[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
"ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (now_sec() - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }

        if (ok) {
            s->checkpoint.len = start;
            ok = spec_frontier_commit_prefix1(s);
        }
        if (ok) memcpy(s->logits, row0_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
        if (ok) {
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double replay_done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=1 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (replay_done - verify_done) * 1000.0,
                        (replay_done - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }
        if (have_frontier) {
            s->checkpoint.len = start;
            (void)spec_frontier_restore(&frontier, s);
        }
        spec_frontier_free(&frontier);
        free(row0_logits);
        free(row_logits);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp decode2 verifier failed, falling back to sequential\n");
        }
    }

    if (!use_decode2_exact)
    {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        int *row_tops = xmalloc((size_t)draft_n * sizeof(row_tops[0]));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        const int start = s->checkpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
"ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (now_sec() - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }

        if (ok) {
            s->checkpoint.len = start;
            ok = spec_frontier_commit_prefix1(s);
        }
        if (ok) memcpy(s->logits, row0_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
        if (ok) {
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double replay_done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=1 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (replay_done - verify_done) * 1000.0,
                        (replay_done - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }
        if (have_frontier) {
            s->checkpoint.len = start;
            (void)spec_frontier_restore(&frontier, s);
        }
        spec_frontier_free(&frontier);
        free(row0_logits);
        free(row_logits);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp decode2 verifier failed, falling back to sequential\n");
        }
    }

    if (!use_decode2_exact)
    {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        int *row_tops = xmalloc((size_t)draft_n * sizeof(row_tops[0]));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        const int start = s->checkpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
"ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (now_sec() - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }

        if (ok) {
            s->checkpoint.len = start;
            ok = spec_frontier_commit_prefix1(s);
        }
        if (ok) memcpy(s->logits, row0_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
        if (ok) {
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double replay_done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=1 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (replay_done - verify_done) * 1000.0,
                        (replay_done - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }
        if (have_frontier) {
            s->checkpoint.len = start;
            (void)spec_frontier_restore(&frontier, s);
        }
        spec_frontier_free(&frontier);
        free(row0_logits);
        free(row_logits);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp decode2 verifier failed, falling back to sequential\n");
        }
    }

    if (!use_decode2_exact)
    {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        int *row_tops = xmalloc((size_t)draft_n * sizeof(row_tops[0]));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        const int start = s->checkpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
"ds4: mtp timing decode2 drafted=2 committed=2 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (now_sec() - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }

        if (ok) {
            s->checkpoint.len = start;
            ok = spec_frontier_commit_prefix1(s);
        }
        if (ok) memcpy(s->logits, row0_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
        if (ok) {
            token_vec_push(&s->checkpoint, drafts[0]);
            accepted[n_accept++] = drafts[0];
            s->checkpoint_valid = true;
            s->mtp_draft_valid = false;
            DS4_MTP_KEEP_ACCEPTED(1);
            if (mtp_timing) {
                const double replay_done = now_sec();
                fprintf(stderr,
                        "ds4: mtp timing decode2 drafted=2 committed=1 draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms\n",
                        (mtp_t_after_draft - mtp_t0) * 1000.0,
                        (snapshot_done - snapshot_t0) * 1000.0,
                        (verify_done - snapshot_done) * 1000.0,
                        (replay_done - verify_done) * 1000.0,
                        (replay_done - mtp_t0) * 1000.0);
            }
            spec_frontier_free(&frontier);
            free(row0_logits);
            free(row_logits);
            return n_accept;
        }
        if (have_frontier) {
            s->checkpoint.len = start;
            (void)spec_frontier_restore(&frontier, s);
        }
        spec_frontier_free(&frontier);
        free(row0_logits);
        free(row_logits);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp decode2 verifier failed, falling back to sequential\n");
        }
    }

    if (!use_decode2_exact)
    {
        ds4_spec_frontier frontier;
        memset(&frontier, 0, sizeof(frontier));
        int *row_tops = xmalloc((size_t)draft_n * sizeof(row_tops[0]));
        float *row_logits = xmalloc((size_t)DS4_N_VOCAB * sizeof(row_logits[0]));
        const int start = s->checkpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ckpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
         * both draft tokens are accepted.  Full accepts are the path that makes
         * MTP worthwhile, so by default we snapshot before the verifier and
         * replay one token on partial accept.  DS4_MTP_CAPTURE_PREFIX1 restores
         * the older no-replay partial path for measurement.
         */
        const bool capture_prefix1 =
            draft_n == 2 && (!strict_mtp || getenv("DS4_MTP_CAPTURE_PREFIX1") != NULL);
        const bool exact_replay_debug = getenv("DS4_MTP_EXACT_REPLAY") != NULL;
        const bool snapshot_required =
            draft_n > 2 ||
            (draft_n == 2 && (!capture_prefix1 || exact_replay_debug)) ||
            getenv("DS4_MTP_FORCE_SNAPSHOT") != NULL;
        bool have_frontier = false;
        bool ok = true;
        bool verifier_may_have_mutated = false;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        if (snapshot_required) {
            have_frontier = spec_frontier_snapshot(&frontier, s);
            ok = have_frontier;
        }
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            for (int i = 0; i < draft_n; i++) token_vec_push(&s->checkpoint, drafts[i]);
            verifier_may_have_mutated = true;
            ok = metal_graph_verify_suffix_tops(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &s->checkpoint,
                                                (uint32_t)start,
                                                (uint32_t)draft_n,
                                                capture_prefix1,
                                                row_tops,
                                                NULL);
        }
        const double micro_verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            int commit_drafts = 1;
            for (int i = 1; i < draft_n; i++) {
                if (row_tops[i - 1] != drafts[i]) break;
                commit_drafts++;
            }
            if (mtp_conf_log) {
                fprintf(stderr,
                        "ds4: mtp conf drafted=%d committed=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ckpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
         * both draft tokens are accepted.  Full accepts are the path that makes
         * MTP worthwhile, so by default we snapshot before the verifier and
         * replay one token on partial accept.  DS4_MTP_CAPTURE_PREFIX1 restores
         * the older no-replay partial path for measurement.
         */
        const bool capture_prefix1 =
            draft_n == 2 && (!strict_mtp || getenv("DS4_MTP_CAPTURE_PREFIX1") != NULL);
        const bool exact_replay_debug = getenv("DS4_MTP_EXACT_REPLAY") != NULL;
        const bool snapshot_required =
            draft_n > 2 ||
            (draft_n == 2 && (!capture_prefix1 || exact_replay_debug)) ||
            getenv("DS4_MTP_FORCE_SNAPSHOT") != NULL;
        bool have_frontier = false;
        bool ok = true;
        bool verifier_may_have_mutated = false;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        if (snapshot_required) {
            have_frontier = spec_frontier_snapshot(&frontier, s);
            ok = have_frontier;
        }
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            for (int i = 0; i < draft_n; i++) token_vec_push(&s->checkpoint, drafts[i]);
            verifier_may_have_mutated = true;
            ok = metal_graph_verify_suffix_tops(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &s->checkpoint,
                                                (uint32_t)start,
                                                (uint32_t)draft_n,
                                                capture_prefix1,
                                                row_tops,
                                                NULL);
        }
        const double micro_verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            int commit_drafts = 1;
            for (int i = 1; i < draft_n; i++) {
                if (row_tops[i - 1] != drafts[i]) break;
                commit_drafts++;
            }
            if (mtp_conf_log) {
                fprintf(stderr,
                        "ds4: mtp conf drafted=%d committed=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ckpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
         * both draft tokens are accepted.  Full accepts are the path that makes
         * MTP worthwhile, so by default we snapshot before the verifier and
         * replay one token on partial accept.  DS4_MTP_CAPTURE_PREFIX1 restores
         * the older no-replay partial path for measurement.
         */
        const bool capture_prefix1 =
            draft_n == 2 && (!strict_mtp || getenv("DS4_MTP_CAPTURE_PREFIX1") != NULL);
        const bool exact_replay_debug = getenv("DS4_MTP_EXACT_REPLAY") != NULL;
        const bool snapshot_required =
            draft_n > 2 ||
            (draft_n == 2 && (!capture_prefix1 || exact_replay_debug)) ||
            getenv("DS4_MTP_FORCE_SNAPSHOT") != NULL;
        bool have_frontier = false;
        bool ok = true;
        bool verifier_may_have_mutated = false;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        if (snapshot_required) {
            have_frontier = spec_frontier_snapshot(&frontier, s);
            ok = have_frontier;
        }
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            for (int i = 0; i < draft_n; i++) token_vec_push(&s->checkpoint, drafts[i]);
            verifier_may_have_mutated = true;
            ok = metal_graph_verify_suffix_tops(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &s->checkpoint,
                                                (uint32_t)start,
                                                (uint32_t)draft_n,
                                                capture_prefix1,
                                                row_tops,
                                                NULL);
        }
        const double micro_verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            int commit_drafts = 1;
            for (int i = 1; i < draft_n; i++) {
                if (row_tops[i - 1] != drafts[i]) break;
                commit_drafts++;
            }
            if (mtp_conf_log) {
                fprintf(stderr,
                        "ds4: mtp conf drafted=%d committed=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
ckpoint.len;
        /*
         * The production MTP depth is two.  Prefix-1 capture makes partial
         * accepts cheap, but it copies per-layer compressor frontiers even when
         * both draft tokens are accepted.  Full accepts are the path that makes
         * MTP worthwhile, so by default we snapshot before the verifier and
         * replay one token on partial accept.  DS4_MTP_CAPTURE_PREFIX1 restores
         * the older no-replay partial path for measurement.
         */
        const bool capture_prefix1 =
            draft_n == 2 && (!strict_mtp || getenv("DS4_MTP_CAPTURE_PREFIX1") != NULL);
        const bool exact_replay_debug = getenv("DS4_MTP_EXACT_REPLAY") != NULL;
        const bool snapshot_required =
            draft_n > 2 ||
            (draft_n == 2 && (!capture_prefix1 || exact_replay_debug)) ||
            getenv("DS4_MTP_FORCE_SNAPSHOT") != NULL;
        bool have_frontier = false;
        bool ok = true;
        bool verifier_may_have_mutated = false;
        const double snapshot_t0 = mtp_timing ? now_sec() : 0.0;
        if (snapshot_required) {
            have_frontier = spec_frontier_snapshot(&frontier, s);
            ok = have_frontier;
        }
        const double snapshot_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            for (int i = 0; i < draft_n; i++) token_vec_push(&s->checkpoint, drafts[i]);
            verifier_may_have_mutated = true;
            ok = metal_graph_verify_suffix_tops(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                &s->checkpoint,
                                                (uint32_t)start,
                                                (uint32_t)draft_n,
                                                capture_prefix1,
                                                row_tops,
                                                NULL);
        }
        const double micro_verify_done = mtp_timing ? now_sec() : 0.0;
        if (ok) {
            int commit_drafts = 1;
            for (int i = 1; i < draft_n; i++) {
                if (row_tops[i - 1] != drafts[i]) break;
                commit_drafts++;
            }
            if (mtp_conf_log) {
                fprintf(stderr,
                        "ds4: mtp conf drafted=%d committed=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
(type) {
    case DS4_TENSOR_IQ2_XXS: return sizeof(block_iq2_xxs);
    case DS4_TENSOR_Q2_K:    return sizeof(block_q2_K);
    case DS4_TENSOR_Q4_K:    return sizeof(block_q4_K);
    default:                 ds4_die("unsupported routed expert tensor type");
    }
    return 0;
}

static DS4_MAYBE_UNUSED uint64_t routed_expert_row_bytes(const ds4_tensor *t) {
    if ((t->dim[0] % QK_K) != 0) ds4_die("routed expert row is not QK_K aligned");
    return (t->dim[0] / QK_K) * routed_expert_block_bytes(t->type);
}

static void tensor_expect_routed_expert(
        const ds4_tensor *t,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!tensor_is_routed_expert_type(t->type)) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %u (%s), expected a routed expert quant type\n",
                (int)t->name.len,
                t->name.ptr,
                t->type,
                tensor_type_name(t->type));
        exit(1);
    }
    if (t->ndim != ndim) {
        fprintf(stderr,
                "ds4: tensor %.*s has %u dimensions, expected %u\n",
                (int)t->name.len,
                t->name.ptr,
                t->ndim,
                ndim);
        exit(1);
    }

    const uint64_t want[3] = { d0, d1, d2 };
    for (uint32_t i = 0; i < ndim; i++) {
        if (t->dim[i] == want[i]) continue;
        fprintf(stderr,
                "ds4: tensor %.*s has dim[%u]=%" PRIu64 ", expected %" PRIu64 "\n",
                (int)t->name.len,
                t->name.ptr,
                i,
                t->dim[i],
                want[i]);
        exit(1);
    }
}

/* Verify every tensor type and dimension used by the specialized pipeline.
 * After this succeeds, inference code can rely on fixed DS4 constants. */
static void weights_validate_layout(const ds4_weights *w) {
    const uint64_t hc_dim = (uint64_t)DS4_N_EMBD * DS4_N_HC;
    const uint64_t hc_mix_dim = 2u * DS4_N_HC + (uint64_t)DS4_N_HC * DS4_N_HC;
    const uint64_t q_dim = (uint64_t)DS4_N_HEAD * DS4_N_HEAD_DIM;
    const uint64_t out_low_dim = (uint64_t)DS4_N_OUT_GROUP * DS4_N_LORA_O;

    tensor_expect_layout(w->token_embd,      DS4_TENSOR_F16,  2, DS4_N_EMBD, DS4_N_VOCAB, 0);
    tensor_expect_layout(w->output_hc_base,  DS4_TENSOR_F32,  1, DS4_N_HC, 0, 0);
    tensor_expect_layout(w->output_hc_fn,    DS4_TENSOR_F16,  2, hc_dim, DS4_N_HC, 0);
    tensor_expect_layout(w->output_hc_scale, DS4_TENSOR_F32,  1, 1, 0, 0);
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
(type) {
    case DS4_TENSOR_IQ2_XXS: return sizeof(block_iq2_xxs);
    case DS4_TENSOR_Q2_K:    return sizeof(block_q2_K);
    case DS4_TENSOR_Q4_K:    return sizeof(block_q4_K);
    default:                 ds4_die("unsupported routed expert tensor type");
    }
    return 0;
}

static DS4_MAYBE_UNUSED uint64_t routed_expert_row_bytes(const ds4_tensor *t) {
    if ((t->dim[0] % QK_K) != 0) ds4_die("routed expert row is not QK_K aligned");
    return (t->dim[0] / QK_K) * routed_expert_block_bytes(t->type);
}

static void tensor_expect_routed_expert(
        const ds4_tensor *t,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!tensor_is_routed_expert_type(t->type)) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %u (%s), expected a routed expert quant type\n",
                (int)t->name.len,
                t->name.ptr,
                t->type,
                tensor_type_name(t->type));
        exit(1);
    }
    if (t->ndim != ndim) {
        fprintf(stderr,
                "ds4: tensor %.*s has %u dimensions, expected %u\n",
                (int)t->name.len,
                t->name.ptr,
                t->ndim,
                ndim);
        exit(1);
    }

    const uint64_t want[3] = { d0, d1, d2 };
    for (uint32_t i = 0; i < ndim; i++) {
        if (t->dim[i] == want[i]) continue;
        fprintf(stderr,
                "ds4: tensor %.*s has dim[%u]=%" PRIu64 ", expected %" PRIu64 "\n",
                (int)t->name.len,
                t->name.ptr,
                i,
                t->dim[i],
                want[i]);
        exit(1);
    }
}

/* Verify every tensor type and dimension used by the specialized pipeline.
 * After this succeeds, inference code can rely on fixed DS4 constants. */
static void weights_validate_layout(const ds4_weights *w) {
    const uint64_t hc_dim = (uint64_t)DS4_N_EMBD * DS4_N_HC;
    const uint64_t hc_mix_dim = 2u * DS4_N_HC + (uint64_t)DS4_N_HC * DS4_N_HC;
    const uint64_t q_dim = (uint64_t)DS4_N_HEAD * DS4_N_HEAD_DIM;
    const uint64_t out_low_dim = (uint64_t)DS4_N_OUT_GROUP * DS4_N_LORA_O;

    tensor_expect_layout(w->token_embd,      DS4_TENSOR_F16,  2, DS4_N_EMBD, DS4_N_VOCAB, 0);
    tensor_expect_layout(w->output_hc_base,  DS4_TENSOR_F32,  1, DS4_N_HC, 0, 0);
    tensor_expect_layout(w->output_hc_fn,    DS4_TENSOR_F16,  2, hc_dim, DS4_N_HC, 0);
    tensor_expect_layout(w->output_hc_scale, DS4_TENSOR_F32,  1, 1, 0, 0);
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
(type) {
    case DS4_TENSOR_IQ2_XXS: return sizeof(block_iq2_xxs);
    case DS4_TENSOR_Q2_K:    return sizeof(block_q2_K);
    case DS4_TENSOR_Q4_K:    return sizeof(block_q4_K);
    default:                 ds4_die("unsupported routed expert tensor type");
    }
    return 0;
}

static DS4_MAYBE_UNUSED uint64_t routed_expert_row_bytes(const ds4_tensor *t) {
    if ((t->dim[0] % QK_K) != 0) ds4_die("routed expert row is not QK_K aligned");
    return (t->dim[0] / QK_K) * routed_expert_block_bytes(t->type);
}

static void tensor_expect_routed_expert(
        const ds4_tensor *t,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!tensor_is_routed_expert_type(t->type)) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %u (%s), expected a routed expert quant type\n",
                (int)t->name.len,
                t->name.ptr,
                t->type,
                tensor_type_name(t->type));
        exit(1);
    }
    if (t->ndim != ndim) {
        fprintf(stderr,
                "ds4: tensor %.*s has %u dimensions, expected %u\n",
                (int)t->name.len,
                t->name.ptr,
                t->ndim,
                ndim);
        exit(1);
    }

    const uint64_t want[3] = { d0, d1, d2 };
    for (uint32_t i = 0; i < ndim; i++) {
        if (t->dim[i] == want[i]) continue;
        fprintf(stderr,
                "ds4: tensor %.*s has dim[%u]=%" PRIu64 ", expected %" PRIu64 "\n",
                (int)t->name.len,
                t->name.ptr,
                i,
                t->dim[i],
                want[i]);
        exit(1);
    }
}

/* Verify every tensor type and dimension used by the specialized pipeline.
 * After this succeeds, inference code can rely on fixed DS4 constants. */
static void weights_validate_layout(const ds4_weights *w) {
    const uint64_t hc_dim = (uint64_t)DS4_N_EMBD * DS4_N_HC;
    const uint64_t hc_mix_dim = 2u * DS4_N_HC + (uint64_t)DS4_N_HC * DS4_N_HC;
    const uint64_t q_dim = (uint64_t)DS4_N_HEAD * DS4_N_HEAD_DIM;
    const uint64_t out_low_dim = (uint64_t)DS4_N_OUT_GROUP * DS4_N_LORA_O;

    tensor_expect_layout(w->token_embd,      DS4_TENSOR_F16,  2, DS4_N_EMBD, DS4_N_VOCAB, 0);
    tensor_expect_layout(w->output_hc_base,  DS4_TENSOR_F32,  1, DS4_N_HC, 0, 0);
    tensor_expect_layout(w->output_hc_fn,    DS4_TENSOR_F16,  2, hc_dim, DS4_N_HC, 0);
    tensor_expect_layout(w->output_hc_scale, DS4_TENSOR_F32,  1, 1, 0, 0);
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
(type) {
    case DS4_TENSOR_IQ2_XXS: return sizeof(block_iq2_xxs);
    case DS4_TENSOR_Q2_K:    return sizeof(block_q2_K);
    case DS4_TENSOR_Q4_K:    return sizeof(block_q4_K);
    default:                 ds4_die("unsupported routed expert tensor type");
    }
    return 0;
}

static DS4_MAYBE_UNUSED uint64_t routed_expert_row_bytes(const ds4_tensor *t) {
    if ((t->dim[0] % QK_K) != 0) ds4_die("routed expert row is not QK_K aligned");
    return (t->dim[0] / QK_K) * routed_expert_block_bytes(t->type);
}

static void tensor_expect_routed_expert(
        const ds4_tensor *t,
        uint32_t          ndim,
        uint64_t          d0,
        uint64_t          d1,
        uint64_t          d2) {
    if (!tensor_is_routed_expert_type(t->type)) {
        fprintf(stderr,
                "ds4: tensor %.*s has type %u (%s), expected a routed expert quant type\n",
                (int)t->name.len,
                t->name.ptr,
                t->type,
                tensor_type_name(t->type));
        exit(1);
    }
    if (t->ndim != ndim) {
        fprintf(stderr,
                "ds4: tensor %.*s has %u dimensions, expected %u\n",
                (int)t->name.len,
                t->name.ptr,
                t->ndim,
                ndim);
        exit(1);
    }

    const uint64_t want[3] = { d0, d1, d2 };
    for (uint32_t i = 0; i < ndim; i++) {
        if (t->dim[i] == want[i]) continue;
        fprintf(stderr,
                "ds4: tensor %.*s has dim[%u]=%" PRIu64 ", expected %" PRIu64 "\n",
                (int)t->name.len,
                t->name.ptr,
                i,
                t->dim[i],
                want[i]);
        exit(1);
    }
}

/* Verify every tensor type and dimension used by the specialized pipeline.
 * After this succeeds, inference code can rely on fixed DS4 constants. */
static void weights_validate_layout(const ds4_weights *w) {
    const uint64_t hc_dim = (uint64_t)DS4_N_EMBD * DS4_N_HC;
    const uint64_t hc_mix_dim = 2u * DS4_N_HC + (uint64_t)DS4_N_HC * DS4_N_HC;
    const uint64_t q_dim = (uint64_t)DS4_N_HEAD * DS4_N_HEAD_DIM;
    const uint64_t out_low_dim = (uint64_t)DS4_N_OUT_GROUP * DS4_N_LORA_O;

    tensor_expect_layout(w->token_embd,      DS4_TENSOR_F16,  2, DS4_N_EMBD, DS4_N_VOCAB, 0);
    tensor_expect_layout(w->output_hc_base,  DS4_TENSOR_F32,  1, DS4_N_HC, 0, 0);
    tensor_expect_layout(w->output_hc_fn,    DS4_TENSOR_F16,  2, hc_dim, DS4_N_HC, 0);
    tensor_expect_layout(w->output_hc_scale, DS4_TENSOR_F32,  1, 1, 0, 0);
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
                        mtp_last_top1,
                        mtp_last_margin,
                        draft_n > 1 ? row_tops[0] : -1,
                        draft_n > 1 ? drafts[1] : -1);
            }
            if (exact_replay_debug && have_frontier) {
                s->checkpoint.len = start;
                ok = spec_frontier_restore(&frontier, s);
                if (ok) {
                    int replayed = 0;
                    for (; replayed < commit_drafts && ok; replayed++) {
                        ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                            &e->model,
                                                            &e->weights,
                                                            drafts[replayed],
                                                            (uint32_t)(start + replayed),
                                                            row_logits);
                        if (ok) token_vec_push(&s->checkpoint, drafts[replayed]);
                    }
                    if (ok) {
                        memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                        for (int i = 0; i < replayed && n_accept < accepted_cap; i++) {
                            accepted[n_accept++] = drafts[i];
                            if (drafts[i] == eos_token) break;
                        }
                        s->checkpoint_valid = true;
                        s->mtp_draft_valid = false;
                        DS4_MTP_KEEP_ACCEPTED(replayed);
                        spec_frontier_free(&frontier);
                        free(row_logits);
                        free(row_tops);
                        return n_accept;
                    }
                }
            }

            if (commit_drafts == draft_n) {
                ok = metal_graph_read_spec_logits_row(&s->graph,
                                                      (uint32_t)(draft_n - 1),
                                                      row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
                        mtp_last_top1,
                        mtp_last_margin,
                        draft_n > 1 ? row_tops[0] : -1,
                        draft_n > 1 ? drafts[1] : -1);
            }
            if (exact_replay_debug && have_frontier) {
                s->checkpoint.len = start;
                ok = spec_frontier_restore(&frontier, s);
                if (ok) {
                    int replayed = 0;
                    for (; replayed < commit_drafts && ok; replayed++) {
                        ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                            &e->model,
                                                            &e->weights,
                                                            drafts[replayed],
                                                            (uint32_t)(start + replayed),
                                                            row_logits);
                        if (ok) token_vec_push(&s->checkpoint, drafts[replayed]);
                    }
                    if (ok) {
                        memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                        for (int i = 0; i < replayed && n_accept < accepted_cap; i++) {
                            accepted[n_accept++] = drafts[i];
                            if (drafts[i] == eos_token) break;
                        }
                        s->checkpoint_valid = true;
                        s->mtp_draft_valid = false;
                        DS4_MTP_KEEP_ACCEPTED(replayed);
                        spec_frontier_free(&frontier);
                        free(row_logits);
                        free(row_tops);
                        return n_accept;
                    }
                }
            }

            if (commit_drafts == draft_n) {
                ok = metal_graph_read_spec_logits_row(&s->graph,
                                                      (uint32_t)(draft_n - 1),
                                                      row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
                        mtp_last_top1,
                        mtp_last_margin,
                        draft_n > 1 ? row_tops[0] : -1,
                        draft_n > 1 ? drafts[1] : -1);
            }
            if (exact_replay_debug && have_frontier) {
                s->checkpoint.len = start;
                ok = spec_frontier_restore(&frontier, s);
                if (ok) {
                    int replayed = 0;
                    for (; replayed < commit_drafts && ok; replayed++) {
                        ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                            &e->model,
                                                            &e->weights,
                                                            drafts[replayed],
                                                            (uint32_t)(start + replayed),
                                                            row_logits);
                        if (ok) token_vec_push(&s->checkpoint, drafts[replayed]);
                    }
                    if (ok) {
                        memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                        for (int i = 0; i < replayed && n_accept < accepted_cap; i++) {
                            accepted[n_accept++] = drafts[i];
                            if (drafts[i] == eos_token) break;
                        }
                        s->checkpoint_valid = true;
                        s->mtp_draft_valid = false;
                        DS4_MTP_KEEP_ACCEPTED(replayed);
                        spec_frontier_free(&frontier);
                        free(row_logits);
                        free(row_tops);
                        return n_accept;
                    }
                }
            }

            if (commit_drafts == draft_n) {
                ok = metal_graph_read_spec_logits_row(&s->graph,
                                                      (uint32_t)(draft_n - 1),
                                                      row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
=%d mtp_top=%d runner=%d margin=%.6f target_next=%d draft_next=%d\n",
                        draft_n,
                        commit_drafts,
                        mtp_last_top0,
                        mtp_last_top1,
                        mtp_last_margin,
                        draft_n > 1 ? row_tops[0] : -1,
                        draft_n > 1 ? drafts[1] : -1);
            }
            if (exact_replay_debug && have_frontier) {
                s->checkpoint.len = start;
                ok = spec_frontier_restore(&frontier, s);
                if (ok) {
                    int replayed = 0;
                    for (; replayed < commit_drafts && ok; replayed++) {
                        ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                            &e->model,
                                                            &e->weights,
                                                            drafts[replayed],
                                                            (uint32_t)(start + replayed),
                                                            row_logits);
                        if (ok) token_vec_push(&s->checkpoint, drafts[replayed]);
                    }
                    if (ok) {
                        memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                        for (int i = 0; i < replayed && n_accept < accepted_cap; i++) {
                            accepted[n_accept++] = drafts[i];
                            if (drafts[i] == eos_token) break;
                        }
                        s->checkpoint_valid = true;
                        s->mtp_draft_valid = false;
                        DS4_MTP_KEEP_ACCEPTED(replayed);
                        spec_frontier_free(&frontier);
                        free(row_logits);
                        free(row_tops);
                        return n_accept;
                    }
                }
            }

            if (commit_drafts == draft_n) {
                ok = metal_graph_read_spec_logits_row(&s->graph,
                                                      (uint32_t)(draft_n - 1),
                                                      row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
raft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(draft_n);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                                draft_n,
                                draft_n,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }

            if (draft_n == 2 && commit_drafts == 1 && capture_prefix1) {
                s->checkpoint.len = start;
                const double prefix_t0 = mtp_timing ? now_sec() : 0.0;
                ok = spec_frontier_commit_prefix1(s);
                const double prefix_done = mtp_timing ? now_sec() : 0.0;
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph, 0, row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms noreplay=1\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
raft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(draft_n);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                                draft_n,
                                draft_n,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }

            if (draft_n == 2 && commit_drafts == 1 && capture_prefix1) {
                s->checkpoint.len = start;
                const double prefix_t0 = mtp_timing ? now_sec() : 0.0;
                ok = spec_frontier_commit_prefix1(s);
                const double prefix_done = mtp_timing ? now_sec() : 0.0;
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph, 0, row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms noreplay=1\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
raft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(draft_n);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                                draft_n,
                                draft_n,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }

            if (draft_n == 2 && commit_drafts == 1 && capture_prefix1) {
                s->checkpoint.len = start;
                const double prefix_t0 = mtp_timing ? now_sec() : 0.0;
                ok = spec_frontier_commit_prefix1(s);
                const double prefix_done = mtp_timing ? now_sec() : 0.0;
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph, 0, row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms noreplay=1\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
raft_n && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(draft_n);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms total=%.3f ms\n",
                                draft_n,
                                draft_n,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }

            if (draft_n == 2 && commit_drafts == 1 && capture_prefix1) {
                s->checkpoint.len = start;
                const double prefix_t0 = mtp_timing ? now_sec() : 0.0;
                ok = spec_frontier_commit_prefix1(s);
                const double prefix_done = mtp_timing ? now_sec() : 0.0;
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph, 0, row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms prefix=%.3f ms total=%.3f ms noreplay=1\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
shot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            } else {
                s->checkpoint.len = start;
                ok = have_frontier && spec_frontier_restore(&frontier, s);
            }
            if (ok && draft_n == 2 && commit_drafts == 1) {
                ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    drafts[0],
                                                    (uint32_t)start,
                                                    row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms exact_replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
            if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
shot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            } else {
                s->checkpoint.len = start;
                ok = have_frontier && spec_frontier_restore(&frontier, s);
            }
            if (ok && draft_n == 2 && commit_drafts == 1) {
                ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    drafts[0],
                                                    (uint32_t)start,
                                                    row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms exact_replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
            if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
shot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            } else {
                s->checkpoint.len = start;
                ok = have_frontier && spec_frontier_restore(&frontier, s);
            }
            if (ok && draft_n == 2 && commit_drafts == 1) {
                ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    drafts[0],
                                                    (uint32_t)start,
                                                    row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms exact_replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
            if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Explain what this code does and identify the inference stage it belongs to.

File: ds4.c

```c
shot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (prefix_done - prefix_t0) * 1000.0,
                                (now_sec() - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            } else {
                s->checkpoint.len = start;
                ok = have_frontier && spec_frontier_restore(&frontier, s);
            }
            if (ok && draft_n == 2 && commit_drafts == 1) {
                ok = metal_graph_eval_token_raw_swa(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    drafts[0],
                                                    (uint32_t)start,
                                                    row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    accepted[n_accept++] = drafts[0];
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(1);
                    token_vec_push(&s->checkpoint, drafts[0]);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms exact_replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
            if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    &s->checkpoint,
                                                    (uint32_t)start,
                                                    (uint32_t)commit_drafts,
                                                    false,
                                                    row_tops,
                                                    NULL);
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph,
                                                              (uint32_t)(commit_drafts - 1),
                                                              row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < commit_drafts && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(commit_drafts);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    &s->checkpoint,
                                                    (uint32_t)start,
                                                    (uint32_t)commit_drafts,
                                                    false,
                                                    row_tops,
                                                    NULL);
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph,
                                                              (uint32_t)(commit_drafts - 1),
                                                              row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < commit_drafts && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(commit_drafts);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    &s->checkpoint,
                                                    (uint32_t)start,
                                                    (uint32_t)commit_drafts,
                                                    false,
                                                    row_tops,
                                                    NULL);
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph,
                                                              (uint32_t)(commit_drafts - 1),
                                                              row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < commit_drafts && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(commit_drafts);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Suggest a minimal correctness-preserving optimization for this excerpt.

File: ds4.c

```c
if (ok) {
                for (int i = 0; i < commit_drafts; i++) token_vec_push(&s->checkpoint, drafts[i]);
                ok = metal_graph_verify_suffix_tops(&s->graph,
                                                    &e->model,
                                                    &e->weights,
                                                    &s->checkpoint,
                                                    (uint32_t)start,
                                                    (uint32_t)commit_drafts,
                                                    false,
                                                    row_tops,
                                                    NULL);
                if (ok) ok = metal_graph_read_spec_logits_row(&s->graph,
                                                              (uint32_t)(commit_drafts - 1),
                                                              row_logits);
                if (ok) {
                    memcpy(s->logits, row_logits, (size_t)DS4_N_VOCAB * sizeof(s->logits[0]));
                    for (int i = 0; i < commit_drafts && n_accept < accepted_cap; i++) {
                        accepted[n_accept++] = drafts[i];
                        if (drafts[i] == eos_token) break;
                    }
                    s->checkpoint_valid = true;
                    s->mtp_draft_valid = false;
                    DS4_MTP_KEEP_ACCEPTED(commit_drafts);
                    if (mtp_timing) {
                        const double replay_done = now_sec();
                        fprintf(stderr,
                                "ds4: mtp timing micro drafted=%d committed=%d draft=%.3f ms snapshot=%.3f ms verify=%.3f ms replay=%.3f ms total=%.3f ms\n",
                                draft_n,
                                commit_drafts,
                                (mtp_t_after_draft - mtp_t0) * 1000.0,
                                (snapshot_done - snapshot_t0) * 1000.0,
                                (micro_verify_done - snapshot_done) * 1000.0,
                                (replay_done - micro_verify_done) * 1000.0,
                                (replay_done - mtp_t0) * 1000.0);
                    }
                    spec_frontier_free(&frontier);
                    free(row_logits);
                    free(row_tops);
                    return n_accept;
                }
            }
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
}
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
            /* Snapshot setup failed before the verifier touched Metal state.
             * Fall through to the exact sequential verifier below. */
        } else {
            snprintf(err, errlen, "MTP verifier failed");
            s->checkpoint_valid = false;
            DS4_MTP_KEEP_ACCEPTED(0);
            spec_frontier_free(&frontier);
            free(row_logits);
            free(row_tops);
            return -1;
        }
        spec_frontier_free(&frontier);
        free(row_logits);
        free(row_tops);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec micro verifier failed, falling back to sequential\n");
        }
    }

    /*
     * Safety fallback: if the production microbatch verifier fails, verify
     * drafts with the exact normal one-token decode path instead of returning
     * wrong state.  This path is deliberately slow and should not be selected
     * during normal --mtp operation.
     */
    int verified = 0;
    int target_top = sample_argmax(s->logits, DS4_N_VOCAB);
    bool logits_on_host = true;
    const double seq_t0 = mtp_timing ? now_sec() : 0.0;
    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
        if (target_top != drafts[i]) {
            if (getenv("DS4_MTP_SPEC_LOG")) {
                fprintf(stderr,
                        "ds4: mtp spec seq miss at=%d draft=%d base=%d drafted=%d accepted=%d\n",
                        i,
                        drafts[i],
                        target_top,
                        draft_n,
                        n_accept);
            }
            break;
        }
        if (!metal_graph_eval_token_raw_swa_top(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                drafts[i],
                                                (uint32_t)s->checkpoint.len,
                                                &target_top,
                                                NULL))
        {
            snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
            s->checkpoint_valid = false;
            return -1;
        }
        token_vec_push(&s->checkpoint, drafts[i]);
        logits_on_host = false;
        accepted[n_accept++] = drafts[i];
        verified++;
        if (drafts[i] == eos_token) break;
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
}
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
            /* Snapshot setup failed before the verifier touched Metal state.
             * Fall through to the exact sequential verifier below. */
        } else {
            snprintf(err, errlen, "MTP verifier failed");
            s->checkpoint_valid = false;
            DS4_MTP_KEEP_ACCEPTED(0);
            spec_frontier_free(&frontier);
            free(row_logits);
            free(row_tops);
            return -1;
        }
        spec_frontier_free(&frontier);
        free(row_logits);
        free(row_tops);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec micro verifier failed, falling back to sequential\n");
        }
    }

    /*
     * Safety fallback: if the production microbatch verifier fails, verify
     * drafts with the exact normal one-token decode path instead of returning
     * wrong state.  This path is deliberately slow and should not be selected
     * during normal --mtp operation.
     */
    int verified = 0;
    int target_top = sample_argmax(s->logits, DS4_N_VOCAB);
    bool logits_on_host = true;
    const double seq_t0 = mtp_timing ? now_sec() : 0.0;
    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
        if (target_top != drafts[i]) {
            if (getenv("DS4_MTP_SPEC_LOG")) {
                fprintf(stderr,
                        "ds4: mtp spec seq miss at=%d draft=%d base=%d drafted=%d accepted=%d\n",
                        i,
                        drafts[i],
                        target_top,
                        draft_n,
                        n_accept);
            }
            break;
        }
        if (!metal_graph_eval_token_raw_swa_top(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                drafts[i],
                                                (uint32_t)s->checkpoint.len,
                                                &target_top,
                                                NULL))
        {
            snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
            s->checkpoint_valid = false;
            return -1;
        }
        token_vec_push(&s->checkpoint, drafts[i]);
        logits_on_host = false;
        accepted[n_accept++] = drafts[i];
        verified++;
        if (drafts[i] == eos_token) break;
```<｜Assistant｜></think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
}
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
            /* Snapshot setup failed before the verifier touched Metal state.
             * Fall through to the exact sequential verifier below. */
        } else {
            snprintf(err, errlen, "MTP verifier failed");
            s->checkpoint_valid = false;
            DS4_MTP_KEEP_ACCEPTED(0);
            spec_frontier_free(&frontier);
            free(row_logits);
            free(row_tops);
            return -1;
        }
        spec_frontier_free(&frontier);
        free(row_logits);
        free(row_tops);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec micro verifier failed, falling back to sequential\n");
        }
    }

    /*
     * Safety fallback: if the production microbatch verifier fails, verify
     * drafts with the exact normal one-token decode path instead of returning
     * wrong state.  This path is deliberately slow and should not be selected
     * during normal --mtp operation.
     */
    int verified = 0;
    int target_top = sample_argmax(s->logits, DS4_N_VOCAB);
    bool logits_on_host = true;
    const double seq_t0 = mtp_timing ? now_sec() : 0.0;
    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
        if (target_top != drafts[i]) {
            if (getenv("DS4_MTP_SPEC_LOG")) {
                fprintf(stderr,
                        "ds4: mtp spec seq miss at=%d draft=%d base=%d drafted=%d accepted=%d\n",
                        i,
                        drafts[i],
                        target_top,
                        draft_n,
                        n_accept);
            }
            break;
        }
        if (!metal_graph_eval_token_raw_swa_top(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                drafts[i],
                                                (uint32_t)s->checkpoint.len,
                                                &target_top,
                                                NULL))
        {
            snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
            s->checkpoint_valid = false;
            return -1;
        }
        token_vec_push(&s->checkpoint, drafts[i]);
        logits_on_host = false;
        accepted[n_accept++] = drafts[i];
        verified++;
        if (drafts[i] == eos_token) break;
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Trova bug sottili e spiega quali invarianti dell'inferenza possono rompersi.

File: ds4.c

```c
}
        }
        s->checkpoint.len = start;
        if (have_frontier) {
            (void)spec_frontier_restore(&frontier, s);
        } else if (!verifier_may_have_mutated) {
            /* Snapshot setup failed before the verifier touched Metal state.
             * Fall through to the exact sequential verifier below. */
        } else {
            snprintf(err, errlen, "MTP verifier failed");
            s->checkpoint_valid = false;
            DS4_MTP_KEEP_ACCEPTED(0);
            spec_frontier_free(&frontier);
            free(row_logits);
            free(row_tops);
            return -1;
        }
        spec_frontier_free(&frontier);
        free(row_logits);
        free(row_tops);
        if (getenv("DS4_MTP_SPEC_LOG")) {
            fprintf(stderr, "ds4: mtp spec micro verifier failed, falling back to sequential\n");
        }
    }

    /*
     * Safety fallback: if the production microbatch verifier fails, verify
     * drafts with the exact normal one-token decode path instead of returning
     * wrong state.  This path is deliberately slow and should not be selected
     * during normal --mtp operation.
     */
    int verified = 0;
    int target_top = sample_argmax(s->logits, DS4_N_VOCAB);
    bool logits_on_host = true;
    const double seq_t0 = mtp_timing ? now_sec() : 0.0;
    for (int i = 0; i < draft_n && n_accept < accepted_cap; i++) {
        if (target_top != drafts[i]) {
            if (getenv("DS4_MTP_SPEC_LOG")) {
                fprintf(stderr,
                        "ds4: mtp spec seq miss at=%d draft=%d base=%d drafted=%d accepted=%d\n",
                        i,
                        drafts[i],
                        target_top,
                        draft_n,
                        n_accept);
            }
            break;
        }
        if (!metal_graph_eval_token_raw_swa_top(&s->graph,
                                                &e->model,
                                                &e->weights,
                                                drafts[i],
                                                (uint32_t)s->checkpoint.len,
                                                &target_top,
                                                NULL))
        {
            snprintf(err, errlen, "%s decode failed", ds4_backend_name(e->backend));
            s->checkpoint_valid = false;
            return -1;
        }
        token_vec_push(&s->checkpoint, drafts[i]);
        logits_on_host = false;
        accepted[n_accept++] = drafts[i];
        verified++;
        if (drafts[i] == eos_token) break;
```<｜Assistant｜><think>


[System] You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.

[User]
Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
token_vec_push(&s->checkpoint, drafts[i]);
        logits_on_host = false;
        accepted[n_accept++] = drafts[i];
        verified++;
        if (drafts[i] == eos_token) break;
    }
    if (verified > 0 && !logits_on_host) {
        if (ds4_gpu_tensor_read(s->graph.logits,
                                  0,
                                  s->logits,
                                  (uint64_t)DS4_N_VOCAB * sizeof(s->logits[0])) == 0)
        {
            snprintf(err, errlen, "%s logits readback failed", ds4_backend_name(e->backend));
            s->checkpoint_valid = false;
            return -1;
        }
        logits_on_host = true;
    }
    (void)logits_on_host;
    DS4_MTP_KEEP_ACCEPTED(verified);
#undef DS4_MTP_KEEP_ACCEPTED
    if (mtp_timing) {
        fprintf(stderr,
                "ds4: mtp timing seq drafted=%d verified=%d draft=%.3f ms verify=%.3f ms total=%.3f ms\n",
                draft_n,
                verified,
                (mtp_t_after_draft - mtp_t0) * 1000.0,
                (now_sec() - seq_t0) * 1000.0,
                (now_sec() - mtp_t0) * 1000.0);
    }
    if (getenv("DS4_MTP_SPEC_LOG")) {
        if (verified == draft_n) {
            fprintf(stderr,
                    "ds4: mtp spec seq accept drafted=%d accepted=%d\n",
                    draft_n,
                    n_accept);
        } else {
            fprintf(stderr,
                    "ds4: mtp spec seq partial drafted=%d verified=%d accepted=%d\n",
                    draft_n,
                    verified,
                    n_accept);
        }
    }
    return n_accept;
#endif
}

void ds4_session_invalidate(ds4_session *s) {
    s->checkpoint_valid = false;
    s->checkpoint.len = 0;
    s->mtp_draft_valid = false;
}

void ds4_session_rewind(ds4_session *s, int pos) {
    if (pos < 0) pos = 0;
    if (pos > s->checkpoint.len) pos = s->checkpoint.len;
    s->checkpoint.len = pos;
    s->mtp_draft_valid = false;
}

int ds4_session_pos(ds4_session *s) {
    return s->checkpoint.len;
}

int ds4_session_ctx(ds4_session *s) {
    return s->ctx_size;
}
```

<｜begin▁of▁sentence｜>You are DeepSeek V4 Flash running locally. Answer accurately, preserve technical details, and use tools only when the prompt asks for tool use.<｜User｜>Review this excerpt for correctness risks, memory lifetime issues, and performance bottlenecks.

File: ds4.c

```c
token_vec_push(&s->checkpoint, drafts[i]);
        logits_on_host = false;
        accepted[n_accept++] = drafts[i];
        verified++;
        if (drafts[i] == eos_token) break;
    }
    if (verified > 0 && !logits_on_host) {
        if (ds4_gpu_tensor_read(s->graph.logits,
                                  0,
                                  s->logits,
                                  (uint64_t)DS4_N_VOCAB * sizeof(s->logits[0])) == 0)
        {
            snprintf(err, errlen, "%s logits readback failed", ds4_backend_name(e->backend));
            s->checkpoint_valid = false;
            return -1;
        }
        logits_on_host = true;
    }
    (void)logits_on_host;
    DS4_MTP_KEEP_ACCEPTED(verified);
#undef DS4_MTP_KEEP_ACCEPTED
    if (mtp_timing) {
        fprintf(stderr,
                "ds4: mtp timing seq drafted=%d verified=%d draft=%.3f ms verify=%.3f ms total=%.3f ms\n",
                draft_n,
                verified,
                (mtp_t_after_draft - mtp_t0) * 1000.0,
                (now_sec() - seq_t0) * 1000.0,
                (now_sec() - mtp_t0) * 1000.0);
    }
    if (getenv("DS4_MTP_SPEC_LOG")) {
        if (verified == draft_n) {
            fprintf(stderr,
                    "ds4: mtp spec seq accept drafted=%d accepted=%d\n",
                    draft_n,
                    n_accept);
        } else {
            fprintf(stderr,
                    "ds4: mtp spec seq partial drafted=%d verified=%d accepted=%d\n",
                    draft_n,
                    verified,
                    n_accept);
        }
    }
    return n_accept;
#endif
}

void ds4_session_invalidate(ds4_session *s) {
    s->checkpoint_valid = false;
    s->checkpoint.len = 0;
    s->mtp_draft_valid = false;
}

void ds4_session_rewind(ds4_session *s, int pos) {
    if (pos < 0) pos = 0;
    if (pos > s->checkpoint.len) pos = s->checkpoint.len;
    s->checkpoint.len = pos;
    s->mtp_draft_valid = false;
}

int ds4_session_pos(ds4_session *s) {
    return s->checkpoint.len;
}

int ds4_session_ctx(ds4_session *s) {
    return s->ctx_size;
}
```<｜Assistant｜></think>