What we tried

The mission tickets’ runs are not what this entry measures. Step 28 (an end-to-end mission on the 4090) is T28 (#44) and Step 29 (the same on the Orin Nano) is T29 (#45). When this entry landed on 2026-09-11T19:24Z, T28 had no comments at all and T29’s only comment was a blocked deploy smoke, not a mission; no mission had run on either machine. T28 has since run its host mission — open_missions 0 → 1 → 0, a sealed 2395-byte MCAP and the mission id in the session list, on a zero-motion stack (docs/evidence/T28/4090-mission/ on ticket/T28, 449eeea). As of 2026-09-11T20:45Z, PR #213 was open with #44 status:review, T29’s board half had not run (#45 status:review, PR #211), and neither ticket was status:done. What this entry’s numbers measure is the kernel suite, on both machines.

The board deploy was attempted early, on purpose, and recorded as blocked. Deploying 25f2b6f7 to ~/qualia-deploy/ and building natively on the board was cheap and proved the deploy path; the run path then exposed, in order, that the toolchain is not on PATH for non-interactive SSH, that cargo resolves every workspace member even for one -p (so one uncached dev-dependency of an unrelated crate kills a single-package build), that the board’s registry cache is both partial and older than main’s lock, and that the board has no DNS, so git clone and crates.io are both unreachable and the only path is stage-and-ship. The recipe that works — git archive, scp, a trimmed members list, cargo generate-lockfile --offline — is written into the comment and into D-016/D-018.

Two obstacles were specific to the board’s driver. NVRTC 12.9 emits PTX ISA 8.8; the board’s driver 540.4 JITs 8.5 and below, so every device test skipped itself with CUDA_ERROR_UNSUPPORTED_PTX_VERSION. A direct driver probe found the ceiling (load ptx-8.5 result=0 / ptx-8.6 result=222) and the fix: the toolkit’s forward-compatibility libcuda, reached with LD_LIBRARY_PATH=/usr/local/cuda-12.9/compat. A cubin built by the board’s own nvcc -arch=sm_87 -cubin also loads on the stock driver and is the named fallback; the compat loader was used because it changes neither the kernels nor the driver. Also stated, not hidden: the Tegra driver exposes no DRAM counter, so dram__bytes.sum is n/a and no memory-bound verdict is claimed.

The same launches, two machines

The ranking reproduces; the durations do not. On the 4090 the same file cost 4784.75 µs with the same 13 launches and shapes. On the board it cost 39,182.18 µs with the GPC clock held near 306 MHz, which is the board’s 10 W power mode, not a profiler artefact: the unlocked repeat reports the same total to 0.001 % (39 182 176 vs 39 181 760 ns) and belief_update to 0.14 %. The board has 4 SMs in 2 TPCs, and the 1 × 1024 kernels launch one block in total — waves_per_sm 0.25 is that one block averaged over four SMs, and register pressure caps it at one block per SM (theoretical occupancy 66.67 %: 1024 of the 1536 threads the SM can hold). The 4090’s cycle count for the same kernel is an inference, not a measurement — the capture did not measure that clock — but the shape is what a latency-bound kernel predicts: the same cycles, a slower clock, a proportionally larger wall time, and the naive shape is worst exactly where it ships.

Evidence

^1 Captured on the dev host’s WSL2 under nsys in an earlier session than the board work; the 4090 is shared, so durations are one contended sample and launch count/shape are the stable part. ^2 Pinkie, native aarch64, ncu — the first board capture in the tree. Manual, because the board has no nsys and no mage. Durations are ncu’s isolated replay, not a throughput measurement. ^3 The T29 deploy smoke at 25f2b6f7, taken in a session different from both captures.

The commit range this entry describes is 25f2b6f..f6893d2 — the first board deploy through the merge of the T50 Pinkie capture. This entry’s epic is EPIC-10 (#15).

What this does not establish

• No mission had run at this entry’s endpoint. The epic’s actual acceptance — open one exploration mission, watch open_missions go 1 then 0, see a sealed MCAP segment, the same mission id in the session list and the GUI and the same generation in the TUI — had not been attempted in this entry’s period, which ends at f6893d2 (2026-09-11T17:55:18Z). See the note in “What we tried” for what has run since.
• The first board run could not even reach a server. At 25f2b6f7, runners/agent and crates/braid were one-line stubs and qualia-init had no binary, so qualia run refused and qualia health/planner hung on curl with no -m; 0/10 manifest runners were active. The layers that now exist were in flight then. This is a snapshot of a stack that could not start, not a measurement of the one that can.
• The 8.19× divides two different profilers. The board number is an ncu isolated replay with its default clock and cache control; the 4090 number is an nsys wall-clock capture from a different host and commit. Shapes and launch counts are the comparable part; the ratio is indicative.
• One board capture, and the board was shared. Other agents were building and running on Pinkie in the same window; belief_update was captured five times across the session with a 0.21 % spread, so contention moved the second decimal, not the number — but the runs are reported as agreeing rather than undisturbed.
• The memory budget is unproven on the board. The ≤ 6 GiB plan and the sm_87/sm_89 fatbin targets were T18 (#33, then status:ready); T18 has since landed (60beee4, PR #207, merged 2026-09-11T20:16:14Z, capture at docs/evidence/T18/fatbin-sm-87/). Nothing in this entry shows the stack fitting in the board’s 8 GB.
• The board clock is about 10 days behind (date -u read 2026-09-01 when the host read 2026-09-11), which the deploy comment flags as a hazard for anything depending on TLS to a remote upstream; nothing in this entry depends on it.

What we tried

The geometry was moved out of the journal repo. Step 39 says the mark is authored “in the journal repo”. The decision that survived (D-007) is the opposite: superposition/qualia owns assets/mark/{psi.json,render_mark.py,psi.svg}, so the flat mark and the 3D mesh cannot drift from each other or from a second copy, and the sites receive inlined geometry later. T41’s handoff is a patch to the sites, not a push.

The crash left a file of NUL bytes. The session that started T40 died mid-write: assets/mark/build_mark.py was NUL-filled — the ticket’s two comments report the size as 24,106 and 31,261 NUL bytes, and the discrepancy is left as recorded rather than reconciled — and the six artifacts beside it were of unknown provenance. Nothing from that session was kept. The script was re-authored in the repository and every artifact regenerated from it, then proved by running the whole pipeline twice from two fresh copies.

Two sources of nondeterminism had to be closed, and only two were found. Blender stamps PNG Date/RenderTime metadata, so those are switched off in the script; and the threaded exact boolean returns element faces in an order that varies, so the combined mesh is rebuilt in a canonical face order before export. With both closed, the GLB and the five rasters compare byte-identical across runs. The search for a third is not claimed to be exhaustive — it is claimed that two independent runs agree on every file.

The SVG importer reads fills and ignores strokes, so the pipeline took a documented detour. Step 40 says to import psi.svg, convert curves to mesh and extrude. Blender’s io_curve_svg imports the closed polygons’ centre lines and drops the stroke entirely; extruding zero-width lines produces nothing. The script therefore takes the centre lines from the imported SVG, checks them against psi.json, and strokes them under the SVG’s own cap, join and mitre-limit rules before extruding by 0.12 and bevelling by 0.01 in two segments. The deviation is written in the script, not smuggled past the ticket.

Why geometry and not a glyph

A glyph is a font’s opinion. It renders differently in every browser, cannot be extruded honestly, and cannot be checked. Geometry can be checked: render_mark.py --check regenerates the SVG and fails if the bytes differ, so an edit to psi.json that is not re-rendered is caught. The renderer is also the mark’s only rasteriser in this phase — Blender renders the icons at 512, 180 and 32 pixels from the same camera and the same mesh, rather than shelling out to inkscape, rsvg-convert or ImageMagick.

The shape itself is deliberate: a vertical stem with two arms sweeping outward and up from below its head, tapering to points at roughly 33° from horizontal, so the monogram cannot be misread as a plus, plus an accent descender below the baseline. The unit square maps as $v’ = 8 + 84v$ — the 8-unit inset the ticket fixes — so a stroke of 0.085 in unit-square coordinates is 7.14 viewBox units wide. Both numbers are stated in the SVG comment and in the script.

Evidence

^1 Measured when the mark landed, in a session different from the Blender work. ^2 Measured in the T40 session, which re-authored the script after the crash; the byte-identity comparison is between two runs from two fresh copies on the same host and Blender version (4.3.2).

The commit range this entry describes is a2c1440..ce04eaf — the geometry source through the merge of the Blender pipeline. Its epic is EPIC-11 (#13); tickets T39 #56 and T40 #57 are the tickets described here; T41 #58 landed just after this entry’s period.

What this does not establish

• The sites were wired after this entry’s period. T41 (#58) landed in 6894d7f (PR #203, merged 2026-09-11T19:31:10Z); its two site legs merged a few minutes earlier — superposition/superposition.github.io#16 (merge ccd441b, 2026-09-11T19:24:49Z) and superposition/mage#82 (merge 7a798f6, 2026-09-11T19:24:53Z) — so both sites now carry the inlined four-path wordmark and the 180×180 touch icon, and assets/mark/install_mark.py --check proves the installed copies have not drifted.
• The hero and turntable landed after this entry’s period. T42 (#59, one hero render per milestone entry) and T43 (#60, one turntable GLB per entry with a download fallback) landed in PR #206 (b6dfda6, merged 2026-09-11T19:59:10Z) and PR #205 (3cf3706, merged 2026-09-11T20:02:41Z); T43’s 02909f4 committed the three figures this entry now carries under docs/figures/the-mark/ — mark-geometry.svg, mark-anatomy.svg and turntable.glb. The mark itself is not among the entries T42 gave a hero: c9f77f0 added hero.webp to the three milestone entries the-connectome-as-a-prior, the-ladder and the-front-end-rebuilt-from-lessons, and not to this one.
• Byte-identity is per host and per Blender version. Two runs agree on this workstation with Blender 4.3.2. A different Blender release is a different rasteriser and may not reproduce the same bytes; no cross-version or cross-machine comparison was made.
• The 33° reading is a design description, not a measurement. The arm angle comes from how the polygon points were authored; no instrument measured it.
• The mark has never been seen at 32 pixels by a human in this record. The icon rasters are produced deterministically; whether the 32-pixel icon is legible is a judgement the ticket asserts by construction (“the flat camera is what makes the 32-pixel icon legible”) and no reader test is recorded.

What we tried

The measurement was not re-derived. crates/jepa already exports the Mahalanobis routine the model’s own NLL uses, so the braid calls it instead of writing a second one. The reference tree has no braid crate at all, so drift.rs has no counterpart to match and the ticket text is the whole interface; reusing the only existing math for the same quantity was the one decision available.

Three inputs had to be made mute, not loud. The ticket says a length mismatch returns sample_count == 0 and that observe treats it as “no opinion”. Review found the rest of the family: non-finite latents or means, a non-finite log-variance — which would otherwise reach exp — and a precision that is not real. All of them return the mute pair. The point is that the drift path cannot panic a running stack on a bad sample; a rule layer that fires on garbage is worse than one that abstains.

The first rule table had a rule that cannot fire, and that is recorded, not hidden. The plan’s default_rules() includes DriftAbove { threshold: 3.0 } → EnterObserveOnly. The braid’s frozen BraidEvent vocabulary is a closed set of six variants plus Unknown, and no variant carries a drift measurement; T34 shipped DriftReport without adding a drift event. So DriftAbove is contract data that fires against no event evaluate can be handed today. The ticket’s text was left as written and the gap was pinned by a test — the_drift_rule_fires_on_no_event_the_braid_carries_yet — rather than inventing a variant the ticket does not name. The drift reaches the healing ladder directly, when the ladder exists.

Falsification, not just green. For the rules, two deliberate mutations (swap the first two default rules; ignore the matched outcome) were built and both were caught, EXIT=101; reverted, the suite went green again. For the drift tests, they were written before drift.rs existed and failed with E0432: unresolved import qualia_braid::drift.

The ladder is the ticket’s contract, not a measurement

The epic’s Step 35 fixes the escalation, and it is worth writing down exactly because none of it runs yet — these are thresholds from the plan, and no code in the tree compares a drift to them:

SafeStop produces a request: the agent forwards it to leash and leash decides, exactly as the compute API’s authority statement requires. No function in the crate may call a motor, and no test may assert that it does. The numbers above are the plan’s; the only measured quantities in this entry are the drift values and the test counts.

What the rules say, in order

default_rules() returns, in this order:

1. MissionClosed { outcome: "failed" } → LowerCoupling { factor: 0.90 }
2. PromotionRolledBack → EnterObserveOnly
3. Quarantined → RequestTraining — a quarantine is a reason to learn from what survived
4. DriftAbove { threshold: 3.0 } → EnterObserveOnly

Rules are data, so a later rule set is a new vector and not a code change. What is measured about them is their order and their effect on the events the braid can receive: the seven tests cover the table, and the board re-ran the whole crate at 24 passed.

Evidence

^1 Host tests on the dev workstation in a different session from the board runs. ^2 Pinkie, native aarch64, from a git archive of the head; qualia-braid has no binary, so cargo test -p qualia-braid is its own smoke path. ^3 The 3, 5, 8 and 10 s values are the plan’s specification, not measured behaviour. No code in the tree compares a drift to them.

The commit range this entry describes is 7cac730..7b3bd15 — the drift commit through the merge of T34. The rule layer landed in 2891580 (PR #200, 2602c4d, merged 2026-09-11T19:25:47Z). This entry’s epic is EPIC-08C (#11); tickets T33 #49 and T34 #50.

What this does not establish

• The ladder has not landed. As of 2026-09-11T20:45Z, crates/braid/src/heal.rs was not in main; T35 (#51) was status:claimed, with the ladder on PR #209 (ticket/T35, head d8b05af, open), and T36 (#52, the authority bound on safe stop) was still status:ready. So no step has been selected from a real drift, no rollback has been requested, and no safe stop has been requested.
• The drift thresholds are uncalibrated. 3, 5 and 8 are the plan’s numbers. No run has measured what a normal drift looks like on this stack, so there is no evidence that these values separate “fine” from “recalibrate”.
• DriftAbove fires on nothing. As above: the braid carries no drift event, so the fourth default rule is inert until the wire does.
• measure has no board capture. Step 47 lists T35 as one of three mandatory needs:profile captures — the ladder’s decision path as a CPU timeline, with no kernel in it — and that capture cannot exist until the decision path does.
• Drift is a number, not a diagnosis. A large squared Mahalanobis says the latent is far from the predicted mean under the predicted precision; it does not say whether the model is wrong, the world changed, or the precision estimate is bad. The ladder is a policy over that number, and the policy is untested.

What we tried

The rollback dispatch was deferred, with a failing test to prove it. Step 19 says observe calls the registry’s existing rollback. The fixed interface, observe(state: &mut BraidState, event: &BraidEvent), is synchronous and carries a PromotionRolledBack { generation, reason } with no registry handle and no generation-pointer path; the registry itself had only a [[bin]] target and a fn main() {} at the time, so cargo tree -p qualia-braid warned about a dependency with no lib target. Rather than change the interface the ticket fixes, T19 keeps the state transition (the generation moves, last_promotion_ns does not) and the reason stays on the wire, asserted by a test that decodes the envelope. The call moves to C10 (#76) and the routing to T22 (#37). A temporary test asserting the braid records the reason was written first, failed as expected, and was removed; the committed assertion is the one that stays true.

The braid’s event vocabulary resisted invention. T19 added one variant, Unknown, marked #[serde(other)], so a future event decodes and leaves the state untouched — the forward-compatibility arm the epic’s own test asks for.

The read-only write edge. The literal step — every strand calls observe itself — is impossible for arena-recorder and jepa-runtime, which are processes. Main ruled the write edge into the ticket: body is crates/braid’s frozen envelope, reply is the view GET /braid returns, a failed dispatch is 503, and AuthScope::Peer (already loopback-bypassed) means co-located runners need no new secret. The agent’s src/braid.rs dropped its local mirror of the braid types and now holds the one BraidState the process owns.

Board hygiene was found the hard way. Two later suites died with SIGBUS because the board’s /dev/shm was 100 % full — 33 stale 64 MiB qualia* test regions, about 1.8 GB, owned by no live process. After rm -f /dev/shm/qualia* (100 % → 1 %) the same commands were green. It is reported in the board comment and every later board leg checks df -h /dev/shm first. A parallel test-isolation defect (ShmError::OsError(17) from two smoke tests naming one region) was fixed with a per-test region name and re-run green.

Pacing: the map degrades, it does not stop

QUALIA_BELIEF_PACE_MS (default 250) gates runners/map and runners/pose: before publishing, wait until the newest accepted belief commit is younger than the window; if none has been committed for 8× the window, publish anyway and log belief pace: stale, publishing map/pose at {lag} ms. A live probe of the real qualia-pose binary with a belief tick 300 ms old and QUALIA_BELIEF_PACE_MS=200 held the first pose for 1.3 s, then logged qualia-pose: belief pace: stale, publishing pose at 1604 ms (a second run read 1605 ms). That is the design in one line: navigation slows, it does not deadlock. Nothing in the step writes to the ROS graph; leash remains the mapping/localization provider boundary.

The other half of Step 24b is the clock. BeliefClock::decision_latency_ns() reads the newest BeliefSlot timestamp across the eight layers, subtracts the newest finished ledger row, and returns zero when either side is absent or when a ledger row reads newer than the belief — zero rather than a wrapped subtraction. It sits on an arena view, not on BraidState, because the braid’s state is serialised to JSON at GET /braid and holds no mapping. T27’s TUI renders it as belief lag: {ms} ms.

The exploration mission, and one field that could not be computed

runners/explore now opens MissionOpened { mission_id: "explore-frontier" } at stack start and puts the fly prior into the planner request’s existing belief_risk block. uncertainty_weight is the prior’s total applied weight divided by the number of coupled types — the mean applied weight per type. The raw total was tried first and rejected by review: couple sums peak-normalised strengths, the peak type is always among them, so the sum is always ≥ 1 and the clamp to 0.0..=1.0 made the field a de-facto boolean. The mean is inside the range by construction and reads 0.625 on the board. semantic_novelty could not be computed at all: the artifact aggregates dimorphism away and the tree has no cell-to-type map, so it is a documented 0.0, and the ticket records the two shapes (a male_specific mask section in the artifact, or a typed sidecar) that would make it real.

Evidence

^1 Board runs on Pinkie, native aarch64, from a git archive of the head; taken in a different session from the host work in the same ticket. ^2 The 1.3 s hold and the 1604/1605 ms stale line are from two bounded live probes of the real qualia-pose binary, in sessions different from the board runs; the pose runner’s own timing, not a board measurement.

The commit range this entry describes is bf4c506..f39c114 — the braid state machine through the merge that landed the exploration mission. Epics: EPIC-07 (#7), EPIC-08 (#8), EPIC-08B (#9).

What this does not establish

• The self-improvement loop has not landed. As of 2026-09-11T20:45Z, EPIC-08B owed all three parts: the bounded QUALIA_FLY_COUPLING_SCALE dial (#46, status:claimed), closing the training/promotion loop through the braid (#47, status:claimed) and its failure paths (#48, status:ready). No coupling scale has been clamps-tested, no training job has been submitted by an agent, and nothing has been promoted.
• T20’s PR merged after this entry’s board leg. The POST /braid write edge and the strand reports are on PR #196, merged 2026-09-11T19:25:44Z in 9fd1e69; the board exercised the head. T22 (#37, rollback and quarantine routing) was status:ready when this entry was written and has since landed too (5c304dc, PR #204, merged 2026-09-11T20:06:32Z; #37 closed, status:review).
• The sync-types fly_governed field defaults false and has never been true at runtime. It landed with the C04 rewrite (3b4fa66), and the test asserts the default and a round trip, not a mission that set it.
• The pace probe was one binary in one window. map and pose have unit and end-to-end tests, and the launch-time stale behaviour was observed once at 1.3 s; no multi-minute soak was run.
• open_missions is a counter, not a mission. Nothing on the board drove an actual exploration to completion; the round trip proves the edge, not the behaviour.
• The board was shared. Other agents were building and running on Pinkie during these legs; the reported results are agreements across runs, not undisturbed measurements.

What we tried

The lessons document ran before the crate, deliberately. Step 25 exists so that apps/qualia-console is built against evidence. Its five sections use a fixed form — what it does → keep → avoid → evidence (path) — and the closing table is the contract. Two of the five sources are in a private repository read-only clone; nothing was copied, and the document records lessons and paths only. docs/inspiration.md indexes every private path that was read. runners/ops is written up as a lesson and not as a component, because Step 27 deletes it and this repository never carried it.

The stacked top headers were built, then thrown away. The first console had a top bar, a tab row and per-view headers; the operator’s direction replaced them with five floating, movable, resizable egui::Windows staggered on a diagonal, one slim strip, and a menu to re-open a closed window. The recovered work was finished as one commit and the blockers as another, so the change of direction is visible in history rather than hidden in a squash.

A manifest edit was reverted after review. The console briefly declared qualia-lidar, qualia-camera and qualia-vslam into config/stack-manifest.default.json; the contract re-read ruled it out of scope, the file went back byte-identical to the merge base, and the Telemetry view instead derives its rows from the ABI slots — a named stack contributes its sensing runners in its own order, and no stack renders the honest empty table. Two tests pin that route.

Small correctness fixes kept, one dead field deleted. The Refresh button was inert; the telemetry view dropped a row on a torn read and rendered a never-published camera as zeros; the poll loop re-inventoried every *.mcap four times a second; the dead SegmentReading::sha256 field and the fixture-shaped Sample::healthy builder were removed from the library (the builder moved to tests/support/). A README toolchain note claiming a Cargo.lock pin the lock did not carry was deleted rather than corrected.

The board leg blocked rather than faked. The dev host has no Docker engine, no cross, and no aarch64 C toolchain: cargo check --target aarch64-unknown-linux-gnu -p qualia-console walks 91 dependency crates and dies in ring’s build script for want of aarch64-linux-gnu-gcc. That was recorded as blocked, not as a build. The console was then built natively on Pinkie instead (D-010/D-018).

Five views, one enum, and a fixture that needs no stack

The view set is fixed — mission, belief, world, evidence, telemetry — one module each under src/views/, and the agent’s base URL comes from QUALIA_AGENT_URL (default http://127.0.0.1:8080) with no host literal in the source. The snapshots are mission_healthy, mission_degraded, belief_stale, evidence_empty, world_fresh and default_arrangement, all driven from one committed braid-state.json fixture — world_fresh attaches a fresh region of its own — so no live stack is needed; the empty and error cases were written first because those are the ones that regress.

The TUI half is the same data on a terminal: runners/watch gained a Mission panel reading GET /braid and the chrome line braid gen {n} · belief lag: {ms} ms, with the milliseconds from BeliefClock::decision_latency_ns(). The existing panels and child supervision are unchanged, and the ops dashboard’s carriers are gone: grep -rn QUALIA_OPS_URL returns nothing, and runners/ops was never in git ls-tree origin/main runners/ to delete. qualia-watch reached 38 passed / 0 failed on the board, up from 36, the two extra tests being the agent-URL scheme fix.

The board can build it, not display it

Pinkie has DISPLAY/WAYLAND_DISPLAY unset, XDG_SESSION_TYPE=tty and no compositor, so an egui window cannot open there; the built ELF is the board evidence and the interactive smoke stays the host record. The watch binary is different: under a PTY with stty rows 40 cols 130 it enters the alternate screen and draws the tab row through 8:Mission; operator input cannot be exercised headlessly, so the panel rendering is covered by tests/view.rs and tests/braid.rs instead.

Evidence

^1 The 42/42 path resolution was checked when the document landed, in the session that wrote it. ^2 The smoke readings and the board builds are from different sessions: the console smoke was taken by the session that recovered the crashed worktree, and the Pinkie artifacts by the board job. The two board artifacts were built in different legs, and the console’s was reproduced byte-for-byte by a second leg.

The commit range this entry describes is 665c1ab..7ad59a1: the lessons commit through the merge that carried the TUI change (T27, PR #191, merged 2026-09-11T18:15:39Z). The range has to end there, not at the TUI change’s board leg 2306c4c: the console (T26, PR #152, merge 4700e47) is not an ancestor of 2306c4c — git merge-base --is-ancestor 4700e47 2306c4c fails — while 7ad59a1 contains both. The console’s five views, its 16-test host run and its aarch64 board artifacts describe the range’s endpoint, where VIEWS is [View; 5]; at main it is [View; 6] because T51 added View::Brain (a65f94f, PR #201, merged 2026-09-11T19:55:40Z) after this entry’s period. Its epic is EPIC-09 (#10); tickets T25 #41, T26 #42, T27 #43.

What this does not establish

• The smoke is one session’s reading. The pose, map, ledger and telemetry values above are quoted from a smoke run against a real shared region and a stub GET /braid — not a live agent, not Leash. The accessibility-tree read-back is the method; there is no automated end-to-end test of the window.
• The GUI has never run on the board, and cannot. Headless is a property of the machine, not a configuration gap; the aarch64 build is the only board evidence.
• docs/frontend-lessons.md is the entry’s substance, not this post. Five sources distilled into a table is a document; whether a reader of this entry learns the same lessons depends on following the link.
• The TUI’s Mission panel was not exercised by a human on the board. Rendering is covered by tests and a PTY start; selecting the tab and scrolling were not driven.
• The 42/42 path check is a point-in-time check. Paths in a private repository can move; nothing re-runs the resolution.

What we tried

A signature that could not work on one of the two backends was changed, and said so. The plan’s step 11 gives Metal the same couple_prior(ctx, prior, slots). MetalContext is macOS-only, the coupling is host-side data (D-001), and the Metal belief loop holds no MetalCognitionStack — building one to pass it here would allocate and initialise the whole layer set for a host-side sum. The shipped Metal signature is couple_prior(prior, slots), same name, same feature, no context.

The per-tick call moved out of the runner. Step 12 puts couple_prior in each belief runner’s src/main.rs; those are pure dispatchers, and runners/l3-belief’s own test pins that the runner must not touch the layer slot. The mode, the prior load and the diagnostics stay in the runners; the per-tick coupling is wired where the loop is, in the compute backends, behind the same feature. The reference tree has no QUALIA_FLY_* and no coupling, so no reference behaviour could decide this; the plan’s intent — a per-tick coupled belief under QUALIA_FLY_MODE — could not be reached from a dispatcher.

A stacked PR stranded a ticket, and it was replayed rather than re-invented. #27 (T12) was opened with base ticket/T11 and merged into that branch; when ticket/T11 was later rebased onto main, the rebase dropped the merge commit and with it T12’s commits, so the work was an ancestor of neither. That is now decision D-019, and the replay (ticket/T12-replay, PR #198) is a single cherry-pick -x of the reviewed commit. It was open when this entry was written and merged on 2026-09-11T19:55:37Z in 14b60de (PR #198).

The simulator was kept away from the motor path by construction. The dataset carries no dynamics and no sign; the model is invented. So it is a separate crate (qualia-fly-circuit, feature sim off by default) whose README says in one paragraph that it is a rate model over a graph, not a connectome simulation; its weights are used as positive because the artifact carries no sign; and a build without the feature compiles an empty crate with no dependencies.

Coupling is a normalisation, and the observable is the total

Two consequences are worth separating. First, the value is bounded by the slot count and reaches 1.0 only for a uniformly innervated graph — the same property that later made a naive “sum, then clamp to 0..1” reading a de-facto boolean, so the exploration ticket divides by the coupled-type count (the mean applied weight) instead. Second, the prior cannot silently half-apply: a mapping the graph or the layer cannot satisfy is refused with UnknownType(u32) or SlotOutOfRange(usize), not skipped, so a stale mapping cannot read as a partial success. With the feature off, the symbol exists and returns Ok(0.0); there is no branch in the belief loop.

The honest limit, recorded on the ticket: on an idle stack the coupling’s effect on the published belief is not separately observable — the belief starts at zero and the identity model keeps it there, and the coupling scales the mean. The observable is the per-tick total above plus the unit test that pins the normalised scaling.

The board and the GPU

Two independent exercises, and they measured different things.

The Orin NX (aarch64). qualia-cuda --features fly-prior → 29 passed / 0 failed, including coupling_applies_the_prior_by_type_strength and coupling_refuses_an_unmappable_slot; qualia-metal --features fly-prior → 15 passed (the platform-independent CPU fallback; no Metal device is claimed on Linux). The coupling tests opened a real CudaContext — no skipping line — and the artifact was an ELF aarch64 binary. The FlySimSlot half landed separately on the board: qualia-jepa-runtime --features sim → 8 passed plus 2 smoke tests, with fly_sim_publishes_only_while_observe_only_is_approved publishing sim_step 1 then 2 into SHM_VERSION 3’s slot, and a smoke start that printed fly sim: disabled (QUALIA_FLY_PRIOR_PATH is unset).

The 4090. The three new kernels ran once each in a single-threaded capture under Nsight Systems (WSL2 host, nsys 2025.3.2.474, mage 0.1.0): 16 launches over 8 kernels, 4892.89 µs of kernel time, of which the new three are 2.50 µs (belief_couple), 10.59 µs (action_score) and 11.84 µs (perception_voxel). That capture is committed under docs/evidence/T16/three-kernels/ and is the number T17 and T18 have to beat. It replaced a 5-kernel baseline of 4784.75 µs / 13 launches (docs/evidence/baseline-2026-09-11/, at 76143f0).

The ABI for the simulator’s slot is fully pinned: FlySimPayload is repr(C, align(64)), 65,984 bytes, with a 65,536-byte state array (FLY_SIM_MAX_TYPES = 16,384 f32) and SHM_VERSION bumped 2 → 3. The payload carries no coupling gain — the model keeps gain private, so an observer cannot be handed a value the writer cannot read.

Evidence

^1 Measured on the host’s RTX 4090 in a different session from the board runs; the value is the fixture prior’s total, not a dataset-scale coupling. ^2 Both captures are from different sessions and different hardware: the T16 capture is the RTX 4090 under nsys on WSL2; the baseline is the same host before the three kernels existed. Durations on a shared 4090 are one contended sample; launch count and shape are the stable part.

The commit range this entry describes is 5999ba4..b13ca80 — the first coupling commit through the merge that put the backend couple_prior on main. Epics: EPIC-04 (#4), EPIC-05 (#5), EPIC-06 (#6).

What this does not establish

• T17 has not landed; T18 landed after this entry’s period. CPU/CUDA parity for the three new kernels was status:ready (#32) and was status:review as of 2026-09-11T20:45Z (#32, open): the three kernels have host oracles and a capture, not a parity assertion. The ≤ 6 GiB memory plan and the sm_87/sm_89 fatbin targets were status:ready (#33); T18 landed in 60beee4 (PR #207, merged 2026-09-11T20:16:14Z), and its board capture shows the sm_87 cubins loading on Pinkie with no CUDA_ERROR_UNSUPPORTED_PTX_VERSION (docs/evidence/T18/fatbin-sm-87/).
• T12 was not on main when this entry was written. The runner wiring that reads QUALIA_FLY_MODE and loads the prior at start-up was the replay on PR #198, then still open; it merged in 14b60de (2026-09-11T19:55:37Z). At the entry’s endpoint, main carried the backend coupling, the manifests’ env keys and the tests.
• semantic_novelty and dimorphism are not derivable. The artifact aggregates dimorphism away and the runtime carries no cell-to-type map; the exploration ticket sends a documented 0.0.
• The simulator has no drive. Nothing in the JEPA path is an input to the type graph, so the published state is the model’s resting state with a zeros drive — stated in the code, not hidden.
• couple’s effect on published belief is unobserved on an idle stack (see above). The per-tick total and the unit tests are the evidence; a mission that moves the belief has not been run.
• The 4090 numbers are one contended session. No error bar and no repeated-run spread are recorded in the T16 capture; compare shape and launch count first.

What we tried

A single crate, four narrow steps. build_type_graph reads Arrow IPC (file and stream framing), maps both endpoints through the annotation table, sums weights per (pre_type, post_type), sorts by that pair and emits CSR. write_prior writes the three files. main.rs is a clap binary with three arguments. The last step added the error paths. They landed as four commits — b56789e, a61fdb9, 6799365, 8adb09c on ticket/T06 — because one owner held the directory and the tests could grow one assertion at a time.

The plan’s Arrow 53 was abandoned. arrow = "53" cannot compile in this workspace: arrow-arith 53.4.0 declares an internal ChronoDateExt::quarter() that collides with chrono::Datelike::quarter, added in chrono 0.4.44. Arrow 56 is already the workspace’s arrow (through rerun), removed the redundant methods, and carries the same IPC reader. The dependency is arrow = { version = "56", features = ["ipc"] }, and the lock churn is exactly the arrow 53 stack leaving (14 packages) plus arrow-csv 56.2.1. The ticket text was left as written; this is the resolution.

The binary was rebuilt three times for line endings. 860235a → b56789e, d4eff4c → a61fdb9, d670f93 → 6799365: a staging script had introduced CRLF into the new files, and the provenance gate treats line-ending differences as real (see the licence entry). Content unchanged each time; the LF rewrite was cheaper than teaching the gate an exception.

edge_count had two defensible readings and we fixed one. The manifest says edge_count, and write_prior receives only the graph, so the only value recoverable from its inputs is the CSR nonzero count — the 12 fixture rows collapse to 9 pairs and the manifest records 9. The alternative (segment-level rows) is not available to the function, so the ambiguity was resolved by the interface, and stated on the ticket rather than left to a reader.

The fixture is the oracle

The test does not assert against a table copied from the implementation. It synthesises Feather inputs from the committed CSVs with arrow’s own IPC writer, then aggregates an oracle in the test from the CSV rows, and compares the emitted CSR to that. The invariant the fixture holds is the one the builder needs: every type in the edge file appears in the annotations file, and exactly one type (DNp01) is male-specific. The five types are DNp01, EPG, KCg-m, OA-VPM3, PEN_a; the 12 rows become 9 pairs.

Two error paths are pinned beside it. A missing file or a missing column is PriorError::Read. A row whose body id is in no annotation is skipped and counted, not fatal: the test injects one such row so the fixture holds 13 rows, and build_type_graph_reporting returns UnmappedRows { skipped: 1, total: 13 } as a warning while the emitted CSR is unchanged. For a dataset whose annotation table and edge table are separate downloads, the difference between “some rows did not join” and “the build failed” is the difference between a usable warning and an outage.

Written once, refused on reread

The artifact is designed to be read by a crate that does not trust it. manifest.json carries four digests — source_sha256 over the whole graph.bin, and one per section — and the consumer (crates/jepa) verifies them, and the size the counts imply, before decoding any array. The producer also refuses to overwrite itself: if dir already holds a manifest.json whose source_sha256 matches, write_prior returns AlreadyBuilt before any write or create_dir_all. The test compares name, mtime, length and bytes of all three files across the second call; the binary reports the same thing on stderr and exits non-zero (prior: prior already built from the same graph, exit 1), while a first run prints one line to stdout: prior: 5 types, 9 edges -> <dir>.

Evidence

^1 The 929,735 / 11,687 pair is the dataset release figure quoted in the earlier journal entry the-male-cns-as-arrays, which was written in a different session from this one. It is the scale this builder targets; it is not a measurement made by this ticket, whose only measured graph is the 9-pair fixture. The dataset numbers and the fixture numbers are different quantities and are not comparable.

The commit range this entry describes is d6f19d7..2e288a4: the workspace registration and fixture commit, through the merge of the four builder commits. Epics: EPIC-02 (#2) for the fixture and the members, EPIC-03 (#3) for the crate.

What this does not establish

• The dataset path is untested. Every measured number is from the 12-row fixture. The real build reads two multi-gigabyte Feather exports; whether it completes, how much it skips and how long it takes are unmeasured. The dataset’s own type graph is a release figure, not an output of this code.
• No sign, no dimorphism, no dynamics. The edge table carries no excitatory/inhibitory column, and the artifact is rowptr/cols/weights only. dimorphism is read from the annotations and then aggregated away. The type names and the male-specific flag are in the input and not in the output.
• skipped has never been non-trivial. The unmapped-row path was exercised with one injected row out of 13. What the ratio is on the real download — where identity is per segment and the annotation table has its own coverage gaps — is unknown.
• The digests prove integrity, not provenance. source_sha256 pinned in the manifest proves the graph.bin next to it is the one that was written; it says nothing about which upstream export was read. Attribution is a separate JSON file and is not signed.
• The idempotence rule is exact-match only. A rebuilt artifact from updated inputs has a different source_sha256 and will overwrite the directory without asking. “Already built” means “built from these exact bytes”, not “do not rebuild”.

What we tried

The first shape was a snapshot with the history thrown away: git archive HEAD | tar -x, git init, one commit. That is the shape that survived — the first commit is those five files, and every later commit is written here.

Relicensing was conditional, and the condition was checked. The ticket’s failure mode reads: if any commit author in git log --format='%ae' | sort -u is not under the user’s control, keep those files at MIT and note them in the NOTICE rather than relicense a third party’s work. The authors were under control, so the workspace field became license = "Apache-2.0" and the per-crate manifests point at it.

The guard moved twice, and ended as a script. A notice-check workflow job tested test -s NOTICE && grep -q "Leash project" NOTICE && grep -q "CC-BY" NOTICE && test -s LICENSE. When the workflows were dropped the same check became .github/scripts/notice-check.sh, so the guard survives without CI. This is the first entry, so it is also where the pattern of handing a check to a script instead of a runner starts.

The provenance gate kept being wrong, in four distinguishable ways. The verifier’s first version treated any byte-identical file as fatal, which flagged prose and rendered output that could not plausibly have been copied: provenance: a raw byte match is fatal unless the bytes are our own text (7751c45), then judge the reference on what it records, not what it renders (b2b4a70), then identity is fatal only for text this worktree authored (92e6871). None of those were kept as written. What was kept is text compared modulo line endings — compare text modulo line endings so the verdict ignores checkout settings (d99fe9a) — because a Windows checkout writes CRLF and the same file then reads as identical on one host and not on another. The final rule is in b7ac824 (#160): the identity verdict must not depend on checkout settings. The gate is also rooted at git rev-parse --show-toplevel rather than at the script’s own directory (902f286), so running the copy in a worktree measures that worktree and not main.

Secrets were a rule, not a review. .gitignore carries **/*.env, !**/*.env.example and deploy/**/camera-stream.env, so the one secret-shaped path in the private tree cannot be committed by accident. git check-ignore -v deploy/leash/camera-stream.env prints the match.

Two sources, one file

The NOTICE is where two other licences land, and neither of them is Apache-2.0:

• software from the Leash project (https://github.com/specdog/leash) under MIT;
• the Male CNS connectome (Berg et al. 2026, https://male-cns.janelia.org) under CC-BY 4.0.

So the repository’s licence is not one licence. Apache-2.0 covers the rewrite; MIT covers a dependency whose work is included; CC-BY covers data derived from a published dataset. The NOTICE is the join.

The number the gate prints

The gate’s method is narrow on purpose: it compares only files whose relative path also exists in the reference checkout, because everything else cannot have been copied. That is why the compared count is smaller than the tracked count — 104 of 157, then 110 of 170.

Evidence

^1 Read from the committed file at main, not from this text. ^2 docs/figures/the-licence-and-the-snapshot/provenance.json. The two runs were taken in a later session than the commits they measure; the commits are 144bb6d (which introduced the check) and a59b836 (the head then).

The commit range this entry describes is 776bff0..144bb6d — the snapshot and licence files through the commit that added the provenance gate. 776bff0 is the first commit on main; there is no history before it. A later run recorded in provenance.json is taken at a59b836. The rewrite itself is EPIC-00 (#66); this entry’s epic is EPIC-01 (#1).

What this does not establish

• Zero identical is measured against one checkout. The gate compares against the private reference tree present on the machine it runs on. A different revision of the reference, or none at all, gives a different number; the verdict is only as good as that checkout. The reference’s path is deliberately not recorded in the committed data.
• The comparison is byte equality, not similarity. A file that is 90 % copied is not identical and the gate passes it. Reformatting defeats the check; the check is a floor, not a proof of authorship.
• Two runs are recorded, not a continuous measurement. 144bb6d and a59b836 are the two runs in provenance.json. Nothing re-runs the gate on every commit.
• Not a legal opinion. That the NOTICE’s MIT and CC-BY attributions are the ones that are owed was decided by the plan’s step text, not by counsel; no third party audited the result.
• The 104/157 split is a path coincidence, not an audit. A file is compared only when a same-relative-path file exists in the reference; files that differ in name are never compared, so “0 identical” does not mean “0 files read”.

The claim. The whole central nervous system of a male fruit fly is now public data — 166,700 neurons, 11,710 cell types, 45.6 million pre-synaptic sites — and it is small enough to hold on one workstation. Reduce it to the graph between cell types and it becomes 929,735 edges over 11,687 types, which is a graph a GPU can sweep thousands of times while you wait. What is computable is therefore no longer “where does this neuron go” but “what happens to the circuit if this class of neuron is rewired” — and the classes that differ between the sexes are an enumerable list: 138 dimorphic and 289 male-specific types. That list is the thing worth computing on, and it is the thing that can be handed to a robot as a cost.

This post is a map and a plan, not a result. Every number below is the dataset’s; nothing on it has been computed yet, and the last section says exactly where the plan stops.

What the map is

One adult male, all of it: central brain, both optic lobes, and the ventral nerve cord in a single seamless volume — the first complete male CNS connectome, published in Cell in 2026 with a preprint in 2025.

All eight values are quoted; the last line is the one that matters here.

The type-level graph is the useful scale. Written as a dense matrix it would be

that is, about seven entries in a million — sparse enough to store as a list, small enough to hold several copies of, which is what makes sweeps affordable.

The sex comparison is where the numbers get sharp. Against the female FlyWire connectome, the types split into 8,069 isomorphic, 138 dimorphic, 289 male-specific and 71 female-specific. Put differently: roughly 95% of cells are shared, about 12% of neurons in the male brain show wiring differences against fewer than 3% in the female brain, and the male-specific and dimorphic types together are a few hundred names — small enough to enumerate by hand, large enough to be a real circuit.

How it gets onto one machine

Two doors, and they are not equivalent:

Python, for arrays. neuprint-python talks to the server at neuprint.janelia.org and returns pandas or Arrow tables; navis and navis-flybrains handle skeletons, meshes and coordinate transforms. This is the door for anyone who wants the connectivity as arrays and a GPU underneath it.

R, for the annotation ecosystem. neuprintr plus malevnc (the nerve-cord subset, MANC: about 23,000 neurons, 10 million pre-synaptic sites, 74 million post-synaptic densities) or malecns (the whole CNS). malecns is, in its own words, “a very thin wrapper around the malevnc package”. This is the door for Clio annotations and template-brain registration across light-level templates.

The bulk data sits on a public Google Cloud bucket, and this is the part that decides what kind of work is possible:

Row counts are read from each file’s Arrow footer, and the first two check out against the dataset’s own metadata: $45{,}656{,}140 + 311{,}833{,}243 = 357{,}489{,}383$.

That is a couple of hundred gigabytes of local disk at most, and the connectivity itself — the 1.051 GB export — is a file you can open in a notebook.

Four things make the wrangling harder than the download, and all four are worth knowing before writing code:

• Identity is per segment, not per neuron. The Neuprint_Neurons export has 88.7 million rows, because it also carries untraced fragments. The neuron count comes from the annotation table (211,577 rows with curated annotation) and from the status field, not from the row count.
• A pre-synaptic site is not a connection. One T-bar can contact several partners, so connections exceed pre-synaptic sites; weight on the ConnectsTo edge is the count of contacts. Connections and synapses are different quantities and the press numbers mix them.
• Sign is inferred. There is no excitatory/inhibitory column. There are predicted neurotransmitter probabilities per neuron and per T-bar — ACh, GABA, glutamate, dopamine, octopamine, serotonin, histamine, tyramine — and the sign is a reading of those.
• The join keys are the point. Each type can carry flywireType, mancType, hemibrainType, vfbId and a itoleeHl hemilineage; 8,137 of the 11,751 type entries in the explorer carry a FlyWire type. Cross-dataset work is a join on those columns, and where they are empty the join is simply unavailable.

What the GPU is actually for

Not size. The adjacency is 1 GB, and any laptop holds that. The GPU is for repetition: every question worth asking about a circuit is a null test — how surprising is this many connections between these two types; what survives if these 289 types are rewired at random; which dimorphic types are dimorphic in a structured way rather than by drift. Each of those is a full pass over the edge list, and there are thousands of them.

The primitive is one we have already measured. Neighbour aggregation over a CSR edge list — a rowptr array, an indices array, a weights array, one output row per input row — is exactly the shape of a connectome statistic, and on the RTX 4090 it runs at 7.06 µs over 65,536 edges after the load-widening change (Triton’s kernel, 5.97 µs, is still ahead). The type graph is about fourteen times larger, so one statistical sweep is on the order of a tenth of a millisecond; ten thousand permutations then cost seconds, not hours, and that is the whole argument for the card.

Three kernels cover most of it: a degree and sign census (one pass, per-type segmented reduce), a two-hop reach — sparse × sparse, $929{,}735 \times 929{,}735$ at type level, which is how you ask “what does this class touch through one intermediate” — and permutation tests, the same census run across shuffled adjacency, where the GPU’s job is to run many tiny independent versions of the same kernel rather than one large one.

How it drives

The loop it feeds already exists, in two repositories.

leash is a safety-gated Rust robotics runtime: CLI, HTTP and MCP control over simulation, replay and physical hardware, with the safety authority — authorization, approval, deadman, freshness, collision, distance, stop, latching E-stop — held by the runtime and not by the caller. Its compute surface is exactly what this needs: a bounded, authenticated, advisory job API (POST /compute/jobs, results capped at 1 MiB, at most two concurrent, deadlines up to 120 seconds) whose own documentation states that compute results “cannot authorize or refresh motor output”. The leash-cuda crate owns the on-robot CUDA contract: a checked-in fatbin for the Jetson Orin NX (SM 8.7, CUDA 12.9, SHA-256 recorded in a manifest, six kernels each compared against a CPU oracle), built deliberately rather than compiled at startup.

qualia is the runtime that carries the higher-order state, and its planner speaks a frozen contract: plan_path over a local socket as newline-delimited JSON, taking a start pose, a goal pose, an occupancy grid, constraints — and a belief_risk block of two floats:

That is the seam. The planner today is grid-only — A* or uniform cost over a 2D occupancy grid — so a connectome does not become the planner. It becomes a prior on the cost: a table saying where the male-specific and dimorphic circuitry is involved, which the planner already knows how to price in, with the evidence attached and the authority left where it is.

What this does not establish

Nothing on this page has been computed. The dataset numbers are quoted from the paper, the release metadata and the exports; the graph sizes are read from file footers; the kernel time is from the earlier profiling session and is a neighbour-aggregation kernel on synthetic edges, not on this data. The plan — map, compute, price — is a plan.

Beyond that, four things are open or unresolved and none of them are small:

• The step from structure to a cost is the research problem. Knowing that 289 types are male-specific does not say what a robot should do differently. Nothing here identifies which of those types, if any, corresponds to a navigational decision; that mapping would have to be earned.
• Version and count discrepancies. The paper says 11,710 types, the v1.0 explorer says 11,751, and the preprint said 11,691; the explorer’s catalog sums to 164,838 cells against the paper’s 166,700 neurons. Two different dataset UUIDs circulate (one in the neuprint metadata, one in the explorer). I have not resolved any of these.
• The press figure is not the table figure. “125 million synaptic connections” does not match the 311.8 M post-synaptic sites or the 151.9 M segment-to-segment edges; the arithmetic that reconciles them is not stated in any source I found, and I have not asserted one.
• Sign, and the parts of the nervous system the plan ignores. Excitatory/inhibitory is inferred from neurotransmitter prediction, not measured. Neuromodulation, gap junctions, and everything that is not a chemical synapse are outside the edge list; so is the animal, since a connectome recorded from one male fly is a single sample of a species.

The download page has the exports; the paper and its preprint have the biology; malecns and 2025malecns are the two access paths this post uses; leash is where the numbers would land.

The claim. Give a compiler the job of deciding how a GPU kernel places its data, and it will do well where reuse is low and worse where reuse is high. On five FP32 operations, the cuTile Rust tile kernels beat the hand-written kernels on bias + GELU — $8.19\ \mu s$ against $11.0$ — drew on layer normalization, and lost on matrix multiply, triangle contraction and neighbor aggregation by $1.6\times$, $1.4\times$ and $3.4\times$.

Two arguments carry that claim, and both are about memory rather than arithmetic.

Reuse is a layout problem

A thread that computes one output element of $C = A B$ reads one value of $A$ and one of $B$ per multiply-add. A thread that computes a $4\times4$ block reads four of each and performs sixteen multiply-adds, so shared-memory reads per multiply-add fall from $\tfrac{2}{1}$ to $\tfrac{8}{16} = 0.5$ — and loading those as 128-bit quads takes it to $0.125$: one instruction fetching all four values the thread needs.

The tile compiler is not blind to any of this: it widens loads too, and it partitions the output into $32\times128$ tiles with $32\times32$ operands per contraction step. What it cannot know is that this problem wants a particular arrangement. Its matrix multiply is $1.6\times$ slower, and no arithmetic explains that — only where the operands sit when the multiply issues.

The clock measures two things

Time around a call is submission plus execution:

The tile runtime submits lazily, and one awaited call costs $14\text{–}23\ \mu s$ of host time against $2\text{–}3\ \mu s$ for the hand-written kernel. It is the difference between a taxi meter that starts when you pick up the phone and one that starts when the wheels turn: a comparison that waits for every call is comparing phone calls, not journeys. Bias + GELU measures $29.97\ \mu s$ around a kernel that runs in $8.19\ \mu s$. Queue the calls, or replay them from a recorded CUDA graph, and every operation lands on its kernel time:

Microseconds, mean of 100 launches. Replay reaches $7.77\ \mu s$ on bias + GELU. Timed the same way, Triton and PyTorch also improve, by $6\text{–}7\ \mu s$ and about $1\ \mu s$ per call.

Evidence

Kernel time from separate Nsight Systems captures, 100 launches each. Every output was checked against PyTorch with TF32 disabled before any timing was believed.

Microseconds of GPU kernel time per operation. Layer normalization is worth reading twice: the tile kernel pads every $768$-wide row out to $1024$, because tile dimensions must be powers of two, so a third of its lanes do nothing — and it still draws.

Tile shape turned out to be the same kind of decision: the identical kernel measured $738\ \mu s$ at the tutorial’s $16\times16\times8$ tile and $131.56\ \mu s$ at $32\times128\times32$, and $128\times128\times8$ was $2.3\times$ slower than a smaller tile. That non-monotonicity is a register or occupancy cliff, not arithmetic.

What was tried and not kept

• A broadcast product instead of the matrix instruction. It did not compile, and the matrix instruction kept FP32 accuracy anyway: $1.5\times10^{-5}$ against the strict reference at $K = 1024$ — accumulation error, not a 10-bit mantissa’s.
• Deeper contraction steps at small tiles. $16\times16\times32$ measured $1072\ \mu s$ against $738$ at $16\times16\times8$.
• A loop over the channel axis in the triangle kernel. Every channel read the first channel’s values; a partition load indexed by a loop variable does not vary, so the channel has to come from the grid axes.
• One row per program for layer norm. It runs, but it forces the $768 \to 1024$ padding.

What these numbers do not establish

No hardware counters are available on this host, so occupancy and bandwidth are inferred from ratios rather than read. The cuda-oxide column is a previous round’s measurement, not taken in the same session, so the two Rust columns should not be subtracted from each other. One capture per operation means a kernel time carries no interval of its own, and compilation, transfers and process startup are excluded throughout.

The field note has the full tables, and the technical record has the method, the compiler’s constraints and the reproduction commands.