wai: keep loaded parameter sets between decodes, keyed by the SHA-256 of their bytes (O23) #268

Merged

dcharlot merged 20 commits from wai/o23-loaded-set-cache into main 2026-10-15 20:41:28 -04:00

Conversation 0 Commits 20 Files changed 43 +2978 -253

dcharlot commented 2026-10-15 12:05:30 -04:00

Owner

Copy link

Stacked on #267 (wai/d2c-m4, still open): this branch is based on its head 2143d25b, so until #267 merges the diff below also shows #267's commits. The seven commits from e2a93241 to 4d7b9e28 are this PR's own.

What

Since the decoders were re-expressed through wai-ops/1, every integer decode lowers its parameter set and loads each graph, the bounds pass (load step 8) included, on every call. That is the same work for every payload the set decodes, and for the pretrained conditional-codec set it costs more than the decode. This PR keeps a set once it has loaded and reuses it.

• int_set_cache::LoadedSets (new, neural_int). One store per process, behind a lock (on wasm32, one thread). Entries are found by a SetKey: the capability, the lowering, the profile the graphs were loaded under, and the SHA-256 of the listing of the members the decode reads, each listed by its own SHA-256 (pin::listing_from). That is the digest a pin over exactly those members names. The key is never a name.
• Used by: int_payload::decode_int and int_payload::declared_cost for WIH1, a WIV1's keyframe, WIA1, WIS1 and wai.neural.int_synth. Through these, the neural sink and wai-web's decodeWiv1, decodeWih1, decodeWia1, decodeWis1 and decodeIntSynth use it too.
  • decodeIntSynth now decodes through decode_int like the others, so a refusal's message starts with its code.
  • int_synth::decode_from_spec is shared with the byte-equality crate, which includes the decoder sources and not the store. It is now three steps (check_payload, load_spec, decode_loaded) and loads its set every time.
  • The debug entry points that read the tools' JSON forms do not use the store.
• Only the load step is answered from the store. Every check before it runs as before, in integer-payloads §7's order.
  • An entry is made only from what a load returned, after it returned. A wai_ops::Loaded is made only by graph::load.
  • The steps before the load are cond_checked, int_audio::ops::plan_with, int_splat::ops::plan_with, and int_synth::check_payload.
  • A refused set is never kept: it is lowered, loaded and refused again on its next decode, with the same refusal.
• Bounded.
  • The budget is 256 MiB to start with (LoadedSets::DEFAULT_BUDGET). The least recently used entry goes first, a set larger than the whole budget is not kept, and a budget of 0 turns the store off (the set is then not hashed).
  • Set it with LoadedSets::set_budget, or setLoadedSetBudget in wai-web; loadedSetStats reports for a page.
  • An entry counts as the shared allocation that holds the set, plus wai_ops::Graph::heap_bytes (new: every list at capacity × element size), plus 4096 bytes for its share of the two indexes.
• No second hash. An unpinned resolve (or a pinned one with a key log) already hashes every member the decode reads, and their listing, for check 5. IntParams keeps that listing digest with the member names it was formed over. The key uses it only for a capability that reads exactly those members; any other key hashes the bytes. The bytes are borrowed for as long as the parameters live.
• Docs.
  • integer-operators §8.6: an informative note on what a sink may keep between decodes (the loaded graphs, keyed by the SHA-256 of the exact bytes with capability, lowering and profile; only after the load passed; nothing else moves; memory is the set's).
  • integer-payloads §7: an informative note that a kept set is outside the declared working bytes, and bounded by the sink's budget.
  • CHANGELOG.
• Unchanged: no golden, output, refusal or declared cost changed. include/wai.h gains the two associated constants that cbindgen exports (LoadedSets_DEFAULT_BUDGET, LoadedSets_INDEX_BYTES_PER_ENTRY).

Declared cost

working_bytes is what a decode holds beyond the payload and its parameter set. For a capability that decodes through the operator set, the set is already counted (by tests/int_payload_cost.rs) as parsed, lowered and loaded, the same for every payload. A kept entry is that set, kept. So it is the set's memory, outside every decode's declared working bytes, and the store's budget bounds it.

tests/int_payload_cost.rs runs its checks in three ways:

• Store off: its existing checks, with the same figures as before.
• Store on, the decode that loads the set: it holds within working + set, as before.
• Store on, the decode that finds the set held: it holds within the same bound and less than the decode that loaded it, and leaves nothing more behind.

It also checks the store's count against a live-bytes allocator. The count is never under what the store holds:

set	held (bytes)	counted (bytes)	note
video_nk	9,693	11,733	the first entry, which allocates the indexes
tiny	7,637	11,733
audio	41,233	45,329
splat	304,967	309,063

Tests

tests/int_set_cache.rs (new; in both conformance steps):

• A second decode through a set is a hit, by the store's count, never a clock. It gives the bytes of a decode with the store off on every committed vector with a set: tiny, video_nk, audio, splat and the four int_synth corpus vectors. The declared cost finds the set held too.
• Sets one byte apart never share an entry: a tiny g_s bias byte, and an int_synth bias digit.
• A set the load refuses stays refused while a set one byte away is held, and is never kept:
  • int_synth: overflow_acc64, refused by the bounds pass at Load(8), beside its neighbour with bias 0;
  • conditional codec: a tiny with a layer-0 bias that admits no input range, refused as it is lowered.
• Every refusal fixture of int-payload-conformance keeps its code and detail with its set held. A payload refused while it is parsed never reaches the store.
• Under a small budget, the least recently used set goes first, a set past the budget is not kept, and a budget of 0 neither keeps nor looks up.
• Eight threads decoding one set at once keep one entry.

Elsewhere:

• Unit tests in int_set_cache (5).
• int_payload::tests::a_resolved_digest_keys_only_the_members_it_was_formed_over.
• wai_ops::graph::tests::heap_bytes_count_every_list.
• wai-web/demo/verify_int_payload_wasm.mjs decodes tiny twice in wasm32 and counts the hit, then decodes with a budget of 0.

Falsifications

Each was applied to the committed final head 4d7b9e28, run red on the build host, and restored with git checkout. The tree was then byte-equal to that head, which is green (gate below). The same faults were also shown red on earlier heads of this branch.

#	fault	red
F1	the decode's key hashes the member names, not their bytes (keyed by name)	int_set_cache EXIT=101, 5 of 6 tests. "tiny: kept under the SHA-256 of its members". overflow_acc64 is not "refused again, with the same refusal": it decodes with its one-byte neighbour's certified graph. "the set one byte away is decoded with its own networks" (wrong image). The least-recently-used test got [5, 10, 15] for [5, 10, 20]. A refusal fixture's set is not under its key
F2	a lookup ignores the digest: any held set of the capability, lowering and profile answers (a hit for a different digest skips the bounds pass)	lib EXIT=101 (2 unit tests); int_set_cache EXIT=101 (5 tests). "tiny: the first decode loads its set and keeps it" (0, 1, 0) for (1, 0, 1), a hit on another set's entry. overflow_acc64 decodes. The one-byte neighbour gets the wrong image. [255, 0, 0] for [5, 10, 15]. Threads (8, 2) for (8, 1)
F3	a decode whose set is held skips the plan	int_set_cache EXIT=101: "wiv1_geometry: with its set held", field_range "i_frame size disagrees with h·w·3" for geometry_mismatch "the keyframe's size is not the clip's h × w"
F4	no eviction to make room	lib EXIT=101 (the_least_recently_used_entry_goes_first); int_set_cache EXIT=101 ("s2 went first")
F5	a graph's weights counted at 2 bytes, not as held	int_payload_cost EXIT=101 ("video_nk: the store holds 9693 bytes for the set and counts 8061"); wai-ops heap_bytes_count_every_list EXIT=101 (39 for 57)
F6	a loaded set is never kept	lib EXIT=101 (3 tests); int_set_cache EXIT=101 (6 of 6)
F7	the digest resolve formed is used for any capability's members	lib EXIT=101: "another capability's one member is hashed"

Measured

The pretrained conditional-codec set: 24.3 MB in three members (f16fd09c…), 256×256, through decode_int (WIH1). It was run on the build host in release, in three processes per row, at a 1-minute host load of about 20–43 (stated per run in the report). Every decode gave eb1acd2159f8a966. The set counts 93,204,616 bytes in the store (93,203,464 on wasm32).

	store off	store on, first call	store on, later calls
native, automatic threads, resolve once	699–867 ms (medians)	704–906 ms	61–64 ms (medians; all 51–73 ms)
native, automatic threads, resolve per call	772–861 ms (medians)	787–991 ms	129–168 ms (medians; includes resolve's check-5 hash)
native, one thread, resolve once (two processes)	1180–1273 ms (medians)	1201–1366 ms	526–578 ms (medians)
wasm32 under Node (decodeWih1, resolve per call)	8.5–10.9 s	8.7–10.3 s	4.7–5.3 s

The SHA-256 of the set's members (software sha2) takes 59–69 ms (medians). Before the last commit the key formed it on every decode, as well as resolve's. Now a decode through parameters resolve built does not form it again.

Gate

gate.sh o23-final2 on 4d7b9e28: GREEN. Main (ca79392a) is already in this branch, so no merge was needed. The steps: build, lib-tests, carriage, corpus loop 21/21, fast-kernels, byte-exact, wai-web wasm32, neural gates.

Also EXIT=0 on that head:

• the release conformance step;
• the pretrained-set step (WAI_REQUIRE_SOTA_VECTORS=1: int_hyper_synth, int_video_sota_keyframe, require_vectors_rule);
• neural_native_decode and neural_cost_limit;
• the wasm32 tests, 4 passed, under the pinned wasm-bindgen-test-runner 0.2.127;
• wai-web native, 32 passed;
• under Node: verify_int_payload_wasm (with the new hit and budget-0 checks), verify_int_synth_wasm, verify_int_hyper_wasm on the pretrained set (eb1acd2159f8a966, JSON and binary model) and verify_staged_wasm;
• check-lockfiles.sh: 38 lockfiles current.

Locally, all EXIT=0: comparative prose, vanity metrics, public names, section refs, tests in CI, orphan sources and workflow concurrency.

include/wai.h was regenerated once (1bd2547b) and is unchanged by every build since. git status --porcelain --untracked-files=no was empty after each build.

An earlier gate on 5c456dc4 was RED in byte-exact: that crate #[path]-includes int_synth.rs and int_hyper_synth.rs and has no store. 4d7b9e28 fixed it.

Not in this PR

• A single decode still pays the lowering and the bounds pass. The /int_hyper demo page decodes once per view (through the debug decodeIntHyperBin), so a store does not change it. A faster bounds pass is the lever there.
• Parameters that no check-5 run hashed (a pinned decode with no key log, the neural sink's verified path) hash the members read once at key time.
• Concurrent misses on one set both load it; one entry is kept.

🤖 Generated with Claude Code

**Stacked on #267** (`wai/d2c-m4`, still open): this branch is based on its head `2143d25b`, so until #267 merges the diff below also shows #267's commits. The seven commits from `e2a93241` to `4d7b9e28` are this PR's own. ## What Since the decoders were re-expressed through `wai-ops/1`, every integer decode lowers its parameter set and loads each graph, the bounds pass (load step 8) included, on every call. That is the same work for every payload the set decodes, and for the pretrained conditional-codec set it costs more than the decode. This PR keeps a set once it has loaded and reuses it. - **`int_set_cache::LoadedSets`** (new, `neural_int`). One store per process, behind a lock (on `wasm32`, one thread). Entries are found by a `SetKey`: the capability, the lowering, the profile the graphs were loaded under, and the SHA-256 of the listing of the members the decode reads, each listed by its own SHA-256 (`pin::listing_from`). That is the digest a pin over exactly those members names. The key is never a name. - **Used by:** `int_payload::decode_int` and `int_payload::declared_cost` for `WIH1`, a `WIV1`'s keyframe, `WIA1`, `WIS1` and `wai.neural.int_synth`. Through these, the neural sink and `wai-web`'s `decodeWiv1`, `decodeWih1`, `decodeWia1`, `decodeWis1` and `decodeIntSynth` use it too. - `decodeIntSynth` now decodes through `decode_int` like the others, so a refusal's message starts with its code. - `int_synth::decode_from_spec` is shared with the byte-equality crate, which includes the decoder sources and not the store. It is now three steps (`check_payload`, `load_spec`, `decode_loaded`) and loads its set every time. - The debug entry points that read the tools' JSON forms do not use the store. - **Only the load step is answered from the store.** Every check before it runs as before, in integer-payloads §7's order. - An entry is made only from what a load returned, after it returned. A `wai_ops::Loaded` is made only by `graph::load`. - The steps before the load are `cond_checked`, `int_audio::ops::plan_with`, `int_splat::ops::plan_with`, and `int_synth::check_payload`. - A refused set is never kept: it is lowered, loaded and refused again on its next decode, with the same refusal. - **Bounded.** - The budget is 256 MiB to start with (`LoadedSets::DEFAULT_BUDGET`). The least recently used entry goes first, a set larger than the whole budget is not kept, and a budget of 0 turns the store off (the set is then not hashed). - Set it with `LoadedSets::set_budget`, or `setLoadedSetBudget` in `wai-web`; `loadedSetStats` reports for a page. - An entry counts as the shared allocation that holds the set, plus `wai_ops::Graph::heap_bytes` (new: every list at capacity × element size), plus 4096 bytes for its share of the two indexes. - **No second hash.** An unpinned `resolve` (or a pinned one with a key log) already hashes every member the decode reads, and their listing, for check 5. `IntParams` keeps that listing digest with the member names it was formed over. The key uses it only for a capability that reads exactly those members; any other key hashes the bytes. The bytes are borrowed for as long as the parameters live. - **Docs.** - integer-operators §8.6: an informative note on what a sink may keep between decodes (the loaded graphs, keyed by the SHA-256 of the exact bytes with capability, lowering and profile; only after the load passed; nothing else moves; memory is the set's). - integer-payloads §7: an informative note that a kept set is outside the declared working bytes, and bounded by the sink's budget. - CHANGELOG. - **Unchanged:** no golden, output, refusal or declared cost changed. `include/wai.h` gains the two associated constants that cbindgen exports (`LoadedSets_DEFAULT_BUDGET`, `LoadedSets_INDEX_BYTES_PER_ENTRY`). ## Declared cost `working_bytes` is what a decode holds beyond the payload and its parameter set. For a capability that decodes through the operator set, the set is already counted (by `tests/int_payload_cost.rs`) as parsed, lowered and loaded, the same for every payload. A kept entry is that set, kept. So it is the set's memory, outside every decode's declared working bytes, and the store's budget bounds it. `tests/int_payload_cost.rs` runs its checks in three ways: - **Store off:** its existing checks, with the same figures as before. - **Store on, the decode that loads the set:** it holds within `working + set`, as before. - **Store on, the decode that finds the set held:** it holds within the same bound and less than the decode that loaded it, and leaves nothing more behind. It also checks the store's count against a live-bytes allocator. The count is never under what the store holds: | set | held (bytes) | counted (bytes) | note | |---|---|---|---| | `video_nk` | 9,693 | 11,733 | the first entry, which allocates the indexes | | `tiny` | 7,637 | 11,733 | | | audio | 41,233 | 45,329 | | | splat | 304,967 | 309,063 | | ## Tests `tests/int_set_cache.rs` (new; in both conformance steps): - **A second decode through a set is a hit,** by the store's count, never a clock. It gives the bytes of a decode with the store off on every committed vector with a set: `tiny`, `video_nk`, `audio`, `splat` and the four `int_synth` corpus vectors. The declared cost finds the set held too. - **Sets one byte apart never share an entry:** a `tiny` `g_s` bias byte, and an `int_synth` bias digit. - **A set the load refuses stays refused** while a set one byte away is held, and is never kept: - `int_synth`: `overflow_acc64`, refused by the bounds pass at `Load(8)`, beside its neighbour with bias 0; - conditional codec: a `tiny` with a layer-0 bias that admits no input range, refused as it is lowered. - **Every refusal fixture** of int-payload-conformance keeps its code and detail with its set held. A payload refused while it is parsed never reaches the store. - **Under a small budget,** the least recently used set goes first, a set past the budget is not kept, and a budget of 0 neither keeps nor looks up. - **Eight threads decoding one set** at once keep one entry. Elsewhere: - Unit tests in `int_set_cache` (5). - `int_payload::tests::a_resolved_digest_keys_only_the_members_it_was_formed_over`. - `wai_ops::graph::tests::heap_bytes_count_every_list`. - `wai-web/demo/verify_int_payload_wasm.mjs` decodes `tiny` twice in wasm32 and counts the hit, then decodes with a budget of 0. ## Falsifications Each was applied to the committed final head `4d7b9e28`, run red on the build host, and restored with `git checkout`. The tree was then byte-equal to that head, which is green (gate below). The same faults were also shown red on earlier heads of this branch. | # | fault | red | |---|---|---| | F1 | the decode's key hashes the member names, not their bytes (keyed by name) | `int_set_cache` EXIT=101, 5 of 6 tests. "tiny: kept under the SHA-256 of its members". `overflow_acc64` is not "refused again, with the same refusal": it decodes with its one-byte neighbour's certified graph. "the set one byte away is decoded with its own networks" (wrong image). The least-recently-used test got `[5, 10, 15]` for `[5, 10, 20]`. A refusal fixture's set is not under its key | | F2 | a lookup ignores the digest: any held set of the capability, lowering and profile answers (a hit for a different digest skips the bounds pass) | lib EXIT=101 (2 unit tests); `int_set_cache` EXIT=101 (5 tests). "tiny: the first decode loads its set and keeps it" `(0, 1, 0)` for `(1, 0, 1)`, a hit on another set's entry. `overflow_acc64` decodes. The one-byte neighbour gets the wrong image. `[255, 0, 0]` for `[5, 10, 15]`. Threads `(8, 2)` for `(8, 1)` | | F3 | a decode whose set is held skips the plan | `int_set_cache` EXIT=101: "wiv1_geometry: with its set held", `field_range` "i_frame size disagrees with h·w·3" for `geometry_mismatch` "the keyframe's size is not the clip's h × w" | | F4 | no eviction to make room | lib EXIT=101 (`the_least_recently_used_entry_goes_first`); `int_set_cache` EXIT=101 ("s2 went first") | | F5 | a graph's weights counted at 2 bytes, not as held | `int_payload_cost` EXIT=101 ("video_nk: the store holds 9693 bytes for the set and counts 8061"); `wai-ops` `heap_bytes_count_every_list` EXIT=101 (39 for 57) | | F6 | a loaded set is never kept | lib EXIT=101 (3 tests); `int_set_cache` EXIT=101 (6 of 6) | | F7 | the digest `resolve` formed is used for any capability's members | lib EXIT=101: "another capability's one member is hashed" | ## Measured The pretrained conditional-codec set: 24.3 MB in three members (`f16fd09c…`), 256×256, through `decode_int` (`WIH1`). It was run on the build host in release, in three processes per row, at a 1-minute host load of about 20–43 (stated per run in the report). Every decode gave `eb1acd2159f8a966`. The set counts 93,204,616 bytes in the store (93,203,464 on wasm32). | | store off | store on, first call | store on, later calls | |---|---|---|---| | native, automatic threads, `resolve` once | 699–867 ms (medians) | 704–906 ms | 61–64 ms (medians; all 51–73 ms) | | native, automatic threads, `resolve` per call | 772–861 ms (medians) | 787–991 ms | 129–168 ms (medians; includes `resolve`'s check-5 hash) | | native, one thread, `resolve` once (two processes) | 1180–1273 ms (medians) | 1201–1366 ms | 526–578 ms (medians) | | wasm32 under Node (`decodeWih1`, `resolve` per call) | 8.5–10.9 s | 8.7–10.3 s | 4.7–5.3 s | The SHA-256 of the set's members (software `sha2`) takes 59–69 ms (medians). Before the last commit the key formed it on every decode, as well as `resolve`'s. Now a decode through parameters `resolve` built does not form it again. ## Gate **`gate.sh o23-final2` on `4d7b9e28`: GREEN.** Main (`ca79392a`) is already in this branch, so no merge was needed. The steps: build, lib-tests, carriage, corpus loop 21/21, fast-kernels, byte-exact, wai-web wasm32, neural gates. **Also EXIT=0 on that head:** - the release conformance step; - the pretrained-set step (`WAI_REQUIRE_SOTA_VECTORS=1`: `int_hyper_synth`, `int_video_sota_keyframe`, `require_vectors_rule`); - `neural_native_decode` and `neural_cost_limit`; - the wasm32 tests, 4 passed, under the pinned `wasm-bindgen-test-runner` 0.2.127; - wai-web native, 32 passed; - under Node: `verify_int_payload_wasm` (with the new hit and budget-0 checks), `verify_int_synth_wasm`, `verify_int_hyper_wasm` on the pretrained set (`eb1acd2159f8a966`, JSON and binary model) and `verify_staged_wasm`; - `check-lockfiles.sh`: 38 lockfiles current. **Locally, all EXIT=0:** comparative prose, vanity metrics, public names, section refs, tests in CI, orphan sources and workflow concurrency. `include/wai.h` was regenerated once (`1bd2547b`) and is unchanged by every build since. `git status --porcelain --untracked-files=no` was empty after each build. An earlier gate on `5c456dc4` was RED in byte-exact: that crate `#[path]`-includes `int_synth.rs` and `int_hyper_synth.rs` and has no store. `4d7b9e28` fixed it. ## Not in this PR - **A single decode still pays the lowering and the bounds pass.** The `/int_hyper` demo page decodes once per view (through the debug `decodeIntHyperBin`), so a store does not change it. A faster bounds pass is the lever there. - **Parameters that no check-5 run hashed** (a pinned decode with no key log, the neural sink's verified path) hash the members read once at key time. - **Concurrent misses on one set** both load it; one entry is kept. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 20 commits 2026-10-15 12:05:30 -04:00

int_hyper gate 1: the conditional codec's lowering and certificates, as wai-rs loads them ... dac57e2b30

D2c M4, gate 1 (extensions/integer-operators.md §13.2, §13.0, §13.5).

- int_hyper_synth::ops: lower (h_s by whm1/1, then g_s by whm1/1 with the
  RGB8 step, from the models this crate parses) and load (each loaded under
  acc64 in turn, as the decode will hold them: Nets).
- int_ops::whm1_net refuses a model whose weights are past i16 or whose
  inverse-GDN gamma is past i32 (model_mismatch): the widths WHM1 gives them
  and whm1/1 writes them at. A model parsed from WHM1 bytes never has one;
  a JSON model (the tools' form, which the browser's debug decode and the
  byte-exact keyframe golden read) could, and its graph would otherwise hold
  truncated values. Unit test int_ops::conversion at both ends of each width.
- tests/int_hyper_ops.rs (video_int, legacy_int; named in both fast-kernels
  steps): every committed set of wai.neural.int_hyper and wai.video.int_hyper
  (tiny under both, the synthetic hyper) lowers to its committed h_s.whg1 and
  g_s.whg1 from its bytes and from the parsed models; its set digest, the
  certificate's graph digests and input check ranges are those graphs'; each
  graph loads under acc64 and not acc32; the first acc32 failure is h_s input
  0, range, 53 bits for tiny (Appendix C) and 52 for hyper; the tiny set's
  JSON models lower to the same graphs as its binary ones. The pretrained
  set's committed certificate (f16fd09c) has Appendix C's verdict (41 bits).
- tests/int_hyper_synth.rs: the_pretrained_set_lowers_to_its_certificates_graphs
  (the regenerated set is f16fd09c, and ops::lower writes the graphs its
  certificate records); named in wai-sota-vectors.yml's required list, whose
  path filters gain src/int_ops.rs.

Green (build host, logs wai-build/logs/d2c-m4/g1): int_hyper_ops debug and
release EXIT=0 (2 passed); --lib int_ops:: EXIT=0 (4); the SOTA step
(WAI_REQUIRE_SOTA_VECTORS=1, vectors regenerated on the build host from the
pinned stack: set digest f16fd09c, as committed) EXIT=0, 7 passed, the new
test included; check-tests-in-ci.py EXIT=0.

Falsified: h_s lowered with the RGB8 step in ops::lower. Red: int_hyper_ops
EXIT=101 ("tiny: the lowering of the parsed models differs from the
committed h_s"); the SOTA test EXIT=101 (h_s's graph digest is not the
certificate's). Restored with git; green above is this commit.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 2: the conditional codec decodes through whm1/1 to its goldens ... 90c696f7ff

D2c M4, gate 2 (golden equality).

- int_hyper_synth: the stream decodes factored out of the checked decode
  (hyper_latent, latent; unchanged), the direct decode kept as
  legacy::decode_conditional_checked (decode_conditional_checked still calls
  it: the switch is gate 6), and ops::{plan, decode, decode_loaded}: the
  plan (cond_plan, integer-payloads §7's order), the two networks lowered and
  loaded, the hyper-latent stream, h_s's graph, the driver's split of its
  output into sigma (channels [0, m)) and mu ([m, 2m)) after the shape check
  (§13.5), the latent stream conditioned on sigma, g_s's graph ending in the
  RGB8 step, then HWC bytes.
- tests/int_hyper_ops.rs: every committed vector decodes through the
  lowering to the direct decode's image and every committed digest: tiny
  (WIH1, its JSON form, and the set's JSON models: SHA-256 sidecar dce7282d…,
  FNV-1a 7cbe882c42c6725d) and video_nk (WIV1 keyframe 1: the keyframe, then
  the P-frames, every frame's and the clip's SHA-256 4a81f0c9… and FNV-1a).
- byte-exact-conformance: wih1_through_its_lowering_is_golden (reference and
  fast kernels), wiv1_keyframe_1_through_its_lowering_is_golden, and
  the_neural_keyframe_clip_through_its_lowering_is_byte_identical (the JSON
  models neural_keyframe_golden reads, now with the check ranges; clip FNV-1a
  a5f53d477999d159).
- tests/int_hyper_synth.rs: the pretrained set's binary models also decode
  through the lowering to the export image (wai-sota-vectors.yml).

Green (build host, logs wai-build/logs/d2c-m4/g2, g2v): int_hyper_ops debug
and release EXIT=0 (3 passed); cargo check --lib --features neural_int
EXIT=0, no warning (ops::plan is pub(crate), as CondPlan is);
byte-exact cargo test --release EXIT=0 (100 passed; its two warnings are
the pre-existing CondPlan ones); the SOTA step on the regenerated vectors
EXIT=0, the pretrained binary models decoding through the lowering to the
export image eb1acd2159f8a966.

Falsified, Part 3.5 row "rq rounding floor -> half_up in whm1/1": Red:
int_hyper_ops EXIT=101 (the vector test: "tiny WIH1: StreamNoncanonical",
since h_s's sigma moves the buckets; gate 1's graph bytes); byte-exact
EXIT=101 with wih1_through_its_lowering_is_golden,
wiv1_keyframe_1_through_its_lowering_is_golden and
the_neural_keyframe_clip_through_its_lowering_is_byte_identical FAILED
while the file-based wih1_payload_is_byte_identical and
the_neural_keyframe_clip_is_byte_identical stay ok (pre-switch); splat's and
audio's goldens FAILED too (switched). Restored.

Row "igdn sums first, then shifts once": the tiny set survives it
(int_hyper_ops EXIT=0, every byte-exact int_hyper golden ok) while the
audio goldens FAIL, as Part 3.5 predicts for every set but audio; the
pretrained set does carry it: the SOTA test EXIT=101, "the decode through
the integer operator set must give the export image" d5763810e3fdef99 !=
eb1acd2159f8a966. Restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 3 (WIP: committed before running): refusal parity, ops members, SPEC citations ... f420423b20

D2c M4, gate 3 (refusal parity). The registry export follows.

- tests/int_hyper_ops.rs:
  (a) every committed fixture of both capabilities (33) is refused by a sink
      with its code; for each decode fixture (15) its WIH1, or its WIV1's
      keyframe, decodes through the lowering and directly to the same image,
      or is refused by both with the same code, the fixture's for WIH1;
  (b) 27 fixtures, one per refusal the direct decode makes, in integer-
      payloads §7's order, each one change from the committed tiny set or
      payload (the set against the payload, the networks planned and the
      caps, the shapes, each stream, each network's ranges); both decodes
      refuse each with the code §8 gives it;
  (c) at the edge of every check range of the committed h_s and g_s (six
      layers; the leaky ReLU followed by a zero 1x1 transposed convolution,
      since a network without a tag 0, 1 or 2 layer does not lower): at
      +-X_l both run alike, at +-(X_l + 1) both refuse (field_range at input
      0; run_net_checked out of range at layer 0).
- codecs::capability_ops: wai.neural.int_hyper and wai.video.int_hyper =
  {acc64, full, whm1/1, rans64 t4097/lenient/canonical, bucket ceil}; the
  registry unit test lists five capabilities.
- SPEC §5's two rows cite integer-payloads §4 (§3 for the clip) and
  integer-operators §13.2; SPEC §7 names both; CHANGELOG section started.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 4 (WIP: committed before running): the differential's conditional-codec half ... e2ae159456

D2c M4, gate 4. tests/int_ops_differential.rs gains int_hyper:
int_hyper_planned_break (either network refused at load by its lowering for
a rule the direct decode does not make; the shared load_break), a generator
of random WHM1 h_s/g_s pairs, entropy tables and WIH1 payloads whose latent
symbols are coded against the tables the direct decode's sigma buckets them
to, int_hyper_random_sets_and_payloads_decode_alike, and
int_hyper_planned_breaks_are_new_refusals.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 3: the registry export ... 9751c56552

registry/capabilities.json regenerated (wai registry export) with the ops
members of wai.neural.int_hyper and wai.video.int_hyper: whm1/1, rans64
t4097/lenient/canonical, bucket ceil.

Gate 3 green (on this commit's tree; logs wai-build/logs/d2c-m4/g3, g3v):
int_hyper_ops debug and release EXIT=0 (6 passed: the 33 committed
fixtures, the 27 one-change fixtures, the six layers' range edges); the
CI lib-test step EXIT=0 (830 passed, the registry's ops test included);
registry export --check EXIT=0; check-wai-section-refs.py EXIT=0; no file
changed by the builds but this one.

Falsified, Part 3.5 row "refusal parity: X_l + 1 used as the check bound"
(check_x in wai-ops' lowering): Red: int_hyper_ops EXIT=101, the edge test
"tiny_h_s.bin layer 0: 3222701620144926 runs directly: layer 0:
accumulation could leave i64" (the graph accepts what the direct decode
refuses), and at X_0 + 1 h_s no longer loads under acc64, so every decode
through the lowering is refused (model_mismatch) where the direct decode
decodes. Restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 4: compile fix in the generator (one borrow of the generator per call) ... 6dcf3e19db

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 4: a wider hyper-latent in the generator; the decodable floor at an eighth ... 6d8ea3c87d

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 4: the nightly differential names the conditional codec ... ea7a230cef

D2c M4, gate 4 (differential), its record. tests/int_ops_differential.rs's
int_hyper half needs no further feature (neural_int, through legacy_int), so
the nightly's features stand; its header names the decoder.

Green (logs wai-build/logs/d2c-m4/g4): the whole differential file, debug
and release, EXIT=0 (8 passed). int_hyper, 3000 cases from the default
seed: 462 decoded alike; refused by both FieldRange 730, GeometryMismatch
328, ModelMismatch 853, StreamExhausted 82, StreamNoncanonical 76; planned
breaks: bias 225, unmeetable check range 2, unused shift/gf 141, no tag
0/1/2 layer 101. int_hyper_planned_breaks_are_new_refusals ok: each break
on a set the direct decode decodes (no tag layer in h_s; an unused h_s
shift; an unused g_s gf) or refuses with another code (a g_s bias at
i64::MAX: field_range after both streams; an h_s bias at i64::MIN with a
hyper-latent stream that runs out: stream_exhausted; an unmeetable g_s
range: field_range), all model_mismatch through the lowering.

Falsified (no Part 3.5 row; a fault only random sets reach: every committed
conditional-codec convolution has stride 1): int_ops::whm1_net lowers a
convolution's stride as 1. int_hyper_ops (gates 1-3) stays green, EXIT=0,
6 passed; the differential EXIT=101, "new Err(GeometryMismatch), direct
Some(Ok(..))", seed 40882766991264310. Restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 5 (WIP: committed before running): the fast kernels behind the interpreter, the IGDN kernel lent ... 03d5e8d60f

D2c M4, gate 5 (fast-kernel parity), and M3's open item: the host lends the
interpreter its fast inverse-GDN kernel.

- int_ops::Host: an igdn operator runs on int_kernels::igdn (its narrow,
  64-bit and 128-bit paths), declined back to the interpreter where, on the
  values present, a term or the norm could pass i128 or the root or output
  i64 (§13.2's P_l read on the actual values; no certified graph forms one),
  or gf or frac exceeds 127.
- int_kernels: a test-only count of fast IGDN runs (testkit::fast_igdn_runs).
- int_ops::equivalence: the_conditional_codec_runs_its_networks_on_the_fast_kernels
  (tiny: 4 convolutions and 1 inverse GDN on the fast kernels under every
  fast policy, 0 under the reference, the interpreter's bytes);
  inverse_gdns_equal_the_interpreter (int_transform's IGDN equivalence held to
  the interpreter: random gf, frac, gamma and beta of either sign, inputs on
  each of the kernel's three paths); whm1_convolutions_equal_the_interpreter
  (int_hyper_synth's kernel_equivalence held to the interpreter: WHM1's rq,
  strides to 16, i32/i64/mixed operands). The splat and audio tests now count
  their inverse GDNs on the fast kernel too.
- tests/int_hyper_ops.rs: every_kernel_policy_decodes_through_the_lowering_alike
  (reference and fast(1|2|5|0) on WIH1, its JSON form, the JSON models, and
  sets with a hyper-latent channel about h_s's input range).

Green (logs wai-build/logs/d2c-m4/g5): --lib int_ops debug and release
EXIT=0 (9 passed); int_hyper_ops debug and release EXIT=0 (7 passed);
byte-exact cargo test --release EXIT=0 (103 passed, the two pre-existing
CondPlan warnings only).

Gate 4's timed runs, on gate 4's tree (logs g4-timed*): 300 s per profile,
seed 20261015, no disagreement, EXIT=0 both: debug 79,998 cases (12,560
alike; breaks bias 6,563 / unmeetable 47 / unused 3,969 / no tag 2,645),
release 3,349,906 cases (529,718 alike; breaks 273,794 / 2,210 / 163,351 /
109,491).

Falsified, M1's row for this gate (every channel requantised with channel
0's parameters, int_ops::conv): Red: --lib int_ops EXIT=101 (all three
convolution equivalences, the new whm1 one included, and the three decoder
tests); int_hyper_ops EXIT=101 (5 tests: the policy test, and, since the
production policy is fast, the goldens, fixtures and range edges).
Restored.

Falsified, the IGDN arm (the fast IGDN given gf - 1): Red: --lib int_ops
EXIT=101: inverse_gdns_equal_the_interpreter ("c=5 gf=24 frac=12" differs
under fast(1)) and the conditional codec's, splat's and audio's decoder
tests, while the three convolution equivalences stay ok; int_hyper_ops'
every_kernel_policy_decodes_through_the_lowering_alike EXIT=101. Restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 6 (WIP: committed before running): the switch ... 6e1a05587c

D2c M4, gate 6.

- int_hyper_synth::decode_conditional_checked decodes through the integer
  operator set (ops::decode); the direct decode (legacy, with its
  run_net_checked wrapper) is cfg(any(test, feature = "legacy_int")).
- int_payload: the WIH1 decode, the WIV1 keyframe and the declared cost run
  one pre-stream check (cond_checked) in integer-payloads §7's order: the
  plan, the keyframe's size against the clip's, then h_s and g_s lowered and
  loaded; the decode then runs from the loaded networks
  (ops::decode_loaded), holding the set as its networks and tables.
- tests/int_payload_cost.rs: the conditional codec's set allowance is its
  tables and networks parsed, lowered and loaded; with them loaded
  beforehand, the decode must hold no more than the declared working bytes.
- tests/int_hyper_ops.rs: the scan (every committed set of both capabilities
  meets the new load rules; every committed WIH1 payload, found by its magic
  in the conformance corpora, decodes through the lowering exactly as
  directly).
- Text: integer-payloads §4 (h_s and g_s through whm1/1; the sigma/mu split
  a driver step after the shape check; the RGB8 step ends g_s's graph), §7
  (the set rule; the order: shapes, then h_s and g_s lowered and loaded; for
  a WIV1 keyframe, its size before its networks' lowering; Exactness);
  integer-operators' status note and §15.3 item 3; SPEC §8; CHANGELOG.

Green (logs wai-build/logs/d2c-m4/g6 and d2c-m4-g6, land/d2c-m4-g6):
gate.sh d2c-m4-g6 GREEN (build, lib-tests, carriage, corpus loop 21/21,
fast-kernels, byte-exact, wai-web wasm32 check, neural gates); the release
fast-kernels step EXIT=0; int_hyper_ops EXIT=0 (8 passed, the scan
included); int_payload_cost debug and release EXIT=0; cargo check --lib with
neural_int alone and video_int alone EXIT=0, no warning; the SOTA step on the
regenerated vectors EXIT=0, no skip banner; wai-ops debug and release
EXIT=0; wai-verify vectors verify EXIT=0 (every file verifies); the Python
checker EXIT=0; wai-web native EXIT=0; wasm32 release + wasm-bindgen 0.2.127
EXIT=0, and under Node: verify_int_payload_wasm (tiny WIH1 dce7282d…,
video_nk 4a81f0c9…), verify_int_synth_wasm, verify_int_hyper_wasm on the
pretrained set (eb1acd2159f8a966, the native hash) and verify_staged_wasm
all EXIT=0. No tracked file changed by the builds.

Memory: with its networks loaded beforehand, the tiny decode holds 16,470
bytes against 16,480 declared; the whole decode held 28,038, within the
declared working bytes and the set's allowance.

Falsified, row "rq floor -> half_up in whm1/1", the switch live: Red:
byte-exact EXIT=101 with the file-based wih1_payload_is_byte_identical and
wiv1_keyframe_1_payload_is_byte_identical FAILED (green under the same
fault at gate 2) beside the through-the-lowering ones; --lib int_payload
EXIT=101 (wih1_json_equivalence, wiv1_json_equivalence, decode_int_without_
neural …); tests/int_payload.rs EXIT=101; the corpus verify EXIT=1 ("FAIL
tiny … stream_noncanonical", "FAIL video_nk …"). The unchecked
neural_keyframe goldens stay green until gate 7 moves them. Restored.

Falsified, the memory claim: the decode keeps a copy of its hyper-latent.
Red: int_payload_cost EXIT=101, "int_hyper, set loaded: held 16534,
declared 16480". Restored: 16,470.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 7 (WIP: committed before running): the unchecked decode goes ... e4c7287acb

D2c M4, gate 7 (delete).

- int_hyper_synth::decode_conditional, the unchecked conditional decode, is
  deleted; its callers decode through decode_conditional_checked (the
  lowering, with its check ranges): the int_hyper_decode_frame example (step
  3 of tools/wai_sota_vectors.sh), wai_decode_bench's tiny-vector case,
  int_payload's JSON-equivalence unit tests, tests/int_hyper_synth.rs,
  int_kernels_vectors.rs, int_video_keyframe.rs, int_video_sota_keyframe.rs,
  and byte-exact's neural_keyframe_golden (the trap: it gains the check
  ranges, outputs equal; gate 2's duplicate test through ops::decode goes).
- The pretrained synthesis-only and hyper-decoder-only goldens
  (tests/int_hyper_synth.rs) are also held through the lowering.
- The conditional codec's direct guard (legacy's run_checked) is test-only
  since gate 6. run_net_checked, check_layer and igdn_check stay: their one
  production caller left is int_mlicpp (M5); run_net and decode stay for the
  world renderer (M6), and int_hyper_synth's kernel_equivalence with them,
  since their conv dispatch is still run_net's. Docs say so.
- Doc references (int_video, int_video_golden, two tools) and CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

int_hyper gate 7: the decode checks its image against its plan (CondPlan.gs is read where the direct decode no longer is) ... 0076f947db

Gate 7 green (logs wai-build/logs/d2c-m4/g7): --lib with
--test int_kernels_vectors, int_video_keyframe, int_hyper_ops and
int_hyper_synth EXIT=0 (343 lib tests); the SOTA step on the regenerated
vectors EXIT=0, no skip banner (the decode-frame example, the clip and the
synthesis-only and hyper-decoder-only goldens now through the lowering);
the example and wai_decode_bench build, and the bench's int_hyper case
runs with every policy's output identical; cargo check --lib with
neural_int alone and video_int alone EXIT=0, no warning; byte-exact
EXIT=0 (102 passed; only its two pre-existing CondPlan warnings, which a
third, CondPlan.gs, joined until this commit read it); no tracked file
changed by the builds.

Falsified (what carries the guard now): the test-only direct decode's
run_checked runs the networks unchecked (run_net). The production decode
stays green: --lib int_payload (22 passed), tests/int_payload.rs (every
fixture's code), int_kernels_vectors, int_video_keyframe,
int_hyper_synth's tiny vector, the corpus verify, byte-exact's int_hyper
goldens, all EXIT=0; while int_hyper_ops EXIT=101, the per-rule parity
fixtures: "hyper-latents past h_s's range: through the lowering, then
directly" (field_range, stream_noncanonical). Restored.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Merge origin/main (at ca79392a, with #264, #265 and #263) into wai/d2c-m4 ... 2143d25bd5

CHANGELOG: both sides kept (the conditional codec's section, then
wai-quantum 0.5.1's, then the audio and splat sections).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: keep loaded parameter sets between decodes, keyed by the SHA-256 of their bytes (WIP) ... e2a93241e7

A decode through the integer operator set lowers its set and loads each graph,
the bounds pass included, on every call. int_set_cache::LoadedSets keeps a set
once it has loaded, keyed by (capability, lowering, profile, SHA-256 of the
listing of the members read), within a byte budget (256 MiB, LRU, 0 = off).
int_payload::decode_int / declared_cost and int_synth::decode_from_spec take
the load step from it; every other check runs as before. A refused set is
never kept. wai_ops::Graph::heap_bytes counts an entry's graphs.

Committed before the first build; results follow.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the store's constants stay out of the C header; tests take their store-off outputs first ... 0f2cc11ecb

LoadedSets::DEFAULT_BUDGET and INDEX_BYTES_PER_ENTRY are associated consts, and
int_ops::PROFILE is crate-only, so cbindgen exports none of them (the first build
wrote two #defines and an opaque Profile into include/wai.h; that change is not
kept). A budget of 0 empties the store, so the tests decode with the store off
before they fill it. A whm1/1 set with a huge multiplier still loads (its check
ranges shrink to fit) and is refused at run time; the refused conditional-codec
set is now one whose layer-0 bias leaves no admissible input range, refused as it
is lowered.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: int_set_cache test checks keys after the decodes, so a shared entry shows as a wrong image first ... 5b9d63704a

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: include/wai.h as build.rs regenerates it (the store's two associated constants) ... 1bd2547b45

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the loaded set's key reuses the listing digest resolve formed for check 5 ... e0a741db36

An unpinned resolve (and a pinned one with a key log) already hashes every member
the decode reads and their listing, for check 5. IntParams keeps that listing's
SHA-256 with the member names it was formed over, and the key of the loaded set
uses it only for a capability that reads exactly those members; any other key
hashes the bytes (IntParams::read_digest). The bytes are borrowed for as long as
the parameters live. Measured before this change: the key's SHA-256 of the
pretrained set (24 MB, software SHA-256) was about 58 ms of a ~110 ms decode with
its set held.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: CHANGELOG: the key reuses resolve's listing digest ... 5c456dc48d

Co-Authored-By: Claude Opus 5.5 <[email protected]>

wai: the store stays out of the sources the byte-equality crate includes ... 4d7b9e28fd

byte-exact-conformance #[path]-includes int_synth.rs and int_hyper_synth.rs, and
has no int_set_cache, codecs or pin module, so gate.sh's byte-exact step failed to
compile. int_synth::decode_from_spec is now three steps (check_payload,
load_spec, decode_loaded) and loads its set every time, as before the store;
int_payload's wai.neural.int_synth decode takes the middle step from the store.
wai-web's decodeIntSynth decodes through decode_int, as the other payload entry
points do (a refusal's message now starts with its code). The Resident impl for
int_hyper_synth::ops::Nets moves into int_set_cache.rs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit f5dd8113d1 into main 2026-10-15 20:41:28 -04:00

dcharlot referenced this pull request from a commit 2026-10-15 20:41:29 -04:00

Merge pull request 'wai: keep loaded parameter sets between decodes, keyed by the SHA-256 of their bytes (O23)' (#268) from wai/o23-loaded-set-cache into main

dcharlot referenced this pull request 2026-10-15 21:25:13 -04:00

wai-ops: load step 8 in closed form; a lowered network loads once; SHA-256 on 64-bit Arm #271

dcharlot referenced this pull request from a commit 2026-10-16 02:19:24 -04:00

Merge remote-tracking branch 'origin/main' into wai/bounds-pass-speed

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!268

No description provided.