[cwschroeder]

Draft validation candidate for the Clef checkpoint-reader and disposable-hidden-row slice in ashhart#692. Upstream base: 6ee828c24bf802cdd73507d6fc60bb27a82c0d66. Candidate: d288181f741a52a760aacb1d5dac1752d98670da. This remains a fork-only draft, with no deployment or upstream readiness claim.

The separate bf16 head reader and inspector remain independent of backbone weights and serving. Hidden rows are captured on the engine owner thread with caller-owned completion storage and a private frame and runner. Credit for outcastofmusic's ashhart#241/ashhart#251 is retained.

This update adds capture-buffer admission (4c685d07): before allocation, the owner checks private KV, owned output rows and a conservative bound from existing fixed buffers against the remaining device working set, preserving the server's 8 GiB reserve. Insufficient room returns HiddenRowsMemory without evicting chat snapshots. This is a buffer bound, not a measured peak-memory result. Astra reviewed the bounded fix with no further source finding.

It also merges ashhart#928's three commits unchanged, preserving chaog992's authorship. The existing owner-call yield test aborts at s.inflight.? without that dependency. With it, the complete engine-API/LaneHost CPU suite passes 177/177 in Debug, including all nine owner-call cases.

Current local evidence (M5 Max, macOS 26.6.2, Zig 0.17.0):

• Head inspection against the actual Cloudflare/clef-flash release 8b2e5fd17c09fd49bc2880b805d5323ec7ff4ff3 validates 122 tensors with hidden width 4096. Head SHA256: 19cdcec8c81dc9212be320fff47462ab342fbc1278be4368fb3da71241cf5ba0. Backbone config SHA256: 66f87f6fb2616b46604daf2a9c67ddc87938296d07156efa34d59b5be49e3238. The receipt keeps backbone_weights_checked=false, gpu=false, model_ready=false.
• All 36 checkpoint/admission tests pass in Debug and Fast, and four inspector CLI tests pass. Capture-budget regressions cover insufficient room, the exact byte boundary and overflow. Removing the budget refusal makes the long-capture regression fail.
• Whole-tree formatting and whitespace pass; lean has 517 inherited findings and zero new.
• Final current-head kernel-contract, golden and fuzz targets pass: 309/319 frozen answers equal, ten documented differences, zero unexpected; the seven fuzz tests pass. The native server and both synthetic device harnesses compile on this exact commit; none has been executed.

A separate current-main server-suite run while rechecking ashhart#929 failed the inherited delayed-refusal benchmark test: it expected HTTP 400: soon but received HTTP 400. The same failure reproduces on unchanged 6ee828c2; it is outside the Clef source delta. In a diagnostic run the fixture's requested 20 ms sleep resumed after about 109 ms, past its client's 100 ms body deadline. The test is not being weakened or counted as passed.

Still required: the original 45-record/128-question token/span/option corpus or generator; GPU/ANE on/off and device-failure checks; real-model chat/resume and vision isolation; concurrent-request and performance checks; an agreed numerical head tolerance. The existing 15-record prototype does not replace that corpus. HTTP scoring is not connected. The two synthetic device harnesses are build-only until an exclusive Metal test window.

All six current-head GitHub checks pass at d288181f: both desktop jobs, both mobile jobs, Zig format and the complete Linux No GPU workflow. Its log confirms the four CLI tests, frozen goldens and zero new lean findings against 6ee828c2. This does not remove the local macOS timing-test failure or qualify a model/device.

Final current-head native build SHA256: b6848765ddad9939d7918d435462b167b7089d60fccf4791825f8aca51f246ec. Zig compiler SHA256: 1c5f706db0ed6d55451940f31dc05a6177d05696bc1fa5d853696d04c718b523. The current upstream tip remains 6ee828c2. These are build receipts only; no service was changed.