[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
const ds4_tensor *t,
        uint32_t          type,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!t) ds4_die("internal error: missing tensor while validating layout");
    if (t->type != type) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %s, expected %s\n",
                (int)t->name.len,
                t->name.ptr,
                tensor_type_name(t->type),
                tensor_type_name(type));
        exit(1);
    }
    if (t->ndim != ndim) {
        fprintf(stderr,
                "ds4: tensor %.*s has %u dimensions, expected %u\n",
                (int)t->name.len,
                t->name.ptr,
                t->ndim,
                ndim);
        exit(1);
    }

    const uint64_t want[3] = { d0, d1, d2 };
    for (uint32_t i = 0; i < ndim; i++) {
        if (t->dim[i] == want[i]) continue;
        fprintf(stderr,
                "ds4: tensor %.*s has dim[%u]=%" PRIu64 ", expected %" PRIu64 "\n",
                (int)t->name.len,
                t->name.ptr,
                i,
                t->dim[i],
                want[i]);
        exit(1);
    }
}

static void tensor_expect_optional(
        const ds4_tensor *t,
        uint32_t          type,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (t) tensor_expect_layout(t, type, ndim, d0, d1, d2);
}

static void tensor_expect_plain_layout(
        const ds4_tensor *t,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!t) ds4_die("internal error: missing tensor while validating layout");
    if (t->type != DS4_TENSOR_F16 && t->type != DS4_TENSOR_F32) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %s, expected F16 or F32\n",
                (int)t->name.len,
                t->name.ptr,
                tensor_type_name(t->type));
        exit(1);
    }
    tensor_expect_layout(t, t->type, ndim, d0, d1, d2);
}

static bool tensor_is_routed_expert_type(uint32_t type) {
    return type == DS4_TENSOR_IQ2_XXS ||
           type == DS4_TENSOR_Q2_K ||
           type == DS4_TENSOR_Q4_K;
}

static DS4_MAYBE_UNUSED uint64_t routed_expert_block_bytes(uint32_t type) {
    switch (type) {
    case DS4_TENSOR_IQ2_XXS: return sizeof(block_iq2_xxs);
    case DS4_TENSOR_Q2_K:    return sizeof(block_q2_K);
    case DS4_TENSOR_Q4_K:    return sizeof(block_q4_K);
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
const ds4_tensor *t,
        uint32_t          type,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!t) ds4_die("internal error: missing tensor while validating layout");
    if (t->type != type) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %s, expected %s\n",
                (int)t->name.len,
                t->name.ptr,
                tensor_type_name(t->type),
                tensor_type_name(type));
        exit(1);
    }
    if (t->ndim != ndim) {
        fprintf(stderr,
                "ds4: tensor %.*s has %u dimensions, expected %u\n",
                (int)t->name.len,
                t->name.ptr,
                t->ndim,
                ndim);
        exit(1);
    }

    const uint64_t want[3] = { d0, d1, d2 };
    for (uint32_t i = 0; i < ndim; i++) {
        if (t->dim[i] == want[i]) continue;
        fprintf(stderr,
                "ds4: tensor %.*s has dim[%u]=%" PRIu64 ", expected %" PRIu64 "\n",
                (int)t->name.len,
                t->name.ptr,
                i,
                t->dim[i],
                want[i]);
        exit(1);
    }
}

static void tensor_expect_optional(
        const ds4_tensor *t,
        uint32_t          type,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (t) tensor_expect_layout(t, type, ndim, d0, d1, d2);
}

static void tensor_expect_plain_layout(
        const ds4_tensor *t,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!t) ds4_die("internal error: missing tensor while validating layout");
    if (t->type != DS4_TENSOR_F16 && t->type != DS4_TENSOR_F32) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %s, expected F16 or F32\n",
                (int)t->name.len,
                t->name.ptr,
                tensor_type_name(t->type));
        exit(1);
    }
    tensor_expect_layout(t, t->type, ndim, d0, d1, d2);
}

static bool tensor_is_routed_expert_type(uint32_t type) {
    return type == DS4_TENSOR_IQ2_XXS ||
           type == DS4_TENSOR_Q2_K ||
           type == DS4_TENSOR_Q4_K;
}

static DS4_MAYBE_UNUSED uint64_t routed_expert_block_bytes(uint32_t type) {
    switch (type) {
    case DS4_TENSOR_IQ2_XXS: return sizeof(block_iq2_xxs);
    case DS4_TENSOR_Q2_K:    return sizeof(block_q2_K);
    case DS4_TENSOR_Q4_K:    return sizeof(block_q4_K);
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
el may have emitted
 * DSML in an order that is semantically valid but not byte-for-byte equal to the
 * canonical prompt we will see on the next request.  Rewriting only the token
 * checkpoint is not enough: the backend still contains raw and compressed rows
 * for the old suffix.  Until we have a real frontier snapshot at the
 * rewrite point, any replacement behind the live end reports that a rebuild is
 * needed without mutating the session.  The server may still find an older disk KV
 * checkpoint before falling back to a full replay. */
ds4_session_rewrite_result ds4_session_rewrite_from_common(
        ds4_session *s, const ds4_tokens *prompt, int common,
        char *err, size_t errlen) {
    if (!s || !prompt || prompt->len <= 0 || prompt->len >= s->ctx_size) {
        snprintf(err, errlen, "prompt exceeds context");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (!s->checkpoint_valid) {
        snprintf(err, errlen, "session has no valid checkpoint");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (common < 0 || common > s->checkpoint.len || common > prompt->len) {
        snprintf(err, errlen, "invalid rewrite prefix");
        return DS4_SESSION_REWRITE_ERROR;
    }
    for (int i = 0; i < common; i++) {
        if (s->checkpoint.v[i] != prompt->v[i]) {
            snprintf(err, errlen, "rewrite prefix does not match live checkpoint");
            return DS4_SESSION_REWRITE_ERROR;
        }
    }

    if (common == s->checkpoint.len) {
        return ds4_session_sync(s, prompt, err, errlen) == 0 ?
            DS4_SESSION_REWRITE_OK : DS4_SESSION_REWRITE_ERROR;
    }

    if (ds4_session_rewrite_requires_rebuild(s->checkpoint.len, prompt->len, common)) {
        snprintf(err, errlen, "rewrite needs rebuild: common=%d live=%d canonical=%d",
                 common, s->checkpoint.len, prompt->len);
        return DS4_SESSION_REWRITE_REBUILD_NEEDED;
    }

    snprintf(err, errlen, "unexpected canonical rewrite state");
    return DS4_SESSION_REWRITE_ERROR;
}

int ds4_session_common_prefix(ds4_session *s, const ds4_tokens *prompt) {
    if (!s->checkpoint_valid) return 0;
    int n = s->checkpoint.len < prompt->len ? s->checkpoint.len : prompt->len;
    int i = 0;
    while (i < n && s->checkpoint.v[i] == prompt->v[i]) i++;
    return i;
}

int ds4_session_argmax(ds4_session *s) {
    return sample_argmax(s->logits, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
el may have emitted
 * DSML in an order that is semantically valid but not byte-for-byte equal to the
 * canonical prompt we will see on the next request.  Rewriting only the token
 * checkpoint is not enough: the backend still contains raw and compressed rows
 * for the old suffix.  Until we have a real frontier snapshot at the
 * rewrite point, any replacement behind the live end reports that a rebuild is
 * needed without mutating the session.  The server may still find an older disk KV
 * checkpoint before falling back to a full replay. */
ds4_session_rewrite_result ds4_session_rewrite_from_common(
        ds4_session *s, const ds4_tokens *prompt, int common,
        char *err, size_t errlen) {
    if (!s || !prompt || prompt->len <= 0 || prompt->len >= s->ctx_size) {
        snprintf(err, errlen, "prompt exceeds context");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (!s->checkpoint_valid) {
        snprintf(err, errlen, "session has no valid checkpoint");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (common < 0 || common > s->checkpoint.len || common > prompt->len) {
        snprintf(err, errlen, "invalid rewrite prefix");
        return DS4_SESSION_REWRITE_ERROR;
    }
    for (int i = 0; i < common; i++) {
        if (s->checkpoint.v[i] != prompt->v[i]) {
            snprintf(err, errlen, "rewrite prefix does not match live checkpoint");
            return DS4_SESSION_REWRITE_ERROR;
        }
    }

    if (common == s->checkpoint.len) {
        return ds4_session_sync(s, prompt, err, errlen) == 0 ?
            DS4_SESSION_REWRITE_OK : DS4_SESSION_REWRITE_ERROR;
    }

    if (ds4_session_rewrite_requires_rebuild(s->checkpoint.len, prompt->len, common)) {
        snprintf(err, errlen, "rewrite needs rebuild: common=%d live=%d canonical=%d",
                 common, s->checkpoint.len, prompt->len);
        return DS4_SESSION_REWRITE_REBUILD_NEEDED;
    }

    snprintf(err, errlen, "unexpected canonical rewrite state");
    return DS4_SESSION_REWRITE_ERROR;
}

int ds4_session_common_prefix(ds4_session *s, const ds4_tokens *prompt) {
    if (!s->checkpoint_valid) return 0;
    int n = s->checkpoint.len < prompt->len ? s->checkpoint.len : prompt->len;
    int i = 0;
    while (i < n && s->checkpoint.v[i] == prompt->v[i]) i++;
    return i;
}

int ds4_session_argmax(ds4_session *s) {
    return sample_argmax(s->logits, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
el may have emitted
 * DSML in an order that is semantically valid but not byte-for-byte equal to the
 * canonical prompt we will see on the next request.  Rewriting only the token
 * checkpoint is not enough: the backend still contains raw and compressed rows
 * for the old suffix.  Until we have a real frontier snapshot at the
 * rewrite point, any replacement behind the live end reports that a rebuild is
 * needed without mutating the session.  The server may still find an older disk KV
 * checkpoint before falling back to a full replay. */
ds4_session_rewrite_result ds4_session_rewrite_from_common(
        ds4_session *s, const ds4_tokens *prompt, int common,
        char *err, size_t errlen) {
    if (!s || !prompt || prompt->len <= 0 || prompt->len >= s->ctx_size) {
        snprintf(err, errlen, "prompt exceeds context");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (!s->checkpoint_valid) {
        snprintf(err, errlen, "session has no valid checkpoint");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (common < 0 || common > s->checkpoint.len || common > prompt->len) {
        snprintf(err, errlen, "invalid rewrite prefix");
        return DS4_SESSION_REWRITE_ERROR;
    }
    for (int i = 0; i < common; i++) {
        if (s->checkpoint.v[i] != prompt->v[i]) {
            snprintf(err, errlen, "rewrite prefix does not match live checkpoint");
            return DS4_SESSION_REWRITE_ERROR;
        }
    }

    if (common == s->checkpoint.len) {
        return ds4_session_sync(s, prompt, err, errlen) == 0 ?
            DS4_SESSION_REWRITE_OK : DS4_SESSION_REWRITE_ERROR;
    }

    if (ds4_session_rewrite_requires_rebuild(s->checkpoint.len, prompt->len, common)) {
        snprintf(err, errlen, "rewrite needs rebuild: common=%d live=%d canonical=%d",
                 common, s->checkpoint.len, prompt->len);
        return DS4_SESSION_REWRITE_REBUILD_NEEDED;
    }

    snprintf(err, errlen, "unexpected canonical rewrite state");
    return DS4_SESSION_REWRITE_ERROR;
}

int ds4_session_common_prefix(ds4_session *s, const ds4_tokens *prompt) {
    if (!s->checkpoint_valid) return 0;
    int n = s->checkpoint.len < prompt->len ? s->checkpoint.len : prompt->len;
    int i = 0;
    while (i < n && s->checkpoint.v[i] == prompt->v[i]) i++;
    return i;
}

int ds4_session_argmax(ds4_session *s) {
    return sample_argmax(s->logits, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
el may have emitted
 * DSML in an order that is semantically valid but not byte-for-byte equal to the
 * canonical prompt we will see on the next request.  Rewriting only the token
 * checkpoint is not enough: the backend still contains raw and compressed rows
 * for the old suffix.  Until we have a real frontier snapshot at the
 * rewrite point, any replacement behind the live end reports that a rebuild is
 * needed without mutating the session.  The server may still find an older disk KV
 * checkpoint before falling back to a full replay. */
ds4_session_rewrite_result ds4_session_rewrite_from_common(
        ds4_session *s, const ds4_tokens *prompt, int common,
        char *err, size_t errlen) {
    if (!s || !prompt || prompt->len <= 0 || prompt->len >= s->ctx_size) {
        snprintf(err, errlen, "prompt exceeds context");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (!s->checkpoint_valid) {
        snprintf(err, errlen, "session has no valid checkpoint");
        return DS4_SESSION_REWRITE_ERROR;
    }
    if (common < 0 || common > s->checkpoint.len || common > prompt->len) {
        snprintf(err, errlen, "invalid rewrite prefix");
        return DS4_SESSION_REWRITE_ERROR;
    }
    for (int i = 0; i < common; i++) {
        if (s->checkpoint.v[i] != prompt->v[i]) {
            snprintf(err, errlen, "rewrite prefix does not match live checkpoint");
            return DS4_SESSION_REWRITE_ERROR;
        }
    }

    if (common == s->checkpoint.len) {
        return ds4_session_sync(s, prompt, err, errlen) == 0 ?
            DS4_SESSION_REWRITE_OK : DS4_SESSION_REWRITE_ERROR;
    }

    if (ds4_session_rewrite_requires_rebuild(s->checkpoint.len, prompt->len, common)) {
        snprintf(err, errlen, "rewrite needs rebuild: common=%d live=%d canonical=%d",
                 common, s->checkpoint.len, prompt->len);
        return DS4_SESSION_REWRITE_REBUILD_NEEDED;
    }

    snprintf(err, errlen, "unexpected canonical rewrite state");
    return DS4_SESSION_REWRITE_ERROR;
}

int ds4_session_common_prefix(ds4_session *s, const ds4_tokens *prompt) {
    if (!s->checkpoint_valid) return 0;
    int n = s->checkpoint.len < prompt->len ? s->checkpoint.len : prompt->len;
    int i = 0;
    while (i < n && s->checkpoint.v[i] == prompt->v[i]) i++;
    return i;
}

int ds4_session_argmax(ds4_session *s) {
    return sample_argmax(s->logits, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ts, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        if ((int)i == excluded_id) continue;
        const float v = s->logits[i];
        if (best < 0 || v > best_logit) {
            best = (int)i;
            best_logit = v;
        }
    }
    return best;
}

int ds4_session_sample(ds4_session *s, float temperature, int top_k, float top_p, float min_p, uint64_t *rng) {
    return sample_top_p_min_p(s->logits, DS4_N_VOCAB, temperature, top_k, top_p, min_p, rng);
}

int ds4_session_top_logprobs(ds4_session *s, ds4_token_score *out, int k) {
    if (!s || !out || k <= 0) return 0;
    if (k > (int)DS4_N_VOCAB) k = (int)DS4_N_VOCAB;
    for (int i = 0; i < k; i++) {
        out[i].id = -1;
        out[i].logit = DS4_NEG_INF;
        out[i].logprob = DS4_NEG_INF;
    }

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (!isfinite(v)) continue;
        if (v > max_logit) max_logit = v;
        for (int j = 0; j < k; j++) {
            if (out[j].id < 0 || v > out[j].logit) {
                for (int l = k - 1; l > j; l--) out[l] = out[l - 1];
                out[j].id = (int)i;
                out[j].logit = v;
                break;
            }
        }
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    for (int i = 0; i < k && out[i].id >= 0; i++) {
        out[i].logprob = isfinite(out[i].logit) ? (float)((double)out[i].logit - logsum) : DS4_NEG_INF;
    }
    return k;
}

int ds4_session_token_logprob(ds4_session *s, int token, ds4_token_score *out) {
    if (!s || !out || token < 0 || token >= (int)DS4_N_VOCAB) return 0;

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v) && v > max_logit) max_logit = v;
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ts, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        if ((int)i == excluded_id) continue;
        const float v = s->logits[i];
        if (best < 0 || v > best_logit) {
            best = (int)i;
            best_logit = v;
        }
    }
    return best;
}

int ds4_session_sample(ds4_session *s, float temperature, int top_k, float top_p, float min_p, uint64_t *rng) {
    return sample_top_p_min_p(s->logits, DS4_N_VOCAB, temperature, top_k, top_p, min_p, rng);
}

int ds4_session_top_logprobs(ds4_session *s, ds4_token_score *out, int k) {
    if (!s || !out || k <= 0) return 0;
    if (k > (int)DS4_N_VOCAB) k = (int)DS4_N_VOCAB;
    for (int i = 0; i < k; i++) {
        out[i].id = -1;
        out[i].logit = DS4_NEG_INF;
        out[i].logprob = DS4_NEG_INF;
    }

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (!isfinite(v)) continue;
        if (v > max_logit) max_logit = v;
        for (int j = 0; j < k; j++) {
            if (out[j].id < 0 || v > out[j].logit) {
                for (int l = k - 1; l > j; l--) out[l] = out[l - 1];
                out[j].id = (int)i;
                out[j].logit = v;
                break;
            }
        }
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    for (int i = 0; i < k && out[i].id >= 0; i++) {
        out[i].logprob = isfinite(out[i].logit) ? (float)((double)out[i].logit - logsum) : DS4_NEG_INF;
    }
    return k;
}

int ds4_session_token_logprob(ds4_session *s, int token, ds4_token_score *out) {
    if (!s || !out || token < 0 || token >= (int)DS4_N_VOCAB) return 0;

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v) && v > max_logit) max_logit = v;
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ts, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        if ((int)i == excluded_id) continue;
        const float v = s->logits[i];
        if (best < 0 || v > best_logit) {
            best = (int)i;
            best_logit = v;
        }
    }
    return best;
}

int ds4_session_sample(ds4_session *s, float temperature, int top_k, float top_p, float min_p, uint64_t *rng) {
    return sample_top_p_min_p(s->logits, DS4_N_VOCAB, temperature, top_k, top_p, min_p, rng);
}

int ds4_session_top_logprobs(ds4_session *s, ds4_token_score *out, int k) {
    if (!s || !out || k <= 0) return 0;
    if (k > (int)DS4_N_VOCAB) k = (int)DS4_N_VOCAB;
    for (int i = 0; i < k; i++) {
        out[i].id = -1;
        out[i].logit = DS4_NEG_INF;
        out[i].logprob = DS4_NEG_INF;
    }

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (!isfinite(v)) continue;
        if (v > max_logit) max_logit = v;
        for (int j = 0; j < k; j++) {
            if (out[j].id < 0 || v > out[j].logit) {
                for (int l = k - 1; l > j; l--) out[l] = out[l - 1];
                out[j].id = (int)i;
                out[j].logit = v;
                break;
            }
        }
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    for (int i = 0; i < k && out[i].id >= 0; i++) {
        out[i].logprob = isfinite(out[i].logit) ? (float)((double)out[i].logit - logsum) : DS4_NEG_INF;
    }
    return k;
}

int ds4_session_token_logprob(ds4_session *s, int token, ds4_token_score *out) {
    if (!s || !out || token < 0 || token >= (int)DS4_N_VOCAB) return 0;

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v) && v > max_logit) max_logit = v;
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ts, DS4_N_VOCAB);
}

int ds4_session_argmax_excluding(ds4_session *s, int excluded_id) {
    if (!s || !s->logits) return -1;
    int best = -1;
    float best_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        if ((int)i == excluded_id) continue;
        const float v = s->logits[i];
        if (best < 0 || v > best_logit) {
            best = (int)i;
            best_logit = v;
        }
    }
    return best;
}

int ds4_session_sample(ds4_session *s, float temperature, int top_k, float top_p, float min_p, uint64_t *rng) {
    return sample_top_p_min_p(s->logits, DS4_N_VOCAB, temperature, top_k, top_p, min_p, rng);
}

int ds4_session_top_logprobs(ds4_session *s, ds4_token_score *out, int k) {
    if (!s || !out || k <= 0) return 0;
    if (k > (int)DS4_N_VOCAB) k = (int)DS4_N_VOCAB;
    for (int i = 0; i < k; i++) {
        out[i].id = -1;
        out[i].logit = DS4_NEG_INF;
        out[i].logprob = DS4_NEG_INF;
    }

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (!isfinite(v)) continue;
        if (v > max_logit) max_logit = v;
        for (int j = 0; j < k; j++) {
            if (out[j].id < 0 || v > out[j].logit) {
                for (int l = k - 1; l > j; l--) out[l] = out[l - 1];
                out[j].id = (int)i;
                out[j].logit = v;
                break;
            }
        }
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    for (int i = 0; i < k && out[i].id >= 0; i++) {
        out[i].logprob = isfinite(out[i].logit) ? (float)((double)out[i].logit - logsum) : DS4_NEG_INF;
    }
    return k;
}

int ds4_session_token_logprob(ds4_session *s, int token, ds4_token_score *out) {
    if (!s || !out || token < 0 || token >= (int)DS4_N_VOCAB) return 0;

    float max_logit = DS4_NEG_INF;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v) && v > max_logit) max_logit = v;
    }
    if (!isfinite(max_logit)) return 0;

    double sum = 0.0;
    for (uint32_t i = 0; i < DS4_N_VOCAB; i++) {
        const float v = s->logits[i];
        if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
    out->logprob = isfinite(out->logit) ? (float)((double)out->logit - logsum) : DS4_NEG_INF;
    return 1;
}

static int ds4_session_eval_internal(ds4_session *s, int token, bool probe_mtp,
                                     char *err, size_t errlen) {
    if (!s) return 1;
    if (ds4_session_is_cpu(s)) {
        ds4_engine *e = s->engine;
        forward_token_raw_swa_cpu_decode_scratch(s->logits,
                                                 &e->model,
                                                 &e->weights,
                                                 &s->cpu_cache,
                                                 token,
                                                 (uint32_t)s->checkpoint.len,
                                                 e->directional_steering_dirs,
                                                 e->directional_steering_attn_scale,
                                                 e->directional_steering_ffn_scale,
                                                 &s->cpu_scratch);
        token_vec_push(&s->checkpoint, token);
        s->checkpoint_valid = true;
        s->mtp_draft_valid = false;
        (void)probe_mtp;
        return 0;
    }
#ifdef DS4_NO_GPU
    (void)s;
    (void)token;
    (void)probe_mtp;
    snprintf(err, errlen, "GPU support is not compiled in");
    return 1;
#else
    ds4_engine *e = s->engine;
    const bool mtp_probe_log = getenv("DS4_MTP_PROBE") != NULL;
    const bool mtp_should_draft =
        probe_mtp && e->mtp_ready && s->mtp_logits &&
        (e->mtp_draft_tokens > 1 || mtp_probe_log);
    if (probe_mtp && s->mtp_draft_valid) {
        if (mtp_probe_log) {
            s->mtp_probe_total++;
            if (s->mtp_draft_token == token) s->mtp_probe_hit++;
            fprintf(stderr,
                    "ds4: mtp probe token=%d draft=%d hit=%llu/%llu\n",
                    token,
                    s->mtp_draft_token,
                    (unsigned long long)s->mtp_probe_hit,
                    (unsigned long long)s->mtp_probe_total);
        }
        s->mtp_draft_valid = false;
    }
    if (!metal_graph_eval_token_raw_swa(&s->graph, &e->model, &e->weights,
                                        (uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
    out->logprob = isfinite(out->logit) ? (float)((double)out->logit - logsum) : DS4_NEG_INF;
    return 1;
}

static int ds4_session_eval_internal(ds4_session *s, int token, bool probe_mtp,
                                     char *err, size_t errlen) {
    if (!s) return 1;
    if (ds4_session_is_cpu(s)) {
        ds4_engine *e = s->engine;
        forward_token_raw_swa_cpu_decode_scratch(s->logits,
                                                 &e->model,
                                                 &e->weights,
                                                 &s->cpu_cache,
                                                 token,
                                                 (uint32_t)s->checkpoint.len,
                                                 e->directional_steering_dirs,
                                                 e->directional_steering_attn_scale,
                                                 e->directional_steering_ffn_scale,
                                                 &s->cpu_scratch);
        token_vec_push(&s->checkpoint, token);
        s->checkpoint_valid = true;
        s->mtp_draft_valid = false;
        (void)probe_mtp;
        return 0;
    }
#ifdef DS4_NO_GPU
    (void)s;
    (void)token;
    (void)probe_mtp;
    snprintf(err, errlen, "GPU support is not compiled in");
    return 1;
#else
    ds4_engine *e = s->engine;
    const bool mtp_probe_log = getenv("DS4_MTP_PROBE") != NULL;
    const bool mtp_should_draft =
        probe_mtp && e->mtp_ready && s->mtp_logits &&
        (e->mtp_draft_tokens > 1 || mtp_probe_log);
    if (probe_mtp && s->mtp_draft_valid) {
        if (mtp_probe_log) {
            s->mtp_probe_total++;
            if (s->mtp_draft_token == token) s->mtp_probe_hit++;
            fprintf(stderr,
                    "ds4: mtp probe token=%d draft=%d hit=%llu/%llu\n",
                    token,
                    s->mtp_draft_token,
                    (unsigned long long)s->mtp_probe_hit,
                    (unsigned long long)s->mtp_probe_total);
        }
        s->mtp_draft_valid = false;
    }
    if (!metal_graph_eval_token_raw_swa(&s->graph, &e->model, &e->weights,
                                        (uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
    out->logprob = isfinite(out->logit) ? (float)((double)out->logit - logsum) : DS4_NEG_INF;
    return 1;
}

static int ds4_session_eval_internal(ds4_session *s, int token, bool probe_mtp,
                                     char *err, size_t errlen) {
    if (!s) return 1;
    if (ds4_session_is_cpu(s)) {
        ds4_engine *e = s->engine;
        forward_token_raw_swa_cpu_decode_scratch(s->logits,
                                                 &e->model,
                                                 &e->weights,
                                                 &s->cpu_cache,
                                                 token,
                                                 (uint32_t)s->checkpoint.len,
                                                 e->directional_steering_dirs,
                                                 e->directional_steering_attn_scale,
                                                 e->directional_steering_ffn_scale,
                                                 &s->cpu_scratch);
        token_vec_push(&s->checkpoint, token);
        s->checkpoint_valid = true;
        s->mtp_draft_valid = false;
        (void)probe_mtp;
        return 0;
    }
#ifdef DS4_NO_GPU
    (void)s;
    (void)token;
    (void)probe_mtp;
    snprintf(err, errlen, "GPU support is not compiled in");
    return 1;
#else
    ds4_engine *e = s->engine;
    const bool mtp_probe_log = getenv("DS4_MTP_PROBE") != NULL;
    const bool mtp_should_draft =
        probe_mtp && e->mtp_ready && s->mtp_logits &&
        (e->mtp_draft_tokens > 1 || mtp_probe_log);
    if (probe_mtp && s->mtp_draft_valid) {
        if (mtp_probe_log) {
            s->mtp_probe_total++;
            if (s->mtp_draft_token == token) s->mtp_probe_hit++;
            fprintf(stderr,
                    "ds4: mtp probe token=%d draft=%d hit=%llu/%llu\n",
                    token,
                    s->mtp_draft_token,
                    (unsigned long long)s->mtp_probe_hit,
                    (unsigned long long)s->mtp_probe_total);
        }
        s->mtp_draft_valid = false;
    }
    if (!metal_graph_eval_token_raw_swa(&s->graph, &e->model, &e->weights,
                                        (uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
if (isfinite(v)) sum += exp((double)v - (double)max_logit);
    }
    const double logsum = (double)max_logit + log(sum);
    out->id = token;
    out->logit = s->logits[token];
    out->logprob = isfinite(out->logit) ? (float)((double)out->logit - logsum) : DS4_NEG_INF;
    return 1;
}

static int ds4_session_eval_internal(ds4_session *s, int token, bool probe_mtp,
                                     char *err, size_t errlen) {
    if (!s) return 1;
    if (ds4_session_is_cpu(s)) {
        ds4_engine *e = s->engine;
        forward_token_raw_swa_cpu_decode_scratch(s->logits,
                                                 &e->model,
                                                 &e->weights,
                                                 &s->cpu_cache,
                                                 token,
                                                 (uint32_t)s->checkpoint.len,
                                                 e->directional_steering_dirs,
                                                 e->directional_steering_attn_scale,
                                                 e->directional_steering_ffn_scale,
                                                 &s->cpu_scratch);
        token_vec_push(&s->checkpoint, token);
        s->checkpoint_valid = true;
        s->mtp_draft_valid = false;
        (void)probe_mtp;
        return 0;
    }
#ifdef DS4_NO_GPU
    (void)s;
    (void)token;
    (void)probe_mtp;
    snprintf(err, errlen, "GPU support is not compiled in");
    return 1;
#else
    ds4_engine *e = s->engine;
    const bool mtp_probe_log = getenv("DS4_MTP_PROBE") != NULL;
    const bool mtp_should_draft =
        probe_mtp && e->mtp_ready && s->mtp_logits &&
        (e->mtp_draft_tokens > 1 || mtp_probe_log);
    if (probe_mtp && s->mtp_draft_valid) {
        if (mtp_probe_log) {
            s->mtp_probe_total++;
            if (s->mtp_draft_token == token) s->mtp_probe_hit++;
            fprintf(stderr,
                    "ds4: mtp probe token=%d draft=%d hit=%llu/%llu\n",
                    token,
                    s->mtp_draft_token,
                    (unsigned long long)s->mtp_probe_hit,
                    (unsigned long long)s->mtp_probe_total);
        }
        s->mtp_draft_valid = false;
    }
    if (!metal_graph_eval_token_raw_swa(&s->graph, &e->model, &e->weights,
                                        (uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
(uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
        snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
        s->checkpoint_valid = false;
        return 1;
    }
    token_vec_push(&s->checkpoint, token);
    if (mtp_should_draft) {
        int mtp_top = -1;
        if (metal_graph_eval_mtp_draft(&s->graph,
                                       &e->model,
                                       &e->weights,
                                       &e->mtp_model,
                                       &e->mtp_weights,
                                       token,
                                       (uint32_t)(s->checkpoint.len - 1),
                                       getenv("DS4_MTP_FULL_LOGITS") ? s->mtp_logits : NULL,
                                       &mtp_top)) {
            s->mtp_draft_token = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
            s->mtp_draft_valid = true;
        } else if (getenv("DS4_MTP_PROBE")) {
            fprintf(stderr, "ds4: mtp probe draft failed\n");
        }
    }
    return 0;
#endif
}

int ds4_session_eval(ds4_session *s, int token, char *err, size_t errlen) {
    return ds4_session_eval_internal(s, token, true, err, errlen);
}

/* Speculative decode state machine:
 * 1. commit the normal target token and use its logits to validate draft[0];
 * 2. let MTP recursively draft a tiny suffix from its own raw-cache frontier;
 * 3. verify the suffix with the target graph, committing only the accepted
 *    prefix and rolling back speculative Metal state on miss;
 * 4. fall back to ordinary one-token decode if the fast verifier cannot prove
 *    the target stream. */
int ds4_session_eval_speculative_argmax(ds4_session *s, int first_token,
                                        int max_tokens, int eos_token,
                                        int *accepted, int accepted_cap,
                                        char *err, size_t errlen) {
    if (ds4_session_is_cpu(s)) {
        (void)max_tokens;
        (void)eos_token;
        if (!accepted || accepted_cap <= 0) return 0;
        if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
        accepted[0] = first_token;
        return 1;
    }
#ifdef DS4_NO_GPU
    (void)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
(uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
        snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
        s->checkpoint_valid = false;
        return 1;
    }
    token_vec_push(&s->checkpoint, token);
    if (mtp_should_draft) {
        int mtp_top = -1;
        if (metal_graph_eval_mtp_draft(&s->graph,
                                       &e->model,
                                       &e->weights,
                                       &e->mtp_model,
                                       &e->mtp_weights,
                                       token,
                                       (uint32_t)(s->checkpoint.len - 1),
                                       getenv("DS4_MTP_FULL_LOGITS") ? s->mtp_logits : NULL,
                                       &mtp_top)) {
            s->mtp_draft_token = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
            s->mtp_draft_valid = true;
        } else if (getenv("DS4_MTP_PROBE")) {
            fprintf(stderr, "ds4: mtp probe draft failed\n");
        }
    }
    return 0;
#endif
}

int ds4_session_eval(ds4_session *s, int token, char *err, size_t errlen) {
    return ds4_session_eval_internal(s, token, true, err, errlen);
}

/* Speculative decode state machine:
 * 1. commit the normal target token and use its logits to validate draft[0];
 * 2. let MTP recursively draft a tiny suffix from its own raw-cache frontier;
 * 3. verify the suffix with the target graph, committing only the accepted
 *    prefix and rolling back speculative Metal state on miss;
 * 4. fall back to ordinary one-token decode if the fast verifier cannot prove
 *    the target stream. */
int ds4_session_eval_speculative_argmax(ds4_session *s, int first_token,
                                        int max_tokens, int eos_token,
                                        int *accepted, int accepted_cap,
                                        char *err, size_t errlen) {
    if (ds4_session_is_cpu(s)) {
        (void)max_tokens;
        (void)eos_token;
        if (!accepted || accepted_cap <= 0) return 0;
        if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
        accepted[0] = first_token;
        return 1;
    }
#ifdef DS4_NO_GPU
    (void)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
(uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
        snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
        s->checkpoint_valid = false;
        return 1;
    }
    token_vec_push(&s->checkpoint, token);
    if (mtp_should_draft) {
        int mtp_top = -1;
        if (metal_graph_eval_mtp_draft(&s->graph,
                                       &e->model,
                                       &e->weights,
                                       &e->mtp_model,
                                       &e->mtp_weights,
                                       token,
                                       (uint32_t)(s->checkpoint.len - 1),
                                       getenv("DS4_MTP_FULL_LOGITS") ? s->mtp_logits : NULL,
                                       &mtp_top)) {
            s->mtp_draft_token = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
            s->mtp_draft_valid = true;
        } else if (getenv("DS4_MTP_PROBE")) {
            fprintf(stderr, "ds4: mtp probe draft failed\n");
        }
    }
    return 0;
#endif
}

int ds4_session_eval(ds4_session *s, int token, char *err, size_t errlen) {
    return ds4_session_eval_internal(s, token, true, err, errlen);
}

/* Speculative decode state machine:
 * 1. commit the normal target token and use its logits to validate draft[0];
 * 2. let MTP recursively draft a tiny suffix from its own raw-cache frontier;
 * 3. verify the suffix with the target graph, committing only the accepted
 *    prefix and rolling back speculative Metal state on miss;
 * 4. fall back to ordinary one-token decode if the fast verifier cannot prove
 *    the target stream. */
int ds4_session_eval_speculative_argmax(ds4_session *s, int first_token,
                                        int max_tokens, int eos_token,
                                        int *accepted, int accepted_cap,
                                        char *err, size_t errlen) {
    if (ds4_session_is_cpu(s)) {
        (void)max_tokens;
        (void)eos_token;
        if (!accepted || accepted_cap <= 0) return 0;
        if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
        accepted[0] = first_token;
        return 1;
    }
#ifdef DS4_NO_GPU
    (void)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
(uint32_t)token,
                                        (uint32_t)s->checkpoint.len,
                                        s->logits))
    {
        snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
        s->checkpoint_valid = false;
        return 1;
    }
    token_vec_push(&s->checkpoint, token);
    if (mtp_should_draft) {
        int mtp_top = -1;
        if (metal_graph_eval_mtp_draft(&s->graph,
                                       &e->model,
                                       &e->weights,
                                       &e->mtp_model,
                                       &e->mtp_weights,
                                       token,
                                       (uint32_t)(s->checkpoint.len - 1),
                                       getenv("DS4_MTP_FULL_LOGITS") ? s->mtp_logits : NULL,
                                       &mtp_top)) {
            s->mtp_draft_token = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
            s->mtp_draft_valid = true;
        } else if (getenv("DS4_MTP_PROBE")) {
            fprintf(stderr, "ds4: mtp probe draft failed\n");
        }
    }
    return 0;
#endif
}

int ds4_session_eval(ds4_session *s, int token, char *err, size_t errlen) {
    return ds4_session_eval_internal(s, token, true, err, errlen);
}

/* Speculative decode state machine:
 * 1. commit the normal target token and use its logits to validate draft[0];
 * 2. let MTP recursively draft a tiny suffix from its own raw-cache frontier;
 * 3. verify the suffix with the target graph, committing only the accepted
 *    prefix and rolling back speculative Metal state on miss;
 * 4. fall back to ordinary one-token decode if the fast verifier cannot prove
 *    the target stream. */
int ds4_session_eval_speculative_argmax(ds4_session *s, int first_token,
                                        int max_tokens, int eos_token,
                                        int *accepted, int accepted_cap,
                                        char *err, size_t errlen) {
    if (ds4_session_is_cpu(s)) {
        (void)max_tokens;
        (void)eos_token;
        if (!accepted || accepted_cap <= 0) return 0;
        if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
        accepted[0] = first_token;
        return 1;
    }
#ifdef DS4_NO_GPU
    (void)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
d)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
    if (!s || max_tokens <= 0 || accepted_cap <= 0) return 0;
    ds4_engine *e = s->engine;

    /*
     * MTP in DeepSeek V4 is a speculative drafter, not a replacement sampler.
     * The target model still defines the exact output stream.  A cycle starts
     * by accepting one normal target token, then asks the MTP block to propose
     * a short suffix.  The suffix is useful only if the target model can verify
     * several proposed positions together; running ordinary decode once per
     * draft token is correctness-safe but cannot be faster than baseline.
     */
    if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
    int n_accept = 0;
    accepted[n_accept++] = first_token;
    if (first_token == eos_token || max_tokens == 1 || n_accept >= accepted_cap) return n_accept;

    if (!e->mtp_ready || !s->mtp_draft_valid || e->mtp_draft_tokens <= 1) return n_accept;

    int draft_cap = e->mtp_draft_tokens;
    if (draft_cap > max_tokens - n_accept) draft_cap = max_tokens - n_accept;
    if (draft_cap > accepted_cap - n_accept) draft_cap = accepted_cap - n_accept;
    int room = s->ctx_size - s->checkpoint.len;
    if (draft_cap > room - 1) draft_cap = room - 1;
    if (draft_cap <= 0) return n_accept;

    int drafts[16];
    int draft_n = 1;
    drafts[0] = s->mtp_draft_token;
    s->mtp_draft_valid = false;
    const bool strict_mtp = e->quality || getenv("DS4_MTP_STRICT") != NULL;
    float mtp_margin_threshold = e->mtp_margin;
    const char *mtp_margin_env = getenv("DS4_MTP_MIN_MARGIN");
    if (mtp_margin_env && mtp_margin_env[0]) {
        char *end = NULL;
        float v = strtof(mtp_margin_env, &end);
        if (end != mtp_margin_env && v >= 0.0f) mtp_margin_threshold = v;
    }
    const bool mtp_timing = getenv("DS4_MTP_TIMING") != NULL;
    const bool mtp_conf_log = getenv("DS4_MTP_CONF_LOG") != NULL;
    const bool mtp_need_logits = mtp_conf_log ||
        getenv("DS4_MTP_FULL_LOGITS") != NULL ||
        (!strict_mtp && mtp_margin_threshold > 0.0f);
    const double mtp_t0 = mtp_timing ? now_sec() : 0.0;
    double mtp_t_after_draft = mtp_t0;
    float mtp_last_margin = 0.0f;
    int mtp_last_top0 = -1, mtp_last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
d)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
    if (!s || max_tokens <= 0 || accepted_cap <= 0) return 0;
    ds4_engine *e = s->engine;

    /*
     * MTP in DeepSeek V4 is a speculative drafter, not a replacement sampler.
     * The target model still defines the exact output stream.  A cycle starts
     * by accepting one normal target token, then asks the MTP block to propose
     * a short suffix.  The suffix is useful only if the target model can verify
     * several proposed positions together; running ordinary decode once per
     * draft token is correctness-safe but cannot be faster than baseline.
     */
    if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
    int n_accept = 0;
    accepted[n_accept++] = first_token;
    if (first_token == eos_token || max_tokens == 1 || n_accept >= accepted_cap) return n_accept;

    if (!e->mtp_ready || !s->mtp_draft_valid || e->mtp_draft_tokens <= 1) return n_accept;

    int draft_cap = e->mtp_draft_tokens;
    if (draft_cap > max_tokens - n_accept) draft_cap = max_tokens - n_accept;
    if (draft_cap > accepted_cap - n_accept) draft_cap = accepted_cap - n_accept;
    int room = s->ctx_size - s->checkpoint.len;
    if (draft_cap > room - 1) draft_cap = room - 1;
    if (draft_cap <= 0) return n_accept;

    int drafts[16];
    int draft_n = 1;
    drafts[0] = s->mtp_draft_token;
    s->mtp_draft_valid = false;
    const bool strict_mtp = e->quality || getenv("DS4_MTP_STRICT") != NULL;
    float mtp_margin_threshold = e->mtp_margin;
    const char *mtp_margin_env = getenv("DS4_MTP_MIN_MARGIN");
    if (mtp_margin_env && mtp_margin_env[0]) {
        char *end = NULL;
        float v = strtof(mtp_margin_env, &end);
        if (end != mtp_margin_env && v >= 0.0f) mtp_margin_threshold = v;
    }
    const bool mtp_timing = getenv("DS4_MTP_TIMING") != NULL;
    const bool mtp_conf_log = getenv("DS4_MTP_CONF_LOG") != NULL;
    const bool mtp_need_logits = mtp_conf_log ||
        getenv("DS4_MTP_FULL_LOGITS") != NULL ||
        (!strict_mtp && mtp_margin_threshold > 0.0f);
    const double mtp_t0 = mtp_timing ? now_sec() : 0.0;
    double mtp_t_after_draft = mtp_t0;
    float mtp_last_margin = 0.0f;
    int mtp_last_top0 = -1, mtp_last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
d)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
    if (!s || max_tokens <= 0 || accepted_cap <= 0) return 0;
    ds4_engine *e = s->engine;

    /*
     * MTP in DeepSeek V4 is a speculative drafter, not a replacement sampler.
     * The target model still defines the exact output stream.  A cycle starts
     * by accepting one normal target token, then asks the MTP block to propose
     * a short suffix.  The suffix is useful only if the target model can verify
     * several proposed positions together; running ordinary decode once per
     * draft token is correctness-safe but cannot be faster than baseline.
     */
    if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
    int n_accept = 0;
    accepted[n_accept++] = first_token;
    if (first_token == eos_token || max_tokens == 1 || n_accept >= accepted_cap) return n_accept;

    if (!e->mtp_ready || !s->mtp_draft_valid || e->mtp_draft_tokens <= 1) return n_accept;

    int draft_cap = e->mtp_draft_tokens;
    if (draft_cap > max_tokens - n_accept) draft_cap = max_tokens - n_accept;
    if (draft_cap > accepted_cap - n_accept) draft_cap = accepted_cap - n_accept;
    int room = s->ctx_size - s->checkpoint.len;
    if (draft_cap > room - 1) draft_cap = room - 1;
    if (draft_cap <= 0) return n_accept;

    int drafts[16];
    int draft_n = 1;
    drafts[0] = s->mtp_draft_token;
    s->mtp_draft_valid = false;
    const bool strict_mtp = e->quality || getenv("DS4_MTP_STRICT") != NULL;
    float mtp_margin_threshold = e->mtp_margin;
    const char *mtp_margin_env = getenv("DS4_MTP_MIN_MARGIN");
    if (mtp_margin_env && mtp_margin_env[0]) {
        char *end = NULL;
        float v = strtof(mtp_margin_env, &end);
        if (end != mtp_margin_env && v >= 0.0f) mtp_margin_threshold = v;
    }
    const bool mtp_timing = getenv("DS4_MTP_TIMING") != NULL;
    const bool mtp_conf_log = getenv("DS4_MTP_CONF_LOG") != NULL;
    const bool mtp_need_logits = mtp_conf_log ||
        getenv("DS4_MTP_FULL_LOGITS") != NULL ||
        (!strict_mtp && mtp_margin_threshold > 0.0f);
    const double mtp_t0 = mtp_timing ? now_sec() : 0.0;
    double mtp_t_after_draft = mtp_t0;
    float mtp_last_margin = 0.0f;
    int mtp_last_top0 = -1, mtp_last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
d)s; (void)first_token; (void)max_tokens; (void)eos_token;
    (void)accepted; (void)accepted_cap;
    snprintf(err, errlen, "GPU support is not compiled in");
    return -1;
#else
    if (!s || max_tokens <= 0 || accepted_cap <= 0) return 0;
    ds4_engine *e = s->engine;

    /*
     * MTP in DeepSeek V4 is a speculative drafter, not a replacement sampler.
     * The target model still defines the exact output stream.  A cycle starts
     * by accepting one normal target token, then asks the MTP block to propose
     * a short suffix.  The suffix is useful only if the target model can verify
     * several proposed positions together; running ordinary decode once per
     * draft token is correctness-safe but cannot be faster than baseline.
     */
    if (ds4_session_eval(s, first_token, err, errlen) != 0) return -1;
    int n_accept = 0;
    accepted[n_accept++] = first_token;
    if (first_token == eos_token || max_tokens == 1 || n_accept >= accepted_cap) return n_accept;

    if (!e->mtp_ready || !s->mtp_draft_valid || e->mtp_draft_tokens <= 1) return n_accept;

    int draft_cap = e->mtp_draft_tokens;
    if (draft_cap > max_tokens - n_accept) draft_cap = max_tokens - n_accept;
    if (draft_cap > accepted_cap - n_accept) draft_cap = accepted_cap - n_accept;
    int room = s->ctx_size - s->checkpoint.len;
    if (draft_cap > room - 1) draft_cap = room - 1;
    if (draft_cap <= 0) return n_accept;

    int drafts[16];
    int draft_n = 1;
    drafts[0] = s->mtp_draft_token;
    s->mtp_draft_valid = false;
    const bool strict_mtp = e->quality || getenv("DS4_MTP_STRICT") != NULL;
    float mtp_margin_threshold = e->mtp_margin;
    const char *mtp_margin_env = getenv("DS4_MTP_MIN_MARGIN");
    if (mtp_margin_env && mtp_margin_env[0]) {
        char *end = NULL;
        float v = strtof(mtp_margin_env, &end);
        if (end != mtp_margin_env && v >= 0.0f) mtp_margin_threshold = v;
    }
    const bool mtp_timing = getenv("DS4_MTP_TIMING") != NULL;
    const bool mtp_conf_log = getenv("DS4_MTP_CONF_LOG") != NULL;
    const bool mtp_need_logits = mtp_conf_log ||
        getenv("DS4_MTP_FULL_LOGITS") != NULL ||
        (!strict_mtp && mtp_margin_threshold > 0.0f);
    const double mtp_t0 = mtp_timing ? now_sec() : 0.0;
    double mtp_t_after_draft = mtp_t0;
    float mtp_last_margin = 0.0f;
    int mtp_last_top0 = -1, mtp_last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
     * this point there is no suffix to verify, so the exact behavior is to emit
     * only first_token and skip all speculative work.
     */
    if (sample_argmax(s->logits, DS4_N_VOCAB) != drafts[0]) {
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec miss first draft=%d\n", drafts[0]);
        }
        return n_accept;
    }
    if (drafts[0] == eos_token) draft_cap = 1;
    const uint32_t mtp_base_raw = s->graph.mtp_n_raw;
    /*
     * MTP has its own raw SWA cache. Recursive drafting writes speculative
     * future rows into it; after verification, rows beyond the accepted prefix
     * must become invisible.  We do not copy/rollback the cache body because the
     * next draft attempt will overwrite future slots.  A counter is enough.
     */
#define DS4_MTP_KEEP_ACCEPTED(n_) do { \
        uint32_t keep_ = mtp_base_raw + (uint32_t)(n_); \
        if (keep_ > s->graph.raw_window) keep_ = s->graph.raw_window; \
        s->graph.mtp_n_raw = keep_; \
    } while (0)

    for (; draft_n < draft_cap; draft_n++) {
        ds4_gpu_tensor *prev_hc = (draft_n & 1) ? s->graph.mtp_state_hc : s->graph.mtp_next_hc;
        ds4_gpu_tensor *out_hc = (draft_n & 1) ? s->graph.mtp_next_hc : s->graph.mtp_state_hc;
        int mtp_top = -1;
        if (!metal_graph_eval_mtp_draft_from_hc(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &e->mtp_model,
                                                &e->mtp_weights,
                                                prev_hc,
                                                out_hc,
                                                drafts[draft_n - 1],
                                                (uint32_t)(s->checkpoint.len + draft_n - 1),
                                                mtp_need_logits ? s->mtp_logits : NULL,
                                                &mtp_top))
        {
            return n_accept;
        }
        drafts[draft_n] = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
     * this point there is no suffix to verify, so the exact behavior is to emit
     * only first_token and skip all speculative work.
     */
    if (sample_argmax(s->logits, DS4_N_VOCAB) != drafts[0]) {
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec miss first draft=%d\n", drafts[0]);
        }
        return n_accept;
    }
    if (drafts[0] == eos_token) draft_cap = 1;
    const uint32_t mtp_base_raw = s->graph.mtp_n_raw;
    /*
     * MTP has its own raw SWA cache. Recursive drafting writes speculative
     * future rows into it; after verification, rows beyond the accepted prefix
     * must become invisible.  We do not copy/rollback the cache body because the
     * next draft attempt will overwrite future slots.  A counter is enough.
     */
#define DS4_MTP_KEEP_ACCEPTED(n_) do { \
        uint32_t keep_ = mtp_base_raw + (uint32_t)(n_); \
        if (keep_ > s->graph.raw_window) keep_ = s->graph.raw_window; \
        s->graph.mtp_n_raw = keep_; \
    } while (0)

    for (; draft_n < draft_cap; draft_n++) {
        ds4_gpu_tensor *prev_hc = (draft_n & 1) ? s->graph.mtp_state_hc : s->graph.mtp_next_hc;
        ds4_gpu_tensor *out_hc = (draft_n & 1) ? s->graph.mtp_next_hc : s->graph.mtp_state_hc;
        int mtp_top = -1;
        if (!metal_graph_eval_mtp_draft_from_hc(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &e->mtp_model,
                                                &e->mtp_weights,
                                                prev_hc,
                                                out_hc,
                                                drafts[draft_n - 1],
                                                (uint32_t)(s->checkpoint.len + draft_n - 1),
                                                mtp_need_logits ? s->mtp_logits : NULL,
                                                &mtp_top))
        {
            return n_accept;
        }
        drafts[draft_n] = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
     * this point there is no suffix to verify, so the exact behavior is to emit
     * only first_token and skip all speculative work.
     */
    if (sample_argmax(s->logits, DS4_N_VOCAB) != drafts[0]) {
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec miss first draft=%d\n", drafts[0]);
        }
        return n_accept;
    }
    if (drafts[0] == eos_token) draft_cap = 1;
    const uint32_t mtp_base_raw = s->graph.mtp_n_raw;
    /*
     * MTP has its own raw SWA cache. Recursive drafting writes speculative
     * future rows into it; after verification, rows beyond the accepted prefix
     * must become invisible.  We do not copy/rollback the cache body because the
     * next draft attempt will overwrite future slots.  A counter is enough.
     */
#define DS4_MTP_KEEP_ACCEPTED(n_) do { \
        uint32_t keep_ = mtp_base_raw + (uint32_t)(n_); \
        if (keep_ > s->graph.raw_window) keep_ = s->graph.raw_window; \
        s->graph.mtp_n_raw = keep_; \
    } while (0)

    for (; draft_n < draft_cap; draft_n++) {
        ds4_gpu_tensor *prev_hc = (draft_n & 1) ? s->graph.mtp_state_hc : s->graph.mtp_next_hc;
        ds4_gpu_tensor *out_hc = (draft_n & 1) ? s->graph.mtp_next_hc : s->graph.mtp_state_hc;
        int mtp_top = -1;
        if (!metal_graph_eval_mtp_draft_from_hc(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &e->mtp_model,
                                                &e->mtp_weights,
                                                prev_hc,
                                                out_hc,
                                                drafts[draft_n - 1],
                                                (uint32_t)(s->checkpoint.len + draft_n - 1),
                                                mtp_need_logits ? s->mtp_logits : NULL,
                                                &mtp_top))
        {
            return n_accept;
        }
        drafts[draft_n] = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
last_top1 = -1;

    /*
     * The first proposed token is verified for free: ds4_session_eval() just
     * produced the base logits for the committed prefix.  If MTP disagrees at
     * this point there is no suffix to verify, so the exact behavior is to emit
     * only first_token and skip all speculative work.
     */
    if (sample_argmax(s->logits, DS4_N_VOCAB) != drafts[0]) {
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec miss first draft=%d\n", drafts[0]);
        }
        return n_accept;
    }
    if (drafts[0] == eos_token) draft_cap = 1;
    const uint32_t mtp_base_raw = s->graph.mtp_n_raw;
    /*
     * MTP has its own raw SWA cache. Recursive drafting writes speculative
     * future rows into it; after verification, rows beyond the accepted prefix
     * must become invisible.  We do not copy/rollback the cache body because the
     * next draft attempt will overwrite future slots.  A counter is enough.
     */
#define DS4_MTP_KEEP_ACCEPTED(n_) do { \
        uint32_t keep_ = mtp_base_raw + (uint32_t)(n_); \
        if (keep_ > s->graph.raw_window) keep_ = s->graph.raw_window; \
        s->graph.mtp_n_raw = keep_; \
    } while (0)

    for (; draft_n < draft_cap; draft_n++) {
        ds4_gpu_tensor *prev_hc = (draft_n & 1) ? s->graph.mtp_state_hc : s->graph.mtp_next_hc;
        ds4_gpu_tensor *out_hc = (draft_n & 1) ? s->graph.mtp_next_hc : s->graph.mtp_state_hc;
        int mtp_top = -1;
        if (!metal_graph_eval_mtp_draft_from_hc(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &e->mtp_model,
                                                &e->mtp_weights,
                                                prev_hc,
                                                out_hc,
                                                drafts[draft_n - 1],
                                                (uint32_t)(s->checkpoint.len + draft_n - 1),
                                                mtp_need_logits ? s->mtp_logits : NULL,
                                                &mtp_top))
        {
            return n_accept;
        }
        drafts[draft_n] = mtp_top >= 0 ? mtp_top : sample_argmax(s->mtp_logits, DS4_N_VOCAB);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
B);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
        logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
        mtp_last_margin = v0 - v1;
    }
    if (mtp_timing) mtp_t_after_draft = now_sec();

    if (!strict_mtp && draft_n == 2 && mtp_margin_threshold > 0.0f) {
        if (!mtp_conf_log) {
            float v0 = 0.0f, v1 = 0.0f;
            logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
            mtp_last_margin = v0 - v1;
        }
        if (mtp_last_margin < mtp_margin_threshold) {
            float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
            const int start = s->checkpoint.len;
            const double verify_t0 = mtp_timing ? now_sec() : 0.0;
            bool ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                     &e->model,
                                                     &e->weights,
                                                     drafts[0],
                                                     (uint32_t)start,
                                                     row_logits);
            if (!ok) {
                free(row_logits);
                snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
                s->checkpoint_valid = false;
                return -1;
            }
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            free(row_logits);
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing margin-skip drafted=2 committed=1 margin=%.3f threshold=%.3f draft=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        mtp_last_margin,
                        mtp_margin_threshold,
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (done - verify_t0) * 1000.0,
                        (done - mtp_t0) * 1000.0);
            }
            return n_accept;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
B);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
        logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
        mtp_last_margin = v0 - v1;
    }
    if (mtp_timing) mtp_t_after_draft = now_sec();

    if (!strict_mtp && draft_n == 2 && mtp_margin_threshold > 0.0f) {
        if (!mtp_conf_log) {
            float v0 = 0.0f, v1 = 0.0f;
            logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
            mtp_last_margin = v0 - v1;
        }
        if (mtp_last_margin < mtp_margin_threshold) {
            float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
            const int start = s->checkpoint.len;
            const double verify_t0 = mtp_timing ? now_sec() : 0.0;
            bool ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                     &e->model,
                                                     &e->weights,
                                                     drafts[0],
                                                     (uint32_t)start,
                                                     row_logits);
            if (!ok) {
                free(row_logits);
                snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
                s->checkpoint_valid = false;
                return -1;
            }
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            free(row_logits);
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing margin-skip drafted=2 committed=1 margin=%.3f threshold=%.3f draft=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        mtp_last_margin,
                        mtp_margin_threshold,
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (done - verify_t0) * 1000.0,
                        (done - mtp_t0) * 1000.0);
            }
            return n_accept;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
B);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
        logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
        mtp_last_margin = v0 - v1;
    }
    if (mtp_timing) mtp_t_after_draft = now_sec();

    if (!strict_mtp && draft_n == 2 && mtp_margin_threshold > 0.0f) {
        if (!mtp_conf_log) {
            float v0 = 0.0f, v1 = 0.0f;
            logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
            mtp_last_margin = v0 - v1;
        }
        if (mtp_last_margin < mtp_margin_threshold) {
            float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
            const int start = s->checkpoint.len;
            const double verify_t0 = mtp_timing ? now_sec() : 0.0;
            bool ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                     &e->model,
                                                     &e->weights,
                                                     drafts[0],
                                                     (uint32_t)start,
                                                     row_logits);
            if (!ok) {
                free(row_logits);
                snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
                s->checkpoint_valid = false;
                return -1;
            }
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            free(row_logits);
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing margin-skip drafted=2 committed=1 margin=%.3f threshold=%.3f draft=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        mtp_last_margin,
                        mtp_margin_threshold,
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (done - verify_t0) * 1000.0,
                        (done - mtp_t0) * 1000.0);
            }
            return n_accept;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
B);
        if (drafts[draft_n] == eos_token) {
            draft_n++;
            break;
        }
    }
    if (mtp_conf_log && draft_n > 1) {
        float v0 = 0.0f, v1 = 0.0f;
        logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
        mtp_last_margin = v0 - v1;
    }
    if (mtp_timing) mtp_t_after_draft = now_sec();

    if (!strict_mtp && draft_n == 2 && mtp_margin_threshold > 0.0f) {
        if (!mtp_conf_log) {
            float v0 = 0.0f, v1 = 0.0f;
            logits_top2(s->mtp_logits, DS4_N_VOCAB, &mtp_last_top0, &v0, &mtp_last_top1, &v1);
            mtp_last_margin = v0 - v1;
        }
        if (mtp_last_margin < mtp_margin_threshold) {
            float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
            const int start = s->checkpoint.len;
            const double verify_t0 = mtp_timing ? now_sec() : 0.0;
            bool ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                     &e->model,
                                                     &e->weights,
                                                     drafts[0],
                                                     (uint32_t)start,
                                                     row_logits);
            if (!ok) {
                free(row_logits);
                snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
                s->checkpoint_valid = false;
                return -1;
            }
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            free(row_logits);
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing margin-skip drafted=2 committed=1 margin=%.3f threshold=%.3f draft=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        mtp_last_margin,
                        mtp_margin_threshold,
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (done - verify_t0) * 1000.0,
                        (done - mtp_t0) * 1000.0);
            }
            return n_accept;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
t;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
     * partial accept.  Like the rest of the non-quality Metal path, it may pick
     * a different greedy token when batched reductions perturb nearly-tied
     * logits.  --quality / DS4_MTP_STRICT selects the exact decode verifier,
     * which preserves the one-token target stream but is not a speed win.
     */
    const bool use_decode2_exact =
        draft_n == 2 && strict_mtp && getenv("DS4_MTP_BATCH_VERIFY") == NULL;
    if (use_decode2_exact) {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        float *row0_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row0_logits[0]));
        const int start = s->checkpoint.len;
        int row0_top = -1;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        bool have_frontier = spec_frontier_snapshot(&frontier, s);
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        bool ok = have_frontier;
        if (ok) {
            ok = metal_graph_verify_decode2_exact(&s->graph,
                                                  &e->model,
                                                  &e->weights,
                                                  drafts[0],
                                                  drafts[1],
                                                  (uint32_t)start,
                                                  &row0_top,
                                                  row0_logits,
                                                  row_logits);
        }
        const double verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok && row0_top == drafts[1]) {
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            token_vec_push(&s->checkpoint, drafts[0]);
            token_vec_push(&s->checkpoint, drafts[1]);
            accepted[n_accept++] = drafts[0];
            if (n_accept < accepted_cap) accepted[n_accept++] = drafts[1];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(2);
            if (mtp_timing) {
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
t;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
     * partial accept.  Like the rest of the non-quality Metal path, it may pick
     * a different greedy token when batched reductions perturb nearly-tied
     * logits.  --quality / DS4_MTP_STRICT selects the exact decode verifier,
     * which preserves the one-token target stream but is not a speed win.
     */
    const bool use_decode2_exact =
        draft_n == 2 && strict_mtp && getenv("DS4_MTP_BATCH_VERIFY") == NULL;
    if (use_decode2_exact) {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        float *row0_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row0_logits[0]));
        const int start = s->checkpoint.len;
        int row0_top = -1;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        bool have_frontier = spec_frontier_snapshot(&frontier, s);
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        bool ok = have_frontier;
        if (ok) {
            ok = metal_graph_verify_decode2_exact(&s->graph,
                                                  &e->model,
                                                  &e->weights,
                                                  drafts[0],
                                                  drafts[1],
                                                  (uint32_t)start,
                                                  &row0_top,
                                                  row0_logits,
                                                  row_logits);
        }
        const double verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok && row0_top == drafts[1]) {
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            token_vec_push(&s->checkpoint, drafts[0]);
            token_vec_push(&s->checkpoint, drafts[1]);
            accepted[n_accept++] = drafts[0];
            if (n_accept < accepted_cap) accepted[n_accept++] = drafts[1];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(2);
            if (mtp_timing) {
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
t;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
     * partial accept.  Like the rest of the non-quality Metal path, it may pick
     * a different greedy token when batched reductions perturb nearly-tied
     * logits.  --quality / DS4_MTP_STRICT selects the exact decode verifier,
     * which preserves the one-token target stream but is not a speed win.
     */
    const bool use_decode2_exact =
        draft_n == 2 && strict_mtp && getenv("DS4_MTP_BATCH_VERIFY") == NULL;
    if (use_decode2_exact) {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        float *row0_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row0_logits[0]));
        const int start = s->checkpoint.len;
        int row0_top = -1;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        bool have_frontier = spec_frontier_snapshot(&frontier, s);
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        bool ok = have_frontier;
        if (ok) {
            ok = metal_graph_verify_decode2_exact(&s->graph,
                                                  &e->model,
                                                  &e->weights,
                                                  drafts[0],
                                                  drafts[1],
                                                  (uint32_t)start,
                                                  &row0_top,
                                                  row0_logits,
                                                  row_logits);
        }
        const double verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok && row0_top == drafts[1]) {
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            token_vec_push(&s->checkpoint, drafts[0]);
            token_vec_push(&s->checkpoint, drafts[1]);
            accepted[n_accept++] = drafts[0];
            if (n_accept < accepted_cap) accepted[n_accept++] = drafts[1];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(2);
            if (mtp_timing) {
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
t;
        }
    }

    /*
     * The useful N=2 verifier is the tiny batch path: it verifies two target
     * positions in one layer-major pass and commits prefix-1 directly on a
     * partial accept.  Like the rest of the non-quality Metal path, it may pick
     * a different greedy token when batched reductions perturb nearly-tied
     * logits.  --quality / DS4_MTP_STRICT selects the exact decode verifier,
     * which preserves the one-token target stream but is not a speed win.
     */
    const bool use_decode2_exact =
        draft_n == 2 && strict_mtp && getenv("DS4_MTP_BATCH_VERIFY") == NULL;
    if (use_decode2_exact) {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        float *row0_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row0_logits[0]));
        const int start = s->checkpoint.len;
        int row0_top = -1;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        bool have_frontier = spec_frontier_snapshot(&frontier, s);
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        bool ok = have_frontier;
        if (ok) {
            ok = metal_graph_verify_decode2_exact(&s->graph,
                                                  &e->model,
                                                  &e->weights,
                                                  drafts[0],
                                                  drafts[1],
                                                  (uint32_t)start,
                                                  &row0_top,
                                                  row0_logits,
                                                  row_logits);
        }
        const double verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok && row0_top == drafts[1]) {
            memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
            token_vec_push(&s->checkpoint, drafts[0]);
            token_vec_push(&s->checkpoint, drafts[1]);
            accepted[n_accept++] = drafts[0];
            if (n_accept < accepted_cap) accepted[n_accept++] = drafts[1];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(2);
            if (mtp_timing) {
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
```<｜Assistant｜><think>