int:
+    args = _parser().parse_args(tuple(argv) if argv is not None else None)
+    try:
+        if args.command == "prepare":
+            config = _load_config(args.config)
+            bundle = load_sample_bundle(args.sample_bundle)
+            workspace_binding = load_gpu_baseline_workspace_binding(
+                args.provenance,
+                bundle,
+            )
+            contract = build_gpu_baseline_contract(
+                config,
+                bundle,
+                workspace_binding,
+                attention_implementation=args.attention_implementation,
+                warmup_steps=args.warmup_steps,
+                measured_steps=args.measured_steps,
+                repetitions=args.repetitions,
+                planned_device_labels=args.device_labels,
+                planned_batch_sizes=args.batch_sizes,
+                energy_meter_priority=args.energy_meter_priority,
+                power_trace_sample_interval_ms=(
+                    args.power_trace_sample_interval_ms
+                ),
+            )
+            payload = contract.to_dict()
+        elif args.command == "run":
+            config = _load_config(args.config)
+            bundle = load_sample_bundle(args.sample_bundle)
+            contract = GPUBaselineContract.from_dict(
+                load_immutable_json(Path(args.contract))
+            )
+            destination = Path(args.output)
+            if destination.exists():
+                existing = GPUBaselineResult.from_dict(
+                    load_immutable_json(destination)
+                )
+                if (
+                    existing.contract_hash != contract.contract_hash
+                    or existing.batch_size != args.batch_size
+                    or _normalized_label(existing.device_label)
+                    != _normalized_label(args.device_label)
+                ):
+                    raise ValueError(
+                        "existing GPU baseline result belongs to another work unit"
+                    )
+                payload = existing.to_dict()
+            else:
+                payload = run_gpu_baseline(
+                    config,
+                    bundle,
+                    contract,
+                    device=args.device,
+                    device_label=args.device_label,
+                    batch_size=args.batch_size,
+                ).to_dict()
+        elif args.command == "merge":
+            contract = GPUBaselineContract.from_dict(
+                load_immutable_json(Path(args.contract))
+            )
+            results = tuple(
+                GPUBaselineResult.from_dict(load_immutable_json(Path(path)))
+                for path in args.results
+            )
+            payload = build_gpu_baseline_report(contract, results)
+        else:
+            payload = build_gpu_baseline_stage_receipt(
+                load_immutable_json(Path(args.report)),
+                provenance_path=args.provenance,
+            )
+        write_immutable_json(Path(args.output), payload)
+        print(json.dumps(payload, indent=2, sort_keys=True))
+        return 0
+    except Exception as error:
+        print(
+            json.dumps(
+                {
+                    "error_class": type(error).__name__,
+                    "error_message": str(error),
+                },
+                sort_keys=True,
+            ),
+            file=sys.stderr,
+        )
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+
+
+__all__ = [
+    "ENERGY_COMPARISON_SCHEMA",
+    "ENERGY_EVIDENCE_SCHEMA",
+    "ENERGY_UNAVAILABLE_METHOD",
+    "GPU_BASELINE_CONTRACT_SCHEMA",
+    "GPU_BASELINE_ENERGY_METER_PRIORITY",
+    "GPU_BASELINE_ENERGY_SCOPE",
+    "GPU_BASELINE_ENERGY_SOURCE",
+    "GPU_BASELINE_EXECUTION_MODE",
+    "GPU_BASELINE_REPORT_SCHEMA",
+    "GPU_BASELINE_RESULT_SCHEMA",
+    "GPU_BASELINE_SCOPE",
+    "GPU_BASELINE_STAGE_RECEIPT_SCHEMA",
+    "GPU_BASELINE_TIMING_SCOPE",
+    "GPU_BASELINE_WORKSPACE_BINDING_SCHEMA",
+    "GPU_ENERGY_MEASUREMENT_SCHEMA",
+    "MEASURED_EVIDENCE_TIER",
+    "NVIDIA_SMI_QUERY_FIELDS",
+    "NVML_POWER_TRACE_METHOD",
+    "NVML_TOTAL_ENERGY_METHOD",
+    "PEAK_ROOFLINE_EVIDENCE_TIER",
+    "THROUGHPUT_COMPARISON_SCHEMA",
+    "THROUGHPUT_EVIDENCE_SCHEMA",
+    "EnergyEvidenceRow",
+    "GPUDeviceEnergyMeasurement",
+    "GPUEnergyMeasurement",
+    "GPUHardwareStateSnapshot",
+    "GPUPowerTraceSample",
+    "GPUBaselineContract",
+    "GPUBaselinePrompt",
+    "GPUBaselineRepetition",
+    "GPUBaselineResult",
+    "GPUBaselineWorkspaceBinding",
+    "ThroughputEvidenceRow",
+    "build_headline_energy_comparison",
+    "build_headline_throughput_comparison",
+    "build_gpu_baseline_contract",
+    "build_gpu_baseline_report",
+    "build_gpu_baseline_stage_receipt",
+    "gpu_baseline_energy_evidence",
+    "gpu_baseline_throughput_evidence",
+    "load_gpu_baseline_workspace_binding",
+    "main",
+    "run_gpu_baseline",
+    "validate_gpu_baseline_report",
+    "validate_gpu_baseline_stage_receipt",
+]
diff --git a/decode_dse/software/precision_bindings.py b/decode_dse/software/precision_bindings.py
new file mode 100644
index 0000000..2c2edee
--- /dev/null
+++ b/decode_dse/software/precision_bindings.py
@@ -0,0 +1,508 @@
+"""Decode-only precision bindings for the MASE phase-split quantize pass."""
+
+from __future__ import annotations
+
+import hashlib
+from dataclasses import dataclass
+from typing import Any
+
+# Attention vs FFN projections, split so each can carry an independent weight
+# width. Regexes match Llama and Qwen3 dense naming.
+def parse_prec_token(tok: Any) -> tuple[str, Any]:
+    """Parse a precision token into (format, width).
+
+    ``4`` or ``"MXINT4"`` -> ("mxint", 4); ``"E2M1"`` -> ("mxfp", (2, 1)).
+    Width 16 (or ``None``) means unquantised -> ("mxint", None).
+    """
+    def parse_integer_width(value: int) -> tuple[str, int | None]:
+        if value == 16:
+            return ("mxint", None)
+        if value not in (2, 4, 8):
+            raise ValueError("MXINT width must be 2, 4, 8, or unquantized 16")
+        return ("mxint", value)
+
+    if tok is None:
+        return ("mxint", None)
+    if isinstance(tok, int):
+        return parse_integer_width(tok)
+    s = str(tok).upper()
+    if s.startswith("MXINT"):
+        return parse_integer_width(int(s[5:]))
+    if s.startswith("E") and "M" in s:
+        e, m = s[1:].split("M")
+        return ("mxfp", (int(e), int(m)))
+    if s.isdigit():
+        return parse_prec_token(int(s))
+    raise ValueError(
+        f"unrecognised precision token {tok!r} "
+        "(use e.g. 4, 'MXINT4', 'E2M1')."
+    )
+
+
+_ATTN_LINEAR_RE = r"model\.layers\.\d+\.self_attn\.(q_proj|k_proj|v_proj|o_proj)$"
+_FFN_LINEAR_RE = r"model\.layers\.\d+\.mlp\.(gate_proj|up_proj|down_proj)$"
+_SELF_ATTN_RE = r"model\.layers\.\d+\.self_attn$"
+_MLP_RE = r"model\.layers\.\d+\.mlp$"
+_DECODER_LAYER_RE = r"model\.layers\.\d+$"
+_RMSNORM_RE = (
+    r"(model\.layers\.\d+\.(input_layernorm|post_attention_layernorm|"
+    r"self_attn\.(q_norm|k_norm))|model\.norm)$"
+)
+
+
+@dataclass(frozen=True)
+class DecodeQuantSpec:
+    """One decode precision point for the software eval.
+
+    Widths are ints for MXINT and ``"E{e}M{m}"`` tokens (or (exp, frac) tuples)
+    for MXFP. ``act_w`` is the decode activation compute width (stored bf16 —
+    accuracy-only, no HBM cost). ``fp_setting`` optionally quantises the vector
+    unit (SiLU + RMSNorm) to a plain-minifloat ``(exp, frac)`` width; leaving it
+    ``None`` keeps those ops unquantised so SDPA remains usable in both phases.
+    """
+
+    attn_w: Any = 4
+    ffn_w: Any = 4
+    kv: Any = 4
+    w_fmt: str = "mxint"
+    kv_fmt: str = "mxint"
+    key_kv: Any | None = None
+    value_kv: Any | None = None
+    key_kv_fmt: str | None = None
+    value_kv_fmt: str | None = None
+    weight_block: int = 8
+    kv_block: int = 8
+    act_w: Any = 8
+    act_fmt: str = "mxint"
+    act_block: int = 8
+    use_gptq: bool = False
+    use_rotation: bool = False  # selective phase-aware rotation (decode-only) — subsumes GPTQ
+    fp_setting: str | tuple[int, int] | None = "BF16"
+    fp_setting_attention: bool = True
+    quant_attn_internals: bool = True
+    matrix_mlen: int = 1024
+
+    def __post_init__(self):
+        def validate_integer(role: str, fmt: str | None, width: Any) -> None:
+            if fmt != "mxint" or width is None:
+                return
+            value = int(width)
+            if value not in (2, 4, 8) and value < 16:
+                raise ValueError(
+                    f"{role} MXINT width must be 2, 4, 8, or unquantized"
+                )
+
+        if self.attn_w != self.ffn_w:
+            raise ValueError(
+                "attention and FFN must share one global weight precision"
+            )
+        validate_integer("weight", self.w_fmt, self.attn_w)
+        validate_integer("activation", self.act_fmt, self.act_w)
+        validate_integer("KV", self.kv_fmt, self.kv)
+        for name, block in (
+            ("weight_block", self.weight_block),
+            ("act_block", self.act_block),
+            ("kv_block", self.kv_block),
+        ):
+            if block not in (8, 16, 32):
+                raise ValueError(f"{name} must be 8, 16, or 32")
+        split_values = (
+            self.key_kv,
+            self.value_kv,
+            self.key_kv_fmt,
+            self.value_kv_fmt,
+        )
+        if any(value is not None for value in split_values) and not all(
+            value is not None for value in split_values
+        ):
+            raise ValueError(
+                "split KV precision requires key/value formats and widths"
+            )
+        if all(value is not None for value in split_values):
+            validate_integer("key KV", self.key_kv_fmt, self.key_kv)
+            validate_integer("value KV", self.value_kv_fmt, self.value_kv)
+        if self.fp_setting is not None:
+            _vector_token(self.fp_setting)
+        if self.fp_setting is not None and not self.fp_setting_attention:
+            raise ValueError("vector precision must cover qk_norm, RoPE, and softmax")
+        if self.act_w is not None and not self.quant_attn_internals:
+            raise ValueError("activation precision must cover QK and PV inputs")
+        if (
+            isinstance(self.matrix_mlen, bool)
+            or not isinstance(self.matrix_mlen, int)
+            or self.matrix_mlen <= 0
+            or self.matrix_mlen % 8
+        ):
+            raise ValueError("matrix_mlen must be a positive multiple of 8")
+
+    @property
+    def gptq_weights(self) -> bool:
+        """Whether the decode weight bank comes from a calibrated pass (GPTQ or
+        rotation, which runs GPTQ internally) rather than plain RTN."""
+        return self.use_gptq or self.use_rotation
+
+    @property
+    def needs_eager(self) -> bool:
+        """Return whether the configured decode semantics require eager attention."""
+        return self.act_w is not None or self.fp_setting is not None
+
+    @property
+    def split_kv(self) -> bool:
+        """Return whether K and V use explicit role-specific formats."""
+
+        return self.key_kv is not None
+
+    @property
+    def key_kv_precision(self) -> tuple[str, Any]:
+        """Return the K-cache format and width."""
+
+        if self.split_kv:
+            return str(self.key_kv_fmt), self.key_kv
+        return self.kv_fmt, self.kv
+
+    @property
+    def value_kv_precision(self) -> tuple[str, Any]:
+        """Return the V-cache format and width."""
+
+        if self.split_kv:
+            return str(self.value_kv_fmt), self.value_kv
+        return self.kv_fmt, self.kv
+
+    @property
+    def tag(self) -> str:
+        method = "rot" if self.use_rotation else "gptq" if self.use_gptq else "rtn"
+        if isinstance(self.fp_setting, tuple):
+            fp_token = f"E{self.fp_setting[0]}M{self.fp_setting[1]}"
+        else:
+            fp_token = self.fp_setting
+        fp = f"_fp-{fp_token}" if fp_token else ""
+        act = _wtok(self.act_fmt, self.act_w) if self.act_w is not None else "i16"
+        key_fmt, key_width = self.key_kv_precision
+        value_fmt, value_width = self.value_kv_precision
+        kv = (
+            f"__k-{_wtok(key_fmt, key_width)}__v-{_wtok(value_fmt, value_width)}"
+            if self.split_kv
+            else f"__kv-{_wtok(self.kv_fmt, self.kv)}"
+        )
+        return (
+            f"{method}__aw-{_wtok(self.w_fmt, self.attn_w)}"
+            f"__fw-{_wtok(self.w_fmt, self.ffn_w)}"
+            f"{kv}__a-{act}__b{self.weight_block}{fp}"
+        )
+
+
+# One 8-bit shared scale per MX block (E8M0)
+_SCALE_BITS = 8
+_MATRIX_SEMANTICS = {
+    "schema_version": "plena-matrix-semantics",
+    "block_size": 8,
+    "mxint_rule": "block8_range_safe_scale_widened_mac_max_shift16_rne_vector",
+    "mxint_max_shift": 16,
+    "mxint_vector_rounding": "round_to_nearest_even",
+    "mxint_partial_conversion": (
+        "per_mm_ic_integer_reduction_to_vector_storage_fp"
+    ),
+    "mxint_cross_instruction_accumulation": (
+        "signed_fixed16_16_wraparound"
+    ),
+    "mxfp_rule": "product_cast_to_m_fp_then_fixed16_16_bank",
+    "m_fp_format_binding": "profile.vector_format",
+    "matrix_storage_fp_binding": "profile.vector_format",
+    "matrix_instruction_k_partition": "MLEN",
+    "qk_logical_k_partition": "HLEN",
+    "fixed_accumulator_integer_bits": 16,
+    "fixed_accumulator_fraction_bits": 16,
+    "accumulator_rule": "plena_fixed16_16_accumulate_truncate",
+    "output_rule": "truncate_to_vector_format",
+    "mixed_family_rule": "deployment_unsupported_without_trace_evidence",
+    "mixed_family_deployment_supported": False,
+}
+
+
+def eff_bits(fmt: str, width: Any, block: int) -> float:
+    """Average stored bits per element including the per-block shared scale."""
+    if fmt == "mxint":
+        elem = int(width)
+    else:
+        e, m = _mxfp_exp_frac(width)
+        elem = 1 + e + m
+    return elem + _SCALE_BITS / block
+
+
+def _wtok(fmt: str, width: Any) -> str:
+    if fmt == "mxint":
+        return f"i{int(width)}"
+    if isinstance(width, str):
+        return width
+    return f"E{width[0]}M{width[1]}"
+
+
+def _mxfp_exp_frac(width: Any) -> tuple[int, int]:
+    """Parse an MXFP width token/tuple into (exponent_bits, frac_bits)."""
+    if isinstance(width, str):
+        e, m = width.upper().lstrip("E").split("M")
+        return int(e), int(m)
+    return int(width[0]), int(width[1])
+
+
+def _weight_keys(fmt: str, width: Any, block: int) -> dict[str, Any]:
+    """Weight quantiser keys for the given format."""
+    if fmt == "mxint":
+        return {"weight_block_size": block, "weight_width": int(width)}
+    e, m = _mxfp_exp_frac(width)
+    return {"weight_block_size": block, "weight_exponent_width": e, "weight_frac_width": m}
+
+
+def _act_keys(fmt: str, width: Any, block: int) -> dict[str, Any]:
+    """Activation (data_in) quantiser keys for the given format."""
+    if fmt == "mxint":
+        return {"data_in_block_size": block, "data_in_width": int(width)}
+    e, m = _mxfp_exp_frac(width)
+    return {"data_in_block_size": block, "data_in_exponent_width": e, "data_in_frac_width": m}
+
+
+def _linear_decode(spec: DecodeQuantSpec, weight_width: Any) -> dict[str, Any]:
+    """Decode config for one linear group (weights + optional activation quant)."""
+    cfg: dict[str, Any] = dict(_weight_keys(spec.w_fmt, weight_width, spec.weight_block))
+    if spec.act_w is not None:
+        cfg.update(_act_keys(spec.act_fmt, spec.act_w, spec.act_block))
+    cfg.update(
+        _matrix_contract(
+            spec.act_fmt if spec.act_w is not None else "bf16",
+            spec.w_fmt,
+            spec.fp_setting or "BF16",
+            block_sizes=(
+                spec.weight_block,
+                spec.act_block if spec.act_w is not None else spec.weight_block,
+            ),
+            matrix_mlen=spec.matrix_mlen,
+        )
+    )
+    if spec.gptq_weights:
+        # The decode weight bank comes from GPTQ/rotation; don't RTN it again.
+        cfg["gptq"] = True
+    return cfg
+
+
+def _vector_token(fp_setting: str | tuple[int, int]) -> str:
+    """Return the canonical vector-format token."""
+    if isinstance(fp_setting, tuple):
+        return f"FP_E{int(fp_setting[0])}M{int(fp_setting[1])}"
+    token = str(fp_setting).upper()
+    if token == "BF16":
+        return token
+    if token.startswith("FP_E") and "M" in token:
+        return token
+    if token.startswith("E") and "M" in token:
+        return f"FP_{token}"
+    raise ValueError(f"unsupported vector format {fp_setting!r}")
+
+
+def _fp_stage_keys(fp_setting: str | tuple[int, int]) -> dict[str, Any]:
+    """Return one vector-stage precision config."""
+    return {
+        "format": _vector_token(fp_setting),
+        "data_in_is_finite": False,
+        "data_in_round_mode": "rn",
+    }
+
+
+def _matrix_contract(
+    left_family: str,
+    right_family: str,
+    output_format: str | tuple[int, int],
+    *,
+    block_sizes: tuple[int, ...],
+    matrix_mlen: int,
+) -> dict[str, Any]:
+    """Return the strict matrix-output oracle contract for one operand pair."""
+    unique_blocks = set(block_sizes)
+    if len(unique_blocks) != 1:
+        raise ValueError("matrix operands must use one shared MX block size")
+    quantization_block_size = unique_blocks.pop()
+    if quantization_block_size not in (8, 16, 32):
+        raise ValueError("matrix quantization block must be 8, 16, or 32")
+    family_pair = (left_family, right_family)
+    if family_pair == ("mxint", "mxint"):
+        family_binding = _MATRIX_SEMANTICS["mxint_rule"]
+    elif family_pair == ("mxfp", "mxfp"):
+        family_binding = _MATRIX_SEMANTICS["mxfp_rule"]
+    else:
+        family_binding = _MATRIX_SEMANTICS["mixed_family_rule"]
+    return {
+        "accumulator_rule": _MATRIX_SEMANTICS["accumulator_rule"],
+        "output_rule": _MATRIX_SEMANTICS["output_rule"],
+        "output_format": _vector_token(output_format),
+        "operand_family_binding": family_binding,
+        "matrix_semantics": dict(_MATRIX_SEMANTICS),
+        "quantization_block_size": quantization_block_size,
+        "native_datapath": quantization_block_size == 8,
+        "numerical_trace_conformance": "not_run",
+        "matrix_oracle_scope": "instruction_partitioned_numerical_oracle",
+        "matrix_mlen": matrix_mlen,
+    }
+
+
+def _attn_decode(spec: DecodeQuantSpec) -> dict[str, Any]:
+    """Bind A to attention inputs and KV only to cached matrix operands."""
+    matrix_input = (
+        _act_keys(spec.act_fmt, spec.act_w, spec.act_block)
+        if spec.act_w is not None
+        else {"bypass": True}
+    )
+    fp = (
+        _fp_stage_keys(spec.fp_setting)
+        if spec.fp_setting is not None
+        else {"bypass": True}
+    )
+    key_fmt, key_width = spec.key_kv_precision
+    value_fmt, value_width = spec.value_kv_precision
+
+    def matrix_config(cache_format: str) -> dict[str, Any]:
+        config = dict(matrix_input)
+        config.update(
+            _matrix_contract(
+                spec.act_fmt,
+                cache_format,
+                spec.fp_setting or "BF16",
+                block_sizes=(spec.act_block, spec.kv_block),
+                matrix_mlen=spec.matrix_mlen,
+            )
+        )
+        return config
+
+    if spec.split_kv:
+        kv_cache = {
+            "key": _act_keys(key_fmt, key_width, spec.kv_block),
+            "value": _act_keys(value_fmt, value_width, spec.kv_block),
+        }
+    else:
+        kv_cache = _act_keys(spec.kv_fmt, spec.kv, spec.kv_block)
+    return {
+        "qk_norm": dict(fp),
+        "qk_matmul": matrix_config(key_fmt),
+        "av_matmul": matrix_config(value_fmt),
+        "softmax": dict(fp),
+        "rope": dict(fp),
+        "kv_cache": kv_cache,
+    }
+
+
+def _fp_setting_keys(
+    fp_setting: str | tuple[int, int],
+) -> dict[str, Any]:
+    """Return vector config shared by norms, gates, and residuals."""
+    config = _fp_stage_keys(fp_setting)
+    config.update(
+        {
+            "weight_is_finite": False,
+            "weight_round_mode": "rn",
+        }
+    )
+    return config
+
+
+def build_decode_pass_args(
+    model_name: str,
+    device: str,
+    spec: DecodeQuantSpec,
+    gptq_cfg: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Assemble the phase-split quantize ``pass_args`` for one decode precision.
+
+    Each module carries only a ``decode`` bucket, so the normaliser bypasses
+    prefill unquantised and sets ``decode_policy="quantized"`` automatically.
+    """
+    wname = spec.w_fmt  # "mxint" | "mxfp"
+    pass_args: dict[str, Any] = {
+        "by": "regex_name",
+        _SELF_ATTN_RE: {
+            "config": {
+                "name": spec.act_fmt,
+                "kv_cache_handoff": "fp",
+                "decode": _attn_decode(spec),
+            },
+        },
+        _ATTN_LINEAR_RE: {
+            "config": {"name": wname, "decode": _linear_decode(spec, spec.attn_w)},
+        },
+        _FFN_LINEAR_RE: {
+            "config": {"name": wname, "decode": _linear_decode(spec, spec.ffn_w)},
+        },
+    }
+
+    if spec.fp_setting is not None:
+        fp = _fp_setting_keys(spec.fp_setting)
+        pass_args[_DECODER_LAYER_RE] = {
+            "config": {"name": "minifloat", "decode": dict(fp)}
+        }
+        pass_args[_MLP_RE] = {"config": {"name": "minifloat", "decode": dict(fp)}}
+        pass_args[_RMSNORM_RE] = {"config": {"name": "minifloat", "decode": dict(fp)}}
+
+    # Calibrated weights (GPTQ, or rotation which runs GPTQ internally) need the
+    # gptq block: it carries the calibration setup and the checkpoint dir.
+    if spec.gptq_weights:
+        base_gptq = {
+            "model_name": model_name,
+            "device": device,
+            "dataset": "wikitext2",
+            "nsamples": 128,
+            "seqlen": 2048,
+            "format": wname,
+            "weight_config": _weight_keys(wname, spec.attn_w, spec.weight_block),
+            # GPTQ output becomes the DECODE weight bank; FP weights are
+            # restored so prefill stays unquantised.
+            "phase": "decode",
+            "quantile_search": True,
+            "clip_search_y": False,
+        }
+        if gptq_cfg:
+            base_gptq.update(gptq_cfg)
+        pass_args["gptq"] = base_gptq
+
+    if spec.use_rotation:
+        # Route the whole quantize step through phase-aware rotation search:
+        # it does GPTQ + module replacement + per-matmul rotate tuning, scoring
+        # every candidate in the decode phase. Prefill stays unquantised
+        rot: dict[str, Any] = {
+            "model_name": model_name,
+            "device": device,
+            "calib_data": base_gptq.get("dataset", "wikitext2"),
+            "calib_nsamples": 32,
+            "calib_seqlen": 1024,
+            "score_phase": "decode",
+        }
+        ckpt = base_gptq.get("checkpoint_dir")
+        if ckpt:
+            rot["cache_path"] = f"{ckpt}/rotation_decisions.json"
+        if gptq_cfg and gptq_cfg.get("rotation"):
+            rot.update(gptq_cfg["rotation"])
+        pass_args["rotation_search"] = rot
+
+    return pass_args
+
+
+def gptq_cache_key(model_name: str, spec: DecodeQuantSpec, gptq_cfg: dict[str, Any] | None) -> str:
+    """Stable key for the GPTQ decode weight bank.
+
+    GPTQ depends only on the model, the weight format/width/block and the
+    calibration setup — NOT on KV width, activation width or FP_SETTING. So one
+    checkpoint serves every KV/activation variant at the same weight width,
+    which is what makes a decode precision sweep cheap.
+    """
+    cfg = gptq_cfg or {}
+    payload = "|".join(
+        str(x)
+        for x in (
+            model_name,
+            spec.w_fmt,
+            spec.attn_w,  # == ffn_w in calibrated mode
+            spec.weight_block,
+            "rot" if spec.use_rotation else "gptq",  # rotation banks differ from plain GPTQ
+            cfg.get("dataset", "wikitext2"),          # task-aligned calib -> distinct bank
+            cfg.get("nsamples", 128),
+            cfg.get("seqlen", 2048),
+            "erry" if cfg.get("clip_search_y") else "noclip",  # Erry clip changes weights
+        )
+    )
+    return hashlib.sha1(payload.encode()).hexdigest()[:12]
diff --git a/decode_dse/software/preflight.py b/decode_dse/software/preflight.py
new file mode 100644
index 0000000..dec6183
--- /dev/null
+++ b/decode_dse/software/preflight.py
@@ -0,0 +1,1356 @@
+"""Preflight correctness checks and the fail-closed evidence they feed.
+
+Checks measure fresh-bank, split-BF16, and cache-reuse behaviour; evidence
+assembly then requires every profile to carry a verified terminal result."""
+
+from __future__ import annotations
+
+import argparse
+import gc
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+from decode_dse.manifest import SweepManifest, load_manifest
+from decode_dse.profiles import DECODE_FORMATS, PROFILE_KIND_BF16_REFERENCE
+from decode_dse.software.cached_decode import (
+    ContinuationExample,
+    TorchHFCachedDecodeBackend,
+    capture_bf16_prefill,
+    evaluate_teacher_forced_cached,
+    evaluate_teacher_forced_cached_batched,
+)
+from decode_dse.software.sweep import (
+    ExecutorContext,
+    _load_config,
+    _validate_provenance,
+)
+from decode_dse.software.decode_evaluator import (
+    PACKED_CACHE_LAYOUT,
+    DecodeEvaluator,
+    _prefill_path,
+)
+from decode_dse.software.cache_artifacts import (
+    ArtifactProvenance,
+    BF16CacheConverter,
+    admit_prefill_cache,
+    load_prefill_artifact,
+)
+from decode_dse.software.sweep_plan import (
+    PromptManifest,
+    NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+    SweepRunPlan,
+    load_immutable_json,
+    make_stage_manifest,
+    write_immutable_json,
+)
+import hashlib
+import json
+import math
+from datetime import datetime
+from decode_dse.legality import load_stack_validity
+from decode_dse.software.sweep_runner import (
+    COMPLETION_SCHEMA,
+    RESULT_SCHEMA,
+)
+from decode_dse.software.sweep import STAGE_INVOCATION_SCHEMA
+from decode_dse.software.sweep_plan import (
+    PREFLIGHT_EVIDENCE_SCHEMA,
+    PromptManifest,
+    SweepRunPlan,
+    load_immutable_json,
+    write_immutable_json,
+)
+
+
+FRESH_BANK_SCHEMA = "decode-fresh-bank-check"
+
+
+BF16_CHECK_SCHEMA = "decode-bf16-check"
+
+
+CROSS_DEVICE_SCHEMA = "decode-cross-device-anchor"
+
+
+def _load_plan(path: Path) -> SweepRunPlan:
+    value = load_immutable_json(path)
+    value.pop("content_hash")
+    return SweepRunPlan.from_dict(value)
+
+
+def _load_prompts(path: Path) -> PromptManifest:
+    value = load_immutable_json(path)
+    value.pop("content_hash")
+    return PromptManifest.from_dict(value)
+
+
+def _context(
+    *,
+    config_path: Path,
+    output_dir: Path,
+    device_label: str,
+) -> ExecutorContext:
+    config = _load_config(config_path)
+    manifest = load_manifest(output_dir / "manifest.json")
+    plan = _load_plan(output_dir / "run_plan.json")
+    prompts = _load_prompts(output_dir / "prompt_manifest.json")
+    if device_label not in plan.device_labels:
+        raise ValueError("device label is outside the run plan")
+    _validate_provenance(
+        output_dir / "provenance.json",
+        repository=Path(__file__).resolve().parents[2],
+        config_path=config_path,
+        manifest=manifest,
+        plan=plan,
+        prompts=prompts,
+    )
+    return ExecutorContext(
+        stage="preflight",
+        workspace_root=output_dir,
+        output_dir=output_dir / "preflight-correctness",
+        config=config,
+        master_manifest=manifest,
+        stage_manifest=make_stage_manifest(
+            manifest,
+            plan.preflight_profile_ids,
+        ),
+        run_plan=plan,
+        prompts=prompts,
+        sample_contract=NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+        shard_index=0,
+        shard_count=1,
+        device_label=device_label,
+    )
+
+
+def _entry(manifest: SweepManifest, profile_id: str):
+    matches = tuple(
+        entry for entry in manifest.entries if entry.profile_id == profile_id
+    )
+    if len(matches) != 1:
+        raise ValueError(f"unknown or duplicate profile {profile_id}")
+    return matches[0]
+
+
+def _run_fresh_bank_worker(
+    *,
+    config_path: Path,
+    output_dir: Path,
+    device_label: str,
+    profile_id: str,
+    result_path: Path,
+) -> None:
+    context = _context(
+        config_path=config_path,
+        output_dir=output_dir,
+        device_label=device_label,
+    )
+    entry = _entry(context.stage_manifest, profile_id)
+    executor = DecodeEvaluator(context)
+    with executor.open_weight_bank(
+        entry.profile.weight_format,
+        (entry,),
+    ) as bank:
+        with executor.open_kv_admission_cache(
+            entry.profile.kv_format
+        ) as admitted:
+            outcome = executor.evaluate(
+                entry,
+                weight_bank=bank,
+                kv_admission_cache=admitted,
+            )
+    write_immutable_json(
+        result_path,
+        {
+            "schema_version": FRESH_BANK_SCHEMA,
+            "manifest_hash": context.master_manifest.canonical_hash,
+            "run_plan_hash": context.run_plan.canonical_hash,
+            "prompt_manifest_hash": context.prompts.canonical_hash,
+            "profile_id": profile_id,
+            "weight_format": entry.profile.weight_format,
+            "mean_token_nll": outcome.metrics["mean_token_nll"],
+        },
+    )
+
+
+def _run_device_anchor_worker(
+    *,
+    config_path: Path,
+    output_dir: Path,
+    device_label: str,
+    result_path: Path,
+) -> None:
+    context = _context(
+        config_path=config_path,
+        output_dir=output_dir,
+        device_label=device_label,
+    )
+    entries = tuple(
+        entry
+        for entry in context.stage_manifest.entries
+        if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+    )
+    if len(entries) != 1:
+        raise RuntimeError("preflight requires one BF16 cross-device anchor")
+    entry = entries[0]
+    executor = DecodeEvaluator(context)
+    with executor.open_weight_bank("BF16", (entry,)) as bank:
+        with executor.open_kv_admission_cache("BF16") as admitted:
+            outcome = executor.evaluate(
+                entry,
+                weight_bank=bank,
+                kv_admission_cache=admitted,
+            )
+    write_immutable_json(
+        result_path,
+        {
+            "schema_version": CROSS_DEVICE_SCHEMA,
+            "manifest_hash": context.master_manifest.canonical_hash,
+            "run_plan_hash": context.run_plan.canonical_hash,
+            "prompt_manifest_hash": context.prompts.canonical_hash,
+            "device_label": device_label,
+            "profile_nll": {
+                entry.profile_id: outcome.metrics["mean_token_nll"],
+            },
+        },
+    )
+
+
+class _RecordingBackend(TorchHFCachedDecodeBackend):
+    def __init__(
+        self, *, device: Any, execution_batch_width: int | None = None
+    ) -> None:
+        super().__init__(
+            device=device,
+            native_append_format=True,
+            execution_batch_width=execution_batch_width,
+        )
+        self.logits: list[Any] = []
+
+    def decode_step(self, model: Any, **kwargs: Any):
+        result = super().decode_step(model, **kwargs)
+        self.logits.append(result.logits.detach().to("cpu"))
+        return result
+
+    def decode_step_batch(self, model: Any, **kwargs: Any):
+        result = super().decode_step_batch(model, **kwargs)
+        self.logits.append(result.logits.detach().to("cpu"))
+        return result
+
+
+def _cache_equal(left: Any, right: Any) -> bool:
+    if len(left.layers) != len(right.layers):
+        return False
+    return all(
+        fresh.key == saved.key and fresh.value == saved.value
+        for fresh, saved in zip(left.layers, right.layers)
+    )
+
+
+def _evaluate_bf16(
+    *,
+    model: Any,
+    device: Any,
+    prefill: Any,
+    continuation: tuple[int, ...],
+    document_id: str,
+    provenance: ArtifactProvenance,
+    execution_batch_width: int | None = None,
+) -> tuple[Any, tuple[Any, ...]]:
+    admitted = admit_prefill_cache(
+        prefill,
+        precision_id="BF16",
+        layout_id=PACKED_CACHE_LAYOUT,
+        converter=BF16CacheConverter(),
+        provenance=provenance,
+        metadata={"document_id": document_id},
+    )
+    backend = _RecordingBackend(
+        device=device, execution_batch_width=execution_batch_width
+    )
+    result = evaluate_teacher_forced_cached(
+        model,
+        ContinuationExample(
+            document_id=document_id,
+            prefill=prefill,
+            decode_cache=admitted,
+            continuation_ids=continuation,
+        ),
+        backend,
+    )
+    return result, tuple(backend.logits)
+
+
+def _evaluate_direct_hf(
+    *,
+    model: Any,
+    device: Any,
+    prompt_token_ids: tuple[int, ...],
+    continuation: tuple[int, ...],
+    execution_batch_width: int | None = None,
+) -> tuple[float, tuple[Any, ...], tuple[int, ...]]:
+    import torch
+
+    input_ids = torch.tensor(
+        [prompt_token_ids],
+        dtype=torch.long,
+        device=device,
+    )
+    attention_mask = torch.ones_like(input_ids)
+    position_ids = torch.arange(
+        input_ids.shape[1],
+        dtype=torch.long,
+        device=device,
+    )[None, :]
+    cache_position = torch.arange(
+        input_ids.shape[1],
+        dtype=torch.long,
+        device=device,
+    )
+    with torch.no_grad():
+        output = model(
+            input_ids=input_ids,
+            attention_mask=attention_mask,
+            position_ids=position_ids,
+            cache_position=cache_position,
+            use_cache=True,
+        )
+    first_token = int(output.logits[0, -1].argmax(dim=-1).item())
+    if first_token != continuation[0]:
+        raise AssertionError("direct BF16 prefill selected a different first token")
+    backend = _RecordingBackend(
+        device=device, execution_batch_width=execution_batch_width
+    )
+    cache = backend.adopt_cache(output.past_key_values)
+    losses: list[float] = []
+    predicted = [first_token]
+    for step_index, target_token in enumerate(continuation[1:]):
+        previous_length = backend.cache_length(cache)
+        expected_length = len(prompt_token_ids) + step_index
+        if previous_length != expected_length:
+            raise AssertionError("direct BF16 cache length is inconsistent")
+        result = backend.decode_step(
+            model,
+            input_token_id=continuation[step_index],
+            cache=cache,
+            attention_mask=(1,) * (previous_length + 1),
+            position_id=previous_length,
+            cache_position=previous_length,
+        )
+        if backend.cache_length(result.cache) != previous_length + 1:
+            raise AssertionError("direct BF16 decode did not append one entry")
+        cache = result.cache
+        losses.append(backend.token_nll(result.logits, target_token))
+        predicted.append(int(result.logits[0, 0].argmax(dim=-1).item()))
+    return (
+        sum(losses) / len(losses),
+        tuple(backend.logits),
+        tuple(predicted),
+    )
+
+
+def _run_bf16_worker(
+    *,
+    config_path: Path,
+    output_dir: Path,
+    device_label: str,
+    result_path: Path,
+) -> None:
+    import torch
+
+    context = _context(
+        config_path=config_path,
+        output_dir=output_dir,
+        device_label=device_label,
+    )
+    executor = DecodeEvaluator(context)
+    model = executor._load_model().to(executor.device).eval()
+    execution_batch_width = max(
+        context.run_plan.numerical_screen_microbatch_size,
+        context.run_plan.hardware_validation_microbatch_size,
+    )
+    provenance = ArtifactProvenance(
+        producer="packedkv-bf16-preflight-check",
+        code_revision=context.master_manifest.canonical_hash,
+        created_at_utc="1970-01-01T00:00:00Z",
+        parameters=(("manifest_hash", context.master_manifest.canonical_hash),),
+    )
+    split_checks: list[dict[str, Any]] = []
+    cache_checks: list[dict[str, Any]] = []
+    batched_examples: list[ContinuationExample] = []
+    scalar_results: dict[str, Any] = {}
+    scalar_logits: dict[str, tuple[Any, ...]] = {}
+    try:
+        for sample in executor.samples:
+            input_ids = torch.tensor(
+                [sample.prompt_token_ids],
+                dtype=torch.long,
+                device=executor.device,
+            )
+            mask = torch.ones_like(input_ids)
+            fresh = capture_bf16_prefill(
+                model,
+                input_ids=input_ids,
+                attention_mask=mask,
+                model_revision=str(context.config["model_revision"]),
+                tokenizer_revision=str(context.config["tokenizer_revision"]),
+                provenance=provenance,
+            )
+            saved = load_prefill_artifact(
+                _prefill_path(executor.prefill_root, sample.document_id)
+            )
+            continuation = (
+                saved.first_token.token_ids[0],
+                *sample.decode_target_ids[
+                    : context.sample_contract.decode_steps
+                ],
+            )
+            direct_nll, direct_logits, direct_tokens = _evaluate_direct_hf(
+                model=model,
+                device=executor.device,
+                prompt_token_ids=sample.prompt_token_ids,
+                continuation=continuation,
+                execution_batch_width=execution_batch_width,
+            )
+            fresh_result, fresh_logits = _evaluate_bf16(
+                model=model,
+                device=executor.device,
+                prefill=fresh,
+                continuation=continuation,
+                document_id=sample.document_id,
+                provenance=provenance,
+                execution_batch_width=execution_batch_width,
+            )
+            saved_result, saved_logits = _evaluate_bf16(
+                model=model,
+                device=executor.device,
+                prefill=saved,
+                continuation=continuation,
+                document_id=sample.document_id,
+                provenance=provenance,
+                execution_batch_width=execution_batch_width,
+            )
+            if len(direct_logits) != len(saved_logits):
+                raise AssertionError("BF16 decode produced different step counts")
+            max_logit_error = max(
+                (
+                    float((left.float() - right.float()).abs().max().item())
+                    for left, right in zip(direct_logits, saved_logits)
+                ),
+                default=0.0,
+            )
+            token_ids_equal = (
+                direct_tokens[0] == saved.first_token.token_ids[0]
+                and tuple(
+                    int(logits[0, 0].argmax(dim=-1).item())
+                    for logits in saved_logits
+                )
+                == direct_tokens[1:]
+            )
+            split_nll_error = abs(direct_nll - saved_result.mean_nll)
+            cache_nll_error = abs(fresh_result.mean_nll - saved_result.mean_nll)
+            source = str(result_path.resolve())
+            split_checks.append(
+                {
+                    "document_id": sample.document_id,
+                    "token_ids_equal": token_ids_equal,
+                    "max_abs_logit_error": max_logit_error,
+                    "mean_token_nll_abs_error": split_nll_error,
+                    "source_artifact": source,
+                }
+            )
+            cache_checks.append(
+                {
+                    "document_id": sample.document_id,
+                    "cache_content_equal": _cache_equal(fresh, saved),
+                    "mean_token_nll_abs_error": cache_nll_error,
+                    "source_artifact": source,
+                }
+            )
+            admitted = admit_prefill_cache(
+                saved,
+                precision_id="BF16",
+                layout_id=PACKED_CACHE_LAYOUT,
+                converter=BF16CacheConverter(),
+                provenance=provenance,
+                metadata={"document_id": sample.document_id},
+            )
+            batched_examples.append(
+                ContinuationExample(
+                    document_id=sample.document_id,
+                    prefill=saved,
+                    decode_cache=admitted,
+                    continuation_ids=continuation,
+                )
+            )
+            scalar_results[sample.document_id] = saved_result
+            scalar_logits[sample.document_id] = saved_logits
+            del (
+                input_ids,
+                mask,
+                fresh,
+                fresh_result,
+                direct_logits,
+                fresh_logits,
+            )
+        microbatch_checks = []
+        for microbatch_size in sorted(
+            {
+                context.run_plan.numerical_screen_microbatch_size,
+                context.run_plan.hardware_validation_microbatch_size,
+            }
+        ):
+            selected = tuple(batched_examples[:microbatch_size])
+            backend = _RecordingBackend(
+                device=executor.device,
+                execution_batch_width=execution_batch_width,
+            )
+            batched = evaluate_teacher_forced_cached_batched(
+                model,
+                selected,
+                backend,
+            )
+            reversed_backend = _RecordingBackend(
+                device=executor.device,
+                execution_batch_width=execution_batch_width,
+            )
+            reversed_results = evaluate_teacher_forced_cached_batched(
+                model,
+                tuple(reversed(selected)),
+                reversed_backend,
+            )
+            reversed_by_id = {
+                result.document_id: result for result in reversed_results
+            }
+            max_nll_error = 0.0
+            max_logit_error = 0.0
+            permutation_error = 0.0
+            cache_growth_exact = True
+            for lane, (example, result) in enumerate(zip(selected, batched)):
+                scalar = scalar_results[example.document_id]
+                max_nll_error = max(
+                    max_nll_error,
+                    *(
+                        abs(left - right)
+                        for left, right in zip(
+                            scalar.per_token_nll,
+                            result.per_token_nll,
+                        )
+                    ),
+                )
+                permutation_error = max(
+                    permutation_error,
+                    *(
+                        abs(left - right)
+                        for left, right in zip(
+                            result.per_token_nll,
+                            reversed_by_id[
+                                example.document_id
+                            ].per_token_nll,
+                        )
+                    ),
+                )
+                cache_growth_exact &= (
+                    result.final_cache_length
+                    == result.initial_cache_length + result.token_count
+                )
+                for step, batch_logits in enumerate(backend.logits):
+                    max_logit_error = max(
+                        max_logit_error,
+                        float(
+                            (
+                                scalar_logits[example.document_id][step][0]
+                                .float()
+                                - batch_logits[lane].float()
+                            )
+                            .abs()
+                            .max()
+                            .item()
+                        ),
+                    )
+            microbatch_checks.append(
+                {
+                    "profile_id": next(
+                        entry.profile_id
+                        for entry in context.master_manifest.entries
+                        if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+                    ),
+                    "microbatch_size": microbatch_size,
+                    "execution_batch_width": execution_batch_width,
+                    "max_abs_logit_error": max_logit_error,
+                    "max_abs_token_nll_error": max_nll_error,
+                    "max_abs_permutation_nll_error": permutation_error,
+                    "cache_growth_exact": cache_growth_exact,
+                    "lane_isolation_checked": True,
+                    "source_artifact": str(result_path.resolve()),
+                }
+            )
+    finally:
+        del model
+        gc.collect()
+        if torch.cuda.is_available():
+            torch.cuda.empty_cache()
+    write_immutable_json(
+        result_path,
+        {
+            "schema_version": BF16_CHECK_SCHEMA,
+            "manifest_hash": context.master_manifest.canonical_hash,
+            "run_plan_hash": context.run_plan.canonical_hash,
+            "prompt_manifest_hash": context.prompts.canonical_hash,
+            "bf16_split_checks": split_checks,
+            "cache_reuse_checks": cache_checks,
+            "microbatch_checks": microbatch_checks,
+        },
+    )
+
+
+def _run_subprocess(arguments: list[str]) -> None:
+    completed = subprocess.run(arguments, check=False)
+    if completed.returncode:
+        raise RuntimeError(
+            f"preflight worker failed with exit code {completed.returncode}"
+        )
+
+
+def _observed_preflight(output_dir: Path) -> dict[str, tuple[Mapping[str, Any], str]]:
+    return {
+        str(row["profile_id"]): (row, source)
+        for row, source in stage_rows(output_dir / "preflight")
+    }
+
+
+def _cross_device_checks(
+    plan: SweepRunPlan,
+    inputs: Iterable[str],
+    *,
+    prompt_manifest_hash: str,
+) -> list[dict[str, Any]]:
+    paths: dict[str, Path] = {}
+    for value in inputs:
+        if "=" not in value:
+            raise ValueError("cross-device inputs must use label=path")
+        label, path = value.split("=", 1)
+        if label in paths:
+            raise ValueError(f"duplicate cross-device label {label}")
+        paths[label] = Path(path)
+    if len(plan.device_labels) == 1:
+        if paths:
+            raise ValueError("cross-device inputs are invalid for one device type")
+        return []
+    if set(paths) != set(plan.device_labels):
+        raise ValueError("cross-device inputs must cover every planned device type")
+    by_label = {}
+    for label, path in paths.items():
+        value = load_immutable_json(path)
+        if (
+            value.get("schema_version") != CROSS_DEVICE_SCHEMA
+            or value.get("manifest_hash") != plan.manifest_hash
+            or value.get("run_plan_hash") != plan.canonical_hash
+            or value.get("prompt_manifest_hash") != prompt_manifest_hash
+            or value.get("device_label") != label
+            or not isinstance(value.get("profile_nll"), Mapping)
+        ):
+            raise ValueError(f"invalid cross-device anchor artifact: {path}")
+        by_label[label] = value
+    common = set.intersection(
+        *(
+            set(value["profile_nll"])
+            for value in by_label.values()
+        )
+    )
+    if not common:
+        raise ValueError("cross-device inputs have no common anchor profile")
+    if len(common) != 1:
+        raise ValueError("cross-device inputs require exactly one common anchor")
+    anchor = next(iter(common))
+    result: list[dict[str, Any]] = []
+    labels = sorted(by_label)
+    for left_index, left in enumerate(labels):
+        for right in labels[left_index + 1 :]:
+            result.append(
+                {
+                    "profile_id": anchor,
+                    "left_label": left,
+                    "right_label": right,
+                    "left_mean_token_nll": by_label[left]["profile_nll"][anchor],
+                    "right_mean_token_nll": by_label[right]["profile_nll"][anchor],
+                    "source_artifact": (
+                        f"{paths[left].resolve()}::{paths[right].resolve()}"
+                    ),
+                }
+            )
+    return result
+
+
+def _run_main(args: argparse.Namespace) -> None:
+    config_path = args.config.resolve()
+    output_dir = args.output_dir.resolve()
+    context = _context(
+        config_path=config_path,
+        output_dir=output_dir,
+        device_label=args.device_label,
+    )
+    observed = _observed_preflight(output_dir)
+    by_weight: dict[str, str] = {}
+    for entry in context.stage_manifest.entries:
+        weight = entry.profile.weight_format
+        if weight in DECODE_FORMATS and weight not in by_weight:
+            by_weight[weight] = entry.profile_id
+    if set(by_weight) != set(DECODE_FORMATS):
+        raise RuntimeError("preflight does not cover every decode weight format")
+    root = output_dir / "preflight-correctness"
+    root.mkdir(parents=True, exist_ok=True)
+    checks: list[dict[str, Any]] = []
+    for weight_format in DECODE_FORMATS:
+        profile_id = by_weight[weight_format]
+        path = root / f"fresh-{weight_format}.json"
+        if not path.exists():
+            _run_subprocess(
+                [
+                    sys.executable,
+                    "-m",
+                    "decode_dse.software.preflight", "check",
+                    "_weight",
+                    "--config",
+                    str(config_path),
+                    "--output-dir",
+                    str(output_dir),
+                    "--device-label",
+                    args.device_label,
+                    "--profile-id",
+                    profile_id,
+                    "--out",
+                    str(path),
+                ]
+            )
+        fresh = load_immutable_json(path)
+        if (
+            fresh.get("schema_version") != FRESH_BANK_SCHEMA
+            or fresh.get("manifest_hash")
+            != context.master_manifest.canonical_hash
+            or fresh.get("run_plan_hash") != context.run_plan.canonical_hash
+            or fresh.get("prompt_manifest_hash")
+            != context.prompts.canonical_hash
+            or fresh.get("profile_id") != profile_id
+            or fresh.get("weight_format") != weight_format
+        ):
+            raise ValueError(f"invalid fresh-bank artifact: {path}")
+        row, reused_source = observed[profile_id]
+        checks.append(
+            {
+                "profile_id": profile_id,
+                "left_label": "fresh_process",
+                "right_label": "reused_bank",
+                "left_mean_token_nll": fresh["mean_token_nll"],
+                "right_mean_token_nll": row["result"]["mean_token_nll"],
+                "source_artifact": f"{path.resolve()}::{reused_source}",
+            }
+        )
+    bf16_path = root / "bf16.json"
+    if not bf16_path.exists():
+        _run_subprocess(
+            [
+                sys.executable,
+                "-m",
+                "decode_dse.software.preflight", "check",
+                "_bf16",
+                "--config",
+                str(config_path),
+                "--output-dir",
+                str(output_dir),
+                "--device-label",
+                args.device_label,
+                "--out",
+                str(bf16_path),
+            ]
+        )
+    bf16 = load_immutable_json(bf16_path)
+    if (
+        bf16.get("schema_version") != BF16_CHECK_SCHEMA
+        or bf16.get("manifest_hash")
+        != context.master_manifest.canonical_hash
+        or bf16.get("run_plan_hash") != context.run_plan.canonical_hash
+        or bf16.get("prompt_manifest_hash")
+        != context.prompts.canonical_hash
+    ):
+        raise ValueError(f"invalid BF16 correctness artifact: {bf16_path}")
+    result = {
+        "schema_version": CORRECTNESS_SCHEMA,
+        "manifest_hash": context.master_manifest.canonical_hash,
+        "run_plan_hash": context.run_plan.canonical_hash,
+        "prompt_manifest_hash": context.prompts.canonical_hash,
+        "weight_bank_checks": checks,
+        "cross_device_checks": _cross_device_checks(
+            context.run_plan,
+            args.cross_device,
+            prompt_manifest_hash=context.prompts.canonical_hash,
+        ),
+        "bf16_split_checks": bf16["bf16_split_checks"],
+        "cache_reuse_checks": bf16["cache_reuse_checks"],
+        "microbatch_checks": bf16["microbatch_checks"],
+    }
+    write_immutable_json(args.out, result)
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    run = commands.add_parser("run")
+    worker = commands.add_parser("_weight")
+    bf16 = commands.add_parser("_bf16")
+    anchor = commands.add_parser("anchor")
+    for command in (run, worker, bf16, anchor):
+        command.add_argument("--config", type=Path, required=True)
+        command.add_argument("--output-dir", type=Path, required=True)
+        command.add_argument("--device-label", required=True)
+        command.add_argument("--out", type=Path, required=True)
+    run.add_argument("--cross-device", action="append", default=[])
+    worker.add_argument("--profile-id", required=True)
+    return parser
+
+
+def preflight_checks_main(argv: Iterable[str] | None = None) -> int:
+    args = _parser().parse_args(tuple(argv) if argv is not None else None)
+    if args.command == "run":
+        _run_main(args)
+    elif args.command == "anchor":
+        _run_device_anchor_worker(
+            config_path=args.config.resolve(),
+            output_dir=args.output_dir.resolve(),
+            device_label=args.device_label,
+            result_path=args.out.resolve(),
+        )
+    elif args.command == "_weight":
+        _run_fresh_bank_worker(
+            config_path=args.config.resolve(),
+            output_dir=args.output_dir.resolve(),
+            device_label=args.device_label,
+            profile_id=args.profile_id,
+            result_path=args.out.resolve(),
+        )
+    else:
+        _run_bf16_worker(
+            config_path=args.config.resolve(),
+            output_dir=args.output_dir.resolve(),
+            device_label=args.device_label,
+            result_path=args.out.resolve(),
+        )
+    return 0
+
+
+CORRECTNESS_SCHEMA = "decode-preflight-correctness"
+
+
+def _partitions(root: Path) -> tuple[Path, ...]:
+    if (root / "manifest.json").is_file():
+        return (root,)
+    values = tuple(sorted(root.glob("part-*-of-*")))
+    if not values:
+        raise FileNotFoundError(f"no stage partitions under {root}")
+    return values
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _parse_utc(value: object) -> datetime:
+    text = str(value)
+    parsed = datetime.fromisoformat(text.replace("Z", "+00:00"))
+    if parsed.tzinfo is None:
+        raise ValueError("stack evidence timestamps must include a timezone")
+    return parsed
+
+
+def _stack_evidence_preparation(
+    *,
+    path: Path,
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+) -> dict[str, Any]:
+    load_stack_validity(
+        path,
+        scope_profile_ids=plan.hardware_validation_profile_ids,
+        required_stages=("compiler", "emulator"),
+        scope_name="hardware-validation",
+        run_plan_hash=plan.canonical_hash,
+    )
+    value = load_immutable_json(path)
+    source_reports = value.get("source_reports")
+    if not isinstance(source_reports, Mapping):
+        raise ValueError("stack validity has no source reports")
+    intervals = []
+    stage_seconds = {}
+    stage_hashes = {}
+    for stage in ("compiler", "emulator"):
+        report = source_reports.get(stage)
+        if not isinstance(report, Mapping):
+            raise ValueError(f"stack validity lacks {stage} evidence")
+        provenance = report.get("provenance")
+        if not isinstance(provenance, Mapping):
+            raise ValueError(f"{stage} evidence lacks provenance")
+        started = _parse_utc(provenance.get("started_at_utc"))
+        completed = _parse_utc(provenance.get("completed_at_utc"))
+        elapsed = (completed - started).total_seconds()
+        if not math.isfinite(elapsed) or elapsed <= 0:
+            raise ValueError(
+                f"{stage} evidence has no positive measured wall interval"
+            )
+        intervals.append((started, completed))
+        stage_seconds[stage] = elapsed
+        stage_hashes[stage] = str(report.get("content_hash", ""))
+        if not stage_hashes[stage]:
+            raise ValueError(f"{stage} evidence lacks a report hash")
+    intervals.sort()
+    merged = []
+    for started, completed in intervals:
+        if not merged or started >= merged[-1][1]:
+            merged.append([started, completed])
+        elif completed > merged[-1][1]:
+            merged[-1][1] = completed
+    critical_path_seconds = sum(
+        (completed - started).total_seconds() for started, completed in merged
+    )
+    return {
+        "manifest_hash": manifest.canonical_hash,
+        "run_plan_hash": plan.canonical_hash,
+        "required_stages": ["compiler", "emulator"],
+        "compiler_seconds": stage_seconds["compiler"],
+        "emulator_seconds": stage_seconds["emulator"],
+        "critical_path_seconds": critical_path_seconds,
+        "timing_basis": "union_of_measured_stage_wall_intervals",
+        "stage_report_hashes": stage_hashes,
+        "stack_validity_hash": str(value["content_hash"]),
+        "source_artifact": str(path.resolve()),
+    }
+
+
+def _checked_row(
+    value: Mapping[str, Any],
+    *,
+    hash_field: str,
+    path: Path,
+) -> dict[str, Any]:
+    row = dict(value)
+    observed = row.pop(hash_field, None)
+    if observed != _content_hash(row):
+        raise ValueError(f"checksum mismatch: {path}")
+    return row | {hash_field: observed}
+
+
+def stage_rows(
+    root: Path,
+    *,
+    expected_master_manifest_hash: str | None = None,
+) -> tuple[tuple[Mapping[str, Any], str], ...]:
+    """Return one verified terminal result row per profile in a stage.
+
+    Each element is ``(row, source)`` where ``source`` is an absolute
+    ``<shard>#<record_hash>`` reference to the exact measured line.
+    """
+
+    rows: dict[str, tuple[Mapping[str, Any], str]] = {}
+    for partition in _partitions(root):
+        manifest = load_manifest(partition / "manifest.json")
+        expected = {entry.profile_id: entry for entry in manifest.entries}
+        invocation_path = partition / "invocation.json"
+        invocation = load_immutable_json(invocation_path)
+        if (
+            invocation.get("schema_version") != STAGE_INVOCATION_SCHEMA
+            or invocation.get("stage") != root.name
+            or invocation.get("stage_manifest_hash") != manifest.canonical_hash
+            or invocation.get("profile_count") != len(manifest.entries)
+            or (
+                expected_master_manifest_hash is not None
+                and invocation.get("master_manifest_hash")
+                != expected_master_manifest_hash
+            )
+        ):
+            raise ValueError(f"stage invocation mismatch: {invocation_path}")
+        completion_root = partition / "completed"
+        if not completion_root.is_dir():
+            raise RuntimeError(f"incomplete stage partition {partition}")
+        completions: dict[str, Mapping[str, Any]] = {}
+        for path in sorted(completion_root.glob("*.json")):
+            value = _checked_row(
+                json.loads(path.read_text(encoding="utf-8")),
+                hash_field="marker_hash",
+                path=path,
+            )
+            profile_id = str(value["profile_id"])
+            entry = expected.get(profile_id)
+            if (
+                value.get("schema_version") != COMPLETION_SCHEMA
+                or entry is None
+                or path.name != f"{profile_id}.json"
+                or value.get("manifest_hash") != manifest.canonical_hash
+                or int(value["ordinal"]) != entry.ordinal
+                or int(value["attempt"]) < 1
+                or value.get("state") not in {"succeeded", "failed"}
+                or profile_id in completions
+            ):
+                raise ValueError(f"invalid completion marker: {path}")
+            completions[profile_id] = value
+        if set(completions) != set(expected):
+            raise RuntimeError(f"incomplete completion coverage in {partition}")
+        attempts: dict[tuple[str, int], tuple[Mapping[str, Any], str, str]] = {}
+        for shard in sorted((partition / "shards").glob("*.jsonl")):
+            for line_number, line in enumerate(shard.read_text().splitlines(), 1):
+                value = _checked_row(
+                    json.loads(line),
+                    hash_field="record_hash",
+                    path=Path(f"{shard}:{line_number}"),
+                )
+                record_hash = str(value["record_hash"])
+                profile_id = str(value["profile_id"])
+                entry = expected.get(profile_id)
+                if (
+                    value.get("schema_version") != RESULT_SCHEMA
+                    or entry is None
+                    or value.get("manifest_hash") != manifest.canonical_hash
+                    or int(value["ordinal"]) != entry.ordinal
+                    or value.get("profile") != entry.profile.to_dict()
+                    or value.get("weight_format") != entry.profile.weight_format
+                    or shard.name != f"{entry.profile.weight_format}.jsonl"
+                    or int(value["attempt"]) < 1
+                    or value.get("state") not in {"succeeded", "failed"}
+                ):
+                    raise ValueError(f"invalid result row at {shard}:{line_number}")
+                key = (str(value["profile_id"]), int(value["attempt"]))
+                if key in attempts:
+                    raise ValueError(f"duplicate result at {shard}:{line_number}")
+                attempts[key] = (
+                    value,
+                    f"{shard.resolve()}#{record_hash}",
+                    f"shards/{shard.name}#{record_hash}",
+                )
+        for profile_id, completion in completions.items():
+            if completion.get("state") != "succeeded":
+                raise RuntimeError(f"preflight profile failed: {profile_id}")
+            key = (profile_id, int(completion["attempt"]))
+            if key not in attempts:
+                raise RuntimeError(f"missing terminal result for {profile_id}")
+            row, source, relative_source = attempts[key]
+            if (
+                row.get("state") != completion.get("state")
+                or completion.get("result_path") != relative_source
+            ):
+                raise ValueError(f"terminal result mismatch for {profile_id}")
+            if profile_id in rows:
+                raise ValueError(
+                    f"duplicate profile across partitions: {profile_id}"
+                )
+            rows[profile_id] = (row, source)
+    return tuple(rows[key] for key in sorted(rows))
+
+
+def _runtime_records(
+    rows: Iterable[tuple[Mapping[str, Any], str]],
+    *,
+    stage: str,
+) -> tuple[
+    list[dict[str, Any]],
+    list[dict[str, Any]],
+    list[dict[str, Any]],
+    list[dict[str, Any]],
+]:
+    runtime: list[dict[str, Any]] = []
+    rebinding: list[dict[str, Any]] = []
+    gpu_memory: list[dict[str, Any]] = []
+    append_validation: list[dict[str, Any]] = []
+    for row, source in rows:
+        metrics = row.get("result")
+        if not isinstance(metrics, Mapping):
+            raise ValueError("successful preflight row has no result metrics")
+        binding = metrics.get("runtime_rebinding")
+        if not isinstance(binding, Mapping):
+            raise ValueError("preflight row has no rebinding telemetry")
+        memory = metrics.get("gpu_memory")
+        if not isinstance(memory, Mapping):
+            raise ValueError("preflight row has no GPU-memory telemetry")
+        append = metrics.get("native_append_validation")
+        if not isinstance(append, Mapping):
+            raise ValueError("preflight row has no append-validation telemetry")
+        raw_runtime = float(row["runtime_seconds"])
+        oracle_seconds = float(append["oracle_seconds"])
+        hot_runtime = raw_runtime - oracle_seconds
+        if not math.isfinite(hot_runtime) or hot_runtime <= 0:
+            raise ValueError(
+                "profile runtime does not exceed deep append-oracle time"
+            )
+        invocation = load_immutable_json(
+            Path(source.split("#", 1)[0]).parents[1] / "invocation.json"
+        )
+        common = {
+            "stage": stage,
+            "profile_id": str(row["profile_id"]),
+            "device_label": str(invocation["device_label"]),
+            "source_artifact": source,
+        }
+        runtime.append(
+            common
+            | {
+                "runtime_seconds": hot_runtime,
+                "basis": (
+                    "evaluation_per_profile_excluding_weight_bank_build_"
+                    "and_deep_append_oracle"
+                ),
+            }
+        )
+        rebinding.append(
+            common
+            | {
+                "binding_seconds": binding["seconds"],
+                "performed": binding["performed"],
+                "target_count": binding["target_count"],
+                "used_cached_targets": binding["used_cached_targets"],
+                "weight_requantizations": binding["weight_requantizations"],
+                "sealed_weight_modules": binding["sealed_weight_modules"],
+                "weight_quantization_events_before": binding[
+                    "weight_quantization_events_before"
+                ],
+                "weight_quantization_events_after": binding[
+                    "weight_quantization_events_after"
+                ],
+                "weight_identity_before": binding["weight_identity_before"],
+                "weight_identity_after": binding["weight_identity_after"],
+                "weight_structure_fingerprint": binding[
+                    "weight_structure_fingerprint"
+                ],
+            }
+        )
+        append_validation.append(
+            common
+            | {
+                "mode": append["mode"],
+                "deep_oracle_enabled": append["deep_oracle_enabled"],
+                "calls": append["calls"],
+                "expected_calls": append["expected_calls"],
+                "tensor_checks": append["tensor_checks"],
+                "expected_tensor_checks": append["expected_tensor_checks"],
+                "quantized_tensor_checks": append["quantized_tensor_checks"],
+                "expected_quantized_tensor_checks": append[
+                    "expected_quantized_tensor_checks"
+                ],
+                "oracle_seconds": oracle_seconds,
+            }
+        )
+        gpu_memory.append(
+            common
+            | {
+                "microbatch_size": memory["microbatch_size"],
+                "peak_allocated_bytes": memory["peak_allocated_bytes"],
+                "peak_reserved_bytes": memory["peak_reserved_bytes"],
+                "total_device_bytes": memory["total_device_bytes"],
+            }
+        )
+    return runtime, rebinding, gpu_memory, append_validation
+
+
+def _weight_build_records(
+    rows: Iterable[tuple[Mapping[str, Any], str]],
+) -> list[dict[str, Any]]:
+    result: dict[str, dict[str, Any]] = {}
+    for row, source in rows:
+        metrics = row["result"]
+        bank = metrics.get("weight_bank")
+        if not isinstance(bank, Mapping):
+            raise ValueError("preflight row has no weight-bank telemetry")
+        weight_format = str(bank["weight_format"])
+        invocation = load_immutable_json(
+            Path(source.split("#", 1)[0]).parents[1] / "invocation.json"
+        )
+        candidate = {
+            "weight_format": weight_format,
+            "device_label": str(invocation["device_label"]),
+            "build_seconds": float(bank["build_seconds"]),
+            "source_artifact": source,
+        }
+        previous = result.get(weight_format)
+        if previous is not None and (
+            previous["build_seconds"] != candidate["build_seconds"]
+            or previous["device_label"] != candidate["device_label"]
+        ):
+            raise ValueError(f"inconsistent build telemetry for {weight_format}")
+        result[weight_format] = candidate
+    return [result[key] for key in sorted(result)]
+
+
+def _weight_build_serialization(
+    rows: Iterable[tuple[Mapping[str, Any], str]],
+) -> bool:
+    policies = set()
+    for _, source in rows:
+        invocation = load_immutable_json(
+            Path(source.split("#", 1)[0]).parents[1] / "invocation.json"
+        )
+        policy = invocation.get("weight_bank_build_serialized")
+        if not isinstance(policy, bool):
+            raise TypeError("stage invocation lacks a weight-bank build policy")
+        policies.add(policy)
+    if len(policies) != 1:
+        raise ValueError("preflight stages used different weight-bank policies")
+    return policies.pop()
+
+
+def build_evidence(
+    *,
+    output_dir: Path,
+    correctness_path: Path,
+    stack_validity_path: Path,
+    numerical_screen_workers: int,
+    hardware_validation_workers: int,
+) -> dict[str, Any]:
+    """Combine stage results, correctness checks, and stack evidence."""
+
+    manifest = load_manifest(output_dir / "manifest.json")
+    plan = _load_plan(output_dir / "run_plan.json")
+    prompts = _load_prompts(output_dir / "prompt_manifest.json")
+    if (
+        numerical_screen_workers != plan.numerical_screen_workers
+        or hardware_validation_workers != plan.hardware_validation_workers
+    ):
+        raise ValueError("worker counts differ from the immutable run plan")
+    numerical_screen_rows = stage_rows(
+        output_dir / "preflight",
+        expected_master_manifest_hash=manifest.canonical_hash,
+    )
+    hardware_validation_rows = stage_rows(
+        output_dir / "validation-pilot",
+        expected_master_manifest_hash=manifest.canonical_hash,
+    )
+    (
+        numerical_screen_runtime,
+        numerical_screen_rebinding,
+        numerical_screen_memory,
+        numerical_screen_append,
+    ) = _runtime_records(numerical_screen_rows, stage="numerical-screen")
+    (
+        hardware_validation_runtime,
+        hardware_validation_rebinding,
+        hardware_validation_memory,
+        hardware_validation_append,
+    ) = _runtime_records(hardware_validation_rows, stage="hardware-validation")
+    correctness = load_immutable_json(correctness_path)
+    if correctness.get("schema_version") != CORRECTNESS_SCHEMA:
+        raise ValueError("unsupported correctness evidence schema")
+    if correctness.get("manifest_hash") != manifest.canonical_hash:
+        raise ValueError("correctness evidence manifest mismatch")
+    if correctness.get("run_plan_hash") != plan.canonical_hash:
+        raise ValueError("correctness evidence run-plan mismatch")
+    if correctness.get("prompt_manifest_hash") != prompts.canonical_hash:
+        raise ValueError("correctness evidence prompt-manifest mismatch")
+    admission_path = output_dir / "admission_preparation.json"
+    admission = load_immutable_json(admission_path)
+    if (
+        admission.get("manifest_hash") != manifest.canonical_hash
+        or admission.get("run_plan_hash") != plan.canonical_hash
+        or admission.get("prompt_manifest_hash") != prompts.canonical_hash
+    ):
+        raise ValueError("admission preparation receipt mismatch")
+    admission_sha256 = _sha256_file(admission_path)
+    for _, source in numerical_screen_rows + hardware_validation_rows:
+        invocation = load_immutable_json(
+            Path(source.split("#", 1)[0]).parents[1] / "invocation.json"
+        )
+        if invocation.get("admission_preparation_sha256") != admission_sha256:
+            raise ValueError("stage invocation used a different admission receipt")
+    admission.pop("content_hash")
+    admission["source_artifact"] = str(admission_path.resolve())
+    stack_preparation = _stack_evidence_preparation(
+        path=stack_validity_path,
+        manifest=manifest,
+        plan=plan,
+    )
+    completed = tuple(str(row[0]["profile_id"]) for row in numerical_screen_rows)
+    return {
+        "schema_version": PREFLIGHT_EVIDENCE_SCHEMA,
+        "manifest_hash": manifest.canonical_hash,
+        "run_plan_hash": plan.canonical_hash,
+        "prompt_manifest_hash": prompts.canonical_hash,
+        "completed_profile_ids": list(completed),
+        "runtime_samples": numerical_screen_runtime + hardware_validation_runtime,
+        "weight_bank_build_samples": _weight_build_records(numerical_screen_rows),
+        "runtime_rebinding_samples": (
+            numerical_screen_rebinding + hardware_validation_rebinding
+        ),
+        "native_append_validation_samples": (
+            numerical_screen_append + hardware_validation_append
+        ),
+        "gpu_memory_samples": numerical_screen_memory + hardware_validation_memory,
+        "admission_preparation": admission,
+        "stack_evidence_preparation": stack_preparation,
+        "parallel_workers": {
+            "numerical_screen": plan.numerical_screen_workers,
+            "hardware_validation": plan.hardware_validation_workers,
+        },
+        "weight_bank_build_serialized": _weight_build_serialization(
+            numerical_screen_rows + hardware_validation_rows
+        ),
+        "weight_bank_checks": correctness["weight_bank_checks"],
+        "cross_device_checks": correctness["cross_device_checks"],
+        "bf16_split_checks": correctness["bf16_split_checks"],
+        "cache_reuse_checks": correctness["cache_reuse_checks"],
+        "microbatch_checks": correctness["microbatch_checks"],
+    }
+
+
+def preflight_evidence_main(argv: Iterable[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument("--correctness", type=Path, required=True)
+    parser.add_argument("--stack-validity", type=Path, required=True)
+    parser.add_argument("--numerical-screen-workers", type=int, required=True)
+    parser.add_argument("--hardware-validation-workers", type=int, required=True)
+    parser.add_argument("--out", type=Path, required=True)
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    if args.numerical_screen_workers <= 0 or args.hardware_validation_workers <= 0:
+        raise SystemExit("worker counts must be positive")
+    value = build_evidence(
+        output_dir=args.output_dir.resolve(),
+        correctness_path=args.correctness.resolve(),
+        stack_validity_path=args.stack_validity.resolve(),
+        numerical_screen_workers=args.numerical_screen_workers,
+        hardware_validation_workers=args.hardware_validation_workers,
+    )
+    write_immutable_json(args.out, value)
+    print(args.out)
+    return 0
+
+
+__all__ = ["CORRECTNESS_SCHEMA", "build_evidence", "preflight_evidence_main", "stage_rows"]
+
+
+def dispatch(argv: Sequence[str] | None = None) -> int:
+    """Route to one of this module's commands."""
+
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    commands = {
+        "check": preflight_checks_main,
+        "evidence": preflight_evidence_main,
+    }
+    if not arguments or arguments[0] not in commands:
+        raise SystemExit(
+            "usage: <command> [options]; commands: "
+            + ", ".join(sorted(commands))
+        )
+    return commands[arguments[0]](arguments[1:])
+
+
+if __name__ == "__main__":
+    raise SystemExit(dispatch())
diff --git a/decode_dse/software/refinement_evaluator.py b/decode_dse/software/refinement_evaluator.py
new file mode 100644
index 0000000..8bcca72
--- /dev/null
+++ b/decode_dse/software/refinement_evaluator.py
@@ -0,0 +1,969 @@
+"""Build sealed GPTQ, clipping, and rotation banks for refinement."""
+
+from __future__ import annotations
+
+import gc
+import hashlib
+import json
+import math
+import os
+import random
+import time
+from contextlib import contextmanager
+from datetime import datetime, timezone
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Any, Iterator, Mapping
+
+from decode_dse.software.cached_decode import (
+    ContinuationExample,
+    TorchHFCachedDecodeBackend,
+    evaluate_teacher_forced_cached_batched,
+)
+from decode_dse.software.refinement_runner import (
+    GPTQ_SELECTION_POLICY,
+    REFINEMENT_PREFILL_INDEX_SCHEMA,
+)
+from decode_dse.software.decode_evaluator import (
+    ADMISSION_CONVERTER_SCHEMA,
+    PACKED_CACHE_LAYOUT,
+    AdmissionCacheHandle,
+    DecodeWeightBank,
+    DecodeWeightBankIdentity,
+    DecodeWeightQuantizationGuard,
+    DecodeEvaluator,
+    _DecodeCacheLRU,
+    _decode_cache_path,
+    _document_token,
+    _mase_tree_hash,
+    _repository_root,
+    _software_tree_hash,
+    _validate_bank_structure,
+    build_decode_binding_plan,
+)
+from decode_dse.software.refinement_schedule import (
+    RefinementScheduleEntry,
+    refinement_profile_to_decode_quant_spec,
+)
+from decode_dse.software.refinement_runner import (
+    RefinementBankHandle,
+    RefinementBankSpec,
+    RefinementDocumentMetric,
+    RefinementEvaluation,
+    RefinementExecutionEvidence,
+    rotation_decision_contract,
+    rotation_decision_contract_hash,
+    refinement_rng_policy,
+    refinement_rng_policy_hash,
+    rotation_policy,
+    seal_checkpoint_identity,
+)
+from decode_dse.software.token_samples import RefinementSampleBundle
+from decode_dse.software.runtime_environment import (
+    RuntimeEnvironment,
+    capture_runtime_environment,
+    initialize_numerical_runtime,
+)
+from decode_dse.software.cache_artifacts import (
+    load_decode_cache_artifact,
+    load_prefill_artifact,
+)
+from decode_dse.software.sweep_plan import (
+    load_immutable_json,
+    write_immutable_json,
+)
+
+
+def _file_sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        while block := handle.read(1 << 20):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _seed_refinement_runtime(
+    bank: RefinementBankSpec,
+    torch: Any,
+) -> dict[str, Any]:
+    if bank.rng_policy_hash != refinement_rng_policy_hash():
+        raise ValueError("refinement bank RNG policy differs from the runtime")
+    policy = refinement_rng_policy()
+    os.environ["CUBLAS_WORKSPACE_CONFIG"] = str(policy["cublas_workspace_config"])
+    initialize_numerical_runtime(bank.rng_seed)
+    random.seed(bank.rng_seed)
+    python_state = hashlib.sha256(repr(random.getstate()).encode("utf-8")).hexdigest()
+    numpy_state = None
+    try:
+        import numpy
+
+        numpy.random.seed(bank.rng_seed % (2**32))
+        numpy_state = hashlib.sha256(
+            repr(numpy.random.get_state()).encode("utf-8")
+        ).hexdigest()
+    except ImportError:
+        pass
+    torch.manual_seed(bank.rng_seed)
+    if torch.cuda.is_available():
+        torch.cuda.manual_seed_all(bank.rng_seed)
+    torch.use_deterministic_algorithms(True)
+    torch.backends.cudnn.deterministic = True
+    torch.backends.cudnn.benchmark = False
+    torch.backends.cuda.matmul.allow_tf32 = False
+    torch.backends.cudnn.allow_tf32 = False
+    torch_state = hashlib.sha256(
+        torch.get_rng_state().cpu().numpy().tobytes()
+    ).hexdigest()
+    cuda_state = []
+    if torch.cuda.is_available():
+        cuda_state = [
+            hashlib.sha256(state.cpu().numpy().tobytes()).hexdigest()
+            for state in torch.cuda.get_rng_state_all()
+        ]
+    return {
+        "schema_version": "decode-refinement-rng",
+        "bank_id": bank.bank_id,
+        "seed": bank.rng_seed,
+        "policy": policy,
+        "policy_hash": bank.rng_policy_hash,
+        "python_state_sha256": python_state,
+        "numpy_state_sha256": numpy_state,
+        "torch_cpu_state_sha256": torch_state,
+        "torch_cuda_state_sha256": cuda_state,
+    }
+
+
+class RefinementEvaluator:
+    """Run refinement without altering the screen/validation sample bundle."""
+
+    def __init__(
+        self,
+        *,
+        config: Mapping[str, Any],
+        sample_bundle_path: str | Path,
+        prefill_root: str | Path,
+        admission_root: str | Path,
+        workspace_root: str | Path,
+        device_label: str,
+        decode_microbatch_size: int = 8,
+        max_cpu_cache_gib: float = 24.0,
+    ) -> None:
+        self.config = dict(config)
+        refinement = config.get("refinement")
+        if not isinstance(refinement, Mapping):
+            raise ValueError("config.refinement is required")
+        self.refinement_config = dict(refinement)
+        self.gpu_min_free_mb = int(self.refinement_config.get("gpu_min_free_mb", 0))
+        if self.gpu_min_free_mb <= 0:
+            raise ValueError("refinement requires a positive declared GPU-memory floor")
+        from decode_dse.software.token_samples import (
+            load_refinement_sample_bundle,
+        )
+
+        self.sample_bundle_path = Path(sample_bundle_path).resolve()
+        self.bundle = load_refinement_sample_bundle(self.sample_bundle_path)
+        if self.bundle.model_revision != str(config["model_revision"]):
+            raise ValueError("refinement bundle model revision mismatch")
+        if self.bundle.tokenizer_revision != str(config["tokenizer_revision"]):
+            raise ValueError("refinement bundle tokenizer revision mismatch")
+        if decode_microbatch_size <= 0:
+            raise ValueError("refinement decode microbatch must be positive")
+        self.decode_microbatch_size = int(decode_microbatch_size)
+        self.prefill_root = Path(prefill_root).resolve()
+        self.admission_root = Path(admission_root).resolve()
+        self.workspace_root = Path(workspace_root).resolve()
+        self.workspace_root.mkdir(parents=True, exist_ok=True)
+        self.device = str(config.get("device", "cuda:0"))
+        self.device_label = str(device_label)
+        self.engine = DecodeEvaluator.__new__(DecodeEvaluator)
+        self._initialize_engine(max_cpu_cache_gib)
+        self._validate_prefill_index()
+        self._open_banks: dict[str, DecodeWeightBank] = {}
+        self._bank_receipts: dict[str, Path] = {}
+        self._validated_pairs: dict[tuple[str, str], Path] = {}
+
+    def _initialize_engine(self, max_cpu_cache_gib: float) -> None:
+        executor_config = self.config.get("executor")
+        if not isinstance(executor_config, Mapping):
+            raise ValueError("config.executor is required")
+        if not str(self.config.get("scratch_dir", "")).startswith("workspace://"):
+            raise ValueError("refinement scratch_dir must be workspace-bound")
+        if executor_config.get("serialize_weight_bank_builds") is not True:
+            raise ValueError("refinement weight-bank build locking must be enabled")
+        engine = self.engine
+        engine.config = self.config
+        engine.executor_config = dict(executor_config)
+        engine._initialize_model_contract()
+        engine.device = self.device
+        engine.runtime_seed = int(self.config.get("seed", 0))
+        initialize_numerical_runtime(engine.runtime_seed)
+        engine.runtime_environment = capture_runtime_environment(
+            engine.device,
+            seed=engine.runtime_seed,
+        )
+        engine._configure_mase_path()
+        engine.bundle = self.bundle
+        engine.samples = self.bundle.samples
+        engine.prefill_root = self.prefill_root
+        engine.admission_root = self.admission_root
+        engine.layout_id = str(executor_config.get("layout_id", PACKED_CACHE_LAYOUT))
+        if engine.layout_id != str(executor_config["layout_id"]):
+            raise ValueError("refinement requires the native PackedKV layout")
+        identity = {
+            "schema_version": ADMISSION_CONVERTER_SCHEMA,
+            "sample_schema_version": self.bundle.schema_version,
+            "software_tree_sha256": _software_tree_hash(_repository_root()),
+            "mase_tree_sha256": _mase_tree_hash(_repository_root(), self.config),
+            "runtime_environment_fingerprint": (
+                engine.runtime_environment.logical_fingerprint
+            ),
+            "layout_id": engine.layout_id,
+            "block_size": 8,
+            "scale_format": "E8M0",
+            "scale_encoding": "bias127",
+            "mxint_element_encoding": "sign_magnitude_lsb",
+            "mxfp_element_encoding": "ieee_lsb",
+            "plane_order": "row_major_lsb_first",
+        }
+        engine.admission_code_revision = hashlib.sha256(
+            json.dumps(
+                identity,
+                sort_keys=True,
+                separators=(",", ":"),
+            ).encode("utf-8")
+        ).hexdigest()
+        engine.admission_contract_id = (
+            "refinement-"
+            f"{ADMISSION_CONVERTER_SCHEMA.rsplit('/', 1)[-1]}-"
+            f"{engine.admission_code_revision[:16]}"
+        )
+        admission_provenance_path = (
+            engine.admission_root / engine.admission_contract_id / "provenance.json"
+        )
+        with engine._artifact_lock(admission_provenance_path):
+            if not admission_provenance_path.exists():
+                write_immutable_json(
+                    admission_provenance_path,
+                    {
+                        "schema_version": "decode-refinement-admission-provenance",
+                        "admission_contract_id": engine.admission_contract_id,
+                        "admission_code_revision": engine.admission_code_revision,
+                        "sample_bundle_hash": self.bundle.canonical_hash,
+                        "runtime_environment_fingerprint": (
+                            engine.runtime_environment.logical_fingerprint
+                        ),
+                        "created_at_utc": datetime.now(timezone.utc)
+                        .isoformat()
+                        .replace("+00:00", "Z"),
+                    },
+                )
+            admission_provenance = load_immutable_json(admission_provenance_path)
+        if (
+            admission_provenance.get("schema_version")
+            != "decode-refinement-admission-provenance"
+            or admission_provenance.get("admission_contract_id")
+            != engine.admission_contract_id
+            or admission_provenance.get("admission_code_revision")
+            != engine.admission_code_revision
+            or admission_provenance.get("sample_bundle_hash")
+            != self.bundle.canonical_hash
+            or admission_provenance.get("runtime_environment_fingerprint")
+            != engine.runtime_environment.logical_fingerprint
+            or not str(admission_provenance.get("created_at_utc", "")).endswith("Z")
+        ):
+            raise ValueError("refinement admission provenance is invalid")
+        engine.admission_provenance_created_at = str(
+            admission_provenance["created_at_utc"]
+        )
+        engine.cache_lru = _DecodeCacheLRU(int(float(max_cpu_cache_gib) * (1 << 30)))
+        engine.context = SimpleNamespace(
+            device_label=self.device_label,
+            workspace_root=self.workspace_root,
+        )
+        engine.deep_append_validation = False
+
+    @property
+    def admission_contract_id(self) -> str:
+        return str(self.engine.admission_contract_id)
+
+    @property
+    def runtime_environment(self) -> dict[str, Any]:
+        return self.engine.runtime_environment.to_dict()
+
+    def _validate_prefill_index(self) -> None:
+        index = load_immutable_json(self.prefill_root / "index.json")
+        if index.get("schema_version") != REFINEMENT_PREFILL_INDEX_SCHEMA:
+            raise ValueError("unsupported refinement prefill index")
+        if index.get("model_revision") != self.bundle.model_revision:
+            raise ValueError("refinement prefill model revision mismatch")
+        if index.get("tokenizer_revision") != self.bundle.tokenizer_revision:
+            raise ValueError("refinement prefill tokenizer revision mismatch")
+        if index.get("sample_bundle_hash") != self.bundle.canonical_hash:
+            raise ValueError("refinement prefill sample identity mismatch")
+        recorded_runtime = RuntimeEnvironment.from_dict(
+            index.get("runtime_environment", {})
+        )
+        if (
+            recorded_runtime.logical_fingerprint
+            != self.engine.runtime_environment.logical_fingerprint
+        ):
+            raise ValueError("refinement prefill runtime environment mismatch")
+        code_revision = _software_tree_hash(_repository_root())
+        if index.get("code_revision") != code_revision:
+            raise ValueError("refinement prefill source-tree identity mismatch")
+        records = {
+            str(record["document_id"]): record for record in index.get("records", ())
+        }
+        if set(records) != {sample.document_id for sample in self.bundle.samples}:
+            raise ValueError("refinement prefill index coverage mismatch")
+        for sample in self.bundle.samples:
+            path = self.prefill_root / _document_token(sample.document_id)
+            if not path.is_dir():
+                raise ValueError(
+                    f"missing refinement prefill artifact: {sample.document_id}"
+                )
+            artifact = load_prefill_artifact(path)
+            record = records[sample.document_id]
+            if (
+                artifact.artifact_id != record.get("artifact_id")
+                or artifact.prompt_hash != sample.prompt_hash
+                or artifact.model_revision != self.bundle.model_revision
+                or artifact.tokenizer_revision != self.bundle.tokenizer_revision
+                or artifact.first_token.selection != "greedy"
+                or len(artifact.layers)
+                != int(self.engine.model_architecture["num_hidden_layers"])
+                or any(
+                    layer.key.shape
+                    != (
+                        1,
+                        int(self.engine.model_architecture["num_key_value_heads"]),
+                        512,
+                        int(self.engine.model_architecture["head_dim"]),
+                    )
+                    or layer.value.shape != layer.key.shape
+                    for layer in artifact.layers
+                )
+            ):
+                raise ValueError("refinement prefill artifact contract mismatch")
+        self.prefill_index_path = self.prefill_root / "index.json"
+
+    def _validate_bank_spec(
+        self,
+        bank: RefinementBankSpec,
+        entries: tuple[RefinementScheduleEntry, ...],
+    ) -> None:
+        if bank.model_name != str(self.config["model_name"]):
+            raise ValueError("refinement bank model differs from execution config")
+        if bank.model_revision != str(self.config["model_revision"]):
+            raise ValueError(
+                "refinement bank model revision differs from execution config"
+            )
+        if not entries or any(
+            (
+                entry.profile.weight_format,
+                entry.profile.weight_method,
+            )
+            != (bank.weight_format, bank.weight_method)
+            for entry in entries
+        ):
+            raise ValueError("refinement bank group is empty or inconsistent")
+        if bank.weight_method == "rotation":
+            if len(entries) != 1:
+                raise ValueError("rotation decisions must be profile-local")
+            profile = entries[0].profile
+            if bank.rotation_profile_id != profile.profile_id:
+                raise ValueError("rotation bank profile identity mismatch")
+            if bank.rotation_config_hash != rotation_decision_contract_hash(profile):
+                raise ValueError("refinement rotation decision contract mismatch")
+        calibration = Path(bank.calibration_path)
+        if not calibration.is_file():
+            raise ValueError("refinement GPTQ calibration artifact is missing")
+        if _file_sha256(calibration) != bank.calibration_bundle_hash:
+            raise ValueError("refinement GPTQ calibration bytes changed")
+        try:
+            import torch
+        except ImportError as exc:
+            raise RuntimeError(
+                "refinement calibration validation requires torch"
+            ) from exc
+        payload = torch.load(calibration, map_location="cpu", weights_only=False)
+        if not isinstance(payload, Mapping) or not isinstance(
+            payload.get("loader"), list
+        ):
+            raise ValueError("refinement GPTQ calibration payload is malformed")
+        expected_metadata = {
+            "dataset_name": bank.calibration_dataset,
+            "dataset_revision": bank.calibration_revision,
+            "model_revision": bank.model_revision,
+            "tokenizer_revision": str(self.config["tokenizer_revision"]),
+            "nsamples": bank.calibration_samples,
+            "seqlen": bank.calibration_sequence_length,
+        }
+        if any(payload.get(key) != value for key, value in expected_metadata.items()):
+            raise ValueError(
+                "refinement GPTQ calibration metadata differs from the bank"
+            )
+        if len(payload["loader"]) != bank.calibration_samples:
+            raise ValueError("refinement GPTQ calibration sample coverage mismatch")
+        selection = payload.get("selection")
+        if (
+            payload.get("selection_policy") != GPTQ_SELECTION_POLICY
+            or isinstance(payload.get("selection_seed"), bool)
+            or not isinstance(payload.get("selection_seed"), int)
+            or not isinstance(selection, list)
+            or len(selection) != bank.calibration_samples
+        ):
+            raise ValueError(
+                "refinement GPTQ calibration selection evidence is invalid"
+            )
+        intervals: dict[int, list[tuple[int, int]]] = {}
+        for ordinal, (record, loader_item) in enumerate(
+            zip(selection, payload["loader"])
+        ):
+            if (
+                not isinstance(record, Mapping)
+                or record.get("ordinal") != ordinal
+                or int(record.get("token_count", -1))
+                != bank.calibration_sequence_length
+            ):
+                raise ValueError(
+                    "refinement GPTQ calibration selection order is invalid"
+                )
+            document_index = int(record["document_index"])
+            start = int(record["token_offset"])
+            end = start + bank.calibration_sequence_length
+            if any(
+                start < prior_end and prior_start < end
+                for prior_start, prior_end in intervals.setdefault(document_index, [])
+            ):
+                raise ValueError("refinement GPTQ calibration windows overlap")
+            intervals[document_index].append((start, end))
+            token_ids = tuple(int(token) for token in loader_item[0][0].tolist())
+            digest = hashlib.sha256(
+                json.dumps(token_ids, separators=(",", ":")).encode("utf-8")
+            ).hexdigest()
+            if digest != record.get("window_hash"):
+                raise ValueError("refinement GPTQ calibration window hash mismatch")
+        if bank.weight_method != "rotation" and bank.rotation_config_hash is not None:
+            raise ValueError("GPTQ+Erry bank carries a rotation policy")
+
+    def _gptq_config(self, bank: RefinementBankSpec) -> dict[str, Any]:
+        calibration = Path(bank.calibration_path).resolve()
+        value: dict[str, Any] = {
+            "dataset": f"file:{calibration}",
+            "nsamples": bank.calibration_samples,
+            "seqlen": bank.calibration_sequence_length,
+            "cali_batch_size": bank.calibration_batch_size,
+            "quantile_search": True,
+            "clip_search_y": True,
+            "checkpoint_dir": bank.checkpoint_dir,
+        }
+        if bank.weight_method == "rotation":
+            policy = rotation_policy()
+            value["rotation"] = {
+                "calib_data": f"file:{calibration}",
+                "calib_nsamples": policy["calibration_samples"],
+                "calib_seqlen": policy["calibration_sequence_length"],
+                "improvement_eps": policy["improvement_epsilon"],
+                "cache_winners": policy["cache_winners"],
+                "score_phase": policy["score_phase"],
+                "cache_path": str(
+                    Path(bank.checkpoint_dir) / "rotation_decisions.json"
+                ),
+            }
+        return value
+
+    def _validate_checkpoint_coverage(self, bank: RefinementBankSpec) -> None:
+        root = Path(bank.checkpoint_dir)
+        layer_files = {
+            int(path.stem.rsplit("_", 1)[1])
+            for path in root.glob("quantized_model_layer_*.safetensors")
+        }
+        metadata_files = {
+            int(path.name.split("_layer_", 1)[1].split("_metadata", 1)[0])
+            for path in root.glob("quantized_model_layer_*_metadata.json")
+        }
+        layers = int(self.engine.model_architecture["num_hidden_layers"])
+        expected = set(range(layers))
+        if layer_files != expected or metadata_files != expected:
+            raise ValueError(
+                f"refinement checkpoint does not cover all {layers} decoder layers"
+            )
+        if bank.weight_method == "rotation":
+            decision_path = root / "rotation_decisions.json"
+            if not decision_path.is_file():
+                raise ValueError("rotation decisions are missing")
+            decision = json.loads(decision_path.read_text(encoding="utf-8"))
+            if not isinstance(decision.get("winners"), list):
+                raise ValueError("rotation decisions contain no winner list")
+            for key in ("baseline_ppl", "final_ppl"):
+                if not math.isfinite(float(decision[key])):
+                    raise ValueError("rotation decision score is non-finite")
+
+    @contextmanager
+    def open_weight_bank(
+        self,
+        bank: RefinementBankSpec,
+        entries: tuple[RefinementScheduleEntry, ...],
+    ) -> Iterator[RefinementBankHandle]:
+        self._validate_bank_spec(bank, entries)
+        if bank.bank_id in self._open_banks:
+            raise RuntimeError("refinement bank is already open")
+        try:
+            import torch
+            from chop.passes.module.transforms.quantize.quantize import (
+                install_phase_context_pre_hooks,
+                quantize_module_transform_pass,
+            )
+            from decode_dse.software.precision_bindings import build_decode_pass_args
+        except ImportError as exc:
+            raise RuntimeError(
+                "decode refinement requires torch, transformers, and MASE"
+            ) from exc
+        rng_receipt = _seed_refinement_runtime(bank, torch)
+        if not self.device.startswith("cuda") or not torch.cuda.is_available():
+            raise RuntimeError("refinement bank construction requires CUDA")
+        device_index = torch.device(self.device).index or 0
+        free_bytes, _ = torch.cuda.mem_get_info(device_index)
+        if free_bytes / float(1 << 20) < self.gpu_min_free_mb:
+            raise RuntimeError(
+                "insufficient free GPU memory for the calibrated refinement bank"
+            )
+        checkpoint = Path(bank.checkpoint_dir)
+        checkpoint.mkdir(parents=True, exist_ok=True)
+        write_immutable_json(
+            checkpoint / "rng_receipt.json",
+            rng_receipt,
+        )
+        write_immutable_json(
+            checkpoint / "bank_contract.json",
+            {
+                "schema_version": "decode-refinement-bank-contract",
+                "bank": bank.to_dict(),
+                "gptq": self._gptq_config(bank),
+                "rotation_policy": (
+                    rotation_decision_contract(entries[0].profile)
+                    if bank.weight_method == "rotation"
+                    else None
+                ),
+                "minimum_free_gpu_mib": self.gpu_min_free_mb,
+                "rng": rng_receipt,
+            },
+        )
+        self.engine.cache_lru.clear()
+        gc.collect()
+        self.engine._validate_device_label()
+        build_started = time.perf_counter()
+        properties = torch.cuda.get_device_properties(device_index)
+        device_observation = {
+            "device_label": self.device_label,
+            "device_name": str(properties.name),
+            "device_uuid": str(getattr(properties, "uuid", "unavailable")),
+            "compute_capability": f"{properties.major}.{properties.minor}",
+            "free_mib_before_build": free_bytes / float(1 << 20),
+            "total_mib": properties.total_memory / float(1 << 20),
+            "cuda_runtime": str(torch.version.cuda),
+        }
+        model = None
+        internal = None
+        try:
+            with self.engine._weight_bank_build_lock():
+                model = self.engine._load_model()
+                representative = refinement_profile_to_decode_quant_spec(
+                    entries[0].profile
+                )
+                pass_args = build_decode_pass_args(
+                    str(self.config["model_name"]),
+                    self.device,
+                    representative,
+                    gptq_cfg=self._gptq_config(bank),
+                )
+                if bank.weight_method == "gptq_erry":
+                    pass_args["collapse_decode_banks"] = True
+                bank_device_variable = "MASE_PHASE_BANK_DEVICE"
+                previous_bank_device = os.environ.get(bank_device_variable)
+                try:
+                    if self.device.startswith("cuda"):
+                        os.environ[bank_device_variable] = self.device
+                    else:
+                        os.environ.pop(bank_device_variable, None)
+                    model, _ = quantize_module_transform_pass(model, pass_args)
+                finally:
+                    if previous_bank_device is None:
+                        os.environ.pop(bank_device_variable, None)
+                    else:
+                        os.environ[bank_device_variable] = previous_bank_device
+                if bank.weight_method == "rotation":
+                    collapsed = 0
+                    for module in model.modules():
+                        collapse = getattr(module, "collapse_to_decode_bank", None)
+                        if callable(collapse) and collapse():
+                            collapsed += 1
+                    expected_linears = 7 * int(
+                        self.engine.model_architecture["num_hidden_layers"]
+                    )
+                    if collapsed != expected_linears:
+                        raise RuntimeError(
+                            "rotation bank did not collapse all decode linears"
+                        )
+                model = model.to(self.device).eval()
+                install_phase_context_pre_hooks(model)
+                binding_plan = build_decode_binding_plan(model, pass_args)
+                quantization_guard = DecodeWeightQuantizationGuard.capture(
+                    binding_plan,
+                    expected_modules=(
+                        7 * int(self.engine.model_architecture["num_hidden_layers"])
+                    ),
+                )
+                _validate_bank_structure(
+                    model,
+                    binding_plan,
+                    len(quantization_guard.modules),
+                    self.engine.model_architecture,
+                )
+            self._validate_checkpoint_coverage(bank)
+            identity_guard = DecodeWeightBankIdentity.capture(model)
+            build_seconds = time.perf_counter() - build_started
+            checkpoint_tree_before_receipt = seal_checkpoint_identity(
+                bank,
+                checkpoint,
+                identity_guard.fingerprint,
+            ).checkpoint_tree_sha256
+            receipt_body = {
+                "schema_version": "decode-refinement-bank-measurement",
+                "bank_id": bank.bank_id,
+                "checkpoint_tree_before_receipt_sha256": (
+                    checkpoint_tree_before_receipt
+                ),
+                "weight_identity": identity_guard.fingerprint,
+                "build_seconds": build_seconds,
+                "device": device_observation,
+                "observed_at_utc": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            }
+            receipt_id = hashlib.sha256(
+                json.dumps(
+                    receipt_body,
+                    sort_keys=True,
+                    separators=(",", ":"),
+                ).encode("utf-8")
+            ).hexdigest()
+            receipt_path = checkpoint / "measurements" / f"bank-{receipt_id}.json"
+            write_immutable_json(receipt_path, receipt_body)
+            internal = DecodeWeightBank(
+                model=model,
+                device=torch.device(self.device),
+                weight_format=bank.weight_format,
+                weight_method=bank.weight_method,
+                binding_plan=binding_plan,
+                identity_guard=identity_guard,
+                quantization_guard=quantization_guard,
+                build_seconds=build_seconds,
+            )
+            handle = seal_checkpoint_identity(
+                bank,
+                checkpoint,
+                identity_guard.fingerprint,
+            )
+            self._open_banks[bank.bank_id] = internal
+            self._bank_receipts[bank.bank_id] = receipt_path
+            yield handle
+        finally:
+            self._open_banks.pop(bank.bank_id, None)
+            self._bank_receipts.pop(bank.bank_id, None)
+            del internal
+            del model
+            gc.collect()
+            if "torch" in locals() and torch.cuda.is_available():
+                torch.cuda.empty_cache()
+
+    def _pair_index(
+        self,
+        key_format: str,
+        value_format: str,
+        paths: Mapping[str, Path],
+    ) -> Path:
+        root = (
+            self.admission_root
+            / self.admission_contract_id
+            / f"K-{key_format}__V-{value_format}"
+        )
+        records = []
+        for sample in self.bundle.samples:
+            path = paths[sample.document_id]
+            artifact = load_decode_cache_artifact(path)
+            logical_path = _decode_cache_path(
+                self.admission_root,
+                key_format,
+                sample.document_id,
+                value_format,
+                contract_id=self.admission_contract_id,
+            )
+            records.append(
+                {
+                    "document_id": sample.document_id,
+                    "relative_path": logical_path.relative_to(
+                        self.admission_root
+                    ).as_posix(),
+                    "artifact_id": artifact.artifact_id,
+                    "manifest_sha256": _file_sha256(path / "manifest.json"),
+                }
+            )
+        index = root / "index.json"
+        write_immutable_json(
+            index,
+            {
+                "schema_version": "decode-refinement-admission-pair",
+                "sample_bundle_hash": self.bundle.canonical_hash,
+                "admission_contract_id": self.admission_contract_id,
+                "key_format": key_format,
+                "value_format": value_format,
+                "records": records,
+            },
+        )
+        return index
+
+    def _append_evidence_path(
+        self,
+        key_format: str,
+        value_format: str,
+    ) -> Path:
+        return (
+            self.admission_root
+            / self.admission_contract_id
+            / ".append-evidence"
+            / f"K-{key_format}__V-{value_format}.json"
+        )
+
+    def _load_append_evidence(
+        self,
+        key_format: str,
+        value_format: str,
+        pair_index: Path,
+    ) -> Path | None:
+        path = self._append_evidence_path(key_format, value_format)
+        if not path.exists():
+            return None
+        value = load_immutable_json(path)
+        pair = load_immutable_json(pair_index)
+        layers = int(self.engine.model_architecture["num_hidden_layers"])
+        expected = {
+            "schema_version": "decode-refinement-split-append-evidence",
+            "sample_bundle_hash": self.bundle.canonical_hash,
+            "admission_contract_id": self.admission_contract_id,
+            "key_format": key_format,
+            "value_format": value_format,
+            "pair_index_hash": pair["content_hash"],
+            "q_len": 1,
+            "layers_checked": layers,
+            "key_value_tensors_checked": layers * 2,
+            "native_append_passed": True,
+            "software_tree_sha256": _software_tree_hash(_repository_root()),
+            "mase_tree_sha256": _mase_tree_hash(_repository_root(), self.config),
+        }
+        if any(value.get(key) != item for key, item in expected.items()):
+            raise ValueError("refinement split-append evidence identity mismatch")
+        return path
+
+    @contextmanager
+    def open_split_kv_admission_cache(
+        self,
+        key_format: str,
+        value_format: str,
+        samples: RefinementSampleBundle,
+    ) -> Iterator[tuple[AdmissionCacheHandle, Path]]:
+        if samples.canonical_hash != self.bundle.canonical_hash:
+            raise ValueError("refinement admission received a different sample bundle")
+        with self.engine.open_split_kv_admission_cache(
+            key_format,
+            value_format,
+        ) as handle:
+            pair_index = self._pair_index(
+                key_format,
+                value_format,
+                handle.paths,
+            )
+            evidence = self._load_append_evidence(
+                key_format,
+                value_format,
+                pair_index,
+            )
+            if evidence is not None:
+                self._validated_pairs[(key_format, value_format)] = evidence
+            yield handle, pair_index
+
+    def evaluate(
+        self,
+        entry: RefinementScheduleEntry,
+        *,
+        samples: RefinementSampleBundle,
+        weight_bank: RefinementBankHandle,
+        kv_admission_cache: Any,
+    ) -> RefinementEvaluation:
+        if samples.canonical_hash != self.bundle.canonical_hash:
+            raise ValueError("refinement evaluation received a different sample bundle")
+        internal = self._open_banks.get(weight_bank.bank_id)
+        if internal is None:
+            raise RuntimeError("refinement weight bank is not open")
+        if (
+            not isinstance(kv_admission_cache, tuple)
+            or len(kv_admission_cache) != 2
+            or not isinstance(kv_admission_cache[0], AdmissionCacheHandle)
+        ):
+            raise TypeError("refinement admission handle is malformed")
+        admission, pair_index = kv_admission_cache
+        if (
+            admission.key_format,
+            admission.resolved_value_format,
+        ) != (
+            entry.profile.key_format,
+            entry.profile.value_format,
+        ):
+            raise ValueError("refinement profile differs from its admitted K/V pair")
+        binding = self.engine.bind_refinement_profile(
+            internal,
+            entry.profile,
+        )
+        if binding.weight_requantizations != 0:
+            raise RuntimeError("refinement runtime binding requantized a weight")
+        from chop.nn.quantized.modules.phase_context import force_runtime_phase
+
+        pair = (entry.profile.key_format, entry.profile.value_format)
+        needs_append_oracle = pair not in self._validated_pairs
+        self.engine._native_append_validation_calls = 0
+        self.engine._native_append_tensor_checks = 0
+        self.engine._native_append_quantized_tensor_checks = 0
+        self.engine._native_append_validation_seconds = 0.0
+
+        def validate_first_append(cache, start, end, artifact):
+            if self.engine._native_append_validation_calls == 0:
+                self.engine._validate_native_append(
+                    cache,
+                    start,
+                    end,
+                    artifact,
+                )
+
+        backend = TorchHFCachedDecodeBackend(
+            device=internal.device,
+            append_validator=validate_first_append if needs_append_oracle else None,
+            native_append_format=True,
+        )
+        documents = []
+        with force_runtime_phase("decode"):
+            for offset in range(
+                0,
+                len(self.bundle.samples),
+                self.decode_microbatch_size,
+            ):
+                batch = self.bundle.samples[
+                    offset : offset + self.decode_microbatch_size
+                ]
+                examples = []
+                for sample in batch:
+                    prefill = load_prefill_artifact(
+                        self.prefill_root / _document_token(sample.document_id)
+                    )
+                    admitted = self.engine.cache_lru.get(
+                        admission.paths[sample.document_id]
+                    )
+                    examples.append(
+                        ContinuationExample(
+                            document_id=sample.document_id,
+                            prefill=prefill,
+                            decode_cache=admitted,
+                            continuation_ids=(
+                                prefill.first_token.token_ids[0],
+                                *sample.decode_target_ids[:128],
+                            ),
+                        )
+                    )
+                documents.extend(
+                    evaluate_teacher_forced_cached_batched(
+                        internal.model,
+                        examples,
+                        backend,
+                    )
+                )
+        if needs_append_oracle:
+            layers = int(self.engine.model_architecture["num_hidden_layers"])
+            expected_tensor_checks = layers * 2
+            if (
+                self.engine._native_append_validation_calls != 1
+                or self.engine._native_append_tensor_checks != expected_tensor_checks
+                or self.engine._native_append_quantized_tensor_checks
+                != expected_tensor_checks
+            ):
+                raise AssertionError(
+                    "refinement split-append oracle did not cover every layer and role"
+                )
+            pair_index_value = load_immutable_json(pair_index)
+            append_evidence = self._append_evidence_path(*pair)
+            write_immutable_json(
+                append_evidence,
+                {
+                    "schema_version": "decode-refinement-split-append-evidence",
+                    "sample_bundle_hash": self.bundle.canonical_hash,
+                    "admission_contract_id": self.admission_contract_id,
+                    "key_format": pair[0],
+                    "value_format": pair[1],
+                    "pair_index_hash": pair_index_value["content_hash"],
+                    "q_len": 1,
+                    "layers_checked": layers,
+                    "key_value_tensors_checked": expected_tensor_checks,
+                    "native_append_passed": True,
+                    "software_tree_sha256": _software_tree_hash(_repository_root()),
+                    "mase_tree_sha256": _mase_tree_hash(
+                        _repository_root(), self.config
+                    ),
+                },
+            )
+            self._validated_pairs[pair] = append_evidence
+        append_evidence = self._validated_pairs.get(pair)
+        if append_evidence is None:
+            raise AssertionError("refinement split-append evidence is missing")
+        identity_after = internal.identity_guard.verify(internal.model)
+        internal.quantization_guard.verify()
+        source_clusters = {
+            sample.document_id: sample.source_cluster_id
+            for sample in self.bundle.samples
+        }
+        metrics = tuple(
+            RefinementDocumentMetric(
+                document_id=document.document_id,
+                source_cluster_id=source_clusters[document.document_id],
+                nll_sum=document.nll_sum,
+                token_count=document.token_count,
+                initial_cache_length=document.initial_cache_length,
+                final_cache_length=document.final_cache_length,
+            )
+            for document in documents
+        )
+        evidence = RefinementExecutionEvidence(
+            prefill_precision="BF16",
+            prefill_kv_precision="BF16",
+            first_token_owner="prefill",
+            q_len_values=(1,),
+            exact_cache_positions=True,
+            independent_batch_caches=True,
+            admission_count_per_prompt=1,
+            direct_native_kv_append=append_evidence.is_file(),
+            runtime_rebinding=binding.performed,
+            weight_requantizations=binding.weight_requantizations,
+            weight_identity_before=binding.identity_before,
+            weight_identity_after=identity_after,
+            checkpoint_tree_sha256=weight_bank.checkpoint_tree_sha256,
+        )
+        return RefinementEvaluation(
+            documents=metrics,
+            evidence=evidence,
+            artifacts=(
+                str(self.sample_bundle_path),
+                str(self.prefill_index_path),
+                str(pair_index),
+                str(append_evidence),
+                str(self._bank_receipts[weight_bank.bank_id]),
+            ),
+        )
+
+
+__all__ = ["RefinementEvaluator"]
diff --git a/decode_dse/software/refinement_runner.py b/decode_dse/software/refinement_runner.py
new file mode 100644
index 0000000..74eb44e
--- /dev/null
+++ b/decode_dse/software/refinement_runner.py
@@ -0,0 +1,2751 @@
+"""Prepare, run, and launch restartable cached-decode precision refinement.
+
+Commands: `prepare` builds disjoint samples, BF16 caches, and GPTQ
+calibration; `run` executes or resumes one shard; `launch` fans the
+schedule across isolated workers and checksum-merges their shards."""
+
+from __future__ import annotations
+
+import argparse
+from contextlib import AbstractContextManager, contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import fcntl
+import gc
+import hashlib
+import json
+import math
+import os
+from pathlib import Path
+import random
+import re
+import subprocess
+import sys
+import tempfile
+import time
+import traceback
+from typing import Any, Iterable, Mapping, Protocol, Sequence
+
+from decode_dse.hardware.statistics import percentile
+from decode_dse.software.cache_artifacts import (
+    ArtifactProvenance,
+    load_prefill_artifact,
+    save_prefill_artifact,
+)
+from decode_dse.software.cached_decode import capture_bf16_prefill
+from decode_dse.software.refinement_schedule import (
+    DecodeRefinementProfile,
+    RefinementSchedule,
+    RefinementScheduleEntry,
+    RefinementShardPlan,
+    build_refinement_shard_plans,
+    load_refinement_schedule,
+    load_refinement_shard_plan,
+    validate_refinement_shard_plan,
+    write_refinement_shard_plan,
+)
+from decode_dse.software.runtime_environment import (
+    RuntimeEnvironment,
+    capture_runtime_environment,
+    initialize_numerical_runtime,
+)
+from decode_dse.software.sweep_plan import load_immutable_json, write_immutable_json
+from decode_dse.software.token_samples import (
+    REFINEMENT_DECODE_STEPS,
+    RefinementSampleBundle,
+    TokenizedSourceDocument,
+    build_refinement_bundle_from_documents,
+    load_refinement_sample_bundle,
+    load_sample_bundle,
+    save_refinement_sample_bundle,
+)
+
+REFINEMENT_BANK_SCHEMA = "decode-refinement-bank"
+
+
+REFINEMENT_RESULT_SCHEMA = "decode-refinement-result"
+
+
+REFINEMENT_COMPLETION_SCHEMA = "decode-refinement-completion"
+
+
+REFINEMENT_MERGE_SCHEMA = "decode-refinement-merge"
+
+
+_SAFE_TOKEN = re.compile(r"^[a-zA-Z0-9_.-]+$")
+
+
+def _timestamp() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _canonical_bytes(value: Mapping[str, Any]) -> bytes:
+    return (
+        json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        )
+        + "\n"
+    ).encode("utf-8")
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(_canonical_bytes(value).rstrip(b"\n")).hexdigest()
+
+
+def _tree_hash(path: Path) -> str:
+    digest = hashlib.sha256()
+    files = tuple(sorted(value for value in path.rglob("*") if value.is_file()))
+    if not files:
+        raise ValueError(f"checkpoint contains no files: {path}")
+    for value in files:
+        relative = value.relative_to(path).as_posix().encode("utf-8")
+        digest.update(len(relative).to_bytes(8, "little"))
+        digest.update(relative)
+        payload = value.read_bytes()
+        digest.update(len(payload).to_bytes(8, "little"))
+        digest.update(payload)
+    return digest.hexdigest()
+
+
+def _file_hash(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        while block := handle.read(1 << 20):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _sha256(value: str, label: str) -> None:
+    if not re.fullmatch(r"[0-9a-f]{64}", value):
+        raise ValueError(f"{label} must be a lowercase SHA-256")
+
+
+def _strict_bool(value: Any, label: str) -> bool:
+    if not isinstance(value, bool):
+        raise TypeError(f"{label} must be a boolean")
+    return value
+
+
+def _artifact_identity(path_value: str) -> dict[str, Any]:
+    path = Path(path_value).resolve()
+    if path.is_file():
+        size = path.stat().st_size
+        if size <= 0:
+            raise ValueError(f"refinement artifact is empty: {path}")
+        digest = _file_hash(path)
+        kind = "file"
+        file_count = 1
+    elif path.is_dir():
+        files = tuple(sorted(value for value in path.rglob("*") if value.is_file()))
+        if not files:
+            raise ValueError(f"refinement artifact directory is empty: {path}")
+        size = sum(value.stat().st_size for value in files)
+        digest = _tree_hash(path)
+        kind = "directory"
+        file_count = len(files)
+    else:
+        raise ValueError(f"refinement artifact does not exist: {path}")
+    return {
+        "path": str(path),
+        "kind": kind,
+        "file_count": file_count,
+        "size_bytes": size,
+        "sha256": digest,
+    }
+
+
+def _is_out_of_memory(error: BaseException) -> bool:
+    name = type(error).__name__.lower()
+    message = str(error).lower()
+    return (
+        isinstance(error, MemoryError)
+        or "outofmemory" in name
+        or ("out of memory" in message and ("cuda" in message or "host" in message))
+    )
+
+
+def rotation_policy() -> dict[str, Any]:
+    """Return the fixed calibration-aware rotation search contract."""
+
+    return {
+        "calibration_samples": 32,
+        "calibration_sequence_length": 1024,
+        "improvement_epsilon": 0.0,
+        "matmul_types": "all_supported",
+        "cache_winners": True,
+        "score_phase": "decode",
+    }
+
+
+def rotation_policy_hash() -> str:
+    return _content_hash(rotation_policy())
+
+
+def rotation_decision_contract(
+    profile: DecodeRefinementProfile,
+) -> dict[str, Any]:
+    """Bind rotation search to every precision role that affects its score."""
+
+    return {
+        "policy": rotation_policy(),
+        "profile_id": profile.profile_id,
+        "profile": profile.to_dict(),
+    }
+
+
+def rotation_decision_contract_hash(
+    profile: DecodeRefinementProfile,
+) -> str:
+    return _content_hash(rotation_decision_contract(profile))
+
+
+def refinement_rng_policy() -> dict[str, Any]:
+    """Return the deterministic calibration and search runtime contract."""
+
+    return {
+        "python_random": "seeded",
+        "numpy_random": "seeded_if_available",
+        "torch_cpu": "seeded",
+        "torch_cuda_all": "seeded",
+        "torch_deterministic_algorithms": True,
+        "cudnn_deterministic": True,
+        "cudnn_benchmark": False,
+        "cuda_matmul_allow_tf32": False,
+        "cudnn_allow_tf32": False,
+        "cublas_workspace_config": ":4096:8",
+    }
+
+
+def refinement_rng_policy_hash() -> str:
+    return _content_hash(refinement_rng_policy())
+
+
+def refinement_bank_key(
+    profile: DecodeRefinementProfile,
+) -> tuple[str, str, str]:
+    """Keep GPTQ banks W-shared and rotation decisions profile-local."""
+
+    scope = profile.profile_id if profile.weight_method == "rotation" else "shared"
+    return profile.weight_format, profile.weight_method, scope
+
+
+@dataclass(frozen=True)
+class RefinementBankSpec:
+    """Immutable identity of one calibrated W/method bank."""
+
+    model_name: str
+    model_revision: str
+    weight_format: str
+    weight_method: str
+    block_size: int
+    calibration_dataset: str
+    calibration_revision: str
+    calibration_bundle_hash: str
+    calibration_path: str
+    calibration_samples: int
+    calibration_sequence_length: int
+    calibration_batch_size: int
+    checkpoint_dir: str
+    quantile_search: bool = True
+    clip_search_y: bool = True
+    rng_seed: int = 0
+    rng_policy_hash: str = ""
+    rotation_config_hash: str | None = None
+    rotation_profile_id: str | None = None
+    schema_version: str = REFINEMENT_BANK_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != REFINEMENT_BANK_SCHEMA:
+            raise ValueError(f"unsupported bank schema {self.schema_version!r}")
+        for label, value in (
+            ("model_name", self.model_name),
+            ("model_revision", self.model_revision),
+            ("weight_format", self.weight_format),
+            ("weight_method", self.weight_method),
+            ("calibration_dataset", self.calibration_dataset),
+            ("calibration_revision", self.calibration_revision),
+            ("calibration_bundle_hash", self.calibration_bundle_hash),
+            ("calibration_path", self.calibration_path),
+            ("checkpoint_dir", self.checkpoint_dir),
+        ):
+            if not value:
+                raise ValueError(f"{label} is required")
+        if self.weight_method not in {"gptq_erry", "rotation"}:
+            raise ValueError(
+                "refinement banks must use GPTQ+Erry or selective rotation"
+            )
+        if self.block_size != 8:
+            raise ValueError("refinement banks require native block size 8")
+        if (
+            min(
+                self.calibration_samples,
+                self.calibration_sequence_length,
+                self.calibration_batch_size,
+            )
+            <= 0
+        ):
+            raise ValueError("calibration dimensions must be positive")
+        if isinstance(self.rng_seed, bool) or not 0 <= self.rng_seed < 2**63:
+            raise ValueError("rng_seed must be an integer in [0, 2^63)")
+        if self.rng_policy_hash != refinement_rng_policy_hash():
+            raise ValueError("refinement RNG policy identity mismatch")
+        if not self.quantile_search or not self.clip_search_y:
+            raise ValueError("GPTQ+Erry requires quantile and output-error clipping")
+        if self.weight_method == "rotation" and not self.rotation_config_hash:
+            raise ValueError("rotation banks require a pinned rotation config")
+        if self.weight_method == "rotation" and not self.rotation_profile_id:
+            raise ValueError("rotation banks require a profile identity")
+        if self.weight_method != "rotation" and self.rotation_config_hash is not None:
+            raise ValueError("non-rotation banks cannot carry rotation identity")
+        if self.weight_method != "rotation" and self.rotation_profile_id is not None:
+            raise ValueError("non-rotation banks cannot carry a rotation profile")
+        _sha256(self.calibration_bundle_hash, "calibration_bundle_hash")
+        if self.rotation_config_hash is not None:
+            _sha256(self.rotation_config_hash, "rotation_config_hash")
+        if not Path(self.calibration_path).is_absolute():
+            raise ValueError("calibration_path must be absolute")
+        if not Path(self.checkpoint_dir).is_absolute():
+            raise ValueError("checkpoint_dir must be absolute")
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "model_name": self.model_name,
+            "model_revision": self.model_revision,
+            "weight_format": self.weight_format,
+            "weight_method": self.weight_method,
+            "block_size": self.block_size,
+            "calibration_dataset": self.calibration_dataset,
+            "calibration_revision": self.calibration_revision,
+            "calibration_bundle_hash": self.calibration_bundle_hash,
+            "calibration_path": self.calibration_path,
+            "calibration_samples": self.calibration_samples,
+            "calibration_sequence_length": self.calibration_sequence_length,
+            "calibration_batch_size": self.calibration_batch_size,
+            "checkpoint_dir": self.checkpoint_dir,
+            "quantile_search": self.quantile_search,
+            "clip_search_y": self.clip_search_y,
+            "rng_seed": self.rng_seed,
+            "rng_policy_hash": self.rng_policy_hash,
+            "rotation_config_hash": self.rotation_config_hash,
+            "rotation_profile_id": self.rotation_profile_id,
+        }
+
+    @property
+    def bank_id(self) -> str:
+        return f"rwb-{_content_hash(self._content_dict())}"
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"bank_id": self.bank_id}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementBankSpec":
+        spec = cls(
+            model_name=str(value["model_name"]),
+            model_revision=str(value["model_revision"]),
+            weight_format=str(value["weight_format"]),
+            weight_method=str(value["weight_method"]),
+            block_size=int(value["block_size"]),
+            calibration_dataset=str(value["calibration_dataset"]),
+            calibration_revision=str(value["calibration_revision"]),
+            calibration_bundle_hash=str(value["calibration_bundle_hash"]),
+            calibration_path=str(value["calibration_path"]),
+            calibration_samples=int(value["calibration_samples"]),
+            calibration_sequence_length=int(value["calibration_sequence_length"]),
+            calibration_batch_size=int(value["calibration_batch_size"]),
+            checkpoint_dir=str(value["checkpoint_dir"]),
+            quantile_search=_strict_bool(value["quantile_search"], "quantile_search"),
+            clip_search_y=_strict_bool(value["clip_search_y"], "clip_search_y"),
+            rng_seed=int(value["rng_seed"]),
+            rng_policy_hash=str(value["rng_policy_hash"]),
+            rotation_config_hash=(
+                None
+                if value.get("rotation_config_hash") is None
+                else str(value["rotation_config_hash"])
+            ),
+            rotation_profile_id=(
+                None
+                if value.get("rotation_profile_id") is None
+                else str(value["rotation_profile_id"])
+            ),
+            schema_version=str(value["schema_version"]),
+        )
+        if value.get("bank_id") != spec.bank_id:
+            raise ValueError("refinement bank identity mismatch")
+        return spec
+
+
+@dataclass(frozen=True)
+class RefinementBankHandle:
+    """Measured bank identity returned by an execution adapter."""
+
+    bank_id: str
+    checkpoint_tree_sha256: str
+    weight_identity_before: str
+
+    def __post_init__(self) -> None:
+        for label, value in (
+            ("bank_id", self.bank_id),
+            ("checkpoint_tree_sha256", self.checkpoint_tree_sha256),
+            ("weight_identity_before", self.weight_identity_before),
+        ):
+            if not value:
+                raise ValueError(f"{label} is required")
+
+
+@dataclass(frozen=True)
+class RefinementDocumentMetric:
+    document_id: str
+    source_cluster_id: str
+    nll_sum: float
+    token_count: int
+    initial_cache_length: int
+    final_cache_length: int
+
+    def __post_init__(self) -> None:
+        if not self.document_id or not self.source_cluster_id:
+            raise ValueError("document and source-cluster IDs are required")
+        if not math.isfinite(self.nll_sum) or self.nll_sum < 0:
+            raise ValueError("document NLL must be finite and non-negative")
+        if self.token_count != REFINEMENT_DECODE_STEPS:
+            raise ValueError(
+                "each refinement document must score "
+                f"{REFINEMENT_DECODE_STEPS} tokens"
+            )
+        if self.initial_cache_length != 512:
+            raise ValueError(
+                "refinement decode must start from a 512-token prompt cache"
+            )
+        if self.final_cache_length - self.initial_cache_length != self.token_count:
+            raise ValueError(
+                "refinement cache growth must equal the scored token count"
+            )
+
+    @property
+    def mean_nll(self) -> float:
+        return self.nll_sum / self.token_count
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "document_id": self.document_id,
+            "source_cluster_id": self.source_cluster_id,
+            "nll_sum": self.nll_sum,
+            "token_count": self.token_count,
+            "mean_token_nll": self.mean_nll,
+            "initial_cache_length": self.initial_cache_length,
+            "final_cache_length": self.final_cache_length,
+        }
+
+
+@dataclass(frozen=True)
+class RefinementExecutionEvidence:
+    """Proof that one result used cached q_len=1 decode and runtime rebinding."""
+
+    prefill_precision: str
+    prefill_kv_precision: str
+    first_token_owner: str
+    q_len_values: tuple[int, ...]
+    exact_cache_positions: bool
+    independent_batch_caches: bool
+    admission_count_per_prompt: int
+    direct_native_kv_append: bool
+    runtime_rebinding: bool
+    weight_requantizations: int
+    weight_identity_before: str
+    weight_identity_after: str
+    checkpoint_tree_sha256: str
+
+    def __post_init__(self) -> None:
+        if self.prefill_precision != "BF16" or self.prefill_kv_precision != "BF16":
+            raise ValueError(
+                "refinement requires a BF16 prefill artifact and BF16 handoff"
+            )
+        if self.first_token_owner != "prefill":
+            raise ValueError("the first generated token must come from prefill")
+        if self.q_len_values != (1,):
+            raise ValueError("refinement evidence must contain only q_len=1 calls")
+        if not self.exact_cache_positions or not self.independent_batch_caches:
+            raise ValueError(
+                "refinement requires exact positions and independent caches"
+            )
+        if self.admission_count_per_prompt != 1 or not self.direct_native_kv_append:
+            raise ValueError(
+                "refinement requires one admission and native decode appends"
+            )
+        if not self.runtime_rebinding or self.weight_requantizations != 0:
+            raise ValueError(
+                "refinement profiles must rebind without weight quantization"
+            )
+        if self.weight_identity_before != self.weight_identity_after:
+            raise ValueError("weight identity changed during runtime rebinding")
+        if not self.checkpoint_tree_sha256:
+            raise ValueError("checkpoint tree identity is required")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "prefill_precision": self.prefill_precision,
+            "prefill_kv_precision": self.prefill_kv_precision,
+            "first_token_owner": self.first_token_owner,
+            "q_len_values": list(self.q_len_values),
+            "exact_cache_positions": self.exact_cache_positions,
+            "independent_batch_caches": self.independent_batch_caches,
+            "admission_count_per_prompt": self.admission_count_per_prompt,
+            "direct_native_kv_append": self.direct_native_kv_append,
+            "runtime_rebinding": self.runtime_rebinding,
+            "weight_requantizations": self.weight_requantizations,
+            "weight_identity_before": self.weight_identity_before,
+            "weight_identity_after": self.weight_identity_after,
+            "checkpoint_tree_sha256": self.checkpoint_tree_sha256,
+        }
+
+
+@dataclass(frozen=True)
+class RefinementEvaluation:
+    documents: tuple[RefinementDocumentMetric, ...]
+    evidence: RefinementExecutionEvidence
+    artifacts: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        documents = tuple(self.documents)
+        if len(documents) != 128:
+            raise ValueError("refinement requires 128 document metrics")
+        ids = tuple(document.document_id for document in documents)
+        if len(ids) != len(set(ids)):
+            raise ValueError("refinement document metrics contain duplicate IDs")
+        object.__setattr__(self, "documents", documents)
+        object.__setattr__(self, "artifacts", tuple(map(str, self.artifacts)))
+
+
+class RefinementExecutor(Protocol):
+    def open_weight_bank(
+        self,
+        bank: RefinementBankSpec,
+        entries: tuple[RefinementScheduleEntry, ...],
+    ) -> AbstractContextManager[RefinementBankHandle]: ...
+
+    def open_split_kv_admission_cache(
+        self,
+        key_format: str,
+        value_format: str,
+        samples: RefinementSampleBundle,
+    ) -> AbstractContextManager[Any]: ...
+
+    def evaluate(
+        self,
+        entry: RefinementScheduleEntry,
+        *,
+        samples: RefinementSampleBundle,
+        weight_bank: RefinementBankHandle,
+        kv_admission_cache: Any,
+    ) -> RefinementEvaluation: ...
+
+
+def clustered_bootstrap_mean_nll(
+    documents: Sequence[RefinementDocumentMetric],
+    *,
+    seed: int,
+    replicates: int = 2000,
+) -> dict[str, float | int]:
+    """Bootstrap source documents while retaining all windows from each source."""
+
+    clusters: dict[str, list[RefinementDocumentMetric]] = {}
+    for document in documents:
+        clusters.setdefault(document.source_cluster_id, []).append(document)
+    if len(clusters) < 2:
+        raise ValueError("clustered bootstrap requires at least two sources")
+    if replicates < 100:
+        raise ValueError("clustered bootstrap requires at least 100 replicates")
+    rng = random.Random(int(seed))
+    means = []
+    ordered_clusters = tuple(tuple(clusters[key]) for key in sorted(clusters))
+    count = len(ordered_clusters)
+    for _ in range(replicates):
+        selected_clusters = [
+            ordered_clusters[rng.randrange(count)] for _ in range(count)
+        ]
+        selected = [document for cluster in selected_clusters for document in cluster]
+        means.append(
+            sum(document.nll_sum for document in selected)
+            / sum(document.token_count for document in selected)
+        )
+    observed = sum(document.nll_sum for document in documents) / sum(
+        document.token_count for document in documents
+    )
+    return {
+        "method": "clustered_source_document_bootstrap",
+        "replicates": replicates,
+        "seed": int(seed),
+        "source_cluster_count": count,
+        "window_count": len(documents),
+        "mean_nll": observed,
+        "ci95_low": percentile(means, 0.025),
+        "ci95_high": percentile(means, 0.975),
+    }
+
+
+def build_refinement_bank_specs(
+    schedule: RefinementSchedule,
+    *,
+    model_name: str,
+    model_revision: str,
+    calibration_dataset: str,
+    calibration_revision: str,
+    calibration_bundle_hash: str,
+    calibration_path: str | Path,
+    checkpoint_root: str | Path,
+    calibration_samples: int = 128,
+    calibration_sequence_length: int = 2048,
+    calibration_batch_size: int = 8,
+    rng_seed_base: int = 0,
+    rotation_config_hashes: Mapping[str, str] | None = None,
+    profile_ids: Sequence[str] | None = None,
+) -> dict[tuple[str, str, str], RefinementBankSpec]:
+    """Share GPTQ by W while keeping every rotation decision profile-local."""
+
+    rotation_hashes = dict(rotation_config_hashes or {})
+    selected_ids = (
+        {str(profile_id) for profile_id in profile_ids}
+        if profile_ids is not None
+        else None
+    )
+    if selected_ids is not None:
+        known_ids = {entry.profile_id for entry in schedule.entries}
+        if len(selected_ids) != len(tuple(profile_ids)):
+            raise ValueError("refinement bank filter contains duplicate profiles")
+        if selected_ids - known_ids:
+            raise ValueError("refinement bank filter contains unknown profiles")
+    entries_by_key: dict[tuple[str, str, str], RefinementScheduleEntry] = {}
+    for entry in schedule.entries:
+        if selected_ids is not None and entry.profile_id not in selected_ids:
+            continue
+        if not entry.gate.executable:
+            continue
+        entries_by_key.setdefault(refinement_bank_key(entry.profile), entry)
+    root = Path(checkpoint_root).resolve()
+    calibration = Path(calibration_path).resolve()
+    specs = {}
+    for key in sorted(entries_by_key):
+        weight_format, weight_method, scope = key
+        representative = entries_by_key[key].profile
+        seed_material = (
+            f"{int(rng_seed_base)}:{weight_method}:{weight_format}:{scope}"
+        ).encode("utf-8")
+        rng_seed = int.from_bytes(hashlib.sha256(seed_material).digest()[:8], "big") % (
+            2**63
+        )
+        rotation_hash = (
+            rotation_hashes.get(
+                representative.profile_id,
+                rotation_decision_contract_hash(representative),
+            )
+            if weight_method == "rotation"
+            else None
+        )
+        spec = RefinementBankSpec(
+            model_name=model_name,
+            model_revision=model_revision,
+            weight_format=weight_format,
+            weight_method=weight_method,
+            block_size=8,
+            calibration_dataset=calibration_dataset,
+            calibration_revision=calibration_revision,
+            calibration_bundle_hash=calibration_bundle_hash,
+            calibration_path=str(calibration),
+            calibration_samples=calibration_samples,
+            calibration_sequence_length=calibration_sequence_length,
+            calibration_batch_size=calibration_batch_size,
+            rng_seed=rng_seed,
+            rng_policy_hash=refinement_rng_policy_hash(),
+            checkpoint_dir=str(root / weight_method / weight_format / scope),
+            rotation_config_hash=rotation_hash,
+            rotation_profile_id=(
+                representative.profile_id if weight_method == "rotation" else None
+            ),
+        )
+        specs[key] = spec
+    return specs
+
+
+class _RecordStore:
+    def __init__(
+        self,
+        root: Path,
+        schedule: RefinementSchedule,
+        samples: RefinementSampleBundle,
+        entries: Sequence[RefinementScheduleEntry] | None = None,
+    ) -> None:
+        self.root = root
+        self.schedule = schedule
+        self.samples = samples
+        self.shards = root / "shards"
+        self.completed = root / "completed"
+        self.shards.mkdir(parents=True, exist_ok=True)
+        self.completed.mkdir(parents=True, exist_ok=True)
+        selected = tuple(entries) if entries is not None else schedule.entries
+        self.execution_entries = selected
+        self.entries = {entry.profile_id: entry for entry in selected}
+        if len(self.entries) != len(selected):
+            raise ValueError("refinement execution entries contain duplicates")
+        self.records: dict[tuple[str, int], dict[str, Any]] = {}
+        self._load()
+
+    def _repair_tail(self, path: Path) -> None:
+        descriptor = os.open(path, os.O_RDWR)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            size = os.lseek(descriptor, 0, os.SEEK_END)
+            if size == 0:
+                return
+            os.lseek(descriptor, 0, os.SEEK_SET)
+            payload = os.read(descriptor, size)
+            if not payload.endswith(b"\n"):
+                os.ftruncate(descriptor, payload.rfind(b"\n") + 1)
+                os.fsync(descriptor)
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def _load(self) -> None:
+        for path in sorted(self.shards.glob("*.jsonl")):
+            self._repair_tail(path)
+            for line_number, line in enumerate(
+                path.read_text(encoding="utf-8").splitlines(), start=1
+            ):
+                value = json.loads(line)
+                record_hash = value.pop("record_hash", None)
+                if record_hash != _content_hash(value):
+                    raise ValueError(
+                        f"refinement result checksum mismatch at {path}:{line_number}"
+                    )
+                if value.get("schedule_hash") != self.schedule.canonical_hash:
+                    raise ValueError("refinement result schedule mismatch")
+                if value.get("sample_bundle_hash") != self.samples.canonical_hash:
+                    raise ValueError("refinement result sample-bundle mismatch")
+                profile_id = str(value["profile_id"])
+                entry = self.entries.get(profile_id)
+                if entry is None or value.get("profile") != entry.profile.to_dict():
+                    raise ValueError("refinement result profile mismatch")
+                if value.get("state") not in {
+                    "succeeded",
+                    "failed",
+                    "oom",
+                    "skipped_doomed",
+                    "blocked_evidence",
+                }:
+                    raise ValueError("refinement result state is invalid")
+                if value["state"] == "succeeded":
+                    artifacts = value.get("artifacts")
+                    if not isinstance(artifacts, list) or not artifacts:
+                        raise ValueError(
+                            "successful refinement result has no artifacts"
+                        )
+                    for artifact in artifacts:
+                        if not isinstance(artifact, Mapping):
+                            raise ValueError(
+                                "refinement artifact identity is malformed"
+                            )
+                        current = _artifact_identity(str(artifact.get("path", "")))
+                        if current != artifact:
+                            raise ValueError(
+                                "refinement result artifact identity changed"
+                            )
+                key = profile_id, int(value["attempt"])
+                if key in self.records:
+                    raise ValueError("duplicate refinement result attempt")
+                self.records[key] = value | {"record_hash": record_hash}
+
+    def latest(self, profile_id: str) -> dict[str, Any] | None:
+        values = [
+            value
+            for (candidate, _), value in self.records.items()
+            if candidate == profile_id
+        ]
+        return max(values, key=lambda value: int(value["attempt"]), default=None)
+
+    def append(
+        self,
+        entry: RefinementScheduleEntry,
+        *,
+        attempt: int,
+        state: str,
+        bank_id: str | None,
+        result: Mapping[str, Any] | None = None,
+        artifacts: Sequence[Mapping[str, Any]] = (),
+        error: BaseException | None = None,
+        runtime_seconds: float = 0.0,
+    ) -> dict[str, Any]:
+        if (entry.profile_id, attempt) in self.records:
+            raise ValueError("refinement result attempt already exists")
+        body = {
+            "schema_version": REFINEMENT_RESULT_SCHEMA,
+            "schedule_hash": self.schedule.canonical_hash,
+            "sample_bundle_hash": self.samples.canonical_hash,
+            "ordinal": entry.ordinal,
+            "profile_id": entry.profile_id,
+            "profile": entry.profile.to_dict(),
+            "gate": entry.gate.to_dict(),
+            "bank_id": bank_id,
+            "attempt": attempt,
+            "state": state,
+            "result": result,
+            "artifacts": [dict(artifact) for artifact in artifacts],
+            "error_class": type(error).__name__ if error else None,
+            "error_message": str(error) if error else None,
+            "traceback": traceback.format_exc() if error else None,
+            "runtime_seconds": float(runtime_seconds),
+            "completed_at": _timestamp(),
+        }
+        record = body | {"record_hash": _content_hash(body)}
+        shard = "gates" if bank_id is None else bank_id
+        if not _SAFE_TOKEN.fullmatch(shard):
+            raise ValueError("unsafe refinement shard identity")
+        path = self.shards / f"{shard}.jsonl"
+        payload = _canonical_bytes(record)
+        descriptor = os.open(path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o644)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            offset = 0
+            while offset < len(payload):
+                written = os.write(descriptor, payload[offset:])
+                if written <= 0:
+                    raise OSError("incomplete refinement journal append")
+                offset += written
+            os.fsync(descriptor)
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+        self.records[(entry.profile_id, attempt)] = record
+        return record
+
+    def mark_terminal(
+        self, entry: RefinementScheduleEntry, record: Mapping[str, Any]
+    ) -> None:
+        body = {
+            "schema_version": REFINEMENT_COMPLETION_SCHEMA,
+            "schedule_hash": self.schedule.canonical_hash,
+            "sample_bundle_hash": self.samples.canonical_hash,
+            "profile_id": entry.profile_id,
+            "ordinal": entry.ordinal,
+            "state": record["state"],
+            "attempt": int(record["attempt"]),
+            "record_hash": record["record_hash"],
+        }
+        write_immutable_json(self.completed / f"{entry.profile_id}.json", body)
+
+    def reconcile_completions(self, max_attempts: int) -> None:
+        for entry in self.execution_entries:
+            latest = self.latest(entry.profile_id)
+            marker_path = self.completed / f"{entry.profile_id}.json"
+            terminal = latest is not None and (
+                latest["state"] in {"succeeded", "skipped_doomed", "blocked_evidence"}
+                or (
+                    latest["state"] in {"failed", "oom"}
+                    and int(latest["attempt"]) >= max_attempts
+                )
+            )
+            if marker_path.exists():
+                marker = json.loads(marker_path.read_text(encoding="utf-8"))
+                content_hash = marker.pop("content_hash", None)
+                if content_hash != _content_hash(marker):
+                    raise ValueError("refinement completion checksum mismatch")
+                if not terminal:
+                    raise ValueError("refinement completion marker is not terminal")
+                expected = {
+                    "schema_version": REFINEMENT_COMPLETION_SCHEMA,
+                    "schedule_hash": self.schedule.canonical_hash,
+                    "sample_bundle_hash": self.samples.canonical_hash,
+                    "profile_id": entry.profile_id,
+                    "ordinal": entry.ordinal,
+                    "state": latest["state"],
+                    "attempt": int(latest["attempt"]),
+                    "record_hash": latest["record_hash"],
+                }
+                if marker != expected:
+                    raise ValueError(
+                        "refinement completion marker disagrees with its result"
+                    )
+            elif terminal:
+                self.mark_terminal(entry, latest)
+
+    def require_complete(self, max_attempts: int) -> None:
+        """Require checksummed terminal markers for every assigned profile."""
+
+        for entry in self.execution_entries:
+            latest = self.latest(entry.profile_id)
+            if latest is None:
+                raise ValueError("refinement shard has an unstarted profile")
+            terminal = latest["state"] in {
+                "succeeded",
+                "skipped_doomed",
+                "blocked_evidence",
+            } or (
+                latest["state"] in {"failed", "oom"}
+                and int(latest["attempt"]) >= max_attempts
+            )
+            if not terminal:
+                raise ValueError("refinement shard has a non-terminal profile")
+            marker_path = self.completed / f"{entry.profile_id}.json"
+            if not marker_path.is_file():
+                raise ValueError("refinement shard lacks a completion marker")
+            marker = json.loads(marker_path.read_text(encoding="utf-8"))
+            content_hash = marker.pop("content_hash", None)
+            if content_hash != _content_hash(marker):
+                raise ValueError("refinement completion checksum mismatch")
+            expected = {
+                "schema_version": REFINEMENT_COMPLETION_SCHEMA,
+                "schedule_hash": self.schedule.canonical_hash,
+                "sample_bundle_hash": self.samples.canonical_hash,
+                "profile_id": entry.profile_id,
+                "ordinal": entry.ordinal,
+                "state": latest["state"],
+                "attempt": int(latest["attempt"]),
+                "record_hash": latest["record_hash"],
+            }
+            if marker != expected:
+                raise ValueError(
+                    "refinement completion marker disagrees with its result"
+                )
+
+
+@dataclass(frozen=True)
+class RefinementRunSummary:
+    succeeded: int
+    failed_terminal: int
+    oom_terminal: int
+    skipped_doomed: int
+    blocked_evidence: int
+    pending: int
+    result_rows: int
+
+
+@dataclass(frozen=True)
+class RefinementMergeSummary:
+    master_schedule_hash: str
+    sample_bundle_hash: str
+    profile_count: int
+    result_rows: int
+    merged_results_sha256: str
+    receipt_path: str
+
+
+@dataclass(frozen=True)
+class RefinementMergedResults:
+    """Verified terminal rows from one immutable four-shard merge."""
+
+    receipt: Mapping[str, Any]
+    results_path: Path
+    results_sha256: str
+    terminal_rows: tuple[Mapping[str, Any], ...]
+
+
+def load_refinement_merged_results(
+    schedule: RefinementSchedule,
+    merge_receipt: str | Path,
+    *,
+    results_path: str | Path | None = None,
+    verify_result_artifacts: bool = True,
+) -> RefinementMergedResults:
+    """Fail closed on merge coverage, checksums, terminals, and artifacts."""
+
+    receipt_path = Path(merge_receipt).resolve()
+    receipt = load_immutable_json(receipt_path)
+    if receipt.get("schema_version") != REFINEMENT_MERGE_SCHEMA:
+        raise ValueError("unsupported refinement merge receipt")
+    if receipt.get("master_schedule_hash") != schedule.canonical_hash:
+        raise ValueError("refinement merge was produced for another schedule")
+    expected_ids = tuple(entry.profile_id for entry in schedule.entries)
+    if (
+        int(receipt.get("profile_count", -1)) != len(expected_ids)
+        or tuple(receipt.get("profile_ids", ())) != expected_ids
+    ):
+        raise ValueError("refinement merge profile coverage is not exact")
+    declared = receipt.get("merged_results")
+    if not isinstance(declared, Mapping):
+        raise ValueError("refinement merge results identity is missing")
+    source = Path(
+        results_path if results_path is not None else str(declared.get("path", ""))
+    ).resolve()
+    if not source.is_file() or source.stat().st_size <= 0:
+        raise ValueError("merged refinement results are missing or empty")
+    digest = _file_hash(source)
+    if (
+        source.stat().st_size != int(declared.get("size_bytes", -1))
+        or digest != declared.get("sha256")
+    ):
+        raise ValueError("merged refinement results identity changed")
+
+    entries = {entry.profile_id: entry for entry in schedule.entries}
+    attempts: dict[str, dict[int, dict[str, Any]]] = {}
+    observed_rows = 0
+    with source.open("r", encoding="utf-8") as handle:
+        for line_number, line in enumerate(handle, start=1):
+            if not line.strip():
+                raise ValueError(
+                    f"merged refinement results contain a blank row at {line_number}"
+                )
+            value = json.loads(line)
+            if not isinstance(value, Mapping):
+                raise TypeError("merged refinement result must be an object")
+            row = dict(value)
+            record_hash = row.pop("record_hash", None)
+            if record_hash != _content_hash(row):
+                raise ValueError(
+                    f"merged refinement result checksum mismatch at row {line_number}"
+                )
+            if (
+                row.get("schema_version") != REFINEMENT_RESULT_SCHEMA
+                or row.get("schedule_hash") != schedule.canonical_hash
+                or row.get("sample_bundle_hash")
+                != receipt.get("sample_bundle_hash")
+            ):
+                raise ValueError("merged refinement result provenance differs")
+            profile_id = str(row.get("profile_id", ""))
+            entry = entries.get(profile_id)
+            if (
+                entry is None
+                or int(row.get("ordinal", -1)) != entry.ordinal
+                or row.get("profile") != entry.profile.to_dict()
+                or row.get("gate") != entry.gate.to_dict()
+            ):
+                raise ValueError("merged refinement result profile binding differs")
+            state = str(row.get("state", ""))
+            attempt = int(row.get("attempt", -1))
+            if entry.gate.executable:
+                if attempt not in {1, 2, 3} or state not in {
+                    "succeeded",
+                    "failed",
+                    "oom",
+                }:
+                    raise ValueError(
+                        "executable refinement result terminal state is invalid"
+                    )
+            elif (
+                attempt != 0
+                or state != entry.gate.execution_state
+                or state not in {"skipped_doomed", "blocked_evidence"}
+            ):
+                raise ValueError(
+                    "gated refinement result terminal state is invalid"
+                )
+            profile_attempts = attempts.setdefault(profile_id, {})
+            if attempt in profile_attempts:
+                raise ValueError("merged refinement result attempt is duplicated")
+            restored = {**row, "record_hash": record_hash}
+            if restored.get("state") == "succeeded":
+                result = restored.get("result")
+                mean_nll = (
+                    result.get("mean_token_nll")
+                    if isinstance(result, Mapping)
+                    else None
+                )
+                if (
+                    isinstance(mean_nll, bool)
+                    or not isinstance(mean_nll, (int, float))
+                    or not math.isfinite(float(mean_nll))
+                    or float(mean_nll) < 0
+                ):
+                    raise ValueError(
+                        "successful refinement result has no finite mean NLL"
+                    )
+                artifacts = restored.get("artifacts")
+                if not isinstance(artifacts, list) or not artifacts:
+                    raise ValueError(
+                        "successful refinement result has no sealed artifacts"
+                    )
+                if verify_result_artifacts:
+                    for artifact in artifacts:
+                        if (
+                            not isinstance(artifact, Mapping)
+                            or _artifact_identity(str(artifact.get("path", "")))
+                            != artifact
+                        ):
+                            raise ValueError(
+                                "refinement result artifact identity changed"
+                            )
+            profile_attempts[attempt] = restored
+            observed_rows += 1
+    if observed_rows != int(receipt.get("result_rows", -1)):
+        raise ValueError("refinement merge result-row count differs")
+    if set(attempts) != set(expected_ids):
+        raise ValueError("refinement merge terminal coverage is incomplete")
+    terminal_rows = tuple(
+        attempts[profile_id][max(attempts[profile_id])]
+        for profile_id in expected_ids
+    )
+    terminal_receipts = receipt.get("terminal")
+    expected_terminal = [
+        {
+            "profile_id": profile_id,
+            "state": row["state"],
+            "attempt": int(row["attempt"]),
+            "record_hash": row["record_hash"],
+        }
+        for profile_id, row in zip(expected_ids, terminal_rows)
+    ]
+    if terminal_receipts != expected_terminal:
+        raise ValueError("refinement merge terminal receipt differs from results")
+    return RefinementMergedResults(
+        receipt=receipt,
+        results_path=source,
+        results_sha256=digest,
+        terminal_rows=terminal_rows,
+    )
+
+
+class RefinementRunner:
+    """Execute an immutable schedule with at most three attempts per point."""
+
+    def __init__(
+        self,
+        *,
+        schedule: RefinementSchedule,
+        samples: RefinementSampleBundle,
+        banks: Mapping[tuple[str, str, str], RefinementBankSpec],
+        executor: RefinementExecutor,
+        output_dir: str | Path,
+        max_attempts: int = 3,
+        bootstrap_replicates: int = 2000,
+        shard_plan: RefinementShardPlan | None = None,
+    ) -> None:
+        if max_attempts != 3:
+            raise ValueError("the refinement artifact contract requires three attempts")
+        if bootstrap_replicates < 100:
+            raise ValueError("bootstrap_replicates must be at least 100")
+        self.schedule = schedule
+        self.samples = samples
+        self.banks = dict(banks)
+        self.executor = executor
+        self.output_dir = Path(output_dir)
+        self.max_attempts = max_attempts
+        self.bootstrap_replicates = bootstrap_replicates
+        self.shard_plan = shard_plan
+        self.execution_entries = (
+            validate_refinement_shard_plan(schedule, shard_plan)
+            if shard_plan is not None
+            else schedule.entries
+        )
+        expected_groups = {
+            refinement_bank_key(entry.profile)
+            for entry in self.execution_entries
+            if entry.gate.executable
+        }
+        if set(self.banks) != expected_groups:
+            raise ValueError(
+                "refinement bank coverage differs from executable schedule groups"
+            )
+        for key, bank in self.banks.items():
+            expected_key = (
+                bank.weight_format,
+                bank.weight_method,
+                bank.rotation_profile_id or "shared",
+            )
+            if key != expected_key:
+                raise ValueError("refinement bank mapping key is inconsistent")
+            calibration_path = Path(bank.calibration_path)
+            if not calibration_path.is_file():
+                raise ValueError(
+                    f"refinement calibration artifact is missing: {calibration_path}"
+                )
+            if _file_hash(calibration_path) != bank.calibration_bundle_hash:
+                raise ValueError("refinement calibration artifact hash mismatch")
+
+    @contextmanager
+    def _run_lock(self):
+        self.output_dir.mkdir(parents=True, exist_ok=True)
+        path = self.output_dir / ".run.lock"
+        descriptor = os.open(path, os.O_CREAT | os.O_RDWR, 0o644)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            yield
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def _result(
+        self,
+        entry: RefinementScheduleEntry,
+        evaluation: RefinementEvaluation,
+        handle: RefinementBankHandle,
+    ) -> dict[str, Any]:
+        expected_ids = tuple(sample.document_id for sample in self.samples.samples)
+        actual_ids = tuple(document.document_id for document in evaluation.documents)
+        if actual_ids != expected_ids:
+            raise ValueError(
+                "refinement results differ from the immutable sample order"
+            )
+        expected_clusters = tuple(
+            sample.source_cluster_id for sample in self.samples.samples
+        )
+        actual_clusters = tuple(
+            document.source_cluster_id for document in evaluation.documents
+        )
+        if actual_clusters != expected_clusters:
+            raise ValueError(
+                "refinement result clusters differ from the immutable samples"
+            )
+        if handle.bank_id != self.banks[refinement_bank_key(entry.profile)].bank_id:
+            raise ValueError("executor returned the wrong refinement weight bank")
+        if evaluation.evidence.weight_identity_before != handle.weight_identity_before:
+            raise ValueError("refinement evidence does not match the open weight bank")
+        if evaluation.evidence.checkpoint_tree_sha256 != handle.checkpoint_tree_sha256:
+            raise ValueError("refinement checkpoint evidence changed during evaluation")
+        seed = int(entry.profile.canonical_hash[:16], 16)
+        bootstrap = clustered_bootstrap_mean_nll(
+            evaluation.documents,
+            seed=seed,
+            replicates=self.bootstrap_replicates,
+        )
+        return {
+            "nll_sum": sum(document.nll_sum for document in evaluation.documents),
+            "token_count": sum(
+                document.token_count for document in evaluation.documents
+            ),
+            "mean_token_nll": bootstrap["mean_nll"],
+            "post_handoff_greedy_conditioned_nll": bootstrap["mean_nll"],
+            "post_handoff_greedy_conditioned_exp_nll": math.exp(
+                float(bootstrap["mean_nll"])
+            ),
+            "metric_id": "post_handoff_greedy_conditioned_nll/v1",
+            "clustered_bootstrap": bootstrap,
+            "documents": [document.to_dict() for document in evaluation.documents],
+            "execution_evidence": evaluation.evidence.to_dict(),
+        }
+
+    def _pending(self, store: _RecordStore) -> tuple[RefinementScheduleEntry, ...]:
+        pending = []
+        for entry in self.execution_entries:
+            latest = store.latest(entry.profile_id)
+            if latest is None:
+                pending.append(entry)
+            elif latest["state"] in {"failed", "oom"} and int(latest["attempt"]) < 3:
+                pending.append(entry)
+        return tuple(pending)
+
+    def _summary(self, store: _RecordStore) -> RefinementRunSummary:
+        states = []
+        for entry in self.execution_entries:
+            latest = store.latest(entry.profile_id)
+            states.append(None if latest is None else latest["state"])
+        return RefinementRunSummary(
+            succeeded=states.count("succeeded"),
+            failed_terminal=sum(
+                state == "failed"
+                and int(store.latest(entry.profile_id)["attempt"]) >= 3
+                for state, entry in zip(states, self.execution_entries)
+                if state is not None
+            ),
+            oom_terminal=sum(
+                state == "oom" and int(store.latest(entry.profile_id)["attempt"]) >= 3
+                for state, entry in zip(states, self.execution_entries)
+                if state is not None
+            ),
+            skipped_doomed=states.count("skipped_doomed"),
+            blocked_evidence=states.count("blocked_evidence"),
+            pending=states.count(None)
+            + sum(
+                state in {"failed", "oom"}
+                and int(store.latest(entry.profile_id)["attempt"]) < 3
+                for state, entry in zip(states, self.execution_entries)
+                if state is not None
+            ),
+            result_rows=len(store.records),
+        )
+
+    def run(self) -> RefinementRunSummary:
+        with self._run_lock():
+            return self._run_locked()
+
+    def _run_locked(self) -> RefinementRunSummary:
+        runtime_environment = getattr(
+            self.executor,
+            "runtime_environment",
+            None,
+        )
+        if callable(runtime_environment):
+            runtime_environment = runtime_environment()
+        write_immutable_json(
+            self.output_dir / "contract.json",
+            {
+                "schema_version": "decode-refinement-run",
+                "schedule": self.schedule.to_dict(),
+                "shard_plan": (
+                    self.shard_plan.to_dict() if self.shard_plan is not None else None
+                ),
+                "execution_profile_ids": [
+                    entry.profile_id for entry in self.execution_entries
+                ],
+                "sample_bundle": self.samples.to_dict(),
+                "banks": [self.banks[key].to_dict() for key in sorted(self.banks)],
+                "runtime_environment": runtime_environment,
+                "max_attempts": self.max_attempts,
+                "bootstrap_replicates": self.bootstrap_replicates,
+            },
+        )
+        store = _RecordStore(
+            self.output_dir,
+            self.schedule,
+            self.samples,
+            self.execution_entries,
+        )
+        store.reconcile_completions(self.max_attempts)
+        for entry in self.execution_entries:
+            if entry.gate.executable or store.latest(entry.profile_id) is not None:
+                continue
+            record = store.append(
+                entry,
+                attempt=0,
+                state=entry.gate.execution_state,
+                bank_id=None,
+                result={"gate": entry.gate.to_dict()},
+            )
+            store.mark_terminal(entry, record)
+
+        while True:
+            pending = tuple(
+                entry for entry in self._pending(store) if entry.gate.executable
+            )
+            if not pending:
+                break
+            groups: dict[tuple[str, str, str], list[RefinementScheduleEntry]] = {}
+            for entry in pending:
+                groups.setdefault(
+                    refinement_bank_key(entry.profile),
+                    [],
+                ).append(entry)
+            for key in sorted(groups):
+                entries = tuple(sorted(groups[key], key=lambda value: value.ordinal))
+                bank = self.banks[key]
+                try:
+                    manager = self.executor.open_weight_bank(bank, entries)
+                    with manager as handle:
+                        if not isinstance(handle, RefinementBankHandle):
+                            raise TypeError(
+                                "refinement executor must return RefinementBankHandle"
+                            )
+                        if handle.bank_id != bank.bank_id:
+                            raise ValueError(
+                                "refinement executor opened an unexpected bank"
+                            )
+                        pair_groups: dict[
+                            tuple[str, str], list[RefinementScheduleEntry]
+                        ] = {}
+                        for entry in entries:
+                            pair_groups.setdefault(
+                                (
+                                    entry.profile.key_format,
+                                    entry.profile.value_format,
+                                ),
+                                [],
+                            ).append(entry)
+                        for pair in sorted(pair_groups):
+                            with self.executor.open_split_kv_admission_cache(
+                                pair[0],
+                                pair[1],
+                                self.samples,
+                            ) as admission:
+                                for entry in pair_groups[pair]:
+                                    started = time.monotonic()
+                                    latest = store.latest(entry.profile_id)
+                                    attempt = (
+                                        1
+                                        if latest is None
+                                        else int(latest["attempt"]) + 1
+                                    )
+                                    try:
+                                        evaluation = self.executor.evaluate(
+                                            entry,
+                                            samples=self.samples,
+                                            weight_bank=handle,
+                                            kv_admission_cache=admission,
+                                        )
+                                        result = self._result(
+                                            entry,
+                                            evaluation,
+                                            handle,
+                                        )
+                                        if not evaluation.artifacts:
+                                            raise ValueError(
+                                                "refinement evaluation returned no bound artifacts"
+                                            )
+                                        record = store.append(
+                                            entry,
+                                            attempt=attempt,
+                                            state="succeeded",
+                                            bank_id=bank.bank_id,
+                                            result=result,
+                                            artifacts=tuple(
+                                                _artifact_identity(path)
+                                                for path in evaluation.artifacts
+                                            ),
+                                            runtime_seconds=(
+                                                time.monotonic() - started
+                                            ),
+                                        )
+                                        store.mark_terminal(entry, record)
+                                    except Exception as error:
+                                        current = store.latest(entry.profile_id)
+                                        if (
+                                            current is not None
+                                            and int(current["attempt"]) == attempt
+                                            and current["state"] == "succeeded"
+                                        ):
+                                            raise
+                                        state = (
+                                            "oom"
+                                            if _is_out_of_memory(error)
+                                            else "failed"
+                                        )
+                                        record = store.append(
+                                            entry,
+                                            attempt=attempt,
+                                            state=state,
+                                            bank_id=bank.bank_id,
+                                            error=error,
+                                            runtime_seconds=(
+                                                time.monotonic() - started
+                                            ),
+                                        )
+                                        if attempt >= self.max_attempts:
+                                            store.mark_terminal(entry, record)
+                except Exception as error:
+                    for entry in entries:
+                        latest = store.latest(entry.profile_id)
+                        if latest is not None and latest["state"] == "succeeded":
+                            continue
+                        attempt = 1 if latest is None else int(latest["attempt"]) + 1
+                        state = "oom" if _is_out_of_memory(error) else "failed"
+                        record = store.append(
+                            entry,
+                            attempt=attempt,
+                            state=state,
+                            bank_id=bank.bank_id,
+                            error=error,
+                        )
+                        if attempt >= self.max_attempts:
+                            store.mark_terminal(entry, record)
+        return self._summary(store)
+
+
+def _write_immutable_jsonl(path: Path, rows: Sequence[Mapping[str, Any]]) -> str:
+    payload = b"".join(_canonical_bytes(dict(row)) for row in rows)
+    digest = hashlib.sha256(payload).hexdigest()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if path.exists():
+        if path.read_bytes() != payload:
+            raise FileExistsError(
+                f"refusing to replace different merged results: {path}"
+            )
+        return digest
+    temporary_name: str | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=path.parent,
+            prefix=f".{path.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as temporary:
+            temporary_name = temporary.name
+            temporary.write(payload)
+            temporary.flush()
+            os.fsync(temporary.fileno())
+        os.chmod(temporary_name, 0o644)
+        try:
+            os.link(temporary_name, path)
+        except FileExistsError:
+            if path.read_bytes() != payload:
+                raise FileExistsError(
+                    f"refusing to replace different merged results: {path}"
+                )
+    finally:
+        if temporary_name and os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return digest
+
+
+def merge_refinement_shards(
+    *,
+    schedule: RefinementSchedule,
+    samples: RefinementSampleBundle,
+    shard_roots: Sequence[str | Path],
+    output_dir: str | Path,
+    max_attempts: int = 3,
+) -> RefinementMergeSummary:
+    """Verify four shard journals and create one immutable coverage artifact."""
+
+    if max_attempts != 3:
+        raise ValueError("the refinement merge contract requires three attempts")
+    if len(shard_roots) != 4:
+        raise ValueError("the refinement merge requires exactly four shard roots")
+    expected_plans = build_refinement_shard_plans(schedule)
+    observed: dict[
+        int,
+        tuple[Path, RefinementShardPlan, Mapping[str, Any]],
+    ] = {}
+    logical_fingerprint: str | None = None
+    for raw_root in shard_roots:
+        root = Path(raw_root).resolve()
+        contract_path = root / "contract.json"
+        contract = load_immutable_json(contract_path)
+        if contract.get("schema_version") != "decode-refinement-run":
+            raise ValueError("unsupported refinement shard-run contract")
+        if contract.get("schedule") != schedule.to_dict():
+            raise ValueError("refinement shard master schedule mismatch")
+        if contract.get("sample_bundle") != samples.to_dict():
+            raise ValueError("refinement shard sample bundle mismatch")
+        plan_value = contract.get("shard_plan")
+        if not isinstance(plan_value, Mapping):
+            raise ValueError("refinement shard contract has no shard plan")
+        plan = RefinementShardPlan.from_dict(plan_value)
+        validate_refinement_shard_plan(schedule, plan)
+        if plan != expected_plans[plan.shard_index]:
+            raise ValueError("refinement shard plan differs from deterministic plan")
+        if plan.shard_index in observed:
+            raise ValueError("duplicate refinement shard index")
+        if contract.get("execution_profile_ids") != list(plan.profile_ids):
+            raise ValueError("refinement shard execution coverage mismatch")
+        if int(contract.get("max_attempts", -1)) != max_attempts:
+            raise ValueError("refinement shard retry contract mismatch")
+        runtime = contract.get("runtime_environment")
+        if not isinstance(runtime, Mapping):
+            raise ValueError("refinement shard lacks runtime-environment evidence")
+        environment = RuntimeEnvironment.from_dict(runtime)
+        current_fingerprint = environment.logical_fingerprint
+        if logical_fingerprint is None:
+            logical_fingerprint = current_fingerprint
+        elif current_fingerprint != logical_fingerprint:
+            raise ValueError("refinement shards used different numerical runtimes")
+        observed[plan.shard_index] = (root, plan, contract)
+    if set(observed) != set(range(4)):
+        raise ValueError("refinement shard coverage is incomplete")
+    device_observations = [
+        dict(
+            RuntimeEnvironment.from_dict(
+                observed[index][2]["runtime_environment"]
+            ).observation
+        )
+        for index in range(4)
+    ]
+
+    merged_rows: list[dict[str, Any]] = []
+    terminal_rows: dict[str, dict[str, Any]] = {}
+    source_artifacts = []
+    for shard_index in range(4):
+        root, plan, _ = observed[shard_index]
+        entries = validate_refinement_shard_plan(schedule, plan)
+        store = _RecordStore(root, schedule, samples, entries)
+        store.require_complete(max_attempts)
+        rows = tuple(
+            sorted(
+                store.records.values(),
+                key=lambda row: (int(row["ordinal"]), int(row["attempt"])),
+            )
+        )
+        merged_rows.extend(dict(row) for row in rows)
+        for entry in entries:
+            latest = store.latest(entry.profile_id)
+            if latest is None:
+                raise AssertionError("complete refinement shard has no latest row")
+            if entry.profile_id in terminal_rows:
+                raise ValueError("refinement profile appears in multiple shards")
+            terminal_rows[entry.profile_id] = latest
+        result_files = tuple(sorted((root / "shards").glob("*.jsonl")))
+        completion_files = tuple(sorted((root / "completed").glob("*.json")))
+        source_artifacts.append(
+            {
+                "shard_index": shard_index,
+                "root": str(root),
+                "shard_plan_hash": plan.canonical_hash,
+                "contract_sha256": _file_hash(root / "contract.json"),
+                "result_files": [
+                    {
+                        "name": path.name,
+                        "size_bytes": path.stat().st_size,
+                        "sha256": _file_hash(path),
+                    }
+                    for path in result_files
+                ],
+                "completion_files": [
+                    {
+                        "name": path.name,
+                        "size_bytes": path.stat().st_size,
+                        "sha256": _file_hash(path),
+                    }
+                    for path in completion_files
+                ],
+            }
+        )
+    expected_ids = tuple(entry.profile_id for entry in schedule.entries)
+    if set(terminal_rows) != set(expected_ids):
+        raise ValueError("merged refinement coverage differs from the master schedule")
+    merged_rows.sort(key=lambda row: (int(row["ordinal"]), int(row["attempt"])))
+    destination = Path(output_dir).resolve()
+    results_path = destination / "results.jsonl"
+    merged_hash = _write_immutable_jsonl(results_path, merged_rows)
+    receipt_path = destination / "merge.json"
+    write_immutable_json(
+        receipt_path,
+        {
+            "schema_version": REFINEMENT_MERGE_SCHEMA,
+            "master_schedule_hash": schedule.canonical_hash,
+            "sample_bundle_hash": samples.canonical_hash,
+            "logical_runtime_fingerprint": logical_fingerprint,
+            "device_observations": device_observations,
+            "profile_count": len(expected_ids),
+            "profile_ids": list(expected_ids),
+            "terminal": [
+                {
+                    "profile_id": profile_id,
+                    "state": terminal_rows[profile_id]["state"],
+                    "attempt": int(terminal_rows[profile_id]["attempt"]),
+                    "record_hash": terminal_rows[profile_id]["record_hash"],
+                }
+                for profile_id in expected_ids
+            ],
+            "result_rows": len(merged_rows),
+            "merged_results": {
+                "path": str(results_path),
+                "size_bytes": results_path.stat().st_size,
+                "sha256": merged_hash,
+            },
+            "sources": source_artifacts,
+        },
+    )
+    return RefinementMergeSummary(
+        master_schedule_hash=schedule.canonical_hash,
+        sample_bundle_hash=samples.canonical_hash,
+        profile_count=len(expected_ids),
+        result_rows=len(merged_rows),
+        merged_results_sha256=merged_hash,
+        receipt_path=str(receipt_path),
+    )
+
+
+def seal_checkpoint_identity(
+    bank: RefinementBankSpec,
+    checkpoint_dir: str | Path,
+    weight_identity: str,
+) -> RefinementBankHandle:
+    """Bind an opened bank to the exact files produced or resumed."""
+
+    path = Path(checkpoint_dir).resolve()
+    if path != Path(bank.checkpoint_dir).resolve():
+        raise ValueError("checkpoint path differs from the bank contract")
+    return RefinementBankHandle(
+        bank_id=bank.bank_id,
+        checkpoint_tree_sha256=_tree_hash(path),
+        weight_identity_before=weight_identity,
+    )
+
+
+def _file_sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        while block := handle.read(1 << 20):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _load_config(path: str | Path) -> dict[str, Any]:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(value, dict):
+        raise ValueError("config must contain a JSON object")
+    return value
+
+
+def _refinement_config(config: Mapping[str, Any]) -> Mapping[str, Any]:
+    value = config.get("refinement")
+    if not isinstance(value, Mapping):
+        raise ValueError("config.refinement is required")
+    return value
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--schedule", required=True)
+    parser.add_argument("--sample-bundle", required=True)
+    parser.add_argument("--prefill-root", required=True)
+    parser.add_argument("--admission-root", required=True)
+    parser.add_argument("--calibration", required=True)
+    parser.add_argument("--calibration-receipt", required=True)
+    parser.add_argument("--checkpoint-root", required=True)
+    parser.add_argument("--output-dir", required=True)
+    parser.add_argument("--work-root")
+    parser.add_argument("--shard-plan")
+    parser.add_argument("--device-label", required=True)
+    parser.add_argument("--decode-microbatch-size", type=int, default=8)
+    parser.add_argument("--bootstrap-replicates", type=int, default=2000)
+    return parser
+
+
+def main(argv: Iterable[str] | None = None) -> int:
+    args = _parser().parse_args(tuple(argv) if argv is not None else None)
+    config = _load_config(args.config)
+    refinement = _refinement_config(config)
+    schedule = load_refinement_schedule(args.schedule)
+    shard_plan = (
+        load_refinement_shard_plan(args.shard_plan) if args.shard_plan else None
+    )
+    execution_entries = (
+        validate_refinement_shard_plan(schedule, shard_plan)
+        if shard_plan is not None
+        else schedule.entries
+    )
+    samples = load_refinement_sample_bundle(args.sample_bundle)
+    receipt = load_immutable_json(args.calibration_receipt)
+    if receipt.get("schema_version") != "decode-gptq-calibration":
+        raise ValueError("unsupported GPTQ calibration receipt")
+    calibration = Path(args.calibration).resolve()
+    if str(calibration) != receipt.get("calibration_path"):
+        raise ValueError("GPTQ calibration path differs from its receipt")
+    calibration_hash = _file_sha256(calibration)
+    if calibration_hash != receipt.get("calibration_sha256"):
+        raise ValueError("GPTQ calibration hash differs from its receipt")
+    if receipt.get("model_revision") != str(config["model_revision"]):
+        raise ValueError("GPTQ calibration model revision mismatch")
+    if receipt.get("tokenizer_revision") != str(config["tokenizer_revision"]):
+        raise ValueError("GPTQ calibration tokenizer revision mismatch")
+    selection = receipt.get("selection")
+    if (
+        receipt.get("selection_policy") != "document_round_robin_nonoverlap/v1"
+        or not isinstance(selection, list)
+        or len(selection) != 128
+    ):
+        raise ValueError("GPTQ calibration selection receipt is incomplete")
+    selection_hash = hashlib.sha256(
+        json.dumps(
+            selection,
+            sort_keys=True,
+            separators=(",", ":"),
+        ).encode("utf-8")
+    ).hexdigest()
+    if selection_hash != receipt.get("selection_sha256"):
+        raise ValueError("GPTQ calibration selection receipt hash mismatch")
+    configured_seed = int(refinement.get("calibration_seed", 0))
+    if receipt.get("selection_seed") != configured_seed:
+        raise ValueError("GPTQ calibration selection seed mismatch")
+    banks = build_refinement_bank_specs(
+        schedule,
+        model_name=str(config["model_name"]),
+        model_revision=str(config["model_revision"]),
+        calibration_dataset=str(receipt["dataset_name"]),
+        calibration_revision=str(receipt["dataset_revision"]),
+        calibration_bundle_hash=calibration_hash,
+        calibration_path=calibration,
+        checkpoint_root=args.checkpoint_root,
+        calibration_samples=int(receipt["sample_count"]),
+        calibration_sequence_length=int(receipt["sequence_length"]),
+        calibration_batch_size=int(refinement.get("calibration_batch_size", 8)),
+        rng_seed_base=configured_seed,
+        profile_ids=tuple(entry.profile_id for entry in execution_entries),
+    )
+    work_root = (
+        Path(args.work_root).resolve()
+        if args.work_root
+        else Path(args.output_dir).resolve() / "work"
+    )
+    # Imported here: refinement_evaluator imports this module's bank types.
+    from decode_dse.software.refinement_evaluator import RefinementEvaluator
+
+    adapter = RefinementEvaluator(
+        config=config,
+        sample_bundle_path=args.sample_bundle,
+        prefill_root=args.prefill_root,
+        admission_root=args.admission_root,
+        workspace_root=work_root,
+        device_label=args.device_label,
+        decode_microbatch_size=args.decode_microbatch_size,
+        max_cpu_cache_gib=float(refinement.get("max_cpu_cache_gib", 24)),
+    )
+    summary = RefinementRunner(
+        schedule=schedule,
+        samples=samples,
+        banks=banks,
+        executor=adapter,
+        output_dir=args.output_dir,
+        bootstrap_replicates=args.bootstrap_replicates,
+        shard_plan=shard_plan,
+    ).run()
+    print(json.dumps(summary.__dict__, indent=2, sort_keys=True))
+    return (
+        0
+        if summary.pending == 0
+        and summary.failed_terminal == 0
+        and summary.oom_terminal == 0
+        else 2
+    )
+
+
+_GPU_TOKEN = re.compile(r"^[A-Za-z0-9_.:-]+$")
+
+
+def parse_gpu_pool(value: str) -> tuple[str, ...]:
+    devices = tuple(token.strip() for token in value.split(",") if token.strip())
+    if not 1 <= len(devices) <= 4 or len(set(devices)) != len(devices):
+        raise ValueError(
+            "refinement launch requires one to four unique GPU identifiers"
+        )
+    if any(not _GPU_TOKEN.fullmatch(device) for device in devices):
+        raise ValueError("GPU identifiers contain unsupported characters")
+    return devices
+
+
+def refinement_worker_command(
+    *,
+    config: Path,
+    schedule: Path,
+    shard_plan: Path,
+    sample_bundle: Path,
+    prefill_root: Path,
+    admission_root: Path,
+    calibration: Path,
+    calibration_receipt: Path,
+    checkpoint_root: Path,
+    output_dir: Path,
+    work_root: Path,
+    device_label: str,
+    decode_microbatch_size: int,
+    bootstrap_replicates: int,
+) -> tuple[str, ...]:
+    return (
+        sys.executable,
+        "-m",
+        "decode_dse.software.refinement_runner",
+        "--config",
+        str(config),
+        "--schedule",
+        str(schedule),
+        "--shard-plan",
+        str(shard_plan),
+        "--sample-bundle",
+        str(sample_bundle),
+        "--prefill-root",
+        str(prefill_root),
+        "--admission-root",
+        str(admission_root),
+        "--calibration",
+        str(calibration),
+        "--calibration-receipt",
+        str(calibration_receipt),
+        "--checkpoint-root",
+        str(checkpoint_root),
+        "--output-dir",
+        str(output_dir),
+        "--work-root",
+        str(work_root),
+        "--device-label",
+        device_label,
+        "--decode-microbatch-size",
+        str(decode_microbatch_size),
+        "--bootstrap-replicates",
+        str(bootstrap_replicates),
+    )
+
+
+def _shard_roots(output_root: Path) -> tuple[Path, ...]:
+    return tuple(output_root / "shards" / f"shard-{index:02d}" for index in range(4))
+
+
+def _refinement_launch_waves(
+    devices: Sequence[str],
+) -> tuple[tuple[tuple[int, str], ...], ...]:
+    """Map four immutable source shards onto a bounded physical GPU pool."""
+
+    pool = tuple(devices)
+    if not 1 <= len(pool) <= 4 or len(set(pool)) != len(pool):
+        raise ValueError(
+            "refinement execution requires one to four unique GPUs"
+        )
+    assignments = tuple(
+        (shard_index, pool[shard_index % len(pool)])
+        for shard_index in range(4)
+    )
+    return tuple(
+        assignments[offset : offset + len(pool)]
+        for offset in range(0, len(assignments), len(pool))
+    )
+
+
+def _require_isolated_roots(roots: Sequence[Path]) -> None:
+    resolved = tuple(path.resolve() for path in roots)
+    for index, left in enumerate(resolved):
+        for right in resolved[index + 1 :]:
+            if left == right or left in right.parents or right in left.parents:
+                raise ValueError("refinement mutable roots must not overlap")
+
+
+def launch_refinement(
+    *,
+    config: Path,
+    schedule_path: Path,
+    sample_bundle_path: Path,
+    prefill_root: Path,
+    admission_root: Path,
+    calibration: Path,
+    calibration_receipt: Path,
+    checkpoint_root: Path,
+    output_root: Path,
+    work_root: Path,
+    device_label: str,
+    devices: Sequence[str],
+    decode_microbatch_size: int = 8,
+    bootstrap_replicates: int = 2000,
+) -> int:
+    waves = _refinement_launch_waves(devices)
+    _require_isolated_roots((admission_root, checkpoint_root, output_root, work_root))
+    schedule = load_refinement_schedule(schedule_path)
+    plans = build_refinement_shard_plans(schedule)
+    shard_roots = _shard_roots(output_root)
+    plan_root = output_root / "plans"
+    plan_paths = []
+    for plan in plans:
+        path = plan_root / f"shard-{plan.shard_index:02d}.json"
+        write_refinement_shard_plan(path, plan)
+        plan_paths.append(path)
+
+    timestamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S.%fZ")
+    log_root = output_root / "logs" / f"refinement-{timestamp}"
+    log_root.mkdir(parents=True, exist_ok=False)
+    workers: list[dict[str, Any] | None] = [None] * 4
+    return_codes: list[int | None] = [None] * 4
+    for wave_index, wave in enumerate(waves):
+        processes: list[
+            tuple[int, subprocess.Popen[bytes], object]
+        ] = []
+        try:
+            for worker_slot, (index, device) in enumerate(wave):
+                shard_name = f"shard-{index:02d}"
+                command = refinement_worker_command(
+                    config=config,
+                    schedule=schedule_path,
+                    shard_plan=plan_paths[index],
+                    sample_bundle=sample_bundle_path,
+                    prefill_root=prefill_root,
+                    admission_root=admission_root / shard_name,
+                    calibration=calibration,
+                    calibration_receipt=calibration_receipt,
+                    checkpoint_root=checkpoint_root / shard_name,
+                    output_dir=shard_roots[index],
+                    work_root=work_root / shard_name,
+                    device_label=device_label,
+                    decode_microbatch_size=decode_microbatch_size,
+                    bootstrap_replicates=bootstrap_replicates,
+                )
+                log_path = log_root / f"{shard_name}.log"
+                handle = log_path.open("wb")
+                environment = os.environ.copy()
+                environment["CUDA_VISIBLE_DEVICES"] = str(device)
+                environment["CUDA_DEVICE_ORDER"] = "PCI_BUS_ID"
+                try:
+                    process = subprocess.Popen(
+                        command,
+                        cwd=Path(__file__).resolve().parents[2],
+                        env=environment,
+                        stdout=handle,
+                        stderr=subprocess.STDOUT,
+                    )
+                except BaseException:
+                    handle.close()
+                    raise
+                processes.append((index, process, handle))
+                workers[index] = {
+                    "shard_index": index,
+                    "source_profile_id": plans[index].source_profile_id,
+                    "shard_plan_hash": plans[index].canonical_hash,
+                    "wave_index": wave_index,
+                    "worker_slot": worker_slot,
+                    "cuda_visible_devices": str(device),
+                    "command": list(command),
+                    "log": str(log_path.resolve()),
+                }
+            for index, process, _ in processes:
+                return_codes[index] = process.wait()
+        except BaseException:
+            for _, process, _ in processes:
+                if process.poll() is None:
+                    process.terminate()
+            for _, process, _ in processes:
+                process.wait()
+            raise
+        finally:
+            for _, _, handle in processes:
+                handle.close()
+
+    if any(worker is None for worker in workers) or any(
+        return_code is None for return_code in return_codes
+    ):
+        raise AssertionError("refinement launch did not cover every source shard")
+
+    samples = load_refinement_sample_bundle(sample_bundle_path)
+    merge = merge_refinement_shards(
+        schedule=schedule,
+        samples=samples,
+        shard_roots=shard_roots,
+        output_dir=output_root / "merged",
+    )
+    write_immutable_json(
+        log_root / "summary.json",
+        {
+            "schema_version": "decode-refinement-launch",
+            "master_schedule_hash": schedule.canonical_hash,
+            "sample_bundle_hash": samples.canonical_hash,
+            "workers": [
+                worker | {"return_code": return_codes[index]}
+                for index, worker in enumerate(workers)
+                if worker is not None
+            ],
+            "merge": merge.__dict__,
+        },
+    )
+    if all(return_code == 0 for return_code in return_codes):
+        print(json.dumps(merge.__dict__, indent=2, sort_keys=True))
+        return 0
+    failed = [index for index, return_code in enumerate(return_codes) if return_code]
+    print(
+        f"refinement produced complete terminal coverage with failed shards {failed}",
+        file=sys.stderr,
+    )
+    return 2
+
+
+def merge_existing_refinement(
+    *,
+    schedule_path: Path,
+    sample_bundle_path: Path,
+    output_root: Path,
+) -> int:
+    summary = merge_refinement_shards(
+        schedule=load_refinement_schedule(schedule_path),
+        samples=load_refinement_sample_bundle(sample_bundle_path),
+        shard_roots=_shard_roots(output_root),
+        output_dir=output_root / "merged",
+    )
+    print(json.dumps(summary.__dict__, indent=2, sort_keys=True))
+    return 0
+
+
+def launch_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    subparsers = parser.add_subparsers(dest="command", required=True)
+    launch = subparsers.add_parser("launch")
+    launch.add_argument("--config", type=Path, required=True)
+    launch.add_argument("--schedule", type=Path, required=True)
+    launch.add_argument("--sample-bundle", type=Path, required=True)
+    launch.add_argument("--prefill-root", type=Path, required=True)
+    launch.add_argument("--admission-root", type=Path, required=True)
+    launch.add_argument("--calibration", type=Path, required=True)
+    launch.add_argument("--calibration-receipt", type=Path, required=True)
+    launch.add_argument("--checkpoint-root", type=Path, required=True)
+    launch.add_argument("--output-root", type=Path, required=True)
+    launch.add_argument("--work-root", type=Path, required=True)
+    launch.add_argument("--device-label", required=True)
+    launch.add_argument("--gpus", required=True)
+    launch.add_argument("--decode-microbatch-size", type=int, default=8)
+    launch.add_argument("--bootstrap-replicates", type=int, default=2000)
+
+    merge = subparsers.add_parser("merge")
+    merge.add_argument("--schedule", type=Path, required=True)
+    merge.add_argument("--sample-bundle", type=Path, required=True)
+    merge.add_argument("--output-root", type=Path, required=True)
+    return parser
+
+
+def launch_main(argv: Iterable[str] | None = None) -> int:
+    parser = launch_parser()
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    try:
+        if args.command == "merge":
+            return merge_existing_refinement(
+                schedule_path=args.schedule.resolve(),
+                sample_bundle_path=args.sample_bundle.resolve(),
+                output_root=args.output_root.resolve(),
+            )
+        return launch_refinement(
+            config=args.config.resolve(),
+            schedule_path=args.schedule.resolve(),
+            sample_bundle_path=args.sample_bundle.resolve(),
+            prefill_root=args.prefill_root.resolve(),
+            admission_root=args.admission_root.resolve(),
+            calibration=args.calibration.resolve(),
+            calibration_receipt=args.calibration_receipt.resolve(),
+            checkpoint_root=args.checkpoint_root.resolve(),
+            output_root=args.output_root.resolve(),
+            work_root=args.work_root.resolve(),
+            device_label=args.device_label,
+            devices=parse_gpu_pool(args.gpus),
+            decode_microbatch_size=args.decode_microbatch_size,
+            bootstrap_replicates=args.bootstrap_replicates,
+        )
+    except (OSError, ValueError) as error:
+        parser.error(str(error))
+    return 2
+
+
+__all__ = [
+    "REFINEMENT_BANK_SCHEMA",
+    "REFINEMENT_COMPLETION_SCHEMA",
+    "REFINEMENT_MERGE_SCHEMA",
+    "REFINEMENT_RESULT_SCHEMA",
+    "RefinementBankHandle",
+    "RefinementBankSpec",
+    "RefinementDocumentMetric",
+    "RefinementEvaluation",
+    "RefinementExecutionEvidence",
+    "RefinementMergedResults",
+    "RefinementRunSummary",
+    "RefinementMergeSummary",
+    "RefinementRunner",
+    "build_refinement_bank_specs",
+    "clustered_bootstrap_mean_nll",
+    "merge_refinement_shards",
+    "load_refinement_merged_results",
+    "rotation_policy",
+    "rotation_policy_hash",
+    "rotation_decision_contract",
+    "rotation_decision_contract_hash",
+    "refinement_bank_key",
+    "refinement_rng_policy",
+    "refinement_rng_policy_hash",
+    "seal_checkpoint_identity",
+]
+
+
+REFINEMENT_PREFILL_INDEX_SCHEMA = "decode-refinement-prefill-index"
+
+
+GPTQ_CALIBRATION_SCHEMA = "decode-gptq-calibration"
+
+
+GPTQ_SELECTION_POLICY = "document_round_robin_nonoverlap/v1"
+
+
+def _load_token_documents(
+    config: Mapping[str, Any],
+    data: Mapping[str, Any],
+) -> tuple[tuple[int, str, tuple[int, ...]], ...]:
+    from decode_dse.software.sweep import _group_wikitext_documents
+
+    try:
+        from datasets import load_dataset
+        from transformers import AutoTokenizer
+    except ImportError as exc:
+        raise RuntimeError(
+            "GPTQ calibration preparation requires datasets and transformers"
+        ) from exc
+    tokenizer = AutoTokenizer.from_pretrained(
+        str(config["model_name"]),
+        revision=str(config["tokenizer_revision"]),
+        cache_dir=config.get("hf_cache_dir"),
+        local_files_only=bool(config.get("local_files_only", True)),
+        trust_remote_code=bool(config.get("trust_remote_code", False)),
+    )
+    dataset = load_dataset(
+        str(data["dataset_name"]),
+        data.get("dataset_config"),
+        split=str(data.get("split", "train")),
+        revision=str(data["dataset_revision"]),
+        cache_dir=data.get("cache_dir"),
+    )
+    text_column = str(data.get("text_column", "text"))
+    if text_column not in dataset.column_names:
+        raise ValueError(f"dataset lacks text column {text_column!r}")
+    grouped = _group_wikitext_documents(
+        dataset[text_column],
+        split=str(data.get("split", "train")),
+        separator=str(data.get("document_separator", "\n\n")),
+    )
+    documents = []
+    for document_index, (_, text) in enumerate(grouped):
+        token_ids = tuple(
+            int(token)
+            for token in tokenizer(
+                text,
+                add_special_tokens=False,
+                return_attention_mask=False,
+            )["input_ids"]
+        )
+        if token_ids:
+            documents.append(
+                (
+                    document_index,
+                    hashlib.sha256(text.encode("utf-8")).hexdigest(),
+                    token_ids,
+                )
+            )
+    return tuple(documents)
+
+
+def _load_heldout_documents(
+    config: Mapping[str, Any],
+    data: Mapping[str, Any],
+) -> tuple[TokenizedSourceDocument, ...]:
+    from decode_dse.software.sweep import _group_wikitext_documents
+
+    try:
+        from datasets import load_dataset
+        from transformers import AutoTokenizer
+    except ImportError as exc:
+        raise RuntimeError(
+            "refinement sample preparation requires datasets and transformers"
+        ) from exc
+    tokenizer = AutoTokenizer.from_pretrained(
+        str(config["model_name"]),
+        revision=str(config["tokenizer_revision"]),
+        cache_dir=config.get("hf_cache_dir"),
+        local_files_only=bool(config.get("local_files_only", True)),
+        trust_remote_code=bool(config.get("trust_remote_code", False)),
+    )
+    split = str(data.get("split", "test"))
+    dataset = load_dataset(
+        str(data["dataset_name"]),
+        data.get("dataset_config"),
+        split=split,
+        revision=str(data["dataset_revision"]),
+        cache_dir=data.get("cache_dir"),
+    )
+    text_column = str(data.get("text_column", "text"))
+    if text_column not in dataset.column_names:
+        raise ValueError(f"dataset lacks text column {text_column!r}")
+    documents = []
+    for document_id, text in _group_wikitext_documents(
+        dataset[text_column],
+        split=split,
+        separator=str(data.get("document_separator", "\n\n")),
+    ):
+        tokens = tuple(
+            int(token)
+            for token in tokenizer(
+                text,
+                add_special_tokens=False,
+                return_attention_mask=False,
+            )["input_ids"]
+        )
+        if tokens:
+            documents.append(
+                TokenizedSourceDocument(
+                    document_id=document_id,
+                    content_hash=hashlib.sha256(text.encode("utf-8")).hexdigest(),
+                    token_ids=tokens,
+                )
+            )
+    return tuple(documents)
+
+
+def select_document_calibration_windows(
+    documents: Iterable[tuple[int, str, tuple[int, ...]]],
+    *,
+    nsamples: int,
+    seqlen: int,
+    seed: int,
+) -> tuple[tuple[tuple[int, ...], dict[str, Any]], ...]:
+    """Select non-overlapping windows while maximizing document coverage."""
+
+    by_document = []
+    for document_index, document_hash, token_ids in documents:
+        windows = []
+        for window_index, offset in enumerate(
+            range(0, len(token_ids) - seqlen + 1, seqlen)
+        ):
+            window = tuple(token_ids[offset : offset + seqlen])
+            rank = hashlib.sha256(
+                f"{seed}:{document_hash}:{window_index}".encode("utf-8")
+            ).hexdigest()
+            windows.append((rank, window_index, offset, window))
+        if windows:
+            by_document.append(
+                (
+                    document_index,
+                    document_hash,
+                    tuple(sorted(windows)),
+                )
+            )
+    if not by_document:
+        raise ValueError("calibration dataset has no complete token windows")
+    selected = []
+    round_index = 0
+    while len(selected) < nsamples:
+        available = [item for item in by_document if round_index < len(item[2])]
+        if not available:
+            break
+        available.sort(
+            key=lambda item: hashlib.sha256(
+                f"{seed}:{round_index}:{item[1]}:{item[0]}".encode("utf-8")
+            ).hexdigest()
+        )
+        for document_index, document_hash, windows in available:
+            if len(selected) == nsamples:
+                break
+            _, window_index, offset, window = windows[round_index]
+            window_hash = hashlib.sha256(
+                json.dumps(
+                    window,
+                    separators=(",", ":"),
+                ).encode("utf-8")
+            ).hexdigest()
+            selected.append(
+                (
+                    window,
+                    {
+                        "ordinal": len(selected),
+                        "document_index": document_index,
+                        "document_hash": document_hash,
+                        "window_index": window_index,
+                        "token_offset": offset,
+                        "token_count": seqlen,
+                        "window_hash": window_hash,
+                    },
+                )
+            )
+        round_index += 1
+    if len(selected) != nsamples:
+        raise ValueError(
+            f"calibration dataset provides {len(selected)} of {nsamples} windows"
+        )
+    return tuple(selected)
+
+
+def build_refinement_sample_file(
+    *,
+    config: Mapping[str, Any],
+    source_bundle_path: str | Path,
+    output_path: str | Path,
+) -> RefinementSampleBundle:
+    """Create samples disjoint from sealed screen and validation prompts."""
+
+    from decode_dse.software.sweep import _dataset_config
+
+    source = load_sample_bundle(source_bundle_path)
+    if source.model_revision != str(config["model_revision"]):
+        raise ValueError(
+            "source-bundle model revision differs from refinement configuration"
+        )
+    if source.tokenizer_revision != str(config["tokenizer_revision"]):
+        raise ValueError(
+            "source-bundle tokenizer revision differs from refinement configuration"
+        )
+    data = _dataset_config(config)
+    documents = _load_heldout_documents(config, data)
+    refinement = config.get("refinement")
+    if not isinstance(refinement, Mapping):
+        raise ValueError("config.refinement is required")
+    bundle = build_refinement_bundle_from_documents(
+        documents,
+        model_revision=source.model_revision,
+        tokenizer_revision=source.tokenizer_revision,
+        dataset_name=str(data["dataset_name"]),
+        dataset_revision=str(data["dataset_revision"]),
+        excluded_source_spans=tuple(
+            span
+            for sample in source.numerical_screen + source.hardware_validation
+            for span in sample.source_spans
+        ),
+        excluded_prompt_hashes=tuple(
+            sample.prompt_hash
+            for sample in source.numerical_screen + source.hardware_validation
+        ),
+        selection_seed=int(
+            refinement.get("sample_selection_seed", config.get("seed", 0))
+        ),
+    )
+    save_refinement_sample_bundle(bundle, output_path)
+    return bundle
+
+
+def prepare_refinement_prefill_artifacts(
+    *,
+    config: Mapping[str, Any],
+    bundle_path: str | Path,
+    artifact_root: str | Path,
+) -> dict[str, Any]:
+    """Capture one immutable BF16 prefill artifact per refinement prompt."""
+
+    from decode_dse.software.sweep import (
+        _artifact_directory,
+        _repository_hash,
+        _verify_prefill,
+    )
+
+    try:
+        import torch
+        from transformers import AutoModelForCausalLM
+    except ImportError as exc:
+        raise RuntimeError(
+            "refinement prefill preparation requires torch and transformers"
+        ) from exc
+    bundle = load_refinement_sample_bundle(bundle_path)
+    if bundle.model_revision != str(config["model_revision"]):
+        raise ValueError("refinement sample model revision differs from config")
+    if bundle.tokenizer_revision != str(config["tokenizer_revision"]):
+        raise ValueError("refinement sample tokenizer revision differs from config")
+    root = Path(artifact_root).resolve()
+    root.mkdir(parents=True, exist_ok=True)
+    device = str(config.get("device", "cuda:0"))
+    seed = int(config.get("seed", 0))
+    initialize_numerical_runtime(seed)
+    runtime_environment = capture_runtime_environment(device, seed=seed)
+    preparation_device = {
+        **dict(runtime_environment.observation),
+        "device_name": runtime_environment.logical["device_name"],
+        "compute_capability": runtime_environment.logical["compute_capability"],
+    }
+    preparation_metadata = {
+        "preparation_device_index": str(preparation_device["device_index"]),
+        "preparation_device_uuid": str(preparation_device["device_uuid"]),
+        "preparation_total_memory_bytes": str(preparation_device["total_memory_bytes"]),
+        "preparation_device_name": str(preparation_device["device_name"]),
+        "preparation_compute_capability": str(preparation_device["compute_capability"]),
+    }
+    code_revision = _repository_hash()
+    provenance = ArtifactProvenance(
+        producer="packedkv-refinement-bf16-prefill",
+        code_revision=code_revision,
+        created_at_utc=datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+        parameters=(
+            ("model_revision", bundle.model_revision),
+            ("sample_bundle_hash", bundle.canonical_hash),
+            ("tokenizer_revision", bundle.tokenizer_revision),
+            (
+                "runtime_environment_fingerprint",
+                runtime_environment.logical_fingerprint,
+            ),
+        ),
+    )
+    artifact_ids: dict[str, str] = {}
+    pending = []
+    for sample in bundle.samples:
+        path = _artifact_directory(root, sample.document_id)
+        if path.exists():
+            artifact = load_prefill_artifact(path)
+            _verify_prefill(
+                artifact,
+                sample=sample,
+                bundle=bundle,
+                provenance=provenance,
+                runtime_environment=runtime_environment,
+                model_architecture=config["model_architecture"],
+            )
+            artifact_ids[sample.document_id] = artifact.artifact_id
+        else:
+            pending.append(sample)
+
+    model = None
+    try:
+        if pending:
+            if str(config.get("dtype", "bfloat16")).lower() != "bfloat16":
+                raise ValueError("refinement prefill capture requires bfloat16")
+            model = AutoModelForCausalLM.from_pretrained(
+                str(config["model_name"]),
+                revision=bundle.model_revision,
+                torch_dtype=torch.bfloat16,
+                cache_dir=config.get("hf_cache_dir"),
+                local_files_only=bool(config.get("local_files_only", True)),
+                trust_remote_code=bool(config.get("trust_remote_code", False)),
+                attn_implementation="eager",
+                low_cpu_mem_usage=True,
+            )
+            model = model.to(device).eval()
+            for sample in pending:
+                input_ids = torch.tensor(
+                    [sample.prompt_token_ids],
+                    dtype=torch.long,
+                    device=device,
+                )
+                artifact = capture_bf16_prefill(
+                    model,
+                    input_ids=input_ids,
+                    attention_mask=torch.ones_like(input_ids),
+                    model_revision=bundle.model_revision,
+                    tokenizer_revision=bundle.tokenizer_revision,
+                    provenance=provenance,
+                    metadata={
+                        "document_id": sample.document_id,
+                        "sample_bundle_hash": bundle.canonical_hash,
+                        **preparation_metadata,
+                    },
+                )
+                _verify_prefill(
+                    artifact,
+                    sample=sample,
+                    bundle=bundle,
+                    provenance=provenance,
+                    runtime_environment=runtime_environment,
+                    model_architecture=config["model_architecture"],
+                )
+                save_prefill_artifact(
+                    artifact,
+                    _artifact_directory(root, sample.document_id),
+                )
+                artifact_ids[sample.document_id] = artifact.artifact_id
+    finally:
+        if model is not None:
+            del model
+        gc.collect()
+        if "torch" in locals() and torch.cuda.is_available():
+            torch.cuda.empty_cache()
+
+    records = [
+        {
+            "document_id": sample.document_id,
+            "prompt_hash": sample.prompt_hash,
+            "artifact_id": artifact_ids[sample.document_id],
+            "relative_path": _artifact_directory(
+                Path("."), sample.document_id
+            ).as_posix(),
+        }
+        for sample in bundle.samples
+    ]
+    value = {
+        "schema_version": REFINEMENT_PREFILL_INDEX_SCHEMA,
+        "model_revision": bundle.model_revision,
+        "tokenizer_revision": bundle.tokenizer_revision,
+        "sample_bundle_hash": bundle.canonical_hash,
+        "code_revision": code_revision,
+        "runtime_environment": runtime_environment.to_dict(),
+        "records": records,
+    }
+    write_immutable_json(root / "index.json", value)
+    return value
+
+
+def prepare_gptq_calibration(
+    *,
+    config: Mapping[str, Any],
+    output_path: str | Path,
+    receipt_path: str | Path,
+) -> dict[str, Any]:
+    """Seal a pinned file-backed loader consumed identically by every W bank."""
+
+    from decode_dse.software.sweep import _dataset_config
+
+    try:
+        import torch
+    except ImportError as exc:
+        raise RuntimeError("GPTQ calibration preparation requires torch") from exc
+    refinement = config.get("refinement")
+    if not isinstance(refinement, Mapping):
+        raise ValueError("config.refinement is required")
+    data = refinement.get("calibration_data")
+    if not isinstance(data, Mapping):
+        raise ValueError("config.refinement.calibration_data is required")
+    required = ("dataset_name", "dataset_revision")
+    if any(not data.get(key) for key in required):
+        raise ValueError("calibration dataset name and revision must be pinned")
+    nsamples = int(refinement.get("calibration_samples", 128))
+    seqlen = int(refinement.get("calibration_sequence_length", 2048))
+    seed = int(refinement.get("calibration_seed", 0))
+    if isinstance(refinement.get("calibration_seed", 0), bool) or not 0 <= seed < 2**63:
+        raise ValueError("calibration_seed must be an integer in [0, 2^63)")
+    if nsamples != 128 or seqlen != 2048:
+        raise ValueError(
+            "refinement GPTQ calibration is fixed at 128 samples by 2,048 tokens"
+        )
+    heldout = _dataset_config(config)
+    calibration_identity = (
+        str(data["dataset_name"]),
+        str(data.get("dataset_config", "")),
+        str(data["dataset_revision"]),
+        str(data.get("split", "train")),
+    )
+    heldout_identity = (
+        str(heldout["dataset_name"]),
+        str(heldout.get("dataset_config", "")),
+        str(heldout["dataset_revision"]),
+        str(heldout.get("split", "validation")),
+    )
+    if calibration_identity == heldout_identity:
+        raise ValueError("GPTQ calibration must not reuse the held-out selection split")
+    destination = Path(output_path).resolve()
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    expected_metadata = {
+        "seqlen": seqlen,
+        "nsamples": nsamples,
+        "dataset_name": str(data["dataset_name"]),
+        "dataset_config": str(data.get("dataset_config", "")),
+        "dataset_revision": str(data["dataset_revision"]),
+        "dataset_split": str(data.get("split", "train")),
+        "heldout_dataset_name": heldout_identity[0],
+        "heldout_dataset_config": heldout_identity[1],
+        "heldout_dataset_revision": heldout_identity[2],
+        "heldout_dataset_split": heldout_identity[3],
+        "heldout_split_disjoint": True,
+        "model_revision": str(config["model_revision"]),
+        "tokenizer_revision": str(config["tokenizer_revision"]),
+        "selection_policy": GPTQ_SELECTION_POLICY,
+        "selection_seed": seed,
+    }
+    documents = _load_token_documents(config, data)
+    selected = select_document_calibration_windows(
+        documents,
+        nsamples=nsamples,
+        seqlen=seqlen,
+        seed=seed,
+    )
+    selection = [record for _, record in selected]
+    if destination.exists():
+        existing = torch.load(destination, map_location="cpu", weights_only=False)
+        if (
+            not isinstance(existing, Mapping)
+            or not isinstance(existing.get("loader"), list)
+            or len(existing["loader"]) != nsamples
+            or any(
+                existing.get(key) != value for key, value in expected_metadata.items()
+            )
+            or existing.get("selection") != selection
+        ):
+            raise FileExistsError(
+                f"existing calibration artifact differs: {destination}"
+            )
+        for (expected_tokens, _), item in zip(selected, existing["loader"]):
+            if (
+                not isinstance(item, (tuple, list))
+                or len(item) != 2
+                or tuple(int(token) for token in item[0][0].tolist()) != expected_tokens
+            ):
+                raise FileExistsError(
+                    f"existing calibration tokens differ: {destination}"
+                )
+    else:
+        loader = []
+        for window, _ in selected:
+            input_ids = torch.tensor(
+                [window],
+                dtype=torch.long,
+            )
+            target = input_ids.clone()
+            target[:, :-1] = -100
+            loader.append((input_ids, target))
+        temporary_name = None
+        try:
+            with tempfile.NamedTemporaryFile(
+                dir=destination.parent,
+                prefix=f".{destination.name}.",
+                suffix=".tmp",
+                delete=False,
+            ) as temporary:
+                temporary_name = temporary.name
+            torch.save(
+                {
+                    "loader": loader,
+                    "selection": selection,
+                    **expected_metadata,
+                },
+                temporary_name,
+            )
+            os.replace(temporary_name, destination)
+            temporary_name = None
+        finally:
+            if temporary_name is not None:
+                Path(temporary_name).unlink(missing_ok=True)
+    receipt = {
+        "schema_version": GPTQ_CALIBRATION_SCHEMA,
+        "model_revision": str(config["model_revision"]),
+        "tokenizer_revision": str(config["tokenizer_revision"]),
+        "dataset_name": str(data["dataset_name"]),
+        "dataset_config": str(data.get("dataset_config", "")),
+        "dataset_revision": str(data["dataset_revision"]),
+        "split": str(data.get("split", "train")),
+        "heldout_dataset_name": heldout_identity[0],
+        "heldout_dataset_config": heldout_identity[1],
+        "heldout_dataset_revision": heldout_identity[2],
+        "heldout_dataset_split": heldout_identity[3],
+        "heldout_split_disjoint": True,
+        "sample_count": nsamples,
+        "sequence_length": seqlen,
+        "selection_policy": GPTQ_SELECTION_POLICY,
+        "selection_seed": seed,
+        "selection": selection,
+        "selection_sha256": hashlib.sha256(
+            json.dumps(
+                selection,
+                sort_keys=True,
+                separators=(",", ":"),
+            ).encode("utf-8")
+        ).hexdigest(),
+        "calibration_path": str(destination),
+        "calibration_sha256": _file_sha256(destination),
+    }
+    write_immutable_json(receipt_path, receipt)
+    return receipt
+
+
+def _refinement_inputs_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    samples = commands.add_parser("samples")
+    samples.add_argument("--config", required=True)
+    samples.add_argument("--source-bundle", required=True)
+    samples.add_argument("--output", required=True)
+    prefill = commands.add_parser("prefill")
+    prefill.add_argument("--config", required=True)
+    prefill.add_argument("--sample-bundle", required=True)
+    prefill.add_argument("--artifact-root", required=True)
+    calibration = commands.add_parser("calibration")
+    calibration.add_argument("--config", required=True)
+    calibration.add_argument("--output", required=True)
+    calibration.add_argument("--receipt", required=True)
+    return parser
+
+
+def refinement_inputs_main(argv: Iterable[str] | None = None) -> int:
+    args = _refinement_inputs_parser().parse_args(
+        tuple(argv) if argv is not None else None
+    )
+    config = _load_config(args.config)
+    if args.command == "samples":
+        result: Any = build_refinement_sample_file(
+            config=config,
+            source_bundle_path=args.source_bundle,
+            output_path=args.output,
+        ).to_dict()
+    elif args.command == "prefill":
+        result = prepare_refinement_prefill_artifacts(
+            config=config,
+            bundle_path=args.sample_bundle,
+            artifact_root=args.artifact_root,
+        )
+    else:
+        result = prepare_gptq_calibration(
+            config=config,
+            output_path=args.output,
+            receipt_path=args.receipt,
+        )
+    print(json.dumps(result, indent=2, sort_keys=True))
+    return 0
+
+
+_refinement_inputs_all__ = [
+    "GPTQ_CALIBRATION_SCHEMA",
+    "GPTQ_SELECTION_POLICY",
+    "REFINEMENT_PREFILL_INDEX_SCHEMA",
+    "build_refinement_sample_file",
+    "refinement_inputs_main",
+    "prepare_gptq_calibration",
+    "prepare_refinement_prefill_artifacts",
+    "select_document_calibration_windows",
+]
+
+
+def dispatch(argv: Sequence[str] | None = None) -> int:
+    """Route to one of this module's commands."""
+
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    if arguments and arguments[0] in {"launch", "merge"}:
+        return launch_main(arguments)
+    commands = {
+        "prepare": refinement_inputs_main,
+        "run": main,
+    }
+    if not arguments or arguments[0] not in commands:
+        raise SystemExit(
+            "usage: <command> [options]; commands: launch, merge, prepare, run"
+        )
+    return commands[arguments[0]](arguments[1:])
+
+
+if __name__ == "__main__":
+    raise SystemExit(dispatch())
diff --git a/decode_dse/software/refinement_schedule.py b/decode_dse/software/refinement_schedule.py
new file mode 100644
index 0000000..a324e94
--- /dev/null
+++ b/decode_dse/software/refinement_schedule.py
@@ -0,0 +1,1574 @@
+"""Deterministic precision refinement with independent K/V formats."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import math
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+
+from decode_dse.hardware.design_space import (
+    HARDWARE_STORAGE_REVISION,
+    LEGACY_COMPACT_STORAGE_REVISION,
+    load_hardware_artifact,
+)
+from decode_dse.hardware.evaluation import load_terminal_numerical_rows
+from decode_dse.hardware.selection import (
+    EpsilonPolicy,
+    ParetoPoint,
+    select_refinement_sources,
+)
+from decode_dse.legality import StackValidity
+from decode_dse.manifest import load_manifest
+from decode_dse.profiles import (
+    DECODE_FORMATS,
+    MX_BLOCK_SIZE,
+    PROFILE_KIND_BF16_REFERENCE,
+    PROFILE_KIND_QUANTIZED,
+    DecodePrecisionProfile,
+    format_descriptor,
+)
+from decode_dse.software.sweep_plan import (
+    SweepRunPlan,
+    load_immutable_json,
+    make_stage_manifest,
+    validate_run_plan,
+    write_immutable_json,
+)
+
+REFINEMENT_PROFILE_SCHEMA = "decode-refinement-profile"
+REFINEMENT_SCHEDULE_SCHEMA = "decode-refinement-schedule"
+REFINEMENT_SHARD_PLAN_SCHEMA = "decode-refinement-shard-plan"
+REFINEMENT_VALIDITY_SCHEMA = "decode-refinement-validity"
+REFINEMENT_WEIGHT_METHODS = ("rtn", "gptq_erry", "rotation")
+REFINEMENT_EVIDENCE_STATES = ("succeeded", "failed", "oom")
+REFINEMENT_EXECUTION_STATES = (
+    "scheduled",
+    "skipped_doomed",
+    "blocked_evidence",
+)
+_VALIDITY_FIELDS = (
+    "software_valid",
+    "compiler_valid",
+    "emulator_valid",
+    "rtl_valid",
+    "dc_calibrated",
+)
+
+
+def _canonical_json(value: Mapping[str, Any]) -> str:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    )
+
+
+@dataclass(frozen=True)
+class DecodeRefinementProfile:
+    """Precision contract derived from one promoted hardware-validation profile."""
+
+    source_profile: DecodePrecisionProfile
+    key_format: str
+    value_format: str
+    weight_method: str = "gptq_erry"
+    schema_version: str = REFINEMENT_PROFILE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != REFINEMENT_PROFILE_SCHEMA:
+            raise ValueError(f"unsupported refinement schema {self.schema_version!r}")
+        if self.source_profile.kind != PROFILE_KIND_QUANTIZED:
+            raise ValueError("refinement requires a quantized source profile")
+        if self.source_profile.block_size != MX_BLOCK_SIZE:
+            raise ValueError(f"refinement requires block size {MX_BLOCK_SIZE}")
+        if self.key_format not in DECODE_FORMATS:
+            raise ValueError(f"unsupported K refinement format {self.key_format!r}")
+        if self.value_format not in DECODE_FORMATS:
+            raise ValueError(f"unsupported V refinement format {self.value_format!r}")
+        if self.weight_method not in REFINEMENT_WEIGHT_METHODS:
+            raise ValueError(
+                f"unsupported refinement weight method {self.weight_method!r}"
+            )
+
+    @property
+    def weight_format(self) -> str:
+        return self.source_profile.weight_format
+
+    @property
+    def activation_format(self) -> str:
+        return self.source_profile.activation_format
+
+    @property
+    def vector_format(self) -> str:
+        return self.source_profile.vector_format
+
+    @property
+    def block_size(self) -> int:
+        return self.source_profile.block_size
+
+    @property
+    def kind(self) -> str:
+        return self.source_profile.kind
+
+    @property
+    def scale_format(self) -> str:
+        return self.source_profile.scale_format
+
+    @property
+    def scale_bits(self) -> int:
+        return self.source_profile.scale_bits
+
+    @property
+    def accumulator_rule(self) -> str:
+        return self.source_profile.accumulator_rule
+
+    @property
+    def output_rule(self) -> str:
+        return self.source_profile.output_rule
+
+    @property
+    def matrix_semantics(self) -> Any:
+        return self.source_profile.matrix_semantics
+
+    @property
+    def weight_operators(self) -> tuple[str, ...]:
+        return self.source_profile.weight_operators
+
+    @property
+    def activation_operators(self) -> tuple[str, ...]:
+        return self.source_profile.activation_operators
+
+    @property
+    def kv_operators(self) -> tuple[str, ...]:
+        return self.source_profile.kv_operators
+
+    @property
+    def vector_operators(self) -> tuple[str, ...]:
+        return self.source_profile.vector_operators
+
+    @property
+    def bf16_operators(self) -> tuple[str, ...]:
+        return self.source_profile.bf16_operators
+
+    @property
+    def split_kv(self) -> bool:
+        return self.key_format != self.value_format
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "source_profile_id": self.source_profile.profile_id,
+            "source_profile": self.source_profile.to_dict(),
+            "key_format": self.key_format,
+            "value_format": self.value_format,
+            "weight_method": self.weight_method,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DecodeRefinementProfile":
+        source = DecodePrecisionProfile.from_dict(value["source_profile"])
+        if value.get("source_profile_id") != source.profile_id:
+            raise ValueError("refinement source-profile identity mismatch")
+        return cls(
+            source_profile=source,
+            key_format=str(value["key_format"]),
+            value_format=str(value["value_format"]),
+            weight_method=str(value.get("weight_method", "gptq_erry")),
+            schema_version=str(
+                value.get(
+                    "schema_version",
+                    REFINEMENT_PROFILE_SCHEMA,
+                )
+            ),
+        )
+
+    @property
+    def canonical_json(self) -> str:
+        return _canonical_json(self.to_dict())
+
+    @property
+    def canonical_hash(self) -> str:
+        return hashlib.sha256(self.canonical_json.encode("utf-8")).hexdigest()
+
+    @property
+    def profile_id(self) -> str:
+        return f"drp-{self.canonical_hash}"
+
+
+def _adjacent_role_formats(format_id: str) -> tuple[str, ...]:
+    descriptor = format_descriptor(format_id)
+    family_formats = tuple(
+        token
+        for token in DECODE_FORMATS
+        if format_descriptor(token).family == descriptor.family
+    )
+    tiers = sorted({format_descriptor(token).element_bits for token in family_formats})
+    current_bits = descriptor.element_bits
+    lower = max((bits for bits in tiers if bits < current_bits), default=None)
+    upper = min((bits for bits in tiers if bits > current_bits), default=None)
+    selected_bits = {current_bits}
+    if lower is not None:
+        selected_bits.add(lower)
+    if upper is not None:
+        selected_bits.add(upper)
+    return tuple(
+        token
+        for token in family_formats
+        if token != format_id and format_descriptor(token).element_bits in selected_bits
+    )
+
+
+def iter_split_kv_variants(
+    source_profile: DecodePrecisionProfile,
+    *,
+    weight_method: str = "gptq_erry",
+) -> Iterable[DecodeRefinementProfile]:
+    """Yield equal-KV baseline and adjacent-tier directional controls."""
+
+    if source_profile.kind != PROFILE_KIND_QUANTIZED:
+        raise ValueError("only quantized profiles can enter refinement")
+    base = source_profile.kv_format
+    candidates = [(base, base)]
+    for neighbor in _adjacent_role_formats(base):
+        candidates.extend(((base, neighbor), (neighbor, base)))
+    seen: set[tuple[str, str]] = set()
+    for key_format, value_format in candidates:
+        pair = key_format, value_format
+        if pair in seen:
+            continue
+        seen.add(pair)
+        yield DecodeRefinementProfile(
+            source_profile=source_profile,
+            key_format=key_format,
+            value_format=value_format,
+            weight_method=weight_method,
+        )
+
+
+@dataclass(frozen=True)
+class RefinementAccuracyEvidence:
+    """Measured hardware-validation evidence consumed by the doomed gate."""
+
+    source_profile_id: str
+    state: str
+    mean_nll: float | None = None
+    error_class: str | None = None
+    error_message: str | None = None
+
+    def __post_init__(self) -> None:
+        if not self.source_profile_id:
+            raise ValueError("source_profile_id is required")
+        if self.state not in REFINEMENT_EVIDENCE_STATES:
+            raise ValueError(f"unsupported evidence state {self.state!r}")
+        if self.state == "succeeded":
+            if self.mean_nll is None or not math.isfinite(self.mean_nll):
+                raise ValueError("successful evidence requires finite mean_nll")
+            if self.mean_nll < 0:
+                raise ValueError("mean_nll must be non-negative")
+            if self.error_class is not None or self.error_message is not None:
+                raise ValueError("successful evidence cannot carry an error")
+        else:
+            if self.mean_nll is not None:
+                raise ValueError("failed evidence cannot carry a numerical score")
+            if not self.error_class:
+                raise ValueError("failed evidence requires error_class")
+
+    @classmethod
+    def succeeded(
+        cls,
+        profile_id: str,
+        mean_nll: float,
+    ) -> "RefinementAccuracyEvidence":
+        return cls(profile_id, "succeeded", float(mean_nll))
+
+    @classmethod
+    def failed(
+        cls,
+        profile_id: str,
+        *,
+        error_class: str,
+        error_message: str | None = None,
+        oom: bool = False,
+    ) -> "RefinementAccuracyEvidence":
+        return cls(
+            profile_id,
+            "oom" if oom else "failed",
+            error_class=error_class,
+            error_message=error_message,
+        )
+
+
+@dataclass(frozen=True)
+class DoomedGatePolicy:
+    """Conservative perplexity limits for skipping costly refinement."""
+
+    perplexity_ratio: float = 3.0
+    absolute_perplexity: float = 100.0
+
+    def __post_init__(self) -> None:
+        if not math.isfinite(self.perplexity_ratio) or self.perplexity_ratio <= 1.0:
+            raise ValueError("perplexity_ratio must be finite and greater than one")
+        if (
+            not math.isfinite(self.absolute_perplexity)
+            or self.absolute_perplexity <= 1.0
+        ):
+            raise ValueError("absolute_perplexity must be finite and greater than one")
+
+    def to_dict(self) -> dict[str, float]:
+        return {
+            "perplexity_ratio": self.perplexity_ratio,
+            "absolute_perplexity": self.absolute_perplexity,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DoomedGatePolicy":
+        return cls(
+            perplexity_ratio=float(value["perplexity_ratio"]),
+            absolute_perplexity=float(value["absolute_perplexity"]),
+        )
+
+
+@dataclass(frozen=True)
+class DoomedGateDecision:
+    execution_state: str
+    reason: str
+    threshold_mean_nll: float | None
+    observed_mean_nll: float | None
+
+    def __post_init__(self) -> None:
+        if self.execution_state not in REFINEMENT_EXECUTION_STATES:
+            raise ValueError(f"unsupported execution state {self.execution_state!r}")
+
+    @property
+    def executable(self) -> bool:
+        return self.execution_state == "scheduled"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "execution_state": self.execution_state,
+            "executable": self.executable,
+            "reason": self.reason,
+            "threshold_mean_nll": self.threshold_mean_nll,
+            "observed_mean_nll": self.observed_mean_nll,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DoomedGateDecision":
+        decision = cls(
+            execution_state=str(value["execution_state"]),
+            reason=str(value["reason"]),
+            threshold_mean_nll=(
+                None
+                if value.get("threshold_mean_nll") is None
+                else float(value["threshold_mean_nll"])
+            ),
+            observed_mean_nll=(
+                None
+                if value.get("observed_mean_nll") is None
+                else float(value["observed_mean_nll"])
+            ),
+        )
+        if (
+            value.get("executable") is not None
+            and bool(value["executable"]) != decision.executable
+        ):
+            raise ValueError("stored refinement executable flag is inconsistent")
+        return decision
+
+
+def evaluate_doomed_gate(
+    evidence: RefinementAccuracyEvidence | None,
+    *,
+    reference_mean_nll: float,
+    policy: DoomedGatePolicy = DoomedGatePolicy(),
+) -> DoomedGateDecision:
+    """Return an auditable decision without scoring failed evaluations."""
+
+    if not math.isfinite(reference_mean_nll) or reference_mean_nll < 0:
+        raise ValueError("reference_mean_nll must be finite and non-negative")
+    if evidence is None:
+        return DoomedGateDecision(
+            "blocked_evidence",
+            "missing_source_evidence",
+            None,
+            None,
+        )
+    if evidence.state != "succeeded":
+        return DoomedGateDecision(
+            "blocked_evidence",
+            f"source_{evidence.state}:{evidence.error_class}",
+            None,
+            None,
+        )
+    threshold = max(
+        reference_mean_nll + math.log(policy.perplexity_ratio),
+        math.log(policy.absolute_perplexity),
+    )
+    if evidence.mean_nll > threshold:
+        return DoomedGateDecision(
+            "skipped_doomed",
+            "source_accuracy_exceeds_gate",
+            threshold,
+            evidence.mean_nll,
+        )
+    return DoomedGateDecision(
+        "scheduled",
+        "source_accuracy_within_gate",
+        threshold,
+        evidence.mean_nll,
+    )
+
+
+@dataclass(frozen=True)
+class RefinementScheduleEntry:
+    ordinal: int
+    profile: DecodeRefinementProfile
+    gate: DoomedGateDecision
+    validity: StackValidity = StackValidity()
+
+    def __post_init__(self) -> None:
+        if self.ordinal < 0:
+            raise ValueError("refinement ordinals must be non-negative")
+
+    @property
+    def profile_id(self) -> str:
+        return self.profile.profile_id
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "ordinal": self.ordinal,
+            "profile_id": self.profile_id,
+            "profile": self.profile.to_dict(),
+            "gate": self.gate.to_dict(),
+            **self.validity.to_dict(),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementScheduleEntry":
+        profile = DecodeRefinementProfile.from_dict(value["profile"])
+        if value.get("profile_id") != profile.profile_id:
+            raise ValueError("refinement profile identity mismatch")
+        return cls(
+            ordinal=int(value["ordinal"]),
+            profile=profile,
+            gate=DoomedGateDecision.from_dict(value["gate"]),
+            validity=StackValidity.from_dict(value),
+        )
+
+
+@dataclass(frozen=True)
+class RefinementSchedule:
+    entries: tuple[RefinementScheduleEntry, ...]
+    source_profile_ids: tuple[str, ...]
+    reference_mean_nll: float
+    policy: DoomedGatePolicy
+    schema_version: str = REFINEMENT_SCHEDULE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != REFINEMENT_SCHEDULE_SCHEMA:
+            raise ValueError(f"unsupported refinement schedule {self.schema_version!r}")
+        if not math.isfinite(self.reference_mean_nll):
+            raise ValueError("reference_mean_nll must be finite")
+        if tuple(entry.ordinal for entry in self.entries) != tuple(
+            range(len(self.entries))
+        ):
+            raise ValueError("refinement ordinals must be contiguous")
+        profile_ids = tuple(entry.profile_id for entry in self.entries)
+        if len(profile_ids) != len(set(profile_ids)):
+            raise ValueError("refinement schedule contains duplicate profiles")
+        if tuple(sorted(set(self.source_profile_ids))) != self.source_profile_ids:
+            raise ValueError("source_profile_ids must be unique and sorted")
+
+    @property
+    def counts(self) -> dict[str, int]:
+        counts = {state: 0 for state in REFINEMENT_EXECUTION_STATES}
+        for entry in self.entries:
+            counts[entry.gate.execution_state] += 1
+        counts["total"] = len(self.entries)
+        return counts
+
+    def to_dict(self) -> dict[str, Any]:
+        content = {
+            "schema_version": self.schema_version,
+            "source_profile_ids": list(self.source_profile_ids),
+            "reference_mean_nll": self.reference_mean_nll,
+            "policy": self.policy.to_dict(),
+            "counts": self.counts,
+            "entries": [entry.to_dict() for entry in self.entries],
+        }
+        return {
+            **content,
+            "schedule_hash": self._hash_content(content),
+        }
+
+    @staticmethod
+    def _hash_content(content: Mapping[str, Any]) -> str:
+        return hashlib.sha256(_canonical_json(content).encode("utf-8")).hexdigest()
+
+    @property
+    def canonical_hash(self) -> str:
+        return str(self.to_dict()["schedule_hash"])
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementSchedule":
+        schedule = cls(
+            entries=tuple(
+                RefinementScheduleEntry.from_dict(entry) for entry in value["entries"]
+            ),
+            source_profile_ids=tuple(
+                str(profile_id) for profile_id in value["source_profile_ids"]
+            ),
+            reference_mean_nll=float(value["reference_mean_nll"]),
+            policy=DoomedGatePolicy.from_dict(value["policy"]),
+            schema_version=str(value["schema_version"]),
+        )
+        if value.get("counts") != schedule.counts:
+            raise ValueError("refinement schedule count mismatch")
+        if value.get("schedule_hash") != schedule.canonical_hash:
+            raise ValueError("refinement schedule hash mismatch")
+        return schedule
+
+
+@dataclass(frozen=True)
+class RefinementShardPlan:
+    """One source-owned partition of an immutable refinement schedule."""
+
+    master_schedule_hash: str
+    shard_index: int
+    shard_count: int
+    source_profile_id: str
+    profile_ids: tuple[str, ...]
+    schema_version: str = REFINEMENT_SHARD_PLAN_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != REFINEMENT_SHARD_PLAN_SCHEMA:
+            raise ValueError("unsupported refinement shard-plan schema")
+        if len(self.master_schedule_hash) != 64 or any(
+            character not in "0123456789abcdef"
+            for character in self.master_schedule_hash
+        ):
+            raise ValueError("master schedule hash must be a lowercase SHA-256")
+        if self.shard_count != 4:
+            raise ValueError("refinement execution requires exactly four shards")
+        if self.shard_index < 0 or self.shard_index >= self.shard_count:
+            raise ValueError("refinement shard index is out of range")
+        if not self.source_profile_id:
+            raise ValueError("refinement shard source identity is required")
+        if not self.profile_ids or len(self.profile_ids) != len(set(self.profile_ids)):
+            raise ValueError("refinement shard profiles must be non-empty and unique")
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "master_schedule_hash": self.master_schedule_hash,
+            "shard_index": self.shard_index,
+            "shard_count": self.shard_count,
+            "source_profile_id": self.source_profile_id,
+            "profile_ids": list(self.profile_ids),
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return hashlib.sha256(
+            _canonical_json(self._content_dict()).encode("utf-8")
+        ).hexdigest()
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"shard_plan_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementShardPlan":
+        plan = cls(
+            master_schedule_hash=str(value["master_schedule_hash"]),
+            shard_index=int(value["shard_index"]),
+            shard_count=int(value["shard_count"]),
+            source_profile_id=str(value["source_profile_id"]),
+            profile_ids=tuple(str(item) for item in value["profile_ids"]),
+            schema_version=str(value["schema_version"]),
+        )
+        if value.get("shard_plan_hash") != plan.canonical_hash:
+            raise ValueError("refinement shard-plan hash mismatch")
+        return plan
+
+
+def validate_refinement_shard_plan(
+    schedule: RefinementSchedule,
+    plan: RefinementShardPlan,
+) -> tuple[RefinementScheduleEntry, ...]:
+    """Bind a shard plan to its exact master entries and source."""
+
+    if plan.master_schedule_hash != schedule.canonical_hash:
+        raise ValueError("refinement shard plan targets another master schedule")
+    by_id = {entry.profile_id: entry for entry in schedule.entries}
+    if any(profile_id not in by_id for profile_id in plan.profile_ids):
+        raise ValueError("refinement shard plan contains an unknown profile")
+    entries = tuple(by_id[profile_id] for profile_id in plan.profile_ids)
+    if tuple(entry.ordinal for entry in entries) != tuple(
+        sorted(entry.ordinal for entry in entries)
+    ):
+        raise ValueError("refinement shard profiles differ from master order")
+    if any(
+        entry.profile.source_profile.profile_id != plan.source_profile_id
+        for entry in entries
+    ):
+        raise ValueError("refinement shard spans multiple source profiles")
+    expected = tuple(
+        entry.profile_id
+        for entry in schedule.entries
+        if entry.profile.source_profile.profile_id == plan.source_profile_id
+    )
+    if plan.profile_ids != expected:
+        raise ValueError("refinement shard does not cover its complete source")
+    return entries
+
+
+def build_refinement_shard_plans(
+    schedule: RefinementSchedule,
+) -> tuple[RefinementShardPlan, ...]:
+    """Partition four sources into disjoint, deterministic GPU shards."""
+
+    if len(schedule.source_profile_ids) != 4:
+        raise ValueError("refinement sharding requires exactly four source profiles")
+    plans = tuple(
+        RefinementShardPlan(
+            master_schedule_hash=schedule.canonical_hash,
+            shard_index=index,
+            shard_count=4,
+            source_profile_id=source_profile_id,
+            profile_ids=tuple(
+                entry.profile_id
+                for entry in schedule.entries
+                if entry.profile.source_profile.profile_id == source_profile_id
+            ),
+        )
+        for index, source_profile_id in enumerate(schedule.source_profile_ids)
+    )
+    covered = tuple(profile_id for plan in plans for profile_id in plan.profile_ids)
+    expected = tuple(entry.profile_id for entry in schedule.entries)
+    if len(covered) != len(set(covered)) or set(covered) != set(expected):
+        raise AssertionError("refinement shard plans are not a disjoint cover")
+    for plan in plans:
+        validate_refinement_shard_plan(schedule, plan)
+    return plans
+
+
+def write_refinement_shard_plan(
+    path: str | Path,
+    plan: RefinementShardPlan,
+) -> Path:
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    return write_immutable_json(path, plan.to_dict())
+
+
+def load_refinement_shard_plan(path: str | Path) -> RefinementShardPlan:
+    from decode_dse.software.sweep_plan import load_immutable_json
+
+    value = load_immutable_json(path)
+    value.pop("content_hash", None)
+    return RefinementShardPlan.from_dict(value)
+
+
+@dataclass(frozen=True)
+class RefinementValidityRecord:
+    """Measured validity for one exact equal- or split-K/V profile."""
+
+    profile_id: str
+    validity: StackValidity
+    evidence: tuple[tuple[str, str | None], ...]
+
+    def __post_init__(self) -> None:
+        if not self.profile_id.startswith("drp-"):
+            raise ValueError("refinement validity requires a refinement profile ID")
+        evidence = tuple(sorted((str(name), value) for name, value in self.evidence))
+        if tuple(name for name, _ in evidence) != tuple(sorted(_VALIDITY_FIELDS)):
+            raise ValueError("refinement validity evidence fields are incomplete")
+        for name, digest in evidence:
+            observed = getattr(self.validity, name)
+            if observed is None:
+                if digest is not None:
+                    raise ValueError("unmeasured validity cannot cite evidence")
+            elif (
+                not isinstance(digest, str)
+                or len(digest) != 64
+                or any(character not in "0123456789abcdef" for character in digest)
+            ):
+                raise ValueError("measured validity requires a lowercase evidence hash")
+        object.__setattr__(self, "evidence", evidence)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "profile_id": self.profile_id,
+            **self.validity.to_dict(),
+            "evidence": dict(self.evidence),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementValidityRecord":
+        if set(value) != {"profile_id", *_VALIDITY_FIELDS, "evidence"}:
+            raise ValueError("refinement validity record fields differ from schema")
+        evidence = value.get("evidence")
+        if not isinstance(evidence, Mapping):
+            raise TypeError("refinement validity evidence must be a mapping")
+        return cls(
+            profile_id=str(value["profile_id"]),
+            validity=StackValidity.from_dict(value),
+            evidence=tuple((str(name), digest) for name, digest in evidence.items()),
+        )
+
+
+@dataclass(frozen=True)
+class RefinementValidityManifest:
+    """Immutable profile-local validity join for one base schedule."""
+
+    source_schedule_hash: str
+    records: tuple[RefinementValidityRecord, ...]
+    schema_version: str = REFINEMENT_VALIDITY_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != REFINEMENT_VALIDITY_SCHEMA:
+            raise ValueError("unsupported refinement validity schema")
+        if len(self.source_schedule_hash) != 64 or any(
+            character not in "0123456789abcdef"
+            for character in self.source_schedule_hash
+        ):
+            raise ValueError("source schedule hash must be a lowercase SHA-256")
+        profile_ids = tuple(record.profile_id for record in self.records)
+        if len(profile_ids) != len(set(profile_ids)):
+            raise ValueError("refinement validity contains duplicate profiles")
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "source_schedule_hash": self.source_schedule_hash,
+            "records": [record.to_dict() for record in self.records],
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return hashlib.sha256(
+            _canonical_json(self._content_dict()).encode("utf-8")
+        ).hexdigest()
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"validity_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementValidityManifest":
+        manifest = cls(
+            source_schedule_hash=str(value["source_schedule_hash"]),
+            records=tuple(
+                RefinementValidityRecord.from_dict(record)
+                for record in value["records"]
+            ),
+            schema_version=str(value["schema_version"]),
+        )
+        if value.get("validity_hash") != manifest.canonical_hash:
+            raise ValueError("refinement validity identity mismatch")
+        return manifest
+
+
+def attach_refinement_validity(
+    schedule: RefinementSchedule,
+    validity: RefinementValidityManifest,
+) -> RefinementSchedule:
+    """Join only measurements made for each exact refinement profile."""
+
+    if validity.source_schedule_hash != schedule.canonical_hash:
+        raise ValueError("refinement validity was measured for another schedule")
+    expected_ids = tuple(entry.profile_id for entry in schedule.entries)
+    observed_ids = tuple(record.profile_id for record in validity.records)
+    if observed_ids != expected_ids:
+        raise ValueError("refinement validity coverage is missing, extra, or reordered")
+    entries = tuple(
+        RefinementScheduleEntry(
+            ordinal=entry.ordinal,
+            profile=entry.profile,
+            gate=entry.gate,
+            validity=record.validity,
+        )
+        for entry, record in zip(schedule.entries, validity.records)
+    )
+    return RefinementSchedule(
+        entries=entries,
+        source_profile_ids=schedule.source_profile_ids,
+        reference_mean_nll=schedule.reference_mean_nll,
+        policy=schedule.policy,
+    )
+
+
+def write_refinement_validity(
+    path: str | Path,
+    validity: RefinementValidityManifest,
+) -> Path:
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    return write_immutable_json(path, validity.to_dict())
+
+
+def load_refinement_validity(
+    path: str | Path,
+) -> RefinementValidityManifest:
+    from decode_dse.software.sweep_plan import load_immutable_json
+
+    value = load_immutable_json(path)
+    value.pop("content_hash", None)
+    return RefinementValidityManifest.from_dict(value)
+
+
+def build_refinement_schedule(
+    promoted_profiles: Sequence[DecodePrecisionProfile],
+    evidence: Mapping[str, RefinementAccuracyEvidence],
+    *,
+    reference_mean_nll: float,
+    policy: DoomedGatePolicy = DoomedGatePolicy(),
+    weight_method: str = "gptq_erry",
+) -> RefinementSchedule:
+    """Build a stable schedule without expanding the screening manifest."""
+
+    sources = tuple(sorted(promoted_profiles, key=lambda item: item.profile_id))
+    source_ids = tuple(profile.profile_id for profile in sources)
+    if len(source_ids) != len(set(source_ids)):
+        raise ValueError("promoted profiles must be unique")
+    unknown_evidence = sorted(set(evidence) - set(source_ids))
+    if unknown_evidence:
+        raise ValueError(f"evidence contains unpromoted profiles: {unknown_evidence}")
+
+    entries: list[RefinementScheduleEntry] = []
+    seen: set[str] = set()
+    for source in sources:
+        source_evidence = evidence.get(source.profile_id)
+        if (
+            source_evidence is not None
+            and source_evidence.source_profile_id != source.profile_id
+        ):
+            raise ValueError("refinement evidence key/profile mismatch")
+        decision = evaluate_doomed_gate(
+            source_evidence,
+            reference_mean_nll=reference_mean_nll,
+            policy=policy,
+        )
+        for profile in iter_split_kv_variants(
+            source,
+            weight_method=weight_method,
+        ):
+            if profile.profile_id in seen:
+                raise AssertionError("split-KV generation produced a duplicate")
+            seen.add(profile.profile_id)
+            entries.append(
+                RefinementScheduleEntry(
+                    ordinal=len(entries),
+                    profile=profile,
+                    gate=decision,
+                )
+            )
+    return RefinementSchedule(
+        entries=tuple(entries),
+        source_profile_ids=source_ids,
+        reference_mean_nll=reference_mean_nll,
+        policy=policy,
+    )
+
+
+def build_refinement_schedule_from_promotion(
+    promotion: Any,
+    evidence: Mapping[str, RefinementAccuracyEvidence],
+    *,
+    reference_mean_nll: float,
+    policy: DoomedGatePolicy = DoomedGatePolicy(),
+    weight_method: str = "gptq_erry",
+) -> RefinementSchedule:
+    """Build refinement directly from a complete epsilon-Pareto promotion."""
+
+    from decode_dse.hardware.selection import PromotionResult
+
+    if not isinstance(promotion, PromotionResult):
+        raise TypeError("promotion must be a PromotionResult")
+    if not promotion.controls_complete:
+        raise ValueError("refinement requires a complete promotion control set")
+    return build_refinement_schedule(
+        tuple(point.profile for point in promotion.points),
+        evidence,
+        reference_mean_nll=reference_mean_nll,
+        policy=policy,
+        weight_method=weight_method,
+    )
+
+
+def build_selective_rotation_schedule(
+    base_schedule: RefinementSchedule,
+    *,
+    best_supported_profile_ids: Sequence[str],
+    uniform_i8_profile_id: str,
+) -> RefinementSchedule:
+    """Rotate one measured winner per source, including equal-K/V MXINT8."""
+
+    best = tuple(str(profile_id) for profile_id in best_supported_profile_ids)
+    if len(best) != 4 or len(set(best)) != 4:
+        raise ValueError("selective rotation requires four distinct profiles")
+    if uniform_i8_profile_id not in set(best):
+        raise ValueError("the four rotation profiles must include uniform MXINT8")
+    entries_by_id = {entry.profile_id: entry for entry in base_schedule.entries}
+    missing = tuple(
+        profile_id for profile_id in best if profile_id not in entries_by_id
+    )
+    if missing:
+        raise ValueError(f"rotation selection contains unknown profiles: {missing}")
+    selected_by_source: dict[str, RefinementScheduleEntry] = {}
+    for profile_id in best:
+        entry = entries_by_id[profile_id]
+        source_id = entry.profile.source_profile.profile_id
+        if source_id in selected_by_source:
+            raise ValueError("rotation selection contains two profiles from one source")
+        selected_by_source[source_id] = entry
+    if set(selected_by_source) != set(base_schedule.source_profile_ids):
+        raise ValueError("rotation selection must cover every refinement source")
+    requested = tuple(
+        selected_by_source[source_id].profile_id
+        for source_id in base_schedule.source_profile_ids
+    )
+
+    rotated = []
+    for profile_id in requested:
+        source_entry = entries_by_id[profile_id]
+        if not source_entry.gate.executable:
+            raise ValueError("rotation selection contains a gated profile")
+        validity = source_entry.validity
+        if any(
+            value is not True
+            for value in (
+                validity.software_valid,
+                validity.compiler_valid,
+                validity.emulator_valid,
+                validity.rtl_valid,
+            )
+        ):
+            raise ValueError(
+                "rotation selection requires measured software/compiler/emulator/RTL support"
+            )
+        source = source_entry.profile.source_profile
+        if profile_id == uniform_i8_profile_id and (
+            source.weight_format,
+            source.activation_format,
+            source.kv_format,
+            source_entry.profile.key_format,
+            source_entry.profile.value_format,
+        ) != (
+            "MXINT8",
+            "MXINT8",
+            "MXINT8",
+            "MXINT8",
+            "MXINT8",
+        ):
+            raise ValueError("uniform-I8 rotation control has the wrong precision")
+        profile = DecodeRefinementProfile(
+            source_profile=source,
+            key_format=source_entry.profile.key_format,
+            value_format=source_entry.profile.value_format,
+            weight_method="rotation",
+        )
+        rotated.append(
+            RefinementScheduleEntry(
+                ordinal=len(rotated),
+                profile=profile,
+                gate=source_entry.gate,
+                validity=StackValidity(),
+            )
+        )
+    source_ids = tuple(
+        sorted({entry.profile.source_profile.profile_id for entry in rotated})
+    )
+    return RefinementSchedule(
+        entries=tuple(rotated),
+        source_profile_ids=source_ids,
+        reference_mean_nll=base_schedule.reference_mean_nll,
+        policy=base_schedule.policy,
+    )
+
+
+def write_refinement_schedule(
+    path: str | Path,
+    schedule: RefinementSchedule,
+) -> Path:
+    """Atomically create or verify an immutable refinement schedule."""
+
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    return write_immutable_json(path, schedule.to_dict())
+
+
+def load_refinement_schedule(path: str | Path) -> RefinementSchedule:
+    """Load and verify an immutable refinement schedule."""
+
+    from decode_dse.software.sweep_plan import load_immutable_json
+
+    value = load_immutable_json(path)
+    value.pop("content_hash", None)
+    return RefinementSchedule.from_dict(value)
+
+
+def refinement_profile_to_decode_quant_spec(
+    profile: DecodeRefinementProfile,
+) -> Any:
+    """Map one refinement profile to a role-specific MASE runtime binding."""
+
+    from decode_dse.software.precision_bindings import DecodeQuantSpec
+
+    def operand(token: str) -> tuple[str, Any]:
+        descriptor = format_descriptor(token)
+        if descriptor.family == "mxint":
+            return descriptor.family, descriptor.element_bits
+        return descriptor.family, (
+            descriptor.exponent_bits,
+            descriptor.mantissa_bits,
+        )
+
+    weight_family, weight_width = operand(profile.weight_format)
+    activation_family, activation_width = operand(profile.activation_format)
+    key_family, key_width = operand(profile.key_format)
+    value_family, value_width = operand(profile.value_format)
+    return DecodeQuantSpec(
+        attn_w=weight_width,
+        ffn_w=weight_width,
+        kv=key_width,
+        w_fmt=weight_family,
+        kv_fmt=key_family,
+        key_kv=key_width,
+        value_kv=value_width,
+        key_kv_fmt=key_family,
+        value_kv_fmt=value_family,
+        weight_block=profile.block_size,
+        kv_block=profile.block_size,
+        act_w=activation_width,
+        act_fmt=activation_family,
+        act_block=profile.block_size,
+        use_gptq=profile.weight_method == "gptq_erry",
+        use_rotation=profile.weight_method == "rotation",
+        fp_setting=profile.vector_format,
+        fp_setting_attention=True,
+        quant_attn_internals=True,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Schedule construction command
+# ---------------------------------------------------------------------------
+def _canonical_hash(value: Any) -> str:
+    return hashlib.sha256(
+        json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            allow_nan=False,
+        ).encode("utf-8")
+    ).hexdigest()
+
+
+def _file_hash(path: str | Path) -> str:
+    digest = hashlib.sha256()
+    with Path(path).open("rb") as handle:
+        while block := handle.read(1 << 20):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def _load_sharded_stage_rows(
+    paths: Sequence[str | Path],
+    *,
+    manifest: Any,
+    plan: SweepRunPlan,
+    stage: str,
+    profile_ids: Sequence[str],
+) -> tuple[
+    tuple[Mapping[str, Any], ...],
+    dict[str, Any],
+]:
+    from decode_dse.software.sweep import partition_stage_profile_ids
+
+    invocations = []
+    for raw in paths:
+        path = Path(raw)
+        candidates = (
+            tuple(path.rglob("invocation.json"))
+            if path.is_dir()
+            else (path.parent / "invocation.json",)
+        )
+        for candidate in candidates:
+            if candidate.is_file():
+                value = load_immutable_json(candidate)
+                if value.get("stage") == stage:
+                    invocations.append((candidate, value))
+    unique = {str(path.resolve()): (path, value) for path, value in invocations}
+    invocations = tuple(unique[key] for key in sorted(unique))
+    if not invocations:
+        raise ValueError(f"{stage.upper()} result shards lack invocation receipts")
+    shard_counts = {int(value["shard_count"]) for _, value in invocations}
+    if len(shard_counts) != 1:
+        raise ValueError(f"{stage.upper()} shard counts disagree")
+    shard_count = shard_counts.pop()
+    if {int(value["shard_index"]) for _, value in invocations} != set(
+        range(shard_count)
+    ):
+        raise ValueError(f"{stage.upper()} shard receipts are incomplete")
+    rows_by_id = {}
+    manifests = {}
+    for invocation_path, invocation in invocations:
+        if (
+            invocation.get("master_manifest_hash") != manifest.canonical_hash
+            or invocation.get("run_plan_hash") != plan.canonical_hash
+        ):
+            raise ValueError(f"{stage.upper()} invocation identity mismatch")
+        shard_ids = partition_stage_profile_ids(
+            manifest,
+            profile_ids,
+            shard_index=int(invocation["shard_index"]),
+            shard_count=shard_count,
+        )
+        shard_manifest = make_stage_manifest(manifest, shard_ids)
+        if invocation.get("stage_manifest_hash") != shard_manifest.canonical_hash:
+            raise ValueError(f"{stage.upper()} shard manifest mismatch")
+        manifests[shard_manifest.canonical_hash] = shard_manifest
+        rows = load_terminal_numerical_rows(
+            (invocation_path.parent,),
+            shard_manifest,
+            require_complete=True,
+        )
+        for row in rows:
+            profile_id = str(row["profile_id"])
+            if profile_id in rows_by_id:
+                raise ValueError(f"{stage.upper()} contains duplicate profile rows")
+            rows_by_id[profile_id] = row
+    expected = tuple(profile_ids)
+    if set(rows_by_id) != set(expected):
+        raise ValueError(f"{stage.upper()} profile coverage is incomplete")
+    full_manifest = make_stage_manifest(manifest, expected)
+    manifests[full_manifest.canonical_hash] = full_manifest
+    return tuple(rows_by_id[profile_id] for profile_id in expected), manifests
+
+
+def validate_complete_numerical_rows(
+    rows: Sequence[Mapping[str, Any]],
+    *,
+    expected_profile_ids: Sequence[str],
+) -> dict[str, Mapping[str, Any]]:
+    """Reject missing, duplicate, reordered, or unmeasured numerical rows."""
+
+    expected = tuple(expected_profile_ids)
+    observed = tuple(str(row.get("profile_id", "")) for row in rows)
+    if observed != expected or len(observed) != len(set(observed)):
+        raise ValueError("hardware-validation coverage is incomplete or reordered")
+    result = {}
+    for row in rows:
+        state = row.get("state")
+        if state not in {"succeeded", "failed"}:
+            raise ValueError("hardware-validation row is not terminal")
+        validity = row.get("validity")
+        if not isinstance(validity, Mapping):
+            raise ValueError("hardware-validation row lacks measured validity")
+        observed_validity = validity.get("software_valid")
+        if not isinstance(observed_validity, bool):
+            raise ValueError("hardware-validation software validity is unmeasured")
+        if state == "succeeded" and observed_validity is not True:
+            raise ValueError("successful hardware-validation row is not software-valid")
+        result[str(row["profile_id"])] = row
+    return result
+
+
+def _finite_positive(value: Any) -> float:
+    if (
+        isinstance(value, bool)
+        or not isinstance(value, (int, float))
+        or not math.isfinite(value)
+        or value <= 0
+    ):
+        raise ValueError("hardware promotion metric must be finite and positive")
+    return float(value)
+
+
+def _hardware_point(
+    row: Mapping[str, Any],
+    *,
+    profile: Any,
+    mean_nll: float,
+) -> ParetoPoint | None:
+    metrics = row.get("metrics")
+    if not isinstance(metrics, Mapping) or row.get("error_code") is not None:
+        return None
+    whole = metrics.get("whole_model")
+    energy = whole.get("calibrated_energy") if isinstance(whole, Mapping) else None
+    output_head = metrics.get("output_head_boundary")
+    head_estimate = (
+        output_head.get("estimate") if isinstance(output_head, Mapping) else None
+    )
+    capacity = metrics.get("capacity")
+    energy_tier = energy.get("energy_tier") if isinstance(energy, Mapping) else None
+    energy_identity = (
+        energy.get("energy_id") or energy.get("calibration_id")
+        if isinstance(energy, Mapping)
+        else None
+    )
+    timing_tier = whole.get("publication_timing_tier") if isinstance(whole, Mapping) else None
+    if (
+        row.get("deployment_valid") is not True
+        or not isinstance(whole, Mapping)
+        or whole.get("rankable") is not True
+        or timing_tier
+        not in {
+            "compiler_trace_request_calibrated",
+            "stage_calibrated_analytic",
+        }
+        or not isinstance(energy, Mapping)
+        or energy_tier not in {"analytic_anchored", "dc_calibrated"}
+        or not isinstance(energy_identity, str)
+        or not energy_identity
+        or metrics.get("timing_calibrated") is not True
+        or metrics.get("runtime_feasible") is not True
+        or not isinstance(capacity, Mapping)
+        or capacity.get("feasible") is not True
+        or row.get("packedkv_selector_valid") is not True
+        or not isinstance(head_estimate, Mapping)
+    ):
+        return None
+    return ParetoPoint(
+        profile=profile,
+        mean_nll=mean_nll,
+        tpot_ms=_finite_positive(whole.get("tpot_ms")),
+        tps=_finite_positive(whole.get("tps")),
+        energy_per_token_j=_finite_positive(energy.get("total_j")),
+        area_mm2=_finite_positive(metrics.get("area_mm2")),
+        candidate_id=str(row["candidate_id"]),
+        power_calibration_id=energy_identity,
+        cost_scope="whole_model",
+        system_calibration_id=str(whole["system_calibration_id"]),
+        head_service_calibration_id=str(head_estimate["calibration_id"]),
+        whole_model_rankable=True,
+        energy_tier=energy_tier,
+        publication_timing_tier=str(timing_tier),
+    )
+
+
+def _error_evidence(row: Mapping[str, Any]) -> RefinementAccuracyEvidence:
+    if row["state"] == "succeeded":
+        return RefinementAccuracyEvidence.succeeded(
+            str(row["profile_id"]),
+            float(row["result"]["mean_nll"]),
+        )
+    error_class = str(row.get("error_class") or "NumericalEvaluationFailed")
+    return RefinementAccuracyEvidence.failed(
+        str(row["profile_id"]),
+        error_class=error_class,
+        error_message=(
+            None if row.get("error_message") is None else str(row["error_message"])
+        ),
+        oom="outofmemory" in error_class.casefold()
+        or "out of memory" in str(row.get("error_message", "")).casefold(),
+    )
+
+
+def prepare_refinement_schedule(
+    *,
+    manifest_path: str | Path,
+    run_plan_path: str | Path,
+    numerical_screen_paths: Sequence[str | Path],
+    hardware_validation_paths: Sequence[str | Path],
+    hardware_study_paths: Sequence[str | Path],
+    schedule_path: str | Path,
+    promotion_path: str | Path,
+    epsilon: EpsilonPolicy = EpsilonPolicy(),
+    validity_path: str | Path | None = None,
+) -> None:
+    """Build four measured refinement sources from complete upstream results."""
+
+    manifest = load_manifest(manifest_path)
+    plan_value = load_immutable_json(run_plan_path)
+    plan_value.pop("content_hash", None)
+    plan = SweepRunPlan.from_dict(plan_value)
+    validate_run_plan(plan, manifest)
+    hardware_validation_manifest = make_stage_manifest(
+        manifest, plan.hardware_validation_profile_ids
+    )
+    hardware_validation_rows, hardware_validation_manifests = _load_sharded_stage_rows(
+        hardware_validation_paths,
+        manifest=manifest,
+        plan=plan,
+        stage="hardware-validation",
+        profile_ids=plan.hardware_validation_profile_ids,
+    )
+    numerical = validate_complete_numerical_rows(
+        hardware_validation_rows,
+        expected_profile_ids=plan.hardware_validation_profile_ids,
+    )
+    numerical_screen_rows, _ = _load_sharded_stage_rows(
+        numerical_screen_paths,
+        manifest=manifest,
+        plan=plan,
+        stage="numerical-screen",
+        profile_ids=plan.numerical_screen_profile_ids,
+    )
+    reference_rows = [
+        row
+        for entry, row in zip(manifest.entries, numerical_screen_rows)
+        if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+    ]
+    if len(reference_rows) != 1:
+        raise ValueError("numerical screen must contain one BF16 reference")
+    reference = reference_rows[0]
+    if (
+        reference.get("state") != "succeeded"
+        or reference.get("validity", {}).get("software_valid") is not True
+    ):
+        raise ValueError("BF16 reference is incomplete or unmeasured")
+    reference_mean_nll = float(reference["result"]["mean_nll"])
+    if not math.isfinite(reference_mean_nll) or reference_mean_nll < 0:
+        raise ValueError("BF16 reference NLL is invalid")
+
+    hardware_rows = []
+    compact_profiles: dict[str, Mapping[str, Any]] = {}
+    if not hardware_study_paths:
+        raise ValueError("at least one hardware-validation study is required")
+    for hardware_path in hardware_study_paths:
+        header, artifact_rows = load_hardware_artifact(hardware_path)
+        provenance = header.get("provenance", {})
+        if provenance.get("manifest_hash") not in hardware_validation_manifests:
+            raise ValueError(
+                "hardware-validation study was produced for another manifest"
+            )
+        if header.get("storage_revision") in {
+            HARDWARE_STORAGE_REVISION,
+            LEGACY_COMPACT_STORAGE_REVISION,
+        }:
+            aggregates = header.get("profile_aggregates")
+            if not isinstance(aggregates, list):
+                raise ValueError("compact hardware profile aggregates are missing")
+            for aggregate in aggregates:
+                if not isinstance(aggregate, Mapping):
+                    raise TypeError("compact hardware aggregate must be a mapping")
+                profile_id = str(aggregate.get("profile_id", ""))
+                if not profile_id or profile_id in compact_profiles:
+                    raise ValueError(
+                        "compact hardware profile aggregates overlap partitions"
+                    )
+                compact_profiles[profile_id] = aggregate
+        hardware_rows.extend(artifact_rows)
+    by_profile: dict[str, list[Mapping[str, Any]]] = {}
+    for row in hardware_rows:
+        profile_id = str(row["profile_id"])
+        if profile_id not in numerical:
+            raise ValueError("hardware-validation row references an unknown profile")
+        if row.get("profile") != next(
+            entry.profile.to_dict()
+            for entry in hardware_validation_manifest.entries
+            if entry.profile_id == profile_id
+        ):
+            raise ValueError("hardware-validation profile identity mismatch")
+        if row.get("numerical_result_hash") != _canonical_hash(numerical[profile_id]):
+            raise ValueError(
+                "hardware-validation hardware/numerical join hash mismatch"
+            )
+        retention_labels = tuple(row.get("retention_labels", ()))
+        if (
+            retention_labels
+            and retention_labels != ("legacy_full_row",)
+            and "profile_frontier" not in retention_labels
+        ):
+            continue
+        by_profile.setdefault(profile_id, []).append(row)
+
+    entries = {
+        entry.profile_id: entry for entry in hardware_validation_manifest.entries
+    }
+    for profile_id, aggregate in compact_profiles.items():
+        entry = entries.get(profile_id)
+        if (
+            entry is None
+            or aggregate.get("profile") != entry.profile.to_dict()
+            or aggregate.get("numerical_result_hash")
+            != _canonical_hash(numerical[profile_id])
+        ):
+            raise ValueError(
+                "compact hardware aggregate differs from its numerical profile"
+            )
+    points = []
+    evidence = {}
+    for profile_id in plan.hardware_validation_profile_ids:
+        entry = entries[profile_id]
+        row = numerical[profile_id]
+        evidence[profile_id] = _error_evidence(row)
+        if row["state"] != "succeeded":
+            continue
+        mean_nll = float(row["result"]["mean_nll"])
+        hardware_points = tuple(
+            point
+            for candidate in by_profile.get(profile_id, ())
+            if (
+                point := _hardware_point(
+                    candidate,
+                    profile=entry.profile,
+                    mean_nll=mean_nll,
+                )
+            )
+            is not None
+        )
+        aggregate = compact_profiles.get(profile_id)
+        if aggregate is not None:
+            valid_count = int(aggregate.get("valid_count", -1))
+            frontier_count = int(aggregate.get("local_frontier_count", -1))
+            if valid_count < 0 or frontier_count < 0:
+                raise ValueError("compact hardware valid count is invalid")
+            if (
+                (valid_count > 0) != bool(hardware_points)
+                or frontier_count != len(hardware_points)
+            ):
+                raise ValueError(
+                    "compact hardware frontier differs from its profile aggregate"
+                )
+        if entry.legality.hardware_candidate and not hardware_points:
+            raise ValueError(
+                "hardware-validation costs are unmeasured for " f"{profile_id}"
+            )
+        points.extend(
+            hardware_points
+            or (
+                ParetoPoint(
+                    profile=entry.profile,
+                    mean_nll=mean_nll,
+                    tpot_ms=None,
+                    tps=None,
+                    energy_per_token_j=None,
+                    area_mm2=None,
+                ),
+            )
+        )
+    source_selection = select_refinement_sources(
+        points,
+        reference_mean_nll=reference_mean_nll,
+        epsilon=epsilon,
+    )
+    promotion = source_selection.promotion
+    promoted_evidence = {
+        point.profile_id: evidence[point.profile_id] for point in promotion.points
+    }
+    schedule = build_refinement_schedule_from_promotion(
+        promotion,
+        promoted_evidence,
+        reference_mean_nll=reference_mean_nll,
+    )
+    if validity_path is not None:
+        schedule = attach_refinement_validity(
+            schedule,
+            load_refinement_validity(validity_path),
+        )
+    write_refinement_schedule(schedule_path, schedule)
+    write_immutable_json(
+        promotion_path,
+        {
+            "schema_version": "decode-refinement-source-selection",
+            "manifest_hash": manifest.canonical_hash,
+            "run_plan_hash": plan.canonical_hash,
+            "hardware_validation_manifest_hash": (
+                hardware_validation_manifest.canonical_hash
+            ),
+            "numerical_screen_sha256": [
+                _file_hash(path) for path in numerical_screen_paths
+            ],
+            "hardware_validation_sha256": [
+                _file_hash(path) for path in hardware_validation_paths
+            ],
+            "hardware_study_sha256": [
+                _file_hash(path) for path in hardware_study_paths
+            ],
+            "reference_mean_nll": reference_mean_nll,
+            "source_selection": source_selection.to_dict(),
+            "schedule_hash": schedule.canonical_hash,
+        },
+    )
+
+
+def build_schedule_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--manifest", required=True)
+    parser.add_argument("--run-plan", required=True)
+    parser.add_argument(
+        "--numerical-screen-results",
+        dest="numerical_screen_results",
+        action="append",
+        required=True,
+    )
+    parser.add_argument(
+        "--hardware-validation-results",
+        dest="hardware_validation_results",
+        action="append",
+        required=True,
+    )
+    parser.add_argument("--hardware-study", action="append", required=True)
+    parser.add_argument("--validity")
+    parser.add_argument("--schedule", required=True)
+    parser.add_argument("--promotion", required=True)
+    for name in ("mean-nll", "tpot-ms", "tps", "energy-per-token-j", "area-mm2"):
+        parser.add_argument(f"--epsilon-{name}", type=float, default=0.0)
+    return parser
+
+
+def build_schedule_main(argv: Iterable[str] | None = None) -> int:
+    args = build_schedule_parser().parse_args(tuple(argv) if argv is not None else None)
+    prepare_refinement_schedule(
+        manifest_path=args.manifest,
+        run_plan_path=args.run_plan,
+        numerical_screen_paths=args.numerical_screen_results,
+        hardware_validation_paths=args.hardware_validation_results,
+        hardware_study_paths=args.hardware_study,
+        schedule_path=args.schedule,
+        promotion_path=args.promotion,
+        validity_path=args.validity,
+        epsilon=EpsilonPolicy(
+            mean_nll=args.epsilon_mean_nll,
+            tpot_ms=args.epsilon_tpot_ms,
+            tps=args.epsilon_tps,
+            energy_per_token_j=args.epsilon_energy_per_token_j,
+            area_mm2=args.epsilon_area_mm2,
+        ),
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(build_schedule_main())
+
+
+__all__ = [
+    "DecodeRefinementProfile",
+    "DoomedGateDecision",
+    "DoomedGatePolicy",
+    "REFINEMENT_EVIDENCE_STATES",
+    "REFINEMENT_EXECUTION_STATES",
+    "REFINEMENT_PROFILE_SCHEMA",
+    "REFINEMENT_SCHEDULE_SCHEMA",
+    "REFINEMENT_SHARD_PLAN_SCHEMA",
+    "REFINEMENT_VALIDITY_SCHEMA",
+    "RefinementAccuracyEvidence",
+    "RefinementSchedule",
+    "RefinementScheduleEntry",
+    "RefinementShardPlan",
+    "RefinementValidityManifest",
+    "RefinementValidityRecord",
+    "attach_refinement_validity",
+    "build_refinement_schedule_from_promotion",
+    "build_refinement_schedule",
+    "build_refinement_shard_plans",
+    "build_selective_rotation_schedule",
+    "evaluate_doomed_gate",
+    "iter_split_kv_variants",
+    "load_refinement_schedule",
+    "load_refinement_shard_plan",
+    "load_refinement_validity",
+    "refinement_profile_to_decode_quant_spec",
+    "write_refinement_schedule",
+    "write_refinement_shard_plan",
+    "write_refinement_validity",
+    "validate_refinement_shard_plan",
+]
diff --git a/decode_dse/software/runtime_environment.py b/decode_dse/software/runtime_environment.py
new file mode 100644
index 0000000..60f1a67
--- /dev/null
+++ b/decode_dse/software/runtime_environment.py
@@ -0,0 +1,1648 @@
+"""Numerical-runtime identity for sweep artifacts.
+
+GPU kernel selection, TF32 policy, and library versions all change decode
+numerics, so results are only comparable within one recorded stack.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import fcntl
+import importlib.machinery
+import importlib.metadata
+import json
+import math
+import os
+import platform
+import re
+import shutil
+import sys
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from packaging.version import InvalidVersion, Version
+
+from decode_dse.manifest import validate_sweep_config
+from decode_dse.software.sweep_plan import (
+    HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+    build_quantizer_provenance,
+    load_immutable_json,
+    write_immutable_json,
+)
+
+#: Stages that persist an admitted decode cache, in schedule order.
+STAGE_SAMPLE_CONTRACTS = (
+    NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+    HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+)
+
+RUNTIME_ENVIRONMENT_SCHEMA = "decode-runtime-environment"
+LAUNCH_PREFLIGHT_SCHEMA = "decode-launch-preflight"
+#: The decode cache layout every config must declare, parameterised by MLEN.
+_PACKED_CACHE_LAYOUT = re.compile(
+    r"^packed-gqa-mlen(?P<mlen>[0-9]+)-block8-native-encoding$"
+)
+#: Architecture field a config declares for the parameter arithmetic. It is not
+#: matched against the snapshot because the released configs imply it from the
+#: model type rather than stating it.
+_QK_NORM_FIELD = "use_qk_norm"
+#: Architecture fields a config must pin and the cached snapshot must match.
+_ARCHITECTURE_FIELDS = (
+    "hidden_size",
+    "intermediate_size",
+    "num_hidden_layers",
+    "num_attention_heads",
+    "num_key_value_heads",
+    "head_dim",
+    "vocab_size",
+    "tie_word_embeddings",
+    "attention_bias",
+)
+_MIB = 1 << 20
+_GIB = 1 << 30
+_ACTIVATION_LIVE_TENSOR_FACTOR = 4
+_FRAMEWORK_WORKSPACE_HEADROOM_BYTES = 4 * _GIB
+_ADMISSION_PERSISTED_BYTES_PER_ELEMENT = {
+    "MXINT2": 2.0 + 2 / 8 + 1 / 8,
+    "MXINT4": 2.0 + 4 / 8 + 1 / 8,
+    "MXINT8": 2.0 + 8 / 8 + 1 / 8,
+    "E1M2": 2.0 + 4 / 8 + 1 / 8,
+    "E2M1": 2.0 + 4 / 8 + 1 / 8,
+    "E3M4": 2.0 + 8 / 8 + 1 / 8,
+    "E4M3": 2.0 + 8 / 8 + 1 / 8,
+    "E5M2": 2.0 + 8 / 8 + 1 / 8,
+    "BF16": 2.0 + 2.0,
+}
+#: Per-prompt receipt, index, and numerical-view overhead beside the planes.
+_ADMISSION_METADATA_BYTES_PER_PROMPT = 9 * _MIB
+_PREFILL_METADATA_BYTES_PER_PROMPT = 1 * _MIB
+
+
+@dataclass(frozen=True)
+class ArtifactFootprintEstimate:
+    """Logical writes and peak retained bytes for recomputable cache artifacts."""
+
+    prefill_persisted_bytes: int
+    admission_total_logical_bytes: int
+    admission_peak_persisted_bytes: int
+    metadata_bytes: int
+    reserve_bytes: int
+    required_workspace_bytes: int
+    concurrent_kv_formats: int
+    policy: str = "content_addressed_recompute_per_format"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "policy": self.policy,
+            "prefill_persisted_bytes": self.prefill_persisted_bytes,
+            "admission_total_logical_bytes": self.admission_total_logical_bytes,
+            "total_logical_workspace_bytes": (
+                self.prefill_persisted_bytes + self.admission_total_logical_bytes
+            ),
+            "admission_peak_persisted_bytes": self.admission_peak_persisted_bytes,
+            "metadata_bytes": self.metadata_bytes,
+            "reserve_bytes": self.reserve_bytes,
+            "required_workspace_bytes": self.required_workspace_bytes,
+            "concurrent_kv_formats": self.concurrent_kv_formats,
+        }
+
+
+def _parse_compute_capability(token: str) -> tuple[int, int] | None:
+    """Split an `sm_90`/`compute_100` token into (major, minor)."""
+
+    text = str(token).strip().lower()
+    for prefix in ("sm_", "compute_"):
+        if text.startswith(prefix):
+            digits = text[len(prefix) :]
+            if digits.isdigit() and len(digits) >= 2:
+                return int(digits[:-1]), int(digits[-1])
+    return None
+
+
+def _architecture_supported(
+    capability: str,
+    arch_list: Sequence[str],
+) -> bool:
+    """Return whether a build covers a device capability.
+
+    A cubin built for `sm_XY` also runs on `sm_XZ` for Z >= Y, so a device is
+    covered by any listed architecture with the same major version and a minor
+    version no greater than the device's.
+    """
+
+    device = _parse_compute_capability(capability)
+    if device is None:
+        return False
+    for token in arch_list:
+        built = _parse_compute_capability(token)
+        if built is None:
+            continue
+        if built[0] == device[0] and built[1] <= device[1]:
+            return True
+    return False
+
+
+def _canonical_hash(value: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _backend_value(owner: Any, name: str) -> Any:
+    try:
+        value = getattr(owner, name)
+        return value() if callable(value) else value
+    except (AttributeError, RuntimeError):
+        return None
+
+
+@dataclass(frozen=True)
+class RuntimeEnvironment:
+    """Logical numerical stack plus non-identity device observations."""
+
+    logical: Mapping[str, Any]
+    observation: Mapping[str, Any]
+    schema_version: str = RUNTIME_ENVIRONMENT_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != RUNTIME_ENVIRONMENT_SCHEMA:
+            raise ValueError("unsupported runtime-environment schema")
+        if not self.logical or not self.observation:
+            raise ValueError("runtime environment requires logical and observed data")
+
+    @property
+    def logical_fingerprint(self) -> str:
+        return _canonical_hash(dict(self.logical))
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "logical_fingerprint": self.logical_fingerprint,
+            "logical": dict(self.logical),
+            "observation": dict(self.observation),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RuntimeEnvironment":
+        environment = cls(
+            schema_version=str(value["schema_version"]),
+            logical=dict(value["logical"]),
+            observation=dict(value["observation"]),
+        )
+        if value.get("logical_fingerprint") != environment.logical_fingerprint:
+            raise ValueError("runtime-environment fingerprint mismatch")
+        return environment
+
+
+def initialize_numerical_runtime(seed: int) -> None:
+    """Set the deterministic policy before model construction or calibration."""
+
+    if seed < 0:
+        raise ValueError("runtime seed must be non-negative")
+    os.environ["CUBLAS_WORKSPACE_CONFIG"] = ":4096:8"
+    import random
+
+    random.seed(seed)
+    try:
+        import numpy
+    except ImportError:
+        numpy = None
+    if numpy is not None:
+        numpy.random.seed(seed)
+    try:
+        import torch
+    except ImportError as exc:
+        raise RuntimeError("runtime initialization requires torch") from exc
+    torch.manual_seed(seed)
+    if torch.cuda.is_available():
+        torch.cuda.manual_seed_all(seed)
+    torch.use_deterministic_algorithms(True)
+    torch.set_float32_matmul_precision("highest")
+    torch.backends.cudnn.deterministic = True
+    torch.backends.cudnn.benchmark = False
+    torch.backends.cudnn.allow_tf32 = False
+    torch.backends.cuda.matmul.allow_tf32 = False
+    for flag in (
+        "allow_fp16_reduced_precision_reduction",
+        "allow_bf16_reduced_precision_reduction",
+    ):
+        if hasattr(torch.backends.cuda.matmul, flag):
+            setattr(torch.backends.cuda.matmul, flag, False)
+
+
+def capture_runtime_environment(device: str, *, seed: int) -> RuntimeEnvironment:
+    """Capture fields that can change decode numerical results."""
+
+    try:
+        import torch
+    except ImportError as exc:
+        raise RuntimeError("runtime capture requires torch") from exc
+
+    selected = torch.device(device)
+    if selected.type != "cuda":
+        raise ValueError("the publication sweep requires a CUDA device")
+    if not torch.cuda.is_available():
+        raise RuntimeError("CUDA execution requested but CUDA is unavailable")
+    index = selected.index or 0
+    properties = torch.cuda.get_device_properties(index)
+    logical = {
+        "python": sys.version.splitlines()[0],
+        "platform": platform.platform(),
+        "torch": str(torch.__version__),
+        "transformers": importlib.metadata.version("transformers"),
+        "datasets": importlib.metadata.version("datasets"),
+        "numpy": importlib.metadata.version("numpy"),
+        "seed": int(seed),
+        "cuda_runtime": str(torch.version.cuda),
+        "cudnn": str(torch.backends.cudnn.version()),
+        "device_type": "cuda",
+        "device_name": str(properties.name),
+        "compute_capability": f"{properties.major}.{properties.minor}",
+        "float32_matmul_precision": str(torch.get_float32_matmul_precision()),
+        "deterministic_algorithms": bool(torch.are_deterministic_algorithms_enabled()),
+        "cudnn_deterministic": bool(torch.backends.cudnn.deterministic),
+        "cudnn_benchmark": bool(torch.backends.cudnn.benchmark),
+        "cudnn_allow_tf32": _backend_value(torch.backends.cudnn, "allow_tf32"),
+        "cuda_matmul_allow_tf32": _backend_value(
+            torch.backends.cuda.matmul,
+            "allow_tf32",
+        ),
+        "cuda_matmul_allow_fp16_reduced_precision_reduction": _backend_value(
+            torch.backends.cuda.matmul,
+            "allow_fp16_reduced_precision_reduction",
+        ),
+        "cuda_matmul_allow_bf16_reduced_precision_reduction": _backend_value(
+            torch.backends.cuda.matmul,
+            "allow_bf16_reduced_precision_reduction",
+        ),
+        "cublas_workspace_config": os.environ.get("CUBLAS_WORKSPACE_CONFIG"),
+    }
+    observation = {
+        "device_index": index,
+        "device_uuid": str(getattr(properties, "uuid", "unavailable")),
+        "total_memory_bytes": int(properties.total_memory),
+    }
+    return RuntimeEnvironment(logical=logical, observation=observation)
+
+
+def seal_runtime_environment(
+    path: str | Path,
+    environment: RuntimeEnvironment,
+) -> Mapping[str, Any]:
+    """Create or verify one immutable workspace runtime contract."""
+
+    destination = Path(path)
+    write_immutable_json(destination, environment.to_dict())
+    return load_immutable_json(destination)
+
+
+def require_runtime_environment(
+    path: str | Path,
+    current: RuntimeEnvironment,
+) -> RuntimeEnvironment:
+    """Reject execution under a different logical numerical stack."""
+
+    recorded = RuntimeEnvironment.from_dict(load_immutable_json(Path(path)))
+    if recorded.logical_fingerprint != current.logical_fingerprint:
+        raise ValueError("runtime environment differs from the immutable workspace")
+    return recorded
+
+
+@dataclass(frozen=True)
+class GPUObservation:
+    """Capacity and identity observed for one visible CUDA device."""
+
+    index: int
+    name: str
+    total_bytes: int
+    free_bytes: int
+    compute_capability: str | None = None
+    bf16_supported: bool | None = None
+
+
+@dataclass(frozen=True)
+class MutablePathObservation:
+    """Plan-time write, lock, and capacity observation for one mutable root."""
+
+    label: str
+    path: str
+    writable: bool
+    lockable: bool
+    free_bytes: int
+    error: str | None = None
+
+
+@dataclass(frozen=True)
+class LaunchEnvironmentObservation:
+    """Fast, model-load-free observations consumed by the aggregate gate."""
+
+    package_versions: Mapping[str, str | None]
+    cuda_devices: tuple[GPUObservation, ...]
+    host_available_bytes: int | None
+    model_snapshot: str | None
+    model_config: Mapping[str, Any]
+    model_weight_bytes: int | None
+    model_assets_complete: bool
+    model_asset_error: str | None
+    dataset_assets: Mapping[str, str | None]
+    mase_origin: str | None
+    mutable_paths: tuple[MutablePathObservation, ...]
+    collection_errors: tuple[str, ...] = ()
+    #: CUDA architectures the installed torch wheel was built for.
+    torch_arch_list: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True)
+class ModelMemoryEstimate:
+    """Single-device BF16 memory arithmetic for one execution mode."""
+
+    mode: str
+    parameter_count: int
+    weight_bytes: int
+    kv_cache_bytes: int
+    activation_headroom_bytes: int
+    framework_workspace_bytes: int
+    computed_required_bytes: int
+    configured_floor_bytes: int
+    required_bytes: int
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "mode": self.mode,
+            "parameter_count": self.parameter_count,
+            "dtype": "bfloat16",
+            "dtype_bytes": 2,
+            "weight_bytes": self.weight_bytes,
+            "kv_cache_bytes": self.kv_cache_bytes,
+            "activation_headroom_bytes": self.activation_headroom_bytes,
+            "framework_workspace_bytes": self.framework_workspace_bytes,
+            "computed_required_bytes": self.computed_required_bytes,
+            "configured_floor_bytes": self.configured_floor_bytes,
+            "required_bytes": self.required_bytes,
+            "required_mib": self.required_bytes / _MIB,
+        }
+
+
+@dataclass(frozen=True)
+class LaunchPreflightCheck:
+    """One independently evaluated launch prerequisite."""
+
+    code: str
+    passed: bool
+    requirement: str
+    observed: str
+    resolution: str
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "code": self.code,
+            "passed": self.passed,
+            "requirement": self.requirement,
+            "observed": self.observed,
+            "resolution": self.resolution,
+        }
+
+
+class LaunchPreflightError(RuntimeError):
+    """Raised after every launch prerequisite has been evaluated."""
+
+
+@dataclass(frozen=True)
+class LaunchPreflightReport:
+    """Aggregate report that never hides later failures behind an earlier one."""
+
+    checks: tuple[LaunchPreflightCheck, ...]
+    memory_estimates: tuple[ModelMemoryEstimate, ...]
+    artifact_footprint: ArtifactFootprintEstimate | None = None
+    schema_version: str = LAUNCH_PREFLIGHT_SCHEMA
+
+    @property
+    def passed(self) -> bool:
+        return all(check.passed for check in self.checks)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "passed": self.passed,
+            "checks": [check.to_dict() for check in self.checks],
+            "memory_estimates": [
+                estimate.to_dict() for estimate in self.memory_estimates
+            ],
+            "artifact_footprint": (
+                self.artifact_footprint.to_dict()
+                if self.artifact_footprint is not None
+                else None
+            ),
+        }
+
+    def require_passed(self) -> None:
+        failures = tuple(check for check in self.checks if not check.passed)
+        if failures:
+            lines = [f"launch preflight found {len(failures)} unmet prerequisites:"]
+            for index, failure in enumerate(failures, start=1):
+                lines.extend(
+                    (
+                        f"{index}. [{failure.code}] {failure.requirement}",
+                        f"   observed: {failure.observed}",
+                        f"   action: {failure.resolution}",
+                    )
+                )
+            raise LaunchPreflightError("\n".join(lines))
+
+
+def dense_decoder_parameter_count(model_config: Mapping[str, Any]) -> int:
+    """Compute parameters for a dense GQA decoder from its pinned architecture.
+
+    Covers the Llama and Qwen3 dense families. Qwen3 adds RMSNorm over the
+    per-head query and key projections, which Llama does not have; the term is
+    included only when the snapshot declares it.
+    """
+
+    required = (
+        "hidden_size",
+        "intermediate_size",
+        "num_hidden_layers",
+        "num_attention_heads",
+        "num_key_value_heads",
+        "vocab_size",
+    )
+    missing = [name for name in required if name not in model_config]
+    if missing:
+        raise ValueError(
+            "pinned model config lacks architecture dimensions: " + ", ".join(missing)
+        )
+    hidden = int(model_config["hidden_size"])
+    intermediate = int(model_config["intermediate_size"])
+    layers = int(model_config["num_hidden_layers"])
+    attention_heads = int(model_config["num_attention_heads"])
+    kv_heads = int(model_config["num_key_value_heads"])
+    vocab = int(model_config["vocab_size"])
+    head_dim = int(model_config.get("head_dim") or hidden // attention_heads)
+    tied = bool(model_config.get("tie_word_embeddings", False))
+    biased = bool(model_config.get("attention_bias", False))
+
+    query_dim = attention_heads * head_dim
+    kv_dim = kv_heads * head_dim
+    attention = hidden * query_dim + 2 * hidden * kv_dim + query_dim * hidden
+    if biased:
+        attention += query_dim + 2 * kv_dim + hidden
+    feed_forward = 3 * hidden * intermediate
+    # Input and post-attention RMSNorm; Qwen3 adds q_norm and k_norm.
+    layer_norms = 2 * hidden
+    if _has_qk_norm(model_config):
+        layer_norms += 2 * head_dim
+
+    embedding = vocab * hidden
+    output_head = 0 if tied else embedding
+    final_norm = hidden
+    return (
+        embedding
+        + output_head
+        + layers * (attention + feed_forward + layer_norms)
+        + final_norm
+    )
+
+
+def _has_qk_norm(model_config: Mapping[str, Any]) -> bool:
+    """Return whether the snapshot declares per-head query/key normalization."""
+
+    if "use_qk_norm" in model_config:
+        return bool(model_config["use_qk_norm"])
+    architectures = model_config.get("architectures") or ()
+    model_type = str(model_config.get("model_type", ""))
+    return model_type.startswith("qwen3") or any(
+        str(name).lower().startswith("qwen3") for name in architectures
+    )
+
+
+def _architecture_view(model_config: Mapping[str, Any]) -> dict[str, Any]:
+    """Return explicit architecture values, deriving standard head width."""
+
+    result = {field: model_config.get(field) for field in _ARCHITECTURE_FIELDS}
+    if result["head_dim"] is None:
+        hidden = result["hidden_size"]
+        heads = result["num_attention_heads"]
+        if (
+            isinstance(hidden, int)
+            and not isinstance(hidden, bool)
+            and isinstance(heads, int)
+            and not isinstance(heads, bool)
+            and heads > 0
+            and hidden % heads == 0
+        ):
+            result["head_dim"] = hidden // heads
+    return result
+
+
+def _memory_estimate(
+    *,
+    mode: str,
+    model_config: Mapping[str, Any],
+    parameter_count: int,
+    weight_bytes: int,
+    batch_size: int,
+    sequence_length: int,
+    configured_floor_mib: int,
+) -> ModelMemoryEstimate:
+    layers = int(model_config["num_hidden_layers"])
+    kv_heads = int(model_config["num_key_value_heads"])
+    head_dim = int(model_config["head_dim"])
+    hidden = int(model_config["hidden_size"])
+    kv_cache_bytes = batch_size * sequence_length * layers * 2 * kv_heads * head_dim * 2
+    # Hidden state, residual, normalization, and attention staging live set.
+    activation_headroom_bytes = (
+        batch_size * sequence_length * hidden * 2 * _ACTIVATION_LIVE_TENSOR_FACTOR
+    )
+    framework_workspace_bytes = _FRAMEWORK_WORKSPACE_HEADROOM_BYTES
+    computed = (
+        weight_bytes
+        + kv_cache_bytes
+        + activation_headroom_bytes
+        + framework_workspace_bytes
+    )
+    configured_floor = configured_floor_mib * _MIB
+    return ModelMemoryEstimate(
+        mode=mode,
+        parameter_count=parameter_count,
+        weight_bytes=weight_bytes,
+        kv_cache_bytes=kv_cache_bytes,
+        activation_headroom_bytes=activation_headroom_bytes,
+        framework_workspace_bytes=framework_workspace_bytes,
+        computed_required_bytes=computed,
+        configured_floor_bytes=configured_floor,
+        required_bytes=max(computed, configured_floor),
+    )
+
+
+def _nearest_existing_directory(path: Path) -> Path:
+    candidate = path.resolve()
+    while not candidate.exists() and candidate != candidate.parent:
+        candidate = candidate.parent
+    if not candidate.is_dir():
+        raise OSError(f"no existing parent directory for {path}")
+    return candidate
+
+
+def _stable_probe_error(error: BaseException) -> str:
+    """Describe a path-probe failure without a random temporary filename."""
+
+    if isinstance(error, OSError) and error.errno is not None:
+        reason = error.strerror or os.strerror(error.errno)
+        return f"{type(error).__name__}: errno={error.errno} ({reason})"
+    return type(error).__name__
+
+
+def _observe_mutable_path(label: str, path: Path) -> MutablePathObservation:
+    temporary_name: str | None = None
+    descriptor: int | None = None
+    try:
+        parent = _nearest_existing_directory(path)
+        free_bytes = int(shutil.disk_usage(parent).free)
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=parent,
+            prefix=".plena-launch-probe-",
+            delete=False,
+        ) as temporary:
+            temporary_name = temporary.name
+        descriptor = os.open(temporary_name, os.O_RDWR)
+        fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        fcntl.flock(descriptor, fcntl.LOCK_UN)
+        os.close(descriptor)
+        descriptor = None
+        os.unlink(temporary_name)
+        temporary_name = None
+        return MutablePathObservation(
+            label=label,
+            path=str(path),
+            writable=True,
+            lockable=True,
+            free_bytes=free_bytes,
+        )
+    except Exception as error:
+        if descriptor is not None:
+            os.close(descriptor)
+        if temporary_name is not None:
+            try:
+                os.unlink(temporary_name)
+            except OSError:
+                pass
+        try:
+            free_bytes = int(shutil.disk_usage(_nearest_existing_directory(path)).free)
+        except OSError:
+            free_bytes = 0
+        return MutablePathObservation(
+            label=label,
+            path=str(path),
+            writable=False,
+            lockable=False,
+            free_bytes=free_bytes,
+            error=_stable_probe_error(error),
+        )
+
+
+def _resolve_workspace_path(value: str, repository: Path, workspace: Path) -> Path:
+    if value.startswith("workspace://"):
+        suffix = value.removeprefix("workspace://")
+        relative = Path(suffix)
+        if not suffix or relative.is_absolute() or ".." in relative.parts:
+            raise ValueError(f"invalid workspace-bound path: {value!r}")
+        result = (workspace / relative).resolve()
+        result.relative_to(workspace.resolve())
+        return result
+    path = Path(value)
+    return path.resolve() if path.is_absolute() else (repository / path).resolve()
+
+
+def _model_snapshot_path(config: Mapping[str, Any]) -> Path:
+    cache = Path(str(config["hf_cache_dir"])).resolve()
+    repo_name = "models--" + str(config["model_name"]).replace("/", "--")
+    return cache / repo_name / "snapshots" / str(config["model_revision"])
+
+
+def _observe_model_assets(
+    config: Mapping[str, Any],
+) -> tuple[str | None, Mapping[str, Any], int | None, bool, str | None]:
+    snapshot: Path | None = None
+    model_config: Mapping[str, Any] = {}
+    weight_bytes: int | None = None
+    try:
+        snapshot = _model_snapshot_path(config)
+        tokenizer_snapshot = snapshot.parent / str(config["tokenizer_revision"])
+        model_config_path = snapshot / "config.json"
+        index_path = snapshot / "model.safetensors.index.json"
+        tokenizer_paths = (
+            tokenizer_snapshot / "tokenizer.json",
+            tokenizer_snapshot / "tokenizer_config.json",
+        )
+        if not snapshot.is_dir() or not model_config_path.is_file():
+            raise FileNotFoundError(f"pinned model snapshot is absent: {snapshot}")
+        loaded_config = json.loads(model_config_path.read_text(encoding="utf-8"))
+        if not isinstance(loaded_config, Mapping):
+            raise ValueError("pinned model config is not a JSON object")
+        model_config = loaded_config
+        if not index_path.is_file():
+            raise FileNotFoundError(f"model shard index is absent: {index_path}")
+        index = json.loads(index_path.read_text(encoding="utf-8"))
+        shard_names = tuple(sorted(set(index.get("weight_map", {}).values())))
+        missing_shards = tuple(
+            name for name in shard_names if not (snapshot / name).is_file()
+        )
+        if not shard_names or missing_shards:
+            raise FileNotFoundError(
+                "pinned model shards are absent: "
+                + ", ".join(str(snapshot / name) for name in missing_shards)
+            )
+        weight_bytes = int(index.get("metadata", {}).get("total_size", 0))
+        if weight_bytes <= 0:
+            raise ValueError("model shard index lacks total_size")
+        missing_tokenizer = tuple(
+            path for path in tokenizer_paths if not path.is_file()
+        )
+        if missing_tokenizer:
+            raise FileNotFoundError(
+                "pinned tokenizer assets are incomplete: "
+                + ", ".join(str(path) for path in missing_tokenizer)
+            )
+        return str(snapshot), model_config, weight_bytes, True, None
+    except Exception as error:
+        return (
+            str(snapshot) if snapshot is not None and snapshot.is_dir() else None,
+            model_config,
+            weight_bytes,
+            False,
+            f"{type(error).__name__}: {error}",
+        )
+
+
+def _dataset_asset(
+    data: Mapping[str, Any],
+) -> str | None:
+    try:
+        cache = Path(str(data["cache_dir"])).resolve()
+        dataset_dir = cache / str(data["dataset_name"]).replace("/", "___")
+        config_dir = dataset_dir / str(data["dataset_config"])
+        revision = str(data["dataset_revision"])
+        matches = tuple(
+            path
+            for path in config_dir.rglob(revision)
+            if path.is_dir() and (path / "dataset_info.json").is_file()
+        )
+        split = str(data["split"])
+        matches = tuple(path for path in matches if any(path.glob(f"*-{split}.arrow")))
+        return str(matches[0]) if len(matches) == 1 else None
+    except (KeyError, OSError):
+        return None
+
+
+def collect_launch_environment(
+    config: Mapping[str, Any],
+    *,
+    repository_root: Path,
+    workspace_root: Path,
+) -> LaunchEnvironmentObservation:
+    """Collect all inexpensive launch observations without loading the model."""
+
+    repository = repository_root.resolve()
+    workspace = workspace_root.resolve()
+    errors: list[str] = []
+    packages: dict[str, str | None] = {}
+    for package in (
+        "torch",
+        "transformers",
+        "datasets",
+        "numpy",
+        "nvidia-ml-py",
+    ):
+        try:
+            packages[package] = importlib.metadata.version(package)
+        except importlib.metadata.PackageNotFoundError:
+            packages[package] = None
+
+    devices: list[GPUObservation] = []
+    arch_list: tuple[str, ...] = ()
+    try:
+        import torch
+
+        arch_list = tuple(str(arch) for arch in torch.cuda.get_arch_list())
+        if not arch_list:
+            compiled_arches = _backend_value(torch._C, "_cuda_getArchFlags")
+            if isinstance(compiled_arches, str):
+                arch_list = tuple(compiled_arches.split())
+        if torch.cuda.is_available():
+            for index in range(torch.cuda.device_count()):
+                properties = torch.cuda.get_device_properties(index)
+                free, total = torch.cuda.mem_get_info(index)
+                devices.append(
+                    GPUObservation(
+                        index=index,
+                        name=str(properties.name),
+                        total_bytes=int(total),
+                        free_bytes=int(free),
+                        compute_capability=(f"sm_{properties.major}{properties.minor}"),
+                        bf16_supported=bool(properties.major >= 8),
+                    )
+                )
+    except Exception as error:
+        errors.append(f"CUDA observation: {type(error).__name__}: {error}")
+
+    try:
+        meminfo = Path("/proc/meminfo").read_text(encoding="utf-8")
+        available_line = next(
+            line for line in meminfo.splitlines() if line.startswith("MemAvailable:")
+        )
+        host_available = int(available_line.split()[1]) * 1024
+    except Exception as error:
+        host_available = None
+        errors.append(f"host memory observation: {type(error).__name__}: {error}")
+
+    snapshot, model_config, weight_bytes, complete, model_error = _observe_model_assets(
+        config
+    )
+    datasets: dict[str, str | None] = {}
+    evaluation = config.get("evaluation_data")
+    if isinstance(evaluation, Mapping):
+        datasets["evaluation"] = _dataset_asset(evaluation)
+    else:
+        datasets["evaluation"] = None
+    refinement = config.get("refinement")
+    calibration = (
+        refinement.get("calibration_data") if isinstance(refinement, Mapping) else None
+    )
+    if isinstance(calibration, Mapping):
+        datasets["refinement_calibration"] = _dataset_asset(calibration)
+    else:
+        datasets["refinement_calibration"] = None
+
+    mase_origin: str | None = None
+    executor = config.get("executor")
+    if isinstance(executor, Mapping) and executor.get("mase_src"):
+        mase_root = Path(str(executor["mase_src"]))
+        if not mase_root.is_absolute():
+            mase_root = repository / mase_root
+        mase_root = mase_root.resolve()
+        try:
+            loaded = sys.modules.get("chop")
+            spec = (
+                getattr(loaded, "__spec__", None)
+                if loaded is not None
+                else importlib.machinery.PathFinder.find_spec("chop", [str(mase_root)])
+            )
+            if spec is not None and spec.origin is not None:
+                mase_origin = str(Path(spec.origin).resolve())
+        except (ImportError, OSError) as error:
+            errors.append(f"MASE observation: {type(error).__name__}: {error}")
+
+    path_values: list[tuple[str, Path]] = [("workspace", workspace)]
+    if isinstance(executor, Mapping):
+        for key in (
+            "prefill_artifact_root",
+            "admission_artifact_root",
+        ):
+            value = executor.get(key)
+            if isinstance(value, str):
+                try:
+                    path_values.append(
+                        (key, _resolve_workspace_path(value, repository, workspace))
+                    )
+                except (OSError, ValueError) as error:
+                    errors.append(f"{key}: {type(error).__name__}: {error}")
+    scratch = config.get("scratch_dir")
+    if isinstance(scratch, str):
+        try:
+            path_values.append(
+                ("scratch_dir", _resolve_workspace_path(scratch, repository, workspace))
+            )
+        except (OSError, ValueError) as error:
+            errors.append(f"scratch_dir: {type(error).__name__}: {error}")
+    if isinstance(refinement, Mapping):
+        for key in (
+            "prefill_artifact_root",
+            "admission_artifact_root",
+            "checkpoint_root",
+        ):
+            value = refinement.get(key)
+            if isinstance(value, str):
+                try:
+                    path_values.append(
+                        (
+                            f"refinement.{key}",
+                            _resolve_workspace_path(value, repository, workspace),
+                        )
+                    )
+                except (OSError, ValueError) as error:
+                    errors.append(f"refinement.{key}: {type(error).__name__}: {error}")
+    observations = tuple(
+        _observe_mutable_path(label, path) for label, path in path_values
+    )
+    return LaunchEnvironmentObservation(
+        package_versions=packages,
+        cuda_devices=tuple(devices),
+        host_available_bytes=host_available,
+        model_snapshot=snapshot,
+        model_config=model_config,
+        model_weight_bytes=weight_bytes,
+        model_assets_complete=complete,
+        model_asset_error=model_error,
+        dataset_assets=datasets,
+        mase_origin=mase_origin,
+        mutable_paths=observations,
+        collection_errors=tuple(errors),
+        torch_arch_list=arch_list,
+    )
+
+
+def _append_check(
+    checks: list[LaunchPreflightCheck],
+    *,
+    code: str,
+    passed: bool,
+    requirement: str,
+    observed: str,
+    resolution: str,
+) -> None:
+    checks.append(
+        LaunchPreflightCheck(
+            code=code,
+            passed=bool(passed),
+            requirement=requirement,
+            observed=observed,
+            resolution=resolution,
+        )
+    )
+
+
+def _finite_float(value: Any, default: float = float("nan")) -> float:
+    try:
+        result = float(value)
+    except (TypeError, ValueError, OverflowError):
+        return default
+    return result if math.isfinite(result) else default
+
+
+def _integer(value: Any, default: int = -1) -> int:
+    if isinstance(value, bool):
+        return default
+    try:
+        return int(value)
+    except (TypeError, ValueError, OverflowError):
+        return default
+
+
+def _version_at_least(observed: str | None, required: str) -> bool:
+    """Compare package versions while accepting local build suffixes."""
+
+    if observed is None:
+        return False
+    try:
+        return Version(observed) >= Version(required)
+    except InvalidVersion:
+        return False
+
+
+def _projected_admission_bytes(model_config: Mapping[str, Any]) -> int:
+    """Return total logical admission bytes written across all cache formats."""
+
+    layers = int(model_config["num_hidden_layers"])
+    kv_heads = int(model_config["num_key_value_heads"])
+    hidden = int(model_config["hidden_size"])
+    attention_heads = int(model_config["num_attention_heads"])
+    head_dim = int(model_config.get("head_dim") or hidden // attention_heads)
+    bytes_per_element = sum(_ADMISSION_PERSISTED_BYTES_PER_ELEMENT.values())
+    total = 0
+    for contract in STAGE_SAMPLE_CONTRACTS:
+        elements = layers * 2 * kv_heads * contract.prefill_tokens * head_dim
+        total += math.ceil(contract.prompt_count * elements * bytes_per_element)
+        total += contract.prompt_count * _ADMISSION_METADATA_BYTES_PER_PROMPT
+    return total
+
+
+def estimate_artifact_footprint(
+    config: Mapping[str, Any],
+    model_config: Mapping[str, Any],
+    *,
+    concurrent_workers: int | None = None,
+) -> ArtifactFootprintEstimate:
+    """Derive workspace demand from model geometry and artifact policy."""
+
+    executor = config.get("executor")
+    if not isinstance(executor, Mapping):
+        raise ValueError("config.executor is required")
+    policy = str(
+        executor.get(
+            "artifact_policy",
+            "content_addressed_recompute_per_format",
+        )
+    )
+    if policy != "content_addressed_recompute_per_format":
+        raise ValueError("unsupported executor.artifact_policy")
+    workers = (
+        _integer(config.get("max_parallel_points", 1), 1)
+        if concurrent_workers is None
+        else int(concurrent_workers)
+    )
+    if workers <= 0:
+        raise ValueError("concurrent workers must be positive")
+
+    layers = int(model_config["num_hidden_layers"])
+    kv_heads = int(model_config["num_key_value_heads"])
+    hidden = int(model_config["hidden_size"])
+    attention_heads = int(model_config["num_attention_heads"])
+    head_dim = int(model_config.get("head_dim") or hidden // attention_heads)
+    total_elements = 0
+    total_prompts = 0
+    for contract in STAGE_SAMPLE_CONTRACTS:
+        total_elements += (
+            contract.prompt_count
+            * layers
+            * 2
+            * kv_heads
+            * contract.prefill_tokens
+            * head_dim
+        )
+        total_prompts += contract.prompt_count
+    prefill_metadata = total_prompts * _PREFILL_METADATA_BYTES_PER_PROMPT
+    prefill_bytes = 2 * total_elements + prefill_metadata
+    format_bytes = sorted(
+        (
+            math.ceil(total_elements * bytes_per_element)
+            + total_prompts * _ADMISSION_METADATA_BYTES_PER_PROMPT
+        )
+        for bytes_per_element in _ADMISSION_PERSISTED_BYTES_PER_ELEMENT.values()
+    )
+    concurrent_formats = min(workers, len(format_bytes))
+    peak_admission = sum(format_bytes[-concurrent_formats:])
+    total_admission = sum(format_bytes)
+    reserve = int(
+        max(
+            0.0,
+            _finite_float(executor.get("artifact_space_reserve_gib", 8.0), 8.0),
+        )
+        * _GIB
+    )
+    safety = _finite_float(executor.get("artifact_space_safety_factor", 1.05), 1.05)
+    if safety < 1.0:
+        raise ValueError("artifact_space_safety_factor must be at least one")
+    configured_floor = int(
+        max(
+            0.0,
+            _finite_float(executor.get("min_free_artifact_gib", 0.0), 0.0),
+        )
+        * _GIB
+    )
+    required = max(
+        math.ceil((prefill_bytes + peak_admission) * safety) + reserve,
+        configured_floor,
+    )
+    return ArtifactFootprintEstimate(
+        prefill_persisted_bytes=prefill_bytes,
+        admission_total_logical_bytes=total_admission,
+        admission_peak_persisted_bytes=peak_admission,
+        metadata_bytes=(
+            prefill_metadata
+            + total_prompts
+            * len(_ADMISSION_PERSISTED_BYTES_PER_ELEMENT)
+            * _ADMISSION_METADATA_BYTES_PER_PROMPT
+        ),
+        reserve_bytes=reserve,
+        required_workspace_bytes=required,
+        concurrent_kv_formats=concurrent_formats,
+    )
+
+
+def evaluate_launch_preflight(
+    config: Mapping[str, Any],
+    observation: LaunchEnvironmentObservation,
+    *,
+    repository_root: Path,
+    device_labels: Sequence[str],
+) -> LaunchPreflightReport:
+    """Evaluate all prerequisites and retain every failure in one report."""
+
+    checks: list[LaunchPreflightCheck] = []
+    try:
+        validate_sweep_config(config)
+        config_error = None
+    except Exception as error:
+        config_error = str(error)
+    executor = config.get("executor")
+    refinement = config.get("refinement")
+    placement = config.get("model_placement")
+    runtime_requirements = config.get("runtime_requirements")
+    executor_map = executor if isinstance(executor, Mapping) else {}
+    refinement_map = refinement if isinstance(refinement, Mapping) else {}
+    placement_map = placement if isinstance(placement, Mapping) else {}
+    requirements_map = (
+        runtime_requirements if isinstance(runtime_requirements, Mapping) else {}
+    )
+    placement_valid = (
+        placement_map.get("policy") == "single_device"
+        and _integer(placement_map.get("device_count", -1)) == 1
+        and placement_map.get("automatic_device_map") is False
+    )
+    policy_requirements = (
+        bool(str(config.get("model_name", "")).strip()),
+        str(config.get("dtype", "")).lower() == "bfloat16",
+        str(config.get("device", "")).startswith("cuda"),
+        config.get("local_files_only") is True,
+        config.get("trust_remote_code") is False,
+        bool(_PACKED_CACHE_LAYOUT.fullmatch(str(executor_map.get("layout_id", "")))),
+        executor_map.get("serialize_weight_bank_builds") is True,
+        executor_map.get("artifact_policy") == "content_addressed_recompute_per_format",
+        str(config.get("scratch_dir", "")).startswith("workspace://"),
+        _finite_float(executor_map.get("min_free_artifact_gib", 0)) >= 0.0,
+        _finite_float(executor_map.get("artifact_space_safety_factor", -1)) >= 1.0,
+        _finite_float(executor_map.get("artifact_space_reserve_gib", -1)) >= 0.0,
+        _finite_float(executor_map.get("min_available_host_gib", 0)) >= 0.0,
+        _finite_float(executor_map.get("max_cpu_cache_gib", 0)) > 0.0,
+        _integer(config.get("gpu_min_free_mb", -1)) >= 0,
+        _integer(refinement_map.get("gpu_min_free_mb", -1)) >= 0,
+        _finite_float(refinement_map.get("max_cpu_cache_gib", 0)) > 0.0,
+        placement_valid,
+        bool(requirements_map),
+    )
+    _append_check(
+        checks,
+        code="configuration",
+        passed=config_error is None and all(policy_requirements),
+        requirement=(
+            "a named BF16, local-only, native PackedKV decode contract; "
+            "workspace scratch; serialized bank builds; positive CPU caches; "
+            "non-negative artifact/host/GPU floors; safety factor >=1; and an "
+            "explicit single-device placement with automatic mapping disabled"
+        ),
+        observed=config_error or "configuration fields inspected",
+        resolution="restore the publication configuration",
+    )
+
+    missing_packages = tuple(
+        name
+        for name, version in observation.package_versions.items()
+        if version is None
+    )
+    _append_check(
+        checks,
+        code="packages",
+        passed=not missing_packages,
+        requirement=(
+            "torch, transformers, datasets, numpy, and nvidia-ml-py installed"
+        ),
+        observed=json.dumps(dict(observation.package_versions), sort_keys=True),
+        resolution="enter the PLENA_Software environment containing every runtime package",
+    )
+    minimum_versions = requirements_map.get("minimum_package_versions")
+    version_requirements = (
+        dict(minimum_versions) if isinstance(minimum_versions, Mapping) else {}
+    )
+    version_failures = {
+        str(name): {
+            "required": str(required),
+            "observed": observation.package_versions.get(str(name)),
+        }
+        for name, required in sorted(version_requirements.items())
+        if not _version_at_least(
+            observation.package_versions.get(str(name)),
+            str(required),
+        )
+    }
+    _append_check(
+        checks,
+        code="package_versions",
+        passed=bool(version_requirements) and not version_failures,
+        requirement=("runtime packages meet the model's declared minimum versions"),
+        observed=json.dumps(
+            {
+                "minimum": version_requirements,
+                "installed": dict(observation.package_versions),
+            },
+            sort_keys=True,
+        ),
+        resolution=(
+            "install package versions satisfying runtime_requirements; "
+            f"failures={json.dumps(version_failures, sort_keys=True)}"
+        ),
+    )
+
+    _append_check(
+        checks,
+        code="model_assets",
+        passed=observation.model_assets_complete,
+        requirement=(
+            "the exact pinned model, tokenizer, shard index, and every shard "
+            "cached locally"
+        ),
+        observed=(
+            str(observation.model_snapshot)
+            if observation.model_assets_complete
+            else str(observation.model_asset_error)
+        ),
+        resolution="populate the configured Hugging Face cache at the pinned revision",
+    )
+
+    declared_architecture = config.get("model_architecture")
+    architecture_declared = isinstance(declared_architecture, Mapping) and all(
+        field in declared_architecture for field in _ARCHITECTURE_FIELDS
+    )
+    expected_architecture: Mapping[str, Any] = (
+        {field: declared_architecture[field] for field in _ARCHITECTURE_FIELDS}
+        if architecture_declared
+        else {}
+    )
+    observed_architecture = _architecture_view(observation.model_config)
+    architecture_ok = (
+        architecture_declared
+        and all(
+            observed_architecture.get(key) == value
+            for key, value in expected_architecture.items()
+        )
+        and str(observation.model_config.get("torch_dtype", "")).lower()
+        in {"bfloat16", "torch.bfloat16"}
+    )
+    model_name = str(config.get("model_name", "the configured model"))
+    _append_check(
+        checks,
+        code="model_architecture",
+        passed=architecture_ok,
+        requirement=(
+            f"the cached revision must match the architecture {model_name} pins "
+            f"in model_architecture ({', '.join(_ARCHITECTURE_FIELDS)})"
+        ),
+        observed=(
+            json.dumps(
+                {key: observed_architecture.get(key) for key in _ARCHITECTURE_FIELDS},
+                sort_keys=True,
+            )
+            if architecture_declared
+            else "config does not pin model_architecture"
+        ),
+        resolution=(
+            "pin model_architecture in the config and use the matching snapshot; "
+            "do not substitute another size"
+        ),
+    )
+    # Resource arithmetic is declarative: the snapshot is checked for identity,
+    # while every required dimension comes from the pinned configuration.
+    arithmetic_config: dict[str, Any] = dict(observation.model_config)
+    arithmetic_config.update(expected_architecture)
+    arithmetic_config.setdefault("torch_dtype", "bfloat16")
+    if isinstance(declared_architecture, Mapping) and (
+        _QK_NORM_FIELD in declared_architecture
+    ):
+        arithmetic_config[_QK_NORM_FIELD] = bool(declared_architecture[_QK_NORM_FIELD])
+
+    for label in ("evaluation", "refinement_calibration"):
+        asset = observation.dataset_assets.get(label)
+        _append_check(
+            checks,
+            code=f"dataset_{label}",
+            passed=asset is not None,
+            requirement=(
+                f"the exact pinned {label.replace('_', ' ')} dataset revision "
+                "and split cached locally"
+            ),
+            observed=asset or "no matching revision/split cache found",
+            resolution="materialize the configured dataset revision in its configured cache",
+        )
+
+    configured_mase = Path(str(executor_map.get("mase_src", "")))
+    if not configured_mase.is_absolute():
+        configured_mase = repository_root.resolve() / configured_mase
+    expected_mase = (configured_mase.resolve() / "chop" / "__init__.py").resolve()
+    _append_check(
+        checks,
+        code="mase_origin",
+        passed=(
+            observation.mase_origin is not None
+            and Path(observation.mase_origin).resolve() == expected_mase
+        ),
+        requirement="chop must resolve from the configured sibling mase/src tree",
+        observed=observation.mase_origin or "chop did not resolve",
+        resolution="correct executor.mase_src and remove conflicting imports",
+    )
+    try:
+        provenance = build_quantizer_provenance(repository_root, config)
+        provenance_observed = (
+            f"{len(provenance.sources)} files, {provenance.canonical_hash}"
+        )
+        provenance_ok = True
+    except Exception as error:
+        provenance_observed = f"{type(error).__name__}: {error}"
+        provenance_ok = False
+    _append_check(
+        checks,
+        code="quantizer_sources",
+        passed=provenance_ok,
+        requirement=(
+            "all MASE, Simulator, RTL, and Software arithmetic sources "
+            "resolvable and hashable"
+        ),
+        observed=provenance_observed,
+        resolution="restore every configured arithmetic source tree and decode import origin",
+    )
+
+    visible = observation.cuda_devices
+    _append_check(
+        checks,
+        code="cuda",
+        passed=bool(visible),
+        requirement="CUDA available with visible devices",
+        observed=(
+            ", ".join(
+                f"{gpu.index}:{gpu.name} free={gpu.free_bytes / _MIB:.0f} MiB "
+                f"total={gpu.total_bytes / _MIB:.0f} MiB"
+                for gpu in visible
+            )
+            or "no CUDA device is visible"
+        ),
+        resolution="run on the intended CUDA host before creating the immutable plan",
+    )
+    required_arches = tuple(
+        sorted({gpu.compute_capability for gpu in visible if gpu.compute_capability})
+    )
+    unsupported = tuple(
+        arch
+        for arch in required_arches
+        if not _architecture_supported(arch, observation.torch_arch_list)
+    )
+    _append_check(
+        checks,
+        code="cuda_architecture",
+        passed=(
+            bool(observation.torch_arch_list)
+            and bool(required_arches)
+            and not unsupported
+        ),
+        requirement=(
+            "the installed torch wheel must contain kernels for every device "
+            "compute capability"
+        ),
+        observed=(
+            f"devices={required_arches or '(none reported)'}; "
+            f"torch_arch_list={observation.torch_arch_list or '(unavailable)'}"
+        ),
+        resolution=(
+            "install a torch build whose CUDA architecture list covers the "
+            "execution host, for example a cu128 wheel for sm_100"
+        ),
+    )
+    required_capability = str(requirements_map.get("compute_capability", ""))
+    capability_matches = bool(required_capability) and all(
+        gpu.compute_capability == required_capability for gpu in visible
+    )
+    _append_check(
+        checks,
+        code="target_compute_capability",
+        passed=capability_matches,
+        requirement=(
+            f"every execution GPU must be {required_capability or 'declared'}"
+        ),
+        observed=str(tuple(gpu.compute_capability for gpu in visible)),
+        resolution="run preflight on hardware matching the declared capability",
+    )
+    bf16_ready = bool(visible) and all(gpu.bf16_supported is True for gpu in visible)
+    _append_check(
+        checks,
+        code="bf16",
+        passed=bf16_ready,
+        requirement="native BF16 support on every execution GPU",
+        observed=str(tuple(gpu.bf16_supported for gpu in visible)),
+        resolution="run on GPUs with native BF16 support",
+    )
+    names = tuple(gpu.name.lower() for gpu in visible)
+    bad_labels = tuple(
+        label
+        for label in device_labels
+        if label.lower() == "cpu" or not any(label.lower() in name for name in names)
+    )
+    _append_check(
+        checks,
+        code="device_labels",
+        passed=bool(device_labels) and not bad_labels,
+        requirement="each plan device label is a GPU-name substring, never a CUDA ordinal",
+        observed=(
+            f"labels={tuple(device_labels)!r}; visible_names={tuple(gpu.name for gpu in visible)!r}"
+        ),
+        resolution="use a stable part-name substring such as 'a6000', not 'cuda:0'",
+    )
+
+    try:
+        parameter_count = dense_decoder_parameter_count(arithmetic_config)
+        parameter_count_error: str | None = None
+    except Exception as error:
+        parameter_count = 0
+        parameter_count_error = f"{type(error).__name__}: {error}"
+    expected_weight_bytes = parameter_count * 2
+    observed_weight_bytes = observation.model_weight_bytes
+    weight_bytes = expected_weight_bytes
+    weight_identity_ok = (
+        parameter_count > 0
+        and observed_weight_bytes is not None
+        and observed_weight_bytes == expected_weight_bytes
+    )
+    _append_check(
+        checks,
+        code="model_weight_size",
+        passed=weight_identity_ok,
+        requirement=f"parameter_count x BF16 bytes = {expected_weight_bytes:,} bytes",
+        observed=(
+            parameter_count_error
+            or f"parameters={parameter_count:,}; "
+            f"shard_index_total={observed_weight_bytes!r} bytes"
+        ),
+        resolution="use the exact pinned BF16 shard set",
+    )
+    microbatches = executor_map.get("decode_microbatch_size", {})
+    numerical_batch = max(
+        1,
+        _integer(
+            (
+                microbatches.get("numerical_screen", 16)
+                if isinstance(microbatches, Mapping)
+                else 16
+            ),
+            16,
+        ),
+    )
+    hardware_batch = max(
+        1,
+        _integer(
+            (
+                microbatches.get("hardware_validation", 8)
+                if isinstance(microbatches, Mapping)
+                else 8
+            ),
+            8,
+        ),
+    )
+    try:
+        estimates = (
+            _memory_estimate(
+                mode="numerical-screen",
+                model_config=arithmetic_config,
+                parameter_count=parameter_count,
+                weight_bytes=weight_bytes,
+                batch_size=numerical_batch,
+                sequence_length=512 + 16,
+                configured_floor_mib=_integer(config.get("gpu_min_free_mb", 0), 0),
+            ),
+            _memory_estimate(
+                mode="hardware-validation",
+                model_config=arithmetic_config,
+                parameter_count=parameter_count,
+                weight_bytes=weight_bytes,
+                batch_size=hardware_batch,
+                sequence_length=512 + 32,
+                configured_floor_mib=_integer(config.get("gpu_min_free_mb", 0), 0),
+            ),
+            _memory_estimate(
+                mode="refinement",
+                model_config=arithmetic_config,
+                parameter_count=parameter_count,
+                weight_bytes=weight_bytes,
+                batch_size=max(
+                    1,
+                    _integer(refinement_map.get("calibration_batch_size", 8), 8),
+                ),
+                sequence_length=max(
+                    1,
+                    _integer(
+                        refinement_map.get("calibration_sequence_length", 2048),
+                        2048,
+                    ),
+                ),
+                configured_floor_mib=_integer(
+                    refinement_map.get("gpu_min_free_mb", 0), 0
+                ),
+            ),
+        )
+    except Exception:
+        estimates = ()
+    capacity_options = (
+        "use a larger single GPU with at least the reported total/free capacity to "
+        "preserve semantics, or explicitly redesign _load_model for multi-device "
+        "sharding; multi-device placement changes timing and runtime identity and "
+        "requires a new hashed protocol. Automatic device_map remains disabled"
+    )
+    for estimate in estimates:
+        matching = tuple(
+            gpu
+            for gpu in visible
+            if any(label.lower() in gpu.name.lower() for label in device_labels)
+        )
+        qualifying = tuple(
+            gpu
+            for gpu in matching
+            if gpu.total_bytes >= estimate.required_bytes
+            and gpu.free_bytes >= estimate.required_bytes
+        )
+        needed_count = (
+            max(1, _integer(config.get("max_parallel_points", 1), 1))
+            if estimate.mode == "refinement"
+            else 1
+        )
+        observed_capacity = (
+            ", ".join(
+                f"{gpu.name}: free {gpu.free_bytes / _MIB:.0f} MiB, "
+                f"total {gpu.total_bytes / _MIB:.0f} MiB"
+                for gpu in matching
+            )
+            or "no matching visible GPU"
+        )
+        # A shortfall in device *count* with sufficient per-device capacity is a
+        # scheduling choice, not a hardware limit, and has a different remedy.
+        count_limited = (
+            len(qualifying) < needed_count
+            and len(qualifying) == len(matching)
+            and bool(matching)
+        )
+        resolution = (
+            (
+                f"{needed_count} concurrent workers were requested but only "
+                f"{len(qualifying)} qualifying device(s) are available; set "
+                f"max_parallel_points to at most {len(qualifying)} or run on a "
+                "host with more devices of this size"
+            )
+            if count_limited
+            else capacity_options
+        )
+        _append_check(
+            checks,
+            code=f"gpu_memory_{estimate.mode.replace('-', '_')}",
+            passed=len(qualifying) >= needed_count,
+            requirement=(
+                f"{needed_count} matching single-device GPU(s), each with at least "
+                f"{estimate.required_bytes / _MIB:.0f} MiB total and free; arithmetic: "
+                f"weights {estimate.weight_bytes / _MIB:.2f} + KV "
+                f"{estimate.kv_cache_bytes / _MIB:.2f} + activation headroom "
+                f"{estimate.activation_headroom_bytes / _MIB:.2f} + framework/workspace "
+                f"{estimate.framework_workspace_bytes / _MIB:.2f} MiB, with configured "
+                f"floor {estimate.configured_floor_bytes / _MIB:.0f} MiB"
+            ),
+            observed=observed_capacity,
+            resolution=resolution,
+        )
+
+    host_gib = _finite_float(executor_map.get("min_available_host_gib", 0), 0.0)
+    host_floor = int(max(0.0, host_gib) * _GIB)
+    # Loading materializes one BF16 copy of the weights in host memory before
+    # the transfer to device, alongside the configured CPU cache per worker.
+    host_cache = int(
+        max(0.0, _finite_float(executor_map.get("max_cpu_cache_gib", 0), 0.0)) * _GIB
+    )
+    host_workers = max(1, _integer(config.get("max_parallel_points", 1), 1))
+    host_computed = weight_bytes + host_workers * host_cache
+    host_required = max(host_computed, host_floor)
+    host_observed = observation.host_available_bytes
+    _append_check(
+        checks,
+        code="host_memory",
+        passed=host_observed is not None and host_observed >= host_required,
+        requirement=(
+            f"at least {host_required / _GIB:.1f} GiB MemAvailable; arithmetic: "
+            f"BF16 weights {weight_bytes / _GIB:.2f} + {host_workers} x CPU cache "
+            f"{host_cache / _GIB:.2f} GiB, with configured floor "
+            f"{host_floor / _GIB:.1f} GiB"
+        ),
+        observed=(
+            f"{host_observed / _GIB:.2f} GiB"
+            if host_observed is not None
+            else "unavailable"
+        ),
+        resolution="run on a host meeting the computed available-memory requirement",
+    )
+
+    try:
+        footprint = estimate_artifact_footprint(config, arithmetic_config)
+        disk_required = footprint.required_workspace_bytes
+    except Exception:
+        footprint = None
+        disk_required = 0
+    for path_observation in observation.mutable_paths:
+        _append_check(
+            checks,
+            code=f"path_{path_observation.label.replace('.', '_')}",
+            passed=(
+                path_observation.writable
+                and path_observation.lockable
+                and path_observation.free_bytes >= disk_required
+            ),
+            requirement=(
+                f"{path_observation.label} writable and flock-capable with at least "
+                f"{disk_required / _GIB:.2f} GiB free for retained BF16 prefill, "
+                "concurrency-bounded admitted caches, metadata, and reserve"
+            ),
+            observed=(
+                f"path={path_observation.path}; writable={path_observation.writable}; "
+                f"lockable={path_observation.lockable}; "
+                f"free={path_observation.free_bytes / _GIB:.2f} GiB; "
+                f"error={path_observation.error}"
+            ),
+            resolution="select a workspace filesystem satisfying the immutable artifact policy",
+        )
+    for index, error in enumerate(observation.collection_errors):
+        _append_check(
+            checks,
+            code=f"observation_{index + 1}",
+            passed=False,
+            requirement="every environment observation must complete",
+            observed=error,
+            resolution="repair the reported host or path observation failure",
+        )
+    return LaunchPreflightReport(
+        checks=tuple(checks),
+        memory_estimates=estimates,
+        artifact_footprint=footprint,
+    )
+
+
+def run_launch_preflight(
+    config: Mapping[str, Any],
+    *,
+    repository_root: Path,
+    workspace_root: Path,
+    device_labels: Sequence[str],
+    observation: LaunchEnvironmentObservation | None = None,
+) -> LaunchPreflightReport:
+    """Collect and evaluate the complete plan-to-run launch contract."""
+
+    current = observation or collect_launch_environment(
+        config,
+        repository_root=repository_root,
+        workspace_root=workspace_root,
+    )
+    return evaluate_launch_preflight(
+        config,
+        current,
+        repository_root=repository_root,
+        device_labels=device_labels,
+    )
+
+
+__all__ = [
+    "GPUObservation",
+    "LAUNCH_PREFLIGHT_SCHEMA",
+    "LaunchEnvironmentObservation",
+    "LaunchPreflightCheck",
+    "LaunchPreflightError",
+    "LaunchPreflightReport",
+    "ModelMemoryEstimate",
+    "MutablePathObservation",
+    "RUNTIME_ENVIRONMENT_SCHEMA",
+    "RuntimeEnvironment",
+    "capture_runtime_environment",
+    "initialize_numerical_runtime",
+    "collect_launch_environment",
+    "evaluate_launch_preflight",
+    "estimate_artifact_footprint",
+    "require_runtime_environment",
+    "seal_runtime_environment",
+    "run_launch_preflight",
+]
diff --git a/decode_dse/software/seal_chat_template_asset.py b/decode_dse/software/seal_chat_template_asset.py
new file mode 100644
index 0000000..8f64309
--- /dev/null
+++ b/decode_dse/software/seal_chat_template_asset.py
@@ -0,0 +1,128 @@
+"""Seal a pinned publication chat-template asset from the local tokenizer.
+
+Extracts the chat template from the locally cached tokenizer snapshot at the
+config's pinned revision (no network access), writes the versioned asset file
+next to the sweep configs, and pins ``publication.chat_template_asset`` and
+``publication.chat_template_sha256`` in the config so every later pipeline
+run validates against the sealed asset instead of re-executing the tokenizer.
+
+The tokenizer files must already exist in the pinned local snapshot. For a
+gated repository, fetch them once with an authenticated download, e.g.:
+
+    hf download meta-llama/Llama-3.1-8B-Instruct \
+        "tokenizer*" "special_tokens_map.json" \
+        --revision <model_revision> --cache-dir /data/models
+
+Then seal:
+
+    python -m decode_dse.software.seal_chat_template_asset \
+        --config decode_dse/configs/llama3_1_8b.json \
+        --asset decode_dse/configs/publication_chat_template_llama3_1_8b.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import copy
+import json
+import re
+from pathlib import Path
+
+from decode_dse.software.benchmark_runner import (
+    PUBLICATION_CHAT_TEMPLATE_SCHEMA,
+    seal_publication_chat_template,
+)
+
+_ASSET_FIELDS = (
+    "schema_version",
+    "model_name",
+    "model_revision",
+    "tokenizer_revision",
+    "enable_thinking",
+    "chat_template_sha256",
+    "chat_template",
+)
+
+
+def _repo_relative(path: Path, repository: Path) -> str:
+    return path.resolve().relative_to(repository.resolve()).as_posix()
+
+
+def _pin_config_fields(
+    config_path: Path, *, asset_reference: str, template_sha256: str
+) -> None:
+    """Set the two publication pin fields with minimal formatting churn."""
+
+    text = config_path.read_text(encoding="utf-8")
+    for key, value in (
+        ("chat_template_asset", asset_reference),
+        ("chat_template_sha256", template_sha256),
+    ):
+        pattern = re.compile(rf'("({key})":\s*)"[^"]*"')
+        replacement = rf'\g<1>"{value}"'
+        if pattern.search(text):
+            text = pattern.sub(replacement, text, count=1)
+        else:
+            anchor = '"publication": {'
+            if anchor not in text:
+                raise SystemExit(
+                    f"{config_path} has no publication object to pin"
+                )
+            text = text.replace(
+                anchor,
+                f'{anchor}\n    "{key}": "{value}",',
+                1,
+            )
+    config_path.write_text(text, encoding="utf-8")
+    reloaded = json.loads(config_path.read_text(encoding="utf-8"))
+    publication = reloaded["publication"]
+    if (
+        publication.get("chat_template_asset") != asset_reference
+        or publication.get("chat_template_sha256") != template_sha256
+    ):
+        raise SystemExit(f"failed to pin the chat template in {config_path}")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", required=True, type=Path)
+    parser.add_argument("--asset", required=True, type=Path)
+    args = parser.parse_args()
+
+    config_path = args.config.resolve()
+    config = json.loads(config_path.read_text(encoding="utf-8"))
+    extraction_config = copy.deepcopy(config)
+    publication = extraction_config.get("publication")
+    if not isinstance(publication, dict):
+        raise SystemExit("config.publication is required")
+    publication.pop("chat_template_asset", None)
+    publication.pop("chat_template_sha256", None)
+
+    sealed = seal_publication_chat_template(
+        extraction_config, config_path=config_path
+    )
+    if sealed["schema_version"] != PUBLICATION_CHAT_TEMPLATE_SCHEMA:
+        raise SystemExit("sealed chat template has an unexpected schema")
+    asset = {field: sealed[field] for field in _ASSET_FIELDS}
+
+    asset_path = args.asset.resolve()
+    asset_path.parent.mkdir(parents=True, exist_ok=True)
+    asset_path.write_text(
+        json.dumps(asset, indent=1, sort_keys=True) + "\n", encoding="utf-8"
+    )
+
+    repository = Path(__file__).resolve().parents[2]
+    asset_reference = _repo_relative(asset_path, repository)
+    _pin_config_fields(
+        config_path,
+        asset_reference=asset_reference,
+        template_sha256=str(sealed["chat_template_sha256"]),
+    )
+    print(f"asset: {asset_path}")
+    print(f"chat_template_sha256: {sealed['chat_template_sha256']}")
+    print(f"pinned in: {config_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/decode_dse/software/spotcheck_full_model_trace.py b/decode_dse/software/spotcheck_full_model_trace.py
new file mode 100644
index 0000000..d2f989a
--- /dev/null
+++ b/decode_dse/software/spotcheck_full_model_trace.py
@@ -0,0 +1,245 @@
+"""Cross-tier timing spot-check for the published decode configurations.
+
+Prices each selected (profile, candidate) pair twice — once from full-model
+compiler traces and once from the stage-calibrated analytic model — over a
+sampled context axis, and writes a labelled comparison artifact. The scope is
+decoder-step timing only: the BF16 output head is excluded identically on
+both sides, so the delta isolates the timing source.
+
+The compiler-trace pass raises the request-memory interpreter's runaway
+guard (a resource valve, not a correctness gate) for the duration of this
+process only; nothing on disk changes.
+"""
+
+from __future__ import annotations
+
+import argparse
+import functools
+import json
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from decode_dse.hardware.design_space import (
+    COMPILER_TRACE_EXECUTION_MODE,
+    COMPILER_TRACE_TIMING_TIER,
+    ExactHardwareSpace,
+    LEGACY_AGGREGATE_BANDWIDTH_MODE,
+    STAGE_CALIBRATED_ANALYTIC_TIMING_TIER,
+)
+from decode_dse.hardware.evaluation import (
+    DecodeSimulatorBackend,
+    HardwareWorkload,
+)
+from decode_dse.manifest import load_manifest
+from decode_dse.software.sweep_plan import write_immutable_json
+
+SPOTCHECK_SCHEMA = "decode-compiler-trace-spotcheck"
+DEFAULT_DYNAMIC_INSTRUCTION_LIMIT = 2_000_000_000
+
+
+def _raise_dynamic_instruction_limit(limit: int) -> None:
+    import compiler.aten.plena.compiler as plena_compiler
+
+    original = plena_compiler.build_request_memory_trace
+    if isinstance(original, functools.partial):
+        original = original.func
+    plena_compiler.build_request_memory_trace = functools.partial(
+        original,
+        max_dynamic_instructions=limit,
+    )
+
+
+def _parse_pairs(values: Sequence[str]) -> tuple[tuple[str, str], ...]:
+    pairs = []
+    for value in values:
+        profile_id, _, candidate_id = value.partition(":")
+        if not profile_id or not candidate_id:
+            raise ValueError("pairs must use PROFILE_ID:CANDIDATE_ID")
+        pairs.append((profile_id, candidate_id))
+    if not pairs:
+        raise ValueError("at least one spot-check pair is required")
+    return tuple(pairs)
+
+
+def _candidate_index(
+    space: ExactHardwareSpace,
+    hidden_size: int,
+    wanted: set[str],
+) -> dict[str, Any]:
+    found: dict[str, Any] = {}
+    for candidate in space.iter_candidates(hidden_size):
+        if candidate.candidate_id in wanted:
+            found[candidate.candidate_id] = candidate
+            if len(found) == len(wanted):
+                break
+    missing = wanted - set(found)
+    if missing:
+        raise ValueError(
+            "candidates absent from the exact hardware space: "
+            + ", ".join(sorted(missing))
+        )
+    return found
+
+
+def run_spotcheck(
+    *,
+    config: Mapping[str, Any],
+    workspace: Path,
+    pairs: Sequence[tuple[str, str]],
+    stride: int,
+    dynamic_instruction_limit: int,
+    output: Path,
+) -> Mapping[str, Any]:
+    manifest = load_manifest(workspace / "manifest.json")
+    entries = {entry.profile_id: entry for entry in manifest.entries}
+    reference = config["reference_workload"]
+    resources = config["publication_pipeline"]["resources"]
+    workload = HardwareWorkload(
+        input_seq=int(reference["input_seq"]),
+        output_seq=int(reference["output_seq"]),
+        stride=int(stride),
+        runtime_hbm_reserve_bytes=int(resources["runtime_hbm_reserve_bytes"]),
+    )
+    architecture = config["model_architecture"]
+    space = ExactHardwareSpace.from_study_config(config)
+    candidates = _candidate_index(
+        space,
+        int(architecture["hidden_size"]),
+        {candidate_id for _, candidate_id in pairs},
+    )
+
+    timing_evidence = workspace / "external" / "decode_timing_evidence.json"
+    trace_artifacts = workspace / "external" / "compiler_trace_artifacts.json"
+    _raise_dynamic_instruction_limit(dynamic_instruction_limit)
+    backend_common = {
+        "model": str(config["sim_model"]),
+        "model_lib": config.get("model_lib"),
+        "settings_toml": None,
+        "isa_path": None,
+        "timing_evidence": timing_evidence,
+    }
+    trace_backend = DecodeSimulatorBackend(
+        calibrated_bandwidth=False,
+        execution_mode=COMPILER_TRACE_EXECUTION_MODE,
+        compiler_trace_artifacts=trace_artifacts,
+        **backend_common,
+    )
+    analytic_backend = DecodeSimulatorBackend(
+        calibrated_bandwidth=True,
+        execution_mode=LEGACY_AGGREGATE_BANDWIDTH_MODE,
+        **backend_common,
+    )
+
+    rows = []
+    for profile_id, candidate_id in pairs:
+        entry = entries.get(profile_id)
+        if entry is None:
+            raise ValueError(f"profile {profile_id} is not in the manifest")
+        candidate = candidates[candidate_id]
+        trace = trace_backend.evaluate(entry, candidate, workload)
+        analytic = analytic_backend.evaluate(entry, candidate, workload)
+        if not (trace.timing_calibrated and analytic.timing_calibrated):
+            raise ValueError(
+                f"spot-check pair {profile_id}:{candidate_id} is not "
+                "calibrated on both timing sources"
+            )
+        rows.append(
+            {
+                "profile_id": profile_id,
+                "candidate_id": candidate_id,
+                "batch": int(candidate.batch),
+                "compiler_trace": {
+                    "publication_timing_tier": COMPILER_TRACE_TIMING_TIER,
+                    "tpot_ms": trace.tpot_ms,
+                    "tps": trace.tps,
+                    "timing_evidence_id": trace.timing_evidence_id,
+                },
+                "stage_calibrated_analytic": {
+                    "publication_timing_tier": (
+                        STAGE_CALIBRATED_ANALYTIC_TIMING_TIER
+                    ),
+                    "tpot_ms": analytic.tpot_ms,
+                    "tps": analytic.tps,
+                    "timing_evidence_id": analytic.timing_evidence_id,
+                    "bandwidth_calibration_id": (
+                        analytic.bandwidth_calibration_id
+                    ),
+                },
+                "tpot_relative_delta": (
+                    (trace.tpot_ms - analytic.tpot_ms) / analytic.tpot_ms
+                ),
+            }
+        )
+
+    sampled_contexts = len(
+        range(
+            workload.input_seq,
+            workload.input_seq + workload.output_seq,
+            workload.stride,
+        )
+    )
+    body = {
+        "schema_version": SPOTCHECK_SCHEMA,
+        "scope": "decoder_step_timing_only_output_head_excluded_both_sides",
+        "model_name": manifest.model_name,
+        "model_revision": manifest.model_revision,
+        "manifest_hash": manifest.canonical_hash,
+        "context_stride": workload.stride,
+        "sampled_contexts_per_pair": sampled_contexts,
+        "dynamic_instruction_limit": dynamic_instruction_limit,
+        "compiler_trace_artifact_set": str(
+            trace_backend.compiler_trace_runtime.artifact_set.artifact_set_id
+        ),
+        "pairs": rows,
+    }
+    write_immutable_json(output, body)
+    return body
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument(
+        "--pair",
+        action="append",
+        required=True,
+        help="PROFILE_ID:CANDIDATE_ID of one published configuration",
+    )
+    parser.add_argument("--stride", type=int, default=384)
+    parser.add_argument(
+        "--max-dynamic-instructions",
+        type=int,
+        default=DEFAULT_DYNAMIC_INSTRUCTION_LIMIT,
+    )
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args(argv)
+    if args.stride < 1:
+        raise ValueError("stride must be positive")
+    config = json.loads(args.config.read_text(encoding="utf-8"))
+    body = run_spotcheck(
+        config=config,
+        workspace=args.output_dir.resolve(),
+        pairs=_parse_pairs(args.pair),
+        stride=args.stride,
+        dynamic_instruction_limit=args.max_dynamic_instructions,
+        output=args.output.resolve(),
+    )
+    print(
+        json.dumps(
+            {
+                "output": str(args.output.resolve()),
+                "pair_count": len(body["pairs"]),
+                "sampled_contexts_per_pair": body[
+                    "sampled_contexts_per_pair"
+                ],
+            },
+            indent=2,
+            sort_keys=True,
+        )
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/decode_dse/software/stack_validity.py b/decode_dse/software/stack_validity.py
new file mode 100644
index 0000000..5b0e0c5
--- /dev/null
+++ b/decode_dse/software/stack_validity.py
@@ -0,0 +1,186 @@
+"""Build the workspace stack-validity artifact from measured stage reports.
+
+The artifact records, per hardware-validation profile, whether the compiler
+and emulator stages passed their measured validation. It binds the workspace
+run plan and sweep manifest by canonical hash, so it must be produced against
+the planned workspace it will gate — never generated elsewhere and copied.
+
+Inputs are the two stage reports emitted by the simulator's
+``build_stack_stage_reports`` tool (timestamped compiler and emulator runs
+with per-artifact SHA-256 bindings) and the retained emulator-calibration
+artifacts whose ids both reports must carry. The builder refuses to emit when
+any scoped profile's structural capability floor forbids a required stage, so
+a document the launch gate would reject is never written.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any, Mapping
+
+from decode_dse.legality import evaluate_stack_capability
+from decode_dse.manifest import SweepManifest
+from decode_dse.software.sweep_plan import SweepRunPlan, write_immutable_json
+
+STAGE_REPORT_SCHEMA = "plena-stack-stage-report"
+CALIBRATION_SCHEMA = "plena-decode-emulator-calibration"
+RTL_SERIALIZED = "rtl_serialized"
+REQUIRED_STAGES = ("compiler", "emulator")
+
+
+def _canonical_content_hash(value: Mapping[str, Any]) -> str:
+    body = {key: item for key, item in value.items() if key != "content_hash"}
+    encoded = json.dumps(
+        body,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+def load_stage_report(path: str | Path, *, stage: str) -> dict[str, Any]:
+    """Load one measured stage report and verify its identity and shape."""
+
+    report = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(report, Mapping):
+        raise TypeError(f"{stage} stage report must be a JSON object")
+    if report.get("schema") != STAGE_REPORT_SCHEMA:
+        raise ValueError(f"{path} is not a {STAGE_REPORT_SCHEMA} document")
+    if report.get("stage") != stage:
+        raise ValueError(
+            f"{path} records stage {report.get('stage')!r}, expected {stage!r}"
+        )
+    recorded_hash = report.get("content_hash")
+    if recorded_hash != _canonical_content_hash(report):
+        raise ValueError(f"{stage} stage report failed its content-hash check")
+    provenance = report.get("provenance")
+    if not isinstance(provenance, Mapping):
+        raise ValueError(f"{stage} stage report lacks provenance")
+    for field in ("started_at_utc", "completed_at_utc"):
+        if not provenance.get(field):
+            raise ValueError(f"{stage} stage report lacks {field}")
+    artifacts = report.get("artifacts")
+    if not isinstance(artifacts, Mapping) or not artifacts:
+        raise ValueError(f"{stage} stage report binds no artifacts")
+    calibration_ids = report.get("calibration_ids")
+    if not isinstance(calibration_ids, list) or not calibration_ids:
+        raise ValueError(f"{stage} stage report binds no calibration ids")
+    return dict(report)
+
+
+def load_calibration_artifact(path: str | Path) -> dict[str, Any]:
+    """Load one retained calibration artifact and verify its gate result."""
+
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    if value.get("schema") != CALIBRATION_SCHEMA:
+        raise ValueError(f"{path} is not a {CALIBRATION_SCHEMA} artifact")
+    if value.get("passed") is not True:
+        raise ValueError(f"{path} did not pass its stage-validation gate")
+    contract = value.get("execution_contract", {})
+    if contract.get("timing_mode") != RTL_SERIALIZED:
+        raise ValueError(
+            f"{path} was calibrated under timing mode "
+            f"{contract.get('timing_mode')!r}, not {RTL_SERIALIZED!r}"
+        )
+    calibration_id = value.get("calibration_id")
+    if not isinstance(calibration_id, str) or not calibration_id:
+        raise ValueError(f"{path} has no calibration id")
+    return value
+
+
+def build_stack_validity_document(
+    *,
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    compiler_report: Mapping[str, Any],
+    emulator_report: Mapping[str, Any],
+    calibration_ids: tuple[str, ...],
+) -> dict[str, Any]:
+    """Assemble the per-profile validity document the launch gate loads."""
+
+    for stage, report in (
+        ("compiler", compiler_report),
+        ("emulator", emulator_report),
+    ):
+        bound = set(report["calibration_ids"])
+        missing = sorted(set(calibration_ids) - bound)
+        if missing:
+            raise ValueError(
+                f"{stage} stage report does not bind calibration ids: {missing}"
+            )
+
+    entries = {entry.profile_id: entry for entry in manifest.entries}
+    profiles: dict[str, dict[str, Any]] = {}
+    blocked: list[str] = []
+    for profile_id in plan.hardware_validation_profile_ids:
+        entry = entries.get(profile_id)
+        if entry is None:
+            raise ValueError(f"plan profile {profile_id} is not in the manifest")
+        capability = evaluate_stack_capability(entry.profile)
+        floor = capability.validity_floor
+        if any(
+            getattr(floor, f"{stage}_valid") is False for stage in REQUIRED_STAGES
+        ):
+            blocked.append(profile_id)
+            continue
+        profiles[profile_id] = {
+            "software_valid": floor.software_valid,
+            "compiler_valid": True,
+            "emulator_valid": True,
+            "rtl_valid": floor.rtl_valid,
+            "dc_calibrated": floor.dc_calibrated,
+        }
+    if blocked:
+        raise ValueError(
+            "structural capability forbids a required stage for "
+            f"{len(blocked)} scoped profiles (first: {blocked[0]}); "
+            "the launch gate would reject this document"
+        )
+
+    return {
+        "schema": "decode-stack-validity",
+        "run_plan_hash": plan.canonical_hash,
+        "manifest_hash": manifest.canonical_hash,
+        "calibration_ids": sorted(calibration_ids),
+        "profiles": profiles,
+        "source_reports": {
+            "compiler": dict(compiler_report),
+            "emulator": dict(emulator_report),
+        },
+    }
+
+
+def build_stack_validity_artifact(
+    *,
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    compiler_report_path: str | Path,
+    emulator_report_path: str | Path,
+    calibration_paths: tuple[Path, ...],
+    destination: str | Path,
+) -> dict[str, Any]:
+    """Validate every input and write the immutable workspace artifact."""
+
+    compiler_report = load_stage_report(compiler_report_path, stage="compiler")
+    emulator_report = load_stage_report(emulator_report_path, stage="emulator")
+    if not calibration_paths:
+        raise ValueError("at least one retained calibration artifact is required")
+    calibration_ids = tuple(
+        sorted(
+            load_calibration_artifact(path)["calibration_id"]
+            for path in calibration_paths
+        )
+    )
+    document = build_stack_validity_document(
+        manifest=manifest,
+        plan=plan,
+        compiler_report=compiler_report,
+        emulator_report=emulator_report,
+        calibration_ids=calibration_ids,
+    )
+    write_immutable_json(destination, document)
+    return document
diff --git a/decode_dse/software/sweep.py b/decode_dse/software/sweep.py
new file mode 100644
index 0000000..e3a66c8
--- /dev/null
+++ b/decode_dse/software/sweep.py
@@ -0,0 +1,4586 @@
+"""Prepare, launch, and gate the staged exhaustive decode sweep.
+
+Commands: `inputs` builds tokens and reusable BF16 prefill artifacts;
+`compiler-trace-artifacts` builds compact native timing evidence; `stage`
+drives one workspace stage; `shards` fans a stage across isolated devices;
+`pipeline` runs every stage through its gates."""
+
+from __future__ import annotations
+
+import argparse
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import gc
+import hashlib
+import importlib
+import json
+import math
+import os
+from pathlib import Path
+import platform
+import re
+import stat
+import subprocess
+import sys
+import time
+from typing import Any, Callable, Iterable, Mapping, Protocol, Sequence
+
+from decode_dse.legality import load_built_stack_validity
+from decode_dse.manifest import (
+    SweepManifest,
+    build_exhaustive_manifest,
+    load_manifest,
+    validate_sweep_config,
+    write_manifest,
+)
+from decode_dse.profiles import DECODE_FORMATS
+from decode_dse.software.cache_artifacts import (
+    ArtifactProvenance,
+    load_prefill_artifact,
+    save_prefill_artifact,
+)
+from decode_dse.software.cached_decode import capture_bf16_prefill
+from decode_dse.software.decode_evaluator import DecodeEvaluator
+from decode_dse.software.runtime_environment import (
+    RuntimeEnvironment,
+    capture_runtime_environment,
+    initialize_numerical_runtime,
+    require_runtime_environment,
+    run_launch_preflight,
+)
+from decode_dse.software.sweep_plan import (
+    ExecutorContext,
+    GPUBaselinePlan,
+    HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+    PromptManifest,
+    StageSampleContract,
+    SweepRunPlan,
+    _mase_tree_hash,
+    _software_tree_hash,
+    build_quantizer_provenance,
+    build_run_plan,
+    evaluate_preflight_gates,
+    load_immutable_json,
+    load_preflight_evidence,
+    load_prompt_manifest,
+    make_stage_manifest,
+    profile_to_decode_quant_spec,
+    resolve_bound_path,
+    validate_run_plan,
+    write_immutable_json,
+)
+from decode_dse.software.sweep_runner import (
+    ExhaustiveSweepExecutor,
+    ExhaustiveSweepRunner,
+    SweepRunSummary,
+)
+from decode_dse.software.token_samples import (
+    TokenSampleBundle,
+    TokenizedSourceDocument,
+    build_bundle_from_documents,
+    load_sample_bundle,
+    save_sample_bundle,
+)
+
+PREFILL_INDEX_SCHEMA = "decode-prefill-index"
+
+
+def _load_config(path: str | Path) -> dict[str, Any]:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(value, dict):
+        raise ValueError("config must contain a JSON object")
+    return value
+
+
+def _repository_hash() -> str:
+    repository = Path(__file__).resolve().parents[2]
+    digest = hashlib.sha256()
+    for path in sorted((repository / "decode_dse").rglob("*")):
+        if (
+            path.is_file()
+            and path.suffix in {".py", ".json", ".sh"}
+            and "__pycache__" not in path.parts
+        ):
+            relative = path.relative_to(repository).as_posix().encode()
+            payload = path.read_bytes()
+            digest.update(len(relative).to_bytes(8, "little"))
+            digest.update(relative)
+            digest.update(len(payload).to_bytes(8, "little"))
+            digest.update(payload)
+    return digest.hexdigest()
+
+
+def _artifact_directory(root: Path, document_id: str) -> Path:
+    token = hashlib.sha256(document_id.encode("utf-8")).hexdigest()
+    return root / token
+
+
+def _dataset_config(config: Mapping[str, Any]) -> Mapping[str, Any]:
+    value = config.get("evaluation_data")
+    if not isinstance(value, Mapping):
+        raise ValueError("config.evaluation_data is required")
+    required = ("dataset_name", "dataset_revision")
+    missing = tuple(key for key in required if not value.get(key))
+    if missing:
+        raise ValueError(f"evaluation_data is missing {missing}")
+    return value
+
+
+def _is_wikitext_article_heading(text: str) -> bool:
+    value = text.strip()
+    return (
+        value.startswith("= ")
+        and value.endswith(" =")
+        and not value.startswith("= =")
+        and not value.endswith("= =")
+    )
+
+
+def _group_wikitext_documents(
+    rows: Iterable[Any],
+    *,
+    split: str,
+    separator: str,
+) -> tuple[tuple[str, str], ...]:
+    grouped: list[tuple[int, int, list[str]]] = []
+    start: int | None = None
+    content: list[str] = []
+    last_index = -1
+    for index, raw in enumerate(rows):
+        text = str(raw)
+        last_index = index
+        if _is_wikitext_article_heading(text) and content:
+            grouped.append((int(start), index - 1, content))
+            start = index
+            content = []
+        if text.strip():
+            if start is None:
+                start = index
+            content.append(text)
+    if content:
+        grouped.append((int(start), last_index, content))
+    if not grouped:
+        raise ValueError("held-out dataset contains no non-empty documents")
+    result = []
+    for ordinal, (first_row, last_row, parts) in enumerate(grouped):
+        document_id = (
+            f"wikitext-{split}-article-{ordinal:04d}-"
+            f"rows-{first_row:04d}-{last_row:04d}"
+        )
+        result.append((document_id, separator.join(parts)))
+    return tuple(result)
+
+
+def build_sample_files(
+    *,
+    config: Mapping[str, Any],
+    bundle_path: str | Path,
+    prompt_manifest_path: str | Path,
+) -> TokenSampleBundle:
+    """Tokenize the pinned held-out split and persist its exact token windows."""
+
+    try:
+        from datasets import load_dataset
+        from transformers import AutoTokenizer
+    except ImportError as exc:
+        raise RuntimeError(
+            "sample preparation requires datasets and transformers"
+        ) from exc
+
+    data = _dataset_config(config)
+    model_name = str(config["model_name"])
+    model_revision = str(config["model_revision"])
+    tokenizer_revision = str(config["tokenizer_revision"])
+    cache_dir = config.get("hf_cache_dir")
+    local_only = bool(config.get("local_files_only", True))
+    trust_remote_code = bool(config.get("trust_remote_code", False))
+    tokenizer = AutoTokenizer.from_pretrained(
+        model_name,
+        revision=tokenizer_revision,
+        cache_dir=cache_dir,
+        local_files_only=local_only,
+        trust_remote_code=trust_remote_code,
+    )
+    dataset = load_dataset(
+        str(data["dataset_name"]),
+        data.get("dataset_config"),
+        split=str(data.get("split", "test")),
+        revision=str(data["dataset_revision"]),
+        cache_dir=data.get("cache_dir"),
+    )
+    text_column = str(data.get("text_column", "text"))
+    if text_column not in dataset.column_names:
+        raise ValueError(f"dataset split does not contain text column {text_column!r}")
+    split = str(data.get("split", "test"))
+    source_documents = []
+    for document_id, text in _group_wikitext_documents(
+        dataset[text_column],
+        split=split,
+        separator=str(data.get("document_separator", "\n\n")),
+    ):
+        token_ids = tokenizer(
+            text,
+            add_special_tokens=False,
+            return_attention_mask=False,
+        )["input_ids"]
+        if token_ids:
+            source_documents.append(
+                TokenizedSourceDocument(
+                    document_id=document_id,
+                    content_hash=hashlib.sha256(text.encode("utf-8")).hexdigest(),
+                    token_ids=tuple(token_ids),
+                )
+            )
+    bundle = build_bundle_from_documents(
+        source_documents,
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        dataset_name=str(data["dataset_name"]),
+        dataset_revision=str(data["dataset_revision"]),
+        seed=int(config.get("seed", 0)),
+    )
+    save_sample_bundle(bundle, bundle_path)
+    write_immutable_json(prompt_manifest_path, bundle.prompt_manifest().to_dict())
+    return bundle
+
+
+def _verify_prefill(
+    artifact: Any,
+    *,
+    sample: Any,
+    bundle: TokenSampleBundle,
+    provenance: ArtifactProvenance,
+    runtime_environment: RuntimeEnvironment,
+    model_architecture: Mapping[str, Any],
+) -> None:
+    if artifact.model_revision != bundle.model_revision:
+        raise ValueError("prefill artifact model revision mismatch")
+    if artifact.tokenizer_revision != bundle.tokenizer_revision:
+        raise ValueError("prefill artifact tokenizer revision mismatch")
+    if artifact.prompt_hash != sample.prompt_hash:
+        raise ValueError("prefill artifact prompt mismatch")
+    if artifact.first_token.selection != "greedy":
+        raise ValueError("prefill artifact must own greedy first-token selection")
+    metadata = dict(artifact.metadata)
+    if metadata.get("document_id") != sample.document_id:
+        raise ValueError("prefill artifact document mismatch")
+    if metadata.get("sample_bundle_hash") != bundle.canonical_hash:
+        raise ValueError("prefill artifact sample-bundle mismatch")
+    if (
+        not metadata.get("preparation_device_uuid")
+        or metadata.get("preparation_device_name")
+        != runtime_environment.logical["device_name"]
+        or metadata.get("preparation_compute_capability")
+        != runtime_environment.logical["compute_capability"]
+    ):
+        raise ValueError("prefill artifact device observation is invalid")
+    if (
+        artifact.provenance.producer != provenance.producer
+        or artifact.provenance.code_revision != provenance.code_revision
+        or artifact.provenance.parameters != provenance.parameters
+    ):
+        raise ValueError("prefill artifact producer contract mismatch")
+    layer_count = int(model_architecture["num_hidden_layers"])
+    if len(artifact.layers) != layer_count:
+        raise ValueError(f"prefill requires exactly {layer_count} cache layers")
+    expected_shape = (
+        1,
+        int(model_architecture["num_key_value_heads"]),
+        len(sample.prompt_token_ids),
+        int(model_architecture["head_dim"]),
+    )
+    if any(layer.key.shape != expected_shape for layer in artifact.layers):
+        raise ValueError("prefill cache geometry differs from model_architecture")
+
+
+def prepare_prefill_artifacts(
+    *,
+    config: Mapping[str, Any],
+    bundle_path: str | Path,
+    artifact_root: str | Path,
+) -> dict[str, Any]:
+    """Capture each BF16 prompt cache once and resume from verified artifacts."""
+
+    try:
+        import torch
+        from transformers import AutoModelForCausalLM
+    except ImportError as exc:
+        raise RuntimeError(
+            "prefill preparation requires torch and transformers"
+        ) from exc
+
+    bundle = load_sample_bundle(bundle_path)
+    if bundle.model_revision != str(config["model_revision"]):
+        raise ValueError("sample bundle model revision differs from config")
+    if bundle.tokenizer_revision != str(config["tokenizer_revision"]):
+        raise ValueError("sample bundle tokenizer revision differs from config")
+    artifact_root = Path(artifact_root).resolve()
+    artifact_root.mkdir(parents=True, exist_ok=True)
+    device = str(config.get("device", "cuda:0"))
+    seed = int(config.get("seed", 0))
+    initialize_numerical_runtime(seed)
+    runtime_environment = capture_runtime_environment(device, seed=seed)
+    preparation_device = {
+        **dict(runtime_environment.observation),
+        "device_name": runtime_environment.logical["device_name"],
+        "compute_capability": runtime_environment.logical["compute_capability"],
+    }
+    code_revision = _repository_hash()
+    created_at = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+    provenance = ArtifactProvenance(
+        producer="packedkv-bf16-prefill",
+        code_revision=code_revision,
+        created_at_utc=created_at,
+        parameters=(
+            ("model_revision", bundle.model_revision),
+            ("sample_bundle_hash", bundle.canonical_hash),
+            ("tokenizer_revision", bundle.tokenizer_revision),
+            (
+                "runtime_environment_fingerprint",
+                runtime_environment.logical_fingerprint,
+            ),
+        ),
+    )
+
+    artifact_ids: dict[str, str] = {}
+    artifact_devices: dict[str, Mapping[str, Any]] = {}
+
+    def artifact_device(artifact: Any) -> Mapping[str, Any]:
+        metadata = dict(artifact.metadata)
+        return {
+            "device_index": int(metadata["preparation_device_index"]),
+            "device_uuid": metadata["preparation_device_uuid"],
+            "total_memory_bytes": int(metadata["preparation_total_memory_bytes"]),
+            "device_name": metadata["preparation_device_name"],
+            "compute_capability": metadata["preparation_compute_capability"],
+        }
+
+    preparation_metadata = {
+        "preparation_device_index": str(preparation_device["device_index"]),
+        "preparation_device_uuid": str(preparation_device["device_uuid"]),
+        "preparation_total_memory_bytes": str(preparation_device["total_memory_bytes"]),
+        "preparation_device_name": str(preparation_device["device_name"]),
+        "preparation_compute_capability": str(preparation_device["compute_capability"]),
+    }
+    pending = []
+    for sample in bundle.numerical_screen + bundle.hardware_validation:
+        path = _artifact_directory(artifact_root, sample.document_id)
+        if path.exists():
+            artifact = load_prefill_artifact(path)
+            _verify_prefill(
+                artifact,
+                sample=sample,
+                bundle=bundle,
+                provenance=provenance,
+                runtime_environment=runtime_environment,
+                model_architecture=config["model_architecture"],
+            )
+            artifact_ids[sample.document_id] = artifact.artifact_id
+            artifact_devices[sample.document_id] = artifact_device(artifact)
+            del artifact
+        else:
+            pending.append(sample)
+
+    model = None
+    try:
+        if pending:
+            dtype_name = str(config.get("dtype", "bfloat16")).lower()
+            if dtype_name != "bfloat16":
+                raise ValueError("prefill artifact capture requires bfloat16")
+            load_kwargs = {
+                "revision": bundle.model_revision,
+                "torch_dtype": torch.bfloat16,
+                "cache_dir": config.get("hf_cache_dir"),
+                "local_files_only": bool(config.get("local_files_only", True)),
+                "trust_remote_code": bool(config.get("trust_remote_code", False)),
+                "attn_implementation": "eager",
+                "low_cpu_mem_usage": True,
+            }
+            model = AutoModelForCausalLM.from_pretrained(
+                str(config["model_name"]),
+                **load_kwargs,
+            )
+            model = model.to(device).eval()
+            for index, sample in enumerate(pending, start=1):
+                input_ids = torch.tensor(
+                    [sample.prompt_token_ids],
+                    dtype=torch.long,
+                    device=device,
+                )
+                attention_mask = torch.ones_like(input_ids)
+                artifact = capture_bf16_prefill(
+                    model,
+                    input_ids=input_ids,
+                    attention_mask=attention_mask,
+                    model_revision=bundle.model_revision,
+                    tokenizer_revision=bundle.tokenizer_revision,
+                    provenance=provenance,
+                    metadata={
+                        "document_id": sample.document_id,
+                        "sample_bundle_hash": bundle.canonical_hash,
+                        **preparation_metadata,
+                    },
+                )
+                _verify_prefill(
+                    artifact,
+                    sample=sample,
+                    bundle=bundle,
+                    provenance=provenance,
+                    runtime_environment=runtime_environment,
+                    model_architecture=config["model_architecture"],
+                )
+                save_prefill_artifact(
+                    artifact,
+                    _artifact_directory(artifact_root, sample.document_id),
+                )
+                artifact_ids[sample.document_id] = artifact.artifact_id
+                artifact_devices[sample.document_id] = dict(preparation_device)
+                print(
+                    f"[prefill {index}/{len(pending)}] {sample.document_id}",
+                    flush=True,
+                )
+                del input_ids, attention_mask, artifact
+    finally:
+        if model is not None:
+            del model
+        gc.collect()
+        if "torch" in locals() and torch.cuda.is_available():
+            torch.cuda.empty_cache()
+
+    records = []
+    for sample in bundle.numerical_screen + bundle.hardware_validation:
+        artifact_id = artifact_ids.get(sample.document_id)
+        if artifact_id is None:
+            artifact = load_prefill_artifact(
+                _artifact_directory(artifact_root, sample.document_id)
+            )
+            _verify_prefill(
+                artifact,
+                sample=sample,
+                bundle=bundle,
+                provenance=provenance,
+                runtime_environment=runtime_environment,
+                model_architecture=config["model_architecture"],
+            )
+            artifact_id = artifact.artifact_id
+            artifact_devices[sample.document_id] = artifact_device(artifact)
+            del artifact
+        records.append(
+            {
+                "document_id": sample.document_id,
+                "prompt_hash": sample.prompt_hash,
+                "artifact_id": artifact_id,
+                "preparation_device": dict(artifact_devices[sample.document_id]),
+                "relative_path": _artifact_directory(
+                    Path("."), sample.document_id
+                ).as_posix(),
+            }
+        )
+    index = {
+        "schema_version": PREFILL_INDEX_SCHEMA,
+        "model_revision": bundle.model_revision,
+        "tokenizer_revision": bundle.tokenizer_revision,
+        "sample_bundle_hash": bundle.canonical_hash,
+        "code_revision": code_revision,
+        "runtime_environment": runtime_environment.to_dict(),
+        "preparation_devices": [
+            json.loads(encoded)
+            for encoded in sorted(
+                {
+                    json.dumps(
+                        dict(device_observation),
+                        sort_keys=True,
+                        separators=(",", ":"),
+                    )
+                    for device_observation in artifact_devices.values()
+                }
+            )
+        ],
+        "records": records,
+    }
+    write_immutable_json(artifact_root / "index.json", index)
+    return index
+
+
+def _load_run_plan(path: Path) -> SweepRunPlan:
+    value = load_immutable_json(path)
+    value.pop("content_hash")
+    return SweepRunPlan.from_dict(value)
+
+
+def _load_prompts(path: Path) -> PromptManifest:
+    value = load_immutable_json(path)
+    value.pop("content_hash")
+    return PromptManifest.from_dict(value)
+
+
+def prepare_admission_artifacts(
+    *,
+    config: Mapping[str, Any],
+    config_path: str | Path,
+    output_dir: str | Path,
+) -> Mapping[str, Any]:
+    """Seal every cache representation consumed by both evaluation sets."""
+
+    output_dir = Path(output_dir).resolve()
+    config_path = Path(config_path).resolve()
+    manifest = load_manifest(output_dir / "manifest.json")
+    plan = _load_run_plan(output_dir / "run_plan.json")
+    prompts = _load_prompts(output_dir / "prompt_manifest.json")
+    validate_run_plan(plan, manifest)
+    _validate_provenance(
+        output_dir / "provenance.json",
+        repository=Path(__file__).resolve().parents[2],
+        config_path=config_path,
+        manifest=manifest,
+        plan=plan,
+        prompts=prompts,
+    )
+    executor = DecodeEvaluator.for_admission_preparation(
+        config,
+        workspace_root=output_dir,
+    )
+    if executor.bundle.prompt_manifest() != prompts:
+        raise ValueError("sample bundle differs from the workspace prompts")
+    executor.seal_workspace_runtime_environment(output_dir)
+    return executor.prepare_admission_catalog(
+        workspace_root=output_dir,
+        workspace_identity={
+            "manifest_hash": manifest.canonical_hash,
+            "run_plan_hash": plan.canonical_hash,
+            "prompt_manifest_hash": prompts.canonical_hash,
+        },
+    )
+
+
+def prepare_stack_validity_artifact(
+    *,
+    output_dir: str | Path,
+    compiler_report_path: str | Path,
+    emulator_report_path: str | Path,
+    calibration_paths: tuple[Path, ...],
+) -> Mapping[str, Any]:
+    """Seal the workspace stack-validity artifact from measured stage reports.
+
+    The artifact binds this workspace's run plan and manifest hashes, so it
+    must be produced against the planned workspace it will gate.
+    """
+
+    from decode_dse.software.stack_validity import build_stack_validity_artifact
+
+    output_dir = Path(output_dir).resolve()
+    manifest = load_manifest(output_dir / "manifest.json")
+    plan = _load_run_plan(output_dir / "run_plan.json")
+    validate_run_plan(plan, manifest)
+    destination = output_dir / "stack_validity.json"
+    document = build_stack_validity_artifact(
+        manifest=manifest,
+        plan=plan,
+        compiler_report_path=compiler_report_path,
+        emulator_report_path=emulator_report_path,
+        calibration_paths=calibration_paths,
+        destination=destination,
+    )
+    load_built_stack_validity(
+        destination,
+        manifest=manifest,
+        scope_profile_ids=plan.hardware_validation_profile_ids,
+        required_stages=("compiler", "emulator"),
+        scope_name="hardware-validation",
+        run_plan_hash=plan.canonical_hash,
+    )
+    return {
+        "stack_validity": str(destination),
+        "profile_count": len(document["profiles"]),
+        "calibration_ids": document["calibration_ids"],
+        "run_plan_hash": document["run_plan_hash"],
+        "manifest_hash": document["manifest_hash"],
+    }
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    samples = commands.add_parser("samples")
+    samples.add_argument("--config", required=True)
+    samples.add_argument("--sample-bundle", required=True)
+    samples.add_argument("--prompt-manifest", required=True)
+    prefill = commands.add_parser("prefill")
+    prefill.add_argument("--config", required=True)
+    prefill.add_argument("--sample-bundle", required=True)
+    prefill.add_argument("--artifact-root", required=True)
+    admission = commands.add_parser("admission")
+    admission.add_argument("--config", required=True)
+    admission.add_argument("--output-dir", required=True)
+    validity = commands.add_parser("stack-validity")
+    validity.add_argument("--config", required=True)
+    validity.add_argument("--output-dir", required=True)
+    validity.add_argument("--compiler-report", required=True)
+    validity.add_argument("--emulator-report", required=True)
+    validity.add_argument(
+        "--calibration-artifact",
+        action="append",
+        required=True,
+        help="retained emulator-calibration artifact to bind (repeatable)",
+    )
+    return parser
+
+
+def sweep_inputs_main(argv: Iterable[str] | None = None) -> int:
+    args = _parser().parse_args(tuple(argv) if argv is not None else None)
+    try:
+        config = _load_config(args.config)
+        if args.command == "samples":
+            result = build_sample_files(
+                config=config,
+                bundle_path=args.sample_bundle,
+                prompt_manifest_path=args.prompt_manifest,
+            )
+            payload = {
+                "sample_bundle_hash": result.canonical_hash,
+                "prompt_manifest_hash": result.prompt_manifest().canonical_hash,
+            }
+        elif args.command == "prefill":
+            payload = prepare_prefill_artifacts(
+                config=config,
+                bundle_path=args.sample_bundle,
+                artifact_root=args.artifact_root,
+            )
+        elif args.command == "stack-validity":
+            payload = prepare_stack_validity_artifact(
+                output_dir=args.output_dir,
+                compiler_report_path=args.compiler_report,
+                emulator_report_path=args.emulator_report,
+                calibration_paths=tuple(
+                    Path(path) for path in args.calibration_artifact
+                ),
+            )
+        else:
+            payload = prepare_admission_artifacts(
+                config=config,
+                config_path=args.config,
+                output_dir=args.output_dir,
+            )
+        print(json.dumps(payload, indent=2, sort_keys=True))
+        return 0
+    except Exception as error:
+        print(
+            json.dumps(
+                {
+                    "error_class": type(error).__name__,
+                    "error_message": str(error),
+                },
+                sort_keys=True,
+            ),
+            file=sys.stderr,
+        )
+        return 2
+
+
+__all__ = [
+    "PREFILL_INDEX_SCHEMA",
+    "build_sample_files",
+    "main",
+    "prepare_admission_artifacts",
+    "prepare_stack_validity_artifact",
+    "prepare_prefill_artifacts",
+]
+
+
+PROVENANCE_SCHEMA = "decode-sweep-provenance"
+
+
+STAGE_INVOCATION_SCHEMA = "decode-stage-invocation"
+
+
+DEFAULT_EXECUTOR_FACTORY = "decode_dse.software.decode_evaluator:create_executor"
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _sweep_launcher_load_config(path: str | Path) -> dict[str, Any]:
+    return json.loads(Path(path).read_text(encoding="utf-8"))
+
+
+def _build_manifest(
+    config: Mapping[str, Any],
+    repository: Path,
+) -> SweepManifest:
+    validate_sweep_config(config)
+    return build_exhaustive_manifest(
+        str(config["model_name"]),
+        str(config["model_revision"]),
+        dict(config["model_architecture"]),
+        build_quantizer_provenance(repository, config),
+        str(config["tokenizer_revision"]),
+    )
+
+
+def _load_plan(path: Path) -> SweepRunPlan:
+    value = load_immutable_json(path)
+    value.pop("content_hash")
+    return SweepRunPlan.from_dict(value)
+
+
+def _load_output_prompts(path: Path) -> PromptManifest:
+    value = load_immutable_json(path)
+    value.pop("content_hash")
+    return PromptManifest.from_dict(value)
+
+
+def _provenance(
+    *,
+    repository: Path,
+    config_path: Path,
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    prompts: PromptManifest | None,
+    created_at_utc: str | None = None,
+) -> dict[str, Any]:
+    config = json.loads(config_path.read_text(encoding="utf-8"))
+    refinement = config.get("refinement", {})
+    calibration = (
+        refinement.get("calibration_data", {})
+        if isinstance(refinement, Mapping)
+        else {}
+    )
+    datasets = {
+        "evaluation": {
+            "name": config.get("evaluation_data", {}).get("dataset_name"),
+            "config": config.get("evaluation_data", {}).get("dataset_config"),
+            "revision": config.get("evaluation_data", {}).get("dataset_revision"),
+            "split": config.get("evaluation_data", {}).get("split"),
+        }
+    }
+    if calibration:
+        calibration_descriptor = {
+            "name": calibration.get("dataset_name"),
+            "config": calibration.get("dataset_config"),
+            "revision": calibration.get("dataset_revision"),
+            "split": calibration.get("split"),
+        }
+        if any(value is None for value in calibration_descriptor.values()):
+            raise ValueError(
+                "refinement calibration provenance descriptor is incomplete"
+            )
+        datasets["refinement_calibration"] = calibration_descriptor
+    return {
+        "schema_version": PROVENANCE_SCHEMA,
+        "created_at_utc": created_at_utc
+        or datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+        "manifest_hash": manifest.canonical_hash,
+        "run_plan_hash": plan.canonical_hash,
+        "model": {
+            "name": manifest.model_name,
+            "revision": manifest.model_revision,
+            "tokenizer_revision": manifest.tokenizer_revision,
+            "dtype": str(config.get("dtype")),
+            "architecture": dict(config.get("model_architecture", {})),
+            "placement": dict(config.get("model_placement", {})),
+        },
+        "runtime_requirements": dict(config.get("runtime_requirements", {})),
+        "artifact_policy": str(config.get("executor", {}).get("artifact_policy", "")),
+        "datasets": datasets,
+        "quantizer_provenance": manifest.quantizer_provenance.to_dict(),
+        "quantizer_provenance_hash": manifest.quantizer_provenance.canonical_hash,
+        "prompt_manifest_hash": (
+            prompts.canonical_hash if prompts is not None else None
+        ),
+        "config_sha256": _sha256_file(config_path),
+        "software_tree_sha256": _software_tree_hash(repository),
+        "mase_tree_sha256": _mase_tree_hash(
+            repository,
+            config,
+        ),
+        "python_version": sys.version.splitlines()[0],
+        "platform": platform.platform(),
+    }
+
+
+def _validate_provenance(
+    provenance_path: Path,
+    *,
+    repository: Path,
+    config_path: Path,
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    prompts: PromptManifest,
+) -> None:
+    recorded = load_immutable_json(provenance_path)
+    config = json.loads(config_path.read_text(encoding="utf-8"))
+    current_quantizers = build_quantizer_provenance(repository, config)
+    if current_quantizers != manifest.quantizer_provenance:
+        raise RuntimeError(
+            "quantizer sources differ from the immutable sweep manifest: "
+            f"recorded={manifest.quantizer_provenance.canonical_hash}, "
+            f"current={current_quantizers.canonical_hash}"
+        )
+    created_at_utc = recorded.get("created_at_utc")
+    if not isinstance(created_at_utc, str) or not created_at_utc.endswith("Z"):
+        raise RuntimeError("provenance is missing its UTC creation timestamp")
+    expected = _provenance(
+        repository=repository,
+        config_path=config_path,
+        manifest=manifest,
+        plan=plan,
+        prompts=prompts,
+        created_at_utc=created_at_utc,
+    )
+    for key, value in expected.items():
+        if recorded.get(key) != value:
+            raise RuntimeError(
+                f"provenance mismatch for {key}: "
+                f"recorded={recorded.get(key)!r}, current={value!r}"
+            )
+
+
+class ExecutorFactory(Protocol):
+    def __call__(self, context: ExecutorContext) -> ExhaustiveSweepExecutor: ...
+
+
+def _load_executor_factory(spec: str) -> ExecutorFactory:
+    if ":" not in spec:
+        raise ValueError("executor factory must use module.path:callable syntax")
+    module_name, attribute = spec.rsplit(":", 1)
+    if not module_name or not attribute:
+        raise ValueError("executor factory must use module.path:callable syntax")
+    module = importlib.import_module(module_name)
+    factory = getattr(module, attribute)
+    if not callable(factory):
+        raise TypeError(f"executor factory is not callable: {spec}")
+    return factory
+
+
+def _stage_ids(plan: SweepRunPlan, stage: str) -> tuple[str, ...]:
+    if stage == "preflight":
+        return plan.preflight_profile_ids
+    if stage == "validation-pilot":
+        hardware_validation_ids = set(plan.hardware_validation_profile_ids)
+        return tuple(
+            profile_id
+            for profile_id in plan.preflight_profile_ids
+            if profile_id in hardware_validation_ids
+        )
+    if stage == "numerical-screen":
+        return plan.numerical_screen_profile_ids
+    if stage == "hardware-validation":
+        return plan.hardware_validation_profile_ids
+    raise ValueError(f"unsupported stage {stage!r}")
+
+
+def _stage_contract(plan: SweepRunPlan, stage: str) -> StageSampleContract:
+    if stage == "preflight":
+        name = "numerical-screen"
+    elif stage == "validation-pilot":
+        name = "hardware-validation"
+    else:
+        name = stage
+    contracts = {contract.name: contract for contract in plan.sample_contracts}
+    return contracts[name]
+
+
+def partition_stage_profile_ids(
+    manifest: SweepManifest,
+    profile_ids: Sequence[str],
+    *,
+    shard_index: int,
+    shard_count: int,
+) -> tuple[str, ...]:
+    """Partition whole weight banks across deterministic execution shards."""
+
+    if shard_count <= 0:
+        raise ValueError("shard_count must be positive")
+    if shard_index < 0 or shard_index >= shard_count:
+        raise ValueError("shard_index must be in [0, shard_count)")
+    selected = set(profile_ids)
+    if len(selected) != len(profile_ids):
+        raise ValueError("stage schedule contains duplicate profile IDs")
+    by_id = {entry.profile_id: entry for entry in manifest.entries}
+    unknown = selected - set(by_id)
+    if unknown:
+        raise ValueError(f"stage schedule contains unknown profiles: {sorted(unknown)}")
+    weight_order: list[str] = []
+    for profile_id in profile_ids:
+        weight_format = by_id[profile_id].profile.weight_format
+        if weight_format not in weight_order:
+            weight_order.append(weight_format)
+    if shard_count > len(weight_order):
+        raise ValueError(
+            f"{shard_count} shards exceed {len(weight_order)} weight banks"
+        )
+    shard_by_weight = {
+        weight_format: index % shard_count
+        for index, weight_format in enumerate(weight_order)
+    }
+    result = tuple(
+        profile_id
+        for profile_id in profile_ids
+        if shard_by_weight[by_id[profile_id].profile.weight_format] == shard_index
+    )
+    if not result:
+        raise AssertionError("deterministic sharding produced an empty shard")
+    return result
+
+
+def _completion_rows(
+    root: Path,
+    stage_manifest: SweepManifest,
+) -> dict[str, Mapping[str, Any]]:
+    completed = root / "completed"
+    rows: dict[str, Mapping[str, Any]] = {}
+    if not completed.exists():
+        return rows
+    for path in sorted(completed.glob("*.json")):
+        value = json.loads(path.read_text(encoding="utf-8"))
+        marker_hash = value.pop("marker_hash", None)
+        payload = json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        ).encode("utf-8")
+        if marker_hash != hashlib.sha256(payload).hexdigest():
+            raise ValueError(f"completion checksum mismatch: {path}")
+        if value.get("manifest_hash") != stage_manifest.canonical_hash:
+            raise ValueError(f"completion manifest mismatch: {path}")
+        profile_id = str(value["profile_id"])
+        if profile_id in rows:
+            raise ValueError(f"duplicate completion marker for {profile_id}")
+        rows[profile_id] = value
+    return rows
+
+
+def _require_stage_completion(
+    root: Path,
+    master_manifest: SweepManifest,
+    *,
+    expected_profile_ids: Iterable[str],
+    required_success_ids: Iterable[str],
+) -> None:
+    expected_ids = set(expected_profile_ids)
+    master_by_id = {
+        entry.profile_id: entry.profile for entry in master_manifest.entries
+    }
+    if (root / "manifest.json").is_file():
+        partitions = (root,)
+    else:
+        partitions = tuple(sorted(root.glob("part-*-of-*")))
+    rows: dict[str, Mapping[str, Any]] = {}
+    scheduled: set[str] = set()
+    for partition in partitions:
+        manifest_path = partition / "manifest.json"
+        if not manifest_path.is_file():
+            continue
+        partition_manifest = load_manifest(manifest_path)
+        invocation_path = partition / "invocation.json"
+        if not invocation_path.is_file():
+            raise ValueError(f"missing upstream invocation: {invocation_path}")
+        invocation = load_immutable_json(invocation_path)
+        if (
+            invocation.get("master_manifest_hash") != master_manifest.canonical_hash
+            or invocation.get("stage_manifest_hash")
+            != partition_manifest.canonical_hash
+            or invocation.get("profile_count") != len(partition_manifest.entries)
+        ):
+            raise ValueError(f"upstream invocation mismatch: {invocation_path}")
+        for entry in partition_manifest.entries:
+            if (
+                entry.profile_id not in expected_ids
+                or master_by_id.get(entry.profile_id) != entry.profile
+            ):
+                raise ValueError(
+                    f"invalid upstream profile in {manifest_path}: "
+                    f"{entry.profile_id}"
+                )
+            if entry.profile_id in scheduled:
+                raise ValueError(
+                    f"profile appears in multiple upstream partitions: "
+                    f"{entry.profile_id}"
+                )
+            scheduled.add(entry.profile_id)
+        for profile_id, value in _completion_rows(
+            partition, partition_manifest
+        ).items():
+            if profile_id in rows:
+                raise ValueError(f"duplicate upstream completion for {profile_id}")
+            rows[profile_id] = value
+    if scheduled != expected_ids:
+        missing = sorted(expected_ids - scheduled)
+        unexpected = sorted(scheduled - expected_ids)
+        raise RuntimeError(
+            f"upstream schedule is incomplete: missing={missing[:3]}, "
+            f"unexpected={unexpected[:3]}"
+        )
+    if set(rows) != expected_ids:
+        missing = sorted(expected_ids - set(rows))
+        unexpected = sorted(set(rows) - expected_ids)
+        raise RuntimeError(
+            f"stage is incomplete: missing={missing[:3]}, "
+            f"unexpected={unexpected[:3]}"
+        )
+    failed_required = sorted(
+        profile_id
+        for profile_id in required_success_ids
+        if rows[profile_id]["state"] != "succeeded"
+    )
+    if failed_required:
+        raise RuntimeError(
+            "required upstream profiles failed: " + ", ".join(failed_required[:3])
+        )
+
+
+def _load_workspace(
+    output_dir: Path,
+) -> tuple[SweepManifest, SweepRunPlan, PromptManifest]:
+    manifest = load_manifest(output_dir / "manifest.json")
+    plan = _load_plan(output_dir / "run_plan.json")
+    prompts = _load_output_prompts(output_dir / "prompt_manifest.json")
+    validate_run_plan(plan, manifest)
+    return manifest, plan, prompts
+
+
+def _plan_summary(
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    prompts: PromptManifest | None,
+) -> dict[str, Any]:
+    return {
+        "manifest_hash": manifest.canonical_hash,
+        "run_plan_hash": plan.canonical_hash,
+        "quantizer_provenance_hash": (manifest.quantizer_provenance.canonical_hash),
+        "prompt_manifest_hash": (
+            prompts.canonical_hash if prompts is not None else None
+        ),
+        "preflight_profiles": len(plan.preflight_profile_ids),
+        "numerical_screen_profiles": len(plan.numerical_screen_profile_ids),
+        "hardware_validation_profiles": len(plan.hardware_validation_profile_ids),
+        "numerical_screen_workers": plan.numerical_screen_workers,
+        "hardware_validation_workers": plan.hardware_validation_workers,
+        "numerical_screen_microbatch_size": plan.numerical_screen_microbatch_size,
+        "hardware_validation_microbatch_size": plan.hardware_validation_microbatch_size,
+        "device_labels": list(plan.device_labels),
+        "gpu_baseline_work_units": list(plan.gpu_baseline_work_units),
+        "gpu_baseline_measurements": len(plan.gpu_baseline_work_units),
+        "execution_ready": prompts is not None,
+    }
+
+
+_COMPILER_TRACE_PREFLIGHT_SCHEMA = "decode-compiler-trace-preflight/v1"
+_COMPILER_TRACE_PREFLIGHT_FIELDS = frozenset(
+    {
+        "schema_version",
+        "max_unique_family_artifacts",
+        "max_unique_lowering_instantiations",
+        "max_lazy_trace_instantiations",
+        "max_projected_trace_bytes",
+        "max_context_timing_resolutions",
+        "max_joined_identities",
+        "max_joined_bytes",
+        "max_digest_updates",
+        "projected_joined_row_bytes",
+        "digest_updates_per_joined_identity",
+    }
+)
+_COMPILER_TRACE_PREFLIGHT_CACHE: dict[str, dict[str, Any]] = {}
+
+
+def _compiler_trace_execution_limits(
+    config: Mapping[str, Any],
+) -> dict[str, int | float | str]:
+    value = config.get("compiler_trace_preflight")
+    if not isinstance(value, Mapping):
+        raise ValueError("config.compiler_trace_preflight is required")
+    if set(value) != _COMPILER_TRACE_PREFLIGHT_FIELDS:
+        raise ValueError("compiler_trace_preflight fields differ from its schema")
+    if value.get("schema_version") != _COMPILER_TRACE_PREFLIGHT_SCHEMA:
+        raise ValueError("unsupported compiler_trace_preflight schema_version")
+    integer_fields = _COMPILER_TRACE_PREFLIGHT_FIELDS - {"schema_version"}
+    normalized: dict[str, int | float | str] = {
+        "schema_version": _COMPILER_TRACE_PREFLIGHT_SCHEMA
+    }
+    for name in sorted(integer_fields):
+        raw = value[name]
+        if isinstance(raw, bool) or not isinstance(raw, int) or raw <= 0:
+            raise ValueError(
+                f"compiler_trace_preflight.{name} must be a positive integer"
+            )
+        normalized[name] = int(raw)
+    return normalized
+
+
+def _storage_token(token: str) -> tuple[str, int]:
+    if token.startswith("MXINT") and token[5:].isdigit():
+        return "mxint", int(token[5:])
+    match = re.fullmatch(r"E([0-9]+)M([0-9]+)", token)
+    if match is not None:
+        return "mxfp", 1 + int(match.group(1)) + int(match.group(2))
+    raise ValueError(f"unsupported compiler storage token {token!r}")
+
+
+def _profile_storage_signature(profile: Any) -> tuple[Any, ...]:
+    weight_family, weight_bits = _storage_token(str(profile.weight_format))
+    key_family, key_bits = _storage_token(str(profile.key_format))
+    value_family, value_bits = _storage_token(str(profile.value_format))
+    return (
+        weight_family,
+        weight_bits,
+        key_family,
+        key_bits,
+        value_family,
+        value_bits,
+        int(profile.block_size),
+        int(profile.scale_bits),
+    )
+
+
+def _storage_signature_blockers(signature: tuple[Any, ...]) -> tuple[str, ...]:
+    # MXINT/MXFP and distinct K/V formats are explicit frontend receipt
+    # bindings. Their element widths remain structure-changing; their format
+    # family does not alter the native ISA or logical request addresses.
+    _ = signature
+    return ()
+
+
+def _lowering_storage_signature(signature: tuple[Any, ...]) -> tuple[int, ...]:
+    """Return only physical widths that shape native trace generation."""
+
+    return (
+        int(signature[1]),
+        int(signature[3]),
+        int(signature[5]),
+        int(signature[6]),
+        int(signature[7]),
+    )
+
+
+def _sum_positive_ceiling_range(start: int, count: int, divisor: int) -> int:
+    """Return sum(ceil(value/divisor)) without materializing context points."""
+
+    def prefix(last: int) -> int:
+        if last <= 0:
+            return 0
+        quotient, remainder = divmod(last, divisor)
+        return (
+            divisor * quotient * (quotient + 1) // 2
+            + remainder * (quotient + 1)
+        )
+
+    return prefix(start + count - 1) - prefix(start - 1)
+
+
+def _native_compiler_geometry_blockers(
+    candidate: Any,
+    architecture: Mapping[str, Any],
+    block_sizes: set[int],
+) -> tuple[str, ...]:
+    """Return exact rank-local frontend blockers for one hardware candidate."""
+
+    heads = int(architecture["num_attention_heads"])
+    kv_heads = int(architecture["num_key_value_heads"])
+    head_dim = int(architecture["head_dim"])
+    blockers = []
+    if heads % kv_heads or heads % candidate.tp or kv_heads % candidate.tp:
+        blockers.append("invalid_grouped_query_attention_ratio")
+        local_heads = heads
+        local_kv_heads = kv_heads
+    else:
+        local_heads = heads // candidate.tp
+        local_kv_heads = kv_heads // candidate.tp
+    if candidate.vlen != candidate.mlen:
+        blockers.append("native_frontend_requires_vlen_equal_mlen")
+    if head_dim != candidate.hlen or candidate.mlen % candidate.hlen:
+        blockers.append("packed_attention_head_geometry_unsupported")
+    elif local_heads // local_kv_heads > candidate.mlen // candidate.hlen:
+        blockers.append("grouped_query_ratio_exceeds_head_broadcast")
+    if (
+        local_kv_heads * head_dim > candidate.mlen
+        or local_kv_heads > 16
+        or candidate.mlen % head_dim
+        or any(
+            head_dim % block or candidate.mlen % block
+            for block in block_sizes
+        )
+    ):
+        blockers.append("packed_kv_layout_geometry_unsupported")
+    return tuple(sorted(set(blockers)))
+
+
+def _compiler_trace_generation_points(
+    config: Mapping[str, Any],
+    manifest: SweepManifest,
+) -> tuple[Any, ...]:
+    """Build one exact point for every native batch/storage lowering."""
+
+    from decode_dse.hardware.design_space import ExactHardwareSpace
+    from decode_dse.hardware.evaluation import precision_request
+    from decode_dse.simulator_bridge import DecodeSimulator
+
+    architecture = config.get("model_architecture")
+    workload = config.get("reference_workload")
+    output_head = config.get("output_head_contract")
+    pipeline = config.get("publication_pipeline")
+    if not isinstance(architecture, Mapping):
+        raise ValueError("config is missing model_architecture")
+    if not isinstance(workload, Mapping):
+        raise ValueError("config is missing reference_workload")
+    if not isinstance(output_head, Mapping):
+        raise ValueError("config is missing output_head_contract")
+    if not isinstance(pipeline, Mapping) or not isinstance(
+        pipeline.get("resources"), Mapping
+    ):
+        raise ValueError("config is missing publication_pipeline.resources")
+    resources = pipeline["resources"]
+
+    storage_representatives: dict[tuple[int, ...], Any] = {}
+    for entry in manifest.entries:
+        if not entry.legality.hardware_candidate:
+            continue
+        signature = _lowering_storage_signature(
+            _profile_storage_signature(entry.profile)
+        )
+        storage_representatives.setdefault(signature, entry)
+    if not storage_representatives:
+        raise ValueError("compiler artifact generation has no hardware profiles")
+
+    block_sizes = {
+        int(signature[3]) for signature in storage_representatives
+    }
+    candidate_representatives: dict[tuple[Any, ...], Any] = {}
+    hardware_space = ExactHardwareSpace.from_study_config(config)
+    for candidate in hardware_space.iter_candidates(
+        int(architecture["hidden_size"])
+    ):
+        if _native_compiler_geometry_blockers(
+            candidate,
+            architecture,
+            block_sizes,
+        ):
+            continue
+        signature = (
+            int(candidate.mlen),
+            int(candidate.blen),
+            int(candidate.vlen),
+            int(candidate.hlen),
+            int(candidate.batch),
+            int(candidate.tp),
+            int(candidate.kvp),
+            bool(candidate.kv_head_reuse),
+        )
+        candidate_representatives.setdefault(signature, candidate)
+    if not candidate_representatives:
+        raise ValueError("compiler artifact generation has no supported hardware")
+
+    simulator = DecodeSimulator(str(config["sim_model"]))
+    precisions = {}
+    for signature, entry in storage_representatives.items():
+        request = precision_request(entry.profile)
+        precisions[signature] = simulator.make_precision(
+            attn_w=request.weight,
+            ffn_w=request.weight,
+            key=request.key,
+            value=request.value,
+            w_fmt=request.weight_family,
+            key_fmt=request.key_family,
+            value_fmt=request.value_family,
+            block=request.block_size,
+            act_w=request.activation,
+            act_fmt=request.activation_family,
+        )
+
+    points = []
+    for candidate_signature in sorted(candidate_representatives):
+        candidate = candidate_representatives[candidate_signature]
+        hbm = simulator.hbm_overrides(
+            candidate.hbm_generation,
+            candidate.hbm_channels,
+        )
+        overrides = {
+            "MLEN": candidate.mlen,
+            "BLEN": candidate.blen,
+            "VLEN": candidate.vlen,
+            "HLEN": candidate.hlen,
+            "TP": candidate.tp,
+            "KVP": candidate.kvp,
+            "LINK_PORTS": candidate.link_ports,
+            "SRAM_POLICY": candidate.sram_policy,
+            "LINK_GENERATION": "nvlink4",
+            **hbm,
+        }
+        if candidate.architecture_knobs_explicit:
+            overrides.update(
+                {
+                    "KV_HEAD_REUSE": candidate.kv_head_reuse,
+                    "DRAIN_OVERLAPPED": candidate.drain_overlapped,
+                }
+            )
+        hardware = simulator.base_hw.model_copy(update=overrides)
+        for storage_signature in sorted(precisions):
+            points.append(
+                simulator.compiler_trace_point(
+                    precisions[storage_signature],
+                    hardware=hardware,
+                    overrides=overrides,
+                    batch=int(candidate.batch),
+                    input_seq=int(workload["input_seq"]),
+                    output_seq=int(workload["output_seq"]),
+                    stride=int(resources["stride"]),
+                    n_chips=int(candidate.chip_count),
+                    hbm_gen=str(candidate.hbm_generation),
+                    hbm_channels=int(candidate.hbm_channels),
+                    kv_layout="dense_selector",
+                    runtime_hbm_reserve_bytes=int(
+                        resources["runtime_hbm_reserve_bytes"]
+                    ),
+                    output_head_location=str(
+                        output_head["headline_location"]
+                    ),
+                )
+            )
+    return tuple(points)
+
+
+def compiler_trace_artifacts_main(
+    argv: Iterable[str] | None = None,
+) -> int:
+    """Generate the complete compact compiler-trace artifact set."""
+
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    repository = Path(__file__).resolve().parents[2]
+    try:
+        config = _load_config(args.config.resolve())
+        _, artifact_values, _ = _publication_pipeline_config(config)
+        configured_output = _resolve_publication_pipeline_paths(
+            artifact_values,
+            repository=repository,
+            output_dir=args.output_dir.resolve(),
+        )["compiler_trace_artifacts"]
+        if configured_output is None or args.output.resolve() != configured_output:
+            raise ValueError(
+                "compiler trace output differs from publication_pipeline.artifacts"
+            )
+        manifest = _build_manifest(config, repository)
+        preflight = _compiler_trace_feasibility(config, manifest)
+        _require_compiler_trace_feasible(preflight)
+        points = _compiler_trace_generation_points(config, manifest)
+        workload = config["reference_workload"]
+        resources = config["publication_pipeline"]["resources"]
+        contexts = range(
+            int(workload["input_seq"]),
+            int(workload["input_seq"]) + int(workload["output_seq"]),
+            int(resources["stride"]),
+        )
+        from full_model_artifact_build import build_full_model_decode_artifact_set
+
+        result = build_full_model_decode_artifact_set(
+            ((point, contexts) for point in points),
+            args.output.resolve(),
+            dry_run=args.dry_run,
+        )
+        if not args.dry_run and not args.output.resolve().is_file():
+            raise RuntimeError(
+                "compiler trace builder did not create its declared artifact"
+            )
+        if callable(getattr(result, "to_dict", None)):
+            payload = result.to_dict()
+        elif isinstance(result, Mapping):
+            payload = dict(result)
+        else:
+            payload = {"result": str(result)}
+        print(
+            json.dumps(
+                {
+                    "schema_version": "decode-compiler-trace-generation/v1",
+                    "dry_run": args.dry_run,
+                    "point_count": len(points),
+                    "context_start": contexts.start,
+                    "context_stop": contexts.stop,
+                    "context_step": contexts.step,
+                    "output": None if args.dry_run else str(args.output.resolve()),
+                    "build": payload,
+                },
+                indent=2,
+                sort_keys=True,
+            )
+        )
+        return 0
+    except (OSError, RuntimeError, TypeError, ValueError) as error:
+        print(
+            json.dumps(
+                {
+                    "error_class": type(error).__name__,
+                    "error_message": str(error),
+                },
+                sort_keys=True,
+            ),
+            file=sys.stderr,
+        )
+        return 2
+
+
+def _compiler_trace_feasibility(
+    config: Mapping[str, Any],
+    manifest: SweepManifest,
+) -> dict[str, Any]:
+    """Factorize the full legal compiler/simulator/join workload exactly."""
+
+    from decode_dse.hardware.design_space import ExactHardwareSpace
+
+    cache_key = hashlib.sha256(
+        json.dumps(
+            {
+                "schema_version": _COMPILER_TRACE_PREFLIGHT_SCHEMA,
+                "config": dict(config),
+                "manifest_hash": manifest.canonical_hash,
+            },
+            sort_keys=True,
+            separators=(",", ":"),
+            allow_nan=False,
+        ).encode("utf-8")
+    ).hexdigest()
+    cached = _COMPILER_TRACE_PREFLIGHT_CACHE.get(cache_key)
+    if cached is not None:
+        return json.loads(json.dumps(cached))
+
+    limits = _compiler_trace_execution_limits(config)
+    architecture = config.get("model_architecture")
+    workload = config.get("reference_workload")
+    pipeline = config.get("publication_pipeline")
+    if not isinstance(architecture, Mapping):
+        raise ValueError("config is missing model_architecture")
+    if not isinstance(workload, Mapping):
+        raise ValueError("config is missing reference_workload")
+    if not isinstance(pipeline, Mapping) or not isinstance(
+        pipeline.get("resources"),
+        Mapping,
+    ):
+        raise ValueError("config is missing publication_pipeline.resources")
+    resources = pipeline["resources"]
+    stride = int(resources["stride"])
+    input_tokens = int(workload["input_seq"])
+    output_tokens = int(workload["output_seq"])
+    if min(stride, input_tokens, output_tokens) <= 0:
+        raise ValueError("compiler workload lengths and stride must be positive")
+
+    hardware_entries = tuple(
+        entry for entry in manifest.entries if entry.legality.hardware_candidate
+    )
+    storage_signatures = {
+        _profile_storage_signature(entry.profile) for entry in hardware_entries
+    }
+    lowering_storage_signatures = {
+        _lowering_storage_signature(signature) for signature in storage_signatures
+    }
+    family_signatures = {
+        ("dense_selector", "format_bound_in_exact_point_receipt")
+    }
+    storage_blocker_sets = {
+        signature: _storage_signature_blockers(signature)
+        for signature in storage_signatures
+    }
+    supported_storage = {
+        signature
+        for signature, blockers in storage_blocker_sets.items()
+        if not blockers
+    }
+
+    hidden = int(architecture["hidden_size"])
+    heads = int(architecture["num_attention_heads"])
+    block_sizes = {int(signature[6]) for signature in storage_signatures}
+    hardware_space = ExactHardwareSpace.from_study_config(config)
+    structural_candidates = 0
+    batch_resolution_signatures: set[tuple[Any, ...]] = set()
+    hardware_signature_blockers: dict[tuple[Any, ...], tuple[str, ...]] = {}
+    hardware_signature_candidate_counts: dict[tuple[Any, ...], int] = {}
+    for candidate in hardware_space.iter_candidates(hidden):
+        structural_candidates += 1
+        batch_resolution_signatures.add(
+            (
+                int(candidate.mlen),
+                int(candidate.blen),
+                int(candidate.vlen),
+                int(candidate.hlen),
+                int(candidate.batch),
+                int(candidate.tp),
+                int(candidate.kvp),
+                bool(candidate.kv_head_reuse),
+            )
+        )
+        # Independent serving batches are exact affine slab replications.
+        # Native code generation is keyed only by the single-slab template;
+        # the requested batch remains sealed in the resolution receipt.
+        signature = (
+            int(candidate.mlen),
+            int(candidate.blen),
+            int(candidate.vlen),
+            int(candidate.hlen),
+            int(candidate.tp),
+            int(candidate.kvp),
+            bool(candidate.kv_head_reuse),
+        )
+        hardware_signature_candidate_counts[signature] = (
+            hardware_signature_candidate_counts.get(signature, 0) + 1
+        )
+        if signature in hardware_signature_blockers:
+            continue
+        hardware_signature_blockers[signature] = (
+            _native_compiler_geometry_blockers(
+                candidate,
+                architecture,
+                block_sizes,
+            )
+        )
+
+    hardware_signatures = set(hardware_signature_blockers)
+    structural_geometry_blockers = {
+        "invalid_grouped_query_attention_ratio",
+        "packed_attention_head_geometry_unsupported",
+        "grouped_query_ratio_exceeds_head_broadcast",
+        "packed_kv_layout_geometry_unsupported",
+    }
+    geometry_eligible_hardware = {
+        signature
+        for signature, blockers in hardware_signature_blockers.items()
+        if not structural_geometry_blockers.intersection(blockers)
+    }
+    supported_hardware = {
+        signature
+        for signature, blockers in hardware_signature_blockers.items()
+        if not blockers
+    }
+    model_blockers = []
+    if int(architecture.get("num_local_experts", 1)) > 1:
+        model_blockers.append("mixture_of_experts_not_lowered")
+    if int(architecture.get("n_sliding", 0)) > 0:
+        model_blockers.append("sliding_attention_not_lowered")
+
+    batch_record_counts: dict[tuple[Any, ...], int] = {}
+    for signature in batch_resolution_signatures:
+        batch_free_signature = signature[:4] + signature[5:]
+        batch_record_counts[batch_free_signature] = (
+            batch_record_counts.get(batch_free_signature, 0) + 1
+        )
+    geometry_eligible_batch_record_count = sum(
+        batch_record_counts[item] for item in geometry_eligible_hardware
+    )
+    geometry_eligible_candidate_count = sum(
+        hardware_signature_candidate_counts[item]
+        for item in geometry_eligible_hardware
+    )
+    lowering_instantiations = (
+        geometry_eligible_batch_record_count * len(lowering_storage_signatures)
+    )
+    native_supported_lowerings = (
+        0
+        if model_blockers
+        else sum(batch_record_counts[item] for item in supported_hardware)
+        * len({_lowering_storage_signature(item) for item in supported_storage})
+    )
+    # The native recipe is batch-free, but exact records are not. Query tiling,
+    # activation/cache addresses, shared weight traffic, and tails are compiled
+    # for every requested batch. Context and storage parameters remain bound by
+    # their separate exact algebraic resolvers.
+    native_template_instantiations = geometry_eligible_batch_record_count
+    raw_profile_candidate_pairs = structural_candidates * len(hardware_entries)
+    raw_context_point_resolutions = raw_profile_candidate_pairs * output_tokens
+    physical_signature_pairs = (
+        geometry_eligible_candidate_count * len(lowering_storage_signatures)
+    )
+    # Every eligible candidate/storage factor produces one exact evaluator
+    # outcome. Each outcome resolves its growing-context sequence through one
+    # compact algebraic schedule rather than per-context compiler invocation.
+    full_evaluator_calls = physical_signature_pairs
+    timing_resolutions = full_evaluator_calls
+    physical_context_step_outcomes = timing_resolutions * output_tokens
+    joined_identities = physical_signature_pairs
+    digest_updates = (
+        joined_identities * int(limits["digest_updates_per_joined_identity"])
+    )
+    joined_bytes = joined_identities * int(limits["projected_joined_row_bytes"])
+
+    layers = int(architecture["num_hidden_layers"])
+    projected_trace_bytes = geometry_eligible_batch_record_count * (
+        # Fixed decoder body plus one full-block and one masked-tail template
+        # per layer/head. Context block multiplicity is an integer parameter,
+        # so no per-token or per-block trace rows are serialized.
+        64 * 1024 + layers * 96 * 1024 + layers * heads * 2 * 512
+    )
+
+    capability_counts: dict[str, int] = {}
+    for blocker in model_blockers:
+        capability_counts[blocker] = lowering_instantiations
+    structural_rejection_signature_counts: dict[str, int] = {}
+    structural_rejection_candidate_counts: dict[str, int] = {}
+    for blocker in structural_geometry_blockers:
+        rejected_signatures = {
+            signature
+            for signature, blockers in hardware_signature_blockers.items()
+            if blocker in blockers
+        }
+        structural_rejection_signature_counts[blocker] = sum(
+            batch_record_counts[signature] for signature in rejected_signatures
+        )
+        structural_rejection_candidate_counts[blocker] = sum(
+            hardware_signature_candidate_counts[signature]
+            for signature in rejected_signatures
+        )
+    for blocker in {
+        item
+        for blockers in hardware_signature_blockers.values()
+        for item in blockers
+    } - structural_geometry_blockers:
+        capability_counts[blocker] = (
+            sum(
+                batch_record_counts[signature]
+                for signature, blockers in hardware_signature_blockers.items()
+                if blocker in blockers
+            )
+            * len(lowering_storage_signatures)
+        )
+    for blocker in {
+        item for blockers in storage_blocker_sets.values() for item in blockers
+    }:
+        capability_counts[blocker] = (
+            sum(blocker in blockers for blockers in storage_blocker_sets.values())
+            * geometry_eligible_batch_record_count
+        )
+
+    checks = {
+        "unique_family_artifacts": (
+            len(family_signatures),
+            int(limits["max_unique_family_artifacts"]),
+        ),
+        "unique_lowering_instantiations": (
+            lowering_instantiations,
+            int(limits["max_unique_lowering_instantiations"]),
+        ),
+        "lazy_trace_instantiations": (
+            native_template_instantiations,
+            int(limits["max_lazy_trace_instantiations"]),
+        ),
+        "projected_trace_bytes": (
+            projected_trace_bytes,
+            int(limits["max_projected_trace_bytes"]),
+        ),
+        "context_timing_resolutions": (
+            timing_resolutions,
+            int(limits["max_context_timing_resolutions"]),
+        ),
+        "joined_identities": (
+            joined_identities,
+            int(limits["max_joined_identities"]),
+        ),
+        "joined_bytes": (joined_bytes, int(limits["max_joined_bytes"])),
+        "digest_updates": (digest_updates, int(limits["max_digest_updates"])),
+    }
+    blockers = [
+        f"unsupported_native_lowering:{name}:{count}"
+        for name, count in sorted(capability_counts.items())
+        if count
+    ]
+    if stride != 1:
+        blockers.append(
+            "nonunit_context_stride_is_not_exact:"
+            f"stride={stride}"
+        )
+    blockers.extend(
+        f"execution_limit_exceeded:{name}:{observed}>{limit}"
+        for name, (observed, limit) in checks.items()
+        if observed > limit
+    )
+    result = {
+        "schema_version": _COMPILER_TRACE_PREFLIGHT_SCHEMA,
+        "execution_mode": "compiler_trace",
+        "artifact_scope": "full_model_decode_step_independent_request_batch",
+        "structurally_legal_hardware_candidates": structural_candidates,
+        "compiler_geometry_eligible_hardware_candidates": (
+            geometry_eligible_candidate_count
+        ),
+        "compiler_geometry_rejected_hardware_candidates": (
+            structural_candidates - geometry_eligible_candidate_count
+        ),
+        "compiler_base_hardware_signatures": len(batch_resolution_signatures),
+        "raw_batch_free_native_template_signatures": len(hardware_signatures),
+        "batch_free_native_template_signatures": len(
+            geometry_eligible_hardware
+        ),
+        "raw_exact_batch_record_signatures": len(batch_resolution_signatures),
+        "exact_batch_record_signatures": geometry_eligible_batch_record_count,
+        "batch_record_instantiation_factor": (
+            geometry_eligible_batch_record_count
+            / len(geometry_eligible_hardware)
+        ),
+        "hardware_timing_reuse_factor": (
+            structural_candidates / len(batch_resolution_signatures)
+        ),
+        "hardware_relevant_precision_profiles": len(hardware_entries),
+        "unique_storage_signatures": len(storage_signatures),
+        "unique_structure_changing_storage_signatures": len(
+            lowering_storage_signatures
+        ),
+        "unique_compiler_family_artifacts": len(family_signatures),
+        "unique_compiler_lowering_instantiations": lowering_instantiations,
+        "native_capability_supported_lowering_instantiations": (
+            native_supported_lowerings
+        ),
+        "unique_lazy_trace_instantiations": native_template_instantiations,
+        "projected_trace_generation_calls": native_template_instantiations,
+        "projected_trace_bytes": projected_trace_bytes,
+        "exact_contexts_per_evaluation": output_tokens,
+        "configured_stride": stride,
+        "projected_context_timing_resolutions": timing_resolutions,
+        "physical_context_step_outcomes": physical_context_step_outcomes,
+        "raw_profile_candidate_pairs": raw_profile_candidate_pairs,
+        "raw_context_point_resolutions": raw_context_point_resolutions,
+        "physical_signature_pairs": physical_signature_pairs,
+        "projected_full_evaluator_calls": full_evaluator_calls,
+        "simulator_priced_pairs": None,
+        "simulator_priced_pairs_upper_bound": physical_signature_pairs,
+        "projected_joined_identities": joined_identities,
+        "joined_result_rows": None,
+        "joined_result_rows_upper_bound": raw_profile_candidate_pairs,
+        "conceptual_joined_result_rows": raw_profile_candidate_pairs,
+        "projected_joined_bytes": joined_bytes,
+        "projected_digest_updates": digest_updates,
+        "capability_blocker_signature_counts": capability_counts,
+        "structural_rejection_signature_counts": (
+            structural_rejection_signature_counts
+        ),
+        "structural_rejection_candidate_counts": (
+            structural_rejection_candidate_counts
+        ),
+        "projection_basis": {
+            "trace_bytes": (
+                "sum over exact-batch records of 64KiB + "
+                "layers*96KiB + two loop/tail blocks*layers*heads*512B"
+            ),
+            "contexts": (
+                "one compact schedule per candidate/storage factor represents "
+                "every exact input_seq..input_seq+output_seq-1 context"
+            ),
+            "simulator_calls": (
+                "one exact factor outcome per compiler-eligible hardware "
+                "candidate and structure-changing storage signature"
+            ),
+            "joined_rows": (
+                "factor rows are physical-signature*candidate; conceptual "
+                "profile joins remain sealed separately and are not materialized"
+            ),
+            "native_template_resolution": (
+                "the batch-free recipe is reused, but every batch has an exact "
+                "compiled record; only storage and context loop/tail parameters "
+                "bind outside native record generation"
+            ),
+            "elapsed_time_status": "awaiting_first_completed_profile",
+        },
+        "execution_limits": dict(limits),
+        "compiler_trace_preflight_feasible": not blockers,
+        "compiler_trace_preflight_blockers": blockers,
+        "hard_gate": (
+            "block_before launch preflight, remote GPU work, simulator pricing, "
+            "or joined-result materialization"
+        ),
+    }
+    _COMPILER_TRACE_PREFLIGHT_CACHE[cache_key] = result
+    return json.loads(json.dumps(result))
+
+
+def _require_compiler_trace_feasible(plan: Mapping[str, Any]) -> None:
+    if plan.get("compiler_trace_preflight_feasible") is not True:
+        blockers = plan.get("compiler_trace_preflight_blockers")
+        if not isinstance(blockers, list):
+            raise RuntimeError("compiler trace preflight did not return blockers")
+        raise RuntimeError(
+            "compiler trace production preflight failed: "
+            + "; ".join(str(value) for value in blockers)
+        )
+
+
+def _cost_declaration(
+    config: Mapping[str, Any],
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    launch_preflight: Any,
+    compiler_trace_preflight: Mapping[str, Any],
+) -> dict[str, Any]:
+    """Declare exact static work and measurement-dependent runtime cost."""
+
+    from decode_dse.hardware.design_space import physical_cost_signature_id
+
+    structural_candidates = int(
+        compiler_trace_preflight["structurally_legal_hardware_candidates"]
+    )
+    hardware_entries = tuple(
+        entry for entry in manifest.entries if entry.legality.hardware_candidate
+    )
+    physical_signatures = {
+        physical_cost_signature_id(entry.profile)
+        for entry in hardware_entries
+    }
+    tolerance = config.get("fp_ppl_tol")
+    if (
+        isinstance(tolerance, bool)
+        or not isinstance(tolerance, (int, float))
+        or not math.isfinite(float(tolerance))
+        or float(tolerance) <= 0
+    ):
+        raise ValueError("fp_ppl_tol must be finite and positive")
+    joint_hardware_search = {
+        "schema": "plena-lossless-joint-search-declaration",
+        "hardware_relevant_profiles": len(hardware_entries),
+        "physical_cost_signatures_before_accuracy": len(physical_signatures),
+        "structurally_legal_hardware_candidates": structural_candidates,
+        "raw_precision_hardware_pairs": (
+            len(hardware_entries) * structural_candidates
+        ),
+        "raw_signature_hardware_pairs": (
+            len(physical_signatures) * structural_candidates
+        ),
+        "hard_accuracy_constraint": {
+            "bf16_relative_perplexity_limit": 1.0 + float(tolerance),
+            "formula": (
+                "candidate_mean_nll <= reference_mean_nll + "
+                "log(bf16_relative_perplexity_limit)"
+            ),
+        },
+        "artifact_dependent_exact_counts": {
+            "accuracy_passing_profiles": None,
+            "accuracy_passing_physical_signatures": None,
+            "hard_resource_passing_signature_pairs": None,
+            "simulator_priced_pairs": None,
+            "joined_result_rows": None,
+            "resolution": "hardware_study_provenance_after_numerical_results",
+        },
+        "losslessness": (
+            "The production study removes only hard accuracy, structural, "
+            "matched-area, physical HBM/SRAM-capacity, and aggregate-resource "
+            "failures; it performs no latency, bottleneck, or bandwidth-demand "
+            "pruning and joins each cached cost result to every equivalent "
+            "accuracy row."
+        ),
+    }
+
+    pilot_profiles = len(_stage_ids(plan, "validation-pilot"))
+    stage_profiles = {
+        "preflight": len(plan.preflight_profile_ids),
+        "validation_pilot": pilot_profiles,
+        "numerical_screen": len(plan.numerical_screen_profile_ids),
+        "hardware_validation": len(plan.hardware_validation_profile_ids),
+    }
+    measured = config.get("measured_trial_cost")
+    trial_seconds = None
+    source = None
+    if isinstance(measured, Mapping):
+        candidate = measured.get("seconds")
+        source_candidate = measured.get("source_artifact")
+        if (
+            isinstance(candidate, (int, float))
+            and not isinstance(candidate, bool)
+            and math.isfinite(float(candidate))
+            and float(candidate) > 0
+            and isinstance(source_candidate, str)
+            and source_candidate
+        ):
+            trial_seconds = float(candidate)
+            source = source_candidate
+    total_evaluations = sum(stage_profiles.values())
+    gpu_baseline_measurements = len(plan.gpu_baseline_work_units)
+    executor = config.get("executor", {})
+    executor_map = executor if isinstance(executor, Mapping) else {}
+    weight_bytes = (
+        launch_preflight.memory_estimates[0].weight_bytes
+        if launch_preflight.memory_estimates
+        else 0
+    )
+    cpu_cache_bytes = int(float(executor_map.get("max_cpu_cache_gib", 0.0)) * (1 << 30))
+    host_floor_bytes = int(
+        float(executor_map.get("min_available_host_gib", 0.0)) * (1 << 30)
+    )
+    peak_host_bytes = max(
+        host_floor_bytes,
+        weight_bytes + int(config.get("max_parallel_points", 1)) * cpu_cache_bytes,
+    )
+    return {
+        "manifest_profiles": len(manifest.entries),
+        "stage_profile_evaluations": stage_profiles,
+        "total_profile_evaluations": total_evaluations,
+        "gpu_baseline_measurements": gpu_baseline_measurements,
+        "gpu_baseline_prefill_runs": (
+            gpu_baseline_measurements * plan.gpu_baseline.repetitions
+        ),
+        "gpu_baseline_decode_steps": (
+            gpu_baseline_measurements
+            * plan.gpu_baseline.repetitions
+            * (
+                plan.gpu_baseline.warmup_steps
+                + plan.gpu_baseline.measured_steps
+            )
+        ),
+        "total_work_units": total_evaluations + gpu_baseline_measurements,
+        "joint_hardware_search": joint_hardware_search,
+        "compiler_trace_preflight": dict(compiler_trace_preflight),
+        "artifact_footprint": (
+            launch_preflight.artifact_footprint.to_dict()
+            if launch_preflight.artifact_footprint is not None
+            else None
+        ),
+        "peak_host_memory_bytes": peak_host_bytes or None,
+        "peak_device_memory_bytes": max(
+            (estimate.required_bytes for estimate in launch_preflight.memory_estimates),
+            default=None,
+        ),
+        "measured_trial_seconds": trial_seconds,
+        "measured_trial_source": source,
+        "projected_wall_clock_seconds": (
+            total_evaluations * trial_seconds if trial_seconds is not None else None
+        ),
+        "projection_status": (
+            "measured_trial_cost"
+            if trial_seconds is not None
+            else "awaiting_first_completed_profile"
+        ),
+        "maximum_projected_wall_clock_seconds": (plan.max_projected_hours * 3600.0),
+    }
+
+
+def create_workspace(
+    *,
+    config_path: str | Path,
+    output_dir: str | Path,
+    device_labels: Sequence[str],
+    prompt_manifest_path: str | Path | None = None,
+    numerical_screen_workers: int | None = None,
+    hardware_validation_workers: int | None = None,
+    numerical_screen_microbatch_size: int | None = None,
+    hardware_validation_microbatch_size: int | None = None,
+    dry_run: bool = False,
+) -> dict[str, Any]:
+    """Validate and optionally persist one immutable sweep workspace."""
+
+    config_path = Path(config_path).resolve()
+    output_dir = Path(output_dir).resolve()
+    repository = Path(__file__).resolve().parents[2]
+    config = _sweep_launcher_load_config(config_path)
+    manifest = _build_manifest(config, repository)
+    compiler_trace_preflight = _compiler_trace_feasibility(config, manifest)
+    if not dry_run:
+        _require_compiler_trace_feasible(compiler_trace_preflight)
+    launch_preflight = run_launch_preflight(
+        config,
+        repository_root=repository,
+        workspace_root=output_dir,
+        device_labels=device_labels,
+    )
+    if not dry_run:
+        launch_preflight.require_passed()
+    executor_config = config.get("executor", {})
+    microbatches = executor_config.get("decode_microbatch_size", {})
+    if not isinstance(microbatches, Mapping):
+        raise ValueError(
+            "executor.decode_microbatch_size must map numerical_screen and hardware_validation"
+        )
+    configured_workers = int(config.get("max_parallel_points", 4))
+    gpu_baseline_config = config.get("gpu_baseline")
+    if not isinstance(gpu_baseline_config, Mapping):
+        raise TypeError("config.gpu_baseline must be an explicit object")
+    plan = build_run_plan(
+        manifest,
+        device_labels=device_labels,
+        numerical_screen_workers=(
+            configured_workers
+            if numerical_screen_workers is None
+            else numerical_screen_workers
+        ),
+        hardware_validation_workers=(
+            configured_workers
+            if hardware_validation_workers is None
+            else hardware_validation_workers
+        ),
+        numerical_screen_microbatch_size=(
+            int(microbatches.get("numerical_screen", 16))
+            if numerical_screen_microbatch_size is None
+            else numerical_screen_microbatch_size
+        ),
+        hardware_validation_microbatch_size=(
+            int(microbatches.get("hardware_validation", 8))
+            if hardware_validation_microbatch_size is None
+            else hardware_validation_microbatch_size
+        ),
+        gpu_baseline=GPUBaselinePlan.from_config(gpu_baseline_config),
+    )
+    prompts = (
+        load_prompt_manifest(prompt_manifest_path)
+        if prompt_manifest_path is not None
+        else None
+    )
+    summary = _plan_summary(manifest, plan, prompts)
+    summary["compiler_trace_preflight"] = compiler_trace_preflight
+    for name in (
+        "unique_compiler_family_artifacts",
+        "unique_lazy_trace_instantiations",
+        "projected_trace_generation_calls",
+        "projected_trace_bytes",
+        "compiler_trace_preflight_feasible",
+    ):
+        summary[name] = compiler_trace_preflight[name]
+    summary["launch_preflight"] = launch_preflight.to_dict()
+    summary["cost_declaration"] = _cost_declaration(
+        config,
+        manifest,
+        plan,
+        launch_preflight,
+        compiler_trace_preflight,
+    )
+    if dry_run:
+        summary["manifest"] = manifest.to_dict()
+        summary["run_plan"] = plan.to_dict()
+        summary["provenance"] = _provenance(
+            repository=repository,
+            config_path=config_path,
+            manifest=manifest,
+            plan=plan,
+            prompts=prompts,
+            created_at_utc="1970-01-01T00:00:00Z",
+        )
+        return summary
+    if prompts is None:
+        raise ValueError("persisted workspaces require a versioned prompt manifest")
+
+    write_manifest(output_dir / "manifest.json", manifest)
+    write_immutable_json(output_dir / "run_plan.json", plan.to_dict())
+    if prompts is not None:
+        write_immutable_json(output_dir / "prompt_manifest.json", prompts.to_dict())
+    provenance_path = output_dir / "provenance.json"
+    existing_created_at = (
+        load_immutable_json(provenance_path).get("created_at_utc")
+        if provenance_path.is_file()
+        else None
+    )
+    write_immutable_json(
+        provenance_path,
+        _provenance(
+            repository=repository,
+            config_path=config_path,
+            manifest=manifest,
+            plan=plan,
+            prompts=prompts,
+            created_at_utc=(
+                str(existing_created_at) if existing_created_at is not None else None
+            ),
+        ),
+    )
+    return summary
+
+
+def validate_workspace(
+    *,
+    output_dir: str | Path,
+    evidence_path: str | Path,
+) -> dict[str, Any]:
+    """Validate preflight evidence against immutable workspace artifacts."""
+
+    output_dir = Path(output_dir).resolve()
+    manifest, plan, prompts = _load_workspace(output_dir)
+    evidence = load_preflight_evidence(evidence_path)
+    return evaluate_preflight_gates(manifest, plan, prompts, evidence).to_dict()
+
+
+def launch_stage(
+    *,
+    config_path: str | Path,
+    output_dir: str | Path,
+    stage: str,
+    executor_factory: str = DEFAULT_EXECUTOR_FACTORY,
+    evidence_path: str | Path | None = None,
+    limit: int | None = None,
+    shard_index: int = 0,
+    shard_count: int = 1,
+    device_label: str | None = None,
+) -> SweepRunSummary:
+    """Launch one stage after all applicable immutable gates pass."""
+
+    if limit is not None and limit < 0:
+        raise ValueError("limit must be non-negative")
+    config_path = Path(config_path).resolve()
+    output_dir = Path(output_dir).resolve()
+    repository = Path(__file__).resolve().parents[2]
+    config = _sweep_launcher_load_config(config_path)
+    validate_sweep_config(config)
+    manifest, plan, prompts = _load_workspace(output_dir)
+    if device_label is None:
+        if len(plan.device_labels) != 1:
+            raise ValueError(
+                "device_label is required when the plan has multiple device types"
+            )
+        device_label = plan.device_labels[0]
+    if device_label not in plan.device_labels:
+        raise ValueError(f"device label {device_label!r} is outside the run plan")
+    expected_shards = (
+        plan.numerical_screen_workers
+        if _stage_contract(plan, stage).name == "numerical-screen"
+        else plan.hardware_validation_workers
+    )
+    if shard_count != expected_shards:
+        raise ValueError(f"{stage} requires exactly {expected_shards} planned shards")
+    _validate_provenance(
+        output_dir / "provenance.json",
+        repository=repository,
+        config_path=config_path,
+        manifest=manifest,
+        plan=plan,
+        prompts=prompts,
+    )
+    admission_receipt_path = output_dir / "admission_preparation.json"
+    if executor_factory == DEFAULT_EXECUTOR_FACTORY:
+        if not admission_receipt_path.is_file():
+            raise FileNotFoundError(
+                "decode stages require sealed admission preparation"
+            )
+        admission_receipt_sha256: str | None = _sha256_file(admission_receipt_path)
+    else:
+        admission_receipt_sha256 = None
+    if stage not in {"preflight", "validation-pilot"}:
+        if evidence_path is None:
+            raise ValueError(f"{stage} requires validated preflight evidence")
+        evidence = load_preflight_evidence(evidence_path)
+        evaluate_preflight_gates(manifest, plan, prompts, evidence).require_passed()
+        if executor_factory == DEFAULT_EXECUTOR_FACTORY:
+            receipt = load_immutable_json(admission_receipt_path)
+            if evidence.admission_preparation.admission_index_hash != receipt.get(
+                "admission_index_hash"
+            ) or evidence.admission_preparation.admission_contract_id != receipt.get(
+                "admission_contract_id"
+            ):
+                raise ValueError(
+                    "preflight evidence uses a different admission preparation"
+                )
+        evidence_sha256: str | None = _sha256_file(Path(evidence_path))
+    else:
+        evidence_sha256 = None
+
+    stage_ids = _stage_ids(plan, stage)
+    shard_ids = partition_stage_profile_ids(
+        manifest,
+        stage_ids,
+        shard_index=shard_index,
+        shard_count=shard_count,
+    )
+    stage_manifest = make_stage_manifest(manifest, shard_ids)
+    if stage == "validation-pilot":
+        _require_stage_completion(
+            output_dir / "preflight",
+            manifest,
+            expected_profile_ids=plan.preflight_profile_ids,
+            required_success_ids=plan.preflight_profile_ids,
+        )
+    elif stage == "numerical-screen":
+        _require_stage_completion(
+            output_dir / "preflight",
+            manifest,
+            expected_profile_ids=plan.preflight_profile_ids,
+            required_success_ids=plan.preflight_profile_ids,
+        )
+    elif stage == "hardware-validation":
+        _require_stage_completion(
+            output_dir / "numerical-screen",
+            manifest,
+            expected_profile_ids=plan.numerical_screen_profile_ids,
+            required_success_ids=plan.hardware_validation_profile_ids,
+        )
+
+    stage_root = output_dir / stage
+    full_stage_manifest = make_stage_manifest(manifest, stage_ids)
+    write_immutable_json(
+        stage_root / "sharding.json",
+        {
+            "schema_version": "decode-stage-sharding",
+            "stage": stage,
+            "master_manifest_hash": manifest.canonical_hash,
+            "full_stage_manifest_hash": full_stage_manifest.canonical_hash,
+            "run_plan_hash": plan.canonical_hash,
+            "shard_count": shard_count,
+            "algorithm": "whole_weight_bank_round_robin/v1",
+        },
+    )
+    stage_output = (
+        stage_root
+        if shard_count == 1
+        else stage_root / f"part-{shard_index:04d}-of-{shard_count:04d}"
+    )
+    if limit == 0:
+        return SweepRunSummary(
+            attempts_written=0,
+            succeeded=0,
+            failed_terminal=0,
+            pending=len(stage_manifest.entries),
+            result_rows=0,
+        )
+    invocation = {
+        "schema_version": STAGE_INVOCATION_SCHEMA,
+        "stage": stage,
+        "master_manifest_hash": manifest.canonical_hash,
+        "stage_manifest_hash": stage_manifest.canonical_hash,
+        "run_plan_hash": plan.canonical_hash,
+        "prompt_manifest_hash": prompts.canonical_hash,
+        "preflight_evidence_sha256": evidence_sha256,
+        "admission_preparation_sha256": admission_receipt_sha256,
+        "executor_factory": executor_factory,
+        "device_label": device_label,
+        "shard_index": shard_index,
+        "shard_count": shard_count,
+        "profile_count": len(stage_manifest.entries),
+        "sample_contract": _stage_contract(plan, stage).to_dict(),
+        "decode_microbatch_size": (
+            plan.numerical_screen_microbatch_size
+            if _stage_contract(plan, stage).name == "numerical-screen"
+            else plan.hardware_validation_microbatch_size
+        ),
+        "max_attempts": int(config.get("runtime", {}).get("max_attempts", 3)),
+        "weight_bank_build_serialized": bool(
+            config.get("executor", {}).get(
+                "serialize_weight_bank_builds",
+                True,
+            )
+        ),
+    }
+    write_immutable_json(stage_output / "invocation.json", invocation)
+
+    context = ExecutorContext(
+        stage=stage,
+        workspace_root=output_dir,
+        output_dir=stage_output,
+        config=config,
+        master_manifest=manifest,
+        stage_manifest=stage_manifest,
+        run_plan=plan,
+        prompts=prompts,
+        sample_contract=_stage_contract(plan, stage),
+        shard_index=shard_index,
+        shard_count=shard_count,
+        device_label=device_label,
+    )
+    factory = _load_executor_factory(executor_factory)
+    executor = factory(context)
+    for method in ("open_weight_bank", "open_kv_admission_cache", "evaluate"):
+        if not callable(getattr(executor, method, None)):
+            raise TypeError(f"executor is missing callable {method}")
+    runner = ExhaustiveSweepRunner(
+        manifest=stage_manifest,
+        output_dir=stage_output,
+        executor=executor,
+        max_attempts=int(config.get("runtime", {}).get("max_attempts", 3)),
+        stage=stage,
+    )
+    return runner.run(limit=limit)
+
+
+def _add_common_plan_arguments(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--config", required=True)
+    parser.add_argument("--output-dir", required=True)
+
+
+def sweep_launcher_main(argv: Iterable[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+
+    plan_parser = commands.add_parser("plan")
+    _add_common_plan_arguments(plan_parser)
+    plan_parser.add_argument("--device-label", action="append", required=True)
+    plan_parser.add_argument("--prompt-manifest")
+    plan_parser.add_argument("--numerical-screen-workers", type=int)
+    plan_parser.add_argument("--hardware-validation-workers", type=int)
+    plan_parser.add_argument("--numerical-screen-microbatch-size", type=int)
+    plan_parser.add_argument("--hardware-validation-microbatch-size", type=int)
+    plan_parser.add_argument("--dry-run", action="store_true")
+
+    validate_parser = commands.add_parser("validate")
+    validate_parser.add_argument("--output-dir", required=True)
+    validate_parser.add_argument("--evidence", required=True)
+    validate_parser.add_argument("--report")
+
+    run_parser = commands.add_parser("run")
+    _add_common_plan_arguments(run_parser)
+    run_parser.add_argument(
+        "--stage",
+        choices=(
+            "preflight",
+            "validation-pilot",
+            "numerical-screen",
+            "hardware-validation",
+        ),
+        required=True,
+    )
+    run_parser.add_argument(
+        "--executor-factory",
+        default=DEFAULT_EXECUTOR_FACTORY,
+    )
+    run_parser.add_argument("--evidence")
+    run_parser.add_argument("--limit", type=int)
+    run_parser.add_argument("--shard-index", type=int, default=0)
+    run_parser.add_argument("--shard-count", type=int, default=1)
+    run_parser.add_argument("--device-label")
+
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    try:
+        if args.command == "plan":
+            result = create_workspace(
+                config_path=args.config,
+                output_dir=args.output_dir,
+                device_labels=args.device_label,
+                prompt_manifest_path=args.prompt_manifest,
+                numerical_screen_workers=args.numerical_screen_workers,
+                hardware_validation_workers=args.hardware_validation_workers,
+                numerical_screen_microbatch_size=args.numerical_screen_microbatch_size,
+                hardware_validation_microbatch_size=args.hardware_validation_microbatch_size,
+                dry_run=args.dry_run,
+            )
+        elif args.command == "validate":
+            result = validate_workspace(
+                output_dir=args.output_dir,
+                evidence_path=args.evidence,
+            )
+            if args.report:
+                write_immutable_json(args.report, result)
+            print(json.dumps(result, indent=2, sort_keys=True))
+            return 0 if result["passed"] else 2
+        else:
+            summary = launch_stage(
+                config_path=args.config,
+                output_dir=args.output_dir,
+                stage=args.stage,
+                executor_factory=args.executor_factory,
+                evidence_path=args.evidence,
+                limit=args.limit,
+                shard_index=args.shard_index,
+                shard_count=args.shard_count,
+                device_label=args.device_label,
+            )
+            result = {
+                "stage": args.stage,
+                "attempts_written": summary.attempts_written,
+                "succeeded": summary.succeeded,
+                "failed_terminal": summary.failed_terminal,
+                "pending": summary.pending,
+                "result_rows": summary.result_rows,
+            }
+        print(json.dumps(result, indent=2, sort_keys=True))
+        return 0
+    except Exception as error:
+        print(
+            json.dumps(
+                {
+                    "error_class": type(error).__name__,
+                    "error_message": str(error),
+                },
+                sort_keys=True,
+            ),
+            file=sys.stderr,
+        )
+        return 2
+
+
+_GPU_TOKEN = re.compile(r"^[A-Za-z0-9_.:-]+$")
+
+
+_GATED_STAGES = {"numerical-screen", "hardware-validation"}
+
+
+def parse_gpu_list(value: str) -> tuple[str, ...]:
+    devices = tuple(token.strip() for token in value.split(",") if token.strip())
+    if not devices or len(devices) != len(set(devices)):
+        raise ValueError("GPU identifiers must be non-empty and unique")
+    if any(not _GPU_TOKEN.fullmatch(device) for device in devices):
+        raise ValueError("GPU identifiers contain unsupported characters")
+    return devices
+
+
+def worker_command(
+    *,
+    config: Path,
+    output_dir: Path,
+    stage: str,
+    device_label: str,
+    shard_index: int,
+    shard_count: int,
+    evidence: Path | None,
+) -> tuple[str, ...]:
+    command = [
+        sys.executable,
+        "-m",
+        "decode_dse.software.sweep",
+        "stage",
+        "run",
+        "--config",
+        str(config),
+        "--output-dir",
+        str(output_dir),
+        "--stage",
+        stage,
+        "--device-label",
+        device_label,
+        "--shard-index",
+        str(shard_index),
+        "--shard-count",
+        str(shard_count),
+    ]
+    if evidence is not None:
+        command.extend(("--evidence", str(evidence)))
+    return tuple(command)
+
+
+def launch(
+    *,
+    config: Path,
+    output_dir: Path,
+    stage: str,
+    device_label: str,
+    devices: tuple[str, ...],
+    evidence: Path | None,
+) -> int:
+    if stage in _GATED_STAGES and evidence is None:
+        raise ValueError(f"{stage} requires preflight evidence")
+    if stage not in _GATED_STAGES and evidence is not None:
+        raise ValueError(f"{stage} does not consume preflight evidence")
+    timestamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S.%fZ")
+    log_root = output_dir / "logs" / f"{stage}-{timestamp}"
+    log_root.mkdir(parents=True, exist_ok=False)
+    processes: list[tuple[subprocess.Popen[bytes], object, Path]] = []
+    commands = []
+    try:
+        for index, device in enumerate(devices):
+            command = worker_command(
+                config=config,
+                output_dir=output_dir,
+                stage=stage,
+                device_label=device_label,
+                shard_index=index,
+                shard_count=len(devices),
+                evidence=evidence,
+            )
+            log_path = log_root / f"part-{index:04d}.log"
+            handle = log_path.open("wb")
+            environment = os.environ.copy()
+            environment["CUDA_VISIBLE_DEVICES"] = device
+            environment["CUDA_DEVICE_ORDER"] = "PCI_BUS_ID"
+            try:
+                process = subprocess.Popen(
+                    command,
+                    cwd=Path(__file__).resolve().parents[2],
+                    env=environment,
+                    stdout=handle,
+                    stderr=subprocess.STDOUT,
+                )
+            except BaseException:
+                handle.close()
+                raise
+            processes.append((process, handle, log_path))
+            commands.append(
+                {
+                    "shard_index": index,
+                    "cuda_visible_devices": device,
+                    "command": list(command),
+                    "log": str(log_path.resolve()),
+                    "progress": str(
+                        (
+                            (
+                                output_dir / stage
+                                if len(devices) == 1
+                                else output_dir
+                                / stage
+                                / f"part-{index:04d}-of-{len(devices):04d}"
+                            )
+                            / "progress.json"
+                        ).resolve()
+                    ),
+                }
+            )
+    except BaseException:
+        for process, handle, _ in processes:
+            if process.poll() is None:
+                process.terminate()
+            process.wait()
+            handle.close()
+        raise
+    return_codes = []
+    reported_updates: dict[int, str] = {}
+
+    def report_worker_progress() -> None:
+        for index, command in enumerate(commands):
+            progress_path = Path(command["progress"])
+            if not progress_path.is_file():
+                continue
+            try:
+                progress = json.loads(progress_path.read_text(encoding="utf-8"))
+            except (OSError, ValueError):
+                continue
+            identity = str(progress.get("updated_at", ""))
+            if not identity or reported_updates.get(index) == identity:
+                continue
+            reported_updates[index] = identity
+            eta = progress.get("estimated_remaining_seconds")
+            eta_text = "unknown" if eta is None else f"{float(eta):.1f}s"
+            print(
+                f"{stage} shard {index}: event={progress.get('event')} "
+                f"profiles={progress.get('completed_profiles')}/{progress.get('total_profiles')} "
+                f"unique-banks={progress.get('unique_weight_banks_opened')}/"
+                f"{progress.get('unique_weight_banks_required_this_invocation')} "
+                f"remaining-eta={eta_text}",
+                flush=True,
+            )
+
+    try:
+        while any(process.poll() is None for process, _, _ in processes):
+            report_worker_progress()
+            time.sleep(1.0)
+        report_worker_progress()
+        return_codes.extend(process.wait() for process, _, _ in processes)
+    except BaseException:
+        for process, _, _ in processes:
+            if process.poll() is None:
+                process.terminate()
+        for process, _, _ in processes:
+            process.wait()
+        raise
+    finally:
+        for _, handle, _ in processes:
+            handle.close()
+    summary = {
+        "schema_version": "decode-shard-launch",
+        "stage": stage,
+        "device_label": device_label,
+        "shard_count": len(devices),
+        "config": str(config),
+        "output_dir": str(output_dir),
+        "evidence": str(evidence) if evidence is not None else None,
+        "workers": [
+            command | {"return_code": return_codes[index]}
+            for index, command in enumerate(commands)
+        ],
+    }
+    write_immutable_json(log_root / "summary.json", summary)
+    failed = [index for index, return_code in enumerate(return_codes) if return_code]
+    if failed:
+        print(f"{stage} failed on shards {failed}", file=sys.stderr)
+        return 1
+    print(f"{stage} completed across {len(devices)} shards")
+    return 0
+
+
+def shards_main(argv: Iterable[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument(
+        "--stage",
+        choices=(
+            "preflight",
+            "validation-pilot",
+            "numerical-screen",
+            "hardware-validation",
+        ),
+        required=True,
+    )
+    parser.add_argument("--device-label", required=True)
+    parser.add_argument("--gpus", required=True)
+    parser.add_argument("--evidence", type=Path)
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    try:
+        devices = parse_gpu_list(args.gpus)
+        return launch(
+            config=args.config.resolve(),
+            output_dir=args.output_dir.resolve(),
+            stage=args.stage,
+            device_label=args.device_label,
+            devices=devices,
+            evidence=args.evidence.resolve() if args.evidence else None,
+        )
+    except (OSError, ValueError) as error:
+        parser.error(str(error))
+    return 2
+
+
+_sweep_launcher_all__ = [
+    "DEFAULT_EXECUTOR_FACTORY",
+    "ExecutorContext",
+    "ExecutorFactory",
+    "create_workspace",
+    "launch_stage",
+    "sweep_launcher_main",
+    "partition_stage_profile_ids",
+    "profile_to_decode_quant_spec",
+    "shards_main",
+    "validate_workspace",
+]
+
+
+@dataclass(frozen=True)
+class PipelineCommand:
+    name: str
+    argv: tuple[str, ...]
+    first_gpu_only: bool = False
+    outputs: tuple[Path, ...] = ()
+
+    @property
+    def command_id(self) -> str:
+        body = {
+            "name": self.name,
+            "argv": list(self.argv),
+            "first_gpu_only": self.first_gpu_only,
+            "outputs": [str(path) for path in self.outputs],
+        }
+        return hashlib.sha256(
+            json.dumps(
+                body,
+                sort_keys=True,
+                separators=(",", ":"),
+            ).encode("utf-8")
+        ).hexdigest()
+
+
+def _module_command(module: str, *arguments: str) -> tuple[str, ...]:
+    return (sys.executable, "-m", module, *arguments)
+
+
+PUBLICATION_PIPELINE_SCHEMA = "decode-publication-pipeline"
+
+_PIPELINE_ARTIFACT_FIELDS = frozenset(
+    {
+        "admission_receipt",
+        "timing_evidence",
+        "compiler_trace_artifacts",
+        "request_memory_calibration",
+        "head_service_calibration",
+        "handoff_artifact",
+        "power_calibration",
+        "area_config",
+        "exact_dc_anchors",
+        "hardware_study",
+        "refined_hardware_study",
+        "refinement_validity",
+        "refinement_schedule",
+        "refinement_promotion",
+        "refinement_results",
+        "publication_configurations",
+        "publication_benchmarks",
+        "publication_chat_template",
+        "publication_contract",
+        "publication_results",
+        "final_selection",
+        "packedkv_evidence",
+        "decode_analysis",
+        "figures",
+    }
+)
+_OPTIONAL_PIPELINE_ARTIFACT_FIELDS = frozenset(
+    {
+        "handoff_artifact",
+        "power_calibration",
+        "area_config",
+        "exact_dc_anchors",
+        "refinement_validity",
+        "packedkv_evidence",
+        "decode_analysis",
+    }
+)
+_PIPELINE_RESOURCE_FIELDS = frozenset(
+    {
+        "stride",
+        "runtime_hbm_reserve_bytes",
+        "rtl_source_tree_sha256",
+        "refinement_enabled",
+        "refinement_execution",
+        "refinement_decode_microbatch_size",
+        "bootstrap_replicates",
+        "publication_enabled",
+        "publication_executor",
+        "publication_timing_tier",
+        "figure_formats",
+    }
+)
+
+
+def _hardware_timing_arguments(
+    resources: Mapping[str, Any],
+    required_path: Callable[[str], Path],
+) -> list[str]:
+    """Build the tier-matched timing arguments for the hardware evaluator."""
+
+    timing_tier = str(resources["publication_timing_tier"])
+    if timing_tier == "compiler_trace_request_calibrated":
+        arguments = [
+            "--execution-mode",
+            "compiler_trace",
+            "--compiler-trace-artifacts",
+            str(required_path("compiler_trace_artifacts")),
+            "--request-memory-calibration",
+            str(required_path("request_memory_calibration")),
+        ]
+    else:
+        arguments = ["--execution-mode", "legacy_aggregate_bandwidth"]
+    arguments.extend(("--publication-timing-tier", timing_tier))
+    return arguments
+
+
+def _publication_pipeline_config(
+    config: Mapping[str, Any],
+) -> tuple[Mapping[str, Any], Mapping[str, Any], Mapping[str, Any]]:
+    """Validate the declarative post-accuracy workflow without touching files."""
+
+    pipeline = config.get("publication_pipeline")
+    if not isinstance(pipeline, Mapping):
+        raise ValueError("config.publication_pipeline is required")
+    if pipeline.get("schema_version") != PUBLICATION_PIPELINE_SCHEMA:
+        raise ValueError("unsupported publication_pipeline schema_version")
+    if set(pipeline) != {"schema_version", "artifacts", "resources"}:
+        raise ValueError("publication_pipeline fields differ from its schema")
+    artifacts = pipeline.get("artifacts")
+    resources = pipeline.get("resources")
+    if not isinstance(artifacts, Mapping) or set(artifacts) != _PIPELINE_ARTIFACT_FIELDS:
+        raise ValueError("publication_pipeline.artifacts fields differ from its schema")
+    if not isinstance(resources, Mapping) or set(resources) != _PIPELINE_RESOURCE_FIELDS:
+        raise ValueError("publication_pipeline.resources fields differ from its schema")
+    for name, value in artifacts.items():
+        if name in _OPTIONAL_PIPELINE_ARTIFACT_FIELDS and value is None:
+            continue
+        if not isinstance(value, str) or not value:
+            raise ValueError(
+                f"publication_pipeline.artifacts.{name} must be a non-empty path"
+            )
+    for name in ("stride", "refinement_decode_microbatch_size"):
+        value = resources.get(name)
+        if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+            raise ValueError(
+                f"publication_pipeline.resources.{name} must be a positive integer"
+            )
+    reserve = resources.get("runtime_hbm_reserve_bytes")
+    if isinstance(reserve, bool) or not isinstance(reserve, int) or reserve < 0:
+        raise ValueError(
+            "publication_pipeline.resources.runtime_hbm_reserve_bytes must be "
+            "a non-negative integer"
+        )
+    for name in ("refinement_enabled", "publication_enabled"):
+        if not isinstance(resources.get(name), bool):
+            raise ValueError(
+                f"publication_pipeline.resources.{name} must be a boolean"
+            )
+    if resources["publication_enabled"] and not resources["refinement_enabled"]:
+        raise ValueError(
+            "publication execution requires refined-profile evaluation and repricing"
+        )
+    if resources.get("refinement_execution") != "four_logical_shards":
+        raise ValueError(
+            "publication_pipeline.resources.refinement_execution must be "
+            "four_logical_shards"
+        )
+    replicates = resources.get("bootstrap_replicates")
+    if (
+        isinstance(replicates, bool)
+        or not isinstance(replicates, int)
+        or replicates < 100
+    ):
+        raise ValueError(
+            "publication_pipeline.resources.bootstrap_replicates must be at least 100"
+        )
+    executor = resources.get("publication_executor")
+    if not isinstance(executor, str) or not executor:
+        raise ValueError(
+            "publication_pipeline.resources.publication_executor must be non-empty"
+        )
+    from decode_dse.hardware.design_space import PUBLICATION_TIMING_TIERS
+
+    if resources.get("publication_timing_tier") not in PUBLICATION_TIMING_TIERS:
+        raise ValueError(
+            "publication_pipeline.resources.publication_timing_tier must be "
+            "one of " + ", ".join(sorted(PUBLICATION_TIMING_TIERS))
+        )
+    formats = resources.get("figure_formats")
+    if (
+        not isinstance(formats, list)
+        or not formats
+        or len(formats) != len(set(formats))
+        or any(value not in {"png", "pdf", "svg"} for value in formats)
+    ):
+        raise ValueError(
+            "publication_pipeline.resources.figure_formats must be unique PNG/PDF/SVG formats"
+        )
+    rtl_digest = resources.get("rtl_source_tree_sha256")
+    if rtl_digest is not None and (
+        not isinstance(rtl_digest, str)
+        or not re.fullmatch(r"[0-9a-f]{64}", rtl_digest)
+    ):
+        raise ValueError(
+            "publication_pipeline.resources.rtl_source_tree_sha256 must be null or SHA-256"
+        )
+    if bool(artifacts["power_calibration"]) != bool(artifacts["area_config"]):
+        raise ValueError(
+            "publication pipeline power_calibration and area_config must be supplied together"
+        )
+    if bool(artifacts["exact_dc_anchors"]) != bool(rtl_digest):
+        raise ValueError(
+            "publication pipeline exact_dc_anchors and rtl_source_tree_sha256 "
+            "must be supplied together"
+        )
+    if artifacts["exact_dc_anchors"] and not artifacts["power_calibration"]:
+        raise ValueError("publication pipeline exact DC anchors require power calibration")
+    return pipeline, artifacts, resources
+
+
+def _resolve_publication_pipeline_paths(
+    artifacts: Mapping[str, Any],
+    *,
+    repository: Path,
+    output_dir: Path,
+) -> dict[str, Path | None]:
+    resolved: dict[str, Path | None] = {}
+    for name, value in artifacts.items():
+        if value is None:
+            resolved[name] = None
+            continue
+        if value.startswith("simulator://"):
+            suffix = value.removeprefix("simulator://")
+            relative = Path(suffix)
+            if not suffix or relative.is_absolute() or ".." in relative.parts:
+                raise ValueError(f"invalid simulator-bound path: {value!r}")
+            simulator = Path(
+                os.environ.get(
+                    "PLENA_SIMULATOR_PATH",
+                    str(
+                        Path(__file__).resolve().parents[3]
+                        / "PLENA_Simulator"
+                    ),
+                )
+            ).resolve()
+            path = (simulator / relative).resolve()
+            try:
+                path.relative_to(simulator)
+            except ValueError as exc:
+                raise ValueError(
+                    f"simulator-bound path escapes its root: {value!r}"
+                ) from exc
+            resolved[name] = path
+            continue
+        resolved[name] = resolve_bound_path(
+            value,
+            repository_root=repository,
+            workspace_root=output_dir,
+        )
+    return resolved
+
+
+def _stage_partition_roots(
+    output_dir: Path,
+    stage: str,
+    count: int,
+) -> tuple[Path, ...]:
+    if count == 1:
+        return (output_dir / stage,)
+    return tuple(
+        output_dir / stage / f"part-{index:04d}-of-{count:04d}"
+        for index in range(count)
+    )
+
+
+def _partitioned_artifact(path: Path, index: int, count: int) -> Path:
+    if count == 1:
+        return path
+    return path.with_name(
+        f"{path.stem}.part-{index:04d}-of-{count:04d}{path.suffix}"
+    )
+
+
+def _path_identity(path: Path) -> dict[str, Any]:
+    if path.is_file():
+        return {
+            "path": str(path.resolve()),
+            "kind": "file",
+            "size_bytes": path.stat().st_size,
+            "sha256": _sha256_file(path),
+        }
+    if path.is_dir():
+        files = tuple(sorted(item for item in path.rglob("*") if item.is_file()))
+        digest = hashlib.sha256()
+        for item in files:
+            relative = item.relative_to(path).as_posix().encode("utf-8")
+            payload_hash = _sha256_file(item).encode("ascii")
+            digest.update(len(relative).to_bytes(8, "little"))
+            digest.update(relative)
+            digest.update(payload_hash)
+        return {
+            "path": str(path.resolve()),
+            "kind": "directory",
+            "file_count": len(files),
+            "tree_sha256": digest.hexdigest(),
+        }
+    raise FileNotFoundError(path)
+
+
+def validate_publication_evidence(
+    *,
+    config: Path,
+    output_dir: Path,
+    report: Path,
+) -> Mapping[str, Any]:
+    """Fail before GPU work when required physical evidence is unavailable."""
+
+    repository = Path(__file__).resolve().parents[2]
+    value = _load_config(config)
+    _, artifact_values, resources = _publication_pipeline_config(value)
+    paths = _resolve_publication_pipeline_paths(
+        artifact_values,
+        repository=repository,
+        output_dir=output_dir,
+    )
+
+    def require(name: str) -> Path:
+        path = paths[name]
+        if path is None or not path.exists():
+            raise FileNotFoundError(
+                f"required publication artifact {name} is missing: {path}"
+            )
+        return path
+
+    timing_path = require("timing_evidence")
+    from decode_dse.simulator_bridge import _disagg
+
+    timing = _disagg().TimingEvidence.load(timing_path)
+    if timing.mode not in ("rtl_serialized", "emulator_serialized") or not timing.passed:
+        raise ValueError(
+            "timing_evidence must be passing serialized-contract evidence "
+            "(rtl_serialized or emulator_serialized) for the production study"
+        )
+
+    head_path = require("head_service_calibration")
+    architecture = value.get("model_architecture")
+    space = value.get("hardware_space")
+    if not isinstance(architecture, Mapping) or not isinstance(space, Mapping):
+        raise ValueError("model_architecture and hardware_space are required")
+    batches = space.get("BATCH")
+    if not isinstance(batches, list):
+        raise ValueError("hardware_space.BATCH must be a list")
+    from decode_dse.hardware.lm_head_service import (
+        load_bf16_head_service_artifact,
+    )
+
+    head = load_bf16_head_service_artifact(
+        head_path,
+        model_name=str(value["model_name"]),
+        model_revision=str(value["model_revision"]),
+        hidden_size=int(architecture["hidden_size"]),
+        vocab_size=int(architecture["vocab_size"]),
+        tie_embeddings=bool(architecture["tie_word_embeddings"]),
+        required_batches=tuple(int(batch) for batch in batches),
+    )
+    if not head.passed:
+        raise ValueError(
+            "the external BF16 output-head artifact is not publication-rankable; "
+            "it must contain repeated and holdout measurements from the dedicated "
+            "prefill-chip endpoint, including numerical logits, remote-link timing, "
+            "component dynamic energy, and leakage evidence: "
+            + "; ".join(head.failures)
+        )
+
+    required_inputs = {
+        "admission_receipt",
+        "compiler_trace_artifacts",
+        "request_memory_calibration",
+    }
+    optional_inputs = {
+        "handoff_artifact",
+        "power_calibration",
+        "area_config",
+        "exact_dc_anchors",
+        "refinement_validity",
+        "packedkv_evidence",
+        "decode_analysis",
+    }
+    identities = {
+        "timing_evidence": _path_identity(timing_path),
+        "head_service_calibration": _path_identity(head_path),
+    }
+    for name in sorted(required_inputs):
+        identities[name] = _path_identity(require(name))
+    for name in sorted(optional_inputs):
+        path = paths[name]
+        if path is not None:
+            identities[name] = _path_identity(require(name))
+    timing_tier = str(resources["publication_timing_tier"])
+    body = {
+        "schema_version": "decode-publication-evidence-gate",
+        "model_name": value["model_name"],
+        "model_revision": value["model_revision"],
+        "timing_evidence_id": timing.evidence_id,
+        "timing_mode": timing.mode,
+        "timing_evidence_tier": timing.evidence_tier,
+        "publication_timing_tier": timing_tier,
+        "compiler_trace_artifacts_role": (
+            "exhaustive_study_pricing"
+            if timing_tier == "compiler_trace_request_calibrated"
+            else "spot_check_only"
+        ),
+        "head_service": head.to_dict(),
+        "artifacts": identities,
+    }
+    write_immutable_json(report, body)
+    return body
+
+
+def pipeline_evidence_main(argv: Iterable[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=validate_publication_evidence.__doc__)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument("--report", type=Path, required=True)
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    result = validate_publication_evidence(
+        config=args.config.resolve(),
+        output_dir=args.output_dir.resolve(),
+        report=args.report.resolve(),
+    )
+    print(json.dumps(result, indent=2, sort_keys=True))
+    return 0
+
+
+def publication_gate_main(argv: Iterable[str] | None = None) -> int:
+    """Seal the benchmark-selected hardware deployment or fail closed."""
+
+    parser = argparse.ArgumentParser(description=publication_gate_main.__doc__)
+    parser.add_argument("--contract", type=Path, required=True)
+    parser.add_argument("--report", type=Path, required=True)
+    parser.add_argument(
+        "--hardware-artifact",
+        type=Path,
+        action="append",
+        required=True,
+    )
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    from decode_dse.software.benchmark_runner import (
+        PUBLICATION_REPORT_SCHEMA,
+        PublicationContract,
+    )
+
+    contract_value = load_immutable_json(args.contract)
+    contract_value.pop("content_hash", None)
+    contract = PublicationContract.from_dict(contract_value)
+    report = load_immutable_json(args.report)
+    if report.get("schema_version") != PUBLICATION_REPORT_SCHEMA:
+        raise ValueError("unsupported publication benchmark report")
+    if report.get("contract_hash") != contract.canonical_hash:
+        raise ValueError("publication report differs from its contract")
+    selection = report.get("selection")
+    if not isinstance(selection, Mapping) or selection.get("selected") is not True:
+        raise ValueError("publication accuracy gates did not select a deployment")
+    passing_ids = selection.get("accuracy_configuration_ids")
+    if (
+        not isinstance(passing_ids, list)
+        or not passing_ids
+        or any(not isinstance(value, str) or not value for value in passing_ids)
+        or len(passing_ids) != len(set(passing_ids))
+    ):
+        raise ValueError("publication report accuracy-pass coverage is invalid")
+    configuration_by_id = {
+        item.configuration_id: item for item in contract.configurations
+    }
+    if any(
+        configuration_id not in configuration_by_id
+        or configuration_by_id[configuration_id].role == "bf16"
+        for configuration_id in passing_ids
+    ):
+        raise ValueError("publication report selected an unknown accuracy configuration")
+    contract_order = [
+        item.configuration_id
+        for item in contract.configurations
+        if item.configuration_id in set(passing_ids)
+    ]
+    if passing_ids != contract_order:
+        raise ValueError("publication accuracy-pass configurations are reordered")
+    from decode_dse.hardware.design_space import (
+        HARDWARE_STORAGE_REVISION,
+        load_hardware_artifact,
+    )
+
+    artifacts_by_sha: dict[str, tuple[Mapping[str, Any], tuple[Mapping[str, Any], ...]]] = {}
+    component_artifacts = []
+    for path in args.hardware_artifact:
+        artifact_sha256 = _sha256_file(path)
+        if artifact_sha256 in artifacts_by_sha:
+            raise ValueError("publication hardware artifacts are duplicated")
+        header, rows = load_hardware_artifact(path)
+        if header.get("storage_revision") != HARDWARE_STORAGE_REVISION:
+            raise ValueError("publication requires factorized exact hardware artifacts")
+        artifacts_by_sha[artifact_sha256] = (header, rows)
+        component_artifacts.append(
+            {
+                "path": str(path.resolve()),
+                "sha256": artifact_sha256,
+                "run_id": header["run_id"],
+                "factor_evaluation_count": header["factor_evaluation_count"],
+                "factor_evaluation_sha256": header[
+                    "factor_evaluation_sha256"
+                ],
+                "ordered_membership_map_sha256": header[
+                    "ordered_membership_map_sha256"
+                ],
+                "expansion_contract_sha256": header[
+                    "expansion_contract_sha256"
+                ],
+                "conceptual_result_count": header[
+                    "conceptual_result_count"
+                ],
+            }
+        )
+    referenced_artifacts = {
+        alternative.hardware_artifact_sha256
+        for alternative in contract.hardware_alternatives
+    }
+    if set(artifacts_by_sha) != referenced_artifacts:
+        raise ValueError("publication hardware artifact coverage differs from contract")
+
+    joined_alternatives = []
+    for alternative in contract.hardware_alternatives:
+        configuration = configuration_by_id[alternative.configuration_id]
+        header, rows = artifacts_by_sha[alternative.hardware_artifact_sha256]
+        matched = tuple(
+            row for row in rows if row.get("record_hash") == alternative.record_hash
+        )
+        if len(matched) != 1:
+            raise ValueError("publication hardware row is missing or duplicated")
+        row = matched[0]
+        labels = row.get("retention_labels")
+        metrics = row.get("metrics")
+        whole = metrics.get("whole_model") if isinstance(metrics, Mapping) else None
+        energy = (
+            whole.get("calibrated_energy")
+            if isinstance(whole, Mapping)
+            else None
+        )
+        source_profile = getattr(configuration.profile, "source_profile", None)
+        observed_source_id = (
+            source_profile.profile_id
+            if source_profile is not None
+            else configuration.profile.profile_id
+        )
+        if (
+            not isinstance(labels, list)
+            or "profile_frontier" not in labels
+            or row.get("deployment_valid") is not True
+            or row.get("profile_id") != alternative.profile_id
+            or row.get("profile") != configuration.profile.to_dict()
+            or row.get("candidate_id") != alternative.candidate_id
+            or alternative.source_profile_id != observed_source_id
+            or not isinstance(whole, Mapping)
+            or whole.get("rankable") is not True
+            or not isinstance(energy, Mapping)
+            or energy.get("energy_tier") != alternative.energy_tier
+            or not math.isclose(
+                float(whole.get("tpot_ms", math.nan)),
+                alternative.tpot_ms,
+                rel_tol=1e-12,
+                abs_tol=0.0,
+            )
+            or not math.isclose(
+                float(energy.get("total_j", math.nan)),
+                alternative.energy_per_token_j,
+                rel_tol=1e-12,
+                abs_tol=0.0,
+            )
+        ):
+            raise ValueError("publication alternative differs from exact hardware evidence")
+        if alternative.configuration_id in passing_ids:
+            joined_alternatives.append((configuration, alternative, row, header))
+    if not joined_alternatives:
+        raise ValueError("no hardware alternatives cover passing accuracy configurations")
+
+    selected_configuration, selected_alternative, selected_row, selected_header = min(
+        joined_alternatives,
+        key=lambda item: (
+            0 if item[1].energy_tier == "dc_calibrated" else 1,
+            item[1].energy_per_token_j,
+            item[1].tpot_ms,
+            item[0].configuration_id,
+            item[1].profile_id,
+            item[1].candidate_id,
+            item[1].record_hash,
+        ),
+    )
+    final_selection = {
+        "configuration_id": selected_configuration.configuration_id,
+        "role": selected_configuration.role,
+        "alternative_id": selected_alternative.alternative_id,
+        "profile_id": selected_alternative.profile_id,
+        "source_profile_id": selected_alternative.source_profile_id,
+        "candidate_id": selected_alternative.candidate_id,
+        "hardware_record_hash": selected_alternative.record_hash,
+        "hardware_artifact_sha256": (
+            selected_alternative.hardware_artifact_sha256
+        ),
+        "tpot_ms": selected_alternative.tpot_ms,
+        "energy_per_token_j": selected_alternative.energy_per_token_j,
+        "energy_tier": selected_alternative.energy_tier,
+        "retention_labels": list(selected_row["retention_labels"]),
+        "factor_evaluation_sha256": selected_header[
+            "factor_evaluation_sha256"
+        ],
+        "ordered_membership_map_sha256": selected_header[
+            "ordered_membership_map_sha256"
+        ],
+        "expansion_contract_sha256": selected_header[
+            "expansion_contract_sha256"
+        ],
+    }
+    result = {
+        "schema_version": "decode-final-publication-selection",
+        "contract_hash": contract.canonical_hash,
+        "contract_sha256": _sha256_file(args.contract),
+        "benchmark_report_sha256": _sha256_file(args.report),
+        "accuracy_pass_configuration_ids": passing_ids,
+        "hardware_join": {
+            "candidate_count": len(joined_alternatives),
+            "alternative_ids": [
+                alternative.alternative_id
+                for _, alternative, _, _ in joined_alternatives
+            ],
+            "selection_order": [
+                "energy_tier_dc_before_analytic",
+                "energy_per_token_j",
+                "tpot_ms",
+                "configuration_id",
+                "profile_id",
+                "candidate_id",
+                "record_hash",
+            ],
+            "accuracy_and_hardware_joined_after_accuracy_gates": True,
+        },
+        "hardware_artifacts": component_artifacts,
+        "selection": final_selection,
+    }
+    write_immutable_json(args.output, result)
+    print(json.dumps(result, indent=2, sort_keys=True))
+    return 0
+
+
+def build_pipeline(
+    *,
+    config: Path,
+    output_dir: Path,
+    device_label: str,
+    gpus: tuple[str, ...],
+    plan: SweepRunPlan,
+    stack_validity: Path | None = None,
+) -> tuple[PipelineCommand, ...]:
+    """Build the restartable publication workflow from declared artifacts."""
+
+    repository = Path(__file__).resolve().parents[2]
+    workers = str(len(gpus))
+    correctness = output_dir / "preflight_correctness.json"
+    evidence = output_dir / "preflight_evidence.json"
+    report = output_dir / "preflight_gate_report.json"
+    publication_evidence = output_dir / "publication_evidence_gate.json"
+    stack_validity = (
+        output_dir / "stack_validity.json" if stack_validity is None else stack_validity
+    )
+    config_value = json.loads(config.read_text(encoding="utf-8"))
+    _, artifact_values, resources = _publication_pipeline_config(config_value)
+    paths = _resolve_publication_pipeline_paths(
+        artifact_values,
+        repository=repository,
+        output_dir=output_dir,
+    )
+
+    def required_path(name: str) -> Path:
+        value = paths[name]
+        if value is None:
+            raise AssertionError(f"required publication path {name} is null")
+        return value
+
+    executor = config_value.get("executor")
+    if not isinstance(executor, Mapping):
+        raise ValueError("config.executor is required")
+    sample_bundle = resolve_bound_path(
+        str(executor.get("sample_bundle", "")),
+        repository_root=repository,
+        workspace_root=output_dir,
+    )
+    refinement = config_value.get("refinement")
+    if not isinstance(refinement, Mapping):
+        raise ValueError("config.refinement is required")
+    refinement_paths = {
+        name: resolve_bound_path(
+            str(refinement.get(name, "")),
+            repository_root=repository,
+            workspace_root=output_dir,
+        )
+        for name in (
+            "sample_bundle",
+            "prefill_artifact_root",
+            "admission_artifact_root",
+            "calibration_artifact",
+            "calibration_receipt",
+            "checkpoint_root",
+        )
+    }
+    numerical_roots = _stage_partition_roots(
+        output_dir,
+        "numerical-screen",
+        len(gpus),
+    )
+    validation_roots = _stage_partition_roots(
+        output_dir,
+        "hardware-validation",
+        len(gpus),
+    )
+    hardware_studies = tuple(
+        _partitioned_artifact(
+            required_path("hardware_study"),
+            index,
+            len(validation_roots),
+        )
+        for index in range(len(validation_roots))
+    )
+    refinement_output_root = required_path("refinement_results")
+    refinement_merge_receipt = refinement_output_root / "merged" / "merge.json"
+    refinement_merged_results = (
+        refinement_output_root / "merged" / "results.jsonl"
+    )
+    refined_hardware_study = required_path("refined_hardware_study")
+    baseline_root = output_dir / "gpu_baseline"
+    baseline_contract = baseline_root / "contract.json"
+    baseline_report = baseline_root / "report.json"
+    baseline_receipt = baseline_root / "stage_receipt.json"
+    baseline_results = tuple(
+        baseline_root / f"batch-{batch_size}.json"
+        for batch_size in plan.gpu_baseline.batch_sizes
+    )
+    common_shards = (
+        "--config",
+        str(config),
+        "--output-dir",
+        str(output_dir),
+        "--device-label",
+        device_label,
+        "--gpus",
+        ",".join(gpus),
+    )
+    baseline_commands = (
+        PipelineCommand(
+            "gpu-baseline-contract",
+            _module_command(
+                "decode_dse.software.gpu_baseline",
+                "prepare",
+                "--config",
+                str(config),
+                "--sample-bundle",
+                str(sample_bundle),
+                "--provenance",
+                str(output_dir / "provenance.json"),
+                "--output",
+                str(baseline_contract),
+                "--attention-implementation",
+                plan.gpu_baseline.attention_implementation,
+                "--warmup-steps",
+                str(plan.gpu_baseline.warmup_steps),
+                "--measured-steps",
+                str(plan.gpu_baseline.measured_steps),
+                "--repetitions",
+                str(plan.gpu_baseline.repetitions),
+                "--device-labels",
+                device_label,
+                "--batch-sizes",
+                *(str(value) for value in plan.gpu_baseline.batch_sizes),
+                "--energy-meter-priority",
+                *plan.gpu_baseline.energy_meter_priority,
+                "--power-trace-sample-interval-ms",
+                str(plan.gpu_baseline.power_trace_sample_interval_ms),
+            ),
+            outputs=(baseline_contract,),
+        ),
+        *(
+            PipelineCommand(
+                f"gpu-baseline-batch-{batch_size}",
+                _module_command(
+                    "decode_dse.software.gpu_baseline",
+                    "run",
+                    "--config",
+                    str(config),
+                    "--sample-bundle",
+                    str(sample_bundle),
+                    "--contract",
+                    str(baseline_contract),
+                    "--device",
+                    "cuda:0",
+                    "--device-label",
+                    device_label,
+                    "--batch-size",
+                    str(batch_size),
+                    "--output",
+                    str(result_path),
+                ),
+                first_gpu_only=True,
+                outputs=(result_path,),
+            )
+            for batch_size, result_path in zip(
+                plan.gpu_baseline.batch_sizes,
+                baseline_results,
+            )
+        ),
+        PipelineCommand(
+            "gpu-baseline-report",
+            _module_command(
+                "decode_dse.software.gpu_baseline",
+                "merge",
+                "--contract",
+                str(baseline_contract),
+                "--results",
+                *(str(path) for path in baseline_results),
+                "--output",
+                str(baseline_report),
+            ),
+            outputs=(baseline_report,),
+        ),
+        PipelineCommand(
+            "gpu-baseline-receipt",
+            _module_command(
+                "decode_dse.software.gpu_baseline",
+                "receipt",
+                "--report",
+                str(baseline_report),
+                "--provenance",
+                str(output_dir / "provenance.json"),
+                "--output",
+                str(baseline_receipt),
+            ),
+            outputs=(baseline_receipt,),
+        ),
+    )
+    commands: list[PipelineCommand] = [
+        PipelineCommand(
+            "compiler-trace-artifacts",
+            _module_command(
+                "decode_dse.software.sweep",
+                "compiler-trace-artifacts",
+                "--config",
+                str(config),
+                "--output-dir",
+                str(output_dir),
+                "--output",
+                str(required_path("compiler_trace_artifacts")),
+            ),
+            outputs=(required_path("compiler_trace_artifacts"),),
+        ),
+        PipelineCommand(
+            "publication-evidence-gate",
+            _module_command(
+                "decode_dse.software.sweep",
+                "pipeline-evidence",
+                "--config",
+                str(config),
+                "--output-dir",
+                str(output_dir),
+                "--report",
+                str(publication_evidence),
+            ),
+            outputs=(publication_evidence,),
+        ),
+        *(
+            (
+                PipelineCommand(
+                    "publication-benchmark-manifest",
+                    _module_command(
+                        "decode_dse.software.benchmark_runner",
+                        "manifest",
+                        "--config",
+                        str(config),
+                        "--output",
+                        str(required_path("publication_benchmarks")),
+                    ),
+                    outputs=(required_path("publication_benchmarks"),),
+                ),
+                PipelineCommand(
+                    "publication-chat-template",
+                    _module_command(
+                        "decode_dse.software.benchmark_runner",
+                        "chat-template",
+                        "--config",
+                        str(config),
+                        "--output",
+                        str(required_path("publication_chat_template")),
+                    ),
+                    outputs=(required_path("publication_chat_template"),),
+                ),
+            )
+            if resources["publication_enabled"]
+            else ()
+        ),
+        PipelineCommand(
+            "preflight-numerical-screen-fidelity",
+            _module_command(
+                "decode_dse.software.sweep",
+                "shards",
+                *common_shards,
+                "--stage",
+                "preflight",
+            ),
+            outputs=_stage_partition_roots(output_dir, "preflight", len(gpus)),
+        ),
+        PipelineCommand(
+            "validation-pilot-fidelity",
+            _module_command(
+                "decode_dse.software.sweep",
+                "shards",
+                *common_shards,
+                "--stage",
+                "validation-pilot",
+            ),
+            outputs=_stage_partition_roots(
+                output_dir,
+                "validation-pilot",
+                len(gpus),
+            ),
+        ),
+        PipelineCommand(
+            "correctness",
+            _module_command(
+                "decode_dse.software.preflight",
+                "check",
+                "run",
+                "--config",
+                str(config),
+                "--output-dir",
+                str(output_dir),
+                "--device-label",
+                device_label,
+                "--out",
+                str(correctness),
+            ),
+            first_gpu_only=True,
+            outputs=(correctness,),
+        ),
+        PipelineCommand(
+            "build-preflight-evidence",
+            _module_command(
+                "decode_dse.software.preflight",
+                "evidence",
+                "--output-dir",
+                str(output_dir),
+                "--correctness",
+                str(correctness),
+                "--stack-validity",
+                str(stack_validity),
+                "--numerical-screen-workers",
+                workers,
+                "--hardware-validation-workers",
+                workers,
+                "--out",
+                str(evidence),
+            ),
+            outputs=(evidence,),
+        ),
+        PipelineCommand(
+            "validate-preflight",
+            _module_command(
+                "decode_dse.software.sweep",
+                "stage",
+                "validate",
+                "--output-dir",
+                str(output_dir),
+                "--evidence",
+                str(evidence),
+                "--report",
+                str(report),
+            ),
+            outputs=(report,),
+        ),
+        *baseline_commands,
+        PipelineCommand(
+            "numerical-screen",
+            _module_command(
+                "decode_dse.software.sweep",
+                "shards",
+                *common_shards,
+                "--stage",
+                "numerical-screen",
+                "--evidence",
+                str(evidence),
+            ),
+            outputs=numerical_roots,
+        ),
+        PipelineCommand(
+            "hardware-validation",
+            _module_command(
+                "decode_dse.software.sweep",
+                "shards",
+                *common_shards,
+                "--stage",
+                "hardware-validation",
+                "--evidence",
+                str(evidence),
+            ),
+            outputs=validation_roots,
+        ),
+    ]
+
+    for index, (validation_root, hardware_study) in enumerate(
+        zip(validation_roots, hardware_studies)
+    ):
+        hardware_arguments = [
+            "--manifest",
+            str(validation_root / "manifest.json"),
+            "--numerical-jsonl",
+            str(validation_root),
+            "--config",
+            str(config),
+            "--timing-evidence",
+            str(required_path("timing_evidence")),
+            *_hardware_timing_arguments(resources, required_path),
+            "--stride",
+            str(resources["stride"]),
+            "--runtime-hbm-reserve-bytes",
+            str(resources["runtime_hbm_reserve_bytes"]),
+            "--head-service-calibration",
+            str(required_path("head_service_calibration")),
+            "--admission-receipt",
+            str(required_path("admission_receipt")),
+            "--output",
+            str(hardware_study),
+        ]
+        optional_hardware_paths = (
+            ("handoff_artifact", "--handoff-artifact"),
+            ("power_calibration", "--power-calibration"),
+            ("area_config", "--area-config"),
+            ("exact_dc_anchors", "--exact-dc-anchors"),
+        )
+        for name, flag in optional_hardware_paths:
+            value = paths[name]
+            if value is not None:
+                hardware_arguments.extend((flag, str(value)))
+        if resources["rtl_source_tree_sha256"] is not None:
+            hardware_arguments.extend(
+                (
+                    "--rtl-source-tree-sha256",
+                    str(resources["rtl_source_tree_sha256"]),
+                )
+            )
+        commands.append(
+            PipelineCommand(
+                f"exact-hardware-study-part-{index:04d}",
+                _module_command(
+                    "decode_dse.hardware.evaluation",
+                    *hardware_arguments,
+                ),
+                outputs=(
+                    hardware_study,
+                    hardware_study.with_name(f"{hardware_study.name}.meta.json"),
+                ),
+            )
+        )
+
+    schedule_arguments = [
+        "--manifest",
+        str(output_dir / "manifest.json"),
+        "--run-plan",
+        str(output_dir / "run_plan.json"),
+    ]
+    for path in numerical_roots:
+        schedule_arguments.extend(("--numerical-screen-results", str(path)))
+    for path in validation_roots:
+        schedule_arguments.extend(("--hardware-validation-results", str(path)))
+    for path in hardware_studies:
+        schedule_arguments.extend(("--hardware-study", str(path)))
+    if paths["refinement_validity"] is not None:
+        schedule_arguments.extend(
+            ("--validity", str(paths["refinement_validity"]))
+        )
+    schedule_arguments.extend(
+        (
+            "--schedule",
+            str(required_path("refinement_schedule")),
+            "--promotion",
+            str(required_path("refinement_promotion")),
+        )
+    )
+    commands.append(
+        PipelineCommand(
+            "joint-selection",
+            _module_command(
+                "decode_dse.software.refinement_schedule",
+                *schedule_arguments,
+            ),
+            outputs=(
+                required_path("refinement_schedule"),
+                required_path("refinement_promotion"),
+            ),
+        )
+    )
+
+    if resources["refinement_enabled"]:
+        commands.extend(
+            (
+                PipelineCommand(
+                    "refinement-samples",
+                    _module_command(
+                        "decode_dse.software.refinement_runner",
+                        "prepare",
+                        "samples",
+                        "--config",
+                        str(config),
+                        "--source-bundle",
+                        str(sample_bundle),
+                        "--output",
+                        str(refinement_paths["sample_bundle"]),
+                    ),
+                    outputs=(refinement_paths["sample_bundle"],),
+                ),
+                PipelineCommand(
+                    "refinement-prefill",
+                    _module_command(
+                        "decode_dse.software.refinement_runner",
+                        "prepare",
+                        "prefill",
+                        "--config",
+                        str(config),
+                        "--sample-bundle",
+                        str(refinement_paths["sample_bundle"]),
+                        "--artifact-root",
+                        str(refinement_paths["prefill_artifact_root"]),
+                    ),
+                    first_gpu_only=True,
+                    outputs=(
+                        refinement_paths["prefill_artifact_root"] / "index.json",
+                    ),
+                ),
+                PipelineCommand(
+                    "refinement-calibration",
+                    _module_command(
+                        "decode_dse.software.refinement_runner",
+                        "prepare",
+                        "calibration",
+                        "--config",
+                        str(config),
+                        "--output",
+                        str(refinement_paths["calibration_artifact"]),
+                        "--receipt",
+                        str(refinement_paths["calibration_receipt"]),
+                    ),
+                    first_gpu_only=True,
+                    outputs=(
+                        refinement_paths["calibration_artifact"],
+                        refinement_paths["calibration_receipt"],
+                    ),
+                ),
+                PipelineCommand(
+                    "refinement-evaluation",
+                    _module_command(
+                        "decode_dse.software.refinement_runner",
+                        "launch",
+                        "--config",
+                        str(config),
+                        "--schedule",
+                        str(required_path("refinement_schedule")),
+                        "--sample-bundle",
+                        str(refinement_paths["sample_bundle"]),
+                        "--prefill-root",
+                        str(refinement_paths["prefill_artifact_root"]),
+                        "--admission-root",
+                        str(refinement_paths["admission_artifact_root"]),
+                        "--calibration",
+                        str(refinement_paths["calibration_artifact"]),
+                        "--calibration-receipt",
+                        str(refinement_paths["calibration_receipt"]),
+                        "--checkpoint-root",
+                        str(refinement_paths["checkpoint_root"]),
+                        "--output-root",
+                        str(refinement_output_root),
+                        "--work-root",
+                        str(refinement_output_root.with_name("work")),
+                        "--device-label",
+                        device_label,
+                        "--gpus",
+                        ",".join(gpus),
+                        "--decode-microbatch-size",
+                        str(resources["refinement_decode_microbatch_size"]),
+                        "--bootstrap-replicates",
+                        str(resources["bootstrap_replicates"]),
+                    ),
+                    outputs=(refinement_output_root,),
+                ),
+            )
+        )
+
+        refined_hardware_arguments = [
+            "--manifest",
+            str(output_dir / "manifest.json"),
+            "--refinement-schedule",
+            str(required_path("refinement_schedule")),
+            "--refinement-merge",
+            str(refinement_merge_receipt),
+            "--refinement-results",
+            str(refinement_merged_results),
+            "--config",
+            str(config),
+            "--timing-evidence",
+            str(required_path("timing_evidence")),
+            *_hardware_timing_arguments(resources, required_path),
+            "--stride",
+            str(resources["stride"]),
+            "--runtime-hbm-reserve-bytes",
+            str(resources["runtime_hbm_reserve_bytes"]),
+            "--head-service-calibration",
+            str(required_path("head_service_calibration")),
+            "--admission-receipt",
+            str(required_path("admission_receipt")),
+            "--output",
+            str(refined_hardware_study),
+        ]
+        for name, flag in (
+            ("handoff_artifact", "--handoff-artifact"),
+            ("power_calibration", "--power-calibration"),
+            ("area_config", "--area-config"),
+            ("exact_dc_anchors", "--exact-dc-anchors"),
+        ):
+            value = paths[name]
+            if value is not None:
+                refined_hardware_arguments.extend((flag, str(value)))
+        if resources["rtl_source_tree_sha256"] is not None:
+            refined_hardware_arguments.extend(
+                (
+                    "--rtl-source-tree-sha256",
+                    str(resources["rtl_source_tree_sha256"]),
+                )
+            )
+        commands.extend(
+            (
+                PipelineCommand(
+                    "refined-hardware-study",
+                    _module_command(
+                        "decode_dse.hardware.evaluation",
+                        *refined_hardware_arguments,
+                    ),
+                    outputs=(
+                        refined_hardware_study,
+                        refined_hardware_study.with_name(
+                            f"{refined_hardware_study.name}.meta.json"
+                        ),
+                    ),
+                ),
+                PipelineCommand(
+                    "publication-configurations",
+                    _module_command(
+                        "decode_dse.software.benchmark_runner",
+                        "configurations",
+                        "--manifest",
+                        str(output_dir / "manifest.json"),
+                        "--refinement-schedule",
+                        str(required_path("refinement_schedule")),
+                        "--source-selection",
+                        str(required_path("refinement_promotion")),
+                        "--refinement-merge",
+                        str(refinement_merge_receipt),
+                        "--refinement-results",
+                        str(refinement_merged_results),
+                        "--hardware-artifact",
+                        str(refined_hardware_study),
+                        "--output",
+                        str(required_path("publication_configurations")),
+                    ),
+                    outputs=(required_path("publication_configurations"),),
+                ),
+            )
+        )
+
+    if resources["publication_enabled"]:
+        commands.extend(
+            (
+                PipelineCommand(
+                    "publication-contract",
+                    _module_command(
+                        "decode_dse.software.benchmark_runner",
+                        "contract",
+                        "--config",
+                        str(config),
+                        "--configurations",
+                        str(required_path("publication_configurations")),
+                        "--benchmarks",
+                        str(required_path("publication_benchmarks")),
+                        "--chat-template",
+                        str(required_path("publication_chat_template")),
+                        "--output",
+                        str(required_path("publication_contract")),
+                    ),
+                    outputs=(required_path("publication_contract"),),
+                ),
+                PipelineCommand(
+                    "publication-benchmarks",
+                    _module_command(
+                        "decode_dse.software.benchmark_runner",
+                        "run",
+                        "--config",
+                        str(config),
+                        "--contract",
+                        str(required_path("publication_contract")),
+                        "--executor",
+                        str(resources["publication_executor"]),
+                        "--output-dir",
+                        str(required_path("publication_results")),
+                        "--bootstrap-replicates",
+                        str(resources["bootstrap_replicates"]),
+                    ),
+                    first_gpu_only=True,
+                    outputs=(
+                        required_path("publication_results")
+                        / "publication_report.json",
+                    ),
+                ),
+                PipelineCommand(
+                    "final-publication-selection",
+                    _module_command(
+                        "decode_dse.software.sweep",
+                        "publication-gate",
+                        "--contract",
+                        str(required_path("publication_contract")),
+                        "--report",
+                        str(
+                            required_path("publication_results")
+                            / "publication_report.json"
+                        ),
+                        "--hardware-artifact",
+                        str(refined_hardware_study),
+                        "--output",
+                        str(required_path("final_selection")),
+                    ),
+                    outputs=(required_path("final_selection"),),
+                ),
+            )
+        )
+
+    plot_arguments = [
+        "--manifest",
+        str(output_dir / "manifest.json"),
+    ]
+    for path in numerical_roots:
+        plot_arguments.extend(("--numerical", str(path)))
+    for path in validation_roots:
+        plot_arguments.extend(("--validation-numerical", str(path)))
+    for path in hardware_studies:
+        plot_arguments.extend(("--hardware-artifact", str(path)))
+    for name, flag in (
+        ("packedkv_evidence", "--packedkv-evidence"),
+        ("decode_analysis", "--decode-analysis"),
+    ):
+        if paths[name] is not None:
+            plot_arguments.extend((flag, str(paths[name])))
+    if resources["publication_enabled"]:
+        plot_arguments.extend(
+            (
+                "--config",
+                str(config),
+                "--gpu-baseline-report",
+                str(baseline_report),
+                "--gpu-baseline-receipt",
+                str(baseline_receipt),
+                "--publication-contract",
+                str(required_path("publication_contract")),
+                "--publication-report",
+                str(
+                    required_path("publication_results")
+                    / "publication_report.json"
+                ),
+                "--final-selection",
+                str(required_path("final_selection")),
+                "--refined-hardware-artifact",
+                str(refined_hardware_study),
+            )
+        )
+    plot_arguments.extend(
+        (
+            "--output-dir",
+            str(required_path("figures")),
+            "--formats",
+            *(str(value) for value in resources["figure_formats"]),
+        )
+    )
+    commands.append(
+        PipelineCommand(
+            "publication-figures",
+            _module_command("decode_dse.plots", *plot_arguments),
+            outputs=(required_path("figures"),),
+        )
+    )
+    return tuple(commands)
+
+
+def _resolve_config_path(
+    repository: Path,
+    output_dir: Path,
+    value: str,
+) -> Path:
+    return resolve_bound_path(
+        value,
+        repository_root=repository,
+        workspace_root=output_dir,
+    )
+
+
+def _validate_bound_launch_artifacts(
+    *,
+    repository: Path,
+    config: Path,
+    value: Mapping[str, object],
+    output_dir: Path,
+    plan: SweepRunPlan,
+    validity_path: Path,
+) -> None:
+    """Validate immutable numerical, admission, and stack-evidence bindings."""
+
+    validate_sweep_config(value)
+    seed = int(value.get("seed", 0))
+    initialize_numerical_runtime(seed)
+    current_runtime = capture_runtime_environment(
+        str(value.get("device", "cuda:0")),
+        seed=seed,
+    )
+    require_runtime_environment(
+        output_dir / "runtime_environment.json",
+        current_runtime,
+    )
+    manifest = load_manifest(output_dir / "manifest.json")
+    prompts = _load_prompts(output_dir / "prompt_manifest.json")
+    validate_run_plan(plan, manifest)
+    _validate_provenance(
+        output_dir / "provenance.json",
+        repository=repository,
+        config_path=config,
+        manifest=manifest,
+        plan=plan,
+        prompts=prompts,
+    )
+
+    executor = value.get("executor")
+    if not isinstance(executor, Mapping):
+        raise ValueError("config.executor is required")
+    sample_path = _resolve_config_path(
+        repository,
+        output_dir,
+        str(executor.get("sample_bundle", "")),
+    )
+    if not sample_path.is_file():
+        raise FileNotFoundError(sample_path)
+    bundle = load_sample_bundle(sample_path)
+    if bundle.prompt_manifest() != prompts:
+        raise ValueError("sample bundle differs from the immutable workspace")
+
+    prefill_root = _resolve_config_path(
+        repository,
+        output_dir,
+        str(executor.get("prefill_artifact_root", "")),
+    )
+    if not (prefill_root / "index.json").is_file():
+        raise FileNotFoundError(prefill_root / "index.json")
+
+    expected_documents = (
+        NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count
+        + HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+    )
+    receipt = load_immutable_json(output_dir / "admission_preparation.json")
+    if (
+        receipt.get("schema_version") != "decode-admission-preparation"
+        or receipt.get("manifest_hash") != manifest.canonical_hash
+        or receipt.get("run_plan_hash") != plan.canonical_hash
+        or receipt.get("prompt_manifest_hash") != prompts.canonical_hash
+        or receipt.get("quantized_format_count") != len(DECODE_FORMATS)
+        or receipt.get("document_count") != expected_documents
+        or receipt.get("artifact_count")
+        != expected_documents * (len(DECODE_FORMATS) + 1)
+        or receipt.get("runtime_environment_fingerprint")
+        != current_runtime.logical_fingerprint
+    ):
+        raise ValueError("admission preparation is not bound to the workspace")
+    admission_index = Path(str(receipt.get("admission_index_path", ""))).resolve()
+    if not admission_index.is_file():
+        raise FileNotFoundError(admission_index)
+    index = load_immutable_json(admission_index)
+    if (
+        index.get("content_hash") != receipt.get("admission_index_hash")
+        or index.get("sample_bundle_hash") != bundle.canonical_hash
+        or index.get("document_count") != expected_documents
+        or index.get("artifact_count")
+        != expected_documents * (len(DECODE_FORMATS) + 1)
+    ):
+        raise ValueError("admission index differs from its workspace receipt")
+
+    load_built_stack_validity(
+        validity_path,
+        manifest=manifest,
+        scope_profile_ids=plan.hardware_validation_profile_ids,
+        required_stages=("compiler", "emulator"),
+        scope_name="hardware-validation",
+        run_plan_hash=plan.canonical_hash,
+    )
+
+
+def _validate_pipeline_shape(
+    *,
+    config: Path,
+    output_dir: Path,
+    device_label: str,
+    gpus: tuple[str, ...],
+) -> tuple[Mapping[str, Any], SweepRunPlan]:
+    """Validate the CUDA-free pipeline identity and shard shape."""
+
+    if not config.is_file():
+        raise FileNotFoundError(config)
+    value = json.loads(config.read_text(encoding="utf-8"))
+    if not isinstance(value, Mapping):
+        raise TypeError("config must contain a JSON object")
+    architecture = value.get("model_architecture")
+    if not isinstance(architecture, Mapping):
+        raise ValueError("the gated pipeline requires model_architecture")
+    plan_path = output_dir / "run_plan.json"
+    plan = _load_plan(plan_path)
+    if plan.device_labels != (device_label,):
+        raise ValueError("the pipeline requires one homogeneous planned GPU type")
+    if plan.numerical_screen_workers != len(
+        gpus
+    ) or plan.hardware_validation_workers != len(gpus):
+        raise ValueError(
+            "GPU count must equal both immutable numerical screen and hardware validation worker counts"
+        )
+    return value, plan
+
+
+def validate_inputs(
+    *,
+    repository: Path,
+    config: Path,
+    output_dir: Path,
+    device_label: str,
+    gpus: tuple[str, ...],
+) -> SweepRunPlan:
+    """Reject an incomplete or differently sharded immutable workspace."""
+
+    value, plan = _validate_pipeline_shape(
+        config=config,
+        output_dir=output_dir,
+        device_label=device_label,
+        gpus=gpus,
+    )
+    compiler_trace_preflight = _compiler_trace_feasibility(
+        value,
+        _build_manifest(value, repository),
+    )
+    _require_compiler_trace_feasible(compiler_trace_preflight)
+    for name in (
+        "manifest.json",
+        "prompt_manifest.json",
+        "provenance.json",
+        "admission_preparation.json",
+        "runtime_environment.json",
+    ):
+        path = output_dir / name
+        if not path.is_file():
+            raise FileNotFoundError(path)
+    executor = value.get("executor")
+    if not isinstance(executor, Mapping):
+        raise ValueError("config.executor is required")
+    validity = executor.get("stack_validity_manifest")
+    if not isinstance(validity, str) or not validity:
+        raise ValueError("stack-validity artifact path is required")
+    validity_path = _resolve_config_path(repository, output_dir, validity)
+    if not validity_path.is_file():
+        raise FileNotFoundError(validity_path)
+    _validate_bound_launch_artifacts(
+        repository=repository,
+        config=config,
+        value=value,
+        output_dir=output_dir,
+        plan=plan,
+        validity_path=validity_path,
+    )
+    return plan
+
+
+def _pipeline_output_identity(path: Path) -> dict[str, Any]:
+    """Return a content identity for one declared pipeline output."""
+
+    try:
+        root_status = path.lstat()
+    except FileNotFoundError as exc:
+        raise FileNotFoundError(
+            f"pipeline command did not create declared output: {path}"
+        ) from exc
+    if stat.S_ISLNK(root_status.st_mode):
+        raise ValueError(f"pipeline output cannot be a symbolic link: {path}")
+    if stat.S_ISREG(root_status.st_mode):
+        return {
+            "path": str(path.resolve()),
+            "kind": "file",
+            "size_bytes": root_status.st_size,
+            "sha256": _sha256_file(path),
+        }
+    if not stat.S_ISDIR(root_status.st_mode):
+        raise ValueError(f"pipeline output has an unsupported file type: {path}")
+
+    digest = hashlib.sha256()
+    digest.update(b"decode-pipeline-output-tree-v1\0")
+    entry_count = 0
+    file_count = 0
+    directory_count = 0
+    size_bytes = 0
+
+    def visit(directory: Path, relative_directory: Path) -> None:
+        nonlocal entry_count, file_count, directory_count, size_bytes
+        with os.scandir(directory) as iterator:
+            entries = sorted(iterator, key=lambda item: item.name)
+        for entry in entries:
+            relative = relative_directory / entry.name
+            relative_name = relative.as_posix()
+            entry_status = entry.stat(follow_symlinks=False)
+            if stat.S_ISLNK(entry_status.st_mode):
+                raise ValueError(
+                    "pipeline output directory cannot contain symbolic links: "
+                    f"{entry.path}"
+                )
+            if stat.S_ISREG(entry_status.st_mode):
+                entry_path = Path(entry.path)
+                file_hash = _sha256_file(entry_path)
+                observed_status = entry_path.stat(follow_symlinks=False)
+                before = (
+                    entry_status.st_dev,
+                    entry_status.st_ino,
+                    entry_status.st_size,
+                    entry_status.st_mtime_ns,
+                    entry_status.st_ctime_ns,
+                )
+                after = (
+                    observed_status.st_dev,
+                    observed_status.st_ino,
+                    observed_status.st_size,
+                    observed_status.st_mtime_ns,
+                    observed_status.st_ctime_ns,
+                )
+                if before != after:
+                    raise RuntimeError(
+                        f"pipeline output changed while it was hashed: {entry.path}"
+                    )
+                record = {
+                    "path": relative_name,
+                    "kind": "file",
+                    "size_bytes": entry_status.st_size,
+                    "sha256": file_hash,
+                }
+                file_count += 1
+                size_bytes += entry_status.st_size
+            elif stat.S_ISDIR(entry_status.st_mode):
+                record = {
+                    "path": relative_name,
+                    "kind": "directory",
+                }
+                directory_count += 1
+            else:
+                raise ValueError(
+                    "pipeline output directory contains an unsupported file type: "
+                    f"{entry.path}"
+                )
+            digest.update(
+                json.dumps(
+                    record,
+                    sort_keys=True,
+                    separators=(",", ":"),
+                    allow_nan=False,
+                ).encode("utf-8")
+            )
+            digest.update(b"\n")
+            entry_count += 1
+            if record["kind"] == "directory":
+                visit(Path(entry.path), relative)
+
+    visit(path, Path())
+    return {
+        "path": str(path.resolve()),
+        "kind": "directory",
+        "tree_schema": "decode-pipeline-output-tree-v1",
+        "entry_count": entry_count,
+        "file_count": file_count,
+        "directory_count": directory_count,
+        "size_bytes": size_bytes,
+        "tree_sha256": digest.hexdigest(),
+    }
+
+
+def run_pipeline(
+    *,
+    repository: Path,
+    output_dir: Path,
+    commands: Sequence[PipelineCommand],
+    gpus: tuple[str, ...],
+) -> None:
+    """Execute commands synchronously with immutable command-level receipts."""
+
+    pipeline_root = output_dir / "pipeline"
+    completion_root = pipeline_root / "completed"
+    contract_body = {
+        "schema_version": "decode-publication-pipeline-contract",
+        "commands": [
+            {
+                "ordinal": index,
+                "name": command.name,
+                "command_id": command.command_id,
+                "argv": list(command.argv),
+                "first_gpu_only": command.first_gpu_only,
+                "outputs": [str(path) for path in command.outputs],
+            }
+            for index, command in enumerate(commands)
+        ],
+    }
+    contract_path = write_immutable_json(
+        pipeline_root / "contract.json",
+        contract_body,
+    )
+    contract = load_immutable_json(contract_path)
+    contract_hash = str(contract["content_hash"])
+
+    completion_paths: list[Path] = []
+
+    for index, command in enumerate(commands, start=1):
+        completion_path = (
+            completion_root / f"{index - 1:03d}-{command.name}.json"
+        )
+        if completion_path.is_file():
+            completion = load_immutable_json(completion_path)
+            if (
+                completion.get("schema_version")
+                != "decode-publication-pipeline-command"
+                or completion.get("contract_hash") != contract_hash
+                or completion.get("ordinal") != index - 1
+                or completion.get("name") != command.name
+                or completion.get("command_id") != command.command_id
+            ):
+                raise ValueError(
+                    f"pipeline completion receipt changed for {command.name}"
+                )
+            observed = [
+                _pipeline_output_identity(path) for path in command.outputs
+            ]
+            if completion.get("outputs") != observed:
+                raise ValueError(
+                    f"pipeline output identity changed for {command.name}"
+                )
+            completion_paths.append(completion_path)
+            print(
+                f"[{index}/{len(commands)}] {command.name} (receipt verified)",
+                flush=True,
+            )
+            continue
+        print(
+            f"[{index}/{len(commands)}] {command.name}",
+            flush=True,
+        )
+        environment = os.environ.copy()
+        if command.first_gpu_only:
+            environment["CUDA_VISIBLE_DEVICES"] = gpus[0]
+            environment["CUDA_DEVICE_ORDER"] = "PCI_BUS_ID"
+        subprocess.run(
+            command.argv,
+            cwd=repository,
+            env=environment,
+            check=True,
+        )
+        outputs = [
+            _pipeline_output_identity(path) for path in command.outputs
+        ]
+        write_immutable_json(
+            completion_path,
+            {
+                "schema_version": "decode-publication-pipeline-command",
+                "contract_hash": contract_hash,
+                "ordinal": index - 1,
+                "name": command.name,
+                "command_id": command.command_id,
+                "outputs": outputs,
+            },
+        )
+        completion_paths.append(completion_path)
+
+    write_immutable_json(
+        pipeline_root / "receipt.json",
+        {
+            "schema_version": "decode-publication-pipeline-receipt",
+            "contract_hash": contract_hash,
+            "command_count": len(commands),
+            "completed": [
+                {
+                    "ordinal": index,
+                    "name": commands[index].name,
+                    "receipt_sha256": _sha256_file(path),
+                }
+                for index, path in enumerate(completion_paths)
+            ],
+        },
+    )
+
+
+def sweep_pipeline_main(argv: Iterable[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--config", type=Path, required=True)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument("--device-label", required=True)
+    parser.add_argument("--gpus", required=True)
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args(tuple(argv) if argv is not None else None)
+    repository = Path(__file__).resolve().parents[2]
+    config = args.config.resolve()
+    output_dir = args.output_dir.resolve()
+    try:
+        gpus = parse_gpu_list(args.gpus)
+        if args.dry_run:
+            config_value, plan = _validate_pipeline_shape(
+                config=config,
+                output_dir=output_dir,
+                device_label=args.device_label,
+                gpus=gpus,
+            )
+            compiler_trace_preflight = _compiler_trace_feasibility(
+                config_value,
+                _build_manifest(config_value, repository),
+            )
+        else:
+            plan = validate_inputs(
+                repository=repository,
+                config=config,
+                output_dir=output_dir,
+                device_label=args.device_label,
+                gpus=gpus,
+            )
+        commands = build_pipeline(
+            config=config,
+            output_dir=output_dir,
+            device_label=args.device_label,
+            gpus=gpus,
+            plan=plan,
+            stack_validity=_resolve_config_path(
+                repository,
+                output_dir,
+                str(
+                    json.loads(config.read_text(encoding="utf-8"))["executor"][
+                        "stack_validity_manifest"
+                    ]
+                ),
+            ),
+        )
+        if args.dry_run:
+            print(
+                json.dumps(
+                    {
+                        "compiler_trace_preflight": compiler_trace_preflight,
+                        "unique_compiler_family_artifacts": (
+                            compiler_trace_preflight[
+                                "unique_compiler_family_artifacts"
+                            ]
+                        ),
+                        "unique_lazy_trace_instantiations": (
+                            compiler_trace_preflight[
+                                "unique_lazy_trace_instantiations"
+                            ]
+                        ),
+                        "projected_trace_generation_calls": (
+                            compiler_trace_preflight[
+                                "projected_trace_generation_calls"
+                            ]
+                        ),
+                        "projected_trace_bytes": compiler_trace_preflight[
+                            "projected_trace_bytes"
+                        ],
+                        "compiler_trace_preflight_feasible": (
+                            compiler_trace_preflight[
+                                "compiler_trace_preflight_feasible"
+                            ]
+                        ),
+                        "commands": [
+                            {
+                                "name": command.name,
+                                "argv": list(command.argv),
+                                "first_gpu_only": command.first_gpu_only,
+                                "outputs": [str(path) for path in command.outputs],
+                                "command_id": command.command_id,
+                            }
+                            for command in commands
+                        ],
+                    },
+                    indent=2,
+                )
+            )
+            return 0
+        run_pipeline(
+            repository=repository,
+            output_dir=output_dir,
+            commands=commands,
+            gpus=gpus,
+        )
+        return 0
+    except (
+        OSError,
+        RuntimeError,
+        TypeError,
+        ValueError,
+        subprocess.CalledProcessError,
+    ) as error:
+        print(
+            json.dumps(
+                {
+                    "error_class": type(error).__name__,
+                    "error_message": str(error),
+                },
+                sort_keys=True,
+            ),
+            file=sys.stderr,
+        )
+        return 2
+
+
+_sweep_pipeline_all__ = [
+    "PipelineCommand",
+    "PUBLICATION_PIPELINE_SCHEMA",
+    "_validate_bound_launch_artifacts",
+    "build_pipeline",
+    "compiler_trace_artifacts_main",
+    "pipeline_evidence_main",
+    "publication_gate_main",
+    "sweep_pipeline_main",
+    "run_pipeline",
+    "validate_publication_evidence",
+    "validate_inputs",
+]
+
+
+def dispatch(argv: Sequence[str] | None = None) -> int:
+    """Route to one of this module's commands."""
+
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    commands = {
+        "compiler-trace-artifacts": compiler_trace_artifacts_main,
+        "inputs": sweep_inputs_main,
+        "pipeline-evidence": pipeline_evidence_main,
+        "publication-gate": publication_gate_main,
+        "stage": sweep_launcher_main,
+        "shards": shards_main,
+        "pipeline": sweep_pipeline_main,
+    }
+    if not arguments or arguments[0] not in commands:
+        raise SystemExit(
+            "usage: <command> [options]; commands: " + ", ".join(sorted(commands))
+        )
+    return commands[arguments[0]](arguments[1:])
+
+
+if __name__ == "__main__":
+    raise SystemExit(dispatch())
diff --git a/decode_dse/software/sweep_plan.py b/decode_dse/software/sweep_plan.py
new file mode 100644
index 0000000..8df3d62
--- /dev/null
+++ b/decode_dse/software/sweep_plan.py
@@ -0,0 +1,2883 @@
+"""Immutable stage plans and fail-closed preflight gates for decode sweeps."""
+
+from __future__ import annotations
+
+import hashlib
+import itertools
+import json
+import math
+import os
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+
+from decode_dse.manifest import (
+    EXPECTED_BF16_REFERENCES,
+    EXPECTED_QUANTIZED_PROFILES,
+    EXPECTED_TOTAL_PROFILES,
+    EXPECTED_VECTOR_CONTROLS,
+    QuantizerProvenance,
+    QuantizerSource,
+    ResolvedImportOrigin,
+    SweepManifest,
+    SweepManifestEntry,
+)
+from decode_dse.profiles import (
+    DECODE_FORMATS,
+    PROFILE_KIND_BF16_REFERENCE,
+    PROFILE_KIND_QUANTIZED,
+    PROFILE_KIND_VECTOR_BF16_CONTROL,
+    DecodePrecisionProfile,
+    enumerate_decode_profiles,
+    format_descriptor,
+)
+
+RUN_PLAN_SCHEMA = "decode-sweep-run-plan"
+PROMPT_MANIFEST_SCHEMA = "decode-prompt-manifest"
+PREFLIGHT_EVIDENCE_SCHEMA = "decode-preflight-evidence"
+GATE_REPORT_SCHEMA = "decode-preflight-gates"
+
+PREFLIGHT_PROFILE_COUNT = 36
+NUMERICAL_SCREEN_PROFILE_COUNT = 3585
+HARDWARE_VALIDATION_QUANTIZED_PROFILE_COUNT = 492
+HARDWARE_VALIDATION_VECTOR_CONTROL_COUNT = 82
+HARDWARE_VALIDATION_PROFILE_COUNT = (
+    HARDWARE_VALIDATION_QUANTIZED_PROFILE_COUNT
+    + HARDWARE_VALIDATION_VECTOR_CONTROL_COUNT
+)
+PARITY_TOLERANCE = 1e-5
+MAX_PROJECTED_HOURS = 168.0
+WORKSPACE_PATH_PREFIX = "workspace://"
+
+
+def resolve_bound_path(
+    value: str | os.PathLike[str],
+    *,
+    repository_root: str | os.PathLike[str],
+    workspace_root: str | os.PathLike[str] | None = None,
+) -> Path:
+    """Resolve repository-relative, absolute, or workspace-bound paths."""
+
+    token = os.fspath(value)
+    repository = Path(repository_root).resolve()
+    if token.startswith(WORKSPACE_PATH_PREFIX):
+        if workspace_root is None:
+            raise ValueError("workspace_root is required for workspace-bound paths")
+        suffix = token[len(WORKSPACE_PATH_PREFIX) :]
+        relative = Path(suffix)
+        if not suffix or relative.is_absolute() or ".." in relative.parts:
+            raise ValueError(f"invalid workspace-bound path: {token!r}")
+        workspace = Path(workspace_root).resolve()
+        resolved = (workspace / relative).resolve()
+        try:
+            resolved.relative_to(workspace)
+        except ValueError as exc:
+            raise ValueError(
+                f"workspace-bound path escapes its root: {token!r}"
+            ) from exc
+        return resolved
+    path = Path(token)
+    return path.resolve() if path.is_absolute() else (repository / path).resolve()
+
+
+def _canonical_bytes(value: Mapping[str, Any]) -> bytes:
+    return json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _strict_bool(value: Any, label: str) -> bool:
+    if not isinstance(value, bool):
+        raise TypeError(f"{label} must be a boolean")
+    return value
+
+
+def write_immutable_json(
+    path: str | os.PathLike[str],
+    value: Mapping[str, Any],
+) -> Path:
+    """Atomically create a checksummed JSON file or verify an identical file."""
+
+    destination = Path(path)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    body = dict(value)
+    body.pop("content_hash", None)
+    payload = body | {"content_hash": _content_hash(body)}
+    encoded = json.dumps(payload, indent=2, sort_keys=True, allow_nan=False) + "\n"
+    if destination.exists():
+        if load_immutable_json(destination) != payload:
+            raise FileExistsError(
+                f"refusing to replace a different immutable file: {destination}"
+            )
+        return destination
+
+    temporary_name: str | None = None
+    try:
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            encoding="utf-8",
+            dir=destination.parent,
+            prefix=f".{destination.name}.",
+            suffix=".tmp",
+            delete=False,
+        ) as temporary:
+            temporary_name = temporary.name
+            temporary.write(encoded)
+            temporary.flush()
+            os.fsync(temporary.fileno())
+        os.chmod(temporary_name, 0o644)
+        try:
+            os.link(temporary_name, destination)
+        except FileExistsError:
+            if load_immutable_json(destination) != payload:
+                raise FileExistsError(
+                    f"refusing to replace a different immutable file: {destination}"
+                )
+    finally:
+        if temporary_name and os.path.exists(temporary_name):
+            os.unlink(temporary_name)
+    return destination
+
+
+def load_immutable_json(path: str | os.PathLike[str]) -> dict[str, Any]:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    expected = value.pop("content_hash", None)
+    if expected != _content_hash(value):
+        raise ValueError(f"immutable JSON checksum mismatch: {path}")
+    return value | {"content_hash": expected}
+
+
+def validate_exhaustive_manifest(manifest: SweepManifest) -> None:
+    """Require the canonical 3,585 profiles in their canonical order."""
+
+    expected_counts = {
+        PROFILE_KIND_QUANTIZED: EXPECTED_QUANTIZED_PROFILES,
+        PROFILE_KIND_VECTOR_BF16_CONTROL: EXPECTED_VECTOR_CONTROLS,
+        PROFILE_KIND_BF16_REFERENCE: EXPECTED_BF16_REFERENCES,
+        "total": EXPECTED_TOTAL_PROFILES,
+    }
+    if manifest.counts != expected_counts:
+        raise ValueError(
+            f"manifest counts differ from the exhaustive contract: {manifest.counts}"
+        )
+    expected_profiles = enumerate_decode_profiles()
+    actual_ids = tuple(entry.profile_id for entry in manifest.entries)
+    expected_ids = tuple(profile.profile_id for profile in expected_profiles)
+    if actual_ids != expected_ids:
+        mismatch = next(
+            (
+                index
+                for index, (actual, expected) in enumerate(
+                    zip(actual_ids, expected_ids)
+                )
+                if actual != expected
+            ),
+            min(len(actual_ids), len(expected_ids)),
+        )
+        raise ValueError(f"manifest profile order differs at ordinal {mismatch}")
+    for entry, profile in zip(manifest.entries, expected_profiles):
+        if entry.profile != profile:
+            raise ValueError(f"manifest profile differs at ordinal {entry.ordinal}")
+    if len(set(actual_ids)) != EXPECTED_TOTAL_PROFILES:
+        raise ValueError("manifest profile IDs are not unique")
+
+
+def _entry_features(entry: SweepManifestEntry) -> frozenset[str]:
+    profile = entry.profile
+    features = {
+        f"kind:{profile.kind}",
+        f"weight:{profile.weight_format}",
+        f"activation:{profile.activation_format}",
+        f"kv:{profile.kv_format}",
+        f"vector:{profile.vector_format}",
+        (
+            "legality:hardware_candidate"
+            if entry.legality.hardware_candidate
+            else "legality:numerical_only"
+        ),
+    }
+    if profile.kind != PROFILE_KIND_BF16_REFERENCE:
+        features.add(
+            "families:"
+            + "/".join(
+                (
+                    format_descriptor(profile.weight_format).family,
+                    format_descriptor(profile.activation_format).family,
+                    format_descriptor(profile.kv_format).family,
+                )
+            )
+        )
+    features.update(f"issue:{issue.code}" for issue in entry.legality.issues)
+    return frozenset(features)
+
+
+def preflight_required_features(
+    manifest: SweepManifest,
+) -> frozenset[str]:
+    """Return all format, family, vector, kind, and legality strata."""
+
+    return frozenset(
+        feature for entry in manifest.entries for feature in _entry_features(entry)
+    )
+
+
+def _evenly_spaced(
+    entries: Sequence[SweepManifestEntry],
+    count: int,
+) -> tuple[SweepManifestEntry, ...]:
+    if count <= 0 or not entries:
+        return ()
+    if count >= len(entries):
+        return tuple(entries)
+    if count == 1:
+        return (entries[len(entries) // 2],)
+    indices = tuple(
+        round(index * (len(entries) - 1) / (count - 1)) for index in range(count)
+    )
+    return tuple(entries[index] for index in indices)
+
+
+def select_preflight_entries(
+    manifest: SweepManifest,
+) -> tuple[SweepManifestEntry, ...]:
+    """Select 36 deterministic profiles covering every required stratum."""
+
+    validate_exhaustive_manifest(manifest)
+    features = {entry.profile_id: _entry_features(entry) for entry in manifest.entries}
+    uncovered = set(preflight_required_features(manifest))
+    selected: dict[str, SweepManifestEntry] = {}
+
+    while uncovered:
+        candidates = (
+            entry for entry in manifest.entries if entry.profile_id not in selected
+        )
+        best = max(
+            candidates,
+            key=lambda entry: (
+                len(features[entry.profile_id] & uncovered),
+                -entry.ordinal,
+            ),
+        )
+        gain = features[best.profile_id] & uncovered
+        if not gain:
+            raise AssertionError(
+                f"uncovered preflight strata are unreachable: {sorted(uncovered)}"
+            )
+        selected[best.profile_id] = best
+        uncovered.difference_update(gain)
+
+    legal_quantized = tuple(
+        entry
+        for entry in manifest.entries
+        if entry.profile.kind == PROFILE_KIND_QUANTIZED
+        and entry.legality.hardware_candidate
+    )
+    for entry in _evenly_spaced(legal_quantized, 12):
+        selected.setdefault(entry.profile_id, entry)
+
+    fill_buckets = (
+        legal_quantized,
+        tuple(
+            entry
+            for entry in manifest.entries
+            if entry.profile.kind == PROFILE_KIND_QUANTIZED
+            and not entry.legality.hardware_candidate
+        ),
+        tuple(
+            entry
+            for entry in manifest.entries
+            if entry.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+        ),
+    )
+    fill_width = PREFLIGHT_PROFILE_COUNT
+    fill_candidates = tuple(
+        entry for bucket in fill_buckets for entry in _evenly_spaced(bucket, fill_width)
+    )
+    for entry in fill_candidates:
+        if len(selected) == PREFLIGHT_PROFILE_COUNT:
+            break
+        selected.setdefault(entry.profile_id, entry)
+    if len(selected) < PREFLIGHT_PROFILE_COUNT:
+        for entry in manifest.entries:
+            if len(selected) == PREFLIGHT_PROFILE_COUNT:
+                break
+            selected.setdefault(entry.profile_id, entry)
+    if len(selected) != PREFLIGHT_PROFILE_COUNT:
+        raise AssertionError(
+            f"expected {PREFLIGHT_PROFILE_COUNT} preflight profiles, got {len(selected)}"
+        )
+
+    ordered = tuple(sorted(selected.values(), key=lambda entry: entry.ordinal))
+    covered = frozenset(
+        feature for entry in ordered for feature in features[entry.profile_id]
+    )
+    missing = preflight_required_features(manifest) - covered
+    if missing:
+        raise AssertionError(f"preflight selection misses strata: {sorted(missing)}")
+    return ordered
+
+
+@dataclass(frozen=True)
+class StageSampleContract:
+    """Pinned numerical and validation workload for one sweep stage."""
+
+    name: str
+    prompt_set: str
+    prompt_count: int
+    prefill_tokens: int
+    decode_steps: int
+    q_len: int
+    teacher_forced_cached: bool
+    compiler_required: bool
+    emulator_required: bool
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "prompt_set": self.prompt_set,
+            "prompt_count": self.prompt_count,
+            "prefill_tokens": self.prefill_tokens,
+            "decode_steps": self.decode_steps,
+            "q_len": self.q_len,
+            "teacher_forced_cached": self.teacher_forced_cached,
+            "compiler_required": self.compiler_required,
+            "emulator_required": self.emulator_required,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "StageSampleContract":
+        return cls(
+            name=str(value["name"]),
+            prompt_set=str(value["prompt_set"]),
+            prompt_count=int(value["prompt_count"]),
+            prefill_tokens=int(value["prefill_tokens"]),
+            decode_steps=int(value["decode_steps"]),
+            q_len=int(value["q_len"]),
+            teacher_forced_cached=_strict_bool(
+                value["teacher_forced_cached"], "teacher_forced_cached"
+            ),
+            compiler_required=_strict_bool(
+                value["compiler_required"], "compiler_required"
+            ),
+            emulator_required=_strict_bool(
+                value["emulator_required"], "emulator_required"
+            ),
+        )
+
+
+NUMERICAL_SCREEN_SAMPLE_CONTRACT = StageSampleContract(
+    name="numerical-screen",
+    prompt_set="numerical_screen",
+    prompt_count=16,
+    prefill_tokens=512,
+    decode_steps=16,
+    q_len=1,
+    teacher_forced_cached=True,
+    compiler_required=False,
+    emulator_required=False,
+)
+HARDWARE_VALIDATION_SAMPLE_CONTRACT = StageSampleContract(
+    name="hardware-validation",
+    prompt_set="hardware_validation",
+    prompt_count=32,
+    prefill_tokens=512,
+    decode_steps=16,
+    q_len=1,
+    teacher_forced_cached=True,
+    compiler_required=True,
+    emulator_required=True,
+)
+
+
+@dataclass(frozen=True)
+class GPUBaselinePlan:
+    """CUDA-free plan for measured cached-one-token GPU baseline work units."""
+
+    attention_implementation: str = "sdpa"
+    warmup_steps: int = 16
+    measured_steps: int = 128
+    repetitions: int = 3
+    batch_sizes: tuple[int, ...] = (1, 2, 4, 8)
+    precision: str = "BF16"
+    q_len: int = 1
+    first_gpu_only: bool = True
+    energy_meter_priority: tuple[str, ...] = (
+        "nvml_total_energy_counter",
+        "nvml_power_trace_trapezoidal",
+    )
+    power_trace_sample_interval_ms: int = 10
+
+    def __post_init__(self) -> None:
+        if self.attention_implementation != "sdpa":
+            raise ValueError("GPU baseline attention implementation must be sdpa")
+        for name in ("warmup_steps", "measured_steps", "repetitions"):
+            value = getattr(self, name)
+            if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+                raise ValueError(f"GPU baseline {name} must be a positive integer")
+        if self.repetitions < 3:
+            raise ValueError("GPU baseline requires at least three repetitions")
+        if (
+            not self.batch_sizes
+            or self.batch_sizes != tuple(sorted(set(self.batch_sizes)))
+            or any(
+                isinstance(value, bool)
+                or not isinstance(value, int)
+                or not 1 <= value <= HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+                for value in self.batch_sizes
+            )
+        ):
+            raise ValueError(
+                "GPU baseline batch sizes must be unique, increasing, and within the prompt count"
+            )
+        if self.precision != "BF16" or self.q_len != 1:
+            raise ValueError("GPU baseline must use BF16 cached q_len=1 decode")
+        if self.first_gpu_only is not True:
+            raise ValueError("GPU baseline must run on only the first physical GPU")
+        if self.energy_meter_priority != (
+            "nvml_total_energy_counter",
+            "nvml_power_trace_trapezoidal",
+        ):
+            raise ValueError("GPU baseline energy-meter priority is not canonical")
+        if (
+            isinstance(self.power_trace_sample_interval_ms, bool)
+            or not isinstance(self.power_trace_sample_interval_ms, int)
+            or not 1 <= self.power_trace_sample_interval_ms <= 1000
+        ):
+            raise ValueError(
+                "GPU baseline power-trace interval must be an integer in [1, 1000] ms"
+            )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "attention_implementation": self.attention_implementation,
+            "warmup_steps": self.warmup_steps,
+            "measured_steps": self.measured_steps,
+            "repetitions": self.repetitions,
+            "batch_sizes": list(self.batch_sizes),
+            "precision": self.precision,
+            "q_len": self.q_len,
+            "first_gpu_only": self.first_gpu_only,
+            "energy_meter_priority": list(self.energy_meter_priority),
+            "power_trace_sample_interval_ms": self.power_trace_sample_interval_ms,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUBaselinePlan":
+        return cls(
+            attention_implementation=str(value["attention_implementation"]),
+            warmup_steps=int(value["warmup_steps"]),
+            measured_steps=int(value["measured_steps"]),
+            repetitions=int(value["repetitions"]),
+            batch_sizes=tuple(int(item) for item in value["batch_sizes"]),
+            precision=str(value["precision"]),
+            q_len=int(value["q_len"]),
+            first_gpu_only=_strict_bool(
+                value["first_gpu_only"],
+                "gpu_baseline.first_gpu_only",
+            ),
+            energy_meter_priority=tuple(
+                str(item) for item in value["energy_meter_priority"]
+            ),
+            power_trace_sample_interval_ms=int(
+                value["power_trace_sample_interval_ms"]
+            ),
+        )
+
+    @classmethod
+    def from_config(cls, value: Mapping[str, Any] | None) -> "GPUBaselinePlan":
+        raw = dict(value or {})
+        defaults = cls()
+        return cls(
+            attention_implementation=str(
+                raw.get(
+                    "attention_implementation",
+                    defaults.attention_implementation,
+                )
+            ),
+            warmup_steps=int(raw.get("warmup_steps", defaults.warmup_steps)),
+            measured_steps=int(raw.get("measured_steps", defaults.measured_steps)),
+            repetitions=int(raw.get("repetitions", defaults.repetitions)),
+            batch_sizes=tuple(
+                int(item) for item in raw.get("batch_sizes", defaults.batch_sizes)
+            ),
+            precision=str(raw.get("precision", defaults.precision)),
+            q_len=int(raw.get("q_len", defaults.q_len)),
+            first_gpu_only=raw.get("first_gpu_only", defaults.first_gpu_only),
+            energy_meter_priority=tuple(
+                str(item)
+                for item in raw.get(
+                    "energy_meter_priority",
+                    defaults.energy_meter_priority,
+                )
+            ),
+            power_trace_sample_interval_ms=int(
+                raw.get(
+                    "power_trace_sample_interval_ms",
+                    defaults.power_trace_sample_interval_ms,
+                )
+            ),
+        )
+
+
+@dataclass(frozen=True)
+class SweepRunPlan:
+    """Content-addressed precision sweep and measured GPU-baseline schedule."""
+
+    manifest_hash: str
+    quantizer_provenance: QuantizerProvenance
+    preflight_profile_ids: tuple[str, ...]
+    numerical_screen_profile_ids: tuple[str, ...]
+    hardware_validation_profile_ids: tuple[str, ...]
+    device_labels: tuple[str, ...]
+    gpu_baseline: GPUBaselinePlan = GPUBaselinePlan()
+    numerical_screen_workers: int = 4
+    hardware_validation_workers: int = 4
+    numerical_screen_microbatch_size: int = 16
+    hardware_validation_microbatch_size: int = 8
+    sample_contracts: tuple[StageSampleContract, ...] = (
+        NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+        HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    )
+    parity_tolerance: float = PARITY_TOLERANCE
+    max_projected_hours: float = MAX_PROJECTED_HOURS
+    schema_version: str = RUN_PLAN_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != RUN_PLAN_SCHEMA:
+            raise ValueError(f"unsupported run-plan schema {self.schema_version!r}")
+        if not isinstance(self.gpu_baseline, GPUBaselinePlan):
+            raise TypeError("run plan requires a GPU baseline plan")
+        if len(self.preflight_profile_ids) != PREFLIGHT_PROFILE_COUNT:
+            raise ValueError("run plan requires exactly 36 preflight profiles")
+        if len(self.numerical_screen_profile_ids) != NUMERICAL_SCREEN_PROFILE_COUNT:
+            raise ValueError(
+                "run plan requires exactly 3,585 numerical-screen profiles"
+            )
+        if (
+            len(self.hardware_validation_profile_ids)
+            != HARDWARE_VALIDATION_PROFILE_COUNT
+        ):
+            raise ValueError(
+                "run plan has an unexpected hardware-validation profile count"
+            )
+        for label, values in (
+            ("preflight", self.preflight_profile_ids),
+            ("numerical_screen", self.numerical_screen_profile_ids),
+            ("hardware_validation", self.hardware_validation_profile_ids),
+            ("device", self.device_labels),
+        ):
+            if len(values) != len(set(values)):
+                raise ValueError(f"run plan contains duplicate {label} identifiers")
+        if not self.device_labels or any(not value for value in self.device_labels):
+            raise ValueError("run plan requires non-empty device labels")
+        if self.device_labels != tuple(sorted(self.device_labels)):
+            raise ValueError("run-plan device labels must be in canonical order")
+        if self.parity_tolerance <= 0 or not math.isfinite(self.parity_tolerance):
+            raise ValueError("parity tolerance must be finite and positive")
+        if self.max_projected_hours <= 0 or not math.isfinite(self.max_projected_hours):
+            raise ValueError("runtime limit must be finite and positive")
+        for name in ("numerical_screen_workers", "hardware_validation_workers"):
+            if getattr(self, name) <= 0 or getattr(self, name) > len(DECODE_FORMATS):
+                raise ValueError(f"{name} must be in [1, {len(DECODE_FORMATS)}]")
+        if (
+            not 1
+            <= self.numerical_screen_microbatch_size
+            <= NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count
+        ):
+            raise ValueError(
+                "numerical-screen microbatch size is outside the prompt count"
+            )
+        if (
+            not 1
+            <= self.hardware_validation_microbatch_size
+            <= HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+        ):
+            raise ValueError(
+                "hardware-validation microbatch size is outside the prompt count"
+            )
+
+    @property
+    def canonical_hash(self) -> str:
+        return _content_hash(self._content_dict())
+
+    @property
+    def gpu_baseline_work_units(self) -> tuple[dict[str, Any], ...]:
+        return tuple(
+            {
+                "device_label": device_label,
+                "batch_size": batch_size,
+                "first_gpu_only": self.gpu_baseline.first_gpu_only,
+            }
+            for device_label in self.device_labels
+            for batch_size in self.gpu_baseline.batch_sizes
+        )
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "manifest_hash": self.manifest_hash,
+            "quantizer_provenance": self.quantizer_provenance.to_dict(),
+            "preflight_profile_ids": list(self.preflight_profile_ids),
+            "numerical_screen_profile_ids": list(self.numerical_screen_profile_ids),
+            "hardware_validation_profile_ids": list(
+                self.hardware_validation_profile_ids
+            ),
+            "device_labels": list(self.device_labels),
+            "gpu_baseline": self.gpu_baseline.to_dict(),
+            "parallel_workers": {
+                "numerical_screen": self.numerical_screen_workers,
+                "hardware_validation": self.hardware_validation_workers,
+            },
+            "decode_microbatch_size": {
+                "numerical_screen": self.numerical_screen_microbatch_size,
+                "hardware_validation": self.hardware_validation_microbatch_size,
+            },
+            "sample_contracts": [
+                contract.to_dict() for contract in self.sample_contracts
+            ],
+            "parity_tolerance": self.parity_tolerance,
+            "max_projected_hours": self.max_projected_hours,
+        }
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"run_plan_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "SweepRunPlan":
+        plan = cls(
+            schema_version=str(value["schema_version"]),
+            manifest_hash=str(value["manifest_hash"]),
+            quantizer_provenance=QuantizerProvenance.from_dict(
+                value["quantizer_provenance"]
+            ),
+            preflight_profile_ids=tuple(value["preflight_profile_ids"]),
+            numerical_screen_profile_ids=tuple(value["numerical_screen_profile_ids"]),
+            hardware_validation_profile_ids=tuple(
+                value["hardware_validation_profile_ids"]
+            ),
+            device_labels=tuple(value["device_labels"]),
+            gpu_baseline=GPUBaselinePlan.from_dict(value["gpu_baseline"]),
+            numerical_screen_workers=int(value["parallel_workers"]["numerical_screen"]),
+            hardware_validation_workers=int(
+                value["parallel_workers"]["hardware_validation"]
+            ),
+            numerical_screen_microbatch_size=int(
+                value["decode_microbatch_size"]["numerical_screen"]
+            ),
+            hardware_validation_microbatch_size=int(
+                value["decode_microbatch_size"]["hardware_validation"]
+            ),
+            sample_contracts=tuple(
+                StageSampleContract.from_dict(contract)
+                for contract in value["sample_contracts"]
+            ),
+            parity_tolerance=float(value["parity_tolerance"]),
+            max_projected_hours=float(value["max_projected_hours"]),
+        )
+        if value.get("run_plan_hash") != plan.canonical_hash:
+            raise ValueError("run-plan content hash mismatch")
+        return plan
+
+
+def build_run_plan(
+    manifest: SweepManifest,
+    *,
+    device_labels: Sequence[str],
+    numerical_screen_workers: int = 4,
+    hardware_validation_workers: int = 4,
+    numerical_screen_microbatch_size: int = 16,
+    hardware_validation_microbatch_size: int = 8,
+    gpu_baseline: GPUBaselinePlan = GPUBaselinePlan(),
+) -> SweepRunPlan:
+    validate_exhaustive_manifest(manifest)
+    preflight = select_preflight_entries(manifest)
+    legal_triples = {
+        (
+            entry.profile.weight_format,
+            entry.profile.activation_format,
+            entry.profile.kv_format,
+        )
+        for entry in manifest.entries
+        if entry.profile.kind == PROFILE_KIND_QUANTIZED
+        and entry.legality.hardware_candidate
+    }
+    hardware_validation_entries = tuple(
+        entry
+        for entry in manifest.entries
+        if (
+            entry.profile.kind == PROFILE_KIND_QUANTIZED
+            and entry.legality.hardware_candidate
+        )
+        or (
+            entry.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+            and (
+                entry.profile.weight_format,
+                entry.profile.activation_format,
+                entry.profile.kv_format,
+            )
+            in legal_triples
+        )
+    )
+    quantized_count = sum(
+        entry.profile.kind == PROFILE_KIND_QUANTIZED
+        for entry in hardware_validation_entries
+    )
+    control_count = sum(
+        entry.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+        for entry in hardware_validation_entries
+    )
+    if (
+        quantized_count != HARDWARE_VALIDATION_QUANTIZED_PROFILE_COUNT
+        or control_count != HARDWARE_VALIDATION_VECTOR_CONTROL_COUNT
+    ):
+        raise AssertionError(
+            f"unexpected hardware-validation composition: {quantized_count} quantized, "
+            f"{control_count} controls"
+        )
+    plan = SweepRunPlan(
+        manifest_hash=manifest.canonical_hash,
+        quantizer_provenance=manifest.quantizer_provenance,
+        preflight_profile_ids=tuple(entry.profile_id for entry in preflight),
+        numerical_screen_profile_ids=tuple(
+            entry.profile_id for entry in manifest.entries
+        ),
+        hardware_validation_profile_ids=tuple(
+            entry.profile_id for entry in hardware_validation_entries
+        ),
+        device_labels=tuple(sorted(str(label) for label in device_labels)),
+        gpu_baseline=gpu_baseline,
+        numerical_screen_workers=numerical_screen_workers,
+        hardware_validation_workers=hardware_validation_workers,
+        numerical_screen_microbatch_size=numerical_screen_microbatch_size,
+        hardware_validation_microbatch_size=hardware_validation_microbatch_size,
+    )
+    validate_run_plan(plan, manifest)
+    return plan
+
+
+def validate_run_plan(plan: SweepRunPlan, manifest: SweepManifest) -> None:
+    validate_exhaustive_manifest(manifest)
+    if plan.manifest_hash != manifest.canonical_hash:
+        raise ValueError("run plan references a different manifest")
+    if plan.quantizer_provenance != manifest.quantizer_provenance:
+        raise ValueError("run plan references different quantizer arithmetic")
+    expected_preflight = tuple(
+        entry.profile_id for entry in select_preflight_entries(manifest)
+    )
+    if plan.preflight_profile_ids != expected_preflight:
+        raise ValueError("run-plan preflight selection is not canonical")
+    expected_numerical_screen = tuple(entry.profile_id for entry in manifest.entries)
+    if plan.numerical_screen_profile_ids != expected_numerical_screen:
+        raise ValueError("run-plan numerical-screen schedule is not exhaustive")
+    expected_hardware_validation = {
+        entry.profile_id
+        for entry in manifest.entries
+        if (
+            entry.profile.kind == PROFILE_KIND_QUANTIZED
+            and entry.legality.hardware_candidate
+        )
+    }
+    legal_triples = {
+        (
+            entry.profile.weight_format,
+            entry.profile.activation_format,
+            entry.profile.kv_format,
+        )
+        for entry in manifest.entries
+        if entry.profile_id in expected_hardware_validation
+    }
+    expected_hardware_validation.update(
+        entry.profile_id
+        for entry in manifest.entries
+        if entry.profile.kind == PROFILE_KIND_VECTOR_BF16_CONTROL
+        and (
+            entry.profile.weight_format,
+            entry.profile.activation_format,
+            entry.profile.kv_format,
+        )
+        in legal_triples
+    )
+    canonical_hardware_validation = tuple(
+        entry.profile_id
+        for entry in manifest.entries
+        if entry.profile_id in expected_hardware_validation
+    )
+    if plan.hardware_validation_profile_ids != canonical_hardware_validation:
+        raise ValueError(
+            "run-plan hardware-validation schedule differs from the legality contract"
+        )
+    if plan.sample_contracts != (
+        NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+        HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    ):
+        raise ValueError(
+            "run-plan sample contracts differ from numerical-screen/hardware-validation"
+        )
+    profile_by_id = {entry.profile_id: entry.profile for entry in manifest.entries}
+    for stage, profile_ids, workers in (
+        (
+            "numerical-screen",
+            plan.numerical_screen_profile_ids,
+            plan.numerical_screen_workers,
+        ),
+        (
+            "hardware-validation",
+            plan.hardware_validation_profile_ids,
+            plan.hardware_validation_workers,
+        ),
+    ):
+        weight_banks = {
+            profile_by_id[profile_id].weight_format for profile_id in profile_ids
+        }
+        if workers > len(weight_banks):
+            raise ValueError(
+                f"{stage} workers exceed its {len(weight_banks)} weight banks"
+            )
+
+
+@dataclass(frozen=True)
+class PromptRecord:
+    document_id: str
+    prompt_hash: str
+
+    def __post_init__(self) -> None:
+        if not self.document_id or not self.prompt_hash:
+            raise ValueError("prompt records require document and content hashes")
+
+    def to_dict(self) -> dict[str, str]:
+        return {
+            "document_id": self.document_id,
+            "prompt_hash": self.prompt_hash,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PromptRecord":
+        return cls(
+            document_id=str(value["document_id"]),
+            prompt_hash=str(value["prompt_hash"]),
+        )
+
+
+@dataclass(frozen=True)
+class PromptManifest:
+    dataset_name: str
+    dataset_revision: str
+    numerical_screen: tuple[PromptRecord, ...]
+    hardware_validation: tuple[PromptRecord, ...]
+    schema_version: str = PROMPT_MANIFEST_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != PROMPT_MANIFEST_SCHEMA:
+            raise ValueError(
+                f"unsupported prompt-manifest schema {self.schema_version!r}"
+            )
+        if not self.dataset_name or not self.dataset_revision:
+            raise ValueError("prompt dataset name and revision must be pinned")
+        if len(self.numerical_screen) != NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count:
+            raise ValueError(
+                "numerical screen requires exactly "
+                f"{NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count} prompt records"
+            )
+        if (
+            len(self.hardware_validation)
+            != HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+        ):
+            raise ValueError(
+                "hardware validation requires exactly "
+                f"{HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count} prompt records"
+            )
+        all_records = self.numerical_screen + self.hardware_validation
+        document_ids = tuple(record.document_id for record in all_records)
+        prompt_hashes = tuple(record.prompt_hash for record in all_records)
+        if len(document_ids) != len(set(document_ids)):
+            raise ValueError(
+                "numerical-screen and hardware-validation documents must be disjoint"
+            )
+        if len(prompt_hashes) != len(set(prompt_hashes)):
+            raise ValueError(
+                "numerical-screen and hardware-validation prompts must be disjoint"
+            )
+
+    @property
+    def canonical_hash(self) -> str:
+        return _content_hash(self._content_dict())
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "dataset_name": self.dataset_name,
+            "dataset_revision": self.dataset_revision,
+            "numerical_screen": [record.to_dict() for record in self.numerical_screen],
+            "hardware_validation": [
+                record.to_dict() for record in self.hardware_validation
+            ],
+        }
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"prompt_manifest_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PromptManifest":
+        prompt_manifest = cls(
+            schema_version=str(value["schema_version"]),
+            dataset_name=str(value["dataset_name"]),
+            dataset_revision=str(value["dataset_revision"]),
+            numerical_screen=tuple(
+                PromptRecord.from_dict(record) for record in value["numerical_screen"]
+            ),
+            hardware_validation=tuple(
+                PromptRecord.from_dict(record)
+                for record in value["hardware_validation"]
+            ),
+        )
+        if value.get("prompt_manifest_hash") != prompt_manifest.canonical_hash:
+            raise ValueError("prompt-manifest content hash mismatch")
+        return prompt_manifest
+
+
+def load_prompt_manifest(path: str | os.PathLike[str]) -> PromptManifest:
+    return PromptManifest.from_dict(json.loads(Path(path).read_text(encoding="utf-8")))
+
+
+def _finite_float(value: Any, label: str, *, positive: bool = False) -> float:
+    result = float(value)
+    if not math.isfinite(result) or (positive and result <= 0):
+        condition = "finite and positive" if positive else "finite"
+        raise ValueError(f"{label} must be {condition}")
+    return result
+
+
+def _nonnegative_float(value: Any, label: str) -> float:
+    result = _finite_float(value, label)
+    if result < 0:
+        raise ValueError(f"{label} must be non-negative")
+    return result
+
+
+def _require_source(value: Mapping[str, Any]) -> str:
+    source = str(value.get("source_artifact", ""))
+    if not source:
+        raise ValueError("every preflight observation requires a source artifact")
+    return source
+
+
+@dataclass(frozen=True)
+class RuntimeSample:
+    stage: str
+    profile_id: str
+    device_label: str
+    runtime_seconds: float
+    basis: str
+    source_artifact: str
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RuntimeSample":
+        stage = str(value["stage"])
+        if stage not in {"numerical-screen", "hardware-validation"}:
+            raise ValueError(f"unsupported runtime stage {stage!r}")
+        basis = str(value["basis"])
+        if basis != (
+            "evaluation_per_profile_excluding_weight_bank_build_"
+            "and_deep_append_oracle"
+        ):
+            raise ValueError(f"unsupported runtime basis {basis!r}")
+        return cls(
+            stage=stage,
+            profile_id=str(value["profile_id"]),
+            device_label=str(value["device_label"]),
+            runtime_seconds=_finite_float(
+                value["runtime_seconds"], "runtime_seconds", positive=True
+            ),
+            basis=basis,
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class WeightBankBuildSample:
+    weight_format: str
+    device_label: str
+    build_seconds: float
+    source_artifact: str
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "WeightBankBuildSample":
+        return cls(
+            weight_format=str(value["weight_format"]),
+            device_label=str(value["device_label"]),
+            build_seconds=_finite_float(
+                value["build_seconds"],
+                "build_seconds",
+                positive=True,
+            ),
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class RuntimeRebindingSample:
+    stage: str
+    profile_id: str
+    device_label: str
+    binding_seconds: float
+    performed: bool
+    target_count: int
+    used_cached_targets: bool
+    weight_requantizations: int
+    sealed_weight_modules: int
+    weight_quantization_events_before: int
+    weight_quantization_events_after: int
+    weight_identity_before: str
+    weight_identity_after: str
+    weight_structure_fingerprint: str
+    source_artifact: str
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RuntimeRebindingSample":
+        stage = str(value["stage"])
+        if stage not in {"numerical-screen", "hardware-validation"}:
+            raise ValueError(f"unsupported rebinding stage {stage!r}")
+        target_count = int(value["target_count"])
+        requantizations = int(value["weight_requantizations"])
+        sealed_modules = int(value["sealed_weight_modules"])
+        events_before = int(value["weight_quantization_events_before"])
+        events_after = int(value["weight_quantization_events_after"])
+        if any(
+            number < 0
+            for number in (
+                target_count,
+                requantizations,
+                sealed_modules,
+                events_before,
+                events_after,
+            )
+        ):
+            raise ValueError("rebinding counts must be non-negative")
+        fingerprints = tuple(
+            str(value[key])
+            for key in (
+                "weight_identity_before",
+                "weight_identity_after",
+                "weight_structure_fingerprint",
+            )
+        )
+        if any(not fingerprint for fingerprint in fingerprints):
+            raise ValueError("rebinding fingerprints must be non-empty")
+        return cls(
+            stage=stage,
+            profile_id=str(value["profile_id"]),
+            device_label=str(value["device_label"]),
+            binding_seconds=_nonnegative_float(
+                value["binding_seconds"],
+                "binding_seconds",
+            ),
+            performed=_strict_bool(value["performed"], "performed"),
+            target_count=target_count,
+            used_cached_targets=_strict_bool(
+                value["used_cached_targets"],
+                "used_cached_targets",
+            ),
+            weight_requantizations=requantizations,
+            sealed_weight_modules=sealed_modules,
+            weight_quantization_events_before=events_before,
+            weight_quantization_events_after=events_after,
+            weight_identity_before=fingerprints[0],
+            weight_identity_after=fingerprints[1],
+            weight_structure_fingerprint=fingerprints[2],
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class NativeAppendValidationSample:
+    stage: str
+    profile_id: str
+    device_label: str
+    mode: str
+    deep_oracle_enabled: bool
+    calls: int
+    expected_calls: int
+    tensor_checks: int
+    expected_tensor_checks: int
+    quantized_tensor_checks: int
+    expected_quantized_tensor_checks: int
+    oracle_seconds: float
+    source_artifact: str
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "NativeAppendValidationSample":
+        stage = str(value["stage"])
+        if stage not in {"numerical-screen", "hardware-validation"}:
+            raise ValueError(f"unsupported append-validation stage {stage!r}")
+        counts = {
+            key: int(value[key])
+            for key in (
+                "calls",
+                "expected_calls",
+                "tensor_checks",
+                "expected_tensor_checks",
+                "quantized_tensor_checks",
+                "expected_quantized_tensor_checks",
+            )
+        }
+        if any(count < 0 for count in counts.values()):
+            raise ValueError("append-validation counts must be non-negative")
+        return cls(
+            stage=stage,
+            profile_id=str(value["profile_id"]),
+            device_label=str(value["device_label"]),
+            mode=str(value["mode"]),
+            deep_oracle_enabled=_strict_bool(
+                value["deep_oracle_enabled"],
+                "deep_oracle_enabled",
+            ),
+            calls=counts["calls"],
+            expected_calls=counts["expected_calls"],
+            tensor_checks=counts["tensor_checks"],
+            expected_tensor_checks=counts["expected_tensor_checks"],
+            quantized_tensor_checks=counts["quantized_tensor_checks"],
+            expected_quantized_tensor_checks=counts["expected_quantized_tensor_checks"],
+            oracle_seconds=_nonnegative_float(
+                value["oracle_seconds"],
+                "oracle_seconds",
+            ),
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class NLLParityCheck:
+    profile_id: str
+    left_label: str
+    right_label: str
+    left_mean_token_nll: float
+    right_mean_token_nll: float
+    source_artifact: str
+
+    @property
+    def absolute_error(self) -> float:
+        return abs(self.left_mean_token_nll - self.right_mean_token_nll)
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "NLLParityCheck":
+        return cls(
+            profile_id=str(value["profile_id"]),
+            left_label=str(value["left_label"]),
+            right_label=str(value["right_label"]),
+            left_mean_token_nll=_nonnegative_float(
+                value["left_mean_token_nll"], "left_mean_token_nll"
+            ),
+            right_mean_token_nll=_nonnegative_float(
+                value["right_mean_token_nll"], "right_mean_token_nll"
+            ),
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class BF16SplitCheck:
+    document_id: str
+    token_ids_equal: bool
+    max_abs_logit_error: float
+    mean_token_nll_abs_error: float
+    source_artifact: str
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "BF16SplitCheck":
+        return cls(
+            document_id=str(value["document_id"]),
+            token_ids_equal=_strict_bool(value["token_ids_equal"], "token_ids_equal"),
+            max_abs_logit_error=_nonnegative_float(
+                value["max_abs_logit_error"], "max_abs_logit_error"
+            ),
+            mean_token_nll_abs_error=_nonnegative_float(
+                value["mean_token_nll_abs_error"],
+                "mean_token_nll_abs_error",
+            ),
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class CacheReuseCheck:
+    document_id: str
+    cache_content_equal: bool
+    mean_token_nll_abs_error: float
+    source_artifact: str
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "CacheReuseCheck":
+        return cls(
+            document_id=str(value["document_id"]),
+            cache_content_equal=_strict_bool(
+                value["cache_content_equal"], "cache_content_equal"
+            ),
+            mean_token_nll_abs_error=_nonnegative_float(
+                value["mean_token_nll_abs_error"],
+                "mean_token_nll_abs_error",
+            ),
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class MicrobatchParityCheck:
+    profile_id: str
+    microbatch_size: int
+    max_abs_logit_error: float
+    max_abs_token_nll_error: float
+    max_abs_permutation_nll_error: float
+    cache_growth_exact: bool
+    lane_isolation_checked: bool
+    source_artifact: str
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "MicrobatchParityCheck":
+        microbatch_size = int(value["microbatch_size"])
+        if microbatch_size <= 0:
+            raise ValueError("microbatch_size must be positive")
+        return cls(
+            profile_id=str(value["profile_id"]),
+            microbatch_size=microbatch_size,
+            max_abs_logit_error=_nonnegative_float(
+                value["max_abs_logit_error"],
+                "max_abs_logit_error",
+            ),
+            max_abs_token_nll_error=_nonnegative_float(
+                value["max_abs_token_nll_error"],
+                "max_abs_token_nll_error",
+            ),
+            max_abs_permutation_nll_error=_nonnegative_float(
+                value["max_abs_permutation_nll_error"],
+                "max_abs_permutation_nll_error",
+            ),
+            cache_growth_exact=_strict_bool(
+                value["cache_growth_exact"],
+                "cache_growth_exact",
+            ),
+            lane_isolation_checked=_strict_bool(
+                value["lane_isolation_checked"],
+                "lane_isolation_checked",
+            ),
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class GPUMemorySample:
+    stage: str
+    profile_id: str
+    device_label: str
+    microbatch_size: int
+    peak_allocated_bytes: int
+    peak_reserved_bytes: int
+    total_device_bytes: int
+    source_artifact: str
+
+    @property
+    def peak_reserved_fraction(self) -> float:
+        return self.peak_reserved_bytes / self.total_device_bytes
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "GPUMemorySample":
+        stage = str(value["stage"])
+        if stage not in {"numerical-screen", "hardware-validation"}:
+            raise ValueError(f"unsupported GPU-memory stage {stage!r}")
+        fields = {
+            name: int(value[name])
+            for name in (
+                "microbatch_size",
+                "peak_allocated_bytes",
+                "peak_reserved_bytes",
+                "total_device_bytes",
+            )
+        }
+        if any(number <= 0 for number in fields.values()):
+            raise ValueError("GPU memory fields must be positive")
+        if (
+            fields["peak_allocated_bytes"] > fields["peak_reserved_bytes"]
+            or fields["peak_reserved_bytes"] > fields["total_device_bytes"]
+        ):
+            raise ValueError("GPU memory accounting is inconsistent")
+        return cls(
+            stage=stage,
+            profile_id=str(value["profile_id"]),
+            device_label=str(value["device_label"]),
+            source_artifact=_require_source(value),
+            **fields,
+        )
+
+
+@dataclass(frozen=True)
+class AdmissionPreparationSample:
+    manifest_hash: str
+    run_plan_hash: str
+    prompt_manifest_hash: str
+    admission_index_hash: str
+    admission_contract_id: str
+    quantized_format_count: int
+    document_count: int
+    artifact_count: int
+    cold_build_seconds: float
+    persistence_policy: str
+    logical_artifact_bytes: int
+    persisted_bytes: int
+    required_cold_capacity_bytes: int
+    observed_cold_available_bytes: int
+    required_host_bytes: int
+    observed_host_available_bytes: int
+    source_artifact: str
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "AdmissionPreparationSample":
+        if value.get("schema_version") != "decode-admission-preparation":
+            raise ValueError("unsupported admission preparation schema")
+        resources = value["resource_projection"]
+        persistence_policy = str(value.get("persistence_policy", ""))
+        if persistence_policy != "content_addressed_recompute_per_format":
+            raise ValueError("unsupported admission persistence policy")
+        counts = {
+            name: int(value[name])
+            for name in (
+                "quantized_format_count",
+                "document_count",
+                "artifact_count",
+                "persisted_bytes",
+                "logical_artifact_bytes",
+            )
+        }
+        counts.update(
+            {
+                name: int(resources[name])
+                for name in (
+                    "required_cold_capacity_bytes",
+                    "observed_cold_available_bytes",
+                    "required_host_bytes",
+                    "observed_host_available_bytes",
+                )
+            }
+        )
+        positive = {
+            name: number for name, number in counts.items() if name != "persisted_bytes"
+        }
+        if (
+            any(number <= 0 for number in positive.values())
+            or counts["persisted_bytes"] != 0
+        ):
+            raise ValueError("admission preparation counts must be positive")
+        identities = {
+            name: str(value[name])
+            for name in (
+                "manifest_hash",
+                "run_plan_hash",
+                "prompt_manifest_hash",
+                "admission_index_hash",
+                "admission_contract_id",
+            )
+        }
+        if any(not identity for identity in identities.values()):
+            raise ValueError("admission preparation identities cannot be empty")
+        return cls(
+            **identities,
+            quantized_format_count=counts["quantized_format_count"],
+            document_count=counts["document_count"],
+            artifact_count=counts["artifact_count"],
+            cold_build_seconds=_finite_float(
+                value["cold_build_seconds"],
+                "cold_build_seconds",
+                positive=True,
+            ),
+            persistence_policy=persistence_policy,
+            logical_artifact_bytes=counts["logical_artifact_bytes"],
+            persisted_bytes=counts["persisted_bytes"],
+            required_cold_capacity_bytes=counts["required_cold_capacity_bytes"],
+            observed_cold_available_bytes=counts["observed_cold_available_bytes"],
+            required_host_bytes=counts["required_host_bytes"],
+            observed_host_available_bytes=counts["observed_host_available_bytes"],
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class StackEvidencePreparationSample:
+    """Measured compiler/emulator evidence-production time for hardware validation."""
+
+    manifest_hash: str
+    run_plan_hash: str
+    required_stages: tuple[str, ...]
+    compiler_seconds: float
+    emulator_seconds: float
+    critical_path_seconds: float
+    timing_basis: str
+    stage_report_hashes: Mapping[str, str]
+    stack_validity_hash: str
+    source_artifact: str
+
+    @classmethod
+    def from_dict(
+        cls,
+        value: Mapping[str, Any],
+    ) -> "StackEvidencePreparationSample":
+        required_stages = tuple(map(str, value["required_stages"]))
+        if required_stages != ("compiler", "emulator"):
+            raise ValueError("stack preparation must cover compiler and emulator")
+        timing_basis = str(value["timing_basis"])
+        if timing_basis != "union_of_measured_stage_wall_intervals":
+            raise ValueError("unsupported stack preparation timing basis")
+        compiler_seconds = _finite_float(
+            value["compiler_seconds"],
+            "compiler_seconds",
+            positive=True,
+        )
+        emulator_seconds = _finite_float(
+            value["emulator_seconds"],
+            "emulator_seconds",
+            positive=True,
+        )
+        critical_path_seconds = _finite_float(
+            value["critical_path_seconds"],
+            "critical_path_seconds",
+            positive=True,
+        )
+        if not (
+            max(compiler_seconds, emulator_seconds)
+            <= critical_path_seconds
+            <= compiler_seconds + emulator_seconds
+        ):
+            raise ValueError("stack critical path is inconsistent with stage intervals")
+        report_hashes = value["stage_report_hashes"]
+        if (
+            not isinstance(report_hashes, Mapping)
+            or set(report_hashes) != {"compiler", "emulator"}
+            or any(not str(item) for item in report_hashes.values())
+        ):
+            raise ValueError("stack stage-report hashes are incomplete")
+        identities = {
+            key: str(value[key])
+            for key in (
+                "manifest_hash",
+                "run_plan_hash",
+                "stack_validity_hash",
+            )
+        }
+        if any(not item for item in identities.values()):
+            raise ValueError("stack preparation identities cannot be empty")
+        return cls(
+            **identities,
+            required_stages=required_stages,
+            compiler_seconds=compiler_seconds,
+            emulator_seconds=emulator_seconds,
+            critical_path_seconds=critical_path_seconds,
+            timing_basis=timing_basis,
+            stage_report_hashes={
+                str(key): str(item) for key, item in report_hashes.items()
+            },
+            source_artifact=_require_source(value),
+        )
+
+
+@dataclass(frozen=True)
+class PreflightEvidence:
+    manifest_hash: str
+    run_plan_hash: str
+    prompt_manifest_hash: str
+    completed_profile_ids: tuple[str, ...]
+    runtime_samples: tuple[RuntimeSample, ...]
+    weight_bank_build_samples: tuple[WeightBankBuildSample, ...]
+    runtime_rebinding_samples: tuple[RuntimeRebindingSample, ...]
+    native_append_validation_samples: tuple[
+        NativeAppendValidationSample,
+        ...,
+    ]
+    numerical_screen_workers: int
+    hardware_validation_workers: int
+    weight_bank_build_serialized: bool
+    weight_bank_checks: tuple[NLLParityCheck, ...]
+    cross_device_checks: tuple[NLLParityCheck, ...]
+    bf16_split_checks: tuple[BF16SplitCheck, ...]
+    cache_reuse_checks: tuple[CacheReuseCheck, ...]
+    microbatch_checks: tuple[MicrobatchParityCheck, ...]
+    gpu_memory_samples: tuple[GPUMemorySample, ...]
+    admission_preparation: AdmissionPreparationSample
+    stack_evidence_preparation: StackEvidencePreparationSample
+    schema_version: str = PREFLIGHT_EVIDENCE_SCHEMA
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "PreflightEvidence":
+        if value["schema_version"] != PREFLIGHT_EVIDENCE_SCHEMA:
+            raise ValueError(
+                f"unsupported preflight evidence schema {value['schema_version']!r}"
+            )
+        workers = value["parallel_workers"]
+        evidence = cls(
+            schema_version=str(value["schema_version"]),
+            manifest_hash=str(value["manifest_hash"]),
+            run_plan_hash=str(value["run_plan_hash"]),
+            prompt_manifest_hash=str(value["prompt_manifest_hash"]),
+            completed_profile_ids=tuple(value["completed_profile_ids"]),
+            runtime_samples=tuple(
+                RuntimeSample.from_dict(sample) for sample in value["runtime_samples"]
+            ),
+            weight_bank_build_samples=tuple(
+                WeightBankBuildSample.from_dict(sample)
+                for sample in value["weight_bank_build_samples"]
+            ),
+            runtime_rebinding_samples=tuple(
+                RuntimeRebindingSample.from_dict(sample)
+                for sample in value["runtime_rebinding_samples"]
+            ),
+            native_append_validation_samples=tuple(
+                NativeAppendValidationSample.from_dict(sample)
+                for sample in value["native_append_validation_samples"]
+            ),
+            numerical_screen_workers=int(workers["numerical_screen"]),
+            hardware_validation_workers=int(workers["hardware_validation"]),
+            weight_bank_build_serialized=_strict_bool(
+                value["weight_bank_build_serialized"],
+                "weight_bank_build_serialized",
+            ),
+            weight_bank_checks=tuple(
+                NLLParityCheck.from_dict(check) for check in value["weight_bank_checks"]
+            ),
+            cross_device_checks=tuple(
+                NLLParityCheck.from_dict(check)
+                for check in value["cross_device_checks"]
+            ),
+            bf16_split_checks=tuple(
+                BF16SplitCheck.from_dict(check) for check in value["bf16_split_checks"]
+            ),
+            cache_reuse_checks=tuple(
+                CacheReuseCheck.from_dict(check)
+                for check in value["cache_reuse_checks"]
+            ),
+            microbatch_checks=tuple(
+                MicrobatchParityCheck.from_dict(check)
+                for check in value["microbatch_checks"]
+            ),
+            gpu_memory_samples=tuple(
+                GPUMemorySample.from_dict(sample)
+                for sample in value["gpu_memory_samples"]
+            ),
+            admission_preparation=AdmissionPreparationSample.from_dict(
+                value["admission_preparation"]
+            ),
+            stack_evidence_preparation=(
+                StackEvidencePreparationSample.from_dict(
+                    value["stack_evidence_preparation"]
+                )
+            ),
+        )
+        if (
+            evidence.numerical_screen_workers <= 0
+            or evidence.hardware_validation_workers <= 0
+        ):
+            raise ValueError("parallel worker counts must be positive")
+        return evidence
+
+
+def load_preflight_evidence(path: str | os.PathLike[str]) -> PreflightEvidence:
+    return PreflightEvidence.from_dict(load_immutable_json(path))
+
+
+@dataclass(frozen=True)
+class GateResult:
+    name: str
+    passed: bool
+    detail: str
+    measured: float | int | None = None
+    limit: float | int | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "passed": self.passed,
+            "detail": self.detail,
+            "measured": self.measured,
+            "limit": self.limit,
+        }
+
+
+@dataclass(frozen=True)
+class PreflightGateReport:
+    manifest_hash: str
+    run_plan_hash: str
+    gates: tuple[GateResult, ...]
+    schema_version: str = GATE_REPORT_SCHEMA
+
+    @property
+    def passed(self) -> bool:
+        return all(gate.passed for gate in self.gates)
+
+    def to_dict(self) -> dict[str, Any]:
+        body = {
+            "schema_version": self.schema_version,
+            "manifest_hash": self.manifest_hash,
+            "run_plan_hash": self.run_plan_hash,
+            "passed": self.passed,
+            "gates": [gate.to_dict() for gate in self.gates],
+        }
+        return body | {"gate_report_hash": _content_hash(body)}
+
+    def require_passed(self) -> None:
+        failed = [gate for gate in self.gates if not gate.passed]
+        if failed:
+            detail = "; ".join(f"{gate.name}: {gate.detail}" for gate in failed)
+            raise RuntimeError(f"preflight gates failed: {detail}")
+
+
+def _percentile_nearest_rank(values: Iterable[float], percentile: float) -> float:
+    ordered = sorted(values)
+    if not ordered:
+        raise ValueError("cannot compute a percentile without samples")
+    index = max(0, math.ceil(percentile * len(ordered)) - 1)
+    return ordered[index]
+
+
+def _set_gate(
+    name: str,
+    actual: Iterable[str],
+    expected: Iterable[str],
+) -> GateResult:
+    actual_values = tuple(actual)
+    actual_set = set(actual_values)
+    expected_set = set(expected)
+    missing = sorted(expected_set - actual_set)
+    unexpected = sorted(actual_set - expected_set)
+    duplicate_count = len(actual_values) - len(actual_set)
+    passed = not missing and not unexpected and duplicate_count == 0
+    detail = (
+        "exact coverage"
+        if passed
+        else (
+            f"missing={missing[:3]}, unexpected={unexpected[:3]}, "
+            f"duplicates={duplicate_count}"
+        )
+    )
+    return GateResult(name, passed, detail, len(actual_set), len(expected_set))
+
+
+def _runtime_observation_key(
+    stage: str,
+    profile_id: str,
+    device_label: str,
+) -> str:
+    return "\x1f".join((stage, profile_id, device_label))
+
+
+def _max_stage_profiles_per_worker(
+    profile_ids: Sequence[str],
+    *,
+    workers: int,
+    profile_by_id: Mapping[str, DecodePrecisionProfile],
+) -> int:
+    weight_order: list[str] = []
+    counts: dict[str, int] = {}
+    for profile_id in profile_ids:
+        weight = profile_by_id[profile_id].weight_format
+        counts[weight] = counts.get(weight, 0) + 1
+        if weight not in weight_order:
+            weight_order.append(weight)
+    if workers <= 0 or workers > len(weight_order):
+        raise ValueError("worker count exceeds the stage weight-bank count")
+    loads = [0] * workers
+    for index, weight in enumerate(weight_order):
+        loads[index % workers] += counts[weight]
+    return max(loads)
+
+
+def _max_stage_build_seconds_per_worker(
+    profile_ids: Sequence[str],
+    *,
+    workers: int,
+    profile_by_id: Mapping[str, DecodePrecisionProfile],
+    builds_by_format: Mapping[str, float],
+) -> float:
+    weight_order: list[str] = []
+    for profile_id in profile_ids:
+        weight = profile_by_id[profile_id].weight_format
+        if weight not in weight_order:
+            weight_order.append(weight)
+    if workers <= 0 or workers > len(weight_order):
+        raise ValueError("worker count exceeds the stage weight-bank count")
+    missing = set(weight_order) - set(builds_by_format)
+    if missing:
+        raise ValueError(f"missing weight-bank build samples: {sorted(missing)}")
+    loads = [0.0] * workers
+    for index, weight in enumerate(weight_order):
+        loads[index % workers] += builds_by_format[weight]
+    return max(loads)
+
+
+def _project_homogeneous_runtime_hours(
+    *,
+    plan: SweepRunPlan,
+    profile_by_id: Mapping[str, DecodePrecisionProfile],
+    builds_by_format: Mapping[str, float],
+    p95_numerical_screen: float,
+    p95_hardware_validation: float,
+    admission_hours: float,
+    stack_evidence_hours: float,
+    workers: int,
+    serialized_builds: bool,
+) -> float:
+    numerical_screen_evaluations = _max_stage_profiles_per_worker(
+        plan.numerical_screen_profile_ids,
+        workers=workers,
+        profile_by_id=profile_by_id,
+    )
+    hardware_validation_evaluations = _max_stage_profiles_per_worker(
+        plan.hardware_validation_profile_ids,
+        workers=workers,
+        profile_by_id=profile_by_id,
+    )
+    if serialized_builds:
+        stage_weights = tuple(
+            tuple(
+                dict.fromkeys(
+                    profile_by_id[profile_id].weight_format
+                    for profile_id in profile_ids
+                )
+            )
+            for profile_ids in (
+                plan.numerical_screen_profile_ids,
+                plan.hardware_validation_profile_ids,
+            )
+        )
+        build_seconds = sum(
+            builds_by_format[weight] for weights in stage_weights for weight in weights
+        )
+    else:
+        build_seconds = _max_stage_build_seconds_per_worker(
+            plan.numerical_screen_profile_ids,
+            workers=workers,
+            profile_by_id=profile_by_id,
+            builds_by_format=builds_by_format,
+        ) + _max_stage_build_seconds_per_worker(
+            plan.hardware_validation_profile_ids,
+            workers=workers,
+            profile_by_id=profile_by_id,
+            builds_by_format=builds_by_format,
+        )
+    return (
+        stack_evidence_hours
+        + admission_hours
+        + (
+            p95_numerical_screen * numerical_screen_evaluations
+            + p95_hardware_validation * hardware_validation_evaluations
+            + build_seconds
+        )
+        / 3600.0
+    )
+
+
+def evaluate_preflight_gates(
+    manifest: SweepManifest,
+    plan: SweepRunPlan,
+    prompts: PromptManifest,
+    evidence: PreflightEvidence,
+) -> PreflightGateReport:
+    """Evaluate every launch gate without substituting missing measurements."""
+
+    validate_run_plan(plan, manifest)
+    gates: list[GateResult] = []
+    gates.append(
+        GateResult(
+            "manifest_integrity",
+            evidence.manifest_hash == manifest.canonical_hash,
+            "evidence is bound to the exhaustive manifest",
+            len(manifest.entries),
+            EXPECTED_TOTAL_PROFILES,
+        )
+    )
+    gates.append(
+        GateResult(
+            "run_plan_integrity",
+            evidence.run_plan_hash == plan.canonical_hash,
+            "evidence is bound to the run plan",
+        )
+    )
+    gates.append(
+        GateResult(
+            "prompt_manifest_integrity",
+            evidence.prompt_manifest_hash == prompts.canonical_hash,
+            "evidence is bound to the fixed prompt sets",
+        )
+    )
+    gates.append(
+        GateResult(
+            "execution_topology",
+            (
+                evidence.numerical_screen_workers == plan.numerical_screen_workers
+                and evidence.hardware_validation_workers
+                == plan.hardware_validation_workers
+            ),
+            "worker counts are bound to the immutable run plan",
+        )
+    )
+    admission = evidence.admission_preparation
+    admission_identity_valid = (
+        admission.manifest_hash == manifest.canonical_hash
+        and admission.run_plan_hash == plan.canonical_hash
+        and admission.prompt_manifest_hash == prompts.canonical_hash
+    )
+    admission_coverage_valid = (
+        admission.quantized_format_count == len(DECODE_FORMATS)
+        and admission.document_count
+        == (
+            NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count
+            + HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+        )
+        and admission.artifact_count
+        == admission.document_count * (len(DECODE_FORMATS) + 1)
+    )
+    admission_resources_valid = (
+        admission.persistence_policy == "content_addressed_recompute_per_format"
+        and admission.logical_artifact_bytes > 0
+        and admission.persisted_bytes == 0
+        and admission.observed_cold_available_bytes
+        >= admission.required_cold_capacity_bytes
+        and admission.observed_host_available_bytes >= admission.required_host_bytes
+    )
+    gates.append(
+        GateResult(
+            "admission_preparation",
+            (
+                admission_identity_valid
+                and admission_coverage_valid
+                and admission_resources_valid
+            ),
+            (
+                f"formats={admission.quantized_format_count}, "
+                f"documents={admission.document_count}, "
+                f"artifacts={admission.artifact_count}, "
+                f"cold_build_seconds={admission.cold_build_seconds:.6g}"
+            ),
+            admission.artifact_count,
+            admission.document_count * (len(DECODE_FORMATS) + 1),
+        )
+    )
+    stack_preparation = evidence.stack_evidence_preparation
+    stack_identity_valid = (
+        stack_preparation.manifest_hash == manifest.canonical_hash
+        and stack_preparation.run_plan_hash == plan.canonical_hash
+        and stack_preparation.required_stages == ("compiler", "emulator")
+    )
+    gates.append(
+        GateResult(
+            "stack_evidence_preparation",
+            stack_identity_valid,
+            (
+                f"compiler_seconds={stack_preparation.compiler_seconds:.6g}, "
+                f"emulator_seconds={stack_preparation.emulator_seconds:.6g}, "
+                "critical_path_seconds="
+                f"{stack_preparation.critical_path_seconds:.6g}"
+            ),
+            stack_preparation.critical_path_seconds,
+        )
+    )
+    expected_microbatches = {
+        plan.numerical_screen_microbatch_size,
+        plan.hardware_validation_microbatch_size,
+    }
+    observed_microbatches = {
+        check.microbatch_size for check in evidence.microbatch_checks
+    }
+    max_microbatch_error = max(
+        (
+            max(
+                check.max_abs_logit_error,
+                check.max_abs_token_nll_error,
+                check.max_abs_permutation_nll_error,
+            )
+            for check in evidence.microbatch_checks
+        ),
+        default=None,
+    )
+    invalid_microbatch = any(
+        (
+            check.profile_id
+            not in {
+                entry.profile_id
+                for entry in manifest.entries
+                if entry.profile.kind == PROFILE_KIND_BF16_REFERENCE
+            }
+            or not check.cache_growth_exact
+            or not check.lane_isolation_checked
+        )
+        for check in evidence.microbatch_checks
+    )
+    gates.append(
+        GateResult(
+            "microbatch_parity",
+            (
+                observed_microbatches == expected_microbatches
+                and not invalid_microbatch
+                and max_microbatch_error is not None
+                and max_microbatch_error <= plan.parity_tolerance
+            ),
+            (
+                f"sizes={sorted(observed_microbatches)}, "
+                f"max_error={max_microbatch_error}"
+            ),
+            max_microbatch_error,
+            plan.parity_tolerance,
+        )
+    )
+    memory_keys = tuple(
+        _runtime_observation_key(
+            sample.stage,
+            sample.profile_id,
+            sample.device_label,
+        )
+        for sample in evidence.gpu_memory_samples
+    )
+    runtime_keys_for_memory = tuple(
+        _runtime_observation_key(
+            sample.stage,
+            sample.profile_id,
+            sample.device_label,
+        )
+        for sample in evidence.runtime_samples
+    )
+    expected_microbatch_by_stage = {
+        "numerical-screen": plan.numerical_screen_microbatch_size,
+        "hardware-validation": plan.hardware_validation_microbatch_size,
+    }
+    invalid_memory = tuple(
+        sample.profile_id
+        for sample in evidence.gpu_memory_samples
+        if (
+            sample.microbatch_size != expected_microbatch_by_stage[sample.stage]
+            or sample.peak_reserved_fraction >= 0.90
+        )
+    )
+    max_reserved_fraction = max(
+        (sample.peak_reserved_fraction for sample in evidence.gpu_memory_samples),
+        default=None,
+    )
+    gates.append(
+        GateResult(
+            "gpu_memory_headroom",
+            (
+                not invalid_memory
+                and sorted(memory_keys) == sorted(runtime_keys_for_memory)
+                and max_reserved_fraction is not None
+            ),
+            (
+                f"max_peak_reserved_fraction={max_reserved_fraction}, "
+                f"invalid={list(invalid_memory[:3])}"
+            ),
+            max_reserved_fraction,
+            0.90,
+        )
+    )
+    gates.append(
+        _set_gate(
+            "preflight_completion",
+            evidence.completed_profile_ids,
+            plan.preflight_profile_ids,
+        )
+    )
+
+    pilot_ids = set(plan.preflight_profile_ids)
+    numerical_screen_samples = tuple(
+        sample
+        for sample in evidence.runtime_samples
+        if sample.stage == "numerical-screen"
+    )
+    hardware_validation_samples = tuple(
+        sample
+        for sample in evidence.runtime_samples
+        if sample.stage == "hardware-validation"
+    )
+    gates.append(
+        _set_gate(
+            "numerical_screen_runtime_coverage",
+            (sample.profile_id for sample in numerical_screen_samples),
+            plan.preflight_profile_ids,
+        )
+    )
+    legal_pilot_ids = {
+        entry.profile_id
+        for entry in manifest.entries
+        if entry.profile_id in pilot_ids and entry.legality.hardware_candidate
+    }
+    gates.append(
+        _set_gate(
+            "hardware_validation_runtime_coverage",
+            (sample.profile_id for sample in hardware_validation_samples),
+            legal_pilot_ids,
+        )
+    )
+    profile_by_id = {entry.profile_id: entry.profile for entry in manifest.entries}
+    preflight_weight_formats = {
+        profile_by_id[profile_id].weight_format
+        for profile_id in plan.preflight_profile_ids
+    }
+    gates.append(
+        _set_gate(
+            "weight_bank_build_coverage",
+            (sample.weight_format for sample in evidence.weight_bank_build_samples),
+            preflight_weight_formats,
+        )
+    )
+
+    runtime_keys = tuple(
+        _runtime_observation_key(
+            sample.stage,
+            sample.profile_id,
+            sample.device_label,
+        )
+        for sample in evidence.runtime_samples
+    )
+    rebinding_keys = tuple(
+        _runtime_observation_key(
+            sample.stage,
+            sample.profile_id,
+            sample.device_label,
+        )
+        for sample in evidence.runtime_rebinding_samples
+    )
+    gates.append(
+        _set_gate(
+            "runtime_rebinding_coverage",
+            rebinding_keys,
+            runtime_keys,
+        )
+    )
+    append_validation_keys = tuple(
+        _runtime_observation_key(
+            sample.stage,
+            sample.profile_id,
+            sample.device_label,
+        )
+        for sample in evidence.native_append_validation_samples
+    )
+    gates.append(
+        _set_gate(
+            "native_append_oracle_coverage",
+            append_validation_keys,
+            runtime_keys,
+        )
+    )
+
+    invalid_append_validation: list[str] = []
+    decoder_layers = int(manifest.model_architecture["num_hidden_layers"])
+    for sample in evidence.native_append_validation_samples:
+        if not sample.deep_oracle_enabled or sample.mode != "deep_oracle":
+            invalid_append_validation.append(f"{sample.profile_id}:oracle-disabled")
+            continue
+        if sample.expected_calls <= 0:
+            invalid_append_validation.append(f"{sample.profile_id}:no-calls")
+        if (
+            sample.calls != sample.expected_calls
+            or sample.tensor_checks != sample.expected_tensor_checks
+            or sample.quantized_tensor_checks != sample.expected_quantized_tensor_checks
+        ):
+            invalid_append_validation.append(f"{sample.profile_id}:coverage-mismatch")
+        if sample.expected_tensor_checks != sample.expected_calls * decoder_layers * 2:
+            invalid_append_validation.append(f"{sample.profile_id}:layer-role-coverage")
+        profile = profile_by_id.get(sample.profile_id)
+        if profile is None:
+            invalid_append_validation.append(f"{sample.profile_id}:unknown-profile")
+        elif profile.kind == PROFILE_KIND_BF16_REFERENCE:
+            if sample.expected_quantized_tensor_checks != 0:
+                invalid_append_validation.append(
+                    f"{sample.profile_id}:bf16-quantized-checks"
+                )
+        elif sample.expected_quantized_tensor_checks != sample.expected_tensor_checks:
+            invalid_append_validation.append(
+                f"{sample.profile_id}:quantized-check-coverage"
+            )
+    gates.append(
+        GateResult(
+            "native_append_oracle_integrity",
+            not invalid_append_validation,
+            (
+                f"every pilot append passed the full {decoder_layers}-layer K/V oracle"
+                if not invalid_append_validation
+                else f"invalid={invalid_append_validation[:3]}"
+            ),
+            sum(
+                sample.tensor_checks
+                for sample in evidence.native_append_validation_samples
+            ),
+        )
+    )
+
+    invalid_rebinding: list[str] = []
+    expected_sealed_modules = 7 * decoder_layers
+    expected_binding_targets = (
+        14 if manifest.model_architecture["use_qk_norm"] else 12
+    ) * decoder_layers + 1
+    for sample in evidence.runtime_rebinding_samples:
+        profile = profile_by_id.get(sample.profile_id)
+        is_bf16 = profile is not None and profile.kind == PROFILE_KIND_BF16_REFERENCE
+        if profile is None:
+            invalid_rebinding.append(f"{sample.profile_id}:unknown-profile")
+            continue
+        if sample.weight_identity_before != sample.weight_identity_after:
+            invalid_rebinding.append(f"{sample.profile_id}:weight-mutated")
+        if not sample.used_cached_targets:
+            invalid_rebinding.append(f"{sample.profile_id}:uncached-targets")
+        if sample.weight_requantizations != 0:
+            invalid_rebinding.append(f"{sample.profile_id}:requantized")
+        if (
+            sample.weight_quantization_events_after
+            - sample.weight_quantization_events_before
+            != sample.weight_requantizations
+        ):
+            invalid_rebinding.append(f"{sample.profile_id}:counter-disagreement")
+        if is_bf16:
+            if (
+                sample.performed
+                or sample.target_count != 0
+                or sample.sealed_weight_modules != 0
+                or sample.weight_quantization_events_before != 0
+                or sample.weight_quantization_events_after != 0
+            ):
+                invalid_rebinding.append(f"{sample.profile_id}:bf16-binding")
+        elif (
+            not sample.performed
+            or sample.target_count != expected_binding_targets
+            or sample.sealed_weight_modules != expected_sealed_modules
+            or sample.weight_quantization_events_before != expected_sealed_modules
+            or sample.weight_quantization_events_after != expected_sealed_modules
+        ):
+            invalid_rebinding.append(f"{sample.profile_id}:binding-or-seal-coverage")
+    total_requantizations = sum(
+        sample.weight_requantizations for sample in evidence.runtime_rebinding_samples
+    )
+    gates.append(
+        GateResult(
+            "runtime_rebinding_integrity",
+            not invalid_rebinding,
+            (
+                "cached targets preserved every decode weight bank"
+                if not invalid_rebinding
+                else f"invalid={invalid_rebinding[:3]}"
+            ),
+            total_requantizations,
+            0,
+        )
+    )
+
+    runtime_by_key = {
+        _runtime_observation_key(
+            sample.stage,
+            sample.profile_id,
+            sample.device_label,
+        ): sample.runtime_seconds
+        for sample in evidence.runtime_samples
+    }
+    binding_exceeds_runtime = tuple(
+        sample.profile_id
+        for sample in evidence.runtime_rebinding_samples
+        if sample.binding_seconds
+        > runtime_by_key.get(
+            _runtime_observation_key(
+                sample.stage,
+                sample.profile_id,
+                sample.device_label,
+            ),
+            -1.0,
+        )
+    )
+    gates.append(
+        GateResult(
+            "runtime_rebinding_accounting",
+            not binding_exceeds_runtime,
+            (
+                "binding time is contained in profile evaluation time"
+                if not binding_exceeds_runtime
+                else f"inconsistent={list(binding_exceeds_runtime[:3])}"
+            ),
+        )
+    )
+
+    allowed_devices = set(plan.device_labels)
+    observed_devices = {sample.device_label for sample in evidence.runtime_samples}
+    observed_devices.update(
+        sample.device_label for sample in evidence.runtime_rebinding_samples
+    )
+    observed_devices.update(
+        sample.device_label for sample in evidence.weight_bank_build_samples
+    )
+    unknown_devices = sorted(observed_devices - allowed_devices)
+    gates.append(
+        GateResult(
+            "runtime_device_labels",
+            not unknown_devices,
+            (
+                "runtime samples use planned devices"
+                if not unknown_devices
+                else f"unplanned device labels: {unknown_devices}"
+            ),
+        )
+    )
+
+    projected_hours: float | None = None
+    evaluation_hours: float | None = None
+    bank_build_hours: float | None = None
+    rebinding_hours: float | None = None
+    homogeneous_fallback: str | None = None
+    admission_hours = admission.cold_build_seconds / 3600.0
+    stack_evidence_hours = stack_preparation.critical_path_seconds / 3600.0
+    projection_error: str | None = None
+    try:
+        p95_numerical_screen = _percentile_nearest_rank(
+            (sample.runtime_seconds for sample in numerical_screen_samples), 0.95
+        )
+        p95_hardware_validation = _percentile_nearest_rank(
+            (sample.runtime_seconds for sample in hardware_validation_samples), 0.95
+        )
+        numerical_screen_shard_profiles = _max_stage_profiles_per_worker(
+            plan.numerical_screen_profile_ids,
+            workers=evidence.numerical_screen_workers,
+            profile_by_id=profile_by_id,
+        )
+        hardware_validation_shard_profiles = _max_stage_profiles_per_worker(
+            plan.hardware_validation_profile_ids,
+            workers=evidence.hardware_validation_workers,
+            profile_by_id=profile_by_id,
+        )
+        evaluation_hours = (
+            p95_numerical_screen * numerical_screen_shard_profiles
+            + p95_hardware_validation * hardware_validation_shard_profiles
+        ) / 3600.0
+        builds_by_format = {
+            sample.weight_format: sample.build_seconds
+            for sample in evidence.weight_bank_build_samples
+        }
+        if len(builds_by_format) != len(evidence.weight_bank_build_samples):
+            raise ValueError("duplicate weight-bank build samples")
+        numerical_screen_weight_formats = {
+            profile_by_id[profile_id].weight_format
+            for profile_id in plan.numerical_screen_profile_ids
+        }
+        hardware_validation_weight_formats = {
+            profile_by_id[profile_id].weight_format
+            for profile_id in plan.hardware_validation_profile_ids
+        }
+        required_builds = (
+            numerical_screen_weight_formats | hardware_validation_weight_formats
+        )
+        missing_builds = required_builds - set(builds_by_format)
+        if missing_builds:
+            raise ValueError(
+                f"missing weight-bank build samples: {sorted(missing_builds)}"
+            )
+        if evidence.weight_bank_build_serialized:
+            bank_build_seconds = sum(
+                builds_by_format[weight]
+                for weights in (
+                    numerical_screen_weight_formats,
+                    hardware_validation_weight_formats,
+                )
+                for weight in weights
+            )
+        else:
+            bank_build_seconds = _max_stage_build_seconds_per_worker(
+                plan.numerical_screen_profile_ids,
+                workers=evidence.numerical_screen_workers,
+                profile_by_id=profile_by_id,
+                builds_by_format=builds_by_format,
+            ) + _max_stage_build_seconds_per_worker(
+                plan.hardware_validation_profile_ids,
+                workers=evidence.hardware_validation_workers,
+                profile_by_id=profile_by_id,
+                builds_by_format=builds_by_format,
+            )
+        bank_build_hours = bank_build_seconds / 3600.0
+
+        numerical_screen_bindings = tuple(
+            sample.binding_seconds
+            for sample in evidence.runtime_rebinding_samples
+            if sample.stage == "numerical-screen"
+        )
+        hardware_validation_bindings = tuple(
+            sample.binding_seconds
+            for sample in evidence.runtime_rebinding_samples
+            if sample.stage == "hardware-validation"
+        )
+        p95_numerical_screen_binding = _percentile_nearest_rank(
+            numerical_screen_bindings, 0.95
+        )
+        p95_hardware_validation_binding = _percentile_nearest_rank(
+            hardware_validation_bindings, 0.95
+        )
+        rebinding_hours = (
+            p95_numerical_screen_binding * numerical_screen_shard_profiles
+            + p95_hardware_validation_binding * hardware_validation_shard_profiles
+        ) / 3600.0
+        projected_hours = (
+            stack_evidence_hours + admission_hours + evaluation_hours + bank_build_hours
+        )
+        if len(plan.device_labels) == 1:
+            max_homogeneous_workers = min(
+                len(numerical_screen_weight_formats),
+                len(hardware_validation_weight_formats),
+            )
+            alternatives = tuple(
+                (
+                    workers,
+                    _project_homogeneous_runtime_hours(
+                        plan=plan,
+                        profile_by_id=profile_by_id,
+                        builds_by_format=builds_by_format,
+                        p95_numerical_screen=p95_numerical_screen,
+                        p95_hardware_validation=p95_hardware_validation,
+                        admission_hours=admission_hours,
+                        stack_evidence_hours=stack_evidence_hours,
+                        workers=workers,
+                        serialized_builds=(evidence.weight_bank_build_serialized),
+                    ),
+                )
+                for workers in range(1, max_homogeneous_workers + 1)
+            )
+            feasible = tuple(
+                item for item in alternatives if item[1] <= plan.max_projected_hours
+            )
+            if feasible:
+                workers, hours = feasible[0]
+                homogeneous_fallback = (
+                    f"minimum homogeneous whole-bank topology is {workers} "
+                    f"workers at {hours:.6g} hours"
+                )
+            else:
+                workers, hours = min(
+                    alternatives,
+                    key=lambda item: item[1],
+                )
+                homogeneous_fallback = (
+                    f"whole-bank sharding reaches {hours:.6g} hours at its "
+                    f"{workers}-worker limit; extend the budget or use a "
+                    "separately validated replicated-bank plan"
+                )
+    except ValueError as error:
+        projection_error = str(error)
+    gates.append(
+        GateResult(
+            "projected_rebinding_runtime",
+            (
+                rebinding_hours is not None
+                and rebinding_hours <= plan.max_projected_hours
+            ),
+            (
+                f"p95 rebinding projection is {rebinding_hours:.6g} hours"
+                if rebinding_hours is not None
+                else f"rebinding measurements are incomplete: {projection_error}"
+            ),
+            rebinding_hours,
+            plan.max_projected_hours,
+        )
+    )
+    gates.append(
+        GateResult(
+            "projected_runtime",
+            (
+                projected_hours is not None
+                and projected_hours <= plan.max_projected_hours
+            ),
+            (
+                (
+                    f"p95 projection is {projected_hours:.6g} hours "
+                    f"(stack_evidence={stack_evidence_hours:.6g}, "
+                    f"admission={admission_hours:.6g}, "
+                    f"evaluation={evaluation_hours:.6g}, "
+                    f"weight_banks={bank_build_hours:.6g}, "
+                    f"serialized_weight_builds="
+                    f"{evidence.weight_bank_build_serialized})"
+                    + (
+                        f"; {homogeneous_fallback}"
+                        if homogeneous_fallback is not None
+                        else ""
+                    )
+                )
+                if projected_hours is not None
+                else f"runtime measurements are incomplete: {projection_error}"
+            ),
+            projected_hours,
+            plan.max_projected_hours,
+        )
+    )
+
+    bank_by_weight: dict[str, list[NLLParityCheck]] = {}
+    invalid_bank_profile = False
+    for check in evidence.weight_bank_checks:
+        profile = profile_by_id.get(check.profile_id)
+        if (
+            profile is None
+            or check.profile_id not in pilot_ids
+            or {check.left_label, check.right_label} != {"fresh_process", "reused_bank"}
+        ):
+            invalid_bank_profile = True
+            continue
+        bank_by_weight.setdefault(profile.weight_format, []).append(check)
+    bank_errors = tuple(
+        check.absolute_error for checks in bank_by_weight.values() for check in checks
+    )
+    bank_coverage = set(bank_by_weight) == set(DECODE_FORMATS)
+    max_bank_error = max(bank_errors, default=None)
+    gates.append(
+        GateResult(
+            "reused_weight_bank_parity",
+            (
+                bank_coverage
+                and not invalid_bank_profile
+                and max_bank_error is not None
+                and max_bank_error <= plan.parity_tolerance
+            ),
+            (
+                f"covered={sorted(bank_by_weight)}, "
+                + (
+                    f"max_abs_nll_error={max_bank_error:.6g}"
+                    if max_bank_error is not None
+                    else "max_abs_nll_error=missing"
+                )
+            ),
+            max_bank_error,
+            plan.parity_tolerance,
+        )
+    )
+
+    required_pairs = {
+        frozenset(pair) for pair in itertools.combinations(plan.device_labels, 2)
+    }
+    observed_pairs: set[frozenset[str]] = set()
+    profiles_by_pair: dict[frozenset[str], set[str]] = {}
+    device_errors: list[float] = []
+    invalid_device_check = False
+    for check in evidence.cross_device_checks:
+        pair = frozenset((check.left_label, check.right_label))
+        if (
+            len(pair) != 2
+            or not pair.issubset(allowed_devices)
+            or check.profile_id not in pilot_ids
+        ):
+            invalid_device_check = True
+            continue
+        observed_pairs.add(pair)
+        profiles_by_pair.setdefault(pair, set()).add(check.profile_id)
+        device_errors.append(check.absolute_error)
+    max_device_error = max(device_errors, default=0.0)
+    common_anchor = (
+        set.intersection(*profiles_by_pair.values()) if profiles_by_pair else set()
+    )
+    device_passed = (
+        observed_pairs == required_pairs
+        and not invalid_device_check
+        and max_device_error <= plan.parity_tolerance
+        and (not required_pairs or bool(common_anchor))
+    )
+    gates.append(
+        GateResult(
+            "cross_device_parity",
+            device_passed,
+            (
+                f"pairs={len(observed_pairs)}/{len(required_pairs)}, "
+                f"common_anchors={len(common_anchor)}, "
+                f"max_abs_nll_error={max_device_error:.6g}"
+            ),
+            max_device_error,
+            plan.parity_tolerance,
+        )
+    )
+
+    numerical_screen_documents = {
+        record.document_id for record in prompts.numerical_screen
+    }
+    split_documents = {check.document_id for check in evidence.bf16_split_checks}
+    split_max = max(
+        (
+            max(check.max_abs_logit_error, check.mean_token_nll_abs_error)
+            for check in evidence.bf16_split_checks
+        ),
+        default=None,
+    )
+    split_passed = (
+        split_documents == numerical_screen_documents
+        and len(evidence.bf16_split_checks) == len(numerical_screen_documents)
+        and all(
+            isinstance(check.token_ids_equal, bool) and check.token_ids_equal
+            for check in evidence.bf16_split_checks
+        )
+        and split_max is not None
+        and split_max <= plan.parity_tolerance
+    )
+    gates.append(
+        GateResult(
+            "bf16_split_parity",
+            split_passed,
+            (
+                f"documents={len(split_documents)}/{len(numerical_screen_documents)}, "
+                + (
+                    f"max_error={split_max:.6g}"
+                    if split_max is not None
+                    else "max_error=missing"
+                )
+            ),
+            split_max,
+            plan.parity_tolerance,
+        )
+    )
+
+    cache_documents = {check.document_id for check in evidence.cache_reuse_checks}
+    cache_max = max(
+        (check.mean_token_nll_abs_error for check in evidence.cache_reuse_checks),
+        default=None,
+    )
+    cache_passed = (
+        cache_documents == numerical_screen_documents
+        and len(evidence.cache_reuse_checks) == len(numerical_screen_documents)
+        and all(
+            isinstance(check.cache_content_equal, bool) and check.cache_content_equal
+            for check in evidence.cache_reuse_checks
+        )
+        and cache_max is not None
+        and cache_max <= plan.parity_tolerance
+    )
+    gates.append(
+        GateResult(
+            "cache_snapshot_reuse",
+            cache_passed,
+            (
+                f"documents={len(cache_documents)}/{len(numerical_screen_documents)}, "
+                + (
+                    f"max_abs_nll_error={cache_max:.6g}"
+                    if cache_max is not None
+                    else "max_abs_nll_error=missing"
+                )
+            ),
+            cache_max,
+            plan.parity_tolerance,
+        )
+    )
+    return PreflightGateReport(
+        manifest_hash=manifest.canonical_hash,
+        run_plan_hash=plan.canonical_hash,
+        gates=tuple(gates),
+    )
+
+
+def make_stage_manifest(
+    manifest: SweepManifest,
+    profile_ids: Sequence[str],
+) -> SweepManifest:
+    """Build a contiguous stage manifest while preserving canonical profiles."""
+
+    by_id = {entry.profile_id: entry for entry in manifest.entries}
+    if len(profile_ids) != len(set(profile_ids)):
+        raise ValueError("stage schedule contains duplicate profile IDs")
+    unknown = set(profile_ids) - set(by_id)
+    if unknown:
+        raise ValueError(f"stage schedule contains unknown profiles: {sorted(unknown)}")
+    entries = tuple(
+        SweepManifestEntry(
+            ordinal=ordinal,
+            profile=by_id[profile_id].profile,
+            legality=by_id[profile_id].legality,
+            validity=by_id[profile_id].validity,
+        )
+        for ordinal, profile_id in enumerate(profile_ids)
+    )
+    return SweepManifest(
+        model_name=manifest.model_name,
+        model_revision=manifest.model_revision,
+        model_architecture=manifest.model_architecture,
+        tokenizer_revision=manifest.tokenizer_revision,
+        quantizer_provenance=manifest.quantizer_provenance,
+        entries=entries,
+    )
+
+
+def _sha256_source(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def build_quantizer_provenance(
+    repository: Path,
+    config: Mapping[str, Any],
+) -> QuantizerProvenance:
+    """Capture every arithmetic source and the imports selected by decode."""
+
+    repository = repository.resolve()
+    workspace = repository.parent
+    executor_config = config.get("executor")
+    if not isinstance(executor_config, Mapping):
+        raise ValueError("config.executor is required")
+    configured_mase = executor_config.get("mase_src")
+    if not configured_mase:
+        raise ValueError("executor.mase_src is required")
+    mase_root = Path(str(configured_mase))
+    if not mase_root.is_absolute():
+        mase_root = repository / mase_root
+    mase_root = mase_root.resolve()
+
+    roots: tuple[tuple[str, Path], ...] = (
+        (
+            "mase_quantizers",
+            mase_root / "chop" / "nn" / "quantizers",
+        ),
+        (
+            "mase_decode_arithmetic",
+            mase_root / "chop" / "nn" / "quantized",
+        ),
+        (
+            "mase_quantize_wiring",
+            mase_root / "chop" / "passes" / "module" / "transforms" / "quantize",
+        ),
+        (
+            "plena_rtl_quantizers",
+            workspace / "PLENA_RTL" / "PLENA_Tools" / "plena_quant",
+        ),
+        (
+            "plena_simulator_quantizers",
+            workspace / "PLENA_Simulator" / "PLENA_Tools" / "plena_quant",
+        ),
+    )
+    selected: list[tuple[str, Path]] = []
+    for component, root in roots:
+        if not root.is_dir():
+            raise ValueError(f"quantizer source root does not exist: {root}")
+        files = tuple(
+            path
+            for path in sorted(root.rglob("*.py"))
+            if "__pycache__" not in path.parts
+        )
+        if not files:
+            raise ValueError(f"quantizer source root contains no Python files: {root}")
+        selected.extend((component, path) for path in files)
+    for path in (
+        mase_root / "chop" / "passes" / "module" / "module_modify_helper.py",
+        mase_root / "chop" / "passes" / "module" / "state_dict_map.py",
+        repository / "decode_dse" / "software" / "precision_bindings.py",
+    ):
+        if not path.is_file():
+            raise ValueError(f"quantizer wiring source does not exist: {path}")
+        component = (
+            "plena_software_binding"
+            if repository in path.parents
+            else "mase_quantize_wiring"
+        )
+        selected.append((component, path))
+
+    sources = tuple(
+        sorted(
+            (
+                QuantizerSource(
+                    component=component,
+                    path=path.resolve().relative_to(workspace).as_posix(),
+                    sha256=_sha256_source(path),
+                )
+                for component, path in selected
+            ),
+            key=lambda source: (source.component, source.path),
+        )
+    )
+    import_paths = {
+        "chop.nn.quantized.functional.vector": (
+            mase_root / "chop/nn/quantized/functional/vector.py"
+        ),
+        "chop.nn.quantized.modules.qwen3": (
+            mase_root / "chop/nn/quantized/modules/qwen3/__init__.py"
+        ),
+        "chop.nn.quantizers._minifloat_mx.fake": (
+            mase_root / "chop/nn/quantizers/_minifloat_mx/fake.py"
+        ),
+        "chop.nn.quantizers.mxfp.fake": (mase_root / "chop/nn/quantizers/mxfp/fake.py"),
+        "chop.nn.quantizers.mxint.fake": (
+            mase_root / "chop/nn/quantizers/mxint/fake.py"
+        ),
+        "chop.passes.module.transforms.quantize.quantize": (
+            mase_root / "chop/passes/module/transforms/quantize/quantize.py"
+        ),
+    }
+    missing = tuple(path for path in import_paths.values() if not path.is_file())
+    if missing:
+        raise ValueError(f"resolved quantizer imports do not exist: {missing}")
+    resolved_imports = tuple(
+        ResolvedImportOrigin(
+            module=module,
+            path=path.resolve().relative_to(workspace).as_posix(),
+        )
+        for module, path in sorted(import_paths.items())
+    )
+    source_paths = {source.path for source in sources}
+    if any(origin.path not in source_paths for origin in resolved_imports):
+        raise ValueError("resolved quantizer imports must be hashed sources")
+    return QuantizerProvenance(
+        sources=sources,
+        resolved_imports=resolved_imports,
+    )
+
+
+def _software_tree_hash(repository: Path) -> str:
+    digest = hashlib.sha256()
+    files = sorted(
+        path
+        for path in (repository / "decode_dse").rglob("*")
+        if path.is_file()
+        and path.suffix in {".py", ".json", ".sh"}
+        and "__pycache__" not in path.parts
+    )
+    for path in files:
+        relative = path.relative_to(repository).as_posix().encode("utf-8")
+        payload = path.read_bytes()
+        digest.update(len(relative).to_bytes(8, "little"))
+        digest.update(relative)
+        digest.update(len(payload).to_bytes(8, "little"))
+        digest.update(payload)
+    return digest.hexdigest()
+
+
+def _mase_tree_hash(
+    repository: Path,
+    config: Mapping[str, Any],
+) -> str:
+    executor_config = config.get("executor")
+    if not isinstance(executor_config, Mapping):
+        raise ValueError("config.executor is required")
+    configured = executor_config.get("mase_src")
+    if not configured:
+        raise ValueError("executor.mase_src is required")
+    root = Path(str(configured))
+    if not root.is_absolute():
+        root = repository / root
+    root = root.resolve()
+    if not root.is_dir():
+        raise ValueError(f"MASE source tree does not exist: {root}")
+    digest = hashlib.sha256()
+    files = sorted(
+        path
+        for path in root.rglob("*")
+        if path.is_file()
+        and path.suffix in {".py", ".json"}
+        and "__pycache__" not in path.parts
+    )
+    if not files:
+        raise ValueError(f"MASE source tree contains no tracked source files: {root}")
+    for path in files:
+        relative = path.relative_to(root).as_posix().encode("utf-8")
+        payload = path.read_bytes()
+        digest.update(len(relative).to_bytes(8, "little"))
+        digest.update(relative)
+        digest.update(len(payload).to_bytes(8, "little"))
+        digest.update(payload)
+    return digest.hexdigest()
+
+
+def profile_to_decode_quant_spec(
+    profile: DecodePrecisionProfile,
+) -> Any | None:
+    """Map a canonical numerical profile to the decode quantizer binding."""
+
+    if profile.kind == PROFILE_KIND_BF16_REFERENCE:
+        return None
+    from decode_dse.software.precision_bindings import DecodeQuantSpec
+
+    def operand(token: str) -> tuple[str, Any]:
+        descriptor = format_descriptor(token)
+        if descriptor.family == "mxint":
+            return "mxint", descriptor.element_bits
+        if descriptor.family == "mxfp":
+            return "mxfp", (descriptor.exponent_bits, descriptor.mantissa_bits)
+        raise ValueError(f"{token!r} is not an MX operand format")
+
+    weight_family, weight_width = operand(profile.weight_format)
+    activation_family, activation_width = operand(profile.activation_format)
+    kv_family, kv_width = operand(profile.kv_format)
+    return DecodeQuantSpec(
+        attn_w=weight_width,
+        ffn_w=weight_width,
+        kv=kv_width,
+        w_fmt=weight_family,
+        kv_fmt=kv_family,
+        weight_block=profile.block_size,
+        kv_block=profile.block_size,
+        act_w=activation_width,
+        act_fmt=activation_family,
+        act_block=profile.block_size,
+        use_gptq=False,
+        use_rotation=False,
+        fp_setting=profile.vector_format,
+        fp_setting_attention=True,
+        quant_attn_internals=True,
+    )
+
+
+@dataclass(frozen=True)
+class ExecutorContext:
+    """Pinned resources provided to an injected evaluation executor."""
+
+    stage: str
+    workspace_root: Path
+    output_dir: Path
+    config: Mapping[str, Any]
+    master_manifest: SweepManifest
+    stage_manifest: SweepManifest
+    run_plan: SweepRunPlan
+    prompts: PromptManifest
+    sample_contract: StageSampleContract
+    shard_index: int
+    shard_count: int
+    device_label: str
+
+
+__all__ = [
+    "ExecutorContext",
+    "profile_to_decode_quant_spec",
+    "BF16SplitCheck",
+    "CacheReuseCheck",
+    "GateResult",
+    "GPUBaselinePlan",
+    "MAX_PROJECTED_HOURS",
+    "NativeAppendValidationSample",
+    "NLLParityCheck",
+    "PARITY_TOLERANCE",
+    "PREFLIGHT_PROFILE_COUNT",
+    "PreflightEvidence",
+    "PreflightGateReport",
+    "PromptManifest",
+    "PromptRecord",
+    "RuntimeRebindingSample",
+    "RuntimeSample",
+    "NUMERICAL_SCREEN_PROFILE_COUNT",
+    "NUMERICAL_SCREEN_SAMPLE_CONTRACT",
+    "HARDWARE_VALIDATION_PROFILE_COUNT",
+    "HARDWARE_VALIDATION_SAMPLE_CONTRACT",
+    "StageSampleContract",
+    "SweepRunPlan",
+    "WeightBankBuildSample",
+    "build_run_plan",
+    "build_quantizer_provenance",
+    "evaluate_preflight_gates",
+    "load_immutable_json",
+    "load_preflight_evidence",
+    "load_prompt_manifest",
+    "make_stage_manifest",
+    "preflight_required_features",
+    "select_preflight_entries",
+    "validate_exhaustive_manifest",
+    "validate_run_plan",
+    "write_immutable_json",
+]
diff --git a/decode_dse/software/sweep_runner.py b/decode_dse/software/sweep_runner.py
new file mode 100644
index 0000000..cf522a1
--- /dev/null
+++ b/decode_dse/software/sweep_runner.py
@@ -0,0 +1,1040 @@
+"""Deterministic, restartable execution for the canonical decode sweep."""
+
+from __future__ import annotations
+
+import fcntl
+import hashlib
+import json
+import math
+import os
+import re
+import tempfile
+import time
+import traceback
+from contextlib import AbstractContextManager, ExitStack, contextmanager
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from itertools import groupby
+from pathlib import Path
+from typing import Any, Callable, Mapping, Protocol, Sequence
+
+from decode_dse.legality import constrain_stack_validity, merge_stack_validity
+from decode_dse.legality import StackValidity
+from decode_dse.manifest import (
+    StatusJournal,
+    SweepManifest,
+    SweepManifestEntry,
+    write_manifest,
+)
+from decode_dse.profiles import DECODE_FORMATS, VECTOR_FORMATS
+
+RESULT_SCHEMA = "decode-sweep-result"
+COMPLETION_SCHEMA = "decode-sweep-completion"
+_SHARD_TOKEN = re.compile(r"^[A-Za-z0-9_.-]+$")
+_DECODE_FORMAT_ORDER = {token: index for index, token in enumerate(DECODE_FORMATS)}
+_VECTOR_FORMAT_ORDER = {token: index for index, token in enumerate(VECTOR_FORMATS)}
+
+
+def _timestamp() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _canonical_json(value: Mapping[str, Any]) -> bytes:
+    return (
+        json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        )
+        + "\n"
+    ).encode("utf-8")
+
+
+def _content_hash(value: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _safe_shard_name(weight_format: str) -> str:
+    if not _SHARD_TOKEN.fullmatch(weight_format):
+        raise ValueError(f"unsafe weight format for result shard: {weight_format!r}")
+    return f"{weight_format}.jsonl"
+
+
+def _group_execution_key(entry: SweepManifestEntry) -> tuple[int, int, int, int]:
+    """Keep each admitted KV representation hot across A and vector settings."""
+
+    fallback = len(DECODE_FORMATS)
+    return (
+        _DECODE_FORMAT_ORDER.get(entry.profile.kv_format, fallback),
+        _DECODE_FORMAT_ORDER.get(entry.profile.activation_format, fallback),
+        _VECTOR_FORMAT_ORDER.get(entry.profile.vector_format, len(VECTOR_FORMATS)),
+        entry.ordinal,
+    )
+
+
+def _sanitize_result(value: Any, path: str = "result") -> tuple[Any, tuple[str, ...]]:
+    non_finite: list[str] = []
+
+    def visit(item: Any, item_path: str) -> Any:
+        if item is None or isinstance(item, (str, bool, int)):
+            return item
+        if isinstance(item, float):
+            if math.isfinite(item):
+                return item
+            non_finite.append(item_path)
+            if math.isnan(item):
+                token = "NaN"
+            elif item > 0:
+                token = "+Infinity"
+            else:
+                token = "-Infinity"
+            return {"__nonfinite__": token}
+        if isinstance(item, Path):
+            return str(item)
+        if isinstance(item, Mapping):
+            return {
+                str(key): visit(child, f"{item_path}.{key}")
+                for key, child in sorted(item.items(), key=lambda pair: str(pair[0]))
+            }
+        if isinstance(item, (tuple, list)):
+            return [
+                visit(child, f"{item_path}[{index}]")
+                for index, child in enumerate(item)
+            ]
+        if hasattr(item, "item"):
+            return visit(item.item(), item_path)
+        raise TypeError(f"{item_path} has unsupported type {type(item).__name__}")
+
+    return visit(value, path), tuple(non_finite)
+
+
+class NonFiniteResultError(FloatingPointError):
+    """Raised when an evaluation returns a non-finite numeric metric."""
+
+    def __init__(self, paths: Sequence[str]) -> None:
+        self.paths = tuple(paths)
+        super().__init__("non-finite metrics at " + ", ".join(self.paths))
+
+
+@dataclass(frozen=True)
+class EvaluationOutcome:
+    """Finite metrics and measured cross-stack validity for one profile."""
+
+    metrics: Mapping[str, Any]
+    validity: StackValidity = StackValidity()
+    artifacts: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "metrics", dict(self.metrics))
+        object.__setattr__(
+            self, "artifacts", tuple(str(artifact) for artifact in self.artifacts)
+        )
+
+
+class ExhaustiveSweepExecutor(Protocol):
+    """Resource lifecycle implemented by the numerical evaluation stack."""
+
+    def open_weight_bank(
+        self,
+        weight_format: str,
+        entries: tuple[SweepManifestEntry, ...],
+    ) -> AbstractContextManager[Any]: ...
+
+    def open_kv_admission_cache(
+        self,
+        kv_format: str,
+    ) -> AbstractContextManager[Any]: ...
+
+    def evaluate(
+        self,
+        entry: SweepManifestEntry,
+        *,
+        weight_bank: Any,
+        kv_admission_cache: Any,
+    ) -> EvaluationOutcome: ...
+
+
+@dataclass(frozen=True)
+class ResultPointer:
+    """Stable location and identity of one append-only result row."""
+
+    relative_path: str
+    record_hash: str
+    record: Mapping[str, Any]
+
+    @property
+    def journal_path(self) -> str:
+        return f"{self.relative_path}#{self.record_hash}"
+
+
+class ResultShardStore:
+    """Append-only result shards with torn-tail recovery and row checksums."""
+
+    def __init__(self, root: Path, manifest: SweepManifest) -> None:
+        self.root = root
+        self.manifest = manifest
+        self.shard_root = root / "shards"
+        self.shard_root.mkdir(parents=True, exist_ok=True)
+        self._profile_ids = {entry.profile_id: entry for entry in manifest.entries}
+        self._records: dict[tuple[str, int], ResultPointer] = {}
+        self._load()
+
+    def _repair_torn_tail(self, path: Path) -> None:
+        descriptor = os.open(path, os.O_RDWR)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            size = os.lseek(descriptor, 0, os.SEEK_END)
+            if size == 0:
+                return
+            os.lseek(descriptor, 0, os.SEEK_SET)
+            payload = os.read(descriptor, size)
+            if payload.endswith(b"\n"):
+                return
+            end = payload.rfind(b"\n") + 1
+            os.ftruncate(descriptor, end)
+            os.fsync(descriptor)
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def _load(self) -> None:
+        for path in sorted(self.shard_root.glob("*.jsonl")):
+            self._repair_torn_tail(path)
+            relative = str(path.relative_to(self.root))
+            with path.open("r", encoding="utf-8") as handle:
+                for line_number, line in enumerate(handle, start=1):
+                    value = json.loads(line)
+                    record_hash = value.pop("record_hash", None)
+                    if record_hash != _content_hash(value):
+                        raise ValueError(
+                            f"result checksum mismatch at {path}:{line_number}"
+                        )
+                    if value.get("manifest_hash") != self.manifest.canonical_hash:
+                        raise ValueError(
+                            f"result manifest mismatch at {path}:{line_number}"
+                        )
+                    profile_id = str(value["profile_id"])
+                    entry = self._profile_ids.get(profile_id)
+                    if entry is None:
+                        raise ValueError(f"unknown profile at {path}:{line_number}")
+                    if int(value["ordinal"]) != entry.ordinal:
+                        raise ValueError(
+                            f"result ordinal mismatch at {path}:{line_number}"
+                        )
+                    if value.get("profile") != entry.profile.to_dict():
+                        raise ValueError(
+                            f"result profile mismatch at {path}:{line_number}"
+                        )
+                    if entry.profile.weight_format != value["weight_format"]:
+                        raise ValueError(
+                            f"result shard mismatch at {path}:{line_number}"
+                        )
+                    expected_shard = _safe_shard_name(entry.profile.weight_format)
+                    if path.name != expected_shard:
+                        raise ValueError(
+                            f"result is in the wrong shard at {path}:{line_number}"
+                        )
+                    attempt = int(value["attempt"])
+                    if attempt < 1 or value.get("state") not in {
+                        "succeeded",
+                        "failed",
+                    }:
+                        raise ValueError(
+                            f"invalid result state at {path}:{line_number}"
+                        )
+                    StackValidity.from_dict(value.get("validity"))
+                    key = (profile_id, attempt)
+                    if key in self._records:
+                        raise ValueError(f"duplicate result attempt for {profile_id}")
+                    record = value | {"record_hash": record_hash}
+                    self._records[key] = ResultPointer(
+                        relative_path=relative,
+                        record_hash=record_hash,
+                        record=record,
+                    )
+
+    def get(self, profile_id: str, attempt: int) -> ResultPointer | None:
+        return self._records.get((profile_id, attempt))
+
+    @property
+    def records(self) -> tuple[ResultPointer, ...]:
+        return tuple(
+            sorted(
+                self._records.values(),
+                key=lambda pointer: (
+                    int(pointer.record["ordinal"]),
+                    int(pointer.record["attempt"]),
+                ),
+            )
+        )
+
+    def append(
+        self,
+        entry: SweepManifestEntry,
+        *,
+        attempt: int,
+        state: str,
+        validity: StackValidity,
+        result: Any,
+        artifacts: Sequence[str] = (),
+        error: BaseException | None = None,
+        traceback_text: str | None = None,
+        runtime_seconds: float,
+    ) -> ResultPointer:
+        if state not in {"succeeded", "failed"}:
+            raise ValueError(f"unsupported result state {state!r}")
+        key = (entry.profile_id, attempt)
+        if key in self._records:
+            raise ValueError(
+                f"result already exists for {entry.profile_id} attempt {attempt}"
+            )
+        safe_result, non_finite = _sanitize_result(result)
+        if non_finite and state != "failed":
+            raise NonFiniteResultError(non_finite)
+        body: dict[str, Any] = {
+            "schema_version": RESULT_SCHEMA,
+            "manifest_hash": self.manifest.canonical_hash,
+            "ordinal": entry.ordinal,
+            "profile_id": entry.profile_id,
+            "profile": entry.profile.to_dict(),
+            "weight_format": entry.profile.weight_format,
+            "attempt": attempt,
+            "state": state,
+            "validity": validity.to_dict(),
+            "result": safe_result,
+            "artifacts": [str(path) for path in artifacts],
+            "error_class": type(error).__name__ if error is not None else None,
+            "error_message": str(error) if error is not None else None,
+            "traceback": traceback_text,
+            "runtime_seconds": float(runtime_seconds),
+            "completed_at": _timestamp(),
+        }
+        record_hash = _content_hash(body)
+        record = body | {"record_hash": record_hash}
+        shard_path = self.shard_root / _safe_shard_name(entry.profile.weight_format)
+        payload = _canonical_json(record)
+        descriptor = os.open(shard_path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o644)
+        try:
+            fcntl.flock(descriptor, fcntl.LOCK_EX)
+            offset = 0
+            while offset < len(payload):
+                written = os.write(descriptor, payload[offset:])
+                if written <= 0:
+                    raise OSError("incomplete result journal append")
+                offset += written
+            os.fsync(descriptor)
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+        pointer = ResultPointer(
+            relative_path=str(shard_path.relative_to(self.root)),
+            record_hash=record_hash,
+            record=record,
+        )
+        self._records[key] = pointer
+        return pointer
+
+
+class CompletionStore:
+    """Atomic terminal markers derived from the status and result journals."""
+
+    def __init__(self, root: Path, manifest: SweepManifest) -> None:
+        self.root = root / "completed"
+        self.root.mkdir(parents=True, exist_ok=True)
+        self.manifest = manifest
+
+    def mark(
+        self,
+        entry: SweepManifestEntry,
+        *,
+        state: str,
+        attempt: int,
+        result: ResultPointer,
+    ) -> Path:
+        if state not in {"succeeded", "failed"}:
+            raise ValueError("completion markers require a terminal state")
+        body = {
+            "schema_version": COMPLETION_SCHEMA,
+            "manifest_hash": self.manifest.canonical_hash,
+            "profile_id": entry.profile_id,
+            "ordinal": entry.ordinal,
+            "state": state,
+            "attempt": attempt,
+            "result_path": result.journal_path,
+        }
+        marker_hash = _content_hash(body)
+        payload = _canonical_json(body | {"marker_hash": marker_hash})
+        destination = self.root / f"{entry.profile_id}.json"
+        if destination.exists():
+            existing = json.loads(destination.read_text(encoding="utf-8"))
+            if existing != json.loads(payload):
+                raise ValueError(f"conflicting completion marker: {destination}")
+            return destination
+        temporary_name: str | None = None
+        try:
+            with tempfile.NamedTemporaryFile(
+                mode="wb",
+                dir=self.root,
+                prefix=f".{entry.profile_id}.",
+                suffix=".tmp",
+                delete=False,
+            ) as temporary:
+                temporary_name = temporary.name
+                temporary.write(payload)
+                temporary.flush()
+                os.fsync(temporary.fileno())
+            os.link(temporary_name, destination)
+        finally:
+            if temporary_name and os.path.exists(temporary_name):
+                os.unlink(temporary_name)
+        return destination
+
+
+@dataclass(frozen=True)
+class SweepRunSummary:
+    """Terminal and pending counts after one runner invocation."""
+
+    attempts_written: int
+    succeeded: int
+    failed_terminal: int
+    pending: int
+    result_rows: int
+
+
+class SweepProgressReporter:
+    """Persist and print measured profile and weight-bank progress."""
+
+    def __init__(
+        self,
+        *,
+        output_dir: Path,
+        stage: str,
+        total_profiles: int,
+        initial_succeeded: int,
+        initial_failed_terminal: int,
+        required_weight_banks: Sequence[str],
+        prior_trial_seconds: Sequence[float] = (),
+        emit: Callable[[str], None] = print,
+    ) -> None:
+        self.output_dir = output_dir
+        self.stage = stage
+        self.work_class = (
+            "hardware-validation"
+            if stage in {"hardware-validation", "validation-pilot"}
+            else "numerical"
+        )
+        self.total_profiles = int(total_profiles)
+        self.succeeded = int(initial_succeeded)
+        self.failed_terminal = int(initial_failed_terminal)
+        self.required_weight_banks = tuple(dict.fromkeys(required_weight_banks))
+        self.opened_weight_banks: set[str] = set()
+        self.trial_seconds = [
+            float(value) for value in prior_trial_seconds if float(value) > 0
+        ]
+        self.bank_open_seconds: list[float] = []
+        self.attempts_observed = 0
+        self._terminal_reports = 0
+        self._emit = emit
+
+    @property
+    def completed(self) -> int:
+        return self.succeeded + self.failed_terminal
+
+    def _mean(self, values: Sequence[float]) -> float | None:
+        return sum(values) / len(values) if values else None
+
+    def _payload(
+        self,
+        *,
+        event: str,
+        last_trial_seconds: float | None = None,
+        last_bank_seconds: float | None = None,
+    ) -> dict[str, Any]:
+        mean_trial = (
+            sum(self.trial_seconds) / self.completed
+            if self.trial_seconds and self.completed
+            else None
+        )
+        mean_bank = self._mean(self.bank_open_seconds)
+        profiles_remaining = max(0, self.total_profiles - self.completed)
+        banks_remaining = max(
+            0,
+            len(self.required_weight_banks) - len(self.opened_weight_banks),
+        )
+        remaining_seconds = None
+        if mean_trial is not None:
+            remaining_seconds = profiles_remaining * mean_trial
+            if mean_bank is not None:
+                remaining_seconds += banks_remaining * mean_bank
+        completion = (
+            datetime.fromtimestamp(
+                datetime.now(timezone.utc).timestamp() + remaining_seconds,
+                tz=timezone.utc,
+            )
+            .isoformat()
+            .replace("+00:00", "Z")
+            if remaining_seconds is not None
+            else None
+        )
+        return {
+            "schema_version": "decode-sweep-progress",
+            "event": event,
+            "stage": self.stage,
+            "work_class": self.work_class,
+            "completed_profiles": self.completed,
+            "succeeded_profiles": self.succeeded,
+            "failed_terminal_profiles": self.failed_terminal,
+            "total_profiles": self.total_profiles,
+            "remaining_profiles": profiles_remaining,
+            "attempts_observed_this_invocation": self.attempts_observed,
+            "unique_weight_banks_opened": len(self.opened_weight_banks),
+            "unique_weight_banks_required_this_invocation": len(
+                self.required_weight_banks
+            ),
+            "unique_weight_banks_remaining": banks_remaining,
+            "last_trial_seconds": last_trial_seconds,
+            "mean_trial_seconds": mean_trial,
+            "last_weight_bank_open_seconds": last_bank_seconds,
+            "mean_weight_bank_open_seconds": mean_bank,
+            "estimated_remaining_seconds": remaining_seconds,
+            "estimated_completion_utc": completion,
+            "updated_at": _timestamp(),
+        }
+
+    def _publish(self, payload: Mapping[str, Any]) -> None:
+        self.output_dir.mkdir(parents=True, exist_ok=True)
+        destination = self.output_dir / "progress.json"
+        temporary_name: str | None = None
+        try:
+            with tempfile.NamedTemporaryFile(
+                mode="w",
+                encoding="utf-8",
+                dir=self.output_dir,
+                prefix=".progress.",
+                suffix=".tmp",
+                delete=False,
+            ) as temporary:
+                temporary_name = temporary.name
+                json.dump(dict(payload), temporary, indent=2, sort_keys=True)
+                temporary.write("\n")
+                temporary.flush()
+                os.fsync(temporary.fileno())
+            os.replace(temporary_name, destination)
+            temporary_name = None
+        finally:
+            if temporary_name and os.path.exists(temporary_name):
+                os.unlink(temporary_name)
+        eta = payload["estimated_remaining_seconds"]
+        eta_text = "unknown" if eta is None else f"{float(eta):.1f}s"
+        trial = payload["last_trial_seconds"]
+        trial_text = "n/a" if trial is None else f"{float(trial):.3f}s"
+        mean_trial = payload["mean_trial_seconds"]
+        mean_trial_text = "n/a" if mean_trial is None else f"{float(mean_trial):.3f}s"
+        bank = payload["last_weight_bank_open_seconds"]
+        bank_text = "n/a" if bank is None else f"{float(bank):.3f}s"
+        self._emit(
+            "sweep-progress "
+            f"event={payload['event']} stage={self.stage} class={self.work_class} "
+            f"profiles={self.completed}/{self.total_profiles} "
+            f"succeeded={self.succeeded} failed={self.failed_terminal} "
+            f"unique-banks={len(self.opened_weight_banks)}/{len(self.required_weight_banks)} "
+            f"attempt={trial_text} measured-per-completed-trial={mean_trial_text} "
+            f"bank-open={bank_text} remaining-eta={eta_text}"
+        )
+
+    def start(self) -> None:
+        self._publish(self._payload(event="resume" if self.completed else "start"))
+
+    def record_weight_bank(self, weight_format: str, seconds: float) -> None:
+        self.opened_weight_banks.add(weight_format)
+        if seconds > 0:
+            self.bank_open_seconds.append(float(seconds))
+        self._publish(
+            self._payload(event="weight-bank-opened", last_bank_seconds=seconds)
+        )
+
+    def record_weight_bank_failure(self, seconds: float) -> None:
+        if seconds > 0:
+            self.bank_open_seconds.append(float(seconds))
+        self._publish(
+            self._payload(event="weight-bank-failed", last_bank_seconds=seconds)
+        )
+
+    def record_attempt(
+        self,
+        *,
+        state: str,
+        terminal: bool,
+        seconds: float,
+    ) -> None:
+        self.attempts_observed += 1
+        if seconds > 0:
+            self.trial_seconds.append(float(seconds))
+        if terminal:
+            if state == "succeeded":
+                self.succeeded += 1
+            elif state == "failed":
+                self.failed_terminal += 1
+            else:
+                raise ValueError(f"unsupported terminal progress state {state!r}")
+            self._terminal_reports += 1
+        event = (
+            "first-completion"
+            if terminal and self._terminal_reports == 1
+            else ("profile-completed" if terminal else "retry-required")
+        )
+        self._publish(self._payload(event=event, last_trial_seconds=float(seconds)))
+
+
+class ExhaustiveSweepRunner:
+    """Run manifest entries by weight bank with deterministic three-attempt resume."""
+
+    def __init__(
+        self,
+        *,
+        manifest: SweepManifest,
+        output_dir: str | Path,
+        executor: ExhaustiveSweepExecutor,
+        max_attempts: int = 3,
+        stage: str = "sweep",
+        clock: Callable[[], float] = time.monotonic,
+        emit_progress: Callable[[str], None] = print,
+    ) -> None:
+        if max_attempts < 1:
+            raise ValueError("max_attempts must be positive")
+        self.manifest = manifest
+        self.output_dir = Path(output_dir)
+        self.executor = executor
+        self.max_attempts = max_attempts
+        self.stage = str(stage)
+        self.clock = clock
+        self.emit_progress = emit_progress
+        self.entries = {entry.profile_id: entry for entry in manifest.entries}
+
+    @contextmanager
+    def _run_lock(self):
+        self.output_dir.mkdir(parents=True, exist_ok=True)
+        path = self.output_dir / "runner.lock"
+        descriptor = os.open(path, os.O_CREAT | os.O_RDWR, 0o644)
+        try:
+            try:
+                fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError as exc:
+                raise RuntimeError(f"another sweep runner owns {path}") from exc
+            yield
+        finally:
+            fcntl.flock(descriptor, fcntl.LOCK_UN)
+            os.close(descriptor)
+
+    def _write_failure(
+        self,
+        *,
+        entry: SweepManifestEntry,
+        attempt: int,
+        error: BaseException,
+        validity: StackValidity,
+        store: ResultShardStore,
+        journal: StatusJournal,
+        runtime_seconds: float,
+        result: Any = None,
+        traceback_text: str | None = None,
+    ) -> ResultPointer:
+        pointer = store.append(
+            entry,
+            attempt=attempt,
+            state="failed",
+            validity=validity,
+            result=result,
+            error=error,
+            traceback_text=traceback_text,
+            runtime_seconds=runtime_seconds,
+        )
+        journal.fail(entry.profile_id, error=error, validity=validity)
+        return pointer
+
+    def _recover(
+        self,
+        store: ResultShardStore,
+        journal: StatusJournal,
+        completions: CompletionStore,
+    ) -> None:
+        latest = journal.latest()
+        for profile_id, status in latest.items():
+            if status.state != "running":
+                continue
+            entry = self.entries[profile_id]
+            pointer = store.get(profile_id, status.attempt)
+            if pointer is None:
+                error = RuntimeError("interrupted before a result row was committed")
+                pointer = self._write_failure(
+                    entry=entry,
+                    attempt=status.attempt,
+                    error=error,
+                    validity=status.validity,
+                    store=store,
+                    journal=journal,
+                    runtime_seconds=0.0,
+                    result={"recovered": True},
+                )
+            elif pointer.record["state"] == "succeeded":
+                validity = StackValidity.from_dict(pointer.record["validity"])
+                journal.complete(
+                    profile_id,
+                    validity=validity,
+                    result_path=pointer.journal_path,
+                )
+            else:
+                validity = StackValidity.from_dict(pointer.record["validity"])
+                error = (
+                    f"{pointer.record['error_class']}: "
+                    f"{pointer.record['error_message']}"
+                )
+                journal.fail(profile_id, error=error, validity=validity)
+
+        latest = journal.latest()
+        for profile_id, status in latest.items():
+            terminal = status.state == "succeeded" or (
+                status.state == "failed" and status.attempt >= self.max_attempts
+            )
+            if not terminal:
+                continue
+            pointer = store.get(profile_id, status.attempt)
+            if pointer is None:
+                raise ValueError(f"terminal status has no result row: {profile_id}")
+            if (
+                status.state == "succeeded"
+                and status.result_path != pointer.journal_path
+            ):
+                raise ValueError(
+                    f"terminal status points to a different result: {profile_id}"
+                )
+            if pointer.record["state"] != status.state:
+                raise ValueError(f"terminal status/result disagreement: {profile_id}")
+            completions.mark(
+                self.entries[profile_id],
+                state=status.state,
+                attempt=status.attempt,
+                result=pointer,
+            )
+
+    def _evaluate_entry(
+        self,
+        entry: SweepManifestEntry,
+        *,
+        weight_bank: Any,
+        kv_cache: Any,
+        store: ResultShardStore,
+        journal: StatusJournal,
+        completions: CompletionStore,
+    ) -> tuple[str, bool, float]:
+        running = journal.begin(entry.profile_id)
+        started = self.clock()
+        try:
+            outcome = self.executor.evaluate(
+                entry,
+                weight_bank=weight_bank,
+                kv_admission_cache=kv_cache,
+            )
+            if not isinstance(outcome, EvaluationOutcome):
+                raise TypeError("executor.evaluate must return EvaluationOutcome")
+            validity = constrain_stack_validity(
+                entry.profile,
+                merge_stack_validity(entry.validity, outcome.validity),
+            )
+            if validity.software_valid is False:
+                raise ValueError("successful evaluation cannot be software-invalid")
+            if validity.software_valid is None:
+                validity = validity.updated(software_valid=True)
+            safe_metrics, non_finite = _sanitize_result(outcome.metrics)
+            if non_finite:
+                raise NonFiniteResultError(non_finite)
+        except Exception as error:
+            validity = (
+                merge_stack_validity(
+                    entry.validity,
+                    StackValidity(software_valid=False),
+                )
+                if isinstance(error, NonFiniteResultError)
+                else entry.validity
+            )
+            result = None
+            if "outcome" in locals() and isinstance(outcome, EvaluationOutcome):
+                try:
+                    result = _sanitize_result(outcome.metrics)[0]
+                except Exception:
+                    result = {"unserializable_result": repr(outcome.metrics)}
+            elapsed = self.clock() - started
+            pointer = self._write_failure(
+                entry=entry,
+                attempt=running.attempt,
+                error=error,
+                validity=validity,
+                store=store,
+                journal=journal,
+                runtime_seconds=elapsed,
+                result=result,
+                traceback_text=traceback.format_exc(),
+            )
+            if running.attempt >= self.max_attempts:
+                completions.mark(
+                    entry,
+                    state="failed",
+                    attempt=running.attempt,
+                    result=pointer,
+                )
+            return "failed", running.attempt >= self.max_attempts, elapsed
+
+        elapsed = self.clock() - started
+        pointer = store.append(
+            entry,
+            attempt=running.attempt,
+            state="succeeded",
+            validity=validity,
+            result=safe_metrics,
+            artifacts=outcome.artifacts,
+            runtime_seconds=elapsed,
+        )
+        journal.complete(
+            entry.profile_id,
+            validity=validity,
+            result_path=pointer.journal_path,
+        )
+        completions.mark(
+            entry,
+            state="succeeded",
+            attempt=running.attempt,
+            result=pointer,
+        )
+        return "succeeded", True, elapsed
+
+    def _fail_unopened_group(
+        self,
+        entries: Sequence[SweepManifestEntry],
+        error: BaseException,
+        *,
+        store: ResultShardStore,
+        journal: StatusJournal,
+        completions: CompletionStore,
+    ) -> tuple[tuple[str, bool, float], ...]:
+        results: list[tuple[str, bool, float]] = []
+        for entry in entries:
+            running = journal.begin(entry.profile_id)
+            pointer = self._write_failure(
+                entry=entry,
+                attempt=running.attempt,
+                error=error,
+                validity=entry.validity,
+                store=store,
+                journal=journal,
+                runtime_seconds=0.0,
+                traceback_text=traceback.format_exc(),
+            )
+            if running.attempt >= self.max_attempts:
+                completions.mark(
+                    entry,
+                    state="failed",
+                    attempt=running.attempt,
+                    result=pointer,
+                )
+            results.append(("failed", running.attempt >= self.max_attempts, 0.0))
+        return tuple(results)
+
+    def _summary(
+        self, journal: StatusJournal, store: ResultShardStore, attempts: int
+    ) -> SweepRunSummary:
+        latest = journal.latest()
+        succeeded = sum(record.state == "succeeded" for record in latest.values())
+        failed_terminal = sum(
+            record.state == "failed" and record.attempt >= self.max_attempts
+            for record in latest.values()
+        )
+        return SweepRunSummary(
+            attempts_written=attempts,
+            succeeded=succeeded,
+            failed_terminal=failed_terminal,
+            pending=len(self.manifest.entries) - succeeded - failed_terminal,
+            result_rows=len(store.records),
+        )
+
+    def run(self, *, limit: int | None = None) -> SweepRunSummary:
+        """Execute or resume profiles until success or the attempt limit."""
+        if limit is not None and limit < 0:
+            raise ValueError("limit must be non-negative")
+        with self._run_lock():
+            write_manifest(self.output_dir / "manifest.json", self.manifest)
+            journal = StatusJournal(self.output_dir / "status.jsonl", self.manifest)
+            store = ResultShardStore(self.output_dir, self.manifest)
+            completions = CompletionStore(self.output_dir, self.manifest)
+            initial_rows = len(store.records)
+            self._recover(store, journal, completions)
+            remaining_limit = limit
+            latest = journal.latest()
+            initial_succeeded = sum(
+                status.state == "succeeded" for status in latest.values()
+            )
+            initial_failed = sum(
+                status.state == "failed" and status.attempt >= self.max_attempts
+                for status in latest.values()
+            )
+            pending_ids = {
+                profile_id
+                for profile_id, status in latest.items()
+                if not (
+                    status.state == "succeeded"
+                    or (
+                        status.state == "failed" and status.attempt >= self.max_attempts
+                    )
+                )
+            }
+            required_weight_banks = tuple(
+                dict.fromkeys(
+                    entry.profile.weight_format
+                    for entry in self.manifest.entries
+                    if entry.profile_id in pending_ids
+                )
+            )
+            progress = SweepProgressReporter(
+                output_dir=self.output_dir,
+                stage=self.stage,
+                total_profiles=len(self.manifest.entries),
+                initial_succeeded=initial_succeeded,
+                initial_failed_terminal=initial_failed,
+                required_weight_banks=required_weight_banks,
+                prior_trial_seconds=tuple(
+                    float(pointer.record["runtime_seconds"])
+                    for pointer in store.records
+                    if float(pointer.record["runtime_seconds"]) > 0
+                ),
+                emit=self.emit_progress,
+            )
+            progress.start()
+
+            with ExitStack():
+                while True:
+                    pending = journal.next_entries(
+                        max_attempts=self.max_attempts,
+                        limit=remaining_limit,
+                    )
+                    if not pending:
+                        break
+                    groups: dict[str, list[SweepManifestEntry]] = {}
+                    for entry in pending:
+                        groups.setdefault(entry.profile.weight_format, []).append(entry)
+
+                    for weight_format, group_values in groups.items():
+                        group = tuple(sorted(group_values, key=_group_execution_key))
+                        weight_stack = ExitStack()
+                        bank_started = self.clock()
+                        try:
+                            weight_bank = weight_stack.enter_context(
+                                self.executor.open_weight_bank(weight_format, group)
+                            )
+                        except Exception as error:
+                            bank_seconds = self.clock() - bank_started
+                            progress.record_weight_bank_failure(bank_seconds)
+                            weight_stack.close()
+                            outcomes = self._fail_unopened_group(
+                                group,
+                                error,
+                                store=store,
+                                journal=journal,
+                                completions=completions,
+                            )
+                            for state, terminal, seconds in outcomes:
+                                progress.record_attempt(
+                                    state=state,
+                                    terminal=terminal,
+                                    seconds=seconds,
+                                )
+                            if remaining_limit is not None:
+                                remaining_limit -= len(group)
+                                if remaining_limit <= 0:
+                                    return self._summary(
+                                        journal,
+                                        store,
+                                        len(store.records) - initial_rows,
+                                    )
+                            continue
+
+                        progress.record_weight_bank(
+                            weight_format,
+                            self.clock() - bank_started,
+                        )
+                        with weight_stack:
+                            for kv_format, format_entries in groupby(
+                                group,
+                                key=lambda entry: entry.profile.kv_format,
+                            ):
+                                format_group = tuple(format_entries)
+                                try:
+                                    cache_context = (
+                                        self.executor.open_kv_admission_cache(kv_format)
+                                    )
+                                    kv_cache = cache_context.__enter__()
+                                except Exception as error:
+                                    outcomes = self._fail_unopened_group(
+                                        format_group,
+                                        error,
+                                        store=store,
+                                        journal=journal,
+                                        completions=completions,
+                                    )
+                                    for state, terminal, seconds in outcomes:
+                                        progress.record_attempt(
+                                            state=state,
+                                            terminal=terminal,
+                                            seconds=seconds,
+                                        )
+                                else:
+                                    try:
+                                        for entry in format_group:
+                                            state, terminal, seconds = (
+                                                self._evaluate_entry(
+                                                    entry,
+                                                    weight_bank=weight_bank,
+                                                    kv_cache=kv_cache,
+                                                    store=store,
+                                                    journal=journal,
+                                                    completions=completions,
+                                                )
+                                            )
+                                            progress.record_attempt(
+                                                state=state,
+                                                terminal=terminal,
+                                                seconds=seconds,
+                                            )
+                                    finally:
+                                        cache_context.__exit__(None, None, None)
+                                if remaining_limit is not None:
+                                    remaining_limit -= len(format_group)
+                                    if remaining_limit <= 0:
+                                        return self._summary(
+                                            journal,
+                                            store,
+                                            len(store.records) - initial_rows,
+                                        )
+
+            return self._summary(journal, store, len(store.records) - initial_rows)
+
+
+__all__ = [
+    "COMPLETION_SCHEMA",
+    "EvaluationOutcome",
+    "ExhaustiveSweepExecutor",
+    "ExhaustiveSweepRunner",
+    "NonFiniteResultError",
+    "RESULT_SCHEMA",
+    "ResultPointer",
+    "ResultShardStore",
+    "SweepRunSummary",
+    "SweepProgressReporter",
+]
diff --git a/decode_dse/software/test_launch_contracts.py b/decode_dse/software/test_launch_contracts.py
new file mode 100644
index 0000000..f4b6931
--- /dev/null
+++ b/decode_dse/software/test_launch_contracts.py
@@ -0,0 +1,3555 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import sys
+from contextlib import contextmanager
+from dataclasses import replace
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from decode_dse.hardware.selection import _deduplicate_profile_points
+from decode_dse.legality import (
+    StackValidity,
+    evaluate_profile_legality,
+    load_built_stack_validity,
+)
+from decode_dse.manifest import (
+    QuantizerProvenance,
+    QuantizerSource,
+    ResolvedImportOrigin,
+    SweepManifest,
+    SweepManifestEntry,
+    build_exhaustive_manifest,
+    validate_sweep_config,
+)
+from decode_dse.profiles import DecodePrecisionProfile, enumerate_decode_profiles
+from decode_dse.plots import (
+    PORTABLE_WORKSPACE_PROVENANCE,
+    RESULTS_PROVENANCE_SCHEMA,
+    _build_results_provenance,
+    _copy_sweep_provenance,
+    _load_sweep_provenance,
+    _write_json,
+)
+from decode_dse.software.runtime_environment import (
+    GPUObservation,
+    LaunchEnvironmentObservation,
+    LaunchPreflightError,
+    MutablePathObservation,
+    RuntimeEnvironment,
+    _architecture_supported,
+    _observe_model_assets,
+    dense_decoder_parameter_count,
+    estimate_artifact_footprint,
+    evaluate_launch_preflight,
+)
+from decode_dse.software.gpu_baseline import (
+    ENERGY_UNAVAILABLE_METHOD,
+    GPU_BASELINE_REPORT_SCHEMA,
+    GPU_BASELINE_ENERGY_SOURCE,
+    GPU_BASELINE_SCOPE,
+    GPU_BASELINE_TIMING_SCOPE,
+    MEASURED_EVIDENCE_TIER,
+    NVML_POWER_TRACE_METHOD,
+    NVML_TOTAL_ENERGY_METHOD,
+    PEAK_ROOFLINE_EVIDENCE_TIER,
+    EnergyEvidenceRow,
+    GPUDeviceEnergyMeasurement,
+    GPUEnergyMeasurement,
+    GPUHardwareStateSnapshot,
+    GPUPowerTraceSample,
+    GPUBaselineContract,
+    GPUBaselinePrompt,
+    GPUBaselineRepetition,
+    GPUBaselineResult,
+    GPUBaselineWorkspaceBinding,
+    ThroughputEvidenceRow,
+    build_headline_energy_comparison,
+    build_gpu_baseline_report,
+    build_gpu_baseline_stage_receipt,
+    build_headline_throughput_comparison,
+    gpu_baseline_energy_evidence,
+    gpu_baseline_throughput_evidence,
+    load_gpu_baseline_workspace_binding,
+)
+from decode_dse.software.refinement_schedule import _hardware_point
+from decode_dse.software.benchmark_runner import (
+    LocalDatasetSnapshot,
+    PublicationBenchmark,
+    PublicationConfiguration,
+    PublicationContract,
+    PublicationHardwareAlternative,
+    PublicationProtocol,
+    build_publication_benchmark_manifest,
+    load_publication_benchmark_manifest,
+)
+from decode_dse.software.sweep_plan import (
+    GPUBaselinePlan,
+    HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+    PromptManifest,
+    PromptRecord,
+    build_quantizer_provenance,
+    build_run_plan,
+    load_immutable_json,
+    validate_run_plan,
+    write_immutable_json,
+)
+from decode_dse.software.sweep_runner import (
+    EvaluationOutcome,
+    ExhaustiveSweepRunner,
+)
+
+REPOSITORY = Path(__file__).resolve().parents[2]
+CONFIG_PATH = REPOSITORY / "decode_dse/configs/qwen3_32b.json"
+
+
+def _config() -> dict:
+    return json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+
+
+def _model_config() -> dict:
+    return {
+        "hidden_size": 5120,
+        "intermediate_size": 25600,
+        "num_hidden_layers": 64,
+        "num_attention_heads": 64,
+        "num_key_value_heads": 8,
+        "head_dim": 128,
+        "vocab_size": 151936,
+        "tie_word_embeddings": False,
+        "attention_bias": False,
+        "torch_dtype": "bfloat16",
+    }
+
+
+def _good_observation() -> LaunchEnvironmentObservation:
+    capacity = 100_000 * (1 << 20)
+    path = MutablePathObservation(
+        label="workspace",
+        path="/publication/workspace",
+        writable=True,
+        lockable=True,
+        free_bytes=256 * (1 << 30),
+    )
+    return LaunchEnvironmentObservation(
+        package_versions={
+            "torch": "2.8.0",
+            "transformers": "4.53.2",
+            "datasets": "4.0.0",
+            "numpy": "2.3.1",
+            "nvidia-ml-py": "13.595.45",
+        },
+        cuda_devices=tuple(
+            GPUObservation(
+                index=index,
+                name="NVIDIA B200",
+                total_bytes=capacity,
+                free_bytes=capacity,
+                compute_capability="sm_100",
+                bf16_supported=True,
+            )
+            for index in range(4)
+        ),
+        torch_arch_list=("sm_80", "sm_86", "sm_90", "sm_100"),
+        host_available_bytes=256 * (1 << 30),
+        model_snapshot="/data/models/pinned-qwen3-32b",
+        model_config=_model_config(),
+        model_weight_bytes=65_524_246_528,
+        model_assets_complete=True,
+        model_asset_error=None,
+        dataset_assets={
+            "evaluation": "/data/datasets/evaluation-revision",
+            "refinement_calibration": "/data/datasets/calibration-revision",
+        },
+        mase_origin=str((REPOSITORY.parent / "mase/src/chop/__init__.py").resolve()),
+        mutable_paths=(path,),
+    )
+
+
+def _small_manifest() -> SweepManifest:
+    provenance = QuantizerProvenance(
+        sources=(
+            QuantizerSource(
+                component="test",
+                path="mase/src/chop/nn/quantizers/mxint/fake.py",
+                sha256="1" * 64,
+            ),
+        ),
+        resolved_imports=(
+            ResolvedImportOrigin(
+                module="chop.nn.quantizers.mxint.fake",
+                path="mase/src/chop/nn/quantizers/mxint/fake.py",
+            ),
+        ),
+    )
+    candidates = enumerate_decode_profiles()
+    weight_format = candidates[0].weight_format
+    profiles = tuple(
+        profile for profile in candidates if profile.weight_format == weight_format
+    )[:2]
+    entries = tuple(
+        SweepManifestEntry(
+            ordinal=ordinal,
+            profile=profile,
+            legality=evaluate_profile_legality(profile),
+        )
+        for ordinal, profile in enumerate(profiles)
+    )
+    return SweepManifest(
+        model_name="Qwen/Qwen3-32B",
+        model_revision="a" * 40,
+        model_architecture=_config()["model_architecture"],
+        tokenizer_revision="a" * 40,
+        quantizer_provenance=provenance,
+        entries=entries,
+    )
+
+
+def test_aggregate_launch_preflight_and_exact_memory_arithmetic(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    config = _config()
+    good = evaluate_launch_preflight(
+        config,
+        _good_observation(),
+        repository_root=REPOSITORY,
+        device_labels=("b200",),
+    )
+    assert good.passed
+    numerical, hardware, refinement = good.memory_estimates
+    assert numerical.parameter_count == 32_762_123_264
+    assert numerical.weight_bytes == 65_524_246_528
+    assert numerical.kv_cache_bytes == 2_214_592_512
+    assert numerical.required_bytes == 70_000 * (1 << 20)
+    assert hardware.kv_cache_bytes == 1_140_850_688
+    assert hardware.required_bytes == 70_000 * (1 << 20)
+    assert refinement.kv_cache_bytes == 4_294_967_296
+    assert refinement.required_bytes == 90_000 * (1 << 20)
+
+    bad_path = replace(
+        _good_observation().mutable_paths[0],
+        writable=False,
+        lockable=False,
+        free_bytes=1 << 30,
+        error="permission denied",
+    )
+    bad = replace(
+        _good_observation(),
+        package_versions={
+            "torch": None,
+            "transformers": None,
+            "datasets": None,
+            "numpy": None,
+            "nvidia-ml-py": None,
+        },
+        cuda_devices=(),
+        host_available_bytes=1 << 30,
+        model_assets_complete=False,
+        model_asset_error="missing pinned shards",
+        dataset_assets={"evaluation": None, "refinement_calibration": None},
+        mase_origin="/wrong/chop/__init__.py",
+        mutable_paths=(bad_path,),
+    )
+    report = evaluate_launch_preflight(
+        config,
+        bad,
+        repository_root=REPOSITORY,
+        device_labels=("cuda:0",),
+    )
+    failure_codes = {check.code for check in report.checks if not check.passed}
+    assert {
+        "packages",
+        "model_assets",
+        "dataset_evaluation",
+        "dataset_refinement_calibration",
+        "mase_origin",
+        "cuda",
+        "device_labels",
+        "gpu_memory_numerical_screen",
+        "gpu_memory_hardware_validation",
+        "gpu_memory_refinement",
+        "host_memory",
+        "path_workspace",
+    } <= failure_codes
+    with pytest.raises(LaunchPreflightError) as failure:
+        report.require_passed()
+    message = str(failure.value)
+    assert "no CUDA device is visible" in message
+    assert "weights 62488.79 + KV 2112.00" in message
+    assert "Automatic device_map remains disabled" in message
+
+    from decode_dse.software import sweep
+
+    monkeypatch.setattr(
+        sweep,
+        "run_launch_preflight",
+        lambda *args, **kwargs: good,
+    )
+    summary = sweep.create_workspace(
+        config_path=CONFIG_PATH,
+        output_dir=tmp_path / "good-plan",
+        device_labels=("b200",),
+        dry_run=True,
+    )
+    assert summary["launch_preflight"]["passed"] is True
+    assert summary["quantizer_provenance_hash"]
+    qwen_trace_plan = summary["compiler_trace_preflight"]
+    assert qwen_trace_plan["structurally_legal_hardware_candidates"] == 471_072
+    assert qwen_trace_plan["compiler_geometry_eligible_hardware_candidates"] == 26_496
+    assert qwen_trace_plan["compiler_base_hardware_signatures"] == 16_216
+    assert qwen_trace_plan["exact_batch_record_signatures"] == 912
+    assert qwen_trace_plan["unique_compiler_lowering_instantiations"] == 5_472
+    assert qwen_trace_plan["unique_lazy_trace_instantiations"] == 912
+    assert qwen_trace_plan["raw_profile_candidate_pairs"] == 270_395_328
+    assert qwen_trace_plan["raw_context_point_resolutions"] == (
+        830_654_447_616
+    )
+    assert qwen_trace_plan["physical_signature_pairs"] == 158_976
+    assert qwen_trace_plan["projected_context_timing_resolutions"] == 158_976
+    assert qwen_trace_plan["physical_context_step_outcomes"] == 488_374_272
+    assert qwen_trace_plan["projected_full_evaluator_calls"] == 158_976
+    assert qwen_trace_plan["projected_joined_identities"] == 158_976
+    assert qwen_trace_plan["projected_trace_bytes"] == 9_622_781_952
+    assert qwen_trace_plan["projected_digest_updates"] == 317_952
+    assert "projected_wall_clock_seconds" not in qwen_trace_plan
+    assert qwen_trace_plan["compiler_trace_preflight_feasible"] is True
+
+
+def test_quantizer_sources_change_manifest_and_run_plan_identity(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    config = _config()
+    first = build_quantizer_provenance(REPOSITORY, config)
+    assert dict((origin.module, origin.path) for origin in first.resolved_imports)[
+        "chop.nn.quantizers.mxint.fake"
+    ].endswith("/chop/nn/quantizers/mxint/fake.py")
+
+    from decode_dse.software import sweep_plan
+
+    original_hash = sweep_plan._sha256_source
+
+    def changed_hash(path: Path) -> str:
+        if path.name == "precision_bindings.py":
+            return "f" * 64
+        return original_hash(path)
+
+    monkeypatch.setattr(sweep_plan, "_sha256_source", changed_hash)
+    second = build_quantizer_provenance(REPOSITORY, config)
+    assert first.canonical_hash != second.canonical_hash
+
+    manifest = build_exhaustive_manifest(
+        config["model_name"],
+        config["model_revision"],
+        config["model_architecture"],
+        first,
+        config["tokenizer_revision"],
+    )
+    changed_manifest = replace(manifest, quantizer_provenance=second)
+    assert manifest.canonical_hash != changed_manifest.canonical_hash
+    run_plan = build_run_plan(manifest, device_labels=("h100",))
+    changed_plan = replace(
+        run_plan,
+        manifest_hash=changed_manifest.canonical_hash,
+        quantizer_provenance=second,
+    )
+    assert run_plan.canonical_hash != changed_plan.canonical_hash
+    with pytest.raises(ValueError, match="different quantizer arithmetic"):
+        validate_run_plan(
+            replace(run_plan, quantizer_provenance=second),
+            manifest,
+        )
+
+    from decode_dse.software.sweep import _provenance, _validate_provenance
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    optional_config = _config()
+    optional_refinement = dict(optional_config["refinement"])
+    optional_refinement.pop("calibration_data")
+    optional_config["refinement"] = optional_refinement
+    optional_config_path = tmp_path / "config-without-refinement-dataset.json"
+    optional_config_path.write_text(
+        json.dumps(optional_config),
+        encoding="utf-8",
+    )
+    optional_provenance = _provenance(
+        repository=REPOSITORY,
+        config_path=optional_config_path,
+        manifest=manifest,
+        plan=run_plan,
+        prompts=None,
+        created_at_utc="2026-08-01T00:00:00Z",
+    )
+    assert tuple(optional_provenance["datasets"]) == ("evaluation",)
+
+    incomplete_config = dict(optional_config)
+    incomplete_refinement = dict(optional_refinement)
+    incomplete_refinement["calibration_data"] = {"dataset_name": "Salesforce/wikitext"}
+    incomplete_config["refinement"] = incomplete_refinement
+    incomplete_config_path = tmp_path / "config-with-incomplete-dataset.json"
+    incomplete_config_path.write_text(
+        json.dumps(incomplete_config),
+        encoding="utf-8",
+    )
+    with pytest.raises(ValueError, match="descriptor is incomplete"):
+        _provenance(
+            repository=REPOSITORY,
+            config_path=incomplete_config_path,
+            manifest=manifest,
+            plan=run_plan,
+            prompts=None,
+            created_at_utc="2026-08-01T00:00:00Z",
+        )
+
+    provenance_path = tmp_path / "provenance.json"
+    write_immutable_json(
+        provenance_path,
+        _provenance(
+            repository=REPOSITORY,
+            config_path=CONFIG_PATH,
+            manifest=manifest,
+            plan=run_plan,
+            prompts=None,
+            created_at_utc="2026-08-01T00:00:00Z",
+        ),
+    )
+    with pytest.raises(RuntimeError, match="quantizer sources differ"):
+        _validate_provenance(
+            provenance_path,
+            repository=REPOSITORY,
+            config_path=CONFIG_PATH,
+            manifest=manifest,
+            plan=run_plan,
+            prompts=None,
+        )
+
+    wrong_origin = tuple(
+        (
+            replace(
+                origin,
+                path="mase/src/chop/nn/quantizers/mxint_hardware.py",
+            )
+            if origin.module == "chop.nn.quantizers.mxint.fake"
+            else origin
+        )
+        for origin in first.resolved_imports
+    )
+    with pytest.raises(ValueError, match="mxint.fake"):
+        replace(first, resolved_imports=wrong_origin)
+
+
+class _Clock:
+    def __init__(self) -> None:
+        self.value = 0.0
+
+    def __call__(self) -> float:
+        return self.value
+
+    def advance(self, seconds: float) -> None:
+        self.value += seconds
+
+
+class _Executor:
+    def __init__(self, clock: _Clock, *, fail_first: bool = False) -> None:
+        self.clock = clock
+        self.fail_first = fail_first
+        self.evaluations = 0
+
+    @contextmanager
+    def open_weight_bank(self, weight_format, entries):
+        self.clock.advance(5.0)
+        yield weight_format
+
+    @contextmanager
+    def open_kv_admission_cache(self, kv_format):
+        yield kv_format
+
+    def evaluate(self, entry, *, weight_bank, kv_admission_cache):
+        del entry, weight_bank, kv_admission_cache
+        self.clock.advance(2.0)
+        self.evaluations += 1
+        if self.fail_first and self.evaluations == 1:
+            raise RuntimeError("deliberate transient failure")
+        return EvaluationOutcome(metrics={"mean_token_nll": 1.0})
+
+
+class _InterruptingExecutor(_Executor):
+    def __init__(self, clock: _Clock, *, interrupt_on: int) -> None:
+        super().__init__(clock)
+        self.interrupt_on = interrupt_on
+
+    def evaluate(self, entry, *, weight_bank, kv_admission_cache):
+        if self.evaluations + 1 == self.interrupt_on:
+            self.evaluations += 1
+            raise KeyboardInterrupt("simulated process termination")
+        return super().evaluate(
+            entry,
+            weight_bank=weight_bank,
+            kv_admission_cache=kv_admission_cache,
+        )
+
+
+def test_runner_reports_first_completion_continuous_eta_failure_and_resume(
+    tmp_path: Path,
+) -> None:
+    manifest = _small_manifest()
+    clock = _Clock()
+    emitted: list[str] = []
+    executor = _Executor(clock, fail_first=True)
+    summary = ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=tmp_path,
+        executor=executor,
+        max_attempts=2,
+        stage="numerical-screen",
+        clock=clock,
+        emit_progress=emitted.append,
+    ).run()
+    assert summary.succeeded == 2
+    assert summary.failed_terminal == 0
+    assert executor.evaluations == 3
+    assert any("event=retry-required" in line for line in emitted)
+    assert any("event=first-completion" in line for line in emitted)
+    progress = json.loads((tmp_path / "progress.json").read_text(encoding="utf-8"))
+    assert progress["work_class"] == "numerical"
+    assert progress["completed_profiles"] == 2
+    assert progress["unique_weight_banks_opened"] == 1
+    assert progress["mean_trial_seconds"] == 3.0
+    assert progress["estimated_remaining_seconds"] == 0.0
+
+    resumed_messages: list[str] = []
+    resumed_executor = _Executor(clock)
+    resumed = ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=tmp_path,
+        executor=resumed_executor,
+        max_attempts=2,
+        stage="numerical-screen",
+        clock=clock,
+        emit_progress=resumed_messages.append,
+    ).run()
+    assert resumed.succeeded == 2
+    assert resumed_executor.evaluations == 0
+    assert any("event=resume" in line for line in resumed_messages)
+
+
+def test_runner_counts_terminal_failure(tmp_path: Path) -> None:
+    manifest = replace(_small_manifest(), entries=_small_manifest().entries[:1])
+    clock = _Clock()
+    executor = _Executor(clock, fail_first=True)
+    summary = ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=tmp_path,
+        executor=executor,
+        max_attempts=1,
+        stage="hardware-validation",
+        clock=clock,
+        emit_progress=lambda message: None,
+    ).run()
+    assert summary.failed_terminal == 1
+    progress = json.loads((tmp_path / "progress.json").read_text(encoding="utf-8"))
+    assert progress["work_class"] == "hardware-validation"
+    assert progress["failed_terminal_profiles"] == 1
+    assert progress["event"] == "first-completion"
+
+
+def test_interrupted_and_boundary_resumes_preserve_the_exact_manifest(
+    tmp_path: Path,
+) -> None:
+    manifest = _small_manifest()
+    reference = tmp_path / "reference"
+    ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=reference,
+        executor=_Executor(_Clock()),
+        stage="numerical-screen",
+        emit_progress=lambda message: None,
+    ).run()
+    expected_manifest = (reference / "manifest.json").read_bytes()
+
+    interrupted = tmp_path / "interrupted"
+    with pytest.raises(KeyboardInterrupt, match="simulated process"):
+        ExhaustiveSweepRunner(
+            manifest=manifest,
+            output_dir=interrupted,
+            executor=_InterruptingExecutor(_Clock(), interrupt_on=2),
+            stage="numerical-screen",
+            emit_progress=lambda message: None,
+        ).run()
+    with (interrupted / "status.jsonl").open("ab") as handle:
+        handle.write(b'{"incomplete"')
+    resumed = ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=interrupted,
+        executor=_Executor(_Clock()),
+        stage="numerical-screen",
+        emit_progress=lambda message: None,
+    ).run()
+    assert resumed.succeeded == len(manifest.entries)
+    assert (interrupted / "manifest.json").read_bytes() == expected_manifest
+
+    boundary = tmp_path / "boundary"
+    first = ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=boundary,
+        executor=_Executor(_Clock()),
+        stage="numerical-screen",
+        emit_progress=lambda message: None,
+    ).run(limit=1)
+    assert first.pending == 1
+    completed = ExhaustiveSweepRunner(
+        manifest=manifest,
+        output_dir=boundary,
+        executor=_Executor(_Clock()),
+        stage="numerical-screen",
+        emit_progress=lambda message: None,
+    ).run()
+    assert completed.succeeded == len(manifest.entries)
+    assert (boundary / "manifest.json").read_bytes() == expected_manifest
+
+
+def test_model_general_resource_and_dry_run_contracts(
+    monkeypatch,
+    tmp_path: Path,
+    capsys,
+) -> None:
+    llama_path = REPOSITORY / "decode_dse/configs/llama3_1_8b.json"
+    llama = json.loads(llama_path.read_text(encoding="utf-8"))
+    qwen = _config()
+    validate_sweep_config(llama)
+    assert dense_decoder_parameter_count(llama["model_architecture"]) == 8_030_261_248
+    assert dense_decoder_parameter_count(qwen["model_architecture"]) == 32_762_123_264
+    for config in (llama, qwen):
+        footprint = estimate_artifact_footprint(
+            config,
+            config["model_architecture"],
+        )
+        assert footprint.policy == "content_addressed_recompute_per_format"
+        assert (
+            footprint.admission_peak_persisted_bytes
+            < footprint.admission_total_logical_bytes
+        )
+        assert footprint.required_workspace_bytes > footprint.prefill_persisted_bytes
+        assert footprint.to_dict()["total_logical_workspace_bytes"] == (
+            footprint.prefill_persisted_bytes
+            + footprint.admission_total_logical_bytes
+        )
+
+    from decode_dse.software import sweep
+
+    report = evaluate_launch_preflight(
+        qwen,
+        _good_observation(),
+        repository_root=REPOSITORY,
+        device_labels=("b200",),
+    )
+    monkeypatch.setattr(
+        sweep,
+        "run_launch_preflight",
+        lambda *args, **kwargs: report,
+    )
+    stable_software_hash = sweep._software_tree_hash(REPOSITORY)
+    monkeypatch.setattr(
+        sweep,
+        "_software_tree_hash",
+        lambda repository: stable_software_hash,
+    )
+    first = sweep.create_workspace(
+        config_path=llama_path,
+        output_dir=tmp_path / "dry-run",
+        device_labels=("b200",),
+        dry_run=True,
+    )
+    second = sweep.create_workspace(
+        config_path=llama_path,
+        output_dir=tmp_path / "dry-run",
+        device_labels=("b200",),
+        dry_run=True,
+    )
+    assert first["manifest"] == second["manifest"]
+    assert first["run_plan"] == second["run_plan"]
+    assert first["provenance"] == second["provenance"]
+    assert len(first["manifest"]["entries"]) == 3585
+    assert first["cost_declaration"]["manifest_profiles"] == 3585
+    assert first["gpu_baseline_measurements"] == 6
+    assert len(first["gpu_baseline_work_units"]) == 6
+    assert first["cost_declaration"]["gpu_baseline_measurements"] == 6
+    assert first["cost_declaration"]["gpu_baseline_prefill_runs"] == 18
+    assert first["cost_declaration"]["gpu_baseline_decode_steps"] == 2592
+    assert first["run_plan"]["gpu_baseline"] == llama["gpu_baseline"]
+    assert first["cost_declaration"]["total_work_units"] == (
+        first["cost_declaration"]["total_profile_evaluations"] + 6
+    )
+    llama_trace_plan = first["compiler_trace_preflight"]
+    assert llama_trace_plan["structurally_legal_hardware_candidates"] == 616_032
+    assert llama_trace_plan["compiler_geometry_eligible_hardware_candidates"] == 90_720
+    assert llama_trace_plan["compiler_base_hardware_signatures"] == 21_192
+    assert llama_trace_plan["exact_batch_record_signatures"] == 3_144
+    assert llama_trace_plan["unique_compiler_lowering_instantiations"] == 18_864
+    assert llama_trace_plan["unique_lazy_trace_instantiations"] == 3_144
+    assert llama_trace_plan["raw_profile_candidate_pairs"] == 353_602_368
+    assert llama_trace_plan["raw_context_point_resolutions"] == (
+        1_086_266_474_496
+    )
+    assert llama_trace_plan["physical_signature_pairs"] == 544_320
+    assert llama_trace_plan["projected_context_timing_resolutions"] == 544_320
+    assert llama_trace_plan["physical_context_step_outcomes"] == 1_672_151_040
+    assert llama_trace_plan["projected_full_evaluator_calls"] == 544_320
+    assert llama_trace_plan["projected_joined_identities"] == 544_320
+    assert llama_trace_plan["projected_trace_bytes"] == 13_392_936_960
+    assert llama_trace_plan["projected_digest_updates"] == 1_088_640
+    assert "projected_wall_clock_seconds" not in llama_trace_plan
+    assert (
+        first["cost_declaration"]["projection_status"]
+        == "awaiting_first_completed_profile"
+    )
+    assert not (tmp_path / "dry-run").exists()
+
+    pipeline_workspace = tmp_path / "pipeline-plan"
+    write_immutable_json(
+        pipeline_workspace / "run_plan.json",
+        first["run_plan"],
+    )
+    monkeypatch.setattr(
+        sweep,
+        "capture_runtime_environment",
+        lambda *args, **kwargs: (_ for _ in ()).throw(
+            AssertionError("pipeline dry-run must not inspect CUDA")
+        ),
+    )
+    assert (
+        sweep.sweep_pipeline_main(
+            (
+                "--config",
+                str(llama_path),
+                "--output-dir",
+                str(pipeline_workspace),
+                "--device-label",
+                "b200",
+                "--gpus",
+                "0,1,2,3",
+                "--dry-run",
+            )
+        )
+        == 0
+    )
+    pipeline_dry_run = json.loads(capsys.readouterr().out)
+    pipeline_commands = pipeline_dry_run["commands"]
+    assert pipeline_commands[0]["name"] == "compiler-trace-artifacts"
+    assert pipeline_commands[0]["outputs"] == [
+        str(
+            pipeline_workspace
+            / "external"
+            / "compiler_trace_artifacts.json"
+        )
+    ]
+    assert pipeline_dry_run["compiler_trace_preflight_feasible"] is True
+    assert pipeline_dry_run["unique_compiler_family_artifacts"] == 1
+    assert pipeline_dry_run["unique_lazy_trace_instantiations"] > 0
+    assert pipeline_dry_run["projected_trace_generation_calls"] == (
+        pipeline_dry_run["unique_lazy_trace_instantiations"]
+    )
+    assert pipeline_dry_run["projected_trace_bytes"] > 0
+    assert [
+        command["name"]
+        for command in pipeline_commands
+        if command["name"].startswith("gpu-baseline-batch-")
+    ] == [
+        "gpu-baseline-batch-1",
+        "gpu-baseline-batch-2",
+        "gpu-baseline-batch-4",
+        "gpu-baseline-batch-8",
+        "gpu-baseline-batch-16",
+        "gpu-baseline-batch-32",
+    ]
+    baseline_contract_command = next(
+        command
+        for command in pipeline_commands
+        if command["name"] == "gpu-baseline-contract"
+    )
+    attention_index = baseline_contract_command["argv"].index(
+        "--attention-implementation"
+    )
+    assert baseline_contract_command["argv"][attention_index + 1] == "sdpa"
+    meter_index = baseline_contract_command["argv"].index(
+        "--energy-meter-priority"
+    )
+    assert baseline_contract_command["argv"][meter_index + 1 : meter_index + 3] == [
+        NVML_TOTAL_ENERGY_METHOD,
+        NVML_POWER_TRACE_METHOD,
+    ]
+    interval_index = baseline_contract_command["argv"].index(
+        "--power-trace-sample-interval-ms"
+    )
+    assert baseline_contract_command["argv"][interval_index + 1] == "10"
+
+    missing_baseline = dict(llama)
+    missing_baseline.pop("gpu_baseline")
+    with pytest.raises(ValueError, match="gpu_baseline must be an explicit object"):
+        validate_sweep_config(missing_baseline)
+    mistyped_baseline = json.loads(json.dumps(llama))
+    mistyped_baseline["gpu_baseline"]["first_gpu_only"] = 1
+    with pytest.raises(ValueError, match="gpu_baseline.first_gpu_only"):
+        validate_sweep_config(mistyped_baseline)
+
+    failed_report = replace(
+        report,
+        checks=tuple(
+            replace(
+                check,
+                passed=False,
+                observed=(
+                    "FileNotFoundError: pinned tokenizer assets are incomplete"
+                ),
+            )
+            if check.code == "model_assets"
+            else check
+            for check in report.checks
+        ),
+    )
+    monkeypatch.setattr(
+        sweep,
+        "run_launch_preflight",
+        lambda *args, **kwargs: failed_report,
+    )
+    blocked_dry_run = sweep.create_workspace(
+        config_path=llama_path,
+        output_dir=tmp_path / "blocked-dry-run",
+        device_labels=("b200",),
+        dry_run=True,
+    )
+    assert blocked_dry_run["launch_preflight"]["passed"] is False
+    assert blocked_dry_run["compiler_trace_preflight_feasible"] is True
+    assert len(blocked_dry_run["manifest"]["entries"]) == 3585
+    assert blocked_dry_run["provenance"]["model"]["name"] == (
+        "meta-llama/Llama-3.1-8B-Instruct"
+    )
+    assert not (tmp_path / "blocked-dry-run").exists()
+    with pytest.raises(LaunchPreflightError, match="pinned tokenizer"):
+        sweep.create_workspace(
+            config_path=llama_path,
+            output_dir=tmp_path / "blocked-execution",
+            device_labels=("b200",),
+            dry_run=False,
+        )
+    assert not (tmp_path / "blocked-execution").exists()
+
+
+def _simulator_performance_paths(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Make the real artifact producer importable the way _disagg() would."""
+
+    from decode_dse import simulator_bridge
+
+    root = simulator_bridge._sim_root()
+    monkeypatch.syspath_prepend(str(root))
+    monkeypatch.syspath_prepend(str(root / "analytic_models" / "performance"))
+
+
+def _exact_trace_point(batch: int) -> dict[str, object]:
+    """One minimal exact point accepted by the real artifact producer."""
+
+    return {
+        "schema_version": "plena-compiler-trace-point-v1",
+        "artifact_scope": "full_model_decode_step_independent_request_batch",
+        "model": {
+            "model_json_sha256": "0" * 64,
+            "dimensions": {
+                "hidden": 16,
+                "inter": 32,
+                "layers": 1,
+                "heads": 2,
+                "kv_heads": 2,
+                "head_dim": 8,
+                "vocab": 32,
+            },
+            "layer_scope": "all_decoder_layers",
+            "output_head_location": "prefill_chip",
+        },
+        "precision": {
+            "specification": {"attn_elem": 4, "ffn_elem": 4, "kv_elem": 4},
+            "weight_format": "mxint",
+            "kv_format": "mxint",
+            "block_size": 8,
+            "mac_bits": 4,
+        },
+        "hardware": {
+            "array_geometry": {"mlen": 16, "blen": 2, "vlen": 16, "hlen": 8},
+            "hbm_timing_geometry": {
+                "generation": "HBM2",
+                "channels": 8,
+                "pin_rate_gbps": 2.0,
+            },
+            "configuration": {},
+            "memory_configuration": {},
+            "overrides": {"TP": 1, "KVP": 1},
+            "topology": {
+                "tp": 1,
+                "kvp": 1,
+                "chip_count": 1,
+                "explicit_topology": True,
+                "legacy_ideal_parallelism": False,
+                "link_ports": 0,
+                "sram_policy": "streaming",
+                "link_generation": "p2p_100GBs",
+                "architecture_knobs_explicit": True,
+                "kv_head_reuse": True,
+                "drain_overlapped": False,
+            },
+        },
+        "serving": {
+            "batch": batch,
+            "input_tokens": 17,
+            "generation_tokens": 1,
+            "sample_stride": 1,
+            "kv_layout": "dense_selector",
+            "runtime_hbm_reserve_bytes": 0,
+        },
+        "compiler": {
+            "settings_sha256": "1" * 64,
+            "latency_library_sha256": "2" * 64,
+            "timing_mode": "rtl_serialized",
+            "frequency_hz": 1.0e9,
+        },
+    }
+
+
+def test_compiler_trace_artifact_command_builds_the_configured_output(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    from decode_dse.software import sweep
+
+    _simulator_performance_paths(monkeypatch)
+    config = _config()
+    workspace = tmp_path / "workspace"
+    output = workspace / "external" / "compiler_trace_artifacts.json"
+    config_path = tmp_path / "config.json"
+    config_path.write_text(
+        json.dumps(config, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    points = (_exact_trace_point(batch=2), _exact_trace_point(batch=4))
+    monkeypatch.setattr(sweep, "_build_manifest", lambda *args: _small_manifest())
+    monkeypatch.setattr(
+        sweep,
+        "_compiler_trace_feasibility",
+        lambda *args: {
+            "compiler_trace_preflight_feasible": True,
+            "compiler_trace_preflight_blockers": [],
+        },
+    )
+    monkeypatch.setattr(
+        sweep,
+        "_compiler_trace_generation_points",
+        lambda *args: points,
+    )
+    assert (
+        sweep.compiler_trace_artifacts_main(
+            (
+                "--config",
+                str(config_path),
+                "--output-dir",
+                str(workspace),
+                "--output",
+                str(output),
+            )
+        )
+        == 0
+    )
+    receipt = json.loads(capsys.readouterr().out)
+    assert receipt["point_count"] == 2
+    assert receipt["context_start"] == 512
+    assert receipt["context_stop"] == 3584
+    assert receipt["context_step"] == 1
+    assert receipt["build"]["native_compile_calls"] == 2
+    assert receipt["build"]["unique_lowering_keys"] == 2
+    assert receipt["build"]["family_count"] == 1
+    assert receipt["build"]["record_count"] == 0
+    assert receipt["build"]["records_materialized"] == "lazy_at_consume"
+    assert receipt["output"] == str(output)
+    assert output.is_file()
+
+    from compiler_trace_timing import (
+        FullModelDecodeArtifactSet,
+        native_decode_compiler_source_sha256,
+    )
+
+    loaded = FullModelDecodeArtifactSet.load(output)
+    assert loaded.artifact_set_id == receipt["build"]["artifact_set_id"]
+    assert loaded.compiler_source_sha256 == native_decode_compiler_source_sha256()
+    assert loaded.records == ()
+    assert len(loaded.families) == 1
+
+
+def test_compiler_trace_artifact_command_dry_run_writes_nothing(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    from decode_dse.software import sweep
+
+    _simulator_performance_paths(monkeypatch)
+    config = _config()
+    workspace = tmp_path / "workspace"
+    output = workspace / "external" / "compiler_trace_artifacts.json"
+    config_path = tmp_path / "config.json"
+    config_path.write_text(
+        json.dumps(config, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(sweep, "_build_manifest", lambda *args: _small_manifest())
+    monkeypatch.setattr(
+        sweep,
+        "_compiler_trace_feasibility",
+        lambda *args: {
+            "compiler_trace_preflight_feasible": True,
+            "compiler_trace_preflight_blockers": [],
+        },
+    )
+    monkeypatch.setattr(
+        sweep,
+        "_compiler_trace_generation_points",
+        lambda *args: (_exact_trace_point(batch=2),),
+    )
+    assert (
+        sweep.compiler_trace_artifacts_main(
+            (
+                "--config",
+                str(config_path),
+                "--output-dir",
+                str(workspace),
+                "--output",
+                str(output),
+                "--dry-run",
+            )
+        )
+        == 0
+    )
+    receipt = json.loads(capsys.readouterr().out)
+    assert receipt["dry_run"] is True
+    assert receipt["output"] is None
+    assert receipt["build"]["native_compile_calls"] == 1
+    assert not output.exists()
+
+
+def test_measured_gpu_baseline_binding_and_strict_comparison_tiers(
+    tmp_path: Path,
+) -> None:
+    config = _config()
+    provenance_path = tmp_path / "provenance.json"
+    write_immutable_json(
+        provenance_path,
+        {
+            "schema_version": "decode-sweep-provenance",
+            "manifest_hash": "1" * 64,
+            "run_plan_hash": "2" * 64,
+            "prompt_manifest_hash": "3" * 64,
+            "model": {
+                "revision": config["model_revision"],
+                "tokenizer_revision": config["tokenizer_revision"],
+            },
+        },
+    )
+
+    class _BundleIdentity:
+        model_revision = config["model_revision"]
+        tokenizer_revision = config["tokenizer_revision"]
+
+        @staticmethod
+        def prompt_manifest():
+            class _PromptIdentity:
+                canonical_hash = "3" * 64
+
+            return _PromptIdentity()
+
+    binding = load_gpu_baseline_workspace_binding(
+        provenance_path,
+        _BundleIdentity(),
+    )
+    assert GPUBaselineWorkspaceBinding.from_dict(binding.to_dict()) == binding
+    contract = GPUBaselineContract(
+        model_name=config["model_name"],
+        model_revision=config["model_revision"],
+        tokenizer_revision=config["tokenizer_revision"],
+        sample_bundle_hash="5" * 64,
+        workspace_binding=binding,
+        prompts=tuple(
+            GPUBaselinePrompt(
+                document_id=f"hardware-{index:03d}",
+                prompt_hash=hashlib.sha256(f"prompt-{index}".encode()).hexdigest(),
+                token_count=512,
+            )
+            for index in range(HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count)
+        ),
+        attention_implementation="sdpa",
+        warmup_steps=1,
+        measured_steps=2,
+        repetitions=3,
+        planned_device_labels=("B200",),
+        planned_batch_sizes=(2,),
+        seed=0,
+        source_tree_sha256="6" * 64,
+    )
+    assert GPUBaselineContract.from_dict(contract.to_dict()) == contract
+
+    device_uuid = "GPU-publication-test"
+    runtime = RuntimeEnvironment(
+        logical={"device_name": "NVIDIA B200", "stack": "test"},
+        observation={"device_uuid": device_uuid, "total_memory_bytes": 192_000},
+    )
+
+    def snapshot(phase: str) -> GPUHardwareStateSnapshot:
+        values = (
+            "2026/08/02 00:00:00.000",
+            "600.00",
+            "NVIDIA B200",
+            device_uuid,
+            "00000000:01:00.0",
+            "P0",
+            "192000",
+            "1000",
+            "40",
+            "300",
+            "1000",
+            "1800",
+            "1800",
+            "3500",
+            "Disabled",
+        )
+        raw = ", ".join(values)
+        return GPUHardwareStateSnapshot(
+            phase=phase,
+            captured_at_utc="2026-08-02T00:00:00Z",
+            raw_query_line=raw,
+            raw_query_sha256=hashlib.sha256(raw.encode()).hexdigest(),
+            values=values,
+        )
+
+    repetitions = tuple(
+        GPUBaselineRepetition(
+            repetition=index,
+            document_ids=(
+                f"hardware-{index * 2:03d}",
+                f"hardware-{index * 2 + 1:03d}",
+            ),
+            prefill_ms=20.0,
+            decode_step_ms=(10.0, 10.0),
+            q_len_one_calls=3,
+            cache_growth_checks=3,
+            first_token_count=2,
+            generated_token_sha256=hashlib.sha256(
+                f"tokens-{index}".encode()
+            ).hexdigest(),
+            peak_allocated_bytes=1_000,
+            peak_reserved_bytes=2_000,
+            energy_measurement=GPUEnergyMeasurement(
+                repetition=index,
+                generated_tokens=4,
+                devices=(
+                    GPUDeviceEnergyMeasurement(
+                        device_uuid=device_uuid,
+                        meter_method=NVML_TOTAL_ENERGY_METHOD,
+                        measurement_status="measured",
+                        started_at_monotonic_ns=(
+                            1_000_000_000 + index * 20_000_000
+                        ),
+                        ended_at_monotonic_ns=(
+                            1_010_000_000 + index * 20_000_000
+                        ),
+                        energy_j=2.0,
+                        counter_start_mj=10_000 + index * 3_000,
+                        counter_end_mj=12_000 + index * 3_000,
+                        power_trace=(),
+                        requested_power_sample_interval_ms=10,
+                        unavailable_reason=None,
+                    ),
+                ),
+            ),
+        )
+        for index in range(3)
+    )
+    phases = ["run_start"]
+    for index in range(3):
+        phases.extend((f"repetition_{index}_start", f"repetition_{index}_end"))
+    phases.append("run_end")
+    result = GPUBaselineResult(
+        contract_hash=contract.contract_hash,
+        device_label="B200",
+        device_name="NVIDIA B200",
+        device_uuid=device_uuid,
+        runtime_environment=runtime,
+        batch_size=2,
+        state="succeeded",
+        repetitions=repetitions,
+        hardware_state_snapshots=tuple(snapshot(phase) for phase in phases),
+        error_class=None,
+        error_message=None,
+        created_at_utc="2026-08-02T00:00:00Z",
+    )
+    report = build_gpu_baseline_report(contract, (result,))
+    receipt = build_gpu_baseline_stage_receipt(
+        report,
+        provenance_path=provenance_path,
+    )
+    assert receipt["complete"] is True
+    assert receipt["work_units"] == [
+        {"device_label": "B200", "batch_size": 2, "first_gpu_only": True}
+    ]
+    budget = {
+        "reference_system": "B200x1",
+        "aggregate_area_limit_mm2": 826.0,
+        "aggregate_hbm_capacity_limit_bytes": 192_000_000_000,
+        "aggregate_hbm_bandwidth_limit_bytes_per_s": 8_000_000_000_000.0,
+    }
+    denominator = gpu_baseline_throughput_evidence(
+        report,
+        stage_receipt=receipt,
+        device_label="B200",
+        resource_budget=budget,
+    )
+    assert denominator.evidence_tier == MEASURED_EVIDENCE_TIER
+    assert denominator.evidence_source == GPU_BASELINE_SCOPE
+    energy_denominator = gpu_baseline_energy_evidence(
+        report,
+        stage_receipt=receipt,
+        device_label="B200",
+        resource_budget=budget,
+    )
+    assert energy_denominator.evidence_source == GPU_BASELINE_ENERGY_SOURCE
+    assert energy_denominator.tokens_per_joule == pytest.approx(2.0)
+    assert energy_denominator.energy_delay_product_j_s == pytest.approx(0.005)
+    energy_numerator = EnergyEvidenceRow(
+        system_name="PLENA measured prototype",
+        model_name=energy_denominator.model_name,
+        model_revision=energy_denominator.model_revision,
+        context_length=energy_denominator.context_length,
+        batch_size=2,
+        energy_per_token_j=0.25,
+        mean_decode_step_s=0.005,
+        meter_method="measured_dc_power_rail",
+        device_ids=("plena-prototype",),
+        evidence_source="plena_cached_q1_measured_board_energy",
+        resource_budget_hash=energy_denominator.resource_budget_hash,
+        artifact_hash="9" * 64,
+        workspace_provenance_sha256=(
+            energy_denominator.workspace_provenance_sha256
+        ),
+    )
+    energy_comparison = build_headline_energy_comparison(
+        plena_measurement=energy_numerator,
+        gpu_measurement=energy_denominator,
+        resource_budget=budget,
+    )
+    assert energy_comparison["tokens_per_joule_ratio"] == pytest.approx(2.0)
+    assert energy_comparison["energy_delay_product_improvement"] == pytest.approx(4.0)
+    assert energy_comparison["analytic_substitution_permitted"] is False
+    trace_measurement = GPUDeviceEnergyMeasurement(
+        device_uuid=device_uuid,
+        meter_method=NVML_POWER_TRACE_METHOD,
+        measurement_status="measured",
+        started_at_monotonic_ns=2_000_000_000,
+        ended_at_monotonic_ns=3_000_000_000,
+        energy_j=100.0,
+        counter_start_mj=None,
+        counter_end_mj=None,
+        power_trace=(
+            GPUPowerTraceSample(2_000_000_000, 100_000),
+            GPUPowerTraceSample(3_000_000_000, 100_000),
+        ),
+        requested_power_sample_interval_ms=10,
+        unavailable_reason=None,
+    )
+    assert trace_measurement.to_dict()["power_trace_sample_count"] == 2
+
+    unavailable_repetitions = tuple(
+        replace(
+            repetition,
+            energy_measurement=GPUEnergyMeasurement(
+                repetition=repetition.repetition,
+                generated_tokens=4,
+                devices=(
+                    GPUDeviceEnergyMeasurement(
+                        device_uuid=device_uuid,
+                        meter_method=ENERGY_UNAVAILABLE_METHOD,
+                        measurement_status="unavailable",
+                        started_at_monotonic_ns=(
+                            4_000_000_000
+                            + repetition.repetition * 20_000_000
+                        ),
+                        ended_at_monotonic_ns=(
+                            4_010_000_000
+                            + repetition.repetition * 20_000_000
+                        ),
+                        energy_j=None,
+                        counter_start_mj=None,
+                        counter_end_mj=None,
+                        power_trace=(),
+                        requested_power_sample_interval_ms=10,
+                        unavailable_reason=(
+                            "NVML energy is not supported by publication GPU"
+                        ),
+                    ),
+                ),
+            ),
+        )
+        for repetition in repetitions
+    )
+    unavailable_report = build_gpu_baseline_report(
+        contract,
+        (replace(result, repetitions=unavailable_repetitions),),
+    )
+    unavailable_receipt = build_gpu_baseline_stage_receipt(
+        unavailable_report,
+        provenance_path=provenance_path,
+    )
+    unavailable_throughput = gpu_baseline_throughput_evidence(
+        unavailable_report,
+        stage_receipt=unavailable_receipt,
+        device_label="B200",
+        resource_budget=budget,
+    )
+    assert unavailable_throughput.tokens_per_second == denominator.tokens_per_second
+    with pytest.raises(ValueError, match="not supported by publication GPU"):
+        gpu_baseline_energy_evidence(
+            unavailable_report,
+            stage_receipt=unavailable_receipt,
+            device_label="B200",
+            resource_budget=budget,
+        )
+    numerator = ThroughputEvidenceRow(
+        system_name="PLENA measured prototype",
+        model_name=denominator.model_name,
+        model_revision=denominator.model_revision,
+        context_length=denominator.context_length,
+        batch_size=2,
+        tokens_per_second=100.0,
+        evidence_tier=MEASURED_EVIDENCE_TIER,
+        evidence_source="plena_cached_q1_measurement",
+        resource_budget_hash=denominator.resource_budget_hash,
+        artifact_hash="7" * 64,
+        workspace_provenance_sha256=denominator.workspace_provenance_sha256,
+    )
+    peak = ThroughputEvidenceRow(
+        system_name="A100 peak roofline",
+        model_name=denominator.model_name,
+        model_revision=denominator.model_revision,
+        context_length=denominator.context_length,
+        batch_size=2,
+        tokens_per_second=10_000.0,
+        evidence_tier=PEAK_ROOFLINE_EVIDENCE_TIER,
+        evidence_source="published_peak_roofline",
+        resource_budget_hash=denominator.resource_budget_hash,
+        artifact_hash="8" * 64,
+        workspace_provenance_sha256=None,
+    )
+    comparison = build_headline_throughput_comparison(
+        plena_measurement=numerator,
+        gpu_measurement=denominator,
+        peak_roofline_rows=(peak,),
+        resource_budget=budget,
+    )
+    assert comparison["headline"]["throughput_ratio"] == 0.5
+    assert comparison["peak_roofline_ratio_permitted"] is False
+    assert all(
+        "throughput_ratio" not in row
+        for row in comparison["peak_roofline_table"]
+    )
+    with pytest.raises(ValueError, match="measured evidence"):
+        build_headline_throughput_comparison(
+            plena_measurement=replace(
+                numerator,
+                evidence_tier=PEAK_ROOFLINE_EVIDENCE_TIER,
+            ),
+            gpu_measurement=denominator,
+            peak_roofline_rows=(peak,),
+            resource_budget=budget,
+        )
+    with pytest.raises(ValueError, match="workspace_provenance"):
+        build_headline_throughput_comparison(
+            plena_measurement=replace(
+                numerator,
+                workspace_provenance_sha256="9" * 64,
+            ),
+            gpu_measurement=denominator,
+            peak_roofline_rows=(peak,),
+            resource_budget=budget,
+        )
+
+
+def test_measured_gpu_energy_meter_counter_and_trace_fallback(monkeypatch) -> None:
+    from decode_dse.software import gpu_baseline
+
+    device_uuid = "GPU-meter-test"
+
+    class _Torch:
+        @staticmethod
+        def device(value):
+            return value
+
+        class cuda:
+            @staticmethod
+            def synchronize(device):
+                assert device == "cuda:0"
+
+    class _FakeNVML:
+        def __init__(self, *, counter_supported: bool) -> None:
+            self.counter_supported = counter_supported
+            self.counter_values = iter((1_000, 2_000, 5_000))
+            self.shutdown = False
+
+        @staticmethod
+        def nvmlInit() -> None:
+            return None
+
+        @staticmethod
+        def nvmlDeviceGetHandleByUUID(value):
+            assert value == device_uuid
+            return "handle"
+
+        @staticmethod
+        def nvmlDeviceGetUUID(handle):
+            assert handle == "handle"
+            return device_uuid
+
+        def nvmlDeviceGetTotalEnergyConsumption(self, handle):
+            assert handle == "handle"
+            if not self.counter_supported:
+                raise RuntimeError("energy counter is not supported")
+            return next(self.counter_values)
+
+        @staticmethod
+        def nvmlDeviceGetPowerUsage(handle):
+            assert handle == "handle"
+            return 100_000
+
+        def nvmlShutdown(self) -> None:
+            self.shutdown = True
+
+    counter_nvml = _FakeNVML(counter_supported=True)
+    monkeypatch.setattr(
+        gpu_baseline.importlib,
+        "import_module",
+        lambda name: counter_nvml,
+    )
+    counter_meter = gpu_baseline._NVMLBoardEnergyMeter(
+        device_uuid=device_uuid,
+        method_priority=gpu_baseline.GPU_BASELINE_ENERGY_METER_PRIORITY,
+        power_trace_sample_interval_ms=10,
+    )
+    counter_meter.begin(_Torch, device="cuda:0")
+    counter_energy = counter_meter.end(
+        _Torch,
+        device="cuda:0",
+        repetition=0,
+        generated_tokens=4,
+    )
+    assert counter_energy.meter_method == NVML_TOTAL_ENERGY_METHOD
+    assert counter_energy.total_energy_j == pytest.approx(3.0)
+    counter_meter.close()
+    assert counter_nvml.shutdown is True
+
+    trace_nvml = _FakeNVML(counter_supported=False)
+    monkeypatch.setattr(
+        gpu_baseline.importlib,
+        "import_module",
+        lambda name: trace_nvml,
+    )
+    trace_meter = gpu_baseline._NVMLBoardEnergyMeter(
+        device_uuid=device_uuid,
+        method_priority=gpu_baseline.GPU_BASELINE_ENERGY_METER_PRIORITY,
+        power_trace_sample_interval_ms=10,
+    )
+    trace_meter.begin(_Torch, device="cuda:0")
+    trace_energy = trace_meter.end(
+        _Torch,
+        device="cuda:0",
+        repetition=0,
+        generated_tokens=4,
+    )
+    assert trace_energy.meter_method == NVML_POWER_TRACE_METHOD
+    assert trace_energy.available is True
+    assert len(trace_energy.devices[0].power_trace) >= 2
+    assert trace_energy.total_energy_j > 0
+    trace_meter.close()
+    assert trace_nvml.shutdown is True
+
+    with pytest.raises(ValueError, match="cannot mix NVML meter methods"):
+        GPUEnergyMeasurement(
+            repetition=0,
+            generated_tokens=4,
+            devices=(
+                counter_energy.devices[0],
+                replace(
+                    trace_energy.devices[0],
+                    device_uuid="GPU-meter-test-second",
+                ),
+            ),
+        )
+
+
+def test_incomplete_tokenizer_keeps_model_architecture_evidence(
+    tmp_path: Path,
+) -> None:
+    config = json.loads(
+        (REPOSITORY / "decode_dse/configs/llama3_1_8b.json").read_text(encoding="utf-8")
+    )
+    cache = tmp_path / "models"
+    config["hf_cache_dir"] = str(cache)
+    snapshot = (
+        cache
+        / "models--meta-llama--Llama-3.1-8B-Instruct"
+        / "snapshots"
+        / config["model_revision"]
+    )
+    snapshot.mkdir(parents=True)
+    model_config = dict(config["model_architecture"])
+    model_config.pop("head_dim")
+    model_config["torch_dtype"] = "bfloat16"
+    (snapshot / "config.json").write_text(json.dumps(model_config), encoding="utf-8")
+    shard_name = "model-00001-of-00001.safetensors"
+    (snapshot / shard_name).write_bytes(b"stub")
+    expected_weight_bytes = 8_030_261_248 * 2
+    (snapshot / "model.safetensors.index.json").write_text(
+        json.dumps(
+            {
+                "metadata": {"total_size": expected_weight_bytes},
+                "weight_map": {"model.embed_tokens.weight": shard_name},
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    path, observed_config, weight_bytes, complete, error = _observe_model_assets(config)
+    assert path == str(snapshot)
+    assert weight_bytes == expected_weight_bytes
+    assert not complete
+    assert error == (
+        "FileNotFoundError: pinned tokenizer assets are incomplete: "
+        f"{snapshot / 'tokenizer.json'}, {snapshot / 'tokenizer_config.json'}"
+    )
+    observation = replace(
+        _good_observation(),
+        model_snapshot=path,
+        model_config=observed_config,
+        model_weight_bytes=weight_bytes,
+        model_assets_complete=complete,
+        model_asset_error=error,
+    )
+    report = evaluate_launch_preflight(
+        config,
+        observation,
+        repository_root=REPOSITORY,
+        device_labels=("b200",),
+    )
+    checks = {
+        check.code: check
+        for check in report.checks
+    }
+    assert not checks["model_assets"].passed
+    assert checks["model_assets"].observed == error
+    assert checks["model_architecture"].passed
+    assert checks["model_weight_size"].passed
+    assert len(report.memory_estimates) == 3
+    assert max(item.required_bytes for item in report.memory_estimates) == 36_000 * (
+        1 << 20
+    )
+
+
+def test_refinement_hardware_points_preserve_energy_identity_and_tier() -> None:
+    profile = _small_manifest().entries[0].profile
+
+    def point(tier: str, identity: str, total_j: float):
+        row = {
+            "candidate_id": f"candidate-{tier}",
+            "deployment_valid": True,
+            "packedkv_selector_valid": True,
+            "error_code": None,
+            "metrics": {
+                "area_source": "analytic_full_chip",
+                "area_mm2": 100.0,
+                "timing_calibrated": True,
+                "runtime_feasible": True,
+                "capacity": {"feasible": True},
+                "whole_model": {
+                    "rankable": True,
+                    "publication_timing_tier": "stage_calibrated_analytic",
+                    "tpot_ms": 10.0,
+                    "tps": 100.0,
+                    "system_calibration_id": "system-calibration",
+                    "calibrated_energy": {
+                        "energy_tier": tier,
+                        "energy_id": identity,
+                        "calibration_id": "underlying-calibration",
+                        "total_j": total_j,
+                    },
+                },
+                "output_head_boundary": {
+                    "estimate": {"calibration_id": "head-calibration"}
+                },
+            },
+        }
+        return _hardware_point(row, profile=profile, mean_nll=1.0)
+
+    analytic = point("analytic_anchored", "analytic-energy", 1.0)
+    calibrated = point("dc_calibrated", "dc-energy", 10.0)
+    assert analytic is not None
+    assert calibrated is not None
+    assert analytic.power_calibration_id == "analytic-energy"
+    assert analytic.energy_tier == "analytic_anchored"
+    assert calibrated.power_calibration_id == "dc-energy"
+    assert (
+        _deduplicate_profile_points((analytic, calibrated))[profile.profile_id]
+        is calibrated
+    )
+
+
+def test_stubbed_stage_pipeline_is_idempotent_end_to_end(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from decode_dse.software import sweep
+
+    config = _config()
+    report = evaluate_launch_preflight(
+        config,
+        _good_observation(),
+        repository_root=REPOSITORY,
+        device_labels=("b200",),
+    )
+    monkeypatch.setattr(
+        sweep,
+        "run_launch_preflight",
+        lambda *args, **kwargs: report,
+    )
+    monkeypatch.setattr(
+        sweep,
+        "_require_compiler_trace_feasible",
+        lambda plan: None,
+    )
+    prompts = PromptManifest(
+        dataset_name="stubbed-publication-inputs",
+        dataset_revision="1" * 40,
+        numerical_screen=tuple(
+            PromptRecord(
+                document_id=f"numerical-{index:03d}",
+                prompt_hash=hashlib.sha256(f"n{index}".encode()).hexdigest(),
+            )
+            for index in range(NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count)
+        ),
+        hardware_validation=tuple(
+            PromptRecord(
+                document_id=f"hardware-{index:03d}",
+                prompt_hash=hashlib.sha256(f"h{index}".encode()).hexdigest(),
+            )
+            for index in range(HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count)
+        ),
+    )
+    prompt_path = tmp_path / "prompts.json"
+    write_immutable_json(prompt_path, prompts.to_dict())
+    workspace = tmp_path / "workspace"
+    sweep.create_workspace(
+        config_path=CONFIG_PATH,
+        output_dir=workspace,
+        device_labels=("b200",),
+        prompt_manifest_path=prompt_path,
+        numerical_screen_workers=1,
+        hardware_validation_workers=1,
+    )
+    manifest_bytes = (workspace / "manifest.json").read_bytes()
+    recorded_software_hash = json.loads(
+        (workspace / "provenance.json").read_text(encoding="utf-8")
+    )["software_tree_sha256"]
+    monkeypatch.setattr(
+        sweep,
+        "_software_tree_hash",
+        lambda repository: recorded_software_hash,
+    )
+    plan = sweep._load_plan(workspace / "run_plan.json")
+    stage_ids = {
+        stage: sweep._stage_ids(plan, stage)[:2]
+        for stage in (
+            "preflight",
+            "validation-pilot",
+            "numerical-screen",
+            "hardware-validation",
+        )
+    }
+    monkeypatch.setattr(
+        sweep,
+        "_stage_ids",
+        lambda plan, stage: stage_ids[stage],
+    )
+    monkeypatch.setattr(
+        sweep,
+        "_require_stage_completion",
+        lambda *args, **kwargs: None,
+    )
+    monkeypatch.setattr(
+        sweep,
+        "_load_executor_factory",
+        lambda spec: (lambda context: _Executor(_Clock())),
+    )
+
+    class _PassingGates:
+        def require_passed(self) -> None:
+            return None
+
+    monkeypatch.setattr(sweep, "load_preflight_evidence", lambda path: object())
+    monkeypatch.setattr(
+        sweep,
+        "evaluate_preflight_gates",
+        lambda *args, **kwargs: _PassingGates(),
+    )
+    evidence = tmp_path / "evidence.json"
+    evidence.write_text("{}\n", encoding="utf-8")
+    stage_manifests: dict[str, bytes] = {}
+    for stage in stage_ids:
+        summary = sweep.launch_stage(
+            config_path=CONFIG_PATH,
+            output_dir=workspace,
+            stage=stage,
+            executor_factory="decode_dse.tests:stub_executor",
+            evidence_path=(
+                evidence
+                if stage in {"numerical-screen", "hardware-validation"}
+                else None
+            ),
+            device_label="b200",
+        )
+        assert summary.succeeded == 2
+        stage_root = workspace / stage
+        stage_manifests[stage] = (stage_root / "manifest.json").read_bytes()
+        assert (stage_root / "invocation.json").is_file()
+        assert len(tuple((stage_root / "completed").glob("*.json"))) == 2
+
+    for stage in stage_ids:
+        resumed = sweep.launch_stage(
+            config_path=CONFIG_PATH,
+            output_dir=workspace,
+            stage=stage,
+            executor_factory="decode_dse.tests:stub_executor",
+            evidence_path=(
+                evidence
+                if stage in {"numerical-screen", "hardware-validation"}
+                else None
+            ),
+            device_label="b200",
+        )
+        assert resumed.attempts_written == 0
+        assert (workspace / stage / "manifest.json").read_bytes() == stage_manifests[
+            stage
+        ]
+    assert (workspace / "manifest.json").read_bytes() == manifest_bytes
+
+
+@pytest.fixture
+def local_publication_dataset_fixture(tmp_path: Path):
+    cache_root = (tmp_path / "dataset-cache").resolve()
+    cache_root.mkdir()
+    rows = {
+        "Salesforce/wikitext": (
+            {"text": "first document"},
+            {"text": "second document"},
+        ),
+        "google/IFEval": (
+            {
+                "key": 1000,
+                "prompt": "Write a short answer.",
+                "instruction_id_list": ["length_constraints:number_words"],
+                "kwargs": [{"num_words": 10}],
+            },
+            {
+                "key": 1001,
+                "prompt": "Use two bullets.",
+                "instruction_id_list": ["detectable_format:number_bullet_lists"],
+                "kwargs": [{"num_bullets": 2}],
+            },
+        ),
+        "openai/gsm8k": (
+            {"question": "What is 1 + 1?", "answer": "#### 2"},
+            {"question": "What is 2 + 2?", "answer": "#### 4"},
+        ),
+    }
+    revisions = {
+        "Salesforce/wikitext": "1" * 40,
+        "google/IFEval": "2" * 40,
+        "openai/gsm8k": "3" * 40,
+    }
+    declarations = {
+        "wikitext2": {
+            "dataset_name": "Salesforce/wikitext",
+            "dataset_config": "wikitext-2-raw-v1",
+            "dataset_revision": revisions["Salesforce/wikitext"],
+            "split": "test",
+            "cache_dir": str(cache_root),
+            "content_columns": ["text"],
+            "id_column": None,
+            "source_item_count": 2,
+        },
+        "ifeval": {
+            "dataset_name": "google/IFEval",
+            "dataset_config": "default",
+            "dataset_revision": revisions["google/IFEval"],
+            "split": "train",
+            "cache_dir": str(cache_root),
+            "content_columns": [
+                "key",
+                "prompt",
+                "instruction_id_list",
+                "kwargs",
+            ],
+            "id_column": "key",
+            "source_item_count": 2,
+        },
+        "gsm8k": {
+            "dataset_name": "openai/gsm8k",
+            "dataset_config": "main",
+            "dataset_revision": revisions["openai/gsm8k"],
+            "split": "test",
+            "cache_dir": str(cache_root),
+            "content_columns": ["question", "answer"],
+            "id_column": None,
+            "source_item_count": 2,
+        },
+    }
+    sources = {}
+    for index, (dataset_name, records) in enumerate(rows.items()):
+        source = cache_root / f"snapshot-{index:02d}.jsonl"
+        source.write_text(
+            "".join(
+                json.dumps(record, sort_keys=True) + "\n" for record in records
+            ),
+            encoding="utf-8",
+        )
+        sources[dataset_name] = source
+
+    calls = []
+
+    def load_snapshot(specification):
+        dataset_name = str(specification["dataset_name"])
+        calls.append(dict(specification))
+        return LocalDatasetSnapshot(
+            records=rows[dataset_name],
+            source_files=(sources[dataset_name],),
+        )
+
+    return (
+        {"publication": {"benchmark_datasets": declarations}},
+        load_snapshot,
+        calls,
+        sources,
+    )
+
+
+def test_local_only_publication_benchmark_manifest_is_deterministic(
+    monkeypatch,
+    tmp_path: Path,
+    local_publication_dataset_fixture,
+) -> None:
+    from decode_dse.software import benchmark_runner
+
+    config, loader, calls, sources = local_publication_dataset_fixture
+    first = build_publication_benchmark_manifest(
+        config,
+        load_snapshot=loader,
+    )
+    second = build_publication_benchmark_manifest(
+        config,
+        load_snapshot=loader,
+    )
+    assert first == second
+    assert [record["name"] for record in first["benchmarks"]] == [
+        "wikitext2",
+        "ifeval",
+        "gsm8k",
+    ]
+    assert all(record["full_evaluation"] for record in first["benchmarks"])
+    assert all(record["dataset_config"] for record in first["benchmarks"])
+    assert all(
+        PublicationBenchmark.from_dict(record).source_item_count == 2
+        for record in first["benchmarks"]
+    )
+    assert len(calls) == 6
+
+    config_path = tmp_path / "publication-config.json"
+    output_path = tmp_path / "benchmarks.json"
+    config_path.write_text(
+        json.dumps(config, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(
+        benchmark_runner,
+        "_load_local_huggingface_snapshot",
+        loader,
+    )
+    assert benchmark_runner.build_benchmark_manifest_main(
+        ("--config", str(config_path), "--output", str(output_path))
+    ) == 0
+    output_bytes = output_path.read_bytes()
+    loaded = load_publication_benchmark_manifest(output_path)
+    assert tuple(benchmark.name for benchmark in loaded) == (
+        "wikitext2",
+        "ifeval",
+        "gsm8k",
+    )
+    measured = StackValidity(True, True, True, True, True)
+    configurations = (
+        PublicationConfiguration(
+            "bf16",
+            DecodePrecisionProfile.bf16_reference(),
+            StackValidity(),
+        ),
+        PublicationConfiguration(
+            "uniform_i8",
+            DecodePrecisionProfile.quantized(
+                "MXINT8", "MXINT8", "MXINT8", "FP_E3M2"
+            ),
+            measured,
+        ),
+        PublicationConfiguration(
+            "uniform_i4",
+            DecodePrecisionProfile.quantized(
+                "MXINT4", "MXINT4", "MXINT4", "FP_E3M2"
+            ),
+            measured,
+        ),
+        PublicationConfiguration(
+            "pareto",
+            DecodePrecisionProfile.quantized(
+                "MXINT8", "MXINT4", "MXINT4", "FP_E2M3"
+            ),
+            measured,
+        ),
+    )
+    alternatives = tuple(
+        PublicationHardwareAlternative(
+            configuration_id=configuration.configuration_id,
+            profile_id=configuration.profile.profile_id,
+            source_profile_id=configuration.profile.profile_id,
+            candidate_id=f"hardware-{configuration.role}",
+            record_hash=f"{index + 1:x}" * 64,
+            hardware_artifact_sha256="a" * 64,
+            tpot_ms=1.0 + index,
+            energy_per_token_j=0.5 + index,
+            energy_tier="analytic_anchored",
+        )
+        for index, configuration in enumerate(configurations[1:])
+    )
+    contract = PublicationContract(
+        configurations=configurations,
+        hardware_alternatives=alternatives,
+        benchmarks=loaded,
+        protocol=PublicationProtocol(
+            model_name="fixture/model",
+            model_revision="4" * 40,
+            tokenizer_revision="5" * 40,
+            chat_template_sha256="6" * 64,
+            thinking_mode="disabled",
+            enable_thinking=False,
+            greedy=True,
+            temperature=0.0,
+            token_budgets=(
+                ("wikitext2", 128),
+                ("ifeval", 128),
+                ("gsm8k", 128),
+                ("ruler", 128),
+            ),
+        ),
+    )
+    assert len(contract.benchmarks) == 3
+    assert benchmark_runner.build_benchmark_manifest_main(
+        ("--config", str(config_path), "--output", str(output_path))
+    ) == 0
+    assert output_path.read_bytes() == output_bytes
+
+    sources["openai/gsm8k"].write_text(
+        '{"changed":true}\n',
+        encoding="utf-8",
+    )
+    changed = build_publication_benchmark_manifest(
+        config,
+        load_snapshot=loader,
+    )
+    assert changed["manifest_hash"] != first["manifest_hash"]
+
+
+def test_publication_chat_template_is_sealed_only_from_pinned_local_inputs() -> None:
+    from decode_dse.software.benchmark_runner import (
+        seal_publication_chat_template,
+    )
+
+    qwen_config = json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
+    qwen = seal_publication_chat_template(
+        qwen_config,
+        config_path=CONFIG_PATH,
+    )
+    assert qwen["schema_version"] == "decode-chat-template"
+    assert qwen["model_revision"] == qwen_config["model_revision"]
+    assert qwen["source"]["kind"] == "pinned_local_asset"
+    assert hashlib.sha256(qwen["chat_template"].encode()).hexdigest() == qwen[
+        "chat_template_sha256"
+    ]
+
+    llama_config = json.loads(
+        (REPOSITORY / "decode_dse/configs/llama3_1_8b.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    # Exercise the tokenizer-execution path: drop any sealed asset pin, exactly
+    # as seal_chat_template_asset does before extraction.
+    llama_config["publication"].pop("chat_template_asset", None)
+    llama_config["publication"].pop("chat_template_sha256", None)
+    calls = []
+
+    class LocalTokenizer:
+        @staticmethod
+        def get_chat_template():
+            return "{{ messages | tojson }}"
+
+    def local_loader(model_name, **kwargs):
+        calls.append((model_name, kwargs))
+        return LocalTokenizer()
+
+    llama = seal_publication_chat_template(
+        llama_config,
+        tokenizer_loader=local_loader,
+    )
+    assert llama["chat_template"] == "{{ messages | tojson }}"
+    assert llama["source"]["kind"] == "pinned_local_tokenizer_execution"
+    assert calls == [
+        (
+            llama_config["model_name"],
+            {
+                "revision": llama_config["tokenizer_revision"],
+                "local_files_only": True,
+                "trust_remote_code": False,
+            },
+        )
+    ]
+
+    def unavailable(*args, **kwargs):
+        raise OSError("not cached")
+
+    with pytest.raises(RuntimeError, match="unavailable locally"):
+        seal_publication_chat_template(
+            llama_config,
+            tokenizer_loader=unavailable,
+        )
+
+
+def test_refinement_launch_maps_four_logical_shards_to_two_gpu_waves() -> None:
+    from decode_dse.software.refinement_runner import (
+        _refinement_launch_waves,
+        parse_gpu_pool,
+    )
+
+    devices = parse_gpu_pool("0,1")
+    waves = _refinement_launch_waves(devices)
+    assert waves == (
+        ((0, "0"), (1, "1")),
+        ((2, "0"), (3, "1")),
+    )
+    assert tuple(index for wave in waves for index, _ in wave) == tuple(range(4))
+    assert all(len(wave) <= 2 for wave in waves)
+    assert all(len({device for _, device in wave}) == len(wave) for wave in waves)
+    with pytest.raises(ValueError, match="unique GPU identifiers"):
+        parse_gpu_pool("0,0")
+
+
+def test_pipeline_directory_identity_covers_the_complete_tree(
+    tmp_path: Path,
+) -> None:
+    from decode_dse.software import sweep
+
+    root = tmp_path / "output"
+    nested = root / "nested"
+    nested.mkdir(parents=True)
+    first = root / "first.json"
+    second = nested / "second.bin"
+    first.write_text('{"value":1}\n', encoding="utf-8")
+    second.write_bytes(b"payload")
+
+    baseline = sweep._pipeline_output_identity(root)
+    assert baseline == sweep._pipeline_output_identity(root)
+    assert baseline["entry_count"] == 3
+    assert baseline["file_count"] == 2
+    assert baseline["directory_count"] == 1
+    assert baseline["size_bytes"] == first.stat().st_size + second.stat().st_size
+
+    first.write_text('{"value":2}\n', encoding="utf-8")
+    assert sweep._pipeline_output_identity(root) != baseline
+    first.write_text('{"value":1}\n', encoding="utf-8")
+    assert sweep._pipeline_output_identity(root) == baseline
+
+    second.unlink()
+    assert sweep._pipeline_output_identity(root) != baseline
+    second.write_bytes(b"payload")
+    assert sweep._pipeline_output_identity(root) == baseline
+
+    added = root / "added.txt"
+    added.write_text("added\n", encoding="utf-8")
+    assert sweep._pipeline_output_identity(root) != baseline
+    added.unlink()
+    assert sweep._pipeline_output_identity(root) == baseline
+
+    link = root / "link"
+    link.symlink_to(first)
+    with pytest.raises(ValueError, match="symbolic links"):
+        sweep._pipeline_output_identity(root)
+    link.unlink()
+
+    fifo = root / "fifo"
+    os.mkfifo(fifo)
+    with pytest.raises(ValueError, match="unsupported file type"):
+        sweep._pipeline_output_identity(root)
+
+
+def test_publication_configuration_builder_separates_accuracy_and_hardware(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from decode_dse.hardware import design_space, evaluation
+    from decode_dse.software import refinement_runner
+    from decode_dse.software.benchmark_runner import (
+        build_publication_configuration_manifest,
+        load_publication_configuration_manifest,
+    )
+    from decode_dse.software.refinement_schedule import (
+        DecodeRefinementProfile,
+        DoomedGateDecision,
+        DoomedGatePolicy,
+        RefinementSchedule,
+        RefinementScheduleEntry,
+        write_refinement_schedule,
+    )
+
+    base_manifest = _small_manifest()
+    sources = {
+        "uniform_mxint8": DecodePrecisionProfile.quantized(
+            "MXINT8", "MXINT8", "MXINT8", "FP_E3M2"
+        ),
+        "uniform_mxint4": DecodePrecisionProfile.quantized(
+            "MXINT4", "MXINT4", "MXINT4", "FP_E3M2"
+        ),
+        "mxint_kv2": DecodePrecisionProfile.quantized(
+            "MXINT8", "MXINT8", "MXINT2", "FP_E3M2"
+        ),
+        "accuracy_constrained_deployment": DecodePrecisionProfile.quantized(
+            "MXINT8", "MXINT4", "MXINT4", "FP_E2M3"
+        ),
+    }
+    manifest_profiles = (
+        DecodePrecisionProfile.bf16_reference(),
+        *sources.values(),
+    )
+    manifest = SweepManifest(
+        model_name=base_manifest.model_name,
+        model_revision=base_manifest.model_revision,
+        model_architecture=base_manifest.model_architecture,
+        tokenizer_revision=base_manifest.tokenizer_revision,
+        quantizer_provenance=base_manifest.quantizer_provenance,
+        entries=tuple(
+            SweepManifestEntry(
+                ordinal=index,
+                profile=profile,
+                legality=evaluate_profile_legality(profile),
+            )
+            for index, profile in enumerate(manifest_profiles)
+        ),
+    )
+    manifest_path = tmp_path / "manifest.json"
+    manifest_path.write_text(
+        json.dumps(manifest.to_dict(), indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    profiles = (
+        DecodeRefinementProfile(sources["uniform_mxint8"], "MXINT8", "MXINT8"),
+        DecodeRefinementProfile(sources["uniform_mxint8"], "MXINT8", "MXINT4"),
+        DecodeRefinementProfile(sources["uniform_mxint4"], "MXINT4", "MXINT4"),
+        DecodeRefinementProfile(sources["mxint_kv2"], "MXINT2", "MXINT2"),
+        DecodeRefinementProfile(
+            sources["accuracy_constrained_deployment"], "MXINT4", "MXINT4"
+        ),
+    )
+    validity = StackValidity(True, True, True, True, True)
+    scheduled_gate = DoomedGateDecision("scheduled", "fixture", 2.0, 1.0)
+    skipped_gate = DoomedGateDecision(
+        "skipped_doomed",
+        "source_accuracy_exceeds_gate",
+        2.0,
+        3.0,
+    )
+    gates = (
+        scheduled_gate,
+        scheduled_gate,
+        scheduled_gate,
+        skipped_gate,
+        scheduled_gate,
+    )
+    schedule = RefinementSchedule(
+        entries=tuple(
+            RefinementScheduleEntry(index, profile, gates[index], validity)
+            for index, profile in enumerate(profiles)
+        ),
+        source_profile_ids=tuple(
+            sorted(profile.profile_id for profile in sources.values())
+        ),
+        reference_mean_nll=1.0,
+        policy=DoomedGatePolicy(),
+    )
+    schedule_path = write_refinement_schedule(
+        tmp_path / "refinement_schedule.json",
+        schedule,
+    )
+    source_selection_path = write_immutable_json(
+        tmp_path / "source_selection.json",
+        {
+            "schema_version": "decode-refinement-source-selection",
+            "manifest_hash": manifest.canonical_hash,
+            "schedule_hash": schedule.canonical_hash,
+            "source_selection": {
+                "source_roles": {
+                    role: profile.profile_id for role, profile in sources.items()
+                }
+            },
+        },
+    )
+
+    means = (1.1, 1.0, 1.2, 1.3, 1.05)
+    sample_bundle_hash = "7" * 64
+    result_rows = []
+    for entry, mean_nll in zip(schedule.entries, means):
+        artifacts = []
+        if entry.gate.executable:
+            artifact_path = tmp_path / f"result-{entry.ordinal}.json"
+            artifact_path.write_text(
+                json.dumps({"mean_token_nll": mean_nll}) + "\n",
+                encoding="utf-8",
+            )
+            artifacts.append(
+                refinement_runner._artifact_identity(str(artifact_path))
+            )
+        body = {
+            "schema_version": refinement_runner.REFINEMENT_RESULT_SCHEMA,
+            "schedule_hash": schedule.canonical_hash,
+            "sample_bundle_hash": sample_bundle_hash,
+            "ordinal": entry.ordinal,
+            "profile_id": entry.profile_id,
+            "profile": entry.profile.to_dict(),
+            "gate": entry.gate.to_dict(),
+            "bank_id": "fixture-bank" if entry.gate.executable else None,
+            "attempt": 1 if entry.gate.executable else 0,
+            "state": (
+                "succeeded"
+                if entry.gate.executable
+                else entry.gate.execution_state
+            ),
+            "result": (
+                {"mean_token_nll": mean_nll}
+                if entry.gate.executable
+                else {"gate": entry.gate.to_dict()}
+            ),
+            "artifacts": artifacts,
+            "error_class": None,
+            "error_message": None,
+            "traceback": None,
+            "runtime_seconds": 1.0,
+            "completed_at": "2026-08-02T00:00:00Z",
+        }
+        result_rows.append(
+            {**body, "record_hash": refinement_runner._content_hash(body)}
+        )
+    results_path = tmp_path / "refinement_results.jsonl"
+    results_path.write_text(
+        "".join(
+            json.dumps(row, sort_keys=True, separators=(",", ":")) + "\n"
+            for row in result_rows
+        ),
+        encoding="utf-8",
+    )
+    merge_path = write_immutable_json(
+        tmp_path / "refinement_merge.json",
+        {
+            "schema_version": refinement_runner.REFINEMENT_MERGE_SCHEMA,
+            "master_schedule_hash": schedule.canonical_hash,
+            "sample_bundle_hash": sample_bundle_hash,
+            "profile_count": len(schedule.entries),
+            "profile_ids": [entry.profile_id for entry in schedule.entries],
+            "terminal": [
+                {
+                    "profile_id": row["profile_id"],
+                    "state": row["state"],
+                    "attempt": row["attempt"],
+                    "record_hash": row["record_hash"],
+                }
+                for row in result_rows
+            ],
+            "result_rows": len(result_rows),
+            "merged_results": {
+                "path": str(results_path.resolve()),
+                "size_bytes": results_path.stat().st_size,
+                "sha256": hashlib.sha256(results_path.read_bytes()).hexdigest(),
+            },
+        },
+    )
+    hardware_path = tmp_path / "refined_hardware.jsonl"
+    hardware_path.write_text("factorized fixture\n", encoding="utf-8")
+    chosen_profiles = (profiles[1], profiles[2], profiles[4])
+    hardware_rows = tuple(
+        {
+            "profile_id": profile.profile_id,
+            "profile": profile.to_dict(),
+            "candidate_id": f"candidate-{index}",
+            "record_hash": hashlib.sha256(
+                f"{profile.profile_id}:candidate-{index}".encode()
+            ).hexdigest(),
+            "retention_labels": ["profile_frontier"],
+            "deployment_valid": True,
+            "validity": validity.to_dict(),
+            "metrics": {
+                "whole_model": {
+                    "rankable": True,
+                    "tpot_ms": 2.0 + index,
+                    "calibrated_energy": {
+                        "total_j": 0.2 + index * 0.1,
+                        "energy_tier": "analytic_anchored",
+                    },
+                }
+            },
+        }
+        for index, profile in enumerate(chosen_profiles)
+    )
+    monkeypatch.setattr(
+        design_space,
+        "load_hardware_artifact",
+        lambda path: (
+            {
+                "storage_revision": "factorized-exact",
+                "provenance": {
+                    "model_revision": manifest.model_revision,
+                    "tokenizer_revision": manifest.tokenizer_revision,
+                },
+            },
+            hardware_rows,
+        ),
+    )
+    built = build_publication_configuration_manifest(
+        manifest_path=manifest_path,
+        schedule_path=schedule_path,
+        source_selection_path=source_selection_path,
+        merge_receipt_path=merge_path,
+        merged_results_path=results_path,
+        hardware_artifacts=(hardware_path,),
+    )
+    assert [item["role"] for item in built["configurations"]] == [
+        "bf16",
+        "uniform_i8",
+        "uniform_i4",
+        "pareto",
+    ]
+    assert built["configurations"][1]["profile_id"] == profiles[1].profile_id
+    assert len(built["hardware_alternatives"]) == 3
+    assert built["selection_semantics"]["source_hardware_costs_inherited"] is False
+    output = write_immutable_json(tmp_path / "configurations.json", built)
+    loaded = load_publication_configuration_manifest(output)
+    assert loaded["manifest_hash"] == built["manifest_hash"]
+    refined_manifest, refined_rows = evaluation._refinement_hardware_inputs(
+        manifest,
+        schedule_path,
+        merge_path,
+        results_path,
+    )
+    assert len(refined_manifest.entries) == len(refined_rows) == len(profiles) - 1
+    assert refined_manifest.refinement_schedule_hash == schedule.canonical_hash
+
+    results_path.write_text("tampered\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="identity changed"):
+        build_publication_configuration_manifest(
+            manifest_path=manifest_path,
+            schedule_path=schedule_path,
+            source_selection_path=source_selection_path,
+            merge_receipt_path=merge_path,
+            merged_results_path=results_path,
+            hardware_artifacts=(hardware_path,),
+        )
+
+
+def test_full_publication_pipeline_receipts_partition_and_resume(
+    monkeypatch,
+    tmp_path: Path,
+    capsys,
+) -> None:
+    from decode_dse.software import sweep
+    from decode_dse.hardware import evaluation
+    from decode_dse.hardware.lm_head_service import (
+        load_bf16_head_service_artifact,
+    )
+
+    config = _config()
+    config["publication_pipeline"]["resources"]["publication_enabled"] = True
+    config["publication_pipeline"]["artifacts"][
+        "head_service_calibration"
+    ] = "workspace://test-fixtures/synthetic_test_only_head.json"
+    config["publication_pipeline"]["artifacts"][
+        "packedkv_evidence"
+    ] = "workspace://test-fixtures/synthetic_test_only_packedkv.json"
+    config["publication_pipeline"]["artifacts"][
+        "decode_analysis"
+    ] = "workspace://test-fixtures/synthetic_test_only_decode_analysis.json"
+    workspace = (tmp_path / "workspace").resolve()
+    synthetic_head = workspace / "test-fixtures" / "synthetic_test_only_head.json"
+    synthetic_head.parent.mkdir(parents=True)
+    synthetic_head.write_text(
+        json.dumps(
+            {
+                "schema_version": "synthetic-test-only-head",
+                "production_provenance": False,
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    for name in (
+        "synthetic_test_only_packedkv.json",
+        "synthetic_test_only_decode_analysis.json",
+    ):
+        (synthetic_head.parent / name).write_text(
+            json.dumps(
+                {
+                    "schema_version": "synthetic-test-only",
+                    "production_provenance": False,
+                }
+            )
+            + "\n",
+            encoding="utf-8",
+        )
+    head_status = load_bf16_head_service_artifact(
+        synthetic_head,
+        model_name=str(config["model_name"]),
+        model_revision=str(config["model_revision"]),
+        hidden_size=int(config["model_architecture"]["hidden_size"]),
+        vocab_size=int(config["model_architecture"]["vocab_size"]),
+        tie_embeddings=bool(
+            config["model_architecture"]["tie_word_embeddings"]
+        ),
+        required_batches=tuple(config["hardware_space"]["BATCH"]),
+    )
+    assert head_status.passed is False
+    config_path = tmp_path / "config.json"
+    config_path.write_text(
+        json.dumps(config, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    manifest = build_exhaustive_manifest(
+        str(config["model_name"]),
+        str(config["model_revision"]),
+        dict(config["model_architecture"]),
+        _small_manifest().quantizer_provenance,
+        str(config["tokenizer_revision"]),
+    )
+    plan = build_run_plan(
+        manifest,
+        device_labels=("b200",),
+        numerical_screen_workers=2,
+        hardware_validation_workers=2,
+        gpu_baseline=GPUBaselinePlan.from_config(config["gpu_baseline"]),
+    )
+    monkeypatch.setattr(sweep, "validate_inputs", lambda **kwargs: plan)
+    commands = sweep.build_pipeline(
+        config=config_path.resolve(),
+        output_dir=workspace,
+        device_label="b200",
+        gpus=("0", "1"),
+        plan=plan,
+        stack_validity=workspace / "stack_validity.json",
+    )
+    command_names = tuple(command.name for command in commands)
+    assert command_names[:4] == (
+        "compiler-trace-artifacts",
+        "publication-evidence-gate",
+        "publication-benchmark-manifest",
+        "publication-chat-template",
+    )
+    command_by_argv = {command.argv: command for command in commands}
+    calls: list[str] = []
+    first_gpu_environments: list[tuple[str, str | None]] = []
+    interrupted = False
+    partition_manifests: dict[Path, bytes] = {}
+    hardware_outputs = tuple(
+        command.outputs[0]
+        for command in commands
+        if command.name.startswith("exact-hardware-study")
+    )
+    final_hardware_outputs = tuple(
+        command.outputs[0]
+        for command in commands
+        if command.name == "refined-hardware-study"
+    )
+    for command in commands:
+        if command.name.startswith("exact-hardware-study"):
+            parsed = evaluation._parser().parse_args(command.argv[3:])
+            assert parsed.execution_mode == "legacy_aggregate_bandwidth"
+            assert parsed.publication_timing_tier == "stage_calibrated_analytic"
+            assert parsed.compiler_trace_artifacts is None
+            assert parsed.request_memory_calibration is None
+    figure_stems = (
+        "00_numerical_completion",
+        "01_accuracy_by_weight",
+        "02_weight_kv_accuracy_landscape",
+        "03_vector_precision_sensitivity",
+        "04_screening_fidelity",
+        "05_hardware_pareto",
+        "06_packedkv_causal_ablation",
+        "07_model_validation",
+        "08_decode_stage_breakdown",
+        "09_decode_capacity",
+        "10_handoff_regimes",
+        "11_multichip_scaling",
+        "12_selected_deployment",
+    )
+    csv_names = tuple(f"{stem}_data.csv" for stem in figure_stems)
+
+    def create_output(path: Path, command_name: str) -> None:
+        if command_name == "publication-figures":
+            path.mkdir(parents=True, exist_ok=True)
+            figure_names = tuple(
+                f"{stem}.{format_name}"
+                for stem in figure_stems
+                for format_name in ("png", "pdf", "svg")
+            )
+            for name in (*figure_names, *csv_names):
+                (path / name).write_bytes(
+                    f"synthetic test output: {name}\n".encode("utf-8")
+                )
+            figure_command = next(
+                item for item in commands if item.name == "publication-figures"
+            )
+            source_flags = (
+                "--gpu-baseline-report",
+                "--gpu-baseline-receipt",
+                "--publication-contract",
+                "--publication-report",
+                "--final-selection",
+                "--refined-hardware-artifact",
+            )
+            consumed = []
+            for flag in source_flags:
+                argument_index = figure_command.argv.index(flag)
+                source_path = Path(figure_command.argv[argument_index + 1])
+                consumed.append(
+                    {
+                        "flag": flag,
+                        "path": str(source_path),
+                        "sha256": hashlib.sha256(
+                            source_path.read_bytes()
+                        ).hexdigest(),
+                    }
+                )
+            identity_header = ",".join(
+                item["flag"].removeprefix("--").replace("-", "_")
+                + "_sha256"
+                for item in consumed
+            )
+            identity_row = ",".join(item["sha256"] for item in consumed)
+            (path / "12_selected_deployment_data.csv").write_text(
+                identity_header + "\n" + identity_row + "\n",
+                encoding="utf-8",
+            )
+            (path / "figure_manifest.json").write_text(
+                json.dumps(
+                    {
+                        "evidence_tier": "synthetic_test_only",
+                        "figures": list(figure_names),
+                        "data_tables": list(csv_names),
+                        "consumed_publication_sources": consumed,
+                    },
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            return
+        if path.suffix:
+            path.parent.mkdir(parents=True, exist_ok=True)
+            if command_name == "final-publication-selection":
+                payload = {
+                    "selected": True,
+                    "hardware_artifacts": [
+                        {
+                            "sha256": hashlib.sha256(item.read_bytes()).hexdigest()
+                        }
+                        for item in final_hardware_outputs
+                    ],
+                }
+            else:
+                payload = {"command": command_name, "path": str(path)}
+            path.write_text(
+                json.dumps(payload, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+            return
+        path.mkdir(parents=True, exist_ok=True)
+        manifest_path = path / "manifest.json"
+        if not manifest_path.exists():
+            manifest_path.write_bytes(
+                json.dumps(
+                    {"command": command_name, "partition": path.name},
+                    sort_keys=True,
+                ).encode("utf-8")
+                + b"\n"
+            )
+        partition_manifests.setdefault(path, manifest_path.read_bytes())
+        journal = path / "journal.jsonl"
+        payload = journal.read_bytes() if journal.exists() else b""
+        if payload and not payload.endswith(b"\n"):
+            payload = payload[: payload.rfind(b"\n") + 1]
+        if b'"boundary":"terminal"' not in payload:
+            payload += b'{"boundary":"terminal"}\n'
+        journal.write_bytes(payload)
+
+    def stub_run(argv, *, cwd, env, check):
+        nonlocal interrupted
+        command = command_by_argv[tuple(argv)]
+        calls.append(command.name)
+        if command.first_gpu_only:
+            first_gpu_environments.append(
+                (command.name, env.get("CUDA_VISIBLE_DEVICES"))
+            )
+        if command.name == "numerical-screen" and not interrupted:
+            interrupted = True
+            for output in command.outputs:
+                output.mkdir(parents=True, exist_ok=True)
+                manifest_path = output / "manifest.json"
+                manifest_path.write_bytes(
+                    json.dumps(
+                        {"command": command.name, "partition": output.name},
+                        sort_keys=True,
+                    ).encode("utf-8")
+                    + b"\n"
+                )
+                partition_manifests[output] = manifest_path.read_bytes()
+                (output / "journal.jsonl").write_bytes(
+                    b'{"boundary":"completed"}\n{"truncated"'
+                )
+            raise KeyboardInterrupt("stubbed interruption")
+        for output in command.outputs:
+            create_output(output, command.name)
+        return None
+
+    monkeypatch.setattr(sweep.subprocess, "run", stub_run)
+    arguments = (
+        "--config",
+        str(config_path),
+        "--output-dir",
+        str(workspace),
+        "--device-label",
+        "b200",
+        "--gpus",
+        "0,1",
+    )
+    with pytest.raises(KeyboardInterrupt, match="stubbed interruption"):
+        sweep.sweep_pipeline_main(arguments)
+    contract_bytes = (workspace / "pipeline" / "contract.json").read_bytes()
+    assert not any(
+        name.startswith("exact-hardware-study") for name in calls
+    )
+
+    assert sweep.sweep_pipeline_main(arguments) == 0
+    assert (workspace / "pipeline" / "contract.json").read_bytes() == contract_bytes
+    assert set(calls) == {command.name for command in commands}
+    assert len(
+        tuple((workspace / "pipeline" / "completed").glob("*.json"))
+    ) == len(commands)
+    assert (workspace / "pipeline" / "receipt.json").is_file()
+    assert (workspace / "publication" / "final_selection.json").is_file()
+    assert (
+        workspace / "publication" / "figures" / "figure_manifest.json"
+    ).is_file()
+    figure_root = workspace / "publication" / "figures"
+    assert all(
+        (figure_root / f"{stem}.{format_name}").is_file()
+        for stem in figure_stems
+        for format_name in ("png", "pdf", "svg")
+    )
+    assert all((figure_root / name).is_file() for name in csv_names)
+    figure_manifest = json.loads(
+        (figure_root / "figure_manifest.json").read_text(encoding="utf-8")
+    )
+    consumed_sources = figure_manifest["consumed_publication_sources"]
+    assert {item["flag"] for item in consumed_sources} == {
+        "--gpu-baseline-report",
+        "--gpu-baseline-receipt",
+        "--publication-contract",
+        "--publication-report",
+        "--final-selection",
+        "--refined-hardware-artifact",
+    }
+    selected_table = (
+        figure_root / "12_selected_deployment_data.csv"
+    ).read_text(encoding="utf-8")
+    assert all(item["sha256"] in selected_table for item in consumed_sources)
+    final_selection = json.loads(
+        (workspace / "publication" / "final_selection.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    assert [
+        item["sha256"] for item in final_selection["hardware_artifacts"]
+    ] == [
+        hashlib.sha256(path.read_bytes()).hexdigest()
+        for path in final_hardware_outputs
+    ]
+    for root, expected in partition_manifests.items():
+        assert (root / "manifest.json").read_bytes() == expected
+        assert (root / "journal.jsonl").read_bytes().endswith(
+            b'{"boundary":"terminal"}\n'
+        )
+    assert first_gpu_environments
+    assert all(device == "0" for _, device in first_gpu_environments)
+
+    call_count = len(calls)
+    receipt_bytes = (workspace / "pipeline" / "receipt.json").read_bytes()
+    assert sweep.sweep_pipeline_main(arguments) == 0
+    assert len(calls) == call_count
+    assert (workspace / "pipeline" / "contract.json").read_bytes() == contract_bytes
+    assert (workspace / "pipeline" / "receipt.json").read_bytes() == receipt_bytes
+
+    directory_output = next(
+        output
+        for command in commands
+        for output in command.outputs
+        if not output.suffix
+    )
+    tracked_file = directory_output / "manifest.json"
+    tracked_bytes = tracked_file.read_bytes()
+    capsys.readouterr()
+
+    tracked_file.write_bytes(tracked_bytes + b'{"tampered":true}\n')
+    assert sweep.sweep_pipeline_main(arguments) == 2
+    assert "pipeline output identity changed" in capsys.readouterr().err
+    tracked_file.write_bytes(tracked_bytes)
+    assert sweep.sweep_pipeline_main(arguments) == 0
+    capsys.readouterr()
+
+    tracked_file.unlink()
+    assert sweep.sweep_pipeline_main(arguments) == 2
+    assert "pipeline output identity changed" in capsys.readouterr().err
+    tracked_file.write_bytes(tracked_bytes)
+    assert sweep.sweep_pipeline_main(arguments) == 0
+    capsys.readouterr()
+
+    unexpected_file = directory_output / "unexpected.json"
+    unexpected_file.write_text('{"unexpected":true}\n', encoding="utf-8")
+    assert sweep.sweep_pipeline_main(arguments) == 2
+    assert "pipeline output identity changed" in capsys.readouterr().err
+    unexpected_file.unlink()
+    assert sweep.sweep_pipeline_main(arguments) == 0
+    assert len(calls) == call_count
+    assert (workspace / "pipeline" / "receipt.json").read_bytes() == receipt_bytes
+
+
+def test_publication_evidence_gate_rejects_missing_physical_head_before_sweep(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from decode_dse.software import sweep
+    from decode_dse import simulator_bridge
+
+    config = _config()
+    config_path = tmp_path / "config.json"
+    config_path.write_text(json.dumps(config), encoding="utf-8")
+    workspace = tmp_path / "workspace"
+    timing = workspace / "external" / "decode_timing_evidence.json"
+    timing.parent.mkdir(parents=True)
+    timing.write_text("{}\n", encoding="utf-8")
+
+    class PassingTiming:
+        mode = "rtl_serialized"
+        passed = True
+        evidence_id = "timing-" + "1" * 64
+
+    class TimingLoader:
+        @staticmethod
+        def load(path):
+            assert Path(path) == timing
+            return PassingTiming()
+
+    class SimulatorTiming:
+        TimingEvidence = TimingLoader
+
+    monkeypatch.setattr(simulator_bridge, "_disagg", lambda: SimulatorTiming())
+    with pytest.raises(
+        FileNotFoundError,
+        match="required publication artifact head_service_calibration is missing",
+    ):
+        sweep.validate_publication_evidence(
+            config=config_path,
+            output_dir=workspace,
+            report=workspace / "publication_evidence_gate.json",
+        )
+    assert not (workspace / "preflight").exists()
+
+
+def test_final_publication_gate_joins_benchmarks_to_exact_hardware(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    from decode_dse.software import benchmark_runner, sweep
+    from decode_dse.hardware import design_space
+
+    profile = DecodePrecisionProfile.quantized(
+        "MXINT8", "MXINT4", "MXINT4", "FP_E2M3"
+    )
+    profile_id = profile.profile_id
+    candidate_id = "candidate-identity"
+    configuration_id = "configuration-identity"
+    contract_hash = "1" * 64
+    hardware_path = tmp_path / "hardware.jsonl"
+    hardware_path.write_text("sealed hardware partition\n", encoding="utf-8")
+    hardware_sha256 = hashlib.sha256(hardware_path.read_bytes()).hexdigest()
+    alternative = benchmark_runner.PublicationHardwareAlternative(
+        configuration_id=configuration_id,
+        profile_id=profile_id,
+        source_profile_id=profile_id,
+        candidate_id=candidate_id,
+        record_hash="2" * 64,
+        hardware_artifact_sha256=hardware_sha256,
+        tpot_ms=1.5,
+        energy_per_token_j=0.25,
+        energy_tier="analytic_anchored",
+    )
+    contract = SimpleNamespace(
+        canonical_hash=contract_hash,
+        configurations=(
+            SimpleNamespace(
+                configuration_id=configuration_id,
+                role="pareto",
+                profile=profile,
+            ),
+        ),
+        hardware_alternatives=(alternative,),
+    )
+    monkeypatch.setattr(
+        benchmark_runner.PublicationContract,
+        "from_dict",
+        staticmethod(lambda value: contract),
+    )
+    contract_path = tmp_path / "contract.json"
+    report_path = tmp_path / "publication_report.json"
+    output_path = tmp_path / "selection.json"
+    write_immutable_json(contract_path, {"contract_hash": contract_hash})
+    write_immutable_json(
+        report_path,
+        {
+            "schema_version": "decode-publication-report",
+            "contract_hash": contract_hash,
+            "selection": {
+                "selected": True,
+                "accuracy_configuration_ids": [configuration_id],
+            },
+        },
+    )
+    monkeypatch.setattr(
+        design_space,
+        "load_hardware_artifact",
+        lambda path: (
+            {
+                "storage_revision": "factorized-exact",
+                "run_id": "hardware-run",
+                "factor_evaluation_count": 1,
+                "factor_evaluation_sha256": "3" * 64,
+                "ordered_membership_map_sha256": "4" * 64,
+                "expansion_contract_sha256": "5" * 64,
+                "conceptual_result_count": 1,
+            },
+            (
+                {
+                    "record_hash": alternative.record_hash,
+                    "candidate_id": candidate_id,
+                    "profile_id": profile_id,
+                    "profile": profile.to_dict(),
+                    "deployment_valid": True,
+                    "retention_labels": ["profile_frontier"],
+                    "metrics": {
+                        "whole_model": {
+                            "rankable": True,
+                            "tpot_ms": 1.5,
+                            "calibrated_energy": {
+                                "total_j": 0.25,
+                                "energy_tier": "analytic_anchored",
+                            },
+                        }
+                    },
+                },
+            ),
+        ),
+    )
+    assert (
+        sweep.publication_gate_main(
+            (
+                "--contract",
+                str(contract_path),
+                "--report",
+                str(report_path),
+                "--hardware-artifact",
+                str(hardware_path),
+                "--output",
+                str(output_path),
+            )
+        )
+        == 0
+    )
+    selection = load_immutable_json(output_path)
+    assert selection["selection"]["candidate_id"] == candidate_id
+    assert selection["selection"]["alternative_id"] == alternative.alternative_id
+    assert selection["hardware_join"]["candidate_count"] == 1
+    assert selection["hardware_artifacts"][0]["sha256"] == hardware_sha256
+
+
+def test_csv_export_requires_checksum_bound_workspace_provenance(
+    tmp_path: Path,
+) -> None:
+    manifest = _small_manifest()
+    body = {
+        "schema_version": "decode-sweep-provenance",
+        "created_at_utc": "2026-08-01T00:00:00Z",
+        "manifest_hash": manifest.canonical_hash,
+        "run_plan_hash": "2" * 64,
+        "quantizer_provenance_hash": (manifest.quantizer_provenance.canonical_hash),
+        "model": {
+            "name": manifest.model_name,
+            "revision": manifest.model_revision,
+            "tokenizer_revision": manifest.tokenizer_revision,
+            "dtype": "bfloat16",
+        },
+        "datasets": {
+            "evaluation": {
+                "name": "Salesforce/wikitext",
+                "config": "wikitext-2-raw-v1",
+                "revision": "3" * 40,
+                "split": "validation",
+            }
+        },
+    }
+    workspace = tmp_path / "workspace"
+    export = tmp_path / "publication"
+
+    def write_provenance(value: dict, directory: Path = workspace) -> Path:
+        payload = json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=True,
+            allow_nan=False,
+        ).encode("utf-8")
+        directory.mkdir(parents=True, exist_ok=True)
+        path = directory / "provenance.json"
+        path.write_text(
+            json.dumps(value | {"content_hash": hashlib.sha256(payload).hexdigest()}),
+            encoding="utf-8",
+        )
+        return path
+
+    source_provenance = write_provenance(body)
+    loaded = _load_sweep_provenance(source_provenance, manifest)
+    assert loaded["run_plan_hash"] == "2" * 64
+    assert RESULTS_PROVENANCE_SCHEMA == "decode-sweep-results-provenance"
+    portable_provenance = _copy_sweep_provenance(
+        source_provenance,
+        export,
+        expected_content_hash=loaded["content_hash"],
+    )
+    assert portable_provenance.name == PORTABLE_WORKSPACE_PROVENANCE
+    assert portable_provenance.read_bytes() == source_provenance.read_bytes()
+    assert (
+        _copy_sweep_provenance(
+            source_provenance,
+            export,
+            expected_content_hash=loaded["content_hash"],
+        )
+        == portable_provenance
+    )
+    table = export / "00_numerical_completion_data.csv"
+    table.write_bytes(b"profile_id,state\nabc,succeeded\n")
+    sidecar = _build_results_provenance(
+        sweep_provenance_path=portable_provenance,
+        sweep_provenance=loaded,
+        manifest=manifest,
+        data_tables=(table,),
+        created_at_utc="2026-08-01T00:00:01Z",
+    )
+    assert sidecar["workspace_provenance"] == {
+        "path": PORTABLE_WORKSPACE_PROVENANCE,
+        "content_hash": loaded["content_hash"],
+    }
+    assert sidecar["tables"] == [
+        {
+            "filename": table.name,
+            "sha256": hashlib.sha256(table.read_bytes()).hexdigest(),
+            "size_bytes": table.stat().st_size,
+        }
+    ]
+    sidecar_body = dict(sidecar)
+    content_hash = sidecar_body.pop("content_hash")
+    assert (
+        content_hash
+        == hashlib.sha256(
+            json.dumps(
+                sidecar_body,
+                sort_keys=True,
+                separators=(",", ":"),
+                ensure_ascii=True,
+                allow_nan=False,
+            ).encode("utf-8")
+        ).hexdigest()
+    )
+    table.write_bytes(table.read_bytes() + b"def,failed\n")
+    changed_sidecar = _build_results_provenance(
+        sweep_provenance_path=portable_provenance,
+        sweep_provenance=loaded,
+        manifest=manifest,
+        data_tables=(table,),
+        created_at_utc="2026-08-01T00:00:01Z",
+    )
+    assert changed_sidecar["tables"][0]["sha256"] != sidecar["tables"][0]["sha256"]
+    assert changed_sidecar["content_hash"] != sidecar["content_hash"]
+    results_provenance_path = export / "sweep_results_provenance.json"
+    _write_json(results_provenance_path, changed_sidecar)
+
+    portable_bytes = portable_provenance.read_bytes()
+    portable_provenance.write_bytes(b"conflicting provenance\n")
+    with pytest.raises(FileExistsError, match="differs"):
+        _copy_sweep_provenance(
+            source_provenance,
+            export,
+            expected_content_hash=loaded["content_hash"],
+        )
+    portable_provenance.write_bytes(portable_bytes)
+    workspace.rename(tmp_path / "moved-workspace")
+    assert not source_provenance.exists()
+    relocated = _load_sweep_provenance(portable_provenance, manifest)
+    assert relocated["content_hash"] == loaded["content_hash"]
+    stored_sidecar = json.loads(results_provenance_path.read_text(encoding="utf-8"))
+    stored_body = dict(stored_sidecar)
+    stored_hash = stored_body.pop("content_hash")
+    assert (
+        stored_hash
+        == hashlib.sha256(
+            json.dumps(
+                stored_body,
+                sort_keys=True,
+                separators=(",", ":"),
+                ensure_ascii=True,
+                allow_nan=False,
+            ).encode("utf-8")
+        ).hexdigest()
+    )
+    portable_reference = export / stored_sidecar["workspace_provenance"]["path"]
+    assert portable_reference == portable_provenance
+    assert (
+        _load_sweep_provenance(portable_reference, manifest)["content_hash"]
+        == stored_sidecar["workspace_provenance"]["content_hash"]
+    )
+    stored_table = stored_sidecar["tables"][0]
+    assert hashlib.sha256(table.read_bytes()).hexdigest() == stored_table["sha256"]
+    assert table.stat().st_size == stored_table["size_bytes"]
+    relocated_sidecar = _build_results_provenance(
+        sweep_provenance_path=portable_provenance,
+        sweep_provenance=relocated,
+        manifest=manifest,
+        data_tables=(table,),
+        created_at_utc="2026-08-01T00:00:01Z",
+    )
+    assert relocated_sidecar == changed_sidecar
+
+    with pytest.raises(ValueError, match="does not bind"):
+        _load_sweep_provenance(
+            write_provenance(
+                body | {"manifest_hash": "0" * 64},
+                tmp_path / "wrong-workspace",
+            ),
+            manifest,
+        )
+
+
+@pytest.mark.parametrize(
+    ("capability", "arch_list", "supported"),
+    (
+        ("sm_100", ("sm_90", "sm_100"), True),
+        ("sm_100", ("sm_90", "sm_120"), False),
+        ("sm_86", ("sm_80",), True),
+        ("sm_80", ("sm_86",), False),
+        ("sm_90", ("compute_90",), True),
+        ("sm_90", (), False),
+        ("", ("sm_90",), False),
+    ),
+)
+def test_architecture_compatibility_follows_the_cuda_rule(
+    capability: str,
+    arch_list: tuple[str, ...],
+    supported: bool,
+) -> None:
+    """A cubin for sm_XY also runs on sm_XZ for Z >= Y, same major version."""
+
+    assert _architecture_supported(capability, arch_list) is supported
+
+
+def _write_stack_validity_document(
+    path: Path,
+    *,
+    run_plan_hash: str,
+    manifest_hash: str,
+    profile_ids: tuple[str, ...],
+) -> Path:
+    document = {
+        "run_plan_hash": run_plan_hash,
+        "manifest_hash": manifest_hash,
+        "profiles": {
+            profile_id: {
+                "software_valid": None,
+                "compiler_valid": True,
+                "emulator_valid": True,
+                "rtl_valid": None,
+                "dc_calibrated": None,
+            }
+            for profile_id in profile_ids
+        },
+    }
+    path.write_text(json.dumps(document, sort_keys=True) + "\n", encoding="utf-8")
+    return path
+
+
+def test_stack_validity_loader_accepts_the_launch_call_signature(
+    tmp_path: Path,
+) -> None:
+    """The sweep and executor call the loader with a manifest binding."""
+
+    run_plan_hash = "a" * 64
+    manifest = SimpleNamespace(canonical_hash="b" * 64)
+    profile_ids = ("profile-0", "profile-1")
+    path = _write_stack_validity_document(
+        tmp_path / "stack_validity.json",
+        run_plan_hash=run_plan_hash,
+        manifest_hash=manifest.canonical_hash,
+        profile_ids=profile_ids,
+    )
+    validity = load_built_stack_validity(
+        path,
+        manifest=manifest,
+        scope_profile_ids=profile_ids,
+        required_stages=("compiler", "emulator"),
+        scope_name="hardware-validation",
+        run_plan_hash=run_plan_hash,
+    )
+    assert set(validity) == set(profile_ids)
+    for record in validity.values():
+        assert record.compiler_valid is True
+        assert record.emulator_valid is True
+
+
+def test_stack_validity_loader_rejects_a_foreign_manifest(tmp_path: Path) -> None:
+    """A manifest-hash mismatch means the measurements bind another sweep."""
+
+    run_plan_hash = "a" * 64
+    path = _write_stack_validity_document(
+        tmp_path / "stack_validity.json",
+        run_plan_hash=run_plan_hash,
+        manifest_hash="b" * 64,
+        profile_ids=("profile-0",),
+    )
+    with pytest.raises(ValueError, match="different sweep manifest"):
+        load_built_stack_validity(
+            path,
+            manifest=SimpleNamespace(canonical_hash="c" * 64),
+            scope_profile_ids=("profile-0",),
+            required_stages=("compiler", "emulator"),
+            scope_name="hardware-validation",
+            run_plan_hash=run_plan_hash,
+        )
+
+
+def _synthetic_stage_report(stage: str, calibration_ids: list[str]) -> dict:
+    from decode_dse.software.stack_validity import _canonical_content_hash
+
+    report = {
+        "schema": "plena-stack-stage-report",
+        "stage": stage,
+        "provenance": {
+            "started_at_utc": "2026-08-03T10:00:00Z",
+            "completed_at_utc": "2026-08-03T10:05:00Z",
+            "command": [f"{stage}_stage"],
+            "host": "test-host",
+        },
+        "artifacts": {"primary": "d" * 64},
+        "calibration_ids": sorted(calibration_ids),
+    }
+    report["content_hash"] = _canonical_content_hash(report)
+    return report
+
+
+def _synthetic_calibration_artifact(path: Path, calibration_id: str) -> Path:
+    path.write_text(
+        json.dumps(
+            {
+                "schema": "plena-decode-emulator-calibration",
+                "calibration_id": calibration_id,
+                "passed": True,
+                "execution_contract": {"timing_mode": "rtl_serialized"},
+            },
+            sort_keys=True,
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    return path
+
+
+def test_stack_validity_artifact_builder_satisfies_the_launch_gate(
+    tmp_path: Path,
+) -> None:
+    """The produced artifact passes the loader and the preflight evidence check."""
+
+    from decode_dse.software.preflight import _stack_evidence_preparation
+    from decode_dse.software.stack_validity import build_stack_validity_artifact
+    from decode_dse.software.sweep_plan import GPUBaselinePlan, build_run_plan
+
+    config = json.loads(
+        (REPOSITORY / "decode_dse/configs/llama3_1_8b.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    manifest = build_exhaustive_manifest(
+        str(config["model_name"]),
+        str(config["model_revision"]),
+        dict(config["model_architecture"]),
+        _small_manifest().quantizer_provenance,
+        str(config["tokenizer_revision"]),
+    )
+    plan = build_run_plan(
+        manifest,
+        device_labels=("b200",),
+        numerical_screen_workers=2,
+        hardware_validation_workers=2,
+        gpu_baseline=GPUBaselinePlan.from_config(config["gpu_baseline"]),
+    )
+    calibration_id = "emucal-" + "e" * 64
+    calibration = _synthetic_calibration_artifact(
+        tmp_path / "decode_kv128.json", calibration_id
+    )
+    reports = {}
+    for stage in ("compiler", "emulator"):
+        report_path = tmp_path / f"{stage}_report.json"
+        report_path.write_text(
+            json.dumps(_synthetic_stage_report(stage, [calibration_id])) + "\n",
+            encoding="utf-8",
+        )
+        reports[stage] = report_path
+    destination = tmp_path / "stack_validity.json"
+    document = build_stack_validity_artifact(
+        manifest=manifest,
+        plan=plan,
+        compiler_report_path=reports["compiler"],
+        emulator_report_path=reports["emulator"],
+        calibration_paths=(calibration,),
+        destination=destination,
+    )
+    assert set(document["profiles"]) == set(plan.hardware_validation_profile_ids)
+    validity = load_built_stack_validity(
+        destination,
+        manifest=manifest,
+        scope_profile_ids=plan.hardware_validation_profile_ids,
+        required_stages=("compiler", "emulator"),
+        scope_name="hardware-validation",
+        run_plan_hash=plan.canonical_hash,
+    )
+    assert len(validity) == len(plan.hardware_validation_profile_ids)
+    evidence = _stack_evidence_preparation(
+        path=destination, manifest=manifest, plan=plan
+    )
+    assert evidence["compiler_seconds"] > 0
+    assert evidence["emulator_seconds"] > 0
+    assert evidence["stage_report_hashes"]["compiler"]
+    assert evidence["stage_report_hashes"]["emulator"]
+
+
+def test_stack_validity_builder_rejects_a_tampered_stage_report(
+    tmp_path: Path,
+) -> None:
+    from decode_dse.software.stack_validity import load_stage_report
+
+    report = _synthetic_stage_report("compiler", ["emucal-" + "e" * 64])
+    report["artifacts"]["primary"] = "f" * 64
+    path = tmp_path / "compiler_report.json"
+    path.write_text(json.dumps(report) + "\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="content-hash"):
+        load_stage_report(path, stage="compiler")
+
+
+def test_stack_validity_builder_requires_bound_calibration_ids(
+    tmp_path: Path,
+) -> None:
+    from decode_dse.software.stack_validity import (
+        build_stack_validity_document,
+    )
+
+    calibration_id = "emucal-" + "e" * 64
+    manifest = SimpleNamespace(entries=(), canonical_hash="a" * 64)
+    plan = SimpleNamespace(
+        hardware_validation_profile_ids=(), canonical_hash="b" * 64
+    )
+    with pytest.raises(ValueError, match="does not bind calibration ids"):
+        build_stack_validity_document(
+            manifest=manifest,
+            plan=plan,
+            compiler_report=_synthetic_stage_report("compiler", []),
+            emulator_report=_synthetic_stage_report("emulator", [calibration_id]),
+            calibration_ids=(calibration_id,),
+        )
+
+
+def test_stack_validity_builder_refuses_a_forbidden_capability_floor(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from decode_dse.software import stack_validity as module
+
+    profile = SimpleNamespace(profile_id="profile-0")
+    entry = SimpleNamespace(profile_id="profile-0", profile=profile)
+    manifest = SimpleNamespace(entries=(entry,), canonical_hash="a" * 64)
+    plan = SimpleNamespace(
+        hardware_validation_profile_ids=("profile-0",), canonical_hash="b" * 64
+    )
+    floor = StackValidity(compiler_valid=False)
+    monkeypatch.setattr(
+        module,
+        "evaluate_stack_capability",
+        lambda _profile: SimpleNamespace(validity_floor=floor),
+    )
+    calibration_id = "emucal-" + "e" * 64
+    with pytest.raises(ValueError, match="structural capability forbids"):
+        module.build_stack_validity_document(
+            manifest=manifest,
+            plan=plan,
+            compiler_report=_synthetic_stage_report("compiler", [calibration_id]),
+            emulator_report=_synthetic_stage_report("emulator", [calibration_id]),
+            calibration_ids=(calibration_id,),
+        )
+
+
+def test_chat_template_sealing_pins_the_config(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The sealing tool writes the asset and pins both publication fields."""
+
+    import decode_dse.software.seal_chat_template_asset as sealer
+
+    source_config = REPOSITORY / "decode_dse/configs/llama3_1_8b.json"
+    config_path = tmp_path / "llama3_1_8b.json"
+    config_path.write_text(
+        source_config.read_text(encoding="utf-8"), encoding="utf-8"
+    )
+    config = json.loads(config_path.read_text(encoding="utf-8"))
+    template = "{{ bos_token }}{% for message in messages %}x{% endfor %}"
+    template_hash = hashlib.sha256(template.encode("utf-8")).hexdigest()
+    sealed = {
+        "schema_version": "decode-chat-template",
+        "model_name": config["model_name"],
+        "model_revision": config["model_revision"],
+        "tokenizer_revision": config["tokenizer_revision"],
+        "enable_thinking": False,
+        "chat_template_sha256": template_hash,
+        "chat_template": template,
+        "source": {"kind": "pinned_local_tokenizer_execution"},
+    }
+    monkeypatch.setattr(
+        sealer,
+        "seal_publication_chat_template",
+        lambda extraction_config, config_path: sealed,
+    )
+    asset_path = (
+        REPOSITORY
+        / "decode_dse/configs/publication_chat_template_llama3_1_8b.json"
+    )
+    wrote_asset = not asset_path.exists()
+    monkeypatch.setattr(
+        "sys.argv",
+        [
+            "seal_chat_template_asset",
+            "--config",
+            str(config_path),
+            "--asset",
+            str(tmp_path / "asset.json"),
+        ],
+    )
+    try:
+        monkeypatch.setattr(
+            sealer,
+            "_repo_relative",
+            lambda path, repository: "decode_dse/configs/asset.json",
+        )
+        assert sealer.main() == 0
+    finally:
+        if wrote_asset and asset_path.exists():
+            asset_path.unlink()
+    asset = json.loads((tmp_path / "asset.json").read_text(encoding="utf-8"))
+    assert set(asset) == {
+        "schema_version",
+        "model_name",
+        "model_revision",
+        "tokenizer_revision",
+        "enable_thinking",
+        "chat_template_sha256",
+        "chat_template",
+    }
+    assert asset["chat_template_sha256"] == template_hash
+    updated = json.loads(config_path.read_text(encoding="utf-8"))
+    assert (
+        updated["publication"]["chat_template_asset"]
+        == "decode_dse/configs/asset.json"
+    )
+    assert (
+        updated["publication"]["chat_template_sha256"] == template_hash
+    )
+    assert updated["model_architecture"] == config["model_architecture"]
+
+
+class _WidthRecordingModel:
+    """Fake decoder: records forward batch, appends one cache entry per call."""
+
+    def __init__(self, vocabulary: int = 8) -> None:
+        self.vocabulary = vocabulary
+        self.seen_batches: list[int] = []
+
+    def eval(self) -> "_WidthRecordingModel":
+        return self
+
+    def __call__(self, *, input_ids, attention_mask, position_ids,
+                 cache_position, past_key_values, use_cache):
+        import torch
+
+        batch = int(input_ids.shape[0])
+        self.seen_batches.append(batch)
+        assert attention_mask.shape[0] == batch
+        assert position_ids.shape[0] == batch
+        layers = past_key_values
+        for index in range(len(layers.layers)):
+            key = torch.zeros(batch, 1, 1, 2)
+            layers.update(key, key.clone(), index)
+        logits = torch.zeros(batch, 1, self.vocabulary)
+        logits[:, 0, 0] = torch.arange(batch, dtype=logits.dtype)
+        return SimpleNamespace(logits=logits, past_key_values=layers)
+
+
+def _legacy_lanes(batch: int, length: int = 3):
+    import torch
+
+    key = torch.arange(
+        batch * 1 * length * 2, dtype=torch.float32
+    ).reshape(batch, 1, length, 2)
+    return ((key, key.clone()),)
+
+
+def test_execution_batch_width_requires_plain_append_path():
+    from decode_dse.software.cached_decode import TorchHFCachedDecodeBackend
+
+    with pytest.raises(ValueError):
+        TorchHFCachedDecodeBackend(
+            device="cpu",
+            append_transform=lambda cache, start, end, artifact: cache,
+            execution_batch_width=4,
+        )
+    with pytest.raises(ValueError):
+        TorchHFCachedDecodeBackend(device="cpu", execution_batch_width=0)
+
+
+def test_adopt_cache_pads_to_execution_width_and_reports_logical_batch():
+    import torch
+
+    from decode_dse.software.cached_decode import (
+        TorchHFCachedDecodeBackend,
+        _cache_from_layers,
+    )
+
+    backend = TorchHFCachedDecodeBackend(
+        device="cpu", native_append_format=True, execution_batch_width=4
+    )
+    cache = backend.adopt_cache(_cache_from_layers(_legacy_lanes(1)))
+    first_key = cache.layers[0].keys
+    assert first_key.shape[0] == 4
+    assert torch.equal(first_key[1], first_key[0])
+    assert backend.cache_batch_size(cache) == 1
+    assert backend.cache_length(cache) == 3
+
+    plain = TorchHFCachedDecodeBackend(device="cpu", native_append_format=True)
+    untouched = plain.adopt_cache(_cache_from_layers(_legacy_lanes(1)))
+    assert plain.cache_batch_size(untouched) == 1
+    assert untouched.layers[0].keys.shape[0] == 1
+
+
+def test_decode_step_pads_forward_and_slices_lane_zero():
+    from decode_dse.software.cached_decode import (
+        TorchHFCachedDecodeBackend,
+        _cache_from_layers,
+    )
+
+    backend = TorchHFCachedDecodeBackend(
+        device="cpu", native_append_format=True, execution_batch_width=4
+    )
+    model = _WidthRecordingModel()
+    cache = backend.adopt_cache(_cache_from_layers(_legacy_lanes(1)))
+    result = backend.decode_step(
+        model,
+        input_token_id=5,
+        cache=cache,
+        attention_mask=(1, 1, 1, 1),
+        position_id=3,
+        cache_position=3,
+    )
+    assert model.seen_batches == [4]
+    assert tuple(result.logits.shape[:2]) == (1, 1)
+    assert float(result.logits[0, 0, 0]) == 0.0
+    assert backend.cache_batch_size(result.cache) == 1
+    assert backend.cache_length(result.cache) == 4
+
+
+def test_decode_step_batch_pads_forward_and_slices_real_lanes():
+    from decode_dse.software.cached_decode import (
+        TorchHFCachedDecodeBackend,
+        _cache_from_layers,
+    )
+
+    backend = TorchHFCachedDecodeBackend(
+        device="cpu", native_append_format=True, execution_batch_width=4
+    )
+    model = _WidthRecordingModel()
+    cache = backend.adopt_cache(
+        _cache_from_layers(_legacy_lanes(2)), logical_batch=2
+    )
+    result = backend.decode_step_batch(
+        model,
+        input_token_ids=(5, 6),
+        cache=cache,
+        attention_masks=((1, 1, 1, 1), (1, 1, 1, 1)),
+        position_ids=(3, 3),
+        cache_position=3,
+    )
+    assert model.seen_batches == [4]
+    assert tuple(result.logits.shape[:2]) == (2, 1)
+    assert [float(row[0, 0]) for row in result.logits] == [0.0, 1.0]
+    assert backend.cache_batch_size(result.cache) == 2
+
+    with pytest.raises(ValueError):
+        backend.decode_step_batch(
+            model,
+            input_token_ids=(1, 2, 3, 4, 5),
+            cache=cache,
+            attention_masks=(((1,) * 5),) * 5,
+            position_ids=(3,) * 5,
+            cache_position=3,
+        )
diff --git a/decode_dse/software/token_samples.py b/decode_dse/software/token_samples.py
new file mode 100644
index 0000000..e5e7ded
--- /dev/null
+++ b/decode_dse/software/token_samples.py
@@ -0,0 +1,979 @@
+"""Immutable token sample bundles for sweep and refinement evaluation."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import hashlib
+import json
+import random
+
+from pathlib import Path
+from typing import Any, Iterable, Mapping, Sequence
+from decode_dse.software.cache_artifacts import compute_prompt_hash
+from decode_dse.software.sweep_plan import (
+    PromptManifest,
+    PromptRecord,
+    NUMERICAL_SCREEN_SAMPLE_CONTRACT,
+    HARDWARE_VALIDATION_SAMPLE_CONTRACT,
+    write_immutable_json,
+)
+from decode_dse.software.sweep_plan import write_immutable_json
+
+
+SAMPLE_BUNDLE_SCHEMA = "decode-token-samples"
+
+
+DOCUMENT_SELECTION_POLICY = "document_round_robin_nonoverlap"
+
+
+def _canonical_hash(value: Mapping[str, Any]) -> str:
+    payload = json.dumps(
+        value,
+        sort_keys=True,
+        separators=(",", ":"),
+        ensure_ascii=True,
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+def _prompt_hash(token_ids: Sequence[int]) -> str:
+    ids = tuple(int(token) for token in token_ids)
+    length = len(ids)
+    return compute_prompt_hash(
+        (ids,),
+        ((1,) * length,),
+        (tuple(range(length)),),
+    )
+
+
+def _token_hash(token_ids: Sequence[int]) -> str:
+    payload = json.dumps(
+        [int(token) for token in token_ids],
+        separators=(",", ":"),
+    ).encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()
+
+
+@dataclass(frozen=True)
+class SourceTokenSpan:
+    """Exact source-document token interval used by one fixed window."""
+
+    source_document_id: str
+    token_start: int
+    token_end: int
+    source_content_hash: str
+
+    def __post_init__(self) -> None:
+        if not self.source_document_id:
+            raise ValueError("source document ID is required")
+        if self.token_start < 0 or self.token_end <= self.token_start:
+            raise ValueError("source token span is invalid")
+        if len(self.source_content_hash) != 64:
+            raise ValueError("source content hash must be SHA-256")
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "source_document_id": self.source_document_id,
+            "token_start": self.token_start,
+            "token_end": self.token_end,
+            "source_content_hash": self.source_content_hash,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "SourceTokenSpan":
+        return cls(
+            source_document_id=str(value["source_document_id"]),
+            token_start=int(value["token_start"]),
+            token_end=int(value["token_end"]),
+            source_content_hash=str(value["source_content_hash"]),
+        )
+
+
+@dataclass(frozen=True)
+class TokenizedSourceDocument:
+    """One independently identified source document and its tokenization."""
+
+    document_id: str
+    content_hash: str
+    token_ids: tuple[int, ...]
+
+    def __post_init__(self) -> None:
+        tokens = tuple(int(token) for token in self.token_ids)
+        if not self.document_id or len(self.content_hash) != 64:
+            raise ValueError("source document identity is invalid")
+        if not tokens or any(token < 0 for token in tokens):
+            raise ValueError("source document tokens are invalid")
+        object.__setattr__(self, "token_ids", tokens)
+
+
+@dataclass(frozen=True)
+class DecodeTokenSample:
+    """One fixed prompt and its post-first-token decode targets."""
+
+    document_id: str
+    source_cluster_id: str
+    prompt_token_ids: tuple[int, ...]
+    decode_target_ids: tuple[int, ...]
+    prompt_hash: str
+    prefill_reference_token_id: int
+    source_spans: tuple[SourceTokenSpan, ...]
+    selection_seed: int
+    selection_policy: str
+    window_token_hash: str
+
+    def __post_init__(self) -> None:
+        prompt = tuple(int(token) for token in self.prompt_token_ids)
+        targets = tuple(int(token) for token in self.decode_target_ids)
+        spans = tuple(self.source_spans)
+        if not self.document_id or not self.source_cluster_id:
+            raise ValueError("sample and source-cluster IDs are required")
+        if len(prompt) != NUMERICAL_SCREEN_SAMPLE_CONTRACT.prefill_tokens:
+            raise ValueError(
+                f"prompt must contain {NUMERICAL_SCREEN_SAMPLE_CONTRACT.prefill_tokens} tokens"
+            )
+        if not targets:
+            raise ValueError("decode_target_ids cannot be empty")
+        if any(
+            token < 0
+            for token in (
+                *prompt,
+                int(self.prefill_reference_token_id),
+                *targets,
+            )
+        ):
+            raise ValueError("token IDs must be non-negative")
+        if not spans or sum(
+            span.token_end - span.token_start for span in spans
+        ) != len(prompt) + 1 + len(targets):
+            raise ValueError("source spans do not cover the exact token window")
+        if self.selection_seed < 0:
+            raise ValueError("selection seed must be non-negative")
+        if self.selection_policy not in {
+            DOCUMENT_SELECTION_POLICY,
+            "contiguous_stream_test_only",
+        }:
+            raise ValueError("unsupported sample-selection policy")
+        expected_hash = _prompt_hash(prompt)
+        if self.prompt_hash != expected_hash:
+            raise ValueError("prompt hash does not match token IDs")
+        expected_window_hash = _token_hash(
+            (
+                *prompt,
+                int(self.prefill_reference_token_id),
+                *targets,
+            )
+        )
+        if self.window_token_hash != expected_window_hash:
+            raise ValueError("window token hash does not match token IDs")
+        object.__setattr__(self, "prompt_token_ids", prompt)
+        object.__setattr__(self, "decode_target_ids", targets)
+        object.__setattr__(self, "source_spans", spans)
+
+    @classmethod
+    def create(
+        cls,
+        document_id: str,
+        source_cluster_id: str,
+        prompt_token_ids: Sequence[int],
+        decode_target_ids: Sequence[int],
+        *,
+        prefill_reference_token_id: int,
+        source_spans: Sequence[SourceTokenSpan],
+        selection_seed: int,
+        selection_policy: str,
+    ) -> "DecodeTokenSample":
+        prompt = tuple(int(token) for token in prompt_token_ids)
+        targets = tuple(int(token) for token in decode_target_ids)
+        return cls(
+            document_id=document_id,
+            source_cluster_id=source_cluster_id,
+            prompt_token_ids=prompt,
+            decode_target_ids=targets,
+            prompt_hash=_prompt_hash(prompt),
+            prefill_reference_token_id=int(prefill_reference_token_id),
+            source_spans=tuple(source_spans),
+            selection_seed=int(selection_seed),
+            selection_policy=selection_policy,
+            window_token_hash=_token_hash(
+                (
+                    *prompt,
+                    int(prefill_reference_token_id),
+                    *targets,
+                )
+            ),
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "document_id": self.document_id,
+            "source_cluster_id": self.source_cluster_id,
+            "prompt_hash": self.prompt_hash,
+            "prompt_token_ids": list(self.prompt_token_ids),
+            "decode_target_ids": list(self.decode_target_ids),
+            "prefill_reference_token_id": self.prefill_reference_token_id,
+            "source_spans": [span.to_dict() for span in self.source_spans],
+            "selection_seed": self.selection_seed,
+            "selection_policy": self.selection_policy,
+            "window_token_hash": self.window_token_hash,
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DecodeTokenSample":
+        return cls(
+            document_id=str(value["document_id"]),
+            source_cluster_id=str(value["source_cluster_id"]),
+            prompt_hash=str(value["prompt_hash"]),
+            prompt_token_ids=tuple(value["prompt_token_ids"]),
+            decode_target_ids=tuple(value["decode_target_ids"]),
+            prefill_reference_token_id=int(
+                value["prefill_reference_token_id"]
+            ),
+            source_spans=tuple(
+                SourceTokenSpan.from_dict(span)
+                for span in value["source_spans"]
+            ),
+            selection_seed=int(value["selection_seed"]),
+            selection_policy=str(value["selection_policy"]),
+            window_token_hash=str(value["window_token_hash"]),
+        )
+
+
+@dataclass(frozen=True)
+class TokenSampleBundle:
+    """Disjoint numerical screen and hardware validation token samples bound to pinned data revisions."""
+
+    model_revision: str
+    tokenizer_revision: str
+    dataset_name: str
+    dataset_revision: str
+    numerical_screen: tuple[DecodeTokenSample, ...]
+    hardware_validation: tuple[DecodeTokenSample, ...]
+    schema_version: str = SAMPLE_BUNDLE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != SAMPLE_BUNDLE_SCHEMA:
+            raise ValueError(
+                f"unsupported sample schema {self.schema_version!r}"
+            )
+        for label, value in (
+            ("model_revision", self.model_revision),
+            ("tokenizer_revision", self.tokenizer_revision),
+            ("dataset_name", self.dataset_name),
+            ("dataset_revision", self.dataset_revision),
+        ):
+            if not value:
+                raise ValueError(f"{label} must be pinned")
+        numerical_screen = tuple(self.numerical_screen)
+        hardware_validation = tuple(self.hardware_validation)
+        if len(numerical_screen) != NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count:
+            raise ValueError("numerical screen requires exactly 16 samples")
+        if len(hardware_validation) != HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count:
+            raise ValueError("hardware validation requires exactly 64 samples")
+        if any(
+            len(sample.decode_target_ids) < NUMERICAL_SCREEN_SAMPLE_CONTRACT.decode_steps
+            for sample in numerical_screen
+        ):
+            raise ValueError("numerical screen samples do not contain enough decode targets")
+        if any(
+            len(sample.decode_target_ids) < HARDWARE_VALIDATION_SAMPLE_CONTRACT.decode_steps
+            for sample in hardware_validation
+        ):
+            raise ValueError("hardware validation samples do not contain enough decode targets")
+        all_samples = numerical_screen + hardware_validation
+        document_ids = tuple(sample.document_id for sample in all_samples)
+        prompt_hashes = tuple(sample.prompt_hash for sample in all_samples)
+        if len(document_ids) != len(set(document_ids)):
+            raise ValueError("sample document IDs must be unique")
+        if len(prompt_hashes) != len(set(prompt_hashes)):
+            raise ValueError("sample prompts must be content-disjoint")
+        source_hashes: dict[str, str] = {}
+        source_intervals: dict[str, list[tuple[int, int]]] = {}
+        for sample in all_samples:
+            for span in sample.source_spans:
+                previous_hash = source_hashes.setdefault(
+                    span.source_document_id,
+                    span.source_content_hash,
+                )
+                if previous_hash != span.source_content_hash:
+                    raise ValueError(
+                        "one source document has conflicting content hashes"
+                    )
+                source_intervals.setdefault(
+                    span.source_document_id, []
+                ).append((span.token_start, span.token_end))
+        for source_id, intervals in source_intervals.items():
+            ordered_intervals = sorted(intervals)
+            if any(
+                right_start < left_end
+                for (_, left_end), (right_start, _) in zip(
+                    ordered_intervals,
+                    ordered_intervals[1:],
+                )
+            ):
+                raise ValueError(
+                    f"sample token windows overlap within source {source_id!r}"
+                )
+        if len({sample.selection_seed for sample in all_samples}) != 1:
+            raise ValueError("all samples must use one selection seed")
+        object.__setattr__(self, "numerical_screen", numerical_screen)
+        object.__setattr__(self, "hardware_validation", hardware_validation)
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "model_revision": self.model_revision,
+            "tokenizer_revision": self.tokenizer_revision,
+            "dataset_name": self.dataset_name,
+            "dataset_revision": self.dataset_revision,
+            "numerical_screen": [sample.to_dict() for sample in self.numerical_screen],
+            "hardware_validation": [sample.to_dict() for sample in self.hardware_validation],
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return _canonical_hash(self._content_dict())
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {
+            "sample_bundle_hash": self.canonical_hash
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "TokenSampleBundle":
+        bundle = cls(
+            schema_version=str(value["schema_version"]),
+            model_revision=str(value["model_revision"]),
+            tokenizer_revision=str(value["tokenizer_revision"]),
+            dataset_name=str(value["dataset_name"]),
+            dataset_revision=str(value["dataset_revision"]),
+            numerical_screen=tuple(
+                DecodeTokenSample.from_dict(sample) for sample in value["numerical_screen"]
+            ),
+            hardware_validation=tuple(
+                DecodeTokenSample.from_dict(sample) for sample in value["hardware_validation"]
+            ),
+        )
+        if value.get("sample_bundle_hash") != bundle.canonical_hash:
+            raise ValueError("sample-bundle content hash mismatch")
+        return bundle
+
+    def prompt_manifest(self) -> PromptManifest:
+        return PromptManifest(
+            dataset_name=self.dataset_name,
+            dataset_revision=self.dataset_revision,
+            numerical_screen=tuple(
+                PromptRecord(sample.document_id, sample.prompt_hash)
+                for sample in self.numerical_screen
+            ),
+            hardware_validation=tuple(
+                PromptRecord(sample.document_id, sample.prompt_hash)
+                for sample in self.hardware_validation
+            ),
+        )
+
+    def samples_for_prompt_set(
+        self,
+        prompt_set: str,
+    ) -> tuple[DecodeTokenSample, ...]:
+        if prompt_set == "numerical_screen":
+            return self.numerical_screen
+        if prompt_set == "hardware_validation":
+            return self.hardware_validation
+        raise ValueError(f"unsupported prompt set {prompt_set!r}")
+
+
+def build_bundle_from_documents(
+    documents: Sequence[TokenizedSourceDocument],
+    *,
+    model_revision: str,
+    tokenizer_revision: str,
+    dataset_name: str,
+    dataset_revision: str,
+    seed: int,
+) -> TokenSampleBundle:
+    """Select the stage-contract window count maximizing source coverage."""
+
+    if seed < 0:
+        raise ValueError("selection seed must be non-negative")
+    prefill = NUMERICAL_SCREEN_SAMPLE_CONTRACT.prefill_tokens
+    targets = HARDWARE_VALIDATION_SAMPLE_CONTRACT.decode_steps
+    window = prefill + 1 + targets
+    count = (
+        NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count + HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+    )
+    ordered = tuple(sorted(documents, key=lambda item: item.document_id))
+    if len({document.document_id for document in ordered}) != len(ordered):
+        raise ValueError("source document IDs must be unique")
+
+    candidates_by_document: list[
+        tuple[TokenizedSourceDocument, tuple[int, ...]]
+    ] = []
+    for document in ordered:
+        window_count = len(document.token_ids) // window
+        if window_count == 0:
+            continue
+        unused_tokens = len(document.token_ids) - window_count * window
+        phase_digest = hashlib.sha256(
+            (
+                f"{seed}:{document.document_id}:"
+                f"{document.content_hash}:phase"
+            ).encode("utf-8")
+        ).digest()
+        phase = int.from_bytes(phase_digest[:8], "big") % (
+            unused_tokens + 1
+        )
+        starts = tuple(phase + index * window for index in range(window_count))
+        ranked_starts = tuple(
+            sorted(
+                starts,
+                key=lambda start: hashlib.sha256(
+                    (
+                        f"{seed}:{document.content_hash}:"
+                        f"{start}:window"
+                    ).encode("utf-8")
+                ).digest(),
+            )
+        )
+        candidates_by_document.append((document, ranked_starts))
+    available_windows = sum(
+        len(starts) for _, starts in candidates_by_document
+    )
+    if available_windows < count:
+        raise ValueError(
+            f"held-out documents cannot form {count} non-overlapping decode windows"
+        )
+
+    selected: list[tuple[TokenizedSourceDocument, int]] = []
+    round_index = 0
+    while len(selected) < count:
+        available = [
+            (document, starts[round_index])
+            for document, starts in candidates_by_document
+            if round_index < len(starts)
+        ]
+        if not available:
+            raise AssertionError("window selection exhausted valid candidates")
+        available.sort(
+            key=lambda item: (
+                len(item[0].token_ids),
+                item[0].document_id,
+            )
+        )
+        remaining = count - len(selected)
+        if len(available) > remaining:
+            selection_rng = random.Random(
+                seed ^ 0x53545241 ^ round_index
+            )
+            chosen = []
+            for stratum_index in range(remaining):
+                lower = stratum_index * len(available) // remaining
+                upper = (stratum_index + 1) * len(available) // remaining
+                stratum = available[lower:upper]
+                if not stratum:
+                    raise AssertionError("document-length stratum is empty")
+                chosen.append(
+                    stratum[selection_rng.randrange(len(stratum))]
+                )
+            available = chosen
+        selected.extend(available)
+        round_index += 1
+
+    built: list[tuple[int, int, DecodeTokenSample]] = []
+    for document, start in selected:
+        stop = start + window
+        values = document.token_ids[start:stop]
+        if len(values) != window:
+            raise AssertionError("selected source window is incomplete")
+        window_identity = _canonical_hash(
+            {
+                "source_document_id": document.document_id,
+                "source_content_hash": document.content_hash,
+                "token_start": start,
+                "token_end": stop,
+            }
+        )
+        sample = DecodeTokenSample.create(
+            document_id=f"heldout-window-{window_identity[:24]}",
+            source_cluster_id=document.document_id,
+            prompt_token_ids=values[:prefill],
+            prefill_reference_token_id=values[prefill],
+            decode_target_ids=values[prefill + 1 :],
+            source_spans=(
+                SourceTokenSpan(
+                    source_document_id=document.document_id,
+                    token_start=start,
+                    token_end=stop,
+                    source_content_hash=document.content_hash,
+                ),
+            ),
+            selection_seed=seed,
+            selection_policy=DOCUMENT_SELECTION_POLICY,
+        )
+        built.append((len(document.token_ids), start, sample))
+
+    built.sort(
+        key=lambda item: (
+            item[0],
+            item[2].source_cluster_id,
+            item[1],
+        )
+    )
+    screen_count = NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count
+    validation_count = HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+    if count % screen_count != 0:
+        raise AssertionError("stage prompt counts must stratify evenly")
+    stride = count // screen_count
+    residue = stride // 2
+    numerical_screen = [
+        sample
+        for index, (_, _, sample) in enumerate(built)
+        if index % stride == residue
+    ]
+    hardware_validation = [
+        sample
+        for index, (_, _, sample) in enumerate(built)
+        if index % stride != residue
+    ]
+    if (len(numerical_screen), len(hardware_validation)) != (
+        screen_count,
+        validation_count,
+    ):
+        raise AssertionError("stratified stage assignment has invalid counts")
+    random.Random(seed ^ 0x53315F31).shuffle(numerical_screen)
+    random.Random(seed ^ 0x53325F32).shuffle(hardware_validation)
+    return TokenSampleBundle(
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        dataset_name=dataset_name,
+        dataset_revision=dataset_revision,
+        numerical_screen=tuple(numerical_screen),
+        hardware_validation=tuple(hardware_validation),
+    )
+
+
+def build_bundle_from_token_stream(
+    token_ids: Iterable[int],
+    *,
+    model_revision: str,
+    tokenizer_revision: str,
+    dataset_name: str,
+    dataset_revision: str,
+) -> TokenSampleBundle:
+    """Partition one held-out stream into deterministic non-overlapping samples."""
+
+    tokens = tuple(int(token) for token in token_ids)
+    prefill = NUMERICAL_SCREEN_SAMPLE_CONTRACT.prefill_tokens
+    targets = HARDWARE_VALIDATION_SAMPLE_CONTRACT.decode_steps
+    window = prefill + 1 + targets
+    count = (
+        NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count + HARDWARE_VALIDATION_SAMPLE_CONTRACT.prompt_count
+    )
+    required = window * count
+    if len(tokens) < required:
+        raise ValueError(
+            f"token stream has {len(tokens)} tokens; {required} are required"
+        )
+
+    samples = []
+    for index in range(count):
+        start = index * window
+        values = tokens[start : start + window]
+        samples.append(
+            DecodeTokenSample.create(
+                document_id=f"heldout-window-{index:04d}",
+                source_cluster_id=f"synthetic-window-{index:04d}",
+                prompt_token_ids=values[:prefill],
+                prefill_reference_token_id=values[prefill],
+                decode_target_ids=values[prefill + 1 :],
+                source_spans=(
+                    SourceTokenSpan(
+                        source_document_id=(
+                            f"synthetic-window-{index:04d}"
+                        ),
+                        token_start=0,
+                        token_end=window,
+                        source_content_hash=_token_hash(values),
+                    ),
+                ),
+                selection_seed=0,
+                selection_policy="contiguous_stream_test_only",
+            )
+        )
+    split = NUMERICAL_SCREEN_SAMPLE_CONTRACT.prompt_count
+    return TokenSampleBundle(
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        dataset_name=dataset_name,
+        dataset_revision=dataset_revision,
+        numerical_screen=tuple(samples[:split]),
+        hardware_validation=tuple(samples[split:]),
+    )
+
+
+def save_sample_bundle(
+    bundle: TokenSampleBundle,
+    path: str | Path,
+) -> Path:
+    return write_immutable_json(path, bundle.to_dict())
+
+
+def load_sample_bundle(path: str | Path) -> TokenSampleBundle:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    value.pop("content_hash", None)
+    return TokenSampleBundle.from_dict(value)
+
+
+__all__ = [
+    "DecodeTokenSample",
+    "DOCUMENT_SELECTION_POLICY",
+    "TokenSampleBundle",
+    "SAMPLE_BUNDLE_SCHEMA",
+    "SourceTokenSpan",
+    "TokenizedSourceDocument",
+    "build_bundle_from_documents",
+    "build_bundle_from_token_stream",
+    "load_sample_bundle",
+    "save_sample_bundle",
+]
+
+
+REFINEMENT_SAMPLE_BUNDLE_SCHEMA = "decode-refinement-token-samples"
+
+
+REFINEMENT_PROMPT_COUNT = 128
+
+
+REFINEMENT_PREFILL_TOKENS = 512
+
+
+REFINEMENT_DECODE_STEPS = 128
+
+
+@dataclass(frozen=True)
+class RefinementSampleBundle:
+    """A standalone 128-document refinement sample contract."""
+
+    model_revision: str
+    tokenizer_revision: str
+    dataset_name: str
+    dataset_revision: str
+    samples: tuple[DecodeTokenSample, ...]
+    excluded_prompt_hashes: tuple[str, ...] = ()
+    token_stream_start: int = 0
+    selection_seed: int = 0
+    schema_version: str = REFINEMENT_SAMPLE_BUNDLE_SCHEMA
+
+    def __post_init__(self) -> None:
+        if self.schema_version != REFINEMENT_SAMPLE_BUNDLE_SCHEMA:
+            raise ValueError(
+                f"unsupported refinement sample schema {self.schema_version!r}"
+            )
+        for label, value in (
+            ("model_revision", self.model_revision),
+            ("tokenizer_revision", self.tokenizer_revision),
+            ("dataset_name", self.dataset_name),
+            ("dataset_revision", self.dataset_revision),
+        ):
+            if not value:
+                raise ValueError(f"{label} must be pinned")
+        samples = tuple(self.samples)
+        if self.token_stream_start < 0:
+            raise ValueError("token_stream_start must be non-negative")
+        if self.selection_seed < 0:
+            raise ValueError("selection_seed must be non-negative")
+        if len(samples) != REFINEMENT_PROMPT_COUNT:
+            raise ValueError(
+                f"refinement requires exactly {REFINEMENT_PROMPT_COUNT} samples"
+            )
+        if any(
+            len(sample.prompt_token_ids) != REFINEMENT_PREFILL_TOKENS
+            for sample in samples
+        ):
+            raise ValueError(
+                "refinement prompts must contain exactly "
+                f"{REFINEMENT_PREFILL_TOKENS} tokens"
+            )
+        if any(
+            len(sample.decode_target_ids) < REFINEMENT_DECODE_STEPS
+            for sample in samples
+        ):
+            raise ValueError(
+                "refinement samples require at least "
+                f"{REFINEMENT_DECODE_STEPS} decode targets"
+            )
+        document_ids = tuple(sample.document_id for sample in samples)
+        prompt_hashes = tuple(sample.prompt_hash for sample in samples)
+        if len(document_ids) != len(set(document_ids)):
+            raise ValueError("refinement document IDs must be unique")
+        if len(prompt_hashes) != len(set(prompt_hashes)):
+            raise ValueError("refinement prompts must be content-disjoint")
+        source_hashes: dict[str, str] = {}
+        source_intervals: dict[str, list[tuple[int, int]]] = {}
+        for sample in samples:
+            for span in sample.source_spans:
+                previous_hash = source_hashes.setdefault(
+                    span.source_document_id,
+                    span.source_content_hash,
+                )
+                if previous_hash != span.source_content_hash:
+                    raise ValueError(
+                        "one refinement source has conflicting content hashes"
+                    )
+                source_intervals.setdefault(
+                    span.source_document_id, []
+                ).append((span.token_start, span.token_end))
+        for source_id, intervals in source_intervals.items():
+            ordered_intervals = sorted(intervals)
+            if any(
+                right_start < left_end
+                for (_, left_end), (right_start, _) in zip(
+                    ordered_intervals,
+                    ordered_intervals[1:],
+                )
+            ):
+                raise ValueError(
+                    f"refinement windows overlap within source {source_id!r}"
+                )
+        excluded = tuple(sorted(set(str(value) for value in self.excluded_prompt_hashes)))
+        if set(prompt_hashes) & set(excluded):
+            raise ValueError("refinement prompts overlap an excluded prompt set")
+        object.__setattr__(self, "samples", samples)
+        object.__setattr__(self, "excluded_prompt_hashes", excluded)
+
+    def _content_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "model_revision": self.model_revision,
+            "tokenizer_revision": self.tokenizer_revision,
+            "dataset_name": self.dataset_name,
+            "dataset_revision": self.dataset_revision,
+            "excluded_prompt_hashes": list(self.excluded_prompt_hashes),
+            "token_stream_start": self.token_stream_start,
+            "selection_seed": self.selection_seed,
+            "samples": [sample.to_dict() for sample in self.samples],
+        }
+
+    @property
+    def canonical_hash(self) -> str:
+        return _canonical_hash(self._content_dict())
+
+    def to_dict(self) -> dict[str, Any]:
+        return self._content_dict() | {"sample_bundle_hash": self.canonical_hash}
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "RefinementSampleBundle":
+        bundle = cls(
+            model_revision=str(value["model_revision"]),
+            tokenizer_revision=str(value["tokenizer_revision"]),
+            dataset_name=str(value["dataset_name"]),
+            dataset_revision=str(value["dataset_revision"]),
+            excluded_prompt_hashes=tuple(value.get("excluded_prompt_hashes", ())),
+            token_stream_start=int(value.get("token_stream_start", 0)),
+            selection_seed=int(value.get("selection_seed", 0)),
+            samples=tuple(
+                DecodeTokenSample.from_dict(sample) for sample in value["samples"]
+            ),
+            schema_version=str(value["schema_version"]),
+        )
+        if value.get("sample_bundle_hash") != bundle.canonical_hash:
+            raise ValueError("refinement sample-bundle content hash mismatch")
+        return bundle
+
+
+def build_refinement_bundle_from_token_stream(
+    token_ids: Iterable[int],
+    *,
+    model_revision: str,
+    tokenizer_revision: str,
+    dataset_name: str,
+    dataset_revision: str,
+    excluded_prompt_hashes: Sequence[str] = (),
+    token_stream_start: int = 0,
+) -> RefinementSampleBundle:
+    """Build fixed windows without modifying numerical-screen inputs."""
+
+    tokens = tuple(int(token) for token in token_ids)
+    if token_stream_start < 0:
+        raise ValueError("token_stream_start must be non-negative")
+    window = REFINEMENT_PREFILL_TOKENS + 1 + REFINEMENT_DECODE_STEPS
+    excluded = set(map(str, excluded_prompt_hashes))
+    samples = []
+    window_index = 0
+    while len(samples) < REFINEMENT_PROMPT_COUNT:
+        start = token_stream_start + window_index * window
+        if start + window > len(tokens):
+            raise ValueError(
+                "token stream does not contain 128 prompts after exclusions"
+            )
+        values = tokens[start : start + window]
+        source_id = f"refinement-synthetic-window-{window_index:04d}"
+        candidate = DecodeTokenSample.create(
+            document_id=f"refinement-heldout-window-{window_index:04d}",
+            source_cluster_id=source_id,
+            prompt_token_ids=values[:REFINEMENT_PREFILL_TOKENS],
+            prefill_reference_token_id=values[REFINEMENT_PREFILL_TOKENS],
+            decode_target_ids=values[REFINEMENT_PREFILL_TOKENS + 1 :],
+            source_spans=(
+                SourceTokenSpan(
+                    source_document_id=source_id,
+                    token_start=0,
+                    token_end=window,
+                    source_content_hash=hashlib.sha256(
+                        json.dumps(
+                            values,
+                            separators=(",", ":"),
+                        ).encode("utf-8")
+                    ).hexdigest(),
+                ),
+            ),
+            selection_seed=0,
+            selection_policy="contiguous_stream_test_only",
+        )
+        if candidate.prompt_hash not in excluded:
+            samples.append(candidate)
+        window_index += 1
+    return RefinementSampleBundle(
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        dataset_name=dataset_name,
+        dataset_revision=dataset_revision,
+        samples=tuple(samples),
+        excluded_prompt_hashes=tuple(excluded),
+        token_stream_start=token_stream_start,
+        selection_seed=0,
+    )
+
+
+def build_refinement_bundle_from_documents(
+    documents: Sequence[TokenizedSourceDocument],
+    *,
+    model_revision: str,
+    tokenizer_revision: str,
+    dataset_name: str,
+    dataset_revision: str,
+    excluded_source_spans: Sequence[SourceTokenSpan],
+    excluded_prompt_hashes: Sequence[str],
+    selection_seed: int,
+) -> RefinementSampleBundle:
+    """Select document-stratified windows disjoint from screened spans."""
+
+    if selection_seed < 0:
+        raise ValueError("selection_seed must be non-negative")
+    window = REFINEMENT_PREFILL_TOKENS + 1 + REFINEMENT_DECODE_STEPS
+    blocked: dict[str, list[tuple[int, int]]] = {}
+    for span in excluded_source_spans:
+        blocked.setdefault(span.source_document_id, []).append(
+            (span.token_start, span.token_end)
+        )
+    candidates: dict[
+        str,
+        list[tuple[str, TokenizedSourceDocument, int]]
+    ] = {}
+    for document in sorted(documents, key=lambda item: item.document_id):
+        for start in range(0, len(document.token_ids) - window + 1, window):
+            stop = start + window
+            if any(
+                start < prior_stop and prior_start < stop
+                for prior_start, prior_stop in blocked.get(
+                    document.document_id, ()
+                )
+            ):
+                continue
+            rank = hashlib.sha256(
+                (
+                    f"{selection_seed}:{document.content_hash}:"
+                    f"{start}:{stop}"
+                ).encode("utf-8")
+            ).hexdigest()
+            candidates.setdefault(document.document_id, []).append(
+                (rank, document, start)
+            )
+    for values in candidates.values():
+        values.sort()
+    selected = []
+    round_index = 0
+    excluded = set(map(str, excluded_prompt_hashes))
+    while len(selected) < REFINEMENT_PROMPT_COUNT:
+        available = [
+            (document_id, values)
+            for document_id, values in candidates.items()
+            if round_index < len(values)
+        ]
+        if not available:
+            raise ValueError(
+                "held-out documents cannot form 128 disjoint refinement windows"
+            )
+        available.sort(
+            key=lambda item: hashlib.sha256(
+                f"{selection_seed}:{round_index}:{item[0]}".encode("utf-8")
+            ).hexdigest()
+        )
+        for _, values in available:
+            if len(selected) == REFINEMENT_PROMPT_COUNT:
+                break
+            _, document, start = values[round_index]
+            stop = start + window
+            tokens = document.token_ids[start:stop]
+            sample = DecodeTokenSample.create(
+                document_id=(
+                    f"refinement-{document.document_id}-"
+                    f"{start:08d}-{document.content_hash[:12]}"
+                ),
+                source_cluster_id=document.document_id,
+                prompt_token_ids=tokens[:REFINEMENT_PREFILL_TOKENS],
+                prefill_reference_token_id=tokens[REFINEMENT_PREFILL_TOKENS],
+                decode_target_ids=tokens[REFINEMENT_PREFILL_TOKENS + 1 :],
+                source_spans=(
+                    SourceTokenSpan(
+                        source_document_id=document.document_id,
+                        token_start=start,
+                        token_end=stop,
+                        source_content_hash=document.content_hash,
+                    ),
+                ),
+                selection_seed=selection_seed,
+                selection_policy=DOCUMENT_SELECTION_POLICY,
+            )
+            if sample.prompt_hash not in excluded:
+                selected.append(sample)
+        round_index += 1
+    return RefinementSampleBundle(
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        dataset_name=dataset_name,
+        dataset_revision=dataset_revision,
+        samples=tuple(selected),
+        excluded_prompt_hashes=tuple(excluded),
+        token_stream_start=0,
+        selection_seed=selection_seed,
+    )
+
+
+def save_refinement_sample_bundle(
+    bundle: RefinementSampleBundle, path: str | Path
+) -> Path:
+    return write_immutable_json(path, bundle.to_dict())
+
+
+def load_refinement_sample_bundle(path: str | Path) -> RefinementSampleBundle:
+    value = json.loads(Path(path).read_text(encoding="utf-8"))
+    value.pop("content_hash", None)
+    return RefinementSampleBundle.from_dict(value)
+
+
+_refinement_token_samples_all__ = [
+    "REFINEMENT_DECODE_STEPS",
+    "REFINEMENT_PREFILL_TOKENS",
+    "REFINEMENT_PROMPT_COUNT",
+    "REFINEMENT_SAMPLE_BUNDLE_SCHEMA",
+    "RefinementSampleBundle",
+    "build_refinement_bundle_from_token_stream",
+    "build_refinement_bundle_from_documents",
+    "load_refinement_sample_bundle",
+    "save_refinement_sample_bundle",
+]
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/decode_dse/test_plots.py b/decode_dse/test_plots.py
new file mode 100644
index 0000000..600f4ed
--- /dev/null
+++ b/decode_dse/test_plots.py
@@ -0,0 +1,642 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from decode_dse.plots import (
+    ANALYSIS_SCHEMA,
+    HardwarePoint,
+    NumericalPoint,
+    _capacity_table,
+    _handoff_table,
+    _hardware_table,
+    _landscape_table,
+    _load_decode_analysis,
+    _load_selected_publication_rows,
+    _model_validation_table,
+    _multichip_table,
+    _numerical_table,
+    _packedkv_table,
+    _stage_breakdown_table,
+    _vector_table,
+    _write_csv,
+    plot_accuracy_by_weight,
+    plot_accuracy_landscape,
+    plot_completion_matrix,
+    plot_decode_capacity,
+    plot_handoff_regimes,
+    plot_hardware_pareto,
+    plot_model_validation,
+    plot_multichip_scaling,
+    plot_packedkv_ablation,
+    plot_screening_fidelity,
+    plot_selected_deployment_evidence,
+    plot_stage_breakdown,
+    plot_vector_sensitivity,
+)
+from decode_dse.hardware.packedkv_claims import PACKEDKV_MODES, PRECISION_ROLES
+from decode_dse.profiles import (
+    DECODE_FORMATS,
+    PROFILE_KIND_BF16_REFERENCE,
+    DecodePrecisionProfile,
+    enumerate_decode_profiles,
+)
+
+
+def _assert_rendered(paths: tuple[Path, ...]) -> None:
+    assert paths
+    assert all(path.is_file() and path.stat().st_size > 0 for path in paths)
+
+
+def test_hardware_pareto_handles_single_point_and_missing_energy_tier(
+    tmp_path: Path,
+) -> None:
+    profile = DecodePrecisionProfile.quantized(
+        "MXINT4", "MXINT4", "MXINT4", "FP_E3M2"
+    )
+    point = HardwarePoint(
+        profile=profile,
+        candidate_id="synthetic-candidate",
+        delta_nll=0.01,
+        relative_perplexity_percent=1.01,
+        tpot_ms=1.25,
+        tps=204.8,
+        energy_j=0.08,
+        area_mm2=420.0,
+        max_runtime_batch=256,
+        chip_count=4,
+        tp=2,
+        kvp=2,
+        energy_tier=None,
+        area_budget_mm2=908.6,
+    )
+    _assert_rendered(
+        plot_hardware_pareto(
+            (point,),
+            model_name="Synthetic decode model",
+            output_dir=tmp_path,
+            formats=("svg",),
+        )
+    )
+    table = _hardware_table((point,))
+    assert table[0]["energy_tier"] == ""
+    assert table[0]["tokens_per_joule"] == 12.5
+    _write_csv(
+        tmp_path / "hardware.csv",
+        table,
+        fieldnames=tuple(table[0]),
+    )
+
+
+def test_selected_deployment_plot_keeps_evidence_tiers_separate(
+    tmp_path: Path,
+) -> None:
+    common = {
+        "headline_ratio_permitted": False,
+        "ratio_block_reason": "throughput_evidence_tiers_differ",
+        "throughput_ratio": "",
+        "peak_roofline_row": False,
+        "peak_roofline_ratio_permitted": False,
+    }
+    rows = (
+        {
+            "system_role": "selected_plena_deployment",
+            "tokens_per_second": 240.0,
+            "throughput_evidence_tier": "compiler_trace_request_calibrated",
+            "energy_per_token_j": 0.08,
+            **common,
+        },
+        {
+            "system_role": "measured_gpu_baseline",
+            "tokens_per_second": 180.0,
+            "throughput_evidence_tier": "measured",
+            "energy_per_token_j": "",
+            **common,
+        },
+    )
+    _assert_rendered(
+        plot_selected_deployment_evidence(
+            rows,
+            model_name="Synthetic decode model",
+            output_dir=tmp_path,
+            formats=("svg",),
+        )
+    )
+    assert all(row["headline_ratio_permitted"] is False for row in rows)
+    assert all(row["throughput_ratio"] == "" for row in rows)
+
+
+def test_selected_publication_rows_bind_every_consumed_artifact(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    from decode_dse import plots
+    from decode_dse.hardware.design_space import HARDWARE_STORAGE_REVISION
+    from decode_dse.software import gpu_baseline
+    from decode_dse.software.benchmark_runner import PublicationContract
+    from decode_dse.software.sweep_plan import write_immutable_json
+
+    model_revision = "1" * 40
+    tokenizer_revision = "2" * 40
+    manifest = SimpleNamespace(
+        model_name="synthetic/model",
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        canonical_hash="3" * 64,
+    )
+    config_path = tmp_path / "config.json"
+    config_path.write_text(
+        json.dumps(
+            {
+                "model_name": manifest.model_name,
+                "model_revision": model_revision,
+                "tokenizer_revision": tokenizer_revision,
+                "hardware_space": {
+                    "RESOURCE_BUDGET": {
+                        "reference_system": "B200x1",
+                        "aggregate_area_limit_mm2": 826.0,
+                        "aggregate_hbm_capacity_limit_bytes": 192_000_000_000,
+                        "aggregate_hbm_bandwidth_limit_bytes_per_s": (
+                            8_000_000_000_000.0
+                        ),
+                    }
+                },
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    baseline_report_path = write_immutable_json(
+        tmp_path / "gpu_report.json",
+        {"fixture": "gpu-report"},
+    )
+    baseline_receipt_path = write_immutable_json(
+        tmp_path / "gpu_receipt.json",
+        {"fixture": "gpu-receipt"},
+    )
+    contract_path = write_immutable_json(
+        tmp_path / "publication_contract.json",
+        {"fixture": "publication-contract"},
+    )
+    contract_hash = "4" * 64
+    configuration_id = "pub-configuration"
+    alternative_id = "pubhw-alternative"
+    profile_id = "refined-profile"
+    candidate_id = "exact-candidate"
+    record_hash = "5" * 64
+    selected_configuration = SimpleNamespace(
+        configuration_id=configuration_id,
+        role="pareto",
+        profile=SimpleNamespace(profile_id=profile_id),
+    )
+    refined_hardware_path = tmp_path / "refined_hardware.jsonl"
+    refined_hardware_path.write_text("factorized synthetic fixture\n", encoding="utf-8")
+    refined_hardware_sha256 = hashlib.sha256(
+        refined_hardware_path.read_bytes()
+    ).hexdigest()
+    alternative = SimpleNamespace(
+        alternative_id=alternative_id,
+        configuration_id=configuration_id,
+        profile_id=profile_id,
+        candidate_id=candidate_id,
+        record_hash=record_hash,
+        hardware_artifact_sha256=refined_hardware_sha256,
+        tpot_ms=4.0,
+        energy_per_token_j=0.08,
+        energy_tier="analytic_anchored",
+    )
+    contract = SimpleNamespace(
+        canonical_hash=contract_hash,
+        protocol=SimpleNamespace(
+            model_name=manifest.model_name,
+            model_revision=model_revision,
+            tokenizer_revision=tokenizer_revision,
+        ),
+        configurations=(selected_configuration,),
+        hardware_alternatives=(alternative,),
+    )
+    monkeypatch.setattr(
+        PublicationContract,
+        "from_dict",
+        classmethod(lambda cls, value: contract),
+    )
+    publication_report_path = write_immutable_json(
+        tmp_path / "publication_report.json",
+        {
+            "schema_version": "decode-publication-report",
+            "contract_hash": contract_hash,
+            "selection": {
+                "selected": True,
+                "accuracy_configuration_ids": [configuration_id],
+            },
+        },
+    )
+    final_selection_path = write_immutable_json(
+        tmp_path / "final_selection.json",
+        {
+            "schema_version": "decode-final-publication-selection",
+            "contract_hash": contract_hash,
+            "contract_sha256": hashlib.sha256(contract_path.read_bytes()).hexdigest(),
+            "benchmark_report_sha256": hashlib.sha256(
+                publication_report_path.read_bytes()
+            ).hexdigest(),
+            "accuracy_pass_configuration_ids": [configuration_id],
+            "hardware_artifacts": [{"sha256": refined_hardware_sha256}],
+            "selection": {
+                "configuration_id": configuration_id,
+                "role": "pareto",
+                "alternative_id": alternative_id,
+                "profile_id": profile_id,
+                "candidate_id": candidate_id,
+                "hardware_record_hash": record_hash,
+                "hardware_artifact_sha256": refined_hardware_sha256,
+            },
+        },
+    )
+    baseline_contract = SimpleNamespace(
+        model_name=manifest.model_name,
+        model_revision=model_revision,
+        tokenizer_revision=tokenizer_revision,
+        workspace_binding=SimpleNamespace(manifest_hash=manifest.canonical_hash),
+        planned_device_labels=("B200",),
+    )
+    rebuilt_baseline = {
+        "best_measured_by_device": {
+            "GPU-test": {
+                "device_label": "B200",
+                "mean_batch_step_ms": 5.0,
+                "energy": {"available": True},
+            }
+        }
+    }
+    monkeypatch.setattr(
+        gpu_baseline,
+        "validate_gpu_baseline_report",
+        lambda report: (baseline_contract, rebuilt_baseline),
+    )
+    monkeypatch.setattr(
+        gpu_baseline,
+        "validate_gpu_baseline_stage_receipt",
+        lambda report, receipt: receipt,
+    )
+    monkeypatch.setattr(
+        gpu_baseline,
+        "gpu_baseline_throughput_evidence",
+        lambda *args, **kwargs: SimpleNamespace(
+            system_name="NVIDIA B200",
+            batch_size=2,
+            tokens_per_second=400.0,
+            evidence_tier="measured",
+        ),
+    )
+    monkeypatch.setattr(
+        gpu_baseline,
+        "gpu_baseline_energy_evidence",
+        lambda *args, **kwargs: SimpleNamespace(
+            energy_per_token_j=0.5,
+            tokens_per_joule=2.0,
+            evidence_tier="measured",
+        ),
+    )
+    hardware_row = {
+        "record_hash": record_hash,
+        "deployment_valid": True,
+        "profile_id": profile_id,
+        "candidate_id": candidate_id,
+        "hardware": {"BATCH": 2},
+        "metrics": {
+            "execution_mode": "compiler_trace",
+            "timing_calibrated": True,
+            "timing_evidence_id": "timing-" + "6" * 64,
+            "whole_model": {
+                "rankable": True,
+                "publication_timing_tier": "compiler_trace_request_calibrated",
+                "tpot_ms": 4.0,
+                "tps": 500.0,
+                "calibrated_energy": {"total_j": 0.08},
+            },
+        },
+    }
+    monkeypatch.setattr(
+        plots,
+        "load_hardware_artifact",
+        lambda path: (
+            {
+                "storage_revision": HARDWARE_STORAGE_REVISION,
+                "provenance": {
+                    "model_revision": model_revision,
+                    "tokenizer_revision": tokenizer_revision,
+                },
+            },
+            (hardware_row,),
+        ),
+    )
+
+    rows, receipt = _load_selected_publication_rows(
+        config_path=config_path,
+        manifest=manifest,
+        gpu_baseline_report_path=baseline_report_path,
+        gpu_baseline_receipt_path=baseline_receipt_path,
+        publication_contract_path=contract_path,
+        publication_report_path=publication_report_path,
+        final_selection_path=final_selection_path,
+        refined_hardware_artifact_path=refined_hardware_path,
+    )
+    assert [row["system_role"] for row in rows] == [
+        "selected_plena_deployment",
+        "measured_gpu_baseline",
+    ]
+    assert all(row["headline_ratio_permitted"] is False for row in rows)
+    assert all(row["throughput_ratio"] == "" for row in rows)
+    assert receipt["sources"]["final_selection_sha256"] == hashlib.sha256(
+        final_selection_path.read_bytes()
+    ).hexdigest()
+
+
+def test_decode_analysis_figures_and_csv_tables_render(
+    tmp_path: Path,
+) -> None:
+    validation = tuple(
+        {
+            "model": "Synthetic-8B",
+            "component": component,
+            "evidence_tier": tier,
+            "relative_error_percent": error,
+            "evaluation_seconds": 0.02,
+        }
+        for component, tier, error in (
+            ("compute", "emulator_calibrated", -2.0),
+            ("memory", "ramulator_calibrated", 3.0),
+            ("area", "dc_synthesised", 1.0),
+            ("power", "analytic_anchored", 4.0),
+        )
+    )
+    stages = tuple(
+        {
+            "stage": stage,
+            "variant": variant,
+            "matrix_cycles": 100.0 * scale,
+            "vector_cycles": 70.0 * scale,
+            "scalar_cycles": 40.0 * scale,
+            "control_cycles": 10.0 * scale,
+        }
+        for stage in ("QKV projection", "Flash attention")
+        for variant, scale in (("baseline", 1.0), ("enhanced", 0.8))
+    )
+    capacity = tuple(
+        {
+            "kv_format": kv_format,
+            "context_tokens": context,
+            "kv_bytes_per_token": bytes_per_token,
+            "feasible_batch": max(1, 131_072 // context),
+            "tpot_ms": context / 1_000.0,
+        }
+        for kv_format, bytes_per_token in (("MXINT4", 512), ("MXINT8", 1024))
+        for context in (128, 1024)
+    )
+    handoff = tuple(
+        {
+            "regime": regime,
+            "prefill_s": 0.2,
+            "transfer_s": 0.1,
+            "admission_s": 0.02,
+            "wait_s": wait,
+            "host_spill_s": spill,
+            "ttft_s": 0.32 + wait + spill,
+            "energy_j": 1.0 + spill,
+            "prefill_utilization": utilization,
+            "prefill_decode_ratio": 2.0,
+            "prompt_tokens": 1024,
+            "generation_tokens": 128,
+            "precision": "MXINT4",
+        }
+        for regime, wait, spill, utilization in (
+            ("fully_pipelined", 0.0, 0.0, 0.98),
+            ("back_pressure", 0.2, 0.0, 0.70),
+            ("host_buffered", 0.0, 0.4, 0.95),
+        )
+    )
+    multichip = tuple(
+        {
+            "chip_count": chips,
+            "tp": tp,
+            "kvp": kvp,
+            "tps": 100.0 * chips**0.8,
+            "energy_per_token_j": 0.1 * chips**0.2,
+            "energy_tier": tier,
+        }
+        for chips, tp, kvp, tier in (
+            (1, 1, 1, "analytic_anchored"),
+            (2, 2, 1, "analytic_anchored"),
+            (4, 2, 2, ""),
+        )
+    )
+    plot_specs = (
+        (plot_model_validation, validation, _model_validation_table),
+        (plot_stage_breakdown, stages, _stage_breakdown_table),
+        (plot_decode_capacity, capacity, _capacity_table),
+        (plot_handoff_regimes, handoff, _handoff_table),
+        (plot_multichip_scaling, multichip, _multichip_table),
+    )
+    for index, (plotter, rows, table_builder) in enumerate(plot_specs):
+        _assert_rendered(
+            plotter(rows, output_dir=tmp_path, formats=("svg",))
+        )
+        table = table_builder(rows)
+        _write_csv(
+            tmp_path / f"table-{index}.csv",
+            table,
+            fieldnames=tuple(table[0]),
+        )
+
+    artifact_path = tmp_path / "decode_analysis.json"
+    artifact_path.write_text(
+        json.dumps(
+            {
+                "schema_version": ANALYSIS_SCHEMA,
+                "model_name": "Synthetic-8B",
+                "model_validation": validation,
+                "stage_breakdown": stages,
+                "capacity": capacity,
+                "handoff": handoff,
+                "multichip": multichip,
+            }
+        ),
+        encoding="utf-8",
+    )
+    loaded = _load_decode_analysis(artifact_path)
+    assert loaded["model_name"] == "Synthetic-8B"
+    assert len(loaded["multichip"]) == 3
+
+
+def test_packedkv_causal_ablation_renders_all_controls(
+    tmp_path: Path,
+    monkeypatch: object,
+) -> None:
+    groups = []
+    for precision_index, role in enumerate(PRECISION_ROLES):
+        measurements = {}
+        for mode_index, mode in enumerate(PACKEDKV_MODES):
+            traffic_scale = (1.0, 0.72, 0.55, 0.48)[mode_index]
+            measurements[mode] = SimpleNamespace(
+                read_bytes_per_sequence_token=(
+                    4096.0 * (precision_index + 1) * traffic_scale
+                ),
+                feasible_batch=64 * (mode_index + 1),
+                capacity_limited_tokens_per_s=100.0 * (mode_index + 1),
+                tpot_ms=10.0 / (mode_index + 1),
+            )
+        groups.append(
+            SimpleNamespace(
+                key=("gqa8", role),
+                precision=SimpleNamespace(
+                    role=role,
+                    format_id=("MXINT8" if role == "i8" else "MXINT4"),
+                ),
+                topology=SimpleNamespace(role="gqa8"),
+                by_mode=lambda values=measurements: values,
+            )
+        )
+    evidence = SimpleNamespace(groups=tuple(groups))
+    monkeypatch.setattr(
+        "decode_dse.plots.load_packedkv_evidence",
+        lambda _path: evidence,
+    )
+    monkeypatch.setattr(
+        "decode_dse.plots.evaluate_packedkv_publication",
+        lambda _evidence: SimpleNamespace(passed=True),
+    )
+
+    _assert_rendered(
+        plot_packedkv_ablation(
+            tmp_path / "synthetic-evidence.json",
+            output_dir=tmp_path,
+            formats=("svg",),
+        )
+    )
+    table = _packedkv_table(evidence)
+    assert len(table) == len(PRECISION_ROLES) * len(PACKEDKV_MODES)
+    assert {row["mode"] for row in table} == set(PACKEDKV_MODES)
+
+
+def test_completion_matrix_renders_an_all_failed_column(tmp_path: Path) -> None:
+    entries = []
+    terminal_rows = []
+    for weight_format in DECODE_FORMATS:
+        for kv_format in DECODE_FORMATS:
+            profile = DecodePrecisionProfile.quantized(
+                weight_format,
+                weight_format,
+                kv_format,
+                "FP_E3M2",
+            )
+            entry = SimpleNamespace(profile=profile, profile_id=profile.profile_id)
+            entries.append(entry)
+            terminal_rows.append(
+                {
+                    "profile_id": profile.profile_id,
+                    "state": "failed" if kv_format == DECODE_FORMATS[0] else "succeeded",
+                    "error_class": "SyntheticFailure" if kv_format == DECODE_FORMATS[0] else None,
+                }
+            )
+    manifest = SimpleNamespace(entries=tuple(entries))
+    _assert_rendered(
+        plot_completion_matrix(
+            manifest,
+            terminal_rows,
+            model_name="Synthetic decode model",
+            output_dir=tmp_path,
+            formats=("svg",),
+        )
+    )
+
+
+def test_numerical_figures_and_tables_render_full_manifest(tmp_path: Path) -> None:
+    profiles = enumerate_decode_profiles()
+    points = tuple(
+        NumericalPoint(
+            ordinal=ordinal,
+            profile=profile,
+            mean_nll=(
+                5.0
+                if profile.kind == PROFILE_KIND_BF16_REFERENCE
+                else 5.01 + ordinal * 1e-5
+            ),
+            runtime_seconds=0.01,
+        )
+        for ordinal, profile in enumerate(profiles)
+    )
+    validation_points = tuple(
+        NumericalPoint(
+            ordinal=point.ordinal,
+            profile=point.profile,
+            mean_nll=point.mean_nll + point.ordinal * 1e-7,
+            runtime_seconds=0.02,
+        )
+        for point in points
+    )
+    reference_nll = 5.0
+    for plotter in (
+        plot_accuracy_by_weight,
+        plot_accuracy_landscape,
+        plot_vector_sensitivity,
+    ):
+        _assert_rendered(
+            plotter(
+                points,
+                reference_nll=reference_nll,
+                model_name="Synthetic decode model",
+                output_dir=tmp_path,
+                formats=("svg",),
+            )
+        )
+    fidelity_paths, fidelity = plot_screening_fidelity(
+        points,
+        validation_points,
+        model_name="Synthetic decode model",
+        output_dir=tmp_path,
+        formats=("svg",),
+    )
+    _assert_rendered(fidelity_paths)
+    assert fidelity["passed"] is True
+
+    entries = tuple(
+        SimpleNamespace(
+            ordinal=point.ordinal,
+            profile=point.profile,
+            profile_id=point.profile_id,
+        )
+        for point in points
+    )
+    terminal_rows = tuple(
+        {
+            "profile_id": point.profile_id,
+            "state": "succeeded",
+            "attempt": 1,
+            "runtime_seconds": point.runtime_seconds,
+            "result": {"mean_nll": point.mean_nll},
+            "record_hash": "a" * 64,
+            "validity": {"passed": True},
+        }
+        for point in points
+    )
+    manifest = SimpleNamespace(entries=entries)
+    tables = (
+        _numerical_table(
+            manifest,
+            terminal_rows,
+            reference_nll=reference_nll,
+        ),
+        _landscape_table(points, reference_nll=reference_nll),
+        _vector_table(points),
+    )
+    for index, table in enumerate(tables):
+        _write_csv(
+            tmp_path / f"numerical-table-{index}.csv",
+            table,
+            fieldnames=tuple(table[0]),
+        )