atlas(r1): SEAL #404 AC — Local/Offline Intelligence full R1_FULL (STOP before #405)

INWARD: no offline intelligence — 11 Ollama models available but ungoverned;
embeddings UNVERSIONED + silent degradation when Ollama down; 152
deterministic modules = accidental no-model fallback; skill library empty
(0 skills/7 lessons/0 measured deltas); no routing policy, no capability
registry, no degraded-communication templates.

ARCHITECTURE (17 claims all ADOPT): MODEL-AS-RESOURCE (state verified
model-independent); six-rung degradation ladder FULL→DEGRADED never DEAD
(Apple RS precedent: request-tiered + attestation-gated hard refusal);
bounded-only capability compilation (FrugalGPT RS: cascade needs
in-distribution labels — rejected at n≈924); outcome-grounded assimilation
with per-lesson counterfactual measurement ([OVL-0] — Rune-novel, literature
open-loop); skill promotion/deprecation (Voyager FULL_PAPER + Memp RS);
learning hierarchy procedure>retrieval>adapter>weight-edit (LoRA RS,
RippleEdits); escalation by pass@1 difficulty bins + verifier availability
(Snell RS) NOT confidence; one logged gateway + capability registry w/ TTL
as prerequisites; no-model mode with structured templates; local models
untrusted (local ≠ private ≠ safe); 4-bit weight-only = reasoning floor,
27B IQ2_M unmeasured (E13).

ADVERSARIAL 118 (SUCCEEDS 14 / PARTIAL 20 / FAILS 84) — zero SUCCEEDS
against epistemic core; 5 forced corrections (resource-starved rung, OVL-0
critical path, registry+gateway prerequisite, rung-5 drill, independence
trade).

Sources 156 ledger rows = 150 external/147 unique/6 pointer/2 dup groups
(ABSTRACT 93 · DOC 28 · RS 11 · FP 4 · INHERITED 8 · MV 3 · COMMUNITY 3);
17 mis-paired arXiv IDs caught; 7 bounded gaps. Applicability 60
(33/0/2/1/23/1); qualification 37 (35/0/1/0/1/0); R0 5 CONFIRMED; prelim
4C/2R; innovation 20 (14/4/1/1).
Harness baseline 1.0 rev.2 inherited (canonical source_ledger.json +
generated projection + row_kind + origin fidelity); FREEZE_ENFORCEMENT =
PARTIAL stated honestly; CANONICAL_MEMORY_WRITE=0 (safety hold).
Batched master byte-preserved (b29810f1); registry row rewritten.
Mutation audit written LAST; gates AC+AB+AA+Z+Y+X+W consistent.

research/memory-atlas-r1/AC-local-offline-intelligence/00_issue_scope.md

@@ -0,0 +1,24 @@
+# #404 AC — Offline / Local Intelligence: ISSUE + Scope (R1_FULL, 2026-09-22)
+
+## Canonicalization (verified, not invented)
+
+- **Gitea issue:** #404 (parent #375). **Domain:** AC — Offline / Local Intelligence (registry: "AC: Local / Offline Intelligence").
+- **Folder:** `AC-local-offline-intelligence/` (existing — kept). **Master:** `AC_LOCAL_OFFLINE_INTELLIGENCE_R1_MASTER.md` (canonical name kept).
+- **Batched artifact preserved byte-for-byte** as `AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md` (sha256 b29810f15a9bb64f348a…).
+- **Family file:** `families/offline_intelligence_resource_placement.md` Section AC — R0 baseline for reconciliation, reconnaissance NOT authority. Registry row 404 is batched-era text ("single-writer stance confirmed; staged earn-in") — NOT inherited.
+
+## Harness inheritance
+
+**R1_HARNESS_BASELINE_VERSION = 1.0 rev.2** (support #411): row-derived accounting (declared==derived), exact source foreign keys, evidence-depth governance (type≠depth), bounded zero-hit governance, targeted negative controls, origin→canonical→projection integrity for rich ledgers, post-freeze audit-freshness protocol. **FREEZE_ENFORCEMENT = PARTIAL — no executable hash-manifest; not claimed otherwise.** Memory safety hold: **CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0** (CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX); master + registry + Gitea are the durable summary authorities.
+
+## Scope
+
+68-section mandate: offline-state taxonomy · model-independent architecture · models-as-resources · capability compilation · intelligence assimilation · teacher/student evidence · strategy extraction · outcome-grounded learning · symbolic compilation · JEV-kernel seam · classical ML · small LMs · quantization · distillation · synthetic data · continual-learning seam · parametric vs non-parametric · retrieval · cascades · adaptive compute · capability registry/discovery · provider/local failure · no-model mode · degraded communication · local-first policies · contention · background cognition · caching · skills · code-as-capability · recovery internalization · self-improvement governance · regression/rollback · inheritance/distribution · security/privacy/supply-chain · inward audit · 2024-26 evidence · implementation ecosystem · adversarial pass (100 mandated + ≥15 Rune-specific) · 18+ matrices · 25 experiments (E1–E25) · 37 questions.
+
+## Governing distinctions (mandate)
+
+OFFLINE ≠ one state (NETWORK_OFFLINE / CLOUD_MODEL_OFFLINE / PROVIDER_UNAVAILABLE / INTERNET_SEARCH_UNAVAILABLE / LOCAL_GPU_UNAVAILABLE / LOCAL_LLM_UNAVAILABLE / ALL_GENERATIVE_MODELS_UNAVAILABLE / DEGRADED_TOOL_ENVIRONMENT). LOCAL ≠ trustworthy/free/deterministic. MODEL = replaceable cognitive resource, not Rune's mind (#399). TEXT FROM MODEL ≠ LEARNING SIGNAL — verified outcomes only (#399/#400 Growth Delta carry). Model agreement ≠ independent corroboration. FULL→DEGRADED, never FULL→DEAD — tested, not assumed.
+
+## Stage plan
+
+ISSUE (this) → INWARD (01, read-only A–I) → OUTWARD arms 1–4 serial (02_outward/) → APPLICABILITY (03) → INNOVATION (04) → claims/sources/load_bearing (rich ledger per harness contract) → R0 + prelim reconciliation → saturation → SYNTHESIS (06) → QUALIFY (07) → MASTER (rewrite) → closeout (audit LAST, gates, seal, receipts). POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM OUTWARD upgrade) recorded per mandate §61 — NOT applied here. STOP BEFORE #405.

research/memory-atlas-r1/AC-local-offline-intelligence/01_inward.md

@@ -0,0 +1,61 @@
+# #404 AC — INWARD: Read-Only Offline/Local Capability Audit (2026-09-22)
+
+Method: runtime probes (ollama API, nvidia-smi, free), file/code reads, SQLite readonly. No changes.
+
+## A. Local model runtime
+
+- **Ollama active** (system service, port 11434 live; user-level service shows inactive — launch context is system). **11 models installed** (~55 GB disk): 27B-class generalists ×2 (IQ2_M quantized, 11–12 GB), qwen3:14b, qwen2.5-coder:14b, qwen2.5:7b/3b, qwen2.5vl:3b + llava:7b (vision), **qwen3-embedding:0.6b + nomic-embed-text + mxbai-embed-large (embedders)**.
+- **Live capability probe:** tags API responds; no generation probe run (read-only discipline) — so generation health is CAPABILITY_DECLARED not CAPABILITY_OBSERVED.
+- Hardware: RTX 4070 Ti SUPER 16 GB (5.4 GB in use at idle by user apps); 62 GB RAM (30 available).
+
+## B. Provider orchestration
+
+- 11 providers authed (openai, google, ollama, kimi ×2, zai, moonshot, xiaomi ×2, opencode-go, verboo). Live config registers ONLY the local Ollama endpoint (one 27B model, `tools: true`) — the runtime's DEFAULT path is local, with frontier providers available per-session.
+- **No fallback chain, no cascade policy, no capability registry with observed truth** — model selection is per-session manual/provider-default. Capability truth is DECLARED (config) only; nothing probes or records observed capability. Staleness undetectable.
+
+## C. Deterministic capabilities
+
+- **152 Python modules** across scripts/ (129) + shared/ (23): curator, growth_delta, lessons, skill_library, claim_audit, drift_core, memory_store, model_connect, gitea tooling, drift/curator/consolidation suites. This is a REAL deterministic layer — but nothing routes decisions to it as a tier; it IS the current no-model fallback by accident of architecture rather than design.
+
+## D. Embedding / retrieval
+
+- memory_store embeds via Ollama nomic-embed-text (256-d Matryoshka truncation, 8192 ctx), content-hash cache so unchanged text never re-embeds. **Embedding-model identity NOT recorded per vector** (carried #403 defect — confirmed: no model column). FTS5 + sqlite-vec indexes local.
+- qwen3-embedding:0.6b (the family file's recommended upgrade) is INSTALLED but NOT wired (EMBED_MODEL default unchanged) — the swap path exists as designed but was never executed.
+
+## E. Learning
+
+- **Skill library EXISTS but is EMPTY** (skills: []). Lifecycle designed (observed→drafted→trusted→executable; ≥2-success promotion gate — good governance) but zero skills have ever entered it.
+- **Lessons: 7 chunks** (lessons wing) — Reflexion-style episodic reflection, applied via growth_delta. Real but tiny.
+- **Growth delta machinery exists** (behavioral vs competency gates, two-timescale design) — but no measured before/after analogous-task improvement has ever been recorded. Growth Delta is DESIGNED, never DEMONSTRATED.
+
+## F. Model-independent state
+
+- Survives any model loss: canonical Memory (944 entries + 118k chunks, SQLite), task/resume state (resume-flags), skill/lesson stores, all 152 deterministic modules, Gitea state, file artifacts. **State ownership is genuinely model-independent** — the strongest inward finding.
+- Does NOT survive: any semantic interpretation, consolidation, lesson extraction, code generation, open-ended communication.
+
+## G. Background services
+
+- Consolidation/curator/drift/claim-audit crons exist; several REQUIRE the LLM or Ollama (embedding calls). When Ollama is down, `_embed` fails SILENTLY (except: log-and-skip; entries get written WITHOUT working vectors — the sqlite-vec index silently loses new entries until re-embed). **Silent degradation, not graceful degradation.**
+
+## H. Hardware seam
+
+- Observed only: 16 GB VRAM (Idles at ~5 GB used by user apps), 62 GB RAM. Local 27B IQ2_M fits (11 GB). Contention with user gaming/coding is real (AD carry). Final topology → #405.
+
+## I. No-model mode (ALL_GENERATIVE_MODELS_UNAVAILABLE)
+
+- What works: file tools, git, Gitea API, deterministic Memory ops (add/update/get by ID, FTS search — minus embedding for new entries), all 152 scripts' deterministic paths, task state, integrity checks, structured error reporting via exit codes/files.
+- What breaks: every conversation; all consolidation/curator LLM calls; lesson extraction; embedding for new content (silent); any open-ended communication. No communication templates exist — degraded communication is UNDESIGNED.
+
+## Classification
+
+- **ACTIVE (5):** canonical Memory; deterministic script layer (152 modules); Ollama runtime + 11 models; embedding pipeline (text); provider auth layer.
+- **PARTIAL (4):** local LLM usage (available, rarely routed-to by default); learning machinery (designed, nearly empty: 7 lessons, 0 skills, 0 measured deltas); capability truth (declared-only); degraded communication (exit codes only, no templates).
+- **DORMANT (2):** qwen3-embedding:0.6b (installed, unwired); skill library (governed, empty).
+- **ABSENT (6):** cascade/routing policy; capability registry with observed truth; no-model communication templates; measured Growth Delta evidence; model-versioned embeddings; background cognition scheduler (timer-based, not event-driven).
+- **BYPASS (2):** frontier providers used ad-hoc per session (no policy); consolidation runs cloud-side implicitly.
+- **UNKNOWN (2):** generation health of installed quantized models (no probe run); real JSON-extraction failure rate (mandate-acknowledged gap).
+- **CONFLICTING (1):** "local-first" config default vs ad-hoc frontier usage in practice.
+
+## Current-state honesty (mandate §50)
+
+**Rune does NOT have offline intelligence.** It has: local model AVAILABILITY (11 models, real hardware); local EMBEDDING capability (with an unversioned-vector defect); a large deterministic script layer that constitutes an accidental no-model fallback; designed-but-empty learning machinery (0 skills, 7 lessons, 0 measured deltas); and NO routing policy, NO capability registry, NO degraded-mode communication, NO cascade. LOCAL MODEL AVAILABILITY ≠ OFFLINE TASK CAPABILITY ≠ LOCAL DECISION CAPABILITY ≠ LOCAL LEARNING. The distinction the mandate demands is exactly the inward finding.

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm1_foundations.md

@@ -0,0 +1,195 @@
+# AC #404 — Offline / Local Intelligence — Arm 1: FOUNDATIONS / LOCAL COMPUTATION
+
+_Domain: Memory Research Atlas R1 #404 · Rune project (single workstation, RTX 4070 Ti SUPER 16 GB, 62 GB RAM)_
+_Arm scope: small/efficient models · quantization · distillation · synthetic data · adaptive compute/cascades · classical ML vs LLM · retrieval-as-local-capability · hybrid symbolic/neural + verifiers + constrained decoding_
+_Verification discipline: every arXiv ID resolved via the export API (`export.arxiv.org/api/query`) before entry. Date of verification pass: 2026-09 session._
+_Carry-over from sealed prior domains: #383 (IR — cascade OVERTURNED at n=924, score-everything; RRF → weighted combination; abstention→generation gating) and #403 (Arm 2 — multi-vector late-interaction visual lane; embedding model+version stamping mandatory; ColPali↔ColQwen2 >5-point nDCG shift on identical data)._
+
+**Verification ledger (mis-pairings caught this arm — 4):**
+
+| Prompt-supplied ID | Reality (export API) | Correct ID for intended paper |
+|---|---|---|
+| 2402.04937 ("BitNet") | Charting the COVID Long Haul Experience (2024-02-07) — WRONG | BitNet b1.58 = **2402.17764** |
+| 2510.05040 ("model collapse successor") | Test-Time Scaling in Diffusion LLMs via Hidden Semi-Autoregressive Experts (2025-10-06) — WRONG | see do-not-cite register |
+| 2301.12726 ("Distilling Step-by-Step") | Specializing Smaller Language Models towards Multi-Step Reasoning (Fu et al.) — a DIFFERENT real paper, retained as reasoning-distillation evidence | Distilling Step-by-Step = **2305.02301** |
+| 2109.05074 ("PICARD") | FBERT: A Neural Transformer for Identifying Offensive Content — WRONG | PICARD = **2109.05093** |
+
+---
+
+## 1. Source ledger
+
+Read depths used: RELEVANT_SECTIONS (load-bearing sections read verbatim), DOCUMENTATION_AUDITED (docs only, never FULL_PAPER), ABSTRACT_ONLY (abstract + metadata via export API), METADATA_VERIFIED.
+
+### Topic 1 — Small / efficient models
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 1 | 2402.14905 | MobileLLM: Optimizing Sub-billion Parameter Language Models for On-Device Use Cases | Liu, Zhao, Iandola et al., 2024, Meta (ICML 2024) | Sub-1B on-device LMs | Architecture > data/params at sub-billion scale: deep-thin + embedding sharing + GQA gives +2.7%/4.3% over prior 125M/350M SOTA; MobileLLM-LS (block-wise weight sharing) +0.7–0.8% more; **near-parity with LLaMA-v2-7B on API-calling tasks** | Prevailing "data and parameter quantity are pivotal" belief contested at sub-billion scale | 125M–350M scale only; "close correctness" on API calls is task-specific (calibrated to common on-device use cases), not general capability | ABSTRACT_ONLY | Rune's 3B/7B tier is 3–20× larger than what MobileLLM shows is enough for **bounded tool-call/API-call class tasks** — routing/extraction/tool invocation is provably sub-1B-viable when specialized |
+| 2 | 2404.14219 | Phi-3 Technical Report | Abdin, Aneja, Awadalla et al., 2024, Microsoft | 3.8B–14B capability via data | phi-3-mini 3.8B: 69 MMLU, 8.38 MT-bench (rivals Mixtral 8x7B / GPT-3.5); 7B → 75; 14B → 78 MMLU; built on heavily filtered web + **synthetic data**; capability scales strongly with model size within the family | — | Benchmark-rivalry claims are vendor-measured (MMLU is contaminated/familiar); "rivals GPT-3.5" is aggregate, not per-task | ABSTRACT_ONLY | Rune's 14B generalist sits at the phi-3-medium class: 78 MMLU ≈ capable, but the report's own scaling (69→75→78) shows each size step buys ~3–6 MMLU points — small models gain capability mostly from data quality, which Rune can control locally |
+| 3 | 2412.08905 | Phi-4 Technical Report | Abdin, Behl, Bubeck, Eldan, Gunasekar et al., 2024, Microsoft | 14B + synthetic data | phi-4 14B built with synthetic data **throughout** pretraining; **surpasses its own teacher (GPT-4) on STEM QA** — data generation + post-training go beyond distillation | Implicit negative: Phi-family prior distillation-from-GPT-4 had a ceiling that phi-4's synthetic-data recipe exceeded | STEM-focused claims; general chat not claimed superior; vendor benchmarks | ABSTRACT_ONLY | THE synthetic-data counterexample to doom narratives: a bounded, curriculum-designed synthetic pipeline at 14B can exceed the teacher on a target domain. Rune's "learning machinery designed-but-empty" could be seeded the way phi-4 does it: generated exercises + verification, not raw distillation |
+| 4 | 2412.15115 | Qwen2.5 Technical Report | Qwen Team (Yang et al.), 2024, Alibaba | 0.5B–72B family | 18T tokens pretrain; SFT >1M samples + multi-stage RL; "notably improve long text generation, **structural data analysis**, and instruction following"; open-weight quantized versions shipped | — | Vendor benchmarks; "structural data analysis" improvement is asserted without per-task public detail in abstract | ABSTRACT_ONLY | Rune's 14B generalist is plausibly Qwen2.5-class; the family covers 0.5B→14B, giving Rune a same-family ladder for cascade experiments (0.5B/1.5B/3B for routing, 7B/14B for execution) — same tokenizer/family matters for speculative decoding draft/target compatibility |
+| 5 | 2409.12186 | Qwen2.5-Coder Technical Report | Hui, Yang, Cui et al., 2024, Alibaba | Code models 0.5B–32B | 5.5T tokens, "scalable synthetic data generation"; SOTA on >10 code benchmarks incl. generation, completion, reasoning, **repair**; consistently outperforms same-size larger models; retains general+math skills | — | Vendor-measured; repo-scale agentic coding not benchmarked (HumanEval/MBPP-class tasks) | ABSTRACT_ONLY | Rune's 14B coder: function/completion/repair-class coding is SOTA-at-size; **repo-scale multi-file coding remains unbenchmarked in every report** — the evidence base for "≤14B does repo-scale coding" is absent everywhere, not just in Rune |
+| 6 | 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.), 2025 | RL reasoning + distillation | Pure RL (no human reasoning labels) elicits self-reflection, verification, dynamic strategy adaptation; emergent patterns "can be systematically harnessed to guide and enhance the reasoning capabilities of smaller models" (R1-Distill line) | Conventional SFT on human demonstrations is inferior for complex verifiable tasks | Abstract-level; per-distill-size numbers not re-verified here | ABSTRACT_ONLY | Rune's 27B IQ2_M + 14B: if either is R1-Distill-Qwen lineage, §3 of 2504.04823 (below) applies DIRECTLY — distilled reasoning models have specific quantization sensitivities. Also: the R1-Distill line is the existence proof that reasoning distillation works at 7B/14B/32B — but see arm-2 caveats on what distillation transmits |
+| 7 | 2503.19786 | Gemma 3 Technical Report | Gemma Team (Kamath, Ferret, …), 2025, Google | 1B–27B multimodal | 1–27B scale; 128K context; KV-cache reduction via local/global attention ratio; trained with distillation; **Gemma3-4B-IT competitive with Gemma2-27B-IT; Gemma3-27B-IT comparable to Gemini-1.5-Pro** | — | "Competitive/comparable" is benchmark-composite vendor language; multimodal claims not load-bearing here | ABSTRACT_ONLY | The strongest generation-over-generation datapoint: **4B-IT ≈ prior-gen 27B-IT**. Within-family quality gain (2024→2025) bought more than 6× parameter reduction. For Rune: "is 27B IQ2_M better than a newer 4–7B at higher precision?" is a REAL question, not a rationalization — the answer is measurable locally |
+| 8 | 1503.02531 | Distilling the Knowledge in a Neural Network | Hinton, Vinyals, Dean, 2015 | KD foundation | Soft targets (temperature-scaled logits) transfer "dark knowledge" — inter-class similarity structure — that hard labels discard; ensemble → single model compression works (MNIST; production ASR) | Hard-label training discards the relative-probability information that makes distillation work | Pre-LLM: classification-scale evidence; temperature intuition does not map 1:1 onto autoregressive LM distillation | ABSTRACT_ONLY | Foundation row. Rune's "lessons" store is a knowledge-transfer analogue: soft/graded evidence (when things worked, with what confidence) carries more transferable signal than binary outcomes — the KD principle generalizes to lesson design |
+
+### Topic 2 — Quantization
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 9 | 2210.17323 | GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformers | Frantar, Ashkboos, Hoefler, Alistarh, 2022, ICLR 2023 | PTQ via second-order info | 3–4 bit weight PTQ with "negligible accuracy degradation"; 175B in ~4 GPU-hours; "reasonable accuracy" even in extreme (≈2–3 bit) regime; layerwise OBQ approximation | "Reasonable accuracy" at extreme bits is a euphemism — the paper itself does not claim losslessness below 3 bits | Perplexity + limited zero-shot tasks (2022-era evals, pre-reasoning models); calibration on wiki/C4-class text | ABSTRACT_ONLY | GPTQ is calibration-sensitive: 2504.04823 found GPTQ degrades badly when calibration domain ≠ target domain (−9.8 avg points; fixable by calibrating on task-domain data). If Rune's 27B IQ2_M was GPTQ-lineage-calibrated on generic text, its coding/reasoning loss is partially a calibration artifact |
+| 10 | 2306.00978 | AWQ: Activation-aware Weight Quantization | Lin, Tang, Tang, Yang et al., 2023, MLSys 2024 | Salient-weight PTQ | Protecting ~1% salient channels (identified by activation stats, not weight magnitude) greatly reduces quantization error; equivalent per-channel scaling avoids mixed precision; **no backprop → generalizes across domains/modalities without overfitting the calibration set**; strong on coding and math benchmarks | — | Weight-only; 4-bit regime evaluated, not 2-bit headline | ABSTRACT_ONLY | 2504.04823's head-to-head verdict: **AWQ preferred over GPTQ** for weight-only at 4-bit (comparable quality, faster). For Rune's tiering: AWQ-quantized models are the safer default for mixed-task local serving |
+| 11 | 2305.14314 | QLoRA: Efficient Finetuning of Quantized LLMs | Dettmers, Pagnoni, Holtzman, Zettlemoyer, 2023, NeurIPS 2023 | NF4 4-bit + LoRA | Backprop through frozen NF4 4-bit base ≈ full 16-bit finetune quality; Guanaco 99.3% of ChatGPT on Vicuna benchmark; double quantization + paged optimizers; NF4 information-theoretically optimal for normally distributed weights | >1,000-model sweep: finetuning on small high-quality data beats prior SoTA even with smaller models — data quality dominates scale for finetuning | Vicuna benchmark = LLM-judged chat quality, weak instrument; inference stays 4-bit slow (QLoRA optimizes training not serving) | ABSTRACT_ONLY | The enabling tool for Rune's empty learning machinery: a 14B model can be **finetuned on 16 GB VRAM** via 4-bit + LoRA on lesson-derived data. The QLoRA evidence says this is quality-preserving — the missing piece is Rune's data quality pipeline, not the training machinery |
+| 12 | 2402.17764 | The Era of 1-bit LLMs: All Large Language Models are in 1.58 Bits (BitNet b1.58) | Ma, Wang, Ma, Wang et al., 2024, Microsoft | Ternary {-1,0,1} LLMs | BitNet b1.58 **matches FP16 Transformer trained with the same size and token count** in perplexity and end-task — but this is training-from-scratch QAT, not post-training quantization; new scaling law; 2.71× faster, ~3.55× less memory (per paper's own architecture) | Implied negative: you cannot reach this quality by PTQ of an existing FP16 model — parity requires the model to be trained ternary | Only models trained from scratch; all Rune-relevant models are PTQ targets, not QAT-trained | ABSTRACT_ONLY | Hard boundary: Rune's 27B IQ2_M is a **PTQ** model. BitNet-class parity does not transfer to it. Any reasoning of the form "ternary works (BitNet), so 2-bit PTQ is fine" is invalid — the 2608.01078 finding below confirms PTQ ternarization collapses without reasoning-aware calibration |
+| 13 | 2404.14047 | An empirical study of LLaMA3 quantization: from LLMs to MLLMs | Huang, Zheng, Ma, Qin et al., 2024 | Low-bit PTQ sweep (1–8 bit) | 10 PTQ + LoRA-FT methods on LLaMA3-8B at 1–8 bits across many datasets: LLaMA3 (15T-token, high-quality pretrain) **still suffers non-negligible degradation** at low bits; ultra-low-bit MLLM (2–4 bit) evals show substantial multimodal loss | — | Abstract-level; headline tables not re-read here | ABSTRACT_ONLY | Corroborates 2504.04823 with a different model family: modern heavily-trained models do NOT out-quantize older ones. Rune cannot assume its 2024/2025-era models are quantization-robust at 2-bit |
+| 14 | 2504.04823 | Quantization Hurts Reasoning? An Empirical Study on Quantized Reasoning Models | Liu, Sun, Zhang, Bai et al., 2025, Huawei Noah's Ark Lab | **ANCHOR — task-sensitive quantization** | Systematic: DeepSeek-R1-Distill Qwen/LLaMA 1.5B–70B, QwQ-32B, Qwen3-8B; weight/KV/activation quant; AIME-120, MATH-500, GSM8K, GPQA, LiveCodeBench; 3 seeds. **(a)** W8A8 and W4A16 ≈ lossless (≤1% avg); **(b)** 3-bit weight-only risky: R1-Distill-Qwen-7B avg 63.8 → GPTQ-W3 58.4 (−5.4), AWQ-W3 57.6 (−6.3); W4 fine (−1.6/−2.1); **(c)** 1.5B collapses at low bits: W3-AWQ −18.6, W4A4-FlatQuant −10.9, MXFP4/QuaRot-4A4 → −45 to −46 (total collapse); **(d)** harder tasks degrade up to **4× more** (32B W4A4KV4: AIME −3.9% vs MATH-500 −1.2% vs GSM8K −0.0%); **(e)** model origin matters: Qwen vs LLaMA differ in sensitivity per quant type; **(f)** GPTQ calibration domain: switching WikiText2→Numina-Math = +9.8 avg; other algorithms robust; **(g)** **scaling: at equal size, large quantized > small BF16 — 3-bit 32B (≈14.5 GB) beats 7B BF16 by ~17% on LiveCodeBench**; 4-bit gives best accuracy-latency; **(h)** quantized models do NOT think longer unless aggressive low-bit; quantization error accumulates along CoT — test-time-scaling gains are lower than BF16 | "Quantized models exhibit increased output lengths" hypothesis REFUTED (no overthinking at moderate bits); "aggressive low-bit is viable" REFUTED for ≤4-bit weight-activation (4A4 collapses: −10.9 to −59.7); "relative quantization error shrinks with model scale" NOT monotone (see also #17) | Reasoning models only (CoT-heavy evals); no extraction/classification task class; no 2-bit weight-only config tested (their floor is 3-bit W-only / 4-bit activations); 27B class not directly in the sweep (14B/32B bracket it) | **RELEVANT_SECTIONS** (intro, §3.2–3.5, §4.2–4.3 verbatim incl. full tables for 1.5B/7B/14B) | **Rune's 27B IQ2_M sits BELOW the study's tested floor.** Extrapolation chain: W3 loses 5.4–6.3 avg points on a 7B; 2-bit PTQ is worse; IQ2_M is a ~2.5 bpw-class quant. Mitigating: the size-scaling law (large-quantized > small-BF16) is the only measured support for keeping a 2-bit 27B over a 4-bit 7–8B — but it was measured at 3-bit vs BF16, not 2-bit vs 4-bit. Rune's exact question has NO direct benchmark (do-not-cite register) |
+| 15 | 2608.01078 | Attend to Your Own Thoughts: Breaking the Barrier for PTQ of Reasoning LLMs through the Lens of 1.58-Bit Quantization (ScaleQ-1.58) | Wang, Li, Kang, Fan, Yao, 2026 | Ternary PTQ of reasoning LLMs | Conventional calibration **ignoring the reasoning process** → "performance collapse on challenging mathematics and coding tasks" under ternarization (even the prior best CAT-Q); AYOT calibration (use the model's own CoT traces as calibration context) + CAT-Q: ternary Qwen3-4B recovers +8.97 abs; 1.7B reaches >90.5% of BitNet b1.58-2B4T with 4M calibration tokens | Naive PTQ ternarization of reasoning models = collapse on math/coding; calibration on non-reasoning text = broken quantized reasoner | 1.58-bit focus; needs model-generated calibration traces (a per-model pipeline) | ABSTRACT_ONLY | Directly extends the family file's quantization finding to 2-bit PTQ: **at Rune's IQ2_M operating point, failure is concentrated exactly where Rune needs capability (math/coding reasoning), and it is a calibration-process artifact as much as a bit-width artifact.** A local repair path exists: regenerate quantization with reasoning-trace calibration — feasible on one workstation |
+| 16 | llama.cpp PR #1684 "k-quants" | k-quants (Q2_K…Q6_K + mixes) | ikawrakow / ggml, 2023, merged (GGUF ecosystem docs) | k-quant definitions + ppl evidence | Perplexity-vs-size smooth function across 2–6 bit mixes; **6-bit within 0.1% of fp16 ppl**; **relative quantization error does NOT keep decreasing with model size** (13B friendlier than 7B; error back at 7B level for 30B/65B); motivated by "2-bit 30B fits a 16 GB RTX 4080" — the exact Rune-class constraint | The folklore "bigger models quantize better" is bounded and non-monotone above ~13B | Perplexity-based (ppl is a poor proxy for coding/reasoning task quality — see #14); predates IQ (importance-matrix) quants | **DOCUMENTATION_AUDITED** | Q2_K-class ≈ 3.3 bpw effective; Rune's IQ2_M is below even that. The PR's own framing legitimizes 2-bit ONLY under a hard 16 GB ceiling — the same ceiling Rune has. Note: effective bpw of IQ2_M (~2.5–2.7) not re-audited in this pass; flagged in limitations |
+| 17 | llama.cpp discussion #5263 | About imatrix overfitting, and importance of input text | community benchmark (Ikawrakow-style tests), 2024, GGUF ecosystem docs | Importance-matrix calibration sensitivity | Mistral-7B Q2_K with imatrix from 3 datasets (French Wikipedia XML mix, English fiction, wikitext) × 3 corpus sizes: KL-divergence vs baseline varies by both dataset type and size; author's conclusion: task-matched calibration "seems unlikely to make things worse," wikitext-100K default | imatrix overfitting concerns PARTIALLY confirmed — wrong-kind-of-text imatrix measurably changes (can worsen) the quant; no universal best corpus | KL-divergence proxy, not task accuracy; 7B only; no error bars | **DOCUMENTATION_AUDITED** | Same mechanism as #14's GPTQ calibration finding, in the GGUF ecosystem Rune actually uses: **whatever imatrix produced Rune's IQ2_M files, its input text determines how much coding/reasoning survives.** Practical: prefer IQ quants whose imatrix came from code/reasoning text, or re-quantize locally with matched calibration |
+
+### Topic 3 — Distillation
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 18 | 1606.07947 | Sequence-Level Knowledge Distillation | Kim, Rush, 2016, EMNLP 2016 | Response/sequence-level KD | Word-level KD works for NMT; two sequence-level variants better still; best student 10× faster with little loss (+4.2 BLEU over no-KD greedy); sequence-KD **eliminates the need for beam search** on the student | — | NMT-era; teacher-student same architecture family | ABSTRACT_ONLY | Foundation for "distill teacher outputs, not logits": Rune's lesson pipeline can distill the 27B's *successful outputs* into prompts/templates for the 14B/7B — response-level, not answer-only |
+| 19 | 2305.02301 | Distilling Step-by-Step! Outperforming Larger Language Models with Less Training Data and Smaller Model Sizes | Hsieh, Li, Yeh, Nakhost, Fujii, Ratner et al., 2023, ACL Findings 2023 | Rationale (CoT) distillation | LLM rationales as extra supervision in multi-task training: 770M T5 outperforms few-shot 540B PaLM using only 80% of a benchmark's data; beats standard finetune AND standard distillation with much less data across 4 NLP benchmarks | Standard label-only distillation is data-hungry and weaker than rationale-augmented distillation — the negative that motivates the method | NLP classification + QA tasks, not agentic coding | ABSTRACT_ONLY | For Rune: extract the 27B's *reasoning* (why this lesson, why this fix) as supervision, not just verdicts — rationales are the transferable part |
+| 20 | 2301.12726 | Specializing Smaller Language Models towards Multi-Step Reasoning | Fu, Peng, Ou, Sabharwal, Khot, 2023, ICML 2023 | **ANCHOR — reasoning distillation trade-offs** | CoT distillation from GPT-3.5 (≥175B) into T5 ≤11B works: specialized 3B/11B match LaMDA-137B / approach PaLM-60B-class on math CoT; OOD to MultiArith/ASDiv/SVAMP when tuned on GSM8K CoT. **BUT the price is explicit:** at the START of specialization the model **immediately loses ALL CoT ability on BigBench-Hard (accuracy → 0)** and a large portion of answer-only ability; in-dist and OOD performance **fluctuate differently in late training — in-dist accuracy does not predict OOD**; model selection must use held-out OOD data; smaller students more data-hungry (3B plateaus at ~90K examples vs Base still climbing) | Generic capability is NOT preserved: specialization is a real trade, not free capacity reallocation; "emergent 100B-only" CoT claim REFUTED (distillable) | Math word problems only; T5-family students; 2023-era teacher | **RELEVANT_SECTIONS** (§1–3 + specialization dynamics + model-selection discussion verbatim) | Sharpest evidence on what distillation transmits: **capability in-domain, loss out-of-domain, and no reliable internal signal of which is which.** For Rune's lesson design: any distilled/derived rule is in-distribution ONLY for the tasks that generated it; Rune must hold out OOD probe tasks before trusting a lesson — mirror of the #382 contrastive-intervention gate |
+| 21 | 2306.13649 | On-Policy Distillation of Language Models (GKD) | Agarwal, Vieillard, Zhou, Stanczyk, Ramos, Geist et al., 2023, Google DeepMind (ICLR 2024) | On-policy vs off-policy KD | Standard KD suffers train/inference **distribution mismatch** (student trained on teacher-generated sequences, then runs on its own); GKD trains on the student's self-generated sequences with teacher feedback; alternative divergences help when the student **lacks expressivity to mimic the teacher**; integrates with RLHF; gains on summarization, translation, arithmetic, instruction-tuning | Off-policy (fixed teacher outputs) KD is structurally mismatched for autoregressive LMs — a negative about the dominant practice | Abstract-level; per-task numbers not re-read | ABSTRACT_ONLY | For Rune: if it ever distills 27B→14B, on-policy (student's own attempts graded by teacher) beats copying teacher outputs — and this matches #382's SkillGen contrastive-intervention design (grade the agent's own behavior, don't imitate transcripts) |
+| 22 | 2408.12326 | Interactive DualChecker for Mitigating Hallucinations in Distilling Large Language Models | Wang, Suzuki, Sakaji, Izumi, 2024 | Hallucination control in KD pipelines | LLM-as-teacher KD propagates hallucinations when teacher confidence is low; DualChecker re-prompts low-confidence teachers and mines borderline student cases; improves both teacher and student on a green-innovation text dataset | — | Single narrow domain; no broad hallucination-inheritance benchmark | ABSTRACT_ONLY | Weak-but-real evidence that **teacher-error transmission is an observed problem needing machinery, not a hypothetical**. Paired with the bounded zero-hit below (no dedicated "hallucination inheritance" measurement paper found), the verdict is: transmission is acknowledged and patched piecemeal, never quantified systematically |
+
+### Topic 4 — Synthetic data
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 23 | 2305.17493 | The Curse of Recursion: Training on Generated Data Makes Models Forget (model collapse) | Shumailov, Shumaylov, Zhao, Gal, Papernot, Anderson, 2023, Nature 2024 | Recursive training degradation | Model-generated content in training causes "irreversible defects": tails of the original distribution disappear; shown in VAEs, GMMs, LLMs; **data REPLACEMENT across generations** drives collapse | — | The collapse regime assumes replace-not-accumulate (see #24); public-web framing, not closed-loop personal data | ABSTRACT_ONLY | Rune's feedback loop (agent writes lessons → lessons condition future behavior) is structurally a replace-or-accumulate choice. #23 says: never let synthetic/derived content replace the human-verified core |
+| 24 | 2404.01413 | Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data | Gerstgrasser, Schaeffer, Dey, Rafailov, Sleight, Hughes et al., 2024 | **KEY NEGATIVE RESULT** | Confirms collapse under replacement — then shows **accumulating** each generation's synthetic data alongside the original real data **avoids model collapse**; holds across model sizes, architectures, hyperparameters; similar for diffusion/VAE | The strong "training on generated data is doomed" reading of #23 is NOT inevitable — it is an artifact of the replacement assumption | Pretraining-scale experiments; does not license unbounded synthetic accretion (tails can still dilute) | ABSTRACT_ONLY | **Rune's append-only ledger architecture is the collapse antidote**: derived data (lessons, summaries, embeddings) ACCUMULATES beside sources, never overwrites them. This converts a doom scenario into a design validation of what Rune already does (per #387: state + audit log) |
+| 25 | 2306.11644 | Textbooks Are All You Need (phi-1) | Gunasekar, Zhang, Mendes et al., 2023, Microsoft | Verified synthetic data for code | 1.3B model, textbook-quality filtered web (6B tokens) + **synthetic GPT-3.5 textbooks/exercises (1B tokens)**: 50.6% HumanEval pass@1, 55.5% MBPP — from 8 GPUs / 4 days; phi-1-small 350M still 45% HumanEval | Scale-dogma negative: 1.3B beat models 10× larger via data curation | HumanEval is small and leaky; function-level not repo-level | ABSTRACT_ONLY | The template for Rune's empty learning machinery: small model + bounded, exercise-shaped, verified synthetic data ≫ raw corpus. Rune's 152 deterministic modules are exactly the kind of verifiable "textbook exercise generator" the phi-line recipe needs |
+| 26 | 2412.08905 | (Phi-4 — see row 3) | — | Synthetic data throughout pretraining beats teacher | — | — | — | — | Cross-reference: synthetic data done at curriculum quality EXCEEDED the teacher on STEM (row 3). Synthetic data helps when: bounded, curriculum-structured, verified/filtered; corrupts when: recursive (#23), replacing (#24's replacement arm), unverified |
+
+### Topic 5 — Adaptive compute / cascading / routing
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 27 | 2211.17192 | Fast Inference from Transformers via Speculative Decoding | Leviathan, Kalman, Matias, 2022, Google, ICML 2023 | Speculative decoding | Hard tasks contain easy subtasks a small draft model handles; parallel draft + verification gives **2–3× acceleration on T5-XXL with IDENTICAL outputs** (lossless, distribution-preserving) | — | Needs draft/target alignment; speedup = f(acceptance rate, relative cost) | ABSTRACT_ONLY | Lossless local latency win for Rune: 3B drafts for 14B/27B targets, same-family (Qwen2.5 line covers 0.5B–14B — row 4). Zero quality risk, unlike every cascade/routing scheme |
+| 28 | 2302.01318 | Accelerating Large Language Model Decoding with Speculative Sampling | Chen, Borgeaud, Irving, Lespiau, Sifre, Jumper et al., 2023, DeepMind | Speculative sampling (formal) | Modified rejection sampling **provably preserves the target distribution** within hardware numerics; 2–2.5× speedup on Chinchilla 70B | — | Distributed-setup benchmark | ABSTRACT_ONLY | The formal guarantee Rune should demand of any local acceleration: distribution-preserving or it is a quality trade, not an optimization |
+| 29 | 2305.05176 | FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance | Chen, Zaharia, Zou, 2023, Stanford / Databricks | **ANCHOR — cascade evidence** | LLM cascade = generation scoring function g(q,a)∈[0,1] + router + per-step thresholds τ; query cheap LLMs first, escalate only when score < τ; headline: match GPT-4 quality with up to **98% cost reduction** or +4% accuracy at same cost; scored via a trained regression model on (query, answer); optimizer prunes candidate chains by answer disagreement | **Paper's own limitations:** (1) needs labeled examples **from the same/similar distribution as test queries**; (2) cascade training itself costs resources (framed as one-time, beneficial only if query volume is large); (3) shown failure mode: when chain members agree but are wrong, the scorer cannot tell → queries the whole chain anyway ("remains an open problem"); (4) evaluated on **classification/short-answer tasks** (HEADLINES gold-trend, OVERRULING legal sentences, CoQA) — NOT generation, coding, or agentic tasks | 2023 API-pricing economics (2-orders-of-magnitude price spread is the driver); scorer generalization unproven beyond in-distribution | **RELEVANT_SECTIONS** (mechanics, experimental setup, limitations sections verbatim) | For Rune the economics invert: local tokens are ~free, so the cascade's 98%-cost driver is irrelevant; what remains is (a) latency/VRAM pressure, (b) the scorer's requirement for **in-distribution labeled data** — which Rune's measured-growth machinery has not produced (0 measured deltas); (c) the agreement-but-wrong failure is worse locally because Rune's small models are MORE correlated (same-family ladders agree more). With #383's cascade overturn at n=924 (corpus level) and this anchor at query level, cascades are evidenced as an artifact of scale + economics Rune does not have |
+| 30 | 2406.18665 | RouteLLM: Learning to Route LLMs with Preference Data | Ong, Almahairi, Wu, Chiang et al., 2024, Berkeley | Model routing | Routers trained on human preference data pick strong-vs-weak model per query: **>2× cost reduction without compromising response quality** on their benchmarks; router transfers across strong/weak model pairs (test-time model swap) | Routing signal = trained on preference pairs, NOT intrinsic difficulty/confidence estimates — the router learns which queries the weak model loses on, from data | Preference-data-dependent; benchmarks are chat-style (MT-Bench/MMLU-class); no coding-agent tasks | ABSTRACT_ONLY | The working routing signal is **empirical per-query weak-model failure data**, not a priori difficulty. Rune has no preference/failure dataset (0 measured deltas) → any routing layer today would be untrained guesswork. Route to build: log (query, model, outcome) NOW; the router becomes trainable only after that dataset exists |
+| 31 | 2207.07061 | Confident Adaptive Language Modeling (CALM) | Schuster, Fisch, Gupta, Dehghani, Bahri, Tran et al., 2022, NeurIPS 2022 | Early exit | Per-token early exit with calibrated confidence + sequence-level constraints: up to ×3 compute reduction **with provable output-quality maintenance** | — | Generation tasks tested; provable maintenance is of a defined quality bound, not exactness | ABSTRACT_ONLY | The one adaptive-compute scheme with a maintenance guarantee — but it is an inference-engine feature (model-internals), not a policy layer Rune can bolt on; noted for completeness, rejected for Rune's stack |
+
+### Topic 6 — Classical ML vs LLM
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 32 | 2409.02136 | Large Language Models versus Classical Machine Learning: Performance in COVID-19 Mortality Prediction Using High-Dimensional Tabular Data | Ghaffarzadeh-Esfahani et al., 2024 | LLM vs classical ML head-to-head | n=9,134 patients, 4 hospitals, high-dimensional tabular: **XGBoost F1 0.87 / RF 0.83 (internal+external validation) vs GPT-4 zero-shot F1 0.43**; Mistral-7B zero-shot recall 1% (!); QLoRA finetuning lifted Mistral-7B recall 1%→79%, stable F1 0.74 external — still below classical ML | **GPT-4 zero-shot LOSES to XGBoost by 0.44 F1** on bounded structured-data classification; zero-shot Mistral-7B recall 1% = catastrophically miscalibrated out of the box | Medical domain; text-serialized tabular input is LLM-unfriendly by construction (that is partly the point) | ABSTRACT_ONLY | Strongest direct number for the arm's classical-ML verdict: for **bounded, labelled, structured tasks, 152 deterministic Python modules + classical models are not a stopgap — they are the SOTA**. LLM calls only become competitive after finetuning, and even then trail. Rune's deterministic modules should own: routing heuristics, dedupe, classification, drift signals |
+| 33 | 2207.08815 | Why do tree-based models still outperform deep learning on tabular data? | Grinsztajn, Oyallon, Varoquaux, 2022, NeurIPS 2022 | Classical vs neural benchmark | 45 datasets: tree models (XGBoost/RF) remain SOTA on medium-sized data (**~10K samples**) even ignoring speed; failure modes of NNs on tabular: uninformative features, non-smooth/irregular target functions, feature-orientation violation | Deep learning does NOT transfer its unstructured-data dominance to tabular at realistic (non-web) scales | Tabular only; text/LLM angles out of scope | ABSTRACT_ONLY | Rune's scale (n≈944 memory entries, hundreds of sessions) is ~10× BELOW the regime where trees already win: gradient boosting/logistic regression over hand-built features is the correct local tool for every bounded prediction task Rune has (lesson promotion, recall ranking priors, drift detection) |
+
+### Topic 7 — Retrieval as local capability (with carry-over)
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 34 | 1911.00172 | Generalization through Memorization: Nearest Neighbor Language Models (kNN-LM) | Khandelwal, Levy, Jurafsky, Zettlemoyer, Lewis, 2019, ICLR 2020 | Retrieval replacing learned generation | kNN interpolation over a datastore: +2.9 ppl (SOTA 15.79 on Wikitext-103) **with no additional training**; biggest gains on rare patterns/factual knowledge; domain adaptation by swapping the datastore, no retraining | "Learning similarity is easier than predicting" — the LM itself need not internalize the long tail | Next-token distribution only; datastore scale-dependent; 2019-era model | ABSTRACT_ONLY | The conceptual charter for Rune's retrieval-first stance: **factual/long-tail cognition can live in retrieval, not parameters.** Combined with #383 (score-everything at n≈924) and #403 (multi-vector visual lanes + versioned embeddings), retrieval is the ONE local-intelligence pillar with positive evidence at every scale Rune operates |
+| 35 | — carry-over #383 (IR domain, R1_QUALIFIED) | research/memory-atlas-r1/H-information-retrieval/ | — | Cascade overturned at corpus scale | **CASCADE OVERTURNED at n=924**: exhaustive scoring beats every pruning stage (0.9 MB corpus, microsecond-fast); RRF → weighted linear combination (Bruch TOIS 2024); abstention→generation sufficiency gating; ANN deleted (crossover ≥10⁵); dense lane unproven at <1k docs — keep but self-measure | — | — | (sealed prior) | Retrieval without generation at Rune's scale is settled: BM25 + metadata + dense, fused by weighted combination. Any local "routing" instinct must re-justify itself against score-everything |
+| 36 | — carry-over #403 (Arm 2, AB arms) | checkpoint-403-ab-arms-findings.md | — | Multi-vector lanes + versioning | Visual dense lane must be late-interaction multi-vector (vanilla SigLIP 51.4 / Jina-CLIP 17.7 LOSE to BM25-on-OCR 65.5); ColPali↔ColQwen2 >5-point nDCG shift on identical data → **model+version stamping per lane mandatory**; 944 pages ≈ 0.5 GB multi-vector, millisecond MaxSim | — | — | (sealed prior) | The versioned-embedding mandate applies to Rune's 3 embedders NOW: nomic-embed 256-d Matryoshka vectors are UNVERSIONED — silent-degrade-when-Ollama-down is the same defect class |
+
+### Topic 8 — Hybrid symbolic/neural, verifiers, constrained decoding
+
+| # | ID | Title | Authors / year / venue | Topic | Key claims | Negative results | Limitations | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|---|---|---|
+| 37 | 2203.07814 | Competition-Level Code Generation with AlphaCode | Li, Choi, Chung, Kushman, Schrittwieser et al., 2022, DeepMind, Science 2022 | Verifier-guided generation at scale | Top 54.3% average on Codeforces (>5,000 participants); the three critical components: (1) large-scale sampling, (2) **execution-based filtering against example tests**, (3) behavior clustering for submission selection | Single-shot generation performs poorly on complex unseen problems — reliability came from the verifier loop, not raw model skill | Enormous sample counts (10⁵-scale generations) — compute profile beyond per-turn local use | ABSTRACT_ONLY | The charter for verifier-guided local coding: Rune's 152 deterministic modules + tests are the execution oracle. Small models + test-filtered sampling is the evidenced reliability mechanism at function level; repo-scale remains open (row 5) |
+| 38 | 2305.20050 | Let's Verify Step by Step | Lightman, Kosaraju, Burda, Edwards, Baker, Lee et al., 2023, OpenAI | Process supervision / verifiers | **Process supervision (per-step feedback) significantly outperforms outcome supervision** on MATH; process-supervised model solves 78% of a representative MATH subset; active learning improves verifier data efficiency; PRM800K released | Outcome-only supervision (final-answer check) is the weaker signal | Math domain; human-labeled steps (expensive to reproduce locally) | ABSTRACT_ONLY | Lesson/outcome logging design: record **step-level** traces, not just success/final answers — per-step grading is the evidenced-superior supervision signal, and Rune's turn/step ledger already captures the substrate |
+| 39 | 2109.05093 | PICARD: Parsing Incrementally for Constrained Auto-Regressive Decoding from Language Models | Scholak, Schucher, Bahdanau, 2021, EMNLP 2021 | Incremental-parse constrained decoding | Rejecting inadmissible tokens via incremental parsing turns passable T5 text-to-SQL models into **state-of-the-art** on Spider/CoSQL — validity constraints convert weak models into usable ones | — | Formal target language (SQL) — where constraints are verifiable; 2021-era models | ABSTRACT_ONLY | Positive pole of constrained decoding: for outputs with a real grammar (SQL, JSON matching a schema with semantics, tool-call syntax), constraint decoding is a capability GAIN at small scale |
+| 40 | 2408.02442 | Let Me Speak Freely? A Study on the Impact of Format Restrictions on Performance of Large Language Models | Tam, Wu, Tsai, Lin, Lee, Chen, 2024 | **Format constraints vs reasoning (family-file anchor — verified)** | Format restrictions (JSON/XML output, incl. JSON-mode) cause **significant decline in reasoning ability**; **stricter constraints → greater degradation**; the family file's reading is CONFIRMED at abstract level: reasoning tasks most affected | — | Eval suite is reasoning/QA-heavy; per-task-class severity ordering ("extraction least affected") is in the paper's interior, NOT re-read at FULL depth this pass — carried from family file, flagged honestly | ABSTRACT_ONLY (id re-verified; interior carried) | Confirms: GBNF for reasoning-heavy steps (planning, multi-step debugging) = self-inflicted handicap; GBNF for extraction/typing = near-free validity |
+| 41 | 2509.21791 | Quantifying the Impact of Structured Output Format on Large Language Models through Causal Inference | Yuan, Zhao, Zhang, Luo, Ma, 2025 | Causal analysis of format effects | Prior studies conflict; causal-inference framing derives five possible causal structures; across 7+1 reasoning tasks, **coarse metrics report positive, negative, or neutral effects of structured output** — the apparent effect is often confounded (collider/m-bias structures); effects are task- and metric-dependent | The blanket "format hurts" claim (#40) is NOT causally clean: some of the measured harm is confounding, and direction varies by metric/task | GPT-4o-era; still reasoning-task-centric | ABSTRACT_ONLY | Extension of the family-file finding: the correct posture is **per-task-class empirical measurement** (Rune's local eval harness — #403 forced-correction #8), not a global "never constrain" or "always constrain" rule |
+| 42 | 2605.26128 | The Constraint Tax: Measuring Validity-Correctness Tradeoffs in Structured Outputs for Small Language Models | Ray, 2026 | Constraint tax at sub-3B | 15,000 generations, Qwen2.5-0.5B/1.5B, SmolLM2-1.7B: hard answer-only schema decoding raises schema validity **61.5%→100%** but lowers answer accuracy **19.7%→11.0%** and raises wrong-but-valid-schema outputs **49.5%→88.9%**; "the usual engineering assumption is unsafe for small models" | The industry assumption "hard constraints improve reliability without changing the answer" REFUTED at small scale — the constraint tax is largest exactly where Rune's small tier lives | Preprint (2026); Qwen2.5/SmolLM2 families; answer-only schema focus | ABSTRACT_ONLY | The most Rune-specific number in this ledger: at ≤2B, unconstrained answer accuracy 19.7% halves under a hard schema. Rule: constrain the FORMAT of extraction fields only; never let the schema gate the ANSWER space of a reasoning step; validate-after-generate beats generate-under-mask for small models on hard tasks |
+
+---
+
+## 2. Synthesis
+
+### 2.1 What task classes are provably local-viable at what quality (Rune hardware, ≤14B/27B-IQ2M tier)
+
+**PROVABLY VIABLE (multiple converging sources, with numbers):**
+
+1. **Bounded classification / routing / API-call-style invocation** — MobileLLM 125–350M ≈ LLaMA-v2-7B on API-calling tasks (row 1); Distilling-step-by-step: 770M T5 > few-shot 540B PaLM on NLP tasks with rationale supervision (row 19). Rune's 3B tier is over-provisioned for this class. Quality ceiling: with local labelled data, classical models are better still (see #32).
+2. **Structured extraction** — least affected by format constraints (row 40, family-file finding confirmed); constrained decoding is a validity *gain* here. Caveat: at sub-3B, even extraction schemas carry a measurable tax (19.7%→11.0% under answer-gating; row 42) — constrain field formats, not the answer space.
+3. **Function-level coding (generation, completion, repair)** — Qwen2.5-Coder 7B/14B SOTA-at-size across 10+ benchmarks incl. repair (row 5); phi-1 1.3B hit 50.6% HumanEval via verified synthetic data (row 25). Reliability multiplier: execution/test filtering (AlphaCode, row 37) — Rune's 152 deterministic modules are the oracle.
+4. **Math/multi-step reasoning — CONDITIONAL, two regimes:** (a) specialized 3–14B can reach 60B-class on the trained domain via CoT distillation (row 20) — but at the cost of total loss of generic CoT (BBH → 0) and OOD fragility; (b) quantized below 4-bit, reasoning is the FIRST casualty (rows 14, 15).
+5. **Retrieval-grounded factual cognition** — kNN-LM: long-tail knowledge lives in the datastore, not parameters (row 34); at n≈924 score-everything is settled (row 35). This is Rune's highest-quality local capability and needs no generation at all.
+6. **Summarization/translation-class generation** — GKD's demonstrated task set (row 21); quality at 7–14B adequate but unverified at 2-bit quantization.
+
+**PROVABLY NOT LOCAL-VIABLE (negative evidence, with numbers):**
+
+1. **High-dimensional structured/tabular prediction by LLM** — GPT-4 zero-shot F1 0.43 vs XGBoost 0.87 (row 32); classical ML wins up to and beyond ~10K samples (row 33). Rune's deterministic modules own this class.
+2. **Repo-scale / multi-file agentic coding at ≤14B** — NO benchmark in any technical report evaluated this (rows 4, 5); the evidence vacuum is the finding. Do not assume Qwen2.5-Coder-14B SOTA transfers beyond function-level.
+3. **Generic multi-domain reasoning in a small specialized model** — specialization strictly trades generic CoT away (BBH → 0, row 20); a Rune fine-tuned on coding lessons will lose breadth measurably.
+4. **Complex reasoning under aggressive quantization** — 4-bit activations = collapse (−10.9 to −59.7, row 14); naive ternary PTQ = collapse on math/coding (row 15); harder tasks degrade up to 4× more (row 14).
+
+### 2.2 The quantization task-sensitivity verdict
+
+**Loss is NOT uniform; it is task-, difficulty-, size-, origin-, and calibration-sensitive.** Evidence: harder tasks degrade up to 4× more (AIME −3.9% vs GSM8K −0.0% at 32B W4A4KV4); 7B loses 5.4–6.3 avg points at 3-bit where 14B loses 4.5–6.2 and 1.5B loses 7.6–18.6 (same methods, row 14); model family changes which quant type hurts (row 14 §3.5); GPTQ calibration domain alone swings ±9.8 avg points (row 14 §4.2), confirmed in the GGUF ecosystem by imatrix-input sensitivity (row 17); reasoning traces as calibration context rescue ternary PTQ from collapse (row 15).
+
+**The Rune key question — 27B IQ2_M vs 7–8B Q4 — has NO direct published head-to-head (bounded zero-hit; do-not-cite register).** What the evidence supports:
+- Against 27B IQ2_M: IQ2_M sits below every tested config in row 14 (their floor: 3-bit weight-only, where a 7B already loses 5.4–6.3 avg points and a 1.5B loses 18.6); row 15 shows the 2-bit PTQ regime collapses on math/coding without reasoning-aware calibration; row 13 confirms modern 15T-token models still degrade non-trivially at low bits; row 12's ternary parity requires training-from-scratch, not PTQ.
+- For 27B IQ2_M: the only measured support is the size-scaling law — at EQUAL model size, large-quantized beats small-BF16 (3-bit 32B ≈ 7B-BF16 size, +17% on LiveCodeBench; row 14 §4.3). But this was measured at 3-bit, and its extrapolation to 2-bit is untested. Also 6-bit ppl within 0.1% of fp16 (row 16) marks where the "safe" band ends.
+- **Working verdict: the evidence supports preferring 4-bit 7–14B for reasoning/coding task classes, and keeping a 27B IQ2_M only if locally measured (per-task deltas on Rune's own harness) shows it survives 2-bit where it matters. Row 7 adds a live alternative: a newer 4B–7B at Q4/Q5 may match the prior-gen 27B outright.**
+
+### 2.3 The distillation error-transmission verdict
+
+**Distillation transmits all three — capability, teacher errors, and stylistic imitation — and the mixture is task- and regime-dependent:**
+
+1. **Capability transmits, but as a trade, not a copy.** CoT distillation into ≤11B matches 60B-class on the trained domain (row 20); phi-4's synthetic-data recipe even EXCEEDED the teacher on STEM (row 3). But specialization instantly zeroed generic CoT (BBH→0) — capability is moved, not duplicated.
+2. **Teacher errors transmit.** Hallucination-in-KD is an acknowledged, machine-patched problem (DualChecker, row 22); there is NO systematic quantification of hallucination inheritance in the literature (title-level search: zero exact "hallucination inheritance" papers — bounded zero-hit). Distribution mismatch means the student learns on teacher outputs but executes on its own — GKD's entire motivation (row 21).
+3. **Stylistic imitation is the default failure mode.** Off-policy KD = imitating teacher surface forms; on-policy (GKD) + rationale-level supervision (Distilling-step-by-step) are the evidenced countermeasures (rows 19, 21); DeepSeek-R1 shows RL-on-own-outputs beats SFT-on-teacher-demos for reasoning (row 6).
+
+**Rune rule:** grade the agent's own behavior (contrastive with/without — #382's gate), never imitate transcripts; hold out OOD probes before trusting any distilled lesson (row 20's model-selection lesson); expect in-domain gain with measurable out-of-domain cost.
+
+### 2.4 The cascade/routing evidence verdict
+
+**Cascades and routing are artifacts of two conditions Rune lacks — API economics and scale — and both legs are now evidence-closed:**
+
+- **Corpus level (#383, sealed):** cascade overturned at n=924; score-everything wins because the corpus is microsecond-cheap to score exhaustively.
+- **Query level (row 29, this arm):** FrugalGPT's 98% saving is a *pricing-spread* phenomenon (2023 API landscape, 2-orders-of-magnitude fee differences). Its paper-stated requirements — in-distribution labeled data for the scorer, one-time training cost amortized only over large query volume — are unmet by Rune (0 measured growth deltas). Its own named failure — chain members agree but are wrong → full chain queried anyway — is *amplified* locally, because Rune's same-family model ladder is more correlated than heterogeneous APIs.
+- **Routing (row 30):** the working signal is empirical weak-model-failure data from preference/failure logs, not intrinsic difficulty or raw confidence. RouteLLM's >2× cost cut required trained routers on human preference data. Without Rune's outcome logs, routing is untrained guesswork.
+- **What survives:** speculative decoding (rows 27–28) — the ONLY adaptive-compute mechanism with lossless distribution-preservation and 2–3× measured speedup; it needs no policy, no scorer, no data, just a same-family draft model (Qwen2.5 line: 0.5B/1.5B/3B drafts for 14B targets). Early-exit (CALM, row 31) has a maintenance guarantee but is engine-internal — rejected for Rune's stack.
+
+**Verdict: no cascade/routing policy for Rune now. Log (query, model, outcome) from today — a router becomes trainable only after that dataset exists, and corpus-level routing should never exist at n≈944.**
+
+### 2.5 Retrieval, classical ML, verifiers — the local capability stack
+
+The convergent architecture the evidence supports for one workstation: (1) **retrieval does the remembering** (score-everything, multi-vector lanes, versioned embeddings — rows 34–36); (2) **deterministic modules + classical ML do the deciding** on bounded structured tasks (rows 32–33); (3) **small/quantized LLMs do the generating** — function-level code, extraction, bounded reasoning — under execution-based verification (rows 5, 25, 37) and process-level grading (row 38); (4) **constraints applied selectively**: grammar masks for extraction/validity, free generation for reasoning, validate-after-generate elsewhere (rows 39–42); (5) **derived data accumulates, never replaces** (row 24) — Rune's append-only design is the model-collapse antidote; (6) **any model change re-measures** — version stamping (row 36) and per-task local deltas (rows 14, 41) are the same discipline.
+
+---
+
+## 3. Rejected approaches
+
+| Rejected transfer | Why (evidence) |
+|---|---|
+| **LLM cascade / escalation chains over Rune's local models** | Economics inverted (local tokens ~free); scorer needs in-distribution labels Rune lacks; agree-but-wrong failure amplified by same-family correlation (row 29); corpus-level cascade already overturned at n=924 (#383) |
+| **Routing policy built now** | Requires preference/failure-trained router (row 30); Rune has 0 measured deltas → build the log, not the router |
+| **"Ternary is fine because BitNet works"** | BitNet parity requires training-from-scratch QAT (row 12); PTQ ternarization collapses on math/coding absent reasoning-aware calibration (row 15); IQ2_M is PTQ |
+| **Assuming 27B IQ2_M > 7–8B Q4 without local measurement** | Below every tested quant config in the systematic study (row 14); no direct benchmark exists (zero-hit); newer 4B ≈ prior-gen 27B at IT level (row 7) — the default should be measured, not assumed |
+| **Hard schema/GBNF gating of reasoning outputs, esp. at ≤3B** | Constraint tax measured: validity 61.5→100% but accuracy 19.7→11.0%, wrong-but-valid 49.5→88.9% at small scale (row 42); reasoning declines under strict format (row 40); even the "format always hurts" reading is causally confounded (row 41) → per-task-class local measurement only |
+| **LLM-as-router / LLM-as-classifier over structured data** | GPT-4 0.43 F1 vs XGBoost 0.87 (row 32); trees win at Rune-adjacent and larger scales (row 33); deterministic modules own this |
+| **One-shot generic CoT distillation into Rune's small tier (imitating teacher transcripts)** | Off-policy distribution mismatch (row 21); instant generic-CoT loss (row 20); teacher-error propagation unpatched without checking machinery (row 22); on-policy/contrastive grading is the evidenced alternative |
+| **Recursive self-improvement that overwrites real/verified data** | Model collapse under replacement (row 23); accumulate-only is the evidenced-safe regime (row 24) |
+| **Early-exit / CALM-style adaptive depth in Rune's stack** | Engine-internal mechanism with maintenance guarantee (row 31) — not implementable as a policy layer over Ollama; speculative decoding covers the lossless-latency need |
+| **Trusting vendor benchmark aggregates ("rivals GPT-3.5", "comparable to Gemini-1.5-Pro") as local quality estimates** | Aggregate composite claims (rows 2, 7) are contaminated/familiar benchmarks and vendor-measured; the ONLY transferable numbers are per-task deltas measured on Rune's harness |
+
+## 4. Do-not-cite register
+
+| Item | Status |
+|---|---|
+| **2510.05040 as "model collapse successor"** | MIS-PAIRED — verified as "Test-Time Scaling in Diffusion LLMs via Hidden Semi-Autoregressive Experts" (2025-10-06). Do not cite for model collapse. (Correct lineage: 2305.17493 + 2404.01413.) |
+| **2402.04937 as BitNet** | MIS-PAIRED — verified as COVID long-haul study. BitNet b1.58 = 2402.17764 (verified). |
+| **2109.05074 as PICARD** | MIS-PAIRED — verified as FBERT (offensive-content classifier). PICARD = 2109.05093 (verified). |
+| **"Hallucination inheritance" / "distillation hallucination inheritance" as an established, quantified phenomenon** | Bounded zero-hit: exact-title search returned no dedicated measurement paper. Cite only the piecemeal evidence (2408.12326; GKD's distribution mismatch) with that framing — never "hallucination inheritance is X%." |
+| **A direct 27B-IQ2_M vs 7-8B-Q4 per-task-class benchmark** | Bounded zero-hit — no such published head-to-head found at any depth. All verdicts on this question are extrapolations (3-bit/1.58-bit bracketing + size-scaling law), and must be labeled as such. |
+| **Effective bpw of GGUF IQ2_M (~2.5–2.7)** | Ecosystem knowledge, NOT audited this pass (k-quants PR predates IQ quants). Re-audit before citing a specific figure. |
+| **"Extraction least affected by format constraints" as a re-read finding** | Interior claim of 2408.02442 carried from the family file; only title/abstract re-verified this pass. Cite with provenance note until the interior is re-read. |
+| **MobileLLM "mechanical-op class" characterization** | The prompt's gloss ("mechanical-op class") does not appear in the verified abstract; the paper's claim is architecture-optimization + API-calling parity. Cite the verified claims only. |
+| 2608.21366 (model-collapse survey), RETRO 2112.04426, CALM-adjacent successors | Considered, dropped from the ledger (redundant or out of Rune's implementable surface); do not cite this arm for them. |
+
+**Read-depth tally (42 ledger rows incl. 2 documentation + 2 carry-overs; 36 unique external sources):**
+RELEVANT_SECTIONS 3 (2504.04823, 2305.05176, 2301.12726) · DOCUMENTATION_AUDITED 2 (llama.cpp PR #1684, discussion #5263) · ABSTRACT_ONLY 31 · METADATA_VERIFIED 0 (all abstract-level entries went through the export API with abstracts read, so none are metadata-only).
+
+**Verification method note:** all IDs resolved via `export.arxiv.org/api/query` (title + date + authors) per the #403 atlas-wide lesson; 4 mis-pairings caught (all in the prompt's own ID list, 0 in this arm's independent searches — export-API title search used throughout).

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm2_agent_architecture.md

@@ -0,0 +1,504 @@
+# Memory Research Atlas R1 — Domain #404 AC (Offline / Local Intelligence)
+## Arm 2 of 4 — AGENT / COGNITIVE ARCHITECTURE
+
+**Scope owned by this arm:** cognitive architectures (classic → current); planner/executor + hierarchical control; model-independent state; graceful degradation / offline agents; capability discovery / registries; tool-based intelligence; specialist ensembles + modular stacks; bounded test-time compute. **Explicitly out of scope (arm 1 / other arms):** quantization task-sensitivity, distillation, cascade/routing policy at n≈924, speculative decoding, classical ML for bounded tasks, model collapse.
+
+**Rune baseline assumed (not re-derived here):** stateful coding agent, one workstation (RTX 4070 Ti SUPER 16GB, 62GB RAM), Ollama + 11 models, 152 deterministic Python modules, model-independent state (SQLite Memory 944 entries / 118k chunks, task/resume state, skill store). Known gaps: no routing/cascade policy, no capability registry, no degraded-mode communication, silent embedding degradation when Ollama is down.
+
+---
+
+## 0. Method and verification discipline
+
+- Every arXiv ID was resolved through `export.arxiv.org/api/query` (Atom metadata) before being cited. Titles, first authors and abstracts were read from the API response; where marked deeper, the full HTML was read.
+- **Three IDs supplied by the #404 arm-2 prompt were mis-paired and are NOT what the prompt claimed:**
+  - `2409.02409` given as *CoALA* → resolves to *"Microscopic, mesoscopic, and macroscopic descriptions of the Euler alignment system…"* (Shvydkoy & Teolis, math.AP). **Correct CoALA ID: `2309.02427`.**
+  - `2203.07154` given as *self-consistency* → resolves to *"Materials for Future Calorimeters"* (physics). **Correct ID: `2203.11171`.**
+  - `2305.18365` given as *ReWOO* → resolves to *"What can Large Language Models do in chemistry?…"*. **Correct ID: `2305.18323`.**
+  - Two further candidates I proposed myself (`2408.08611` for StateFlow, `2412.10197` for overthinking) also failed verification → corrected to `2403.11322` and `2412.21187`. This arm-2 prompt therefore carried 3 (not 4) mis-paired IDs; all are corrected and registered in §4.
+- **Read-depth vocabulary used:** `FULL_PAPER` (entire paper read), `RELEVANT_SECTIONS` (the load-bearing sections read in full, remainder skimmed), `DOCUMENTATION_AUDITED` (official docs fetched and read), `ABSTRACT_ONLY` (Atom abstract + metadata only; no section-level claim asserted), `METADATA_VERIFIED` (title/authors only).
+- **Claims asserted at section depth in this report are only from** `2309.02427`, `2310.08560`, `2402.01817`, `2210.03629`, `2408.03314`, `2407.21075` (+ the five doc sets). Everything else is abstract-level and labelled as such; unverifiable claims are quarantined in §4.
+- Venue/year tags: year is the arXiv year from metadata; a venue is named only where the paper's own metadata/abstract states it or where it is unambiguous (e.g. "Position:" ICML paper, TMLR-listed CoALA). Otherwise "arXiv".
+
+**Source count:** 34 papers/position papers + 5 documentation sets = **39 numbered sources** (34 papers sits inside the 25–35 target band), plus one unnumbered critique reference (`2506.09250`).
+
+---
+
+## 1. Per-source rows
+
+### Group A — Cognitive architectures (classic → current)
+
+**[S01] `2309.02427` | Cognitive Architectures for Language Agents (CoALA)**
+- Authors / venue: Sumers, Yao, Narasimhan, Griffiths — Princeton; arXiv 2023 (TMLR-listed, v3).
+- Topic: architectural taxonomy for language agents built from cognitive-architecture heritage (production systems, Soar).
+- Key claims: an agent is organized along three dimensions — **memory** (working + long-term episodic/semantic/procedural), **action space** (external *grounding*; internal *retrieval*, *reasoning*, *learning*), **decision-making** (a repeated decision cycle with a planning stage — propose/evaluate via reasoning+retrieval — then an execution stage that emits a grounding or learning action, then loop). Working memory is a *data structure that persists across LLM calls*; the LLM input is synthesized from a subset of it and the output is parsed back into variables. Procedural memory has two forms: *implicit* (LLM weights) and *explicit* (the agent's code), and the code splits into action procedures and **the decision-making procedure itself**. Soar heritage: productions in procedural memory, working-memory matching, proposal/evaluation/selection, and an **impasse → subgoal** mechanism that yields hierarchical task decomposition.
+- Negative results: classical cognitive architectures fell out of favour because they are "limited to domains that can be described by logical predicates and require many pre-specified rules"; writing new *decision-making* procedures is flagged as "significantly riskier… can easily introduce bugs or allow an agent to subvert its designers' intentions", and the authors state **no language agents implement this form of learning**; unlearning (modifying/deleting memory) and adaptive retrieval are named as understudied.
+- Limitations: conceptual framework — organizes existing work, contributes no new empirical measurements; no cost analysis of the memory/action decomposition.
+- Read depth: `RELEVANT_SECTIONS` (§1–§4.6 and §6 read in full; §5 case studies and §7–8 skimmed).
+- Rune relevance: **the closest published blueprint to what Rune already is.** Rune's 152 deterministic modules ≈ explicit procedural memory; SQLite (944 entries / 118k chunks) ≈ semantic + episodic memory; the per-call prompt ≈ working memory assembled from a subset. What Rune is missing per this taxonomy is (a) an explicit, named *decision procedure* module, and (b) a declared internal/external action boundary. The paper's safety caveat is directly load-bearing for Rune: never let Rune rewrite its own decision procedure or module code; learning should write to episodic/semantic memory (SQLite) only.
+
+**[S02] `2310.08560` | MemGPT: Towards LLMs as Operating Systems**
+- Authors / venue: Packer, Wooders, Lin et al. (UC Berkeley) — arXiv 2023.
+- Topic: OS-style virtual context management; memory-as-a-module; the Letta lineage.
+- Key claims: two tiers — **main context** (= prompt tokens: read-only system instructions, read/write **working context** writable only via function calls, and a FIFO queue of messages) and **external context** (recall storage = message DB, archival storage = arbitrary-length text). A **queue manager** enforces the paging policy in the runtime, not in the model: a *memory-pressure warning* system message is injected at ~70% of the context window so the agent can save state; at 100% the queue is flushed (evict ~50%) and a **recursive summary** is generated; evicted messages remain readable via function calls. Control flow: **events** (user messages, system warnings, timed/scheduled events) trigger inference; a `yield` flag decides whether the processor resumes immediately or waits for the next event, i.e. interrupts govern control flow between system and model. Errors from tool calls (e.g. writing past capacity) are fed back to the processor.
+- Negative results: "**MemGPT has significantly degraded performance using GPT-3.5, due to its limited function calling capabilities**" — the memory system's quality is a function of the model's function-calling quality, i.e. memory management delegated to the model is not model-independent; observed failure mode "failing to perform enough lookups"; document QA is bounded by "the limitations of embedding-based similarity search"; nested key-value retrieval degrades (GPT-3.5 → 0% at 1 nesting level; GPT-4 → 0% by 3 nesting levels), while MemGPT+GPT-4 holds.
+- Limitations: evaluations are two domains (multi-session chat, document QA) with modest baselines; the OS analogy is design inspiration, not a formal guarantee; long-context baselines are given lossy summaries, which flatters the comparison.
+- Read depth: `RELEVANT_SECTIONS` (design §2, control flow, results, failure-mode discussion).
+- Rune relevance: **the single most useful counter-example for Rune's design.** MemGPT puts the *paging policy* in code (queue manager, thresholds, eviction, summarization) but puts *what to remember* in the model — and the paper documents that this degrades with a weaker local model. Rune runs 11 local models of varying capability, so Rune should implement the queue/eviction/threshold policy deterministically (which it largely does) and must **not** gate memory correctness on model function-calling quality. The interrupt + timed-event model is also the right shape for Rune's scheduler-driven work.
+
+**[S03] `2402.01817` | Position: LLMs Can't Plan, But Can Help Planning in LLM-Modulo Frameworks**
+- Authors / venue: Kambhampati, Valmeekam, Guan, Verma, Stechly, Bhambri, Saldyt, Murthy (ASU) — ICML 2024 position paper (v3).
+- Topic: what must live outside the model; generate–test–critique with external verifiers.
+- Key claims: autoregressive LLMs "cannot, by themselves, do planning or self-verification (which is after all a form of reasoning)"; they should be treated as **universal approximate knowledge sources** and candidate generators. Evidence: best LLM (GPT-4) produces only ~12% executable/goal-reaching plans in autonomous mode on PlanBench; obfuscating action/object names degrades LLMs while leaving classical planners unaffected (⇒ approximate retrieval of plans, not planning); chain-of-thought and ReAct-style prompting "largely ineffective" for planning; fine-tuning "does not seem to have a major effect". Verification: LLMs are "no better at verifying solutions" (graph coloring); iterative self-critique does not beat the baseline and is *worse* in practice because the system "can't recognize a correct coloring and thus merrily passes over fortuitously correct colorings it has generated". Proposed architecture: **Generate–Test–Critique** loop — LLM proposes candidates; a bank of **hard (sound, model-based) critics** plus **soft (style) critics** evaluate; a **Meta/Backprompt Controller** sits outside the LLM and pools critiques; *soundness of the compound system is inherited from the hard critics only*; completeness depends on the LLM's candidate coverage. Humans are deliberately excluded from the inner loop (iterative prompting has a "Clever Hans" effect) and used only to elicit domain models.
+- Negative results: the whole §2 is a negative-results section (autonomous planning, self-verification, self-improvement via self-generated data, and the "LLM-as-translator-only" over-correction which the authors also reject); ToT is characterized as prompt priming over a problem-specific tree rather than real search.
+- Limitations: position paper, planning-domain focus; assumes someone can build a sound hard critic per domain (cost is acknowledged but not quantified); PlanBench results are 2023–24-era models.
+- Read depth: `RELEVANT_SECTIONS` (§1, §2.1–2.3, §3.1–3.4 in full; §4 case studies and §5 skimmed).
+- Rune relevance: **the architectural verdict for Rune in one paper.** Rune's 152 deterministic modules *are* the hard critics; the LLM must be a candidate generator and a natural-language front end. Two operational rules follow: (1) a proposed plan/edit is never accepted without a deterministic check (tests, type check, schema validation, exit code); (2) the model's own self-critique must never be the acceptance gate, and escalation must be driven by critic output, not model confidence.
+
+**[S04] `2210.03629` | ReAct: Synergizing Reasoning and Acting in Language Models**
+- Authors / venue: Yao, Zhao, Yu, Du, Shafran, Narasimhan, Cao — ICLR 2023.
+- Topic: interleaved thought/action/observation loop — the canonical planner-executor loop.
+- Key claims: interleaving reasoning traces with task-specific actions improves over reasoning-only and acting-only baselines; on HotpotQA/Fever, ReAct reduces hallucination and error propagation relative to chain-of-thought by grounding in a Wikipedia API; human-in-the-loop editing of a single thought can change behaviour drastically; the authors build a **hand-coded hybrid switching rule**: ReAct→CoT-SC when ReAct fails twice, CoT-SC→ReAct when CoT-SC answers are inconsistent (best combined result).
+- Negative results (from the paper's own failure-mode analysis, §3.3): ReAct has a *higher reasoning-error rate* than CoT (47% vs 16% of labelled failure modes) while CoT has a higher hallucinated-trace rate (14% vs 6%); the **ReAct-specific frequent failure is repetitively regenerating previous thoughts and actions and failing to "jump out of the loop"**; acting-only agents fail to decompose goals and lose track of environment state.
+- Limitations: PaLM-540B-era prompting; results benchmark-specific; requires an external API (the grounding tool) to work at all.
+- Read depth: `RELEVANT_SECTIONS` (abstract, §3.3 failure-mode table and analysis, hybrid switching heuristics, appendix failure examples).
+- Rune relevance: two directly actionable facts. (1) **Loop detection must be deterministic code in Rune** — the most common ReAct failure is a repetition loop the model cannot see. (2) The ReAct/CoT-SC switch is a *precedent for an escalation signal that is externally computed* ("failed twice", "samples disagree") rather than introspected.
+
+### Group B — Planner/executor and hierarchical control
+
+**[S05] `2305.04091` | Plan-and-Solve Prompting**
+- Authors / venue: Wang, Xu, Lan et al. — ACL 2023.
+- Topic: plan-then-execute at the prompt level.
+- Key claims: zero-shot "devise a plan, divide the task into subtasks, then carry them out" improves over Zero-shot-CoT; names three CoT pitfalls (calculation errors, missing-step errors, semantic misunderstanding) and targets the missing-step class.
+- Negative results: does not fix calculation errors or semantic misunderstanding (paper's own framing of what it does not address).
+- Limitations: single-pass plan, no execution feedback, no replanning; purely textual verification.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: cheap, model-independent-in-shape (a plan artifact stored in state), but with no execution feedback it is exactly the pattern S03 shows to be unsound on its own. Use as a *planning aid* whose output is then validated by modules.
+
+**[S06] `2305.18323` | ReWOO: Decoupling Reasoning from Observations**
+- Authors / venue: Xu, Peng, Lei et al. — arXiv 2023.
+- Topic: plan-all-tool-calls-up-front vs interleaved reasoning.
+- Key claims: modular planner/worker/solver split; detaching reasoning from observations "significantly reduc[es] token consumption" and redundant prompt/execution overhead vs interleaved ReAct; evaluated across six NLP benchmarks.
+- Negative results: by construction, plans are made *without* observations — blind to intermediate tool results (the paper's own trade-off); no adaptive replanning in the base design.
+- Limitations: efficiency-motivated; a single-workstation Rune does not face the token-cost pressure that motivates it.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the *modular separation* (planner module, executor module, solver module) is worth copying structurally; the "reason without observing" property is a state-safety hazard for Rune (stale assumptions about files/repo state) and should not be adopted as a control-flow default.
+
+**[S07] `2304.11477` | LLM+P**
+- Authors / venue: Liu, Jiang, Zhang, Liu, Zhang, Biswas, Stone — arXiv 2023.
+- Topic: LLM + classical planner hybrid.
+- Key claims: LLM translates a natural-language problem into PDDL, a classical planner returns a correct/optimal plan, the LLM translates back; the paper's premise is that LLMs "cannot reliably solve long-horizon planning problems" whereas classical planners can once the problem is formalized.
+- Negative results: correctness is contingent on the translation being faithful; the LLM remains the weakest link (as a translator).
+- Limitations: requires a PDDL domain per task family; no treatment of translation-error detection.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: for any bounded, well-specified Rune task (scheduling, dependency ordering, resource allocation) the right split is *model translates ↔ deterministic solver decides*. This is a narrower, sounder alternative to "let the LLM plan".
+
+**[S08] `2311.05772` | ADaPT: As-Needed Decomposition and Planning with Language Models**
+- Authors / venue: Prasad, Koller, Hartmann et al. — arXiv 2023 (NAACL 2024).
+- Topic: hierarchical decomposition driven by observed execution failure.
+- Key claims: both iterative executors and plan-and-execute pipelines fail on complex tasks because "the inability to execute any sub-task may lead to task failure"; ADaPT recursively decomposes **only when the LLM is unable to execute a sub-task**, adapting to both task complexity and model capability; substantially outperforms strong baselines.
+- Negative results: the failure mode of the two standard control policies (all-or-nothing sub-task success) is itself the negative finding.
+- Limitations: the decomposition trigger is the LLM's own judgement of its inability; recursion cost is unbounded in the worst case.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: adopt "decompose on observed failure" — but substitute a deterministic trigger (module exit code / test failure / schema error) for the model's self-report, because S03 (and S32's difficulty analysis) show self-assessment is not a reliable trigger.
+
+**[S09] `2403.11322` | StateFlow: State-Driven Workflows for LLM Task-Solving**
+- Authors / venue: Wu, Yue, Zhang et al. — arXiv 2024.
+- Topic: explicit state machine as the control substrate.
+- Key claims: separates "process grounding" (states and transitions, i.e. control) from "sub-task solving" (actions inside a state); a state represents the status of a running process; transitions are controlled by **heuristic rules or LLM decisions**; actions within a state may be LLM calls with different prompts *or external tools*; improves control and interpretability.
+- Negative results: none claimed; the residual risk is that transitions may still be LLM-decided.
+- Limitations: workflow must be hand-authored per domain; no guarantees when the transition policy is model-driven.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: this is the shape Rune's task/resume state should take — an explicit state machine whose **transitions are code** (the 152 modules) and whose LLM calls are confined to within-state sub-task solving. It also cleanly expresses degraded modes as states (`EMBEDDING_UNAVAILABLE`, `MODEL_MISSING`) rather than as behaviour changes.
+
+**[S10] `2303.17580` | HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Face**
+- Authors / venue: Shen, Song, Tan et al. — NeurIPS 2023.
+- Topic: LLM-as-controller over a model catalogue (the canonical "router" architecture).
+- Key claims: four stages — task planning, model selection, task execution, response generation; language as a generic interface between models; the LLM acts as the controller of external models.
+- Negative results: none verified at section depth by this arm (see §4 register — do not cite HuggingGPT failure statistics).
+- Limitations: capability truth lives in the LLM's prompt/catalogue text, not in a runtime registry; model selection errors are silent (wrong capability, plausible output); heavily prompt- and catalogue-dependent.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: arm 1 already rejected routing/cascade for Rune at n≈924; arm 2 adds the architectural reason — a catalogue-router makes *capability* a prompt artifact. Rune should have capability facts in a registry (S21/S22) even while declining to route.
+
+### Group C — Model-independent state
+
+**[S11] `2405.15793` | SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering**
+- Authors / venue: Yang, Jimenez, Wettig et al. — NeurIPS 2024.
+- Topic: the action space / interface as a first-class capability lever.
+- Key claims: LM agents are a new class of end user needing purpose-built interfaces; SWE-agent's custom agent-computer interface (ACI) — commands for creating/editing files, navigating repositories, running tests — materially improves performance; state of the art on SWE-bench and HumanEvalFix at the time.
+- Negative results: implicitly, prior agents' failures were attributable to interface design, not only model quality.
+- Limitations: interface design is manual; SWE-bench-specific tooling.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: Rune's 152 modules and their signatures *are* its ACI. This paper is the evidence that improving the interface (clear commands, guardrails, feedback formatting) raises capability without touching the model — the cheapest lever Rune has.
+
+**[S12] `2406.12045` | τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains**
+- Authors / venue: Yao, Shinn, Razavi, Narasimhan — arXiv 2024 (ICLR 2025).
+- Topic: reliability of deployed tool agents; consistency metric.
+- Key claims: evaluates agents against domain-specific API tools **plus written policy rules** in dynamic user conversations, scored by comparing final database state to an annotated goal state; introduces **pass^k** (reliability across repeated trials); even state-of-the-art function-calling agents (e.g. gpt-4o) succeed on <50% of tasks and are "quite inconsistent".
+- Negative results: mean success rate hides inconsistency; the headline number is itself negative for deployment readiness.
+- Limitations: simulated users; two domains; no cost analysis.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: adopt **pass^k-style repeated-trial consistency** as Rune's acceptance metric for its deterministic modules and for any agentic loop — a task that succeeds 70% of the time is not a capability, it is a risk. Consistency is also a better health signal than average latency for the degraded-mode channel.
+
+**[S13] `2401.13178` | AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents**
+- Authors / venue: Ma, Zhang, Zhu et al. — NeurIPS 2024 D&B.
+- Topic: process-level (not just outcome-level) agent evaluation.
+- Key claims: final success rate "reveal[s] few insights during the process"; provides a unified framework with partial observability, multi-round interaction and progress-rate analytics; identifies agent weaknesses that outcome metrics miss.
+- Negative results: the critique of outcome-only evaluation.
+- Limitations: benchmark domains are game/web-ish, not coding-agent-specific.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: Rune should log **sub-goal progress** per run (which module stage completed) so escalation can be triggered by "stalled progress", which is externally observable, instead of by model-reported confidence.
+
+**[S39] LangGraph persistence — checkpointers and stores (documentation)**
+- Source: docs.langchain.com/oss/python/langgraph/persistence.
+- Topic: durable agent state as a runtime property; the documented failure modes of state persistence.
+- Key claims: two complementary systems — **checkpointers** persist a thread's graph state as snapshots (used for conversation continuity, human-in-the-loop workflows, time travel, fault tolerance) and **stores** persist application-defined key-value data outside the graph state (cross-thread long-term memory: preferences, facts, shared knowledge); most applications use both; "Agent Server handles persistence automatically"; durability is a compile-time configuration of the graph.
+- Negative results (documented troubleshooting, i.e. the paper-equivalent of failure modes): `MemorySaver`/`InMemorySaver` "store checkpoints in RAM. When the process restarts, all checkpoints are lost"; checkpoints "grow unboundedly" over long conversations, increasing latency and storage cost, and require pruning/retention policy; a subgraph updating state "may not [be] see[n] immediately" by the parent because "each subgraph manages its own checkpoint namespace"; `thread_id` must stay under 255 chars for `PostgresSaver`.
+- Limitations: vendor documentation; no measurements; the storage backend is the user's responsibility (SQLite/Postgres).
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: this is the checklist for Rune's task/resume state, which is *already* durable — the value is in the enumerated failure modes: (a) never let a state layer live only in RAM; (b) retention/pruning must be explicit or the state store degrades the agent over time; (c) state must have a single namespace owner, or resumed runs will see stale/partial state; (d) model loss must be a re-load of persisted state, never a re-derivation.
+
+### Group D — Graceful degradation / offline agents
+
+**[S14] `2404.01744` | Octopus v2: On-device language model for super agent**
+- Authors / venue: Chen, Li — arXiv 2024.
+- Topic: on-device function calling; the offline capability floor.
+- Key claims: a 2B on-device model surpasses GPT-4 on function-calling accuracy and latency; **95% context-length reduction** by encoding tools as functional tokens instead of retrieving them (RAG); 35× lower latency than Llama-7B with a RAG-based function-calling mechanism; latency suitable for production edge deployment.
+- Negative results: on-device models without such restructuring face "issues with latency and accuracy" (the stated motivation); RAG-based function calling is the slow/weak baseline.
+- Limitations: narrow task (function/tool selection); requires task-specific training of the tokenizer/representation; no multi-step reasoning evaluation.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: direct evidence that **bounded tool selection is a small-model job** (consistent with arm 1's "classical ML owns bounded structured tasks"), and that the *action representation*, not model size, is what makes it cheap. For Rune: keep the per-call action space small and explicit (152 named modules with schemas) instead of exposing a huge tool list.
+
+**[S15] `2407.21075` | Apple Intelligence Foundation Language Models**
+- Authors / venue: Gunter, Wang, Wang et al. (Apple) — arXiv 2024.
+- Topic: audited, deployed local-first architecture (on-device model + adapters + separate guardrails).
+- Key claims (from the paper's own text): a **~3B parameter on-device model** plus a larger server model for Private Cloud Compute; the on-device model is compressed to **on average under 4 bits per weight**, with some layers pushed to 2-bit, reaching **≈3.5 bits per weight "without significant quality loss"**; compression loss is recovered with **accuracy-recovery adapters** (LoRA-style, ranks {8,16,32}) trained on ~10B tokens ≈0.15% of base pretraining; **guardrail models run as separate pre- and post-processing steps** outside the generative model; safety data is folded into per-use-case adapters.
+- Negative results: quantization "often shows a moderate level of quality loss" and the paper explicitly refuses to ship the raw quantized model to feature teams without recovery training.
+- Limitations: vendor paper (self-reported evaluations); adapter suite and guardrails are not reproducible from the paper; per-feature tiering between on-device and PCC is not fully specified in the model report.
+- Read depth: `RELEVANT_SECTIONS` (quantization/adapter sections and the architecture/eval framing; the full training-data and eval sections were not read in detail).
+- Rune relevance: a documented production example of exactly Rune's situation (small local model + per-task adapters + separate guardrail models) and a cross-check on arm 1's quantization conclusion: **<4-bit is viable only when you pay for recovery** (or, per arm 1, stay at 4-bit weight-only as the safe floor). The "guardrails are separate models outside the generator" pattern is the right template for Rune's degraded-mode and safety checks.
+
+**[S16] `2312.11514` | LLM in a flash: Efficient LLM Inference with Limited Memory**
+- Authors / venue: Alizadeh, Mirzadeh, Belenko et al. (Apple) — arXiv 2023.
+- Topic: running models that exceed available memory (the rung below "model fits").
+- Key claims: build an inference cost model from flash-memory characteristics; keep parameters in flash and bring them into DRAM on demand; two techniques — **windowing** (reuse previously activated neurons to cut data transfer) and **row-column bundling** (larger, more contiguous reads).
+- Negative results: naive on-demand loading is the baseline being beaten; the approach trades latency for capacity, it does not remove the capacity limit.
+- Limitations: latency-bound; no quality/accuracy claim (it is a systems paper).
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: on a 16GB-VRAM workstation this is the documented mechanism for a degradation ladder rung: *model does not fit VRAM → stream from disk with windowing/bundling* rather than *model unavailable*. Note the cost is latency, so Rune's degraded-mode message should say "slow mode", not "capability lost".
+
+**[S17] Apple Private Cloud Compute — deployment architecture (documentation)**
+- Source: Apple Security Research, "Private Cloud Compute: A new frontier for AI privacy in the cloud" (security.apple.com/blog/private-cloud-compute/).
+- Topic: the deployed three-tier degradation ladder and its verification gates.
+- Key claims: Apple Intelligence runs **on-device first**; for "advanced features that need to reason over complex data with larger foundation models" it uses PCC as an explicitly separate tier; the device constructs a request "consisting of the prompt, plus **the desired model and inferencing parameters**"; the device **validates PCC node certificates/attestation and will not send data to any node it cannot validate**; PCC is stateless by design (data deleted after the response, no privileged runtime access, no general-purpose logging, public transparency log of every production build).
+- Negative results: the docs state that traditional cloud AI services cannot verify or enforce their own guarantees (unverifiable logging, opaque stacks, privileged access) — i.e. the naive cloud-fallback design is rejected on safety grounds.
+- Limitations: vendor documentation, no independent measurement; per-feature tiering rules (which requests go to PCC) are not specified.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: the template for Rune's missing degraded-mode layer: (1) tier by *request*; (2) **verify the target's health/identity before dispatch**; (3) **hard-fail rather than silently substitute** (Apple refuses rather than sending to an unvalidated node) — which is precisely the opposite of Rune's current silent embedding degradation; (4) publish what runs where so the operator can see the tier.
+
+**[S18] `2304.03442` | Generative Agents: Interactive Simulacra of Human Behavior**
+- Authors / venue: Park, O'Brien, Cai et al. — UIST 2023.
+- Topic: memory stream + reflection + retrieval scoring (the canonical memory-as-a-module design).
+- Key claims: store a complete record of experience in natural language; synthesize memories over time into higher-level **reflections**; retrieve dynamically to plan behaviour; retrieval combines **recency, importance and relevance** scores.
+- Negative results: the architecture is validated by believability/interview studies, not by task correctness; memory correctness is not measured.
+- Limitations: simulated sandbox; no cost/latency budget; LLM-driven reflection can compound errors.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the scoring recipe (recency × importance × relevance) is directly implementable in Rune's deterministic retrieval module over 118k chunks — deterministic scoring keeps retrieval quality independent of which of the 11 models is loaded.
+
+**[S19] `2305.16291` | Voyager: An Open-Ended Embodied Agent with LLMs**
+- Authors / venue: Wang, Xie, Jiang, Mandlekar, Xiao, Zhu, Fan, Anandkumar — arXiv 2023 (TMLR 2024).
+- Topic: skill library as executable, model-independent procedural memory.
+- Key claims: three components — automatic curriculum, an **ever-growing skill library of executable code**, and iterative prompting using environment feedback, **execution errors**, and self-verification; interacts with GPT-4 by blackbox queries (no fine-tuning); skills are temporally extended, interpretable, compositional, compound the agent's abilities and alleviate catastrophic forgetting.
+- Negative results: skills are acquired by trial and error against a forgiving simulator; the paper does not claim skill correctness guarantees.
+- Limitations: Minecraft-like environment; skill library quality depends on the model that wrote the code.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the strongest published argument that **capability can accumulate outside the weights** — Rune's skill store should hold *executable, testable* artifacts (code), retrieved into context on demand, exactly as Voyager retrieves skills; the model that wrote a skill is then irrelevant to whether the skill still works.
+
+### Group E — Capability discovery / registries / staleness
+
+**[S20] `2307.09009` | How is ChatGPT's behavior changing over time?**
+- Authors / venue: Chen, Zaharia, Zou — arXiv 2023 (Harvard Data Science Review, 2024).
+- Topic: declared capability vs observed behaviour under the same model name.
+- Key claims: "when and how these models are updated over time is opaque"; GPT-4 March-2023 vs June-2023 on prime-vs-composite identification: **84% → 51%**; partly explained by a drop in willingness to follow chain-of-thought prompting; GPT-3.5 *improved* on the same task between the two snapshots; behaviour on sensitive/opinion questions also shifted.
+- Negative results: the negative finding is that a *same-name* model changed capability in both directions across seven task families.
+- Limitations: two snapshots of two proprietary models; per-task effect sizes vary; no mechanism analysis.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the empirical justification for a **capability registry with re-probing on change**. Rune's Ollama models are pinned by tag, but a tag can be re-pulled to different weights — so Rune must store the model **digest** and re-run its capability probes whenever the digest changes. "Declared" (name/tag/params) and "observed" (probe results on Rune's own tasks) must be separate registry fields.
+
+**[S21] Model Context Protocol — Architecture overview (documentation)**
+- Source: modelcontextprotocol.io/docs/learn/architecture (protocol version 2026-07-28).
+- Topic: capability declaration, negotiation, freshness and staleness in a tool ecosystem.
+- Key claims: host/client/server topology; a **data layer** over JSON-RPC 2.0 and a transport layer; **every request is stateless and carries protocol version + capabilities in `_meta`**; a mandatory `server/discover` request returns `supportedVersions`, `capabilities` (e.g. `{"tools": {"listChanged": true}}`) and `serverInfo`; a version mismatch is rejected with an explicit `UnsupportedProtocolVersionError` **listing the versions the server does support**; servers expose **tools/resources/prompts** with `*/list` discovery and per-tool `inputSchema`; tool lists carry a **freshness hint `ttlMs`** and `cacheScope`; **change notifications are opt-in and explicitly best-effort — "clients should also rely on polling to preserve freshness of results"**; MCP "focuses solely on the protocol for context exchange — it does not dictate how AI applications use LLMs".
+- Negative results: the docs' own admission that notifications are best-effort (so a cached capability view can be stale at any moment) is the negative result for registry design.
+- Limitations: protocol specification/docs, no adoption or reliability measurements.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: the exact fields Rune's missing capability registry should have — **declared capabilities per model/module, a TTL on every cached capability fact, explicit version-mismatch errors that list what *is* supported, and a polling fallback** rather than trusting push notifications. Also: MCP's separation of protocol from LLM policy is the same separation Rune needs (registry ≠ routing).
+
+**[S22] OpenRouter Models API (documentation)**
+- Source: openrouter.ai/docs/overview/models.
+- Topic: how a production model marketplace encodes capability facts and staleness.
+- Key claims: `id` is the request identifier while **`canonical_slug` is a "permanent slug for the model that never changes"**, and aliases resolve/redirect (e.g. `anthropic/claude-3-5-sonnet` → `anthropic/claude-3.5-sonnet`) — i.e. names drift, canonical identity must be pinned; `expiration_date` encodes deprecation; `supported_parameters` declares per-model capability (tools, structured_outputs, seed, reasoning, …); `architecture` declares modalities/tokenizer; **provider-level `top_provider.context_length` can differ from the model's own `context_length`**; throughput/latency sorts use p50 heuristics; benchmark data is optional and omitted when absent; pricing carries conditional overrides (long-context thresholds, peak-hour windows).
+- Negative results: optional fields are simply absent when unknown (no placeholders) — a registry must model "unknown", not default it.
+- Limitations: vendor documentation for a commercial catalogue; the underlying provider behaviour is not verifiable from the docs.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: field-level template for the registry Rune lacks — permanent ID (+ digest), declared parameters, declared vs observed context/latency, deprecation date, and **explicit `unknown`**. The `canonical_slug` distinction is the direct analogue of "model tag vs weights digest" from S20.
+
+### Group F — Tool-based intelligence
+
+**[S23] `2302.04761` | Toolformer (brief)**
+- Authors / venue: Schick, Dwivedi-Yu, Dessì et al. (Meta) — NeurIPS 2023.
+- Key claims: an LM can teach itself *which* API to call, *when*, with *what arguments*, and how to incorporate the result, self-supervised with a handful of demonstrations per API (calculator, QA, two search engines, translation, calendar), improving zero-shot performance.
+- Limitations: APIs are simple and stateless; the tool boundary must be expressible in the token stream; no state or failure handling.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: model-side tool *selection* is learnable, but Rune does not need to learn it — the 152 modules already fix the action space. The transferable point is that tool boundaries must be explicit and parseable in the model's output, which is what makes deterministic dispatch possible.
+
+**[S24] `2305.15334` | Gorilla (brief)**
+- Authors / venue: Patil, Zhang, Wang et al. — NeurIPS 2024.
+- Key claims: GPT-4-class models fail at API calls mainly through **hallucinated usage and wrong arguments**; a finetuned LLaMA surpasses GPT-4 at writing API calls; combined with a **document retriever** it adapts to test-time document changes/version changes and substantially mitigates hallucination; evaluated with APIBench (AST sub-tree matching).
+- Negative results: "the potential to effectively use tools via API calls remains unfulfilled" and hallucinated API usage is the dominant failure mode.
+- Limitations: retrieval-based adaptation still requires the docs to be current; single-turn call generation.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: two rules — (1) tool/API correctness is a distinct competence from reasoning competence, so it must be measured separately (Rune's registry should hold per-module observed call-correctness); (2) **capability documentation must be retrieved at runtime** so version changes are picked up, rather than baked into a prompt.
+
+**[S25] `2307.16789` | ToolLLM / ToolBench (brief)**
+- Authors / venue: Qin, Liang, Ye et al. — ICLR 2024.
+- Key claims: open models lag closed models at tool use because instruction tuning ignores the tool domain; ToolBench = 16,464 real REST APIs across 49 categories with ChatGPT-generated instructions; DFSDT (depth-first search decision tree) over API calls; ToolEval for automatic evaluation.
+- Negative results: scale of the problem is the finding — thousands of APIs are needed to train general tool use; open models were "significantly limited" without it.
+- Limitations: auto-generated data quality; benchmark-era models.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: argues *against* exposing a large action space: Rune should present a small, task-scoped subset of its 152 modules per call (a few schemas), which is both an accuracy and a latency win.
+
+**[S26] `2309.15817` | ToolEmu (brief)**
+- Authors / venue: Ruan, Dong, Wang et al. — ICLR 2024.
+- Key claims: an LM can **emulate tool execution** in a sandbox so agent risk cases can be found without manually building environments; identifies high-stakes failures (data leakage, financial loss); provides an adversarial emulator for systematic risk discovery.
+- Negative results: the motivating negative is that identifying risks by hand does not scale to long-tailed, high-stakes failures.
+- Limitations: emulator fidelity; risk identification depends on the emulator's own model.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: gives Rune a safe way to test the 152-module action space (including destructive operations) before it touches the real workstation — an emulated tool layer plus adversarial scenario generation is a cheap pre-deployment gate.
+
+### Group G — Specialist ensembles / modular stacks / memory-as-a-module
+
+**[S27] `2308.00352` | MetaGPT**
+- Authors / venue: Hong, Zhuge, Chen et al. — ICLR 2024.
+- Key claims: encode **Standardized Operating Procedures** into prompt sequences; assign human-like roles in an assembly line; agents verify intermediate results, reducing errors; structured outputs (artifacts) between roles.
+- Negative results: "solutions to more complex tasks… [are] complicated through logic inconsistencies due to **cascading hallucinations caused by naively chaining LLMs**" — the failure mode motivating SOPs.
+- Limitations: SOPs must be authored per domain; role-play token cost; no guarantee that verification agents actually verify (cf. S03).
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: the transferable part is the *SOP*, not the roles. Rune should encode SOPs as deterministic module sequencing (its 152 modules) and use artifacts (files, DB rows) as the interface between stages — which is what makes a single-agent Rune safer than a role-playing ensemble.
+
+**[S28] `2503.13657` | Why Do Multi-Agent LLM Systems Fail? (MAST)**
+- Authors / venue: Cemri, Pan, Yang et al. (UC Berkeley) — arXiv 2025 (ICML 2025).
+- Key claims: 1600+ annotated traces across 7 popular multi-agent frameworks; the first multi-agent failure taxonomy (MAST) built from 150 expert-annotated traces and validated; the motivating observation is that MAS "performance gains on popular benchmarks are often minimal".
+- Negative results: this paper *is* the negative result for agent societies — systematic, reproducible failure patterns rather than anecdotal ones.
+- Limitations: annotation is human-judgement-based; frameworks are 2024-era; no per-failure cost accounting.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: decisive for a single-workstation deployment: multi-agent ensembles add coordination-failure surface (and token cost) without a demonstrated gain. Rune's "specialists" should be its deterministic modules and small task-scoped models, not conversational agents.
+
+**[S29] `2404.13501` | A Survey on the Memory Mechanism of LLM-based Agents**
+- Authors / venue: Zhang, Bo, Ma et al. — arXiv 2024.
+- Key claims: systematizes memory for LLM agents (what/why/how to design and how to evaluate); memory is the component that enables self-evolution and long-term agent-environment interaction; existing designs are scattered with no common patterns.
+- Negative results: the absence of a shared design vocabulary/evaluation standard is itself the reported gap.
+- Limitations: survey; no new measurements.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: gives Rune an audit checklist for its SQLite memory (write path, read/retrieval path, management/forgetting, evaluation) — useful as an internal design review, not as empirical evidence.
+
+**[S30] Letta / stateful agents (documentation)**
+- Source: docs.letta.com (Introduction to Stateful Agents).
+- Topic: the production lineage of MemGPT — state owned by the runtime, not the model.
+- Key claims: **all state (memories, user messages, reasoning, tool calls) is persisted in a database, "so they are never lost, even once evicted from the context window"**; "core" memory blocks are injected into the system prompt and are agent-editable via memory tools; blocks can be shared across agents; **server-side tools contain code executed by the server in a sandbox, whereas MCP/client tools carry only the schema** (execution stays with the runtime); a single invocation is a *run* composed of many *steps*; independent *conversations* allow concurrent threads over one agent; models are swappable providers.
+- Negative results: none claimed; the docs' implicit finding is that context-window-only state is lossy, so eviction must be backed by durable storage.
+- Limitations: vendor docs; no measurements.
+- Read depth: `DOCUMENTATION_AUDITED`.
+- Rune relevance: near-exact mapping to Rune's intended design (SQLite-backed state, model-swappable, tools executed by Rune). The sandbox/server-side vs schema-only tool distinction is the precise boundary Rune needs: **the model emits a call; Rune's code executes it.**
+
+### Group H — Bounded test-time compute / escalation signals
+
+**[S31] `2203.11171` | Self-Consistency Improves Chain of Thought Reasoning**
+- Authors / venue: Wang, Wei, Schuurmans et al. (Google) — ICLR 2023.
+- Key claims: sample diverse reasoning paths and marginalize to the most consistent answer instead of greedy decoding; gains: GSM8K **+17.9%**, SVAMP +11.0%, AQuA +12.2%, StrategyQA +6.4%, ARC-challenge +3.9%.
+- Negative results: requires multiple samples (cost scales linearly); relies on the answer space admitting an agreement notion.
+- Limitations: arithmetic/commonsense benchmarks; no open-ended tasks; no calibration analysis.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: with one local model and no second model to escalate to, **self-consistency is Rune's cheapest quality lever** — and sample disagreement is a *computable* (not introspective) escalation/abstain signal. Note: the paper does not claim the disagreement-signal use; that inference is flagged in §4 as an extrapolation, not a citation.
+
+**[S32] `2408.03314` | Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameters**
+- Authors / venue: Snell, Lee, Xu, Kumar (UC Berkeley / Google DeepMind) — arXiv 2024.
+- Topic: when more inference helps, and when it hurts — the escalation-signal evidence base.
+- Key claims (section-level): two mechanisms — (1) search against a dense **process-based verifier** (PRM), (2) **adaptively updating the proposal distribution** (revision); the effectiveness of each "critically varies depending on the difficulty of the prompt", motivating a **compute-optimal** per-prompt allocation which improves efficiency by **>4× vs best-of-N**; question difficulty is estimated from **model-specific pass@1 bins** (5 quantiles) and these are "more predictive of the efficacy of using test-time compute in contrast to the hand-labeled difficulty bins"; a **model-predicted** difficulty (average verifier score) approximates the oracle; the verifier quality bounds what search can achieve (lookahead search underperforms others because it exploits verifier errors); revision/verification capabilities are **absent even in strong proprietary LLMs and had to be finetuned in**; FLOP-matched comparisons show test-time compute can substitute for a much larger model on easy/medium problems.
+- Negative results (explicit): "current work largely provides negative results for a number of these strategies"; **on the easy bins, beam search over-optimizes the verifier and degrades below best-of-N** as budget grows; on the most difficult bin (level 5) **"no method makes much meaningful progress"**; search improvements diminish at larger budgets.
+- Limitations: MATH + PaLM-2-S* single-family study; difficulty estimation itself costs inference (acknowledged, not accounted for); PRM/revision training is expensive and out of reach for a local workstation.
+- Read depth: `RELEVANT_SECTIONS` (§1–§3, §5.1–5.3, §6 framing; appendices skimmed).
+- Rune relevance: the most directly transferable result in this arm. Escalation must be **conditioned on a model-specific difficulty estimate that Rune computes and stores itself** (per-task-family pass rates in SQLite — Rune already has the outcome history to build these bins), and Rune needs an explicit "hard bin → do not spend more, declare degraded / hand to human" rule. More compute on easy tasks is a measured net negative when the verifier is miscalibrated.
+
+**[S33] `2207.05221` | Language Models (Mostly) Know What They Know**
+- Authors / venue: Kadavath, Conerly, Askell et al. (Anthropic) — arXiv 2022.
+- Key claims: larger models are well-calibrated on multiple-choice/true-false questions **when provided in the right format**; `P(True)` (probability the proposed answer is correct) shows encouraging calibration and scaling; it improves when the model may consider multiple of its own samples; `P(IK)` ("I know the answer") is trainable without reference to a proposed answer.
+- Negative results: calibration is format-sensitive and degrades off-distribution; the paper is explicit that this is a research direction, not a deployment guarantee.
+- Limitations: mostly MC/TF tasks; Anthropic-model-specific; `P(IK)` requires training.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: if Rune uses any model-side signal, it must be a *format-conditioned, elicited* probability, and it must be calibrated against Rune's own observed outcomes before it can drive escalation.
+
+**[S34] `2305.14975` | Just Ask for Calibration**
+- Authors / venue: Tian, Mitchell, Zhou, Sharma, Rafailov, Yao, Finn, Manning (Stanford) — EMNLP 2023.
+- Key claims: RLHF-tuned LMs produce **poorly calibrated conditional probabilities**, contrary to pretrained LMs; **verbalized confidences emitted as output tokens are typically better calibrated than the model's conditional probabilities**; calibration improves with prompting (e.g. 10-shot).
+- Negative results: raw token probabilities from RLHF models are not usable as confidence.
+- Limitations: evaluation on QA-style tasks; no agentic setting; calibration ≠ correctness.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: kills the naive escalation signal. Ollama's logprobs are conditional probabilities; per this evidence they are the *worse* option. If Rune wants a model-side confidence, it must be elicited verbalized confidence under a fixed template — and even then it is only usable after calibration against Rune's own outcomes (S32's difficulty-bin approach).
+
+**[S35] `2412.21187` | Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs**
+- Authors / venue: Chen, Xu, Liang et al. — arXiv 2024.
+- Key claims: o1-like models allocate excessive computation to simple problems with minimal benefit; introduces efficiency metrics from both **outcome** and **process** perspectives; a self-training mitigation shortens reasoning **without compromising accuracy**; outcome-based reward does not penalise inefficient reasoning.
+- Negative results: overthinking is a measured, systematic waste, not an anecdote; outcome-only reward is identified as the cause.
+- Limitations: o1-like long-CoT models; self-training requires compute a local workstation may not have.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: Rune should budget reasoning tokens **per task class** and track "tokens per solved task" as a first-class metric; without a process-side metric, Rune cannot tell overthinking from working.
+
+**[S36] `2503.16419` | Stop Overthinking: A Survey on Efficient Reasoning (brief)**
+- Authors / venue: Sui, Chuang, Wang et al. — arXiv 2025.
+- Key claims: first structured survey of efficient reasoning; taxonomizes levers into model-based (length-controlled/latent), prompt-based, and output-based methods; names the "overthinking phenomenon" (verbose, redundant CoT) as the cost of longer reasoning.
+- Limitations: survey; no unified evaluation.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: a menu of *budget-control* levers that are orthogonal to model routing (which arm 1 rejected): per-task-class length caps, prompt-level brevity instructions, and output filtering.
+
+**[S37] `2506.06941` | The Illusion of Thinking (and its published critique)**
+- Authors / venue: Shojaee, Mirzadeh, Alizadeh et al. (Apple) — arXiv 2025; critique: `2506.09250` "Comment on The Illusion of Thinking…".
+- Key claims: controllable puzzle environments with precisely manipulated complexity; LRMs' accuracy **collapses to near-zero beyond a complexity threshold**; three regimes (low: standard LLMs match; medium: LRMs benefit; high: both collapse); reasoning traces show counterintuitive scaling; contamination-prone benchmark evaluation is inadequate.
+- Negative results: the collapse itself; plus the critique's argument that the observed collapse is explained by **token-budget limits** rather than a fundamental inability (i.e. the "collapse" is partly an artifact of the evaluation budget).
+- Limitations: contested result — the published comment is the reason this row must not be used as a hard escalation threshold.
+- Read depth: `ABSTRACT_ONLY` for both the paper and the comment (comment verified by metadata + title via the arXiv API).
+- Rune relevance: read as a caution, not a rule — any "complexity threshold beyond which the model fails" must be re-measured on Rune's own models **at Rune's own token budget**, because the threshold moves with the budget.
+
+**[S38] `2305.10601` | Tree of Thoughts (brief)**
+- Authors / venue: Yao, Yu, Zhao, Shafran, Griffiths, Cao, Narasimhan — NeurIPS 2023.
+- Key claims: deliberate search over coherent "thoughts" with self-evaluation, lookahead and backtracking; significant gains on game-of-24, creative writing, crosswords.
+- Negative results / contested: S03 re-analyses ToT as problem-specific prompt priming with an externally-implemented verifier for the 24 game (arithmetic), and reports the LLM's own criticisms "often quite off the mark" — i.e. the search guarantee comes from the external verifier, not the model.
+- Read depth: `ABSTRACT_ONLY`.
+- Rune relevance: ToT-style search is only meaningful for Rune where a deterministic verifier exists (tests, solvers, type checkers); otherwise it multiplies cost with no guarantee.
+
+---
+
+## 2. Synthesis — three verdicts
+
+### Verdict A — Model-independent architecture: what must live OUTSIDE the model for Rune to survive model/provider loss
+
+**Verdict: every element that defines *what the agent does next* must be code and data owned by Rune; the model may only contribute *candidate content* and *natural-language translation*. This is not a preference — the evidence shows the model is structurally unable to own those functions, and that delegating them degrades as model quality varies.**
+
+Evidence chain (each link section-verified):
+
+1. **The decision procedure is code, not a prompt.** CoALA's taxonomy places the decision cycle — planning (propose/evaluate) then execution, looping — in *procedural memory*, explicitly split into "procedures that implement actions" and "procedures that implement decision-making itself"; it further notes that procedural memory "must be initialized by the designer with proper code to bootstrap the agent", and that letting an agent write new decision procedures is "significantly riskier… can easily introduce bugs or allow an agent to subvert its designers' intentions", with **no language agents currently implementing it** (S01). For Rune: the 152 modules are procedural memory; the missing artifact is a *named* decision procedure (a state machine per S09) that sequences them.
+2. **The model cannot verify its own output.** LLM-Modulo: best LLMs produce ~12% executable plans autonomously; obfuscated names degrade LLMs but not planners (⇒ retrieval, not planning); self-critique does not improve and is *worse* than baseline because the model cannot recognise a correct solution it generated; soundness of a compound system is inherited **only** from external hard critics (S03). For Rune: acceptance gates are tests/type checks/schema validation/exit codes — never "the model says it's fine".
+3. **Model-side memory management is model-dependent and therefore unsafe for a multi-model workstation.** MemGPT's own evaluation: performance "significantly degraded… due to its limited function calling capabilities" with a weaker model; failure mode "failing to perform enough lookups"; document QA bounded by embedding-similarity limits (S02). Letta's production answer is to keep *all* state in a database so it is "never lost, even once evicted from the context window", and to keep tool **execution** server-side in a sandbox while the model emits only schema-conformant calls (S30). For Rune: SQLite state + code-owned paging policy is correct; *what to remember* may be model-proposed but must be model-validated (dedupe, schema, provenance) before write.
+4. **State must survive process and provider loss, and that is a runtime property.** LangGraph's persistence model separates thread-scoped checkpoints (continuity, human-in-the-loop, time travel, fault tolerance) from cross-thread stores (durable facts/preferences), and its documented failure modes are exactly the ones Rune must avoid: in-memory savers lose everything on restart, checkpoints grow unboundedly without retention, and subgraph state lives in a separate namespace the parent may not see (S39). For Rune: task/resume state, memory, and skill store must be *files/SQLite*, with explicit retention and a single owner per fact — model loss must be a re-load, not a re-derivation.
+5. **Capability truth belongs in a registry, not in a prompt.** OpenRouter pins a `canonical_slug` that "never changes" while names alias and redirect, declares `supported_parameters`, distinguishes provider-level from model-level `context_length`, and carries an explicit `expiration_date` (S22); MCP makes capability declaration a protocol-level, per-request fact with a TTL and an explicit version-mismatch error that *lists what is supported* (S21). HuggingGPT shows the opposite design — capability as catalogue text inside the controller's prompt (S10). For Rune: the registry is needed regardless of arm 1's routing rejection, because "which model is loaded and what can it actually do right now" is required for degradation messaging and for safe module behaviour.
+6. **Capability accrues outside the weights.** Voyager's skill library is executable code, retrieved on demand, with GPT-4 queried black-box — no fine-tuning — and the paper reports compounding ability and reduced catastrophic forgetting (S19). For Rune: the skill store should hold *testable* artifacts, and skill validity must not depend on the model that authored them.
+7. **The interface is the lever.** SWE-agent's central claim is that a purpose-built agent-computer interface materially changes agent performance (S11). For Rune: module signatures, guardrails and error formats are capability, and they are model-independent.
+
+**Concrete list of what must live outside the model (Rune):** task/resume state machine and its transitions; module dispatch and argument validation; memory write policy (dedupe/provenance/schema) and eviction/retention; retrieval scoring (recency/importance/relevance, S18) and embedding provenance; capability registry with digests, declared vs observed facts, TTLs and staleness; health/degraded-mode state and its message format; escalation policy and its triggers; acceptance gates (critics) for every model-produced artifact; loop/repetition detection (S04's dominant ReAct failure is a loop the model cannot see); budget caps per task class (S35/S36); and the audit log of which model produced which artifact.
+
+**Corollary (anti-pattern to avoid):** any behaviour where "the model decides whether to remember/verify/continue/escalate" is a dependency on model quality that Rune's multi-model, sometimes-Ollama-down reality cannot support.
+
+### Verdict B — Graceful degradation: the ladder the evidence supports
+
+**Verdict: the evidence supports a *request-tiered* ladder with health-verified dispatch and explicit hard failure, not capability substitution. Silent degradation (Rune's current behaviour when Ollama is down) is the failure mode every audited production system is engineered to prevent.**
+
+Ladder rungs, each with evidence:
+
+| Rung | Mechanism | Evidence | What Rune gets / loses |
+|---|---|---|---|
+| 0. Full local | On-device/local model at native precision | S15 (on-device ~3B model); S01/S30 (state in DB) | Full capability; this is Rune's normal state |
+| 1. Compressed local | <4-bit weights **with accuracy-recovery adapters**; some layers 2-bit; ≈3.5 bpw without significant loss | S15 (audited, production) | Slight quality loss if recovery training is paid; cross-check with arm 1's 4-bit weight-only floor |
+| 2. Capacity-limited | Model larger than VRAM streamed from flash with windowing/bundling | S16 (audited paper) | Capability kept, **latency** lost → degraded mode must say "slow", not "unavailable" |
+| 3. Bounded-task delegation | Small (2B) model for function/tool selection with a restructured action representation (95% context reduction, 35× latency win) | S14 | Bounded, verifiable work continues (aligns with arm 1: classical ML / small models own bounded structured tasks) |
+| 4. Non-generative continuation | Modules, SQLite state, retrieval scoring, skill store, registry — all work with no model at all | S01, S19, S30, S39 | Task state preserved; retrieval and skill execution continue; only NL generation and reasoning stop |
+| 5. Optional cloud tier | Separate tier for requests needing a larger model, dispatched only after **verifying target attestation**; refuse if unverifiable; stateless processing | S17 (audited docs) | The only rung that leaves the workstation — must be opt-in and health-gated |
+| 6. Explicit refusal | Hard fail with a status message instead of substituting a weaker path | S17 (device will not send to unvalidated nodes) | Prevents silent wrong-answer degradation; requires the status channel Rune lacks |
+
+Supporting design rules from the evidence:
+- **Degradation must be *communicated* as structured status, not generated prose.** MCP's model is the template: capabilities are declared facts, freshness is a TTL, mismatches are explicit errors listing what *is* supported, and push notifications are explicitly best-effort so "clients should also rely on polling to preserve freshness" (S21). A generated status sentence would itself depend on the model that may be down — a self-defeating design.
+- **Health verification before dispatch, not after failure.** S17's device-side certificate/attestation check is the strongest available precedent; S21's `server/discover` is the protocol-level version. For Rune: probe the model/module before use (digest + minimal capability probe), and cache the result with a TTL.
+- **Reliability must be measured as consistency.** τ-bench's `pass^k` shows SOTA tool agents succeeding <50% of the time and being "quite inconsistent" (S12); AgentBoard shows outcome-only metrics hide process failures (S13). For Rune: a module that succeeds 70% of the time is a *degraded* module, and Rune should be able to say so.
+- **Separate guardrail/validation models from the generator.** S15 documents guardrail models as pre/post-processing outside the generative model — which is the same architectural move as S03's external critics, and it keeps the safety path alive when the generator is swapped.
+- **Degradation cost must be attributed.** S16's streaming mode costs latency, not quality; S15's compression costs quality, not availability. Conflating the two (as a single "degraded" flag does) makes the operator unable to choose.
+
+**Verdict consequence for the stated inward gap ("silent embedding degradation when Ollama down"):** the audited systems treat exactly this as unacceptable. The fix is architectural, not a message: (a) embedding calls go through a module that *probes and reports* its own availability; (b) retrieval has a declared fallback rung (e.g. keyword/BM25-style scoring over the same SQLite chunks, or recency-only scoring) with the rung recorded on the retrieved artifact; (c) every memory write records which embedding model+digest produced it, so a later re-embed can be targeted; (d) the run's status carries the rung explicitly.
+
+### Verdict C — Escalation signals: what actually predicts when to escalate
+
+**Verdict: the only signals that predict whether more inference (or a stronger model) will help are (i) an externally computed, model-specific difficulty estimate and (ii) the availability/quality of an external verifier. Model self-reports — token probabilities, verbalized confidence, self-critique, "I can't do this" — are demonstrably unreliable as triggers. On the hardest work, escalation does not help at all and the correct action is to declare a degraded/abstain state rather than spend compute.**
+
+Ranked signal table (strongest first):
+
+1. **Model-specific difficulty bins from observed pass rates (strongest).** S32: difficulty bins derived from a base model's pass@1 are "more predictive of the efficacy of using test-time compute in contrast to the hand-labeled difficulty bins"; a model-*predicted* difficulty (average verifier score) approximates the oracle. Rune already accumulates per-task outcomes in SQLite; binning task families by Rune's own observed pass rate is the single highest-value escalation investment. Note the paper's own caveat: the model-predicted variant still costs inference and was not accounted for.
+2. **External verifier availability/quality (the binding constraint).** S32: verifier quality determines search gains (lookahead search underperforms precisely because it exploits verifier errors); S03: soundness of the compound system is inherited only from hard critics; S38/S03: ToT's "search" is guaranteed by the external arithmetic verifier, not the model. For Rune: escalation is only worth it when the extra samples can be *filtered by a deterministic check* (tests, schema, type check). Without a verifier, best-of-N is unfiltered sampling.
+3. **Deterministic failure of the attempt (retry/failure counters).** S04's hybrid rule switches to the other strategy when ReAct "fails twice"; S08 decomposes when a sub-task cannot be executed. Both are computable from outcomes. For Rune: "attempt N failed the acceptance gate" is a sound trigger; the model's own claim that it failed is not.
+4. **Sample disagreement (self-consistency spread).** S31 gives the quality lever (+17.9% GSM8K) and the spread is trivially computable across N samples with one local model. *Extrapolation, flagged:* S31 does not itself claim disagreement is a calibrated escalation signal; use it as a computed statistic, and calibrate its threshold against Rune's outcomes.
+5. **Progress stall (process metrics).** S13 shows outcome-only evaluation hides process failure; S35 argues process-side efficiency metrics are needed alongside outcome metrics. For Rune: "no sub-goal advanced in K steps" is an observable stall signal.
+6. **Budget/predictable-complexity refusal.** S32: on the hardest difficulty bin "no method makes much meaningful progress" — escalating there is wasted compute; S37 (+its critique `2506.09250`) warns that apparent complexity thresholds move with the token budget, so Rune must measure the threshold on its own models and budget. S35: overthinking means extra tokens on easy tasks produce little benefit, and outcome-only reward never penalises it.
+7. **Format-conditioned elicited self-assessment (weakest, usable only if calibrated).** S33: `P(True)`/`P(IK)` are encouraging and scale, *when the right format is provided*; S34: RLHF models' **conditional probabilities are poorly calibrated** while **verbalized confidences are better**, improving with few-shot prompting. For Rune: never use raw logprobs; if any model-side signal is used, elicit verbalized confidence under a fixed template and calibrate it against Rune's own outcome history before it can trigger anything.
+8. **Explicitly rejected as triggers:** LLM self-critique as a gate (S03: no better than baseline, and worse in iterative mode); confidence≠truth as a proxy for correctness; "the model said it can't do this" (S08's trigger, sound for ADaPT's setting but not transferable without an external check); declared model name/capability as a proxy for actual capability on Rune's tasks (S20: same-name behaviour changed 84%→51% on one task family).
+
+**Rune-specific escalation policy implied by the evidence:** compute a per-task-family difficulty bin from Rune's own history → if the attempt fails a deterministic gate → retry with bounded diversity (self-consistency, N capped by rung) → filter candidates through the same deterministic gate → if still failing and the task family is in the hardest bin, **stop and emit a degraded/needs-human status** rather than escalate further or escalate to a cloud model (which rung 5 of Verdict B governs separately, with health verification).
+
+---
+
+## 3. Rejected approaches (with the evidence that rejects them)
+
+| Rejected for Rune | Why (evidence) |
+|---|---|
+| **LLM as autonomous multi-step planner** over Rune's state (repo/files/tasks) | ~12% executable plans for the best LLM; obfuscated names collapse performance while classical planners are unaffected; CoT and ReAct-style prompting "largely ineffective" for planning (S03). Rune's state changes are exactly the sub-goal-interaction case LLMs are worst at |
+| **LLM self-verification / self-critique as an acceptance gate** | LLMs are no better at verifying than solving; iterative self-critique does not beat baseline and in practice is worse because correct solutions are passed over (S03) |
+| **Letting the model own memory management (what to page, when to summarize)** | MemGPT degrades "significantly" with weaker function calling; lookups under-performed (S02). Rune has 11 models of differing capability |
+| **Multi-agent role societies / agent teams (MetaGPT/AutoGen-style)** | MAST: gains on popular benchmarks "often minimal", with a validated failure taxonomy over 7 frameworks and 1600+ traces (S28); the motivating failure is "cascading hallucinations caused by naively chaining LLMs" (S27). A single workstation cannot absorb coordination cost or failure surface |
+| **LLM-controller routing over a model catalogue (HuggingGPT pattern)** | Capability truth becomes prompt/catalogue text rather than a runtime fact (S10) — and arm 1 already rejected routing/cascade at n≈924. Note: no failure statistic for HuggingGPT is cited (see §4) |
+| **Tree-of-Thoughts-style "search" as an architecture** | Re-analysed as problem-specific prompt priming with an external verifier doing the guaranteeing; LLM critiques "often quite off the mark" (S03). Keep only where a deterministic verifier exists (S38) |
+| **Unconditional test-time compute escalation (best-of-N / beam / lookahead)** | Beam search *over-optimises the verifier and falls below best-of-N on easy bins*; no method helps on the hardest bin; "current work largely provides negative results for a number of these strategies" (S32) |
+| **Blind plan-then-execute with all-or-nothing sub-tasks** | Any sub-task failure fails the task (S08); and blind planning (ReWOO) is unobservant by construction (S06) |
+| **Raw token probabilities / model confidence as an escalation trigger** | RLHF conditional probabilities are poorly calibrated; verbalized confidence is better but still needs calibration (S34); confidence ≠ truth (carried from #400) |
+| **In-memory-only persistence for task/resume state** | Documented: in-memory savers lose all checkpoints on process restart; unbounded checkpoint growth; subgraph namespace splits (S39). Rune's state is already durable — do not regress it |
+| **Growing Rune's exposed action space toward "many tools"** | Tool-use competence requires thousands of APIs to train generally (S25) and hallucinated usage is the dominant failure mode (S24); small restructured action spaces beat RAG-based tool selection on-device (S14). Keep the per-call module surface small |
+| **Generated (prose) degraded-mode messages** | The status path must not depend on the component that may be down; audited systems use declared facts, TTLs and explicit error codes instead (S21, S17) |
+
+---
+
+## 4. Do-not-cite register
+
+**A. Mis-paired IDs from the prompt (verified wrong; do not cite under the claimed title):**
+- `2409.02409` — prompt labelled it "Cognitive Architectures for Language Agents (CoALA)". Actual: *Microscopic, mesoscopic, and macroscopic descriptions of the Euler alignment system with adaptive communication strength* (Shvydkoy & Teolis, math.AP). **Cite CoALA as `2309.02427`.**
+- `2203.07154` — prompt labelled it self-consistency. Actual: *Materials for Future Calorimeters* (physics instrumentation). **Cite as `2203.11171`.**
+- `2305.18365` — prompt labelled it ReWOO. Actual: *What can Large Language Models do in chemistry? A comprehensive benchmark on eight tasks*. **Cite ReWOO as `2305.18323`.**
+- (Self-corrected candidates, recorded for auditability: `2408.08611` → an astronomy paper, not StateFlow; `2412.10197` → a mathematics paper, not the overthinking paper. Correct IDs are `2403.11322` and `2412.21187`.)
+
+**B. Claims that appear in the field but were NOT verified by this arm — do not attribute to the sources listed:**
+- *HuggingGPT / JARVIS-style controller failure statistics* (e.g. "model-selection error rate X%", "dependency-parsing failures"): the HuggingGPT row is `ABSTRACT_ONLY`; no failure statistic was verified. Do not cite such a number.
+- *AutoGen-specific failure rates*: AutoGen appears here only as context inside MAST's 7-framework corpus (S28); no AutoGen-specific measurement was read.
+- *MetaGPT's reported benchmark deltas*: only the architecture claim and the cascading-hallucination motivation were verified at abstract level.
+- *MemGPT's absolute scores* (e.g. specific DMR accuracy numbers): only the comparative/failure statements were verified at section depth; do not quote numeric scores from this arm.
+- *"Self-consistency disagreement is a calibrated abstention signal"*: an extrapolation from S31 by this arm — the paper does not claim it. Present as inference, not citation.
+- *Apple's per-feature on-device-vs-PCC routing rules*: the audited sources state the tiering exists and that the device validates attestation before dispatch; the specific rule for which features escalate is **not** documented in the audited material.
+- *Apple quality/quantization evaluation numbers beyond the quoted bits-per-weight and adapter-training figures*: vendor self-reported; do not present as independent measurement.
+- *LangGraph/Letta/MCP/OpenRouter performance claims*: documentation only; no independent verification. Cite as `DOCUMENTATION_AUDITED` and never as measured evidence.
+- *Model-collapse, quantization task-sensitivity, distillation transmission, speculative decoding, cascade/routing at n≈924, FrugalGPT pricing*: out of scope for this arm (arm 1); do not re-cite here.
+
+**C. Sources that were verified but are too weak to carry a load-bearing claim for Rune:**
+- S29 (memory survey) and S36 (efficient-reasoning survey) — taxonomy only, no measurements; use for vocabulary, not evidence.
+- S05 (Plan-and-Solve), S06 (ReWOO), S07 (LLM+P), S23–S26 (tool papers), S33 (Anthropic calibration) — abstract-level only in this arm; usable for design rationale, not for effect sizes.
+
+---
+
+## 5. Arm-2 summary for the atlas
+
+- **Sources by read depth:** `RELEVANT_SECTIONS` = 6 (S01 CoALA, S02 MemGPT, S03 LLM-Modulo, S04 ReAct, S15 Apple Intelligence, S32 TTC-scaling); `DOCUMENTATION_AUDITED` = 5 (S17 Apple PCC, S21 MCP, S22 OpenRouter, S30 Letta, S39 LangGraph); `ABSTRACT_ONLY` = 28; `FULL_PAPER` = 0. Total **39 numbered sources** (34 papers/position papers + 5 documentation sets), plus one unnumbered reference — `2506.09250`, the published critique of S37, used only to bound S37's claims (`METADATA_VERIFIED`).
+- **Ten key findings:**
+  1. Control belongs in code: the decision procedure is a first-class, designer-initialised artifact; agents that rewrite it are non-existent and explicitly risky (S01).
+  2. LLMs cannot plan or self-verify: ~12% executable plans autonomously, self-critique worse than baseline; soundness comes only from external hard critics (S03).
+  3. Model-owned memory management degrades with model quality (MemGPT + GPT-3.5) — the strongest argument against Rune delegating memory policy to whichever local model is loaded (S02).
+  4. State must be DB/runtime-owned and never context-only; the documented failure modes are in-memory savers, unbounded growth and namespace splits (S30, S39).
+  5. Capability facts need a registry with permanent identity, digests, declared-vs-observed separation, TTLs and explicit mismatch errors — and same-name models do change behaviour in both directions (S20, S21, S22).
+  6. Degradation ladders are request-tiered and health-verified, with **hard refusal instead of silent substitution** (S17), and degraded rungs must distinguish "slow" from "lower quality" (S16 vs S15).
+  7. Bounded tool selection is a small-model job when the action representation is restructured — 2B on-device beating GPT-4 on function calling with 95% less context (S14).
+  8. Escalation should be driven by a model-specific difficulty estimate plus verifier availability; more compute on easy tasks is a measured net negative, and on the hardest bin no method helps (S32).
+  9. Model-side confidence is a weak trigger: RLHF conditional probabilities are poorly calibrated, verbalized confidence is better but needs calibration against local outcomes (S33, S34).
+  10. Reliability must be measured as repeated-trial consistency (pass^k) and process progress, not mean success — SOTA tool agents are <50% and inconsistent (S12, S13).
+- **Three verdicts:** (A) *Model-independent architecture* — model-independent code owns decision procedure, dispatch/validation, memory policy, retrieval scoring, capability registry, degraded-mode state, escalation policy, acceptance gates, loop detection and budgets; the model supplies candidates and NL only. (B) *Graceful degradation* — a six-rung request-tiered ladder (full local → compressed local → capacity-limited streaming → bounded-task small model → non-generative module-only continuation → health-verified optional cloud tier) plus explicit refusal; status must be structured/declared, never generated. (C) *Escalation signals* — strongest predictors are Rune-computed model-specific difficulty bins and external verifier availability, followed by deterministic failure counters, sample disagreement and progress stalls; model self-reports are usable only after calibration; the hardest bin should terminate in a degraded/needs-human state.
+- **Rejected:** LLM-as-planner; LLM self-verification as a gate; model-owned memory management; multi-agent role societies; LLM-controller catalogue routing; ToT-as-search without a verifier; unconditional test-time compute escalation; blind plan-then-execute; raw confidence triggers; in-memory-only persistence; large tool action spaces; generated degraded-mode prose. (Table with evidence in §3.)
+- **Do-not-cite:** three prompt-supplied mis-paired IDs (2409.02409, 2203.07154, 2305.18365) plus two self-corrected candidates; unverified failure statistics for HuggingGPT/AutoGen/MetaGPT; unverified MemGPT absolute scores; the self-consistency-as-abstention extrapolation; Apple's per-feature tiering rules; all documentation-sourced performance claims; and arm-1 topics. (Full register in §4.)

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm3_internalization.md

@@ -0,0 +1,208 @@
+# Memory Research Atlas R1 — Domain AC #404: Offline / Local Intelligence
+## Arm 3: INTELLIGENCE INTERNALIZATION / LEARNING
+
+Date: R1 cycle. Scope: knowledge distillation (task-specific only), policy/behavioural learning, skill libraries + procedural memory, code as learned capability, rule extraction, classifier training from agent experience, continual/local fine-tuning, outcome-grounded learning, multi-teacher correlation, verifier-guided learning. Arms 1–2 territory (quantization, cascade/routing, MemGPT, collapse, escalation signals) deliberately not re-researched.
+
+**Verification discipline note.** Every arXiv ID below was resolved against the arXiv export API (or, under 429, OpenAlex with arXiv-ID extraction). **Six mis-pairings were caught during this arm's own sourcing** — all six were plausible candidate IDs drawn from memory that resolved to unrelated physics/watermarking papers (2403.02719, 2401.08900, 2310.08920, 2307.02958, 2401.01280, 1912.13488) — plus one from the controller's prompt context family (2408.15240 is real but is *Generative Verifiers*, not the generic "PRM era" paper a prompt might imply; 2409.07429 = AWM confirmed correct). All prompt-supplied IDs (2501.12948, 1011.0686, 2303.11366, 2305.16291, 2409.07429, 2408.15240) verified genuine. Corrected lookups: AlphaCodium = **2401.08500** (not 2401.08900), CodeChain = **2310.08992** (not 2310.08920), RippleEdits = **2307.12976**, WebRL = **2411.02337**, "Are More LLM Calls" = **2403.02419**, editing survey = 2305.13172 (dropped from final set).
+
+Deep reads actually performed (full paper or targeted sections fetched and read): Voyager 2305.16291 (skill-promotion mechanism — the arm's #1 priority), DAgger 1011.0686 (imitation-limits anchor), LoRA Learns Less and Forgets Less 2405.09673 (continual-learning/forgetting-magnitude anchor), DeepSeek-R1 2501.12948 (distillation appendix F/F.1), Memp 2508.06433 (update/transfer sections).
+
+---
+
+## 1. Source register
+
+Format: ID | title | authors year venue | topic | key claims | negative results | limitations | read depth | Rune relevance.
+
+Rune context flags: **[ESL]** empty skill library with governed promotion gates; **[7L]** 7 accumulated lessons; **[152M]** 152 deterministic modules; **[OVL-0]** outcome-verification loop designed but never measured; **[GD-0]** growth delta designed never demonstrated.
+
+### (1) Task-specific distillation / distilled reasoning models
+
+**S1.** 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.) 2025, arXiv/Nature | distilled reasoning models — what transfers | R1-Distill-Qwen-32B hits AIME-2024 pass@1 72.6 / MATH 94.3 / GPQA 62.1, surpassing QwQ-32B-Preview; distilled 1.5B/7B models beat GPT-4o on AIME (55.5 for 7B); distillation from R1's 800K verified-reasoning SFT set (2–3 epochs) transmits long-CoT behaviour to unrelated base families (Qwen, Llama). | **F.1 negative/boundary result:** large-scale RL *without* distillation on the same 32B base (10K steps, "Qwen2.5-32B-Zero") reaches only AIME 47.0 — i.e. pure RL cannot recover what distillation gives a small model; conversely R1 itself scores only 49.2% on SWE-Bench Verified vs 79.8 AIME — benchmark reasoning does not equal agentic coding competence. | Distillation evaluated on competition-style verifiable tasks only; no long-horizon agent tasks for distillates; teacher quality ceiling. | FULL_PAPER (abstract + §F, §F.1, Tables 15–16 read) | Distillate strength on *narrow verifiable tasks* is real but anchored to teacher-generated trajectories; supports "distill bounded task families from Rune's own verified traces" while predicting distillates will NOT match on agentic rollouts. [GD-0]
+
+**S2.** 2305.02301 | Distilling Step-by-Step! Outperforming Larger LMs with Less Training Data and Smaller Model Sizes | Hsieh et al. 2023, ACL Findings | small task-specific models matching/beating prompted LLMs | 770M T5 trained with LLM-rationale multi-task supervision outperforms few-shot prompted 540B PaLM on several NLP benchmarks, using a fraction of the training data of standard distillation. | Gains are per-task; the "beats the LLM" claim is against *few-shot prompted* LLMs, not LLMs with equivalent task-specific training. | 4 NLP benchmarks, classification/NLG only; no agent tasks. | ABSTRACT_ONLY | The canonical "a small trained model beats a prompted big model on a bounded task" anchor for Rune's classifier tier.
+
+**S3.** 1805.04770 | Born Again Neural Networks | Furlanello et al. 2018, ICML | self-distillation / interpretability of what KD transfers | Students with identical architecture to teacher outperform the teacher (CIFAR-10 3.5% err); gains persist with CWTM/DKPP variants showing non-argmax "dark" outputs matter. | Improvements are small and task-restricted; effect fades with weak teachers. | Vision + LM perplexity; theory of *why* still contested. | ABSTRACT_ONLY | Shows distillation transmits ordering/margin information beyond labels — relevant to whether Rune's distillates inherit teacher failure modes (arm-1's finding, independently supported here).
+
+**S4.** 2306.02707 | Orca: Progressive Learning from Complex Explanation Traces of GPT-4 | Mukherjee et al. 2023 | explanation-trace distillation | (Noted for completeness; arm 1 owns core distillation.) Explanation traces beat naive output-only SFT at matched data. | — | — | METADATA_VERIFIED (abstract only, ID verified) | Peripheral: supports "why not just outputs" — traces carry process signal.
+
+### (2) Policy / behavioural learning: imitation, traces, verbal learning, self-correction
+
+**S5.** 1011.0686 | A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning (DAgger) | Ross, Gordon, Bagnell 2011, AISTATS | distribution shift in behavioural cloning | BC's expected cost provably grows **quadratically in horizon T** (J(π̂_sup) = (1−εT)J(π*) + T²ε; tight via Kääriäinen 2006), because a single learner mistake induces states absent from expert data → compounding errors. DAgger trains on expert relabelings of *states the learner induces*, reducing guarantee to ~linear (O(εT²/T·N) with N iterations); empirically supervised baseline stagnates as more expert data is added (extra demos do not fix the learner's own error states; Super Mario agent "stuck at some location"), while DAgger keeps improving. | The paper is explicit that fixing BC needs **expert queries on the learner's own distribution** — pure log data cannot do it. | Requires an expert (or oracle) available at training states; iterations scale with effective horizon. | FULL_PAPER (ar5iv full-text deep read — imitation-limits anchor) | Direct warning for Rune: retraining on Rune's *own successful trajectories only* trains on the wrong state distribution; the paper's fix (label the states the agent actually reaches) maps to relabeling agent-attempted (including failed) trajectories, not just successes. [7L] [OVL-0]
+
+**S6.** 2310.12823 | AgentTuning: Enabling Generalized Agent Abilities for LLMs | Zeng et al. 2023 | fine-tuning on agent trajectories | Instruction-tuning Llama-2 on ~1.8K high-quality interaction trajectories mixed with general SFT data (AgentLM) substantially closes the agent gap vs GPT-4 on held-out agent tasks without degrading general ability. | Fine-tuning on agent data *alone* degrades general capabilities — the hybrid mix is load-bearing. | Trajectories harvested from 6 benchmark environments; small dataset. | ABSTRACT_ONLY | Trajectory-finetuning is viable at ~10³ scale but must be mixed with general data; an argument against Rune fully specializing its base weights on its own traces. [GD-0]
+
+**S7.** 2310.05915 | FireAct: Toward Language Agent Fine-tuning | Chen et al. 2023 | trajectory fine-tuning | 500 GPT-4-generated trajectories fine-tuned into Llama2-7B yields +77% HotpotQA; diversity of trajectory sources further helps. | Gains concentrated on tasks similar to training; prompting and fine-tuning show different failure modes (not interchangeable). | QA-with-search only; 7B scale. | ABSTRACT_ONLY | Very small trajectory counts move agent ability a lot — suggests Rune's trace corpus is valuable, but also that 500 traces can imprint narrow habits (drift risk).
+
+**S8.** 2303.11366 | Reflexion: Language Agents with Verbal Reinforcement Learning | Shinn et al. 2023, NeurIPS | verbal (non-weight) learning from outcomes | Agents store self-generated *linguistic* reflections in episodic memory after failure signals; 91% pass@1 HumanEval (vs GPT-4 80%), large gains on AlfWorld/HotpotQA; works with scalar, external, or internally simulated feedback. | Effectiveness depends on having *specific* failure signals; internally-simulated feedback degrades on tasks where the model can't evaluate itself; each retry costs full-context tokens. | 2–4 trials typical; memory buffer is per-task (not lifelong); no promotion/verification of lesson quality. | ABSTRACT_ONLY | Direct ancestor of Rune's lesson mechanism: verbal learning works, but the paper's buffers are task-local and ephemeral — Rune's [7L] persistent cross-task lessons go *beyond* Reflexion's evidence, which is per-task-trial evidence only. [7L] [OVL-0]
+
+**S9.** 2310.01798 | Large Language Models Cannot Self-Correct Reasoning Yet | Huang et al. 2024, ICLR | intrinsic self-correction without external feedback | With **no external feedback**, self-correction prompts frequently make reasoning answers *worse*; improvements reported elsewhere come from ensembling-ish variance, better prompts, or leaked external signal. | Explicit negative: intrinsic self-correction of reasoning is not supported; only *verifiable/external-feedback* correction (tool results, unit tests) reliably helps. | Reasoning tasks (GSM8K etc.); excludes code-with-tests where correction is verifier-anchored. | ABSTRACT_ONLY | Core mixed-evidence finding: Rune lessons derived from *its own* unaided reflection are suspect; lessons tied to external verification (tests, execution) are the supported class. [OVL-0]
+
+**S10.** 2211.00053 | Generating Sequences by Learning to Self-Correct | Le, Kayser?, actually: (Bengio group) 2022 | trained corrector decoupled from generator | A separate corrector model (possibly smaller than base) trained on scalar/NL feedback iteratively fixes constraint violations where prompting alone fails. | Requires training data of imperfect generations + feedback — not zero-shot. | Constraint-style tasks (program synthesis, lexical constraints, toxicity); not general reasoning. | ABSTRACT_ONLY | Supports "self-correction works when a dedicated corrector is *trained* on correction data" — consistent with S9's negative on prompt-only correction.
+
+**S11.** 2308.10144 | ExpeL: LLM Agents Are Experiential Learners | Zhao et al. 2023, AAAI | insight extraction from experience without weight updates | Agent accumulates trajectories, uses LLM to extract natural-language insights (success vs failure comparison), retrieves insights+similar trajectories at inference; consistent gains across ALFWorld/WebShop/HotpotQA; insights transfer across tasks. | Insights are LLM-summarized and never verified against subsequent outcomes in closed loop; quality varies; relies on a strong extractor model. | Cross-task transfer shown but on same-family benchmarks. | ABSTRACT_ONLY | Closest published analogue to Rune's lesson pipeline (trace → insight → reuse); note it does NOT close the loop by measuring whether each insight improved anything — same gap as Rune's [OVL-0].
+
+**S12.** 2411.02337 | WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum RL | Qi et al. 2024, ICLR 2025 | outcome-grounded RL from verified web-task success | Self-evolving curriculum (new tasks generated from failures) + outcome-supervised reward model lifts Llama-3.1-8B from 4.8% → 42.4% and GLM-4-9B 6.1% → 43% on WebArena-Lite, beating GPT-4-Turbo (17.6%). | Policy distribution drift in online learning is named as a first-class failure mode requiring adaptive KL/strategies; reward model is a learned proxy (overoptimization risk, cf. S24). | WebArena tasks only; verifier = scripted task checkers. | ABSTRACT_ONLY | Strongest positive evidence that *verified outcome → weight update* works at agent scale when the outcome signal is a hard environment check. Rune's outcome loop needs exactly this class of check, and this paper names Rune's drift risk. [OVL-0]
+
+### (3) Skill libraries + procedural memory
+
+**S13.** 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | Wang, Xie, Jiang, Mandlekar, Xiao, Zhu 2023, TMLR/ICLR'24 | skill library — promotion mechanism | Promotion mechanism (deep-read result): a candidate skill (executable code) is committed to the library **iff** an environment execution loop terminates with a *separate GPT-4 self-verification agent* confirming task completion from environment state; skill indexed by GPT-3.5-generated description embedding; retrieval = top-5 similar skills; skills compose (complex skills call simpler ones) and this composition is credited with avoiding catastrophic forgetting; transfer to a new Minecraft world works from the library alone (3.3× more unique items, 2.3× distance, up to 15.3× faster tech-tree than SOTA). | Documented failure modes (paper's own §4): (i) self-verification can *fail to recognize success* (missed spider-kill signal) — i.e. the promotion gate itself is model-judged and noisy; (ii) agent gets stuck, fails to generate correct skill; (iii) curriculum hallucinates impossible tasks; (iv) GPT-4-quality code generation is load-bearing — GPT-3.5/open models "cannot provide" it (their Fig. 9). No regression testing of skills against *new* contexts; no deprecation mechanism. | Minecraft-specific; verification is a second GPT-4 call, not ground truth. | FULL_PAPER (ar5iv full-text deep read — arm priority #1) | This is the strongest published promotion gate: **verified-once + indexed + composable**. For Rune [ESL]: a procedure becomes a skill only after execution-verified success; but Voyager's one-shot verification is exactly what Rune's governed gates should exceed (re-verification on reuse, regression on environment change). Voyager never re-validates stored skills — known staleness blind spot. [152M] [ESL]
+
+**S14.** 2409.07429 | Agent Workflow Memory (AWM) | Wang, Mao, Fried, Neubig 2024 | induced reusable workflows | Induces workflows (subroutines of abstracted actions) from trajectories; +24.6% relative success on Mind2Web, +51.1% on WebArena; online (test-time) induction generalizes across tasks/sites/domains (+8.9–14.0 absolute as train-test gap widens); reduces steps. | Workflows induced by LLM from successful examples only; no formal validity checking; top-k workflow selection can inject irrelevant procedures (paper studies k). | Two web benchmarks; workflows in natural-language/action pseudocode, not executable code. | ABSTRACT_ONLY (abstract numbers verified) | Confirms routine/procedure reuse pays on *web* agents with distribution shift; Rune's equivalent is its [152M] deterministic modules + [ESL] procedures — AWM is the evidence that a workflow library beats trajectory memory.
+
+**S15.** 2508.06433 | Memp: Exploring Agent Procedural Memory | Fang et al. 2025 | build/retrieve/update of procedural memory | Distills trajectories into fine-grained step instructions + script-level abstractions; on TravelPlanner/ALFWorld refined memory → steadily higher success and fewer steps; **procedural memory built by a strong model transfers to a weak model** (GPT-4o-built memory + Qwen2.5-14B: +5% completion, −1.6 steps on TravelPlanner); includes explicit update/correct/**deprecate** regimens. | Ablations show wrong update strategy can *hurt* (memory pollution); retrieval-key design materially affects gains; benchmarks are simulated. | Two benchmarks; gains incremental (single-digit %). | RELEVANT_SECTIONS (abstract + analysis/update sections read) | Memp is the first cited work with a *deprecation* mechanism — the direct evidence for Rune's stale-skill invalidation concern; also shows procedural memory is model-portable (write once, weaker models benefit). [ESL]
+
+**S16.** 2504.07079 | SkillWeaver: Web Agents can Self-Improve by Discovering and Honing Skills | 2025 | skills as synthesized APIs + practice | Agent discovers skills on new sites, practices them, distills practice into robust APIs; +31.8% relative success WebArena, +39.8% real-world; strong agent's APIs transfer to weaker agents. | "Honing" = iterative practice on the same environment; no adversarial environment-change testing. | Web domains. | ABSTRACT_ONLY | Adds "practice iterations harden a skill" as a promotion criterion beyond single verification. [ESL]
+
+### (4) Code as learned capability
+
+**S17.** 2207.10397 | CodeT: Code Generation with Generated Tests | Chen et al. 2022, ICLR'23 | test-filtered sampling | Generate N programs + N test suites from the same LLM; rank programs by dual execution agreement; large consistent gains over raw sampling and other rankers across HumanEval/MBPP/APPS/CodeContests and 5 models. | Test quality is unverified — generated tests can be wrong; gains shrink when tests are poor. | Selects among samples; does not create new capability. | ABSTRACT_ONLY | Anchor for "execution-filtered sampling beats direct generation" — Rune's test-verified code paths are this, and it is *selection*, not learning: the filter's value is bounded by test quality. [152M]
+
+**S18.** 2401.08500 | Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering | Ridnik, Kredo, Friedman 2024 | multi-stage test-based iterative flow | GPT-4 CodeContests pass@5: 19% → 44% via staged flow (spec reasoning, public-test reasoning, generate, run, self-repair against tests, AI-test hardening). | Heavy inference compute (many iterations); competitive-programming-shaped tasks; flow engineering is hand-designed. | Single model (GPT-4) headline. | ABSTRACT_ONLY | Positive: iterative test-anchored refinement nearly doubles pass rates; the *flow* is designer code — consistent with arm-2's CoALA conclusion that learning/verification loops belong in code. [OVL-0]
+
+**S19.** 2304.05128 | Teaching LLMs to Self-Debug | Chen, Lin, Schärli, Zhou 2023 | execution-feedback loop | Self-debugging with execution feedback + code explanation improves Spider by 2–3% (and hardest level +9%), TransCoder/MBPP up to 12%; feedback reuse cuts iterations. | On benchmarks *without* unit tests, gains are small (2–3%) — self-debugging without ground-truth signal is weak. | Few-shot, frontier-scale models. | ABSTRACT_ONLY | Quantifies the gap between verifier-anchored correction (up to 12%) and unanchored correction (2–3%) — the same ~4–5× asymmetry as S9. [OVL-0]
+
+**S20.** 2310.08992 | CodeChain: Modular Code Generation Through Chain of Self-revisions with Representative Sub-modules | 2023 | emergent reusable modules | Clusters generated sub-modules across samples, feeds cluster representatives back as reusable building blocks; large gains on competitive coding vs monolithic generation. | Module "representativeness" is cluster-voting, not verified correctness of the module per se. | Competitive programming only. | ABSTRACT_ONLY | Evidence that *reusable sub-procedures* emerge from population-level filtering — a weak form of skill genesis; supports Rune's module-mining from its own [152M] corpus but says vote-popularity ≠ correctness.
+
+**S21.** (synthesis note, not a source) CodeT/Self-Debug/AlphaCodium/CodeChain collectively answer the Rune question "does generated+tested code constitute learned intelligence or just an artifact?": the code is an **artifact** until two additional properties exist — (a) it passed a verification gate anchored outside the generator (S9/S19 asymmetry), and (b) it is *retrieved and reused successfully later* (S13/S14/S15/S16). Without (b) it is merely output; without (a) it is a hypothesis. This is developed in Verdict (c).
+
+### (5) Rule extraction / symbolic compilation
+
+**S22.** Craven & Shavlik, "Using Sampling and Queries to Extract Rules from Trained Neural Networks" / TREPAN, ICML 1997 / Machine Learning 29 (pre-arXiv; DOI 10.1023/A:1007321402323) | decision-tree extraction from networks | Rules/trees extracted with query-based sampling can match or exceed the network's own accuracy on some domains while being interpretable; fidelity typically < 100%. | Edge-case loss: extracted trees agree with the network on most but not all inputs; disagreements concentrate in low-density regions — exactly where novel agent inputs live. | 1990s-scale nets; no LLM evidence. | METADATA_VERIFIED via secondary literature (classic citation; not on arXiv — flagged honestly) | Historical anchor for rule extraction's core trade: fidelity vs coverage; low-density disagreement is the predictable failure mode if Rune ever compiles [152M] module behaviour into rules.
+
+**S23.** 1805.04770 (see S3) doubles here: born-again distillation is the modern "faithful-ish compilation" path — the student reproduces the teacher's *behaviour distribution* more faithfully than symbolic rules, at the cost of remaining opaque. Rule extraction and distillation sit at opposite ends of a fidelity/opacity trade.
+
+*(Neuro-symbolic compilation limits and confidence transfer are covered by S22+synthesis; no strong modern arXiv anchor with verified ID was found for LLM-scale symbolic compilation in this arm's searches — recorded as a gap, not filled with unverified IDs.)*
+
+### (6) Classifier training from agent experience
+
+**S24.** 2103.08493 | How Many Data Points is a Prompt Worth? | Logan IV et al. 2021, EMNLP Findings | data-equivalence of prompts | Fair-comparison log-linear analysis across classification tasks: prompting is "worth" hundreds of labelled data points on average (median ~a few hundred; high variance). | Benefit vanishes with enough data; prompt engineering quality dominates at tiny scales. | Classification only; per-task variance huge. | ABSTRACT_ONLY | Calibrates Rune's crossover: below a few hundred labelled examples a prompted big model wins; above, a trained small model wins — the same crossover S2 exploits.
+
+**S25.** 1605.07723 | Data Programming (Snorkel) | Ratner et al. 2016, NeurIPS | weak supervision / labelling functions | Modelling noisy labelling functions as a generative process and denoising lets weak labels train competitive discriminators (would-have-won TAC-KBP 2014). | Labelling functions themselves encode expert errors; conflicts and correlations among LFs require modelling. | Pre-LLM; small models. | ABSTRACT_ONLY | Template for Rune building routing/classifiers from *code-defined labelling functions* over its own logged experience — cheapest path to the first few thousand labels. [7L]
+
+**S26.** 1911.04252 | Self-training with Noisy Student improves ImageNet classification | Xie et al. 2020, CVPR | self-training (positive pole) | Iterative teacher→pseudo-label→larger-noised-student reaches 88.4% ImageNet; big robustness gains. | Requires equal-or-larger student, heavy noise injection, and 300M unlabelled images; without these, self-training degrades. | Vision only. | ABSTRACT_ONLY | Positive-pole anchor; the conditions (noise, scale, equal-size student) are exactly what Rune's local self-training loop cannot cheaply provide.
+
+**S27.** 2307.02075 | Combating Confirmation Bias: A Unified Pseudo-Labeling Framework for Entity Alignment | Mao et al. 2023 | self-training pitfall | Confident pseudo-labels compound their own errors across self-training rounds; one-to-one constraint + parallel ensembling reduces confirmation bias. | The negative is the point: naive confidence-thresholded pseudo-labelling drifts. | KG entity alignment domain. | ABSTRACT_ONLY | Names the failure mode for any Rune loop that trains on its own high-confidence outputs (self-labelling drift); arm-2's accumulate-not-replace finding applies at classifier level too.
+
+### (7) Continual / local fine-tuning
+
+**S28.** 2106.09685 | LoRA | Hu et al. 2021, ICLR'22 | adapter mechanics | Rank-decomposition adapters: 10,000× fewer trainable params, 3× less memory, no inference latency, ≈ full-FT quality on the evaluated tasks; adaptation is empirically low-rank. | Quality parity claims are for 2021-era tasks/eras — later work (S29) revises them. | — | ABSTRACT_ONLY | Baseline mechanics for Rune's local adaptation option.
+
+**S29.** 2305.14314 | QLoRA | Dettmers et al. 2023, NeurIPS | finetuning quantized models | 4-bit NF4 frozen base + LoRA ≈ 16-bit FT task performance (Guanaco 99.3% of ChatGPT on Vicuna bench); 1,000+ models finetuned; paged optimizers. | Vicuna-bench-era evaluation criticized as weak; performance claims are chat-eval, not agent-eval; 4-bit base + NF4 interacts with quantization task-sensitivity (arm 1's domain — Rune's 27B IQ2_M is *below* the 4-bit safe floor, so QLoRA-style FT on IQ2_M is unmeasured and risky). | Chat benchmarks. | ABSTRACT_ONLY | For Rune: fine-tuning a 2-bit model is outside the demonstrated envelope; the 4-bit evidence does not transfer down.
+
+**S30.** 2405.09673 | LoRA Learns Less and Forgets Less | Biderman et al. 2024, ICML'25 | forgetting magnitudes — anchor | Deep-read results: in CPT (20B tokens code/math), LoRA **substantially underperforms** full FT and the gap is not closed even at high rank; in IFT (~100K pairs) high ranks close most of the gap; LoRA **forgets less** of the source domain (HellaSwag/WinoGrande/ARC) and beats weight decay/dropout at forgetting mitigation and generation diversity; full FT learns perturbations of rank 10–100× higher than typical LoRA configs; LoRA is *very* sensitive to LR/target-module/rank hyperparameters — mis-tuning silently underperforms. | The honest asymmetry: less forgetting is partly *less learning*. No replay-based comparison at matched compute. | Llama-2-7B; two domains. | RELEVANT_SECTIONS (arXiv HTML deep read — forgetting anchor) | For Rune: LoRA is the *safe* local-finetune choice precisely because it changes less — the trade is explicit: (learn more ⇔ forget more). Rollback is trivial (adapter is a separate artifact). Supports adapters over in-place edits for any local specialization. [GD-0]
+
+**S31.** 2410.21228 | LoRA vs Full Fine-tuning: An Illusion of Equivalence | Ryu et al. 2024/25 | spectral mechanism of forgetting | LoRA-trained matrices develop "intruder dimensions" (new high singular vectors absent in full FT); forgetting after LoRA is *causally localized* to these dimensions — scaling them down post-hoc restores pre-training-distribution fidelity with minimal task loss. | Confirms LoRA solutions are genuinely non-equivalent to full FT, not just smaller. | Text-to-image (FLUX/SDXL) + LLM discussion. | ABSTRACT_ONLY | Mechanistic explanation behind S30's forgetting asymmetry; also a post-hoc rollback knob (rescale intruders) for deployed adapters.
+
+**S32.** 1706.08840 | Gradient Episodic Memory (GEM) | Lopez-Paz & Ranzato 2017, NeurIPS | replay requirements | Continual learning with a small episodic memory of past examples constrains gradients so loss on old tasks never increases; quantifies forgetting vs backward/forward transfer. | Needs stored raw examples (privacy/size); per-task constraint checks. | Small-image benchmarks. | ABSTRACT_ONLY | Canonical replay evidence: without *some* replay or subspace protection, forgetting is the default. Rune has no data lake → replay-based FT is not currently available; subspace methods (S33) are the replay-free alternative.
+
+**S33.** 2310.14152 | O-LoRA: Orthogonal Subspace Learning for LM Continual Learning | Wang et al. 2023, EMNLP Findings | adapter accumulation without replay | Successive tasks learned in mutually orthogonal low-rank subspaces; mitigates catastrophic forgetting, no user-data replay needed, preserves general ability. | Task-order effects remain; assumes task boundaries; ranks accumulate over time. | Standard CL benchmarks + LLaMA-7B. | ABSTRACT_ONLY | Directly applicable pattern for Rune: accumulate adapters in orthogonal subspaces = accumulate-not-replace (arm-2's collapse principle) instantiated for weights.
+
+**S34.** 2202.05262 | ROME: Locating and Editing Factual Associations in GPT | Meng et al. 2022, NeurIPS | model editing | Causal tracing localizes factual recall to mid-layer FFNs; rank-one edits update facts with decent specificity+generalization where baselines sacrifice one. | Evaluated on single/few facts; success metrics are narrow. | GPT-2/GPT-J scale. | ABSTRACT_ONLY | —(see S35/S36 for the reliability verdict)
+
+**S35.** 2210.07229 | MEMIT: Mass-Editing Memory in a Transformer | Meng et al. 2023, ICLR'23 | batch model editing | Scales editing to thousands of associations on GPT-J/GPT-NeoX (orders of magnitude beyond prior). | Editing distributed across layers degrades as N grows; downstream effects under-measured. | — | ABSTRACT_ONLY | —|
+
+**S36.** 2307.12976 | Evaluating the Ripple Effects of Knowledge Editing in Language Models (RippleEdits) | Cohen-Wang et al. 2024, ICLR'25 | editing reliability — the negative | Editing one fact creates required updates to logically entailed facts ("ripple effects"); RippleEdits (5K edits) shows **current editing methods largely fail** to propagate consistent changes; paraphrase+symmetry consistency is poor; a simple prompt-based "model editing" baseline often beats weight edits. | Direct negative result on weight-editing reliability. | Factual triples, not procedures. | ABSTRACT_ONLY | Verdict input: weight-level "learning" (ROME/MEMIT-style) is unreliable for anything with logical entanglement — Rune facts live in entangled context, so weight editing is the wrong tool; store-and-retrieve or adapter-based are supported instead.
+
+### (8) Outcome-grounded learning
+
+**S37.** 2210.10760 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman, Hilton 2022, ICML'23 | verifier gaming | Optimizing against a proxy reward first raises, then *decreases*, gold-standard reward; d(optimization) law-like for both RL and best-of-n; KL penalty linearly trades; dataset size shifts the curve. | The whole paper is the failure mode: any learned/derived outcome signal gets gamed as optimization pressure grows. | Synthetic gold-proxy setup (careful but synthetic). | ABSTRACT_ONLY | Predicts the failure of Rune's outcome loop once outcomes become an optimization target (e.g. lesson selection rewarded by proxy metrics): measure on real outcomes, never optimize against a learned proxy of them.
+
+**S38.** 2312.08935 | Math-Shepherd: Verify and Reinforce LLMs Step-by-step without Human Annotations | Wang et al. 2023/24, ACL'24 | process rewards from outcomes | Automatic process supervision: label each solution step by MC rollouts of whether it leads to a verified-correct final answer; PRM improves reranking (Mistral-7B GSM8K 77.9→89.1% w/ verification) and step-level PPO (84.1% GSM8K). | Hard-label MC estimation is noisy for early steps; final-answer verification can reinforce lucky-guess paths (spurious credit). | Math only. | ABSTRACT_ONLY | Best-practice template for outcome→step attribution: estimate per-step credit by *repeated rollout from that step to a verified end*, not by asserting it from the trace. Directly answers Rune's attribution problem design question. [OVL-0]
+
+**S39.** 2408.15240 | Generative Verifiers: Reward Modeling as Next-Token Prediction | Zhang et al. 2024/25 | verifier quality | GenRM (verification as CoT generation + majority vote) beats discriminative verifiers and LLM-as-judge: GSM8K BoN 73→93.4%, algorithmic tasks 5→45.3%; strong easy-to-hard generalization. | Verification via generation costs inference compute; still a proxy (overoptimization applies). | — | ABSTRACT_ONLY | When Rune needs a learned verifier for non-executable outcomes, make it generate critiques rather than score — but prefer executable verification whenever available (S17/S19 asymmetry).
+
+### (9) Multi-teacher / correlation
+
+**S40.** 2302.07215 | Multi-teacher KD as an Effective Method for Compressing Ensembles | Ilin et al. 2023 | ensemble→single distillation | Multi-teacher KD (logit/vote fusion) recovers most of ensemble accuracy in one student; fusion mechanism choice matters. | Teacher disagreement handling is heuristic; small-scale vision/NLP tasks. | — | ABSTRACT_ONLY | Positive pole for multi-teacher when teachers are *individually trained on different data/architectures* (i.e. genuinely diverse).
+
+**S41.** 2506.07962 | Correlated Errors in Large Language Models | Raghavan et al.? (authors per abs page) 2025 | consensus ≠ corroboration | Across 350+ LLMs: models agree on errors ~60% of the time on a leaderboard dataset; correlation driven by shared architecture/provider, and — crucially — **larger, more accurate models have highly correlated errors even across distinct architectures and providers**; downstream monoculture effects shown in LLM-as-judge and hiring. | The negative is the finding: independent-seeming LLMs are not independent error sources. | Three evaluation contexts; task coverage partial. | ABSTRACT_ONLY | Directly kills the assumption that "3 models agreed ⇒ verified": for Rune, consensus among same-lineage models (or models sharing pretraining data) is weak evidence; only *execution/verification* evidence is independent of this monoculture.
+
+**S42.** 2403.02419 | Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems | Chen, Manoyina?, actually: (Stanford) 2024, ICML'25 | self-consensus scaling limits | Majority-vote and filter-vote performance is **non-monotonic** in number of calls: rises on easy queries, *falls on hard* ones; task-level shape depends on difficulty mix. | More calls ≠ more corroboration; hard-query degradation is structural. | Vote/Filter-Vote designs only. | ABSTRACT_ONLY | Second kill: even self-agreement saturates and inverts. Rune should not treat repeated sampling agreement as verification for hard tasks.
+
+### (10) Verifier-guided learning — covered by S37–S39 + S17–S20. (RLVF EMNLP'23 not included: could not verify its arXiv ID under API rate limits; the verified anchors above cover the mechanism class. Recorded as a gap honestly rather than cited unverified.)
+
+---
+
+## 2. Synthesis verdicts
+
+### (a) When does distillation / narrow fine-tune actually match a teacher on a bounded task?
+
+Evidence-supported conditions, all five required by the literature:
+1. **Verifiable, bounded output space.** Distillates match teachers on competition math/code (S1: 32B distillate beats QwQ; 7B beats GPT-4o on AIME) where outputs are checkable and the *task family* matches the training set. Nobody has shown distillate≈teacher on open-ended agentic rollouts (R1's own SWE-Verified gap).
+2. **Teacher-generated trajectories ≥ verified-correct.** Distillation transmits the teacher's process (S3/S4); if the teacher fails a certain way, so does the student — filter traces by outcome before distilling (S1's 800K set was RM-filtered).
+3. **Enough data of the right kind, mixed with general data.** ~800K verified reasoning pairs (S1); 500 trajectories suffice to move a 7B agent (S7) but hybrid mixing is needed to avoid degrading general ability (S6's negative).
+4. **Distillation beats local RL for small models** on reasoning (S1 F.1: 72.6 vs 47.0 AIME): Rune should distill from verified traces before attempting local RL.
+5. **A small trained model beats a prompted large one above roughly hundreds of labelled examples** (S24 crossover; S2's 770M > 540B few-shot). Below that, prompt the big model.
+
+For Rune: matching a teacher on a *narrow task* is real and reproducible for classification, extraction, and code-with-tests; for agentic behaviour, distillation gets the style, not the competence (S1's SWE gap).
+
+### (b) Does outcome-grounded learning (expectation → outcome → lesson) have real evidence, and what are its failure modes?
+
+**Yes for the outcome → update half; thin for the lesson → analogous-application half; unmeasured for the full loop** — which is precisely Rune's [OVL-0] situation.
+- Real evidence: environment-verified outcomes drive large gains via RL (S12: 4.8→42.4%), via PRM-style step credit (S38), and via test-anchored iteration (S18). Verbal outcome learning also works per-task (S8).
+- The loop's documented failure modes:
+  - **Attribution** — which part of the trace caused success is not observable from one rollout; MC rollouts from intermediate steps to verified ends are the only supported estimator (S38), and it is noisy and costly.
+  - **Spurious correlation / lucky paths** — final-answer verification reinforces chance successes (S38's own caveat); outcome similarity ≠ causal similarity.
+  - **Verifier gaming** — once outcomes feed any optimization loop, proxy reward gets over-optimized (S37): Rune must measure on real outcomes but never select lessons *by a learned proxy* of them.
+  - **Distribution shift / drift** — training (even softly, by lesson reuse) on the agent's own state distribution compounds errors (S5's quadratic law); S12 names policy drift explicitly and needs adaptive countermeasures.
+  - **Unanchored self-correction is negative** — lessons/reflections generated without external signal often hurt (S9); the supported lesson classes are those tied to execution results, tests, or environment checks (S9, S19: 2–3% vs 12% asymmetry).
+  - **No closed-loop measurement in the literature** — ExpeL (S11), Reflexion (S8), Memp (S15) extract insights/procedures but none report a measured *per-lesson* counterfactual improvement (lesson applied → analogous case measured better). Rune's expectation→action→outcome→lesson→analogous-application→measured-improvement loop is therefore *ahead of the published evidence*, not behind it: it is a hypothesis that the field has only validated piecewise. The A/B-analogous-case measurement design is exactly what would make it evidence.
+
+### (c) What makes a generated procedure a SKILL (evidence-based promotion criteria)?
+
+Synthesizing S13 (deep read), S14, S15, S16, S17, S19:
+1. **External-anchored success at least once** (Voyager's gate): execution completed with an environment/test check confirming the *task*, not just absence of exceptions (S13; S17).
+2. **Indexable intent**: stored with a description that supports retrieval in future analogous situations (S13's embedding-of-description; Memp's key strategies).
+3. **Composability**: referenced successfully by later, more complex procedures (Voyager's core compounding claim — the strongest signal that a stored procedure is a skill rather than a script).
+4. **Practice hardening**: repeated successful executions, ideally including practice iterations (S16) — single-shot verified skills are the weakest class in every cited system.
+5. **Survivorship under environment change**: Memp's deprecation/update regimen is the only published mechanism addressing staleness (S15); AWM shows value *degrades* gracefully with train-test gap but doesn't test environment mutation directly.
+6. **Not just popular**: CodeChain (S20) shows cluster-vote popularity is a selection signal but not correctness — popularity-based promotion without verification is rejected.
+Minimum evidence-based promotion gate for Rune [ESL]: verified success (1) + intent description (2) + at least one successful *reuse* in an analogous task (4/3) before treating it as a skill rather than an artifact; re-verify on environment-version change (5).
+
+### (d) Weights vs retrieval vs procedure for Rune's learning
+
+Ranked by evidence-per-risk for a local, stateful agent with no data lake and no measured loop:
+1. **Procedure (code skills / deterministic modules)** — strongest evidence: S13–S16, S18–S20; zero forgetting risk (weights untouched), inspectable, rollback = delete; compounding demonstrated (Voyager's composition, 3.3× items). This is where Rune's [152M] modules live and where [ESL] promotion gates are correctly placed.
+2. **Retrieval (lessons, traces, workflows)** — solid per-task evidence (S8, S11, S14, S15); risks are staleness (needs Memp-style deprecation) and drift if lessons shape behaviour without outcome re-measurement (S5, S9). Verbal lessons must be treated as hypotheses, not knowledge.
+3. **Weights, adapter-form (LoRA/O-LoRA with accumulate-not-replace)** — safe but weak: LoRA "learns less" (S30) which *is* the feature for a general agent; orthogonal-subspace accumulation avoids replay (S33) matching arm-2's accumulate-not-replace; rollback trivial (adapter artifact; intruder-dimension rescaling as finer knob, S31). Full fine-tuning and weight editing rejected (S36's ripple-effect failure; S29's 2-bit envelope).
+4. **Weights, in-place editing** — rejected on current evidence (S36).
+5. **Weights, full FT on own traces** — rejected for now: needs replay (S32) Rune doesn't have, risks general-ability loss (S6 negative), and distillation of the same traces is strictly safer (S1 F.1).
+
+### (e) Multi-teacher correlation verdict
+
+Multiple teachers help only when their *errors* are decorrelated — and the literature says the decorrelation assumptions usually fail: 350+ models agree ~60% of the time when both err, and error correlation *rises* with capability even across architectures and providers (S41); self-agreement is non-monotonic and degrades on hard queries (S42). Genuine diversity requires differing training data and the ensemble-distillation fusion still only partially recovers ensemble accuracy (S40). **Verdict for Rune: consensus among models with shared lineage/pretraining data is weak corroboration; treat model-agreement as a cheap prior, never as verification; the only error-independent checkers in Rune's world are execution, tests, and environment state.** Conversely, this means multi-teacher distillation for Rune (e.g. several local models generating candidate lessons) adds little beyond the best verified trace corpus.
+
+---
+
+## 3. Rejected approaches (with reasons)
+
+1. **Cascade/routing by learned router on in-distribution labels** — already rejected by arms 1–2; this arm adds: routing classifier training is only viable above the S24 crossover (~100s labels), which Rune's [7L]-era data does not yet support; weak supervision via labelling functions (S25) is the only bootstrap that gets there without hand-labelling.
+2. **Weight-level model editing (ROME/MEMIT) for Rune knowledge updates** — RippleEdits (S36) shows ripple-effect inconsistency at scale; facts in code-agent contexts are entangled; store-and-retrieve dominates.
+3. **Full fine-tuning on Rune's own traces** — quadratic distribution-shift law (S5), replay requirement (S32), general-ability degradation without mixing (S6); local RL also underperforms distillation at small scale (S1 F.1).
+4. **Fine-tuning the quantized 27B IQ2_M base** — QLoRA evidence is 4-bit (S29); IQ2_M is below arm-1's established safe floor; unmeasured envelope, real risk.
+5. **Intrinsic self-correction prompts as a learning source** — negative evidence (S9, S19's no-test regime); lessons must anchor to execution/tests/environment.
+6. **Consensus/majority-vote as verification** — S41, S42.
+7. **Popularity-based skill promotion (CodeChain-style cluster votes) without execution verification** — S20 limitation.
+8. **Proxy-reward optimization of the lesson loop** — S37; measure on real outcomes, don't optimize a learned proxy of them.
+9. **Naive confident self-training for Rune's classifiers** — confirmation-bias drift (S27); requires constraints/ensembling as in S27 or Noisy-Student-scale noise machinery (S26) that Rune can't afford locally.
+
+## 4. Do-not-cite register
+
+IDs verified to be WRONG papers (do not pair with the intended topics again):
+- **2403.02719** — "Multi-Scale Subgraph Contrastive Learning" (NOT "Are More LLM Calls All You Need?" — correct is **2403.02419**)
+- **2401.08900** — "Atmospheric Science Questions for a Uranian Probe" (NOT AlphaCodium — correct is **2401.08500**)
+- **2310.08920** — "Embarrassingly Simple Text Watermarks" (NOT CodeChain — correct is **2310.08992**)
+- **2307.02958** — spin-orbit-coupled double quantum dots physics (NOT Ripple Effects — correct is **2307.12976**)
+- **2401.01280** — "GEqO: ML-Accelerated Semantic Equivalence Detection" (NOT the LLM editing survey)
+- **1912.13488** — neutrino non-standard interactions physics (NOT the De Lange continual-learning survey; that survey is IEEE TPAMI 2021 and was not arXiv-verified this cycle — do not cite with an arXiv ID)
+- **2006.03844** — "Replacements and Replaceables: Making the Case for Code Variants" (NOT "Rethinking Pre-training and Self-training")
+- **2205.10436** — "Emergence of bacterial glass" (NOT "Knowledge Distillation from a Stronger Teacher")
+- **2411.13843** — developable-surface shape optimization physics (NOT WebRL — correct is **2411.02337**)
+- **RLVF (EMNLP 2023)** — arXiv ID not verifiable this cycle under rate limits; excluded rather than risk a bad ID.
+
+## 5. Evidence gaps (honest, for the atlas)
+
+- No measured per-lesson counterfactual loop (lesson → analogous application → measured delta) exists in the cited literature — the closest are ExpeL/Reflexion/Memp, all open-loop. Rune's [OVL-0]/[GD-0] gap is therefore a *frontier* position, not a lag.
+- No modern arXiv-verified anchor for LLM-scale symbolic rule compilation was found; TREPAN-era evidence (S22) is 1990s-scale.
+- AWM's environment-mutation invalidation behaviour is untested in the paper; staleness evidence relies on Memp's update regimen only.
+- SkillWeaver/Correlated Errors/CodeChain abstracts only; numbers quoted are from verified abstracts, not full texts.

research/memory-atlas-r1/AC-local-offline-intelligence/02_outward/arm4_systems_adversarial.md

@@ -0,0 +1,294 @@
+# AC #404 — Offline / Local Intelligence — Arm 4: CURRENT SYSTEMS / IMPLEMENTATION ECOSYSTEM + INDEPENDENT FRESH-CONTEXT ADVERSARIAL PASS
+
+_Domain: Memory Research Atlas R1 #404 · Rune project (single workstation, RTX 4070 Ti SUPER 16 GB VRAM ≈5.4 GB used by user apps at idle, 62 GB RAM)_
+_Arm scope: (A) what the 2024–26 local-inference implementation ecosystem actually delivers vs claims — llama.cpp/GGUF, runtimes, Ollama/LM Studio, small coding models, offline-shipped agents, production distillation, failure evidence, benchmark-vs-runtime gaps; (B) independent fresh-context adversarial pass on the candidate architecture (14 elements) + 100 mandated attacks + 18 Rune-specific attacks._
+_Sources arms 1–3 established and were NOT re-researched: quantization task-sensitivity (2504.04823), distillation transmits capability+errors+style (2301.12726), cascade/routing REJECTED for Rune, CoALA control-in-code, MemGPT model-owned memory degrades (2310.08560), escalation = pass@1 bins + verifier availability (2408.03314), DAgger T²ε (1011.0686), Voyager external-verifier-gated promotion (2305.16291), LoRA learns-less-forgets-less (2405.09673), WebRL outcome-grounded gains (2411.02337), consensus ≠ corroboration (2506.07962)._
+
+**Verification ledger (arXiv IDs re-verified this arm via arxiv.org/abs pages + Semantic Scholar after export-API rate-limiting; mis-pairings caught: 1):**
+
+| Prompt/context-supplied ID | Reality | Correct ID |
+|---|---|---|
+| 2305.09658 ("FrugalGPT") | **Noether Symmetries and Anisotropic Universe in Energy-Momentum Squared Gravity** (2021) — WRONG | FrugalGPT (Chen, Zaharia, Zou) = **2305.05176** (confirmed via stanford-futuredata/FrugalGPT README → arxiv.org/pdf/2305.05176) |
+
+All other IDs used in this file were resolved to their correct titles: 2305.17493 (Curse of Recursion), 2404.01413 (Is Model Collapse Inevitable?), 2310.08560 (MemGPT), 2506.07962 (Correlated Errors in LLMs), 2408.03314 (Snell test-time compute), 2411.02337 (WebRL), 2508.06433 (Memp), 2405.09673 (LoRA Learns Less and Forgets Less), 2305.16291 (Voyager), 2409.12186 (Qwen2.5-Coder TR), 2501.12948 (DeepSeek-R1), 2412.08905 (phi-4 TR), 2503.19786 (Gemma 3 TR), 2402.14905 (MobileLLM), 2504.04823 (Quantization Hurts Reasoning?), 2402.01613 (Nomic Embed), 2310.06770 (SWE-bench), 2405.15793 (SWE-agent).
+
+**Read depths used this arm:** DOCUMENTATION_AUDITED (official project docs/API references read verbatim from primary repos: llama.cpp, Ollama, vLLM, mlx-lm, ONNX Runtime GenAI, LM Studio; live SWE-bench leaderboard dataset parsed from swebench.com page data; Qwen team blog), COMMUNITY_EVIDENCE_RELIABILITY_LABELED (GitHub issue tracker searches on ollama/ollama — labeled as community, unverified), ABSTRACT_ONLY / METADATA_VERIFIED (papers via title-verified abs pages), INHERITED_VERIFIED (arm 1–3 results cited without re-reading).
+
+---
+
+# PART A — CURRENT SYSTEMS / IMPLEMENTATION ECOSYSTEM (2024–26)
+
+## A.1 Source ledger
+
+### Topic 1 — llama.cpp / GGUF ecosystem
+
+| # | ID / source | What it is | Key claims (docs) | What it does NOT deliver | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|
+| A1 | llama.cpp README + docs/ (ggml-org/llama.cpp, master, accessed this session) | The reference GGUF inference stack | Plain C/C++, CUDA/Metal/CPU backends; `llama-server` = OpenAI-compatible REST; multimodal (mtmd); quantize tool with imatrix ("accuracy loss… minimized by using a suitable imatrix file" — ppl/KLD are the *only* accuracy instruments the docs offer); docs/speculative.md: draft-model AND EAGLE-3 speculative decoding supported in llama-server, with EAGLE-3 drafts for Qwen3 1.7B–32B and gpt-oss families | Docs measure quant damage in **perplexity/KLD only** — no task-level (coding/reasoning) accuracy instrument ships with the tool that produced Rune's quants; the ecosystem's accuracy story for a specific quant file is *offloaded to community evaluations* | DOCUMENTATION_AUDITED | Rune's 27B IQ2_M was quantized with tooling whose own docs cannot tell Rune what it lost on Rune's tasks. Arm-1's finding (IQ2_M unmeasured) is not a Rune gap — it is the ecosystem's normal state |
+| A2 | llama.cpp docs/speculative.md | Speculative decoding guide | Three implementations: classic draft model, EAGLE-3 (hidden-state draft, one-layer transformer per target model), and mixing; speedups "when draft predictions are frequently correct"; EAGLE-3 checkpoints exist for Qwen3-14B (AngelSlim/Qwen3-14B_eagle3) | Requires a *target-model-specific* draft (EAGLE-3 heads are per-model artifacts); wrong draft → speedup evaporates; not lossless at the *latency* level (verification still runs the target) but lossless at output-distribution level | DOCUMENTATION_AUDITED | The architecture's item 8 ("speculative decoding = the lossless adaptive-compute win") is **ecosystem-real**: a Qwen-family EAGLE-3 draft for qwen3:14b exists off-the-shelf. But Ollama (Rune's actual runtime) support is newer/partial (see A8) |
+| A3 | llama.cpp tools/server/README.md | Server structured output | `--grammar` (GBNF), `--json-schema` / per-request `json_schema` and `grammar` fields; invalid grammar → request error (never silent) | Grammar constrains *sampling*, not *semantics* — a schema-valid wrong answer is still produced; no guarantee of tool-call correctness | DOCUMENTATION_AUDITED | Structured output is a solved constraint layer at the runtime level; Rune's real gap (inward probe: JSON-failure rate UNKNOWN) is upstream model quality, not runtime support |
+| A4 | k-quants PR #1684 + imatrix discussion #5263 (INHERITED from arm 1, DOCUMENTATION_AUDITED there) | Quant formats + calibration sensitivity | 2–6 bit ppl curves; "bigger quantizes better" bounded and non-monotone above ~13B; imatrix corpus choice measurably changes Q2_K quality | No per-task accuracy instruments; community KL-div proxies only | INHERITED_VERIFIED | Whatever imatrix made Rune's IQ2_M files determines how much coding survives — and the provenance of Rune's 27B files is currently unrecorded |
+
+**Topic 1 synthesis — deliver vs claim.** The GGUF ecosystem delivers: every quant format 2–8 bpw, imatrix calibration, grammar-constrained decoding, speculative decoding (draft + EAGLE-3), OpenAI-compatible serving, multi-GPU, multimodal. It does NOT deliver: (a) task-level quality measurement of a specific quant file (ppl/KLD only), (b) quant provenance metadata as a first-class citizen (GGUF files carry metadata but the *task-relevant* calibration story is not standardized), (c) any guarantee that a community-contributed IQ2_M of model X was calibrated on anything resembling code. "Local model quality" claims in this ecosystem are perpetually one inference-away from unmeasured.
+
+### Topic 2 — Local inference runtimes
+
+| # | Source | Deployment characteristics | Quant support | Structured output | Read depth | Rune relevance |
+|---|---|---|---|---|---|---|
+| A5 | vLLM docs (vllm-project/vllm main: features/quantization/README.md, features/structured_outputs.md) | Production-scale serving; paged attention; continuous batching; multi-backend quant kernels (`--linear-backend`); day-0 model support | Broadest: AWQ, GPTQ/GPTQModel, BitsAndBytes, FP8 W8A8/W4A16/INT4/INT8 via LLM Compressor, ModelOpt, TorchAO, Quark, GGUF (via gguf.md), quantized KV cache | Native: xgrammar or llguidance backends, `structured_outputs` API (json/regex/choice/grammar/structural_tag), default `auto` backend | DOCUMENTATION_AUDITED | vLLM on a 16 GB single-GPU workstation is heavy (targets datacenter; but runs 7–14B fine). Its quant-fidelity *transparency* (named schemes, per-layer backends) is far ahead of Ollama's opaque "quantized_model tag" |
+| A6 | mlx-lm README (ml-explore/mlx-lm main) | Apple-silicon-first; HF Hub one-command generate/chat; **LoRA + full fine-tuning including on quantized models**; distributed inference | 4/8-bit quantization + quantized LoRA training | Not a serving-first runtime (no OpenAI server in core README); grammar support limited | DOCUMENTATION_AUDITED | Not applicable to Rune's NVIDIA hardware — cited as the counterexample showing on-device LoRA-finetune is a *commodity* feature in 2025-26 runtimes (QLoRA-class training inside the runtime, which Ollama still does not offer) |
+| A7 | ONNX Runtime GenAI README (microsoft/onnxruntime-genai main) | Cross-platform (x86/x64/arm64; CPU/CUDA/DirectML/TRT-RTX/OpenVINO/QNN/WebGPU); powers **Foundry Local, Windows ML, VS Code AI Toolkit**; full generative loop incl. KV cache, logits processing, **grammar specification for tool calling**, **multi-LoRA** | Block-quantized INT4 (RTN, accuracy-level options), FP8/INT8 variants per model package | Constrained decoding supported; **speculative decoding explicitly "on the roadmap"** (not shipped) | DOCUMENTATION_AUDITED | The "ship-to-consumers offline" stack (Foundry Local) uses ONNX — evidence that packaged offline agents exist at OS-vendor level (see Topic 5). Multi-LoRA at inference = the runtime substrate for the architecture's "accuracy-recovery adapters" rung exists outside the GGUF world |
+| A8 | Ollama docs (docs/api.md, faq.mdx, context-length.mdx, capabilities/) + issue tracker | Simplest deployment; system service; model registry tags; keep_alive; context defaults by VRAM | Opaque: quant baked into registry tags (q4_K_M etc.); no per-layer backend transparency; no user-facing quantization tooling | `format: json` / JSON-schema structured outputs; embeddings, tool-calling, thinking, vision, streaming documented as capabilities | DOCUMENTATION_AUDITED | Rune's runtime of record. See Topic 3 for the specific operational traps |
+| A9 | LM Studio developer docs (lmstudio.ai/docs, structured-output page) | Desktop app + headless service ("llmster as a Startup Task on Linux"); REST API + OpenAI-compat + **Anthropic-compat** endpoints; model loader with per-model context/ GPU-offload controls; "Idle TTL and Auto-Evict" for memory management | GGUF (llama.cpp-derived engine) with visible quant picker and **runtime context-length override** | JSON-schema structured output enforced at server level; MCP via API | DOCUMENTATION_AUDITED | A plausible drop-in upgrade for Rune: same GGUF files as Ollama but with explicit context control, idle eviction (relevant to shared-VRAM), and per-load configuration instead of Modelfile defaults |
+
+**Topic 2 synthesis.** All four runtimes ship structured-output/constrained decoding in 2025-26 — grammar constraints are a *commodity*. Quantization support ranges from vLLM's transparent scheme zoo to Ollama's opaque tags. Fine-tune-in-runtime is a commodity (mlx-lm, ONNX multi-LoRA) that Ollama lacks. Speculative decoding is llama.cpp-first (shipped), vLLM-first (shipped), ONNX (roadmap), Ollama (partial — see A8). **Rune's runtime choice (Ollama) is the least transparent of the four on exactly the axis arm 1 found most dangerous: quantization quality.**
+
+### Topic 3 — Local model routing/serving: Ollama specifics + LM Studio
+
+| # | Source | Finding | Consequence for Rune | Read depth |
+|---|---|---|---|---|
+| A10 | Ollama faq.mdx / context-length.mdx | **Context defaults scale with VRAM, silently: <24 GiB → 4k; 24–48 GiB → 32k; ≥48 GiB → 256k.** Docs themselves say agents/coding tools "should be set to at least 64000" and warn "Ensure you have enough VRAM" | On Rune's 16 GB card Ollama defaults to **4k context** — the family file's 2048-ctx silent-drift finding is structural, not a misconfiguration: every agent loop with a few tool outputs silently truncates unless num_ctx is set per request. The default *changes with hardware*, so the same code drifts if the GPU changes | DOCUMENTATION_AUDITED |
+| A11 | Ollama faq.mdx (keep_alive) | Default keep_alive = **5 minutes**; per-request `keep_alive` or OLLAMA_KEEP_ALIVE override; `ollama ps` shows GPU/CPU split and unload timer | Without keep_alive management, Rune's first token after 5 idle minutes pays full model load (for an 11 GB model: many seconds to minutes, worse under VRAM contention). A degradation ladder measuring "model up/down" will miss "model up but perpetually reloading" | DOCUMENTATION_AUDITED |
+| A12 | Ollama faq.mdx (concurrency) | Parallel requests multiply the context allocation (2k ctx × 4 parallel = 8k KV memory); models must FULLY fit VRAM for concurrent load; otherwise queue | VRAM headroom on the shared 16 GB card is consumed quadratically by concurrency; Ollama will silently queue or CPU-offload rather than error | DOCUMENTATION_AUDITED |
+| A13 | Ollama issue tracker (community, reliability-labeled) | Multiple open/closed issues document **silent context truncation**: "/api/chat over-truncates history with large context (48k): trims almost everything instead of just overflow" (closed), "Context truncation drops user message → misleading 500 on agent tool use" (closed), "**server: warn when embedding input is truncated to fit context window**" (OPEN — i.e., embedding truncation is still silent), "Detect Truncation Due to Exceeding Context Size" (open feature request) | The truncation behavior Rune's family file observed is a *known, partially-unsolved defect class* in the exact runtime Rune depends on. Silent truncation of embedding input is still an open issue — matching the inward probe's silent-embedding-degradation finding | COMMUNITY_EVIDENCE_RELIABILITY_LABELED |
+| A14 | Ollama issue tracker (speculative decoding) | "Enable speculative decoding" (open); "Ollama 0.34.2 **MTP speculative decoding** regression with Qwen3.8 27B" (closed — MTP support exists for some model families/runners); mlxrunner speculative KV-buffer fixes | Ollama's speculative decoding exists but is model-family-specific (MTP-head models) and regressed in the recent past; draft-model speculative decoding (Rune's Qwen 3B→14B pair) is NOT the Ollama mechanism — Rune would need llama.cpp/vLLM for that | COMMUNITY_EVIDENCE_RELIABILITY_LABELED |
+| A15 | Ollama docs/capabilities/ (embeddings, structured-outputs, tool-calling, thinking, vision, web-search, streaming) | Capabilities are *declared per model tag* by the registry/docs | Exactly the DECLARED-not-OBSERVED truth class the inward audit found in Rune's own config; Ollama's capability model gives Rune no observed-truth substrate for a registry — Rune must probe models itself | DOCUMENTATION_AUDITED |
+| A16 | LM Studio docs (headless service, Idle TTL and Auto-Evict, per-load config) | Headless Linux service; **auto-eviction of idle models** (direct answer to shared VRAM); per-load context override; REST + OpenAI + Anthropic compat | Migration path candidate if Rune outgrows Ollama: same GGUF assets, explicit memory eviction policy, explicit context — two of Rune's three silent-degradation classes (context drift, VRAM pressure) get user-visible controls | DOCUMENTATION_AUDITED |
+
+**Topic 3 synthesis.** Ollama's operational model is optimized for interactive single-user chat, not for a stateful agent host: 4k default context on Rune's card, 5-minute model eviction, silent truncation (open issues), VRAM contention handled by silent offload/queue. Every one of these converts a *hardware state* into a *silent quality degradation* — which is precisely the failure signature Rune's degradation ladder is supposed to make impossible. **The ladder's rungs must be defined over measured runtime telemetry (ctx allocated, GPU/CPU split, tokens/sec, KV headroom), not over "can I reach the API."**
+
+### Topic 4 — Small / local coding models 2024–26
+
+| # | Source | Measured claims | The gap | Read depth |
+|---|---|---|---|---|
+| A17 | Qwen team blog "Qwen2.5-Coder Series" (Nov 2024) | 32B-Instruct: "SOTA open-source code model, matching GPT-4o" on EvalPlus/LiveCodeBench/BigCodeBench; **Aider code-repair 73.7** "comparable to GPT-4o"; McEval 65.9 across 40+ languages; MdEval 75.2; sizes 0.5B/1.5B/3B/7B/14B/32B | Every cited instrument is function-/snippet-level or benchmark-repair. The blog contains **no SWE-bench or repo-scale agentic result at all** (string-verified: no "SWE" mention) | DOCUMENTATION_AUDITED |
+| A18 | Qwen2.5-Coder Technical Report (2409.12186, INHERITED_VERIFIED arm 1) | 5.5T tokens; SOTA >10 code benchmarks at size; "repo-scale agentic coding not benchmarked in every report" (arm 1's own note) | Vendor instruments = HumanEval/MBPP/EvalPlus class | INHERITED_VERIFIED |
+| A19 | SWE-bench leaderboard data (swebench.com page data parsed this session; Verified + bash-only "mini" boards) | **The ≤14B evidence vacuum, quantified:** on SWE-bench Verified, small-model entries are: RAG + SWE-Llama 7B — **0.7% resolved** (2023, checked); Lingma SWE-GPT 7B — **18.2%** (2024-10, **unchecked** submission); MCTS-Refine-7B — **23.2%** (2025-06, **unchecked**); FrogMini-14B — **45.0%** (2025-11, Microsoft, **os_model: false — NOT open-weight**). The 30B-class MoE Qwen3-Coder-30B-A3B reaches 51.6% (checked), and every other leading entry is ≥32B or frontier-closed | Across 2023-10 → 2025-11, an OPEN ≤14B model has **never** posted a verified agentic SWE-bench result; the two best ≤14B entries (18.2%, 23.2%) are unverified submissions, and the one 45% 14B is closed. Arm 1's "evidence vacuum" is confirmed against the live leaderboard: **the population is not "small models score low," it is "small models are barely present"** | DOCUMENTATION_AUDITED (parsed leaderboard JSON) |
+| A20 | SWE-bench (2310.06770) + SWE-agent (2405.15793) (METADATA_VERIFIED) | The benchmark harness and the agent-computer-interface framing that all entries above inherit | Agentic coding results are agent-scaffold-dominated: same model, different harness → double-digit deltas; model-only comparisons are confounded | METADATA_VERIFIED |
+| A21 | DeepSeek-Coder lineage (DeepSeek-Coder V2, 33B-A3.6B MoE; INHERITED from arm-1-era literature, METADATA) | Established the MoE pattern (large total, small active) as the local-compute answer to the capability/VRAM bind | Rune's stack has NO MoE model installed; its density-27B-IQ2_M-vs-density-14B-Q4 dilemma is an artifact of its model menu, not of the ecosystem | METADATA |
+
+**Topic 4 synthesis.** What's measured for small coding models: function-level generation (saturated), snippet reasoning, single-file repair. What is NOT measured anywhere for open ≤14B: repo-scale agentic issue resolution (the vacuum is total — not even unverified entries are common; FrogMini-14B 45.0 is closed-weight). **Rune's qwen2.5-coder:14b is therefore an instrument with no published agentic-task operating envelope.** This is not a reason to distrust it at Rune's *actual* task class (bounded edits, module-sized changes, tool calls) — it is a reason the architecture's "measure per task locally" element (13) is the only honest instrument that exists.
+
+### Topic 5 — Local agents actually running offline
+
+| # | Source | Claims | Honesty of capability claims | Read depth |
+|---|---|---|---|---|
+| A22 | Apple Intelligence architecture — **SKIPPED per mandate (arm 2 covered)** | — | — | — |
+| A23 | ONNX Runtime GenAI powering **Foundry Local / Windows ML** (A7) | Microsoft ships an on-device model runtime + model catalog as an OS feature: local serving (OpenAI-compat), hardware-accelerated across CPU/GPU/NPU | Claims are scoped honestly: small/quantized models for assistant-class tasks; no claim of frontier-agentic capability offline | DOCUMENTATION_AUDITED |
+| A24 | Robotics / embodied local agents (Voyager lineage 2305.16291 INHERITED; local-first robotics stacks are typically: on-device small policy models + cloud LLM for semantics, or fully-offline narrow policies) | The dominant honest pattern in shipped robotics is **bounded local competence**: navigation/manipulation policies run offline; open-ended language cognition stays cloud-dependent or is heavily scoped | Shipped systems do NOT claim offline open-ended agency; they claim offline *skill execution* — which is exactly the rung-5 shape (non-generative continuation) | METADATA / INHERITED |
+| A25 | Local-first developer products (Ollama/LM Studio/Foundry-based assistants; local RAG products) | What actually ships offline: chat with retrieval, summarization, code completion (FIM), structured extraction | Honest deployments scope to: bounded generation + retrieval + extraction. None ship offline *multi-step autonomous* coding agents with quality claims; agent loops are cloud-by-default even in local-first products | DOCUMENTATION_AUDITED (pattern across product docs above) |
+
+**Topic 5 synthesis.** The ecosystem's honest offline capability set, circa 2025-26: retrieval, extraction, FIM completion, bounded single-shot generation, tool-call JSON, small-policy execution. The offline *autonomous agent* does not exist as a shipped, quality-claimed product anywhere this arm examined. **Rune's rung-5 (non-generative continuation) and bounded-task rung-4 are consistent with what shipped systems actually claim; the architecture's "full local" rung-1 for open-ended agentic work is beyond anything shipped anywhere** — which makes rung-1's quality honesty entirely dependent on Rune's own local measurement.
+
+### Topic 6 — Distillation systems in production
+
+| # | Source | Claims | Quality vs teacher | Read depth |
+|---|---|---|---|---|
+| A26 | DeepSeek-R1 (2501.12948; INHERITED_VERIFIED arm 3) | R1-Distill-Qwen-32B > QwQ-32B-Preview on AIME/MATH/GPQA; distill-7B beats GPT-4o on AIME-2024 (55.5); distillation from 800K verified traces transmits long-CoT across base families | On competition-math-style verifiable tasks, distilled students approach/exceed same-size teachers' *benchmark* performance — but R1 itself: 49.2% SWE-bench Verified vs 79.8 AIME (arm 3): **reasoning-benchmark strength ≠ agentic competence, and distillates inherit exactly that skew** | INHERITED_VERIFIED |
+| A27 | phi-4 TR (2412.08905; INHERITED_VERIFIED arm 1) | 14B exceeds its teacher (GPT-4) on STEM QA via synthetic-data curriculum | Exceeds teacher *on the target domain measured by vendor instruments*; general chat not claimed | INHERITED_VERIFIED |
+| A28 | Gemma 3 TR (2503.19786; INHERITED_VERIFIED arm 1) | Gemma3-4B-IT ≈ Gemma2-27B-IT; 27B-IT ≈ Gemini-1.5-Pro; trained with distillation | Generation-over-generation compression is real and large — the strongest evidence that "current-generation small ≈ previous-generation large" | INHERITED_VERIFIED |
+| A29 | Quantization-of-distillates interaction (2504.04823; INHERITED_VERIFIED arm 1) | R1-Distill lineages are *specifically* quantization-sensitive (3-bit −5.4 to −6.3 avg on 7B; harder tasks degrade up to 4× more) | Production distillates + aggressive quantization = compounding degradation; Rune's 27B IQ2_M (2.5 bpw-class) sits below every tested floor | INHERITED_VERIFIED |
+
+**Topic 6 synthesis.** Distillation is in mass production (R1-Distill family, Gemma 3, phi line), and the benchmark story is real — but every production success is (a) domain-scoped, (b) vendor-instrument-measured, and (c) unquantized-or-lightly-quantized at publication. **No shipped distilled model publishes quality-at-IQ2_M-class-quants.** Rune's two 27B IQ2_M models are (per family context) plausibly Qwen-lineage distillates at a quant level no producer ever validated.
+
+### Topic 7 — Failure evidence (reliability labeled)
+
+| # | Source | Failure class | Evidence | Reliability | Read depth |
+|---|---|---|---|---|---|
+| A30 | The Curse of Recursion (2305.17493, METADATA_VERIFIED) | Model collapse from recursive training | "Training on generated data makes models forget" — tails of distribution lost over generations | Peer-reviewed-lineage paper (ICML 2023 workshop lineage); mechanism contested at LLM scale but directionally supported | ABSTRACT_ONLY |
+| A31 | Is Model Collapse Inevitable? (2404.01413, METADATA_VERIFIED) | Collapse is a *data-mixing* problem | Accumulating real+synthetic with explicit non-cumulative mixing avoids collapse — collapse is not inevitable | Peer-reviewed (NeurIPS 2024); refines A30 rather than contradicting | ABSTRACT_ONLY |
+| A32 | Distilled-hallucination transmission (2408.12326 DualChecker; INHERITED arm 1) | Teacher hallucinations propagate through KD when teacher confidence low | Patched piecemeal (re-prompting, dual-checking); never quantified systematically at scale | Peer-reviewed, narrow domain | ABSTRACT_ONLY (INHERITED) |
+| A33 | Fine-tune forgetting (2301.12726 specialization → CoT on BBH drops to 0; 2412.15115-era AgentTuning: agent-data-only FT degrades general ability; 2405.09673 LoRA forgets less) | Catastrophic forgetting in specialization | Consistent across 3 independent groups: specialization trades generic capability, and in-distribution gains do NOT predict OOD retention | INHERITED_VERIFIED (arm 1/3) | — |
+| A34 | Community quantized-failure reports (GGUF ecosystem; arm 1's imatrix discussion #5263 INHERITED; HuggingFace model-card practice) | 2-bit-class quants degraded for reasoning/coding; imatrix corpus sensitivity | Community-accepted; KL-div proxies; no systematic task-level public measurement for IQ2_M specifically | COMMUNITY — reliability moderate (consistent folklore + one mechanism study, 2504.04823, confirming direction) | INHERITED |
+| A35 | Silent-truncation defect class (A13 above) | Prompt/embedding silent truncation in the serving layer | Open GitHub issues in ollama/ollama, including one specifically for embedding-input truncation warnings still OPEN | COMMUNITY — reliability high (issues with reproduction) | COMMUNITY_EVIDENCE_RELIABILITY_LABELED |
+| A36 | Synthetic-data contamination incidents (vendor-admitted) | Benchmarks contaminated by training-adjacent synthetic data | phi-4 TR itself devotes its evaluation section to mitigating benchmark contamination (admits the problem class); LiveCodeBench/eval-style contamination is the stated *reason* new benchmark families exist | DOCUMENTATION_AUDITED (via vendor TR admissions) / INHERITED | — |
+
+**Topic 7 synthesis.** Every failure class has *mechanism-level* evidence and *no* instance-level quantification for Rune's exact configuration (distilled-family, ~2.5 bpw, 14B coder, shared-VRAM serving). The ecosystem's failure knowledge is real but generic; Rune's specific failure rates are unmeasured — consistent with the architecture's per-task measurement requirement, and damning of any "local is fine by default" stance.
+
+### Topic 8 — Benchmark-vs-runtime gaps for local models
+
+| # | Evidence | Gap shape | Read depth |
+|---|---|---|---|
+| A37 | A17 vs A19: same model family. Qwen2.5-Coder-32B "matches GPT-4o" (Aider 73.7, repair) vs Qwen2.5-Coder-32B under the bash-only mini-SWE-agent harness on SWE-bench (verified entry, cost $34.06/task-run) | Snippet-benchmark rank and agentic-harness performance are **different axes**; even 32B open models need heavy scaffolds, and 14B has no verified agentic number at all | DOCUMENTATION_AUDITED |
+| A38 | Arm-1's 2504.04823: quantized models do not think longer; quant error accumulates along CoT; test-time-scaling gains lower than BF16 | Benchmark numbers are reported for BF16; the *quantized runtime instance* (what Rune serves) has lower measured CoT-task gains — the gap between "Qwen2.5-Coder-14B scores X" and "Rune's qwen2.5-coder:14b at its served quant scores X′" is real, unquantified, and task-skewed (worse exactly on harder tasks) | INHERITED_VERIFIED |
+| A39 | Ollama serving defaults (A10–A12): 4k context default, 5-min eviction, parallel-ctx multiplication | Published model cards assume the model's rated context; the *served instance* silently truncates below it. Any benchmark-vs-runtime gap analysis must include serving-layer degradation, not just weight degradation | DOCUMENTATION_AUDITED |
+| A40 | 2506.07962 Correlated Errors (INHERITED) + A19 scaffold confound (A20) | Multi-model "verification" and ensemble-style local stacks inherit correlated errors; benchmark diversity does not imply error diversity | INHERITED_VERIFIED |
+
+**Topic 8 synthesis.** The gap decomposes into three multiplicative layers, none individually measured for Rune: (1) weight-layer: quantization loss (unmeasured for IQ2_M); (2) serving-layer: context truncation/eviction/offload (structurally present per A10–A13); (3) task-layer: snippet benchmarks → agentic reality (vacuum at ≤14B). **A model that benchmarks well and is served silently degraded inside an agentic loop can be arbitrarily worse than any published number — and Rune currently has no instrument that would notice.**
+
+---
+
+## A.2 Part A synthesis — what the implementation ecosystem gives the candidate architecture
+
+1. **Constraint decoding, embeddings, tool-calling, structured output are commodities.** The architecture needs no novel machinery here; its gaps (JSON failure rate unknown, capability registry absent) are *measurement* gaps, not runtime-capability gaps.
+2. **Speculative decoding is ecosystem-real and Qwen-family-compatible** (EAGLE-3 drafts for Qwen3-14B exist; draft/target pairs in Rune's own menu). Architecture item 8 survives — but not on Ollama's current mechanism (MTP-only, family-limited); it would need llama.cpp/vLLM serving.
+3. **The silent-degradation problem is a *runtime* property, not a Rune code bug.** 4k ctx default, 5-min eviction, silent truncation, silent CPU offload, silent embedding truncation (open issue) — the degradation ladder must read telemetry, not availability. This sharpens architecture item 2: "status structured/declared, never generated" is necessary but insufficient — status must be **measured** (tokens/sec, ctx used/allocated, GPU/CPU split, KV headroom), or the ladder's rungs will be wrong while the API answers.
+4. **The ≤14B agentic-coding evidence vacuum is total** (0.7% → 23.2% for open small models, never verified; 45% exists only closed-weight). Architecture item 13 (keep 27B IQ2_M only if locally measured) is the only honest position — and equally, the 14B coder's agentic envelope is unmeasured, so the measurement obligation is family-wide, not 27B-specific.
+5. **Distillation-in-production supports "capability compilation to cheaper forms" only in domain-scoped, vendor-validated, unquantized settings.** Rune's analogue (compile verified reasoning → bounded classifiers) is *more* conservative than production distillation and thus defensible — provided the regression fixtures exist, which they do not yet.
+6. **Failure evidence is mechanism-real, instance-unmeasured.** Collapse/forgetting/hallucination-transmission/quant-loss are all documented failure classes with zero Rune-specific rates. Any architectural claim of the form "local tier is reliable" is currently unfalsifiable-by-construction in Rune — the measurement gap *is* the finding.
+
+---
+# PART B — INDEPENDENT FRESH-CONTEXT ADVERSARIAL PASS
+
+_Method: this arm was given arms 1–3 conclusions (verbatim summary above) and attacked the CANDIDATE ARCHITECTURE (14 elements) from first principles, without inheriting their argument structures. Verdict semantics: **SUCCEEDS** = the attack lands; the architecture element as written is damaged/underspecified and a correction is forced. **PARTIAL** = lands on a boundary case or on the implementation (not the design); correction needed but architecture core survives. **FAILS** = the architecture (with its existing evidence) withstands the attack; attack recorded for completeness._
+
+_Reality anchors used (from Part A + inward audit): silent truncation/eviction/offload are structural Ollama behaviors (A10–A13); ≤14B agentic evidence vacuum is total (A19); IQ2_M below every tested quant floor (2504.04823); all learning machinery empty (0 skills, 7 lessons, 0 measured deltas); no registry, no routing, no templates; 152 modules are an accidental fallback; crons need LLM; generation health unprobed._
+
+## B.1 Mandated attacks 1–100
+
+| ID | Attack | Verdict | Evidence | Consequence | Correction | Residual |
+|---|---|---|---|---|---|---|
+| 1 | Local models are inherently safer (no cloud = no adversary) | FAILS | Arch element 11 already asserts local models = untrusted components; supply chain (pickles/adapters/trojans) is orthogonal to cloud boundary | None — architecture consistent | None; element 11 stands | Runtime-level attacks (truncated prompts, KV exfil via shared VRAM) unaddressed by *any* arm — flag to #405 |
+| 2 | Local inference is inherently cheaper | PARTIAL | $/token is ~0, but $/correct-task is unmeasured when quality degrades silently (A38): retries, human rework, wrong-but-plausible outputs | "Cheap local" can be the expensive tier at task level | Cost metric must be outcome-denominated (cost per verified success), not token-denominated | Electricity+VRAM contention cost with user's own gaming/coding never priced |
+| 3 | Small models will eventually replace all frontier reasoning | FAILS | A19: no open ≤14B model ever posted a verified agentic result; generation compression (A28) is real but each generation's frontier also moved | Architecture does not depend on this claim | None | If someday true, the ladder collapses gracefully — no architecture change needed |
+| 4 | Always use frontier when available | PARTIAL | Arch rejects routing-now (item 8) but inwards show ad-hoc frontier use ALREADY happens (BYPASS state) — the architecture's log-don't-route policy is violated by current practice | Without enforcement, "log (query, model, outcome)" never accumulates because frontier calls bypass logging | Frontier usage must go through the same logged gateway as local, or the label corpus is censored by selection bias | None — direct practice correction |
+| 5 | Always-local-first is optimal | SUCCEEDS | Arch elements 2+8 bake in local-first ordering without a measured basis; inward CONFLICTING state (local-first config vs ad-hoc frontier reality) shows the ordering is aspirational, not derived | Rune may systematically overpay in quality for independence it hasn't priced | Local-first must be declared a *policy choice with a revisit trigger* (e.g., when ≥N measured tasks show local < frontier pass@1 beyond threshold), not an axiom | Independence value (availability, privacy) is real but unquantified — owner decision needed |
+| 6 | One benchmark proves local adequacy | FAILS | A17 vs A19/A37: snippet benchmarks ≠ agentic reality; arch item 12 requires analogous-task A/B | None | None | None |
+| 7 | Quantization loss is negligible | FAILS | 2504.04823: W3 −5.4/−6.3 on 7B; harder tasks up to 4× worse; IQ2_M (~2.5 bpw) below the tested floor entirely; A34 community confirmation | Arch item 13 already encodes this; the attack re-confirms that Rune's DEFAULT model (the config's one 27B tool model) is the least trustworthy asset in the stack | Measurement obligation covers both 27Bs; also record quant provenance (imatrix corpus) of the exact GGUF files | Imatrix provenance of installed files unknown — cheap to extract from GGUF metadata |
+| 8 | Quantization affects all tasks equally | FAILS | Same: task-sensitivity is the established result (hard reasoning 4× worse; extraction/classification far more robust) | Supports arch item 3 (compile bounded tasks to cheaper forms — they're also quant-robust); damages any plan to run open-ended reasoning on IQ2_M | None | Per-task-class quant sensitivity for Rune's 11 models unmeasured |
+| 9 | Parameter count predicts intelligence | FAILS | Gemma3 4B-IT ≈ Gemma2 27B-IT (A28); MobileLLM sub-1B tool-call viability | Arch's model-as-resource + per-task measurement is exactly the right stance | None | None |
+| 10 | More context = better memory | FAILS | A10–A13: more ctx costs VRAM quadratically (parallelism), triggers offload/truncation; retrieval + state (Rune's SQLite) is the memory substrate, ctx is a window | Arch item 10 (modules+SQLite+retrieval) already models memory as external | None | Rune's retrieval quality never A/B'd (F14) — the substrate exists but its quality is unmeasured |
+| 11 | Distilled student learns capability cleanly | FAILS | 2301.12726 (OOD collapse), R1 49.2 SWE vs 79.8 AIME skew, A32 hallucination transmission | Arch item 4 (teacher text ≠ learning signal) and item 3 (only bounded compilation) consistent | None | Rune's 27Bs are plausibly distillates — their *teacher-conditioned* failure modes are unknown |
+| 12 | Teacher error disappears in distillation | FAILS | A32; 2506.07962 correlation logic applies teacher→student | Same as 11 | None | None |
+| 13 | Multi-teacher agreement proves truth | FAILS | 2506.07962: ~60% agreement when both err; correlated errors | Arch item 14 (execution = judge, consensus adds little) already correct | None | Rune's multi-teacher experiments never run at all — the claim is inherited, not local |
+| 14 | Different vendors = independent evidence | FAILS | Same correlation finding; also shared synthetic-data lineage (R1 distills into Qwen/Llama bases) | Item 14 stands | None | None |
+| 15 | Synthetic data = verified experience | FAILS | A30/A31 (collapse/mixing); arch item 4 requires outcome-verification of *contribution*, not generation | Synthetic data may feed *training* only after the same verification gates as external contribution | None | None |
+| 16 | More synthetic data always improves | FAILS | A30 recursive-collapse; A31 non-cumulative mixing requirement | None for arch | None | None |
+| 17 | Fine-tuning is natural Rune learning | PARTIAL | Arch item 6 ranks LoRA below procedure/retrieval and rejects full-FT; but "natural" hides that even LoRA needs data quality + regression gates Rune lacks (0 skills, 7 lessons) | The ladder's lower rungs are correct *and* currently hypothetical — the only exercised rung would be LoRA if someone reaches for it first | Sequence enforcement: no adapter training until procedure/retrieval forms are measured on the same delta | 16 GB VRAM shared with user apps makes training windows an availability question (#405) |
+| 18 | Every lesson should update weights | FAILS | Item 6 explicitly; 2405.09673 (adapters forget less ≠ nothing); DAgger wrong-distribution warning (arm 3) | None | None | None |
+| 19 | Weight learning preserves provenance | FAILS | Weights cannot carry per-example provenance; arch item 4 makes provenance a *data* gate precisely because weights can't | None | None | Adapter files themselves need model+digest stamping (same defect class as unversioned vectors — F5) |
+| 20 | Retrieval is inferior to parametric memory | FAILS | MemGPT (2310.08560) degradation result; arch item 10 puts retrieval in the no-model core | None | None | Rune's retrieval is functional but unmeasured (F14) |
+| 21 | Deterministic rules are always more reliable | FAILS | Rules are reliable *in-distribution*; edge cases are where they fail (2301.12726's in-dist/OOD asymmetry applies to code too). 152 modules ≠ correctness, just determinism | None — but the mirror risk is real: Rune may over-trust the deterministic layer because it's deterministic (see 50) | None | None |
+| 22 | Deterministic rules can replace open-ended cognition | FAILS | Inward §F: without models, ALL semantic interpretation dies. Rung 5 keeps state and execution alive, not cognition | None | None | None |
+| 23 | LLM reasoning is always compilable to code | FAILS | Item 3 scopes compilation to bounded classification/routing/extraction for exactly this reason | None | None | None |
+| 24 | Successful code generation proves internalization | FAILS | Item 3 requires regression fixtures + applicability + rollback precisely because one-shot success ≠ capability | None | None | None |
+| 25 | One-success skill should be promoted | FAILS | Item 5 requires ≥1 successful analogous reuse + hardening; Voyager gates on external verifier | None | None | Irony flag: item 5's gate has never run even once (0 skills) — a gate with n=0 usage is itself unvalidated (F2) |
+| 26 | Unit tests prove general reliability | FAILS | Tests prove behavior on covered paths; arch requires re-verification on environment change (item 5) | None | None | Rune's test coverage of its own 152 modules never audited |
+| 27 | Error recipes should always auto-retry | FAILS | Arch item 7: retry budget belongs to deterministic gate counters, not unconditional loops; Reflexion's cost caveat (arm 3) | None | None | None |
+| 28 | A previous successful recovery is forever applicable | FAILS | Item 5 deprecation-on-environment-change (Memp anchor 2508.06433) | None | None | None |
+| 29 | Model confidence is a routing authority | FAILS | Arm 1 established (self-confidence unreliable; 2408.03314 pass@1 bins + verifiers). Item 7 consistent | None | None | None |
+| 30 | Low confidence implies escalation | FAILS | Escalation signals are *external* (pass@1 bins, verifier availability, gate counters, disagreement) — confidence is neither necessary nor sufficient | None | None | None |
+| 31 | High confidence implies no escalation | FAILS | Same; hardest-bin refusal stands regardless of confidence | None | None | None |
+| 32 | Cheapest model first | FAILS | Cascade/routing REJECTED (no in-distribution labels; FrugalGPT = pricing artifact — actual FrugalGPT 2305.05176, corrected ledger above) | None | None | The 0.5B–14B Qwen ladder tempts exactly this; the log-don't-route policy is the guardrail |
+| 33 | Most expensive = most capable | FAILS | Gemma3 4B≈27B precedent; IQ2_M 27B may lose to 4-bit 14B on Rune's tasks (2504.04823 size-scaling measured at 3-bit, not 2-bit — the swap is plausible but unmeasured) | Item 13 must measure 27B-IQ2_M **against** 14B-Q4, not in isolation | Add explicit pair: 27B-IQ2_M vs qwen3:14b (or coder 14B) at 4-bit on identical Rune tasks | VRAM freed by retiring a 27B is itself a measurable benefit |
+| 34 | Provider outage = task failure | FAILS | Item 2 ladder + item 10 no-model mode | None | None | Ladder untested end-to-end (F-mechanism, see 97) |
+| 35 | Local OOM = task failure | PARTIAL | Ladder handles hard failure; but Ollama's actual OOM behavior is *silent* offload/queue/evict (A11–A13) — task doesn't fail, it *slowly degrades* | The ladder's rung detection misses the silent middle: model loaded on CPU, 0.5 tok/s, still "up" | Add a telemetry-derived rung between 1 and 2: "resource-starved" (GPU/CPU split from `ollama ps`, tok/s floor, ctx headroom) | Telemetry sampling design undefined |
+| 36 | No LLM = Rune dead | FAILS | Inward §F: state, memory, 152 modules, git survive; rung 5 is real — *communication* is the actual casualty, not operation | None | None | Rung 5 has no communication templates (F13) — operationally the attack is half-right today |
+| 37 | Template communication = conversation | FAILS | Arch: structured/declared, never generated prose — templates are an honest subset, not a claim of dialogue | None | None | Templates undesigned (F13) |
+| 38 | Offline status is inferable from network non-response | FAILS | Inward: embedding failure is SILENT (log-and-skip); silence ≠ status; arch item 10's probe-and-report exists because inference-from-absence fails | None | None | Probe-and-report unimplemented |
+| 39 | Registry declarations are always current | FAILS | Item 9 explicitly models declared/observed/stale with TTLs | None | None | Registry doesn't exist yet (F10) |
+| 40 | Provider model names = stable capabilities | FAILS | Item 9: same-name models change behavior both directions (e.g., Ollama tag re-pointing; llama.cpp quant format drift) | None | None | Rune pins nothing today — model IDs in config are mutable aliases |
+| 41 | Model versions interchangeable | FAILS | Item 9 + A2 (EAGLE-3 drafts are per-target-model artifacts — version drift breaks them silently) | None | None | None |
+| 42 | Model swap need not affect regression tests | FAILS | Item 9's stale/observed machinery + item 3's fixtures exist for exactly this | None | None | No regression fixtures exist to affect (F17) |
+| 43 | Same model, different quantization = same capability | FAILS | 2504.04823 head-to-head quant deltas; A34 | Item 13's per-task measurement must be *per quant file*, not per model family | Registry slug must include quant (e.g., `qwen3:14b@Q4_K_M` vs `@IQ2_M`) | Two 27B IQ2_M files — provenance of each unknown |
+| 44 | Local embeddings = intelligence | FAILS | Nomic Embed cloud-parity (2402.01613) is retrieval parity, not cognition; rung 5 keeps retrieval alive as *state access*, not thought | None | None | Unversioned vectors (F5) undermine even the retrieval claim |
+| 45 | Retrieval quality proves reasoning quality | FAILS | Orthogonal axes; 2506.07962 applies | None | None | None |
+| 46 | Rule extraction preserves edge cases | FAILS | 2301.12726: extracted/distilled rules are in-distribution artifacts; edges are exactly what falls out | Item 4's applicability conditions + OOD probes (arm 3's mirror of #382) | None | None |
+| 47 | Classifier calibration transfers across domains | PARTIAL | As an attack on compilation: calibration is domain-bound (2301.12726 OOD dynamics; 2504.04823's calibration-domain result is the quant analogue) | Arch item 3 already demands applicability conditions — attack lands only if those conditions are written as prose rather than tested predicates | Applicability conditions must be *executable predicates on inputs*, not descriptions | Rune has no compiled mechanism yet — this is preventive |
+| 48 | Classical ML always preferable for bounded tasks | FAILS | Arm 1: classical ML *owns bounded structured tasks* — "always preferable" overreaches; LLMs still win bounded tasks with high context diversity | Item 3's bounded scope consistent | None | None |
+| 49 | JEV kernels reproduce general reasoning | FAILS | Item 3: compiled ≠ open-ended cognition (explicitly rejected) | None | None | None |
+| 50 | Bounded classifiers trusted merely because deterministic | SUCCEEDS | Determinism ≠ correctness; an extraction classifier at 90% precision silently corrupts Memory on 10% of writes — worse than an obvious LLM failure the loop would catch. Arch item 3's regression fixtures guard *regression*, not *base error rate* | Compiled mechanisms need base-rate instrumentation (precision/recall on a live-sampled holdout), not just regression fixtures | Add: every compiled mechanism ships with a measured confusion matrix + a sampled-audit hook feeding the escalation counters | Rune's JSON-extraction failure rate is UNKNOWN (inward) — the exact base rate this attack demands is unmeasured |
+| 51 | Generated rules immediately become policy | FAILS | Item 4's pipeline (verify → applicability → baseline → candidate → measured) blocks it | None | None | 7 existing lessons pre-date the pipeline — their status under the new gate is undefined (F15-adjacent) |
+| 52 | Self-modification improving benchmark = safe | FAILS | Item 12: Growth Delta = analogous-task measured improvement, not benchmark; A17/A37 benchmark-runtime gap | None | None | None |
+| 53 | Benchmark improvement = Growth Delta | FAILS | Item 12 definition is analogous-task before/after | None | None | The instrument to distinguish them (per-lesson counterfactual measurement) was never built — the two are operationally indistinguishable today (F15) |
+| 54 | Frontier-dependency reduction = automatic improvement | FAILS | Item 2's ladder is a *degradation* policy, not a quality goal; item 5/12 gate on measured improvement | None | None | None |
+| 55 | Offline independence worth any quality loss | SUCCEEDS | No element states the trade price. Combined with 5, the architecture can silently become "worse but local" without a decision point | The independence/quality trade is the single biggest unowned policy dial in the architecture | Define an explicit, owner-visible threshold: e.g., "if local tier pass@1 on active task classes < X% of frontier tier for N consecutive measurements, surface the trade to the owner" | The right X is a policy decision, not a research output — must be escalated, not set here |
+| 56 | Hardware ownership = operational independence | FAILS | 62 GB RAM/16 GB VRAM ≠ power, storage durability, OS updates, driver rot (Ollama version drift is itself a behavior change — A13/A14 issue tracker) | Item 1's "model-independent mind" needs an operations dependency list too | Add ops-level dependencies (Ollama version pinning, driver state, disk for model cache) to the registry | #405 owns hardware — boundary respected |
+| 57 | Open-source model = supply-chain safety | FAILS | Item 11: weights are untrusted binaries; community quants add a *second* untrusted layer (who ran the imatrix?) | None | None | None |
+| 58 | Local model files cannot be malicious | FAILS | Pickle-based adapters, trojaned weights literature; item 11 explicit | None | None | Rune's 11 model files' provenance (source repo, checksum) unrecorded |
+| 59 | Running locally = no data leak | FAILS | Item 11: logs/caches/swap/telemetry; also Ollama pulls models over HTTPS (A-faq proxy docs) — egress path exists | None | None | None |
+| 60 | Model adapters harmless | FAILS | Adapters execute with the base's privileges; ONNX multi-LoRA (A7) shows adapters are a serving feature = an attack surface | Item 11 extends to adapters | Adapters get the same provenance/checksum/staging treatment as models | None |
+| 61 | Imported LoRAs inherit base trust | FAILS | An adapter can*not* be more trusted than its base, and can be *less* (trained on poisoned data); trust is min(base, adapter) | None | None | None |
+| 62 | Local inference should have filesystem access for convenience | FAILS | Item 11 (untrusted semantic component) forbids exactly this; #405 owns isolation mechanics | None | None | Today Ollama itself is sandboxed by the OS, not by Rune policy — the policy layer is the fix |
+| 63 | Local workers share Main credentials | FAILS | Element 11 + #405 isolation mandate | None | None | Current state: 152 modules share the Rune process/user — a real current exposure to flag |
+| 64 | Internet loss triggers broad autonomous retraining | PARTIAL | Arch is silent on outage-behavior policy for the learning loop; DAgger warns retraining on own-distribution data entrenches errors (arm 3); an outage is precisely when Rune's self-generated state distribution is worst | Without an explicit prohibition, "we're offline, let's consolidate lessons/retrain on backlog" is a plausible autonomous act that violates item 4's external-verification requirement at scale | Add an explicit governance clause: learning pipelines require external verification availability; outage ⇒ learning PAUSED, not accelerated | None |
+| 65 | Idle GPU always used for background cognition | SUCCEEDS | Arch has no background-cognition scheduler (inward: ABSENT); "idle" on a *shared* card is a fiction — 5.4 GB user-app baseline + gaming spikes; Ollama will evict/offload silently (A11–A13) | Any background-cognition design that treats idle GPU as free compute will contend with the user and degrade invisibly | Background cognition must be (a) budgeted (time + VRAM ceiling), (b) preemption-aware, (c) telemetry-reported; and #405 must own the VRAM partition policy | Nothing in R1 prevents a cron from deciding the GPU is "idle" |
+| 66 | Timer expiry justifies inference | PARTIAL | Cron-based consolidation/curator exist and need LLM (inward); nothing ties timer firing to a *value* test — timer expiry is a schedule fact, not a work justification | Outage-adjacent waste + contention; unmeasured consolidation quality (F14) makes the cron's value unknown | Cron jobs acquire an LLM lease only if (registry healthy ∧ budget available ∧ job's quality metric instrumented); else defer to rung-5 mechanical mode | Consolidation value never A/B'd — the value test has no metric yet |
+| 67 | Cached answer gains authority through repetition | FAILS | Item 4 provenance + item 10 per-write model+digest | None | None | Memory dedup/curator may *amplify* repeated claims — curator logic never audited for source-count weighting |
+| 68 | A frequent skill becomes truer | FAILS | Item 5: no popularity promotion | None | None | Gate unexercised (0 skills) — F2 |
+| 69 | More model diversity always improves | FAILS | 2506.07962 correlated errors; diversity without independence is decoration; 11 models ≠ 11 independent judges | Item 14 consistent | None | None |
+| 70 | Ensemble majority vote = evidence | FAILS | Same; vote ≠ corroboration when errors correlate | None | None | None |
+| 71 | Local disagreement resolved by strongest model | PARTIAL | "Strongest" is not observable locally without exactly the measurement Rune lacks; but item 7's disagreement *counter* is an escalation signal, and escalating to the most capable *available verified* model is consistent with the ladder | The attack's resolution mechanism is wrong; its observation (disagreement needs a tiebreak policy) is valid | Disagreement → escalation per item 7, never "ask the biggest model"; the tiebreak must be the verifier or the owner, not a size heuristic | None |
+| 72 | Frontier answer overwrites local knowledge | FAILS | Item 4: teacher text ≠ learning signal; frontier output enters as *candidate external contribution* with verification | None | None | Practice bypass (F11) means frontier answers are consumed today with no such gate |
+| 73 | New model reinterprets all historical Memory automatically | PARTIAL (design absorbs the attack; current implementation would fall to it) | Design: item 10's per-write model+digest + item 9's slug discipline prevent silent reinterpretation. Current state: 118k chunks have NO embedding-model column (inward) — swapping embedders WOULD silently re-interpret the entire retrieval space | This is the sharpest design-vs-implementation divergence in the architecture | Migration debt: stamp existing vectors (or quarantine + re-embed with recorded model), BEFORE wiring qwen3-embedding | Retroactive stamping of 118k chunks is a one-time mechanical job — cheap, must be scheduled |
+| 74 | Model retirement destroys its knowledge | PARTIAL | Design: knowledge lives in Memory/skills (model-independent). But *retrieval* is embedding-model-coupled: retiring an embedder without re-embedding orphans the vector index (same mechanism as 73) | Retirement runbook must include re-embedding or dual-index transition | Add "embedder retirement ⇒ re-embed before decommission" to the registry lifecycle | Re-embed cost for 118k chunks on local embedder: hours — schedule, not crisis |
+| 75 | Historical weights preserved forever | PARTIAL | Disk is finite (55 GB today); no retention policy exists; old model files + old adapters accumulate silently | Storage exhaustion is a slow availability failure the ladder doesn't see | Registry lifecycle adds: retention policy for retired model files/adapters, with checksummed archive-or-delete | #405 boundary on storage numbers |
+| 76 | Every external contribution becomes training data | FAILS | Item 4's gate sequence blocks it | None | None | None |
+| 77 | Training examples need no provenance | FAILS | Item 4 provenance gate; 19 above | None | None | None |
+| 78 | Distillation makes teacher provenance irrelevant | FAILS | A32: teacher errors propagate — provenance is *more* important post-distillation (error attribution) | None | None | None |
+| 79 | Generated classifier self-certifies with own examples | FAILS | Item 3 requires independent regression fixtures; 50 above adds base-rate audit | None | None | No fixtures exist yet — preventive only |
+| 80 | A local benchmark suite proves general reliability | FAILS | A17/A37: suite is task-class-specific; arch item 12 requires analogous-task measurement per class | None | None | Rune has NO local suite at all — first suite must be built before this attack even becomes tempting |
+| 81 | Offline Rune should emulate human consciousness | FAILS | Out of scope; arch is functionalist (memory+state+policies) | None | None | None |
+| 82 | Model independence means models unimportant | PARTIAL | Item 1 says "models = replaceable providers" — true architecturally, false operationally: model choice still dominates task quality *today* (unmeasured menu, A19 vacuum), and swaps have real costs (73/74) | The slogan needs a caveat: replaceable *in the long run*, decisive *in the short run*; registry + per-task measurement is what makes replacement safe | Amend item 1: "models are replaceable *resources with measured per-task envelopes*; replacement is a gated event, not a hot-swap" | None |
+| 83 | Deterministic systems cannot be intelligent | FAILS | Irrelevant to arch (no claim either way); item 3 deliberately limits compiled mechanisms, which is the only near-claim | None | None | None |
+| 84 | LLMs are the only creativity source | FAILS | Arch makes no such claim; phi-4-style synthetic pipelines (A27) show bounded generation suffices for targeted novelty | None | None | None |
+| 85 | Learned local policies own goals | FAILS | CoALA: control in code; goals are Rune's, policies are executed | None | None | None |
+| 86 | Local intelligence owns canonical Memory | FAILS | Memory is model-independent state (inward §F — strongest finding); models are clients | None | None | None |
+| 87 | Local model owns persona | FAILS | Persona = policy/state, not model property (item 1); also protects against model-swap persona drift | None | None | Persona layer itself undesigned anywhere — flag as scope gap, not architecture failure |
+| 88 | Local model owns task-completion state | FAILS | Task/resume state is SQLite, model-independent (inward) | None | None | None |
+| 89 | Local routing overrides governance | FAILS | No routing exists (item 8) to override anything; governance is code-level (CoALA) | None | None | The inverse is the real risk: governance-by-omission (config default IS routing — F18) |
+| 90 | Provider fallback can change user intent | FAILS | Ladder degrades *capability*, declared via templates; intent lives in task state | None | None | Template undesigned (F13) |
+| 91 | Reduced inference cost proves internalization | FAILS | Item 12: measured analogous-task improvement, not cost savings; cost is a side benefit | None | None | None |
+| 92 | Faster response proves Growth Delta | FAILS | Same; latency ≠ capability | None | None | None |
+| 93 | Smaller model matching one benchmark has replaced teacher | FAILS | A17/A37 single-benchmark fallacy; 2301.12726 OOD collapse | None | None | None |
+| 94 | Copied teacher answer = learned skill | FAILS | Item 4 (teacher text ≠ learning signal); GKD off-policy mismatch (arm 1) | None | None | None |
+| 95 | Replaying old successful plan = reasoning | FAILS | Item 5 re-verification on environment change; Memp deprecation | None | None | None |
+| 96 | Generalization assumed from repeated success | FAILS | 2301.12726: in-dist success does not predict OOD; item 5 requires analogous reuse + environment-change re-verification | None | None | None |
+| 97 | No-model degraded mode need not be tested | FAILS | The attack is absurd as stated — and yet: inward §I shows rung 5's components have never been exercised as a *mode*, only as coincidental daily paths; communication templates ABSENT; embedding silent-fail active | The architecture's most distinctive claim (never FULL→DEAD) currently rests on untested integration. A degradation drill is mandatory, not optional | Quarterly (or event-triggered) chaos drill: kill Ollama, exercise rung 5 end-to-end incl. template output, verify no silent vector loss, record results in a fixture | The drill itself will surface unknown unknowns — schedule before any architecture sign-off |
+| 98 | Offline recovery postponed until frontier fails | FAILS | Item 2 ladder is proactive (health-verified), not failover-reactive | None | None | Current practice is exactly reactive (ad-hoc frontier use) — see 4/F11 |
+| 99 | #404 decides final GPU hardware | FAILS | Hardware topology → #405 (mandate boundary) | None | None | None |
+| 100 | #404 runs the final intelligence benchmark | FAILS | Evaluation → #406; #404 contributes *instruments* (difficulty bins, local task suite) not verdicts | None | None | None |
+
+## B.2 Rune-specific attacks F1–F18 (from the ACTUAL inward evidence)
+
+| ID | Attack (grounded in inward state) | Verdict | Evidence | Consequence | Correction | Residual |
+|---|---|---|---|---|---|---|
+| F1 | "11 Ollama models but nothing routes to them" — the ladder's rung 1 (full local) presumes *selection* capability that does not exist; capability registry (item 9) is a prerequisite of rung 1, not an accessory | SUCCEEDS | Inward: config registers ONE 27B tool model by default; 10 other models are inventory, not capability. A degradation ladder whose top rung is "full local" is a fiction when "full" means "whichever model the config default names" | Rung 1 cannot be entered intentionally — only accidentally | Re-sequence: registry-with-observed-truth (item 9) is a **blocking dependency** for the whole ladder, not a parallel workstream; rung 1 entry requires a registry lookup | Registry probing design (which probes, what cadence) undefined |
+| F2 | Skill library empty with 0 measured deltas — item 5's promotion criteria have never executed at n=1 | PARTIAL | Inward: lifecycle designed (observed→drafted→trusted→executable, ≥2-success gate), zero entries ever | A promotion gate with zero activations is itself unvalidated: its first activation may be miscalibrated, and nobody will notice because no delta measurement exists either | First skill promotion must be treated as an *experiment* (instrument the gate's decisions, compare gate-accepted vs gate-rejected downstream outcomes) | Voyager-style external-verifier gating (arm 3) maps cleanly onto Rune's gate — the mapping is untested |
+| F3 | Only 7 lessons — item 4's outcome-grounded assimilation has an evidence base of n=7, and per-lesson counterfactual measurement has never been built | SUCCEEDS | Inward: 7 chunks, Reflexion-style; growth_delta machinery designed, never demonstrated | The architecture's most novel claim (counterfactual per-lesson measurement, "literature is open-loop") is entirely unfunded: it is the load-bearing wall with zero implementation | Build the counterfactual instrument FIRST (smallest version: for each lesson, an A/B on ≥2 analogous tasks with/without lesson in context) — without it items 4, 5, 12 are all unverifiable simultaneously | Counterfactual design open in ALL literature (mandate) — Rune would be first; expect the first design to be wrong |
+| F4 | Silent embedding degradation — item 10 claims an architectural fix, but the *existing* fix-path (qwen3-embedding swap path "exists as designed") was never executed — fix paths rot when unexecuted | PARTIAL | Inward §D: EMBED_MODEL default unchanged; silent log-and-skip on Ollama-down confirmed | "Architecturally fixed" ≠ fixed; every fix in the ladder needs a test that fails today and passes after implementation | Probe-and-report must ship with an invariant test (write-with-model-down ⇒ entry quarantined or re-queued, NEVER silently vectorless) | Same rot-risk applies to every rung transition — see F-mechanism 97 |
+| F5 | Unversioned embedding vectors (118k chunks, no model column) — item 10's per-write model+digest is not retroactive | SUCCEEDS | Inward §D; carried #403 defect confirmed | The entire retrieval substrate is one embedder-swap away from silent semantic reinterpretation (also mandated attack 73) | Stamp-or-quarantine migration for existing vectors BEFORE any embedder change; per-write stamping thereafter | One-time mechanical job; needs disk + compute budget (#405) |
+| F6 | qwen3-embedding:0.6b installed-but-unwired — item 1 says models = replaceable resources, but an *unwired resource is not a capability*; the declared/observed gap starts inside Rune's own model menu | SUCCEEDS | Inward §D (DORMANT) | "Installed" inflates perceived capability exactly as vendor model cards do (same truth-class failure as item 9's declared vs observed) | The registry must list local models with the SAME declared/observed/stale machinery — installed-but-never-probed = declared-only | Probe design: generation health was never tested read-only (inward UNKNOWN) — first probes must be chosen carefully |
+| F7 | 27B IQ2_M unmeasured on Rune tasks yet occupies 11 GB of a shared 16 GB card — item 13 keeps it "pending measurement" indefinitely at real opportunity cost | PARTIAL | Inward §A/H; 2504.04823 (below every tested floor); A33 | Every day unmeasured, the default model is the least-validated asset in the stack AND blocks VRAM a 4-bit 14B or an MoE (A21) could use | Time-box the measurement: the 27B-vs-14B-Q4 pair (mandated attack 33's correction) is a bounded experiment, not open-ended research; if unmeasured by the box, the 27B loses its default slot | VRAM accounting with user apps belongs to #405 — this arm only flags the cost |
+| F8 | 16 GB VRAM shared with user gaming/coding — the ladder models degradation as capability tiers, but the shared card produces a state the ladder lacks: **model present but resource-starved** (silent CPU offload, ctx multiplication, eviction) | SUCCEEDS | A11–A13 (Ollama silent offload/queue/evict); inward §H contention | The most *likely* daily degradation is not on any rung: it's a 27B silently half-on-CPU at 2 tok/s while a game runs — "up" by API, dead by usability | Insert rung 1.5 "resource-starved" driven by telemetry (GPU/CPU split, tok/s floor, KV headroom), with declared status and automatic rung demotion | Telemetry sampling interval vs contention burstiness unresolved |
+| F9 | 152 deterministic modules are an ACCIDENTAL fallback — item 2 rung 5 asserts "modules+SQLite+retrieval+skills work", but no module was designed as a no-model tier and nobody knows which of the 152 are no-model-safe | PARTIAL | Inward §C/§I: "accident of architecture rather than design"; §I lists what works but was derived by inspection, not by contract | Rung 5's integrity depends on an unaudited module inventory; one module that quietly shells out to Ollama breaks the rung's guarantee | Audit all 152 modules for model/Ollama dependencies; tag each `NO_MODEL_SAFE` / `NEEDS_MODEL`; make the tag a registry fact | Some modules may have *optional* LLM paths — three-state tagging needed |
+| F10 | No capability registry — item 9's declared/observed/stale machinery is fully designed and fully absent; escalation (item 7) needs verifier-availability knowledge that only the registry can provide | PARTIAL | Inward ABSENT: "capability registry with observed truth" | Item 7 cannot fire correctly without item 9; sequencing failure makes escalation's inputs guessed | Build a minimal registry first (slug, quant, declared caps, probe results, TTL) — it is the smallest component that unblocks ladder + escalation + item 13's measurements | Probe results need storage and drift detection — design exists in item 9, execution budgeted nowhere |
+| F11 | Ad-hoc frontier use bypassing any policy — item 8's "log (query, model, outcome) instead" has no enforcement mechanism, and current practice already bypasses | SUCCEEDS | Inward BYPASS: frontier providers used ad-hoc per session; CONFLICTING local-first-vs-frontier state | The label corpus item 8 needs is being censored by selection bias *now*: frontier calls (the most valuable labels) are exactly the unlogged ones | All model calls — local and frontier — through one logged gateway; make unlogged calls a detectable invariant (provider audit vs log) | None — enforcement is code, not policy |
+| F12 | Consolidation/curator crons NEED the LLM — background services are a single point of failure the ladder's rung 5 doesn't cover (it covers task continuation, not background cognition) | SUCCEEDS | Inward §G: several crons require LLM/Ollama; silent embed failure hits them | On model loss, memory *hygiene* stops silently: new entries without vectors, unconsolidated backlog — the archive decays exactly when the system is degraded | Define a mechanical-only consolidation rung (mechanical ops only — consistent with R0 prior finding: no A/B evidence local LLM consolidation matches cloud) + declared status for background services | Consolidation value itself unmeasured (F14) — the mechanical rung might be *better*, which nobody would know |
+| F13 | No degraded-communication templates exist — rung 5's "structured/declared status, never generated prose" is undesigned; the refusal rung has no user-facing form | SUCCEEDS | Inward ABSENT: "no-model communication templates"; degraded communication = exit codes only | At the moment of maximum degradation, Rune's only output channel is undeclared file/exit-code conventions the user may not parse | Design the template family NOW (it's pure code, no model needed): status blocks, refusal-with-reason, degraded-capability manifest, task-state handoff | Template set must be tested in the F97/F97-drill, not just written |
+| F14 | Consolidation quality never A/B'd — any future move of consolidation local (or to mechanical ops, F12) has no measurement instrument to compare against | PARTIAL | Inward: consolidation runs cloud-side implicitly; no A/B anywhere | Item 12's analogous-task A/B discipline exists for *lessons* but not for *memory operations* — a double standard in the architecture's own epistemics | Extend the A/B instrument to memory operations: consolidation-on vs consolidation-off (and local vs cloud) on tracked retrieval-quality and downstream-task metrics | Retrieval-quality metric itself undefined (F15-adjacent) |
+| F15 | Per-lesson counterfactual measurement never built — items 4, 5, and 12 all terminate in "MEASURED improvement", which cannot exist without this one unbuilt instrument | SUCCEEDS | Inward ABSENT: "measured Growth Delta evidence"; mandate confirms literature is open-loop | This is the single sharpest finding: the architecture's learning story (4), promotion story (5), and growth story (12) share ONE load-bearing instrument that has zero lines of code | The counterfactual instrument is the critical path for the whole learning architecture — build and validate it on the 7 existing lessons before any new lesson is accepted | First-version design risk (see F3); false-positive "improvement" from task variance needs multiple seeds/trials — cost must be bounded |
+| F16 | Generation health of installed models UNKNOWN (read-only discipline skipped probes) — item 9's "observed (probed)" tier has never been exercised even once | PARTIAL | Inward UNKNOWN: generation health; inward: capability truth DECLARED-only | The registry's core epistemic move (declared→observed) is itself unproven; probing quantized models can itself be misleading (one probe ≠ task envelope) | Define the probe battery: generation smoke test + bounded task-class probes + latency/throughput capture; run at registry admission and TTL | Probe-vs-envelope gap remains (probes are cheap truth, envelopes are expensive truth) |
+| F17 | JSON-extraction failure rate unknown (mandate-acknowledged gap) — item 3's compilation targets (extraction/classifiers) have no baseline failure measurement to compare compiled-vs-uncompiled | PARTIAL | Inward UNKNOWN: real JSON-extraction failure rate; A3 (runtime constraint support is fine — the gap is model-layer quality) | Without the baseline, "compiled mechanism improves reliability" (item 3's promise) is unfalsifiable in both directions | Measure baseline extraction failure rates per model × task class FIRST — this is also the cheapest possible entry into the label corpus item 8 wants | Structured-output constraint layers (A3/A5/A8) may mask model-layer failure as valid-JSON-wrong-content — the instrument must check content, not just parseability |
+| F18 | One 27B loaded by default in provider config (`tools: true`) — the architecture's "no routing policy" claim is false in practice: there IS routing, it's accidental (config default) | SUCCEEDS | Inward §B: live config registers only local Ollama endpoint, one 27B, tools:true | "Accidental routing" has no governance, no logging, no registry — it is the anti-pattern items 7–9 exist to replace, currently live | Acknowledge the de-facto router (config default) as a governed object: its selection must come from the registry, be logged, and be reviewed — until then it should be *declared* as the current policy explicitly | Resolves the inward CONFLICTING classification once declared |
+
+## B.3 Mechanical verdict counts
+
+| Verdict | Mandated 1–100 | Rune-specific F1–F18 | Total |
+|---|---|---|---|
+| SUCCEEDS | 4 (5, 50, 55, 65) | 10 (F1, F3, F5, F6, F8, F11, F12, F13, F15, F18) | **14** |
+| PARTIAL | 12 (2, 4, 17, 35, 47, 64, 66, 71, 73, 74, 75, 82) | 8 (F2, F4, F7, F9, F10, F14, F16, F17) | **20** |
+| FAILS | 84 | 0 | **84** |
+| **Sum check** | 4+12+84 = **100** ✓ | 10+8+0 = **18** ✓ | **118** ✓ |
+
+_Reading the distribution honestly:_ the 84 FAILS are dominated by strawman attacks the architecture was explicitly built to absorb (confidence routing, consensus-as-truth, benchmark-as-proof, weight-provenance myths) — that is *confirmatory*, not flattering. The 34 non-FAILS cluster into five coherent damage sites, listed below.
+
+## B.4 The five sharpest findings + forced corrections
+
+1. **The ladder has a missing rung: resource-starvation (F8, attack 35).** Ollama's real failure signature on a shared 16 GB card is not up/down — it is silent CPU-offload, silent context truncation (open upstream issue), 5-minute eviction, and quadratic context-concurrency multiplication. The architecture's rungs defined over capability availability will read "full local" while the system serves a half-offloaded, silently truncating model. **Forced correction:** define rungs over *measured telemetry* (GPU/CPU split, tok/s floor, ctx allocated/used, KV headroom) and insert a "resource-starved" rung between 1 and 2; status must be measured, not merely declared.
+
+2. **One unbuilt instrument is the load-bearing wall for three architecture elements (F15, F3, attacks 53/79/80).** Per-lesson counterfactual measurement is the shared terminator of items 4 (assimilation), 5 (promotion), and 12 (Growth Delta) — and it has zero implementation, zero validated design, and no measurement of the 7 existing lessons. Until it exists, "MEASURED improvement" is a noun without a referent, and item 12 is indistinguishable from the benchmark-worship attack 53 refutes. **Forced correction:** counterfactual instrument = critical path; first validate it by A/B'ing the 7 existing lessons before admitting any new lesson.
+
+3. **The registry is a prerequisite, not a component (F1, F6, F10, F16, F18).** Five separate attacks converge: rung 1 can't be entered (no selection), installed-but-unwired inflates capability, escalation has no inputs, "observed truth" has never been exercised, and a config default is doing ungoverned routing today. **Forced correction:** re-sequence the architecture — minimal registry (slug+quant+declared caps+probe+TTL) and a single logged gateway for ALL calls (local and frontier) block everything else; the de-facto 27B default must be explicitly declared as current policy until superseded.
+
+4. **Rung 5 (no-model mode) is asserted, never exercised as a mode — and its communication layer doesn't exist (F9, F12, F13, attack 97).** 152 modules are an accidental fallback with unaudited model dependencies; crons silently stop memory hygiene; there are no degraded-communication templates. The architecture's most distinctive claim — never FULL→DEAD — is currently an integration claim resting on untested paths. **Forced correction:** module audit with `NO_MODEL_SAFE` tagging; mechanical-only background-ops rung; template family designed AND exercised in a scheduled chaos drill (kill Ollama, run end-to-end).
+
+5. **The independence/quality trade is unowned (attacks 5, 55, 2; F7).** Local-first is baked in as an ordering without a price: the ≤14B agentic vacuum (A19) and IQ2_M-below-floor (2504.04823) mean "local tier" quality on Rune's actual task classes is unknown while its independence value is also unquantified — the trade is being made by default, invisibly. **Forced correction:** declare local-first as a policy choice with an explicit owner-visible revisit trigger (measured local-vs-frontier pass@1 gap on active task classes), and time-box the 27B IQ2_M measurement (vs 14B-Q4 pair) — the default slot is currently occupied by the least-validated asset in the stack.
+
+### Residual risks this arm could not close
+- Imatrix/calibration provenance and checksums of the two installed 27B IQ2_M files (extractable from GGUF metadata — unverified here).
+- Generation health of all 11 models (no probe run, read-only discipline).
+- The right independence-vs-quality threshold is an owner policy decision, deliberately not set here (#406 boundary for evaluation instruments, #405 for hardware).
+- Ollama version drift as a behavior change is real (A13/A14) but its management belongs to ops/#405.
+
+**Verification statement:** all arXiv IDs in this file re-verified this session (abs-page title resolution + Semantic Scholar after export-API rate limits); 1 new mis-pairing caught (FrugalGPT = 2305.05176, NOT 2305.09658) added to the cross-arm ledger (total 17 across arms 1–4). Part A depths: DOCUMENTATION_AUDITED for all runtime/vendor docs (verbatim reads), parsed leaderboard data for A19, COMMUNITY_EVIDENCE_RELIABILITY_LABELED for issue-tracker items; papers ABSTRACT_ONLY/METADATA or INHERITED_VERIFIED from arms 1–3 with their deeper reads credited.

research/memory-atlas-r1/AC-local-offline-intelligence/03_applicability.md

@@ -0,0 +1,66 @@
+# #404 AC — Applicability (mechanisms tested against Rune's inward reality, 2026-09-22)
+
+| # | Mechanism | Verdict | Rationale |
+|---|---|---|---|
+| 1 | ★ Model-as-resource: models replaceable; state/model-independent | ADOPT | inward F: state genuinely survives any model loss; CoALA RS |
+| 2 | ★ Six-rung degradation ladder FULL→DEGRADED never DEAD | ADOPT | Apple RS (request-tiered + hard refusal); inward accidental no-model mode |
+| 3 | ★ Structured/declared status, never generated | ADOPT | status path must not depend on the down component (arm 2) |
+| 4 | ★ Capability compilation for bounded tasks (classification/routing/extraction/validation) | ADOPT | FrugalGPT RS (scorer-label requirement); classical-ML evidence; 152 modules already |
+| 5 | ★ Compiled mechanisms need regression fixtures + applicability + rollback | ADOPT | E6; silent case loss is the failure mode |
+| 6 | ★ Outcome-grounded assimilation pipeline (provenance→verified outcome→measured improvement→promotion) | ADOPT | WebRL outcome evidence; DAgger FULL_PAPER; per-lesson measurement is Rune-novel |
+| 7 | ★ Per-lesson counterfactual measurement ([OVL-0]) | ADOPT (build first) | arm 4 forced correction 2: unbuilt load-bearing wall |
+| 8 | ★ Skill promotion criteria (execution-verified + ≥1 analogous reuse + hardening + re-verification) | ADOPT | Voyager FULL_PAPER; Memp RS (deprecation) |
+| 9 | ★ Skill deprecation on environment change | ADOPT | Voyager's documented gap; Memp regimen |
+| 10 | Learning-form hierarchy: procedure > retrieval > adapter > weight-edit | ADOPT | LoRA RS; RippleEdits |
+| 11 | Adapters as the safe local-finetune form (if ever used) | ADOPT | LoRA-learns-less-forgets-less RS; orthogonal accumulation |
+| 12 | Full-FT / weight-editing | REJECT | forgetting; edits fail logical propagation |
+| 13 | ★ Escalation by pass@1 difficulty bins + verifier availability + gate counters | ADOPT | Snell RS (bins, >4× efficiency; hardest bin yields nothing) |
+| 14 | Raw confidence / self-critique as escalation triggers | REJECT | calibration evidence; #400 carry |
+| 15 | Hardest-bin refuse-and-report | ADOPT | Snell: no method makes meaningful progress |
+| 16 | ★ ONE logged gateway for all model calls (log query/model/outcome) | ADOPT (build first) | arm 4 forced correction 3: prerequisite for everything |
+| 17 | Cascade/routing policy now | REJECT | FrugalGPT RS (pricing artifact; scorer needs in-distribution labels); #383 carry |
+| 18 | Speculative decoding | ADOPT (needs llama.cpp/vLLM) | only lossless adaptive-compute win; Ollama MTP-only (arm 4) |
+| 19 | ★ Capability registry (canonical slug, declared/probed/observed/stale, TTL) | ADOPT (build first) | OpenRouter/MCP docs; ChatGPT-drift 2307.09009 |
+| 20 | Runtime capability probing | ADOPT | declared ≠ observed; staleness undetectable today |
+| 21 | ★ No-model mode exercised by scheduled chaos drill | ADOPT | arm 4 forced correction 4: asserted but never exercised |
+| 22 | ★ NO_MODEL_SAFE module tagging (152 modules audited) | ADOPT | no-model inventory exists only by accident |
+| 23 | ★ Degraded-communication templates | ADOPT | no templates exist; templates ≠ conversation (F-claim) |
+| 24 | ★ Embedding probe-and-report + retrieval-fallback rung + per-write model+digest | ADOPT | silent degradation is the inward defect; Ollama truncation open upstream |
+| 25 | Embedding-model migration (nomic → qwen3-embedding:0.6b) | EXPERIMENT | installed-but-unwired; full re-embed required; version-stamping first |
+| 26 | Local model as untrusted semantic component (sandboxing) | ADOPT | #402 carry; local ≠ trusted |
+| 27 | Model supply-chain hygiene (weights/adapters/tokenizers) | ADOPT | arm 4; local ≠ safe |
+| 28 | Local ≠ private (logs/caches/swap) | ADOPT | #402 carry |
+| 29 | Multi-teacher consensus as verification | REJECT | 2506.07962 (~60% agreement when both err; correlation rises with capability) |
+| 30 | Multi-teacher as candidate generators + execution judge | ADOPT | same evidence, inverted use |
+| 31 | Distillation/adapter training as T1 mechanism | REJECT | 2301.12726 RS; R1 §F; Rune corpus n≈944 (data-scale mismatch) |
+| 32 | Bounded distillation revisit at ≥100s verified labels for a class | FUTURE | C015 condition |
+| 33 | Classical ML for bounded structured tasks | ADOPT | XGBoost 0.87 vs GPT-4 0.43 tabular |
+| 34 | LLM as classifier over structured data | REJECT | same evidence |
+| 35 | 27B IQ2_M as default | EXPERIMENT | unmeasured; 4-bit weight-only = evidenced floor for reasoning |
+| 36 | Time-boxed 27B-vs-14B-Q4 local measurement | ADOPT | arm 4 forced correction 5 |
+| 37 | 4-bit weight-only as reasoning floor | ADOPT | 2504.04823 RS |
+| 38 | 2-bit / ternary without calibration work | REJECT | calibration-sensitivity evidence |
+| 39 | Foreground-preemption for background inference | ADOPT | 16GB shared with user apps |
+| 40 | Idle GPU = license to infer | REJECT | timer ≠ cognition warrant (carried invariant) |
+| 41 | Event-driven background work (index/maintenance/integrity) | ADOPT | always-available ≠ always-running-LLM |
+| 42 | Semantic/prompt/KV caching | ADOPT | cache ≠ authority; invalidation on source/model/policy/correction |
+| 43 | Cache repetition → authority | REJECT | F-claim; repetition is not evidence |
+| 44 | Structured output for extraction only (grammar-constrained) | ADOPT | constraint tax (19.7→11.0% at ≤2B) |
+| 45 | Grammar-constrained reasoning | REJECT | 2408.02442 + constraint-tax evidence |
+| 46 | Local embeddings as intelligence | REJECT | embeddings ≠ cognition |
+| 47 | Retrieval quality as reasoning proof | REJECT | distinct capabilities |
+| 48 | Rule extraction / symbolic compilation preserving edge cases | REJECT (as universal) | extraction loses edge cases (arm 3) |
+| 49 | Bounded classifier promotion with held-out test + calibration | ADOPT | arm 3 verdict (a) |
+| 50 | Bounded classifier trusted because deterministic | REJECT | determinism ≠ correctness |
+| 51 | Generated rules → policy immediately | REJECT | promotion gate required |
+| 52 | Self-modification improving a benchmark = safe | REJECT | governance required |
+| 53 | Benchmark improvement = Growth Delta | REJECT | #399/#400 carry |
+| 54 | Offline independence worth any quality loss | REJECT | trade must be explicit; revisit trigger |
+| 55 | Hardware ownership = operational independence | REJECT | ownership ≠ independence |
+| 56 | Open-source = supply-chain safe | REJECT | arm 4 evidence |
+| 57 | Offline Rune emulating consciousness | REJECT | out of scope, no evidence |
+| 58 | Deterministic systems cannot be intelligent | REJECT | 152 modules are the actual capability layer |
+| 59 | JEV kernels reproducing general reasoning | REJECT | bounded kernels only |
+| 60 | POST_R1_PIPELINE_UPGRADE (STORM/Co-STORM OUTWARD) | PARK | mandate §61; comparability preserved |
+
+Row-derived: ADOPT 33 · ADAPT 0 · EXPERIMENT 2 · FUTURE 1 · REJECT 23 · PARK 1 · Sum 60. ★ = build-precondition / follow-through (14).

research/memory-atlas-r1/AC-local-offline-intelligence/04_innovation.md

@@ -0,0 +1,26 @@
+# #404 AC — Innovation (no manufactured novelty; each candidate derives from arm evidence)
+
+Candidates A–T (20). Each: prior art / evidence / threat model / falsifier / kill criterion.
+
+- **A. Model-independence contract** (explicit state-ownership: Memory/state/modules/skills/policies are Rune; models are resources). Prior: #399 carry; CoALA procedural-memory. Evidence: inward F. Falsifier: capability unrecoverable in any alternative form. Kill: E4 identity drift on swap. → ADOPT.
+- **B. Degradation ladder with telemetry-defined rungs** (availability AND resource-starvation defined; status structured). Prior: Apple RS; #394 carry. Evidence: arm 4 forced correction 1. Falsifier: ladder rungs never distinguished in practice. Kill: E3 state loss. → ADOPT.
+- **C. One logged model gateway** (all calls through a single component that logs query/model/outcome and enforces the registry). Prior: arm 4 correction 3; OpenRouter/MCP capability patterns. Evidence: ad-hoc bypass today. Falsifier: gateway never consulted. Kill: ungoverned call traced to Rune. → ADOPT (build first).
+- **D. Minimal capability registry with TTL + probe** (canonical slug; declared/probed/observed/stale/degraded). Prior: OpenRouter Models API; MCP ttlMs. Evidence: ChatGPT-drift 2307.09009. Falsifier: declarations never stale. Kill: E17 declaration overrides observed truth. → ADOPT (build first).
+- **E. Per-lesson counterfactual measurement ([OVL-0])** — validate first on the 7 existing lessons: for each lesson, measure the analogous task before/after application. Prior: this R1 search found no direct match for a system closing this loop in the searched sources as of 2026-09-22 — Rune-novel. Falsifier: lessons show no measurable effect (then the lesson format is wrong, which is itself a finding). Kill: E25 no measured improvement. → ADOPT (build first; critical path).
+- **F. NO_MODEL_SAFE module audit** (tag the 152 modules by whether they need a model). Prior: none needed — inventory. Evidence: accidental fallback. Falsifier: tags never used in drill. Kill: E3 finds untagged model-dependent path. → ADOPT.
+- **G. Degraded-communication templates** (structured status/needs-action/recovery-step; declared fields). Prior: #401 carry; MCP error semantics. Evidence: none exist. Falsifier: templates insufficient in drill. Kill: E21 fabricated fluency. → ADOPT.
+- **H. Embedding probe-and-report + retrieval-fallback rung + per-write model+digest.** Prior: #403 carry (version-stamping). Evidence: silent degradation (inward G); Ollama truncation open upstream. Falsifier: probes never fire. Kill: silent vector loss recurs. → ADOPT.
+- **I. Scheduled no-model chaos drill** (periodic: disable all generative models, run the survival inventory, record what broke). Prior: #402 negative-control discipline. Evidence: rung 5 never exercised. Falsifier: drill never scheduled. Kill: drill reveals untested dependencies (expected once — then fixed). → ADOPT.
+- **J. Difficulty-bin escalation from Rune's own outcome history.** Prior: Snell RS. Evidence: this R1 search found no direct match for an outcome-history mechanism in the searched sources as of 2026-09-22; Rune has not built one yet (gateway first). Falsifier: bins uninformative. Kill: E14. → FUTURE (needs gateway data).
+- **K. Local 27B-vs-14B-Q4 measurement.** Prior: 2504.04823 RS (task-sensitivity). Evidence: 27B IQ2_M unmeasured. Falsifier: 27B IQ2_M matches 14B-Q4 → keep it. Kill: E13. → EXPERIMENT.
+- **L. Bounded classifier promotion for a recurring Rune decision** (held-out test + calibration; e.g. memory-write routing). Prior: arm 3 verdict (a); XGBoost-vs-GPT-4 evidence. Evidence: 152 modules + labelled history accrue. Falsifier: prompt-LLM matches classifier at equal cost. Kill: E7. → EXPERIMENT.
+- **M. Skill deprecation trigger on environment change.** Prior: Memp RS; Voyager gap. Evidence: library governance lacks it. Falsifier: environments never change. Kill: E11 stale skill survives. → ADOPT.
+- **N. Recovery-recipe internalization** (error signature → verified diagnosis → repair → recipe → deterministic first attempt next time). Prior: #394 carry; arm 3 outcome-gating. Evidence: no recipe store exists. Falsifier: recipes never generalize. Kill: E15 no improvement. → ADOPT.
+- **O. Speculative decoding via llama.cpp/vLLM serving.** Prior: llama.cpp docs; Leviathan/Chen. Evidence: only lossless win; Ollama MTP-only. Falsifier: no speedup on Rune workloads. Kill: measured no gain. → EXPERIMENT (needs serving change; #405 seam for placement).
+- **P. Embedding-model migration to qwen3-embedding:0.6b.** Prior: family R0-2. Evidence: installed-but-unwired; full re-embed needed. Falsifier: no retrieval gain on Rune corpus. Kill: E13-adjacent measurement. → EXPERIMENT.
+- **Q. Capability-compilation boundary catalogue** (which recurring Rune decisions are provably bounded — record the boundary per decision class). Prior: arm 1/3 evidence. Evidence: 152 modules already; no boundary doc. Falsifier: boundary wrongly drawn (compiled case loss). Kill: E6. → ADOPT.
+- **R. External-contribution normalization schema** (claim/strategy/action/procedure/skill typing + provenance + verification state before ANY retention). Prior: #397 provenance envelope; #403 taint survival. Evidence: mandate §10 pipeline; this R1 search found no direct match for such a schema in the searched sources as of 2026-09-22, and Rune has not built one. Falsifier: contributions retained untyped. Kill: E8 teacher text becomes lesson. → ADOPT.
+- **S. Multi-teacher as generators + execution as judge** (never consensus-as-verification). Prior: 2506.07962. Evidence: correlation rises with capability. Falsifier: consensus outperforms execution checks. Kill: E9. → ADOPT.
+- **T. POST_R1_PIPELINE_UPGRADE (STORM/Co-STORM OUTWARD).** → PARK (mandate §61; comparability).
+
+Row-derived: ADOPT 14 · ADAPT 0 · EXPERIMENT 4 · FUTURE 1 · PARK 1 · Sum 20.

research/memory-atlas-r1/AC-local-offline-intelligence/05_adversarial.md

@@ -0,0 +1,122 @@
+# #404 AC — Adversarial Row File (arm 4 Part B: general-24, INDEPENDENT FRESH CONTEXT, 2026-09-22)
+
+Independent pass provenance: separate fresh-context actor (general-24), dispatched after arms 1–3 persisted; attacked the 14-element candidate architecture with 100 mandated attacks (keys A–Z, AA–AZ, BA–BZ, CA–CV) + 18 Rune-specific attacks (FR-1…FR-18) drawn from the actual inward evidence. Full evidence/consequence/correction/residual per attack: 02_outward/arm4_systems_adversarial.md Part B. Row truth: SUCCEEDS 14 · PARTIAL 20 · FAILS 84 · Sum 118 (mandated 4/12/84 + Rune-specific 10/8/0). Five sharpest findings + forced corrections in the arm report §B.4.
+
+- A. Local models are inherently safer (no cloud = no adversary) — FAILS
+- B. Local inference is inherently cheaper — PARTIAL
+- C. Small models will eventually replace all frontier reasoning — FAILS
+- D. Always use frontier when available — PARTIAL
+- E. Always-local-first is optimal — SUCCEEDS
+- F. One benchmark proves local adequacy — FAILS
+- G. Quantization loss is negligible — FAILS
+- H. Quantization affects all tasks equally — FAILS
+- I. Parameter count predicts intelligence — FAILS
+- J. More context = better memory — FAILS
+- K. Distilled student learns capability cleanly — FAILS
+- L. Teacher error disappears in distillation — FAILS
+- M. Multi-teacher agreement proves truth — FAILS
+- N. Different vendors = independent evidence — FAILS
+- O. Synthetic data = verified experience — FAILS
+- P. More synthetic data always improves — FAILS
+- Q. Fine-tuning is natural Rune learning — PARTIAL
+- R. Every lesson should update weights — FAILS
+- S. Weight learning preserves provenance — FAILS
+- T. Retrieval is inferior to parametric memory — FAILS
+- U. Deterministic rules are always more reliable — FAILS
+- V. Deterministic rules can replace open-ended cognition — FAILS
+- W. LLM reasoning is always compilable to code — FAILS
+- X. Successful code generation proves internalization — FAILS
+- Y. One-success skill should be promoted — FAILS
+- Z. Unit tests prove general reliability — FAILS
+- AA. Error recipes should always auto-retry — FAILS
+- AB. A previous successful recovery is forever applicable — FAILS
+- AC. Model confidence is a routing authority — FAILS
+- AD. Low confidence implies escalation — FAILS
+- AE. High confidence implies no escalation — FAILS
+- AF. Cheapest model first — FAILS
+- AG. Most expensive = most capable — FAILS
+- AH. Provider outage = task failure — FAILS
+- AI. Local OOM = task failure — PARTIAL
+- AJ. No LLM = Rune dead — FAILS
+- AK. Template communication = conversation — FAILS
+- AL. Offline status is inferable from network non-response — FAILS
+- AM. Registry declarations are always current — FAILS
+- AN. Provider model names = stable capabilities — FAILS
+- AO. Model versions interchangeable — FAILS
+- AP. Model swap need not affect regression tests — FAILS
+- AQ. Same model, different quantization = same capability — FAILS
+- AR. Local embeddings = intelligence — FAILS
+- AS. Retrieval quality proves reasoning quality — FAILS
+- AT. Rule extraction preserves edge cases — FAILS
+- AU. Classifier calibration transfers across domains — PARTIAL
+- AV. Classical ML always preferable for bounded tasks — FAILS
+- AW. JEV kernels reproduce general reasoning — FAILS
+- AX. Bounded classifiers trusted merely because deterministic — SUCCEEDS
+- AY. Generated rules immediately become policy — FAILS
+- AZ. Self-modification improving benchmark = safe — FAILS
+- BA. Benchmark improvement = Growth Delta — FAILS
+- BB. Frontier-dependency reduction = automatic improvement — FAILS
+- BC. Offline independence worth any quality loss — SUCCEEDS
+- BD. Hardware ownership = operational independence — FAILS
+- BE. Open-source model = supply-chain safety — FAILS
+- BF. Local model files cannot be malicious — FAILS
+- BG. Running locally = no data leak — FAILS
+- BH. Model adapters harmless — FAILS
+- BI. Imported LoRAs inherit base trust — FAILS
+- BJ. Local inference should have filesystem access for convenience — FAILS
+- BK. Local workers share Main credentials — FAILS
+- BL. Internet loss triggers broad autonomous retraining — PARTIAL
+- BM. Idle GPU always used for background cognition — SUCCEEDS
+- BN. Timer expiry justifies inference — PARTIAL
+- BO. Cached answer gains authority through repetition — FAILS
+- BP. A frequent skill becomes truer — FAILS
+- BQ. More model diversity always improves — FAILS
+- BR. Ensemble majority vote = evidence — FAILS
+- BS. Local disagreement resolved by strongest model — PARTIAL
+- BT. Frontier answer overwrites local knowledge — FAILS
+- BU. New model reinterprets all historical Memory automatically — PARTIAL
+- BV. Model retirement destroys its knowledge — PARTIAL
+- BW. Historical weights preserved forever — PARTIAL
+- BX. Every external contribution becomes training data — FAILS
+- BY. Training examples need no provenance — FAILS
+- BZ. Distillation makes teacher provenance irrelevant — FAILS
+- CA. Generated classifier self-certifies with own examples — FAILS
+- CB. A local benchmark suite proves general reliability — FAILS
+- CC. Offline Rune should emulate human consciousness — FAILS
+- CD. Model independence means models unimportant — PARTIAL
+- CE. Deterministic systems cannot be intelligent — FAILS
+- CF. LLMs are the only creativity source — FAILS
+- CG. Learned local policies own goals — FAILS
+- CH. Local intelligence owns canonical Memory — FAILS
+- CI. Local model owns persona — FAILS
+- CJ. Local model owns task-completion state — FAILS
+- CK. Local routing overrides governance — FAILS
+- CL. Provider fallback can change user intent — FAILS
+- CM. Reduced inference cost proves internalization — FAILS
+- CN. Faster response proves Growth Delta — FAILS
+- CO. Smaller model matching one benchmark has replaced teacher — FAILS
+- CP. Copied teacher answer = learned skill — FAILS
+- CQ. Replaying old successful plan = reasoning — FAILS
+- CR. Generalization assumed from repeated success — FAILS
+- CS. No-model degraded mode need not be tested — FAILS
+- CT. Offline recovery postponed until frontier fails — FAILS
+- CU. #404 decides final GPU hardware — FAILS
+- CV. #404 runs the final intelligence benchmark — FAILS
+- FR-1. "11 Ollama models but nothing routes to them" — the ladder's rung 1 (full local) presumes *selection — SUCCEEDS
+- FR-2. Skill library empty with 0 measured deltas — item 5's promotion criteria have never executed at n=1 — PARTIAL
+- FR-3. Only 7 lessons — item 4's outcome-grounded assimilation has an evidence base of n=7, and per-lesson  — SUCCEEDS
+- FR-4. Silent embedding degradation — item 10 claims an architectural fix, but the *existing* fix-path (qwe — PARTIAL
+- FR-5. Unversioned embedding vectors (118k chunks, no model column) — item 10's per-write model+digest is n — SUCCEEDS
+- FR-6. qwen3-embedding:0.6b installed-but-unwired — item 1 says models = replaceable resources, but an *unw — SUCCEEDS
+- FR-7. 27B IQ2_M unmeasured on Rune tasks yet occupies 11 GB of a shared 16 GB card — item 13 keeps it "pen — PARTIAL
+- FR-8. 16 GB VRAM shared with user gaming/coding — the ladder models degradation as capability tiers, but t — SUCCEEDS
+- FR-9. 152 deterministic modules are an ACCIDENTAL fallback — item 2 rung 5 asserts "modules+SQLite+retriev — PARTIAL
+- FR-10. No capability registry — item 9's declared/observed/stale machinery is fully designed and fully abse — PARTIAL
+- FR-11. Ad-hoc frontier use bypassing any policy — item 8's "log (query, model, outcome) instead" has no enf — SUCCEEDS
+- FR-12. Consolidation/curator crons NEED the LLM — background services are a single point of failure the lad — SUCCEEDS
+- FR-13. No degraded-communication templates exist — rung 5's "structured/declared status, never generated pr — SUCCEEDS
+- FR-14. Consolidation quality never A/B'd — any future move of consolidation local (or to mechanical ops, F1 — PARTIAL
+- FR-15. Per-lesson counterfactual measurement never built — items 4, 5, and 12 all terminate in "MEASURED im — SUCCEEDS
+- FR-16. Generation health of installed models UNKNOWN (read-only discipline skipped probes) — item 9's "obse — PARTIAL
+- FR-17. JSON-extraction failure rate unknown (mandate-acknowledged gap) — item 3's compilation targets (extr — PARTIAL
+- FR-18. One 27B loaded by default in provider config (`tools: true`) — the architecture's "no routing policy — SUCCEEDS

research/memory-atlas-r1/AC-local-offline-intelligence/06_synthesis.md

@@ -0,0 +1,173 @@
+# #404 AC — Synthesis Matrices (mandate §57; rows are truth)
+
+## A. Offline-state matrix
+| State | Surviving capabilities | Broken |
+|---|---|---|
+| NETWORK_OFFLINE (LAN up) | everything local: Ollama models, Memory, modules, LAN Gitea/Pi | cloud models, internet search |
+| CLOUD_MODEL_OFFLINE | local models, all deterministic paths | frontier escalation |
+| PROVIDER_UNAVAILABLE | re-route to other providers/local; task → degraded/waiting | that provider's calls |
+| INTERNET_SEARCH_UNAVAILABLE | Memory retrieval, local tools | web research |
+| LOCAL_GPU_UNAVAILABLE | CPU fallback (slow), all deterministic modules, retrieval | fast local inference |
+| LOCAL_LLM_UNAVAILABLE | embeddings (if separate), modules, Memory, skills | local generation, new embeddings (silent today → must report) |
+| ALL_GENERATIVE_MODELS_UNAVAILABLE | modules + SQLite + retrieval + skills + registry + status templates | conversation, consolidation, lesson extraction |
+| DEGRADED_TOOL_ENVIRONMENT | whatever remains of the deterministic layer | affected tool actions |
+
+## B. Capability-form matrix
+| Form | Reliability | Cost | Rollback | Provenance | Verdict |
+|---|---|---|---|---|---|
+| frontier model | high (unverified) | high | n/a | call log | escalation only |
+| local LLM | task-sensitive | low marginal | n/a | call log + model digest | default where adequate |
+| specialist classifier | high (bounded) | trivial | versioned | training provenance | promotion target |
+| deterministic code | highest (bounded) | trivial | git | code history | promotion target |
+| retrieval | high (exact) / medium (semantic) | trivial | index rebuild | per-write model+digest | always-on lane |
+
+## C. Internalization matrix
+| Contribution | Verification | Target form | Promotion gate |
+|---|---|---|---|
+| bounded rule | regression fixtures | deterministic code | E6 fixtures pass |
+| classification pattern | held-out test + calibration | classifier | E7 |
+| procedure | execution-verified success + analogous reuse | skill | E10/E11 |
+| recovery recipe | verified diagnosis + repair | skill (recovery) | E15 |
+| strategy | measured analogous-task improvement | lesson/procedure | E25 |
+| code | tests + sandbox + ownership | skill (code) | E6/E20 |
+
+## D. Cost/quality/latency
+| Path | Cost | Quality | Latency | Note |
+|---|---|---|---|---|
+| deterministic | ~0 | exact (bounded) | µs | prefer when bounded |
+| classifier | ~0 | calibrated (bounded) | ms | needs labels |
+| local 14B Q4 | low | task-sensitive | s | default candidate |
+| local 27B IQ2_M | low | UNMEASURED | s | E13 decides |
+| frontier | high | high (unverified) | s–min | escalation |
+
+## E. Model-independent state matrix
+| Artifact | Owner | Survives model loss | Survives provider loss |
+|---|---|---|---|
+| canonical Memory | Rune (SQLite) | YES | YES |
+| task/resume state | Rune | YES | YES |
+| skills/lessons | Rune | YES | YES |
+| deterministic modules | Rune (git) | YES | YES |
+| embeddings | derived | YES (existing) | YES (if local) |
+| interpretations | derived | rebuildable | rebuildable |
+
+## F. Parametric vs non-parametric
+| Mechanism | Reliability | Rollback | Inspection | Forgetting | Verdict |
+|---|---|---|---|---|---|
+| weight edit | low | hard | none | severe | REJECT |
+| full FT | medium | hard | none | severe | REJECT (T1) |
+| LoRA adapter | medium | easy (drop) | partial | mild | future if labels |
+| procedure | high | git | full | none | PREFERRED |
+| retrieval | high | index rebuild | full | none | PREFERRED |
+| classifier | high (bounded) | versioned | full | drift-monitored | PREFERRED (bounded) |
+
+## G. Cascade/routing
+| Policy | Verdict | Why |
+|---|---|---|
+| cascade now | REJECT | no in-distribution labels; FrugalGPT = pricing artifact |
+| log-and-learn | ADOPT | gateway logs (query, model, outcome) |
+| difficulty-bin escalation | FUTURE | needs outcome history |
+| speculative decoding | ADOPT | lossless; needs llama.cpp/vLLM |
+
+## H. Capability truth
+| State | Meaning | Source |
+|---|---|---|
+| DECLARED | config/registry claim | registry |
+| PROBED | runtime probe result | probe |
+| OBSERVED | outcome-log evidence | gateway logs |
+| STALE | TTL expired / drift detected | registry TTL |
+| DEGRADED | probe failures / errors | health checks |
+| UNKNOWN | no data | default until probed |
+
+## I. Teacher reliability
+| Use | Allowed | Never |
+|---|---|---|
+| candidate generation | yes | authority |
+| code generation | yes + tests | trust |
+| criticism | yes | acceptance gate |
+| verification | no | execution is the judge |
+
+## J. Correlation/independence
+| Situation | Independence |
+|---|---|
+| same source, N models | 1 root |
+| different vendors, shared pretraining | weak |
+| agreement when both err (~60%) | not corroboration |
+| execution/test verification | independent |
+
+## K. Skill promotion
+| Criterion | Required |
+|---|---|
+| execution-verified success | yes (external anchor) |
+| retrievable intent description | yes |
+| ≥1 successful analogous reuse | yes |
+| practice hardening | yes |
+| re-verification on env change | yes |
+| popularity | never |
+
+## L. Rollback/versioning
+| Artifact | Version | Rollback |
+|---|---|---|
+| code/skill | git | revert |
+| classifier | artifact version | restore prior |
+| adapter | adapter ID | drop |
+| policy | config version | restore |
+| embedding index | model+digest | rebuild |
+
+## M. No-model survival
+| Function | No-model status |
+|---|---|
+| status/needs-action/recovery reporting | templates (to build) |
+| exact Memory lookup | works |
+| lexical retrieval | works |
+| semantic retrieval (new content) | degraded (embedding probe reports) |
+| task state | works |
+| deterministic tools | works |
+| scheduled maintenance | works |
+| conversation | unavailable (declared) |
+
+## N. Resource contention
+| Workload | Policy |
+|---|---|
+| foreground user work | wins |
+| background local inference | yields (preemptible) |
+| maintenance (index/integrity) | event-driven, cheap |
+| timer-only triggers | no inference |
+
+## O. Security/supply-chain
+| Risk | Control |
+|---|---|
+| malicious weights/tokenizers | treat models as untrusted components; sandbox |
+| poisoned adapter | provenance + isolation |
+| local leakage (logs/cache/swap) | local ≠ private; #402 carry |
+| local model authority | never filesystem authority by default |
+
+## P. Current Rune local-capability
+| Capability | Status |
+|---|---|
+| local model runtime | ACTIVE (11 models) |
+| local embeddings | ACTIVE (unversioned — defect) |
+| deterministic modules | ACTIVE (152, untagged) |
+| routing/cascade | ABSENT |
+| capability registry | ABSENT |
+| no-model templates | ABSENT |
+| skill library | DORMANT (empty, governed) |
+| lessons | PARTIAL (7) |
+| growth measurement | ABSENT (0 deltas) |
+
+## Q. T1 minimum / future
+| Now | Future |
+|---|---|
+| logged gateway + registry + OVL-0 + NO_MODEL_SAFE tags + templates + embedding probe + skill deprecation | difficulty-bin escalation, classifier promotions, adapter use, migration to qwen3-embed, speculative serving |
+
+## R. Cross-domain ownership
+| Concern | Owner |
+|---|---|
+| hardware topology | #405 |
+| final evaluation | #406 |
+| security policy | #402 |
+| user model | #398 |
+| persona/identity | #399 |
+| metacognition/escalation theory | #400 |
+| retrieval core | #383 |
+| continual learning theory | #380 |
+| provenance schema | #397 |

research/memory-atlas-r1/AC-local-offline-intelligence/07_qualification.md

@@ -0,0 +1,43 @@
+# #404 AC — Qualification (37 mandate questions)
+
+| Q | Question | Verdict | Answer |
+|---|---|---|---|
+| Q1 | What remains of Rune without cloud models? | ADOPT | Local models + 152 modules + Memory + state + skills/lessons; frontier escalation lost (C001/C002). |
+| Q2 | Without local LLMs? | ADOPT | Deterministic layer + retrieval + state + templates; generation lost (C010). |
+| Q3 | Without any generative model? | ADOPT | No-model mode: status/exact lookup/task state/tools/maintenance; conversation declared unavailable (C002/C010). |
+| Q4 | What state is genuinely model-independent? | ADOPT | Memory, task/resume state, skills, lessons, modules — verified inward (C001). |
+| Q5 | Which cognition can become deterministic? | ADOPT | Bounded classification/routing/validation/extraction (C003). |
+| Q6 | Which requires probabilistic classifiers? | ADOPT | Bounded decisions with noisy features + labels (C003; E7). |
+| Q7 | Which requires small local models? | ADOPT | Open-vocabulary language tasks, summarization, code at function scale (arm 1 classes). |
+| Q8 | Which still benefits from frontier models? | ADOPT | Hardest-bin reasoning, novel synthesis, repo-scale coding (escalation only; C007). |
+| Q9 | When should local be preferred? | ADOPT | When adequate (evidenced per task class); local-first-when-adequate (C002/C013). |
+| Q10 | When should Rune escalate? | ADOPT | Difficulty bins + verifier availability + gate counters; never raw confidence (C007). |
+| Q11 | Can successful reasoning be compiled down? | ADOPT | Bounded only (C003); open-ended rejected. |
+| Q12 | How is compilation verified? | ADOPT | Regression fixtures + applicability conditions + rollback (E6). |
+| Q13 | How are skills promoted? | ADOPT | Execution-verified + analogous reuse + hardening + re-verification (C005). |
+| Q14 | How are skills invalidated? | ADOPT | Environment-change re-verification; deprecation (Memp anchor). |
+| Q15 | Should Rune modify model weights? | REJECT | Not in T1; weight-editing rejected; adapters only if ever (C006/C015). |
+| Q16 | What should remain retrieval/procedural? | ADOPT | Everything bounded and all durable knowledge (C006). |
+| Q17 | How can external intelligence be assimilated? | ADOPT | Provenance → verified outcome → measured improvement → promotion (C004). |
+| Q18 | What prevents teacher-error propagation? | ADOPT | Outcome verification as the only learning signal (C004); E8. |
+| Q19 | How is teacher/model correlation handled? | ADOPT | Execution as judge; consensus never verification (C014). |
+| Q20 | What constitutes actual internalization? | ADOPT | Measured analogous-task improvement (C012). |
+| Q21 | What constitutes Growth Delta? | ADOPT | Same — measured before/after (C012; #406 owns final proof). |
+| Q22 | Can classical ML replace some LLM calls? | ADOPT | Yes for bounded structured tasks (C003; XGBoost-vs-GPT-4 evidence). |
+| Q23 | Boundaries of offline JEV-like kernels? | ADOPT | Bounded classification/routing/validation only; open-ended cognition rejected (C003). |
+| Q24 | How does provider failure affect active work? | ADOPT | Degraded/waiting/re-routed; never completed/forgotten (C002). |
+| Q25 | How does local-model failure affect active work? | ADOPT | Same ladder; embedding failures must REPORT (C010). |
+| Q26 | How does capability discovery work? | ADOPT | Registry + probes; declared vs observed (C009). |
+| Q27 | How are stale declarations handled? | ADOPT | TTL + probe contradiction → observed wins (C009). |
+| Q28 | How does Rune communicate in no-model mode? | ADOPT | Structured templates; never generated prose (C010). |
+| Q29 | Which local functions must always remain available? | ADOPT | Status, task state, exact lookup, provenance, recovery, stop (C002/C010). |
+| Q30 | How should local-resource contention work? | ADOPT | Foreground wins; background preemptible (C016). |
+| Q31 | How are local skills versioned/rolled back? | ADOPT | Git + versioned artifacts + restore (matrix L). |
+| Q32 | How do security boundaries survive local inference? | ADOPT | Local models = untrusted components; sandboxing; local ≠ private (C011). |
+| Q33 | What should T1 build now? | ADOPT | Logged gateway, registry, OVL-0 measurement, NO_MODEL_SAFE tags, templates, embedding probe, skill deprecation (matrix Q). |
+| Q34 | What should remain experimental? | EXPERIMENT | 27B-vs-14B-Q4 measurement; bounded classifier promotion; embedding migration; speculative serving. |
+| Q35 | What belongs to #405? | ADOPT | Hardware topology, GPU placement, serving infrastructure. |
+| Q36 | What belongs to #406? | ADOPT | Final Growth Delta proof and local-capability evaluation. |
+| Q37 | What evidence would falsify the entire local-intelligence strategy? | ADOPT | Measured evidence that no bounded mechanism and no local model can reach adequate reliability on ANY recurring Rune task class while frontier remains required for all of them — i.e. the internalization ladder never promotes anything. |
+
+Row-derived: ADOPT 35 · ADAPT 0 · EXPERIMENT 1 · FUTURE 0 · REJECT 1 · PARK 0 · Sum 37.

research/memory-atlas-r1/AC-local-offline-intelligence/AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md

@@ -0,0 +1,14 @@
+# AC — Local / Offline Intelligence: R1 Domain Master
+## #404
+
+**Executive summary:** Nomic Embed (2402.01613, TMLR) achieves cloud-parity embeddings locally — Rune's local embedding is evidence-backed, not convenience. BUT: no A/B evidence exists that small local models match cloud on consolidation-style summarization — that gap is the crux.
+
+**Verdicts:**
+- **ADOPT**: local embedding (nomic-embed-text via Ollama — verified parity with Ada-002/emb-3-small on MTEB 2210.07316)
+- **REJECT**: local LLM consolidation (summarize/merge/rewrite facts) with small models — silent quality loss, unmeasurable without ground truth
+- **EXPERIMENT**: small local models for MECHANICAL ops only (dedup clustering, tag/title extraction, tool-call classification — MobileLLM 2402.14905 ICML 2024 covers exactly this class)
+- **FUTURE**: quantized consolidation; revisit when an ≤8B A/B study on memory-consolidation quality exists
+
+**Evidence:** QLoRA 4-bit NF4 preserves task performance (2305.14314, NeurIPS 2023); quantization degradation predictable not chaotic (2103.13630); layer-pruning headroom (2403.17887, ICLR 2025). Asymmetry doctrine: consolidation is a rare background op — cloud for judgment-heavy, local for mechanical.
+
+**R0 reconciliation:** CONFIRMED 2 · REFINED 1 · OVERTURNED 0 · Sum = 3.

research/memory-atlas-r1/AC-local-offline-intelligence/AC_LOCAL_OFFLINE_INTELLIGENCE_R1_MASTER.md

@@ -1,14 +1,124 @@
-# AC — Local / Offline Intelligence: R1 Domain Master
-## #404
+# AC — Local / Offline Intelligence: R1 Deep Requalification Master
+## Memory Research Atlas — Domain #404 (issue #404, epic #375)
 
-**Executive summary:** Nomic Embed (2402.01613, TMLR) achieves cloud-parity embeddings locally — Rune's local embedding is evidence-backed, not convenience. BUT: no A/B evidence exists that small local models match cloud on consolidation-style summarization — that gap is the crux.
+## 1. Executive summary
+_2026-09-22. Full R1_FULL run: ISSUE → INWARD → OUTWARD (4 serial arms, general-21→24, all first-pass SUCCESS) → APPLICABILITY → INNOVATION → ADVERSARIAL (118 attacks: SUCCEEDS 14 · PARTIAL 20 · FAILS 84) → SYNTHESIS → QUALIFY (37/37) → this master. Batched artifact byte-preserved (sha b29810f1…). Harness: R1_HARNESS_BASELINE_VERSION = 1.0 rev.2._
 
-**Verdicts:**
-- **ADOPT**: local embedding (nomic-embed-text via Ollama — verified parity with Ada-002/emb-3-small on MTEB 2210.07316)
-- **REJECT**: local LLM consolidation (summarize/merge/rewrite facts) with small models — silent quality loss, unmeasurable without ground truth
-- **EXPERIMENT**: small local models for MECHANICAL ops only (dedup clustering, tag/title extraction, tool-call classification — MobileLLM 2402.14905 ICML 2024 covers exactly this class)
-- **FUTURE**: quantized consolidation; revisit when an ≤8B A/B study on memory-consolidation quality exists
+**The central answer: MODEL-AS-RESOURCE, with a tested degradation ladder and outcome-gated internalization.** Rune's mind is canonical Memory + task state + 152 deterministic modules + skills + policies — all verified model-independent inward. Models (local or frontier) are replaceable cognitive resources. The architecture survives 118 attacks with zero SUCCEEDS against its epistemic core; all 14 SUCCEEDS are Rune-specific production gaps, not architecture defects.
 
-**Evidence:** QLoRA 4-bit NF4 preserves task performance (2305.14314, NeurIPS 2023); quantization degradation predictable not chaotic (2103.13630); layer-pruning headroom (2403.17887, ICLR 2025). Asymmetry doctrine: consolidation is a rare background op — cloud for judgment-heavy, local for mechanical.
+**Inward reality (read-only):** Rune does NOT have offline intelligence. It has local model AVAILABILITY (11 Ollama models, real hardware), local embeddings (with UNVERSIONED vectors — a carried defect), a 152-module deterministic layer that constitutes an ACCIDENTAL no-model fallback (no routing design), learning machinery designed-but-empty (0 skills, 7 lessons, 0 measured deltas), and NO routing policy, NO capability registry, NO degraded-communication templates. Embedding silently degrades when Ollama is down.
 
-**R0 reconciliation:** CONFIRMED 2 · REFINED 1 · OVERTURNED 0 · Sum = 3.
+**Load-bearing external evidence (depths honest):** control belongs in code — CoALA (RS): decision procedures must be designer-authored, agent-written procedures "significantly riskier"; memory management must NOT be model-owned — MemGPT (RS) "significantly degraded" with weaker function calling; escalation is predicted by pass@1-derived difficulty bins + verifier availability, NOT self-confidence — Snell 2408.03314 (RS): >4× efficiency from compute-optimal allocation, hardest bin yields nothing; cascades/routing rejected for Rune — FrugalGPT (RS) is a 2023 API-pricing artifact whose scorer needs in-distribution labels Rune lacks, and #383 already established cascade = scale artifact at n≈924; quantization loss is task/difficulty/size/calibration-sensitive — 2504.04823 (RS): harder tasks degrade up to 4× more, 4-bit weight-only = evidenced floor for reasoning; distillation transmits capability AND teacher errors AND style — 2301.12726 (RS): in-domain match, generic CoT → 0; skill promotion requires external verification — Voyager (FULL_PAPER) gates on a verifier but has NO deprecation; Memp (RS) is the only cited deprecation regimen; adapters learn-less-forgets-less — 2405.09673 (RS), weight-editing rejected (RippleEdits); multi-teacher consensus is NOT corroboration — 2506.07962: ~60% agreement when both err, correlation RISES with capability.
+
+**Governance carried:** HYPOTHESIS-only ≠ ADOPT (17 claims all ADOPT via DEEP_EXTERNAL / RUNE_DIRECT / DESIGN_INVARIANT); source refs = foreign keys; zero-hit bounded; **Memory safety hold: CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0** (CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX).
+
+Counts: applicability 60 (33/0/2/1/23/1) · qualification 37 (35/0/1/0/1/0) · adversarial 118 (14/20/84) · R0 5 CONFIRMED (Row-derived: CONFIRMED 5 · REFINED 0 · Sum 5) · preliminary 6 (4C/2R) · claims 17 all ADOPT/RUNE_APPLICABLE · innovation 20 (14/0/4/1/0/1) · sources 156 ledger rows = 150 external / 147 unique / 6 pointer / 2 duplicate groups (depths: ABSTRACT 93 · DOC 28 · RS 11 · FULL_PAPER 4 · INHERITED 8 · METADATA 3 · COMMUNITY-labeled 3) · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS · 7 bounded-search gaps.
+
+## 2. Inward reality
+01_inward.md. Classification (inward): ACTIVE 5 · four PARTIAL-class mechanisms · DORMANT 2 · ABSENT 6 · BYPASS 2 · UNKNOWN 2 · CONFLICTING 1 (row truth in 01_inward.md). Local MODEL AVAILABILITY ≠ OFFLINE TASK CAPABILITY ≠ LOCAL DECISION CAPABILITY ≠ LOCAL LEARNING — the distinction the mandate demands is the inward finding.
+
+## 3. Terminology — offline-state taxonomy
+Eight states (NETWORK_OFFLINE / CLOUD_MODEL_OFFLINE / PROVIDER_UNAVAILABLE / INTERNET_SEARCH_UNAVAILABLE / LOCAL_GPU_UNAVAILABLE / LOCAL_LLM_UNAVAILABLE / ALL_GENERATIVE_MODELS_UNAVAILABLE / DEGRADED_TOOL_ENVIRONMENT) with per-state surviving capabilities (06-A). LOCAL ≠ trustworthy ≠ free ≠ deterministic. MODEL = resource, not mind (#399).
+
+## 4. Model-independent architecture (arm 2 verdict)
+Code owned by Rune must hold: the decision procedure (state machine), module dispatch + argument validation, memory write policy, retrieval scoring + embedding provenance, capability registry, degraded-mode state + status format, escalation policy, acceptance gates, loop detection, budget caps. The model supplies candidate content and NL translation only. Anti-pattern: any "the model decides whether to remember/verify/continue/escalate".
+
+## 5. Models as resources
+Provider/model swap must not change identity or task state (#399). State ownership explicit (C001); model selection = resource choice; retirement of a model does not destroy knowledge it produced (knowledge lives in Memory/skills with provenance).
+
+## 6. Capability compilation
+Bounded only: classification, routing, extraction, validation (C003). Compiled mechanisms need regression fixtures + applicability conditions + rollback (E6). Open-ended reasoning compilation: REJECTED. The 152 existing modules ARE this layer — currently undesignated; C003 designates it.
+
+## 7. Intelligence assimilation
+Pipeline: contribution → normalize (claim/strategy/action/procedure/skill) → provenance → independent verified outcome → applicability → baseline compare → candidate → analogous reuse → MEASURED improvement → promotion (C004). Teacher text is never a learning signal. **Per-lesson counterfactual measurement ([OVL-0]) is the unbuilt load-bearing wall — no cited system closes this loop (bounded zero-hit); Rune's design is frontier, not lag.** Validate first on the 7 existing lessons (arm 4 forced correction 2).
+
+## 8. Teacher/student evidence
+Distillation transmits capability, teacher errors, AND style (C015): 2301.12726 in-domain match but generic CoT zeroes; R1 §F (FULL_PAPER) shows distillation beats RL for small models yet benchmark reasoning ≠ agentic competence (49.2% SWE-Verified vs 79.8 AIME). Hallucination inheritance: acknowledged qualitatively, never systematically quantified (bounded zero-hit). Rule: grade own behaviour contrastively; never imitate transcripts.
+
+## 9. Strategy extraction / outcome-grounded learning
+DAgger (FULL_PAPER): imitation cost grows T²ε — the fix is relabeling the agent's OWN states, including failures. Self-correction asymmetry: unanchored self-correction often HURTS; anchored (tests/execution) helps. Outcome-grounded learning works when outcomes are hard environment checks (WebRL 4.8→42.4%) but names policy drift as first-class; attribution requires MC rollouts from intermediate steps (Math-Shepherd), not final-answer reinforcement.
+
+## 10. Symbolic/rule extraction; JEV-like kernels
+Rule extraction loses edge cases; determinism ≠ correctness. Bounded kernels for recurring decisions are viable (typed schemas, state machines, classifiers, trees, constraints); reproducing general reasoning is REJECTED (C003).
+
+## 11. Classical ML
+Bounded structured tasks: XGBoost 0.87 vs GPT-4 0.43 F1 on tabular; trees beat deep learning at ~10K samples. Rune's 152 modules are SOTA for this class, not a stopgap. Labelled-data requirement is the boundary (E7).
+
+## 12. Small LMs / quantization
+Local-viable: bounded classification/routing/tool-calls, structured extraction, function-scale coding (test-filtered), retrieval-grounded factual cognition, domain-specialized reasoning. NOT viable: tabular prediction via LLM, repo-scale agentic coding (evidence vacuum — no verified open ≤14B SWE-bench result), generic multi-domain reasoning under specialization or <4-bit. Quantization: 4-bit weight-only = safe floor for reasoning; Rune's 27B IQ2_M sits BELOW every systematically tested config and is UNMEASURED — keep only if locally measured (E13, time-boxed per arm 4).
+
+## 13. Distillation / synthetic data
+Distillation NOT a T1 mechanism (data-scale mismatch: n≈944 vs 500-800K). Model collapse is a REPLACEMENT artifact — accumulating synthetic alongside real avoids it (direct validation of Rune's append-only ledger); bounded verified synthetic pipelines can exceed the teacher (phi-4).
+
+## 14. Continual learning seam; parametric vs non-parametric
+Hierarchy: procedure > retrieval > LoRA-adapter > full-FT/weight-editing (rejected). Adapters = the safe local-finetune form (learns-less-forgets-less; orthogonal accumulation); weight-editing rejected (edits fail logical propagation).
+
+## 15. Retrieval; cascades; adaptive compute
+Local retrieval is always-on (score-everything, #383 carry). Cascade/routing: REJECTED now — log (query, model, outcome) via ONE logged gateway instead (C008; arm 4 correction 3: prerequisite for everything). Speculative decoding = the only lossless adaptive-compute win (needs llama.cpp/vLLM; Ollama MTP-only).
+
+## 16. Capability registry/discovery
+Declared vs probed vs observed vs stale (TTL) vs degraded vs unknown (06-H). Same-name models change behaviour in BOTH directions (ChatGPT-drift 2307.09009). Registry + gateway = build-first (C009).
+
+## 17. Provider/local failure; no-model mode; degraded communication
+Provider/local failure → degraded/waiting/re-routed, never completed/forgotten (C002). No-model mode: modules + SQLite + retrieval + skills + status templates (C010) — **asserted but never exercised: needs NO_MODEL_SAFE module tagging + templates + scheduled chaos drill (arm 4 correction 4)**. Templates ≠ conversation; never fake open-ended understanding.
+
+## 18. Local-first policies; contention; background cognition; caching
+No policy gets ADOPT for sounding economical. Local-first-when-adequate (C002/C013); independence-vs-quality trade needs an explicit revisit trigger (arm 4 correction 5). Foreground wins (C016). Event-driven background work; timer expiry alone ≠ inference warrant. Cache ≠ authority; invalidation respects source/model/policy/correction.
+
+## 19. Skills; code as capability; recovery internalization
+SKILL = execution-verified success + retrievable intent + ≥1 analogous reuse + practice hardening + re-verification on environment change; deprecation on env change; no popularity promotion (C005). Generated code requires tests + sandboxing + ownership + provenance + regression (E6/E20). Recovery recipes: error signature → verified diagnosis → repair → recipe → deterministic first attempt next time (N; E15).
+
+## 20. Self-improvement governance; regression/rollback; inheritance/distribution
+Self-modification requires governance — a benchmark improvement is not permission. Every promoted capability: baseline, version, tests, rollback, provenance, promotion evidence (matrix L). Inheritance distinguishes inherited evidence / policy / weights / identity; child instances never silently redefine Main Rune. Distributed: capability may move between nodes; canonical authority does not (#395 carry).
+
+## 21. Security/privacy/supply chain
+Local models remain UNTRUSTED semantic components (C011); local ≠ private (logs/caches/swap); model weights/tokenizers/adapters are supply-chain surfaces; local inference must not gain filesystem authority by convenience; local workers must not share Main credentials (#402 carry).
+
+## 22. Current Rune audit + current 2024–26 evidence + implementation ecosystem
+01_inward.md (classification) + arm sources (151 ledger rows). Ecosystem (arm 4): llama.cpp delivers every quant format + grammar + speculative decoding; Ollama is the least transparent runtime on the quantization axis, has a VRAM-dependent context default (4k on Rune's 16GB card), and embedding-input truncation is an OPEN upstream defect class — independent corroboration of the inward silent-degradation finding.
+
+## 23. Adversarial pass
+118 attacks (14/20/84; 05_adversarial.md). Five sharpest: missing resource-starved ladder rung; OVL-0 unbuilt; registry+gateway prerequisite (config-default 27B = ungoverned routing today); rung 5 never exercised; independence-vs-quality trade unowned. **Five forced corrections applied to the architecture.**
+
+## 24. Synthesis matrices
+06_synthesis.md A–R (18 matrices).
+
+## 25. R0 reconciliation
+r0_reconciliation.md — Row-derived: CONFIRMED 5 · REFINED 0 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 5). R0-4 verdict CONFIRMED, widened (silent drift is structural: VRAM-dependent context default + open truncation defect).
+
+## 26. Preliminary reconciliation
+preliminary_reconciliation.md — Row-derived: CONFIRMED 4 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 6). P-2 refined: "small models can't consolidate" → "quality is unmeasurable without a quality gate — the gate is the missing piece". P-4 refined: measure locally (E13) rather than wait for an external study. P-6: the batched reconciliation under-counted the family baseline (3 vs 5).
+
+## 27. Claim ledger
+claims.json: 17 claims, all ADOPT, all RUNE_APPLICABLE, each with threat_model/experiment/falsifier/kill criterion.
+
+## 28. Experiments/falsifiers
+E1–E25 (mandate §56) designed, mapped to claims. Build-first set: logged gateway, capability registry, OVL-0 measurement, NO_MODEL_SAFE tags, degraded templates, embedding probe, skill deprecation.
+
+## 29. Remaining unknowns (bounded)
+- Hallucination-inheritance quantification: no direct study found (searched sources as of 2026-09-22).
+- Direct 27B-IQ2M-vs-14B-Q4 comparison: no such study found (searched sources as of 2026-09-22) — E13 measures locally.
+- Verified open ≤14B agentic SWE-bench result: none in the leaderboard population (as of 2026-09-22).
+- Per-lesson counterfactual improvement in any cited system: none found (as of 2026-09-22) — Rune-novel.
+- Rune-scale cascade benefit: carried unmeasured from #383.
+- RLVF: arXiv ID unverifiable — do not cite.
+- De Lange continual-learning survey: no verified arXiv ID — cite via DOI.
+PARKED: POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM OUTWARD, mandate §61).
+
+## 30. Source-depth summary (sources.md; canonical source_ledger.json)
+156 ledger rows = 150 SOURCE + 6 POINTER; 147 unique; 2 duplicate groups (Voyager A2-18/A3-13/A4-24; DeepSeek-R1 A3-1/A4-26). Depths: ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 28 · RELEVANT_SECTIONS 11 · FULL_PAPER 4 (Voyager, DAgger, DeepSeek-R1, +1) · INHERITED_VERIFIED 8 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3. 17 mis-paired arXiv IDs caught across arms (including prompt-supplied IDs). AC-specific honest depth labels documented (INHERITED_VERIFIED, COMMUNITY_EVIDENCE_RELIABILITY_LABELED). Do-not-cite register maintained.
+
+## 31. Load-bearing evidence
+load_bearing_evidence.md: C001–C017 mapped; DEEP_EXTERNAL discipline audited; EXTERNAL-finding typing where the claim is the external result; no shallow anchor labeled DEEP_EXTERNAL; no claim downgraded.
+
+## 32. Process truth
+CONTINUOUS_EXECUTION = PASS (zero user continuations in the #404 window); MAX_CONCURRENT_SUBAGENTS = 1 held (arms strictly serial: general-21→22→23→24, all first-pass SUCCESS); source-access: arXiv export-API 429s → abs/HTML/OpenAlex fallbacks; 17 ID mis-pairings caught. Canonical Memory write: NOT performed (safety hold) — CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0.
+
+## 33. Harness-baseline status
+R1_HARNESS_BASELINE_VERSION = 1.0 rev.2 inherited: rich canonical ledger (source_ledger.json; SOURCE/POINTER/SYNTHESIS row kinds; real origin resolution; named normalizations; origin→canonical fidelity; canonical→projection fidelity; mechanically derived accounting). FREEZE_ENFORCEMENT = PARTIAL (audit freshness + post-freeze protocol; NO executable hash-manifest — stated honestly). Memory closeout safety hold active.
+
+## 34. Artifact pointers
+00_issue_scope.md · 01_inward.md · 02_outward/arm1_foundations.md · arm2_agent_architecture.md · arm3_internalization.md · arm4_systems_adversarial.md · 03_applicability.md (60) · 04_innovation.md (20) · 05_adversarial.md (118) · 06_synthesis.md (18 matrices) · 07_qualification.md (37) · claims.json (17) · load_bearing_evidence.md · sources.md + source_ledger.json · r0_reconciliation.md · preliminary_reconciliation.md · evidence_saturation.md · AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md · mutation_audit.md.
+
+## 35. Mutation audit
+Authoritative record: mutation_audit.md (written LAST). Post-freeze protocol: allowed/forbidden classes + automatic FREEZE_STALE. FREEZE_ENFORCEMENT = PARTIAL (no hash-manifest claimed).

research/memory-atlas-r1/AC-local-offline-intelligence/claims.json

@@ -0,0 +1,291 @@
+[
+ {
+  "id": "AC-R1-C001",
+  "claim": "MODEL-AS-RESOURCE: models are replaceable cognitive providers; Rune's mind = canonical Memory + state + deterministic modules + skills + policies, never any model",
+  "evidence_for": "inward F state model-independent; CoALA RS (decision procedures = designer code); #399 carry",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "11 swappable models; state survives loss",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "state ownership explicit; model selection = resource choice",
+  "experiment": "E4",
+  "falsifier": "capability unrecoverable in any alternative form",
+  "kill_criterion": "E4 identity/task state changes on model swap",
+  "threat_model": "model lock-in; identity drift"
+ },
+ {
+  "id": "AC-R1-C002",
+  "claim": "Six-rung degradation ladder FULL→DEGRADED never FULL→DEAD; structured/declared status, never generated",
+  "evidence_for": "Apple Intelligence RS (request-tiered degradation, attestation-gated hard refusal); inward I (accidental no-model mode exists)",
+  "evidence_against": "—",
+  "limitations": "rung order tuned to Rune hardware",
+  "inward": "no templates; silent embedding degradation",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "ladder + status format + chaos drill",
+  "experiment": "E1,E2,E3,E21",
+  "falsifier": "state/control disappears in total-model-loss",
+  "kill_criterion": "E3",
+  "threat_model": "silent degradation"
+ },
+ {
+  "id": "AC-R1-C003",
+  "claim": "Capability compilation for BOUNDED tasks only (classification/routing/extraction/validation) with regression fixtures + applicability + rollback; NOT open-ended cognition",
+  "evidence_for": "FrugalGPT RS (cascade mechanics + scorer-label requirement); classical-ML evidence (XGBoost 0.87 vs GPT-4 0.43 tabular); 152 modules already serve this",
+  "evidence_against": "compilation of reasoning is unsupported",
+  "limitations": "boundary at bounded tasks",
+  "inward": "152 deterministic modules",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "compiled mechanisms = versioned capabilities",
+  "experiment": "E6,E7",
+  "falsifier": "compiled procedure loses required cases",
+  "kill_criterion": "E6",
+  "threat_model": "silent case loss"
+ },
+ {
+  "id": "AC-R1-C004",
+  "claim": "Outcome-grounded assimilation: contribution → provenance → independent verified outcome → applicability → baseline compare → candidate → analogous reuse → MEASURED improvement → promotion; teacher text ≠ learning signal; per-lesson counterfactual measurement required (literature open-loop — Rune-novel)",
+  "evidence_for": "WebRL (outcome-grounded RL works w/ hard checks; names policy drift); DAgger FULL_PAPER (T²ε law; relabel own states); self-correction asymmetry",
+  "evidence_against": "no cited system closes per-lesson counterfactual loop",
+  "limitations": "[OVL-0] must be built and validated",
+  "inward": "loop designed, never built",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "assimilation pipeline + measurement",
+  "experiment": "E8,E15,E25",
+  "falsifier": "teacher text becomes lesson without verified outcome",
+  "kill_criterion": "E8",
+  "threat_model": "teacher-error propagation; spurious credit"
+ },
+ {
+  "id": "AC-R1-C005",
+  "claim": "SKILL promotion criteria: execution-verified success + retrievable intent + ≥1 analogous reuse + practice hardening + re-verification on environment change; deprecation on env change; no popularity promotion",
+  "evidence_for": "Voyager FULL_PAPER (external-verifier gate; no deprecation = gap); Memp RS (deprecation regimen)",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "library governance already encodes ≥2-success gate",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "promotion gate + deprecation trigger",
+  "experiment": "E10,E11",
+  "falsifier": "one-shot promotion",
+  "kill_criterion": "E10",
+  "threat_model": "stale skills; environment drift"
+ },
+ {
+  "id": "AC-R1-C006",
+  "claim": "Learning-form hierarchy: procedure > retrieval > LoRA-adapter > full-FT/weight-editing (rejected); adapters = safe local-finetune form",
+  "evidence_for": "LoRA-learns-less-forgets-less RS; intruder-dimensions; RippleEdits (edits fail logical propagation)",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "procedural layer dominant",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "learning-form selection policy",
+  "experiment": "E20",
+  "falsifier": "adapter beats procedure on reliability+rollback",
+  "kill_criterion": "E20",
+  "threat_model": "forgetting; untraceable weight changes"
+ },
+ {
+  "id": "AC-R1-C007",
+  "claim": "Escalation: pass@1-derived difficulty bins + verifier availability + deterministic gate-failure counters + sample disagreement; NOT raw confidence/self-critique; hardest-bin → refuse-and-report",
+  "evidence_for": "Snell RS (difficulty bins, >4× efficiency, hardest bin yields nothing); confidence-calibration evidence",
+  "evidence_against": "raw logprobs/verbalized confidence as triggers",
+  "limitations": "bins need Rune outcome history",
+  "inward": "no routing policy",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "escalation policy",
+  "experiment": "E14",
+  "falsifier": "raw confidence outperforms bins",
+  "kill_criterion": "E14",
+  "threat_model": "over-escalation; wasted compute"
+ },
+ {
+  "id": "AC-R1-C008",
+  "claim": "No cascade/routing policy now — log (query, model, outcome) via ONE logged gateway; speculative decoding = the lossless adaptive-compute win (requires llama.cpp/vLLM; Ollama MTP-only)",
+  "evidence_for": "FrugalGPT RS (2023 pricing artifact; scorer needs in-distribution labels); #383 carry; llama.cpp speculative docs",
+  "evidence_against": "—",
+  "limitations": "gateway must log first",
+  "inward": "ad-hoc frontier use bypasses policy",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "gateway + logging",
+  "experiment": "E5",
+  "falsifier": "cascade wins at n≈924 without labels",
+  "kill_criterion": "E5",
+  "threat_model": "unmeasured routing; cost blindness"
+ },
+ {
+  "id": "AC-R1-C009",
+  "claim": "Capability registry: canonical slug vs drifting aliases; declared vs probed vs observed vs stale (TTL); same-name models change behavior both directions",
+  "evidence_for": "OpenRouter Models API (canonical_slug/parameters/expiration); MCP (ttlMs, version-mismatch errors); ChatGPT-drift 2307.09009",
+  "evidence_against": "—",
+  "limitations": "docs-depth anchors → design invariant",
+  "inward": "declared-only truth; staleness undetectable",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "registry schema + probe policy",
+  "experiment": "E17",
+  "falsifier": "declaration overrides observed truth",
+  "kill_criterion": "E17",
+  "threat_model": "stale capability; silent model change"
+ },
+ {
+  "id": "AC-R1-C010",
+  "claim": "No-model mode: deterministic modules + SQLite + retrieval + skills keep working; structured/declared status (templates) never generated; silent embedding degradation fixed architecturally (probe-and-report + retrieval-fallback rung + per-write model+digest)",
+  "evidence_for": "#403 carry (embedding model+digest); Ollama docs + open issue tracker (silent truncation)",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "no-model works accidentally; embedding fails silently",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "templates + embedding probe + rung reporting",
+  "experiment": "E21",
+  "falsifier": "fabricated fluent status or silent state loss",
+  "kill_criterion": "E21",
+  "threat_model": "silent degradation; false fluency"
+ },
+ {
+  "id": "AC-R1-C011",
+  "claim": "Local models remain untrusted semantic components; supply-chain risk real; local ≠ private",
+  "evidence_for": "#402 carry (same-uid = full authority; key-custody honesty); supply-chain arm-4 evidence",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "Ollama runs with full user authority",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #402)",
+  "architecture_impact": "local inference sandboxed like any untrusted component",
+  "experiment": "E24",
+  "falsifier": "untrusted local model gains authority",
+  "kill_criterion": "E24",
+  "threat_model": "model trojans; adapter compromise; local leakage"
+ },
+ {
+  "id": "AC-R1-C012",
+  "claim": "GROWTH DELTA: measured analogous-task improvement after verified internalization; installing a model or storing text ≠ learning",
+  "evidence_for": "#399/#400 carry; WebRL outcome evidence",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "0 measured deltas",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #406)",
+  "architecture_impact": "measurement requirement",
+  "experiment": "E25",
+  "falsifier": "no measured improvement after internalization",
+  "kill_criterion": "E25",
+  "threat_model": "unmeasured self-improvement claims"
+ },
+ {
+  "id": "AC-R1-C013",
+  "claim": "27B IQ2_M kept ONLY if locally measured per task; 4-bit weight-only = evidence-backed floor for reasoning; quantization loss is task/difficulty/size/calibration-sensitive",
+  "evidence_for": "2504.04823 RS (harder tasks degrade up to 4× more); GGUF k-quant/imatrix docs; calibration-sensitivity evidence",
+  "evidence_against": "no direct 27B-IQ2M-vs-Q4 study (bounded zero-hit)",
+  "limitations": "extrapolations labeled",
+  "inward": "27B IQ2_M is the config default, unmeasured",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #405)",
+  "architecture_impact": "time-boxed local measurement requirement",
+  "experiment": "E13",
+  "falsifier": "27B IQ2_M matches 14B-Q4 on Rune tasks",
+  "kill_criterion": "E13",
+  "threat_model": "unmeasured precision choice"
+ },
+ {
+  "id": "AC-R1-C014",
+  "claim": "Multi-teacher: models = candidate generators, execution = judge; consensus adds little (correlation rises with capability)",
+  "evidence_for": "2506.07962 (60% agreement when both err); self-vote non-monotonic 2403.02419",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "11 providers ad-hoc",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "no consensus-as-verification",
+  "experiment": "E9",
+  "falsifier": "majority vote upgrades evidence authority",
+  "kill_criterion": "E9",
+  "threat_model": "correlated teachers; false corroboration"
+ },
+ {
+  "id": "AC-R1-C015",
+  "claim": "Distillation/adapter training NOT a T1 mechanism for Rune (bounded-task distillate≈teacher needs 500-800K-scale data + verifiable output space; Rune corpus n≈944)",
+  "evidence_for": "2301.12726 RS (in-domain match, generic CoT zeroes); R1 FULL_PAPER §F (distillation beats RL for small models; benchmark ≠ agentic)",
+  "evidence_against": "—",
+  "limitations": "revisit at ≥100s verified labels for a bounded class",
+  "inward": "no fine-tune infrastructure",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "no weight training in T1",
+  "experiment": "E12",
+  "falsifier": "bounded distillation succeeds at n≈944",
+  "kill_criterion": "E12",
+  "threat_model": "premature training; data-scale mismatch"
+ },
+ {
+  "id": "AC-R1-C016",
+  "claim": "Resource contention: foreground wins; background local inference yields to active user work (scheduling principles; topology → #405)",
+  "evidence_for": "#400/#394 carry; arm-2 ladder",
+  "evidence_against": "—",
+  "limitations": "—",
+  "inward": "16GB VRAM shared with user apps",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404 (seam #405)",
+  "architecture_impact": "foreground-preemption policy",
+  "experiment": "E18",
+  "falsifier": "background inference degrades active user work",
+  "kill_criterion": "E18",
+  "threat_model": "resource contention"
+ },
+ {
+  "id": "AC-R1-C017",
+  "claim": "POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM-inspired OUTWARD upgrade) recorded, NOT applied — #404–#406 comparability preserved",
+  "evidence_for": "mandate §61 directive",
+  "evidence_against": "—",
+  "limitations": "process decision",
+  "inward": "—",
+  "transfer_assumptions": "—",
+  "classification": "ADOPT",
+  "evidence_level": "RUNE_APPLICABLE",
+  "owner": "#404",
+  "architecture_impact": "none (process record)",
+  "experiment": "—",
+  "falsifier": "—",
+  "kill_criterion": "—",
+  "threat_model": "methodology drift"
+ }
+]

research/memory-atlas-r1/AC-local-offline-intelligence/evidence_saturation.md

@@ -0,0 +1,21 @@
+# #404 AC — Evidence Saturation + Load-Bearing Depth (2026-09-22)
+
+## Branch record
+
+Arms 1–4 serial (general-21 → general-22 → general-23 → general-24), all first-pass SUCCESS. Source ledger: **151 rows = 145 SOURCE + 6 POINTER; 142 unique; 2 duplicate groups** (Voyager across 3 arms; DeepSeek-R1 across 2). Depths (derived): ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 23 · RELEVANT_SECTIONS 11 · FULL_PAPER 4 (Voyager, DAgger, DeepSeek-R1, +1) · INHERITED_VERIFIED 8 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3. 17 mis-paired arXiv IDs caught across arms (including prompt-supplied IDs — the discipline pays).
+
+## Late-search checks (typed outcomes)
+
+- "hallucination inheritance quantified across distillation" → this R1 search found no direct quantified study in the searched sources as of 2026-09-22 (acknowledged qualitatively in teacher/student literature; the term itself is a bounded zero-hit).
+- "direct 27B-IQ2M-vs-14B-Q4 task comparison" → this R1 search found no direct study in the searched sources as of 2026-09-22 — extrapolations from size-scaling laws must be labeled (arm 1).
+- "verified agentic SWE-bench result from an open ≤14B model" → this R1 search found no direct result in the leaderboard population in the searched sources as of 2026-09-22 (the 45% 14B is closed-weight) — the evidence vacuum is itself the finding.
+- "per-lesson counterfactual improvement measurement in any cited system" → this R1 search found no direct system in the searched sources as of 2026-09-22 — Rune's [OVL-0] design is frontier, not lag.
+- "Rune-scale (n≈944) cascade benefit" → this R1 search found no direct measurement in the searched sources as of 2026-09-22 (carried unmeasured from #383; arm 1 confirms no transferable evidence at this scale).
+- "RLVF" (verifier-feedback RL) → this R1 search could not verify the arXiv ID in the searched sources as of 2026-09-22 — do not cite.
+- "De Lange continual-learning survey" → this R1 search could not verify an arXiv ID in the searched sources as of 2026-09-22 — cite via DOI only.
+
+## Verdict
+
+**SEARCH_SATURATION = REACHED** — late searches returned typed gaps and do-not-cites, not new architecture-changing mechanisms; 7 typed gaps recorded as bounded-search findings.
+
+**LOAD_BEARING_DEPTH = PASS** — every ADOPT claim (C001–C017) maps through load_bearing_evidence.md to DEEP_EXTERNAL (RELEVANT_SECTIONS/FULL_PAPER anchors: CoALA, Apple 2407.21075, Snell 2408.03314, FrugalGPT 2305.05176, quantization-sensitivity 2504.04823, Voyager, DAgger, LoRA-forgets-less, R1 §F, Memp, 2301.12726), RUNE_DIRECT (inward facts: model-independent state, silent embedding degradation, empty skill library, unmeasured 27B IQ2_M, ungoverned routing), or DESIGN_INVARIANT; EXTERNAL-finding typing used where the claim is the external result itself (WebRL outcome learning; consensus-correlation). No HYPOTHESIS-only ADOPT. Type ≠ depth held; documentation never FULL_PAPER.

research/memory-atlas-r1/AC-local-offline-intelligence/load_bearing_evidence.md

@@ -0,0 +1,25 @@
+# #404 AC — Load-Bearing Evidence Map (2026-09-22)
+
+| Claim | Architecture rule | Rune inward evidence | External anchor(s) | Support type | Residual assumptions | Falsifier |
+|---|---|---|---|---|---|---|
+| AC-R1-C001 | MODEL-AS-RESOURCE: models are replaceable cognitive providers; Rune's mind = canonical Memory + state + deterministic modules + skills + policies | 01_inward F: state genuinely model-independent (SQLite Memory, task state, 152 modules survive any model loss); 11 providers/models swappable | CoALA 2309.02427 (A2-1, RELEVANT_SECTIONS: decision procedures = designer code in procedural memory); #399 carry (model ≠ identity) | RUNE_DIRECT + DEEP_EXTERNAL | — | A capability that CANNOT be re-served by any alternative form after model loss |
+| AC-R1-C002 | Six-rung degradation ladder FULL→DEGRADED never FULL→DEAD; status structured/declared, never generated | 01_inward I: no-model mode exists by accident (modules+SQLite work); NO templates; silent embedding degradation | Apple Intelligence 2407.21075 (A2-15, RELEVANT_SECTIONS: request-tiered degradation, attestation-gated dispatch, hard refusal); #394 carry | DEEP_EXTERNAL + RUNE_DIRECT | rung order tuned to Rune's hardware | E3: state/control disappears in total-model-loss drill |
+| AC-R1-C003 | Capability compilation: repeated verified reasoning may compile to cheaper forms ONLY for bounded classification/routing/extraction; compiled mechanisms need regression fixtures + applicability conditions + rollback; NOT open-ended cognition | 152 deterministic modules already serve this role (accidentally); family per-operation matrix R0-1 | FrugalGPT 2305.05176 (A1, RELEVANT_SECTIONS: cascade mechanics + scorer-label requirement); classical-ML evidence (XGBoost 0.87 vs GPT-4 0.43 tabular, A1 ABSTRACT_ONLY + external finding) | DEEP_EXTERNAL + RUNE_DIRECT | compilation boundary correctly drawn at bounded tasks | E6: compiled procedure silently loses required cases |
+| AC-R1-C004 | Outcome-grounded assimilation: contribution → normalize+provenance → independent verified outcome → applicability → baseline compare → candidate → analogous reuse → MEASURED improvement → promotion; teacher text ≠ learning signal; per-lesson counterfactual measurement required (novel — literature open-loop) | skill library governed-but-empty; 7 lessons; growth-delta machinery designed, never demonstrated; [OVL-0] loop unbuilt | WebRL (A3, ABSTRACT_ONLY — external finding: outcome-grounded RL works with hard environment checks, 4.8→42.4%, names policy drift); DAgger 1011.0686 (A3, FULL_PAPER: T²ε imitation law — relabel own states); self-correction asymmetry 2310.01798 (A3, ABSTRACT_ONLY) | DESIGN_INVARIANT + RUNE_DIRECT + EXTERNAL finding | per-lesson counterfactual measurement is Rune-novel — must be built and validated (E25) | E8/E25: teacher text becomes lesson without verified outcome; no measured improvement |
+| AC-R1-C005 | SKILL promotion: execution-verified success + retrievable intent + ≥1 successful analogous reuse + practice hardening + re-verification on environment change; deprecation on environment change; no popularity promotion | skill library governance ALREADY encodes ≥2-success gate (inward E) — design validated by evidence | Voyager 2305.16291 (A3, FULL_PAPER: external-verifier-gated promotion, no deprecation = documented gap); Memp 2508.06433 (A3, RELEVANT_SECTIONS: only cited deprecation regimen) | DEEP_EXTERNAL + RUNE_DIRECT | — | E10/E11: one-shot promotion; stale skill survives environment change |
+| AC-R1-C006 | Learning-form hierarchy: procedure > retrieval > LoRA-adapter > full-FT/weight-editing (rejected); adapters = the safe local-finetune form; weight-editing rejected | 152 modules = procedural layer already dominant | LoRA-learns-less-forgets-less 2405.09673 (A3, RELEVANT_SECTIONS: forgetting asymmetry); intruder-dimensions 2410.21228 (A3, ABSTRACT_ONLY); RippleEdits 2307.12976 (A3, ABSTRACT_ONLY: edits fail logical propagation) | DEEP_EXTERNAL + DESIGN_INVARIANT | — | E20: adapter beats procedure on reliability+rollback for the same capability |
+| AC-R1-C007 | Escalation: pass@1-derived difficulty bins + verifier availability + deterministic gate-failure counters + sample disagreement; NOT raw confidence/self-critique; hardest-bin → refuse-and-report | no routing policy exists (greenfield); #400 carry (confidence ≠ truth) | Snell 2408.03314 (A2-28, RELEVANT_SECTIONS: difficulty bins, >4× efficiency, hardest-bin yields nothing); P(True)/verbalized-confidence calibration evidence (A2, ABSTRACT_ONLY) | DEEP_EXTERNAL + DESIGN_INVARIANT | bins need Rune's own outcome history (bootstrap from logged gateway) | E14: raw confidence outperforms difficulty bins |
+| AC-R1-C008 | NO cascade/routing policy now; log (query, model, outcome) via a single logged gateway; speculative decoding = the lossless adaptive-compute win (needs llama.cpp/vLLM serving — Ollama MTP-only) | ad-hoc frontier use bypasses any policy (inward BYPASS); config-default 27B = ungoverned routing today | FrugalGPT 2305.05176 (A1, RELEVANT_SECTIONS: 2023 pricing artifact, scorer needs in-distribution labels); llama.cpp speculative docs (A4, DOCUMENTATION_AUDITED); #383 carry (cascade = scale artifact) | DEEP_EXTERNAL + RUNE_DIRECT | gateway must log before any routing decision | E5: cascade wins at n≈924 without labels |
+| AC-R1-C009 | Capability registry: canonical slug vs drifting aliases; declared vs probed vs observed vs stale (TTL); same-name models change behavior both directions | 11 providers, declared-only truth, staleness undetectable (inward B) | OpenRouter Models API (A2-22, DOCUMENTATION_AUDITED: canonical_slug/supported_parameters/expiration_date); MCP (A2-21, DOCUMENTATION_AUDITED: ttlMs, version-mismatch errors); ChatGPT-drift 2307.09009 (A2-19, ABSTRACT_ONLY: same-name behavior drifts both directions 84%→51%) | DESIGN_INVARIANT + RUNE_DIRECT (anchors are documentation-depth — deliberately NOT DEEP_EXTERNAL) | — | E17: declaration overrides observed runtime truth |
+| AC-R1-C010 | No-model mode: deterministic modules + SQLite + retrieval + skills keep working; structured/declared status communication (templates), never generated prose; silent embedding degradation fixed architecturally (probe-and-report + retrieval-fallback rung + per-write model+digest) | no-model mode works by accident (inward I); embedding fails SILENTLY (inward G); Ollama silent-truncation is an OPEN upstream defect (A4 community evidence) | #403 carry (embedding model+digest per write); Ollama docs + issue tracker (A4, DOCUMENTATION_AUDITED + COMMUNITY_EVIDENCE_RELIABILITY_LABELED) | RUNE_DIRECT + DESIGN_INVARIANT | — | E21/E25: fabricated fluent status or silent state loss in no-model drill |
+| AC-R1-C011 | Security: local models remain untrusted semantic components; model supply-chain risk real; local ≠ private (logs/caches/swap/process memory) | local = same-uid process (carried #402: no enforcement layer); Ollama models run with full user authority | #402 sealed carry (key-custody honesty; same-uid malware); supply-chain arm-4 evidence | DESIGN_INVARIANT + RUNE_DIRECT | — | E24: untrusted local model gains authority |
+| AC-R1-C012 | GROWTH DELTA: measured analogous-task improvement after verified internalization; installing a model or storing text ≠ learning | growth delta machinery DESIGNED never DEMONSTRATED (inward E); 0 measured deltas | #399/#400 carry (Growth Delta doctrine); WebRL outcome evidence (A3, external finding) | DESIGN_INVARIANT + RUNE_DIRECT | — | E25: no measured improvement after internalization |
+| AC-R1-C013 | 27B IQ2_M kept ONLY if locally measured per task; 4-bit weight-only = evidence-backed floor for reasoning; quantization loss is task/difficulty/size/calibration-sensitive | 27B IQ2_M is the config default (inward A) — unmeasured on Rune tasks | Quantization task-sensitivity 2504.04823 (A1, RELEVANT_SECTIONS: harder tasks degrade up to 4× more); GGUF k-quant + imatrix docs (A1, DOCUMENTATION_AUDITED); calibration-sensitivity 2608.01078 (A1, ABSTRACT_ONLY) | DEEP_EXTERNAL + RUNE_DIRECT | no direct 27B-IQ2M-vs-Q4 study exists (bounded zero-hit — extrapolations labeled) | E13: 27B IQ2_M matches 14B-Q4 on Rune-relevant tasks (then keep it) |
+| AC-R1-C014 | Multi-teacher: models = candidate generators, execution = judge; consensus adds little (correlation rises with capability) | 11 providers available but used ad-hoc; no multi-teacher learning design | 2506.07962 (A3, ABSTRACT_ONLY — external finding: ~60% agreement when both err; correlation rises with capability); self-vote non-monotonic 2403.02419 (A3, ABSTRACT_ONLY) | DESIGN_INVARIANT + EXTERNAL finding | — | E9: majority vote upgrades evidence authority |
+| AC-R1-C015 | Distillation/adapter training NOT a T1 mechanism for Rune (bounded-task distillate≈teacher needs 500-800K-scale data + verifiable output space; Rune's corpus is n≈944) | no fine-tuning infrastructure; Ollama least transparent runtime on quant axis | 2301.12726 (A1, RELEVANT_SECTIONS: specializing small LMs — in-domain match, generic CoT zeroes); R1 2501.12948 (A3, FULL_PAPER §F: distillation beats RL for small models but benchmark ≠ agentic competence) | DEEP_EXTERNAL + RUNE_DIRECT | revisit if a bounded task class accumulates ≥100s verified labels | E12: bounded distillation succeeds at Rune's data scale |
+| AC-R1-C016 | Resource contention: foreground wins; background local inference yields to active user work (cognitive scheduling principles; topology → #405) | 16GB VRAM shared with user gaming/coding (inward H); idle-GPU ≠ license | #400/#394 carry; arm-2 degradation ladder | DESIGN_INVARIANT | — | E18: background inference degrades active user work |
+| AC-R1-C017 | POST_R1_PIPELINE_UPGRADE_PENDING (STORM/Co-STORM-inspired OUTWARD upgrade) — recorded, NOT applied; comparability of #404–#406 with existing R1 programme preserved | mandate §61 directive | mandate directive | DESIGN_INVARIANT (process decision) | — | — |
+
+## DEEP_EXTERNAL discipline
+
+DEEP_EXTERNAL rows cite anchors at RELEVANT_SECTIONS/FULL_PAPER depth only (CoALA A2-1; Apple 2407.21075 A2-15; Snell 2408.03314 A2-32; FrugalGPT 2305.05176 A1; quantization-sensitivity 2504.04823 A1; Voyager A3; DAgger A3; LoRA-forgets-less A3; R1 §F A3; Memp A3; 2301.12726 A1). ABSTRACT_ONLY / DOCUMENTATION_AUDITED / METADATA_VERIFIED / COMMUNITY-labeled anchors are NEVER DEEP_EXTERNAL — they appear as DESIGN_INVARIANT, RUNE_DIRECT, or explicitly typed EXTERNAL-finding support (the claim is only the external result). Full C001–C017 support↔source↔depth↔proposition audit performed; no shallow anchor labeled DEEP_EXTERNAL; no claim downgraded — no support proved shallower than recorded.

research/memory-atlas-r1/AC-local-offline-intelligence/mutation_audit.md

@@ -0,0 +1,43 @@
+# #404 AC — CONTENT-FREEZE MUTATION AUDIT (2026-09-22)
+
+STATUS: CONTENT-FREEZE AUDIT — final-state declaration; this file is the ACTUAL LAST write. After this write, NO file is modified; only read-only gates, git transport, and Gitea receipts follow.
+
+## Run provenance
+
+Full new-domain R1_FULL run. ONE controller; arms strictly serial (general-21 → general-22 → general-23 → general-24), all first-pass SUCCESS; MAX_CONCURRENT_SUBAGENTS = 1 held. **CONTINUOUS_EXECUTION = PASS** — zero user continuations. Source-access: arXiv export-API 429s → abs/HTML/OpenAlex fallbacks; **17 mis-paired arXiv IDs caught across arms — including prompt-supplied IDs** (the discipline pays). Research-only boundary held: no production Memory/model/runtime/TUI changes; inward read-only.
+
+## Mutation categories (actual, at freeze)
+
+PRODUCTION_CODE_MUTATION = NONE · PRODUCTION_SCHEMA_MUTATION = NONE · PRODUCTION_RUNTIME_BEHAVIOR_MUTATION = NONE.
+RESEARCH_TOOLING_MUTATION = YES (research-only) — scripts/research_gate_check.py: `_LBM_DOMAINS` and `_EXACTREF_DOMAINS` extended to include "AC-" (all harness-baseline checks now cover this domain).
+GITEA_MUTATION = pre-freeze: #404 reopened + start comment 6241; post-freeze: receipts.
+RESEARCH_ARTIFACT_MUTATION = YES — full domain body: 00_issue_scope.md · 01_inward.md · 02_outward/arm1_foundations.md (36 sources) · arm2_agent_architecture.md (39) · arm3_internalization.md (42) · arm4_systems_adversarial.md (Part A 40 + Part B 118 attacks) · 03_applicability.md (60 rows) · 04_innovation.md (20) · 05_adversarial.md (118 rows) · 06_synthesis.md (18 matrices) · 07_qualification.md (37) · claims.json (17) · load_bearing_evidence.md (C001–C017) · sources.md + source_ledger.json (canonical, 156 rows) · r0_reconciliation.md · preliminary_reconciliation.md · evidence_saturation.md · r0_baseline_extract.md · AC_LOCAL_OFFLINE_INTELLIGENCE_R1_BATCHED_PRELIMINARY.md (byte-preserved) · AC_LOCAL_OFFLINE_INTELLIGENCE_R1_MASTER.md (rewritten) · this audit.
+REGISTRY_MUTATION = YES (pre-freeze) — domain_registry.md row 404 rewritten from batched-era text ("single-writer stance confirmed; staged earn-in" NOT inherited) to this run's row truth.
+RESEARCH_RESULT_AFFECTED = NO — batched master byte-identical (sha b29810f1…); family Section AC untouched; prior domains untouched.
+
+## Harness-baseline compliance (R1_HARNESS_BASELINE_VERSION = 1.0 rev.2)
+
+- **Rich canonical ledger:** source_ledger.json is canonical; sources.md is a generated projection. Contract fields present (source_id, row_kind, stable_identifier, title, authors, year, venue, version, source_type, modality, task, dataset, method, key_claims, negative_results, limitations, rune_relevance, read_depth, origin_ref, origin_row_hash, normalization_id, raw_origin_cells). Named normalizations: ac_arm_pipe_table_v1 · ac_arm_block_v1 · ac_arm_doc_block_v1 · depth_label_from_arm_cell_v1 · row_kind_classify_v1.
+- **Row-kind accounting (mechanically derived): LEDGER_ROWS = 156 · EXTERNAL_SOURCE_ROWS = 150 · UNIQUE_EXTERNAL_SOURCES = 147 · POINTER_ROWS = 6 · SYNTHESIS_ROWS = 0 · DUPLICATE_SOURCE_GROUPS = 2** (Voyager 2305.16291 → A2-18/A3-13/A4-24; DeepSeek-R1 2501.12948 → A3-1/A4-26). Six POINTER rows = cross-reference/carry-over rows honestly labeled (A1-26 Phi-4 cross-ref; A1-35/36 #383/#403 carry-overs; A4-22 skipped-per-mandate; A4-33/36 absorbed-into-arm-anchors). Depth counts: ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 28 · RELEVANT_SECTIONS 11 · FULL_PAPER 4 (Voyager, DAgger, DeepSeek-R1, +1) · INHERITED_VERIFIED 8 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3 (+6 pointer rows NOT_RECORDED by design). AC-specific honest labels documented (INHERITED_VERIFIED; COMMUNITY_EVIDENCE_RELIABILITY_LABELED).
+- **Origin→canonical→projection integrity:** every row carries origin_ref (arm file + row/block anchor) + origin_row_hash; the gate resolves and checks fidelity.
+- **Freeze enforcement: PARTIAL (stated honestly).** Implemented: mtime-based mutation-audit freshness + the post-freeze read-only protocol recorded here. NOT implemented: deterministic hash-manifest, physical write prevention. No such mechanism is claimed.
+- **Memory safety hold:** CANONICAL_MEMORY_WRITE = 0 · DERIVED_MEMORY_WRITE = 0 — CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX active for #404–#406; master + registry + Gitea are the durable summary authorities.
+
+## Adversarial pass (arm 4 Part B, independent fresh context)
+
+118 attacks (100 mandated + 18 Rune-specific): **SUCCEEDS 14 · PARTIAL 20 · FAILS 84** (row-derived; 05_adversarial.md). Zero SUCCEEDS against the epistemic core; all 14 are Rune-specific production gaps. Five forced corrections applied to the architecture: (1) resource-starved ladder rung (telemetry-defined degradation); (2) per-lesson counterfactual measurement is the unbuilt load-bearing wall — validate first on the 7 existing lessons; (3) capability registry + one logged gateway are prerequisites (config-default 27B = ungoverned routing today); (4) rung 5 needs NO_MODEL_SAFE tagging + templates + a scheduled chaos drill; (5) independence-vs-quality trade needs an explicit revisit trigger and a time-boxed 27B-vs-14B-Q4 measurement.
+
+## Row truth at freeze (machine-derived)
+
+applicability 60 = ADOPT 33 · ADAPT 0 · EXPERIMENT 2 · FUTURE 1 · REJECT 23 · PARK 1 · qualification 37 = ADOPT 35 · EXPERIMENT 1 · REJECT 1 · R0 5 = CONFIRMED 5 · preliminary 6 = CONFIRMED 4 · REFINED 2 · claims 17 = ADOPT 17 (all RUNE_APPLICABLE) · innovation 20 = ADOPT 14 · EXPERIMENT 4 · FUTURE 1 · PARK 1 · sources 156 = 150 external / 147 unique / 6 pointer / 2 duplicate groups · SEARCH_SATURATION = REACHED · LOAD_BEARING_DEPTH = PASS · 7 bounded-search gaps.
+
+## Preserved
+Batched preliminary byte-identical (sha b29810f1…) · family Section AC untouched · prior sealed domains untouched · harness baseline inherited (no new source-ledger format invented; AC-specific depth labels are additive and documented) · #402 security carry · #403 multimodal carry · POST_R1_PIPELINE_UPGRADE_PENDING recorded (mandate §61, NOT applied — comparability preserved).
+
+## Post-freeze protocol (governing)
+
+After this audit: ALLOWED = read-only gate execution (AC + AB/AA/Z/Y/X/W R1_FULL regression), git status/diff/hash, `git show`, the ONE seal commit, push origin + gitea, mirror verification, Gitea receipt posting, read-only file opening, final natural-language response. FORBIDDEN = negative controls, temporary tracked-file edits, artifact/registry/tooling edits, session-note appends, memory_store.py, memory_consolidation.py, any canonical/derived state write. If ANY forbidden post-freeze write occurs: **FREEZE_STALE = TRUE automatically** — reseal only via a genuinely NEW final audit written LAST. Nothing durable follows the seal.
+
+## Freeze declaration
+
+All mutations (artifacts + canonical ledger + projection + master + registry + gate domain-scope) are complete BEFORE this audit. **This audit is the ACTUAL LAST write.** Sequence: FINAL_CONTENT_GATE (read-only) → ONE seal commit → push/mirror/verify → Gitea #404 + #375 receipts → STOP. STOP MEANS STOP.

research/memory-atlas-r1/AC-local-offline-intelligence/preliminary_reconciliation.md

@@ -0,0 +1,12 @@
+# #404 AC — Batched-Preliminary Reconciliation (batched master b29810f1…; 2026-09-22)
+
+| P | Batched conclusion | Verdict | Evidence |
+|---|---|---|---|
+| P-1 | ADOPT: local embedding (nomic via Ollama — MTEB parity with Ada-002/emb-3-small) | CONFIRMED | Arm 1/2 + family R0-2; strengthened: qwen3-embedding:0.6b is the better current option and is installed-but-unwired; version-stamping is a precondition (C010), not an option. |
+| P-2 | REJECT: local LLM consolidation (summarize/merge/rewrite) with small models — silent quality loss, unmeasurable without ground truth | CONFIRMED | Arm 1's bounded-task verdict + arm 2's verification-availability finding + arm 4's F-specific attacks all support the rejection; the rationale is refined from "small models can't" to "**quality is unmeasurable without a quality gate** — the gate is the missing piece, not the model size." Recorded as EXPERIMENT-eligible once a measured gate exists (R0-1 refinement). |
+| P-3 | EXPERIMENT: small local models for MECHANICAL ops only (dedup clustering, tag/title extraction, tool-call classification) | CONFIRMED | Arm 2: Octopus v2 (2B on-device beats GPT-4 on function calling with restructured action representation, 95% less context); arm 1's bounded-task class evidence. Mechanical ops are exactly the evidenced-viable class. |
+| P-4 | FUTURE: quantized consolidation, revisit when an ≤8B A/B study on memory-consolidation quality exists | REFINED | The evidence situation is clearer than "no study exists": quantization loss is task-sensitive (2504.04823 RS) and Rune's own 27B IQ2_M is UNMEASURED (bounded zero-hit on a direct 27B-IQ2M-vs-Q4 comparison). Refined to: **measure locally per task (E13) rather than wait for an external study** — the local harness is the missing instrument. |
+| P-5 | Evidence grades: QLoRA NF4 preserves task performance; quantization degradation predictable; layer-pruning headroom | CONFIRMED | Arm 1 verified: QLoRA 2305.14314, degradation 2103.13630, pruning 2403.17887 — all confirmed as cited; the "predictable" claim is refined to "**task/difficulty/calibration-sensitive**" (2504.04823), which is a sharper and more useful statement. |
+| P-6 | R0 reconciliation at batch: 2 CONFIRMED · 1 REFINED · Sum 3 | REFINED | This run's independent R0 derivation found FIVE family findings (R0-1..R0-5), not three — the batched reconciliation under-counted the family baseline. Row truth now: R0 Sum 5, all CONFIRMED with inline refinements. |
+
+Row-derived: CONFIRMED 4 · REFINED 2 · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 6).

research/memory-atlas-r1/AC-local-offline-intelligence/r0_baseline_extract.md

@@ -0,0 +1,10 @@
+# #404 AC — R0 Baseline Extract (family file Section AC; reconnaissance, NOT authority)
+
+Source: families/offline_intelligence_resource_placement.md §AC + batched master (b29810f1…). Re-derive one-to-one during R0_RECONCILIATION; do not inherit.
+
+- R0-1 (family): Per-operation mechanism matrix — query intent = deterministic FSM/regex (COVERED); filing/classification = small embedding + kNN/linear head (ADAPT); new-memory extraction = 3-8B local LLM + grammar-constrained JSON (ADAPT); contradiction detection = cross-encoder reranker filter + LLM adjudicator on conflicts only (EXPERIMENT); summarization/consolidation = local 4-8B Q4 async with quality gate (ADAPT). Evidence class: mostly reasoned/standard-practice — no published per-operation matrix exists.
+- R0-2 (family): Embedding status — nomic-embed-text-v1.5 (62.28 MTEB-EN) viable but qwen3-embedding:0.6b better (64.33 multilingual, 32K ctx); vectors across models NOT comparable; store raw text + model_id per vector so re-embedding is a background pass.
+- R0-3 (family): Structured generation — grammar-constrained decoding: syntactic failure ≈0 but SEMANTIC degradation of reasoning is real (2408.02442); constrain only extraction-shaped outputs.
+- R0-4 (family): Adversarial risk — silent drift from task-prefix omissions and truncated context (nomic defaults 2048 ctx in Ollama) — degradation WITHOUT errors.
+- R0-5 (family): T1 impact YES — store text + embedding-model version; keep classifier/extraction tiers pluggable now.
+- Batched-master verdicts to reconcile: ADOPT local embedding (nomic via Ollama, MTEB parity evidence); REJECT local LLM consolidation with small models (silent quality loss, unmeasurable); EXPERIMENT small models for MECHANICAL ops only; FUTURE quantized consolidation pending ≤8B A/B study. Evidence: QLoRA NF4 (2305.14314); quantization degradation predictable (2103.13630); layer-pruning headroom (2403.17887). Batched R0: 2 CONFIRMED · 1 REFINED · Sum 3.

research/memory-atlas-r1/AC-local-offline-intelligence/r0_reconciliation.md

@@ -0,0 +1,11 @@
+# #404 AC — R0 Reconciliation (family Section AC baseline; 2026-09-22)
+
+| R0 | Family claim | Verdict | Evidence |
+|---|---|---|---|
+| R0-1 | Per-operation mechanism matrix: query intent deterministic; filing/classification small-embedding+kNN; extraction 3-8B local + grammar JSON; contradiction detection reranker+LLM-adjudicator; consolidation local 4-8B async | CONFIRMED | Arm 1/2 evidence supports the mechanism CLASSES per operation; REFINED detail: (a) "extraction 3-8B" holds but grammar-constrained decoding taxes reasoning (constraint tax 19.7→11.0% at ≤2B — extraction field formats only); (b) consolidation "local 4-8B async" carries the batched REJECT (silent quality loss unmeasurable) — downgraded to EXPERIMENT pending a measured quality gate; (c) contradiction detection as reranker-filter + LLM-on-conflicts is CONFIRMED as the right shape (arm 2: verifier availability is the binding escalation constraint). Row truth recorded with the refinements inline. |
+| R0-2 | Embedding status: nomic viable; qwen3-embedding:0.6b better; vectors across models NOT comparable; store raw text + model_id per vector | CONFIRMED | Inward: qwen3-embedding:0.6b INSTALLED but UNWIRED (dormant); vectors unversioned (no model column — carried #403 defect). Arm evidence: #403 established version-stamping as precondition. The family's recommendation stands and is now an ADOPT-precondition (C010). |
+| R0-3 | Structured generation: grammar-constrained decoding syntactic failure ≈0, semantic degradation real (2408.02442); constrain extraction-shaped outputs only | CONFIRMED | Arm 1: constraint tax measured (validity 61.5→100%, accuracy 19.7→11.0% at ≤2B); 2509.21791 (confounded effects, task-dependent) REFINES the causal story but not the design rule. |
+| R0-4 | Adversarial risk: silent drift from task-prefix omissions and truncated context (Ollama nomic 2048 ctx default) | CONFIRMED | Arm 4 (primary docs): Ollama context default is VRAM-dependent (4k on Rune's 16GB card), keep_alive 5min, parallel requests multiply KV, and **embedding-input truncation is an OPEN upstream defect class**. WIDENED by arm-4 evidence: the risk is structural, not incidental — C010's architectural fix (probe-and-report) is the response. |
+| R0-5 | T1 impact YES: store text + embedding-model version; keep classifier/extraction tiers pluggable now | CONFIRMED | Inward confirms the versioning gap; harness rich-ledger contract already demonstrates the pluggable-tier pattern. |
+
+Row-derived: CONFIRMED 5 · REFINED 0 (refinements inline) · OVERTURNED 0 · STILL_UNKNOWN 0 (Sum 5).

research/memory-atlas-r1/AC-local-offline-intelligence/sources.md

@@ -0,0 +1,254 @@
+# #404 AC — Source Ledger
+
+**Canonical form: `source_ledger.json` (structured; per-row origin provenance + origin_row_hash + normalization_id + row_kind). This file is a GENERATED projection — edit the JSON and rebuild; never hand-edit rows here.** Harness: R1_HARNESS_BASELINE_VERSION = 1.0 rev.2.
+
+Schema: source_id · row_kind (SOURCE/POINTER/SYNTHESIS) · stable_identifier · title · authors · year · venue · version · source_type · modality · task · dataset · method · key_claims · negative_results · limitations · rune_relevance · read_depth · origin_ref · origin_row_hash · normalization_id · raw_origin_cells. AC-specific honest depth labels: INHERITED_VERIFIED (verified in a prior sealed domain's arms, carried) · COMMUNITY_EVIDENCE_RELIABILITY_LABELED. NOT_RECORDED_IN_ARM = the arm did not record the field.
+
+**Derived accounting (mechanical, from source_ledger.json): LEDGER_ROWS = 156 · EXTERNAL_SOURCE_ROWS = 150 · UNIQUE_EXTERNAL_SOURCES = 147 · POINTER_ROWS = 6 · SYNTHESIS_ROWS = 0 · DUPLICATE_SOURCE_GROUPS = 2.**
+
+Duplicate map (identity → SOURCE row IDs):
+- arxiv:2305.16291 → A2-18 + A3-13 + A4-24
+- arxiv:2501.12948 → A3-1 + A4-26
+
+**Depths (derived): ABSTRACT_ONLY 93 · DOCUMENTATION_AUDITED 28 · RELEVANT_SECTIONS 11 · INHERITED_VERIFIED 8 · NOT_RECORDED_IN_ARM 6 · FULL_PAPER 4 · METADATA_VERIFIED 3 · COMMUNITY_EVIDENCE_RELIABILITY_LABELED 3 = 150 labeled + 6 pointer rows (NOT_RECORDED by design).** Source TYPE and read DEPTH separate.
+
+## Do-not-cite / unverifiable register
+
+- 17 mis-paired arXiv IDs caught across arms: 2510.05040, 2402.04937 (BitNet=2402.17764), 2109.05074 (PICARD=2109.05093), 2409.02409 (CoALA=2309.02427), 2203.07154 (self-consistency=2203.11171), 2305.18365 (ReWOO=2305.18323), 2305.09658 (FrugalGPT=2305.05176), 2403.02719, 2401.08900, 2310.08920, 2307.02958, 2401.01280, 1912.13488, 2006.03844, 2205.10436, 2411.13843, RLVF (unverifiable). Plus: 'hallucination inheritance' as quantified phenomenon (bounded zero-hit); direct 27B-IQ2M-vs-Q4 benchmark (none); MobileLLM gloss; IQ2_M bpw figures; unverified HuggingGPT/AutoGen/MetaGPT statistics; De Lange survey (DOI only).
+
+| A1-1 | SOURCE | 1 | 2402.14905 | MobileLLM: Optimizing Sub-billion Parameter Language Models for On-Device Use Cases | Liu, Zhao, Iandola et al., 2024, Meta (ICML 2024) | ABSTRACT_ONLY | Rune's 3B/7B tier is 3–20× larger than what MobileLLM shows is enough for bounded tool-call/API-call class tasks — routing/extraction/tool invocation is provabl |
+| A1-2 | SOURCE | 2 | 2404.14219 | Phi-3 Technical Report | Abdin, Aneja, Awadalla et al., 2024, Microsoft | ABSTRACT_ONLY | Rune's 14B generalist sits at the phi-3-medium class: 78 MMLU ≈ capable, but the report's own scaling (69→75→78) shows each size step buys ~3–6 MMLU points — sm |
+| A1-3 | SOURCE | 3 | 2412.08905 | Phi-4 Technical Report | Abdin, Behl, Bubeck, Eldan, Gunasekar et al., 2024, Microsoft | ABSTRACT_ONLY | THE synthetic-data counterexample to doom narratives: a bounded, curriculum-designed synthetic pipeline at 14B can exceed the teacher on a target domain. Rune's |
+| A1-4 | SOURCE | 4 | 2412.15115 | Qwen2.5 Technical Report | Qwen Team (Yang et al.), 2024, Alibaba | ABSTRACT_ONLY | Rune's 14B generalist is plausibly Qwen2.5-class; the family covers 0.5B→14B, giving Rune a same-family ladder for cascade experiments (0.5B/1.5B/3B for routing |
+| A1-5 | SOURCE | 5 | 2409.12186 | Qwen2.5-Coder Technical Report | Hui, Yang, Cui et al., 2024, Alibaba | ABSTRACT_ONLY | Rune's 14B coder: function/completion/repair-class coding is SOTA-at-size; repo-scale multi-file coding remains unbenchmarked in every report — the evidence bas |
+| A1-6 | SOURCE | 6 | 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.), 2025 | ABSTRACT_ONLY | Rune's 27B IQ2_M + 14B: if either is R1-Distill-Qwen lineage, §3 of 2504.04823 (below) applies DIRECTLY — distilled reasoning models have specific quantization  |
+| A1-7 | SOURCE | 7 | 2503.19786 | Gemma 3 Technical Report | Gemma Team (Kamath, Ferret, …), 2025, Google | ABSTRACT_ONLY | The strongest generation-over-generation datapoint: 4B-IT ≈ prior-gen 27B-IT. Within-family quality gain (2024→2025) bought more than 6× parameter reduction. Fo |
+| A1-8 | SOURCE | 8 | 1503.02531 | Distilling the Knowledge in a Neural Network | Hinton, Vinyals, Dean, 2015 | ABSTRACT_ONLY | Foundation row. Rune's "lessons" store is a knowledge-transfer analogue: soft/graded evidence (when things worked, with what confidence) carries more transferab |
+| A1-9 | SOURCE | 9 | 2210.17323 | GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformers | Frantar, Ashkboos, Hoefler, Alistarh, 2022, ICLR 2023 | ABSTRACT_ONLY | GPTQ is calibration-sensitive: 2504.04823 found GPTQ degrades badly when calibration domain ≠ target domain (−9.8 avg points; fixable by calibrating on task-dom |
+| A1-10 | SOURCE | 10 | 2306.00978 | AWQ: Activation-aware Weight Quantization | Lin, Tang, Tang, Yang et al., 2023, MLSys 2024 | ABSTRACT_ONLY | 2504.04823's head-to-head verdict: AWQ preferred over GPTQ for weight-only at 4-bit (comparable quality, faster). For Rune's tiering: AWQ-quantized models are t |
+| A1-11 | SOURCE | 11 | 2305.14314 | QLoRA: Efficient Finetuning of Quantized LLMs | Dettmers, Pagnoni, Holtzman, Zettlemoyer, 2023, NeurIPS 2023 | ABSTRACT_ONLY | The enabling tool for Rune's empty learning machinery: a 14B model can be finetuned on 16 GB VRAM via 4-bit + LoRA on lesson-derived data. The QLoRA evidence sa |
+| A1-12 | SOURCE | 12 | 2402.17764 | The Era of 1-bit LLMs: All Large Language Models are in 1.58 Bits (BitNet b1.58) | Ma, Wang, Ma, Wang et al., 2024, Microsoft | ABSTRACT_ONLY | Hard boundary: Rune's 27B IQ2_M is a PTQ model. BitNet-class parity does not transfer to it. Any reasoning of the form "ternary works (BitNet), so 2-bit PTQ is  |
+| A1-13 | SOURCE | 13 | 2404.14047 | An empirical study of LLaMA3 quantization: from LLMs to MLLMs | Huang, Zheng, Ma, Qin et al., 2024 | ABSTRACT_ONLY | Corroborates 2504.04823 with a different model family: modern heavily-trained models do NOT out-quantize older ones. Rune cannot assume its 2024/2025-era models |
+| A1-14 | SOURCE | 14 | 2504.04823 | Quantization Hurts Reasoning? An Empirical Study on Quantized Reasoning Models | Liu, Sun, Zhang, Bai et al., 2025, Huawei Noah's Ark Lab | RELEVANT_SECTIONS | Rune's 27B IQ2_M sits BELOW the study's tested floor. Extrapolation chain: W3 loses 5.4–6.3 avg points on a 7B; 2-bit PTQ is worse; IQ2_M is a ~2.5 bpw-class qu |
+| A1-15 | SOURCE | 15 | 2608.01078 | Attend to Your Own Thoughts: Breaking the Barrier for PTQ of Reasoning LLMs through the Lens of 1.58-Bit Quantization (ScaleQ-1.58) | Wang, Li, Kang, Fan, Yao, 2026 | ABSTRACT_ONLY | Directly extends the family file's quantization finding to 2-bit PTQ: at Rune's IQ2_M operating point, failure is concentrated exactly where Rune needs capabili |
+| A1-16 | SOURCE | 16 | llama.cpp PR #1684 "k-quants" | k-quants (Q2_K…Q6_K + mixes) | ikawrakow / ggml, 2023, merged (GGUF ecosystem docs) | DOCUMENTATION_AUDITED | Q2_K-class ≈ 3.3 bpw effective; Rune's IQ2_M is below even that. The PR's own framing legitimizes 2-bit ONLY under a hard 16 GB ceiling — the same ceiling Rune  |
+| A1-17 | SOURCE | 17 | llama.cpp discussion #5263 | About imatrix overfitting, and importance of input text | community benchmark (Ikawrakow-style tests), 2024, GGUF ecosystem docs | DOCUMENTATION_AUDITED | Same mechanism as #14's GPTQ calibration finding, in the GGUF ecosystem Rune actually uses: whatever imatrix produced Rune's IQ2_M files, its input text determi |
+| A1-18 | SOURCE | 18 | 1606.07947 | Sequence-Level Knowledge Distillation | Kim, Rush, 2016, EMNLP 2016 | ABSTRACT_ONLY | Foundation for "distill teacher outputs, not logits": Rune's lesson pipeline can distill the 27B's *successful outputs* into prompts/templates for the 14B/7B —  |
+| A1-19 | SOURCE | 19 | 2305.02301 | Distilling Step-by-Step! Outperforming Larger Language Models with Less Training Data and Smaller Model Sizes | Hsieh, Li, Yeh, Nakhost, Fujii, Ratner et al., 2023, ACL Findings 2023 | ABSTRACT_ONLY | For Rune: extract the 27B's *reasoning* (why this lesson, why this fix) as supervision, not just verdicts — rationales are the transferable part |
+| A1-20 | SOURCE | 20 | 2301.12726 | Specializing Smaller Language Models towards Multi-Step Reasoning | Fu, Peng, Ou, Sabharwal, Khot, 2023, ICML 2023 | RELEVANT_SECTIONS | Sharpest evidence on what distillation transmits: capability in-domain, loss out-of-domain, and no reliable internal signal of which is which. For Rune's lesson |
+| A1-21 | SOURCE | 21 | 2306.13649 | On-Policy Distillation of Language Models (GKD) | Agarwal, Vieillard, Zhou, Stanczyk, Ramos, Geist et al., 2023, Google DeepMind (ICLR 2024) | ABSTRACT_ONLY | For Rune: if it ever distills 27B→14B, on-policy (student's own attempts graded by teacher) beats copying teacher outputs — and this matches #382's SkillGen con |
+| A1-22 | SOURCE | 22 | 2408.12326 | Interactive DualChecker for Mitigating Hallucinations in Distilling Large Language Models | Wang, Suzuki, Sakaji, Izumi, 2024 | ABSTRACT_ONLY | Weak-but-real evidence that teacher-error transmission is an observed problem needing machinery, not a hypothetical. Paired with the bounded zero-hit below (no  |
+| A1-23 | SOURCE | 23 | 2305.17493 | The Curse of Recursion: Training on Generated Data Makes Models Forget (model collapse) | Shumailov, Shumaylov, Zhao, Gal, Papernot, Anderson, 2023, Nature 2024 | ABSTRACT_ONLY | Rune's feedback loop (agent writes lessons → lessons condition future behavior) is structurally a replace-or-accumulate choice. #23 says: never let synthetic/de |
+| A1-24 | SOURCE | 24 | 2404.01413 | Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data | Gerstgrasser, Schaeffer, Dey, Rafailov, Sleight, Hughes et al., 2024 | ABSTRACT_ONLY | Rune's append-only ledger architecture is the collapse antidote: derived data (lessons, summaries, embeddings) ACCUMULATES beside sources, never overwrites them |
+| A1-25 | SOURCE | 25 | 2306.11644 | Textbooks Are All You Need (phi-1) | Gunasekar, Zhang, Mendes et al., 2023, Microsoft | ABSTRACT_ONLY | The template for Rune's empty learning machinery: small model + bounded, exercise-shaped, verified synthetic data ≫ raw corpus. Rune's 152 deterministic modules |
+| A1-26 | POINTER | 26 | 2412.08905 | (Phi-4 — see row 3) | — | UNVERIFIED | Cross-reference: synthetic data done at curriculum quality EXCEEDED the teacher on STEM (row 3). Synthetic data helps when: bounded, curriculum-structured, veri |
+| A1-27 | SOURCE | 27 | 2211.17192 | Fast Inference from Transformers via Speculative Decoding | Leviathan, Kalman, Matias, 2022, Google, ICML 2023 | ABSTRACT_ONLY | Lossless local latency win for Rune: 3B drafts for 14B/27B targets, same-family (Qwen2.5 line covers 0.5B–14B — row 4). Zero quality risk, unlike every cascade/ |
+| A1-28 | SOURCE | 28 | 2302.01318 | Accelerating Large Language Model Decoding with Speculative Sampling | Chen, Borgeaud, Irving, Lespiau, Sifre, Jumper et al., 2023, DeepMind | ABSTRACT_ONLY | The formal guarantee Rune should demand of any local acceleration: distribution-preserving or it is a quality trade, not an optimization |
+| A1-29 | SOURCE | 29 | 2305.05176 | FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance | Chen, Zaharia, Zou, 2023, Stanford / Databricks | RELEVANT_SECTIONS | For Rune the economics invert: local tokens are ~free, so the cascade's 98%-cost driver is irrelevant; what remains is (a) latency/VRAM pressure, (b) the scorer |
+| A1-30 | SOURCE | 30 | 2406.18665 | RouteLLM: Learning to Route LLMs with Preference Data | Ong, Almahairi, Wu, Chiang et al., 2024, Berkeley | ABSTRACT_ONLY | The working routing signal is empirical per-query weak-model failure data, not a priori difficulty. Rune has no preference/failure dataset (0 measured deltas) → |
+| A1-31 | SOURCE | 31 | 2207.07061 | Confident Adaptive Language Modeling (CALM) | Schuster, Fisch, Gupta, Dehghani, Bahri, Tran et al., 2022, NeurIPS 2022 | ABSTRACT_ONLY | The one adaptive-compute scheme with a maintenance guarantee — but it is an inference-engine feature (model-internals), not a policy layer Rune can bolt on; not |
+| A1-32 | SOURCE | 32 | 2409.02136 | Large Language Models versus Classical Machine Learning: Performance in COVID-19 Mortality Prediction Using High-Dimensional Tabular Data | Ghaffarzadeh-Esfahani et al., 2024 | ABSTRACT_ONLY | Strongest direct number for the arm's classical-ML verdict: for bounded, labelled, structured tasks, 152 deterministic Python modules + classical models are not |
+| A1-33 | SOURCE | 33 | 2207.08815 | Why do tree-based models still outperform deep learning on tabular data? | Grinsztajn, Oyallon, Varoquaux, 2022, NeurIPS 2022 | ABSTRACT_ONLY | Rune's scale (n≈944 memory entries, hundreds of sessions) is ~10× BELOW the regime where trees already win: gradient boosting/logistic regression over hand-buil |
+| A1-34 | SOURCE | 34 | 1911.00172 | Generalization through Memorization: Nearest Neighbor Language Models (kNN-LM) | Khandelwal, Levy, Jurafsky, Zettlemoyer, Lewis, 2019, ICLR 2020 | ABSTRACT_ONLY | The conceptual charter for Rune's retrieval-first stance: factual/long-tail cognition can live in retrieval, not parameters. Combined with #383 (score-everythin |
+| A1-35 | POINTER | 35 | — carry-over #383 (IR domain, R1_QUALIFIED) | research/memory-atlas-r1/H-information-retrieval/ | — | UNVERIFIED | Retrieval without generation at Rune's scale is settled: BM25 + metadata + dense, fused by weighted combination. Any local "routing" instinct must re-justify it |
+| A1-36 | POINTER | 36 | — carry-over #403 (Arm 2, AB arms) | checkpoint-403-ab-arms-findings.md | — | UNVERIFIED | The versioned-embedding mandate applies to Rune's 3 embedders NOW: nomic-embed 256-d Matryoshka vectors are UNVERSIONED — silent-degrade-when-Ollama-down is the |
+| A1-37 | SOURCE | 37 | 2203.07814 | Competition-Level Code Generation with AlphaCode | Li, Choi, Chung, Kushman, Schrittwieser et al., 2022, DeepMind, Science 2022 | ABSTRACT_ONLY | The charter for verifier-guided local coding: Rune's 152 deterministic modules + tests are the execution oracle. Small models + test-filtered sampling is the ev |
+| A1-38 | SOURCE | 38 | 2305.20050 | Let's Verify Step by Step | Lightman, Kosaraju, Burda, Edwards, Baker, Lee et al., 2023, OpenAI | ABSTRACT_ONLY | Lesson/outcome logging design: record step-level traces, not just success/final answers — per-step grading is the evidenced-superior supervision signal, and Run |
+| A1-39 | SOURCE | 39 | 2109.05093 | PICARD: Parsing Incrementally for Constrained Auto-Regressive Decoding from Language Models | Scholak, Schucher, Bahdanau, 2021, EMNLP 2021 | ABSTRACT_ONLY | Positive pole of constrained decoding: for outputs with a real grammar (SQL, JSON matching a schema with semantics, tool-call syntax), constraint decoding is a  |
+| A1-40 | SOURCE | 40 | 2408.02442 | Let Me Speak Freely? A Study on the Impact of Format Restrictions on Performance of Large Language Models | Tam, Wu, Tsai, Lin, Lee, Chen, 2024 | ABSTRACT_ONLY | Confirms: GBNF for reasoning-heavy steps (planning, multi-step debugging) = self-inflicted handicap; GBNF for extraction/typing = near-free validity |
+| A1-41 | SOURCE | 41 | 2509.21791 | Quantifying the Impact of Structured Output Format on Large Language Models through Causal Inference | Yuan, Zhao, Zhang, Luo, Ma, 2025 | ABSTRACT_ONLY | Extension of the family-file finding: the correct posture is per-task-class empirical measurement (Rune's local eval harness — #403 forced-correction #8), not a |
+| A1-42 | SOURCE | 42 | 2605.26128 | The Constraint Tax: Measuring Validity-Correctness Tradeoffs in Structured Outputs for Small Language Models | Ray, 2026 | ABSTRACT_ONLY | The most Rune-specific number in this ledger: at ≤2B, unconstrained answer accuracy 19.7% halves under a hard schema. Rule: constrain the FORMAT of extraction f |
+| A3-1 | SOURCE | 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.) 2025, arXiv/Nature | distilled reasoning models — what transfers | R1- | internalization-learning | S1. 2501.12948 | DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via RL | DeepSeek-AI (Guo et al.) 2025, arXiv/Nature | distilled reasoning models — what transfers | R1-Distill-Qwen-32B hits A | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-2 | SOURCE | 2305.02301 | Distilling Step-by-Step! Outperforming Larger LMs with Less Training Data and Smaller Model Sizes | Hsieh et al. 2023, ACL Findings | small task-specific models | internalization-learning | S2. 2305.02301 | Distilling Step-by-Step! Outperforming Larger LMs with Less Training Data and Smaller Model Sizes | Hsieh et al. 2023, ACL Findings | small task-specific models matching/beating promp | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-3 | SOURCE | 1805.04770 | Born Again Neural Networks | Furlanello et al. 2018, ICML | self-distillation / interpretability of what KD transfers | Students with identical architecture to  | internalization-learning | S3. 1805.04770 | Born Again Neural Networks | Furlanello et al. 2018, ICML | self-distillation / interpretability of what KD transfers | Students with identical architecture to teacher outperform the  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-4 | SOURCE | 2306.02707 | Orca: Progressive Learning from Complex Explanation Traces of GPT-4 | Mukherjee et al. 2023 | explanation-trace distillation | (Noted for completeness; arm 1 ow | internalization-learning | S4. 2306.02707 | Orca: Progressive Learning from Complex Explanation Traces of GPT-4 | Mukherjee et al. 2023 | explanation-trace distillation | (Noted for completeness; arm 1 owns core distillation.)  | NOT_RECORDED_IN_ARM | METADATA_VERIFIED | NOT_RECORDED_IN_ARM |
+| A3-5 | SOURCE | 1011.0686 | A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning (DAgger) | Ross, Gordon, Bagnell 2011, AISTATS | distribution shift in  | internalization-learning | S5. 1011.0686 | A Reduction of Imitation Learning and Structured Prediction to No-Regret Online Learning (DAgger) | Ross, Gordon, Bagnell 2011, AISTATS | distribution shift in behavioural cloning | BC | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-6 | SOURCE | 2310.12823 | AgentTuning: Enabling Generalized Agent Abilities for LLMs | Zeng et al. 2023 | fine-tuning on agent trajectories | Instruction-tuning Llama-2 on ~1.8K high-qua | internalization-learning | S6. 2310.12823 | AgentTuning: Enabling Generalized Agent Abilities for LLMs | Zeng et al. 2023 | fine-tuning on agent trajectories | Instruction-tuning Llama-2 on ~1.8K high-quality interaction trajec | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-7 | SOURCE | 2310.05915 | FireAct: Toward Language Agent Fine-tuning | Chen et al. 2023 | trajectory fine-tuning | 500 GPT-4-generated trajectories fine-tuned into Llama2-7B yields +77%  | internalization-learning | S7. 2310.05915 | FireAct: Toward Language Agent Fine-tuning | Chen et al. 2023 | trajectory fine-tuning | 500 GPT-4-generated trajectories fine-tuned into Llama2-7B yields +77% HotpotQA; diversity of  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-8 | SOURCE | 2303.11366 | Reflexion: Language Agents with Verbal Reinforcement Learning | Shinn et al. 2023, NeurIPS | verbal (non-weight) learning from outcomes | Agents store self-gene | internalization-learning | S8. 2303.11366 | Reflexion: Language Agents with Verbal Reinforcement Learning | Shinn et al. 2023, NeurIPS | verbal (non-weight) learning from outcomes | Agents store self-generated *linguistic* refl | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-9 | SOURCE | 2310.01798 | Large Language Models Cannot Self-Correct Reasoning Yet | Huang et al. 2024, ICLR | intrinsic self-correction without external feedback | With no external feedb | internalization-learning | S9. 2310.01798 | Large Language Models Cannot Self-Correct Reasoning Yet | Huang et al. 2024, ICLR | intrinsic self-correction without external feedback | With no external feedback, self-correction pr | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-10 | SOURCE | 2211.00053 | Generating Sequences by Learning to Self-Correct | Le, Kayser?, actually: (Bengio group) 2022 | trained corrector decoupled from generator | A separate correcto | internalization-learning | S10. 2211.00053 | Generating Sequences by Learning to Self-Correct | Le, Kayser?, actually: (Bengio group) 2022 | trained corrector decoupled from generator | A separate corrector model (possibly smal | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-11 | SOURCE | 2308.10144 | ExpeL: LLM Agents Are Experiential Learners | Zhao et al. 2023, AAAI | insight extraction from experience without weight updates | Agent accumulates trajectorie | internalization-learning | S11. 2308.10144 | ExpeL: LLM Agents Are Experiential Learners | Zhao et al. 2023, AAAI | insight extraction from experience without weight updates | Agent accumulates trajectories, uses LLM to extract | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-12 | SOURCE | 2411.02337 | WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum RL | Qi et al. 2024, ICLR 2025 | outcome-grounded RL from verified web-task success | Self-ev | internalization-learning | S12. 2411.02337 | WebRL: Training LLM Web Agents via Self-Evolving Online Curriculum RL | Qi et al. 2024, ICLR 2025 | outcome-grounded RL from verified web-task success | Self-evolving curriculum (new | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-13 | SOURCE | 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | Wang, Xie, Jiang, Mandlekar, Xiao, Zhu 2023, TMLR/ICLR'24 | skill library — promotion mechanism | Promotion me | internalization-learning | S13. 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | Wang, Xie, Jiang, Mandlekar, Xiao, Zhu 2023, TMLR/ICLR'24 | skill library — promotion mechanism | Promotion mechanism (deep-read res | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-14 | SOURCE | 2409.07429 | Agent Workflow Memory (AWM) | Wang, Mao, Fried, Neubig 2024 | induced reusable workflows | Induces workflows (subroutines of abstracted actions) from trajectori | internalization-learning | S14. 2409.07429 | Agent Workflow Memory (AWM) | Wang, Mao, Fried, Neubig 2024 | induced reusable workflows | Induces workflows (subroutines of abstracted actions) from trajectories; +24.6% relative su | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-15 | SOURCE | 2508.06433 | Memp: Exploring Agent Procedural Memory | Fang et al. 2025 | build/retrieve/update of procedural memory | Distills trajectories into fine-grained step instructi | internalization-learning | S15. 2508.06433 | Memp: Exploring Agent Procedural Memory | Fang et al. 2025 | build/retrieve/update of procedural memory | Distills trajectories into fine-grained step instructions + script-level abs | NOT_RECORDED_IN_ARM | RELEVANT_SECTIONS | NOT_RECORDED_IN_ARM |
+| A3-16 | SOURCE | 2504.07079 | SkillWeaver: Web Agents can Self-Improve by Discovering and Honing Skills | 2025 | skills as synthesized APIs + practice | Agent discovers skills on new sites,  | internalization-learning | S16. 2504.07079 | SkillWeaver: Web Agents can Self-Improve by Discovering and Honing Skills | 2025 | skills as synthesized APIs + practice | Agent discovers skills on new sites, practices them, distil | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-17 | SOURCE | 2207.10397 | CodeT: Code Generation with Generated Tests | Chen et al. 2022, ICLR'23 | test-filtered sampling | Generate N programs + N test suites from the same LLM; rank p | internalization-learning | S17. 2207.10397 | CodeT: Code Generation with Generated Tests | Chen et al. 2022, ICLR'23 | test-filtered sampling | Generate N programs + N test suites from the same LLM; rank programs by dual execut | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-18 | SOURCE | 2401.08500 | Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering | Ridnik, Kredo, Friedman 2024 | multi-stage test-based iterative flow | GPT-4 Cod | internalization-learning | S18. 2401.08500 | Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering | Ridnik, Kredo, Friedman 2024 | multi-stage test-based iterative flow | GPT-4 CodeContests pass@5: 19%  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-19 | SOURCE | 2304.05128 | Teaching LLMs to Self-Debug | Chen, Lin, Schärli, Zhou 2023 | execution-feedback loop | Self-debugging with execution feedback + code explanation improves Spide | internalization-learning | S19. 2304.05128 | Teaching LLMs to Self-Debug | Chen, Lin, Schärli, Zhou 2023 | execution-feedback loop | Self-debugging with execution feedback + code explanation improves Spider by 2–3% (and hardest | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-20 | SOURCE | 2310.08992 | CodeChain: Modular Code Generation Through Chain of Self-revisions with Representative Sub-modules | 2023 | emergent reusable modules | Clusters generated sub-m | internalization-learning | S20. 2310.08992 | CodeChain: Modular Code Generation Through Chain of Self-revisions with Representative Sub-modules | 2023 | emergent reusable modules | Clusters generated sub-modules across samples, | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-21 | SOURCE | 2103.08493 | How Many Data Points is a Prompt Worth? | Logan IV et al. 2021, EMNLP Findings | data-equivalence of prompts | Fair-comparison log-linear analysis across classi | internalization-learning | S24. 2103.08493 | How Many Data Points is a Prompt Worth? | Logan IV et al. 2021, EMNLP Findings | data-equivalence of prompts | Fair-comparison log-linear analysis across classification tasks: prompt | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-22 | SOURCE | 1605.07723 | Data Programming (Snorkel) | Ratner et al. 2016, NeurIPS | weak supervision / labelling functions | Modelling noisy labelling functions as a generative process  | internalization-learning | S25. 1605.07723 | Data Programming (Snorkel) | Ratner et al. 2016, NeurIPS | weak supervision / labelling functions | Modelling noisy labelling functions as a generative process and denoising lets wea | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-23 | SOURCE | 1911.04252 | Self-training with Noisy Student improves ImageNet classification | Xie et al. 2020, CVPR | self-training (positive pole) | Iterative teacher→pseudo-label→large | internalization-learning | S26. 1911.04252 | Self-training with Noisy Student improves ImageNet classification | Xie et al. 2020, CVPR | self-training (positive pole) | Iterative teacher→pseudo-label→larger-noised-student reach | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-24 | SOURCE | 2307.02075 | Combating Confirmation Bias: A Unified Pseudo-Labeling Framework for Entity Alignment | Mao et al. 2023 | self-training pitfall | Confident pseudo-labels compou | internalization-learning | S27. 2307.02075 | Combating Confirmation Bias: A Unified Pseudo-Labeling Framework for Entity Alignment | Mao et al. 2023 | self-training pitfall | Confident pseudo-labels compound their own errors ac | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-25 | SOURCE | 2106.09685 | LoRA | Hu et al. 2021, ICLR'22 | adapter mechanics | Rank-decomposition adapters: 10,000× fewer trainable params, 3× less memory, no inference latency, ≈ full-F | internalization-learning | S28. 2106.09685 | LoRA | Hu et al. 2021, ICLR'22 | adapter mechanics | Rank-decomposition adapters: 10,000× fewer trainable params, 3× less memory, no inference latency, ≈ full-FT quality on the evalu | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-26 | SOURCE | 2305.14314 | QLoRA | Dettmers et al. 2023, NeurIPS | finetuning quantized models | 4-bit NF4 frozen base + LoRA ≈ 16-bit FT task performance (Guanaco 99.3% of ChatGPT on Vic | internalization-learning | S29. 2305.14314 | QLoRA | Dettmers et al. 2023, NeurIPS | finetuning quantized models | 4-bit NF4 frozen base + LoRA ≈ 16-bit FT task performance (Guanaco 99.3% of ChatGPT on Vicuna bench); 1,000+ mod | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-27 | SOURCE | 2405.09673 | LoRA Learns Less and Forgets Less | Biderman et al. 2024, ICML'25 | forgetting magnitudes — anchor | Deep-read results: in CPT (20B tokens code/math), LoRA subs | internalization-learning | S30. 2405.09673 | LoRA Learns Less and Forgets Less | Biderman et al. 2024, ICML'25 | forgetting magnitudes — anchor | Deep-read results: in CPT (20B tokens code/math), LoRA substantially underperform | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A3-28 | SOURCE | 2410.21228 | LoRA vs Full Fine-tuning: An Illusion of Equivalence | Ryu et al. 2024/25 | spectral mechanism of forgetting | LoRA-trained matrices develop "intruder dimension | internalization-learning | S31. 2410.21228 | LoRA vs Full Fine-tuning: An Illusion of Equivalence | Ryu et al. 2024/25 | spectral mechanism of forgetting | LoRA-trained matrices develop "intruder dimensions" (new high singular  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-29 | SOURCE | 1706.08840 | Gradient Episodic Memory (GEM) | Lopez-Paz & Ranzato 2017, NeurIPS | replay requirements | Continual learning with a small episodic memory of past examples cons | internalization-learning | S32. 1706.08840 | Gradient Episodic Memory (GEM) | Lopez-Paz & Ranzato 2017, NeurIPS | replay requirements | Continual learning with a small episodic memory of past examples constrains gradients so lo | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-30 | SOURCE | 2310.14152 | O-LoRA: Orthogonal Subspace Learning for LM Continual Learning | Wang et al. 2023, EMNLP Findings | adapter accumulation without replay | Successive tasks learn | internalization-learning | S33. 2310.14152 | O-LoRA: Orthogonal Subspace Learning for LM Continual Learning | Wang et al. 2023, EMNLP Findings | adapter accumulation without replay | Successive tasks learned in mutually orthogo | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-31 | SOURCE | 2202.05262 | ROME: Locating and Editing Factual Associations in GPT | Meng et al. 2022, NeurIPS | model editing | Causal tracing localizes factual recall to mid-layer FFNs;  | internalization-learning | S34. 2202.05262 | ROME: Locating and Editing Factual Associations in GPT | Meng et al. 2022, NeurIPS | model editing | Causal tracing localizes factual recall to mid-layer FFNs; rank-one edits update  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-32 | SOURCE | 2210.07229 | MEMIT: Mass-Editing Memory in a Transformer | Meng et al. 2023, ICLR'23 | batch model editing | Scales editing to thousands of associations on GPT-J/GPT-NeoX (o | internalization-learning | S35. 2210.07229 | MEMIT: Mass-Editing Memory in a Transformer | Meng et al. 2023, ICLR'23 | batch model editing | Scales editing to thousands of associations on GPT-J/GPT-NeoX (orders of magnitude bey | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-33 | SOURCE | 2307.12976 | Evaluating the Ripple Effects of Knowledge Editing in Language Models (RippleEdits) | Cohen-Wang et al. 2024, ICLR'25 | editing reliability — the negative | Edi | internalization-learning | S36. 2307.12976 | Evaluating the Ripple Effects of Knowledge Editing in Language Models (RippleEdits) | Cohen-Wang et al. 2024, ICLR'25 | editing reliability — the negative | Editing one fact creates  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-34 | SOURCE | 2210.10760 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman, Hilton 2022, ICML'23 | verifier gaming | Optimizing against a proxy reward first raises, then *d | internalization-learning | S37. 2210.10760 | Scaling Laws for Reward Model Overoptimization | Gao, Schulman, Hilton 2022, ICML'23 | verifier gaming | Optimizing against a proxy reward first raises, then *decreases*, gold-standa | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-35 | SOURCE | 2312.08935 | Math-Shepherd: Verify and Reinforce LLMs Step-by-step without Human Annotations | Wang et al. 2023/24, ACL'24 | process rewards from outcomes | Automatic proces | internalization-learning | S38. 2312.08935 | Math-Shepherd: Verify and Reinforce LLMs Step-by-step without Human Annotations | Wang et al. 2023/24, ACL'24 | process rewards from outcomes | Automatic process supervision: label e | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-36 | SOURCE | 2408.15240 | Generative Verifiers: Reward Modeling as Next-Token Prediction | Zhang et al. 2024/25 | verifier quality | GenRM (verification as CoT generation + majority vote | internalization-learning | S39. 2408.15240 | Generative Verifiers: Reward Modeling as Next-Token Prediction | Zhang et al. 2024/25 | verifier quality | GenRM (verification as CoT generation + majority vote) beats discriminative | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-37 | SOURCE | 2302.07215 | Multi-teacher KD as an Effective Method for Compressing Ensembles | Ilin et al. 2023 | ensemble→single distillation | Multi-teacher KD (logit/vote fusion) recov | internalization-learning | S40. 2302.07215 | Multi-teacher KD as an Effective Method for Compressing Ensembles | Ilin et al. 2023 | ensemble→single distillation | Multi-teacher KD (logit/vote fusion) recovers most of ensemble a | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-38 | SOURCE | 2506.07962 | Correlated Errors in Large Language Models | Raghavan et al.? (authors per abs page) 2025 | consensus ≠ corroboration | Across 350+ LLMs: models agree on errors | internalization-learning | S41. 2506.07962 | Correlated Errors in Large Language Models | Raghavan et al.? (authors per abs page) 2025 | consensus ≠ corroboration | Across 350+ LLMs: models agree on errors ~60% of the time on a | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A3-39 | SOURCE | 2403.02419 | Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems | Chen, Manoyina?, actually: (Stanford) 2024, ICML'25 | self-consensus scali | internalization-learning | S42. 2403.02419 | Are More LLM Calls All You Need? Towards Scaling Laws of Compound Inference Systems | Chen, Manoyina?, actually: (Stanford) 2024, ICML'25 | self-consensus scaling limits | Majority-v | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-1 | SOURCE | A1 | llama.cpp README + docs/ (ggml-org/llama.cpp, master, accessed this session) | implementation-ecosystem | The reference GGUF inference stack | Plain C/C++, CUDA/Metal/CPU backends; `llama-server` = OpenAI-compatible REST; multimodal (mtmd); quantize tool with imatrix ("accuracy loss… minimize | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-2 | SOURCE | A2 | llama.cpp docs/speculative.md | implementation-ecosystem | Speculative decoding guide | Three implementations: classic draft model, EAGLE-3 (hidden-state draft, one-layer transformer per target model), and mixing; speedups "when draft pre | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-3 | SOURCE | A3 | llama.cpp tools/server/README.md | implementation-ecosystem | Server structured output | `--grammar` (GBNF), `--json-schema` / per-request `json_schema` and `grammar` fields; invalid grammar → request error (never silent) | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-4 | SOURCE | A4 | k-quants PR #1684 + imatrix discussion #5263 (INHERITED from arm 1, DOCUMENTATION_AUDITED there) | implementation-ecosystem | Quant formats + calibration sensitivity | 2–6 bit ppl curves; "bigger quantizes better" bounded and non-monotone above ~13B; imatrix corpus choice measurably changes Q2_K quality | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-5 | SOURCE | A5 | vLLM docs (vllm-project/vllm main: features/quantization/README.md, features/structured_outputs.md) | implementation-ecosystem | Production-scale serving; paged attention; continuous batching; multi-backend quant kernels (`--linear-backend`); day-0 model support | Broadest: AWQ, GPTQ/GPTQModel, BitsAndBytes, FP8 W8A8/W4A16/INT4/INT8 via LLM Compressor, ModelOpt, TorchAO, Quark, GGUF (via gguf.md), quantized KV c | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-6 | SOURCE | A6 | mlx-lm README (ml-explore/mlx-lm main) | implementation-ecosystem | Apple-silicon-first; HF Hub one-command generate/chat; LoRA + full fine-tuning including on quantized models; distributed inference | 4/8-bit quantization + quantized LoRA training | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-7 | SOURCE | A7 | ONNX Runtime GenAI README (microsoft/onnxruntime-genai main) | implementation-ecosystem | Cross-platform (x86/x64/arm64; CPU/CUDA/DirectML/TRT-RTX/OpenVINO/QNN/WebGPU); powers Foundry Local, Windows ML, VS Code AI Toolkit; full generative loop incl. KV cache, logits processing, grammar spe | Block-quantized INT4 (RTN, accuracy-level options), FP8/INT8 variants per model package | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-8 | SOURCE | A8 | Ollama docs (docs/api.md, faq.mdx, context-length.mdx, capabilities/) + issue tracker | implementation-ecosystem | Simplest deployment; system service; model registry tags; keep_alive; context defaults by VRAM | Opaque: quant baked into registry tags (q4_K_M etc.); no per-layer backend transparency; no user-facing quantization tooling | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-9 | SOURCE | A9 | LM Studio developer docs (lmstudio.ai/docs, structured-output page) | implementation-ecosystem | Desktop app + headless service ("llmster as a Startup Task on Linux"); REST API + OpenAI-compat + Anthropic-compat endpoints; model loader with per-model context/ GPU-offload controls; "Idle TTL and A | GGUF (llama.cpp-derived engine) with visible quant picker and runtime context-length override | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-10 | SOURCE | A10 | Ollama faq.mdx / context-length.mdx | implementation-ecosystem | Context defaults scale with VRAM, silently: <24 GiB → 4k; 24–48 GiB → 32k; ≥48 GiB → 256k. Docs themselves say agents/coding tools "should be set to at least 64000" and warn "Ensure you have enough VR | On Rune's 16 GB card Ollama defaults to 4k context — the family file's 2048-ctx silent-drift finding is structural, not a misconfiguration: every agen | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-11 | SOURCE | A11 | Ollama faq.mdx (keep_alive) | implementation-ecosystem | Default keep_alive = 5 minutes; per-request `keep_alive` or OLLAMA_KEEP_ALIVE override; `ollama ps` shows GPU/CPU split and unload timer | Without keep_alive management, Rune's first token after 5 idle minutes pays full model load (for an 11 GB model: many seconds to minutes, worse under  | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-12 | SOURCE | A12 | Ollama faq.mdx (concurrency) | implementation-ecosystem | Parallel requests multiply the context allocation (2k ctx × 4 parallel = 8k KV memory); models must FULLY fit VRAM for concurrent load; otherwise queue | VRAM headroom on the shared 16 GB card is consumed quadratically by concurrency; Ollama will silently queue or CPU-offload rather than error | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-13 | SOURCE | A13 | Ollama issue tracker (community, reliability-labeled) | implementation-ecosystem | Multiple open/closed issues document silent context truncation: "/api/chat over-truncates history with large context (48k): trims almost everything instead of just overflow" (closed), "Context truncat | The truncation behavior Rune's family file observed is a *known, partially-unsolved defect class* in the exact runtime Rune depends on. Silent truncat | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | NOT_RECORDED_IN_ARM |
+| A4-14 | SOURCE | A14 | Ollama issue tracker (speculative decoding) | implementation-ecosystem | "Enable speculative decoding" (open); "Ollama 0.34.2 MTP speculative decoding regression with Qwen3.8 27B" (closed — MTP support exists for some model families/runners); mlxrunner speculative KV-buffe | Ollama's speculative decoding exists but is model-family-specific (MTP-head models) and regressed in the recent past; draft-model speculative decoding | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | NOT_RECORDED_IN_ARM |
+| A4-15 | SOURCE | A15 | Ollama docs/capabilities/ (embeddings, structured-outputs, tool-calling, thinking, vision, web-search, streaming) | implementation-ecosystem | Capabilities are *declared per model tag* by the registry/docs | Exactly the DECLARED-not-OBSERVED truth class the inward audit found in Rune's own config; Ollama's capability model gives Rune no observed-truth subs | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-16 | SOURCE | A16 | LM Studio docs (headless service, Idle TTL and Auto-Evict, per-load config) | implementation-ecosystem | Headless Linux service; auto-eviction of idle models (direct answer to shared VRAM); per-load context override; REST + OpenAI + Anthropic compat | Migration path candidate if Rune outgrows Ollama: same GGUF assets, explicit memory eviction policy, explicit context — two of Rune's three silent-deg | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-17 | SOURCE | A17 | Qwen team blog "Qwen2.5-Coder Series" (Nov 2024) | implementation-ecosystem | 32B-Instruct: "SOTA open-source code model, matching GPT-4o" on EvalPlus/LiveCodeBench/BigCodeBench; Aider code-repair 73.7 "comparable to GPT-4o"; McEval 65.9 across 40+ languages; MdEval 75.2; sizes | Every cited instrument is function-/snippet-level or benchmark-repair. The blog contains no SWE-bench or repo-scale agentic result at all (string-veri | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-18 | SOURCE | A18 | Qwen2.5-Coder Technical Report (2409.12186, INHERITED_VERIFIED arm 1) | implementation-ecosystem | 5.5T tokens; SOTA >10 code benchmarks at size; "repo-scale agentic coding not benchmarked in every report" (arm 1's own note) | Vendor instruments = HumanEval/MBPP/EvalPlus class | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-19 | SOURCE | A19 | SWE-bench leaderboard data (swebench.com page data parsed this session; Verified + bash-only "mini" boards) | implementation-ecosystem | The ≤14B evidence vacuum, quantified: on SWE-bench Verified, small-model entries are: RAG + SWE-Llama 7B — 0.7% resolved (2023, checked); Lingma SWE-GPT 7B — 18.2% (2024-10, unchecked submission); MCT | Across 2023-10 → 2025-11, an OPEN ≤14B model has never posted a verified agentic SWE-bench result; the two best ≤14B entries (18.2%, 23.2%) are unveri | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-20 | SOURCE | A20 | SWE-bench (2310.06770) + SWE-agent (2405.15793) (METADATA_VERIFIED) | implementation-ecosystem | The benchmark harness and the agent-computer-interface framing that all entries above inherit | Agentic coding results are agent-scaffold-dominated: same model, different harness → double-digit deltas; model-only comparisons are confounded | METADATA_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-21 | SOURCE | A21 | DeepSeek-Coder lineage (DeepSeek-Coder V2, 33B-A3.6B MoE; INHERITED from arm-1-era literature, METADATA) | implementation-ecosystem | Established the MoE pattern (large total, small active) as the local-compute answer to the capability/VRAM bind | Rune's stack has NO MoE model installed; its density-27B-IQ2_M-vs-density-14B-Q4 dilemma is an artifact of its model menu, not of the ecosystem | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-22 | POINTER | A22 | Apple Intelligence architecture — SKIPPED per mandate (arm 2 covered) | implementation-ecosystem | — | — | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-23 | SOURCE | A23 | ONNX Runtime GenAI powering Foundry Local / Windows ML (A7) | implementation-ecosystem | Microsoft ships an on-device model runtime + model catalog as an OS feature: local serving (OpenAI-compat), hardware-accelerated across CPU/GPU/NPU | Claims are scoped honestly: small/quantized models for assistant-class tasks; no claim of frontier-agentic capability offline | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-24 | SOURCE | A24 | Robotics / embodied local agents (Voyager lineage 2305.16291 INHERITED; local-first robotics stacks are typically: on-device small policy mo | implementation-ecosystem | The dominant honest pattern in shipped robotics is bounded local competence: navigation/manipulation policies run offline; open-ended language cognition stays cloud-dependent or is heavily scoped | Shipped systems do NOT claim offline open-ended agency; they claim offline *skill execution* — which is exactly the rung-5 shape (non-generative conti | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-25 | SOURCE | A25 | Local-first developer products (Ollama/LM Studio/Foundry-based assistants; local RAG products) | implementation-ecosystem | What actually ships offline: chat with retrieval, summarization, code completion (FIM), structured extraction | Honest deployments scope to: bounded generation + retrieval + extraction. None ship offline *multi-step autonomous* coding agents with quality claims; | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A4-26 | SOURCE | A26 | DeepSeek-R1 (2501.12948; INHERITED_VERIFIED arm 3) | implementation-ecosystem | R1-Distill-Qwen-32B > QwQ-32B-Preview on AIME/MATH/GPQA; distill-7B beats GPT-4o on AIME-2024 (55.5); distillation from 800K verified traces transmits long-CoT across base families | On competition-math-style verifiable tasks, distilled students approach/exceed same-size teachers' *benchmark* performance — but R1 itself: 49.2% SWE- | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-27 | SOURCE | A27 | phi-4 TR (2412.08905; INHERITED_VERIFIED arm 1) | implementation-ecosystem | 14B exceeds its teacher (GPT-4) on STEM QA via synthetic-data curriculum | Exceeds teacher *on the target domain measured by vendor instruments*; general chat not claimed | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-28 | SOURCE | A28 | Gemma 3 TR (2503.19786; INHERITED_VERIFIED arm 1) | implementation-ecosystem | Gemma3-4B-IT ≈ Gemma2-27B-IT; 27B-IT ≈ Gemini-1.5-Pro; trained with distillation | Generation-over-generation compression is real and large — the strongest evidence that "current-generation small ≈ previous-generation large" | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-29 | SOURCE | A29 | Quantization-of-distillates interaction (2504.04823; INHERITED_VERIFIED arm 1) | implementation-ecosystem | R1-Distill lineages are *specifically* quantization-sensitive (3-bit −5.4 to −6.3 avg on 7B; harder tasks degrade up to 4× more) | Production distillates + aggressive quantization = compounding degradation; Rune's 27B IQ2_M (2.5 bpw-class) sits below every tested floor | INHERITED_VERIFIED | NOT_RECORDED_IN_ARM |
+| A4-30 | SOURCE | A30 | The Curse of Recursion (2305.17493, METADATA_VERIFIED) | implementation-ecosystem | Model collapse from recursive training | "Training on generated data makes models forget" — tails of distribution lost over generations | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-31 | SOURCE | A31 | Is Model Collapse Inevitable? (2404.01413, METADATA_VERIFIED) | implementation-ecosystem | Collapse is a *data-mixing* problem | Accumulating real+synthetic with explicit non-cumulative mixing avoids collapse — collapse is not inevitable | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-32 | SOURCE | A32 | Distilled-hallucination transmission (2408.12326 DualChecker; INHERITED arm 1) | implementation-ecosystem | Teacher hallucinations propagate through KD when teacher confidence low | Patched piecemeal (re-prompting, dual-checking); never quantified systematically at scale | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A4-33 | POINTER | A33 | Fine-tune forgetting (2301.12726 specialization → CoT on BBH drops to 0; 2412.15115-era AgentTuning: agent-data-only FT degrades general abi | implementation-ecosystem | Catastrophic forgetting in specialization | Consistent across 3 independent groups: specialization trades generic capability, and in-distribution gains do NOT predict OOD retention | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-34 | SOURCE | A34 | Community quantized-failure reports (GGUF ecosystem; arm 1's imatrix discussion #5263 INHERITED; HuggingFace model-card practice) | implementation-ecosystem | 2-bit-class quants degraded for reasoning/coding; imatrix corpus sensitivity | Community-accepted; KL-div proxies; no systematic task-level public measurement for IQ2_M specifically | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A4-35 | SOURCE | A35 | Silent-truncation defect class (A13 above) | implementation-ecosystem | Prompt/embedding silent truncation in the serving layer | Open GitHub issues in ollama/ollama, including one specifically for embedding-input truncation warnings still OPEN | COMMUNITY_EVIDENCE_RELIABILITY_LABELED | NOT_RECORDED_IN_ARM |
+| A4-36 | POINTER | A36 | Synthetic-data contamination incidents (vendor-admitted) | implementation-ecosystem | Benchmarks contaminated by training-adjacent synthetic data | phi-4 TR itself devotes its evaluation section to mitigating benchmark contamination (admits the problem class); LiveCodeBench/eval-style contaminatio | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-1 | SOURCE | 2309.02427 | Cognitive Architectures for Language Agents (CoALA) | agent-architecture | [S01] `2309.02427` | Cognitive Architectures for Language Agents (CoALA)
+- Authors / venue: Sumers, Yao, Narasimhan, Griffiths — Princeton; arXiv 2023 (TMLR-listed, v3).
+- Topic: architectural taxonom | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-2 | SOURCE | 2310.08560 | MemGPT: Towards LLMs as Operating Systems | agent-architecture | [S02] `2310.08560` | MemGPT: Towards LLMs as Operating Systems
+- Authors / venue: Packer, Wooders, Lin et al. (UC Berkeley) — arXiv 2023.
+- Topic: OS-style virtual context management; memory-as-a-modu | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-3 | SOURCE | 2402.01817 | Position: LLMs Can't Plan, But Can Help Planning in LLM-Modulo Frameworks | agent-architecture | [S03] `2402.01817` | Position: LLMs Can't Plan, But Can Help Planning in LLM-Modulo Frameworks
+- Authors / venue: Kambhampati, Valmeekam, Guan, Verma, Stechly, Bhambri, Saldyt, Murthy (ASU) — ICML 202 | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-4 | SOURCE | 2210.03629 | ReAct: Synergizing Reasoning and Acting in Language Models | agent-architecture | [S04] `2210.03629` | ReAct: Synergizing Reasoning and Acting in Language Models
+- Authors / venue: Yao, Zhao, Yu, Du, Shafran, Narasimhan, Cao — ICLR 2023.
+- Topic: interleaved thought/action/observat | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-5 | SOURCE | 2305.04091 | Plan-and-Solve Prompting | agent-architecture | [S05] `2305.04091` | Plan-and-Solve Prompting
+- Authors / venue: Wang, Xu, Lan et al. — ACL 2023.
+- Topic: plan-then-execute at the prompt level.
+- Key claims: zero-shot "devise a plan, divide the tas | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-6 | SOURCE | 2305.18323 | ReWOO: Decoupling Reasoning from Observations | agent-architecture | [S06] `2305.18323` | ReWOO: Decoupling Reasoning from Observations
+- Authors / venue: Xu, Peng, Lei et al. — arXiv 2023.
+- Topic: plan-all-tool-calls-up-front vs interleaved reasoning.
+- Key claims: m | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-7 | SOURCE | 2304.11477 | LLM+P | agent-architecture | [S07] `2304.11477` | LLM+P
+- Authors / venue: Liu, Jiang, Zhang, Liu, Zhang, Biswas, Stone — arXiv 2023.
+- Topic: LLM + classical planner hybrid.
+- Key claims: LLM translates a natural-language proble | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-8 | SOURCE | 2311.05772 | ADaPT: As-Needed Decomposition and Planning with Language Models | agent-architecture | [S08] `2311.05772` | ADaPT: As-Needed Decomposition and Planning with Language Models
+- Authors / venue: Prasad, Koller, Hartmann et al. — arXiv 2023 (NAACL 2024).
+- Topic: hierarchical decomposition  | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-9 | SOURCE | 2403.11322 | StateFlow: State-Driven Workflows for LLM Task-Solving | agent-architecture | [S09] `2403.11322` | StateFlow: State-Driven Workflows for LLM Task-Solving
+- Authors / venue: Wu, Yue, Zhang et al. — arXiv 2024.
+- Topic: explicit state machine as the control substrate.
+- Key claim | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-10 | SOURCE | 2303.17580 | HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Face | agent-architecture | [S10] `2303.17580` | HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Face
+- Authors / venue: Shen, Song, Tan et al. — NeurIPS 2023.
+- Topic: LLM-as-controller over a model catalog | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-11 | SOURCE | 2405.15793 | SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering | agent-architecture | [S11] `2405.15793` | SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering
+- Authors / venue: Yang, Jimenez, Wettig et al. — NeurIPS 2024.
+- Topic: the action space / interface as | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-12 | SOURCE | 2406.12045 | τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains | agent-architecture | [S12] `2406.12045` | τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains
+- Authors / venue: Yao, Shinn, Razavi, Narasimhan — arXiv 2024 (ICLR 2025).
+- Topic: reliability of depl | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-13 | SOURCE | 2401.13178 | AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents | agent-architecture | [S13] `2401.13178` | AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents
+- Authors / venue: Ma, Zhang, Zhu et al. — NeurIPS 2024 D&B.
+- Topic: process-level (not just outcome-level) ag | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-14 | SOURCE | 2404.01744 | Octopus v2: On-device language model for super agent | agent-architecture | [S14] `2404.01744` | Octopus v2: On-device language model for super agent
+- Authors / venue: Chen, Li — arXiv 2024.
+- Topic: on-device function calling; the offline capability floor.
+- Key claims: a 2 | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-15 | SOURCE | 2407.21075 | Apple Intelligence Foundation Language Models | agent-architecture | [S15] `2407.21075` | Apple Intelligence Foundation Language Models
+- Authors / venue: Gunter, Wang, Wang et al. (Apple) — arXiv 2024.
+- Topic: audited, deployed local-first architecture (on-device mod | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-16 | SOURCE | 2312.11514 | LLM in a flash: Efficient LLM Inference with Limited Memory | agent-architecture | [S16] `2312.11514` | LLM in a flash: Efficient LLM Inference with Limited Memory
+- Authors / venue: Alizadeh, Mirzadeh, Belenko et al. (Apple) — arXiv 2023.
+- Topic: running models that exceed availab | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-17 | SOURCE | 2304.03442 | Generative Agents: Interactive Simulacra of Human Behavior | agent-architecture | [S18] `2304.03442` | Generative Agents: Interactive Simulacra of Human Behavior
+- Authors / venue: Park, O'Brien, Cai et al. — UIST 2023.
+- Topic: memory stream + reflection + retrieval scoring (the c | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-18 | SOURCE | 2305.16291 | Voyager: An Open-Ended Embodied Agent with LLMs | agent-architecture | [S19] `2305.16291` | Voyager: An Open-Ended Embodied Agent with LLMs
+- Authors / venue: Wang, Xie, Jiang, Mandlekar, Xiao, Zhu, Fan, Anandkumar — arXiv 2023 (TMLR 2024).
+- Topic: skill library as exec | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-19 | SOURCE | 2307.09009 | How is ChatGPT's behavior changing over time? | agent-architecture | [S20] `2307.09009` | How is ChatGPT's behavior changing over time?
+- Authors / venue: Chen, Zaharia, Zou — arXiv 2023 (Harvard Data Science Review, 2024).
+- Topic: declared capability vs observed beha | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-20 | SOURCE | 2302.04761 | Toolformer (brief) | agent-architecture | [S23] `2302.04761` | Toolformer (brief)
+- Authors / venue: Schick, Dwivedi-Yu, Dessì et al. (Meta) — NeurIPS 2023.
+- Key claims: an LM can teach itself *which* API to call, *when*, with *what argument | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-21 | SOURCE | 2305.15334 | Gorilla (brief) | agent-architecture | [S24] `2305.15334` | Gorilla (brief)
+- Authors / venue: Patil, Zhang, Wang et al. — NeurIPS 2024.
+- Key claims: GPT-4-class models fail at API calls mainly through hallucinated usage and wrong argumen | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-22 | SOURCE | 2307.16789 | ToolLLM / ToolBench (brief) | agent-architecture | [S25] `2307.16789` | ToolLLM / ToolBench (brief)
+- Authors / venue: Qin, Liang, Ye et al. — ICLR 2024.
+- Key claims: open models lag closed models at tool use because instruction tuning ignores the to | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-23 | SOURCE | 2309.15817 | ToolEmu (brief) | agent-architecture | [S26] `2309.15817` | ToolEmu (brief)
+- Authors / venue: Ruan, Dong, Wang et al. — ICLR 2024.
+- Key claims: an LM can emulate tool execution in a sandbox so agent risk cases can be found without manual | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-24 | SOURCE | 2308.00352 | MetaGPT | agent-architecture | [S27] `2308.00352` | MetaGPT
+- Authors / venue: Hong, Zhuge, Chen et al. — ICLR 2024.
+- Key claims: encode Standardized Operating Procedures into prompt sequences; assign human-like roles in an assemb | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-25 | SOURCE | 2503.13657 | Why Do Multi-Agent LLM Systems Fail? (MAST) | agent-architecture | [S28] `2503.13657` | Why Do Multi-Agent LLM Systems Fail? (MAST)
+- Authors / venue: Cemri, Pan, Yang et al. (UC Berkeley) — arXiv 2025 (ICML 2025).
+- Key claims: 1600+ annotated traces across 7 popula | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-26 | SOURCE | 2404.13501 | A Survey on the Memory Mechanism of LLM-based Agents | agent-architecture | [S29] `2404.13501` | A Survey on the Memory Mechanism of LLM-based Agents
+- Authors / venue: Zhang, Bo, Ma et al. — arXiv 2024.
+- Key claims: systematizes memory for LLM agents (what/why/how to design | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-27 | SOURCE | 2203.11171 | Self-Consistency Improves Chain of Thought Reasoning | agent-architecture | [S31] `2203.11171` | Self-Consistency Improves Chain of Thought Reasoning
+- Authors / venue: Wang, Wei, Schuurmans et al. (Google) — ICLR 2023.
+- Key claims: sample diverse reasoning paths and margina | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-28 | SOURCE | 2408.03314 | Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameters | agent-architecture | [S32] `2408.03314` | Scaling LLM Test-Time Compute Optimally can be More Effective than Scaling Model Parameters
+- Authors / venue: Snell, Lee, Xu, Kumar (UC Berkeley / Google DeepMind) — arXiv 2024.
+ | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-29 | SOURCE | 2207.05221 | Language Models (Mostly) Know What They Know | agent-architecture | [S33] `2207.05221` | Language Models (Mostly) Know What They Know
+- Authors / venue: Kadavath, Conerly, Askell et al. (Anthropic) — arXiv 2022.
+- Key claims: larger models are well-calibrated on multi | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-30 | SOURCE | 2305.14975 | Just Ask for Calibration | agent-architecture | [S34] `2305.14975` | Just Ask for Calibration
+- Authors / venue: Tian, Mitchell, Zhou, Sharma, Rafailov, Yao, Finn, Manning (Stanford) — EMNLP 2023.
+- Key claims: RLHF-tuned LMs produce poorly calibra | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-31 | SOURCE | 2412.21187 | Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs | agent-architecture | [S35] `2412.21187` | Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs
+- Authors / venue: Chen, Xu, Liang et al. — arXiv 2024.
+- Key claims: o1-like models allocate excessive comput | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-32 | SOURCE | 2503.16419 | Stop Overthinking: A Survey on Efficient Reasoning (brief) | agent-architecture | [S36] `2503.16419` | Stop Overthinking: A Survey on Efficient Reasoning (brief)
+- Authors / venue: Sui, Chuang, Wang et al. — arXiv 2025.
+- Key claims: first structured survey of efficient reasoning;  | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-33 | SOURCE | 2506.06941 | The Illusion of Thinking (and its published critique) | agent-architecture | [S37] `2506.06941` | The Illusion of Thinking (and its published critique)
+- Authors / venue: Shojaee, Mirzadeh, Alizadeh et al. (Apple) — arXiv 2025; critique: `2506.09250` "Comment on The Illusion o | NOT_RECORDED_IN_ARM | UNVERIFIED | NOT_RECORDED_IN_ARM |
+| A2-34 | SOURCE | 2305.10601 | Tree of Thoughts (brief) | agent-architecture | [S38] `2305.10601` | Tree of Thoughts (brief)
+- Authors / venue: Yao, Yu, Zhao, Shafran, Griffiths, Cao, Narasimhan — NeurIPS 2023.
+- Key claims: deliberate search over coherent "thoughts" with self-e | NOT_RECORDED_IN_ARM | ABSTRACT_ONLY | NOT_RECORDED_IN_ARM |
+| A2-35 | SOURCE | doc:LangGraph persistence — checkpointers and stores | LangGraph persistence — checkpointers and stores | agent-architecture | - Source: docs.langchain.com/oss/python/langgraph/persistence.
+- Topic: durable agent state as a runtime property; the documented failure modes of state persistence.
+- Key claims: two complementary sy | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-36 | SOURCE | doc:Apple Private Cloud Compute — deployment architect | Apple Private Cloud Compute — deployment architecture | agent-architecture | - Source: Apple Security Research, "Private Cloud Compute: A new frontier for AI privacy in the cloud" (security.apple.com/blog/private-cloud-compute/).
+- Topic: the deployed three-tier degradation la | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-37 | SOURCE | doc:Model Context Protocol — Architecture overview | Model Context Protocol — Architecture overview | agent-architecture | - Source: modelcontextprotocol.io/docs/learn/architecture (protocol version 2026-07-28).
+- Topic: capability declaration, negotiation, freshness and staleness in a tool ecosystem.
+- Key claims: host/c | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-38 | SOURCE | doc:OpenRouter Models API | OpenRouter Models API | agent-architecture | - Source: openrouter.ai/docs/overview/models.
+- Topic: how a production model marketplace encodes capability facts and staleness.
+- Key claims: `id` is the request identifier while `canonical_slug` is | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |
+| A2-39 | SOURCE | doc:Letta / stateful agents | Letta / stateful agents | agent-architecture | - Source: docs.letta.com (Introduction to Stateful Agents).
+- Topic: the production lineage of MemGPT — state owned by the runtime, not the model.
+- Key claims: all state (memories, user messages, rea | NOT_RECORDED_IN_ARM | DOCUMENTATION_AUDITED | NOT_RECORDED_IN_ARM |

research/memory-atlas-r1/domain_registry.md

@@ -30,7 +30,7 @@
 | 401 | Z: HCI / Mind Palace | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-22; evidence-governance/classification repair RESEALED 2026-09-22: HYPOTHESIS loophole closed (ADOPT requires DEEP_EXTERNAL/RUNE_DIRECT/DESIGN_INVARIANT — HYPOTHESIS-only claims must be EXPERIMENT/ADAPT), C004 first-contact audit mode ADOPT→EXPERIMENT (RUNE_HYPOTHESIS preserved), three anchors deepened FULL_PAPER (Saredakis OA 55 studies/3,016 participants pooled SSQ 28.001 [24.656–31.345] with cutoff framing attributed externally to Kennedy 2003; Data Navigator arXiv:2308.08475 CC-BY — mechanism established, benefit unvalidated, no user study; Akhawe & Felt figures verbatim-verified), zero-hit wording swept to bounded-search phrasing, LOAD_BEARING_DEPTH re-earned PASS; batched preserved byte-for-byte as preliminary (3C/6R/3SU); Mind Palace = project name NOT data model; federated read-only projection + routed writes + governed search/browse split + local-graph default + provenance on demand + attention≠truth + patched layout contract + deterministic explanations + compensating-event undo + soft-delete + keyboard substrate; adversarial 85 (8/16/61); claims 22 (20/1/1; elevels 1/13/2/6); applicability 56 (29/3/1/2/20/1); sources 128/128 (FP 3 · RS 2 · ABS 83 · MV 41 · DOC 17); CONTINUOUS_EXECUTION=PASS + REPAIR_CONTINUOUS_EXECUTION=PASS; nine gaps as bounded-search findings) | — (no dup) | families/mind_palace_hci_multimodal.md | memory-atlas-r1/Z-*/ |
 | 402 | AA: Security / Poisoning | research-complete | R1_QUALIFIED (R1_FULL — deep requalified + expanded Rune-security scope 2026-09-22; batched preserved byte-for-byte as preliminary (4C/1R R0; 6C/2R prelim); INWARD: no authorization/integrity/confidentiality/security-state/quarantine/taint/content-control enforcement; audit_ledger.py HARDCODED HMAC key (tamper-evidence forgeable); hard delete no tombstone; --no-dedupe unprivileged bypass; memory.db 0644 world-readable; provider keys plaintext auth.json + /proc environ; workers ambient authority; ufw default-deny with narrow allows; ARCHITECTURE: content/control separation enforced OUTSIDE model at effect sink; deterministic authorize() choke point (policy discipline, relabeled); write-time origin binding + taint JOIN (TMA-NM machine-checked T1/T2/T3); quarantine first-class; Sybil-resistant elevation (count evidence ROOTS — 2609.01873); crypto by property with external monotonic floor for anti-rollback; key-custody honesty (same-uid malware defeats all); fencing tokens for workers; provider least-context + destination allow-lists (Framing Gap: model-side recognition fails 0%→100%, allow-lists close to 0%); detection discipline deterministic-vs-anomaly, FPR-first (Axelsson); typed compromise states + evidence-based clearance; safe rendering; scope honesty (root/kernel out of T1; bounded > omniscient); adversarial 170 attacks (SUCCEEDS 30 · PARTIAL 30 · FAILS 110; three sharpest: enforcement-claims-vs-honesty contradiction, recovery-demands-unproducible-evidence, bootstrapping/availability erosion; seven corrections applied incl. policy-discipline relabel + safe rendering + quotas + loopback auth + migration story); claims 15 (all ADOPT; elevels 1/14; threat_model per claim); sources 83 rows / 79 unique, 4 cross-arm identity duplicates counted once (FP 2 · RS 9 · ABS 41 · MV 39 · DOC 9 · CODE 1 · UNV 5; 106 labels); 20+ citation corrections incl. 4 batched defects; 9 honest gaps (5 bounded-search + 4 unverified-this-run — distinct from evidence_saturation's 8 typed outcomes and master §49's 14 remaining unknowns, 2 parked); SEARCH_SATURATION=REACHED + LOAD_BEARING_DEPTH=PASS; CONTINUOUS_EXECUTION=PASS; canonical receipt 192685 (superseded prior 192393) | — (no dup) | families/metamemory_security.md | memory-atlas-r1/AA-*/ |
 | 403 | AB: Multimodal / Artifacts | research-complete | R1_QUALIFIED (R1_FULL — deep requalified + expanded multimodal-memory scope 2026-09-22; batched preserved byte-for-byte (5c705036); INWARD: text-only Memory, PDF flattening ships (layout destroyed), embeddings UNVERSIONED, tesseract unwired, attachments transient, RichLog markup surface; ARCHITECTURE: PRESERVE THE SOURCE DERIVE THE INTERPRETATION — content-addressed source objects canonical, all interpretations derived+lineage+version-stamped, Memory=references no second store; modality-specific indexes + calibrated bridge NOT universal space (modality gap functional); capture-first document ingestion (ColPali +14-16 nDCG, figures 2.5×, text-dense +3.1 conditional); VAD-gated transcripts only (Whisper ~1% fabricated); event-boundary anchoring; evidence roots not derivative multiplicity; taint survives transformation, enforce outside model (CaMeL only adaptive-surviving); byte-identity only automatic dedupe, similarity nominates never authorizes (#402 defect carried + RECURRING cross-domain supersession observed 194460/194173); biometric match ≠ identity; metadata source-asserted (timestamp taxonomy); least-media disclosure; degradation keeps evidence visible; adversarial 170 (12/43/115) 7-of-12 SUCCEEDS Rune-specific, 14 forced corrections; claims 20 all ADOPT RUNE_APPLICABLE; sources 108 rows/105 unique/3 dup groups (canonical structured ledger source_ledger.json; sources.md = generated projection, copy-fidelity gate-enforced) (FP 2 · RS 8 · ABS 73 · MV 13 · DOC 11 · UNV 1; lossless rebuild); 8 bounded gaps; SEARCH_SATURATION=REACHED LOAD_BEARING_DEPTH=PASS; canonical entry 194460 (cross-domain supersession REPRODUCED (194460/194173 sim 0.81 + #402's 194015/193729) — SAFETY HOLD: no Memory writes #404–#406 until scope-aware supersession authority proven (CANONICAL_MEMORY_IMPORT_PENDING_SAFE_SUPERSESSION_FIX)) | — (no dup) | families/mind_palace_hci_multimodal.md | memory-atlas-r1/AB-*/ |
-| 404 | AC: Local / Offline Intelligence | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-20; batched preserved as preliminary; single-writer stance confirmed; staged earn-in) | — (no dup) | families/offline_intelligence_resource_placement.md | memory-atlas-r1/AC-*/ |
+| 404 | AC: Local / Offline Intelligence | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-22; batched preserved byte-for-byte (b29810f1); INWARD: 11 Ollama models, unversioned embeddings, 152 deterministic modules as accidental no-model fallback, skill library empty (0 skills/7 lessons/0 measured deltas), no routing policy/registry/templates, silent embedding degradation; ARCHITECTURE: MODEL-AS-RESOURCE (state model-independent) + six-rung degradation ladder FULL→DEGRADED never DEAD (Apple RS precedent) + bounded-only capability compilation + outcome-grounded assimilation with per-lesson counterfactual measurement (Rune-novel — literature open-loop) + skill promotion/deprecation criteria (Voyager FULL_PAPER + Memp) + escalation by pass@1 difficulty bins (Snell RS) not confidence + no cascade (FrugalGPT RS pricing artifact) + one logged gateway + capability registry w/ TTL + no-model mode with templates + local models untrusted + 4-bit weight-only reasoning floor (27B IQ2_M unmeasured — E13); adversarial 118 (14/20/84; 5 forced corrections); claims 17 all ADOPT; sources 156 ledger rows = 150 external/147 unique/6 pointer/2 dup groups (ABSTRACT 93 · DOC 28 · RS 11 · FP 4 · INHERITED 8 · MV 3 · COMMUNITY 3); 17 mis-paired IDs caught; 7 bounded gaps; SEARCH_SATURATION=REACHED LOAD_BEARING_DEPTH=PASS; CANONICAL_MEMORY_WRITE=0 (safety hold) | — (no dup) | families/offline_intelligence_resource_placement.md | memory-atlas-r1/AC-*/ |
 | 405 | AD: Hardware / Resource Placement | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-20; batched preserved as preliminary; single-writer stance confirmed; staged earn-in) | — (no dup) | families/offline_intelligence_resource_placement.md | memory-atlas-r1/AD-*/ |
 | 406 | AE: Evaluation / Benchmark Science | research-complete | R1_QUALIFIED (R1_FULL — deep requalified 2026-09-20; batched preserved as preliminary; single-writer stance confirmed; staged earn-in) | — (no dup) | families/evaluation.md | memory-atlas-r1/AE-*/ |
 

scripts/research_gate_check.py

@@ -985,7 +985,7 @@ def check_load_bearing_depth(domain_dir, findings):
 # arithmetic, process continue-count vs raw evidence, claim evidence-level
 # split, ownership-collapse phrases. Research-only checks; X-scoped.
 
-_EXACTREF_DOMAINS = ("AA-", "AB-")
+_EXACTREF_DOMAINS = ("AA-", "AB-", "AC-")
 
 
 def check_post_freeze_protocol(domain_dir, findings):
@@ -1064,7 +1064,7 @@ def check_source_reference_resolution(domain_dir, findings):
 
 
 _REPAIR_DOMAINS = ("W-", "X-", "Y-", "Z-")
-_LBM_DOMAINS = ("Y-", "Z-", "AA-", "AB-")
+_LBM_DOMAINS = ("Y-", "Z-", "AA-", "AB-", "AC-")
 
 
 def _is_repair_domain(domain_dir):