# WAI Extension: Energy-Landscape Jobs (`wai.quantum.landscape/1`) Status: **Draft.** Reference: the `quantum_landscape` feature of `wai-quantum` (`wai_quantum::quantum_landscape`), the command `wai-quantum landscape`, and `QuantumEngine.landscape` in the browser build. Answer schema: `wai-quantum/schemas/landscape.v1.json`. Conformance set: `quantum-conformance/landscape/vectors.json`. Results: `quantum-conformance/landscape/`. Verifying a sealed answer: §5.4, in `wai_quantum::engine::landscape`. A job on a person's own device or service: the provider protocol's §11 ([quantum-providers](quantum-providers.md#11-energy-landscape-jobs)). The second version, `wai.quantum.landscape/2` ([quantum-landscape-2](quantum-landscape-2.md)), adds a cost for each variable, so that one-hot, at-most-one and cardinality constraints can be written, and prices joules only at a rate with evidence in this repository; this version is unchanged by it. Keywords **MUST**, **MUST NOT**, **SHOULD** and **MAY** are RFC 2119/8174. ## 0. What this extension adds A job of this kind gives no circuit. It states an energy over variables of three states and asks for a state of low energy. A machine that takes such a job settles: each cell adds up the pull of the cells it is coupled to and moves to the state that pull favours, with or without randomness, until the whole comes to rest. This text is the job, the answer and the seam between them and the device that runs them. The same job can be run by the reference in software, by a GPU or by an FPGA board, and its answer names what ran it, says how far that device is held to the reference, and states its joules so that a priced figure can never be read as a measured one. The reference is a classical emulation. Its cells are three-state values sampled with classical random draws. Nothing here is a quantum effect, and no run of the reference involves any device but the machine it runs on. ## 1. The energy ```text E(s) = − Σ_{i i`, as doubles; 1 if there are none. 2. A weight with `|w| > m/2` becomes the coupling of its sign; any other weight becomes 0, and is dropped. 3. Each field `b_i` becomes `round(b_i / m)` and the cost `round(c / m)` (at least 0), dividing as doubles and rounding half away from zero. A result above 2⁴⁰ in size is refused: the weights are too small beside the fields and the cost. The answer MUST say what was lost (`declared.quantised`: the scale, how many were declared, kept and dropped, and the relative error `√(Σ(w − m·t)² / Σw²)` with `t` each weight's coupling), give the energy of its state on the weights as declared, and where every arrangement can be checked say whether that state is the lowest on them (`declared`, §3). Two energies on declared weights are equal within 10⁻⁹. A program whose sizes matter does not run on this model, and its answer says so rather than reaching a low energy on signs that mean something else. ## 3. The answer A `run` answers with these fields (the schema has them all): | field | | |---|---| | `protocol` | `wai.quantum.landscape/1` | | `label` | what kind of run this is, in the member's own words (§5.3) | | `member` | what ran it: `id`, `class`, `kernel`, `parity`, the `capacity` that parity holds within, absent where none is declared (§5), and `demoted`, why the host holds it at `uncertified`, where it does (§7.3) | | `program_digest` | BLAKE3 of the program's bytes | | `seed`, `mode`, `temperature`, `temperature_from`, `restarts`, `sweeps` | how it ran; `seed` is a decimal string; `mode` is `settle`, `quench` or `sample` | | `state`, `energy` | the state of lowest energy found, and its energy from the program | | `truth` | every arrangement checked (up to 16 variables), else null: `arrangements`, `lowest`, `at_lowest`, `at_lowest_passing` and `example` | | `reached` | whether `energy` is `truth.lowest`; null where there is no truth | | `declared` | for a program with `weight`s: §2.2; else null | | `warnings` | what the reader found in the program: `code`, `line`, `text` | | `checks` | each `#! check`, graded on `state` | | `verdict`, `summary` | `solved`, `missed`, `failed` or `unchecked`, and the sentence that says why | | `work` | `sweeps`, `accumulates`, `cell_updates`, `draws`, `ended`, `rests` | | `joules` | §4.4 | | `state_hash`, `replay` | §3.2 | | `refusals` | each member that a placing host passed over, with why (§5); absent where there was none | | `audit` | what the host's audit ran again on the reference, for an answer from a kernel graded `bit-exact`: `checked`, each run's `seed` with the `chains` of it checked, or how much of a `settle` (§7.3); absent where nothing was audited | A `replay` answers with `protocol`, `label`, `member` (`id`, `class`, `kernel`, `parity`, `capacity`, `demoted`), `seeds` and `lines`. A `sweep` and a `compare` give `member` as `id`, `class`, `capacity`, `demoted` and `kernels`, each kernel the job used with the parity the host found for it; each row of a `sweep` gives its own `kernel` and `parity`, and each of a `compare` the member's `parity`, null for a classical method. Each carries `refusals` and `audit` as a `run` does. An accumulate is one read of one coupling into one cell's field, and is the unit of work. The accumulates of a sweep are the non-zero entries of `W`, counting each pair twice, whatever device does it. ### 3.1. The verdict `failed` means the answer does not solve what the program states. A host MUST report it when: the deterministic mode never came to rest; it ran out of sweeps; the answer fails a `#! check`; the lowest states of the landscape fail the program's check, in which case the landscape itself does not express the problem, whatever a run returns; or the answer misses the lowest energy on declared weights. A host MUST grade every lowest state, not just the one it found: an answer can pass by luck where the landscape is wrong. `at_lowest_passing` holds that count. `missed` means the truth is known and the run did not reach it. `solved` means it did, or that a check passed where the truth is out of reach, in which case the summary says nothing shows the energy is the lowest. `unchecked` means neither a truth nor a check exists. A job that ran exits as success on a command line, whatever its verdict. ### 3.2. Replay The digest's restarts are 1 for a settle, and its sweeps are the plan's sweeps, the `steps` asked, not the sweeps a settle ran. `state_hash` is FNV-1a over the state's cells, each the byte `s + 1`, printed as 16 hex digits. `replay` is BLAKE3 over, in order: the protocol's name and a zero byte; the program's length (u64, little-endian) and its bytes; the seed (u64, little-endian); the mode's name and a zero byte; above temperature 0, the bits of the starting temperature (IEEE 754 binary64, as a u64, little-endian); the restarts (u64, little-endian); the sweeps (u32, little-endian); the state's cells, each the byte `s + 1`; the energy (i64, little-endian). The digest leaves out the member and the work. Two members that give the same bits give the same digest, and anyone can re-run a job on any member held to bits and compare. For a member with draws of its own (§5.1) the digest identifies the answer and cannot be reproduced from the seed. The energy can always be recomputed from the program. ## 4. The kernels A host's plan is one of three, from the run line and the request's temperature `T`: | run line | `T` | plan | starts | sweeps | |---|---|---|---|---| | `minimize steps=S` | none, or 0 | `settle`: from every cell at 0, stopping when it comes to rest | 1 | at most `S` | | `minimize steps=S` | above 0 | `sample`, cooling from `T` | 8 | `S` each | | `solve restarts=R steps=S` | 0 | `quench`: chains at temperature 0, every sweep run | `R` | `S` each | | `solve restarts=R steps=S` | above 0 | `sample`, cooling from `T` | `R` | `S` each | | `solve t0=T₀ …` | none | `quench` if `T₀` is 0, else `sample`, cooling from `T₀` | `R` | `S` each | | `solve …` without `t0` | none | `sample`, cooling from the default start (§4.3) | `R` | `S` each | A `settle` runs the settle kernel; a `quench` and a `sample` run chains through the sampling kernel, a quench's every sweep at 0. Of many starts the host keeps the first state of lowest energy, in order of start. ### 4.1. `wai.quantum.landscape/settle` Each cell adds up its field, `h_i = b_i + Σ_j W_ij s_j`, and moves to +1 when `h_i > c`, to −1 when `h_i < −c`, and to 0 otherwise. A sweep reads all the fields from the same state, then moves all the cells. A settle ends at a fixed point (the state did not change), a two-cycle (the state returned to the one two sweeps back; the state reported is the one the last sweep computed) or the bound. Everything here is whole-number arithmetic: the result cannot depend on the order a field is added in, on how many lanes a device has or on how it splits the cells. A settle kernel MUST give the reference's bits. A workload's **field bound** is the largest `|h_i|` any state can give a cell: `max_i (|b_i| + deg_i)`, with `deg_i` the number of cells coupled to `i`. It, and not the largest `|b_i|`, says how wide a lane must be to hold every field. A `quench` runs chains through the kernel of §4.2 at temperature 0, whose every sweep is this one. ### 4.2. `wai.quantum.landscape/sample` Cell by cell, in order, each reading the states the cells before it have just taken, a cell draws its next state with the Boltzmann weights of its field: ```text P(s) ∝ exp((h·s − c·|s|) / T), s ∈ {−1, 0, +1} ``` Updating every cell at once from one common old state does not sample this model's joint distribution: two coupled cells would each follow the other's old value. A kernel that does so fails the battery of §7.2 and is not granted `statistical`. A kernel that colours its cells properly, so that no two coupled cells move at once, can pass it. **The schedule.** The host gives a member every sweep's temperature. A chain of `K` sweeps cooling from `T₀` has, at sweep `k` (from 0), `q = k / (K − 1)` and `T_k = T₀ − T₀·q`, each operation rounded to the nearest double in that order; a chain of one sweep is at 0. So the last sweep is at 0, where a sweep is §4.1's. The conformance set pins the schedule's bits (§7.1). **One draw, two cut points.** For a field `h` at a temperature `T` above 0, with `β = 1 / T`, `l₋ = −h − c`, `l₊ = h − c` (whole numbers, exact as doubles) and `m` the largest of `l₋`, 0 and `l₊`: ```text w₋ = exp(β · (l₋ − m)), w₀ = exp(β · (0 − m)), w₊ = exp(β · (l₊ − m)) z = (w₋ + w₀) + w₊ a = ⌊ (w₋ / z) · 2⁵³ ⌋, b = ⌊ ((w₋ + w₀) / z) · 2⁵³ ⌋ ``` every operation a double rounded to the nearest, in the order the parentheses give, and `exp` the function of Appendix A. A 53-bit number `u` gives −1 if `u < a`, 0 if `u < b`, else +1. A device needs a table of cut points for the fields it can see at each sweep's temperature and two comparisons a cell. It needs no exponential and no floating point. The host may give it the table. Cell `i` only ever sees `b_i − deg_i` to `b_i + deg_i`, so a table of those fields, where two overlap taken once, holds at most `4P + n` entries a sweep however wide the fields are, and at most `2B + 1` for a field bound `B`. **The reference's draws.** They come from a counter, not from a state carried along: ```text mix(x): x ^= x >> 30; x *= 0xBF58476D1CE4E5B9; x ^= x >> 27; x *= 0x94D049BB133111EB; x ^= x >> 31 out(s, j) = mix(s + j · 0x9E3779B97F4A7C15) (64-bit, wrapping; j ≥ 1) ``` For a run's seed `S`, start `r` (from 0) has the chain seed `C = out(S, r + 1)`; its cell `i` starts at `out(!C, i + 1) mod 3 − 1`; and the draw of cell `i` in sweep `k` is `out(C, k·n + i + 1) >> 11`. Any draw can be computed alone, so chains may run side by side and still give the reference's bits. The exponential of Appendix A uses `+ − × ÷` alone, so it gives the same bits on every IEEE 754 platform; the conformance set pins its values and the cut points it gives (§7.1). A device takes the table from the host, or computes its own and is held to it. A member MAY use draws of its own, and then its parity is `statistical` at most. ### 4.3. The default start A `solve` with no `t0` starts at `max(1, √(2·P/n))`, where `P` is how many pairs are coupled: the square root of the mean couplings a variable has. The answer's `temperature_from` is `landscape`, and its words say this is the default. A starting temperature set from the largest row of couplings is hotter than most instances need, and at the same budget does worse on the larger instances of the published table; the table's `start_temperature` section has the numbers. ### 4.4. How the joules are stated `joules` is an object with `kind: "priced"`, always. It is this run's accumulates multiplied by a rate measured elsewhere, with that rate's source named. A host: - MUST state the figure as priced, and MUST NOT call it measured, read, or metered, in `line` or anywhere an answer's reader sees it. `rate_source` may say the *rate* was measured, and on what. - MUST state its class in the terms of [energy-measurement](energy-measurement.md): `ModelBased` for the figure, which describes the board the rate was calibrated on and says nothing of what the machine that ran the job spent (`describes`), and `Estimator` for the published add's figure (`published_add`). - MUST price temperature 0 and sampling at separate rates. Sampling costs more. - MUST say what the rate leaves out (`left_out`): a rate that is a difference cancels the board's own draw, so a small job prices low, by an amount the answer gives from the fewest clocks the work could take. - MUST NOT print an uncertainty it does not have. A member with a meter puts its reading in `joules.metered`: `{ "joules_micro": …, "window_us": …, "class": …, "scope": … }`, with the class and the evidence energy-measurement asks of that class. Over a run of several calls the figure and the window are each the calls' added up, and so is the window of the class's uncertainty; its relative part is the largest a call declared. `scope` says what the figure covers where that is more than the run: a counter that reads a whole rail or board holds its idle draw and any other work on the device in the window, and says so; null is the run alone. The reading stands beside the priced figures and does not replace them, so the two can be compared, and the answer's `label` says it is there and what it covers only where it is. Where there is no meter or no reading, `metered` is null. No figure is `0` for being unmeasured. The reference's rates: | | pJ per accumulate | from | |---|---|---| | temperature 0 | about 0.16 | one FPGA board, a dense 64-cell test design at 100 MHz, the slope of power against clock speed | | sampling | about 0.41 | the same board: about 0.25 more, from paired readings at one temperature, 0.25, on a design that updates all its cells at once | | for scale | about 0.03 | a published 2014 figure for one 8-bit integer add in 45 nm logic: a reference point, not a model of any processor, with no term for sampling | | left out | about 3.1 W at every clock | the same board's own draw, at 100 MHz | These are the numbers of one board and one meter. They are not part of the protocol: another host MAY price at rates of its own, with their sources named. What stands behind them, stated plainly (2026-11-10): the readings of the board the two rates were read on are not in this repository. The sampling rate's increment was read on a design that updates every cell at once, which does not sample this model (§4.2). And this project's own FPGA member, `wai/wai-quantum-landscape-fpga`, measured its settle at about 0.88 pJ an accumulate (its README, *What it measured*), more than five times the 0.16 above, so a priced line here is low against this project's own hardware. The rates are kept as they are so that this version's answers keep their bytes: the replay lines of §2 hash each whole answer, its joule line among them. The second version ([quantum-landscape-2](quantum-landscape-2.md) §4.3) prices only at a rate whose evidence is in this repository, never below what this project's hardware measured, and leaves a run above temperature 0 unpriced, saying why. ## 5. Members A member runs the two kernels and nothing else. The reader, the truth, the energy of the state it returns, the checks, the verdict, the replay digest and the seal stay on the host, and do not trust the member. What the host gives a member: the lowered workload (`n`, the couplings as compressed rows, the fields, the cost); for a settle, a start and a bound; for chains, each chain's start and chain seed, and every sweep's temperature (§4.2). A host gives at most one batch of chains at a time (§2.0). What a member gives back, for a settle or each chain: the state, the sweeps, how it ended, the accumulates and the draws. **Declared capacity.** Real hardware holds so many cells, fields so wide, a table so large. A member declares what its kernels hold, once and before anything runs, as fixed numbers (`member.capacity`, each of them optional, none declared being no limit): | number | what it bounds | |---|---| | `cells` | the cells of a workload | | `couplings` | its couplings, each pair counted twice (`2P`) | | `at_zero`: `field`, `field_bound`, `cost` | for a run with a sweep at temperature 0 (a settle, a quench, the end of a schedule): the largest `\|b_i\|`, field bound (§4.1) and cost | | `above_zero`: `field`, `field_bound`, `cost` | the same, for a run with a sweep above temperature 0 | | `table_entries` | above temperature 0: one sweep's cut points over the fields the cells can reach (§4.2) | | `uncertain_span` | above temperature 0: the span, first to last, of the fields the cells can reach whose draw is uncertain at a sweep's temperature, where it is not the threshold's `(0, 0)`, `(0, 2⁵³)` or `(2⁵³, 2⁵³)`. Those fields at a temperature hold those at any lower one, so the hottest sweep's span is the widest, and it is the one held to the number | | `sweeps` | the sweeps of one run: a settle's bound, a schedule's length | | `chains_per_call` | the chains it takes in one call. Not a limit on a job: a host splits a job into calls of at most this many, and certification splits every vector the same way (§5.1), so no job goes elsewhere for it | A workload fits when every declared number but `chains_per_call` holds for it. Whether it does is a function of the workload, its schedule and the declared numbers alone: the host works it out, and declines for the member exactly the workloads that do not fit, saying which number each is past. A member declines nothing by choice, job by job, and is run on no workload past its capacity, however it was reached. A member that refuses or fails a workload within its capacity has failed it. The reference declares no capacity. **The floor.** A member's declared numbers MUST be at least the floor's, or the host does not certify it at all, so that no member is certified by declaring itself too small to be held to anything. The floor is the least capacity that takes every case of the core set (§7.1): the settle, chains and battery cases the set held before it grew to reach large jobs. Its numbers are 32 cells and 992 couplings (the recall vector of 32 cells, every pair coupled); on each side of temperature 0, fields to ±40, a field bound of 41 and a cost of 8 (the wide-fields chains, run cooling and quenched at 0); 31 entries of cut points a sweep (the dense chains of 16 cells, every pair coupled, at their hottest); an uncertain span of 61 (the wide-fields chains at their hottest); and a run of 5,000 sweeps (the core set's long schedule, §7.1). It declares no batch: any number of chains a call is certified by splitting. A device that cannot hold these cannot be held to the core set, and the grade would vouch for nothing. **Generated vectors.** A finite set samples each axis of a workload at a few points, and a declared number takes vectors out of it. So the host also holds a member to vectors it generates from the member's capacity, by the rules of §7.1, with the reference's bits as their expected bits and the same on every host. Some are generated for every capacity, the reference's none among them, so that a member is held across each axis up to what its capacity lets a workload reach: every cell count at and beside a power of two, every call size to 32 chains and each band of a wavefront past that, the longest row, fields at each lane's wrap points, a corner with every number at its most, and a run past a 24-bit draw index. Others are generated for each number a member declares below what a job can reach (§2.0: 4096 cells; 838,860 couplings, two for each ten bytes of the longest program; a field and a cost of 2⁴⁰; a field bound of 2⁴⁰ + 4095; a table of twice the couplings and the cells; a span of twice the field bound and one; 1,000,000 sweeps), at exactly that number, each also within every other number declared. A table or a span is reached through couplings; where the other declared numbers do not let a workload reach it, the vector reaches as far as they do. Only vectors the capacity admits are run. So a grade is earned across a capacity and at its edges, not only at the fixed vectors inside it. No finite set catches every fault, so the host then audits every answer from a kernel it graded `bit-exact` (§7.3). **Placing a job.** A host offered several members gives the job to the first that can take it: one whose kernel is certified for every kernel the job runs (§5.1), within whose capacity the workload fits at every schedule the job runs, and that gives an answer the host's checks keep. Each member passed over, for any of those, is named under `refusals`, in the order offered, with why; with none, `refusals` is absent. A member that took the job and failed it, or whose answer the checks refused, is passed over the same way and the next is asked. Where no member answers, the job is refused, naming each with why. Offering the reference last gives every job an answer. **Batches.** A host MAY give a member the starts of several seeds' runs in one call, up to one batch (§2.0). Each run is the one it would be alone: the same chains, its best state chosen in the same order. A meter's reading (§4.4) stands for a run only where every call of that run carried that run alone, and a settle that answers several seeds from one call carried none of them alone; elsewhere `metered` is null. A host MUST check what comes back, and refuse the answer with one plain sentence if any of these does not hold: - the state has the right length and every cell is −1, 0 or +1; - for a settle: 1 to `bound` sweeps; accumulates `2P` a sweep and no draws; a fixed point that rests (no cell would move); a two-cycle of period exactly 2 (one sweep moves the state, a second returns it), after at least 2 sweeps; a bound reached only after `bound` sweeps; - for a chain: every sweep of the schedule run; accumulates `2P` a sweep and `n` draws a sweep above 0; and the ending a fixed point exactly when the state rests. It MUST recompute the energy from the program. So a member can be wrong about a state only by returning a worse one, and it cannot price itself low. How many sweeps a settle took before it came to rest can be checked only by running it again: a `bit-exact` certificate is what vouches for it. The reference implementation has three GPU members besides the CPU reference, each certified by the host on its own run of the conformance set within the capacity it declares (informative): through WebGPU (a field bound of 2³¹ − 1 on both sides of temperature 0, which its 32-bit lanes hold; cells and couplings within a 32nd of a storage binding; 4,194,304 entries of cut points a sweep. It holds a cost above every field at its lanes' top, where it holds every cell at 0 as it does at its own size, and its coloured kernel can be `statistical` at most), and through CUDA and Metal (64-bit fields, and 4,194,304 entries of cut points a sweep, which no job reaches). An FPGA board (`wai/wai-quantum-landscape-fpga`) declares 64 cells and, above temperature 0, fields to ±524,287, a cost to 1,048,575 and an uncertain span of 8,192, its registers and its table's window. All three run the sampling kernel one chain a thread, the cells in the reference's order, with the reference's draws and the host's cut points for the fields the cells can reach, a window of sweeps a dispatch, each window waited for before the next is sent; and give its bits. A member names itself `class:name`, with `class` one of the fabric's (`cpu`, `gpu`, `fpga`) and the class it gives, and `name` lower-case letters, digits, `.`, `_` and `-`, at most 64 characters in all. `cpu:reference` is the reference's, and no other member's. ### 5.1. Parity A member does not state its parity: the host finds it, by running the member's kernels on the conformance set (§7) within the member's declared capacity (§5) and at its edges, and an answer states what the host found for the kernel the run used (`member.kernel`, `member.parity`) and the capacity it holds within (`member.capacity`, absent where none is declared, so that the reference's answers are what they were). A parity is a statement about the jobs within that capacity, and no others. | parity | granted when | |---|---| | `reference` | to the host's own reference kernels, and to nothing else | | `bit-exact` | settle: the member gives every `settle` vector within its capacity, and every one generated for it (§5), exactly. Sample: it gives every `chains` vector within its capacity and every one generated for it exactly, each case's chains in calls of as many as a host would give it at run time: the batch of §2.0, or `chains_per_call` where it declares fewer | | `statistical` | sample: not `bit-exact`, and every workload of the `statistical` battery within its capacity, and every battery workload generated for it, passes (§7.2), in calls of the same size | | `uncertified` | anything else, or a member the host was asked to run by name without certifying it | The host reads a member's capacity once, before anything runs: the floor is checked against that reading, the vectors are held to it, and every answer states it. A member is held to every vector within its capacity, and refusing one is failing it. A grade holds while the host's audit finds nothing (§7.3): at the first answer from a kernel graded `bit-exact` that differs from the reference's, the member is `uncertified` for both kernels from then on. The set holds vectors on both sides of a field bound of 2³¹ − 1, at it and just above it by the couplings alone, so that a member that declares 32-bit lanes is held to their edge. A capacity under the floor (§5) is not certified. A settle kernel can earn `bit-exact` on any device. A sampling kernel can, if it uses the reference's draws and order and the cut points of §4.2. A host placing a job never places an uncertified kernel (§5). A host MAY still run one when it is asked for that member by name, without placing it, which is how a board gets its first answers; the answer says `uncertified`, and nothing should be concluded from its state but its energy. Even then the host runs it on nothing past its capacity. ### 5.2. The receipt A host seals an answer in the form of every engine result: the request, and the result with `receipt` (`wai-quantum/schemas/receipt.v2.json`), a digest over both and an Ed25519 signature, verified by the rule every quantum receipt is ([quantum-providers](quantum-providers.md) §8.2 *The signature, strictly*). `member` is inside what is signed. The receipt says which key vouched for the answer and the answer says what ran it, so a board's answer sealed by the host that drove it names the board and names the host's key. `wai-quantum verify` checks it: the seal, and the answer's form by §5.4. A job sent to a person's own provider travels in this form, its operation and its request, and comes back as this answer; the client that sent it checks the answer by §5.4 and seals it, naming the provider (quantum-providers §11). ### 5.3. The label Every answer carries `label`, a sentence that says what kind of run this is. The reference's, word for word: > A classical emulator of the settling model of a planned energy-based processor, running on your machine. > Energies are computed exactly. The joule line is this run's operation count priced at > rates measured on an FPGA, with a published figure for one integer add beside it for > scale. No photonic hardware, custom chip or quantum effect is involved in this run. A member states its own, and MUST say what device ran the job, whether its joules are priced or read from a meter, and that no quantum effect is involved where none is. It calls a device what it is: a software driver that runs on the processor is not a GPU. An answer adds that a reading stands beside the priced figures, and what it covers, only where that answer carries one (§4.4); and, for a member that declares a capacity, that the host runs it on no job past that capacity, in its numbers, and, where the host certified it, that its parity holds within it (§5). A member run by name without certification claims no grade, and one the audit demoted says so and why (§7.3). ### 5.4. Verifying an answer A verifier holds a sealed job of this kind, its request and its answer, to the rules below, and reports `landscape_form` (quantum-providers §8.4) when any of them fails. A job is of this kind when its result's `protocol` or its `schema` is `wai.quantum.landscape/1`. Every rule is checked from the job alone, without reading the program: the rules hold that the answer is of its form, and that what anyone can work out from the request and the answer is what the answer states. The state, the member, its parity, the audit and the truth stay the host's word; the rules hold their form only. A number's value is its nearest double, and a whole number is one whose value is whole, however it is written (quantum-providers §8.2, §8.4). In the request, a member given as `null` is absent (§2); in the answer, `null` is a value. 1. The receipt's `canon` is `rfc8785`: no answer of this kind was sealed in the first form. 2. The result's `protocol` and `schema` are each `wai.quantum.landscape/1`, and its `engine` is an object whose `name` is `wai-quantum` and whose `version` is a string. 3. The request is of §2's form: `program` is a string of at most 4,194,304 bytes; `seed`, where given, is a whole number from 0 to 2⁶⁴ − 1, or a string of 1 to 20 ASCII digits whose value is at most that; `temperature`, where given, is a number, or a string `[0-9]+(.[0-9]+)?` of at most 40 characters, whose value is 0, or finite and at least 0.000001; `seeds`, where given, is a whole number from 1 to 100,000; `temperatures`, where given, is an array of 1 to 64 temperatures of that form; `parity`, where given, is `bit-exact` or `statistical`; `protocol`, where given, is `wai.quantum.landscape/1`; and `provider`, where given, is a string, not empty (quantum-providers §11.3). 4. The answer's operation is read from its members: a `replay` where it has `lines`; else a `compare` where it has `rows` and `target`; else a `sweep` where it has `rows`; else a `run` where it has `state`. An answer with none of them is of no operation: this rule fails, and the rules below that name an operation do not apply. 5. `label` is a string, not empty. 6. `member` is an object of exactly `id`, `class`, and `kernel` and `parity` for a `run` or a `replay`, or `kernels` for a `sweep` or a `compare` (a non-empty array of objects of exactly `kernel` and `parity`, no kernel twice), and optionally `capacity` and `demoted`. `class` is `cpu`, `gpu` or `fpga`, and `id` is that class, a colon and a name, not empty, of lower-case letters, digits, `.`, `_` and `-`, at most 64 characters in all. Each kernel is `wai.quantum.landscape/settle` or `wai.quantum.landscape/sample`, and each parity is `reference`, `bit-exact`, `statistical` or `uncertified`: `reference` exactly where `id` is `cpu:reference`, and `statistical` only for the sampling kernel (§5.1). A `compare` names the sampling kernel alone. 7. `demoted`, where present, is a string, and every parity the member states is `uncertified` (§7.3). 8. `capacity`, where present, is on a member other than `cpu:reference`, and is an object, not empty, whose members are among `cells`, `couplings`, `table_entries`, `uncertain_span`, `sweeps` and `chains_per_call`, each a whole number of at least 0, and `at_zero` and `above_zero`, each an object, not empty, whose members are among `field`, `field_bound` and `cost`, each a whole number of at least 0. Where a parity the member states is `bit-exact` or `statistical`, each of these numbers it gives is at least the floor's (§5): `cells` 32, `couplings` 992, on each side `field` 40, `field_bound` 41 and `cost` 8, `table_entries` 31, `uncertain_span` 61 and `sweeps` 5,000. 9. `audit` is present exactly where a parity the member states is `bit-exact` (§7.3), and is then an object whose `checked` is a non-empty array. `refusals`, where present, is a non-empty array of objects whose `member` and `why` are strings. 10. A `run`: `program_digest` is the BLAKE3 of the request's program, as 64 lower-case hex digits; `seed` is the request's seed in decimal, with no leading zero (`1` where it gives none); `mode` is `settle`, `quench` or `sample`, and the member's `kernel` is the settle kernel for `settle` and the sampling kernel otherwise; `temperature` is a number, 0 for `settle` and `quench` and above 0 for `sample`, and the request's value where it gives one; `restarts` is a whole number from 1 to 100,000, and 1 for `settle`; `sweeps` is a whole number from 1 to 1,000,000; `state` is a string of 1 to 4096 characters, each `+`, `-` or `0`, and `variables` is its length; `energy` is a whole number from −2⁶³ to 2⁶³ − 1; `state_hash` is the state's hash (§3.2), as 16 lower-case hex digits; `replay` is the digest of §3.2 from the request's program, `seed`, `mode`, `temperature` (its bits, for `sample`), `restarts`, `sweeps`, the state and `energy`, as 64 lower-case hex digits; `joules` is an object whose `kind` is `priced` and whose `metered` is `null` or an object whose `joules_micro` and `window_us` are whole numbers of at least 0 (§4.4); `verdict` is `solved`, `missed`, `failed` or `unchecked`; `truth` is `null` or an object whose `lowest` is a number; `reached` is `null` where `truth` is, and otherwise whether `energy` equals `truth.lowest`; and the verdict is not `missed` without a truth and not `unchecked` with one, and is `solved` or `failed` where `reached` is `true` and `missed` or `failed` where it is `false` (§3.1). 11. A `replay`: `seeds` is the request's (20 where it gives none), and `lines` is a string of exactly that many lines, each ending in a line feed and holding seven fields, one space between each two: the line's seed in decimal (the request's seed, plus one for each line before it, modulo 2⁶⁴), 16 lower-case hex digits, a state as rule 10 has it (every line's of one length), its energy (`-?[0-9]+`), a verdict as rule 10 has it, the accumulates (`[0-9]+`), and 16 lower-case hex digits. 12. A `sweep` or a `compare`: `rows` is a non-empty array of objects. Each row of a `sweep` has a `kernel` the member names, the `parity` the member states for it, and a `mode` of rule 10 that kernel runs; each row of a `compare` has `classical`, `true` or `false`, and `parity`, `null` exactly where `classical` is `true` and otherwise the member's parity for the sampling kernel. A `compare`'s `target` is a whole number. 13. A provider's job (quantum-providers §11.3): the result has `provider`, `job` and `cost` exactly where the request has `provider`. Then `provider` is an object of exactly `name` (the request's `provider`), `kind` (`http` or `process`), `protocol` (`wai.quantum.provider/1`), `device` (a string, not empty), `provenance` (`silicon`, or `simulator` or `emulator`, alone or followed by `:` and more) and `describe` (64 lower-case hex digits); `job` is an object of exactly `id` (a string, not empty) and `polls` (a whole number of at least 0); and `cost` is an object of exactly `free` and `confirmed`, each `true` or `false`, with `confirmed` `true` exactly where `free` is `false` (a run that is not free runs only on the person's confirmation), `estimate`, an object, and `charged`, `null` or an object of exactly `amount` (digits, and optionally `.` and digits) and `currency` (a string, not empty). A verifier that holds this text's reader also reads the program, and states whether the answer's energy and plan are the program's: a `run`'s `energy` from its state, and its `mode`, `temperature`, `restarts` and `sweeps` from the program and the request (§4); and each line of a `replay`, its energy and its replay digest. `wai-quantum verify` states it (`landscape.recomputed`) and gives a job whose answer the program does not bear out as not valid, as it does a set whose programs it writes out otherwise (quantum-providers §8.6). That is the engine's check, not a rule of the receipt: a verifier without the reader does not make it. ## 6. The comparison `compare` runs the program on the member and on three classical methods on the same three-state energy: simulated annealing, tabu search and greedy descent. Each has the same budget of operations a run: the sampling run's own count, where one operation is one coupling read, one cell updated or one move considered, whoever does it. A host gives each row's count of runs at the target, and its best energy. A table MUST be published as it comes out, including where a classical method leads. The operation count is not a machine's time. It says nothing of cells that settle side by side, and the comparison is not a claim about any device. ## 7. Conformance `quantum-conformance/landscape/vectors.json` is rebuilt by `wai-quantum landscape vectors`, and a test holds the file to the code. Each part pins a rule of this text, so that an implementation written from the text alone, which computes any of these another way, is caught. The **core set** is the part of it the set held before it grew to reach large jobs, and a long schedule: the `settle` vectors but `fields-at-the-bound`, the first fifteen `chains` vectors (three landscapes cooling at five schedules), `a-long-schedule-across-windows`, and the first eight battery workloads. It sets the floor of a declared capacity (§5), so no capacity a member may declare leaves out the long schedule. The vectors generated for a capacity (§5) are not in the file: a host builds them from the capacity, by the rules below. ### 7.1. Bits - `settle`: whole workloads, starts and bounds, each with its field bound, and the state, sweeps, ending, accumulates and state hash the settle kernel gives: the four recall vectors, every ending, a two-cycle with fields, a bound of one sweep, fields at 2⁴⁰; waves down paths of 65 to 300 cells, which run past one workgroup of cells and past 64 sweeps, one stopped at its bound in a later batch, a two-cycle of 70 cells and 1000 cells of mixed couplings; fields that only their full width tells apart past 16 and 32 bits; and field bounds at 2³¹ − 1 and just above it (§5.1). A settle kernel is `bit-exact` when it gives every one it takes exactly and takes every one §5 does not let it decline. - `exp`: the bits of Appendix A's function at the arguments the cut points use and at its edges, as `[x, exp(x)]` pairs of 16 hexadecimal digits. - `schedule`: the bits of every sweep's temperature for starting temperatures and chain lengths that tell `T₀ − T₀·q` from other ways of writing it. - `cells`: the two cut points for fields from −40 to 40, costs from 0 to 8 and temperatures from 0.25 to 25, the temperature given by its bits too. - `draws`: the generator's outputs `out(s, j)` at several seeds, and at each seed of the `a-draw` chains below. - `chains`: whole chains from their starts and chain seeds, with every start of some runs, cooling from starting temperatures that include one that is not a short decimal, or held at temperatures given sweep by sweep (`held`), which need not end at 0, so that the last sweep's draws are in the final state. Among them: one cell at seeds where a port of the generator in 32-bit words first goes wrong (a carry out of the middle of a product, a cut point compared by its high word alone); 16,384 draws in one sweep; more chains than a workgroup; chains that stop hot, in which the order of the cells shows; chains long enough to cross a device's windows of sweeps, by table and by work, hot in every window: among them, in the core set, 5,000 sweeps on 32 cells each coupled to 15 others, within the floor on every number, which cross windows of both kinds, and 200,000 sweeps of two cells, across a window by work on the smallest workload; and the same fields past 16 and 32 bits and at the line as the settle vectors, at 0 and at a temperature of their own size. A sampling kernel is `bit-exact` when it gives every case it takes exactly, each case's chains in calls of as many as a host would give it (§5.1), and takes every one §5 does not let it decline. - Generated, by rule, from a member's capacity (§5), where `C` is the most cells it lets a workload hold (4096 with none), `P` the most coupled pairs, `B` the chains of one call (4096, or `chains_per_call` where fewer), and each vector run only where the capacity admits it: - cells: for each `n` of 1, 2 and 3, each power of two to `C` with one less and one more, and `C` and `C − 1`: `n` cells, each with a field of 1 or 2 of either sign so that every one moves in its first sweep, coupled each to the next (spread along the whole line where `P` is fewer); settled for 4 sweeps, and held at 1.5 for 3; and, where a last partial warp of 32 or workgroup of 64 holds more than half of it, quenched at 0 for 3 sweeps; and a wave settling down as many cells as a workload can hold (`C`, or `P + 1` where fewer), one cell a sweep, coming to rest within the most sweeps a run may have (of fewer cells where those are fewer): as long as a wave can be; and the same wave stopped at its bound one sweep before it would rest, its last sweep moving a cell; - the final sweep: a sweep at 0 straight after sweeps above 0, as an engine runs it at the end of a job, on as many uncoupled cells as a last, partial warp of 32 or workgroup of 64 holds past half of it: 17, 18, 24, 30 and 31, and 33, 34, 48, 62 and 63 (odd and even, at the band's edges and in its middle), each after two sweeps at 1.5, after three (the sweep at 0 at an odd index), and after two and one at 1/64 (a cold sweep, as an annealing job ends); and, after two sweeps at 1.5, three quarters, all but two and all but one of a group of 128, 256, 512 and 1,024. Each cell's field equals the cost of 1, a tie between two states above 0 that the sweep at 0 settles to 0 however cold the sweep before it, so that the sweep moves cells; - a settle that keeps moving: `u` units of three cells, each unit's third cell agreeing with the other two and each unit coupled to the next two by fixed patterns (`13u − 16` couplings), with fields `−2, 1, 6` on the first unit, `0, 3, −1` between and `0, −5, 0` on the last, which from every cell at 0 moves a cell in every sweep to sweep `11u − 59` and rests at `11u − 58` (for 10 units or more); or, where couplings are too few for those to move longer, units of two, each cell opposed to its partner and to the other cell of the next unit, with fields `0, −5` on the first unit, `1, 2` between and `−4, 5` on the last, which move to sweep `4u − 10`. Stopped at its bound just past 2⁹, 2¹⁰, 2¹¹, 2¹² and 2¹³ sweeps, where a narrow sweep counter wraps, each on as few units as still move there, and at its last moving sweep (or the most a run may have) on as many cells as the capacity takes: with none, 1,365 units of three, 4,095 cells, moving to sweep 14,956. A search over units of three found these; no longest-moving settle within the rules is known, and a sweep counter of 14 bits or more, which none of these wraps, or a stale read at a bound past the sweeps they reach, is left to the audit (§7.3); - two-cycles that end late: the same units of three beside two cells that alternate from the start (agreeing, with fields 1 and −1), so that the whole comes to a two-cycle at sweep `11u − 57`: with 46 units at sweep 449, the first sweep of a later batch of 64, where a host that runs a settle in batches must carry the state two sweeps back from the batch before; and with 378 units at sweep 4,101, past 2¹², where a sweep counter of 9 to 12 bits read at the ending gives the other phase of the cycle (on as many units as the capacity takes, to 378). A fault at a two-cycle ending later than these is left to the audit; - calls: one call of each number of chains from 1 to 32, of 33, 48, 63, 64, 65, 96, 127 and 128, and of `B` and `B − 1`; - a row: one cell coupled to as many as a workload within the capacity can give it, their fields holding them so that its whole row gives it a field of −1 and any shorter part of the row 0 or more; settled, held at 0.5, and ending at 0; - lanes: on each side of 0, a cell at each of `2^(L−1) − 1`, `2^(L−1)`, `3·2^(L−2)` and `2^L`, for `L` of 16, 24 and 32, that the field reaches, of both signs, and a cell whose field is reached exactly through two couplings at each one the field bound reaches; and the same beside the largest cost (to `2¹⁵ − 2`), with a cell each side of the threshold it sets: packed into as few workloads as the capacity takes, so that a small capacity holds each in a workload of its own size. Each is settled for 3 sweeps and for 1 and quenched at 0; held at `2¹⁵` and at 1/64 above 0; and at `2¹⁵`, at 1/64 and at 0, and at 1/64 and then 0, where both sides take it, the shape an annealing job ends in; - a corner on each side of 0, as the capacity takes it: the largest field of both signs beside the largest cost under it, so that those cells move at 0, among as many cells and couplings as the capacity allows (fewer where a table or span limit asks); and a cell whose field is reached exactly through as many couplings as a cell can have, the field bound at its most; and a cell at field 0 whose row of cells held at +1 sums to 128, and to as many as a cell can have, past what a narrow lane holds. Each at 0, cold above 0, and ending at 0; - a span: where no span is declared, two hubs on shared cells as wide apart as the other numbers let them reach (the widest a declared table takes, where it is the narrower), held at a temperature of the span's size and ending at 0; - draw indices: one run of `C` cells carried past `2²⁴` where `C` times the most sweeps reaches it, at 0 until the sweeps that cross it and hot to the end. A run past `2³¹` would be at least `2³¹` updates in one chain, minutes on a device that runs a chain a thread, so a draw index narrower than 64 bits past 24 is left to the audit (§7.3); - at each number declared below what a job can reach: a wave settling down `C` cells; `P` couplings, each cell's as near as the field bounds allow; the field bound at 0 through couplings and by a field alone, settled to the end and for one sweep, and above 0 alone, coupled and reached exactly; the field and the cost at 0, and above 0 hot, cold and ending at 0; a table of exactly that many entries and a span exactly as wide, through hubs coupled to shared cells where the other numbers allow it (where a declared table or the couplings do not take that span, the widest under it they do); and a schedule of exactly that many sweeps; - for the battery (§7.2), where `C` is past 24: `C` alike cells, every cell read in blocks of three (the last block ending at the last cell), and, where `C` is not one less than a power of two, as many alike cells as the largest such count under it from 31 to 1,023, every cell read, so that a last, partial warp or workgroup holds as many as it can; at declared couplings, alike triangles, every one read; at a declared schedule length, one alike triangle warm and then cold, to 1,024 sweeps; at a declared field bound, field and cost, three alike cells at it, and the field bound through couplings; at a declared span, its two hubs where they hold no other cell. Identical blocks cannot reach a table, so a table has none. The rules bound what certification costs, whatever the capacity: at most 300 generated vectors, at most 450 million cell sweeps hot or settled, and at most 20 million at temperature 0 (the run past `2²⁴`, at a fixed point, which the reference skips). With no capacity they come to about 262 million cell sweeps, two fifths of them battery workloads, which run only for a kernel that is not `bit-exact`; the most, for a capacity of 4,096 cells that declares every other number below what a job can reach, is about 430 million, half of them battery workloads. A test holds the bounds over the named capacities and over random ones, and prints each one's share. - `jobs`: whole requests and what their answers hold, refusals included: every worked example at seed 1, and requests that pin a rule each (a `minimize` above temperature 0, a temperature given as text, a pin's size, quantised weights, the state a two-cycle reports, a settle's digest, leading zeros, and refusals of a `+` sign, an exponent in a temperature, a byte-order mark, a no-break space, no steps, too many starts, the most negative whole number, a weight too small and a pin too large). A host that claims this protocol on the reference's kernels MUST give exactly these. ### 7.2. The battery A sampling kernel with draws of its own is held to `statistical`: workloads of two to six cells, and one of eight blocks of three side by side, none coupled to another, each with a schedule. A member may decline a workload of the battery only where §5 lets it decline a vector, and it then passes that workload without running it. A workload of many blocks may name the blocks it reads (`read`); only those are counted, so that many tests at once do not fail a correct sampler by chance. Workload `k` runs `statistical.chains` (20,000) chains, chain `r` with the chain seed `out(statistical.seed + k, r + 1)` and its start from that seed (§4.2), through the workload's temperatures. The final states of each `block` of cells are counted over its `3ⁿ` states, in the order `Σ (s_i + 1)·3ⁱ`, and held to `exact`. Where `law` is `settled`, that is the Boltzmann distribution at the schedule's last temperature above 0, reached on a plateau, carried through one deterministic sweep where the schedule ends at 0. Where it is `walked`, it is the law of the walk itself from the start's uniform law, every sweep of the schedule cell by cell in order, on a block whose cells are all alike; there the counts are read over how many cells of the block hold each state, which any order of the cells leaves the same. The statistic is Pearson's, every bin expected fewer than `statistical.pool_below` (5) times pooled into one; with `df` the bins less one, a block passes when it is at most `df + 5·√(2·df)`, and a workload when every block does. The workloads a capacity adds (§7.1) are held by a bound that holds whatever the law, however small its bins, so that they fail a correct sampler, whatever its draws, less than once in a million between them. They run in calls of 63, 62 and on down to 17 chains in turn (no more than the member takes), so that their calls end in every partial warp of more than 16 chains and every partial workgroup of more than 32. Every block is read. A block's statistic is the likelihood ratio `G = 2 Σ O ln(O/E)` over every bin, none pooled: `2N` times the divergence of its counts from its law, `N` the chains. By the method of types, the chance that `N` draws over `k` bins fall at a divergence `t` or more from their law is at most `C(N + k − 1, k − 1)·e^(−N·t)`, the number of ways `N` draws can fall in `k` bins times the chance of the likeliest of them. So a block passes when `G` is at most `2·(ln C(N + k − 1, k − 1) + ln(B/10⁻⁸))`, `B` the blocks the workload reads: a workload fails a correct sampler with chance at most 10⁻⁸ (for 27 bins and one block, 429.3; for 10 bins, 189.5). A test sums the chance exactly over every way 1,000 draws can fall in three bins, for laws with bins a pooled chi-square mishandles. A sampler that leaves a cell unmoved, draws one at random, or leaves a call's last partial warp at its starts lies far past the bound on the block that holds it: a cell left at its start in a block of three gives `G` near 12,000 at `N` = 20,000. The bound is loose, and what it misses is part of the grade. It sits at a divergence of about 0.011 a block (429.3 over `2N`), so a law near the exact one passes: three alike cells at field 1 drawn at a temperature 10% too high are 0.0055 from their law, `G` near 250, and pass; 15% too high, `G` near 490, and fail. The battery's cells are the fixed workloads' (2 to 24), `C` and the largest `2^j − 1` under it: a fault keyed to another count of cells, such as the lanes past 32 of a partial last workgroup only where it holds an even count, is never run. A test holds each of these statements. A kernel graded `statistical` is never audited (§7.3), and every answer from one says what the grade rests on and what it misses. The workloads hold pairs of coupled cells next to each other, two apart and three apart, a triangle no two colours can split, fields to 40 and a cost of 8 at a high temperature, a small field at a low one, a schedule that ends at 0, one that cools from 6 to 0.7, a ring of six cells, eight triangles side by side, a triangle pulled one way that is warm and then cold, whose end alone gives another law, and fields past 16 bits and past 32 at a temperature of their own size. A kernel that moves two coupled cells at once in any order of cells, that ignores the schedule or keeps only its end, that samples the last sweep rather than running it at 0, whose table is wrong for large fields, that holds its fields in 16 or 32 bits, or that leaves cells from the fifth on where they started fails at least one of them; the reference's own kernel, one that colours its cells properly, and one that takes its cells last to first pass every one. A test holds both statements, with kernels that are wrong in each of those ways. ### 7.3. The audit A finite set cannot catch every fault, so a `bit-exact` grade rests on a continuous check as well as on certification, and the check rests only on what the host computes and remembers. For every answer from a member's kernel graded `bit-exact`, the host runs part of the job again on the reference and compares the bits: - sampling: in every job (a run, a replay, a sweep or a comparison), in every call to the member, the call's last chain and, for each seed's run the call holds chains of, one of those chains, each drawn afresh: what the host checks in one call says nothing of what it checks in the next, so a member that times the host between its calls learns nothing it can use. The host runs a call's checked chains again after the call returns and before it makes the next: on the job's own thread, at the job's priority, and on as many of the audit's threads as are free, a quarter of the host's cores and at most 4 over the whole process at once (none on a host of fewer than 4 cores), each at a low priority (a nice value 10 higher, to 19, on Linux; the background band on macOS). So an audited job takes at most its own thread and the audit's threads; several audited jobs at once each run a share on their own threads at their own priority, beside the audit's threads, and a host that must keep audited jobs from crowding out others lowers those jobs' own priority. An audit thread whose priority cannot be lowered says so on standard error, once, and runs its share all the same; - settling: the reference's settle, as far as a budget of 2²⁴ of work goes, the work being the cells and couplings times the sweeps the host asked for, never the sweeps the member reports. Where the reference comes to rest within the budget, or the whole bound fits it, that is the whole answer, and the member's is compared with it. Past it, the whole settle is run in one job in 8; in the others a member whose settle ends before the reference's had is wrong. The checks of §5 hold as before. The chains, and which settles past the budget are run whole, are drawn with a key the host makes when it starts, from its operating system's randomness, and a count that every draw moves on: no member can tell which of its chains are checked, and the same job sent again is drawn afresh. Every audited answer records what was checked (`audit.checked`: each run's seed and its chains checked, or how much of a settle). The draws are the host's, as the rest of its work is: nothing in an answer lets a reader check afterwards that the chains were drawn and not chosen, and a reader who needs that runs the job on the reference. At the first difference, or the first answer the checks refuse, the host demotes the member to `uncertified` for both kernels, at once. It answers that job from the reference, naming the member under `refusals` with why, and states the demotion in every later answer from the member (`member.demoted`) and in its label. A host placing jobs never places it again. The host keeps the demotion under the member's identity, its id and its fingerprint (a bitstream's or a firmware's digest, a driver's version: `Member::fingerprint`), in a file where it names one, so that it outlives the process: certifying the member again, or its declaring another capacity, does not clear it. Only another identity is certified afresh. Hosts and jobs may share the file. The host keeps a demotion at once in a file of its own beside it (`..demotion.<32 hex digits>.json`, with the file's mode), with no lock to wait for, and then merges it into the file under the file's lock (the file of its name with `.lock` added), waited for at most 5 s (`member::STORE_LOCK_WAIT`): written whole to a file of its own with the file's mode, synced and renamed into place, the merged files of their own then removed. Where that wait runs out, the demotion stays in its own file until a later demotion merges it, and is kept all the same: none is lost and none loses another's. Whenever it certifies a member, the host reads the file and every demotion in a file of its own afresh, under the lock held shared, and then rewrites the file as it is, the way a demotion rewrites it: a file of its own as large as the largest rewrite a demotion can make (the records with the largest entry one can add, a reason being kept to its first 1,024 bytes), synced, cut back and renamed over the file. So a folder no longer written to, a full disk, a limit on a file's size, and a file that cannot be replaced (another user's in a folder with the sticky bit, one marked immutable or append-only) are each found before a member is graded on the store. Its temporary files are named for its file alone (`.....tmp`, matched exactly, so that no other store's file is taken for one of its own), each held locked by its writer while it lives; one unchanged for 10 s that no writer holds is a killed writer's, and the next certification or demotion removes it. Where the path is a link, the store is the link's target, followed link by link: its lock, its files and its rename; a link in a folder anyone may write that has the sticky bit is not followed, whoever made it, and no file of the store's is opened through a link. The store fails closed. The host says so on its standard error, grades no kernel `bit-exact`, and holds the member at `uncertified`, saying why in `member.demoted`, where the path names no file (an empty `WAI_LANDSCAPE_DEMOTIONS` names none, and is as if unset), where it is a link to nothing or a link in such a folder, where the file has more than one name (a hard link, which a rewrite would split), where the file or a demotion in a file of its own cannot be read or does not parse, where the file cannot be rewritten as a demotion rewrites it, where a write fails, or where a host that keeps one has no file to name. A demotion it could neither keep in its own file nor merge it keeps for as long as it runs, and says so. Where the lock is held past 5 s, the certification that waited grades no kernel `bit-exact` and says why, and the next waits again, so that a board job holds the board no longer than that waiting on the store. A kernel graded `statistical` gives draws of its own, which no audit can hold to the reference's bits. A host placing jobs places it only where the job asks for it (`"parity": "statistical"`); otherwise it passes over it, saying why, and a job is answered by a kernel whose bits are audited, or by the reference. Asked for by name, it is run, and its answer says `statistical`. Its cost: in every call, its last chain and one chain of each run it holds chains of, so for a run of `R` chains in calls of `B` at most `2⌈R/B⌉/R` of its sampling work again, and for a job of many seeds' runs in one call, one chain of each and one more; for a settle, at most 2²⁴ of work, and past it the whole settle again one job in 8. The bound is that work. It is work on the host's CPU, which a device outruns, so in wall time the audit costs more than its share of the work, most where a job is many short runs, and by how much depends on the host, its load and the device: a host that needs a wall-time figure measures it on its own hardware (the `timings` test of `landscape_devices` prints five runs of each of four jobs, audited against the same member run by name). Ten runs a device on two shared hosts, with the audit's threads as above, give an idea: a replay of 256 seeds of 8 chains of 64 cells for 500 sweeps took 108% to 171% longer audited through Metal on an M3 Ultra's GPU, and 85% to 122% through CUDA on an RTX 4050 laptop GPU; a replay of 256 seeds of one chain each, where every chain is checked, 112% to 183% and 90% to 120% longer, so that through Metal it took up to 1.18 times what the reference alone took; a run of 4,096 chains of 64 cells at most 18% longer, and one of 1,024 chains of 1,024 cells at most 4%. What it catches: a fault that makes a fraction `q` of a run's chains wrong, on each such run with a chance of at least `q`, whatever chains it chooses, since it cannot tell which are checked; one that makes the last chain of a call wrong (a partial last warp or workgroup, a call longer than the member keeps), on the first job that shows it; one in a settle whose reference comes to rest within the budget, on the first job that shows it; one that ends a settle at or before the last sweep the budget reaches while the reference's goes on, on the first such job; and any other in a settle past the budget, one that ends it later than that sweep and sooner than the reference among them, only within `N` such jobs, with a chance of `1 − (7/8)^N` (0.74 at 10 jobs, 0.99 at 35), each job drawn afresh, repeats of one job included. A draw index narrower than 64 bits, which certification holds only to `2²⁴` (§7.1), is caught on the first job whose run passes its width, since every chain of that run is then wrong. The audit is a check that runs as long as the member does. It is not a proof. ### 7.4. The joint law against exact enumeration (informative) The battery holds blocks of at most six cells to their law. The sampling kernel's joint law over every state of larger workloads is held to the exact law in `quantum-conformance/landscape/stage0/`, registered before it was run: eight landscapes of 10 to 12 cells (3¹⁰ to 3¹² states), ferromagnetic and frustrated, sparse and dense, two of them of the second version, each at three temperatures. Each sample is the state of its own chain after a number of sweeps chosen, before anything is sampled, from the exact law of the chain after each sweep; the energies are whole numbers and the law's rounding is bounded. Total variation over every state, the divergence and Pearson's statistic over a partition of the states, and the laws of the energy, of the magnetisation with the cells not at 0, and of each pair of cells, are held to thresholds registered with the models. An ideal sampler drawing from the exact law is held to the same rule, and so are three kernels that are wrong in ways a port can be: every cell drawn at once from the old state, a field plus noise thresholded into three levels, and a cell that reads its couplings as a three-colour cell does. The results and their document (`wai-quantum/docs/landscape-stage0.md`) say which members ran there, and how each did. None of it is part of a member's grade (§5.1). ## 8. What does not run on this model The worked examples include each of these, and they fail there, on purpose: problems of three interchangeable options (colouring a map), where the state 0 is not a third colour; problems whose sizes matter (two equal piles), where a coupling keeps only a sign; assignment beyond a 2×2 grid written as sums; and a constraint at temperature 0, which flips between two states and never rests. A host MUST NOT hide these, and a program marked `#! expect fails` MUST fail. The second version ([quantum-landscape-2](quantum-landscape-2.md)) gives each variable a cost of its own, of either sign, and with it writes one-hot, at-most-one and cardinality constraints: colouring with three interchangeable colours and assignment above 2×2 run there, and its worked examples say how far. Sizes, and a constraint at temperature 0, do not run there either. ## 9. Versioning The protocol's name carries its version. Within `/1`: fields may be added to an answer, never removed or given another meaning; the kernels' bits, the replay digest and the conformance set's `settle`, `chains` and `jobs` do not change. A change to any of those is `/2`, with a new kernel name. The words of a sentence, the rates of §4.4 and the published table are not part of the protocol, and a host's `label` is its own. §5.4 was added within `/1`: its rules state what every host of this text already wrote, so every answer sealed before it holds them. The members a client adds to an answer from a provider (`provider`, `job`, `cost`, quantum-providers §11.3) were added the same way. **The conformance set did not keep the rule above, and is frozen now.** The file `quantum-conformance/landscape/vectors.json` changed three times after it was first published, on 2026-11-06 (commit `f7078696d`, sha256 `d3bac819…`). No expected state, sweep count, ending, accumulate count, draw count, energy, verdict or replay digest of a vector already in it changed; but entries changed their form, gained expected fields, and were added, so a member certified on an earlier set was held to less: | when | commit | what changed in the set | why | sha256 after | |---|---|---|---|---| | 2026-11-06 | `eb0db8895` | every entry's workload grouped under `landscape`, each job's program and seed under `request`; a chain's `term` and a job's `mode`, `restarts` and `sweeps` added to what is expected; the six chains renamed with their sweeps; the eight cell frequencies and the two coupled-cell frequencies replaced by 650 cut points and a rewritten battery; `exp` and `schedule` added; 3 settle vectors, 9 chains vectors and 17 jobs added | the engine's review of the first version: bound every quantity a job can ask for, and pin every rule a reader must follow | `43e543a6…` | | 2026-11-06 | `0675813de` | every settle and chains entry gained its `field_bound`; 14 settle vectors, 24 chains vectors, the `draws` part and battery workloads added | the review of the GPU members: reach what large jobs reach, past a workgroup, a batch of sweeps and the widths of a lane | `b5286374…` | | 2026-11-09 | `c0ba8a0ce` | 2 chains vectors added: a long schedule across windows and a schedule across a window by work | declared capacity: the core set and its floor needed the long schedule | `1da13d25…` | The FPGA board was certified on hardware against the set of `eb0db8895` (`43e543a6…`), before the later two; its member is certified on the model against the set as it stands, and its grade names that set. From 2026-11-10 the set is frozen as it stood on main that day (sha256 `1da13d2570eb5b1367d3017b465e1b6a199429210def0c4300dbc403413e3a8e`): the code pins its BLAKE3 digest (`conformance2::VECTORS_1_BLAKE3`), a test fails on any difference, and a change of any kind to it, an entry changed, removed or added, is a new version of the protocol, as the second version's set is held (quantum-landscape-2 §7). ## Appendix A. The exponential The exponential of §4.2, as the reference computes it, with every operation a double rounded to the nearest and no operation fused. With `ln2_hi = 6.93147180369123816490e-1`, `ln2_lo = 1.90821492927058770002e-10`, `inv_ln2 = 1.44269504088896338700`, and `P1 … P5 = 1.66666666666666019037e-1, −2.77777777770155933842e-3, 6.61375632143793436117e-5, −1.65339022054652515390e-6, 4.13813679705723846039e-8`: 1. A NaN is returned as it is; `x > 709.782712893383973096` gives +∞, and `x < −745.133219101941108420` gives 0. 2. If `|x| > ½·ln 2` (`ln 2` the double nearest it): `k = ±1` when `|x| < 1.5·ln 2`, with the sign of `x`, and otherwise `k = trunc(inv_ln2·x + (x < 0 ? −0.5 : 0.5))`; then `hi = x − k·ln2_hi`, `lo = k·ln2_lo`. If `|x| < 2⁻²⁸`, the result is `1 + x`. Otherwise `hi = x`, `lo = 0`, `k = 0`. 3. `r = hi − lo`, `t = r·r`, `c = r − t·(P1 + t·(P2 + t·(P3 + t·(P4 + t·P5))))`. 4. If `k = 0`, the result is `1 − ((r·c)/(c − 2) − r)`. Otherwise `y = 1 − ((lo − (r·c)/(2 − c)) − hi)`, and the result is `y·2ᵏ`: computed as `y·2¹⁰²³·2^(k−1023)` when `k > 1023`, as `y·2^(k+1000)·2⁻¹⁰⁰⁰` when `k < −1021`, and as `y·2ᵏ` otherwise, each power of two exact. The conformance set's `exp` part holds its values.