"""Model-routed, crash-safe out-of-core native expert pages.

The resident router, RBO/Fabric pathway state, and page executor are ordinary
``nn.Module`` components in the active graph.  The filesystem store is an
explicit boundary: it may materialize the exact page IDs emitted by the model,
but it may not replace, rerank, truncate, or otherwise alter that route.

Each accepted generation is one immutable transaction covering page weights,
per-page optimizer moments, router/RBO/Fabric/VGE/global component digests, and
RNG state.  Generation directories are fsynced before a regular accepted
pointer advances.  Orphan objects or generation directories are ignored after
a crash because only the pointer is authoritative.
"""

from __future__ import annotations

import base64
import fcntl
import hashlib
import json
import math
import mmap
import os
import shutil
import stat
import struct
import threading
import time
from concurrent.futures import Future, ThreadPoolExecutor, as_completed
from dataclasses import dataclass, replace
from pathlib import Path
from typing import (
    Any,
    BinaryIO,
    Callable,
    Final,
    Iterable,
    Mapping,
    ParamSpec,
    TypeVar,
    cast,
)

import numpy as np
import orjson
import torch
import torch.nn as nn
import torch.nn.functional as F
import zstandard as zstd
from torch.autograd.function import once_differentiable
from safetensors import safe_open
from safetensors.torch import load, save, save_file

from resynthesis.direct_page_pack import (
    DIRECT_PAGE_PACK_ALIGNMENT_BYTES,
    DIRECT_PAGE_PACK_FORMAT_REVISIONS,
    DIRECT_PAGE_PACK_MIN_BYTES_PER_SECOND,
    DirectPagePackBuildPacket,
    DirectPagePackIndexPacket,
    DirectPagePackSetAuthorityPacket,
    DirectPagePackSourcePacket,
    build_direct_page_pack_set_boundary,
    load_existing_direct_page_pack_set_for_source_boundary,
    load_direct_page_pack_index_boundary,
    read_direct_page_pack_selected_boundary,
    reopen_direct_page_pack_set_boundary,
    validate_direct_page_pack_set_authority_boundary,
    verify_direct_page_pack_set_cold_boundary,
)
from resynthesis.none_shared_page_cache import (
    SharedNoNEPageWeights,
    SharedPageCacheAuthority,
    SharedPageWeightsCache,
)
from resynthesis.quantile_balancing import QuantileBalancingRouter


PAGE_OBJECT_SCHEMA: Final[str] = "nnf.resynthesis.none_page_object.v2"
PAGE_GENERATION_SCHEMA_V2: Final[str] = (
    "nnf.resynthesis.none_page_generation.v2"
)
PAGE_GENERATION_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_generation.v3"
)
PAGE_GENERATION_DELTA_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_generation_delta.v1"
)
PAGE_GENERATION_DELTA_MAX_DEPTH: Final[int] = 4
PAGE_GENERATION_SCHEMAS: Final[frozenset[str]] = frozenset(
    (
        PAGE_GENERATION_SCHEMA_V2,
        PAGE_GENERATION_SCHEMA,
        PAGE_GENERATION_DELTA_SCHEMA,
    )
)


def page_generation_schema_supported_boundary(value: object) -> bool:
    """Accept full immutable ancestors and parent-bound catalog deltas."""

    return isinstance(value, str) and value in PAGE_GENERATION_SCHEMAS
PAGE_ACCEPTED_POINTER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_accepted_pointer.v1"
)
PAGE_STORE_LOCATOR_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_store_locator.v1"
)
PAGE_STORE_REACHABILITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_store_reachability.v1"
)
PAGE_STORE_RECLAIM_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_store_reclaim.v1"
)
PAGE_OBJECT_WRITE_PLACEMENT_PROOF_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_object_write_placement_proof.v1"
)
PAGE_OBJECT_WRITE_PLACEMENT_AUTHORITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_object_write_placement_authority.v1"
)
PAGE_OBJECT_WRITE_PLACEMENT_POINTER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_object_write_placement_pointer.v1"
)
PAGE_OBJECT_WRITE_ROOT_OWNER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_object_write_root_owner.v1"
)
TRAINING_BRANCH_RETIREMENT_INTENT_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_retirement_intent.v1"
)
TRAINING_BRANCH_RETIREMENT_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_retirement.v1"
)
TRAINING_BRANCH_STORE_RETIREMENT_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_store_retirement.v1"
)
TRAINING_BRANCH_RETIRED_POINTER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_retired_pointer.v1"
)
TRAINING_BRANCH_RETIRED_MANIFEST_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_retired_manifest.v1"
)
LAYER_BRANCH_PLAN_LOCATOR_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_layer_branch_plan_locator.v1"
)
TRAINING_BRANCH_SCOPE_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_scope.v1"
)
TRAINING_BRANCH_UNION_PROOF_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_union_proof.v1"
)
TRAINING_BRANCH_UNION_REBASE_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_training_branch_union_rebase.v1"
)
SEALED_HISTORICAL_TRAINING_COVERAGE_SCHEMA: Final[str] = (
    "nnf.resynthesis.sealed_historical_training_coverage.v1"
)
CANONICAL_INHERITED_PAGE_TRAINING_PROOF_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_canonical_inherited_page_training_proof.v1"
)
FEDERATED_GROWTH_DEMAND_AUTHORITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_federated_growth_demand_authority.v1"
)
FULL_PAYLOAD_FEDERATED_NONE_GROWTH_PLAN_SCHEMA: Final[str] = (
    "nnf.resynthesis.full_payload_federated_none_growth_plan.v1"
)
FULL_PAYLOAD_FEDERATED_PACKED_COLLECTION_SCHEMA: Final[str] = (
    "nnf.resynthesis.full_payload_federated_packed_token_collection.v1"
)
FULL_PAYLOAD_PACKED_READY_FEDERATION_MODE: Final[str] = (
    "packed_ready_authorities"
)
SPARSE_GRAPH_LAYER_AUTHORITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_sparse_graph_layer_authority.v1"
)
FILE_SHA256_IDENTITY_CACHE_SCHEMA: Final[str] = (
    "nnf.resynthesis.file_sha256_identity_cache.v1"
)
PAGE_CATALOG_TOPOLOGY_CACHE_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_catalog_topology_cache.v1"
)
_PAGE_CATALOG_TOPOLOGY_CACHE_DIRECTORY: Final[str] = (
    ".nnf-resynthesis-page-catalog-topology-cache"
)
DEFAULT_GPU_PAGE_CACHE_ENTRIES: Final[int] = 8
FULL_OPTIMIZER_PAGE_FORMAT_REVISION: Final[int] = 2
IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION: Final[int] = 3
SCALED_FLOAT8_TRANSFER_PAGE_FORMAT_REVISION: Final[int] = 4
STATELESS_HYBRID_PAGE_FORMAT_REVISION: Final[int] = 5
BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION: Final[int] = 6
SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION: Final[int] = 7
SELF_CONTAINED_DIRECT_PAGE_FORMAT_REVISIONS: Final[frozenset[int]] = (
    frozenset(
        {
            FULL_OPTIMIZER_PAGE_FORMAT_REVISION,
            IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION,
            SCALED_FLOAT8_TRANSFER_PAGE_FORMAT_REVISION,
            STATELESS_HYBRID_PAGE_FORMAT_REVISION,
            SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION,
        }
    )
)
ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS: Final[
    frozenset[int]
] = frozenset(
    {
        FULL_OPTIMIZER_PAGE_FORMAT_REVISION,
        SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION,
    }
)
RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS: Final[frozenset[int]] = (
    frozenset(
        {
            FULL_OPTIMIZER_PAGE_FORMAT_REVISION,
            IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION,
            SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION,
        }
    )
)
RECONCILED_DIRECT_PAGE_MAP_LEDGER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_reconciled_direct_page_map_ledger.v1"
)
RECONCILED_DIRECT_PAGE_MAP_AUTHORITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_reconciled_direct_page_map_authority.v1"
)
LEGACY_DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_direct_page_pack_set_authority.v1"
)
DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_direct_page_pack_set_authority.v2"
)
DIRECT_PAGE_PACK_DIAGNOSTIC_INVENTORY_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_direct_page_diagnostic_inventory.v2"
)
DIRECT_PAGE_PACK_LOCAL_LOCATOR_DIAGNOSTIC_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_direct_page_local_locator_diagnostic.v1"
)
RECONCILED_DIRECT_PAGE_MAP_FRONTIER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_reconciled_direct_page_map_frontier.v1"
)
ALL_KNOWLEDGE_PHYSICAL_REPLICA_PROOF_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_physical_replica_proof.v1"
)
ALL_KNOWLEDGE_STAGED_COLD_FORWARD_PROOF_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_staged_cold_forward_proof.v2"
)
ALL_KNOWLEDGE_ACCEPTANCE_TRANSACTION_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_acceptance_transaction.v2"
)
ALL_KNOWLEDGE_ACCEPTANCE_POINTER_VISIBILITY_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_acceptance_pointer_visibility.v1"
)
ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_acceptance_commit_marker.v2"
)
ALL_KNOWLEDGE_ACCEPTANCE_ROLLBACK_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_acceptance_rollback.v1"
)
ALL_KNOWLEDGE_PARENT_PROJECTION_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_disposable_parent_projection.v1"
)
ALL_KNOWLEDGE_RECONCILED_KNOWLEDGE_PROOF_SCHEMA: Final[str] = (
    "nnf.resynthesis.all_knowledge_reconciled_knowledge_proof.v1"
)
ALL_KNOWLEDGE_PHYSICAL_REPLICA_MIN_BYTES_PER_SECOND: Final[int] = (
    1_000_000_000
)
ALL_KNOWLEDGE_PHYSICAL_PAGE_COUNT: Final[int] = 81_602
ALL_KNOWLEDGE_PHYSICAL_PAGE_MAX: Final[int] = 110_581
ALL_KNOWLEDGE_PHYSICAL_PAGES_ABOVE_101000: Final[int] = 9_581
ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT: Final[int] = 14
ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT: Final[int] = 21_942
ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000: Final[int] = 5_479
SEALED_HISTORICAL_TRAINING_PARENT_SESSION_SHA256: Final[str] = (
    "ee33edc74b3c6608be252fa5b4f261af9fdedb07a3a8ab45773eee5d83ed2c2e"
)
SEALED_HISTORICAL_TRAINING_PARENT_GENERATION: Final[int] = 187
ALL_KNOWLEDGE_RECONCILIATION_OUTPUT_GENERATION: Final[int] = 188
SEALED_HISTORICAL_TRAINING_PARENT_MANIFEST_SHA256: Final[str] = (
    "1d38aae81893af7d0b5f4783b15b994690c1e84c7ffc33f2462f001c0a68be57"
)
SEALED_HISTORICAL_TRAINING_PARENT_MANIFEST_PAYLOAD_SHA256: Final[str] = (
    "36f4f177480e4dc5b58febb65633a7b5bcc300a108d28798928ebb58b321b760"
)
SEALED_HISTORICAL_TRAINING_ACCEPTED_POINTER_SHA256: Final[str] = (
    "7e4f7042cbaec3fdcd4c332d51f18ee0f34cdc411e635f76e92fb7391207a9f6"
)
SEALED_HISTORICAL_TRAINING_PLAN_FILE_SHA256: Final[str] = (
    "747ed45a1b17083cfea41aebc2ce3dff8d5d77204f6bd8d6527250d71500eed4"
)
SEALED_HISTORICAL_TRAINING_PLAN_SHA256: Final[str] = (
    "931dba1613952d386419bc7ab088ca88a58d9026c1360f3e4264f576e2134d5b"
)
SEALED_HISTORICAL_TRAINING_HISTORY_SHA256: Final[str] = (
    "3afb9a4d6f8fabd9917d0508d60c187f84466cb063b91b14e5c05d4566c35569"
)
SEALED_HISTORICAL_TRAINING_SOURCE_SHA256: Final[str] = (
    "d2ad314befd60a6023616c550f6a11c95bbdf76a83ad428bcbc9bb68dd8d6b46"
)
SEALED_HISTORICAL_TRAINING_SCHEDULE_SHA256: Final[str] = (
    "2409181fa20a41f147410837496c55331c5feaf929da3843ce9c4f953b5c8c35"
)
SEALED_HISTORICAL_TRAINING_GLOBAL_ROWS: Final[int] = 2_421_548
SEALED_HISTORICAL_TRAINING_ROW_INTERVALS: Final[
    tuple[tuple[int, int], ...]
] = (
    (0, 605_387),
    (605_387, 1_210_774),
    (1_210_774, 1_816_161),
    (1_816_161, 2_421_548),
)
SEALED_HISTORICAL_TRAINING_TRANSACTION_SHA256S: Final[
    tuple[str, ...]
] = (
    "02cd45fedcb366afb452974c987522f83641059a20e15fcb3a7534c5f3897569",
    "10474a423a8d4e6060bbcc79c79822a4a2c4720739032e304a5092aba74d8d7c",
    "92e0d4fbc8373a2ba7923b04e567a19cf21888309234ec2e0034606a86f2440b",
    "847378146bd898bfa1643dd8ca68759c45e2c53750ad7bf13de43a98e1fcfb03",
)
_ALL_KNOWLEDGE_REPLICA_IO_ALIGNMENT: Final[int] = 4_096
_ALL_KNOWLEDGE_REPLICA_IO_WAVE_BYTES: Final[int] = 64 * 1024 * 1024
HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_historical_page_tensor_surgery_ledger.v1"
)
NONE_SEMANTIC_PAGE_PACK_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_semantic_page_pack.v1"
)
NONE_SEMANTIC_PAGE_PACK_LOCATOR_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_semantic_page_pack_locator.v1"
)


def _validated_all_knowledge_plan_inventory_counts_boundary(
    plan: Mapping[str, Any],
) -> tuple[int, int]:
    """Derive accepted inventory counts from one immutable union plan.

    Pointer and head counts describe discovered historical evidence, not model
    capacity.  They therefore come from the self-hashed plan and its complete
    head-coverage rows instead of a source constant that can become a stale
    structural cap when another valid authority is discovered.
    """

    accepted_pointer_count = plan.get("acceptedPointerCount")
    unique_accepted_head_count = plan.get("uniqueAcceptedHeadCount")
    head_coverage = plan.get("headCoverage")
    if (
        not isinstance(accepted_pointer_count, int)
        or isinstance(accepted_pointer_count, bool)
        or accepted_pointer_count < 1
        or not isinstance(unique_accepted_head_count, int)
        or isinstance(unique_accepted_head_count, bool)
        or unique_accepted_head_count < 1
        or unique_accepted_head_count > accepted_pointer_count
        or not isinstance(head_coverage, list)
        or len(head_coverage) != accepted_pointer_count
        or any(
            not isinstance(row, dict)
            or not isinstance(row.get("generation"), int)
            or isinstance(row.get("generation"), bool)
            or row["generation"] < 0
            or not isinstance(row.get("pointerPath"), str)
            or not row["pointerPath"]
            or not _valid_sha256_boundary(row.get("pointerSha256"))
            or not _valid_sha256_boundary(
                row.get("manifestPayloadSha256")
            )
            for row in head_coverage
        )
        or len(
            {
                cast(str, row["pointerPath"])
                for row in head_coverage
                if isinstance(row, dict)
            }
        )
        != accepted_pointer_count
        or len(
            {
                (
                    cast(int, row["generation"]),
                    cast(str, row["manifestPayloadSha256"]),
                )
                for row in head_coverage
                if isinstance(row, dict)
            }
        )
        != unique_accepted_head_count
        or len(
            {
                cast(str, row["pointerSha256"])
                for row in head_coverage
                if isinstance(row, dict)
            }
        )
        != unique_accepted_head_count
    ):
        raise RuntimeError(
            "NoNE historical tensor union plan inventory differs"
        )
    return accepted_pointer_count, unique_accepted_head_count
_NONE_SEMANTIC_PAGE_PACK_MAGIC: Final[bytes] = (
    b"NNFNPACKREV6".ljust(16, b"\x00")
)
_NONE_SEMANTIC_PAGE_PACK_FOOTER_MAGIC: Final[bytes] = (
    b"NNFNPACKFOOT".ljust(16, b"\x00")
)
_NONE_SEMANTIC_PAGE_PACK_VERSION: Final[int] = 1
_NONE_SEMANTIC_PAGE_PACK_HEADER = struct.Struct("<16sIIQQQQQQ")
_NONE_SEMANTIC_PAGE_PACK_FOOTER = struct.Struct("<16sIIQ32s32s")
_NONE_SEMANTIC_PAGE_PACK_SHA256_FOOTER_OFFSET: Final[int] = 64
_NONE_SEMANTIC_PAGE_PACK_WRITE_CHUNK_BYTES: Final[int] = 64 * 1024 * 1024
_NONE_SEMANTIC_PAGE_PACK_SUFFIX: Final[str] = ".none-semantic-pack"
_NONE_SEMANTIC_PAGE_PACK_CODEC: Final[str] = (
    "rev6-bfloat16-low-raw-high-semantic-zstd1-v1"
)
_NONE_SEMANTIC_PAGE_PACK_UNSUPPORTED_DIRECT_ERRNOS: Final[frozenset[int]] = (
    frozenset(
        {
            getattr(os, "ENOTSUP", 95),
            getattr(os, "EOPNOTSUPP", 95),
            getattr(os, "EINVAL", 22),
            getattr(os, "ENOSYS", 38),
            getattr(os, "EPERM", 1),
        }
    )
)
SCALED_FLOAT8_TRANSFER_STORAGE: Final[str] = (
    "scaled_float8_e4m3fn_implicit_zero_optimizer_v1"
)
_BASE_BOUND_DELTA_MAX_DEPTH: Final[int] = 64
# The live four-shard lane repeatedly routes across 1,004 family roots whose
# immutable rows and their rev6 parent chains total more than one thirty-second
# of host memory.  That smaller bound evicted exact FP32 parents before the next
# CUDA wave and forced recursive safetensor reconstruction while the accelerator
# waited.  One sixteenth retains the observed routed closure while four owners
# together remain bounded to one quarter of physical memory.
_CPU_PAGE_MATERIALIZATION_CACHE_MEMORY_DIVISOR: Final[int] = 16
# Exact-CE vocab tiling and grouped BF16 page execution removed the dense-logit
# and active-pair replication cliffs that constrained the previous 64/512-row
# requests.  Ask for one complete 2,048-row knowledge update: retained live
# allocator evidence remains the sole authority for the effective CUDA wave,
# and exact OOM evidence still persists a bisected ceiling before the same
# durable cursor is retried.
MODEL_OWNED_TRAINING_CUDA_WAVE_ROWS: Final[int] = 2_048
# A route cohort owns one coherent model-selected page union.  Bound that union
# to the complete knowledge update so every capacity-clamped CUDA wave reuses
# one model-owned route.  Live receipts show one 2,048-row cohort materializes
# 36 pages in 1-3 seconds, while four 512-row cohorts repeat 144 page reads and
# spend 15-26 seconds in read/dequant.  The later single-cohort failure was the
# capacity planner admitting a measured row projection wider than the current
# prompt geometry; that projection is now intersected with prompt capacity
# before admission.  Exact OOM evidence still narrows CUDA waves independently.
MODEL_OWNED_TRAINING_ROUTE_COHORT_ROWS: Final[int] = 2_048

_PAGE_WEIGHT_TENSOR_NAMES: Final[tuple[str, ...]] = (
    "ffn_mode_t",
    "gate_t",
    "up_t",
    "down_t",
    "glyph_down_t",
    "glyph_up_t",
    "translation_gate_t",
    "outcome_memory_t",
    "repair_memory_t",
    "transfer_memory_t",
)

# The two glyph projections account for enough bytes to keep a complete
# 70,700-page trained generation inside both replica failure domains. Main
# expert matrices remain bfloat16 so first-step parameter deltas are retained
# exactly; glyph projections use their existing explicit scaled-float8 codec.
_STATELESS_HYBRID_FLOAT8_WEIGHT_NAMES: Final[tuple[str, ...]] = (
    "glyph_down_t",
    "glyph_up_t",
)

_PAGE_TENSOR_NAMES: Final[tuple[str, ...]] = (
    "page_ids_t",
    *_PAGE_WEIGHT_TENSOR_NAMES,
    "optimizer_mean_t",
    "optimizer_square_t",
    "step_t",
)

_FileIdentity = tuple[int, int, int, int, int]


@dataclass(frozen=True)
class _NoNEAuthorizedPageObject:
    """One accepted legacy path or exact in-memory packed object."""

    page_id: int
    object_sha256: str
    object_bytes: int
    object_path: Path | None
    object_payload_t: torch.Tensor | None


_AuthorizedPageObject = _NoNEAuthorizedPageObject


@dataclass(frozen=True)
class _NoNEPageCatalogTopology:
    """Compact, verified storage-bound topology derived from one page catalog."""

    page_ids: tuple[int, ...]
    page_layer_ids: tuple[int, ...] | None
    trained_capability_claimed: tuple[bool, ...] | None
    layer_count: int
    family_root_count: int
    sparse_graph_layer_authority: tuple[tuple[int, ...], str] | None


@dataclass(frozen=True)
class _NoNEGenerationLineageAuthority:
    """Compact authority needed to resolve one immutable generation lineage."""

    manifest_sha256: str
    manifest_payload_sha256: str
    session_key: str
    generation: int
    parent_generation: int
    parent_manifest_payload_sha256: str | None


_FILE_SHA256_CACHE: dict[Path, tuple[_FileIdentity, str]] = {}
_FILE_SHA256_IDENTITY_PROBE_CACHE: dict[
    Path,
    tuple[_FileIdentity, str, str],
] = {}
_FILE_IDENTITY_CONTENT_PROBE_BLOCK_BYTES: Final[int] = 128 * 1024
_FILE_IDENTITY_CONTENT_PROBE_BLOCK_COUNT: Final[int] = 64
_GENERATION_JSON_CACHE_LOCK = threading.Lock()
_GENERATION_JSON_CACHE: dict[
    Path,
    tuple[_FileIdentity, str, dict[str, Any]],
] = {}
_GENERATION_MANIFEST_AUTHORITY_CACHE: dict[
    Path,
    tuple[
        _FileIdentity,
        str,
        str,
        dict[int, dict[str, Any]],
        dict[str, Any],
        tuple[tuple[Path, _FileIdentity], ...],
    ],
] = {}
_GENERATION_PAGE_ROW_CACHE: dict[
    tuple[Path, int],
    tuple[
        _FileIdentity,
        str,
        str,
        dict[str, Any],
        tuple[tuple[Path, _FileIdentity], ...],
    ],
] = {}
_GENERATION_LINEAGE_AUTHORITY_CACHE: dict[
    Path,
    tuple[_FileIdentity, _NoNEGenerationLineageAuthority],
] = {}
_GENERATION_LINEAGE_CONTENT_CACHE: dict[
    str,
    _NoNEGenerationLineageAuthority,
] = {}
_GENERATION_LINEAGE_SUMMARY_CACHE_MAX_PATHS: Final[int] = 4_096
_GENERATION_LINEAGE_SUMMARY_CACHE: dict[
    Path,
    tuple[_FileIdentity, dict[str, Any], str | None],
] = {}


def _commit_tail_worker_count(env_var: str, default_cap: int) -> int:
    """Resolve one commit-tail I/O worker pool size for this host.

    Page materialization and rev6 semantic admission do independent per-page
    I/O plus tensor checks (results are verified per page and the accepted
    generation authority is checked before and after the pool), so the pools
    scale with host cores up to a bounded cap instead of serializing behind a
    fixed handful of workers. The prior fixed cap of 8 left 64-core hosts
    committing through ~8 workers; the default cap is raised accordingly while
    staying below the core count so concurrent lanes retain headroom. Operators
    may override per host via ``env_var`` (a positive integer).
    """

    cpu_count = os.cpu_count() or 1
    default = min(default_cap, cpu_count)
    raw = os.environ.get(env_var, "").strip()
    if not raw:
        return default
    try:
        requested = int(raw)
    except ValueError as error:
        raise RuntimeError(f"{env_var} must be a positive integer") from error
    if requested < 1:
        raise RuntimeError(f"{env_var} must be a positive integer")
    return requested


_DEFAULT_COMMIT_TAIL_WORKER_CAP: Final[int] = 32
_PAGE_MATERIALIZATION_IO_WORKERS: Final[int] = _commit_tail_worker_count(
    "NNF_RESYNTHESIS_PAGE_MATERIALIZATION_IO_WORKERS",
    _DEFAULT_COMMIT_TAIL_WORKER_CAP,
)
# Candidate updates are page-local and can be much larger than ordinary
# metadata tasks. Bound the single-writer handoff queue so closures and
# completed Future results never retain one pinned host bundle per routed
# page while still overlapping one transfer with one scratch write.
_CANDIDATE_PAGE_STAGE_MAX_PENDING: Final[int] = 2
# Each page-materialization worker may simultaneously need source and terminal
# manifests while a revision-6 object walks its immutable parent closure. The
# prior one-entry-per-worker bound still cyclically evicted and canonically
# rehashed complete ~81k-page manifests during historical surgery. Retain the
# larger of the complete permitted delta closure or two manifests per worker,
# plus the live accepted generation. Entries remain identity-bound to unchanged
# device/inode/size/mtime/ctime evidence and therefore add no authority.
_GENERATION_JSON_CACHE_MAX_PATHS: Final[int] = (
    max(
        _BASE_BOUND_DELTA_MAX_DEPTH,
        _PAGE_MATERIALIZATION_IO_WORKERS * 2,
    )
    + 1
)
_GENERATION_PAGE_ROW_CACHE_MAX_ENTRIES: Final[int] = (
    _PAGE_MATERIALIZATION_IO_WORKERS * 256
)
# Semantic admission reconstructs and validates immutable rev6 children from
# their delta payloads; that work is independent per page and bounded by host
# I/O and tensor checks, so it scales like the materialization I/O pool
# instead of serializing behind a fixed pair of workers.
_PAGE_SEMANTIC_ADMISSION_WORKERS: Final[int] = _commit_tail_worker_count(
    "NNF_RESYNTHESIS_PAGE_SEMANTIC_ADMISSION_WORKERS",
    _DEFAULT_COMMIT_TAIL_WORKER_CAP,
)
_PAGE_OBJECT_IDENTITY_DIGEST_DOMAIN: Final[bytes] = (
    b"nnf-resynthesis-none-page-object-identities-v1\x00"
)

# ---------------------------------------------------------------------------
# r152 page-fill ledger / tracer (additive, fail-open)
# ---------------------------------------------------------------------------
#
# r152 page-allocation policy (see r152_page_allocation_policy_20260725):
#   When NoNE training needs page capacity, the pager GROWS new pages OR FILLS
#   UNALLOCATED EMPTY pages.  It NEVER reallocates an already-allocated/learned
#   page in a way that discards learned weights, and it preserves every learned
#   page.  Capacity must never block training.
#
# This ledger records, per accepted-generation transaction, how each updated
# page was filled so an operator can confirm pages are actually receiving rows
# (the "are pages filling?" question) and that emitted growth demand was met by
# real filled pages (the demand->grow->fill->validated loop).  It is purely
# diagnostic: every entry is written through a try/except so a tracing failure
# can never stall or break the running r152 training lane.  The only behavior
# that can raise is gated behind NNF_NONE_PAGE_FILL_STRICT=1, which operators
# set explicitly when they want underfill to fail a one-off diagnostic run.
PAGE_FILL_TRACE_SCHEMA: Final[str] = (
    "nnf.resynthesis.none_page_fill_trace.v1"
)
PAGE_FILL_TRACE_FILENAME: Final[str] = "page_fill_trace.jsonl"
# Default minimum acceptable fill ratio before an entry is flagged as underfull.
# A page "fills" when the rows committed for it match the rows the trainer
# offered; below this ratio the entry is recorded as underfull for diagnosis.
_PAGE_FILL_DEFAULT_MIN_RATIO: Final[float] = 1.0
# Allocation outcomes recorded against the r152 policy.  "grown-new" and
# "filled-unallocated" are the two sanctioned capacity paths; "refreshed-existing"
# is a normal retrain of an already-learned page (allowed: it preserves the
# page identity and only advances its weights).  "rejected-already-allocated"
# would indicate the policy was violated and is recorded only when the strict
# gate is on, since the underlying accept boundary already rejects such cases.
_PAGE_FILL_OUTCOME_GROWN_NEW: Final[str] = "grown-new"
_PAGE_FILL_OUTCOME_FILLED_UNALLOCATED: Final[str] = "filled-unallocated"
_PAGE_FILL_OUTCOME_REFRESHED_EXISTING: Final[str] = "refreshed-existing"
_PAGE_FILL_OUTCOME_REJECTED_ALLOCATED: Final[str] = "rejected-already-allocated"


def _strict_page_fill_enabled() -> bool:
    """Return whether page-fill diagnostics may raise instead of only recording.

    Default is OFF so the r152 training lane can never be stalled by a tracing
    hiccup; operators set NNF_NONE_PAGE_FILL_STRICT=1 for one-off validation.
    """

    return os.environ.get("NNF_NONE_PAGE_FILL_STRICT", "").strip() in {
        "1",
        "true",
        "True",
        "TRUE",
    }


def _page_fill_min_ratio() -> float:
    """Resolve the minimum acceptable fill ratio from the environment.

    Defaults to 1.0 (a page must receive every offered row).  Operators may
    lower it via NNF_NONE_PAGE_FILL_MIN_RATIO (0.0..1.0) for diagnosis only;
    this never weakens the actual accept boundary, only the diagnostic flag.
    """

    raw = os.environ.get("NNF_NONE_PAGE_FILL_MIN_RATIO", "").strip()
    if not raw:
        return _PAGE_FILL_DEFAULT_MIN_RATIO
    try:
        value = float(raw)
    except ValueError:
        return _PAGE_FILL_DEFAULT_MIN_RATIO
    if not math.isfinite(value) or value < 0.0 or value > 1.0:
        return _PAGE_FILL_DEFAULT_MIN_RATIO
    return value


def page_fill_trace_path(session_root: Path) -> Path:
    """Return the durable page-fill ledger path for one session root.

    The ledger is an append-only JSONL file placed alongside the accepted
    pointer and generation directories so it shares the page store's lifetime
    and durability domain.  It is never read on the training hot path.
    """

    return session_root / PAGE_FILL_TRACE_FILENAME


def _classify_page_fill_outcome(
    page_id: int,
    parent_page_ids: frozenset[int],
) -> str:
    """Classify one accepted page against the r152 allocation policy.

    ``parent_page_ids`` is the set of page IDs present in the parent (prior)
    accepted manifest.  A page absent from the parent is a capacity allocation
    (grown-new or filled-unallocated, indistinguishable from the manifest alone
    and reported together as ``grown-new``); a page present in the parent is a
    normal retrain that preserves the learned page identity
    (``refreshed-existing``).  This classification never drives an allocation
    decision; it only labels the trace so operators can audit the policy.
    """

    if page_id in parent_page_ids:
        return _PAGE_FILL_OUTCOME_REFRESHED_EXISTING
    return _PAGE_FILL_OUTCOME_GROWN_NEW


def record_page_fill(
    *,
    trace_path: Path,
    session_id: list[int],
    generation: int,
    parent_generation: int,
    page_id: int,
    rows_offered: int,
    rows_written: int,
    bytes_written: int,
    source_work_ids: tuple[str, ...] = (),
    allocation_outcome: str,
    fill_ratio: float | None = None,
    recorded_at_ns: int | None = None,
) -> None:
    """Append one page-fill ledger entry.

    This is the single writer of the page-fill ledger.  It is fail-open by
    construction: any I/O or serialization error is swallowed unless
    NNF_NONE_PAGE_FILL_STRICT=1, so the running training transaction is never
    aborted by a diagnostic write.  The append is a small bounded JSON line and
    never blocks the accept boundary's writer lease (it runs after the pointer
    has advanced and the lease has been released).

    ``rows_offered`` is the row count the trainer intended for this page;
    ``rows_written`` is the row count actually committed in this generation
    (today always 1 page-object per page per generation, but the field is kept
    explicit so future batched page fills remain diagnosable).  ``fill_ratio``
    defaults to ``rows_written / rows_offered`` when omitted.
    """

    safe_ratio: float
    if fill_ratio is not None and math.isfinite(fill_ratio):
        safe_ratio = float(fill_ratio)
    elif rows_offered > 0:
        safe_ratio = rows_written / rows_offered
    else:
        # An offered count of zero means the trainer did not intend to fill
        # this page in this transaction (e.g. an unchanged page carried forward
        # by a union).  Treat it as trivially full so it does not generate
        # spurious underfill noise.
        safe_ratio = 1.0
    entry = {
        "schema": PAGE_FILL_TRACE_SCHEMA,
        "sessionId": list(session_id),
        "generation": int(generation),
        "parentGeneration": int(parent_generation),
        "pageId": int(page_id),
        "rowsOffered": int(rows_offered),
        "rowsWritten": int(rows_written),
        "bytesWritten": int(bytes_written),
        "fillRatio": safe_ratio,
        "allocationOutcome": str(allocation_outcome),
        "sourceWorkIds": [str(work_id) for work_id in source_work_ids],
        "recordedAtNs": (
            int(recorded_at_ns)
            if recorded_at_ns is not None
            else time.time_ns()
        ),
    }
    try:
        trace_path.parent.mkdir(parents=True, exist_ok=True)
        # orjson fragments are the codebase convention for boundary JSON; the
        # append is a single write() under per-process line buffering, which is
        # safe because the accept boundary is single-writer per store session.
        with trace_path.open("a", encoding="utf-8") as handle:
            handle.write(orjson.dumps(entry).decode("utf-8"))
            handle.write("\n")
            handle.flush()
    except OSError:
        if _strict_page_fill_enabled():
            raise


def validate_page_fill(
    *,
    page_id: int,
    expected_rows: int,
    rows_written: int,
    bytes_written: int,
    fill_ratio: float | None = None,
    allocation_outcome: str = _PAGE_FILL_OUTCOME_GROWN_NEW,
    min_ratio: float | None = None,
) -> dict[str, Any]:
    """Return a non-blocking fill-validation verdict for one page.

    This diagnoses "pages not filling" without breaking training: it never
    raises on underfill.  When NNF_NONE_PAGE_FILL_STRICT=1 an underfill that
    violates the r152 policy (a page that was supposed to receive rows but got
    none, or a fill ratio below the configured minimum) raises so a one-off
    diagnostic run can fail fast.  The default path only records and returns.

    Returns a dict with ``filled``, ``fillRatio``, ``underfillOk`` and
    ``reason`` so callers (CLI, telemetry) can summarize without re-deriving.
    """

    ratio_floor = (
        _page_fill_min_ratio() if min_ratio is None else float(min_ratio)
    )
    if fill_ratio is not None and math.isfinite(fill_ratio):
        ratio = float(fill_ratio)
    elif expected_rows > 0:
        ratio = rows_written / expected_rows
    else:
        ratio = 1.0
    filled = rows_written >= max(expected_rows, 0) and ratio >= ratio_floor
    underfill_ok = True
    reason = "filled"
    if rows_written <= 0 and expected_rows > 0:
        reason = "no_rows_written"
        underfill_ok = False
    elif ratio < ratio_floor:
        reason = "below_min_ratio"
        underfill_ok = False
    if (
        not underfill_ok
        and allocation_outcome == _PAGE_FILL_OUTCOME_REJECTED_ALLOCATED
    ):
        reason = "rejected_already_allocated"
    verdict = {
        "pageId": int(page_id),
        "expectedRows": int(expected_rows),
        "rowsWritten": int(rows_written),
        "bytesWritten": int(bytes_written),
        "fillRatio": ratio,
        "minRatio": ratio_floor,
        "filled": bool(filled),
        "underfillOk": bool(underfill_ok),
        "allocationOutcome": str(allocation_outcome),
        "reason": reason,
    }
    if not underfill_ok and _strict_page_fill_enabled():
        raise RuntimeError(
            "NoNE page fill underfill rejected under strict mode: "
            f"{verdict}"
        )
    return verdict


def read_page_fill_trace(trace_path: Path) -> list[dict[str, Any]]:
    """Read every page-fill ledger entry, tolerating a missing/corrupt file.

    Fail-open: a missing or partially-written ledger returns the entries that
    could be parsed so a diagnostic CLI never crashes on a torn final line.
    """

    if not trace_path.is_file():
        return []
    entries: list[dict[str, Any]] = []
    with trace_path.open("rb") as handle:
        for raw_line in handle:
            raw_line = raw_line.strip()
            if not raw_line:
                continue
            try:
                entry = orjson.loads(raw_line)
            except orjson.JSONDecodeError:
                # A torn final line (interrupted append) is skipped rather than
                # fatal: the next accepted generation rewrites a clean line.
                continue
            if isinstance(entry, dict):
                entries.append(entry)
    return entries


def summarize_page_fill_trace(
    trace_path: Path,
    *,
    min_ratio: float | None = None,
) -> dict[str, Any]:
    """Summarize one page-fill ledger for the diagnostic CLI.

    Reports per-page aggregate fill ratios, the set of pages below the minimum
    ratio, and per-outcome counts.  Pure read; never raises on underfill.
    """

    ratio_floor = (
        _page_fill_min_ratio() if min_ratio is None else float(min_ratio)
    )
    entries = read_page_fill_trace(trace_path)
    per_page: dict[int, dict[str, Any]] = {}
    outcome_counts: dict[str, int] = {}
    total_rows_written = 0
    total_bytes_written = 0
    underfull_pages: list[int] = []
    for entry in entries:
        page_id = int(entry.get("pageId", -1))
        rows_written = int(entry.get("rowsWritten", 0))
        bytes_written = int(entry.get("bytesWritten", 0))
        ratio = float(entry.get("fillRatio", 0.0))
        outcome = str(entry.get("allocationOutcome", "unknown"))
        outcome_counts[outcome] = outcome_counts.get(outcome, 0) + 1
        aggregate = per_page.setdefault(
            page_id,
            {
                "pageId": page_id,
                "rowsWritten": 0,
                "bytesWritten": 0,
                "lastFillRatio": ratio,
                "minFillRatio": ratio,
                "lastOutcome": outcome,
                "observations": 0,
            },
        )
        aggregate["rowsWritten"] += rows_written
        aggregate["bytesWritten"] += bytes_written
        aggregate["lastFillRatio"] = ratio
        aggregate["minFillRatio"] = min(aggregate["minFillRatio"], ratio)
        aggregate["lastOutcome"] = outcome
        aggregate["observations"] += 1
        total_rows_written += rows_written
        total_bytes_written += bytes_written
    for page_id, aggregate in per_page.items():
        if aggregate["minFillRatio"] < ratio_floor:
            underfull_pages.append(page_id)
    return {
        "schema": PAGE_FILL_TRACE_SCHEMA,
        "tracePath": str(trace_path),
        "entryCount": len(entries),
        "minRatio": ratio_floor,
        "totalRowsWritten": total_rows_written,
        "totalBytesWritten": total_bytes_written,
        "distinctPageCount": len(per_page),
        "outcomeCounts": outcome_counts,
        "underfullPageIds": sorted(underfull_pages),
        "perPage": sorted(per_page.values(), key=lambda row: row["pageId"]),
    }


def confirm_growth_demand_fulfilled(
    *,
    demand_authority: Mapping[str, Any] | None,
    page_fill_trace: Path | list[dict[str, Any]],
    planned_objective_page_ids: tuple[int, ...] | None = None,
    min_ratio: float | None = None,
) -> dict[str, Any]:
    """Confirm an emitted growth-demand authority actually produced filled pages.

    Closes the demand->grow->fill->validated loop the operator asked for: each
    planned objective page from the federated growth-demand authority must
    appear in the page-fill ledger with at least one accepted row, and its
    fill ratio must meet the minimum.  Returns the unmet demands and a boolean
    ``fulfilled``.  Never raises on unmet demand (fail-open); strict mode is
    reserved for an explicit diagnostic gate the operator invokes separately.
    """

    ratio_floor = (
        _page_fill_min_ratio() if min_ratio is None else float(min_ratio)
    )
    entries = (
        page_fill_trace
        if isinstance(page_fill_trace, list)
        else read_page_fill_trace(page_fill_trace)
    )
    if demand_authority is None:
        return {
            "schema": PAGE_FILL_TRACE_SCHEMA,
            "fulfilled": True,
            "reason": "no_federated_growth_demand",
            "plannedObjectivePageCount": 0,
            "plannedObjectivePageIds": [],
            "metPageIds": [],
            "unmetDemands": [],
            "minRatio": ratio_floor,
        }
    raw_planned_count = demand_authority.get("plannedObjectivePageCount")
    planned_count = (
        int(raw_planned_count)
        if isinstance(raw_planned_count, int)
        and not isinstance(raw_planned_count, bool)
        else 0
    )
    if planned_objective_page_ids is None:
        planned_objective_page_ids = tuple(
            int(page_id)
            for page_id in demand_authority.get(
                "plannedObjectivePageIds", ()
            )
            if isinstance(page_id, int) and not isinstance(page_id, bool)
        )
    filled_by_page: dict[int, dict[str, Any]] = {}
    for entry in entries:
        page_id = int(entry.get("pageId", -1))
        if page_id < 0:
            continue
        rows_written = int(entry.get("rowsWritten", 0))
        ratio = float(entry.get("fillRatio", 0.0))
        prior = filled_by_page.get(page_id)
        if prior is None or rows_written > prior["rowsWritten"]:
            filled_by_page[page_id] = {
                "pageId": page_id,
                "rowsWritten": rows_written,
                "fillRatio": ratio,
            }
    met: list[int] = []
    unmet: list[dict[str, Any]] = []
    for page_id in planned_objective_page_ids:
        observed = filled_by_page.get(page_id)
        if (
            observed is not None
            and observed["rowsWritten"] > 0
            and observed["fillRatio"] >= ratio_floor
        ):
            met.append(page_id)
        else:
            unmet.append(
                {
                    "pageId": page_id,
                    "rowsWritten": (
                        observed["rowsWritten"] if observed is not None else 0
                    ),
                    "fillRatio": (
                        observed["fillRatio"] if observed is not None else 0.0
                    ),
                    "reason": (
                        "below_min_ratio"
                        if observed is not None
                        and observed["rowsWritten"] > 0
                        else "never_filled"
                    ),
                }
            )
    return {
        "schema": PAGE_FILL_TRACE_SCHEMA,
        "fulfilled": len(unmet) == 0,
        "demandAuthoritySha256": str(
            demand_authority.get("authoritySha256", "")
        ),
        "plannedObjectivePageCount": planned_count,
        "plannedObjectivePageIds": list(planned_objective_page_ids),
        "metPageIds": sorted(met),
        "unmetDemands": unmet,
        "minRatio": ratio_floor,
    }


# Manifest page-catalog fragment memoization. The page-catalog digest is the
# SHA-256 over the sorted concatenation of ``pageId.to_bytes(8) || sha256_bytes``
# for every page; that digest anchors the generation authority chain and must
# stay byte-identical. A page object is immutable, so each 40-byte fragment is a
# pure function of ``(pageId, sha256)``; caching it lets unchanged pages skip the
# per-commit ``int.to_bytes`` + ``bytes.fromhex`` Python work (concentrated on the
# commit tail over all ~81k pages) while the join + SHA-256 still runs over every
# page, leaving the digest unchanged. Bounded and cleared at the cap because
# fragments are cheap to recompute.
_PAGE_CATALOG_FRAGMENT_CACHE: dict[tuple[int, str], bytes] = {}
_PAGE_CATALOG_FRAGMENT_CACHE_CAP: Final[int] = 262144


def _page_catalog_fragment(page_id: int, object_sha256: str) -> bytes:
    """Return the canonical 40-byte page-catalog fragment for one page object."""

    key = (page_id, object_sha256)
    cached = _PAGE_CATALOG_FRAGMENT_CACHE.get(key)
    if cached is not None:
        return cached
    fragment = page_id.to_bytes(8, "little", signed=True) + bytes.fromhex(
        object_sha256
    )
    if len(_PAGE_CATALOG_FRAGMENT_CACHE) >= _PAGE_CATALOG_FRAGMENT_CACHE_CAP:
        _PAGE_CATALOG_FRAGMENT_CACHE.clear()
    _PAGE_CATALOG_FRAGMENT_CACHE[key] = fragment
    return fragment


_P = ParamSpec("_P")
_R = TypeVar("_R")


def _disable_compilation_boundary(
    function: Callable[_P, _R],
) -> Callable[_P, _R]:
    """Preserve callable typing around PyTorch's external-boundary decorator."""

    disable = cast(
        Callable[[Callable[_P, _R]], Callable[_P, _R]],
        torch.compiler.disable,
    )
    return disable(function)


@dataclass(frozen=True)
class NoNEPageRequestPacket:
    """Tensor-owned page request emitted by the resident model router.

    ``page_ids_t`` remains the primary (highest-mass) page per batch row for
    compatibility. ``frontier_weight_t`` is ``[batch, unique_pages]`` soft mass
    over ``unique_page_ids_t`` so multiple complementary pages can activate in
    one residency wave when quantile thresholds justify it.
    """

    session_id_t: torch.Tensor
    generation_t: torch.Tensor
    layer_id_t: torch.Tensor
    page_ids_t: torch.Tensor
    unique_page_ids_t: torch.Tensor
    unique_page_catalog_positions_t: torch.Tensor
    page_position_t: torch.Tensor
    route_probability_t: torch.Tensor
    route_entropy_t: torch.Tensor
    frontier_weight_t: torch.Tensor
    active_pair_index_t: torch.Tensor | None = None


@dataclass(frozen=True)
class NoNEPageObjectReadbackPacket:
    """Tensor-owned proof that accepted page-object identities were read back."""

    generation_t: torch.Tensor
    page_object_count_t: torch.Tensor
    page_object_bytes_t: torch.Tensor
    page_ids_sha256_t: torch.Tensor
    object_identities_sha256_t: torch.Tensor
    maximum_in_flight_object_count_t: torch.Tensor

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize bounded readback evidence at the explicit I/O boundary."""

        return {
            "generation": int(
                self.generation_t.detach().cpu().long().reshape(())
            ),
            "verifiedPageObjectCount": int(
                self.page_object_count_t.detach().cpu().long().reshape(())
            ),
            "verifiedPageObjectBytes": int(
                self.page_object_bytes_t.detach().cpu().long().reshape(())
            ),
            "verifiedPageIdsSha256": _tensor_digest_hex(
                self.page_ids_sha256_t
            ),
            "objectIdentitySha256": _tensor_digest_hex(
                self.object_identities_sha256_t
            ),
            "maximumInFlightObjectCount": int(
                self.maximum_in_flight_object_count_t.detach()
                .cpu()
                .long()
                .reshape(())
            ),
        }


@dataclass(frozen=True)
class NoNEPageMaterializationTelemetryPacket:
    """Tensor-owned timing for the immutable page-storage boundary."""

    request_count_t: torch.Tensor
    page_count_t: torch.Tensor
    weights_request_count_t: torch.Tensor
    optimizer_bundle_request_count_t: torch.Tensor
    cuda_request_count_t: torch.Tensor
    authorization_ns_t: torch.Tensor
    read_dequant_ns_t: torch.Tensor
    compose_ns_t: torch.Tensor
    device_transfer_enqueue_ns_t: torch.Tensor
    cpu_cache_hit_count_t: torch.Tensor
    cpu_cache_miss_count_t: torch.Tensor
    cpu_cache_resident_bytes_t: torch.Tensor
    post_accept_cpu_cache_admission_count_t: torch.Tensor
    post_accept_cpu_cache_admission_bytes_t: torch.Tensor

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize diagnostic timing with no model-decision authority."""

        def integer(value: torch.Tensor) -> int:
            return int(value.detach().cpu().long().reshape(()))

        return {
            "schema": (
                "nnf.resynthesis.none_page_materialization_telemetry.v1"
            ),
            "requestCount": integer(self.request_count_t),
            "pageCount": integer(self.page_count_t),
            "weightsRequestCount": integer(self.weights_request_count_t),
            "optimizerBundleRequestCount": integer(
                self.optimizer_bundle_request_count_t
            ),
            "cudaRequestCount": integer(self.cuda_request_count_t),
            "authorizationNanoseconds": integer(self.authorization_ns_t),
            "readDequantNanoseconds": integer(self.read_dequant_ns_t),
            "composeNanoseconds": integer(self.compose_ns_t),
            "deviceTransferEnqueueNanoseconds": integer(
                self.device_transfer_enqueue_ns_t
            ),
            "cpuCacheHitCount": integer(self.cpu_cache_hit_count_t),
            "cpuCacheMissCount": integer(self.cpu_cache_miss_count_t),
            "cpuCacheResidentBytes": integer(
                self.cpu_cache_resident_bytes_t
            ),
            "postAcceptCpuCacheAdmissionCount": integer(
                self.post_accept_cpu_cache_admission_count_t
            ),
            "postAcceptCpuCacheAdmissionBytes": integer(
                self.post_accept_cpu_cache_admission_bytes_t
            ),
            "diagnosticOnly": True,
            "routingAuthority": False,
            "answerSurfaceAuthority": False,
            "scoringAuthority": False,
            "stoppingAuthority": False,
            "promotionAuthority": False,
        }


@dataclass(frozen=True)
class NoNEPageWeights:
    """Selected native expert weights; page-major and tensor-only."""

    page_ids_t: torch.Tensor
    ffn_mode_t: torch.Tensor
    gate_t: torch.Tensor
    up_t: torch.Tensor
    down_t: torch.Tensor
    glyph_down_t: torch.Tensor
    glyph_up_t: torch.Tensor
    translation_gate_t: torch.Tensor
    outcome_memory_t: torch.Tensor
    repair_memory_t: torch.Tensor
    transfer_memory_t: torch.Tensor

    def to(
        self,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageWeights:
        def weight(tensor: torch.Tensor) -> torch.Tensor:
            moved = tensor.to(device=device, dtype=dtype)
            return moved.detach().requires_grad_(trainable)

        return NoNEPageWeights(
            page_ids_t=self.page_ids_t.to(device=device, dtype=torch.long),
            ffn_mode_t=self.ffn_mode_t.detach().to(
                device=device,
                dtype=dtype,
            ),
            gate_t=weight(self.gate_t),
            up_t=weight(self.up_t),
            down_t=weight(self.down_t),
            glyph_down_t=weight(self.glyph_down_t),
            glyph_up_t=weight(self.glyph_up_t),
            translation_gate_t=weight(self.translation_gate_t),
            outcome_memory_t=weight(self.outcome_memory_t),
            repair_memory_t=weight(self.repair_memory_t),
            transfer_memory_t=weight(self.transfer_memory_t),
        )


@torch.no_grad()
def project_resynthesis_expert_weight_int4_qat_boundary(
    weight_t: torch.Tensor,
) -> torch.Tensor:
    """Project one trained expert matrix onto a symmetric INT4 weight lattice.

    This runs once after an optimizer update, never inside forward.  Each
    page/expert output channel owns its scale over the input axis.  Attention
    Q/K/V, KDA, routers, glyph translation, shared/latent projections,
    memories, and reasoning/self-correction parameters remain fully trained
    and checkpointed model state; they deliberately retain their native
    precision because quantization error on those control surfaces can change
    routing, recurrence, or correction decisions.  They are excluded only
    from this expert-matrix INT4 projection, never from the model, optimizer,
    checkpoint, cold reload, or forward graph.  The returned tensor keeps the
    original floating storage dtype; those exact projected values are what
    checkpoint/page safetensors persist and cold-reload.
    """

    if (
        not isinstance(weight_t, torch.Tensor)
        or not weight_t.is_floating_point()
        or weight_t.ndim < 2
        or weight_t.shape[-2] < 1
        or weight_t.shape[-1] < 1
    ):
        raise ValueError("Resynthesis expert QAT weight geometry differs")
    working_t = weight_t.to(dtype=torch.float32)
    maximum_t = working_t.abs().amax(dim=-2, keepdim=True)
    scale_t = maximum_t / 7.0
    safe_scale_t = torch.where(
        maximum_t.gt(0) & torch.isfinite(maximum_t),
        scale_t,
        torch.ones_like(scale_t),
    )
    level_t = torch.round(working_t / safe_scale_t).clamp(-7.0, 7.0)
    projected_t = torch.where(
        maximum_t.gt(0),
        level_t * safe_scale_t,
        torch.zeros_like(working_t),
    )
    return projected_t.to(dtype=weight_t.dtype)


def _shared_page_weights_boundary(
    weights: NoNEPageWeights,
) -> SharedNoNEPageWeights:
    """Expose immutable weights to the process-shared storage boundary."""

    return SharedNoNEPageWeights(
        page_ids_t=weights.page_ids_t,
        ffn_mode_t=weights.ffn_mode_t,
        gate_t=weights.gate_t,
        up_t=weights.up_t,
        down_t=weights.down_t,
        glyph_down_t=weights.glyph_down_t,
        glyph_up_t=weights.glyph_up_t,
        translation_gate_t=weights.translation_gate_t,
        outcome_memory_t=weights.outcome_memory_t,
        repair_memory_t=weights.repair_memory_t,
        transfer_memory_t=weights.transfer_memory_t,
    )


def _page_weights_from_shared_boundary(
    weights: SharedNoNEPageWeights,
) -> NoNEPageWeights:
    """Restore one private shared-cache result to the tensor-native contract."""

    return NoNEPageWeights(
        page_ids_t=weights.page_ids_t,
        ffn_mode_t=weights.ffn_mode_t,
        gate_t=weights.gate_t,
        up_t=weights.up_t,
        down_t=weights.down_t,
        glyph_down_t=weights.glyph_down_t,
        glyph_up_t=weights.glyph_up_t,
        translation_gate_t=weights.translation_gate_t,
        outcome_memory_t=weights.outcome_memory_t,
        repair_memory_t=weights.repair_memory_t,
        transfer_memory_t=weights.transfer_memory_t,
    )


@dataclass(frozen=True)
class NoNEPageBundle:
    """Page weights plus flat, geometry-bound Adam moments."""

    weights: NoNEPageWeights
    optimizer_mean_t: torch.Tensor
    optimizer_square_t: torch.Tensor
    step_t: torch.Tensor


@dataclass(frozen=True)
class _NoNEMaterializedCPUPageCacheEntry:
    """One immutable, hash-verified CPU page reconstruction."""

    object_path: Path
    object_identity: _FileIdentity
    bundle: NoNEPageBundle
    storage_bytes: int


@dataclass(frozen=True)
class _NoNEMaterializedCPUWeightsCacheEntry:
    """One immutable forward-only reconstruction without optimizer state."""

    object_path: Path
    object_identity: _FileIdentity
    weights: NoNEPageWeights
    storage_bytes: int


_NoNEMaterializedCPUCacheEntry = (
    _NoNEMaterializedCPUPageCacheEntry
    | _NoNEMaterializedCPUWeightsCacheEntry
)


def _page_weights_storage_bytes_boundary(weights: NoNEPageWeights) -> int:
    """Count unique CPU storages retained by immutable forward weights."""

    tensors = (
        weights.page_ids_t,
        *(getattr(weights, name) for name in _PAGE_WEIGHT_TENSOR_NAMES),
    )
    if any(tensor.device.type != "cpu" for tensor in tensors):
        raise RuntimeError(
            "materialized CPU weights cache received a device tensor"
        )
    if any(tensor.requires_grad for tensor in tensors):
        raise RuntimeError(
            "materialized CPU weights cache received trainable weights"
        )
    storages: set[tuple[int, int]] = set()
    for tensor in tensors:
        storage = tensor.untyped_storage()
        storages.add((storage.data_ptr(), storage.nbytes()))
    storage_bytes = sum(nbytes for _data_ptr, nbytes in storages)
    if storage_bytes < 1:
        raise RuntimeError(
            "materialized CPU weights cache received empty weights"
        )
    return storage_bytes


def _page_bundle_storage_bytes_boundary(bundle: NoNEPageBundle) -> int:
    """Count unique CPU storages retained by one immutable page bundle."""

    tensors = (
        bundle.weights.page_ids_t,
        *(getattr(bundle.weights, name) for name in _PAGE_WEIGHT_TENSOR_NAMES),
        bundle.optimizer_mean_t,
        bundle.optimizer_square_t,
        bundle.step_t,
    )
    if any(tensor.device.type != "cpu" for tensor in tensors):
        raise RuntimeError("materialized CPU page cache received a device tensor")
    storages: set[tuple[int, int]] = set()
    for tensor in tensors:
        storage = tensor.untyped_storage()
        storages.add((storage.data_ptr(), storage.nbytes()))
    storage_bytes = sum(nbytes for _data_ptr, nbytes in storages)
    if storage_bytes < 1:
        raise RuntimeError("materialized CPU page cache received an empty bundle")
    return storage_bytes


@dataclass(frozen=True)
class NoNEGenerationComponentPacket:
    """Digest packet binding every executable non-page generation component.

    ``code_digest_t`` is accepted only to load/migrate historical v2
    generations.  New v3 manifests omit it: mutable source observations remain
    in launch/status/provenance receipts and cannot alter page identity.
    """

    parent_digest_t: torch.Tensor
    shared_model_digest_t: torch.Tensor
    global_optimizer_digest_t: torch.Tensor
    scheduler_digest_t: torch.Tensor
    rng_digest_t: torch.Tensor
    rbo_digest_t: torch.Tensor
    fabric_digest_t: torch.Tensor
    vge_digest_t: torch.Tensor
    router_digest_t: torch.Tensor
    corpus_digest_t: torch.Tensor
    code_digest_t: torch.Tensor | None = None
    training_proof_digest_t: torch.Tensor | None = None
    training_proof_record_path: str | None = None
    training_proof_record_sha256_t: torch.Tensor | None = None
    reconciliation_proof_digest_t: torch.Tensor | None = None
    reconciliation_proof_record_path: str | None = None
    reconciliation_proof_record_sha256_t: torch.Tensor | None = None


@dataclass(frozen=True)
class NoNEPageOptimizerPacket:
    """Tensor-native optimizer policy for one selected page generation."""

    learning_rate_t: torch.Tensor
    beta1_t: torch.Tensor
    beta2_t: torch.Tensor
    epsilon_t: torch.Tensor
    weight_decay_t: torch.Tensor


@dataclass(frozen=True)
class NoNEPageUpdatePacket:
    """Updated page bundle and gradient-health proof."""

    bundle: NoNEPageBundle
    page_ids_t: torch.Tensor
    gradient_norm_t: torch.Tensor
    parameter_delta_norm_t: torch.Tensor
    gradient_signature_t: torch.Tensor
    finite_components_t: torch.Tensor
    finite_t: torch.Tensor


@dataclass(frozen=True)
class _NoNECandidatePageHostTransfer:
    """One exact page transfer awaiting CPU persistence-boundary validation."""

    bundle: NoNEPageBundle
    finite_components_t: torch.Tensor
    finite_t: torch.Tensor
    signaled_t: torch.Tensor
    completion_event: torch.cuda.Event | None


@dataclass(frozen=True)
class NoNEPageTrainingProofPacket:
    """Tensor-owned cumulative route and gradient proof for family pages."""

    family_page_ids_t: torch.Tensor
    route_count_t: torch.Tensor
    gradient_update_count_t: torch.Tensor
    gradient_norm_t: torch.Tensor
    parameter_delta_norm_t: torch.Tensor
    gradient_signature_t: torch.Tensor
    route_coverage_t: torch.Tensor
    gradient_coverage_t: torch.Tensor
    distinct_gradient_t: torch.Tensor
    finite_t: torch.Tensor
    promotion_ready_t: torch.Tensor


@dataclass(frozen=True)
class NoNETrainingBranchScopePacket:
    """Sealed tensor authority for one disjoint training-store fork.

    The scope constrains which already model-routed pages may receive local
    gradients.  It never selects a route or changes the router's catalog.  Its
    parent generation and manifest payload bind every parallel branch to the
    same immutable accepted graph before any branch writes a candidate.
    """

    session_id_t: torch.Tensor
    parent_generation_t: torch.Tensor
    parent_manifest_payload_sha256_t: torch.Tensor
    page_ids_t: torch.Tensor
    page_layer_ids_t: torch.Tensor
    scope_sha256_t: torch.Tensor
    federated_growth_demand_authority_sha256_t: torch.Tensor | None = None
    objective_page_ids_t: torch.Tensor | None = None
    objective_source_id_sha256s_t: torch.Tensor | None = None

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize branch ownership only at an explicit I/O boundary."""

        validate_training_branch_scope_boundary(self)
        record: dict[str, Any] = {
            "schema": TRAINING_BRANCH_SCOPE_SCHEMA,
            "sessionId": self.session_id_t.detach().cpu().long().tolist(),
            "parentGeneration": int(
                self.parent_generation_t.detach().cpu().long().reshape(())
            ),
            "parentManifestPayloadSha256": _tensor_digest_hex(
                self.parent_manifest_payload_sha256_t
            ),
            "pageIds": self.page_ids_t.detach().cpu().long().tolist(),
            "pageLayerIds": (
                self.page_layer_ids_t.detach().cpu().long().tolist()
            ),
            "scopeSha256": _tensor_digest_hex(self.scope_sha256_t),
            "forkAuthority": True,
            "routingAuthority": False,
            "acceptedPointerMutationAuthority": False,
            "globalTrainingClaimed": False,
        }
        if self.federated_growth_demand_authority_sha256_t is not None:
            if (
                self.objective_page_ids_t is None
                or self.objective_source_id_sha256s_t is None
            ):
                raise RuntimeError(
                    "NoNE federated training branch scope is incomplete"
                )
            record.update(
                {
                    "federatedGrowthDemandAuthoritySha256": (
                        _tensor_digest_hex(
                            self.federated_growth_demand_authority_sha256_t
                        )
                    ),
                    "objectivePageIds": (
                        self.objective_page_ids_t.detach().cpu().long().tolist()
                    ),
                    "objectiveSourceIdSha256s": [
                        _tensor_digest_hex(row)
                        for row in self.objective_source_id_sha256s_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                    ],
                }
            )
        return record


@dataclass(frozen=True)
class NoNEPageObjectWritePlacementRequest:
    """Explicit durable placement request for one disjoint branch store."""

    store_root: Path
    write_root: Path
    branch_scope: NoNETrainingBranchScopePacket
    local_store_t: torch.Tensor


@dataclass(frozen=True)
class NoNEPageObjectWritePlacementBinding:
    """Hash-bound branch-local page-object placement authority."""

    store_root: Path
    write_root: Path
    authority_path: Path
    authority_sha256_t: torch.Tensor
    placement_proof_path: Path
    placement_proof_sha256_t: torch.Tensor
    branch_scope_sha256_t: torch.Tensor
    local_store_t: torch.Tensor
    write_device_t: torch.Tensor


@dataclass(frozen=True)
class NoNEPageObjectWritePlacementFanoutPacket:
    """One four-filesystem placement proof plus all branch bindings."""

    placement_proof_sha256_t: torch.Tensor
    bindings: tuple[NoNEPageObjectWritePlacementBinding, ...]


@dataclass(frozen=True)
class _NoNEPageObjectWritePlacementAuthority:
    """Validated cold-load authority for one store's object write path."""

    store_root: Path
    write_root: Path
    objects_root: Path
    scratch_root: Path
    session_key: str
    branch_scope_sha256: str
    branch_scope: NoNETrainingBranchScopePacket
    authority_path: Path
    authority_sha256: str
    placement_proof_path: Path
    placement_proof_sha256: str
    local_store: bool
    store_root_identity: tuple[int, int]
    write_root_identity: tuple[int, int]
    objects_root_identity: tuple[int, int]
    scratch_root_identity: tuple[int, int]
    owner_marker_path: Path | None
    owner_marker_sha256: str | None


_PAGE_TRAINING_PROOF_TENSOR_NAMES: Final[tuple[str, ...]] = (
    "family_page_ids_t",
    "route_count_t",
    "gradient_update_count_t",
    "gradient_norm_t",
    "parameter_delta_norm_t",
    "gradient_signature_t",
    "route_coverage_t",
    "gradient_coverage_t",
    "distinct_gradient_t",
    "finite_t",
    "promotion_ready_t",
)


@dataclass(frozen=True)
class NoNEScaleCohortPacket:
    """Tensor-owned child-page proposal for one retained frontier.

    Storage and parameter envelopes may reduce a cohort, but cannot make a
    family eligible.  Eligibility requires a retained family page, an
    unresolved model-owned gap, and distinct retained gradient evidence.
    Family identities may repeat when model-owned gap pressure assigns more
    than one child page to the same retained parent in a single transaction.
    """

    selected_family_page_ids_t: torch.Tensor
    selected_priority_t: torch.Tensor
    eligible_family_count_t: torch.Tensor
    storage_page_capacity_t: torch.Tensor
    parameter_envelope_page_capacity_t: torch.Tensor
    selected_page_count_t: torch.Tensor
    projected_physical_parameter_elements_t: torch.Tensor
    projected_replica_storage_bytes_t: torch.Tensor
    storage_limited_t: torch.Tensor
    parameter_envelope_limited_t: torch.Tensor
    ready_t: torch.Tensor


@dataclass(frozen=True)
class NoNEScaleEvidencePacket:
    """Fresh model-owned evidence for a later storage-safe scale cohort.

    The packet is produced from accepted and candidate page-training tensors
    before candidate state is cleared.  It contains no storage decision and no
    graph-admission authority.  A later immutable migration combines it with
    observed storage and parameter envelopes through :func:`plan_none_scale_cohort`.
    """

    family_page_ids_t: torch.Tensor
    retained_family_mask_t: torch.Tensor
    unresolved_gap_pressure_t: torch.Tensor
    route_pressure_t: torch.Tensor
    distinct_gradient_mask_t: torch.Tensor
    fresh_gradient_update_count_t: torch.Tensor
    fresh_gradient_norm_t: torch.Tensor
    fresh_parameter_delta_norm_t: torch.Tensor
    fresh_gradient_signature_t: torch.Tensor
    evidence_ready_t: torch.Tensor

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize model evidence only at the explicit receipt boundary."""

        eligible_t = (
            self.retained_family_mask_t
            & self.distinct_gradient_mask_t
            & self.unresolved_gap_pressure_t.gt(0)
        )
        return {
            "schema": "nnf.resynthesis.none_scale_evidence.v1",
            "modelOwned": True,
            "targetFree": True,
            "storageAuthority": False,
            "graphAdmissionAuthority": False,
            "trainingClaimed": False,
            "familyRootPageIds": (
                self.family_page_ids_t.detach().cpu().long().tolist()
            ),
            "retainedFamilyMask": (
                self.retained_family_mask_t.detach().cpu().bool().tolist()
            ),
            "unresolvedGapPressure": (
                self.unresolved_gap_pressure_t.detach().cpu().float().tolist()
            ),
            "routePressure": (
                self.route_pressure_t.detach().cpu().float().tolist()
            ),
            "distinctGradientMask": (
                self.distinct_gradient_mask_t.detach().cpu().bool().tolist()
            ),
            "freshGradientUpdateCounts": (
                self.fresh_gradient_update_count_t.detach().cpu().long().tolist()
            ),
            "freshGradientNorms": (
                self.fresh_gradient_norm_t.detach().cpu().float().tolist()
            ),
            "freshParameterDeltaNorms": (
                self.fresh_parameter_delta_norm_t.detach().cpu().float().tolist()
            ),
            "freshGradientSignatures": (
                self.fresh_gradient_signature_t.detach().cpu().float().tolist()
            ),
            "eligibleFamilyCount": int(
                eligible_t.detach().cpu().long().sum()
            ),
            "evidenceReady": bool(
                self.evidence_ready_t.detach().cpu().bool()
            ),
        }


@dataclass(frozen=True)
class NoNEAcceptedTrainingSaturationPacket:
    """Tensor-native proof that one accepted physical bank is fully trained.

    Growth pressure and physical saturation are deliberately separate.  Fresh
    retained gradients may request more capacity, but they cannot authorize a
    child page while any page in the manifest-bound accepted bank still lacks
    cumulative accepted training proof.
    """

    accepted_generation_t: torch.Tensor
    accepted_manifest_payload_sha256_t: torch.Tensor
    training_eligible_page_ids_t: torch.Tensor
    accepted_training_proven_page_ids_t: torch.Tensor
    remaining_unproven_page_ids_t: torch.Tensor
    saturated_t: torch.Tensor

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize saturation only at an explicit receipt boundary."""

        eligible_ids_t = (
            self.training_eligible_page_ids_t.detach()
            .cpu()
            .long()
            .contiguous()
        )
        proven_ids_t = (
            self.accepted_training_proven_page_ids_t.detach()
            .cpu()
            .long()
            .contiguous()
        )
        remaining_ids_t = (
            self.remaining_unproven_page_ids_t.detach()
            .cpu()
            .long()
            .contiguous()
        )

        def identity_sha256(value_t: torch.Tensor) -> str:
            return hashlib.sha256(
                value_t.numpy().tobytes(order="C")
            ).hexdigest()

        return {
            "schema": "nnf.resynthesis.none_accepted_training_saturation.v1",
            "acceptedManifestAuthority": True,
            "modelOwnedTrainingProof": True,
            "graphAdmissionAuthority": False,
            "acceptedGeneration": int(
                self.accepted_generation_t.detach().cpu().long().reshape(())
            ),
            "acceptedManifestPayloadSha256": _tensor_digest_hex(
                self.accepted_manifest_payload_sha256_t
            ),
            "trainingEligiblePageCount": int(eligible_ids_t.numel()),
            "trainingEligiblePageIdsSha256": identity_sha256(eligible_ids_t),
            "acceptedTrainingProvenPageCount": int(proven_ids_t.numel()),
            "acceptedTrainingProvenPageIdsSha256": identity_sha256(
                proven_ids_t
            ),
            "remainingUnprovenPageCount": int(remaining_ids_t.numel()),
            "remainingUnprovenPageIdsSha256": identity_sha256(
                remaining_ids_t
            ),
            "saturated": bool(
                self.saturated_t.detach().cpu().bool().reshape(())
            ),
        }


@dataclass(frozen=True)
class NoNEGenerationBinding:
    """Immutable generation identity used by checkpoint/rollback boundaries."""

    session_id_t: torch.Tensor
    generation_t: torch.Tensor
    parent_generation_t: torch.Tensor
    manifest_sha256_t: torch.Tensor
    manifest_payload_sha256_t: torch.Tensor
    updated_page_ids_t: torch.Tensor
    manifest_relative_path: str

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize one generation identity at the explicit JSON boundary."""

        return {
            "schema": "nnf.resynthesis.none_generation_binding.v1",
            "sessionId": (self.session_id_t.detach().cpu().long().reshape(-1).tolist()),
            "generation": int(self.generation_t.detach().cpu().long().reshape(())),
            "parentGeneration": int(
                self.parent_generation_t.detach().cpu().long().reshape(())
            ),
            "manifest": self.manifest_relative_path,
            "manifestSha256": _tensor_digest_hex(self.manifest_sha256_t),
            "manifestPayloadSha256": _tensor_digest_hex(self.manifest_payload_sha256_t),
            "updatedPageIds": (
                self.updated_page_ids_t.detach().cpu().long().reshape(-1).tolist()
            ),
        }


@dataclass(frozen=True)
class NoNEPageStoreLocatorPacket:
    """Filesystem-bound store observation discovered by session identity.

    Locator packets are control-plane evidence only. They never select model
    routes; they resolve where an already model-selected, hash-bound page can
    be loaded after a store is moved, replicated, or split across mounts.
    """

    root: Path
    session_id_t: torch.Tensor
    generation_t: torch.Tensor
    manifest_sha256_t: torch.Tensor
    manifest_payload_sha256_t: torch.Tensor
    pointer_path: Path | None


@dataclass(frozen=True)
class NoNEPageStoreDiscoveryAuditPacket:
    """Coherent movable stores plus quarantined incoherent candidates."""

    locators: tuple[NoNEPageStoreLocatorPacket, ...]
    rejected_roots: tuple[Path, ...]


@dataclass(frozen=True)
class NoNEGraphAuthorityBinding:
    """Executable graph artifacts owned by one accepted page generation.

    Page manifests bind model/RBO/Fabric/VGE/router digests, while this packet
    binds those digests to the concrete checkpoint graph and the composition
    that defines its root, layer, and page topology.  The migration receipt
    path is identity-bearing but deliberately not self-hashed here: expansion
    receipts contain the predicted accepted pointer, so hashing both objects
    into each other would create a circular identity.
    """

    checkpoint_path: str
    checkpoint_sha256_t: torch.Tensor
    optimizer_path: str
    optimizer_sha256_t: torch.Tensor
    external_state_path: str
    external_state_sha256_t: torch.Tensor
    composition_path: str
    composition_sha256_t: torch.Tensor
    page_catalog_path: str
    page_catalog_sha256_t: torch.Tensor
    resident_runtime_path: str
    resident_runtime_sha256_t: torch.Tensor
    migration_receipt_path: str
    replica_receipt_path: str | None
    replica_receipt_sha256_t: torch.Tensor | None
    layer_count_t: torch.Tensor
    family_root_count_t: torch.Tensor
    page_count_t: torch.Tensor
    physical_graph_layer_count_t: torch.Tensor | None = None
    federated_growth_demand_authority_sha256_t: torch.Tensor | None = None

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize graph ownership at the explicit pointer boundary."""

        topology: dict[str, int] = {
            "layers": int(self.layer_count_t.detach().cpu().long().reshape(())),
            "familyRoots": int(
                self.family_root_count_t.detach().cpu().long().reshape(())
            ),
            "pages": int(self.page_count_t.detach().cpu().long().reshape(())),
        }
        if self.physical_graph_layer_count_t is not None:
            physical_graph_layers = int(
                self.physical_graph_layer_count_t.detach()
                .cpu()
                .long()
                .reshape(())
            )
            if physical_graph_layers != topology["pages"]:
                raise RuntimeError(
                    "NoNE physical graph-layer topology differs from pages"
                )
            topology["physicalGraphLayers"] = physical_graph_layers
        record: dict[str, Any] = {
            "schema": "nnf.resynthesis.none_graph_authority.v1",
            "checkpoint": {
                "path": self.checkpoint_path,
                "sha256": _tensor_digest_hex(self.checkpoint_sha256_t),
            },
            "optimizer": {
                "path": self.optimizer_path,
                "sha256": _tensor_digest_hex(self.optimizer_sha256_t),
            },
            "externalState": {
                "path": self.external_state_path,
                "sha256": _tensor_digest_hex(self.external_state_sha256_t),
            },
            "composition": {
                "path": self.composition_path,
                "sha256": _tensor_digest_hex(self.composition_sha256_t),
            },
            "pageCatalog": {
                "path": self.page_catalog_path,
                "sha256": _tensor_digest_hex(self.page_catalog_sha256_t),
            },
            "residentRuntime": {
                "path": self.resident_runtime_path,
                "sha256": _tensor_digest_hex(self.resident_runtime_sha256_t),
            },
            "migrationReceiptPath": self.migration_receipt_path,
            "topology": topology,
        }
        if self.replica_receipt_path is not None:
            if self.replica_receipt_sha256_t is None:
                raise RuntimeError("NoNE graph replica receipt has no digest")
            record["replicaReceipt"] = {
                "path": self.replica_receipt_path,
                "sha256": _tensor_digest_hex(self.replica_receipt_sha256_t),
            }
        elif self.replica_receipt_sha256_t is not None:
            raise RuntimeError("NoNE graph replica digest has no receipt")
        if self.federated_growth_demand_authority_sha256_t is not None:
            record["federatedGrowthDemandAuthoritySha256"] = (
                _tensor_digest_hex(
                    self.federated_growth_demand_authority_sha256_t
                )
            )
        return record


@dataclass(frozen=True)
class _NoNEReleaseGenerationProjection:
    """Read-only placement for an immutable public generation release.

    Content identity remains owned by the canonical accepted pointer and
    generation manifest.  These paths are deployment coordinates selected by
    the release manifest after their bytes have been verified.
    """

    accepted_pointer_path: Path
    generation_manifest_path: Path
    direct_index_path: Path
    direct_pack_path: Path
    graph_authority: NoNEGraphAuthorityBinding
    expected_generation: int
    expected_manifest_sha256: str
    expected_manifest_payload_sha256: str


@dataclass(frozen=True)
class NoNEPageObjectBinding:
    """Content-addressed candidate page row staged outside device memory."""

    page_id_t: torch.Tensor
    object_sha256_t: torch.Tensor
    object_bytes_t: torch.Tensor


@dataclass(frozen=True)
class NoNEPreparedCandidatePagePacket:
    """Tensor-native serialized candidate plus its exact parent witness."""

    page_id_t: torch.Tensor
    object_sha256_t: torch.Tensor
    object_bytes_t: torch.Tensor
    object_payload_t: torch.Tensor
    format_revision_t: torch.Tensor
    dependency_present_t: torch.Tensor
    base_generation_t: torch.Tensor
    base_manifest_payload_sha256_t: torch.Tensor
    base_object_sha256_t: torch.Tensor
    base_object_bytes_t: torch.Tensor


@dataclass(frozen=True)
class _NoNEInMemorySafeTensorHandleBoundary:
    """Minimal safetensors-handle surface over verified in-memory bytes."""

    tensors: Mapping[str, torch.Tensor]

    def keys(self) -> Iterable[str]:
        return self.tensors.keys()

    def get_tensor(self, name: str) -> torch.Tensor:
        try:
            return self.tensors[name]
        except KeyError as error:
            raise RuntimeError(
                f"NoNE in-memory safetensor is missing {name}"
            ) from error


@dataclass(frozen=True)
class _NoNESemanticPagePackSourceBoundary:
    """One exact rev6 object entering the explicit storage codec boundary."""

    object: NoNEPageObjectBinding
    object_path: Path | None = None
    object_payload: bytes | None = None


@dataclass(frozen=True)
class _NoNESemanticPagePackEntryPacket:
    """Tensor-owned identity and location for one page inside a pack."""

    page_id_t: torch.Tensor
    object_sha256_t: torch.Tensor
    object_bytes_t: torch.Tensor
    raw_low_offset_t: torch.Tensor
    raw_low_bytes_t: torch.Tensor
    semantic_frame_offset_t: torch.Tensor
    semantic_frame_bytes_t: torch.Tensor
    semantic_bytes_t: torch.Tensor


@dataclass(frozen=True)
class _NoNESemanticPagePackLocatorPacket:
    """Content-addressed pack locator with tensor-native authority fields."""

    pack_path: Path
    pack_sha256_t: torch.Tensor
    table_sha256_t: torch.Tensor
    pack_bytes_t: torch.Tensor
    alignment_bytes_t: torch.Tensor
    page_ids_t: torch.Tensor
    object_sha256s_t: torch.Tensor
    object_bytes_t: torch.Tensor
    direct_durable_t: torch.Tensor
    rate_eligible_t: torch.Tensor


@dataclass(frozen=True)
class _NoNESemanticPagePackDecodedPacket:
    """Exact grouped page bytes returned without Python object containers."""

    page_ids_t: torch.Tensor
    object_sha256s_t: torch.Tensor
    object_bytes_t: torch.Tensor
    object_offsets_t: torch.Tensor
    object_payload_t: torch.Tensor


@dataclass(frozen=True)
class _NoNESemanticPagePackPerformanceReceiptPacket:
    """Measured exact-data codec/durability/cold-reopen evidence."""

    page_count_t: torch.Tensor
    logical_object_bytes_t: torch.Tensor
    durable_pack_bytes_t: torch.Tensor
    encode_elapsed_ns_t: torch.Tensor
    durable_write_elapsed_ns_t: torch.Tensor
    cold_decode_elapsed_ns_t: torch.Tensor
    exact_object_count_t: torch.Tensor
    direct_durable_t: torch.Tensor
    direct_cold_read_t: torch.Tensor
    rate_eligible_t: torch.Tensor


@dataclass(frozen=True)
class _NoNESemanticTensorSliceBoundary:
    """One safetensors slice descriptor at the explicit disk boundary."""

    name: str
    dtype: str
    shape: tuple[int, ...]
    canonical_start: int
    canonical_end: int
    raw_low_start: int
    raw_low_bytes: int
    semantic_start: int
    semantic_bytes: int


@dataclass(frozen=True)
class _NoNESemanticPagePackEntryBoundary:
    """Validated disk metadata paired with its tensor-native entry packet."""

    packet: _NoNESemanticPagePackEntryPacket
    prefix: bytes
    prefix_sha256: bytes
    raw_low_sha256: bytes
    semantic_sha256: bytes
    semantic_frame_sha256: bytes
    page_sha256: bytes
    tensor_slices: tuple[_NoNESemanticTensorSliceBoundary, ...]


@dataclass(frozen=True)
class _NoNESemanticPageTransformBoundary:
    """Lossless per-page split before native multi-frame compression."""

    source: _NoNESemanticPagePackSourceBoundary
    page_id: int
    object_sha256: bytes
    object_bytes: int
    prefix: bytes
    raw_low: bytes
    semantic: bytes
    prefix_sha256: bytes
    raw_low_sha256: bytes
    semantic_sha256: bytes
    tensor_slices: tuple[_NoNESemanticTensorSliceBoundary, ...]


@dataclass(frozen=True)
class _NoNESemanticPagePackBuildBoundary:
    """Fully encoded immutable bytes before the direct durability boundary."""

    pack_bytes: bytes
    locator: _NoNESemanticPagePackLocatorPacket
    entries: tuple[_NoNESemanticPagePackEntryBoundary, ...]
    encode_elapsed_ns_t: torch.Tensor


@dataclass(frozen=True)
class _NoNESemanticPagePackDurableBoundary:
    """One atomically installed pack plus measured durability latency."""

    locator: _NoNESemanticPagePackLocatorPacket
    durable_write_elapsed_ns_t: torch.Tensor


@dataclass(frozen=True)
class _NoNESemanticPagePackLayoutBoundary:
    """Strictly validated immutable layout mapped from one cold pack."""

    payload_offset: int
    payload_bytes: int
    entries: tuple[_NoNESemanticPagePackEntryBoundary, ...]


@dataclass(frozen=True)
class NoNECandidatePageScratchBinding:
    """Proposal-local page bytes that have not entered immutable authority."""

    page_id_t: torch.Tensor
    scratch_path: Path
    object_sha256_t: torch.Tensor
    object_bytes_t: torch.Tensor


@dataclass(frozen=True)
class _NoNEPageDeltaDependency:
    """Exact signed-parent object required to materialize one delta page."""

    object: NoNEPageObjectBinding
    generation_t: torch.Tensor
    manifest_payload_sha256_t: torch.Tensor


@dataclass(frozen=True)
class _NoNEValidatedPageObjectSchemaProof:
    """One immutable page schema proof bound to its complete file identity."""

    session_key: str
    page_id: int
    object_sha256: str
    object_path: Path
    object_identity: _FileIdentity
    format_revision: int
    delta_dependency: _NoNEPageDeltaDependency | None
    delta_storage_dtype: torch.dtype | None


@dataclass(frozen=True)
class _NoNEAuthorizedSemanticObject:
    """One serially verified immutable object available to a semantic worker."""

    page_id: int
    object_sha256: str
    object_bytes: int
    object_path: Path
    object_identity: _FileIdentity


@dataclass(frozen=True)
class _NoNERev6SemanticAdmission:
    """One distinct rev6 child and its owner-authorized dependency closure."""

    child: _NoNEAuthorizedSemanticObject
    dependency_closure: tuple[_NoNEAuthorizedSemanticObject, ...]


@dataclass(frozen=True)
class _NoNECandidatePageSemanticWitness:
    """Exact store-produced rev6 bytes before immutable generation admission.

    This is not page authority.  It records that this store encoded a validated
    finite candidate bundle against one accepted parent, then hashed the exact
    serialized bytes and captured their complete filesystem identity.  Any
    mutation or foreign object drops to the ordinary reconstruction gate.
    """

    page_id: int
    object_sha256: str
    object_bytes: int
    object_path: Path
    object_identity: _FileIdentity
    base_generation: int
    base_manifest_payload_sha256: str
    base_object_sha256: str
    base_object_bytes: int


@dataclass(frozen=True)
class _NoNEAcceptedGenerationManifestIdentity:
    """Exact mutable-pointer and immutable-manifest identity for one admission."""

    pointer_path: Path
    pointer_identity: _FileIdentity
    generation: int
    manifest_path: Path
    manifest_identity: _FileIdentity
    manifest_sha256: str
    manifest_payload_sha256: str


@dataclass(frozen=True)
class _NoNEValidatedImmutablePageClosureKey:
    """Generation-local key for one fully validated immutable delta closure."""

    authority: _NoNEAcceptedGenerationManifestIdentity
    object_sha256: str
    object_identities: tuple[
        tuple[int, str, int, Path, _FileIdentity],
        ...,
    ]


@dataclass(frozen=True)
class NoNECandidatePageSealPacket:
    """One reversible scratch-to-immutable transition before manifest staging."""

    scratch: NoNECandidatePageScratchBinding
    object: NoNEPageObjectBinding
    created_object_t: torch.Tensor


@dataclass(frozen=True)
class NoNETrainingBranchResultPacket:
    """Actual retained tensors published by one sealed training-store fork."""

    scope: NoNETrainingBranchScopePacket
    source_generation: NoNEGenerationBinding
    page_objects: tuple[NoNEPageObjectBinding, ...]
    source_external_state_sha256_t: torch.Tensor
    source_training_proof: NoNEPageTrainingProofPacket
    training_proof: NoNEPageTrainingProofPacket
    model_owned_capability_state_t: torch.Tensor
    model_owned_capability_state_sha256_t: torch.Tensor
    global_training_claimed_t: torch.Tensor
    global_full_physical_page_bank_traversal_claimed_t: torch.Tensor


@dataclass(frozen=True)
class NoNETrainingBranchRebasePacket:
    """Exact proof that historical branch deltas extend the live parent.

    Branches may finish after the canonical accepted generation has advanced.
    A rebase is safe only when the accepted target is an immutable descendant
    of the sealed source parent. The packet binds both parent manifests, every
    branch terminal manifest/optimizer, the source, target, branch, and final
    page objects, plus the exact target-lineage witness. Semantic applications,
    conflict reseals, and storage-only normalization of subsumed objects have
    separate masks so direct-object conversion cannot expand training coverage.
    It is control-plane evidence only and cannot move an accepted pointer.
    """

    source_parent_generation_t: torch.Tensor
    source_parent_manifest_payload_sha256_t: torch.Tensor
    target_parent_generation_t: torch.Tensor
    target_parent_manifest_payload_sha256_t: torch.Tensor
    branch_source_generations_t: torch.Tensor
    branch_source_manifest_sha256s_t: torch.Tensor
    branch_source_manifest_payload_sha256s_t: torch.Tensor
    branch_source_external_state_sha256s_t: torch.Tensor
    branch_source_optimizer_sha256s_t: torch.Tensor
    training_page_ids_t: torch.Tensor
    page_branch_indices_t: torch.Tensor
    source_parent_object_sha256s_t: torch.Tensor
    source_parent_object_bytes_t: torch.Tensor
    target_parent_object_sha256s_t: torch.Tensor
    target_parent_object_bytes_t: torch.Tensor
    lineage_witness_generations_t: torch.Tensor
    lineage_witness_object_sha256s_t: torch.Tensor
    lineage_witness_object_bytes_t: torch.Tensor
    branch_object_sha256s_t: torch.Tensor
    branch_object_bytes_t: torch.Tensor
    applied_page_mask_t: torch.Tensor
    resealed_page_mask_t: torch.Tensor
    storage_normalized_page_mask_t: torch.Tensor
    final_object_sha256s_t: torch.Tensor
    final_object_bytes_t: torch.Tensor
    rebase_sha256_t: torch.Tensor


@dataclass(frozen=True)
class NoNETrainingBranchUnionPacket:
    """One exact-parent, nonoverlapping union ready for immutable staging."""

    parent_session_id_t: torch.Tensor
    parent_generation_t: torch.Tensor
    parent_manifest_payload_sha256_t: torch.Tensor
    branch_scope_sha256s_t: torch.Tensor
    union_page_ids_t: torch.Tensor
    union_page_layer_ids_t: torch.Tensor
    page_objects: tuple[NoNEPageObjectBinding, ...]
    training_proof: NoNEPageTrainingProofPacket
    model_owned_capability_state_t: torch.Tensor
    model_owned_capability_state_sha256_t: torch.Tensor
    training_data_union_json_t: torch.Tensor
    training_data_union_sha256_t: torch.Tensor
    global_physical_page_training_claimed_t: torch.Tensor
    global_dataset_training_claimed_t: torch.Tensor
    global_training_claimed_t: torch.Tensor
    global_full_physical_page_bank_traversal_claimed_t: torch.Tensor
    union_sha256_t: torch.Tensor
    federated_growth_demand_authority_sha256_t: torch.Tensor | None = None
    lineage_rebase: NoNETrainingBranchRebasePacket | None = None


@dataclass(frozen=True)
class NoNETrainingBranchMergePacket:
    """Staged branch union whose canonical pointer has not yet advanced."""

    union: NoNETrainingBranchUnionPacket
    staged_generation: NoNEGenerationBinding


@dataclass(frozen=True)
class NoNEHistoricalTrainingCoveragePacket:
    """Sealed row-coverage evidence, never physical-page training authority.

    The four historical final receipts prove one exact dataset partition.  They
    do not supply branch tensors, page objects, prompts, targets, logits, or a
    claim that all physical pages were trained.  Their paths remain provenance
    strings at this explicit I/O boundary; every identity and policy value used
    by the model-store transaction is tensor-owned.
    """

    coverage_receipt_path: str
    coverage_receipt_sha256_t: torch.Tensor
    parent_session_sha256_t: torch.Tensor
    parent_generation_t: torch.Tensor
    parent_manifest_sha256_t: torch.Tensor
    parent_manifest_payload_sha256_t: torch.Tensor
    accepted_pointer_sha256_t: torch.Tensor
    historical_union_plan_file_sha256_t: torch.Tensor
    historical_union_plan_sha256_t: torch.Tensor
    canonical_history_sha256_t: torch.Tensor
    final_commit_receipt_paths: tuple[str, ...]
    final_commit_receipt_sha256s_t: torch.Tensor
    row_intervals_t: torch.Tensor
    cursor_ends_t: torch.Tensor
    transaction_sha256s_t: torch.Tensor
    source_sha256_t: torch.Tensor
    schedule_sha256_t: torch.Tensor
    global_rows_t: torch.Tensor
    historical_evidence_only_t: torch.Tensor
    branch_training_source_reuse_t: torch.Tensor
    branch_stores_opened_t: torch.Tensor
    branch_result_recomposition_used_t: torch.Tensor
    promotion_eligible_t: torch.Tensor
    full_physical_page_bank_traversal_required_t: torch.Tensor
    target_entered_forward_t: torch.Tensor
    coverage_sha256_t: torch.Tensor

    def external_record_boundary(self) -> dict[str, Any]:
        """Serialize the sealed coverage authority at an explicit boundary."""

        _validate_historical_training_coverage_packet_boundary(self)
        return _historical_training_coverage_external_record_unchecked_boundary(
            self
        )


def _historical_training_coverage_external_record_unchecked_boundary(
    packet: NoNEHistoricalTrainingCoveragePacket,
) -> dict[str, Any]:
    """Serialize a coverage packet after its tensor contract was checked."""

    intervals = packet.row_intervals_t.detach().cpu().long()
    cursors = packet.cursor_ends_t.detach().cpu().long()
    receipt_sha256s = (
        packet.final_commit_receipt_sha256s_t.detach().cpu()
    )
    transaction_sha256s = packet.transaction_sha256s_t.detach().cpu()
    records = [
        {
            "path": path,
            "sha256": bytes(receipt_sha256s[index]).hex(),
            "cursorStart": int(intervals[index, 0]),
            "cursorEnd": int(intervals[index, 1]),
            "cursor": int(cursors[index]),
            "transactionId": bytes(transaction_sha256s[index]).hex(),
        }
        for index, path in enumerate(packet.final_commit_receipt_paths)
    ]
    return {
        "schema": SEALED_HISTORICAL_TRAINING_COVERAGE_SCHEMA,
        "passed": True,
        "parent": {
            "sessionKey": _tensor_digest_hex(
                packet.parent_session_sha256_t
            ),
            "generation": int(packet.parent_generation_t),
            "manifestSha256": _tensor_digest_hex(
                packet.parent_manifest_sha256_t
            ),
            "manifestPayloadSha256": _tensor_digest_hex(
                packet.parent_manifest_payload_sha256_t
            ),
            "acceptedPointerSha256": _tensor_digest_hex(
                packet.accepted_pointer_sha256_t
            ),
        },
        "historicalReconciliation": {
            "planFileSha256": _tensor_digest_hex(
                packet.historical_union_plan_file_sha256_t
            ),
            "planSha256": _tensor_digest_hex(
                packet.historical_union_plan_sha256_t
            ),
            "canonicalHistorySha256": _tensor_digest_hex(
                packet.canonical_history_sha256_t
            ),
        },
        "finalCommitReceipts": records,
        "sourceSha256": _tensor_digest_hex(packet.source_sha256_t),
        "scheduleSha256": _tensor_digest_hex(packet.schedule_sha256_t),
        "globalRows": int(packet.global_rows_t),
        "historicalEvidenceOnly": bool(
            packet.historical_evidence_only_t
        ),
        "branchTrainingSourceReuse": bool(
            packet.branch_training_source_reuse_t
        ),
        "branchStoresOpened": bool(packet.branch_stores_opened_t),
        "branchResultRecompositionUsed": bool(
            packet.branch_result_recomposition_used_t
        ),
        "promotionEligible": bool(packet.promotion_eligible_t),
        "fullPhysicalPageBankTraversalRequired": bool(
            packet.full_physical_page_bank_traversal_required_t
        ),
        "targetEnteredForward": bool(packet.target_entered_forward_t),
        "coverageSha256": _tensor_digest_hex(packet.coverage_sha256_t),
    }


def _validate_historical_training_coverage_packet_boundary(
    packet: NoNEHistoricalTrainingCoveragePacket,
) -> torch.Tensor:
    """Require the exact sealed four-window historical row authority."""

    if not isinstance(packet, NoNEHistoricalTrainingCoveragePacket):
        raise TypeError("NoNE historical training coverage packet is malformed")
    digest_fields = (
        packet.coverage_receipt_sha256_t,
        packet.parent_session_sha256_t,
        packet.parent_manifest_sha256_t,
        packet.parent_manifest_payload_sha256_t,
        packet.accepted_pointer_sha256_t,
        packet.historical_union_plan_file_sha256_t,
        packet.historical_union_plan_sha256_t,
        packet.canonical_history_sha256_t,
        packet.source_sha256_t,
        packet.schedule_sha256_t,
        packet.coverage_sha256_t,
    )
    scalar_bool_fields = (
        packet.historical_evidence_only_t,
        packet.branch_training_source_reuse_t,
        packet.branch_stores_opened_t,
        packet.branch_result_recomposition_used_t,
        packet.promotion_eligible_t,
        packet.full_physical_page_bank_traversal_required_t,
        packet.target_entered_forward_t,
    )
    intervals_t = packet.row_intervals_t.detach().cpu().long()
    cursors_t = packet.cursor_ends_t.detach().cpu().long()
    expected_intervals_t = torch.tensor(
        SEALED_HISTORICAL_TRAINING_ROW_INTERVALS,
        dtype=torch.long,
    )
    expected_transactions_t = torch.stack(
        tuple(
            digest_tensor(value)
            for value in SEALED_HISTORICAL_TRAINING_TRANSACTION_SHA256S
        )
    )
    paths = packet.final_commit_receipt_paths
    if (
        any(
            value.dtype != torch.uint8 or value.shape != (32,)
            for value in digest_fields
        )
        or packet.parent_generation_t.dtype != torch.long
        or packet.parent_generation_t.shape != ()
        or packet.global_rows_t.dtype != torch.long
        or packet.global_rows_t.shape != ()
        or any(
            value.dtype != torch.bool or value.shape != ()
            for value in scalar_bool_fields
        )
        or packet.final_commit_receipt_sha256s_t.dtype != torch.uint8
        or packet.final_commit_receipt_sha256s_t.shape != (4, 32)
        or packet.row_intervals_t.dtype != torch.long
        or intervals_t.shape != (4, 2)
        or packet.cursor_ends_t.dtype != torch.long
        or cursors_t.shape != (4,)
        or packet.transaction_sha256s_t.dtype != torch.uint8
        or packet.transaction_sha256s_t.shape != (4, 32)
        or len(paths) != 4
        or len(set(paths)) != 4
        or any(
            not isinstance(path, str)
            or not path
            or not Path(path).expanduser().is_absolute()
            for path in paths
        )
        or torch.unique(
            packet.final_commit_receipt_sha256s_t.detach().cpu(),
            dim=0,
        ).shape[0]
        != 4
        or torch.unique(
            packet.transaction_sha256s_t.detach().cpu(),
            dim=0,
        ).shape[0]
        != 4
        or not torch.equal(intervals_t, expected_intervals_t)
        or not torch.equal(cursors_t, expected_intervals_t[:, 1])
        or not torch.equal(
            packet.transaction_sha256s_t.detach().cpu(),
            expected_transactions_t,
        )
        or int(packet.parent_generation_t)
        != SEALED_HISTORICAL_TRAINING_PARENT_GENERATION
        or int(packet.global_rows_t)
        != SEALED_HISTORICAL_TRAINING_GLOBAL_ROWS
        or _tensor_digest_hex(packet.parent_session_sha256_t)
        != SEALED_HISTORICAL_TRAINING_PARENT_SESSION_SHA256
        or _tensor_digest_hex(packet.parent_manifest_sha256_t)
        != SEALED_HISTORICAL_TRAINING_PARENT_MANIFEST_SHA256
        or _tensor_digest_hex(packet.parent_manifest_payload_sha256_t)
        != SEALED_HISTORICAL_TRAINING_PARENT_MANIFEST_PAYLOAD_SHA256
        or _tensor_digest_hex(packet.accepted_pointer_sha256_t)
        != SEALED_HISTORICAL_TRAINING_ACCEPTED_POINTER_SHA256
        or _tensor_digest_hex(packet.historical_union_plan_file_sha256_t)
        != SEALED_HISTORICAL_TRAINING_PLAN_FILE_SHA256
        or _tensor_digest_hex(packet.historical_union_plan_sha256_t)
        != SEALED_HISTORICAL_TRAINING_PLAN_SHA256
        or _tensor_digest_hex(packet.canonical_history_sha256_t)
        != SEALED_HISTORICAL_TRAINING_HISTORY_SHA256
        or _tensor_digest_hex(packet.source_sha256_t)
        != SEALED_HISTORICAL_TRAINING_SOURCE_SHA256
        or _tensor_digest_hex(packet.schedule_sha256_t)
        != SEALED_HISTORICAL_TRAINING_SCHEDULE_SHA256
        or not bool(packet.historical_evidence_only_t)
        or bool(packet.branch_training_source_reuse_t)
        or bool(packet.branch_stores_opened_t)
        or bool(packet.branch_result_recomposition_used_t)
        or bool(packet.promotion_eligible_t)
        or bool(packet.full_physical_page_bank_traversal_required_t)
        or bool(packet.target_entered_forward_t)
    ):
        raise RuntimeError(
            "NoNE sealed historical training coverage authority differs"
        )
    record = _historical_training_coverage_external_record_unchecked_boundary(
        packet
    )
    declared_coverage_sha256 = record.pop("coverageSha256")
    expected_coverage_sha256 = hashlib.sha256(
        _canonical_json_bytes(record)
    ).hexdigest()
    if declared_coverage_sha256 != expected_coverage_sha256:
        raise RuntimeError(
            "NoNE sealed historical training coverage digest differs"
        )
    return packet.coverage_sha256_t.detach().cpu().clone()


def _validated_historical_training_coverage_artifact_boundary(
    packet: NoNEHistoricalTrainingCoveragePacket,
) -> tuple[Path, str]:
    """Verify only the sealed coverage artifact, never its branch stores."""

    _validate_historical_training_coverage_packet_boundary(packet)
    unresolved_path = Path(packet.coverage_receipt_path).expanduser()
    if _unresolved_path_contains_symlink_boundary(unresolved_path):
        raise RuntimeError(
            "NoNE sealed historical training coverage path is a symlink"
        )
    path = unresolved_path.resolve()
    try:
        identity = path.lstat()
    except FileNotFoundError as error:
        raise RuntimeError(
            "NoNE sealed historical training coverage artifact is absent"
        ) from error
    expected_file_sha256 = _tensor_digest_hex(
        packet.coverage_receipt_sha256_t
    )
    if (
        path.is_symlink()
        or not stat.S_ISREG(identity.st_mode)
        or _file_sha256(path) != expected_file_sha256
        or _read_json(path) != packet.external_record_boundary()
    ):
        raise RuntimeError(
            "NoNE sealed historical training coverage artifact differs"
        )
    return path, expected_file_sha256


def _canonical_inherited_page_training_proof_record_boundary(
    *,
    parent_generation: NoNEGenerationBinding,
    training_proven_page_ids_t: torch.Tensor,
) -> dict[str, Any]:
    """Bind inherited per-page proof without inflating it from row coverage."""

    page_ids_t = (
        training_proven_page_ids_t.detach().cpu().long().reshape(-1)
    )
    if (
        training_proven_page_ids_t.dtype != torch.long
        or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
        or torch.unique(page_ids_t).numel() != page_ids_t.numel()
        or bool(page_ids_t.lt(0).any())
    ):
        raise RuntimeError("NoNE canonical inherited page proof differs")
    page_ids_sha256 = hashlib.sha256(
        page_ids_t.contiguous().numpy().astype("<i8", copy=False).tobytes()
    ).hexdigest()
    record: dict[str, Any] = {
        "schema": CANONICAL_INHERITED_PAGE_TRAINING_PROOF_SCHEMA,
        "parent": parent_generation.external_record_boundary(),
        "trainingProvenPageIds": page_ids_t.tolist(),
        "trainingProvenPageCount": int(page_ids_t.numel()),
        "trainingProvenPageIdsTensorSha256": page_ids_sha256,
        "inheritedUnchanged": True,
        "historicalRowCoverageUsedAsPageProof": False,
        "globalFullPhysicalPageBankTraversalClaimed": False,
    }
    record["proofSha256"] = hashlib.sha256(
        _canonical_json_bytes(record)
    ).hexdigest()
    return record


@dataclass(frozen=True)
class NoNEHistoricalPageMergePacket:
    """One exact historical tensor merge and its optimizer-state disposition."""

    bundle: NoNEPageBundle
    optimizer_moments_reinitialized_t: torch.Tensor


@dataclass(frozen=True)
class NoNEHistoricalPageDeltaSegmentPacket:
    """One immutable source-to-terminal learned-page lineage segment."""

    source_store: NoNEImmutablePageStore
    source_generation: NoNEGenerationBinding
    terminal_generation: NoNEGenerationBinding
    provenance_sha256_t: torch.Tensor


@dataclass(frozen=True)
class NoNEHistoricalPageTensorSurgeryPacket:
    """Direct semantic page objects produced without moving authority."""

    target_generation: NoNEGenerationBinding
    semantic_page_ids_t: torch.Tensor
    semantic_page_objects: tuple[NoNEPageObjectBinding, ...]
    optimizer_moments_reinitialized_page_ids_t: torch.Tensor
    surgery_sha256_t: torch.Tensor
    ledger_path: str


@dataclass(frozen=True)
class NoNEReconciledDirectPagePackSourcePacket:
    """Content-bound pack inputs plus diagnostic source-path observations.

    ``object_paths`` exist only at the explicit pack I/O boundary so the
    selected immutable bytes can be opened, parsed, and hashed.  Their store
    placement is provenance diagnostics, not page-map, generation, pointer, or
    acceptance authority.  Only the validated direct object identities and the
    self-contained pack produced from their bytes may enter final authority.
    """

    page_objects: tuple[NoNEPageObjectBinding, ...]
    object_paths: tuple[Path, ...]
    page_map_sha256_t: torch.Tensor
    canonical_pack: DirectPagePackBuildPacket | None = None
    direct_page_map_ledger_path: str | None = None


@dataclass(frozen=True)
class NoNEAllKnowledgeReconciledDirectMapCandidatePacket:
    """A full direct-map candidate whose semantic and training proofs differ.

    Historical row coverage, inherited per-page training proof, and the 81,602
    direct physical objects are three independent authorities.  This packet
    deliberately cannot contain a branch union, so the gen188 path cannot
    reopen B0-B3 stores or turn their row coverage into physical-page proof.
    """

    staged_generation: NoNEGenerationBinding
    historical_training_coverage: NoNEHistoricalTrainingCoveragePacket
    canonical_training_proven_page_ids_t: torch.Tensor
    canonical_page_training_proof_sha256_t: torch.Tensor
    physical_replica_proof_path: str
    physical_replica_proof_sha256_t: torch.Tensor
    direct_page_map_sha256_t: torch.Tensor
    historical_union_plan_path: str
    historical_union_plan_sha256_t: torch.Tensor
    canonical_history_path: str
    canonical_history_sha256_t: torch.Tensor
    surgery_sha256_t: torch.Tensor
    reconciliation_proof_path: str
    reconciliation_proof_sha256_t: torch.Tensor


@dataclass
class NoNECompactTransferTemplate:
    """Prequantized storage payload reused across transfer page identities."""

    payload: bytearray
    page_id_offset: int


@dataclass(frozen=True)
class NoNELayerPageImportPacket:
    """Verified trained layer pages imported from one immutable branch.

    This is an explicit storage/checkpoint boundary packet, not a forward-path
    routing hint.  A branch is portable only when its exact changed page IDs,
    layer ownership, retained gradient proof, held-out gain, anti-forgetting
    result, and cold-reload result all agree.
    """

    source_generation: NoNEGenerationBinding
    layer_id_t: torch.Tensor
    page_ids_t: torch.Tensor
    page_layer_ids_t: torch.Tensor
    training_proof: NoNEPageTrainingProofPacket
    heldout_gain_t: torch.Tensor
    anti_forgetting_retained_t: torch.Tensor
    cold_reload_verified_t: torch.Tensor
    source_checkpoint_path: str
    source_optimizer_path: str
    source_external_state_path: str
    cold_reload_proof_path: str


@dataclass(frozen=True)
class NoNELayerPageImportResultPacket:
    """Verified page objects and retained proof for one branch merge.

    This packet remains at the explicit storage/checkpoint boundary.  The page
    objects do not become accepted inference authority until a candidate model
    has routed through them, passed held-out validation, and committed the
    ordinary shared checkpoint transaction.
    """

    page_objects: tuple[NoNEPageObjectBinding, ...]
    training_proof: NoNEPageTrainingProofPacket


@dataclass(frozen=True)
class NoNELayerPageImportPlanPacket:
    """Hash-bound external plan resolved into verified branch boundaries."""

    plan_path: str
    plan_sha256_t: torch.Tensor
    target_composition_path: str
    target_composition_sha256_t: torch.Tensor
    source_stores: tuple[NoNEImmutablePageStore, ...]
    packets: tuple[NoNELayerPageImportPacket, ...]


@dataclass(frozen=True)
class NoNELayerPageImportDiscoveryPacket:
    """Movable, proof-complete layer branches discovered at the I/O boundary.

    Discovery only reconstructs already retained branch evidence.  It cannot
    choose a route, mutate a page catalog, or advance an accepted pointer; the
    ordinary model-owned candidate window still performs all three decisions.
    """

    target_composition_path: str
    target_composition_sha256_t: torch.Tensor
    locator_paths: tuple[str, ...]
    plan_paths: tuple[str, ...]
    rejected_locator_paths: tuple[str, ...]
    source_stores: tuple[NoNEImmutablePageStore, ...]
    packets: tuple[NoNELayerPageImportPacket, ...]

    def external_record_boundary(self) -> dict[str, Any]:
        page_ids_t = (
            torch.cat(
                tuple(packet.page_ids_t.detach().cpu().long() for packet in self.packets)
            )
            if self.packets
            else torch.zeros(0, dtype=torch.long)
        )
        page_ids_digest = hashlib.sha256(
            page_ids_t.contiguous().numpy().tobytes(order="C")
        ).hexdigest()
        return {
            "schema": "nnf.resynthesis.none_layer_branch_discovery.v1",
            "targetCompositionPath": self.target_composition_path,
            "targetCompositionSha256": _tensor_digest_hex(
                self.target_composition_sha256_t
            ),
            "locatorPaths": list(self.locator_paths),
            "planPaths": list(self.plan_paths),
            "rejectedLocatorPaths": list(self.rejected_locator_paths),
            "sourceBranchCount": len(self.packets),
            "sourceStoreCount": len(self.source_stores),
            "sourcePageCount": int(page_ids_t.numel()),
            "sourcePageIdsSha256": page_ids_digest,
            "sourceBranchesRetainedAndProofComplete": bool(self.packets),
            "targetCapabilityClaimed": False,
            "acceptedPointerMutated": False,
            "routingAuthority": False,
        }


@dataclass(frozen=True)
class NoNEPageForwardPacket:
    """Output and route proof from one page wave."""

    output_t: torch.Tensor
    page_ids_t: torch.Tensor
    route_probability_t: torch.Tensor
    route_entropy_t: torch.Tensor
    generation_t: torch.Tensor


@dataclass(frozen=True)
class NoNEPageResidencyWavePacket:
    """One exact slice of a larger model-owned page route."""

    request: NoNEPageRequestPacket
    active_batch_index_t: torch.Tensor


@dataclass(frozen=True)
class _NoNECandidatePageVJPTrace:
    """One exact full-route backward packet staged outside page residency.

    The trace retains only activations, the original model-owned route, and
    proposal identity. Complete page matrices and their gradients are
    deliberately absent: they are rematerialized one physical page at a time
    when the existing page-local optimizer consumes the summed gradient.
    """

    request: NoNEPageRequestPacket
    hidden_t: torch.Tensor
    gradient_output_t: torch.Tensor
    candidate_generation_t: torch.Tensor
    candidate_state_revision_t: torch.Tensor
    execution_ordinal_t: torch.Tensor


@dataclass(frozen=True)
class _NoNECandidatePageVJPTraceBinding:
    """Proposal-local identity for one disk-backed VJP trace."""

    candidate_generation_t: torch.Tensor
    candidate_state_revision_t: torch.Tensor
    execution_ordinal_t: torch.Tensor
    scratch_path: Path
    object_sha256_t: torch.Tensor
    object_bytes_t: torch.Tensor
    reservation: _NoNECandidateVJPReservation


@dataclass(frozen=True)
class _NoNECandidatePageSourceIdentity:
    """Exact source bytes used to rematerialize one routed page."""

    page_id_t: torch.Tensor
    source_kind_t: torch.Tensor
    object_sha256_t: torch.Tensor
    object_bytes_t: torch.Tensor
    scratch_path: Path | None


@dataclass(frozen=True)
class _NoNECandidateVJPStoreIdentity:
    """Movable-store identity captured by one candidate forward."""

    root: Path
    object_roots: tuple[Path, ...]
    session_id_t: torch.Tensor


@dataclass(frozen=True)
class _NoNECandidateVJPReservation:
    """Forward-reserved logical identity for one exact candidate VJP."""

    execution_ordinal_t: torch.Tensor
    candidate_generation_t: torch.Tensor
    candidate_state_revision_t: torch.Tensor
    generation: NoNEGenerationBinding
    store: _NoNECandidateVJPStoreIdentity
    page_sources: tuple[_NoNECandidatePageSourceIdentity, ...]


@dataclass(frozen=True)
class NoNECandidateVJPCheckpointPacket:
    """Activation-checkpoint snapshot of the complete VJP transaction."""

    forward_count_t: torch.Tensor
    trace_count_t: torch.Tensor
    trace_set_consumed_t: torch.Tensor
    prepare_poisoned_t: torch.Tensor
    reservations: tuple[_NoNECandidateVJPReservation, ...]
    trace_bindings: tuple[_NoNECandidatePageVJPTraceBinding, ...]
    backward_claimed_ids_t: torch.Tensor
    completed_ids_t: torch.Tensor


_CANDIDATE_VJP_SOURCE_ACCEPTED: Final[int] = 0
_CANDIDATE_VJP_SOURCE_JOURNAL: Final[int] = 1
_CANDIDATE_VJP_SOURCE_SCRATCH: Final[int] = 2
_CANDIDATE_VJP_SOURCE_OBJECT: Final[int] = 3


def _clone_none_generation_binding_boundary(
    binding: NoNEGenerationBinding,
) -> NoNEGenerationBinding:
    """Clone tensor identity while retaining one immutable manifest path."""

    return NoNEGenerationBinding(
        session_id_t=binding.session_id_t.detach().cpu().clone(),
        generation_t=binding.generation_t.detach().cpu().long().clone(),
        parent_generation_t=(
            binding.parent_generation_t.detach().cpu().long().clone()
        ),
        manifest_sha256_t=(
            binding.manifest_sha256_t.detach().cpu().to(dtype=torch.uint8).clone()
        ),
        manifest_payload_sha256_t=(
            binding.manifest_payload_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .clone()
        ),
        updated_page_ids_t=(
            binding.updated_page_ids_t.detach().cpu().long().clone()
        ),
        manifest_relative_path=binding.manifest_relative_path,
    )


def _clone_candidate_page_source_identity_boundary(
    identity: _NoNECandidatePageSourceIdentity,
) -> _NoNECandidatePageSourceIdentity:
    return _NoNECandidatePageSourceIdentity(
        page_id_t=identity.page_id_t.detach().cpu().long().clone(),
        source_kind_t=identity.source_kind_t.detach().cpu().long().clone(),
        object_sha256_t=(
            identity.object_sha256_t.detach().cpu().to(dtype=torch.uint8).clone()
        ),
        object_bytes_t=identity.object_bytes_t.detach().cpu().long().clone(),
        scratch_path=identity.scratch_path,
    )


def _same_candidate_page_source_identity_boundary(
    left: _NoNECandidatePageSourceIdentity,
    right: _NoNECandidatePageSourceIdentity,
) -> bool:
    return bool(
        torch.equal(left.page_id_t, right.page_id_t)
        and torch.equal(left.source_kind_t, right.source_kind_t)
        and torch.equal(left.object_sha256_t, right.object_sha256_t)
        and torch.equal(left.object_bytes_t, right.object_bytes_t)
        and left.scratch_path == right.scratch_path
    )


def _clone_candidate_vjp_reservation_boundary(
    reservation: _NoNECandidateVJPReservation,
) -> _NoNECandidateVJPReservation:
    return _NoNECandidateVJPReservation(
        execution_ordinal_t=(
            reservation.execution_ordinal_t.detach().cpu().long().clone()
        ),
        candidate_generation_t=(
            reservation.candidate_generation_t.detach().cpu().long().clone()
        ),
        candidate_state_revision_t=(
            reservation.candidate_state_revision_t.detach()
            .cpu()
            .long()
            .clone()
        ),
        generation=_clone_none_generation_binding_boundary(
            reservation.generation
        ),
        store=_NoNECandidateVJPStoreIdentity(
            root=reservation.store.root,
            object_roots=reservation.store.object_roots,
            session_id_t=(
                reservation.store.session_id_t.detach().cpu().long().clone()
            ),
        ),
        page_sources=tuple(
            _clone_candidate_page_source_identity_boundary(identity)
            for identity in reservation.page_sources
        ),
    )


def _same_candidate_vjp_reservation_boundary(
    left: _NoNECandidateVJPReservation,
    right: _NoNECandidateVJPReservation,
) -> bool:
    return bool(
        torch.equal(left.execution_ordinal_t, right.execution_ordinal_t)
        and torch.equal(
            left.candidate_generation_t,
            right.candidate_generation_t,
        )
        and torch.equal(
            left.candidate_state_revision_t,
            right.candidate_state_revision_t,
        )
        and _same_generation_binding_boundary(
            left.generation,
            right.generation,
        )
        and left.store.root == right.store.root
        and left.store.object_roots == right.store.object_roots
        and torch.equal(left.store.session_id_t, right.store.session_id_t)
        and len(left.page_sources) == len(right.page_sources)
        and all(
            _same_candidate_page_source_identity_boundary(
                left_source,
                right_source,
            )
            for left_source, right_source in zip(
                left.page_sources,
                right.page_sources,
                strict=True,
            )
        )
    )


def _clone_candidate_vjp_trace_binding_boundary(
    binding: _NoNECandidatePageVJPTraceBinding,
) -> _NoNECandidatePageVJPTraceBinding:
    return _NoNECandidatePageVJPTraceBinding(
        candidate_generation_t=(
            binding.candidate_generation_t.detach().cpu().long().clone()
        ),
        candidate_state_revision_t=(
            binding.candidate_state_revision_t.detach().cpu().long().clone()
        ),
        execution_ordinal_t=(
            binding.execution_ordinal_t.detach().cpu().long().clone()
        ),
        scratch_path=binding.scratch_path,
        object_sha256_t=(
            binding.object_sha256_t.detach().cpu().to(dtype=torch.uint8).clone()
        ),
        object_bytes_t=binding.object_bytes_t.detach().cpu().long().clone(),
        reservation=_clone_candidate_vjp_reservation_boundary(
            binding.reservation
        ),
    )


def _move_page_request_tensor_boundary(
    request: NoNEPageRequestPacket,
    *,
    device: torch.device,
    frontier_weight_t: torch.Tensor | None = None,
    detach: bool,
) -> NoNEPageRequestPacket:
    """Move one complete tensor route without changing its support or weights."""

    def moved(tensor: torch.Tensor) -> torch.Tensor:
        source_t = tensor.detach() if detach else tensor
        return source_t.to(device=device, copy=detach)

    active_pair_index_t = (
        None
        if request.active_pair_index_t is None
        else moved(request.active_pair_index_t).long()
    )
    return NoNEPageRequestPacket(
        session_id_t=moved(request.session_id_t).long(),
        generation_t=moved(request.generation_t).long(),
        layer_id_t=moved(request.layer_id_t).long(),
        page_ids_t=moved(request.page_ids_t).long(),
        unique_page_ids_t=moved(request.unique_page_ids_t).long(),
        unique_page_catalog_positions_t=moved(
            request.unique_page_catalog_positions_t
        ).long(),
        page_position_t=moved(request.page_position_t).long(),
        route_probability_t=moved(request.route_probability_t),
        route_entropy_t=moved(request.route_entropy_t),
        frontier_weight_t=(
            moved(request.frontier_weight_t)
            if frontier_weight_t is None
            else frontier_weight_t
        ),
        active_pair_index_t=active_pair_index_t,
    )


@dataclass(frozen=True)
class _NoNECandidateForwardWaveBinding:
    """Bind one routed page to a row of one contiguous CPU autograd leaf."""

    weights: NoNEPageWeights
    row_index_t: torch.Tensor


@dataclass(frozen=True)
class NoNEPageResidencyTelemetryPacket:
    """Tensor-owned diagnostic state for one layer's accepted residency."""

    layer_id_t: torch.Tensor
    generation_t: torch.Tensor
    resident_page_ids_t: torch.Tensor
    candidate_resident_page_ids_t: torch.Tensor
    candidate_external_page_ids_t: torch.Tensor
    candidate_external_object_bytes_t: torch.Tensor
    active_routed_page_ids_t: torch.Tensor
    active_trainable_page_ids_t: torch.Tensor
    validated_trained_page_ids_t: torch.Tensor
    page_parameter_elements_t: torch.Tensor
    request_count_t: torch.Tensor
    hit_page_count_t: torch.Tensor
    miss_page_count_t: torch.Tensor
    gradient_page_forward_count_t: torch.Tensor


def digest_tensor(hex_digest: str) -> torch.Tensor:
    """Convert one lowercase SHA-256 digest into a uint8 tensor packet."""

    if len(hex_digest) != 64 or any(
        character not in "0123456789abcdef" for character in hex_digest
    ):
        raise ValueError("digest must be lowercase hexadecimal SHA-256")
    return torch.tensor(list(bytes.fromhex(hex_digest)), dtype=torch.uint8)


def page_training_proof_digest_t_boundary(
    proof: NoNEPageTrainingProofPacket,
) -> torch.Tensor:
    """Hash one tensor-owned training proof for immutable generation binding."""

    digest = hashlib.sha256()
    for name in _PAGE_TRAINING_PROOF_TENSOR_NAMES:
        value = getattr(proof, name)
        if not isinstance(value, torch.Tensor):
            raise TypeError("NoNE page training proof contains a non-tensor field")
        stable = _stable_cpu_tensor(value)
        shape_t = torch.tensor(stable.shape, dtype=torch.long)
        digest.update(name.encode("ascii") + b"\x00")
        digest.update(str(stable.dtype).encode("ascii") + b"\x00")
        digest.update(shape_t.numpy().tobytes(order="C"))
        digest.update(stable.view(torch.uint8).reshape(-1).numpy().tobytes(order="C"))
    return digest_tensor(digest.hexdigest())


def _training_branch_scope_digest_t_boundary(
    *,
    session_id_t: torch.Tensor,
    parent_generation_t: torch.Tensor,
    parent_manifest_payload_sha256_t: torch.Tensor,
    page_ids_t: torch.Tensor,
    page_layer_ids_t: torch.Tensor,
    federated_growth_demand_authority_sha256_t: torch.Tensor | None = None,
    objective_page_ids_t: torch.Tensor | None = None,
    objective_source_id_sha256s_t: torch.Tensor | None = None,
) -> torch.Tensor:
    """Seal one normalized branch scope without introducing host routing."""

    digest = hashlib.sha256()
    tensors: tuple[tuple[str, torch.Tensor], ...] = (
        ("session_id_t", session_id_t),
        ("parent_generation_t", parent_generation_t),
        (
            "parent_manifest_payload_sha256_t",
            parent_manifest_payload_sha256_t,
        ),
        ("page_ids_t", page_ids_t),
        ("page_layer_ids_t", page_layer_ids_t),
    )
    federated_values = (
        federated_growth_demand_authority_sha256_t,
        objective_page_ids_t,
        objective_source_id_sha256s_t,
    )
    if any(value is not None for value in federated_values):
        if any(value is None for value in federated_values):
            raise ValueError("NoNE federated training branch scope is incomplete")
        assert federated_growth_demand_authority_sha256_t is not None
        assert objective_page_ids_t is not None
        assert objective_source_id_sha256s_t is not None
        tensors += (
            (
                "federated_growth_demand_authority_sha256_t",
                federated_growth_demand_authority_sha256_t,
            ),
            ("objective_page_ids_t", objective_page_ids_t),
            (
                "objective_source_id_sha256s_t",
                objective_source_id_sha256s_t,
            ),
        )
    for name, value in tensors:
        stable = _stable_cpu_tensor(value)
        digest.update(name.encode("ascii") + b"\x00")
        digest.update(str(stable.dtype).encode("ascii") + b"\x00")
        digest.update(
            torch.tensor(stable.shape, dtype=torch.long)
            .numpy()
            .tobytes(order="C")
        )
        digest.update(
            stable.reshape(-1).view(torch.uint8).numpy().tobytes(order="C")
        )
    return digest_tensor(digest.hexdigest())


def build_training_branch_scope_boundary(
    *,
    session_id_t: torch.Tensor,
    parent_generation_t: torch.Tensor,
    parent_manifest_payload_sha256_t: torch.Tensor,
    page_ids_t: torch.Tensor,
    page_layer_ids_t: torch.Tensor,
    federated_growth_demand_authority_sha256_t: torch.Tensor | None = None,
    objective_page_ids_t: torch.Tensor | None = None,
    objective_source_id_sha256s_t: torch.Tensor | None = None,
) -> NoNETrainingBranchScopePacket:
    """Build a canonical, hash-sealed disjoint training-scope authority."""

    session = session_id_t.detach().cpu().long().reshape(-1).clone()
    parent_generation = (
        parent_generation_t.detach().cpu().long().reshape(()).clone()
    )
    parent_payload = (
        parent_manifest_payload_sha256_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
        .reshape(-1)
        .clone()
    )
    page_ids = page_ids_t.detach().cpu().long().reshape(-1).clone()
    page_layer_ids = (
        page_layer_ids_t.detach().cpu().long().reshape(-1).clone()
    )
    federated_values = (
        federated_growth_demand_authority_sha256_t,
        objective_page_ids_t,
        objective_source_id_sha256s_t,
    )
    has_federated_demand = any(value is not None for value in federated_values)
    if has_federated_demand and any(
        value is None for value in federated_values
    ):
        raise ValueError("NoNE federated training branch scope is incomplete")
    federated_authority: torch.Tensor | None = None
    objective_page_ids: torch.Tensor | None = None
    objective_source_id_sha256s: torch.Tensor | None = None
    if has_federated_demand:
        assert federated_growth_demand_authority_sha256_t is not None
        assert objective_page_ids_t is not None
        assert objective_source_id_sha256s_t is not None
        federated_authority = (
            federated_growth_demand_authority_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(-1)
            .clone()
        )
        objective_page_ids = (
            objective_page_ids_t.detach().cpu().long().reshape(-1).clone()
        )
        objective_source_id_sha256s = (
            objective_source_id_sha256s_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .clone()
        )
    if (
        session.numel() < 1
        or int(parent_generation) < 1
        or parent_payload.shape != (32,)
        or page_ids.numel() < 1
        or page_layer_ids.shape != page_ids.shape
        or bool(page_ids.lt(0).any())
        or bool(page_layer_ids.lt(0).any())
    ):
        raise ValueError("NoNE training branch scope geometry is malformed")
    # Persisted scope records are already canonical.  Re-running ``unique`` and
    # ``argsort`` over every page during checkpoint restore consumed minutes of
    # CPU before CUDA admission.  A strict adjacent-order proof accepts the
    # canonical fast path; unsorted construction still performs one sort and
    # then rejects duplicates without a second sorting kernel.
    if page_ids.numel() > 1 and not bool(
        page_ids[1:].gt(page_ids[:-1]).all()
    ):
        order_t = torch.argsort(page_ids)
        page_ids = page_ids.index_select(0, order_t)
        page_layer_ids = page_layer_ids.index_select(0, order_t)
        if bool(page_ids[1:].eq(page_ids[:-1]).any()):
            raise ValueError("NoNE training branch scope geometry is malformed")
    if has_federated_demand:
        assert federated_authority is not None
        assert objective_page_ids is not None
        assert objective_source_id_sha256s is not None
        if (
            federated_authority.shape != (32,)
            or objective_source_id_sha256s.ndim != 2
            or objective_source_id_sha256s.shape
            != (objective_page_ids.numel(), 32)
            or bool(objective_page_ids.lt(0).any())
            or not bool(
                _page_ids_subset_t_boundary(objective_page_ids, page_ids)
            )
        ):
            raise ValueError(
                "NoNE federated training branch objective scope is malformed"
            )
        if objective_page_ids.numel() > 1 and not bool(
            objective_page_ids[1:].gt(objective_page_ids[:-1]).all()
        ):
            objective_order_t = torch.argsort(objective_page_ids)
            objective_page_ids = objective_page_ids.index_select(
                0,
                objective_order_t,
            )
            objective_source_id_sha256s = (
                objective_source_id_sha256s.index_select(
                    0,
                    objective_order_t,
                )
            )
            if bool(
                objective_page_ids[1:].eq(objective_page_ids[:-1]).any()
            ):
                raise ValueError(
                    "NoNE federated training branch objective scope is malformed"
                )
    scope_sha256_t = _training_branch_scope_digest_t_boundary(
        session_id_t=session,
        parent_generation_t=parent_generation,
        parent_manifest_payload_sha256_t=parent_payload,
        page_ids_t=page_ids,
        page_layer_ids_t=page_layer_ids,
        federated_growth_demand_authority_sha256_t=federated_authority,
        objective_page_ids_t=objective_page_ids,
        objective_source_id_sha256s_t=objective_source_id_sha256s,
    )
    return NoNETrainingBranchScopePacket(
        session_id_t=session,
        parent_generation_t=parent_generation,
        parent_manifest_payload_sha256_t=parent_payload,
        page_ids_t=page_ids,
        page_layer_ids_t=page_layer_ids,
        scope_sha256_t=scope_sha256_t,
        federated_growth_demand_authority_sha256_t=federated_authority,
        objective_page_ids_t=objective_page_ids,
        objective_source_id_sha256s_t=objective_source_id_sha256s,
    )


def validate_training_branch_scope_boundary(
    scope: NoNETrainingBranchScopePacket,
) -> torch.Tensor:
    """Fail closed if any tensor in a sealed branch scope has changed."""

    if not isinstance(scope, NoNETrainingBranchScopePacket):
        raise TypeError("NoNE training branch scope packet is malformed")
    rebuilt = build_training_branch_scope_boundary(
        session_id_t=scope.session_id_t,
        parent_generation_t=scope.parent_generation_t,
        parent_manifest_payload_sha256_t=(
            scope.parent_manifest_payload_sha256_t
        ),
        page_ids_t=scope.page_ids_t,
        page_layer_ids_t=scope.page_layer_ids_t,
        federated_growth_demand_authority_sha256_t=(
            scope.federated_growth_demand_authority_sha256_t
        ),
        objective_page_ids_t=scope.objective_page_ids_t,
        objective_source_id_sha256s_t=(
            scope.objective_source_id_sha256s_t
        ),
    )
    federated_values = (
        scope.federated_growth_demand_authority_sha256_t,
        scope.objective_page_ids_t,
        scope.objective_source_id_sha256s_t,
    )
    has_federated_demand = any(value is not None for value in federated_values)
    if (
        scope.session_id_t.dtype != torch.long
        or scope.parent_generation_t.dtype != torch.long
        or scope.parent_manifest_payload_sha256_t.dtype != torch.uint8
        or scope.page_ids_t.dtype != torch.long
        or scope.page_layer_ids_t.dtype != torch.long
        or scope.scope_sha256_t.dtype != torch.uint8
        or (
            has_federated_demand
            and (
                scope.federated_growth_demand_authority_sha256_t is None
                or scope.objective_page_ids_t is None
                or scope.objective_source_id_sha256s_t is None
                or scope.federated_growth_demand_authority_sha256_t.dtype
                != torch.uint8
                or scope.objective_page_ids_t.dtype != torch.long
                or scope.objective_source_id_sha256s_t.dtype != torch.uint8
            )
        )
        or not torch.equal(scope.session_id_t.detach().cpu(), rebuilt.session_id_t)
        or not torch.equal(
            scope.parent_generation_t.detach().cpu(),
            rebuilt.parent_generation_t,
        )
        or not torch.equal(
            scope.parent_manifest_payload_sha256_t.detach().cpu(),
            rebuilt.parent_manifest_payload_sha256_t,
        )
        or not torch.equal(scope.page_ids_t.detach().cpu(), rebuilt.page_ids_t)
        or not torch.equal(
            scope.page_layer_ids_t.detach().cpu(),
            rebuilt.page_layer_ids_t,
        )
        or not torch.equal(
            scope.scope_sha256_t.detach().cpu(),
            rebuilt.scope_sha256_t,
        )
        or (
            has_federated_demand
            and (
                not torch.equal(
                    cast(
                        torch.Tensor,
                        scope.federated_growth_demand_authority_sha256_t,
                    )
                    .detach()
                    .cpu(),
                    cast(
                        torch.Tensor,
                        rebuilt.federated_growth_demand_authority_sha256_t,
                    ),
                )
                or not torch.equal(
                    cast(torch.Tensor, scope.objective_page_ids_t)
                    .detach()
                    .cpu(),
                    cast(torch.Tensor, rebuilt.objective_page_ids_t),
                )
                or not torch.equal(
                    cast(torch.Tensor, scope.objective_source_id_sha256s_t)
                    .detach()
                    .cpu(),
                    cast(
                        torch.Tensor,
                        rebuilt.objective_source_id_sha256s_t,
                    ),
                )
            )
        )
    ):
        raise RuntimeError("NoNE training branch scope seal differs")
    return rebuilt.scope_sha256_t.clone()


def validate_common_parent_training_branch_scopes_boundary(
    scopes: tuple[NoNETrainingBranchScopePacket, ...],
) -> torch.Tensor:
    """Prove branch scopes are disjoint children of one immutable parent."""

    if not scopes:
        raise ValueError("NoNE branch fanout requires at least one scope")
    for scope in scopes:
        validate_training_branch_scope_boundary(scope)
    first = scopes[0]
    first_federated_authority = (
        first.federated_growth_demand_authority_sha256_t
    )
    if any(
        not torch.equal(scope.session_id_t, first.session_id_t)
        or not torch.equal(
            scope.parent_generation_t,
            first.parent_generation_t,
        )
        or not torch.equal(
            scope.parent_manifest_payload_sha256_t,
            first.parent_manifest_payload_sha256_t,
        )
        or (
            (scope.federated_growth_demand_authority_sha256_t is None)
            != (first_federated_authority is None)
        )
        or (
            first_federated_authority is not None
            and (
                scope.federated_growth_demand_authority_sha256_t is None
                or not torch.equal(
                    scope.federated_growth_demand_authority_sha256_t,
                    first_federated_authority,
                )
            )
        )
        for scope in scopes[1:]
    ):
        raise RuntimeError("NoNE branch scopes do not share one immutable parent")
    combined_page_ids_t = torch.cat(
        tuple(scope.page_ids_t for scope in scopes),
        dim=0,
    )
    if torch.unique(combined_page_ids_t).numel() != combined_page_ids_t.numel():
        raise RuntimeError("NoNE branch scopes overlap page ownership")
    return torch.sort(combined_page_ids_t).values


def training_branch_scope_from_record_boundary(
    record: object,
) -> NoNETrainingBranchScopePacket:
    """Rebuild one exact branch-ownership seal from an I/O record."""

    if not isinstance(record, dict):
        raise RuntimeError("NoNE training branch scope record is malformed")
    session_id = record.get("sessionId")
    parent_generation = record.get("parentGeneration")
    parent_payload = record.get("parentManifestPayloadSha256")
    page_ids = record.get("pageIds")
    page_layer_ids = record.get("pageLayerIds")
    scope_sha256 = record.get("scopeSha256")
    federated_authority_sha256 = record.get(
        "federatedGrowthDemandAuthoritySha256"
    )
    objective_page_ids = record.get("objectivePageIds")
    objective_source_id_sha256s = record.get("objectiveSourceIdSha256s")
    federated_fields = (
        federated_authority_sha256,
        objective_page_ids,
        objective_source_id_sha256s,
    )
    has_federated_demand = any(value is not None for value in federated_fields)
    if (
        record.get("schema") != TRAINING_BRANCH_SCOPE_SCHEMA
        or record.get("forkAuthority") is not True
        or record.get("routingAuthority") is not False
        or record.get("acceptedPointerMutationAuthority") is not False
        or record.get("globalTrainingClaimed") is not False
        or not isinstance(session_id, list)
        or not session_id
        or not all(
            isinstance(value, int) and not isinstance(value, bool)
            for value in session_id
        )
        or not isinstance(parent_generation, int)
        or isinstance(parent_generation, bool)
        or parent_generation < 1
        or not isinstance(parent_payload, str)
        or len(parent_payload) != 64
        or not isinstance(page_ids, list)
        or not page_ids
        or not all(
            isinstance(value, int) and not isinstance(value, bool) and value >= 0
            for value in page_ids
        )
        or len(set(page_ids)) != len(page_ids)
        or not isinstance(page_layer_ids, list)
        or len(page_layer_ids) != len(page_ids)
        or not all(
            isinstance(value, int) and not isinstance(value, bool) and value >= 0
            for value in page_layer_ids
        )
        or not isinstance(scope_sha256, str)
        or len(scope_sha256) != 64
        or (
            has_federated_demand
            and (
                not _is_sha256_hex_boundary(federated_authority_sha256)
                or not isinstance(objective_page_ids, list)
                or any(
                    not isinstance(value, int)
                    or isinstance(value, bool)
                    or value < 0
                    for value in objective_page_ids
                )
                or len(set(objective_page_ids)) != len(objective_page_ids)
                or not isinstance(objective_source_id_sha256s, list)
                or len(objective_source_id_sha256s) != len(objective_page_ids)
                or any(
                    not _is_sha256_hex_boundary(value)
                    for value in objective_source_id_sha256s
                )
            )
        )
    ):
        raise RuntimeError("NoNE training branch scope record is malformed")
    scope = build_training_branch_scope_boundary(
        session_id_t=torch.tensor(session_id, dtype=torch.long),
        parent_generation_t=torch.tensor(parent_generation, dtype=torch.long),
        parent_manifest_payload_sha256_t=digest_tensor(parent_payload),
        page_ids_t=torch.tensor(page_ids, dtype=torch.long),
        page_layer_ids_t=torch.tensor(page_layer_ids, dtype=torch.long),
        federated_growth_demand_authority_sha256_t=(
            digest_tensor(cast(str, federated_authority_sha256))
            if has_federated_demand
            else None
        ),
        objective_page_ids_t=(
            torch.tensor(objective_page_ids, dtype=torch.long)
            if has_federated_demand
            else None
        ),
        objective_source_id_sha256s_t=(
            torch.stack(
                tuple(
                    digest_tensor(value)
                    for value in objective_source_id_sha256s
                )
            )
            if has_federated_demand and objective_source_id_sha256s
            else torch.zeros((0, 32), dtype=torch.uint8)
            if has_federated_demand
            else None
        ),
    )
    if (
        _tensor_digest_hex(scope.scope_sha256_t) != scope_sha256
        or scope.external_record_boundary() != record
    ):
        raise RuntimeError("NoNE training branch scope record changed")
    return scope


def load_training_branch_scope_boundary(
    scope_path: Path,
) -> NoNETrainingBranchScopePacket:
    """Load one exact branch-ownership seal at an explicit I/O boundary."""

    return training_branch_scope_from_record_boundary(
        _read_json(scope_path.expanduser().resolve())
    )


def generation_binding_from_record_boundary(
    record: Mapping[str, Any],
) -> NoNEGenerationBinding:
    """Rebuild one exact generation binding from a serialized boundary record."""

    session_id = record.get("sessionId")
    generation = record.get("generation")
    parent_generation = record.get("parentGeneration")
    manifest = record.get("manifest")
    manifest_sha256 = record.get("manifestSha256")
    manifest_payload_sha256 = record.get("manifestPayloadSha256")
    updated_page_ids = record.get("updatedPageIds")
    if (
        record.get("schema") != "nnf.resynthesis.none_generation_binding.v1"
        or not isinstance(session_id, list)
        or not session_id
        or not all(
            isinstance(value, int) and not isinstance(value, bool)
            for value in session_id
        )
        or not isinstance(generation, int)
        or isinstance(generation, bool)
        or generation < 1
        or not isinstance(parent_generation, int)
        or isinstance(parent_generation, bool)
        or parent_generation < 0
        or not isinstance(manifest, str)
        or not manifest
        or not isinstance(manifest_sha256, str)
        or len(manifest_sha256) != 64
        or not isinstance(manifest_payload_sha256, str)
        or len(manifest_payload_sha256) != 64
        or not isinstance(updated_page_ids, list)
        or not updated_page_ids
        or not all(
            isinstance(page_id, int)
            and not isinstance(page_id, bool)
            and page_id >= 0
            for page_id in updated_page_ids
        )
        or len(set(updated_page_ids)) != len(updated_page_ids)
    ):
        raise RuntimeError("NoNE generation binding record is malformed")
    binding = NoNEGenerationBinding(
        session_id_t=torch.tensor(session_id, dtype=torch.long),
        generation_t=torch.tensor(generation, dtype=torch.long),
        parent_generation_t=torch.tensor(parent_generation, dtype=torch.long),
        manifest_sha256_t=digest_tensor(manifest_sha256),
        manifest_payload_sha256_t=digest_tensor(manifest_payload_sha256),
        updated_page_ids_t=torch.tensor(updated_page_ids, dtype=torch.long),
        manifest_relative_path=manifest,
    )
    if binding.external_record_boundary() != dict(record):
        raise RuntimeError("NoNE generation binding record changed")
    return binding


def load_generation_binding_boundary(
    binding_path: Path,
) -> NoNEGenerationBinding:
    """Load one exact existing generation-binding receipt."""

    resolved_binding_path = binding_path.expanduser().resolve()
    binding_sha256 = _file_sha256(resolved_binding_path)
    binding = generation_binding_from_record_boundary(
        _read_json(resolved_binding_path)
    )
    if _file_sha256(resolved_binding_path) != binding_sha256:
        raise RuntimeError("NoNE generation binding record changed")
    return binding


def training_branch_proof_from_record_boundary(
    scope: NoNETrainingBranchScopePacket,
    record: Mapping[str, Any],
) -> tuple[NoNEPageTrainingProofPacket, bool]:
    """Rebuild exact cumulative proof for one sealed branch owner scope.

    Interim retained descendants carry every scoped page with zero evidence for
    pages not yet traversed.  Their full-scope requirement is therefore true
    while verification remains false.  The terminal result flips verification
    only when every scoped page has positive route, update, gradient, and
    parameter-delta evidence.
    """

    validate_training_branch_scope_boundary(scope)
    proof_page_ids = record.get("trainingPageIds")
    route_counts = record.get("routeCounts")
    gradient_update_counts = record.get("gradientUpdateCounts")
    gradient_norms = record.get("gradientNorms")
    parameter_delta_norms = record.get("parameterDeltaNorms")
    gradient_signatures = record.get("gradientSignatures")
    page_count = len(proof_page_ids) if isinstance(proof_page_ids, list) else 0
    expected_page_ids = scope.page_ids_t.detach().cpu().long().tolist()
    signature_width = (
        len(gradient_signatures[0])
        if isinstance(gradient_signatures, list)
        and gradient_signatures
        and isinstance(gradient_signatures[0], list)
        else 0
    )
    scalar_flag_names = (
        "routeCoverage",
        "gradientCoverage",
        "distinctGradients",
        "finite",
        "promotionReady",
    )
    if (
        record.get("schema")
        != "nnf.resynthesis.none_family_training_proof.v1"
        or record.get("branchScopeActive") is not True
        or record.get("branchScope") != scope.external_record_boundary()
        or record.get("branchLocalFullScopeTraversalRequired") is not True
        or not isinstance(
            record.get("branchLocalFullScopeTraversalVerified"),
            bool,
        )
        or record.get("branchOwnedChangedSubsetRequired") is not True
        or record.get("branchOwnedChangedSubsetVerified") is not True
        or record.get("fullPhysicalPageBankTraversalRequired") is not False
        or record.get("globalFullPhysicalPageBankTraversalClaimed") is not False
        or record.get("globalTrainingClaimed") is not False
        or page_count < 1
        or proof_page_ids != expected_page_ids
        or record.get("familyPageIds") != proof_page_ids
        or record.get("trainingPageCount") != page_count
        or not isinstance(route_counts, list)
        or not isinstance(gradient_update_counts, list)
        or not isinstance(gradient_norms, list)
        or not isinstance(parameter_delta_norms, list)
        or not isinstance(gradient_signatures, list)
        or any(
            len(values) != page_count
            for values in (
                route_counts,
                gradient_update_counts,
                gradient_norms,
                parameter_delta_norms,
                gradient_signatures,
            )
        )
        or not all(
            isinstance(value, int)
            and not isinstance(value, bool)
            and value >= 0
            for value in (*route_counts, *gradient_update_counts)
        )
        or not all(
            isinstance(value, (int, float))
            and not isinstance(value, bool)
            and math.isfinite(float(value))
            and float(value) >= 0.0
            for value in (*gradient_norms, *parameter_delta_norms)
        )
        or signature_width < 1
        or not all(
            isinstance(row, list)
            and len(row) == signature_width
            and all(
                isinstance(value, (int, float))
                and not isinstance(value, bool)
                and math.isfinite(float(value))
                for value in row
            )
            for row in gradient_signatures
        )
        or any(not isinstance(record.get(name), bool) for name in scalar_flag_names)
    ):
        raise RuntimeError("NoNE training branch proof record is malformed")

    proof = NoNEPageTrainingProofPacket(
        family_page_ids_t=torch.tensor(proof_page_ids, dtype=torch.long),
        route_count_t=torch.tensor(route_counts, dtype=torch.long),
        gradient_update_count_t=torch.tensor(
            gradient_update_counts,
            dtype=torch.long,
        ),
        gradient_norm_t=torch.tensor(gradient_norms, dtype=torch.float32),
        parameter_delta_norm_t=torch.tensor(
            parameter_delta_norms,
            dtype=torch.float32,
        ),
        gradient_signature_t=torch.tensor(
            gradient_signatures,
            dtype=torch.float32,
        ),
        route_coverage_t=torch.tensor(record["routeCoverage"], dtype=torch.bool),
        gradient_coverage_t=torch.tensor(
            record["gradientCoverage"],
            dtype=torch.bool,
        ),
        distinct_gradient_t=torch.tensor(
            record["distinctGradients"],
            dtype=torch.bool,
        ),
        finite_t=torch.tensor(record["finite"], dtype=torch.bool),
        promotion_ready_t=torch.tensor(
            record["promotionReady"],
            dtype=torch.bool,
        ),
    )
    recomputed = combine_page_training_proofs((proof,))
    if any(
        not torch.equal(
            getattr(recomputed, name).detach().cpu().bool().reshape(()),
            getattr(proof, name).detach().cpu().bool().reshape(()),
        )
        for name in (
            "route_coverage_t",
            "gradient_coverage_t",
            "distinct_gradient_t",
            "finite_t",
            "promotion_ready_t",
        )
    ):
        raise RuntimeError("NoNE training branch proof flags differ")
    full_scope_verified = bool(
        proof.route_count_t.gt(0).all()
        and proof.gradient_update_count_t.gt(0).all()
        and proof.gradient_norm_t.gt(0).all()
        and proof.parameter_delta_norm_t.gt(0).all()
        and proof.route_coverage_t
        and proof.gradient_coverage_t
        and proof.finite_t
    )
    if (
        record.get("branchLocalFullScopeTraversalVerified")
        is not full_scope_verified
    ):
        raise RuntimeError("NoNE training branch full-scope proof flag differs")
    return proof, full_scope_verified


def load_training_branch_result_authority_boundary(
    *,
    scope_path: Path,
    external_state_path: Path,
) -> tuple[NoNEImmutablePageStore, NoNETrainingBranchResultPacket]:
    """Load one exact branch result from its scope and retained sidecar."""

    resolved_scope_path = scope_path.expanduser().resolve()
    resolved_external_path = external_state_path.expanduser().resolve()
    scope_file_sha256 = _file_sha256(resolved_scope_path)
    external_file_sha256 = _file_sha256(resolved_external_path)
    scope = load_training_branch_scope_boundary(resolved_scope_path)
    sidecar = _read_json(resolved_external_path)
    external_state = sidecar.get("externalState")
    generation_record = (
        external_state.get("generationBinding")
        if isinstance(external_state, dict)
        else None
    )
    training_record = (
        external_state.get("trainingProof")
        if isinstance(external_state, dict)
        else None
    )
    store_root = (
        external_state.get("storeRoot")
        if isinstance(external_state, dict)
        else None
    )
    if (
        sidecar.get("schema")
        != "nnf.resynthesis.additive_external_checkpoint_binding.v1"
        or not isinstance(sidecar.get("checkpointSha256"), str)
        or len(str(sidecar["checkpointSha256"])) != 64
        or not isinstance(sidecar.get("optimizerSha256"), str)
        or len(str(sidecar["optimizerSha256"])) != 64
        or not isinstance(generation_record, dict)
        or generation_record.get("schema")
        != "nnf.resynthesis.none_generation_binding.v1"
        or not isinstance(training_record, dict)
        or training_record.get("schema")
        != "nnf.resynthesis.none_family_training_proof.v1"
        or not isinstance(store_root, str)
        or not store_root
        or not Path(store_root).expanduser().is_absolute()
        or _file_sha256(resolved_scope_path) != scope_file_sha256
        or _file_sha256(resolved_external_path) != external_file_sha256
    ):
        raise RuntimeError("NoNE training branch result authority differs")
    training_proof, _full_scope_verified = (
        training_branch_proof_from_record_boundary(scope, training_record)
    )
    _validate_cumulative_training_branch_result_proof_boundary(
        scope,
        training_proof,
    )

    source_store = NoNEImmutablePageStore(
        Path(store_root).expanduser().resolve()
    )
    source_store.begin_session(scope.session_id_t)
    current = source_store.current_generation_binding_boundary()
    graph = source_store.current_graph_authority_boundary()
    if (
        current.external_record_boundary() != generation_record
        or not torch.equal(current.session_id_t, scope.session_id_t)
        or graph is None
        or Path(graph.external_state_path).expanduser().resolve()
        != resolved_external_path
        or not torch.equal(
            graph.external_state_sha256_t.detach().cpu().to(dtype=torch.uint8),
            digest_tensor(external_file_sha256),
        )
        or not torch.equal(
            graph.checkpoint_sha256_t.detach().cpu().to(dtype=torch.uint8),
            digest_tensor(str(sidecar["checkpointSha256"])),
        )
        or not torch.equal(
            graph.optimizer_sha256_t.detach().cpu().to(dtype=torch.uint8),
            digest_tensor(str(sidecar["optimizerSha256"])),
        )
    ):
        raise RuntimeError("NoNE training branch source generation differs")
    result = source_store.publish_training_branch_result_boundary(
        scope=scope,
        training_proof=training_proof,
        source_external_state_sha256_t=digest_tensor(external_file_sha256),
    )
    return source_store, result


def _tensor_payload_digest_t_boundary(tensor: torch.Tensor) -> torch.Tensor:
    """Hash one exact tensor payload at an explicit storage boundary."""

    stable = _stable_cpu_tensor(tensor)
    digest = hashlib.sha256()
    digest.update(str(stable.dtype).encode("ascii") + b"\x00")
    digest.update(
        torch.tensor(stable.shape, dtype=torch.long).numpy().tobytes(order="C")
    )
    digest.update(
        stable.reshape(-1).view(torch.uint8).numpy().tobytes(order="C")
    )
    return digest_tensor(digest.hexdigest())


def _federated_packed_collection_shards_boundary(
    collection: Mapping[str, Any],
) -> list[dict[str, Any]]:
    """Flatten exact federated component shards for a union boundary.

    The federation remains a cursor map over source-root collections.  This
    reads only their sealed metadata, never raw payload bytes, and reproduces
    the qualified WorkID identities used by the branch window authority.
    """

    components = collection.get("components")
    rows = collection.get("rows")
    packed_ready_mode = (
        collection.get("federationMode")
        == FULL_PAYLOAD_PACKED_READY_FEDERATION_MODE
    )
    if (
        collection.get("schema") != FULL_PAYLOAD_FEDERATED_PACKED_COLLECTION_SCHEMA
        or collection.get("passed") is not True
        or collection.get("exactDisjointComponentWindows") is not True
        or collection.get("rawPayloadCopied") is not False
        or collection.get("rawPayloadRequiredAtTraining") is not False
        or collection.get("mmapReadable") is not True
        or collection.get("compressedTokenRandomAccess") is not True
        or collection.get("targetEnteredForward") is not False
        or collection.get("globalCursorStart") != 0
        or collection.get("globalCursorEnd") != rows
        or not _is_sha256_hex_boundary(collection.get("federationAuthoritySha256"))
        or collection.get("federatedScheduleSha256")
        != collection.get("federationAuthoritySha256")
        or type(rows) is not int
        or rows < 1
        or not isinstance(components, list)
        or not components
        or collection.get("componentCount") != len(components)
        or collection.get("federationMode")
        not in {None, FULL_PAYLOAD_PACKED_READY_FEDERATION_MODE}
        or (
            packed_ready_mode
            and (
                collection.get("metadataOnlyFederation") is not True
                or collection.get("exactDisjointPayloadWorkIds") is not True
                or collection.get("rawPayloadReadersInvoked") is not False
                or collection.get("tokenizerInvoked") is not False
            )
        )
    ):
        raise RuntimeError("NoNE federated packed collection authority differs")
    output: list[dict[str, Any]] = []
    expected_global_cursor = 0
    seen_work_ids: set[str] = set()
    for component_index, raw_component in enumerate(components):
        if not isinstance(raw_component, Mapping):
            raise RuntimeError("NoNE federated packed component is malformed")
        component_id = raw_component.get("componentId")
        component_start = raw_component.get("globalCursorStart")
        component_end = raw_component.get("globalCursorEnd")
        child_record = raw_component.get("collectionReceipt")
        if (
            not _is_sha256_hex_boundary(component_id)
            or type(component_start) is not int
            or type(component_end) is not int
            or component_start != expected_global_cursor
            or component_end <= component_start
            or raw_component.get("componentCursorStart") != 0
            or raw_component.get("componentCursorEnd")
            != component_end - component_start
            or not isinstance(child_record, Mapping)
        ):
            raise RuntimeError("NoNE federated packed component differs")
        child_path_value = child_record.get("path")
        child_sha256 = child_record.get("sha256")
        if (
            not isinstance(child_path_value, str)
            or not child_path_value
            or not _is_sha256_hex_boundary(child_sha256)
        ):
            raise RuntimeError("NoNE federated child collection is malformed")
        child_path = Path(child_path_value).expanduser().resolve()
        if not child_path.is_file() or _file_sha256(child_path) != child_sha256:
            raise RuntimeError("NoNE federated child collection differs")
        child_collection = _read_json(child_path)
        child_rows = child_collection.get("rows")
        child_shards = child_collection.get("shards")
        if (
            child_collection.get("schema")
            not in (
                {
                    "nnf.resynthesis.full_payload_packed_token_collection.v1",
                    "nnf.resynthesis.full_payload_packed_token_cohort.v1",
                }
                if packed_ready_mode
                else {
                    "nnf.resynthesis.full_payload_packed_token_collection.v1"
                }
            )
            or (
                packed_ready_mode
                and (
                    raw_component.get("collectionSchema")
                    != child_collection.get("schema")
                    or raw_component.get("componentAuthoritySha256")
                    != component_id
                    or raw_component.get("collectionAuthoritySha256")
                    != component_id
                )
            )
            or child_collection.get("passed") is not True
            or child_collection.get("collectionAuthoritySha256")
            != raw_component.get("collectionAuthoritySha256")
            or type(child_rows) is not int
            or child_rows != component_end - component_start
            or not isinstance(child_shards, list)
            or child_collection.get("shardCount") != len(child_shards)
        ):
            raise RuntimeError("NoNE federated child collection differs")
        child_cursor = 0
        for child_ordinal, raw_shard in enumerate(child_shards):
            if not isinstance(raw_shard, Mapping):
                raise RuntimeError("NoNE federated child shard is malformed")
            payload_work_id = raw_shard.get("payloadWorkId")
            source_id = raw_shard.get("sourceId")
            cursor_start = raw_shard.get("cursorStart")
            cursor_end = raw_shard.get("cursorEnd")
            shard_rows = raw_shard.get("rows")
            shard_authority_sha256 = raw_shard.get("shardAuthoritySha256")
            if (
                not _is_sha256_hex_boundary(payload_work_id)
                or not isinstance(source_id, str)
                or not source_id
                or type(cursor_start) is not int
                or type(cursor_end) is not int
                or type(shard_rows) is not int
                or cursor_start != child_cursor
                or cursor_end <= cursor_start
                or shard_rows != cursor_end - cursor_start
                or not _is_sha256_hex_boundary(shard_authority_sha256)
            ):
                raise RuntimeError("NoNE federated child shard differs")
            qualified_work_id = f"{component_id}:{payload_work_id}"
            if qualified_work_id in seen_work_ids:
                raise RuntimeError("NoNE federated WorkID ownership overlaps")
            seen_work_ids.add(qualified_work_id)
            output.append(
                {
                    "scheduleOrdinal": len(output),
                    "payloadWorkId": qualified_work_id,
                    "sourceId": f"{component_id}:{source_id}",
                    "cursorStart": component_start + cursor_start,
                    "cursorEnd": component_start + cursor_end,
                    "rows": shard_rows,
                    "shardAuthoritySha256": _federated_demand_sha256_boundary(
                        {
                            "componentId": component_id,
                            "componentCollectionAuthoritySha256": (
                                raw_component["collectionAuthoritySha256"]
                            ),
                            "componentShardAuthoritySha256": (
                                shard_authority_sha256
                            ),
                        }
                    ),
                    "componentIndex": component_index,
                    "componentScheduleOrdinal": child_ordinal,
                }
            )
            child_cursor = cursor_end
        if child_cursor != child_rows:
            raise RuntimeError("NoNE federated child shard coverage is incomplete")
        expected_global_cursor = component_end
    if expected_global_cursor != rows:
        raise RuntimeError("NoNE federated cursor coverage is incomplete")
    return output


def _validated_full_payload_training_data_union_record_boundary(
    record: Mapping[str, Any],
) -> torch.Tensor:
    """Validate one exact packed WorkID/token-window union."""

    merge_mode = record.get("mergeMode")
    window_kind = record.get("windowKind")
    partial_windows = merge_mode == "disjoint_partial_full_payload_windows"
    incremental_cohort = (
        window_kind == "full_payload_packed_cohort"
    )
    federated_collection = window_kind == "full_payload_federated_packed"
    complete_collection = bool(
        not incremental_cohort and not partial_windows
    )
    union_sha256 = record.get("unionSha256")
    rows_per_epoch = record.get("rowsPerEpoch")
    branch_count = record.get("branchWindowCount")
    intervals = record.get("componentIntervals")
    component_sha256s = record.get("componentWindowSha256s")
    payload_work_ids = record.get("payloadWorkIds")
    schedule_ordinals = record.get("scheduleOrdinals")
    shard_authority_sha256s = record.get("shardAuthoritySha256s")
    collection_path_value = record.get("collectionPath")
    canonical_sha256 = hashlib.sha256(
        _canonical_json_bytes(
            {
                key: value
                for key, value in record.items()
                if key != "unionSha256"
            }
        )
    ).hexdigest()
    if (
        record.get("schema")
        != "nnf.resynthesis.training_branch_data_union.v1"
        or record.get("mergeMode")
        not in {
            "disjoint_complete_full_payload_collection",
            "disjoint_complete_full_payload_cohort",
            "disjoint_partial_full_payload_windows",
        }
        or window_kind
        not in {
            "full_payload_packed",
            "full_payload_packed_cohort",
            "full_payload_federated_packed",
        }
        or (
            merge_mode == "disjoint_complete_full_payload_cohort"
            and not incremental_cohort
        )
        or (
            merge_mode == "disjoint_complete_full_payload_collection"
            and incremental_cohort
        )
        or not isinstance(union_sha256, str)
        or len(union_sha256) != 64
        or union_sha256 != canonical_sha256
        or type(rows_per_epoch) is not int
        or rows_per_epoch < 1
        or type(branch_count) is not int
        or branch_count < (1 if partial_windows else 2)
        or not isinstance(intervals, list)
        or len(intervals) != branch_count
        or not isinstance(component_sha256s, list)
        or len(component_sha256s) != branch_count
        or any(
            not isinstance(value, str) or len(value) != 64
            for value in component_sha256s
        )
        or not isinstance(payload_work_ids, list)
        or not payload_work_ids
        or len(set(payload_work_ids)) != len(payload_work_ids)
        or any(
            not isinstance(value, str)
            or (
                len(value) != 129
                if federated_collection
                else len(value) != 64
            )
            for value in payload_work_ids
        )
        or record.get("payloadWorkIdsSha256")
        != hashlib.sha256(
            _canonical_json_bytes(
                {"payloadWorkIds": payload_work_ids}
            )
        ).hexdigest()
        or not isinstance(schedule_ordinals, list)
        or len(schedule_ordinals) != len(payload_work_ids)
        or any(
            type(value) is not int or value < 0
            for value in schedule_ordinals
        )
        or not isinstance(shard_authority_sha256s, list)
        or len(shard_authority_sha256s) != len(payload_work_ids)
        or any(
            not _is_sha256_hex_boundary(value)
            for value in shard_authority_sha256s
        )
        or not isinstance(collection_path_value, str)
        or not collection_path_value
        or record.get("mergeablePageGradientCoverage") is not True
        or record.get("promotionEligible") is not False
        or record.get("targetEnteredForward") is not False
    ):
        raise RuntimeError("NoNE packed training data union authority differs")
    previous_end = 0
    first_cursor_start: int | None = None
    interval_rows = 0
    expected_unconsumed_intervals: list[dict[str, int]] = []
    for interval in intervals:
        if not isinstance(interval, dict):
            raise RuntimeError(
                "NoNE packed training data union interval differs"
            )
        cursor_start = interval.get("cursorStart")
        cursor_end = interval.get("cursorEnd")
        rows = interval.get("rows")
        assigned_window_consumed = interval.get(
            "assignedDataWindowConsumed"
        )
        training_handoff = interval.get("trainingHandoff")
        partial_handoff_valid = bool(
            not partial_windows
            or (
                type(assigned_window_consumed) is bool
                and (
                    assigned_window_consumed
                    or (
                        isinstance(training_handoff, dict)
                        and training_handoff.get("schema")
                        == (
                            "nnf.resynthesis."
                            "full_payload_branch_training_handoff.v1"
                        )
                        and training_handoff.get(
                            "assignedDataWindowConsumed"
                        )
                        is False
                        and training_handoff.get("manualResumeOnly") is True
                        and training_handoff.get("promotionEligible") is False
                        and training_handoff.get("targetEnteredForward")
                        is False
                        and (
                            training_handoff.get(
                                "durableGracefulHandoff"
                            )
                            is True
                            or training_handoff.get(
                                "recoveredCommittedHandoff"
                            )
                            is True
                        )
                    )
                )
            )
        )
        if (
            type(cursor_start) is not int
            or type(cursor_end) is not int
            or type(rows) is not int
            or cursor_start < previous_end
            or cursor_end <= cursor_start
            or cursor_end > rows_per_epoch
            or rows != cursor_end - cursor_start
            or (
                not partial_windows
                and assigned_window_consumed is not True
            )
            or not partial_handoff_valid
            or not isinstance(
                interval.get("payloadWorkIdsSha256"),
                str,
            )
            or len(str(interval["payloadWorkIdsSha256"])) != 64
        ):
            raise RuntimeError(
                "NoNE packed training data union interval differs"
            )
        if first_cursor_start is None:
            first_cursor_start = cursor_start
        if cursor_start > previous_end:
            expected_unconsumed_intervals.append(
                {
                    "cursorStart": previous_end,
                    "cursorEnd": cursor_start,
                    "rows": cursor_start - previous_end,
                }
            )
        interval_rows += rows
        previous_end = cursor_end
    if previous_end < rows_per_epoch:
        expected_unconsumed_intervals.append(
            {
                "cursorStart": previous_end,
                "cursorEnd": rows_per_epoch,
                "rows": rows_per_epoch - previous_end,
            }
        )
    common_coverage_valid = bool(
        first_cursor_start is not None
        and record.get("cursorStart") == first_cursor_start
        and record.get("cursorEnd") == previous_end
        and record.get("rows") == interval_rows
        and (
            record.get("incrementalCohort") is True
            if incremental_cohort
            else record.get("incrementalCohort") in {None, False}
        )
        and record.get("completeSourceScheduleConsumed") is False
        and record.get("completeSequenceReleaseQualified") is False
        and record.get("sequencePolicyUniform") is True
        and (
            record.get("exactTokenWindowSliceCoverage") is True
            if partial_windows
            else record.get("exactTokenWindowSliceCoverage")
            in {None, True}
        )
    )
    complete_coverage_valid = bool(
        not partial_windows
        and previous_end == rows_per_epoch
        and interval_rows == rows_per_epoch
        and record.get("cursorStart") == 0
        and record.get("unconsumedIntervals") == []
        and record.get("exactAssignedArtifactPartition") is True
        and record.get("completeAssignedArtifactConsumed") is True
        and record.get("exactDatasetPartition") is complete_collection
        and record.get("completeDatasetConsumed") is complete_collection
        and (
            record.get("completeSelectedCohortConsumed") is True
            if incremental_cohort
            else record.get("completeSelectedCohortConsumed")
            in {None, False}
        )
        and record.get("completeTokenWindowCoverage") is True
        and record.get("exactWorkIdCoverage") is True
        and record.get("globalDatasetTrainingEligible")
        is complete_collection
        and record.get("globalDatasetTrainingClaimed")
        is complete_collection
    )
    partial_coverage_valid = bool(
        partial_windows
        and expected_unconsumed_intervals
        and record.get("unconsumedIntervals")
        == expected_unconsumed_intervals
        and record.get("exactAssignedArtifactPartition") is False
        and record.get("completeAssignedArtifactConsumed") is False
        and record.get("exactDatasetPartition") is False
        and record.get("completeDatasetConsumed") is False
        and record.get("completeSelectedCohortConsumed") is False
        and record.get("completeTokenWindowCoverage") is False
        and record.get("exactWorkIdCoverage") is False
        and record.get("globalDatasetTrainingEligible") is False
        and record.get("globalDatasetTrainingClaimed") is False
    )
    if (
        not common_coverage_valid
        or not (complete_coverage_valid or partial_coverage_valid)
    ):
        raise RuntimeError("NoNE packed training data union coverage differs")
    collection_path = Path(
        collection_path_value
    ).expanduser().resolve()
    try:
        collection = json.loads(collection_path.read_text(encoding="utf-8"))
    except (OSError, json.JSONDecodeError) as error:
        raise RuntimeError(
            "NoNE packed training data collection differs"
        ) from error
    expected_collection_schema = (
        FULL_PAYLOAD_FEDERATED_PACKED_COLLECTION_SCHEMA
        if federated_collection
        else (
            "nnf.resynthesis.full_payload_packed_token_cohort.v1"
            if incremental_cohort
            else "nnf.resynthesis.full_payload_packed_token_collection.v1"
        )
    )
    collection_shards = (
        _federated_packed_collection_shards_boundary(collection)
        if federated_collection and isinstance(collection, Mapping)
        else collection.get("shards") if isinstance(collection, dict) else None
    )
    if (
        not collection_path.is_file()
        or _file_sha256(collection_path)
        != record.get("collectionFileSha256")
        or not isinstance(collection, dict)
        or collection.get("schema") != expected_collection_schema
        or record.get("collectionSchema") != expected_collection_schema
        or collection.get("passed") is not True
        or collection.get("collectionAuthoritySha256")
        != record.get("collectionAuthoritySha256")
        or collection.get(
            "federatedScheduleSha256"
            if federated_collection
            else "scheduleSha256"
        )
        != record.get("scheduleSha256")
        or collection.get("rows") != rows_per_epoch
        or (
            incremental_cohort
            and (
                collection.get("completeSelectedCohortSealed") is not True
                or collection.get("completeSourceScheduleClaimed")
                is not False
                or collection.get("completePayloadCollectionClaimed")
                is not False
                or collection.get("globalDatasetTrainingClaimed")
                is not False
                or collection.get("promotionEligible") is not False
            )
        )
        or not isinstance(collection_shards, list)
        or (
            federated_collection
            and (
                not _is_sha256_hex_boundary(
                    collection.get("federationAuthoritySha256")
                )
                or collection.get("federatedScheduleSha256")
                != collection.get("federationAuthoritySha256")
                or not _is_sha256_hex_boundary(
                    collection.get("tokenizerAuthoritySha256")
                )
            )
        )
    ):
        raise RuntimeError(
            "NoNE packed training data collection authority differs"
        )
    expected_payload_work_ids: list[str] = []
    expected_schedule_ordinals: list[int] = []
    expected_shard_authority_sha256s: list[str] = []
    observed_payload_work_ids: set[str] = set()
    payload_work_ids_repeat = False
    for interval in intervals:
        assert isinstance(interval, dict)
        interval_start = interval["cursorStart"]
        interval_end = interval["cursorEnd"]
        assert isinstance(interval_start, int)
        assert isinstance(interval_end, int)
        interval_payload_work_ids: list[str] = []
        for shard in collection_shards:
            if not isinstance(shard, Mapping):
                raise RuntimeError(
                    "NoNE packed training data collection shard differs"
                )
            shard_start = shard.get("cursorStart")
            shard_end = shard.get("cursorEnd")
            payload_work_id = shard.get("payloadWorkId")
            schedule_ordinal = shard.get("scheduleOrdinal")
            shard_authority_sha256 = shard.get(
                "shardAuthoritySha256"
            )
            if (
                type(shard_start) is not int
                or type(shard_end) is not int
                or shard_end <= shard_start
                or not isinstance(payload_work_id, str)
                or type(schedule_ordinal) is not int
                or not _is_sha256_hex_boundary(
                    shard_authority_sha256
                )
            ):
                raise RuntimeError(
                    "NoNE packed training data collection shard differs"
                )
            if shard_end <= interval_start or shard_start >= interval_end:
                continue
            interval_payload_work_ids.append(payload_work_id)
            if payload_work_id in observed_payload_work_ids:
                payload_work_ids_repeat = True
                continue
            observed_payload_work_ids.add(payload_work_id)
            expected_payload_work_ids.append(payload_work_id)
            expected_schedule_ordinals.append(schedule_ordinal)
            expected_shard_authority_sha256s.append(
                str(shard_authority_sha256)
            )
        if (
            not interval_payload_work_ids
            or interval.get("payloadWorkIdsSha256")
            != hashlib.sha256(
                _canonical_json_bytes(
                    {"payloadWorkIds": interval_payload_work_ids}
                )
            ).hexdigest()
        ):
            raise RuntimeError(
                "NoNE packed training data union WorkID slice differs"
            )
    if (
        expected_payload_work_ids != payload_work_ids
        or expected_schedule_ordinals != schedule_ordinals
        or expected_shard_authority_sha256s
        != shard_authority_sha256s
        or (
            record.get("payloadWorkIdsRepeatAcrossBranches")
            is not payload_work_ids_repeat
            if partial_windows
            else record.get("payloadWorkIdsRepeatAcrossBranches")
            not in {None, payload_work_ids_repeat}
        )
    ):
        raise RuntimeError(
            "NoNE packed training data union WorkID authority differs"
        )
    return digest_tensor(union_sha256)


def _validated_training_data_union_record_boundary(
    record: Mapping[str, Any],
) -> torch.Tensor:
    """Validate one exact disjoint dataset union and return its digest.

    Partial unions are valid merge authority, but never dataset/global
    training authority.  Only one gap-free, uncapped epoch may carry the
    dataset claim.
    """

    if (
        record.get("schema")
        == "nnf.resynthesis.training_branch_multi_cohort_union.v1"
    ):
        return _validated_training_data_multi_cohort_union_record_boundary(
            record
        )
    if record.get("mergeMode") in {
        "disjoint_complete_full_payload_collection",
        "disjoint_complete_full_payload_cohort",
        "disjoint_partial_full_payload_windows",
    }:
        return _validated_full_payload_training_data_union_record_boundary(
            record
        )
    union_sha256 = record.get("unionSha256")
    rows_per_epoch = record.get("rowsPerEpoch")
    branch_count = record.get("branchWindowCount")
    intervals = record.get("componentIntervals")
    window_sha256s = record.get("componentWindowSha256s")
    offsets_sha256s = record.get("componentScheduleOffsetsSha256s")
    identity_sha256s = record.get("componentIdentitySha256s")
    merge_mode = record.get("mergeMode")
    source_sha256 = record.get("sourceSha256")
    canonical_sha256 = hashlib.sha256(
        _canonical_json_bytes(
            {
                key: value
                for key, value in record.items()
                if key != "unionSha256"
            }
        )
    ).hexdigest()
    if (
        record.get("schema")
        != "nnf.resynthesis.training_branch_data_union.v1"
        or merge_mode
        not in {
            "disjoint_complete_dataset_partition",
            "disjoint_partial_dataset_windows",
        }
        or not isinstance(union_sha256, str)
        or len(union_sha256) != 64
        or union_sha256 != canonical_sha256
        or not isinstance(source_sha256, str)
        or len(source_sha256) != 64
        or not isinstance(record.get("scheduleSha256"), str)
        or len(str(record["scheduleSha256"])) != 64
        or type(rows_per_epoch) is not int
        or rows_per_epoch < 1
        or type(branch_count) is not int
        or branch_count < 2
        or record.get("mergeablePageGradientCoverage") is not True
        or record.get("promotionEligible") is not False
        or record.get("targetEnteredForward") is not False
        or not isinstance(intervals, list)
        or len(intervals) != branch_count
        or not all(
            isinstance(values, list)
            and len(values) == branch_count
            and all(
                isinstance(value, str) and len(value) == 64
                for value in values
            )
            for values in (
                window_sha256s,
                offsets_sha256s,
                identity_sha256s,
            )
        )
    ):
        raise RuntimeError("NoNE training data union authority differs")

    origin_keys = (
        "datasetOriginReceiptPath",
        "datasetOriginReceiptSha256",
        "selectionReceiptPath",
        "selectionReceiptSha256",
        "datasetScope",
        "originalSourcePath",
        "originalSourceSha256",
        "originalSourceRows",
        "selectedSourcePath",
        "selectedSourceSha256",
        "selectedSourceRows",
        "globalDatasetTrainingEligible",
    )
    legacy_partial_origin_omitted = bool(
        all(key not in record for key in origin_keys)
        and merge_mode == "disjoint_partial_dataset_windows"
        and record.get("exactDatasetPartition") is False
        and record.get("completeDatasetConsumed") is False
        and record.get("globalDatasetTrainingClaimed") is False
    )
    complete_source_authority = False
    selective_source_authority = False
    if not legacy_partial_origin_omitted:
        origin_receipt_path = record.get("datasetOriginReceiptPath")
        origin_receipt_sha256 = record.get("datasetOriginReceiptSha256")
        selection_receipt_path = record.get("selectionReceiptPath")
        selection_receipt_sha256 = record.get("selectionReceiptSha256")
        dataset_scope = record.get("datasetScope")
        original_source_path = record.get("originalSourcePath")
        original_source_sha256 = record.get("originalSourceSha256")
        original_source_rows = record.get("originalSourceRows")
        selected_source_path = record.get("selectedSourcePath")
        selected_source_sha256 = record.get("selectedSourceSha256")
        selected_source_rows = record.get("selectedSourceRows")
        if (
            not isinstance(origin_receipt_path, str)
            or not origin_receipt_path
            or not isinstance(origin_receipt_sha256, str)
            or len(origin_receipt_sha256) != 64
            or dataset_scope not in {"complete_source", "selective_subset"}
            or not isinstance(original_source_path, str)
            or not original_source_path
            or not isinstance(original_source_sha256, str)
            or len(original_source_sha256) != 64
            or type(original_source_rows) is not int
            or original_source_rows < rows_per_epoch
            or not isinstance(selected_source_path, str)
            or not selected_source_path
            or selected_source_sha256 != source_sha256
            or selected_source_rows != rows_per_epoch
            or type(record.get("globalDatasetTrainingEligible")) is not bool
        ):
            raise RuntimeError("NoNE training data union origin differs")
        resolved_origin_receipt = Path(origin_receipt_path).expanduser().resolve()
        resolved_original_source = Path(
            original_source_path
        ).expanduser().resolve()
        resolved_selected_source = Path(
            selected_source_path
        ).expanduser().resolve()
        try:
            origin_receipt = json.loads(
                resolved_origin_receipt.read_text(encoding="utf-8")
            )
        except (OSError, json.JSONDecodeError) as error:
            raise RuntimeError(
                "NoNE training data union origin receipt differs"
            ) from error
        origin_artifacts = (
            origin_receipt.get("artifacts")
            if isinstance(origin_receipt, dict)
            else None
        )
        origin_train = (
            origin_artifacts.get("train")
            if isinstance(origin_artifacts, dict)
            else None
        )
        if (
            not resolved_original_source.is_file()
            or not resolved_selected_source.is_file()
            or resolved_origin_receipt
            != (
                resolved_original_source.parent / "build_receipt.json"
            ).resolve()
            or _file_sha256(resolved_origin_receipt)
            != origin_receipt_sha256
            or not isinstance(origin_receipt, dict)
            or origin_receipt.get("schema")
            != "nnf.resynthesis.cas_identity_graph_build.v1"
            or origin_receipt.get("passed") is not True
            or not isinstance(origin_train, dict)
            or Path(
                str(origin_train.get("path", ""))
            ).expanduser().resolve()
            != resolved_original_source
            or origin_train.get("sha256") != original_source_sha256
            or origin_train.get("rows") != original_source_rows
        ):
            raise RuntimeError(
                "NoNE training data union origin receipt differs"
            )
        source_identity_cache_root = (
            resolved_original_source.parent
            / ".resynthesis_data_window_source_sha256_cache"
        )
        try:
            if (
                _file_sha256(
                    resolved_original_source,
                    expected_sha256=original_source_sha256,
                    identity_cache_root=source_identity_cache_root,
                )
                != original_source_sha256
                or _file_sha256(
                    resolved_selected_source,
                    expected_sha256=source_sha256,
                    identity_cache_root=source_identity_cache_root,
                )
                != source_sha256
            ):
                raise RuntimeError(
                    "NoNE training data union source bytes differ"
                )
        except (OSError, RuntimeError, ValueError) as error:
            raise RuntimeError(
                "NoNE training data union source bytes differ"
            ) from error
        complete_source_authority = bool(
            dataset_scope == "complete_source"
            and record.get("globalDatasetTrainingEligible") is True
            and resolved_original_source == resolved_selected_source
            and original_source_sha256 == source_sha256
            and original_source_rows == rows_per_epoch
            and selection_receipt_path is None
            and selection_receipt_sha256 is None
        )
        selective_source_authority = bool(
            dataset_scope == "selective_subset"
            and record.get("globalDatasetTrainingEligible") is False
            and resolved_original_source != resolved_selected_source
            and original_source_sha256 != source_sha256
            and original_source_rows > rows_per_epoch
            and isinstance(selection_receipt_path, str)
            and bool(selection_receipt_path)
            and isinstance(selection_receipt_sha256, str)
            and len(selection_receipt_sha256) == 64
        )
        if selective_source_authority:
            resolved_selection_receipt = Path(
                str(selection_receipt_path)
            ).expanduser().resolve()
            try:
                selection_receipt = json.loads(
                    resolved_selection_receipt.read_text(encoding="utf-8")
                )
            except (OSError, json.JSONDecodeError) as error:
                raise RuntimeError(
                    "NoNE training data union selection receipt differs"
                ) from error
            selective_source_authority = bool(
                resolved_selection_receipt
                == resolved_selected_source.with_suffix(".receipt.json")
                and _file_sha256(resolved_selection_receipt)
                == selection_receipt_sha256
                and isinstance(selection_receipt, dict)
                and selection_receipt.get("schema")
                == "nnf.resynthesis.selective_training_corpus.v1"
                and selection_receipt.get("passed") is True
                and selection_receipt.get("selectionPolicy")
                == "uniform_exact_row_bucket_across_complete_source_v1"
                and Path(
                    str(selection_receipt.get("sourcePath", ""))
                ).expanduser().resolve()
                == resolved_original_source
                and selection_receipt.get("sourceRows")
                == original_source_rows
                and selection_receipt.get("sourceBytes")
                == resolved_original_source.stat().st_size
                and Path(
                    str(selection_receipt.get("selectedPath", ""))
                ).expanduser().resolve()
                == resolved_selected_source
                and selection_receipt.get("selectedRows") == rows_per_epoch
                and selection_receipt.get("selectedBytes")
                == resolved_selected_source.stat().st_size
                and selection_receipt.get("selectedSha256") == source_sha256
                and selection_receipt.get("rowsMutated") is False
                and selection_receipt.get("globalTrainingClaimed") is False
                and selection_receipt.get("promotionEligible") is False
            )
        if not (complete_source_authority or selective_source_authority):
            raise RuntimeError("NoNE training data union origin differs")
    previous_end = 0
    interval_rows = 0
    gaps: list[dict[str, int]] = []
    target_complete: list[bool] = []
    prompt_complete: list[bool] = []
    target_policies: list[int | None] = []
    prompt_policies: list[int | None] = []
    for interval in intervals:
        if not isinstance(interval, dict):
            raise RuntimeError("NoNE training data union interval differs")
        cursor_start = interval.get("cursorStart")
        cursor_end = interval.get("cursorEnd")
        rows = interval.get("rows")
        target_complete_value = interval.get("completeTargetSequenceUsed")
        prompt_complete_value = interval.get("completePromptSequenceUsed")
        target_policy = interval.get("trainingTargetTokensPerRow")
        prompt_policy = interval.get("trainingPromptWindowTokens")
        if (
            type(cursor_start) is not int
            or type(cursor_end) is not int
            or type(rows) is not int
            or cursor_start < previous_end
            or cursor_start < 0
            or cursor_end <= cursor_start
            or cursor_end > rows_per_epoch
            or rows != cursor_end - cursor_start
            or type(target_complete_value) is not bool
            or type(prompt_complete_value) is not bool
            or (
                target_policy is not None
                and (
                    type(target_policy) is not int
                    or target_policy < 1
                )
            )
            or (
                prompt_policy is not None
                and (
                    type(prompt_policy) is not int
                    or prompt_policy < 1
                )
            )
            or target_complete_value is not (target_policy is None)
            or prompt_complete_value is not (prompt_policy is None)
            or interval.get("assignedDataWindowConsumed") is not True
        ):
            raise RuntimeError("NoNE training data union interval differs")
        if cursor_start > previous_end:
            gaps.append(
                {
                    "cursorStart": previous_end,
                    "cursorEnd": cursor_start,
                    "rows": cursor_start - previous_end,
                }
            )
        interval_rows += rows
        target_complete.append(target_complete_value)
        prompt_complete.append(prompt_complete_value)
        target_policies.append(target_policy)
        prompt_policies.append(prompt_policy)
        previous_end = cursor_end
    if previous_end < rows_per_epoch:
        gaps.append(
            {
                "cursorStart": previous_end,
                "cursorEnd": rows_per_epoch,
                "rows": rows_per_epoch - previous_end,
            }
        )
    sequence_policy_uniform = bool(
        all(policy == target_policies[0] for policy in target_policies)
        and all(policy == prompt_policies[0] for policy in prompt_policies)
    )
    exact_assigned_artifact_partition = bool(
        not gaps
        and intervals[0]["cursorStart"] == 0
        and previous_end == rows_per_epoch
        and interval_rows == rows_per_epoch
    )
    complete_assigned_artifact_consumed = bool(
        exact_assigned_artifact_partition
        and all(
            interval.get("assignedDataWindowConsumed") is True
            for interval in intervals
        )
    )
    dataset_complete = bool(
        complete_assigned_artifact_consumed
        and complete_source_authority
        and all(target_complete)
        and all(prompt_complete)
        and all(policy is None for policy in target_policies)
        and all(policy is None for policy in prompt_policies)
    )
    expected_mode = (
        "disjoint_complete_dataset_partition"
        if dataset_complete
        else "disjoint_partial_dataset_windows"
    )
    if (
        merge_mode != expected_mode
        or record.get("cursorStart") != intervals[0]["cursorStart"]
        or record.get("cursorEnd") != previous_end
        or record.get("rows") != interval_rows
        or record.get("unconsumedIntervals") != gaps
        or (
            not legacy_partial_origin_omitted
            and record.get("exactAssignedArtifactPartition")
            is not exact_assigned_artifact_partition
        )
        or (
            not legacy_partial_origin_omitted
            and record.get("completeAssignedArtifactConsumed")
            is not complete_assigned_artifact_consumed
        )
        or record.get("exactDatasetPartition") is not dataset_complete
        or record.get("completeDatasetConsumed") is not dataset_complete
        or record.get("completeTargetSequenceUsed") is not all(target_complete)
        or record.get("completePromptSequenceUsed") is not all(prompt_complete)
        or record.get("trainingTargetTokensPerRow")
        != (
            target_policies[0]
            if all(
                policy == target_policies[0]
                for policy in target_policies
            )
            else None
        )
        or record.get("trainingPromptWindowTokens")
        != (
            prompt_policies[0]
            if all(
                policy == prompt_policies[0]
                for policy in prompt_policies
            )
            else None
        )
        or record.get("sequencePolicyUniform")
        is not sequence_policy_uniform
        or record.get("completeSequenceReleaseQualified")
        is not dataset_complete
        or record.get("globalDatasetTrainingClaimed") is not dataset_complete
    ):
        raise RuntimeError("NoNE training data union coverage differs")
    return digest_tensor(union_sha256)


def _validated_training_data_multi_cohort_union_record_boundary(
    record: Mapping[str, Any],
) -> torch.Tensor:
    """Validate multiple dataset cohorts without widening dataset claims."""

    union_sha256 = record.get("unionSha256")
    cohorts = record.get("cohorts")
    parent_session_id = record.get("parentSessionId")
    parent_generation = record.get("parentGeneration")
    parent_manifest_sha256 = record.get("parentManifestPayloadSha256")
    parent_lineage = {
        "parentSessionId": parent_session_id,
        "parentGeneration": parent_generation,
        "parentManifestPayloadSha256": parent_manifest_sha256,
    }
    canonical_sha256 = hashlib.sha256(
        _canonical_json_bytes(
            {
                key: value
                for key, value in record.items()
                if key != "unionSha256"
            }
        )
    ).hexdigest()
    if (
        record.get("schema")
        != "nnf.resynthesis.training_branch_multi_cohort_union.v1"
        or record.get("mergeMode") != "exact_disjoint_multi_cohort_union"
        or not isinstance(union_sha256, str)
        or len(union_sha256) != 64
        or union_sha256 != canonical_sha256
        or not isinstance(cohorts, list)
        or len(cohorts) < 2
        or record.get("cohortCount") != len(cohorts)
        or not isinstance(parent_session_id, list)
        or not parent_session_id
        or not all(type(value) is int for value in parent_session_id)
        or type(parent_generation) is not int
        or parent_generation < 0
        or not isinstance(parent_manifest_sha256, str)
        or len(parent_manifest_sha256) != 64
        or record.get("parentCheckpointLineageSha256")
        != hashlib.sha256(
            _canonical_json_bytes(parent_lineage)
        ).hexdigest()
        or record.get("globalDatasetTrainingClaimed") is not False
        or record.get("globalTrainingClaimed") is not False
        or record.get("globalPhysicalPageTrainingClaimed") is not False
        or record.get("globalFullPhysicalPageBankTraversalClaimed")
        is not False
        or record.get("completeSourceDatasetTrainingClaimed") is not False
        or record.get("globalCapabilityClaimed") is not False
        or record.get("completeDatasetConsumed") is not False
        or record.get("exactDatasetPartition") is not False
        or record.get("completeSequenceReleaseQualified") is not False
        or record.get("mergeablePageGradientCoverage") is not True
        or record.get("promotionEligible") is not False
        or record.get("targetEnteredForward") is not False
    ):
        raise RuntimeError("NoNE training data multi-cohort union differs")
    branch_count = 0
    fanout_paths: set[Path] = set()
    component_sha256s: list[str] = []
    observed_payload_work_ids: set[str] = set()
    ordered_payload_work_ids: list[str] = []
    incremental_packed_cohort_present = False
    for cohort_index, cohort in enumerate(cohorts):
        if not isinstance(cohort, dict):
            raise RuntimeError(
                "NoNE training data multi-cohort component differs"
            )
        fanout_path_value = cohort.get("fanoutReceiptPath")
        fanout_sha256 = cohort.get("fanoutReceiptSha256")
        data_union = cohort.get("trainingDataUnion")
        cohort_branch_count = cohort.get("branchCount")
        if (
            cohort.get("cohortIndex") != cohort_index
            or not isinstance(fanout_path_value, str)
            or not fanout_path_value
            or not isinstance(fanout_sha256, str)
            or len(fanout_sha256) != 64
            or not isinstance(data_union, dict)
            or data_union.get("schema")
            != "nnf.resynthesis.training_branch_data_union.v1"
            or cohort.get("trainingDataUnionSha256")
            != data_union.get("unionSha256")
            or type(cohort_branch_count) is not int
            or cohort_branch_count < 1
            or cohort_branch_count != data_union.get("branchWindowCount")
        ):
            raise RuntimeError(
                "NoNE training data multi-cohort component differs"
            )
        fanout_path = Path(fanout_path_value).expanduser().resolve()
        if (
            fanout_path in fanout_paths
            or not fanout_path.is_file()
            or _file_sha256(fanout_path) != fanout_sha256
        ):
            raise RuntimeError(
                "NoNE training data multi-cohort fanout differs"
            )
        _validated_training_data_union_record_boundary(data_union)
        payload_work_ids = data_union.get("payloadWorkIds")
        packed_union = data_union.get("mergeMode") in {
            "disjoint_complete_full_payload_collection",
            "disjoint_complete_full_payload_cohort",
            "disjoint_partial_full_payload_windows",
        }
        incremental_packed_cohort = (
            data_union.get("mergeMode")
            in {
                "disjoint_complete_full_payload_cohort",
                "disjoint_partial_full_payload_windows",
            }
        )
        incremental_packed_cohort_present = bool(
            incremental_packed_cohort_present or incremental_packed_cohort
        )
        if (
            packed_union
            and (
                not isinstance(payload_work_ids, list)
                or not payload_work_ids
            )
        ):
            raise RuntimeError(
                "NoNE training data multi-cohort WorkID authority differs"
            )
        if isinstance(payload_work_ids, list):
            normalized_work_ids = [
                str(work_id) for work_id in payload_work_ids
            ]
            if (
                len(normalized_work_ids) != len(set(normalized_work_ids))
                or observed_payload_work_ids.intersection(
                    normalized_work_ids
                )
                or (
                    incremental_packed_cohort
                    and cohort.get("payloadWorkIdsSha256")
                    != data_union.get("payloadWorkIdsSha256")
                )
            ):
                raise RuntimeError(
                    "NoNE training data multi-cohort WorkID ownership overlaps"
                )
            observed_payload_work_ids.update(normalized_work_ids)
            ordered_payload_work_ids.extend(normalized_work_ids)
        fanout_paths.add(fanout_path)
        branch_count += cohort_branch_count
        component_sha256s.append(str(data_union["unionSha256"]))
    if (
        record.get("branchCount") != branch_count
        or record.get("componentTrainingDataUnionSha256s")
        != component_sha256s
        or (
            incremental_packed_cohort_present
            and (
                record.get("packedPayloadWorkCount")
                != len(ordered_payload_work_ids)
                or record.get("packedPayloadWorkIdsSha256")
                != hashlib.sha256(
                    _canonical_json_bytes(
                        {"payloadWorkIds": ordered_payload_work_ids}
                    )
                ).hexdigest()
            )
        )
        or (
            not incremental_packed_cohort_present
            and record.get("packedPayloadWorkCount")
            not in {None, len(ordered_payload_work_ids)}
        )
    ):
        raise RuntimeError(
            "NoNE training data multi-cohort membership differs"
        )
    return digest_tensor(union_sha256)


def training_data_union_record_tensor_boundary(
    record: Mapping[str, Any],
) -> torch.Tensor:
    """Encode a validated dataset union for the tensor-native merge boundary."""

    _validated_training_data_union_record_boundary(record)
    return torch.tensor(
        list(_canonical_json_bytes(record)),
        dtype=torch.uint8,
    )


def _training_data_union_record_from_tensor_boundary(
    payload_t: torch.Tensor,
) -> tuple[dict[str, Any], torch.Tensor]:
    """Decode and revalidate a canonical tensor-bound dataset union."""

    stable_t = payload_t.detach().cpu().to(dtype=torch.uint8).reshape(-1)
    if payload_t.dtype != torch.uint8 or stable_t.numel() < 2:
        raise RuntimeError("NoNE training data union tensor differs")
    payload_bytes = bytes(stable_t.tolist())
    try:
        record = json.loads(payload_bytes.decode("utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError) as error:
        raise RuntimeError("NoNE training data union tensor differs") from error
    if (
        not isinstance(record, dict)
        or payload_bytes != _canonical_json_bytes(record)
    ):
        raise RuntimeError("NoNE training data union encoding differs")
    digest_t = _validated_training_data_union_record_boundary(record)
    return record, digest_t


_TRAINING_BRANCH_REBASE_TENSOR_NAMES: Final[tuple[str, ...]] = (
    "source_parent_generation_t",
    "source_parent_manifest_payload_sha256_t",
    "target_parent_generation_t",
    "target_parent_manifest_payload_sha256_t",
    "branch_source_generations_t",
    "branch_source_manifest_sha256s_t",
    "branch_source_manifest_payload_sha256s_t",
    "branch_source_external_state_sha256s_t",
    "branch_source_optimizer_sha256s_t",
    "training_page_ids_t",
    "page_branch_indices_t",
    "source_parent_object_sha256s_t",
    "source_parent_object_bytes_t",
    "target_parent_object_sha256s_t",
    "target_parent_object_bytes_t",
    "lineage_witness_generations_t",
    "lineage_witness_object_sha256s_t",
    "lineage_witness_object_bytes_t",
    "branch_object_sha256s_t",
    "branch_object_bytes_t",
    "applied_page_mask_t",
    "resealed_page_mask_t",
    "storage_normalized_page_mask_t",
    "final_object_sha256s_t",
    "final_object_bytes_t",
)


def _training_branch_rebase_digest_t_boundary(
    rebase: NoNETrainingBranchRebasePacket,
) -> torch.Tensor:
    """Seal one historical-parent to accepted-parent branch rebase."""

    digest = hashlib.sha256()
    digest.update(TRAINING_BRANCH_UNION_REBASE_SCHEMA.encode("ascii") + b"\x00")
    for name in _TRAINING_BRANCH_REBASE_TENSOR_NAMES:
        value = getattr(rebase, name)
        if not isinstance(value, torch.Tensor):
            raise TypeError("NoNE training branch rebase contains a non-tensor field")
        stable = _stable_cpu_tensor(value)
        digest.update(name.encode("ascii") + b"\x00")
        digest.update(str(stable.dtype).encode("ascii") + b"\x00")
        digest.update(
            torch.tensor(stable.shape, dtype=torch.long)
            .numpy()
            .tobytes(order="C")
        )
        digest.update(
            stable.reshape(-1).view(torch.uint8).numpy().tobytes(order="C")
        )
    return digest_tensor(digest.hexdigest())


def _validate_training_branch_rebase_packet_boundary(
    rebase: NoNETrainingBranchRebasePacket,
    *,
    parent_session_id_t: torch.Tensor,
    parent_generation_t: torch.Tensor,
    parent_manifest_payload_sha256_t: torch.Tensor,
    branch_scope_sha256s_t: torch.Tensor,
    union_page_ids_t: torch.Tensor,
    page_objects: tuple[NoNEPageObjectBinding, ...],
) -> torch.Tensor:
    """Reject an incomplete, conflicting, or stale branch rebase proof."""

    if not isinstance(rebase, NoNETrainingBranchRebasePacket):
        raise TypeError("NoNE training branch rebase packet is malformed")
    page_ids_t = union_page_ids_t.detach().cpu().long().reshape(-1)
    page_count = int(page_ids_t.numel())
    branch_count = int(branch_scope_sha256s_t.shape[0])
    page_branch_indices_t = (
        rebase.page_branch_indices_t.detach().cpu().long().reshape(-1)
    )
    applied_mask_t = (
        rebase.applied_page_mask_t.detach().cpu().bool().reshape(-1)
    )
    resealed_mask_t = (
        rebase.resealed_page_mask_t.detach().cpu().bool().reshape(-1)
    )
    storage_normalized_mask_t = (
        rebase.storage_normalized_page_mask_t.detach()
        .cpu()
        .bool()
        .reshape(-1)
    )
    object_sha256s_t = torch.stack(
        tuple(
            binding.object_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(32)
            for binding in page_objects
        ),
        dim=0,
    )
    object_bytes_t = torch.stack(
        tuple(
            binding.object_bytes_t.detach().cpu().long().reshape(())
            for binding in page_objects
        )
    )
    source_parent_object_sha256s_t = (
        rebase.source_parent_object_sha256s_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
    )
    target_parent_object_sha256s_t = (
        rebase.target_parent_object_sha256s_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
    )
    witness_object_sha256s_t = (
        rebase.lineage_witness_object_sha256s_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
    )
    branch_object_sha256s_t = (
        rebase.branch_object_sha256s_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
    )
    final_object_sha256s_t = (
        rebase.final_object_sha256s_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
    )
    source_parent_object_bytes_t = (
        rebase.source_parent_object_bytes_t.detach().cpu().long().reshape(-1)
    )
    target_parent_object_bytes_t = (
        rebase.target_parent_object_bytes_t.detach().cpu().long().reshape(-1)
    )
    witness_object_bytes_t = (
        rebase.lineage_witness_object_bytes_t.detach()
        .cpu()
        .long()
        .reshape(-1)
    )
    branch_object_bytes_t = (
        rebase.branch_object_bytes_t.detach().cpu().long().reshape(-1)
    )
    final_object_bytes_t = (
        rebase.final_object_bytes_t.detach().cpu().long().reshape(-1)
    )
    witness_generations_t = (
        rebase.lineage_witness_generations_t.detach()
        .cpu()
        .long()
        .reshape(-1)
    )
    branch_source_generations_t = (
        rebase.branch_source_generations_t.detach()
        .cpu()
        .long()
        .reshape(-1)
    )
    branch_digest_rows = (
        rebase.branch_source_manifest_sha256s_t,
        rebase.branch_source_manifest_payload_sha256s_t,
        rebase.branch_source_external_state_sha256s_t,
        rebase.branch_source_optimizer_sha256s_t,
    )
    page_digest_rows = (
        source_parent_object_sha256s_t,
        target_parent_object_sha256s_t,
        witness_object_sha256s_t,
        branch_object_sha256s_t,
        final_object_sha256s_t,
    )
    page_byte_rows = (
        source_parent_object_bytes_t,
        target_parent_object_bytes_t,
        witness_object_bytes_t,
        branch_object_bytes_t,
        final_object_bytes_t,
    )
    source_parent_generation = int(
        rebase.source_parent_generation_t.detach().cpu().long().reshape(())
    )
    target_parent_generation = int(
        rebase.target_parent_generation_t.detach().cpu().long().reshape(())
    )
    subsumed_mask_t = ~applied_mask_t
    branch_matches_target_t = (
        branch_object_sha256s_t.eq(target_parent_object_sha256s_t).all(dim=1)
        & branch_object_bytes_t.eq(target_parent_object_bytes_t)
    )
    branch_matches_source_t = (
        branch_object_sha256s_t.eq(source_parent_object_sha256s_t).all(dim=1)
        & branch_object_bytes_t.eq(source_parent_object_bytes_t)
    )
    final_matches_target_t = (
        final_object_sha256s_t.eq(target_parent_object_sha256s_t).all(dim=1)
        & final_object_bytes_t.eq(target_parent_object_bytes_t)
    )
    expected_storage_normalized_mask_t = (
        subsumed_mask_t & ~final_matches_target_t
    )
    if (
        page_count < 1
        or branch_count < 1
        or source_parent_generation < 0
        or target_parent_generation <= source_parent_generation
        or not torch.equal(
            rebase.target_parent_generation_t.detach()
            .cpu()
            .long()
            .reshape(()),
            parent_generation_t.detach().cpu().long().reshape(()),
        )
        or not torch.equal(
            rebase.target_parent_manifest_payload_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
            parent_manifest_payload_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
        )
        or rebase.source_parent_manifest_payload_sha256_t.shape != (32,)
        or rebase.source_parent_manifest_payload_sha256_t.dtype != torch.uint8
        or rebase.target_parent_manifest_payload_sha256_t.shape != (32,)
        or rebase.target_parent_manifest_payload_sha256_t.dtype != torch.uint8
        or parent_session_id_t.detach().cpu().long().reshape(-1).numel() < 1
        or branch_source_generations_t.shape != (branch_count,)
        or not branch_source_generations_t.gt(source_parent_generation).all()
        or any(
            row.shape != (branch_count, 32)
            or row.dtype != torch.uint8
            for row in branch_digest_rows
        )
        or not torch.equal(
            rebase.training_page_ids_t.detach().cpu().long().reshape(-1),
            page_ids_t,
        )
        or page_branch_indices_t.shape != (page_count,)
        or page_branch_indices_t.lt(0).any()
        or page_branch_indices_t.ge(branch_count).any()
        or any(
            row.shape != (page_count, 32)
            for row in page_digest_rows
        )
        or any(
            row.shape != (page_count,)
            or not row.gt(0).all()
            for row in page_byte_rows
        )
        or witness_generations_t.shape != (page_count,)
        or not witness_generations_t.eq(target_parent_generation).all()
        or applied_mask_t.shape != (page_count,)
        or resealed_mask_t.shape != (page_count,)
        or storage_normalized_mask_t.shape != (page_count,)
        or not applied_mask_t.any()
        or bool((resealed_mask_t & ~applied_mask_t).any())
        or bool((storage_normalized_mask_t & applied_mask_t).any())
        or not torch.equal(
            storage_normalized_mask_t,
            expected_storage_normalized_mask_t,
        )
        or not torch.equal(final_object_sha256s_t, object_sha256s_t)
        or not torch.equal(final_object_bytes_t, object_bytes_t)
        or bool(
            (
                subsumed_mask_t
                & ~(branch_matches_target_t | branch_matches_source_t)
            ).any()
        )
        or not torch.equal(
            final_object_sha256s_t[
                subsumed_mask_t & ~storage_normalized_mask_t
            ],
            target_parent_object_sha256s_t[
                subsumed_mask_t & ~storage_normalized_mask_t
            ],
        )
        or not torch.equal(
            final_object_bytes_t[
                subsumed_mask_t & ~storage_normalized_mask_t
            ],
            target_parent_object_bytes_t[
                subsumed_mask_t & ~storage_normalized_mask_t
            ],
        )
        or not torch.equal(
            witness_object_sha256s_t,
            target_parent_object_sha256s_t,
        )
        or not torch.equal(
            witness_object_bytes_t,
            target_parent_object_bytes_t,
        )
        or rebase.rebase_sha256_t.shape != (32,)
        or rebase.rebase_sha256_t.dtype != torch.uint8
    ):
        raise RuntimeError("NoNE training branch rebase authority differs")
    expected_sha256_t = _training_branch_rebase_digest_t_boundary(rebase)
    if not torch.equal(
        rebase.rebase_sha256_t.detach().cpu(),
        expected_sha256_t,
    ):
        raise RuntimeError("NoNE training branch rebase seal differs")
    return expected_sha256_t


def _training_branch_rebase_applied_page_ids_t_boundary(
    union: NoNETrainingBranchUnionPacket,
) -> torch.Tensor:
    """Return the exact pages that differ from the accepted target parent."""

    rebase = union.lineage_rebase
    if rebase is None:
        return union.union_page_ids_t.detach().cpu().long().clone()
    _validate_training_branch_rebase_packet_boundary(
        rebase,
        parent_session_id_t=union.parent_session_id_t,
        parent_generation_t=union.parent_generation_t,
        parent_manifest_payload_sha256_t=(
            union.parent_manifest_payload_sha256_t
        ),
        branch_scope_sha256s_t=union.branch_scope_sha256s_t,
        union_page_ids_t=union.union_page_ids_t,
        page_objects=union.page_objects,
    )
    return union.union_page_ids_t.detach().cpu().long()[
        rebase.applied_page_mask_t.detach().cpu().bool()
    ].clone()


def _training_branch_rebase_applied_page_objects_boundary(
    union: NoNETrainingBranchUnionPacket,
) -> tuple[NoNEPageObjectBinding, ...]:
    """Return staged objects while retaining subsumed pages as proof only."""

    rebase = union.lineage_rebase
    if rebase is None:
        return union.page_objects
    _training_branch_rebase_applied_page_ids_t_boundary(union)
    applied_mask_t = rebase.applied_page_mask_t.detach().cpu().bool()
    return tuple(
        binding
        for row_index, binding in enumerate(union.page_objects)
        if bool(applied_mask_t[row_index])
    )


def _page_object_map_digest_t_boundary(
    page_objects: tuple[NoNEPageObjectBinding, ...],
) -> torch.Tensor:
    """Seal one sorted immutable page map without materializing its tensors."""

    if not page_objects:
        raise ValueError("NoNE direct page-object map is empty")
    page_ids_t = torch.stack(
        tuple(
            binding.page_id_t.detach().cpu().long().reshape(())
            for binding in page_objects
        )
    )
    object_sha256s_t = torch.stack(
        tuple(
            binding.object_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(32)
            for binding in page_objects
        )
    )
    object_bytes_t = torch.stack(
        tuple(
            binding.object_bytes_t.detach().cpu().long().reshape(())
            for binding in page_objects
        )
    )
    if (
        not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
        or torch.unique(page_ids_t).numel() != page_ids_t.numel()
        or bool(object_bytes_t.le(0).any())
    ):
        raise RuntimeError("NoNE direct page-object map differs")
    digest = hashlib.sha256()
    for name, tensor in (
        ("page_ids_t", page_ids_t),
        ("object_sha256s_t", object_sha256s_t),
        ("object_bytes_t", object_bytes_t),
    ):
        stable_t = _stable_cpu_tensor(tensor)
        digest.update(name.encode("ascii") + b"\x00")
        digest.update(str(stable_t.dtype).encode("ascii") + b"\x00")
        digest.update(
            torch.tensor(stable_t.shape, dtype=torch.long)
            .numpy()
            .tobytes(order="C")
        )
        digest.update(
            stable_t.reshape(-1).view(torch.uint8).numpy().tobytes(order="C")
        )
    return digest_tensor(digest.hexdigest())


def _required_sha256_tensor_hex_boundary(
    value_t: torch.Tensor,
    *,
    label: str,
) -> str:
    """Return one exact tensor-native SHA-256 identity."""

    observed_t = value_t.detach().cpu().to(dtype=torch.uint8).reshape(-1)
    if value_t.dtype != torch.uint8 or observed_t.shape != (32,):
        raise RuntimeError(f"NoNE {label} identity differs")
    return _tensor_digest_hex(observed_t)


def all_knowledge_physical_page_ids_t_boundary() -> torch.Tensor:
    """Return the sealed generation-187 r152 physical-page floor.

    The tensor is an immutable historical floor, not a maximum. Direct
    descendants may append authenticated sparse pages above 110,581, but may
    never omit any page in this accepted scientific universe.
    """

    return torch.cat(
        (
            torch.arange(0, 1_020, dtype=torch.long),
            torch.arange(30_000, 110_582, dtype=torch.long),
        )
    )


def _require_all_knowledge_physical_page_ids_boundary(
    page_ids_t: torch.Tensor,
) -> torch.Tensor:
    """Require the sealed r152 floor while permitting sparse direct growth."""

    observed_t = page_ids_t.detach().cpu().long().reshape(-1)
    floor_t = all_knowledge_physical_page_ids_t_boundary()
    high_t = observed_t[observed_t.gt(101_000)]
    if (
        observed_t.numel() < floor_t.numel()
        or not torch.equal(observed_t, torch.sort(observed_t).values)
        or torch.unique(observed_t).numel() != observed_t.numel()
        or bool(torch.any(observed_t < 0))
        or not bool(
            _page_ids_subset_t_boundary(
                floor_t,
                observed_t,
            )
        )
        or high_t.numel() < ALL_KNOWLEDGE_PHYSICAL_PAGES_ABOVE_101000
        or int(high_t[0]) != 101_001
        or int(high_t[-1]) < ALL_KNOWLEDGE_PHYSICAL_PAGE_MAX
    ):
        raise RuntimeError("NoNE all-knowledge physical page universe differs")
    return observed_t.clone()


def _require_exact_generation_187_physical_page_ids_boundary(
    page_ids_t: torch.Tensor,
) -> torch.Tensor:
    """Require the exact sealed g187 catalog for the one-hop g188 rebuild."""

    observed_t = _require_all_knowledge_physical_page_ids_boundary(page_ids_t)
    expected_t = all_knowledge_physical_page_ids_t_boundary()
    high_t = observed_t[observed_t.gt(101_000)]
    if (
        observed_t.numel() != ALL_KNOWLEDGE_PHYSICAL_PAGE_COUNT
        or not torch.equal(observed_t, expected_t)
        or int(observed_t[-1]) != ALL_KNOWLEDGE_PHYSICAL_PAGE_MAX
        or high_t.numel() != ALL_KNOWLEDGE_PHYSICAL_PAGES_ABOVE_101000
    ):
        raise RuntimeError(
            "NoNE generation-187 physical page universe differs"
        )
    return observed_t.clone()


def _training_branch_union_digest_t_boundary(
    *,
    parent_session_id_t: torch.Tensor,
    parent_generation_t: torch.Tensor,
    parent_manifest_payload_sha256_t: torch.Tensor,
    branch_scope_sha256s_t: torch.Tensor,
    union_page_ids_t: torch.Tensor,
    union_page_layer_ids_t: torch.Tensor,
    page_objects: tuple[NoNEPageObjectBinding, ...],
    training_proof: NoNEPageTrainingProofPacket,
    model_owned_capability_state_sha256_t: torch.Tensor,
    training_data_union_sha256_t: torch.Tensor,
    global_physical_page_training_claimed_t: torch.Tensor,
    global_dataset_training_claimed_t: torch.Tensor,
    global_training_claimed_t: torch.Tensor,
    global_full_physical_page_bank_traversal_claimed_t: torch.Tensor,
    federated_growth_demand_authority_sha256_t: torch.Tensor | None = None,
    lineage_rebase_sha256_t: torch.Tensor | None = None,
) -> torch.Tensor:
    """Seal every authority-bearing tensor in one staged branch union."""

    object_page_ids_t = torch.stack(
        tuple(binding.page_id_t.reshape(()) for binding in page_objects)
    ).long()
    object_sha256s_t = torch.stack(
        tuple(binding.object_sha256_t.reshape(32) for binding in page_objects)
    ).to(dtype=torch.uint8)
    object_bytes_t = torch.stack(
        tuple(binding.object_bytes_t.reshape(()) for binding in page_objects)
    ).long()
    proof_sha256_t = page_training_proof_digest_t_boundary(training_proof)
    named_tensors: tuple[tuple[str, torch.Tensor], ...] = (
        ("parent_session_id_t", parent_session_id_t),
        ("parent_generation_t", parent_generation_t),
        (
            "parent_manifest_payload_sha256_t",
            parent_manifest_payload_sha256_t,
        ),
        ("branch_scope_sha256s_t", branch_scope_sha256s_t),
        ("union_page_ids_t", union_page_ids_t),
        ("union_page_layer_ids_t", union_page_layer_ids_t),
        ("object_page_ids_t", object_page_ids_t),
        ("object_sha256s_t", object_sha256s_t),
        ("object_bytes_t", object_bytes_t),
        ("training_proof_sha256_t", proof_sha256_t),
        (
            "model_owned_capability_state_sha256_t",
            model_owned_capability_state_sha256_t,
        ),
        ("training_data_union_sha256_t", training_data_union_sha256_t),
        (
            "global_physical_page_training_claimed_t",
            global_physical_page_training_claimed_t,
        ),
        (
            "global_dataset_training_claimed_t",
            global_dataset_training_claimed_t,
        ),
        ("global_training_claimed_t", global_training_claimed_t),
        (
            "global_full_physical_page_bank_traversal_claimed_t",
            global_full_physical_page_bank_traversal_claimed_t,
        ),
    )
    if federated_growth_demand_authority_sha256_t is not None:
        named_tensors += (
            (
                "federated_growth_demand_authority_sha256_t",
                federated_growth_demand_authority_sha256_t,
            ),
        )
    if lineage_rebase_sha256_t is not None:
        named_tensors += (
            ("lineage_rebase_sha256_t", lineage_rebase_sha256_t),
        )
    digest = hashlib.sha256()
    for name, tensor in named_tensors:
        stable = _stable_cpu_tensor(tensor)
        digest.update(name.encode("ascii") + b"\x00")
        digest.update(str(stable.dtype).encode("ascii") + b"\x00")
        digest.update(
            torch.tensor(stable.shape, dtype=torch.long)
            .numpy()
            .tobytes(order="C")
        )
        digest.update(
            stable.reshape(-1).view(torch.uint8).numpy().tobytes(order="C")
        )
    return digest_tensor(digest.hexdigest())


def _federated_training_union_authority_from_graph_boundary(
    *,
    graph_authority: NoNEGraphAuthorityBinding,
    scopes: tuple[NoNETrainingBranchScopePacket, ...],
    training_data_union: Mapping[str, Any],
) -> torch.Tensor | None:
    """Bind a branch union to the federated demand of its live graph.

    A physical federated expansion can still accept a selective, nonfederated
    training delta, but such a delta is explicitly barred from a global
    dataset-training claim.  A global claim on that graph must instead name
    the exact packed federation, tokenizer, and source-allocation authority
    that allocated its objective pages.
    """

    graph_demand_t = (
        graph_authority.federated_growth_demand_authority_sha256_t
    )
    federated_training_data = (
        training_data_union.get("windowKind")
        == "full_payload_federated_packed"
    )
    scope_demands = tuple(
        scope.federated_growth_demand_authority_sha256_t for scope in scopes
    )
    if graph_demand_t is None:
        if federated_training_data or any(
            demand_t is not None for demand_t in scope_demands
        ):
            raise RuntimeError(
                "NoNE legacy graph cannot claim federated training authority"
            )
        return None
    graph_demand_t = graph_demand_t.detach().cpu().to(dtype=torch.uint8)
    if (
        graph_demand_t.shape != (32,)
        or not scopes
        or any(
            demand_t is None
            or demand_t.shape != (32,)
            or demand_t.dtype != torch.uint8
            or not torch.equal(
                demand_t.detach().cpu().to(dtype=torch.uint8),
                graph_demand_t,
            )
            for demand_t in scope_demands
        )
    ):
        raise RuntimeError("NoNE federated branch scope authority differs")
    if not federated_training_data:
        if training_data_union.get("globalDatasetTrainingClaimed") is True:
            raise RuntimeError(
                "NoNE federated graph global claim lacks packed federation"
            )
        return graph_demand_t.clone()

    catalog_path = Path(graph_authority.page_catalog_path).expanduser().resolve()
    catalog_sha256 = _tensor_digest_hex(
        graph_authority.page_catalog_sha256_t
    )
    if (
        not catalog_path.is_file()
        or _file_sha256(catalog_path) != catalog_sha256
    ):
        raise RuntimeError("NoNE federated graph catalog identity differs")
    loaded_catalog_sha256, catalog = _read_immutable_json_cached(catalog_path)
    demand = federated_growth_demand_authority_from_catalog_boundary(catalog)
    if (
        loaded_catalog_sha256 != catalog_sha256
        or demand is None
        or not torch.equal(
            digest_tensor(str(demand["authoritySha256"])), graph_demand_t
        )
    ):
        raise RuntimeError("NoNE federated graph demand authority differs")

    collection_path_value = training_data_union.get("collectionPath")
    if not isinstance(collection_path_value, str) or not collection_path_value:
        raise RuntimeError("NoNE federated training collection is absent")
    collection_path = Path(collection_path_value).expanduser().resolve()
    if (
        not collection_path.is_file()
        or _file_sha256(collection_path)
        != training_data_union.get("collectionFileSha256")
    ):
        raise RuntimeError("NoNE federated training collection differs")
    collection = _read_json(collection_path)
    if (
        collection.get("schema")
        != FULL_PAYLOAD_FEDERATED_PACKED_COLLECTION_SCHEMA
        or collection.get("collectionAuthoritySha256")
        != demand["packedCollectionAuthoritySha256"]
        or collection.get("federationAuthoritySha256")
        != demand["federationAuthoritySha256"]
        or collection.get("federatedScheduleSha256")
        != demand["federationAuthoritySha256"]
        or collection.get("tokenizerAuthoritySha256")
        != demand["tokenizerAuthoritySha256"]
        or collection.get("contextWindowTokens")
        != demand["contextWindowTokens"]
        or collection.get("answerTokensPerWindow")
        != demand["answerTokensPerWindow"]
        or collection.get("canonicalPayloadFileCount")
        != demand["canonicalPayloadFileCount"]
        or collection.get("canonicalPayloadBytes")
        != demand["canonicalPayloadBytes"]
        or training_data_union.get("collectionAuthoritySha256")
        != demand["packedCollectionAuthoritySha256"]
        or training_data_union.get("scheduleSha256")
        != demand["federationAuthoritySha256"]
    ):
        raise RuntimeError("NoNE federated training demand collection differs")
    return graph_demand_t.clone()


def _validate_changed_page_training_proof_ids_boundary(
    page_ids_t: torch.Tensor,
    proof: NoNEPageTrainingProofPacket,
) -> torch.Tensor:
    """Require truthful retained-change proof for exact page IDs."""

    expected_page_ids_t = page_ids_t.detach().cpu().long().reshape(-1)
    proof_page_ids_t = (
        proof.family_page_ids_t.detach().cpu().long().reshape(-1)
    )
    page_count = int(expected_page_ids_t.numel())
    if (
        page_count < 1
        or torch.unique(expected_page_ids_t).numel() != page_count
        or not torch.equal(proof_page_ids_t, expected_page_ids_t)
        or proof.route_count_t.shape != (page_count,)
        or proof.gradient_update_count_t.shape != (page_count,)
        or proof.gradient_norm_t.shape != (page_count,)
        or proof.parameter_delta_norm_t.shape != (page_count,)
        or proof.gradient_signature_t.ndim != 2
        or proof.gradient_signature_t.shape[0] != page_count
        or not proof.route_count_t.detach().gt(0).all()
        or not proof.gradient_update_count_t.detach().gt(0).all()
        or not torch.isfinite(proof.gradient_norm_t.detach()).all()
        or not proof.gradient_norm_t.detach().gt(0).all()
        or not torch.isfinite(proof.parameter_delta_norm_t.detach()).all()
        or not proof.parameter_delta_norm_t.detach().gt(0).all()
        or not torch.isfinite(proof.gradient_signature_t.detach()).all()
        or proof.route_coverage_t.numel() != 1
        or not bool(proof.route_coverage_t.detach().cpu().bool().reshape(()))
        or proof.gradient_coverage_t.numel() != 1
        or not bool(proof.gradient_coverage_t.detach().cpu().bool().reshape(()))
        or proof.distinct_gradient_t.numel() != 1
        or proof.finite_t.numel() != 1
        or not bool(proof.finite_t.detach().cpu().bool().reshape(()))
        or proof.promotion_ready_t.numel() != 1
    ):
        raise RuntimeError("NoNE page training proof is incomplete")
    recomputed = combine_page_training_proofs((proof,))
    if any(
        not torch.equal(
            getattr(recomputed, field).detach().cpu().bool().reshape(()),
            getattr(proof, field).detach().cpu().bool().reshape(()),
        )
        for field in (
            "route_coverage_t",
            "gradient_coverage_t",
            "distinct_gradient_t",
            "finite_t",
            "promotion_ready_t",
        )
    ):
        raise RuntimeError("NoNE page training proof flags differ")
    return page_training_proof_digest_t_boundary(proof)


def _validate_page_training_proof_ids_boundary(
    page_ids_t: torch.Tensor,
    proof: NoNEPageTrainingProofPacket,
) -> torch.Tensor:
    """Require promotion-ready proof for exact page IDs."""

    proof_sha256_t = _validate_changed_page_training_proof_ids_boundary(
        page_ids_t,
        proof,
    )
    if (
        not bool(proof.distinct_gradient_t.detach().cpu().bool().reshape(()))
        or not bool(proof.promotion_ready_t.detach().cpu().bool().reshape(()))
    ):
        raise RuntimeError("NoNE page training proof is incomplete")
    return proof_sha256_t


def _page_ids_subset_t_boundary(
    candidate_page_ids_t: torch.Tensor,
    accepted_page_ids_t: torch.Tensor,
) -> torch.Tensor:
    """Return whether every candidate page has an accepted immutable ID.

    Branch admission is an external integrity boundary, not a model routing
    operation.  The former broadcast comparison materialized one boolean cell
    per candidate/accepted pair.  At the current full-CAS scope that meant
    billions of cells before the first CUDA update.  Sorting the immutable
    catalog once and using tensor-native binary lookup preserves the exact
    membership rule while keeping startup proportional to the two ID vectors.
    """

    candidates = (
        candidate_page_ids_t.detach().cpu().long().reshape(-1).contiguous()
    )
    accepted = (
        accepted_page_ids_t.detach()
        .cpu()
        .long()
        .reshape(-1)
        .contiguous()
    )
    # Sealed scope and manifest records are canonical ascending tensors. Avoid
    # re-running the parallel stable-sort kernel for every generation in a
    # retained lineage; only non-canonical boundary input pays the sort cost.
    if accepted.numel() > 1 and not bool(
        accepted[1:].ge(accepted[:-1]).all()
    ):
        accepted = torch.sort(accepted).values
    if accepted.numel() == 0:
        return torch.tensor(candidates.numel() == 0, dtype=torch.bool)
    positions = torch.searchsorted(accepted, candidates)
    accepted_with_sentinel = torch.cat(
        (accepted, accepted.new_full((1,), -1)),
    )
    return torch.logical_and(
        positions.ne(accepted.numel()),
        accepted_with_sentinel.index_select(0, positions).eq(candidates),
    ).all().reshape(())


def _validate_training_branch_proof_boundary(
    scope: NoNETrainingBranchScopePacket,
    proof: NoNEPageTrainingProofPacket,
) -> torch.Tensor:
    """Bind one nonempty retained-change proof inside a sealed owner scope."""

    validate_training_branch_scope_boundary(scope)
    proof_page_ids_t = (
        proof.family_page_ids_t.detach().cpu().long().reshape(-1)
    )
    if (
        proof_page_ids_t.numel() < 1
        or torch.unique(proof_page_ids_t).numel()
        != proof_page_ids_t.numel()
        or not bool(
            _page_ids_subset_t_boundary(proof_page_ids_t, scope.page_ids_t)
        )
    ):
        raise RuntimeError(
            "NoNE training branch proof exceeds its ownership scope"
        )
    return _validate_changed_page_training_proof_ids_boundary(
        proof_page_ids_t,
        proof,
    )


def _validate_complete_training_branch_result_proof_boundary(
    scope: NoNETrainingBranchScopePacket,
    proof: NoNEPageTrainingProofPacket,
) -> torch.Tensor:
    """Require positive retained proof for every page in one owner scope."""

    proof_sha256_t = _validate_training_branch_proof_boundary(scope, proof)
    scoped_page_ids_t = torch.sort(
        scope.page_ids_t.detach().cpu().long().reshape(-1)
    ).values
    proof_page_ids_t = torch.sort(
        proof.family_page_ids_t.detach().cpu().long().reshape(-1)
    ).values
    if (
        proof_page_ids_t.shape != scoped_page_ids_t.shape
        or not torch.equal(proof_page_ids_t, scoped_page_ids_t)
    ):
        raise RuntimeError(
            "NoNE training branch result lacks complete owner-scope proof"
        )
    return proof_sha256_t


def _validate_cumulative_training_branch_result_proof_boundary(
    scope: NoNETrainingBranchScopePacket,
    proof: NoNEPageTrainingProofPacket,
) -> torch.Tensor:
    """Validate scope-shaped cumulative evidence before changed-page projection."""

    validate_training_branch_scope_boundary(scope)
    scoped_page_ids_t = scope.page_ids_t.detach().cpu().long().reshape(-1)
    proof_page_ids_t = (
        proof.family_page_ids_t.detach().cpu().long().reshape(-1)
    )
    page_count = int(scoped_page_ids_t.numel())
    if (
        page_count < 1
        or not torch.equal(proof_page_ids_t, scoped_page_ids_t)
        or proof.route_count_t.shape != (page_count,)
        or proof.gradient_update_count_t.shape != (page_count,)
        or proof.gradient_norm_t.shape != (page_count,)
        or proof.parameter_delta_norm_t.shape != (page_count,)
        or proof.gradient_signature_t.ndim != 2
        or proof.gradient_signature_t.shape[0] != page_count
        or bool(proof.route_count_t.detach().lt(0).any())
        or bool(proof.gradient_update_count_t.detach().lt(0).any())
        or not torch.isfinite(proof.gradient_norm_t.detach()).all()
        or bool(proof.gradient_norm_t.detach().lt(0).any())
        or not torch.isfinite(proof.parameter_delta_norm_t.detach()).all()
        or bool(proof.parameter_delta_norm_t.detach().lt(0).any())
        or not torch.isfinite(proof.gradient_signature_t.detach()).all()
        or any(
            tensor.numel() != 1
            for tensor in (
                proof.route_coverage_t,
                proof.gradient_coverage_t,
                proof.distinct_gradient_t,
                proof.finite_t,
                proof.promotion_ready_t,
            )
        )
    ):
        raise RuntimeError(
            "NoNE cumulative training branch proof is malformed"
        )
    recomputed = combine_page_training_proofs((proof,))
    if any(
        not torch.equal(
            getattr(recomputed, field).detach().cpu().bool().reshape(()),
            getattr(proof, field).detach().cpu().bool().reshape(()),
        )
        for field in (
            "route_coverage_t",
            "gradient_coverage_t",
            "distinct_gradient_t",
            "finite_t",
            "promotion_ready_t",
        )
    ):
        raise RuntimeError("NoNE cumulative training branch proof flags differ")
    return page_training_proof_digest_t_boundary(proof)


def _select_page_training_proof_boundary(
    proof: NoNEPageTrainingProofPacket,
    page_ids_t: torch.Tensor,
) -> NoNEPageTrainingProofPacket:
    """Project one validated proof onto exact retained page identities."""

    proof_page_ids_t = proof.family_page_ids_t.detach().cpu().long().reshape(-1)
    selected_page_ids_t = torch.sort(
        page_ids_t.detach().cpu().long().reshape(-1)
    ).values
    matches_t = selected_page_ids_t.unsqueeze(1).eq(
        proof_page_ids_t.unsqueeze(0)
    )
    if (
        selected_page_ids_t.numel() < 1
        or torch.unique(selected_page_ids_t).numel()
        != selected_page_ids_t.numel()
        or not matches_t.sum(dim=1).eq(1).all()
    ):
        raise RuntimeError("NoNE retained page proof projection differs")
    indexes_t = matches_t.to(dtype=torch.long).argmax(dim=1)
    selected = NoNEPageTrainingProofPacket(
        family_page_ids_t=proof_page_ids_t.index_select(0, indexes_t),
        route_count_t=proof.route_count_t.index_select(
            0,
            indexes_t.to(device=proof.route_count_t.device),
        ),
        gradient_update_count_t=proof.gradient_update_count_t.index_select(
            0,
            indexes_t.to(device=proof.gradient_update_count_t.device),
        ),
        gradient_norm_t=proof.gradient_norm_t.index_select(
            0,
            indexes_t.to(device=proof.gradient_norm_t.device),
        ),
        parameter_delta_norm_t=proof.parameter_delta_norm_t.index_select(
            0,
            indexes_t.to(device=proof.parameter_delta_norm_t.device),
        ),
        gradient_signature_t=proof.gradient_signature_t.index_select(
            0,
            indexes_t.to(device=proof.gradient_signature_t.device),
        ),
        route_coverage_t=proof.route_coverage_t,
        gradient_coverage_t=proof.gradient_coverage_t,
        distinct_gradient_t=proof.distinct_gradient_t,
        finite_t=proof.finite_t,
        promotion_ready_t=proof.promotion_ready_t,
    )
    projected = combine_page_training_proofs((selected,))
    _validate_changed_page_training_proof_ids_boundary(
        selected_page_ids_t,
        projected,
    )
    return projected


def _same_generation_binding_boundary(
    left: NoNEGenerationBinding,
    right: NoNEGenerationBinding,
) -> bool:
    return bool(
        torch.equal(left.session_id_t, right.session_id_t)
        and torch.equal(left.generation_t, right.generation_t)
        and torch.equal(left.parent_generation_t, right.parent_generation_t)
        and torch.equal(left.manifest_sha256_t, right.manifest_sha256_t)
        and torch.equal(
            left.manifest_payload_sha256_t,
            right.manifest_payload_sha256_t,
        )
        and torch.equal(left.updated_page_ids_t, right.updated_page_ids_t)
        and left.manifest_relative_path == right.manifest_relative_path
    )


def _same_page_bundle_boundary(
    left: NoNEPageBundle,
    right: NoNEPageBundle,
) -> bool:
    """Compare actual weights, capability memories, moments, and optimizer step."""

    validate_page_bundle(left)
    validate_page_bundle(right)

    def same_tensor(left_t: torch.Tensor, right_t: torch.Tensor) -> bool:
        return bool(
            left_t.shape == right_t.shape
            and left_t.dtype == right_t.dtype
            and torch.equal(left_t.detach().cpu(), right_t.detach().cpu())
        )

    if not same_tensor(left.weights.page_ids_t, right.weights.page_ids_t):
        return False
    if any(
        not same_tensor(
            cast(torch.Tensor, getattr(left.weights, name)),
            cast(torch.Tensor, getattr(right.weights, name)),
        )
        for name in _PAGE_WEIGHT_TENSOR_NAMES
    ):
        return False
    left_implicit = _optimizer_state_is_implicit_zero_boundary(left)
    right_implicit = _optimizer_state_is_implicit_zero_boundary(right)
    moments_equal = bool(
        left.optimizer_mean_t.shape == right.optimizer_mean_t.shape
        and left.optimizer_square_t.shape == right.optimizer_square_t.shape
        and (
            (left_implicit and right_implicit)
            or (
                same_tensor(left.optimizer_mean_t, right.optimizer_mean_t)
                and same_tensor(
                    left.optimizer_square_t,
                    right.optimizer_square_t,
                )
            )
        )
    )
    return bool(moments_equal and same_tensor(left.step_t, right.step_t))


def _same_page_object_binding_boundary(
    left: NoNEPageObjectBinding,
    right: NoNEPageObjectBinding,
) -> bool:
    """Compare one immutable page identity at the storage boundary."""

    return bool(
        torch.equal(
            left.page_id_t.detach().cpu().long().reshape(()),
            right.page_id_t.detach().cpu().long().reshape(()),
        )
        and torch.equal(
            left.object_sha256_t.detach().cpu().to(dtype=torch.uint8),
            right.object_sha256_t.detach().cpu().to(dtype=torch.uint8),
        )
        and torch.equal(
            left.object_bytes_t.detach().cpu().long().reshape(()),
            right.object_bytes_t.detach().cpu().long().reshape(()),
        )
    )


def _three_way_merge_training_page_bundle_boundary(
    *,
    source_parent: NoNEPageBundle,
    target_parent: NoNEPageBundle,
    branch_terminal: NoNEPageBundle,
) -> NoNEPageBundle:
    """Preserve live state while applying one historical branch delta.

    The immutable source parent is the common base. Floating-point learned
    page tensors use the explicit three-way algebra
    ``target + (branch - source)`` in a safe compute dtype before returning to
    their exact storage dtype. Optimizer steps add only the branch's
    nonnegative advance to the target step. Page identity and the
    non-trainable FFN mode must remain identical across all three inputs.
    Explicit optimizer moments cannot be composed from two independently
    advanced histories, so a true conflict accepts only the stateless
    implicit-zero layout used by the r152 external-page optimizer.
    """

    for bundle in (source_parent, target_parent, branch_terminal):
        validate_page_bundle(bundle)
    if (
        not torch.equal(
            source_parent.weights.page_ids_t,
            target_parent.weights.page_ids_t,
        )
        or not torch.equal(
            source_parent.weights.page_ids_t,
            branch_terminal.weights.page_ids_t,
        )
        or not torch.equal(
            source_parent.weights.ffn_mode_t,
            target_parent.weights.ffn_mode_t,
        )
        or not torch.equal(
            source_parent.weights.ffn_mode_t,
            branch_terminal.weights.ffn_mode_t,
        )
    ):
        raise RuntimeError(
            "NoNE training branch rebase structural page state conflicts"
        )

    if _same_page_bundle_boundary(target_parent, branch_terminal):
        return target_parent
    if _same_page_bundle_boundary(source_parent, branch_terminal):
        return target_parent
    if _same_page_bundle_boundary(source_parent, target_parent):
        return branch_terminal
    if not all(
        _optimizer_state_is_implicit_zero_boundary(bundle)
        for bundle in (source_parent, target_parent, branch_terminal)
    ):
        raise RuntimeError(
            "NoNE training branch rebase explicit optimizer moments conflict"
        )

    def additive_tensor(
        source_t: torch.Tensor,
        target_t: torch.Tensor,
        branch_t: torch.Tensor,
    ) -> torch.Tensor:
        if (
            source_t.shape != target_t.shape
            or source_t.shape != branch_t.shape
            or source_t.dtype != target_t.dtype
            or source_t.dtype != branch_t.dtype
            or not source_t.is_floating_point()
        ):
            raise RuntimeError(
                "NoNE training branch rebase tensor geometry conflicts"
            )
        compute_dtype = (
            torch.float64
            if source_t.dtype == torch.float64
            else torch.float32
        )
        source_compute_t = source_t.detach().to(
            device=target_t.device,
            dtype=compute_dtype,
        )
        target_compute_t = target_t.detach().to(dtype=compute_dtype)
        branch_compute_t = branch_t.detach().to(
            device=target_t.device,
            dtype=compute_dtype,
        )
        if not all(
            bool(torch.isfinite(value_t).all())
            for value_t in (
                source_compute_t,
                target_compute_t,
                branch_compute_t,
            )
        ):
            raise RuntimeError(
                "NoNE training branch rebase produced nonfinite tensors"
            )
        merged_compute_t = target_compute_t + (
            branch_compute_t - source_compute_t
        )
        merged_t = merged_compute_t.to(dtype=target_t.dtype)
        if (
            not bool(torch.isfinite(merged_compute_t).all())
            or not bool(torch.isfinite(merged_t).all())
        ):
            raise RuntimeError(
                "NoNE training branch rebase produced nonfinite tensors"
            )
        return merged_t

    weight_names = tuple(
        name for name in _PAGE_WEIGHT_TENSOR_NAMES if name != "ffn_mode_t"
    )
    merged_weights = replace(
        target_parent.weights,
        **{
            name: additive_tensor(
                cast(torch.Tensor, getattr(source_parent.weights, name)),
                cast(torch.Tensor, getattr(target_parent.weights, name)),
                cast(torch.Tensor, getattr(branch_terminal.weights, name)),
            )
            for name in weight_names
        },
    )
    source_step_t = source_parent.step_t.detach().to(
        device=target_parent.step_t.device,
        dtype=torch.long,
    )
    target_step_t = target_parent.step_t.detach().long()
    branch_step_t = branch_terminal.step_t.detach().to(
        device=target_parent.step_t.device,
        dtype=torch.long,
    )
    if any(
        bundle.step_t.dtype != torch.long
        for bundle in (source_parent, target_parent, branch_terminal)
    ):
        raise RuntimeError(
            "NoNE training branch rebase optimizer step dtype differs"
        )
    branch_step_delta_t = branch_step_t - source_step_t
    target_step_delta_t = target_step_t - source_step_t
    maximum_step_t = torch.full_like(
        target_step_t,
        torch.iinfo(torch.long).max,
    )
    if (
        bool(source_step_t.lt(0).any())
        or bool(branch_step_delta_t.lt(0).any())
        or bool(target_step_delta_t.lt(0).any())
        or bool(
            branch_step_delta_t.gt(maximum_step_t - target_step_t).any()
        )
    ):
        raise RuntimeError(
            "NoNE training branch rebase optimizer step regressed"
        )
    merged_step_t = target_step_t + branch_step_delta_t
    if (
        bool(merged_step_t.lt(target_step_t).any())
        or bool(merged_step_t.lt(branch_step_t).any())
    ):
        raise RuntimeError(
            "NoNE training branch rebase optimizer step regressed"
        )
    page_count = int(merged_weights.page_ids_t.numel())
    flat_width = _flat_parameter_width(merged_weights)
    merged = NoNEPageBundle(
        weights=merged_weights,
        optimizer_mean_t=_implicit_zero_optimizer_matrix_boundary(
            page_count=page_count,
            flat_width=flat_width,
            device=target_parent.optimizer_mean_t.device,
        ),
        optimizer_square_t=_implicit_zero_optimizer_matrix_boundary(
            page_count=page_count,
            flat_width=flat_width,
            device=target_parent.optimizer_square_t.device,
        ),
        step_t=merged_step_t,
    )
    validate_page_bundle(merged)
    return merged


def _three_way_reconcile_historical_page_bundle_boundary(
    *,
    source_parent: NoNEPageBundle,
    target_parent: NoNEPageBundle,
    branch_terminal: NoNEPageBundle,
) -> NoNEHistoricalPageMergePacket:
    """Merge disconnected learned tensors without inventing Adam history.

    The ordinary branch merge preserves exact explicit optimizer moments when
    only one history advanced and rejects two independently advanced moment
    streams. Historical reconciliation must still retain both learned weight
    deltas. In that one irreducible case, this boundary performs the same exact
    tensor algebra with compact zero moments, records the reinitialization, and
    retains the additive monotonic optimizer step. No weight, capability
    memory, or update count is discarded.
    """

    try:
        merged = _three_way_merge_training_page_bundle_boundary(
            source_parent=source_parent,
            target_parent=target_parent,
            branch_terminal=branch_terminal,
        )
        return NoNEHistoricalPageMergePacket(
            bundle=merged,
            optimizer_moments_reinitialized_t=torch.zeros(
                (),
                dtype=torch.bool,
            ),
        )
    except RuntimeError as error:
        if str(error) != (
            "NoNE training branch rebase explicit optimizer moments conflict"
        ):
            raise

    def stateless(bundle: NoNEPageBundle) -> NoNEPageBundle:
        validate_page_bundle(bundle)
        page_count = int(bundle.weights.page_ids_t.numel())
        flat_width = _flat_parameter_width(bundle.weights)
        return replace(
            bundle,
            optimizer_mean_t=_implicit_zero_optimizer_matrix_boundary(
                page_count=page_count,
                flat_width=flat_width,
                device=bundle.optimizer_mean_t.device,
            ),
            optimizer_square_t=_implicit_zero_optimizer_matrix_boundary(
                page_count=page_count,
                flat_width=flat_width,
                device=bundle.optimizer_square_t.device,
            ),
        )

    merged = _three_way_merge_training_page_bundle_boundary(
        source_parent=stateless(source_parent),
        target_parent=stateless(target_parent),
        branch_terminal=stateless(branch_terminal),
    )
    return NoNEHistoricalPageMergePacket(
        bundle=merged,
        optimizer_moments_reinitialized_t=torch.ones(
            (),
            dtype=torch.bool,
        ),
    )


def _historical_page_delta_segment_digest_t_boundary(
    segment: NoNEHistoricalPageDeltaSegmentPacket,
) -> torch.Tensor:
    """Seal one immutable historical segment and its external provenance."""

    if not isinstance(segment, NoNEHistoricalPageDeltaSegmentPacket):
        raise TypeError("NoNE historical page segment is malformed")
    source = segment.source_generation
    terminal = segment.terminal_generation
    provenance_t = (
        segment.provenance_sha256_t.detach().cpu().to(dtype=torch.uint8)
    )
    if (
        source.session_id_t.dtype != torch.long
        or terminal.session_id_t.dtype != torch.long
        or not torch.equal(source.session_id_t, terminal.session_id_t)
        or int(terminal.generation_t) <= int(source.generation_t)
        or provenance_t.shape != (32,)
    ):
        raise RuntimeError("NoNE historical page segment identity differs")
    record = {
        "sourceStoreRoot": str(segment.source_store.root),
        "sessionId": source.session_id_t.detach().cpu().long().tolist(),
        "sourceGeneration": int(source.generation_t),
        "sourceManifestSha256": _tensor_digest_hex(
            source.manifest_sha256_t
        ),
        "sourceManifestPayloadSha256": _tensor_digest_hex(
            source.manifest_payload_sha256_t
        ),
        "terminalGeneration": int(terminal.generation_t),
        "terminalManifestSha256": _tensor_digest_hex(
            terminal.manifest_sha256_t
        ),
        "terminalManifestPayloadSha256": _tensor_digest_hex(
            terminal.manifest_payload_sha256_t
        ),
        "provenanceSha256": _tensor_digest_hex(provenance_t),
    }
    return digest_tensor(
        hashlib.sha256(_canonical_json_bytes(record)).hexdigest()
    )


def _validate_training_branch_union_packet_boundary(
    union: NoNETrainingBranchUnionPacket,
) -> torch.Tensor:
    """Fail closed if any staged-union tensor or content binding changed."""

    if not isinstance(union, NoNETrainingBranchUnionPacket):
        raise TypeError("NoNE training branch union packet is malformed")
    page_ids_t = union.union_page_ids_t.detach().cpu().long().reshape(-1)
    page_count = int(page_ids_t.numel())
    scope_sha256s_t = (
        union.branch_scope_sha256s_t.detach().cpu().to(dtype=torch.uint8)
    )
    training_data_union, training_data_union_sha256_t = (
        _training_data_union_record_from_tensor_boundary(
            union.training_data_union_json_t
        )
    )
    federated_training_data_union = (
        training_data_union.get("windowKind")
        == "full_payload_federated_packed"
    )
    expected_dataset_training_claim = bool(
        training_data_union["globalDatasetTrainingClaimed"]
    )
    object_page_ids_t = torch.stack(
        tuple(binding.page_id_t.detach().cpu().long().reshape(()) for binding in union.page_objects)
    )
    if (
        page_count < 1
        or union.union_page_ids_t.dtype != torch.long
        or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
        or torch.unique(page_ids_t).numel() != page_count
        or union.union_page_layer_ids_t.shape != (page_count,)
        or union.union_page_layer_ids_t.dtype != torch.long
        or bool(union.union_page_layer_ids_t.detach().cpu().lt(0).any())
        or scope_sha256s_t.ndim != 2
        or scope_sha256s_t.shape[0] < 1
        or scope_sha256s_t.shape[1] != 32
        or torch.unique(scope_sha256s_t, dim=0).shape[0]
        != scope_sha256s_t.shape[0]
        or len(union.page_objects) != page_count
        or not torch.equal(object_page_ids_t, page_ids_t)
        or any(
            binding.object_sha256_t.shape != (32,)
            or binding.object_sha256_t.dtype != torch.uint8
            or binding.object_bytes_t.numel() != 1
            or not bool(binding.object_bytes_t.detach().cpu().long().gt(0))
            for binding in union.page_objects
        )
        or union.model_owned_capability_state_t.ndim < 3
        or union.model_owned_capability_state_t.shape[0] != page_count
        or union.model_owned_capability_state_t.shape[1] != 3
        or not torch.isfinite(
            union.model_owned_capability_state_t.detach()
        ).all()
        or union.model_owned_capability_state_sha256_t.shape != (32,)
        or union.model_owned_capability_state_sha256_t.dtype != torch.uint8
        or not torch.equal(
            _tensor_payload_digest_t_boundary(
                union.model_owned_capability_state_t
            ),
            union.model_owned_capability_state_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
        )
        or union.training_data_union_sha256_t.shape != (32,)
        or union.training_data_union_sha256_t.dtype != torch.uint8
        or not torch.equal(
            union.training_data_union_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
            training_data_union_sha256_t,
        )
        or (
            federated_training_data_union
            and union.federated_growth_demand_authority_sha256_t is None
        )
        or (
            union.federated_growth_demand_authority_sha256_t is not None
            and (
                union.federated_growth_demand_authority_sha256_t.shape
                != (32,)
                or union.federated_growth_demand_authority_sha256_t.dtype
                != torch.uint8
            )
        )
        or union.global_physical_page_training_claimed_t.numel() != 1
        or union.global_physical_page_training_claimed_t.dtype != torch.bool
        or union.global_dataset_training_claimed_t.numel() != 1
        or union.global_dataset_training_claimed_t.dtype != torch.bool
        or union.global_training_claimed_t.numel() != 1
        or union.global_training_claimed_t.dtype != torch.bool
        or union.global_full_physical_page_bank_traversal_claimed_t.numel()
        != 1
        or union.global_full_physical_page_bank_traversal_claimed_t.dtype
        != torch.bool
        or bool(
            union.global_dataset_training_claimed_t.detach().cpu().bool()
        )
        != expected_dataset_training_claim
        or bool(union.global_training_claimed_t.detach().cpu().bool())
        != bool(
            union.global_physical_page_training_claimed_t.detach()
            .cpu()
            .bool()
            and union.global_dataset_training_claimed_t.detach()
            .cpu()
            .bool()
        )
        or not torch.equal(
            union.global_full_physical_page_bank_traversal_claimed_t.detach()
            .cpu()
            .bool(),
            union.global_physical_page_training_claimed_t.detach()
            .cpu()
            .bool(),
        )
    ):
        raise RuntimeError("NoNE training branch union tensors differ")
    proof_sha256_t = _validate_changed_page_training_proof_ids_boundary(
        page_ids_t,
        union.training_proof,
    )
    lineage_rebase_sha256_t = (
        _validate_training_branch_rebase_packet_boundary(
            union.lineage_rebase,
            parent_session_id_t=union.parent_session_id_t,
            parent_generation_t=union.parent_generation_t,
            parent_manifest_payload_sha256_t=(
                union.parent_manifest_payload_sha256_t
            ),
            branch_scope_sha256s_t=union.branch_scope_sha256s_t,
            union_page_ids_t=union.union_page_ids_t,
            page_objects=union.page_objects,
        )
        if union.lineage_rebase is not None
        else None
    )
    expected_union_sha256_t = _training_branch_union_digest_t_boundary(
        parent_session_id_t=union.parent_session_id_t,
        parent_generation_t=union.parent_generation_t,
        parent_manifest_payload_sha256_t=(
            union.parent_manifest_payload_sha256_t
        ),
        branch_scope_sha256s_t=union.branch_scope_sha256s_t,
        union_page_ids_t=union.union_page_ids_t,
        union_page_layer_ids_t=union.union_page_layer_ids_t,
        page_objects=union.page_objects,
        training_proof=union.training_proof,
        model_owned_capability_state_sha256_t=(
            union.model_owned_capability_state_sha256_t
        ),
        training_data_union_sha256_t=union.training_data_union_sha256_t,
        global_physical_page_training_claimed_t=(
            union.global_physical_page_training_claimed_t
        ),
        global_dataset_training_claimed_t=(
            union.global_dataset_training_claimed_t
        ),
        global_training_claimed_t=union.global_training_claimed_t,
        global_full_physical_page_bank_traversal_claimed_t=(
            union.global_full_physical_page_bank_traversal_claimed_t
        ),
        federated_growth_demand_authority_sha256_t=(
            union.federated_growth_demand_authority_sha256_t
        ),
        lineage_rebase_sha256_t=lineage_rebase_sha256_t,
    )
    if (
        union.union_sha256_t.shape != (32,)
        or union.union_sha256_t.dtype != torch.uint8
        or not torch.equal(
            union.union_sha256_t.detach().cpu(),
            expected_union_sha256_t,
        )
    ):
        raise RuntimeError("NoNE training branch union seal differs")
    return proof_sha256_t


def training_branch_rebase_proof_record_boundary(
    rebase: NoNETrainingBranchRebasePacket,
    *,
    parent_session_id_t: torch.Tensor,
    branch_scope_sha256s_t: torch.Tensor,
    page_objects: tuple[NoNEPageObjectBinding, ...],
) -> dict[str, Any]:
    """Serialize one exact lineage rebase at the immutable proof boundary."""

    _validate_training_branch_rebase_packet_boundary(
        rebase,
        parent_session_id_t=parent_session_id_t,
        parent_generation_t=rebase.target_parent_generation_t,
        parent_manifest_payload_sha256_t=(
            rebase.target_parent_manifest_payload_sha256_t
        ),
        branch_scope_sha256s_t=branch_scope_sha256s_t,
        union_page_ids_t=rebase.training_page_ids_t,
        page_objects=page_objects,
    )
    page_ids_t = rebase.training_page_ids_t.detach().cpu().long()
    applied_mask_t = rebase.applied_page_mask_t.detach().cpu().bool()
    resealed_mask_t = rebase.resealed_page_mask_t.detach().cpu().bool()
    storage_normalized_mask_t = (
        rebase.storage_normalized_page_mask_t.detach().cpu().bool()
    )
    return {
        "schema": TRAINING_BRANCH_UNION_REBASE_SCHEMA,
        "sourceParentGeneration": int(rebase.source_parent_generation_t),
        "sourceParentManifestPayloadSha256": _tensor_digest_hex(
            rebase.source_parent_manifest_payload_sha256_t
        ),
        "targetParentGeneration": int(rebase.target_parent_generation_t),
        "targetParentManifestPayloadSha256": _tensor_digest_hex(
            rebase.target_parent_manifest_payload_sha256_t
        ),
        "branchSourceGenerations": (
            rebase.branch_source_generations_t.detach().cpu().long().tolist()
        ),
        "branchSourceManifestSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.branch_source_manifest_sha256s_t.detach().cpu()
        ],
        "branchSourceManifestPayloadSha256s": [
            _tensor_digest_hex(row)
            for row in (
                rebase.branch_source_manifest_payload_sha256s_t.detach().cpu()
            )
        ],
        "branchSourceExternalStateSha256s": [
            _tensor_digest_hex(row)
            for row in (
                rebase.branch_source_external_state_sha256s_t.detach().cpu()
            )
        ],
        "branchSourceOptimizerSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.branch_source_optimizer_sha256s_t.detach().cpu()
        ],
        "trainingPageIds": page_ids_t.tolist(),
        "pageBranchIndices": (
            rebase.page_branch_indices_t.detach().cpu().long().tolist()
        ),
        "sourceParentObjectSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.source_parent_object_sha256s_t.detach().cpu()
        ],
        "sourceParentObjectBytes": (
            rebase.source_parent_object_bytes_t.detach().cpu().long().tolist()
        ),
        "targetParentObjectSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.target_parent_object_sha256s_t.detach().cpu()
        ],
        "targetParentObjectBytes": (
            rebase.target_parent_object_bytes_t.detach().cpu().long().tolist()
        ),
        "lineageWitnessGenerations": (
            rebase.lineage_witness_generations_t.detach().cpu().long().tolist()
        ),
        "lineageWitnessObjectSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.lineage_witness_object_sha256s_t.detach().cpu()
        ],
        "lineageWitnessObjectBytes": (
            rebase.lineage_witness_object_bytes_t.detach()
            .cpu()
            .long()
            .tolist()
        ),
        "branchObjectSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.branch_object_sha256s_t.detach().cpu()
        ],
        "branchObjectBytes": (
            rebase.branch_object_bytes_t.detach().cpu().long().tolist()
        ),
        "appliedPageIds": page_ids_t[applied_mask_t].tolist(),
        "subsumedPageIds": page_ids_t[~applied_mask_t].tolist(),
        "resealedPageIds": page_ids_t[resealed_mask_t].tolist(),
        "storageNormalizedSubsumedPageIds": (
            page_ids_t[storage_normalized_mask_t].tolist()
        ),
        "finalObjectSha256s": [
            _tensor_digest_hex(row)
            for row in rebase.final_object_sha256s_t.detach().cpu()
        ],
        "finalObjectBytes": (
            rebase.final_object_bytes_t.detach().cpu().long().tolist()
        ),
        "conflictPageIds": page_ids_t[resealed_mask_t].tolist(),
        "acceptedPointerMutationAuthority": False,
        "rebaseSha256": _tensor_digest_hex(rebase.rebase_sha256_t),
    }


def _training_branch_rebase_packet_from_record_boundary(
    record: Mapping[str, Any],
) -> NoNETrainingBranchRebasePacket:
    """Decode a rebase sidecar record back into its tensor-native proof."""

    training_page_ids = record.get("trainingPageIds")
    applied_page_ids = record.get("appliedPageIds")
    subsumed_page_ids = record.get("subsumedPageIds")
    resealed_page_ids = record.get("resealedPageIds")
    storage_normalized_page_ids = record.get(
        "storageNormalizedSubsumedPageIds"
    )
    conflict_page_ids = record.get("conflictPageIds")
    if (
        record.get("schema") != TRAINING_BRANCH_UNION_REBASE_SCHEMA
        or not isinstance(training_page_ids, list)
        or not training_page_ids
        or training_page_ids != sorted(set(training_page_ids))
        or not isinstance(applied_page_ids, list)
        or not isinstance(subsumed_page_ids, list)
        or not isinstance(resealed_page_ids, list)
        or not isinstance(storage_normalized_page_ids, list)
        or not isinstance(conflict_page_ids, list)
        or applied_page_ids != sorted(set(applied_page_ids))
        or subsumed_page_ids != sorted(set(subsumed_page_ids))
        or resealed_page_ids != sorted(set(resealed_page_ids))
        or storage_normalized_page_ids
        != sorted(set(storage_normalized_page_ids))
        or conflict_page_ids != sorted(set(conflict_page_ids))
        or any(
            not isinstance(page_id, int) or isinstance(page_id, bool)
            for values in (
                training_page_ids,
                applied_page_ids,
                subsumed_page_ids,
                resealed_page_ids,
                storage_normalized_page_ids,
                conflict_page_ids,
            )
            for page_id in values
        )
        or set(applied_page_ids) | set(subsumed_page_ids)
        != set(training_page_ids)
        or set(applied_page_ids) & set(subsumed_page_ids)
        or not set(resealed_page_ids).issubset(applied_page_ids)
        or not set(storage_normalized_page_ids).issubset(
            subsumed_page_ids
        )
        or conflict_page_ids != resealed_page_ids
        or record.get("acceptedPointerMutationAuthority") is not False
    ):
        raise RuntimeError("NoNE training branch rebase record differs")
    page_index = {
        int(page_id): row_index
        for row_index, page_id in enumerate(training_page_ids)
    }
    applied_mask_t = torch.zeros(len(training_page_ids), dtype=torch.bool)
    resealed_mask_t = torch.zeros(len(training_page_ids), dtype=torch.bool)
    storage_normalized_mask_t = torch.zeros(
        len(training_page_ids),
        dtype=torch.bool,
    )
    try:
        applied_mask_t[
            torch.tensor(
                [page_index[int(page_id)] for page_id in applied_page_ids],
                dtype=torch.long,
            )
        ] = True
        resealed_mask_t[
            torch.tensor(
                [page_index[int(page_id)] for page_id in resealed_page_ids],
                dtype=torch.long,
            )
        ] = True
        storage_normalized_mask_t[
            torch.tensor(
                [
                    page_index[int(page_id)]
                    for page_id in storage_normalized_page_ids
                ],
                dtype=torch.long,
            )
        ] = True

        def digest_rows(name: str) -> torch.Tensor:
            values = record.get(name)
            if not isinstance(values, list):
                raise RuntimeError(
                    "NoNE training branch rebase record differs"
                )
            return torch.stack(
                tuple(digest_tensor(str(value)) for value in values),
                dim=0,
            )

        def long_rows(name: str) -> torch.Tensor:
            values = record.get(name)
            if (
                not isinstance(values, list)
                or any(
                    not isinstance(value, int) or isinstance(value, bool)
                    for value in values
                )
            ):
                raise RuntimeError(
                    "NoNE training branch rebase record differs"
                )
            return torch.tensor(values, dtype=torch.long)

        packet = NoNETrainingBranchRebasePacket(
            source_parent_generation_t=torch.tensor(
                record["sourceParentGeneration"],
                dtype=torch.long,
            ),
            source_parent_manifest_payload_sha256_t=digest_tensor(
                str(record["sourceParentManifestPayloadSha256"])
            ),
            target_parent_generation_t=torch.tensor(
                record["targetParentGeneration"],
                dtype=torch.long,
            ),
            target_parent_manifest_payload_sha256_t=digest_tensor(
                str(record["targetParentManifestPayloadSha256"])
            ),
            branch_source_generations_t=long_rows(
                "branchSourceGenerations"
            ),
            branch_source_manifest_sha256s_t=digest_rows(
                "branchSourceManifestSha256s"
            ),
            branch_source_manifest_payload_sha256s_t=digest_rows(
                "branchSourceManifestPayloadSha256s"
            ),
            branch_source_external_state_sha256s_t=digest_rows(
                "branchSourceExternalStateSha256s"
            ),
            branch_source_optimizer_sha256s_t=digest_rows(
                "branchSourceOptimizerSha256s"
            ),
            training_page_ids_t=torch.tensor(
                training_page_ids,
                dtype=torch.long,
            ),
            page_branch_indices_t=long_rows("pageBranchIndices"),
            source_parent_object_sha256s_t=digest_rows(
                "sourceParentObjectSha256s"
            ),
            source_parent_object_bytes_t=long_rows(
                "sourceParentObjectBytes"
            ),
            target_parent_object_sha256s_t=digest_rows(
                "targetParentObjectSha256s"
            ),
            target_parent_object_bytes_t=long_rows(
                "targetParentObjectBytes"
            ),
            lineage_witness_generations_t=long_rows(
                "lineageWitnessGenerations"
            ),
            lineage_witness_object_sha256s_t=digest_rows(
                "lineageWitnessObjectSha256s"
            ),
            lineage_witness_object_bytes_t=long_rows(
                "lineageWitnessObjectBytes"
            ),
            branch_object_sha256s_t=digest_rows("branchObjectSha256s"),
            branch_object_bytes_t=long_rows("branchObjectBytes"),
            applied_page_mask_t=applied_mask_t,
            resealed_page_mask_t=resealed_mask_t,
            storage_normalized_page_mask_t=storage_normalized_mask_t,
            final_object_sha256s_t=digest_rows("finalObjectSha256s"),
            final_object_bytes_t=long_rows("finalObjectBytes"),
            rebase_sha256_t=digest_tensor(str(record["rebaseSha256"])),
        )
    except (KeyError, TypeError, ValueError) as error:
        raise RuntimeError("NoNE training branch rebase record differs") from error
    return packet


def training_branch_union_proof_record_boundary(
    union: NoNETrainingBranchUnionPacket,
    *,
    generation_binding: NoNEGenerationBinding,
    cumulative_training_page_ids_t: torch.Tensor,
    physical_page_ids_t: torch.Tensor,
    storage_normalized_page_objects: tuple[
        NoNEPageObjectBinding,
        ...,
    ],
) -> dict[str, Any]:
    """Serialize every merged per-page proof into an accepted sidecar record."""

    proof_sha256_t = _validate_training_branch_union_packet_boundary(union)
    cumulative_ids_t = torch.sort(
        cumulative_training_page_ids_t.detach().cpu().long().reshape(-1)
    ).values
    physical_ids_t = torch.sort(
        physical_page_ids_t.detach().cpu().long().reshape(-1)
    ).values
    union_ids_t = union.union_page_ids_t.detach().cpu().long().reshape(-1)
    storage_page_ids_t = torch.stack(
        tuple(
            binding.page_id_t.detach().cpu().long().reshape(())
            for binding in storage_normalized_page_objects
        )
    )
    storage_page_map_sha256_t = _page_object_map_digest_t_boundary(
        storage_normalized_page_objects
    )
    complete_coverage = bool(
        cumulative_ids_t.shape == physical_ids_t.shape
        and torch.equal(cumulative_ids_t, physical_ids_t)
    )
    training_data_union, training_data_union_sha256_t = (
        _training_data_union_record_from_tensor_boundary(
            union.training_data_union_json_t
        )
    )
    dataset_training_claimed = bool(
        union.global_dataset_training_claimed_t.detach().cpu().bool()
    )
    global_training_claimed = bool(
        complete_coverage and dataset_training_claimed
    )
    if (
        physical_ids_t.numel() < 1
        or torch.unique(physical_ids_t).numel() != physical_ids_t.numel()
        or torch.unique(cumulative_ids_t).numel() != cumulative_ids_t.numel()
        or not bool(
            _page_ids_subset_t_boundary(cumulative_ids_t, physical_ids_t)
        )
        or not bool(
            _page_ids_subset_t_boundary(union_ids_t, cumulative_ids_t)
        )
        or not torch.equal(storage_page_ids_t, physical_ids_t)
        or not torch.equal(
            generation_binding.updated_page_ids_t.detach()
            .cpu()
            .long()
            .reshape(-1),
            storage_page_ids_t,
        )
        or not torch.equal(
            generation_binding.session_id_t.detach().cpu().long(),
            union.parent_session_id_t.detach().cpu().long(),
        )
        or not torch.equal(
            generation_binding.parent_generation_t.detach().cpu().long(),
            union.parent_generation_t.detach().cpu().long(),
        )
        or not torch.equal(
            union.training_data_union_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
            training_data_union_sha256_t,
        )
        or bool(
            union.global_physical_page_training_claimed_t.detach()
            .cpu()
            .bool()
        )
        != complete_coverage
        or dataset_training_claimed
        is not bool(training_data_union["globalDatasetTrainingClaimed"])
        or bool(union.global_training_claimed_t.detach().cpu().bool())
        != global_training_claimed
        or bool(
            union.global_full_physical_page_bank_traversal_claimed_t
            .detach()
            .cpu()
            .bool()
        )
        != complete_coverage
    ):
        raise RuntimeError("NoNE accepted branch union coverage differs")
    proof = union.training_proof
    record: dict[str, Any] = {
        "schema": TRAINING_BRANCH_UNION_PROOF_SCHEMA,
        "acceptedGeneration": int(generation_binding.generation_t),
        "parentGeneration": int(union.parent_generation_t),
        "parentManifestPayloadSha256": _tensor_digest_hex(
            union.parent_manifest_payload_sha256_t
        ),
        "branchScopeSha256s": [
            _tensor_digest_hex(row)
            for row in union.branch_scope_sha256s_t.detach().cpu()
        ],
        "unionSha256": _tensor_digest_hex(union.union_sha256_t),
        "trainingProofSha256": _tensor_digest_hex(proof_sha256_t),
        "modelOwnedCapabilityStateSha256": _tensor_digest_hex(
            union.model_owned_capability_state_sha256_t
        ),
        "trainingDataUnionSha256": _tensor_digest_hex(
            union.training_data_union_sha256_t
        ),
        "trainingDataUnion": training_data_union,
        "trainingPageCount": int(union_ids_t.numel()),
        "globalTrainingPageCount": int(physical_ids_t.numel()),
        "trainingPageIds": union_ids_t.tolist(),
        "familyPageIds": union_ids_t.tolist(),
        "unionPageLayerIds": (
            union.union_page_layer_ids_t.detach().cpu().long().tolist()
        ),
        "storageNormalizedPageCount": int(storage_page_ids_t.numel()),
        "storageNormalizedPageIds": storage_page_ids_t.tolist(),
        "storageNormalizedPageMapSha256": _tensor_digest_hex(
            storage_page_map_sha256_t
        ),
        "storageNormalizationChangesTrainingCoverage": False,
        "storagePageObjectsSelfContainedDirect": True,
        "baseBoundPageObjectCount": 0,
        "cumulativeTrainingProvenPageIds": cumulative_ids_t.tolist(),
        "routeCounts": proof.route_count_t.detach().cpu().long().tolist(),
        "gradientUpdateCounts": (
            proof.gradient_update_count_t.detach().cpu().long().tolist()
        ),
        "gradientNorms": proof.gradient_norm_t.detach().cpu().float().tolist(),
        "parameterDeltaNorms": (
            proof.parameter_delta_norm_t.detach().cpu().float().tolist()
        ),
        "gradientSignatures": (
            proof.gradient_signature_t.detach().cpu().float().tolist()
        ),
        "routeCoverage": bool(proof.route_coverage_t.detach().cpu().bool()),
        "gradientCoverage": bool(
            proof.gradient_coverage_t.detach().cpu().bool()
        ),
        "distinctGradients": bool(
            proof.distinct_gradient_t.detach().cpu().bool()
        ),
        "finite": bool(proof.finite_t.detach().cpu().bool()),
        "promotionReady": bool(proof.promotion_ready_t.detach().cpu().bool()),
        "promotionEligible": False,
        "branchScopeActive": False,
        "branchLocalFullScopeTraversalRequired": False,
        "globalPhysicalPageTrainingClaimed": complete_coverage,
        "globalDatasetTrainingClaimed": dataset_training_claimed,
        "globalFullPhysicalPageBankTraversalClaimed": complete_coverage,
        "globalTrainingClaimed": global_training_claimed,
    }
    if union.federated_growth_demand_authority_sha256_t is not None:
        record["federatedGrowthDemandAuthoritySha256"] = _tensor_digest_hex(
            union.federated_growth_demand_authority_sha256_t
        )
    if union.lineage_rebase is not None:
        record["lineageRebase"] = (
            training_branch_rebase_proof_record_boundary(
                union.lineage_rebase,
                parent_session_id_t=union.parent_session_id_t,
                branch_scope_sha256s_t=union.branch_scope_sha256s_t,
                page_objects=union.page_objects,
            )
        )
    return record


def validate_training_branch_union_proof_record_boundary(
    record: Mapping[str, Any],
    *,
    generation_binding: NoNEGenerationBinding,
    generation_manifest: Mapping[str, Any],
    allow_historical_partial_data_union_omission: bool = False,
) -> NoNEPageTrainingProofPacket:
    """Rebuild and verify an immutable union's per-page proof arrays.

    ``allow_historical_partial_data_union_omission`` is a migration-only
    compatibility boundary for pre-data-union, incomplete ancestors.  It never
    grants dataset coverage, global training, or promotion authority.
    """

    raw_page_rows = generation_manifest.get("pageObjects")
    physical_page_ids = (
        sorted(
            int(row["pageId"])
            for row in raw_page_rows
            if isinstance(row, dict)
            and isinstance(row.get("pageId"), int)
            and not isinstance(row.get("pageId"), bool)
        )
        if isinstance(raw_page_rows, list)
        else []
    )
    training_page_ids = record.get("trainingPageIds")
    family_page_ids = record.get("familyPageIds")
    cumulative_page_ids = record.get("cumulativeTrainingProvenPageIds")
    union_layer_ids = record.get("unionPageLayerIds")
    route_counts = record.get("routeCounts")
    update_counts = record.get("gradientUpdateCounts")
    gradient_norms = record.get("gradientNorms")
    delta_norms = record.get("parameterDeltaNorms")
    signatures = record.get("gradientSignatures")
    storage_normalized_page_ids = record.get(
        "storageNormalizedPageIds"
    )
    storage_normalized_page_count = record.get(
        "storageNormalizedPageCount"
    )
    storage_normalized_page_map_sha256 = record.get(
        "storageNormalizedPageMapSha256"
    )
    storage_contract_fields = (
        storage_normalized_page_ids,
        storage_normalized_page_count,
        storage_normalized_page_map_sha256,
        record.get("storageNormalizationChangesTrainingCoverage"),
        record.get("storagePageObjectsSelfContainedDirect"),
        record.get("baseBoundPageObjectCount"),
    )
    storage_contract_present = any(
        field is not None for field in storage_contract_fields
    )
    components = generation_manifest.get("components")
    manifest_proof = (
        components.get("trainingProof")
        if isinstance(components, dict)
        else None
    )
    expected_physical_complete = bool(
        cumulative_page_ids == physical_page_ids
    )
    training_data_union = record.get("trainingDataUnion")
    federated_training_data_union = bool(
        isinstance(training_data_union, Mapping)
        and training_data_union.get("windowKind")
        == "full_payload_federated_packed"
    )
    federated_growth_demand_authority_sha256 = record.get(
        "federatedGrowthDemandAuthoritySha256"
    )
    historical_partial_data_union_omitted = bool(
        "trainingDataUnion" not in record
        and "trainingDataUnionSha256" not in record
        and "globalPhysicalPageTrainingClaimed" not in record
        and "globalDatasetTrainingClaimed" not in record
        and "promotionEligible" not in record
        and record.get("globalFullPhysicalPageBankTraversalClaimed") is False
        and record.get("globalTrainingClaimed") is False
        and record.get("promotionReady") is False
        and expected_physical_complete is False
    )
    training_data_union_sha256_t: torch.Tensor | None = None
    if isinstance(training_data_union, dict):
        training_data_union_sha256_t = (
            _validated_training_data_union_record_boundary(training_data_union)
        )
        expected_dataset_complete = bool(
            training_data_union["globalDatasetTrainingClaimed"]
        )
    elif (
        allow_historical_partial_data_union_omission
        and historical_partial_data_union_omitted
    ):
        expected_dataset_complete = False
    else:
        raise RuntimeError("NoNE accepted training data union is absent")
    expected_global_complete = bool(
        expected_physical_complete and expected_dataset_complete
    )
    training_data_union_sha256 = (
        _tensor_digest_hex(training_data_union_sha256_t)
        if training_data_union_sha256_t is not None
        else None
    )
    scalar_hex_fields = (
        record.get("parentManifestPayloadSha256"),
        record.get("unionSha256"),
        record.get("trainingProofSha256"),
        record.get("modelOwnedCapabilityStateSha256"),
        *(
            ()
            if historical_partial_data_union_omitted
            else (record.get("trainingDataUnionSha256"),)
        ),
    )
    branch_scope_sha256s = record.get("branchScopeSha256s")
    expected_updated_page_ids = training_page_ids
    lineage_rebase_record = record.get("lineageRebase")
    if lineage_rebase_record is not None:
        if (
            not isinstance(lineage_rebase_record, Mapping)
            or not isinstance(training_page_ids, list)
            or not training_page_ids
            or not isinstance(branch_scope_sha256s, list)
            or not branch_scope_sha256s
            or not isinstance(raw_page_rows, list)
        ):
            raise RuntimeError(
                "NoNE accepted branch union rebase proof differs"
            )
        try:
            lineage_rebase = (
                _training_branch_rebase_packet_from_record_boundary(
                    lineage_rebase_record
                )
            )
            page_rows = {
                int(row["pageId"]): row
                for row in raw_page_rows
                if isinstance(row, dict)
                and isinstance(row.get("pageId"), int)
                and not isinstance(row.get("pageId"), bool)
            }
            final_objects = tuple(
                NoNEPageObjectBinding(
                    page_id_t=torch.tensor(page_id, dtype=torch.long),
                    object_sha256_t=digest_tensor(
                        str(page_rows[page_id]["sha256"])
                    ),
                    object_bytes_t=torch.tensor(
                        int(page_rows[page_id]["bytes"]),
                        dtype=torch.long,
                    ),
                )
                for page_id in training_page_ids
            )
            _validate_training_branch_rebase_packet_boundary(
                lineage_rebase,
                parent_session_id_t=generation_binding.session_id_t,
                parent_generation_t=generation_binding.parent_generation_t,
                parent_manifest_payload_sha256_t=digest_tensor(
                    str(
                        generation_manifest[
                            "parentManifestPayloadSha256"
                        ]
                    )
                ),
                branch_scope_sha256s_t=torch.stack(
                    tuple(
                        digest_tensor(str(value))
                        for value in branch_scope_sha256s
                    ),
                    dim=0,
                ),
                union_page_ids_t=torch.tensor(
                    training_page_ids,
                    dtype=torch.long,
                ),
                page_objects=final_objects,
            )
            expected_updated_page_ids = (
                lineage_rebase.training_page_ids_t.detach().cpu().long()[
                    lineage_rebase.applied_page_mask_t.detach().cpu().bool()
                ].tolist()
            )
        except (KeyError, TypeError, ValueError) as error:
            raise RuntimeError(
                "NoNE accepted branch union rebase proof differs"
            ) from error
    if storage_contract_present:
        try:
            if not isinstance(raw_page_rows, list):
                raise RuntimeError(
                    "NoNE accepted storage-normalized page map is absent"
                )
            storage_page_objects = tuple(
                NoNEPageObjectBinding(
                    page_id_t=torch.tensor(
                        int(row["pageId"]),
                        dtype=torch.long,
                    ),
                    object_sha256_t=digest_tensor(str(row["sha256"])),
                    object_bytes_t=torch.tensor(
                        int(row["bytes"]),
                        dtype=torch.long,
                    ),
                )
                for row in sorted(
                    raw_page_rows,
                    key=lambda value: int(value["pageId"]),
                )
                if isinstance(row, dict)
            )
            observed_storage_map_sha256 = _tensor_digest_hex(
                _page_object_map_digest_t_boundary(storage_page_objects)
            )
        except (KeyError, TypeError, ValueError) as error:
            raise RuntimeError(
                "NoNE accepted storage-normalized page map differs"
            ) from error
        if (
            not isinstance(storage_normalized_page_ids, list)
            or storage_normalized_page_ids != physical_page_ids
            or storage_normalized_page_count != len(physical_page_ids)
            or storage_normalized_page_map_sha256
            != observed_storage_map_sha256
            or record.get("storageNormalizationChangesTrainingCoverage")
            is not False
            or record.get("storagePageObjectsSelfContainedDirect") is not True
            or record.get("baseBoundPageObjectCount") != 0
            or generation_binding.updated_page_ids_t.detach()
            .cpu()
            .long()
            .reshape(-1)
            .tolist()
            != storage_normalized_page_ids
        ):
            raise RuntimeError(
                "NoNE accepted storage-normalized page map differs"
            )
        expected_updated_page_ids = storage_normalized_page_ids
    if (
        record.get("schema") != TRAINING_BRANCH_UNION_PROOF_SCHEMA
        or not page_generation_schema_supported_boundary(
            generation_manifest.get("schema")
        )
        or not physical_page_ids
        or len(physical_page_ids) != len(set(physical_page_ids))
        or not isinstance(training_page_ids, list)
        or not training_page_ids
        or training_page_ids != sorted(set(training_page_ids))
        or family_page_ids != training_page_ids
        or generation_manifest.get("updatedPageIds")
        != expected_updated_page_ids
        or not isinstance(cumulative_page_ids, list)
        or cumulative_page_ids != sorted(set(cumulative_page_ids))
        or generation_manifest.get("trainingProvenPageIds")
        != cumulative_page_ids
        or not set(training_page_ids).issubset(cumulative_page_ids)
        or not set(cumulative_page_ids).issubset(physical_page_ids)
        or not isinstance(union_layer_ids, list)
        or len(union_layer_ids) != len(training_page_ids)
        or any(
            not isinstance(layer_id, int)
            or isinstance(layer_id, bool)
            or layer_id < 0
            for layer_id in union_layer_ids
        )
        or record.get("acceptedGeneration")
        != int(generation_binding.generation_t)
        or record.get("parentGeneration")
        != int(generation_binding.parent_generation_t)
        or record.get("parentManifestPayloadSha256")
        != generation_manifest.get("parentManifestPayloadSha256")
        or any(
            not isinstance(value, str) or len(value) != 64
            for value in scalar_hex_fields
        )
        or not isinstance(branch_scope_sha256s, list)
        or not branch_scope_sha256s
        or len(set(branch_scope_sha256s)) != len(branch_scope_sha256s)
        or any(
            not isinstance(value, str) or len(value) != 64
            for value in branch_scope_sha256s
        )
        or record.get("trainingPageCount") != len(training_page_ids)
        or record.get("globalTrainingPageCount") != len(physical_page_ids)
        or record.get("branchScopeActive") is not False
        or record.get("branchLocalFullScopeTraversalRequired") is not False
        or (
            not historical_partial_data_union_omitted
            and record.get("promotionEligible") is not False
        )
        or (
            not historical_partial_data_union_omitted
            and record.get("trainingDataUnionSha256")
            != training_data_union_sha256
        )
        or (
            not historical_partial_data_union_omitted
            and record.get("globalPhysicalPageTrainingClaimed")
            is not expected_physical_complete
        )
        or (
            not historical_partial_data_union_omitted
            and record.get("globalDatasetTrainingClaimed")
            is not expected_dataset_complete
        )
        or record.get("globalTrainingClaimed") is not expected_global_complete
        or record.get("globalFullPhysicalPageBankTraversalClaimed")
        is not expected_physical_complete
        or (
            federated_training_data_union
            and not _is_sha256_hex_boundary(
                federated_growth_demand_authority_sha256
            )
        )
        or (
            federated_growth_demand_authority_sha256 is not None
            and not _is_sha256_hex_boundary(
                federated_growth_demand_authority_sha256
            )
        )
        or not isinstance(manifest_proof, dict)
        or manifest_proof.get("sha256") != record.get("trainingProofSha256")
    ):
        raise RuntimeError("NoNE accepted branch union proof record differs")
    page_count = len(training_page_ids)
    if (
        not isinstance(route_counts, list)
        or not isinstance(update_counts, list)
        or not isinstance(gradient_norms, list)
        or not isinstance(delta_norms, list)
        or not isinstance(signatures, list)
        or any(len(values) != page_count for values in (
            route_counts,
            update_counts,
            gradient_norms,
            delta_norms,
            signatures,
        ))
        or any(
            not isinstance(value, int) or isinstance(value, bool)
            for values in (route_counts, update_counts)
            for value in values
        )
        or any(
            not isinstance(value, (int, float)) or isinstance(value, bool)
            for values in (gradient_norms, delta_norms)
            for value in values
        )
        or any(
            not isinstance(row, list) or not row
            for row in signatures
        )
        or any(
            not isinstance(value, (int, float)) or isinstance(value, bool)
            for row in signatures
            for value in row
        )
    ):
        raise RuntimeError("NoNE accepted branch union proof arrays differ")
    proof = NoNEPageTrainingProofPacket(
        family_page_ids_t=torch.tensor(training_page_ids, dtype=torch.long),
        route_count_t=torch.tensor(route_counts, dtype=torch.long),
        gradient_update_count_t=torch.tensor(update_counts, dtype=torch.long),
        gradient_norm_t=torch.tensor(gradient_norms, dtype=torch.float32),
        parameter_delta_norm_t=torch.tensor(delta_norms, dtype=torch.float32),
        gradient_signature_t=torch.tensor(signatures, dtype=torch.float32),
        route_coverage_t=torch.tensor(record.get("routeCoverage"), dtype=torch.bool),
        gradient_coverage_t=torch.tensor(
            record.get("gradientCoverage"), dtype=torch.bool
        ),
        distinct_gradient_t=torch.tensor(
            record.get("distinctGradients"), dtype=torch.bool
        ),
        finite_t=torch.tensor(record.get("finite"), dtype=torch.bool),
        promotion_ready_t=torch.tensor(
            record.get("promotionReady"), dtype=torch.bool
        ),
    )
    proof_sha256_t = _validate_changed_page_training_proof_ids_boundary(
        proof.family_page_ids_t,
        proof,
    )
    recomputed = combine_page_training_proofs((proof,))
    if (
        record.get("trainingProofSha256") != _tensor_digest_hex(proof_sha256_t)
        or not torch.equal(recomputed.route_coverage_t, proof.route_coverage_t)
        or not torch.equal(
            recomputed.gradient_coverage_t,
            proof.gradient_coverage_t,
        )
        or not torch.equal(
            recomputed.distinct_gradient_t,
            proof.distinct_gradient_t,
        )
        or not torch.equal(recomputed.finite_t, proof.finite_t)
        or not torch.equal(recomputed.promotion_ready_t, proof.promotion_ready_t)
    ):
        raise RuntimeError("NoNE accepted branch union proof digest differs")
    return proof


def _validated_training_branch_union_proof_artifact_boundary(
    *,
    store: NoNEImmutablePageStore,
    generation_binding: NoNEGenerationBinding,
    generation_manifest: Mapping[str, Any],
    allow_historical_partial_data_union_omission: bool = False,
) -> tuple[dict[str, Any], Path, str]:
    """Load one manifest-bound immutable branch-union proof artifact."""

    components = generation_manifest.get("components")
    training_proof = (
        components.get("trainingProof")
        if isinstance(components, dict)
        else None
    )
    proof_record = (
        training_proof.get("record")
        if isinstance(training_proof, dict)
        else None
    )
    relative_value = (
        proof_record.get("path")
        if isinstance(proof_record, dict)
        else None
    )
    expected_sha256 = (
        proof_record.get("sha256")
        if isinstance(proof_record, dict)
        else None
    )
    if (
        not isinstance(relative_value, str)
        or not relative_value
        or not isinstance(expected_sha256, str)
        or len(expected_sha256) != 64
    ):
        raise RuntimeError(
            "NoNE accepted branch union proof artifact is absent"
        )
    relative_path = Path(relative_value)
    _session_id_t, session_root = store._require_session()
    proof_path = (session_root / relative_path).resolve()
    if (
        relative_path.is_absolute()
        or not proof_path.is_relative_to(session_root.resolve())
        or not proof_path.is_file()
        or _file_sha256(proof_path) != expected_sha256
    ):
        raise RuntimeError(
            "NoNE accepted branch union proof artifact identity differs"
        )
    proof_value = _read_json(proof_path)
    validate_training_branch_union_proof_record_boundary(
        proof_value,
        generation_binding=generation_binding,
        generation_manifest=generation_manifest,
        allow_historical_partial_data_union_omission=(
            allow_historical_partial_data_union_omission
        ),
    )
    return proof_value, proof_path, expected_sha256


def _tensor_digest_hex(tensor: torch.Tensor) -> str:
    value = tensor.detach().contiguous().cpu().to(dtype=torch.uint8).reshape(-1)
    if value.shape != (32,):
        raise ValueError("component digest tensors must contain exactly 32 bytes")
    return bytes(value.tolist()).hex()


def _page_object_identity_record_bytes_boundary(
    *,
    page_id: int,
    object_sha256: str,
    object_bytes: int,
) -> bytes:
    """Encode one accepted page-object identity without reading its payload."""

    if (
        not isinstance(page_id, int)
        or isinstance(page_id, bool)
        or page_id < 0
        or page_id >= 2**64
        or not isinstance(object_bytes, int)
        or isinstance(object_bytes, bool)
        or object_bytes < 1
        or object_bytes >= 2**64
    ):
        raise ValueError("NoNE page-object identity dimensions are malformed")
    try:
        object_digest = bytes.fromhex(object_sha256)
    except ValueError as error:
        raise ValueError("NoNE page-object digest is malformed") from error
    if len(object_digest) != 32 or object_sha256 != object_sha256.lower():
        raise ValueError("NoNE page-object digest is malformed")
    return struct.pack(">QQ", page_id, object_bytes) + object_digest


def page_object_identity_sha256_boundary(
    rows: Iterable[tuple[int, str, int]],
) -> str:
    """Hash ordered accepted page identities with bounded boundary state."""

    digest = hashlib.sha256()
    digest.update(_PAGE_OBJECT_IDENTITY_DIGEST_DOMAIN)
    prior_page_id = -1
    row_count = 0
    for page_id, object_sha256, object_bytes in rows:
        if page_id <= prior_page_id:
            raise ValueError(
                "NoNE page-object identities must be strictly ordered"
            )
        digest.update(
            _page_object_identity_record_bytes_boundary(
                page_id=page_id,
                object_sha256=object_sha256,
                object_bytes=object_bytes,
            )
        )
        prior_page_id = page_id
        row_count += 1
    if row_count < 1:
        raise ValueError("NoNE page-object identity set is empty")
    return digest.hexdigest()


def _session_key(session_id_t: torch.Tensor) -> str:
    value = (
        session_id_t.detach()
        .contiguous()
        .cpu()
        .to(dtype=torch.long)
        .view(torch.uint8)
        .numpy()
        .tobytes()
    )
    return hashlib.sha256(value).hexdigest()


def _canonical_json_bytes(payload: Mapping[str, Any]) -> bytes:
    return json.dumps(
        payload,
        sort_keys=True,
        separators=(",", ":"),
    ).encode("utf-8")


def _sealed_diagnostic_jsonl_record_boundary(
    payload: Mapping[str, Any],
    *,
    previous_record_sha256: str | None,
) -> tuple[bytes, str]:
    """Seal one diagnostic JSONL record without granting runtime authority."""

    record = {
        **payload,
        "previousRecordSha256": previous_record_sha256,
    }
    record_sha256 = hashlib.sha256(
        _canonical_json_bytes(record)
    ).hexdigest()
    sealed = {
        **record,
        "recordSha256": record_sha256,
    }
    return _canonical_json_bytes(sealed) + b"\n", record_sha256


def _direct_page_pack_pread_exact_boundary(
    descriptor: int,
    *,
    offset: int,
    byte_count: int,
) -> bytes:
    """Read one bounded metadata/scalar range from the packed payload."""

    if offset < 0 or byte_count < 0:
        raise ValueError("NoNE direct page inventory read geometry differs")
    payload = bytearray()
    while len(payload) < byte_count:
        chunk = os.pread(
            descriptor,
            byte_count - len(payload),
            offset + len(payload),
        )
        if not chunk:
            raise RuntimeError(
                "NoNE direct page inventory payload read was incomplete"
            )
        payload.extend(chunk)
    return bytes(payload)


def _direct_page_pack_content_inventory_rows_boundary(
    *,
    authority: DirectPagePackSetAuthorityPacket,
    index: DirectPagePackIndexPacket,
) -> tuple[dict[str, Any], ...]:
    """Inventory every tensor without rereading the 1.16-TB value surface.

    Each complete object SHA binds all tensor values. Only the safetensors
    header and the scalar page/revision/optimizer authority are read here, so
    the inventory describes exact names, roles, dtypes, shapes, and byte
    ranges without adding another full-payload I/O pass.
    """

    if (
        len(authority.shard_roots) != 1
        or len(authority.shard_relative_paths) != 1
        or index.shard_indices_t.ne(0).any()
    ):
        raise RuntimeError(
            "NoNE direct page content inventory requires one payload"
        )
    payload_path = (
        authority.shard_roots[0] / authority.shard_relative_paths[0]
    ).expanduser().resolve()
    identity_before = _file_identity(payload_path)
    flags = (
        os.O_RDONLY
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
    )
    try:
        descriptor = os.open(payload_path, flags)
    except OSError as error:
        raise RuntimeError(
            "NoNE direct page inventory payload open failed"
        ) from error

    expected_keys_by_revision = {
        FULL_OPTIMIZER_PAGE_FORMAT_REVISION: {
            "format_revision_t",
            "page_ids_t",
            "optimizer_mean_t",
            "optimizer_square_t",
            "step_t",
            *_PAGE_WEIGHT_TENSOR_NAMES,
        },
        IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION: {
            "format_revision_t",
            "page_ids_t",
            "optimizer_width_t",
            *_PAGE_WEIGHT_TENSOR_NAMES,
        },
        SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION: {
            "format_revision_t",
            "page_ids_t",
            "optimizer_width_t",
            "step_t",
            *_PAGE_WEIGHT_TENSOR_NAMES,
        },
    }
    empty_dependency_closure_sha256 = hashlib.sha256(b"[]").hexdigest()
    rows: list[dict[str, Any]] = []
    try:
        for ordinal in range(int(index.page_ids_t.numel())):
            page_id = int(index.page_ids_t[ordinal])
            revision = int(index.format_revisions_t[ordinal])
            object_sha256 = _tensor_digest_hex(
                index.object_sha256s_t[ordinal]
            )
            object_offset = int(index.object_offsets_t[ordinal])
            object_bytes = int(index.object_bytes_t[ordinal])
            header_length_raw = _direct_page_pack_pread_exact_boundary(
                descriptor,
                offset=object_offset,
                byte_count=8,
            )
            header_bytes = struct.unpack("<Q", header_length_raw)[0]
            data_start = 8 + header_bytes
            if header_bytes < 2 or data_start > object_bytes:
                raise RuntimeError(
                    "NoNE direct page inventory safetensors header differs"
                )
            encoded_header = _direct_page_pack_pread_exact_boundary(
                descriptor,
                offset=object_offset + 8,
                byte_count=header_bytes,
            )
            canonical_header = encoded_header.rstrip(b" ")
            if (
                not canonical_header
                or encoded_header[len(canonical_header) :]
                != b" " * (len(encoded_header) - len(canonical_header))
            ):
                raise RuntimeError(
                    "NoNE direct page inventory safetensors padding differs"
                )
            try:
                header_value = json.loads(canonical_header)
            except (UnicodeDecodeError, json.JSONDecodeError) as error:
                raise RuntimeError(
                    "NoNE direct page inventory safetensors header differs"
                ) from error
            if not isinstance(header_value, dict):
                raise RuntimeError(
                    "NoNE direct page inventory tensor header differs"
                )
            metadata = header_value.get("__metadata__", {})
            if not isinstance(metadata, dict) or any(
                not isinstance(key, str) or not isinstance(value, str)
                for key, value in metadata.items()
            ):
                raise RuntimeError(
                    "NoNE direct page inventory metadata differs"
                )

            tensor_geometry: list[dict[str, Any]] = []
            raw_geometry: list[
                tuple[str, str, tuple[int, ...], int, int]
            ] = []
            for name, descriptor_value in header_value.items():
                if name == "__metadata__":
                    continue
                if (
                    not isinstance(name, str)
                    or not isinstance(descriptor_value, dict)
                ):
                    raise RuntimeError(
                        "NoNE direct page inventory tensor descriptor differs"
                    )
                dtype = descriptor_value.get("dtype")
                shape_value = descriptor_value.get("shape")
                offsets_value = descriptor_value.get("data_offsets")
                if (
                    not isinstance(dtype, str)
                    or dtype not in _SAFETENSORS_DTYPE_BYTES
                    or not isinstance(shape_value, list)
                    or any(
                        not isinstance(dimension, int)
                        or isinstance(dimension, bool)
                        or dimension < 0
                        for dimension in shape_value
                    )
                    or not isinstance(offsets_value, list)
                    or len(offsets_value) != 2
                    or any(
                        not isinstance(value, int)
                        or isinstance(value, bool)
                        or value < 0
                        for value in offsets_value
                    )
                ):
                    raise RuntimeError(
                        "NoNE direct page inventory tensor descriptor differs"
                    )
                shape = tuple(shape_value)
                start, end = offsets_value
                tensor_bytes = end - start
                if (
                    end < start
                    or tensor_bytes
                    != math.prod(shape) * _SAFETENSORS_DTYPE_BYTES[dtype]
                    or data_start + end > object_bytes
                ):
                    raise RuntimeError(
                        "NoNE direct page inventory tensor geometry differs"
                    )
                raw_geometry.append((name, dtype, shape, start, end))
            raw_geometry.sort(key=lambda row: row[3])
            cursor = 0
            for name, dtype, shape, start, end in raw_geometry:
                if start != cursor:
                    raise RuntimeError(
                        "NoNE direct page inventory tensor offsets differ"
                    )
                cursor = end
                if name in _PAGE_WEIGHT_TENSOR_NAMES:
                    role = "knowledgeWeight"
                elif name in {"optimizer_mean_t", "optimizer_square_t"}:
                    role = "optimizerMoment"
                elif name in {"optimizer_width_t", "step_t"}:
                    role = "optimizerState"
                else:
                    role = "objectIdentity"
                object_byte_range = [
                    data_start + start,
                    data_start + end,
                ]
                payload_byte_range = [
                    object_offset + data_start + start,
                    object_offset + data_start + end,
                ]
                value_slice_authority = {
                    "objectSha256": object_sha256,
                    "objectByteRange": object_byte_range,
                }
                tensor_geometry.append(
                    {
                        "name": name,
                        "role": role,
                        "dtype": dtype,
                        "shape": list(shape),
                        "tensorBytes": end - start,
                        "objectByteRange": object_byte_range,
                        "payloadByteRange": payload_byte_range,
                        "valueAuthority": value_slice_authority,
                        "valueSliceAuthoritySha256": hashlib.sha256(
                            _canonical_json_bytes(value_slice_authority)
                        ).hexdigest(),
                    }
                )
            if data_start + cursor != object_bytes:
                raise RuntimeError(
                    "NoNE direct page inventory object extent differs"
                )
            names = {row[0] for row in raw_geometry}
            expected_keys = expected_keys_by_revision.get(revision)
            if expected_keys is None or names != expected_keys:
                raise RuntimeError(
                    "NoNE direct page inventory tensor key set differs"
                )
            descriptor_by_name = {
                name: (dtype, shape, start, end)
                for name, dtype, shape, start, end in raw_geometry
            }

            def scalar_i64(name: str) -> int:
                dtype, shape, start, end = descriptor_by_name[name]
                if dtype != "I64" or shape != (1,) or end - start != 8:
                    raise RuntimeError(
                        "NoNE direct page inventory scalar geometry differs"
                    )
                return cast(
                    int,
                    struct.unpack(
                        "<q",
                        _direct_page_pack_pread_exact_boundary(
                            descriptor,
                            offset=object_offset + data_start + start,
                            byte_count=8,
                        ),
                    )[0],
                )

            if (
                scalar_i64("format_revision_t") != revision
                or scalar_i64("page_ids_t") != page_id
            ):
                raise RuntimeError(
                    "NoNE direct page inventory scalar authority differs"
                )
            optimizer_step = (
                scalar_i64("step_t") if "step_t" in names else None
            )
            if optimizer_step is not None and optimizer_step < 1:
                raise RuntimeError(
                    "NoNE direct page inventory optimizer step differs"
                )
            if revision == FULL_OPTIMIZER_PAGE_FORMAT_REVISION:
                optimizer_mode = "explicitMoments"
                optimizer_width = descriptor_by_name[
                    "optimizer_mean_t"
                ][1][1]
            elif revision == IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION:
                optimizer_mode = "implicitZeroUntrained"
                optimizer_width = scalar_i64("optimizer_width_t")
            else:
                optimizer_mode = "implicitZeroTrained"
                optimizer_width = scalar_i64("optimizer_width_t")
            if optimizer_width < 1:
                raise RuntimeError(
                    "NoNE direct page inventory optimizer width differs"
                )

            tensor_names = [row["name"] for row in tensor_geometry]
            knowledge_tensor_names = [
                row["name"]
                for row in tensor_geometry
                if row["role"] == "knowledgeWeight"
            ]
            optimizer_tensor_names = [
                row["name"]
                for row in tensor_geometry
                if row["role"] in {"optimizerMoment", "optimizerState"}
            ]
            tensor_key_set_sha256 = hashlib.sha256(
                _canonical_json_bytes({"tensorNames": sorted(tensor_names)})
            ).hexdigest()
            tensor_geometry_sha256 = hashlib.sha256(
                _canonical_json_bytes({"tensors": tensor_geometry})
            ).hexdigest()
            rows.append(
                {
                    "safetensorsHeaderBytes": data_start,
                    "safetensorsHeaderSha256": hashlib.sha256(
                        header_length_raw + encoded_header
                    ).hexdigest(),
                    "safetensorsMetadataSha256": hashlib.sha256(
                        _canonical_json_bytes(metadata)
                    ).hexdigest(),
                    "tensorCount": len(tensor_geometry),
                    "tensorNames": tensor_names,
                    "tensorKeySetSha256": tensor_key_set_sha256,
                    "tensorGeometrySha256": tensor_geometry_sha256,
                    "tensors": tensor_geometry,
                    "knowledgeTensorNames": knowledge_tensor_names,
                    "knowledgeTensorCount": len(knowledge_tensor_names),
                    "knowledgeTensorBytes": sum(
                        int(row["tensorBytes"])
                        for row in tensor_geometry
                        if row["role"] == "knowledgeWeight"
                    ),
                    "optimizerTensorNames": optimizer_tensor_names,
                    "optimizerStateMode": optimizer_mode,
                    "optimizerWidth": optimizer_width,
                    "optimizerStep": optimizer_step,
                    "selfContainedDirect": True,
                    "dependencyObjectCount": 0,
                    "dependencyClosure": [],
                    "dependencyClosureSha256": (
                        empty_dependency_closure_sha256
                    ),
                    "tensorValueAuthorityMode": (
                        "sha256_object_plus_exact_byte_range"
                    ),
                    "objectSha256BindsAllTensorValues": True,
                }
            )
    finally:
        os.close(descriptor)
    if _file_identity(payload_path) != identity_before:
        raise RuntimeError(
            "NoNE direct page inventory payload changed during inspection"
        )
    return tuple(rows)


def _direct_page_pack_diagnostic_inventory_bytes_boundary(
    *,
    authority: DirectPagePackSetAuthorityPacket,
    index: DirectPagePackIndexPacket,
) -> tuple[bytes, str]:
    """Describe every packed page and byte range without storing tensors.

    The metadata is release/audit evidence only. Runtime page reads continue to
    use the tensor-native pack index; this JSONL cannot select, replace, or veto
    a model-owned page.
    """

    validated = validate_direct_page_pack_set_authority_boundary(
        authority,
        index=index,
    )
    page_ids_t = _require_exact_generation_187_physical_page_ids_boundary(
        validated.page_ids_t
    )
    if (
        validated.shard_sha256s_t.shape != (1, 32)
        or validated.shard_indices_t.ne(0).any()
        or len(authority.shard_roots) != 1
        or len(authority.shard_relative_paths) != 1
    ):
        raise RuntimeError(
            "NoNE diagnostic inventory requires one knowledge payload"
        )
    payload_sha256 = _tensor_digest_hex(
        validated.shard_sha256s_t[0]
    )
    payload_bytes = int(validated.shard_bytes_t[0])
    index_sha256 = _tensor_digest_hex(authority.index_sha256_t)
    pack_sha256 = _tensor_digest_hex(validated.pack_set_sha256_t)
    page_ids_sha256 = _tensor_digest_hex(validated.page_ids_sha256_t)
    page_map_sha256 = _tensor_digest_hex(validated.page_map_sha256_t)
    content_rows = _direct_page_pack_content_inventory_rows_boundary(
        authority=authority,
        index=validated,
    )
    if len(content_rows) != int(page_ids_t.numel()):
        raise RuntimeError(
            "NoNE direct page diagnostic content inventory differs"
        )
    chunks: list[bytes] = []
    header_bytes, previous_sha256 = (
        _sealed_diagnostic_jsonl_record_boundary(
            {
                "schema": DIRECT_PAGE_PACK_DIAGNOSTIC_INVENTORY_SCHEMA,
                "recordKind": "header",
                "pageCount": int(page_ids_t.numel()),
                "payloadSha256": payload_sha256,
                "payloadBytes": payload_bytes,
                "indexSha256": index_sha256,
                "indexBytes": int(authority.index_bytes_t),
                "packSetSha256": pack_sha256,
                "pageIdsSha256": page_ids_sha256,
                "pageMapSha256": page_map_sha256,
                "contentInventoryComplete": True,
                "tensorValuesBoundByObjectSha256": True,
                "dependencyClosureRecordedPerPage": True,
                "runtimeAuthority": False,
                "containsKnowledgeTensors": False,
                "containsLocalPaths": False,
            },
            previous_record_sha256=None,
        )
    )
    chunks.append(header_bytes)
    revision_counts: dict[int, int] = {}
    for ordinal in range(int(page_ids_t.numel())):
        revision = int(validated.format_revisions_t[ordinal])
        if revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS:
            raise RuntimeError(
                "NoNE diagnostic inventory contains an indirect revision"
            )
        revision_counts[revision] = revision_counts.get(revision, 0) + 1
        row_bytes, previous_sha256 = (
            _sealed_diagnostic_jsonl_record_boundary(
                {
                    "schema": DIRECT_PAGE_PACK_DIAGNOSTIC_INVENTORY_SCHEMA,
                    "recordKind": "page",
                    "ordinal": ordinal,
                    "pageId": int(page_ids_t[ordinal]),
                    "objectSha256": _tensor_digest_hex(
                        validated.object_sha256s_t[ordinal]
                    ),
                    "objectBytes": int(
                        validated.object_bytes_t[ordinal]
                    ),
                    "payloadOffsetBytes": int(
                        validated.object_offsets_t[ordinal]
                    ),
                    "alignedSpanBytes": int(
                        validated.object_spans_t[ordinal]
                    ),
                    "formatRevision": revision,
                    "content": content_rows[ordinal],
                    "runtimeAuthority": False,
                },
                previous_record_sha256=previous_sha256,
            )
        )
        chunks.append(row_bytes)
    complete_bytes, terminal_sha256 = (
        _sealed_diagnostic_jsonl_record_boundary(
            {
                "schema": DIRECT_PAGE_PACK_DIAGNOSTIC_INVENTORY_SCHEMA,
                "recordKind": "complete",
                "recordCount": int(page_ids_t.numel()),
                "minimumPageId": int(page_ids_t[0]),
                "maximumPageId": int(page_ids_t[-1]),
                "pagesAbove101000": int(page_ids_t.gt(101_000).sum()),
                "logicalObjectBytes": int(validated.object_bytes_t.sum()),
                "payloadBytes": payload_bytes,
                "revisionCounts": {
                    str(revision): revision_counts.get(revision, 0)
                    for revision in sorted(
                        RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
                    )
                },
                "payloadSha256": payload_sha256,
                "indexSha256": index_sha256,
                "packSetSha256": pack_sha256,
                "pageIdsSha256": page_ids_sha256,
                "pageMapSha256": page_map_sha256,
                "historicalRevision6Accepted": False,
                "contentInventoryComplete": True,
                "tensorValuesBoundByObjectSha256": True,
                "dependencyClosureRecordedPerPage": True,
                "runtimeAuthority": False,
            },
            previous_record_sha256=previous_sha256,
        )
    )
    chunks.append(complete_bytes)
    return b"".join(chunks), terminal_sha256


def _validated_direct_page_pack_diagnostic_inventory_boundary(
    *,
    path: Path,
    expected_sha256: str,
    expected_terminal_record_sha256: str,
    authority: DirectPagePackSetAuthorityPacket,
    index: DirectPagePackIndexPacket,
) -> None:
    """Require exact deterministic metadata for every packed page."""

    expected_bytes, terminal_sha256 = (
        _direct_page_pack_diagnostic_inventory_bytes_boundary(
            authority=authority,
            index=index,
        )
    )
    unresolved = path.expanduser()
    if _unresolved_path_contains_symlink_boundary(unresolved):
        raise RuntimeError("NoNE direct page diagnostic inventory is a symlink")
    resolved = unresolved.resolve()
    if (
        not resolved.is_file()
        or not _valid_sha256_boundary(expected_sha256)
        or hashlib.sha256(expected_bytes).hexdigest() != expected_sha256
        or terminal_sha256 != expected_terminal_record_sha256
        or resolved.read_bytes() != expected_bytes
    ):
        raise RuntimeError(
            "NoNE direct page diagnostic inventory authority differs"
        )


def _direct_page_pack_local_locator_diagnostic_bytes_boundary(
    *,
    source_paths: tuple[Path, ...],
    index: DirectPagePackIndexPacket,
    authorities_by_root: Mapping[Path, DirectPagePackSetAuthorityPacket],
    canonical_inventory_sha256: str,
) -> tuple[bytes, str]:
    """Record where canonical and source bytes were observed on this host.

    This locator is deliberately excluded from generation, pack, page-map, and
    acceptance identities. It helps an operator find bytes during diagnosis,
    but moving or deleting a local path cannot change tensor authority.
    """

    if (
        len(source_paths) not in (0, int(index.page_ids_t.numel()))
        or len(authorities_by_root) != 1
        or not _valid_sha256_boundary(canonical_inventory_sha256)
    ):
        raise RuntimeError("NoNE local pack locator geometry differs")
    replica_rows: list[dict[str, Any]] = []
    for root, authority in authorities_by_root.items():
        if (
            len(authority.shard_roots) != 1
            or len(authority.shard_relative_paths) != 1
        ):
            raise RuntimeError("NoNE local pack locator is not one-file")
        payload_path = (
            authority.shard_roots[0]
            / authority.shard_relative_paths[0]
        ).resolve()
        index_path = (
            authority.index_root / authority.index_relative_path
        ).resolve()
        replica_rows.append(
            {
                "root": str(root.resolve()),
                "device": root.stat().st_dev,
                "payloadPath": str(payload_path),
                "payloadSha256": _tensor_digest_hex(
                    authority.shard_sha256s_t[0]
                ),
                "payloadBytes": int(authority.shard_bytes_t[0]),
                "indexPath": str(index_path),
                "indexSha256": _tensor_digest_hex(
                    authority.index_sha256_t
                ),
                "indexBytes": int(authority.index_bytes_t),
            }
        )
    chunks: list[bytes] = []
    header_bytes, previous_sha256 = (
        _sealed_diagnostic_jsonl_record_boundary(
            {
                "schema": (
                    DIRECT_PAGE_PACK_LOCAL_LOCATOR_DIAGNOSTIC_SCHEMA
                ),
                "recordKind": "header",
                "pageCount": int(index.page_ids_t.numel()),
                "canonicalInventorySha256": (
                    canonical_inventory_sha256
                ),
                "payloadReplicas": replica_rows,
                "containsLocalPaths": bool(source_paths),
                "diagnosticOnly": True,
                "runtimeAuthority": False,
                "acceptanceGate": False,
            },
            previous_record_sha256=None,
        )
    )
    chunks.append(header_bytes)
    for ordinal, unresolved_path in enumerate(source_paths):
        path = unresolved_path.expanduser().resolve()
        identity = path.lstat()
        row_bytes, previous_sha256 = (
            _sealed_diagnostic_jsonl_record_boundary(
                {
                    "schema": (
                        DIRECT_PAGE_PACK_LOCAL_LOCATOR_DIAGNOSTIC_SCHEMA
                    ),
                    "recordKind": "pageSourceObservation",
                    "ordinal": ordinal,
                    "pageId": int(index.page_ids_t[ordinal]),
                    "objectSha256": _tensor_digest_hex(
                        index.object_sha256s_t[ordinal]
                    ),
                    "objectBytes": int(index.object_bytes_t[ordinal]),
                    "sourcePath": str(path),
                    "sourceDevice": identity.st_dev,
                    "sourceInode": identity.st_ino,
                    "sourceMode": stat.S_IMODE(identity.st_mode),
                    "sourceFileBytes": identity.st_size,
                    "payloadOffsetBytes": int(
                        index.object_offsets_t[ordinal]
                    ),
                    "alignedSpanBytes": int(
                        index.object_spans_t[ordinal]
                    ),
                    "formatRevision": int(
                        index.format_revisions_t[ordinal]
                    ),
                    "diagnosticOnly": True,
                    "runtimeAuthority": False,
                    "acceptanceGate": False,
                },
                previous_record_sha256=previous_sha256,
            )
        )
        chunks.append(row_bytes)
    complete_bytes, terminal_sha256 = (
        _sealed_diagnostic_jsonl_record_boundary(
            {
                "schema": (
                    DIRECT_PAGE_PACK_LOCAL_LOCATOR_DIAGNOSTIC_SCHEMA
                ),
                "recordKind": "complete",
                "recordCount": len(source_paths),
                "canonicalInventorySha256": (
                    canonical_inventory_sha256
                ),
                "containsLocalPaths": bool(source_paths),
                "diagnosticOnly": True,
                "runtimeAuthority": False,
                "acceptanceGate": False,
            },
            previous_record_sha256=previous_sha256,
        )
    )
    chunks.append(complete_bytes)
    return b"".join(chunks), terminal_sha256


_SAFETENSORS_DTYPE_BYTES: Final[dict[str, int]] = {
    "BOOL": 1,
    "U8": 1,
    "I8": 1,
    "F8_E4M3": 1,
    "F8_E5M2": 1,
    "I16": 2,
    "U16": 2,
    "F16": 2,
    "BF16": 2,
    "I32": 4,
    "U32": 4,
    "F32": 4,
    "I64": 8,
    "U64": 8,
    "F64": 8,
}


def _none_semantic_page_pack_align_up_boundary(
    value: int,
    alignment: int,
) -> int:
    """Align one explicit storage offset without changing logical bytes."""

    if value < 0 or alignment < 1 or alignment & (alignment - 1):
        raise ValueError("NoNE semantic pack alignment is malformed")
    return (value + alignment - 1) & -alignment


def _none_semantic_page_pack_sha256_boundary(
    payload: bytes | bytearray | mmap.mmap,
    *,
    digest_offset: int,
) -> bytes:
    """Hash a complete pack with only its self-digest field canonicalized."""

    view = memoryview(payload)
    try:
        if (
            digest_offset < 0
            or digest_offset + hashlib.sha256().digest_size > len(view)
        ):
            raise ValueError("NoNE semantic pack digest offset is malformed")
        digest = hashlib.sha256()
        digest.update(view[:digest_offset])
        digest.update(b"\x00" * hashlib.sha256().digest_size)
        digest.update(view[digest_offset + hashlib.sha256().digest_size :])
        return digest.digest()
    finally:
        view.release()


def _none_semantic_page_pack_source_identity_boundary(
    source: _NoNESemanticPagePackSourceBoundary,
) -> tuple[int, bytes, int, Path | None, bytes]:
    """Read and verify one immutable source object at the disk boundary."""

    page_id_t = source.object.page_id_t.detach().cpu().long().reshape(-1)
    digest_t = (
        source.object.object_sha256_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
        .reshape(-1)
    )
    object_bytes_t = (
        source.object.object_bytes_t.detach().cpu().long().reshape(-1)
    )
    if (
        page_id_t.shape != (1,)
        or page_id_t.lt(0).any()
        or digest_t.shape != (32,)
        or object_bytes_t.shape != (1,)
        or object_bytes_t.le(0).any()
    ):
        raise ValueError("NoNE semantic pack source identity is malformed")
    page_id = int(page_id_t[0])
    object_sha256 = bytes(digest_t.tolist())
    object_bytes = int(object_bytes_t[0])
    if (source.object_path is None) == (source.object_payload is None):
        raise ValueError(
            "NoNE semantic pack source must bind exactly one byte authority"
        )
    object_path: Path | None = None
    if source.object_path is not None:
        object_path = source.object_path.expanduser().resolve()
        try:
            object_stat = object_path.stat()
        except OSError as error:
            raise RuntimeError(
                "NoNE semantic pack source object is absent"
            ) from error
        if (
            not stat.S_ISREG(object_stat.st_mode)
            or object_stat.st_size != object_bytes
        ):
            raise RuntimeError("NoNE semantic pack source object size differs")
        payload = object_path.read_bytes()
    else:
        payload = cast(bytes, source.object_payload)
    if (
        len(payload) != object_bytes
        or hashlib.sha256(payload).digest() != object_sha256
    ):
        raise RuntimeError("NoNE semantic pack source object digest differs")
    return page_id, object_sha256, object_bytes, object_path, payload


def _none_semantic_page_tensor_slices_boundary(
    payload: bytes,
    *,
    expected_page_id: int,
) -> tuple[bytes, tuple[_NoNESemanticTensorSliceBoundary, ...]]:
    """Parse and validate one exact rev6 safetensors byte surface."""

    if len(payload) < 10:
        raise RuntimeError("NoNE semantic pack safetensors object is truncated")
    header_bytes = struct.unpack_from("<Q", payload, 0)[0]
    data_start = 8 + header_bytes
    if header_bytes < 2 or data_start > len(payload):
        raise RuntimeError("NoNE semantic pack safetensors header is malformed")
    encoded_header = payload[8:data_start]
    canonical_header = encoded_header.rstrip(b" ")
    if (
        not canonical_header
        or encoded_header[len(canonical_header) :] != (
            b" " * (len(encoded_header) - len(canonical_header))
        )
    ):
        raise RuntimeError("NoNE semantic pack safetensors padding differs")
    try:
        header_value = json.loads(canonical_header)
    except (UnicodeDecodeError, json.JSONDecodeError) as error:
        raise RuntimeError(
            "NoNE semantic pack safetensors header is malformed"
        ) from error
    if not isinstance(header_value, dict):
        raise RuntimeError("NoNE semantic pack safetensors header differs")

    raw_slices: list[tuple[str, str, tuple[int, ...], int, int]] = []
    for name, descriptor_value in header_value.items():
        if name == "__metadata__":
            if not isinstance(descriptor_value, dict):
                raise RuntimeError(
                    "NoNE semantic pack safetensors metadata differs"
                )
            continue
        if not isinstance(name, str) or not isinstance(descriptor_value, dict):
            raise RuntimeError("NoNE semantic pack tensor descriptor differs")
        dtype = descriptor_value.get("dtype")
        shape_value = descriptor_value.get("shape")
        offsets_value = descriptor_value.get("data_offsets")
        if (
            not isinstance(dtype, str)
            or dtype not in _SAFETENSORS_DTYPE_BYTES
            or not isinstance(shape_value, list)
            or any(
                not isinstance(dimension, int)
                or isinstance(dimension, bool)
                or dimension < 0
                for dimension in shape_value
            )
            or not isinstance(offsets_value, list)
            or len(offsets_value) != 2
            or any(
                not isinstance(offset, int)
                or isinstance(offset, bool)
                or offset < 0
                for offset in offsets_value
            )
        ):
            raise RuntimeError("NoNE semantic pack tensor descriptor differs")
        shape = tuple(shape_value)
        element_count = math.prod(shape)
        start, end = offsets_value
        if (
            end < start
            or end - start != element_count * _SAFETENSORS_DTYPE_BYTES[dtype]
            or data_start + end > len(payload)
        ):
            raise RuntimeError("NoNE semantic pack tensor geometry differs")
        raw_slices.append((name, dtype, shape, start, end))
    if not raw_slices:
        raise RuntimeError("NoNE semantic pack tensor set is empty")
    raw_slices.sort(key=lambda row: row[3])
    cursor = 0
    for _name, _dtype, _shape, start, end in raw_slices:
        if start != cursor:
            raise RuntimeError("NoNE semantic pack tensor offsets are noncanonical")
        cursor = end
    if data_start + cursor != len(payload):
        raise RuntimeError("NoNE semantic pack tensor payload size differs")

    descriptor_by_name = {row[0]: row for row in raw_slices}
    revision = descriptor_by_name.get("format_revision_t")
    page_ids = descriptor_by_name.get("page_ids_t")
    if (
        revision is None
        or revision[1] != "I64"
        or revision[2] != (1,)
        or page_ids is None
        or page_ids[1] != "I64"
        or page_ids[2] != (1,)
    ):
        raise RuntimeError("NoNE semantic pack rev6 authority is incomplete")
    revision_value = struct.unpack_from(
        "<q",
        payload,
        data_start + revision[3],
    )[0]
    page_id_value = struct.unpack_from(
        "<q",
        payload,
        data_start + page_ids[3],
    )[0]
    if (
        revision_value != BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
        or page_id_value != expected_page_id
    ):
        raise RuntimeError("NoNE semantic pack rev6 identity differs")

    raw_low_cursor = 0
    semantic_cursor = 0
    tensor_slices: list[_NoNESemanticTensorSliceBoundary] = []
    for name, dtype, shape, start, end in raw_slices:
        tensor_bytes = end - start
        if dtype == "BF16":
            raw_low_bytes = tensor_bytes // 2
            semantic_bytes = raw_low_bytes
        else:
            raw_low_bytes = 0
            semantic_bytes = tensor_bytes
        tensor_slices.append(
            _NoNESemanticTensorSliceBoundary(
                name=name,
                dtype=dtype,
                shape=shape,
                canonical_start=data_start + start,
                canonical_end=data_start + end,
                raw_low_start=raw_low_cursor,
                raw_low_bytes=raw_low_bytes,
                semantic_start=semantic_cursor,
                semantic_bytes=semantic_bytes,
            )
        )
        raw_low_cursor += raw_low_bytes
        semantic_cursor += semantic_bytes
    return payload[:data_start], tuple(tensor_slices)


def _none_semantic_page_transform_boundary(
    source: _NoNESemanticPagePackSourceBoundary,
) -> _NoNESemanticPageTransformBoundary:
    """Split BF16 low bytes from semantic bytes without changing information."""

    page_id, object_sha256, object_bytes, object_path, payload = (
        _none_semantic_page_pack_source_identity_boundary(source)
    )
    prefix, tensor_slices = _none_semantic_page_tensor_slices_boundary(
        payload,
        expected_page_id=page_id,
    )
    raw_low_bytes = sum(row.raw_low_bytes for row in tensor_slices)
    semantic_bytes = sum(row.semantic_bytes for row in tensor_slices)
    raw_low_array = np.empty(raw_low_bytes, dtype=np.uint8)
    semantic_array = np.empty(semantic_bytes, dtype=np.uint8)
    payload_array = np.frombuffer(payload, dtype=np.uint8)
    for tensor_slice in tensor_slices:
        tensor_array = payload_array[
            tensor_slice.canonical_start : tensor_slice.canonical_end
        ]
        if tensor_slice.dtype == "BF16":
            paired_array = tensor_array.reshape(-1, 2)
            raw_low_array[
                tensor_slice.raw_low_start : (
                    tensor_slice.raw_low_start
                    + tensor_slice.raw_low_bytes
                )
            ] = paired_array[:, 0]
            semantic_array[
                tensor_slice.semantic_start : (
                    tensor_slice.semantic_start
                    + tensor_slice.semantic_bytes
                )
            ] = paired_array[:, 1]
        else:
            semantic_array[
                tensor_slice.semantic_start : (
                    tensor_slice.semantic_start
                    + tensor_slice.semantic_bytes
                )
            ] = tensor_array
    raw_low = raw_low_array.tobytes()
    semantic = semantic_array.tobytes()
    if (
        len(raw_low) != raw_low_bytes
        or len(semantic) != semantic_bytes
    ):
        raise RuntimeError("NoNE semantic page transform geometry differs")
    return _NoNESemanticPageTransformBoundary(
        source=replace(source, object_path=object_path),
        page_id=page_id,
        object_sha256=object_sha256,
        object_bytes=object_bytes,
        prefix=prefix,
        raw_low=raw_low,
        semantic=semantic,
        prefix_sha256=hashlib.sha256(prefix).digest(),
        raw_low_sha256=hashlib.sha256(raw_low).digest(),
        semantic_sha256=hashlib.sha256(semantic).digest(),
        tensor_slices=tensor_slices,
    )


def _none_semantic_page_entry_record_boundary(
    *,
    transform: _NoNESemanticPageTransformBoundary,
    frame: bytes,
    raw_low_offset: int,
    semantic_frame_offset: int,
) -> dict[str, Any]:
    """Form one canonical table row at the explicit JSON disk boundary."""

    tensor_records = [
        {
            "canonicalOffsets": [
                tensor_slice.canonical_start,
                tensor_slice.canonical_end,
            ],
            "dtype": tensor_slice.dtype,
            "name": tensor_slice.name,
            "rawLowOffsets": [
                tensor_slice.raw_low_start,
                tensor_slice.raw_low_bytes,
            ],
            "semanticOffsets": [
                tensor_slice.semantic_start,
                tensor_slice.semantic_bytes,
            ],
            "shape": list(tensor_slice.shape),
        }
        for tensor_slice in transform.tensor_slices
    ]
    record: dict[str, Any] = {
        "objectBytes": transform.object_bytes,
        "objectSha256": transform.object_sha256.hex(),
        "pageId": transform.page_id,
        "prefixBase64": base64.b64encode(transform.prefix).decode("ascii"),
        "prefixSha256": transform.prefix_sha256.hex(),
        "rawLowBytes": len(transform.raw_low),
        "rawLowOffset": raw_low_offset,
        "rawLowSha256": transform.raw_low_sha256.hex(),
        "semanticBytes": len(transform.semantic),
        "semanticFrameBytes": len(frame),
        "semanticFrameOffset": semantic_frame_offset,
        "semanticFrameSha256": hashlib.sha256(frame).hexdigest(),
        "semanticSha256": transform.semantic_sha256.hex(),
        "tensors": tensor_records,
    }
    record["pageSha256"] = hashlib.sha256(
        _canonical_json_bytes(record)
    ).hexdigest()
    return record


def _encode_none_semantic_page_pack_boundary(
    sources: tuple[_NoNESemanticPagePackSourceBoundary, ...],
    *,
    alignment: int,
) -> _NoNESemanticPagePackBuildBoundary:
    """Encode a branch-wide rev6 batch into one deterministic immutable pack."""

    started_ns = time.perf_counter_ns()
    if (
        not sources
        or alignment < 4096
        or alignment % 4096
        or alignment & (alignment - 1)
    ):
        raise ValueError("NoNE semantic page pack batch is malformed")
    transforms = tuple(
        _none_semantic_page_transform_boundary(source)
        for source in sources
    )
    page_ids = tuple(transform.page_id for transform in transforms)
    if page_ids != tuple(sorted(set(page_ids))):
        raise ValueError(
            "NoNE semantic page pack page IDs must be strictly ordered"
        )

    worker_count = min(len(transforms), max(1, os.cpu_count() or 1))
    compressed = zstd.ZstdCompressor(level=1).multi_compress_to_buffer(
        [transform.semantic for transform in transforms],
        threads=worker_count,
    )
    frames = tuple(
        compressed[index].tobytes() for index in range(len(compressed))
    )
    if len(frames) != len(transforms) or any(not frame for frame in frames):
        raise RuntimeError("NoNE semantic page compression is incomplete")

    entry_records: list[dict[str, Any]] = []
    raw_low_offset = 0
    for transform, frame in zip(transforms, frames, strict=True):
        semantic_frame_offset = raw_low_offset + len(transform.raw_low)
        entry_records.append(
            _none_semantic_page_entry_record_boundary(
                transform=transform,
                frame=frame,
                raw_low_offset=raw_low_offset,
                semantic_frame_offset=semantic_frame_offset,
            )
        )
        raw_low_offset = semantic_frame_offset + len(frame)
    payload_bytes = raw_low_offset
    table_record: dict[str, Any] = {
        "codec": _NONE_SEMANTIC_PAGE_PACK_CODEC,
        "compression": {
            "algorithm": "zstd",
            "contentSize": True,
            "framePerPage": True,
            "level": 1,
        },
        "pageCount": len(entry_records),
        "pages": entry_records,
        "schema": NONE_SEMANTIC_PAGE_PACK_SCHEMA,
    }
    table_bytes = _canonical_json_bytes(table_record)
    table_sha256 = hashlib.sha256(table_bytes).digest()
    table_offset = _none_semantic_page_pack_align_up_boundary(
        _NONE_SEMANTIC_PAGE_PACK_HEADER.size,
        alignment,
    )
    payload_offset = _none_semantic_page_pack_align_up_boundary(
        table_offset + len(table_bytes),
        alignment,
    )
    footer_offset = _none_semantic_page_pack_align_up_boundary(
        payload_offset + payload_bytes,
        alignment,
    )
    pack_bytes = _none_semantic_page_pack_align_up_boundary(
        footer_offset + _NONE_SEMANTIC_PAGE_PACK_FOOTER.size,
        alignment,
    )
    pack = bytearray(pack_bytes)
    _NONE_SEMANTIC_PAGE_PACK_HEADER.pack_into(
        pack,
        0,
        _NONE_SEMANTIC_PAGE_PACK_MAGIC,
        _NONE_SEMANTIC_PAGE_PACK_VERSION,
        _NONE_SEMANTIC_PAGE_PACK_HEADER.size,
        table_offset,
        len(table_bytes),
        payload_offset,
        footer_offset,
        pack_bytes,
        len(entry_records),
    )
    pack[table_offset : table_offset + len(table_bytes)] = table_bytes
    for transform, frame, record in zip(
        transforms,
        frames,
        entry_records,
        strict=True,
    ):
        raw_low_start = payload_offset + int(record["rawLowOffset"])
        semantic_frame_start = (
            payload_offset + int(record["semanticFrameOffset"])
        )
        pack[
            raw_low_start : raw_low_start + len(transform.raw_low)
        ] = transform.raw_low
        pack[
            semantic_frame_start : semantic_frame_start + len(frame)
        ] = frame
    _NONE_SEMANTIC_PAGE_PACK_FOOTER.pack_into(
        pack,
        footer_offset,
        _NONE_SEMANTIC_PAGE_PACK_FOOTER_MAGIC,
        _NONE_SEMANTIC_PAGE_PACK_VERSION,
        _NONE_SEMANTIC_PAGE_PACK_FOOTER.size,
        pack_bytes,
        table_sha256,
        b"\x00" * hashlib.sha256().digest_size,
    )
    pack_digest_offset = (
        footer_offset + _NONE_SEMANTIC_PAGE_PACK_SHA256_FOOTER_OFFSET
    )
    pack_sha256 = _none_semantic_page_pack_sha256_boundary(
        pack,
        digest_offset=pack_digest_offset,
    )
    pack[
        pack_digest_offset : pack_digest_offset + hashlib.sha256().digest_size
    ] = pack_sha256

    entries: list[_NoNESemanticPagePackEntryBoundary] = []
    for transform, frame, record in zip(
        transforms,
        frames,
        entry_records,
        strict=True,
    ):
        packet = _NoNESemanticPagePackEntryPacket(
            page_id_t=torch.tensor(record["pageId"], dtype=torch.long),
            object_sha256_t=digest_tensor(record["objectSha256"]),
            object_bytes_t=torch.tensor(record["objectBytes"], dtype=torch.long),
            raw_low_offset_t=torch.tensor(
                record["rawLowOffset"],
                dtype=torch.long,
            ),
            raw_low_bytes_t=torch.tensor(
                record["rawLowBytes"],
                dtype=torch.long,
            ),
            semantic_frame_offset_t=torch.tensor(
                record["semanticFrameOffset"],
                dtype=torch.long,
            ),
            semantic_frame_bytes_t=torch.tensor(
                record["semanticFrameBytes"],
                dtype=torch.long,
            ),
            semantic_bytes_t=torch.tensor(
                record["semanticBytes"],
                dtype=torch.long,
            ),
        )
        entries.append(
            _NoNESemanticPagePackEntryBoundary(
                packet=packet,
                prefix=transform.prefix,
                prefix_sha256=transform.prefix_sha256,
                raw_low_sha256=transform.raw_low_sha256,
                semantic_sha256=transform.semantic_sha256,
                semantic_frame_sha256=bytes.fromhex(
                    record["semanticFrameSha256"]
                ),
                page_sha256=bytes.fromhex(record["pageSha256"]),
                tensor_slices=transform.tensor_slices,
            )
        )
    locator = _NoNESemanticPagePackLocatorPacket(
        pack_path=Path(f"{pack_sha256.hex()}{_NONE_SEMANTIC_PAGE_PACK_SUFFIX}"),
        pack_sha256_t=digest_tensor(pack_sha256.hex()),
        table_sha256_t=digest_tensor(table_sha256.hex()),
        pack_bytes_t=torch.tensor(pack_bytes, dtype=torch.long),
        alignment_bytes_t=torch.tensor(alignment, dtype=torch.long),
        page_ids_t=torch.tensor(page_ids, dtype=torch.long),
        object_sha256s_t=torch.stack(
            tuple(entry.packet.object_sha256_t for entry in entries),
            dim=0,
        ),
        object_bytes_t=torch.stack(
            tuple(entry.packet.object_bytes_t for entry in entries),
            dim=0,
        ),
        direct_durable_t=torch.tensor(False),
        rate_eligible_t=torch.tensor(False),
    )
    return _NoNESemanticPagePackBuildBoundary(
        pack_bytes=bytes(pack),
        locator=locator,
        entries=tuple(entries),
        encode_elapsed_ns_t=torch.tensor(
            time.perf_counter_ns() - started_ns,
            dtype=torch.long,
        ),
    )


def _none_semantic_page_pack_scalar_boundary(
    value_t: torch.Tensor,
    *,
    name: str,
    minimum: int,
) -> int:
    """Extract one persisted storage scalar at the explicit disk boundary."""

    value = value_t.detach().cpu().long().reshape(-1)
    if value.shape != (1,) or value.lt(minimum).any():
        raise RuntimeError(f"NoNE semantic page pack {name} is malformed")
    return int(value[0])


def _none_semantic_page_pack_sha256_bytes_boundary(
    value_t: torch.Tensor,
    *,
    name: str,
) -> bytes:
    """Validate one tensor-native SHA-256 identity at the disk boundary."""

    value = value_t.detach().cpu().to(dtype=torch.uint8).reshape(-1)
    if value.shape != (hashlib.sha256().digest_size,):
        raise RuntimeError(f"NoNE semantic page pack {name} is malformed")
    return bytes(value.tolist())


def _none_semantic_page_pack_record_int_boundary(
    record: Mapping[str, Any],
    key: str,
    *,
    minimum: int,
) -> int:
    """Read one canonical non-boolean JSON integer."""

    value = record.get(key)
    if (
        not isinstance(value, int)
        or isinstance(value, bool)
        or value < minimum
    ):
        raise RuntimeError(f"NoNE semantic page pack {key} is malformed")
    return value


def _none_semantic_page_pack_record_sha256_boundary(
    record: Mapping[str, Any],
    key: str,
) -> bytes:
    """Read one canonical SHA-256 from a table row."""

    value = record.get(key)
    if not _is_sha256_hex_boundary(value):
        raise RuntimeError(f"NoNE semantic page pack {key} is malformed")
    return bytes.fromhex(cast(str, value))


def _none_semantic_page_pack_record_pair_boundary(
    record: Mapping[str, Any],
    key: str,
) -> tuple[int, int]:
    """Read one canonical nonnegative offset/length pair."""

    value = record.get(key)
    if (
        not isinstance(value, list)
        or len(value) != 2
        or any(
            not isinstance(element, int)
            or isinstance(element, bool)
            or element < 0
            for element in value
        )
    ):
        raise RuntimeError(f"NoNE semantic page pack {key} is malformed")
    return int(value[0]), int(value[1])


def _none_semantic_page_pack_table_entries_boundary(
    table_bytes: bytes,
    *,
    expected_page_count: int,
) -> tuple[_NoNESemanticPagePackEntryBoundary, ...]:
    """Decode a canonical table without trusting any allocation geometry."""

    try:
        table_value = json.loads(table_bytes)
    except (UnicodeDecodeError, json.JSONDecodeError) as error:
        raise RuntimeError("NoNE semantic page pack table is malformed") from error
    if (
        not isinstance(table_value, dict)
        or _canonical_json_bytes(table_value) != table_bytes
        or set(table_value)
        != {"codec", "compression", "pageCount", "pages", "schema"}
        or table_value.get("schema") != NONE_SEMANTIC_PAGE_PACK_SCHEMA
        or table_value.get("codec") != _NONE_SEMANTIC_PAGE_PACK_CODEC
        or table_value.get("compression")
        != {
            "algorithm": "zstd",
            "contentSize": True,
            "framePerPage": True,
            "level": 1,
        }
        or table_value.get("pageCount") != expected_page_count
        or not isinstance(table_value.get("pages"), list)
        or len(table_value["pages"]) != expected_page_count
    ):
        raise RuntimeError("NoNE semantic page pack table differs")

    entries: list[_NoNESemanticPagePackEntryBoundary] = []
    prior_page_id = -1
    payload_cursor = 0
    page_keys = {
        "objectBytes",
        "objectSha256",
        "pageId",
        "pageSha256",
        "prefixBase64",
        "prefixSha256",
        "rawLowBytes",
        "rawLowOffset",
        "rawLowSha256",
        "semanticBytes",
        "semanticFrameBytes",
        "semanticFrameOffset",
        "semanticFrameSha256",
        "semanticSha256",
        "tensors",
    }
    tensor_keys = {
        "canonicalOffsets",
        "dtype",
        "name",
        "rawLowOffsets",
        "semanticOffsets",
        "shape",
    }
    for page_value in table_value["pages"]:
        if not isinstance(page_value, dict) or set(page_value) != page_keys:
            raise RuntimeError("NoNE semantic page pack page row differs")
        page_record = cast(dict[str, Any], page_value)
        page_sha256 = _none_semantic_page_pack_record_sha256_boundary(
            page_record,
            "pageSha256",
        )
        page_identity_record = {
            key: value
            for key, value in page_record.items()
            if key != "pageSha256"
        }
        if hashlib.sha256(
            _canonical_json_bytes(page_identity_record)
        ).digest() != page_sha256:
            raise RuntimeError("NoNE semantic page pack page identity differs")

        page_id = _none_semantic_page_pack_record_int_boundary(
            page_record,
            "pageId",
            minimum=0,
        )
        object_bytes = _none_semantic_page_pack_record_int_boundary(
            page_record,
            "objectBytes",
            minimum=1,
        )
        raw_low_offset = _none_semantic_page_pack_record_int_boundary(
            page_record,
            "rawLowOffset",
            minimum=0,
        )
        raw_low_bytes = _none_semantic_page_pack_record_int_boundary(
            page_record,
            "rawLowBytes",
            minimum=0,
        )
        semantic_frame_offset = (
            _none_semantic_page_pack_record_int_boundary(
                page_record,
                "semanticFrameOffset",
                minimum=0,
            )
        )
        semantic_frame_bytes = (
            _none_semantic_page_pack_record_int_boundary(
                page_record,
                "semanticFrameBytes",
                minimum=1,
            )
        )
        semantic_bytes = _none_semantic_page_pack_record_int_boundary(
            page_record,
            "semanticBytes",
            minimum=1,
        )
        if (
            page_id <= prior_page_id
            or raw_low_offset != payload_cursor
            or semantic_frame_offset != raw_low_offset + raw_low_bytes
        ):
            raise RuntimeError("NoNE semantic page pack page order differs")

        prefix_value = page_record.get("prefixBase64")
        if not isinstance(prefix_value, str):
            raise RuntimeError("NoNE semantic page pack prefix is malformed")
        try:
            prefix = base64.b64decode(
                prefix_value.encode("ascii"),
                validate=True,
            )
        except (UnicodeEncodeError, ValueError) as error:
            raise RuntimeError(
                "NoNE semantic page pack prefix is malformed"
            ) from error
        prefix_sha256 = _none_semantic_page_pack_record_sha256_boundary(
            page_record,
            "prefixSha256",
        )
        if not prefix or hashlib.sha256(prefix).digest() != prefix_sha256:
            raise RuntimeError("NoNE semantic page pack prefix differs")

        tensor_values = page_record.get("tensors")
        if not isinstance(tensor_values, list) or not tensor_values:
            raise RuntimeError("NoNE semantic page pack tensor table is malformed")
        tensor_slices: list[_NoNESemanticTensorSliceBoundary] = []
        names: set[str] = set()
        canonical_cursor = len(prefix)
        raw_low_cursor = 0
        semantic_cursor = 0
        for tensor_value in tensor_values:
            if (
                not isinstance(tensor_value, dict)
                or set(tensor_value) != tensor_keys
            ):
                raise RuntimeError(
                    "NoNE semantic page pack tensor row differs"
                )
            tensor_record = cast(dict[str, Any], tensor_value)
            name = tensor_record.get("name")
            dtype = tensor_record.get("dtype")
            shape_value = tensor_record.get("shape")
            if (
                not isinstance(name, str)
                or not name
                or name in names
                or not isinstance(dtype, str)
                or dtype not in _SAFETENSORS_DTYPE_BYTES
                or not isinstance(shape_value, list)
                or any(
                    not isinstance(dimension, int)
                    or isinstance(dimension, bool)
                    or dimension < 0
                    for dimension in shape_value
                )
            ):
                raise RuntimeError(
                    "NoNE semantic page pack tensor identity differs"
                )
            canonical_start, canonical_end = (
                _none_semantic_page_pack_record_pair_boundary(
                    tensor_record,
                    "canonicalOffsets",
                )
            )
            raw_low_start, tensor_raw_low_bytes = (
                _none_semantic_page_pack_record_pair_boundary(
                    tensor_record,
                    "rawLowOffsets",
                )
            )
            semantic_start, tensor_semantic_bytes = (
                _none_semantic_page_pack_record_pair_boundary(
                    tensor_record,
                    "semanticOffsets",
                )
            )
            shape = tuple(shape_value)
            tensor_bytes = math.prod(shape) * _SAFETENSORS_DTYPE_BYTES[dtype]
            expected_raw_low_bytes = tensor_bytes // 2 if dtype == "BF16" else 0
            expected_semantic_bytes = (
                tensor_bytes // 2 if dtype == "BF16" else tensor_bytes
            )
            if (
                canonical_start != canonical_cursor
                or canonical_end - canonical_start != tensor_bytes
                or raw_low_start != raw_low_cursor
                or tensor_raw_low_bytes != expected_raw_low_bytes
                or semantic_start != semantic_cursor
                or tensor_semantic_bytes != expected_semantic_bytes
            ):
                raise RuntimeError(
                    "NoNE semantic page pack tensor geometry differs"
                )
            tensor_slices.append(
                _NoNESemanticTensorSliceBoundary(
                    name=name,
                    dtype=dtype,
                    shape=shape,
                    canonical_start=canonical_start,
                    canonical_end=canonical_end,
                    raw_low_start=raw_low_start,
                    raw_low_bytes=tensor_raw_low_bytes,
                    semantic_start=semantic_start,
                    semantic_bytes=tensor_semantic_bytes,
                )
            )
            names.add(name)
            canonical_cursor = canonical_end
            raw_low_cursor += tensor_raw_low_bytes
            semantic_cursor += tensor_semantic_bytes
        if (
            canonical_cursor != object_bytes
            or raw_low_cursor != raw_low_bytes
            or semantic_cursor != semantic_bytes
            or object_bytes != len(prefix) + raw_low_bytes + semantic_bytes
        ):
            raise RuntimeError("NoNE semantic page pack object geometry differs")

        object_sha256 = _none_semantic_page_pack_record_sha256_boundary(
            page_record,
            "objectSha256",
        )
        raw_low_sha256 = _none_semantic_page_pack_record_sha256_boundary(
            page_record,
            "rawLowSha256",
        )
        semantic_sha256 = _none_semantic_page_pack_record_sha256_boundary(
            page_record,
            "semanticSha256",
        )
        semantic_frame_sha256 = (
            _none_semantic_page_pack_record_sha256_boundary(
                page_record,
                "semanticFrameSha256",
            )
        )
        packet = _NoNESemanticPagePackEntryPacket(
            page_id_t=torch.tensor(page_id, dtype=torch.long),
            object_sha256_t=digest_tensor(object_sha256.hex()),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
            raw_low_offset_t=torch.tensor(raw_low_offset, dtype=torch.long),
            raw_low_bytes_t=torch.tensor(raw_low_bytes, dtype=torch.long),
            semantic_frame_offset_t=torch.tensor(
                semantic_frame_offset,
                dtype=torch.long,
            ),
            semantic_frame_bytes_t=torch.tensor(
                semantic_frame_bytes,
                dtype=torch.long,
            ),
            semantic_bytes_t=torch.tensor(semantic_bytes, dtype=torch.long),
        )
        entries.append(
            _NoNESemanticPagePackEntryBoundary(
                packet=packet,
                prefix=prefix,
                prefix_sha256=prefix_sha256,
                raw_low_sha256=raw_low_sha256,
                semantic_sha256=semantic_sha256,
                semantic_frame_sha256=semantic_frame_sha256,
                page_sha256=page_sha256,
                tensor_slices=tuple(tensor_slices),
            )
        )
        prior_page_id = page_id
        payload_cursor = semantic_frame_offset + semantic_frame_bytes
    return tuple(entries)


def _none_semantic_page_pack_layout_boundary(
    payload: mmap.mmap,
    locator: _NoNESemanticPagePackLocatorPacket,
) -> _NoNESemanticPagePackLayoutBoundary:
    """Validate header, canonical table, footer, hashes, and zero padding."""

    alignment = _none_semantic_page_pack_scalar_boundary(
        locator.alignment_bytes_t,
        name="alignment",
        minimum=4096,
    )
    expected_pack_bytes = _none_semantic_page_pack_scalar_boundary(
        locator.pack_bytes_t,
        name="byte count",
        minimum=_NONE_SEMANTIC_PAGE_PACK_HEADER.size,
    )
    if (
        alignment % 4096
        or alignment & (alignment - 1)
        or len(payload) != expected_pack_bytes
        or len(payload) < (
            _NONE_SEMANTIC_PAGE_PACK_HEADER.size
            + _NONE_SEMANTIC_PAGE_PACK_FOOTER.size
        )
    ):
        raise RuntimeError("NoNE semantic page pack file geometry differs")
    (
        magic,
        version,
        header_bytes,
        table_offset,
        table_bytes_count,
        payload_offset,
        footer_offset,
        pack_bytes,
        page_count,
    ) = _NONE_SEMANTIC_PAGE_PACK_HEADER.unpack_from(payload, 0)
    if (
        magic != _NONE_SEMANTIC_PAGE_PACK_MAGIC
        or version != _NONE_SEMANTIC_PAGE_PACK_VERSION
        or header_bytes != _NONE_SEMANTIC_PAGE_PACK_HEADER.size
        or table_offset
        != _none_semantic_page_pack_align_up_boundary(header_bytes, alignment)
        or table_bytes_count < 2
        or payload_offset
        != _none_semantic_page_pack_align_up_boundary(
            table_offset + table_bytes_count,
            alignment,
        )
        or footer_offset < payload_offset
        or footer_offset % alignment
        or pack_bytes != len(payload)
        or pack_bytes % alignment
        or page_count < 1
        or footer_offset + _NONE_SEMANTIC_PAGE_PACK_FOOTER.size > pack_bytes
    ):
        raise RuntimeError("NoNE semantic page pack header differs")
    if payload[header_bytes:table_offset] != (
        b"\x00" * (table_offset - header_bytes)
    ):
        raise RuntimeError("NoNE semantic page pack header padding differs")

    table_bytes = bytes(
        payload[table_offset : table_offset + table_bytes_count]
    )
    entries = _none_semantic_page_pack_table_entries_boundary(
        table_bytes,
        expected_page_count=page_count,
    )
    payload_bytes = sum(
        _none_semantic_page_pack_scalar_boundary(
            entry.packet.raw_low_bytes_t,
            name="raw-low byte count",
            minimum=0,
        )
        + _none_semantic_page_pack_scalar_boundary(
            entry.packet.semantic_frame_bytes_t,
            name="semantic frame byte count",
            minimum=1,
        )
        for entry in entries
    )
    if (
        footer_offset
        != _none_semantic_page_pack_align_up_boundary(
            payload_offset + payload_bytes,
            alignment,
        )
        or payload[
            table_offset + table_bytes_count : payload_offset
        ] != b"\x00" * (
            payload_offset - table_offset - table_bytes_count
        )
        or payload[payload_offset + payload_bytes : footer_offset]
        != b"\x00" * (footer_offset - payload_offset - payload_bytes)
    ):
        raise RuntimeError("NoNE semantic page pack payload geometry differs")

    (
        footer_magic,
        footer_version,
        footer_bytes,
        footer_pack_bytes,
        table_sha256,
        stored_pack_sha256,
    ) = _NONE_SEMANTIC_PAGE_PACK_FOOTER.unpack_from(payload, footer_offset)
    if (
        footer_magic != _NONE_SEMANTIC_PAGE_PACK_FOOTER_MAGIC
        or footer_version != _NONE_SEMANTIC_PAGE_PACK_VERSION
        or footer_bytes != _NONE_SEMANTIC_PAGE_PACK_FOOTER.size
        or footer_pack_bytes != pack_bytes
        or table_sha256 != hashlib.sha256(table_bytes).digest()
        or table_sha256
        != _none_semantic_page_pack_sha256_bytes_boundary(
            locator.table_sha256_t,
            name="table digest",
        )
        or payload[
            footer_offset + footer_bytes : pack_bytes
        ] != b"\x00" * (pack_bytes - footer_offset - footer_bytes)
    ):
        raise RuntimeError("NoNE semantic page pack footer differs")
    pack_digest_offset = (
        footer_offset + _NONE_SEMANTIC_PAGE_PACK_SHA256_FOOTER_OFFSET
    )
    pack_sha256 = _none_semantic_page_pack_sha256_boundary(
        payload,
        digest_offset=pack_digest_offset,
    )
    if (
        stored_pack_sha256 != pack_sha256
        or pack_sha256
        != _none_semantic_page_pack_sha256_bytes_boundary(
            locator.pack_sha256_t,
            name="pack digest",
        )
    ):
        raise RuntimeError("NoNE semantic page pack digest differs")

    page_ids_t = torch.stack(
        tuple(entry.packet.page_id_t for entry in entries)
    ).reshape(-1)
    object_sha256s_t = torch.stack(
        tuple(entry.packet.object_sha256_t for entry in entries)
    )
    object_bytes_t = torch.stack(
        tuple(entry.packet.object_bytes_t for entry in entries)
    ).reshape(-1)
    if (
        not torch.equal(
            page_ids_t,
            locator.page_ids_t.detach().cpu().long().reshape(-1),
        )
        or not torch.equal(
            object_sha256s_t,
            locator.object_sha256s_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
        )
        or not torch.equal(
            object_bytes_t,
            locator.object_bytes_t.detach().cpu().long().reshape(-1),
        )
    ):
        raise RuntimeError("NoNE semantic page pack locator differs")
    return _NoNESemanticPagePackLayoutBoundary(
        payload_offset=payload_offset,
        payload_bytes=payload_bytes,
        entries=entries,
    )


def _none_semantic_page_pack_pwritev_all_boundary(
    descriptor: int,
    payload: memoryview,
    *,
    alignment: int,
    direct: bool,
) -> None:
    """Complete every positional write, including aligned short writes."""

    if (
        descriptor < 0
        or len(payload) < 1
        or alignment < 1
        or len(payload) % alignment
    ):
        raise ValueError("NoNE semantic page pack write geometry is malformed")
    offset = 0
    while offset < len(payload):
        chunk_bytes = min(
            _NONE_SEMANTIC_PAGE_PACK_WRITE_CHUNK_BYTES,
            len(payload) - offset,
        )
        chunk_written = 0
        while chunk_written < chunk_bytes:
            chunk = payload[
                offset + chunk_written : offset + chunk_bytes
            ]
            try:
                written = os.pwritev(
                    descriptor,
                    (chunk,),
                    offset + chunk_written,
                )
            finally:
                chunk.release()
            if written < 1:
                raise OSError("NoNE semantic page pack positional write stalled")
            chunk_written += written
            if direct and chunk_written < chunk_bytes and written % alignment:
                raise OSError(
                    "NoNE semantic page pack direct short write is unaligned"
                )
        offset += chunk_bytes


def _none_semantic_page_pack_preadv_all_boundary(
    descriptor: int,
    payload: memoryview,
    *,
    alignment: int,
    direct: bool,
    file_offset: int = 0,
) -> None:
    """Read every aligned pack byte, rejecting ambiguous direct short reads."""

    if (
        descriptor < 0
        or len(payload) < 1
        or alignment < 1
        or len(payload) % alignment
        or file_offset < 0
        or (direct and file_offset % alignment)
    ):
        raise ValueError("NoNE semantic page pack read geometry is malformed")
    offset = 0
    while offset < len(payload):
        chunk_bytes = min(
            _NONE_SEMANTIC_PAGE_PACK_WRITE_CHUNK_BYTES,
            len(payload) - offset,
        )
        chunk_read = 0
        while chunk_read < chunk_bytes:
            chunk = payload[offset + chunk_read : offset + chunk_bytes]
            try:
                read_bytes = os.preadv(
                    descriptor,
                    (chunk,),
                    file_offset + offset + chunk_read,
                )
            finally:
                chunk.release()
            if read_bytes < 1:
                raise OSError(
                    "NoNE semantic page pack positional read was incomplete"
                )
            chunk_read += read_bytes
            if direct and chunk_read != chunk_bytes:
                raise OSError(
                    "NoNE semantic page pack direct read was short"
                )
        offset += chunk_bytes


def _none_semantic_page_pack_write_staged_boundary(
    *,
    temporary_path: Path,
    payload: bytes,
    alignment: int,
    direct: bool,
) -> None:
    """Write and fdatasync one O_EXCL staging inode."""

    direct_flag = getattr(os, "O_DIRECT", 0)
    if direct and not direct_flag:
        raise OSError(
            getattr(os, "ENOTSUP", 95),
            "O_DIRECT is unavailable",
        )
    flags = (
        os.O_WRONLY
        | os.O_CREAT
        | os.O_EXCL
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
        | (direct_flag if direct else 0)
    )
    descriptor = os.open(temporary_path, flags, 0o600)
    bounce = mmap.mmap(-1, len(payload), access=mmap.ACCESS_WRITE)
    payload_view = memoryview(bounce)
    try:
        payload_view[:] = payload
        _none_semantic_page_pack_pwritev_all_boundary(
            descriptor,
            payload_view,
            alignment=alignment,
            direct=direct,
        )
        os.fdatasync(descriptor)
    finally:
        payload_view.release()
        bounce.close()
        os.close(descriptor)


def _none_semantic_page_pack_install_staged_boundary(
    *,
    pack_root: Path,
    temporary_path: Path,
    final_path: Path,
) -> bool:
    """Rename one staged inode under an exclusive directory durability lease."""

    directory_flags = (
        os.O_RDONLY
        | getattr(os, "O_DIRECTORY", 0)
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
    )
    directory_descriptor = os.open(pack_root, directory_flags)
    try:
        fcntl.flock(directory_descriptor, fcntl.LOCK_EX)
        if final_path.exists():
            temporary_path.unlink()
            os.fsync(directory_descriptor)
            return False
        os.rename(temporary_path, final_path)
        os.fsync(directory_descriptor)
        return True
    finally:
        fcntl.flock(directory_descriptor, fcntl.LOCK_UN)
        os.close(directory_descriptor)


def _open_none_semantic_page_pack_mmap_boundary(
    locator: _NoNESemanticPagePackLocatorPacket,
) -> mmap.mmap:
    """Open one regular no-follow pack inode and bind its exact byte count."""

    pack_path = locator.pack_path.expanduser().resolve()
    flags = (
        os.O_RDONLY
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
    )
    descriptor = os.open(pack_path, flags)
    try:
        file_stat = os.fstat(descriptor)
        if (
            not stat.S_ISREG(file_stat.st_mode)
            or file_stat.st_size
            != _none_semantic_page_pack_scalar_boundary(
                locator.pack_bytes_t,
                name="byte count",
                minimum=1,
            )
        ):
            raise RuntimeError("NoNE semantic page pack inode differs")
        mapped = mmap.mmap(descriptor, 0, access=mmap.ACCESS_READ)
    finally:
        os.close(descriptor)
    return mapped


def _open_none_semantic_page_pack_direct_buffer_boundary(
    locator: _NoNESemanticPagePackLocatorPacket,
) -> tuple[mmap.mmap, bool]:
    """Cold-read one aligned pack through O_DIRECT, with explicit fallback."""

    pack_path = locator.pack_path.expanduser().resolve()
    pack_bytes = _none_semantic_page_pack_scalar_boundary(
        locator.pack_bytes_t,
        name="byte count",
        minimum=1,
    )
    alignment = _none_semantic_page_pack_scalar_boundary(
        locator.alignment_bytes_t,
        name="alignment",
        minimum=4096,
    )
    if pack_bytes % alignment:
        raise RuntimeError("NoNE semantic page pack direct geometry differs")
    direct_flag = getattr(os, "O_DIRECT", 0)
    direct = bool(direct_flag)
    flags = (
        os.O_RDONLY
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
        | (direct_flag if direct else 0)
    )
    try:
        descriptor = os.open(pack_path, flags)
    except OSError as error:
        if (
            direct
            and error.errno
            in _NONE_SEMANTIC_PAGE_PACK_UNSUPPORTED_DIRECT_ERRNOS
        ):
            direct = False
            descriptor = os.open(
                pack_path,
                os.O_RDONLY
                | getattr(os, "O_CLOEXEC", 0)
                | getattr(os, "O_NOFOLLOW", 0),
            )
        else:
            raise
    bounce = mmap.mmap(-1, pack_bytes, access=mmap.ACCESS_WRITE)
    payload_view = memoryview(bounce)
    failed = False
    try:
        file_stat = os.fstat(descriptor)
        if (
            not stat.S_ISREG(file_stat.st_mode)
            or file_stat.st_size != pack_bytes
        ):
            raise RuntimeError("NoNE semantic page pack inode differs")
        try:
            _none_semantic_page_pack_preadv_all_boundary(
                descriptor,
                payload_view,
                alignment=alignment,
                direct=direct,
            )
        except OSError as error:
            if (
                direct
                and error.errno
                in _NONE_SEMANTIC_PAGE_PACK_UNSUPPORTED_DIRECT_ERRNOS
            ):
                os.close(descriptor)
                descriptor = os.open(
                    pack_path,
                    os.O_RDONLY
                    | getattr(os, "O_CLOEXEC", 0)
                    | getattr(os, "O_NOFOLLOW", 0),
                )
                direct = False
                _none_semantic_page_pack_preadv_all_boundary(
                    descriptor,
                    payload_view,
                    alignment=alignment,
                    direct=False,
                )
            else:
                raise
    except Exception:
        failed = True
        raise
    finally:
        payload_view.release()
        os.close(descriptor)
        if failed:
            bounce.close()
    return bounce, direct


def _verify_none_semantic_page_pack_layout_file_boundary(
    locator: _NoNESemanticPagePackLocatorPacket,
) -> None:
    """Verify every installed byte and its canonical table without decoding."""

    mapped = _open_none_semantic_page_pack_mmap_boundary(locator)
    try:
        _none_semantic_page_pack_layout_boundary(mapped, locator)
    finally:
        mapped.close()


def _read_none_semantic_page_pack_boundary(
    locator: _NoNESemanticPagePackLocatorPacket,
    *,
    _mapped_payload: mmap.mmap | None = None,
    _expected_entries: (
        tuple[_NoNESemanticPagePackEntryPacket, ...] | None
    ) = None,
) -> _NoNESemanticPagePackDecodedPacket:
    """Cold-open, verify, natively decompress, and exactly reconstruct a pack."""

    mapped = (
        _open_none_semantic_page_pack_mmap_boundary(locator)
        if _mapped_payload is None
        else _mapped_payload
    )
    compressed_segments: object | None = None
    try:
        layout = _none_semantic_page_pack_layout_boundary(mapped, locator)
        if _expected_entries is not None:
            actual_by_page_id = {
                int(entry.packet.page_id_t): entry.packet
                for entry in layout.entries
            }
            for expected in _expected_entries:
                actual = actual_by_page_id.get(int(expected.page_id_t))
                if (
                    actual is None
                    or not torch.equal(
                        actual.object_sha256_t,
                        expected.object_sha256_t,
                    )
                    or not torch.equal(
                        actual.object_bytes_t,
                        expected.object_bytes_t,
                    )
                    or not torch.equal(
                        actual.raw_low_offset_t,
                        expected.raw_low_offset_t,
                    )
                    or not torch.equal(
                        actual.raw_low_bytes_t,
                        expected.raw_low_bytes_t,
                    )
                    or not torch.equal(
                        actual.semantic_frame_offset_t,
                        expected.semantic_frame_offset_t,
                    )
                    or not torch.equal(
                        actual.semantic_frame_bytes_t,
                        expected.semantic_frame_bytes_t,
                    )
                    or not torch.equal(
                        actual.semantic_bytes_t,
                        expected.semantic_bytes_t,
                    )
                ):
                    raise RuntimeError(
                        "NoNE semantic page pack manifest entry differs"
                    )
        segment_table = bytearray(16 * len(layout.entries))
        for index, entry in enumerate(layout.entries):
            frame_offset = _none_semantic_page_pack_scalar_boundary(
                entry.packet.semantic_frame_offset_t,
                name="semantic frame offset",
                minimum=0,
            )
            frame_bytes = _none_semantic_page_pack_scalar_boundary(
                entry.packet.semantic_frame_bytes_t,
                name="semantic frame byte count",
                minimum=1,
            )
            struct.pack_into(
                "<QQ",
                segment_table,
                index * 16,
                layout.payload_offset + frame_offset,
                frame_bytes,
            )
        compressed_segments = zstd.BufferWithSegments(
            cast(memoryview, mapped),
            bytes(segment_table),
        )
        worker_count = min(
            len(layout.entries),
            max(1, os.cpu_count() or 1),
        )
        semantic_segments = (
            zstd.ZstdDecompressor().multi_decompress_to_buffer(
                compressed_segments,
                threads=worker_count,
            )
        )
        if len(semantic_segments) != len(layout.entries):
            raise RuntimeError(
                "NoNE semantic page pack decompression is incomplete"
            )

        object_bytes_values = tuple(
            _none_semantic_page_pack_scalar_boundary(
                entry.packet.object_bytes_t,
                name="object byte count",
                minimum=1,
            )
            for entry in layout.entries
        )
        object_offsets = [0]
        for object_bytes in object_bytes_values:
            object_offsets.append(object_offsets[-1] + object_bytes)
        object_payload_t = torch.empty(
            object_offsets[-1],
            dtype=torch.uint8,
            device="cpu",
        )
        object_payload_array = object_payload_t.numpy()

        def reconstruct_object(
            row: tuple[
                int,
                _NoNESemanticPagePackEntryBoundary,
                int,
            ],
        ) -> None:
            index, entry, object_bytes = row
            raw_low_offset = _none_semantic_page_pack_scalar_boundary(
                entry.packet.raw_low_offset_t,
                name="raw-low offset",
                minimum=0,
            )
            raw_low_bytes = _none_semantic_page_pack_scalar_boundary(
                entry.packet.raw_low_bytes_t,
                name="raw-low byte count",
                minimum=0,
            )
            semantic_bytes = _none_semantic_page_pack_scalar_boundary(
                entry.packet.semantic_bytes_t,
                name="semantic byte count",
                minimum=1,
            )
            raw_low_view = memoryview(mapped)[
                layout.payload_offset + raw_low_offset : (
                    layout.payload_offset + raw_low_offset + raw_low_bytes
                )
            ]
            semantic_view = memoryview(cast(Any, semantic_segments[index]))
            object_array: np.ndarray[Any, np.dtype[np.uint8]] | None = None
            raw_low_array: np.ndarray[Any, np.dtype[np.uint8]] | None = None
            semantic_array: np.ndarray[Any, np.dtype[np.uint8]] | None = None
            try:
                if (
                    len(semantic_view) != semantic_bytes
                ):
                    raise RuntimeError(
                        "NoNE semantic page pack semantic geometry differs"
                    )
                object_start = object_offsets[index]
                object_end = object_offsets[index + 1]
                object_array = object_payload_array[object_start:object_end]
                object_array[: len(entry.prefix)] = np.frombuffer(
                    entry.prefix,
                    dtype=np.uint8,
                )
                raw_low_array = np.frombuffer(raw_low_view, dtype=np.uint8)
                semantic_array = np.frombuffer(semantic_view, dtype=np.uint8)
                for tensor_slice in entry.tensor_slices:
                    tensor_array = object_array[
                        tensor_slice.canonical_start : (
                            tensor_slice.canonical_end
                        )
                    ]
                    semantic_tensor_array = semantic_array[
                        tensor_slice.semantic_start : (
                            tensor_slice.semantic_start
                            + tensor_slice.semantic_bytes
                        )
                    ]
                    if tensor_slice.dtype == "BF16":
                        paired_array = tensor_array.reshape(-1, 2)
                        paired_array[:, 0] = raw_low_array[
                            tensor_slice.raw_low_start : (
                                tensor_slice.raw_low_start
                                + tensor_slice.raw_low_bytes
                            )
                        ]
                        paired_array[:, 1] = semantic_tensor_array
                    else:
                        tensor_array[:] = semantic_tensor_array
            finally:
                object_array = None
                raw_low_array = None
                semantic_array = None
                raw_low_view.release()
                semantic_view.release()
            object_sha256 = _none_semantic_page_pack_sha256_bytes_boundary(
                entry.packet.object_sha256_t,
                name="object digest",
            )
            exact_payload_view = memoryview(object_payload_array)[
                object_offsets[index] : object_offsets[index + 1]
            ]
            try:
                if (
                    len(exact_payload_view) != object_bytes
                    or hashlib.sha256(exact_payload_view).digest()
                    != object_sha256
                ):
                    raise RuntimeError(
                        "NoNE semantic page pack reconstructed object differs"
                    )
            finally:
                exact_payload_view.release()

        with ThreadPoolExecutor(max_workers=worker_count) as executor:
            tuple(
                executor.map(
                    reconstruct_object,
                    (
                        (index, entry, object_bytes)
                        for index, (entry, object_bytes) in enumerate(
                            zip(
                                layout.entries,
                                object_bytes_values,
                                strict=True,
                            )
                        )
                    ),
                )
            )
        compressed_segments = None
        return _NoNESemanticPagePackDecodedPacket(
            page_ids_t=torch.stack(
                tuple(entry.packet.page_id_t for entry in layout.entries)
            ).reshape(-1),
            object_sha256s_t=torch.stack(
                tuple(
                    entry.packet.object_sha256_t
                    for entry in layout.entries
                )
            ),
            object_bytes_t=torch.stack(
                tuple(entry.packet.object_bytes_t for entry in layout.entries)
            ).reshape(-1),
            object_offsets_t=torch.tensor(object_offsets, dtype=torch.long),
            object_payload_t=object_payload_t,
        )
    finally:
        compressed_segments = None
        mapped.close()


def _read_none_semantic_page_pack_selected_boundary(
    locator: _NoNESemanticPagePackLocatorPacket,
    *,
    expected_entries: tuple[_NoNESemanticPagePackEntryPacket, ...],
) -> _NoNESemanticPagePackDecodedPacket:
    """Direct-read and reconstruct only model-routed frames from one pack.

    Staging cold-proves the complete immutable pack. Runtime materialization
    revalidates its canonical header, complete hashed table, footer authority,
    and selected object identities, but it never reads or decompresses an
    unselected page payload. Every payload window remains aligned for
    ``O_DIRECT`` and every direct short read is fatal.
    """

    if not expected_entries:
        raise ValueError("NoNE semantic page pack selection is empty")
    selected_page_ids = tuple(
        _none_semantic_page_pack_scalar_boundary(
            entry.page_id_t,
            name="selected page ID",
            minimum=0,
        )
        for entry in expected_entries
    )
    if len(set(selected_page_ids)) != len(selected_page_ids):
        raise RuntimeError(
            "NoNE semantic page pack selection contains duplicate pages"
        )

    pack_path = locator.pack_path.expanduser().resolve()
    pack_bytes = _none_semantic_page_pack_scalar_boundary(
        locator.pack_bytes_t,
        name="byte count",
        minimum=_NONE_SEMANTIC_PAGE_PACK_HEADER.size,
    )
    alignment = _none_semantic_page_pack_scalar_boundary(
        locator.alignment_bytes_t,
        name="alignment",
        minimum=4096,
    )
    expected_pack_sha256 = (
        _none_semantic_page_pack_sha256_bytes_boundary(
            locator.pack_sha256_t,
            name="pack digest",
        )
    )
    if (
        alignment % 4096
        or alignment & (alignment - 1)
        or pack_bytes % alignment
        or pack_path.name
        != expected_pack_sha256.hex() + _NONE_SEMANTIC_PAGE_PACK_SUFFIX
    ):
        raise RuntimeError("NoNE semantic page pack direct geometry differs")

    identity_before = _file_identity(pack_path)
    direct_flag = getattr(os, "O_DIRECT", 0)
    direct = bool(direct_flag)
    common_flags = (
        os.O_RDONLY
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
    )
    try:
        descriptor = os.open(
            pack_path,
            common_flags | (direct_flag if direct else 0),
        )
    except OSError as error:
        if (
            direct
            and error.errno
            in _NONE_SEMANTIC_PAGE_PACK_UNSUPPORTED_DIRECT_ERRNOS
        ):
            direct = False
            descriptor = os.open(pack_path, common_flags)
        else:
            raise

    def validate_descriptor() -> None:
        descriptor_stat = os.fstat(descriptor)
        if (
            not stat.S_ISREG(descriptor_stat.st_mode)
            or descriptor_stat.st_size != pack_bytes
        ):
            raise RuntimeError("NoNE semantic page pack inode differs")

    def reopen_buffered() -> None:
        nonlocal descriptor, direct
        os.close(descriptor)
        descriptor = os.open(pack_path, common_flags)
        direct = False
        validate_descriptor()

    def read_aligned_window(offset: int, length: int) -> bytes:
        if (
            offset < 0
            or length < 1
            or offset % alignment
            or length % alignment
            or offset + length > pack_bytes
        ):
            raise RuntimeError(
                "NoNE semantic page pack selected window differs"
            )
        bounce = mmap.mmap(-1, length, access=mmap.ACCESS_WRITE)
        view = memoryview(bounce)
        try:
            try:
                _none_semantic_page_pack_preadv_all_boundary(
                    descriptor,
                    view,
                    alignment=alignment,
                    direct=direct,
                    file_offset=offset,
                )
            except OSError as error:
                if (
                    direct
                    and error.errno
                    in _NONE_SEMANTIC_PAGE_PACK_UNSUPPORTED_DIRECT_ERRNOS
                ):
                    reopen_buffered()
                    _none_semantic_page_pack_preadv_all_boundary(
                        descriptor,
                        view,
                        alignment=alignment,
                        direct=False,
                        file_offset=offset,
                    )
                else:
                    raise
            return bytes(view)
        finally:
            view.release()
            bounce.close()

    try:
        validate_descriptor()
        header_block = read_aligned_window(0, alignment)
        (
            magic,
            version,
            header_bytes,
            table_offset,
            table_bytes_count,
            payload_offset,
            footer_offset,
            stored_pack_bytes,
            page_count,
        ) = _NONE_SEMANTIC_PAGE_PACK_HEADER.unpack_from(header_block, 0)
        if (
            magic != _NONE_SEMANTIC_PAGE_PACK_MAGIC
            or version != _NONE_SEMANTIC_PAGE_PACK_VERSION
            or header_bytes != _NONE_SEMANTIC_PAGE_PACK_HEADER.size
            or table_offset != alignment
            or table_bytes_count < 2
            or payload_offset
            != _none_semantic_page_pack_align_up_boundary(
                table_offset + table_bytes_count,
                alignment,
            )
            or footer_offset < payload_offset
            or footer_offset % alignment
            or stored_pack_bytes != pack_bytes
            or page_count < 1
            or footer_offset + _NONE_SEMANTIC_PAGE_PACK_FOOTER.size
            > pack_bytes
            or header_block[header_bytes:table_offset]
            != b"\x00" * (table_offset - header_bytes)
        ):
            raise RuntimeError("NoNE semantic page pack header differs")

        table_window = read_aligned_window(
            table_offset,
            payload_offset - table_offset,
        )
        table_bytes = table_window[:table_bytes_count]
        if table_window[table_bytes_count:] != (
            b"\x00" * (len(table_window) - table_bytes_count)
        ):
            raise RuntimeError(
                "NoNE semantic page pack table padding differs"
            )
        entries = _none_semantic_page_pack_table_entries_boundary(
            table_bytes,
            expected_page_count=page_count,
        )
        payload_bytes = sum(
            _none_semantic_page_pack_scalar_boundary(
                entry.packet.raw_low_bytes_t,
                name="raw-low byte count",
                minimum=0,
            )
            + _none_semantic_page_pack_scalar_boundary(
                entry.packet.semantic_frame_bytes_t,
                name="semantic frame byte count",
                minimum=1,
            )
            for entry in entries
        )
        if footer_offset != _none_semantic_page_pack_align_up_boundary(
            payload_offset + payload_bytes,
            alignment,
        ):
            raise RuntimeError(
                "NoNE semantic page pack payload geometry differs"
            )

        footer_window = read_aligned_window(
            footer_offset,
            pack_bytes - footer_offset,
        )
        (
            footer_magic,
            footer_version,
            footer_bytes,
            footer_pack_bytes,
            table_sha256,
            stored_pack_sha256,
        ) = _NONE_SEMANTIC_PAGE_PACK_FOOTER.unpack_from(footer_window, 0)
        if (
            footer_magic != _NONE_SEMANTIC_PAGE_PACK_FOOTER_MAGIC
            or footer_version != _NONE_SEMANTIC_PAGE_PACK_VERSION
            or footer_bytes != _NONE_SEMANTIC_PAGE_PACK_FOOTER.size
            or footer_pack_bytes != pack_bytes
            or table_sha256 != hashlib.sha256(table_bytes).digest()
            or table_sha256
            != _none_semantic_page_pack_sha256_bytes_boundary(
                locator.table_sha256_t,
                name="table digest",
            )
            or stored_pack_sha256 != expected_pack_sha256
            or footer_window[footer_bytes:]
            != b"\x00" * (len(footer_window) - footer_bytes)
        ):
            raise RuntimeError("NoNE semantic page pack footer differs")

        page_ids_t = torch.stack(
            tuple(entry.packet.page_id_t for entry in entries)
        ).reshape(-1)
        object_sha256s_t = torch.stack(
            tuple(entry.packet.object_sha256_t for entry in entries)
        )
        object_bytes_t = torch.stack(
            tuple(entry.packet.object_bytes_t for entry in entries)
        ).reshape(-1)
        if (
            not torch.equal(
                page_ids_t,
                locator.page_ids_t.detach().cpu().long().reshape(-1),
            )
            or not torch.equal(
                object_sha256s_t,
                locator.object_sha256s_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
            )
            or not torch.equal(
                object_bytes_t,
                locator.object_bytes_t.detach().cpu().long().reshape(-1),
            )
        ):
            raise RuntimeError("NoNE semantic page pack locator differs")

        actual_by_page_id = {
            int(entry.packet.page_id_t): entry for entry in entries
        }
        selected_entries: list[_NoNESemanticPagePackEntryBoundary] = []
        for expected in expected_entries:
            actual = actual_by_page_id.get(int(expected.page_id_t))
            if (
                actual is None
                or not torch.equal(
                    actual.packet.object_sha256_t,
                    expected.object_sha256_t,
                )
                or not torch.equal(
                    actual.packet.object_bytes_t,
                    expected.object_bytes_t,
                )
                or not torch.equal(
                    actual.packet.raw_low_offset_t,
                    expected.raw_low_offset_t,
                )
                or not torch.equal(
                    actual.packet.raw_low_bytes_t,
                    expected.raw_low_bytes_t,
                )
                or not torch.equal(
                    actual.packet.semantic_frame_offset_t,
                    expected.semantic_frame_offset_t,
                )
                or not torch.equal(
                    actual.packet.semantic_frame_bytes_t,
                    expected.semantic_frame_bytes_t,
                )
                or not torch.equal(
                    actual.packet.semantic_bytes_t,
                    expected.semantic_bytes_t,
                )
            ):
                raise RuntimeError(
                    "NoNE semantic page pack manifest entry differs"
                )
            selected_entries.append(actual)

        aligned_ranges: list[tuple[int, int]] = []
        for entry in selected_entries:
            raw_low_offset = _none_semantic_page_pack_scalar_boundary(
                entry.packet.raw_low_offset_t,
                name="raw-low offset",
                minimum=0,
            )
            semantic_frame_offset = (
                _none_semantic_page_pack_scalar_boundary(
                    entry.packet.semantic_frame_offset_t,
                    name="semantic frame offset",
                    minimum=0,
                )
            )
            semantic_frame_bytes = (
                _none_semantic_page_pack_scalar_boundary(
                    entry.packet.semantic_frame_bytes_t,
                    name="semantic frame byte count",
                    minimum=1,
                )
            )
            selected_start = payload_offset + raw_low_offset
            selected_end = (
                payload_offset
                + semantic_frame_offset
                + semantic_frame_bytes
            )
            aligned_start = selected_start - (selected_start % alignment)
            aligned_end = _none_semantic_page_pack_align_up_boundary(
                selected_end,
                alignment,
            )
            if (
                selected_end > payload_offset + payload_bytes
                or aligned_end > footer_offset
            ):
                raise RuntimeError(
                    "NoNE semantic page pack selected payload escaped"
                )
            aligned_ranges.append((aligned_start, aligned_end))
        aligned_ranges.sort()
        merged_ranges: list[tuple[int, int]] = []
        for start, end in aligned_ranges:
            if merged_ranges and start <= merged_ranges[-1][1]:
                prior_start, prior_end = merged_ranges[-1]
                merged_ranges[-1] = (prior_start, max(prior_end, end))
            else:
                merged_ranges.append((start, end))
        selected_windows = tuple(
            (start, end, read_aligned_window(start, end - start))
            for start, end in merged_ranges
        )

        def selected_bytes(start: int, end: int) -> bytes:
            for window_start, window_end, window_payload in selected_windows:
                if window_start <= start and end <= window_end:
                    return window_payload[
                        start - window_start : end - window_start
                    ]
            raise RuntimeError(
                "NoNE semantic page pack selected window is absent"
            )

        object_bytes_values = tuple(
            _none_semantic_page_pack_scalar_boundary(
                entry.packet.object_bytes_t,
                name="object byte count",
                minimum=1,
            )
            for entry in selected_entries
        )
        object_offsets = [0]
        for object_bytes in object_bytes_values:
            object_offsets.append(object_offsets[-1] + object_bytes)
        object_payload_t = torch.empty(
            object_offsets[-1],
            dtype=torch.uint8,
            device="cpu",
        )
        object_payload_array = object_payload_t.numpy()
        decompressor = zstd.ZstdDecompressor()
        for index, (entry, object_bytes) in enumerate(
            zip(selected_entries, object_bytes_values, strict=True)
        ):
            raw_low_offset = _none_semantic_page_pack_scalar_boundary(
                entry.packet.raw_low_offset_t,
                name="raw-low offset",
                minimum=0,
            )
            raw_low_bytes = _none_semantic_page_pack_scalar_boundary(
                entry.packet.raw_low_bytes_t,
                name="raw-low byte count",
                minimum=0,
            )
            semantic_frame_offset = (
                _none_semantic_page_pack_scalar_boundary(
                    entry.packet.semantic_frame_offset_t,
                    name="semantic frame offset",
                    minimum=0,
                )
            )
            semantic_frame_bytes = (
                _none_semantic_page_pack_scalar_boundary(
                    entry.packet.semantic_frame_bytes_t,
                    name="semantic frame byte count",
                    minimum=1,
                )
            )
            semantic_bytes = _none_semantic_page_pack_scalar_boundary(
                entry.packet.semantic_bytes_t,
                name="semantic byte count",
                minimum=1,
            )
            raw_low = selected_bytes(
                payload_offset + raw_low_offset,
                payload_offset + raw_low_offset + raw_low_bytes,
            )
            frame = selected_bytes(
                payload_offset + semantic_frame_offset,
                payload_offset
                + semantic_frame_offset
                + semantic_frame_bytes,
            )
            if (
                hashlib.sha256(raw_low).digest() != entry.raw_low_sha256
                or hashlib.sha256(frame).digest()
                != entry.semantic_frame_sha256
            ):
                raise RuntimeError(
                    "NoNE semantic page pack selected payload digest differs"
                )
            semantic = decompressor.decompress(
                frame,
                max_output_size=semantic_bytes,
            )
            if (
                len(semantic) != semantic_bytes
                or hashlib.sha256(semantic).digest()
                != entry.semantic_sha256
            ):
                raise RuntimeError(
                    "NoNE semantic page pack selected semantic digest differs"
                )
            object_array = object_payload_array[
                object_offsets[index] : object_offsets[index + 1]
            ]
            object_array[: len(entry.prefix)] = np.frombuffer(
                entry.prefix,
                dtype=np.uint8,
            )
            raw_low_array = np.frombuffer(raw_low, dtype=np.uint8)
            semantic_array = np.frombuffer(semantic, dtype=np.uint8)
            for tensor_slice in entry.tensor_slices:
                tensor_array = object_array[
                    tensor_slice.canonical_start : tensor_slice.canonical_end
                ]
                semantic_tensor_array = semantic_array[
                    tensor_slice.semantic_start : (
                        tensor_slice.semantic_start
                        + tensor_slice.semantic_bytes
                    )
                ]
                if tensor_slice.dtype == "BF16":
                    paired_array = tensor_array.reshape(-1, 2)
                    paired_array[:, 0] = raw_low_array[
                        tensor_slice.raw_low_start : (
                            tensor_slice.raw_low_start
                            + tensor_slice.raw_low_bytes
                        )
                    ]
                    paired_array[:, 1] = semantic_tensor_array
                else:
                    tensor_array[:] = semantic_tensor_array
            exact_payload = memoryview(object_array)
            try:
                if (
                    len(exact_payload) != object_bytes
                    or hashlib.sha256(exact_payload).digest()
                    != _none_semantic_page_pack_sha256_bytes_boundary(
                        entry.packet.object_sha256_t,
                        name="object digest",
                    )
                ):
                    raise RuntimeError(
                        "NoNE semantic page pack reconstructed object differs"
                    )
            finally:
                exact_payload.release()
        if _file_identity(pack_path) != identity_before:
            raise RuntimeError(
                "NoNE semantic page pack changed during selected read"
            )
        return _NoNESemanticPagePackDecodedPacket(
            page_ids_t=torch.stack(
                tuple(entry.packet.page_id_t for entry in selected_entries)
            ).reshape(-1),
            object_sha256s_t=torch.stack(
                tuple(
                    entry.packet.object_sha256_t
                    for entry in selected_entries
                )
            ),
            object_bytes_t=torch.stack(
                tuple(entry.packet.object_bytes_t for entry in selected_entries)
            ).reshape(-1),
            object_offsets_t=torch.tensor(object_offsets, dtype=torch.long),
            object_payload_t=object_payload_t,
        )
    finally:
        os.close(descriptor)


def _write_none_semantic_page_pack_boundary(
    build: _NoNESemanticPagePackBuildBoundary,
    *,
    pack_root: Path,
) -> _NoNESemanticPagePackDurableBoundary:
    """Durably install one content-addressed pack via direct I/O when supported."""

    started_ns = time.perf_counter_ns()
    root = pack_root.expanduser().resolve()
    root_stat = root.stat()
    if not stat.S_ISDIR(root_stat.st_mode):
        raise RuntimeError("NoNE semantic page pack root is not a directory")
    alignment = _none_semantic_page_pack_scalar_boundary(
        build.locator.alignment_bytes_t,
        name="alignment",
        minimum=4096,
    )
    if len(build.pack_bytes) % alignment:
        raise RuntimeError("NoNE semantic page pack build is unaligned")
    expected_name = (
        _none_semantic_page_pack_sha256_bytes_boundary(
            build.locator.pack_sha256_t,
            name="pack digest",
        ).hex()
        + _NONE_SEMANTIC_PAGE_PACK_SUFFIX
    )
    if build.locator.pack_path != Path(expected_name):
        raise RuntimeError("NoNE semantic page pack build locator differs")
    final_path = root / expected_name
    existing_locator = replace(
        build.locator,
        pack_path=final_path,
        direct_durable_t=torch.tensor(False),
        rate_eligible_t=torch.tensor(False),
    )
    if final_path.exists():
        _verify_none_semantic_page_pack_layout_file_boundary(existing_locator)
        return _NoNESemanticPagePackDurableBoundary(
            locator=existing_locator,
            durable_write_elapsed_ns_t=torch.tensor(
                time.perf_counter_ns() - started_ns,
                dtype=torch.long,
            ),
        )

    temporary_path = root / (
        f".{expected_name}.{os.getpid()}.{threading.get_ident()}."
        f"{time.monotonic_ns()}.tmp"
    )
    direct_durable = True
    try:
        _none_semantic_page_pack_write_staged_boundary(
            temporary_path=temporary_path,
            payload=build.pack_bytes,
            alignment=alignment,
            direct=True,
        )
    except OSError as error:
        temporary_path.unlink(missing_ok=True)
        if (
            error.errno
            not in _NONE_SEMANTIC_PAGE_PACK_UNSUPPORTED_DIRECT_ERRNOS
        ):
            raise
        direct_durable = False
        _none_semantic_page_pack_write_staged_boundary(
            temporary_path=temporary_path,
            payload=build.pack_bytes,
            alignment=alignment,
            direct=False,
        )
    installed = False
    try:
        installed = _none_semantic_page_pack_install_staged_boundary(
            pack_root=root,
            temporary_path=temporary_path,
            final_path=final_path,
        )
    finally:
        temporary_path.unlink(missing_ok=True)
    write_elapsed_ns = time.perf_counter_ns() - started_ns
    locator = replace(
        build.locator,
        pack_path=final_path,
        direct_durable_t=torch.tensor(direct_durable and installed),
        rate_eligible_t=torch.tensor(direct_durable and installed),
    )
    return _NoNESemanticPagePackDurableBoundary(
        locator=locator,
        durable_write_elapsed_ns_t=torch.tensor(
            write_elapsed_ns,
            dtype=torch.long,
        ),
    )


def _cold_reopen_none_semantic_page_pack_boundary(
    build: _NoNESemanticPagePackBuildBoundary,
    durable: _NoNESemanticPagePackDurableBoundary,
) -> _NoNESemanticPagePackPerformanceReceiptPacket:
    """Drop this pack's cache, reopen it, and prove exact measured recovery."""

    cold_cache_proven = False
    if hasattr(os, "posix_fadvise") and hasattr(os, "POSIX_FADV_DONTNEED"):
        descriptor = os.open(
            durable.locator.pack_path,
            os.O_RDONLY
            | getattr(os, "O_CLOEXEC", 0)
            | getattr(os, "O_NOFOLLOW", 0),
        )
        try:
            os.posix_fadvise(
                descriptor,
                0,
                0,
                os.POSIX_FADV_DONTNEED,
            )
            cold_cache_proven = True
        finally:
            os.close(descriptor)
    started_ns = time.perf_counter_ns()
    direct_payload, direct_cold_read = (
        _open_none_semantic_page_pack_direct_buffer_boundary(
            durable.locator
        )
    )
    decoded = _read_none_semantic_page_pack_boundary(
        durable.locator,
        _mapped_payload=direct_payload,
    )
    cold_decode_elapsed_ns = time.perf_counter_ns() - started_ns
    exact_t = (
        decoded.page_ids_t.eq(build.locator.page_ids_t).all()
        & decoded.object_sha256s_t.eq(
            build.locator.object_sha256s_t
        ).all()
        & decoded.object_bytes_t.eq(
            build.locator.object_bytes_t
        ).all()
    )
    exact_count = (
        decoded.page_ids_t.shape[0] if bool(exact_t) else 0
    )
    return _NoNESemanticPagePackPerformanceReceiptPacket(
        page_count_t=torch.tensor(
            decoded.page_ids_t.shape[0],
            dtype=torch.long,
        ),
        logical_object_bytes_t=decoded.object_bytes_t.sum(dtype=torch.long),
        durable_pack_bytes_t=durable.locator.pack_bytes_t.detach()
        .cpu()
        .long()
        .reshape(()),
        encode_elapsed_ns_t=build.encode_elapsed_ns_t.detach()
        .cpu()
        .long()
        .reshape(()),
        durable_write_elapsed_ns_t=durable.durable_write_elapsed_ns_t.detach()
        .cpu()
        .long()
        .reshape(()),
        cold_decode_elapsed_ns_t=torch.tensor(
            cold_decode_elapsed_ns,
            dtype=torch.long,
        ),
        exact_object_count_t=torch.tensor(exact_count, dtype=torch.long),
        direct_durable_t=durable.locator.direct_durable_t.detach()
        .cpu()
        .bool()
        .reshape(()),
        direct_cold_read_t=torch.tensor(
            direct_cold_read,
            dtype=torch.bool,
        ),
        rate_eligible_t=torch.tensor(
            bool(durable.locator.rate_eligible_t)
            and direct_cold_read
            and cold_cache_proven
        ),
    )


def _is_sha256_hex_boundary(value: object) -> bool:
    """Return whether one boundary value is a lowercase SHA-256 digest."""

    return bool(
        isinstance(value, str)
        and len(value) == 64
        and all(character in "0123456789abcdef" for character in value)
    )


def _federated_demand_sha256_boundary(payload: Mapping[str, Any]) -> str:
    """Hash a canonical federation-demand boundary record."""

    return hashlib.sha256(_canonical_json_bytes(payload)).hexdigest()


def _federated_growth_demand_authority_record_boundary(
    record: Mapping[str, Any],
) -> dict[str, Any]:
    """Validate one persisted federated-demand authority record.

    The record is control-plane identity only.  It never supplies a route,
    target, or token to the model; it binds the source-evidence allocation
    that owns already-materialized objective pages.
    """

    authority_sha256 = record.get("authoritySha256")
    source_evidence = record.get("sourceEvidence")
    source_allocations = record.get("sourceAllocations")
    if (
        record.get("schema") != FEDERATED_GROWTH_DEMAND_AUTHORITY_SCHEMA
        or not _is_sha256_hex_boundary(authority_sha256)
        or not _is_sha256_hex_boundary(record.get("federationAuthoritySha256"))
        or not _is_sha256_hex_boundary(record.get("membershipSha256"))
        or not _is_sha256_hex_boundary(
            record.get("packedCollectionAuthoritySha256")
        )
        or not _is_sha256_hex_boundary(record.get("tokenizerAuthoritySha256"))
        or not _is_sha256_hex_boundary(record.get("sourceEvidenceSha256"))
        or not _is_sha256_hex_boundary(record.get("objectiveAllocationSha256"))
        or not isinstance(source_evidence, list)
        or not source_evidence
        or not isinstance(source_allocations, list)
        or not source_allocations
        or record.get("sourceCount") != len(source_evidence)
        or record.get("sourceCount") != len(source_allocations)
        or not isinstance(record.get("plannedObjectivePageCount"), int)
        or isinstance(record.get("plannedObjectivePageCount"), bool)
        or int(record["plannedObjectivePageCount"]) < 1
    ):
        raise RuntimeError("NoNE federated growth-demand authority is malformed")
    normalized = {
        key: value for key, value in record.items() if key != "authoritySha256"
    }
    if authority_sha256 != _federated_demand_sha256_boundary(normalized):
        raise RuntimeError("NoNE federated growth-demand authority differs")
    if record.get("sourceEvidenceSha256") != _federated_demand_sha256_boundary(
        {"sourceEvidence": source_evidence}
    ) or record.get("objectiveAllocationSha256") != _federated_demand_sha256_boundary(
        {"sourceAllocations": source_allocations}
    ):
        raise RuntimeError("NoNE federated growth-demand digest differs")
    return dict(record)


def federated_growth_demand_authority_from_plan_boundary(
    plan: Mapping[str, Any],
) -> dict[str, Any] | None:
    """Derive the canonical source-demand authority for one growth plan.

    Legacy NoNE/CAS plans intentionally have no federated demand and retain
    their exact old boundary bytes.  A federated plan must instead preserve
    the federation, packed-token, tokenizer, canonical source evidence, and
    current source-to-objective allocation together.
    """

    demand = plan.get("federatedContentDemand")
    if demand is None:
        return None
    if not isinstance(demand, Mapping):
        raise RuntimeError("NoNE federated content demand is malformed")
    membership = demand.get("membership")
    source_evidence_value = demand.get("sourceEvidence")
    source_objectives_value = plan.get("sourceObjectives")
    context_window_tokens = demand.get("contextWindowTokens")
    answer_tokens_per_window = demand.get("answerTokensPerWindow")
    if (
        demand.get("schema")
        != FULL_PAYLOAD_FEDERATED_NONE_GROWTH_PLAN_SCHEMA
        or not isinstance(membership, Mapping)
        or not _is_sha256_hex_boundary(membership.get("sha256"))
        or demand.get("membershipSha256") != membership.get("sha256")
        or not _is_sha256_hex_boundary(demand.get("federationAuthoritySha256"))
        or not _is_sha256_hex_boundary(
            demand.get("packedCollectionAuthoritySha256")
        )
        or not _is_sha256_hex_boundary(demand.get("tokenizerAuthoritySha256"))
        or type(context_window_tokens) is not int
        or context_window_tokens < 3
        or type(answer_tokens_per_window) is not int
        or answer_tokens_per_window < 1
        or answer_tokens_per_window >= context_window_tokens
        or demand.get("sourceIdentityNamespace")
        != "component_id_plus_source_record_sha256_plus_original_source_id"
        or not isinstance(source_evidence_value, list)
        or not source_evidence_value
        or not isinstance(source_objectives_value, list)
        or not source_objectives_value
        or demand.get("rawPayloadCopied") is not False
        or demand.get("rawPayloadRequiredAtTraining") is not False
        or demand.get("modelTrainingClaimed") is not False
        or demand.get("pageAllocationClaimed") is not False
        or demand.get("parameterExpansionClaimed") is not False
        or demand.get("promotionEligible") is not False
        or demand.get("acceptedGenerationMutationAllowed") is not False
    ):
        raise RuntimeError("NoNE federated content demand is malformed")

    source_evidence: list[dict[str, Any]] = []
    evidence_by_source_id: dict[str, dict[str, Any]] = {}
    total_payload_files = 0
    total_payload_bytes = 0
    total_duplicate_provenance = 0
    for raw_evidence in source_evidence_value:
        if not isinstance(raw_evidence, Mapping):
            raise RuntimeError("NoNE federated source evidence is malformed")
        source_id = raw_evidence.get("sourceId")
        component_id = raw_evidence.get("componentId")
        source_record_sha256 = raw_evidence.get("sourceRecordSha256")
        original_source_id = raw_evidence.get("originalSourceId")
        content_claims = raw_evidence.get("contentClaims")
        payload_file_count = raw_evidence.get("canonicalPayloadFileCount")
        payload_bytes = raw_evidence.get("canonicalPayloadBytes")
        content_keys_sha256 = raw_evidence.get("canonicalContentKeysSha256")
        duplicate_provenance = raw_evidence.get("duplicateProvenanceCount")
        if (
            not isinstance(source_id, str)
            or not source_id
            or not _is_sha256_hex_boundary(source_id)
            or source_id in evidence_by_source_id
            or not _is_sha256_hex_boundary(component_id)
            or not _is_sha256_hex_boundary(source_record_sha256)
            or not isinstance(original_source_id, str)
            or not original_source_id
            or not isinstance(content_claims, list)
            or not content_claims
            or any(
                not isinstance(claim, str) or not claim for claim in content_claims
            )
            or content_claims != sorted(set(content_claims))
            or type(payload_file_count) is not int
            or payload_file_count < 1
            or type(payload_bytes) is not int
            or payload_bytes < 0
            or not _is_sha256_hex_boundary(content_keys_sha256)
            or type(duplicate_provenance) is not int
            or duplicate_provenance < 0
        ):
            raise RuntimeError("NoNE federated source evidence is malformed")
        normalized_evidence = {
            "sourceId": source_id,
            "componentId": component_id,
            "sourceRecordSha256": source_record_sha256,
            "originalSourceId": original_source_id,
            "contentClaims": list(content_claims),
            "canonicalPayloadFileCount": payload_file_count,
            "canonicalPayloadBytes": payload_bytes,
            "canonicalContentKeysSha256": content_keys_sha256,
            "duplicateProvenanceCount": duplicate_provenance,
        }
        source_evidence.append(normalized_evidence)
        evidence_by_source_id[source_id] = normalized_evidence
        total_payload_files += payload_file_count
        total_payload_bytes += payload_bytes
        total_duplicate_provenance += duplicate_provenance
    source_evidence.sort(key=lambda row: str(row["sourceId"]))
    if (
        demand.get("canonicalPayloadFileCount") != total_payload_files
        or demand.get("canonicalPayloadBytes") != total_payload_bytes
        or demand.get("duplicatePayloadProvenanceCount")
        != total_duplicate_provenance
    ):
        raise RuntimeError("NoNE federated source evidence totals differ")

    source_allocations: list[dict[str, Any]] = []
    planned_objective_page_count = 0
    source_ids: set[str] = set()
    for raw_objective in source_objectives_value:
        if not isinstance(raw_objective, Mapping):
            raise RuntimeError("NoNE federated source objective is malformed")
        source_id = raw_objective.get("source_id")
        planned_page_count = raw_objective.get(
            "planned_expert_page_objectives"
        )
        payload_page_count = raw_objective.get("payload_page_objectives")
        payload_file_count = raw_objective.get("payload_file_count")
        payload_bytes = raw_objective.get("payload_bytes")
        content_claims = raw_objective.get("content_claims")
        source_evidence_row = (
            evidence_by_source_id.get(source_id)
            if isinstance(source_id, str)
            else None
        )
        if (
            not isinstance(source_id, str)
            or not source_id
            or source_id in source_ids
            or source_evidence_row is None
            or type(planned_page_count) is not int
            or planned_page_count < 1
            or type(payload_page_count) is not int
            or payload_page_count < 1
            or payload_page_count > planned_page_count
            or payload_file_count
            != source_evidence_row["canonicalPayloadFileCount"]
            or payload_bytes != source_evidence_row["canonicalPayloadBytes"]
            or not isinstance(content_claims, list)
            or sorted(set(content_claims))
            != source_evidence_row["contentClaims"]
        ):
            raise RuntimeError("NoNE federated source objective differs")
        source_ids.add(source_id)
        planned_objective_page_count += planned_page_count
        source_allocations.append(
            {
                "sourceId": source_id,
                "canonicalContentKeysSha256": source_evidence_row[
                    "canonicalContentKeysSha256"
                ],
                "canonicalPayloadFileCount": source_evidence_row[
                    "canonicalPayloadFileCount"
                ],
                "canonicalPayloadBytes": source_evidence_row[
                    "canonicalPayloadBytes"
                ],
                "plannedExpertPageObjectives": planned_page_count,
                "payloadPageObjectives": payload_page_count,
            }
        )
    source_allocations.sort(key=lambda row: str(row["sourceId"]))
    if (
        source_ids != set(evidence_by_source_id)
        or plan.get("sourceCount") != len(source_evidence)
        or plan.get("initialLogicalExpertPageObjectives")
        != planned_objective_page_count
    ):
        raise RuntimeError("NoNE federated objective allocation differs")

    authority: dict[str, Any] = {
        "schema": FEDERATED_GROWTH_DEMAND_AUTHORITY_SCHEMA,
        "federationAuthoritySha256": demand["federationAuthoritySha256"],
        "membershipSha256": demand["membershipSha256"],
        "packedCollectionAuthoritySha256": demand[
            "packedCollectionAuthoritySha256"
        ],
        "tokenizerAuthoritySha256": demand["tokenizerAuthoritySha256"],
        "contextWindowTokens": context_window_tokens,
        "answerTokensPerWindow": answer_tokens_per_window,
        "canonicalPayloadFileCount": total_payload_files,
        "canonicalPayloadBytes": total_payload_bytes,
        "duplicatePayloadProvenanceCount": total_duplicate_provenance,
        "sourceCount": len(source_evidence),
        "plannedObjectivePageCount": planned_objective_page_count,
        "sourceEvidence": source_evidence,
        "sourceEvidenceSha256": _federated_demand_sha256_boundary(
            {"sourceEvidence": source_evidence}
        ),
        "sourceAllocations": source_allocations,
        "objectiveAllocationSha256": _federated_demand_sha256_boundary(
            {"sourceAllocations": source_allocations}
        ),
    }
    authority["authoritySha256"] = _federated_demand_sha256_boundary(authority)
    return _federated_growth_demand_authority_record_boundary(authority)


def federated_growth_demand_authority_from_catalog_boundary(
    catalog: Mapping[str, Any],
) -> dict[str, Any] | None:
    """Load the optional federated demand authority persisted with a catalog."""

    authority = catalog.get("federatedGrowthDemandAuthority")
    authority_sha256 = catalog.get("federatedGrowthDemandAuthoritySha256")
    if authority is None and authority_sha256 is None:
        return None
    if not isinstance(authority, Mapping):
        raise RuntimeError("NoNE catalog federated growth demand is absent")
    validated = _federated_growth_demand_authority_record_boundary(authority)
    if authority_sha256 != validated["authoritySha256"]:
        raise RuntimeError("NoNE catalog federated growth demand differs")
    return validated


def sparse_graph_layer_ids_sha256_boundary(
    graph_layer_ids: tuple[int, ...],
) -> str:
    """Hash one ordered page-to-sparse-layer identity at the I/O boundary."""

    if (
        not graph_layer_ids
        or any(
            not isinstance(layer_id, int)
            or isinstance(layer_id, bool)
            or layer_id < 0
            for layer_id in graph_layer_ids
        )
        or len(set(graph_layer_ids)) != len(graph_layer_ids)
        or tuple(sorted(graph_layer_ids)) != graph_layer_ids
    ):
        raise ValueError("NoNE sparse graph-layer identity is malformed")
    return hashlib.sha256(
        _canonical_json_bytes(
            {
                "schema": SPARSE_GRAPH_LAYER_AUTHORITY_SCHEMA,
                "graphLayerIds": list(graph_layer_ids),
            }
        )
    ).hexdigest()


def build_sparse_graph_layer_catalog_authority_boundary(
    graph_layer_ids: tuple[int, ...],
) -> dict[str, Any]:
    """Build one-page-object/one-layer catalog authority without training claims."""

    graph_layer_ids_sha256 = sparse_graph_layer_ids_sha256_boundary(
        graph_layer_ids
    )
    return {
        "graphLayerAuthority": {
            "schema": SPARSE_GRAPH_LAYER_AUTHORITY_SCHEMA,
            "onePageObjectPerSparseGraphLayer": True,
            "routeGradientDeltaProofComplete": False,
            "heldoutProofComplete": False,
            "coldReloadProofComplete": False,
            "trainingClaimed": False,
            "promotionEligible": False,
        },
        "graphLayerIds": list(graph_layer_ids),
        "physicalGraphLayerCount": len(graph_layer_ids),
        "graphLayerIdsSha256": graph_layer_ids_sha256,
    }


def sparse_graph_layer_catalog_authority_boundary(
    catalog: Mapping[str, Any],
) -> tuple[tuple[int, ...], str] | None:
    """Validate optional sparse-layer fields while keeping legacy catalogs readable."""

    authority_fields = (
        "graphLayerAuthority",
        "graphLayerIds",
        "physicalGraphLayerCount",
        "graphLayerIdsSha256",
    )
    present_fields = tuple(field in catalog for field in authority_fields)
    if not any(present_fields):
        return None
    if not all(present_fields):
        raise RuntimeError("NoNE sparse graph-layer authority is incomplete")
    authority = catalog.get("graphLayerAuthority")
    graph_layer_ids = catalog.get("graphLayerIds")
    physical_graph_layer_count = catalog.get("physicalGraphLayerCount")
    graph_layer_ids_sha256 = catalog.get("graphLayerIdsSha256")
    pages = catalog.get("pages")
    if (
        not isinstance(authority, Mapping)
        or authority.get("schema") != SPARSE_GRAPH_LAYER_AUTHORITY_SCHEMA
        or authority.get("onePageObjectPerSparseGraphLayer") is not True
        or authority.get("routeGradientDeltaProofComplete") is not False
        or authority.get("heldoutProofComplete") is not False
        or authority.get("coldReloadProofComplete") is not False
        or authority.get("trainingClaimed") is not False
        or authority.get("promotionEligible") is not False
        or not isinstance(graph_layer_ids, list)
        or not isinstance(physical_graph_layer_count, int)
        or isinstance(physical_graph_layer_count, bool)
        or not isinstance(graph_layer_ids_sha256, str)
        or len(graph_layer_ids_sha256) != 64
        or not isinstance(pages, list)
    ):
        raise RuntimeError("NoNE sparse graph-layer authority is malformed")
    page_ids: list[int] = []
    for page in pages:
        page_id = page.get("pageId") if isinstance(page, Mapping) else None
        if (
            not isinstance(page_id, int)
            or isinstance(page_id, bool)
            or page_id < 0
        ):
            raise RuntimeError("NoNE sparse graph-layer page identity differs")
        page_ids.append(page_id)
    if not all(
        isinstance(layer_id, int) and not isinstance(layer_id, bool)
        for layer_id in graph_layer_ids
    ):
        raise RuntimeError("NoNE sparse graph-layer identity differs")
    ordered_ids = tuple(int(layer_id) for layer_id in graph_layer_ids)
    if (
        ordered_ids != tuple(page_ids)
        or physical_graph_layer_count != len(ordered_ids)
        or graph_layer_ids_sha256
        != sparse_graph_layer_ids_sha256_boundary(ordered_ids)
    ):
        raise RuntimeError("NoNE sparse graph-layer catalog identity differs")
    return ordered_ids, graph_layer_ids_sha256


def sparse_graph_layer_binding_record_boundary(
    catalog: Mapping[str, Any],
    *,
    page_catalog_sha256: str,
) -> dict[str, Any] | None:
    """Derive the exact cross-artifact sparse-layer binding for one catalog."""

    catalog_authority = sparse_graph_layer_catalog_authority_boundary(catalog)
    if catalog_authority is None:
        return None
    if len(page_catalog_sha256) != 64 or any(
        character not in "0123456789abcdef"
        for character in page_catalog_sha256
    ):
        raise RuntimeError("NoNE sparse graph-layer catalog hash is malformed")
    graph_layer_ids, graph_layer_ids_sha256 = catalog_authority
    return {
        "schema": SPARSE_GRAPH_LAYER_AUTHORITY_SCHEMA,
        "graphLayerIdsSha256": graph_layer_ids_sha256,
        "physicalGraphLayerCount": len(graph_layer_ids),
        "pageCatalogSha256": page_catalog_sha256,
        "onePageObjectPerSparseGraphLayer": True,
        "routeGradientDeltaProofComplete": False,
        "heldoutProofComplete": False,
        "coldReloadProofComplete": False,
        "trainingClaimed": False,
        "promotionEligible": False,
    }


def _page_catalog_topology_from_catalog_boundary(
    catalog: Mapping[str, Any],
) -> _NoNEPageCatalogTopology:
    """Extract only the immutable topology needed outside the page catalog.

    The full catalog contains large page-object metadata that the runtime never
    needs after graph admission.  Keep this extraction at the storage boundary
    so model routes, page selection, and gradient ownership stay unchanged.
    """

    pages = catalog.get("pages")
    layer_catalog = catalog.get("layerCatalogPageIds")
    family_root_count = catalog.get("familyRootPageCount")
    if (
        not isinstance(pages, list)
        or not pages
        or not isinstance(layer_catalog, dict)
        or not layer_catalog
        or not isinstance(family_root_count, int)
        or isinstance(family_root_count, bool)
        or family_root_count < 1
    ):
        raise RuntimeError("NoNE graph page topology is malformed")

    page_ids: list[int] = []
    page_layer_ids: list[int] = []
    trained_capability_claimed: list[bool] = []
    has_complete_layers = True
    has_complete_training_flags = True
    observed_page_ids: set[int] = set()
    for row in pages:
        page_id = row.get("pageId") if isinstance(row, Mapping) else None
        if (
            not isinstance(page_id, int)
            or isinstance(page_id, bool)
            or page_id < 0
            or page_id in observed_page_ids
        ):
            raise RuntimeError("NoNE graph page topology is malformed")
        observed_page_ids.add(page_id)
        page_ids.append(page_id)

        layer_id = row.get("layerId") if isinstance(row, Mapping) else None
        if (
            not isinstance(layer_id, int)
            or isinstance(layer_id, bool)
            or layer_id < 0
        ):
            has_complete_layers = False
        else:
            page_layer_ids.append(layer_id)

        claimed = (
            row.get("trainedCapabilityClaimed")
            if isinstance(row, Mapping)
            else None
        )
        if not isinstance(claimed, bool):
            has_complete_training_flags = False
        else:
            trained_capability_claimed.append(claimed)

    sparse_graph_layer_authority = sparse_graph_layer_catalog_authority_boundary(
        catalog
    )
    return _NoNEPageCatalogTopology(
        page_ids=tuple(page_ids),
        page_layer_ids=(
            tuple(page_layer_ids) if has_complete_layers else None
        ),
        trained_capability_claimed=(
            tuple(trained_capability_claimed)
            if has_complete_training_flags
            else None
        ),
        layer_count=len(layer_catalog),
        family_root_count=family_root_count,
        sparse_graph_layer_authority=sparse_graph_layer_authority,
    )


def _protected_page_catalog_topology_cache_root_boundary(
    root: Path,
) -> Path | None:
    """Return one protected cache root, or fall back to direct parsing."""

    resolved_root = root.expanduser().resolve()
    try:
        resolved_root.mkdir(mode=0o700, parents=True, exist_ok=True)
        root_stat = resolved_root.stat()
    except OSError:
        return None
    if (
        not resolved_root.is_dir()
        or root_stat.st_uid != os.geteuid()
        or root_stat.st_mode & 0o077
    ):
        return None
    return resolved_root


def _page_catalog_topology_cache_root_boundary(
    catalog_path: Path,
) -> Path | None:
    """Return a protected shared cache root, or fall back to direct parsing."""

    return _protected_page_catalog_topology_cache_root_boundary(
        catalog_path.expanduser().resolve().parent
        / _PAGE_CATALOG_TOPOLOGY_CACHE_DIRECTORY
    )


def _page_catalog_topology_cache_path_boundary(
    *,
    cache_root: Path,
    catalog_path: Path,
    catalog_sha256: str,
) -> Path:
    cache_key = hashlib.sha256(
        f"{catalog_path}\x00{catalog_sha256}".encode("utf-8")
    ).hexdigest()
    return cache_root / f"topology-{cache_key}.json"


def _page_catalog_topology_cache_payload_boundary(
    *,
    catalog_path: Path,
    catalog_sha256: str,
    catalog_identity: _FileIdentity,
    topology: _NoNEPageCatalogTopology,
) -> dict[str, Any]:
    """Serialize one rebuildable topology cache without granting authority."""

    sparse_authority = topology.sparse_graph_layer_authority
    payload: dict[str, Any] = {
        "schema": PAGE_CATALOG_TOPOLOGY_CACHE_SCHEMA,
        "pageCatalogPath": str(catalog_path),
        "pageCatalogSha256": catalog_sha256,
        "pageCatalogIdentity": _file_identity_record(catalog_identity),
        "pageIds": list(topology.page_ids),
        "pageLayerIds": (
            list(topology.page_layer_ids)
            if topology.page_layer_ids is not None
            else None
        ),
        "trainedCapabilityClaimed": (
            list(topology.trained_capability_claimed)
            if topology.trained_capability_claimed is not None
            else None
        ),
        "layerCount": topology.layer_count,
        "familyRootCount": topology.family_root_count,
        "sparseGraphLayerAuthority": (
            {"graphLayerIdsSha256": sparse_authority[1]}
            if sparse_authority is not None
            else None
        ),
    }
    payload["cachePayloadSha256"] = hashlib.sha256(
        _canonical_json_bytes(payload)
    ).hexdigest()
    return payload


def _page_catalog_topology_from_cache_payload_boundary(
    payload: Mapping[str, Any],
    *,
    catalog_path: Path,
    catalog_sha256: str,
    catalog_identity: _FileIdentity,
) -> _NoNEPageCatalogTopology | None:
    """Load a topology hint only when it still binds exact catalog bytes."""

    payload_sha256 = payload.get("cachePayloadSha256")
    unsigned = dict(payload)
    unsigned.pop("cachePayloadSha256", None)
    if (
        payload.get("schema") != PAGE_CATALOG_TOPOLOGY_CACHE_SCHEMA
        or payload.get("pageCatalogPath") != str(catalog_path)
        or payload.get("pageCatalogSha256") != catalog_sha256
        or _file_identity_from_record(payload.get("pageCatalogIdentity"))
        != catalog_identity
        or not isinstance(payload_sha256, str)
        or hashlib.sha256(_canonical_json_bytes(unsigned)).hexdigest()
        != payload_sha256
        or _file_identity(catalog_path) != catalog_identity
    ):
        return None

    raw_page_ids = payload.get("pageIds")
    raw_layer_ids = payload.get("pageLayerIds")
    # ``trainedCapabilityClaimed`` is the page row's SELF-ASSERTED training
    # claim.  This topology helper deliberately preserves the raw flag
    # verbatim (callers need the exact catalog bytes for manifest proofs).
    # The authoritative "did this page really receive gradient updates?"
    # boundary is enforced separately in page_inventory.py via
    # _validate_page_has_trained_knowledge_boundary, which cross-checks the
    # claim against objective state/optimizerState evidence and refuses to
    # count an empty/allocated page as trained/filled before its first
    # gradient step ("confirm the pages are not being filled first").
    raw_claimed = payload.get("trainedCapabilityClaimed")
    layer_count = payload.get("layerCount")
    family_root_count = payload.get("familyRootCount")
    if (
        not isinstance(raw_page_ids, list)
        or not raw_page_ids
        or any(
            not isinstance(page_id, int)
            or isinstance(page_id, bool)
            or page_id < 0
            for page_id in raw_page_ids
        )
        or len(set(raw_page_ids)) != len(raw_page_ids)
        or not isinstance(layer_count, int)
        or isinstance(layer_count, bool)
        or layer_count < 1
        or not isinstance(family_root_count, int)
        or isinstance(family_root_count, bool)
        or family_root_count < 1
    ):
        return None

    page_layer_ids: tuple[int, ...] | None = None
    if raw_layer_ids is not None:
        if (
            not isinstance(raw_layer_ids, list)
            or len(raw_layer_ids) != len(raw_page_ids)
            or any(
                not isinstance(layer_id, int)
                or isinstance(layer_id, bool)
                or layer_id < 0
                for layer_id in raw_layer_ids
            )
        ):
            return None
        page_layer_ids = tuple(raw_layer_ids)

    trained_capability_claimed: tuple[bool, ...] | None = None
    if raw_claimed is not None:
        if (
            not isinstance(raw_claimed, list)
            or len(raw_claimed) != len(raw_page_ids)
            or any(not isinstance(claimed, bool) for claimed in raw_claimed)
        ):
            return None
        trained_capability_claimed = tuple(raw_claimed)

    sparse_graph_layer_authority: tuple[tuple[int, ...], str] | None = None
    sparse_record = payload.get("sparseGraphLayerAuthority")
    if sparse_record is not None:
        sparse_sha256 = (
            sparse_record.get("graphLayerIdsSha256")
            if isinstance(sparse_record, Mapping)
            else None
        )
        ordered_ids = tuple(raw_page_ids)
        if (
            not isinstance(sparse_sha256, str)
            or len(sparse_sha256) != 64
            or sparse_sha256
            != sparse_graph_layer_ids_sha256_boundary(ordered_ids)
        ):
            return None
        sparse_graph_layer_authority = (ordered_ids, sparse_sha256)

    return _NoNEPageCatalogTopology(
        page_ids=tuple(raw_page_ids),
        page_layer_ids=page_layer_ids,
        trained_capability_claimed=trained_capability_claimed,
        layer_count=layer_count,
        family_root_count=family_root_count,
        sparse_graph_layer_authority=sparse_graph_layer_authority,
    )


def _load_page_catalog_topology_boundary(
    *,
    catalog_path: Path,
    expected_sha256: str,
    identity_cache_root: Path | None,
    topology_cache_root: Path | None = None,
) -> _NoNEPageCatalogTopology:
    """Load one exact topology cache or rebuild it from immutable catalog bytes.

    The cache is a storage hint, never an authority record.  A shared lock
    serializes the one cold SHA-256/JSON parse across disjoint training
    branches; every reuse still binds the cache to the catalog's expected hash
    and exact file identity.
    """

    resolved_catalog = catalog_path.expanduser().resolve()
    if len(expected_sha256) != 64:
        raise ValueError("NoNE page catalog digest is malformed")
    shared_cache_root = (
        _protected_page_catalog_topology_cache_root_boundary(
            topology_cache_root
        )
        if topology_cache_root is not None
        else _page_catalog_topology_cache_root_boundary(resolved_catalog)
    )
    if shared_cache_root is None:
        observed_sha256 = _file_sha256(
            resolved_catalog,
            expected_sha256=expected_sha256,
            identity_cache_root=identity_cache_root,
        )
        _catalog_sha256, catalog = _read_immutable_json_cached(resolved_catalog)
        if observed_sha256 != expected_sha256 or _catalog_sha256 != expected_sha256:
            raise RuntimeError("NoNE graph page catalog identity differs")
        return _page_catalog_topology_from_catalog_boundary(catalog)

    observed_sha256 = file_sha256_identity_cache_boundary(
        resolved_catalog,
        identity_cache_root=shared_cache_root,
    )
    if observed_sha256 != expected_sha256:
        raise RuntimeError("NoNE graph page catalog identity differs")
    catalog_identity = _file_identity(resolved_catalog)
    cache_path = _page_catalog_topology_cache_path_boundary(
        cache_root=shared_cache_root,
        catalog_path=resolved_catalog,
        catalog_sha256=expected_sha256,
    )
    lock_path = cache_path.with_suffix(".lock")
    try:
        with lock_path.open("a+b") as handle:
            lock_path.chmod(0o600)
            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
            try:
                if cache_path.is_file():
                    try:
                        cached_payload = _read_json(cache_path)
                    except (OSError, ValueError, json.JSONDecodeError):
                        cached_payload = None
                    if cached_payload is not None:
                        cached = _page_catalog_topology_from_cache_payload_boundary(
                            cached_payload,
                            catalog_path=resolved_catalog,
                            catalog_sha256=expected_sha256,
                            catalog_identity=catalog_identity,
                        )
                        if cached is not None:
                            return cached

                _catalog_sha256, catalog = _read_immutable_json_cached(
                    resolved_catalog
                )
                if (
                    _catalog_sha256 != expected_sha256
                    or _file_identity(resolved_catalog) != catalog_identity
                ):
                    raise RuntimeError("NoNE graph page catalog identity differs")
                topology = _page_catalog_topology_from_catalog_boundary(catalog)
                _atomic_cache_json(
                    cache_path,
                    _page_catalog_topology_cache_payload_boundary(
                        catalog_path=resolved_catalog,
                        catalog_sha256=expected_sha256,
                        catalog_identity=catalog_identity,
                        topology=topology,
                    ),
                )
                cache_path.chmod(0o600)
                return topology
            finally:
                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
    except OSError:
        _catalog_sha256, catalog = _read_immutable_json_cached(resolved_catalog)
        if _catalog_sha256 != expected_sha256:
            raise RuntimeError("NoNE graph page catalog identity differs")
        return _page_catalog_topology_from_catalog_boundary(catalog)


def _page_catalog_layer_ids_for_page_ids_boundary(
    topology: _NoNEPageCatalogTopology,
    page_ids_t: torch.Tensor,
) -> torch.Tensor:
    """Resolve sealed page IDs to their catalog-owned layer identities."""

    if topology.page_layer_ids is None:
        raise RuntimeError("NoNE training branch page catalog is malformed")
    page_layers = dict(zip(topology.page_ids, topology.page_layer_ids))
    requested_page_ids = page_ids_t.detach().cpu().long().reshape(-1)
    expected_layer_ids_t = torch.tensor(
        [page_layers.get(int(page_id), -1) for page_id in requested_page_ids],
        dtype=torch.long,
    )
    if expected_layer_ids_t.lt(0).any():
        raise RuntimeError("NoNE training branch page-layer identity is malformed")
    return expected_layer_ids_t


def _federated_training_scope_bindings_from_catalog_boundary(
    *,
    catalog: Mapping[str, Any],
    page_ids_t: torch.Tensor,
    expected_authority_sha256_t: torch.Tensor | None,
) -> tuple[torch.Tensor, torch.Tensor, torch.Tensor] | None:
    """Bind a page scope to catalog-owned federated source objectives."""

    authority = federated_growth_demand_authority_from_catalog_boundary(catalog)
    if authority is None:
        if expected_authority_sha256_t is not None:
            raise RuntimeError("NoNE graph federated demand authority is absent")
        return None
    authority_sha256_t = digest_tensor(str(authority["authoritySha256"]))
    if (
        expected_authority_sha256_t is None
        or not torch.equal(
            expected_authority_sha256_t.detach().cpu().to(dtype=torch.uint8),
            authority_sha256_t,
        )
    ):
        raise RuntimeError("NoNE graph federated demand authority differs")
    pages = catalog.get("pages")
    allocations = authority.get("sourceAllocations")
    if not isinstance(pages, list) or not isinstance(allocations, list):
        raise RuntimeError("NoNE catalog federated objective authority is absent")
    pages_by_id = {
        row.get("pageId"): row
        for row in pages
        if isinstance(row, Mapping)
        and isinstance(row.get("pageId"), int)
        and not isinstance(row.get("pageId"), bool)
    }
    allocation_by_source = {
        row.get("sourceId"): row
        for row in allocations
        if isinstance(row, Mapping) and isinstance(row.get("sourceId"), str)
    }
    if len(pages_by_id) != len(pages) or len(allocation_by_source) != len(
        allocations
    ):
        raise RuntimeError("NoNE catalog federated objective authority is malformed")
    objective_page_ids: list[int] = []
    source_id_sha256s: list[torch.Tensor] = []
    for page_id_t in page_ids_t.detach().cpu().long().reshape(-1):
        page_id = int(page_id_t)
        page = pages_by_id.get(page_id)
        if page is None:
            raise RuntimeError("NoNE federated training scope has a foreign page")
        objective_id = page.get("objectiveId")
        if objective_id is None:
            continue
        source_id = page.get("objectiveSourceId")
        ordinal = page.get("objectiveOrdinal")
        source_page_count = page.get("objectiveSourcePageCount")
        payload_backed = page.get("payloadShardBacked")
        allocation = (
            allocation_by_source.get(source_id)
            if isinstance(source_id, str)
            else None
        )
        if (
            not isinstance(objective_id, str)
            or not objective_id
            or not isinstance(source_id, str)
            or allocation is None
            or type(ordinal) is not int
            or ordinal < 0
            or source_page_count
            != allocation.get("plannedExpertPageObjectives")
            or ordinal >= int(allocation["plannedExpertPageObjectives"])
            or not isinstance(payload_backed, bool)
            or payload_backed
            != (ordinal < int(allocation["payloadPageObjectives"]))
        ):
            raise RuntimeError("NoNE catalog federated objective page differs")
        objective_page_ids.append(page_id)
        source_id_sha256s.append(digest_tensor(source_id))
    return (
        authority_sha256_t,
        torch.tensor(objective_page_ids, dtype=torch.long),
        (
            torch.stack(tuple(source_id_sha256s))
            if source_id_sha256s
            else torch.zeros((0, 32), dtype=torch.uint8)
        ),
    )


def _file_identity(path: Path) -> _FileIdentity:
    """Return an exact immutable-file identity at the storage boundary."""

    stat = path.stat()
    return (
        int(stat.st_dev),
        int(stat.st_ino),
        int(stat.st_size),
        int(stat.st_mtime_ns),
        int(stat.st_ctime_ns),
    )


def _file_identity_record(identity: _FileIdentity) -> dict[str, int]:
    return {
        "device": identity[0],
        "inode": identity[1],
        "bytes": identity[2],
        "mtimeNs": identity[3],
        "ctimeNs": identity[4],
    }


def _file_identity_from_record(value: object) -> _FileIdentity | None:
    if not isinstance(value, Mapping):
        return None
    device = value.get("device")
    inode = value.get("inode")
    byte_count = value.get("bytes")
    mtime_ns = value.get("mtimeNs")
    ctime_ns = value.get("ctimeNs")
    if (
        not isinstance(device, int)
        or isinstance(device, bool)
        or not isinstance(inode, int)
        or isinstance(inode, bool)
        or not isinstance(byte_count, int)
        or isinstance(byte_count, bool)
        or not isinstance(mtime_ns, int)
        or isinstance(mtime_ns, bool)
        or not isinstance(ctime_ns, int)
        or isinstance(ctime_ns, bool)
    ):
        return None
    return (device, inode, byte_count, mtime_ns, ctime_ns)


def _cache_generation_lineage_summary_boundary(
    *,
    session_root: Path,
    binding_record: Mapping[str, Any],
    parent_manifest_payload_sha256: str | None,
    expected_identity: _FileIdentity | None = None,
) -> None:
    """Retain a compact lineage row only for its exact immutable identity."""

    resolved_session_root = session_root.expanduser().resolve()
    binding = generation_binding_from_record_boundary(binding_record)
    manifest_path = (
        resolved_session_root / binding.manifest_relative_path
    ).resolve()
    if (
        not manifest_path.is_relative_to(resolved_session_root)
        or not manifest_path.is_file()
        or (
            parent_manifest_payload_sha256 is not None
            and not _is_sha256_hex_boundary(
                parent_manifest_payload_sha256
            )
        )
    ):
        raise RuntimeError("NoNE generation lineage summary is malformed")
    identity = _file_identity(manifest_path)
    if expected_identity is not None and identity != expected_identity:
        raise RuntimeError("NoNE generation lineage summary identity changed")
    cached_value = (
        identity,
        binding.external_record_boundary(),
        parent_manifest_payload_sha256,
    )
    with _GENERATION_JSON_CACHE_LOCK:
        _GENERATION_LINEAGE_SUMMARY_CACHE.pop(manifest_path, None)
        _GENERATION_LINEAGE_SUMMARY_CACHE[manifest_path] = cached_value
        while (
            len(_GENERATION_LINEAGE_SUMMARY_CACHE)
            > _GENERATION_LINEAGE_SUMMARY_CACHE_MAX_PATHS
        ):
            oldest = next(iter(_GENERATION_LINEAGE_SUMMARY_CACHE))
            _GENERATION_LINEAGE_SUMMARY_CACHE.pop(oldest)


def _stable_file_sha256(path: Path, identity_before: _FileIdentity) -> str:
    """Hash a file while proving its opened identity remained unchanged."""

    digest = hashlib.sha256()
    with path.open("rb") as handle:
        opened_before = os.fstat(handle.fileno())
        opened_identity_before: _FileIdentity = (
            int(opened_before.st_dev),
            int(opened_before.st_ino),
            int(opened_before.st_size),
            int(opened_before.st_mtime_ns),
            int(opened_before.st_ctime_ns),
        )
        if opened_identity_before != identity_before:
            raise RuntimeError("file identity changed before SHA-256 read")
        for chunk in iter(lambda: handle.read(8 * 1024 * 1024), b""):
            digest.update(chunk)
        opened_after = os.fstat(handle.fileno())
    opened_identity_after: _FileIdentity = (
        int(opened_after.st_dev),
        int(opened_after.st_ino),
        int(opened_after.st_size),
        int(opened_after.st_mtime_ns),
        int(opened_after.st_ctime_ns),
    )
    identity_after = _file_identity(path)
    if opened_identity_after != identity_before or identity_after != identity_before:
        raise RuntimeError("file identity changed during SHA-256 read")
    return digest.hexdigest()


def _file_identity_content_probe_sha256(
    path: Path,
    identity_before: _FileIdentity,
) -> str:
    """Read deterministic content probes while retaining exact stat stability.

    An inode/mtime tuple is a useful fast path but can be preserved by a
    same-size rewrite on coarse or overloaded filesystems. This probe is not a
    substitute for the complete SHA-256 authority read; it invalidates an
    unknown-digest cache before that stale digest can be reused. Small files
    are read in full, while large immutable catalogs use evenly spread probes.
    """

    byte_count = identity_before[2]
    if byte_count < 0:
        raise ValueError("file identity byte count cannot be negative")
    block_bytes = min(_FILE_IDENTITY_CONTENT_PROBE_BLOCK_BYTES, byte_count)
    maximum_offset = max(0, byte_count - block_bytes)
    if byte_count <= (
        _FILE_IDENTITY_CONTENT_PROBE_BLOCK_BYTES
        * _FILE_IDENTITY_CONTENT_PROBE_BLOCK_COUNT
    ):
        offsets = tuple(
            range(0, byte_count, _FILE_IDENTITY_CONTENT_PROBE_BLOCK_BYTES)
        ) or (0,)
    else:
        offsets = tuple(
            sorted(
                {
                    0,
                    maximum_offset,
                    *(
                        (
                            index * maximum_offset
                        )
                        // (_FILE_IDENTITY_CONTENT_PROBE_BLOCK_COUNT - 1)
                        for index in range(
                            1,
                            _FILE_IDENTITY_CONTENT_PROBE_BLOCK_COUNT - 1,
                        )
                    ),
                }
            )
        )
    digest = hashlib.sha256()
    digest.update(b"nnf-resynthesis-file-identity-content-probe-v1\x00")
    digest.update(struct.pack("<Q", byte_count))
    with path.open("rb") as handle:
        opened_before = os.fstat(handle.fileno())
        opened_identity_before: _FileIdentity = (
            int(opened_before.st_dev),
            int(opened_before.st_ino),
            int(opened_before.st_size),
            int(opened_before.st_mtime_ns),
            int(opened_before.st_ctime_ns),
        )
        if opened_identity_before != identity_before:
            raise RuntimeError("file identity changed before content probe")
        for offset in offsets:
            handle.seek(offset)
            payload = handle.read(block_bytes)
            digest.update(struct.pack("<Q", offset))
            digest.update(struct.pack("<Q", len(payload)))
            digest.update(payload)
        opened_after = os.fstat(handle.fileno())
    opened_identity_after: _FileIdentity = (
        int(opened_after.st_dev),
        int(opened_after.st_ino),
        int(opened_after.st_size),
        int(opened_after.st_mtime_ns),
        int(opened_after.st_ctime_ns),
    )
    if opened_identity_after != identity_before or _file_identity(path) != identity_before:
        raise RuntimeError("file identity changed during content probe")
    return digest.hexdigest()


def _identity_cache_path(
    cache_root: Path,
    path: Path,
    expected_sha256: str,
) -> Path:
    cache_key = hashlib.sha256(
        f"{path}\x00{expected_sha256}".encode("utf-8")
    ).hexdigest()
    return cache_root / f"{cache_key}.json"


def _identity_cache_payload(
    path: Path,
    expected_sha256: str,
    identity: _FileIdentity,
    *,
    content_probe_sha256: str | None = None,
) -> dict[str, Any]:
    payload: dict[str, Any] = {
        "schema": FILE_SHA256_IDENTITY_CACHE_SCHEMA,
        "path": str(path),
        "expectedSha256": expected_sha256,
        "fileIdentity": _file_identity_record(identity),
    }
    if content_probe_sha256 is not None:
        if len(content_probe_sha256) != 64:
            raise ValueError("file identity content probe digest is malformed")
        payload["contentProbeSha256"] = content_probe_sha256
    payload["cachePayloadSha256"] = hashlib.sha256(
        _canonical_json_bytes(payload)
    ).hexdigest()
    return payload


def _load_identity_cached_sha256(
    *,
    cache_path: Path,
    path: Path,
    expected_sha256: str,
    identity: _FileIdentity,
    content_probe_sha256: str | None = None,
) -> str | None:
    if not cache_path.is_file():
        return None
    try:
        payload = _read_json(cache_path)
    except (OSError, ValueError, json.JSONDecodeError):
        return None
    payload_sha256 = payload.get("cachePayloadSha256")
    cached_content_probe_sha256 = payload.get("contentProbeSha256")
    unsigned = dict(payload)
    unsigned.pop("cachePayloadSha256", None)
    if (
        payload.get("schema") != FILE_SHA256_IDENTITY_CACHE_SCHEMA
        or payload.get("path") != str(path)
        or payload.get("expectedSha256") != expected_sha256
        or _file_identity_from_record(payload.get("fileIdentity")) != identity
        or not isinstance(payload_sha256, str)
        or hashlib.sha256(_canonical_json_bytes(unsigned)).hexdigest()
        != payload_sha256
        or _file_identity(path) != identity
    ):
        return None
    if content_probe_sha256 is not None and (
        not isinstance(cached_content_probe_sha256, str)
        or cached_content_probe_sha256 != content_probe_sha256
    ):
        return None
    return expected_sha256


def _persist_identity_cached_sha256(
    *,
    cache_root: Path,
    path: Path,
    expected_sha256: str,
    identity: _FileIdentity,
    content_probe_sha256: str | None = None,
) -> None:
    resolved_root = cache_root.expanduser().resolve()
    resolved_root.mkdir(mode=0o700, parents=True, exist_ok=True)
    cache_path = _identity_cache_path(resolved_root, path, expected_sha256)
    if (
        _load_identity_cached_sha256(
            cache_path=cache_path,
            path=path,
            expected_sha256=expected_sha256,
            identity=identity,
            content_probe_sha256=content_probe_sha256,
        )
        is not None
    ):
        return
    _atomic_cache_json(
        cache_path,
        _identity_cache_payload(
            path,
            expected_sha256,
            identity,
            content_probe_sha256=content_probe_sha256,
        ),
    )
    cache_path.chmod(0o600)


def _file_sha256(
    path: Path,
    *,
    expected_sha256: str | None = None,
    identity_cache_root: Path | None = None,
) -> str:
    """Hash stable bytes or reuse a digest bound to unchanged file identity.

    Durable reuse is available only when the caller supplies a cryptographic
    digest from an accepted authority record.  A changed device, inode, size,
    mtime, or ctime forces a complete SHA-256 read; a digest mismatch fails.
    """

    if expected_sha256 is not None and len(expected_sha256) != 64:
        raise ValueError("expected file SHA-256 must contain 64 hex characters")
    resolved = path.expanduser().resolve()
    identity_before = _file_identity(resolved)
    cached = _FILE_SHA256_CACHE.get(resolved)
    if cached is not None and cached[0] == identity_before:
        value = cached[1]
        if expected_sha256 is not None and value != expected_sha256:
            raise RuntimeError("immutable file SHA-256 differs from authority")
        if expected_sha256 is not None and identity_cache_root is not None:
            _persist_identity_cached_sha256(
                cache_root=identity_cache_root,
                path=resolved,
                expected_sha256=expected_sha256,
                identity=identity_before,
            )
        return value

    if expected_sha256 is not None and identity_cache_root is not None:
        cache_path = _identity_cache_path(
            identity_cache_root.expanduser().resolve(),
            resolved,
            expected_sha256,
        )
        durable = _load_identity_cached_sha256(
            cache_path=cache_path,
            path=resolved,
            expected_sha256=expected_sha256,
            identity=identity_before,
        )
        if durable is not None:
            _FILE_SHA256_CACHE[resolved] = (identity_before, durable)
            return durable

    value = _stable_file_sha256(resolved, identity_before)
    if expected_sha256 is not None and value != expected_sha256:
        raise RuntimeError("immutable file SHA-256 differs from authority")
    _FILE_SHA256_CACHE[resolved] = (identity_before, value)
    if expected_sha256 is not None and identity_cache_root is not None:
        _persist_identity_cached_sha256(
            cache_root=identity_cache_root,
            path=resolved,
            expected_sha256=expected_sha256,
            identity=identity_before,
        )
    return value


def file_sha256_authority_boundary(
    path: Path,
    *,
    expected_sha256: str,
    identity_cache_root: Path,
) -> str:
    """Verify or reuse one accepted-authority digest outside the hot path."""

    return _file_sha256(
        path,
        expected_sha256=expected_sha256,
        identity_cache_root=identity_cache_root,
    )


def file_sha256_identity_cache_boundary(
    path: Path,
    *,
    identity_cache_root: Path,
) -> str:
    """Compute or reuse one digest under a canonical-path process lease.

    This boundary is for a protected, same-owner cache when the caller does
    not yet have an accepted expected digest.  The path-only lease serializes
    sibling fanouts before their first stat/read, while every reusable record
    remains bound to the exact device, inode, size, mtime, and ctime tuple.
    """

    resolved = path.expanduser().resolve()
    resolved_root = identity_cache_root.expanduser().resolve()
    resolved_root.mkdir(mode=0o700, parents=True, exist_ok=True)
    root_stat = resolved_root.stat()
    if (
        not resolved_root.is_dir()
        or root_stat.st_uid != os.geteuid()
        or root_stat.st_mode & 0o077
    ):
        raise RuntimeError(
            "file SHA-256 identity cache root is not protected"
        )
    lock_key = hashlib.sha256(str(resolved).encode("utf-8")).hexdigest()
    lock_path = resolved_root / f".{lock_key}.lock"
    with lock_path.open("a+b") as handle:
        lock_path.chmod(0o600)
        fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
        try:
            identity = _file_identity(resolved)
            content_probe_sha256 = _file_identity_content_probe_sha256(
                resolved,
                identity,
            )
            durable_values: set[str] = set()
            for cache_path in sorted(resolved_root.glob("*.json")):
                try:
                    payload = _read_json(cache_path)
                except (OSError, ValueError, json.JSONDecodeError):
                    continue
                expected_sha256 = payload.get("expectedSha256")
                if (
                    not isinstance(expected_sha256, str)
                    or len(expected_sha256) != 64
                    or expected_sha256 != expected_sha256.lower()
                    or any(
                        character not in "0123456789abcdef"
                        for character in expected_sha256
                    )
                    or cache_path
                    != _identity_cache_path(
                        resolved_root,
                        resolved,
                        expected_sha256,
                    )
                ):
                    continue
                durable = _load_identity_cached_sha256(
                    cache_path=cache_path,
                    path=resolved,
                    expected_sha256=expected_sha256,
                    identity=identity,
                    content_probe_sha256=content_probe_sha256,
                )
                if durable is not None:
                    durable_values.add(durable)
            if len(durable_values) > 1:
                raise RuntimeError(
                    "file SHA-256 identity cache has conflicting digests"
                )
            durable = next(iter(durable_values), None)
            cached = _FILE_SHA256_CACHE.get(resolved)
            probe_cached = _FILE_SHA256_IDENTITY_PROBE_CACHE.get(resolved)
            if (
                cached is not None
                and cached[0] == identity
                and probe_cached
                == (identity, cached[1], content_probe_sha256)
            ):
                if durable is not None and durable != cached[1]:
                    raise RuntimeError(
                        "file SHA-256 identity cache conflicts with memory"
                    )
                if durable is None:
                    _persist_identity_cached_sha256(
                        cache_root=resolved_root,
                        path=resolved,
                        expected_sha256=cached[1],
                        identity=identity,
                        content_probe_sha256=content_probe_sha256,
                    )
                return cached[1]
            if durable is not None:
                _FILE_SHA256_CACHE[resolved] = (identity, durable)
                _FILE_SHA256_IDENTITY_PROBE_CACHE[resolved] = (
                    identity,
                    durable,
                    content_probe_sha256,
                )
                return durable
            value = _stable_file_sha256(resolved, identity)
            _FILE_SHA256_CACHE[resolved] = (identity, value)
            _FILE_SHA256_IDENTITY_PROBE_CACHE[resolved] = (
                identity,
                value,
                content_probe_sha256,
            )
            _persist_identity_cached_sha256(
                cache_root=resolved_root,
                path=resolved,
                expected_sha256=value,
                identity=identity,
                content_probe_sha256=content_probe_sha256,
            )
            return value
        finally:
            fcntl.flock(handle.fileno(), fcntl.LOCK_UN)


def file_sha256_authority_batch_boundary(
    objects: tuple[tuple[Path, str], ...],
    *,
    identity_cache_root: Path,
) -> tuple[str, ...]:
    """Verify many immutable objects with one cache-directory durability barrier.

    Each uncached payload is still read completely and matched to its expected
    digest. Cache files retain the same device/inode/size/mtime/ctime binding as
    the scalar boundary, but their directory entries are fsynced once after the
    complete batch instead of once per object.
    """

    if not objects:
        raise ValueError("file SHA-256 authority batch is empty")
    resolved_root = identity_cache_root.expanduser().resolve()
    resolved_root.mkdir(mode=0o700, parents=True, exist_ok=True)
    resolved_objects = tuple(
        (path.expanduser().resolve(), expected_sha256)
        for path, expected_sha256 in objects
    )
    if (
        len({path for path, _expected in resolved_objects})
        != len(resolved_objects)
        or any(len(expected) != 64 for _path, expected in resolved_objects)
    ):
        raise ValueError("file SHA-256 authority batch identity is malformed")

    def verify(
        row: tuple[Path, str],
    ) -> tuple[Path, str, _FileIdentity, str, bool]:
        path, expected_sha256 = row
        identity = _file_identity(path)
        cached = _FILE_SHA256_CACHE.get(path)
        if cached is not None and cached[0] == identity:
            value = cached[1]
            if value != expected_sha256:
                raise RuntimeError("immutable file SHA-256 differs from authority")
            return path, expected_sha256, identity, value, True
        cache_path = _identity_cache_path(
            resolved_root,
            path,
            expected_sha256,
        )
        durable = _load_identity_cached_sha256(
            cache_path=cache_path,
            path=path,
            expected_sha256=expected_sha256,
            identity=identity,
        )
        if durable is not None:
            _FILE_SHA256_CACHE[path] = (identity, durable)
            return path, expected_sha256, identity, durable, False
        value = _stable_file_sha256(path, identity)
        if value != expected_sha256:
            raise RuntimeError("immutable file SHA-256 differs from authority")
        _FILE_SHA256_CACHE[path] = (identity, value)
        return path, expected_sha256, identity, value, True

    worker_count = min(len(resolved_objects), max(1, min(32, os.cpu_count() or 1)))
    with ThreadPoolExecutor(max_workers=worker_count) as executor:
        verified = tuple(executor.map(verify, resolved_objects))
    cache_entries_written = False
    for path, expected_sha256, identity, _value, persist in verified:
        if not persist:
            continue
        cache_path = _identity_cache_path(
            resolved_root,
            path,
            expected_sha256,
        )
        temporary = cache_path.with_name(
            (
                f".{cache_path.name}.{os.getpid()}."
                f"{threading.get_ident()}.tmp"
            )
        )
        temporary.unlink(missing_ok=True)
        with temporary.open("wb") as handle:
            handle.write(
                json.dumps(
                    _identity_cache_payload(path, expected_sha256, identity),
                    sort_keys=True,
                    indent=2,
                ).encode("utf-8")
                + b"\n"
            )
            handle.flush()
            os.fsync(handle.fileno())
        os.replace(temporary, cache_path)
        cache_path.chmod(0o600)
        cache_entries_written = True
    if cache_entries_written:
        _fsync_directory(resolved_root)
    return tuple(value for _path, _expected, _identity, value, _persist in verified)


def stage_atomically_moved_file_sha256_authority_boundary(
    *,
    staged_path: Path,
    final_path: Path,
    expected_sha256: str,
    identity_cache_root: Path,
) -> str:
    """Persist a digest cache for one enclosing-directory atomic move.

    The staged bytes are fully hashed (or reused only from this process's exact
    file-identity cache) before the receipt is written.  The durable record is
    keyed to the future path but retains the staged inode identity, so it can be
    consumed only if the same file is atomically moved there.  Any replacement,
    mutation, or copy has a different identity and therefore forces a complete
    SHA-256 read at the authority boundary.
    """

    staged = staged_path.expanduser().resolve()
    final = final_path.expanduser().resolve()
    if staged == final or final.exists():
        raise RuntimeError("atomic-move SHA-256 cache boundary is invalid")
    identity = _file_identity(staged)
    value = _file_sha256(staged, expected_sha256=expected_sha256)
    if value != expected_sha256 or _file_identity(staged) != identity:
        raise RuntimeError("staged immutable file identity changed")
    _persist_identity_cached_sha256(
        cache_root=identity_cache_root,
        path=final,
        expected_sha256=expected_sha256,
        identity=identity,
    )
    return value


def file_sha256_boundary(path: Path) -> str:
    """Share one stable process-local digest across checkpoint boundaries."""

    return _file_sha256(path)


def _fsync_directory(path: Path) -> None:
    descriptor = os.open(path, os.O_RDONLY)
    try:
        os.fsync(descriptor)
    finally:
        os.close(descriptor)


def _atomic_json(path: Path, payload: Mapping[str, Any]) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_name(
        f".{path.name}.{os.getpid()}.{threading.get_ident()}.tmp"
    )
    temporary.unlink(missing_ok=True)
    with temporary.open("wb") as handle:
        handle.write(
            orjson.dumps(
                payload,
                option=(
                    orjson.OPT_APPEND_NEWLINE
                    | orjson.OPT_INDENT_2
                    | orjson.OPT_SORT_KEYS
                ),
            )
        )
        handle.flush()
        os.fsync(handle.fileno())
    os.replace(temporary, path)
    _fsync_directory(path.parent)


def _atomic_cache_json(path: Path, payload: Mapping[str, Any]) -> None:
    """Atomically update a reconstructable identity-cache hint.

    Cache loss can only force a complete SHA-256 read: cache payloads are
    self-hashed, bound to the current file identity, and never authorize a
    checkpoint or training claim.  Avoiding a file and directory fsync for
    every page keeps sparse traversal from serializing on optional cache I/O.
    """

    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_name(
        f".{path.name}.{os.getpid()}.{threading.get_ident()}.tmp"
    )
    temporary.unlink(missing_ok=True)
    with temporary.open("wb") as handle:
        handle.write(
            orjson.dumps(
                payload,
                option=(
                    orjson.OPT_APPEND_NEWLINE
                    | orjson.OPT_INDENT_2
                    | orjson.OPT_SORT_KEYS
                ),
            )
        )
    os.replace(temporary, path)


def _atomic_bytes(path: Path, payload: bytes) -> None:
    """Persist an exact content-addressed boundary artifact durably."""

    path.parent.mkdir(parents=True, exist_ok=True)
    if path.is_file():
        if path.read_bytes() != payload:
            raise RuntimeError("immutable NoNE boundary artifact changed")
        _fsync_directory(path.parent)
        return
    temporary = path.with_name(
        f".{path.name}.{os.getpid()}.{threading.get_ident()}.tmp"
    )
    temporary.unlink(missing_ok=True)
    with temporary.open("wb") as handle:
        handle.write(payload)
        handle.flush()
        os.fsync(handle.fileno())
    try:
        os.link(temporary, path)
    except FileExistsError:
        if not path.is_file() or path.read_bytes() != payload:
            raise RuntimeError("immutable NoNE boundary artifact changed")
    finally:
        temporary.unlink(missing_ok=True)
        _fsync_directory(path.parent)


def _atomic_replace_bytes_boundary(path: Path, payload: bytes) -> None:
    """Durably replace one mutable authority file with exact caller bytes."""

    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_name(
        f".{path.name}.{os.getpid()}.{threading.get_ident()}.replace.tmp"
    )
    temporary.unlink(missing_ok=True)
    with temporary.open("xb") as handle:
        handle.write(payload)
        handle.flush()
        os.fsync(handle.fileno())
    os.replace(temporary, path)
    _fsync_directory(path.parent)


def _tensor_assert(condition_t: torch.Tensor, message: str) -> None:
    """Keep active validation in the tensor graph without a host scalar read."""

    torch._assert_async(condition_t, message)


def _stable_model_route_logits(
    logits_t: torch.Tensor,
    temperature_t: torch.Tensor,
) -> torch.Tensor:
    """Compress learned logits without changing their finite ordering.

    A valid learned temperature may be as small as ``1e-3``. Dividing an
    otherwise finite ``finfo.max`` score by that temperature overflows before
    softmax can apply its own max subtraction. Normalize each row first, then
    compress its centered span to the dtype's positive-exponential range.
    The tensor straight-through term preserves gradients to the original
    learned scores while every forward value remains finite.
    """

    finite_mask_t = torch.isfinite(logits_t)
    _tensor_assert(
        finite_mask_t.any(dim=-1).all(),
        "NoNE page router received an all-nonfinite learned-logit row",
    )
    active_temperature_t = temperature_t.to(
        device=logits_t.device,
        dtype=logits_t.dtype,
    )
    _tensor_assert(
        (
            torch.isfinite(active_temperature_t)
            & active_temperature_t.gt(torch.finfo(logits_t.dtype).tiny)
        ).all(),
        "NoNE page router learned temperature is not finite and positive",
    )
    finite_values_t = torch.where(
        finite_mask_t,
        logits_t,
        torch.zeros_like(logits_t),
    )
    row_scale_t = finite_values_t.detach().abs().amax(
        dim=-1,
        keepdim=True,
    ).clamp_min(1.0)
    normalized_t = finite_values_t / row_scale_t
    invalid_floor_t = normalized_t.new_full((), -2.0)
    normalized_t = torch.where(
        finite_mask_t,
        normalized_t,
        invalid_floor_t,
    )
    centered_t = normalized_t - normalized_t.amax(dim=-1, keepdim=True)
    log_tiny_t = (
        active_temperature_t.new_ones(())
        .mul_(torch.finfo(centered_t.dtype).tiny)
        .log_()
    )
    maximum_span_t = (
        -log_tiny_t * active_temperature_t
    ).clamp_min(torch.finfo(centered_t.dtype).tiny)
    observed_span_t = -centered_t.amin(dim=-1, keepdim=True)
    compression_t = (observed_span_t / maximum_span_t).clamp_min(1.0)
    compressed_t = centered_t / compression_t
    original_gradient_t = finite_values_t - finite_values_t.detach()
    stable_logits_t = compressed_t + original_gradient_t
    _tensor_assert(
        torch.isfinite(stable_logits_t).all(),
        "NoNE page router logit stabilization produced a nonfinite value",
    )
    return stable_logits_t


def _stable_model_route_softmax(
    logits_t: torch.Tensor,
    temperature_t: torch.Tensor,
) -> torch.Tensor:
    """Return a finite, strictly positive learned-temperature distribution."""

    stable_logits_t = _stable_model_route_logits(logits_t, temperature_t)
    active_temperature_t = temperature_t.to(
        device=stable_logits_t.device,
        dtype=stable_logits_t.dtype,
    )
    probability_t = F.softmax(
        stable_logits_t / active_temperature_t,
        dim=-1,
    )
    _tensor_assert(
        (
            torch.isfinite(probability_t)
            & probability_t.gt(0)
        ).all(),
        "NoNE page router learned probability is not finite and positive",
    )
    return probability_t


def _read_json(path: Path) -> dict[str, Any]:
    # orjson.loads parses straight from bytes (skipping the utf-8 decode step),
    # is ~10x faster, and releases the GIL so the concurrent GPU and staging
    # threads are not blocked while a generation/catalog manifest is read.
    # orjson.JSONDecodeError subclasses json.JSONDecodeError, so every caller's
    # `except json.JSONDecodeError` still catches it; the returned object tree is
    # deep-equal (round-trip verified on production manifests).
    value = orjson.loads(path.read_bytes())
    if not isinstance(value, dict):
        raise ValueError(f"JSON artifact is not an object: {path}")
    return value


def _read_immutable_json_cached(path: Path) -> tuple[str, dict[str, Any]]:
    """Read one immutable authority JSON object once per exact file identity."""

    resolved = path.expanduser().resolve()
    identity_before = _file_identity(resolved)
    with _GENERATION_JSON_CACHE_LOCK:
        cached = _GENERATION_JSON_CACHE.get(resolved)
        if cached is not None and cached[0] == identity_before:
            _GENERATION_JSON_CACHE.pop(resolved)
            _GENERATION_JSON_CACHE[resolved] = cached
            return cached[1], cached[2]
        if cached is not None:
            _GENERATION_JSON_CACHE.pop(resolved)

        manifest_sha256 = _file_sha256(resolved)
        manifest = _read_json(resolved)
        if _file_identity(resolved) != identity_before:
            raise RuntimeError(
                "NoNE generation manifest changed during JSON read"
            )
        _GENERATION_JSON_CACHE[resolved] = (
            identity_before,
            manifest_sha256,
            manifest,
        )
        while len(_GENERATION_JSON_CACHE) > _GENERATION_JSON_CACHE_MAX_PATHS:
            oldest = next(iter(_GENERATION_JSON_CACHE))
            _GENERATION_JSON_CACHE.pop(oldest)
        return manifest_sha256, manifest


def _read_generation_json_cached(path: Path) -> tuple[str, dict[str, Any]]:
    """Compatibility boundary for immutable generation-manifest reads."""

    return _read_immutable_json_cached(path)


def _read_generation_lineage_authority_cached(
    path: Path,
    *,
    expected_session_key: str,
) -> _NoNEGenerationLineageAuthority:
    """Validate one generation lineage once per exact immutable byte identity.

    Store discovery needs only the generation and parent identities, not the
    complete 81k-page lookup.  Keep that compact result for every lineage path
    instead of reparsing and canonicalizing every ancestor on each discovery
    pass.  Exact-byte replicas share a second cache keyed by the complete file
    SHA-256; each replica is still hashed from stable bytes before reuse, so a
    changed or merely similar manifest is validated independently.
    """

    resolved = path.expanduser().resolve()
    identity = _file_identity(resolved)
    with _GENERATION_JSON_CACHE_LOCK:
        cached = _GENERATION_LINEAGE_AUTHORITY_CACHE.get(resolved)
        if cached is not None and cached[0] == identity:
            authority = cached[1]
            if authority.session_key != expected_session_key:
                raise RuntimeError("NoNE discovered generation graph differs")
            _GENERATION_LINEAGE_AUTHORITY_CACHE.pop(resolved)
            _GENERATION_LINEAGE_AUTHORITY_CACHE[resolved] = cached
            return authority
        if cached is not None:
            _GENERATION_LINEAGE_AUTHORITY_CACHE.pop(resolved)

    manifest_sha256 = _file_sha256(resolved)
    with _GENERATION_JSON_CACHE_LOCK:
        content_cached = _GENERATION_LINEAGE_CONTENT_CACHE.get(
            manifest_sha256
        )
    if content_cached is not None:
        if (
            content_cached.session_key != expected_session_key
            or _file_identity(resolved) != identity
        ):
            raise RuntimeError("NoNE discovered generation graph differs")
        with _GENERATION_JSON_CACHE_LOCK:
            _GENERATION_LINEAGE_AUTHORITY_CACHE[resolved] = (
                identity,
                content_cached,
            )
            while (
                len(_GENERATION_LINEAGE_AUTHORITY_CACHE)
                > _GENERATION_LINEAGE_SUMMARY_CACHE_MAX_PATHS
            ):
                _GENERATION_LINEAGE_AUTHORITY_CACHE.pop(
                    next(iter(_GENERATION_LINEAGE_AUTHORITY_CACHE))
                )
        return content_cached

    manifest = _read_json(resolved)
    payload_sha256 = manifest.get("manifestPayloadSha256")
    generation = manifest.get("generation")
    parent_generation = manifest.get("parentGeneration")
    parent_payload_sha256 = manifest.get("parentManifestPayloadSha256")
    if (
        not page_generation_schema_supported_boundary(
            manifest.get("schema")
        )
        or manifest.get("sessionKey") != expected_session_key
        or not isinstance(payload_sha256, str)
        or len(payload_sha256) != 64
        or _manifest_payload_sha256(manifest) != payload_sha256
        or not isinstance(generation, int)
        or isinstance(generation, bool)
        or not isinstance(parent_generation, int)
        or isinstance(parent_generation, bool)
        or (
            parent_payload_sha256 is not None
            and (
                not isinstance(parent_payload_sha256, str)
                or len(parent_payload_sha256) != 64
            )
        )
        or _file_identity(resolved) != identity
    ):
        raise RuntimeError("NoNE discovered generation graph differs")
    authority = _NoNEGenerationLineageAuthority(
        manifest_sha256=manifest_sha256,
        manifest_payload_sha256=payload_sha256,
        session_key=expected_session_key,
        generation=generation,
        parent_generation=parent_generation,
        parent_manifest_payload_sha256=parent_payload_sha256,
    )
    with _GENERATION_JSON_CACHE_LOCK:
        prior_content = _GENERATION_LINEAGE_CONTENT_CACHE.get(
            manifest_sha256
        )
        if prior_content is not None and prior_content != authority:
            raise RuntimeError("NoNE generation digest has conflicting lineage")
        _GENERATION_LINEAGE_CONTENT_CACHE.pop(manifest_sha256, None)
        _GENERATION_LINEAGE_CONTENT_CACHE[manifest_sha256] = authority
        _GENERATION_LINEAGE_AUTHORITY_CACHE[resolved] = (
            identity,
            authority,
        )
        _GENERATION_JSON_CACHE.pop(resolved, None)
        _GENERATION_JSON_CACHE[resolved] = (
            identity,
            manifest_sha256,
            manifest,
        )
        while len(_GENERATION_JSON_CACHE) > _GENERATION_JSON_CACHE_MAX_PATHS:
            _GENERATION_JSON_CACHE.pop(next(iter(_GENERATION_JSON_CACHE)))
        while (
            len(_GENERATION_LINEAGE_CONTENT_CACHE)
            > _GENERATION_LINEAGE_SUMMARY_CACHE_MAX_PATHS
        ):
            _GENERATION_LINEAGE_CONTENT_CACHE.pop(
                next(iter(_GENERATION_LINEAGE_CONTENT_CACHE))
            )
        while (
            len(_GENERATION_LINEAGE_AUTHORITY_CACHE)
            > _GENERATION_LINEAGE_SUMMARY_CACHE_MAX_PATHS
        ):
            _GENERATION_LINEAGE_AUTHORITY_CACHE.pop(
                next(iter(_GENERATION_LINEAGE_AUTHORITY_CACHE))
            )
    return authority


def _generation_manifest_delta_depth_boundary(
    manifest: Mapping[str, Any],
) -> int:
    """Return a validated catalog-projection depth for one generation."""

    if manifest.get("schema") != PAGE_GENERATION_DELTA_SCHEMA:
        return 0
    depth = manifest.get("catalogDeltaDepth")
    if (
        not isinstance(depth, int)
        or isinstance(depth, bool)
        or depth < 1
        or depth > PAGE_GENERATION_DELTA_MAX_DEPTH
    ):
        raise RuntimeError("NoNE generation catalog delta depth is malformed")
    return depth


def _validate_semantic_page_pack_manifest_row_boundary(
    row: Mapping[str, Any],
) -> None:
    """Validate one complete relative pack locator without resolving a path."""

    locator_value = row.get("semanticPack")
    if locator_value is None:
        return
    locator_keys = {
        "alignmentBytes",
        "dependency",
        "directColdRead",
        "directDurable",
        "objectBytes",
        "objectSha256",
        "packBytes",
        "packObjectBytes",
        "packObjectSha256s",
        "packPageIds",
        "packSha256",
        "pageId",
        "rateEligible",
        "rawLowBytes",
        "rawLowOffset",
        "relativePath",
        "schema",
        "semanticBytes",
        "semanticFrameBytes",
        "semanticFrameOffset",
        "tableSha256",
    }
    if (
        not isinstance(locator_value, dict)
        or set(locator_value) != locator_keys
    ):
        raise RuntimeError(
            "NoNE generation semantic pack locator is malformed"
        )
    locator = cast(dict[str, Any], locator_value)
    relative_path = locator.get("relativePath")
    pack_sha256 = locator.get("packSha256")
    page_id = row.get("pageId")
    object_sha256 = row.get("sha256")
    object_bytes = row.get("bytes")
    pack_page_ids = locator.get("packPageIds")
    pack_object_sha256s = locator.get("packObjectSha256s")
    pack_object_bytes = locator.get("packObjectBytes")
    integer_fields = (
        "alignmentBytes",
        "objectBytes",
        "packBytes",
        "pageId",
        "rawLowBytes",
        "rawLowOffset",
        "semanticBytes",
        "semanticFrameBytes",
        "semanticFrameOffset",
    )
    boolean_fields = ("directColdRead", "directDurable", "rateEligible")
    relative_parts = (
        Path(relative_path).parts
        if isinstance(relative_path, str)
        else ()
    )
    if (
        locator.get("schema") != NONE_SEMANTIC_PAGE_PACK_LOCATOR_SCHEMA
        or not _valid_sha256_boundary(pack_sha256)
        or not _valid_sha256_boundary(locator.get("tableSha256"))
        or not _valid_sha256_boundary(locator.get("objectSha256"))
        or relative_parts
        != (
            "semantic-packs",
            "sha256",
            f"{pack_sha256}{_NONE_SEMANTIC_PAGE_PACK_SUFFIX}",
        )
        or Path(cast(str, relative_path)).is_absolute()
        or any(
            not isinstance(locator.get(field), int)
            or isinstance(locator.get(field), bool)
            or int(locator[field]) < (4096 if field == "alignmentBytes" else 0)
            for field in integer_fields
        )
        or int(locator["objectBytes"]) < 1
        or int(locator["packBytes"]) < 1
        or int(locator["semanticBytes"]) < 1
        or int(locator["semanticFrameBytes"]) < 1
        or any(
            not isinstance(locator.get(field), bool)
            for field in boolean_fields
        )
        or (
            bool(locator["rateEligible"])
            and not (
                bool(locator["directDurable"])
                and bool(locator["directColdRead"])
            )
        )
        or locator["pageId"] != page_id
        or locator["objectSha256"] != object_sha256
        or locator["objectBytes"] != object_bytes
        or not isinstance(pack_page_ids, list)
        or not isinstance(pack_object_sha256s, list)
        or not isinstance(pack_object_bytes, list)
        or not pack_page_ids
        or len(pack_page_ids) != len(pack_object_sha256s)
        or len(pack_page_ids) != len(pack_object_bytes)
        or any(
            not isinstance(value, int)
            or isinstance(value, bool)
            or value < 0
            for value in pack_page_ids
        )
        or pack_page_ids != sorted(set(pack_page_ids))
        or any(
            not _valid_sha256_boundary(value)
            for value in pack_object_sha256s
        )
        or any(
            not isinstance(value, int)
            or isinstance(value, bool)
            or value < 1
            for value in pack_object_bytes
        )
        or page_id not in pack_page_ids
        or pack_object_sha256s[pack_page_ids.index(page_id)]
        != object_sha256
        or pack_object_bytes[pack_page_ids.index(page_id)] != object_bytes
    ):
        raise RuntimeError(
            "NoNE generation semantic pack locator differs"
        )
    dependency_value = locator.get("dependency")
    if (
        not isinstance(dependency_value, dict)
        or not isinstance(dependency_value.get("present"), bool)
    ):
        raise RuntimeError(
            "NoNE generation semantic pack dependency is malformed"
        )
    dependency = cast(dict[str, Any], dependency_value)
    if not dependency["present"]:
        if set(dependency) != {"present"}:
            raise RuntimeError(
                "NoNE generation exact pack dependency differs"
            )
    elif (
        set(dependency)
        != {
            "baseGeneration",
            "baseManifestPayloadSha256",
            "baseObjectBytes",
            "baseObjectSha256",
            "present",
        }
        or not isinstance(dependency.get("baseGeneration"), int)
        or isinstance(dependency.get("baseGeneration"), bool)
        or int(dependency["baseGeneration"]) < 1
        or not _valid_sha256_boundary(
            dependency.get("baseManifestPayloadSha256")
        )
        or not _valid_sha256_boundary(dependency.get("baseObjectSha256"))
        or not isinstance(dependency.get("baseObjectBytes"), int)
        or isinstance(dependency.get("baseObjectBytes"), bool)
        or int(dependency["baseObjectBytes"]) < 1
    ):
        raise RuntimeError(
            "NoNE generation delta pack dependency differs"
        )


def _generation_page_rows_boundary(
    value: object,
    *,
    label: str,
) -> dict[int, dict[str, Any]]:
    """Validate and index exact immutable page-object identity rows."""

    if not isinstance(value, list) or not value:
        raise RuntimeError(f"NoNE generation {label} is absent")
    page_rows: dict[int, dict[str, Any]] = {}
    for raw_row in value:
        page_id = (
            raw_row.get("pageId")
            if isinstance(raw_row, dict)
            else None
        )
        object_sha256 = (
            raw_row.get("sha256")
            if isinstance(raw_row, dict)
            else None
        )
        object_bytes = (
            raw_row.get("bytes")
            if isinstance(raw_row, dict)
            else None
        )
        if (
            not isinstance(page_id, int)
            or isinstance(page_id, bool)
            or page_id < 0
            or page_id in page_rows
            or not _valid_sha256_boundary(object_sha256)
            or not isinstance(object_bytes, int)
            or isinstance(object_bytes, bool)
            or object_bytes < 1
        ):
            raise RuntimeError(f"NoNE generation {label} is malformed")
        row = dict(raw_row)
        _validate_semantic_page_pack_manifest_row_boundary(row)
        page_rows[page_id] = row
    return page_rows


def _generation_page_catalog_sha256_boundary(
    page_rows: Mapping[int, Mapping[str, Any]],
) -> str:
    """Hash a fully projected page catalog in canonical page-ID order."""

    return hashlib.sha256(
        b"".join(
            _page_catalog_fragment(
                page_id,
                str(page_rows[page_id]["sha256"]),
            )
            for page_id in sorted(page_rows)
        )
    ).hexdigest()


def _parent_generation_manifest_path_boundary(
    path: Path,
    *,
    parent_generation: int,
    parent_payload_sha256: str,
) -> Path:
    """Resolve one exact immutable parent in a live or retired lineage."""

    resolved = path.expanduser().resolve()
    if (
        parent_generation < 1
        or not _valid_sha256_boundary(parent_payload_sha256)
    ):
        raise RuntimeError("NoNE generation parent identity is malformed")
    canonical = (
        resolved.parent.parent
        / f"generation_{parent_generation:08d}_{parent_payload_sha256}"
        / "generation.json"
    )
    if canonical.is_file():
        return canonical.resolve()

    candidates = (
        sorted(resolved.parent.glob("*.json"))
        if resolved.parent.name == "manifests"
        else sorted(resolved.parent.parent.glob("*/generation.json"))
    )
    matches: list[Path] = []
    for candidate in candidates:
        try:
            raw = _read_json(candidate)
        except (OSError, ValueError):
            continue
        if (
            raw.get("generation") == parent_generation
            and raw.get("manifestPayloadSha256")
            == parent_payload_sha256
        ):
            matches.append(candidate.resolve())
    if len(matches) != 1:
        raise RuntimeError("NoNE generation parent manifest is absent or ambiguous")
    return matches[0]


def _generation_manifest_dependencies_unchanged_boundary(
    dependencies: tuple[tuple[Path, _FileIdentity], ...],
) -> bool:
    try:
        return all(
            _file_identity(dependency_path) == dependency_identity
            for dependency_path, dependency_identity in dependencies
        )
    except OSError:
        return False


def _read_generation_manifest_authority_snapshot_cached(
    path: Path,
) -> tuple[
    str,
    dict[str, Any],
    str,
    dict[int, dict[str, Any]],
    _FileIdentity,
    tuple[tuple[Path, _FileIdentity], ...],
]:
    """Read one full or parent-bound delta manifest as exact authority.

    Delta files retain only the changed page rows.  Their complete ``pageObjects``
    projection is reconstructed in memory from an exact parent payload, while
    the on-disk payload digest deliberately excludes that synthetic projection.
    No cache lock is held during recursive parent resolution.  The immutable
    file-identity dependency snapshot is returned with the projection so
    correctness never depends on the entry remaining in the bounded shared
    cache after this call returns.
    """

    resolved = path.expanduser().resolve()
    identity = _file_identity(resolved)
    manifest_sha256, raw_manifest = _read_generation_json_cached(resolved)
    with _GENERATION_JSON_CACHE_LOCK:
        cached = _GENERATION_MANIFEST_AUTHORITY_CACHE.get(resolved)
        lineage_cached = _GENERATION_LINEAGE_AUTHORITY_CACHE.get(resolved)
    if (
        cached is not None
        and cached[0] == identity
        and cached[1] == manifest_sha256
        and _generation_manifest_dependencies_unchanged_boundary(cached[5])
    ):
        with _GENERATION_JSON_CACHE_LOCK:
            if _GENERATION_MANIFEST_AUTHORITY_CACHE.get(resolved) == cached:
                _GENERATION_MANIFEST_AUTHORITY_CACHE.pop(resolved)
                _GENERATION_MANIFEST_AUTHORITY_CACHE[resolved] = cached
        return (
            manifest_sha256,
            cached[4],
            cached[2],
            cached[3],
            cached[0],
            cached[5],
        )
    with _GENERATION_JSON_CACHE_LOCK:
        _GENERATION_MANIFEST_AUTHORITY_CACHE.pop(resolved, None)

    lineage_authority = (
        lineage_cached[1]
        if (
            lineage_cached is not None
            and lineage_cached[0] == identity
            and lineage_cached[1].manifest_sha256 == manifest_sha256
        )
        else None
    )
    payload_sha256 = (
        lineage_authority.manifest_payload_sha256
        if lineage_authority is not None
        else _manifest_payload_sha256(raw_manifest)
    )
    if (
        raw_manifest.get("manifestPayloadSha256") != payload_sha256
        or not page_generation_schema_supported_boundary(
            raw_manifest.get("schema")
        )
    ):
        raise RuntimeError("NoNE generation manifest payload authority differs")
    placement_authority_sha256 = raw_manifest.get(
        "pageObjectWritePlacementAuthoritySha256"
    )
    placement_proof_sha256 = raw_manifest.get(
        "pageObjectWritePlacementProofSha256"
    )
    if (
        (placement_authority_sha256 is None)
        != (placement_proof_sha256 is None)
        or (
            placement_authority_sha256 is not None
            and (
                not _valid_sha256_boundary(placement_authority_sha256)
                or not _valid_sha256_boundary(placement_proof_sha256)
            )
        )
    ):
        raise RuntimeError(
            "NoNE generation placement authority is incomplete"
        )

    manifest = raw_manifest
    dependencies: tuple[tuple[Path, _FileIdentity], ...] = (
        (resolved, identity),
    )
    if raw_manifest.get("schema") == PAGE_GENERATION_DELTA_SCHEMA:
        generation = raw_manifest.get("generation")
        parent_generation = raw_manifest.get("parentGeneration")
        parent_payload_sha256 = raw_manifest.get(
            "parentManifestPayloadSha256"
        )
        if (
            "pageObjects" in raw_manifest
            or not isinstance(generation, int)
            or isinstance(generation, bool)
            or not isinstance(parent_generation, int)
            or isinstance(parent_generation, bool)
            or parent_generation < 1
            or parent_generation >= generation
            or not _valid_sha256_boundary(parent_payload_sha256)
        ):
            raise RuntimeError("NoNE generation catalog delta lineage is malformed")
        parent_path = _parent_generation_manifest_path_boundary(
            resolved,
            parent_generation=parent_generation,
            parent_payload_sha256=cast(str, parent_payload_sha256),
        )
        (
            _parent_manifest_sha256,
            parent_manifest,
            projected_parent_payload_sha256,
            parent_page_rows,
            _parent_identity,
            parent_dependencies,
        ) = _read_generation_manifest_authority_snapshot_cached(parent_path)
        if (
            parent_manifest.get("sessionKey")
            != raw_manifest.get("sessionKey")
            or parent_manifest.get("generation") != parent_generation
            or projected_parent_payload_sha256 != parent_payload_sha256
            or parent_manifest.get("manifestPayloadSha256")
            != parent_payload_sha256
        ):
            raise RuntimeError("NoNE generation catalog delta parent differs")
        parent_placement_authority_sha256 = parent_manifest.get(
            "pageObjectWritePlacementAuthoritySha256"
        )
        parent_placement_proof_sha256 = parent_manifest.get(
            "pageObjectWritePlacementProofSha256"
        )
        if parent_placement_authority_sha256 is not None and (
            placement_authority_sha256
            != parent_placement_authority_sha256
            or placement_proof_sha256 != parent_placement_proof_sha256
        ):
            raise RuntimeError(
                "NoNE generation placement authority changed in lineage"
            )
        parent_depth = _generation_manifest_delta_depth_boundary(
            parent_manifest
        )
        if (
            _generation_manifest_delta_depth_boundary(raw_manifest)
            != parent_depth + 1
        ):
            raise RuntimeError("NoNE generation catalog delta depth differs")
        updated_page_rows = _generation_page_rows_boundary(
            raw_manifest.get("updatedPageObjects"),
            label="updated page-object catalog",
        )
        updated_page_ids = raw_manifest.get("updatedPageIds")
        if (
            not isinstance(updated_page_ids, list)
            or len(updated_page_ids) != len(updated_page_rows)
            or any(
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                for page_id in updated_page_ids
            )
            or set(updated_page_ids) != set(updated_page_rows)
        ):
            raise RuntimeError("NoNE generation catalog delta update set differs")
        page_rows = dict(parent_page_rows)
        page_rows.update(updated_page_rows)
        page_count = raw_manifest.get("pageCount")
        if (
            not isinstance(page_count, int)
            or isinstance(page_count, bool)
            or page_count != len(page_rows)
        ):
            raise RuntimeError("NoNE generation catalog delta page count differs")
        components = raw_manifest.get("components")
        expert_pages = (
            components.get("expertPages")
            if isinstance(components, dict)
            else None
        )
        if (
            not isinstance(expert_pages, dict)
            or expert_pages.get("sha256")
            != _generation_page_catalog_sha256_boundary(page_rows)
        ):
            raise RuntimeError("NoNE generation catalog delta digest differs")
        training_proven_page_ids = raw_manifest.get(
            "trainingProvenPageIds",
            [],
        )
        if (
            not isinstance(training_proven_page_ids, list)
            or any(
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id not in page_rows
                for page_id in training_proven_page_ids
            )
            or len(training_proven_page_ids)
            != len(set(training_proven_page_ids))
        ):
            raise RuntimeError(
                "NoNE generation catalog delta training proof differs"
            )
        manifest = dict(raw_manifest)
        manifest["pageObjects"] = [
            page_rows[page_id] for page_id in sorted(page_rows)
        ]
        dependencies = (
            (resolved, identity),
            *parent_dependencies,
        )
    else:
        page_rows = _generation_page_rows_boundary(
            raw_manifest.get("pageObjects"),
            label="page-object catalog",
        )
        page_count = raw_manifest.get("pageCount")
        if (
            page_count is not None
            and (
                not isinstance(page_count, int)
                or isinstance(page_count, bool)
                or page_count != len(page_rows)
            )
        ):
            raise RuntimeError("NoNE generation page-object count differs")

    cached_value = (
        identity,
        manifest_sha256,
        payload_sha256,
        page_rows,
        manifest,
        dependencies,
    )
    if (
        _file_identity(resolved) != identity
        or not _generation_manifest_dependencies_unchanged_boundary(
            dependencies
        )
    ):
        raise RuntimeError(
            "NoNE generation manifest changed during authority indexing"
        )
    with _GENERATION_JSON_CACHE_LOCK:
        _GENERATION_MANIFEST_AUTHORITY_CACHE[resolved] = cached_value
        while (
            len(_GENERATION_MANIFEST_AUTHORITY_CACHE)
            > _GENERATION_JSON_CACHE_MAX_PATHS
        ):
            oldest = next(iter(_GENERATION_MANIFEST_AUTHORITY_CACHE))
            _GENERATION_MANIFEST_AUTHORITY_CACHE.pop(oldest)
    return (
        manifest_sha256,
        manifest,
        payload_sha256,
        page_rows,
        identity,
        dependencies,
    )


def _read_generation_manifest_authority_cached(
    path: Path,
) -> tuple[str, dict[str, Any], str, dict[int, dict[str, Any]]]:
    """Read one generation projection while keeping cache state non-authoritative."""

    (
        manifest_sha256,
        manifest,
        payload_sha256,
        page_rows,
        _identity,
        _dependencies,
    ) = _read_generation_manifest_authority_snapshot_cached(path)
    return manifest_sha256, manifest, payload_sha256, page_rows


def _read_generation_page_row_cached(
    path: Path,
    *,
    page_id: int,
    expected_manifest_sha256: str,
    expected_payload_sha256: str,
) -> dict[str, Any]:
    """Read one immutable generation page row without retaining full catalogs.

    Rev6 semantic admission repeatedly checks the same historical page while
    walking a candidate delta chain.  The complete generation manifest is
    large, so retain only the exact row needed by that check.  Every hit is
    still bound to the current device/inode/size/time identity and both
    authority digests; an identity or digest drift falls through to the full
    manifest validator and cannot reuse stale evidence.
    """

    resolved = path.expanduser().resolve()
    key = (resolved, page_id)
    identity = _file_identity(resolved)
    with _GENERATION_JSON_CACHE_LOCK:
        cached = _GENERATION_PAGE_ROW_CACHE.get(key)
    if (
        cached is not None
        and cached[0] == identity
        and cached[1] == expected_manifest_sha256
        and cached[2] == expected_payload_sha256
        and _generation_manifest_dependencies_unchanged_boundary(cached[4])
    ):
        with _GENERATION_JSON_CACHE_LOCK:
            if _GENERATION_PAGE_ROW_CACHE.get(key) == cached:
                _GENERATION_PAGE_ROW_CACHE.pop(key)
                _GENERATION_PAGE_ROW_CACHE[key] = cached
        return cached[3]
    if cached is not None:
        with _GENERATION_JSON_CACHE_LOCK:
            if _GENERATION_PAGE_ROW_CACHE.get(key) == cached:
                _GENERATION_PAGE_ROW_CACHE.pop(key, None)

    (
        manifest_sha256,
        _manifest,
        payload_sha256,
        page_rows,
        authority_identity,
        dependencies,
    ) = _read_generation_manifest_authority_snapshot_cached(resolved)
    if (
        manifest_sha256 != expected_manifest_sha256
        or payload_sha256 != expected_payload_sha256
    ):
        raise RuntimeError("NoNE generation page-row authority differs")
    row = page_rows.get(page_id)
    if not isinstance(row, dict):
        raise RuntimeError("NoNE generation page-object row is absent")
    if (
        authority_identity != identity
        or not _generation_manifest_dependencies_unchanged_boundary(
            dependencies
        )
    ):
        raise RuntimeError(
            "NoNE generation page-row dependency authority differs"
        )
    identity_after = _file_identity(resolved)
    if identity_after != identity:
        raise RuntimeError("NoNE generation page-row identity changed")
    with _GENERATION_JSON_CACHE_LOCK:
        _GENERATION_PAGE_ROW_CACHE.pop(key, None)
        _GENERATION_PAGE_ROW_CACHE[key] = (
            identity,
            manifest_sha256,
            payload_sha256,
            row,
            dependencies,
        )
        while (
            len(_GENERATION_PAGE_ROW_CACHE)
            > _GENERATION_PAGE_ROW_CACHE_MAX_ENTRIES
        ):
            _GENERATION_PAGE_ROW_CACHE.pop(
                next(iter(_GENERATION_PAGE_ROW_CACHE))
            )
    return row


def _decoded_mount_path(value: str) -> Path:
    """Decode the small escape set used by Linux mountinfo paths."""

    return Path(
        value.replace("\\040", " ")
        .replace("\\011", "\t")
        .replace("\\012", "\n")
        .replace("\\134", "\\")
    ).resolve()


def _mounted_filesystem_roots_boundary() -> tuple[Path, ...]:
    """Observe mounted storage roots without assuming device names or years."""

    mountinfo = Path("/proc/self/mountinfo")
    observed: set[Path] = {Path("/")}
    if mountinfo.is_file():
        for line in mountinfo.read_text(encoding="utf-8").splitlines():
            fields = line.split()
            if len(fields) > 4:
                observed.add(_decoded_mount_path(fields[4]))
    return tuple(sorted(observed, key=lambda path: (len(path.parts), str(path))))


def _page_store_registry_root_for_boundary(store_root: Path) -> Path:
    """Choose the registry on the same mounted failure domain as a store."""

    resolved = store_root.expanduser().resolve()
    containing = tuple(
        mount
        for mount in _mounted_filesystem_roots_boundary()
        if resolved == mount or resolved.is_relative_to(mount)
    )
    mount_root = max(containing, key=lambda path: len(path.parts), default=Path("/"))
    if mount_root == Path("/"):
        top_level = (
            Path("/") / resolved.parts[1]
            if len(resolved.parts) > 1
            else Path.home()
        )
        return top_level / ".nnf-resynthesis/page-stores"
    return mount_root / ".nnf-resynthesis/page-stores"


def _default_page_store_registry_roots_boundary() -> tuple[Path, ...]:
    """Return small, mount-local registries rather than crawling whole disks."""

    root_filesystem_registries = {
        child / ".nnf-resynthesis/page-stores"
        for child in Path("/").iterdir()
        if child.is_dir()
        and (child / ".nnf-resynthesis/page-stores").is_dir()
    }
    roots = {
        Path.home() / ".nnf-resynthesis/page-stores",
        *root_filesystem_registries,
        *(
            mount / ".nnf-resynthesis/page-stores"
            for mount in _mounted_filesystem_roots_boundary()
            if mount != Path("/")
        ),
    }
    return tuple(sorted(roots, key=str))


def discover_page_store_session_ids_boundary(
    *,
    registry_roots: tuple[Path, ...] | None = None,
) -> tuple[torch.Tensor, ...]:
    """Discover session identities advertised by mount-local registries.

    This explicit filesystem boundary discovers storage identity only.  It does
    not select a generation, page, layer, expert, or model route.
    """

    roots = (
        _default_page_store_registry_roots_boundary()
        if registry_roots is None
        else tuple(root.expanduser().resolve() for root in registry_roots)
    )
    observed: dict[str, tuple[int, ...]] = {}
    for registry_root in roots:
        try:
            readable = registry_root.is_dir() and os.access(
                registry_root,
                os.R_OK | os.X_OK,
            )
        except OSError:
            readable = False
        if not readable:
            continue
        try:
            session_registries = tuple(sorted(registry_root.iterdir(), key=str))
        except OSError:
            continue
        for session_registry in session_registries:
            try:
                is_session_directory = session_registry.is_dir()
            except OSError:
                is_session_directory = False
            if not is_session_directory:
                continue
            for locator_path in sorted(session_registry.glob("*.json")):
                locator = _read_json(locator_path)
                session_key = locator.get("sessionKey")
                session_values = locator.get("sessionId")
                if (
                    locator.get("schema") != PAGE_STORE_LOCATOR_SCHEMA
                    or not isinstance(session_key, str)
                    or not session_key
                    or session_registry.name != session_key
                    or not isinstance(session_values, list)
                    or len(session_values) < 1
                    or any(
                        not isinstance(value, int) or isinstance(value, bool)
                        for value in session_values
                    )
                ):
                    raise RuntimeError("NoNE page-store session locator differs")
                identity = tuple(session_values)
                session_id_t = torch.tensor(identity, dtype=torch.long)
                if _session_key(session_id_t) != session_key:
                    raise RuntimeError("NoNE page-store session identity differs")
                previous = observed.get(session_key)
                if previous is not None and previous != identity:
                    raise RuntimeError("NoNE page-store session registry conflicts")
                observed[session_key] = identity
    return tuple(
        torch.tensor(observed[key], dtype=torch.long)
        for key in sorted(observed)
    )


def _visible_accepted_pointer_record_boundary(
    pointer_path: Path,
) -> dict[str, Any]:
    """Resolve a preaccept pointer only after its canonical marker is durable.

    A replica may contain candidate pointer bytes before the canonical store is
    committed.  Until the exact marker appears, all readers see the embedded
    prior pointer.  This keeps the multi-device write transaction invisible
    without guessing from pointer mtimes or replica ordering.
    """

    resolved = pointer_path.expanduser().resolve()
    if (
        resolved.name != "accepted.json"
        or resolved.is_symlink()
        or not resolved.is_file()
    ):
        raise RuntimeError("NoNE accepted pointer identity differs")
    raw = _read_json(resolved)
    visibility = raw.get("acceptanceTransaction")
    if visibility is None:
        return raw
    target = dict(raw)
    target.pop("acceptanceTransaction", None)
    prior = visibility.get("priorPointer") if isinstance(visibility, dict) else None
    transaction_sha256 = (
        visibility.get("transactionSha256")
        if isinstance(visibility, dict)
        else None
    )
    marker_path_value = (
        visibility.get("canonicalCommitMarkerPath")
        if isinstance(visibility, dict)
        else None
    )
    marker_payload_sha256 = (
        visibility.get("canonicalCommitMarkerPayloadSha256")
        if isinstance(visibility, dict)
        else None
    )
    prior_sha256 = (
        visibility.get("priorPointerPayloadSha256")
        if isinstance(visibility, dict)
        else None
    )
    target_sha256 = (
        visibility.get("targetPointerPayloadSha256")
        if isinstance(visibility, dict)
        else None
    )
    store_root_value = (
        visibility.get("storeRoot")
        if isinstance(visibility, dict)
        else None
    )
    if (
        not isinstance(visibility, dict)
        or visibility.get("schema")
        != ALL_KNOWLEDGE_ACCEPTANCE_POINTER_VISIBILITY_SCHEMA
        or not _valid_sha256_boundary(transaction_sha256)
        or not isinstance(marker_path_value, str)
        or not marker_path_value
        or not _valid_sha256_boundary(marker_payload_sha256)
        or not isinstance(prior, dict)
        or not _valid_sha256_boundary(prior_sha256)
        or not _valid_sha256_boundary(target_sha256)
        or not isinstance(store_root_value, str)
        or not store_root_value
        or hashlib.sha256(_canonical_json_bytes(prior)).hexdigest()
        != prior_sha256
        or hashlib.sha256(_canonical_json_bytes(target)).hexdigest()
        != target_sha256
    ):
        raise RuntimeError("NoNE acceptance transaction pointer differs")
    marker_path = Path(marker_path_value).expanduser().resolve()
    if marker_path.name != f"{transaction_sha256}.commit.json":
        raise RuntimeError("NoNE acceptance transaction marker path differs")
    if not marker_path.exists():
        return prior
    if marker_path.is_symlink() or not marker_path.is_file():
        raise RuntimeError("NoNE acceptance transaction marker differs")
    marker = _read_json(marker_path)
    target_pointer_sha256s = marker.get(
        "targetPointerPayloadSha256s"
    )
    if (
        hashlib.sha256(_canonical_json_bytes(marker)).hexdigest()
        != marker_payload_sha256
        or marker.get("schema")
        != ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA
        or marker.get("passed") is not True
        or marker.get("transactionSha256") != transaction_sha256
        or not isinstance(target_pointer_sha256s, dict)
        or target_pointer_sha256s.get(store_root_value)
        != target_sha256
    ):
        raise RuntimeError("NoNE acceptance transaction marker differs")
    return target


def _store_pointer_packet_boundary(
    root: Path,
    session_id_t: torch.Tensor,
) -> NoNEPageStoreLocatorPacket:
    """Validate one live accepted pointer and its immutable manifest."""

    resolved_root = root.expanduser().resolve()
    session_key = _session_key(session_id_t)
    session_root = resolved_root / "sessions" / session_key
    if not session_root.is_dir():
        raise RuntimeError("NoNE discovered store has no matching session")
    pointer_path = session_root / "accepted.json"
    if not pointer_path.is_file():
        zero_digest_t = torch.zeros(32, dtype=torch.uint8)
        return NoNEPageStoreLocatorPacket(
            root=resolved_root,
            session_id_t=session_id_t.detach().cpu().long().clone(),
            generation_t=torch.zeros((), dtype=torch.long),
            manifest_sha256_t=zero_digest_t.clone(),
            manifest_payload_sha256_t=zero_digest_t.clone(),
            pointer_path=None,
        )
    pointer = _visible_accepted_pointer_record_boundary(pointer_path)
    manifest_relative = pointer.get("manifest")
    generation = pointer.get("generation")
    manifest_sha256 = pointer.get("manifestSha256")
    payload_sha256 = pointer.get("manifestPayloadSha256")
    if (
        pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA
        or pointer.get("sessionKey") != session_key
        or not isinstance(generation, int)
        or isinstance(generation, bool)
        or generation < 1
        or not isinstance(manifest_relative, str)
        or not isinstance(manifest_sha256, str)
        or len(manifest_sha256) != 64
        or not isinstance(payload_sha256, str)
        or len(payload_sha256) != 64
    ):
        raise RuntimeError("NoNE discovered accepted pointer is malformed")
    manifest_path = (session_root / manifest_relative).resolve()
    if (
        not manifest_path.is_relative_to(session_root)
        or not manifest_path.is_file()
    ):
        raise RuntimeError("NoNE discovered generation manifest changed")
    if _file_sha256(manifest_path) != manifest_sha256:
        raise RuntimeError("NoNE discovered generation manifest changed")
    lineage = _read_generation_lineage_authority_cached(
        manifest_path,
        expected_session_key=session_key,
    )
    if (
        lineage.manifest_sha256 != manifest_sha256
        or lineage.generation != generation
        or lineage.manifest_payload_sha256 != payload_sha256
        or (
            lineage.parent_manifest_payload_sha256 is not None
            and (
                len(lineage.parent_manifest_payload_sha256) != 64
            )
        )
    ):
        raise RuntimeError("NoNE discovered generation identity differs")
    return NoNEPageStoreLocatorPacket(
        root=resolved_root,
        session_id_t=session_id_t.detach().cpu().long().clone(),
        generation_t=torch.tensor(generation, dtype=torch.long),
        manifest_sha256_t=digest_tensor(manifest_sha256),
        manifest_payload_sha256_t=digest_tensor(payload_sha256),
        pointer_path=pointer_path,
    )


def _page_store_candidate_roots_boundary(
    *,
    session_id_t: torch.Tensor,
    anchor_roots: tuple[Path, ...] = (),
    registry_roots: tuple[Path, ...] | None = None,
) -> tuple[torch.Tensor, tuple[Path, ...]]:
    """Resolve advertised roots before validating their accepted pointers."""

    session_id = session_id_t.detach().cpu().long().reshape(-1)
    if session_id.numel() < 1:
        raise ValueError("NoNE store discovery requires a session identity")
    session_key = _session_key(session_id)
    candidates: set[Path] = {
        root.expanduser().resolve() for root in anchor_roots
    }
    roots = (
        _default_page_store_registry_roots_boundary()
        if registry_roots is None
        else tuple(root.expanduser().resolve() for root in registry_roots)
    )
    for registry_root in roots:
        if not os.access(registry_root, os.R_OK | os.X_OK):
            continue
        session_registry = registry_root / session_key
        if not session_registry.is_dir():
            continue
        for locator_path in sorted(session_registry.glob("*.json")):
            locator = _read_json(locator_path)
            root_value = locator.get("root")
            if (
                locator.get("schema") != PAGE_STORE_LOCATOR_SCHEMA
                or locator.get("sessionKey") != session_key
                or locator.get("sessionId") != session_id.tolist()
                or not isinstance(root_value, str)
                or not root_value
            ):
                raise RuntimeError("NoNE page-store locator differs")
            root = Path(root_value).expanduser().resolve()
            if root.is_dir():
                candidates.add(root)
    return session_id, tuple(sorted(candidates, key=str))


def discover_page_store_locators_boundary(
    *,
    session_id_t: torch.Tensor,
    anchor_roots: tuple[Path, ...] = (),
    registry_roots: tuple[Path, ...] | None = None,
) -> tuple[NoNEPageStoreLocatorPacket, ...]:
    """Strictly validate every store advertising one session."""

    session_id, candidates = _page_store_candidate_roots_boundary(
        session_id_t=session_id_t,
        anchor_roots=anchor_roots,
        registry_roots=registry_roots,
    )
    packets: list[NoNEPageStoreLocatorPacket] = []
    for root in candidates:
        if root.is_dir():
            packets.append(_store_pointer_packet_boundary(root, session_id))
    return tuple(packets)


def discover_coherent_page_store_locators_boundary(
    *,
    session_id_t: torch.Tensor,
    anchor_roots: tuple[Path, ...] = (),
    registry_roots: tuple[Path, ...] | None = None,
) -> NoNEPageStoreDiscoveryAuditPacket:
    """Quarantine incoherent replicas while retaining strict pointer checks.

    Every returned locator passed the same validation as strict discovery.
    Rejected roots remain explicit audit evidence; this boundary never repairs,
    selects pages from, or grants authority to an incoherent store.
    """

    session_id, candidates = _page_store_candidate_roots_boundary(
        session_id_t=session_id_t,
        anchor_roots=anchor_roots,
        registry_roots=registry_roots,
    )
    packets: list[NoNEPageStoreLocatorPacket] = []
    rejected: list[Path] = []
    for root in candidates:
        try:
            if root.is_dir():
                packets.append(_store_pointer_packet_boundary(root, session_id))
        except (OSError, RuntimeError, ValueError):
            rejected.append(root)
    return NoNEPageStoreDiscoveryAuditPacket(
        locators=tuple(packets),
        rejected_roots=tuple(rejected),
    )


def build_graph_authority_binding_boundary(
    *,
    generation_binding: NoNEGenerationBinding,
    checkpoint_path: Path,
    optimizer_path: Path,
    external_state_path: Path,
    composition_path: Path,
    migration_receipt_path: Path,
    replica_receipt_path: Path | None = None,
    expected_authority_record: Mapping[str, Any] | None = None,
    identity_cache_root: Path | None = None,
    topology_cache_root: Path | None = None,
) -> NoNEGraphAuthorityBinding:
    """Verify and bind one complete graph transaction at checkpoint I/O.

    This boundary hashes files and parses JSON; it is never part of the tensor
    forward.  The returned packet is subsequently reverified before an
    accepted pointer can advance.
    """

    checkpoint = checkpoint_path.expanduser().resolve()
    optimizer = optimizer_path.expanduser().resolve()
    external = external_state_path.expanduser().resolve()
    composition_file = composition_path.expanduser().resolve()
    migration_receipt = migration_receipt_path.expanduser().resolve()
    replica_receipt = (
        replica_receipt_path.expanduser().resolve()
        if replica_receipt_path is not None
        else None
    )

    def authority_sha256(name: str, path: Path) -> str | None:
        if expected_authority_record is None:
            return None
        artifact = expected_authority_record.get(name)
        if not isinstance(artifact, Mapping):
            raise RuntimeError(f"NoNE graph authority has no {name}")
        expected_path = artifact.get("path")
        expected_sha256 = artifact.get("sha256")
        if (
            not isinstance(expected_path, str)
            or Path(expected_path).expanduser().resolve() != path
            or not isinstance(expected_sha256, str)
            or len(expected_sha256) != 64
        ):
            raise RuntimeError(f"NoNE graph authority {name} identity differs")
        return expected_sha256

    for path, label in (
        (checkpoint, "checkpoint"),
        (optimizer, "optimizer"),
        (external, "external sidecar"),
        (composition_file, "composition"),
    ):
        if not path.is_file():
            raise RuntimeError(f"NoNE graph authority {label} is missing")

    composition_sha256 = _file_sha256(
        composition_file,
        expected_sha256=authority_sha256("composition", composition_file),
        identity_cache_root=identity_cache_root,
    )
    composition = _read_json(composition_file)
    catalog_record = composition.get("pageCatalog")
    resident_record = composition.get("residentRuntime")
    page_store_record = composition.get("pageStore")
    if (
        not isinstance(catalog_record, dict)
        or not isinstance(resident_record, dict)
        or not isinstance(page_store_record, dict)
    ):
        raise RuntimeError("NoNE graph composition has no executable page topology")

    def composition_artifact(
        record: Mapping[str, Any],
        *,
        label: str,
    ) -> tuple[Path, str]:
        path = Path(str(record.get("path", ""))).expanduser().resolve()
        sha256 = record.get("sha256")
        if (
            not path.is_file()
            or not isinstance(sha256, str)
            or len(sha256) != 64
            or _file_sha256(
                path,
                expected_sha256=sha256,
                identity_cache_root=identity_cache_root,
            )
            != sha256
        ):
            raise RuntimeError(f"NoNE graph {label} identity differs")
        return path, sha256

    catalog_path = Path(
        str(catalog_record.get("path", ""))
    ).expanduser().resolve()
    catalog_sha256 = catalog_record.get("sha256")
    if (
        not catalog_path.is_file()
        or not isinstance(catalog_sha256, str)
        or len(catalog_sha256) != 64
    ):
        raise RuntimeError("NoNE graph page catalog identity differs")
    catalog_topology = _load_page_catalog_topology_boundary(
        catalog_path=catalog_path,
        expected_sha256=catalog_sha256,
        identity_cache_root=identity_cache_root,
        topology_cache_root=topology_cache_root,
    )
    loaded_catalog_sha256, catalog = _read_immutable_json_cached(catalog_path)
    if loaded_catalog_sha256 != catalog_sha256:
        raise RuntimeError("NoNE graph page catalog identity differs")
    federated_growth_demand_authority = (
        federated_growth_demand_authority_from_catalog_boundary(catalog)
    )
    composition_demand_authority = composition.get(
        "federatedGrowthDemandAuthority"
    )
    composition_demand_sha256 = composition.get(
        "federatedGrowthDemandAuthoritySha256"
    )
    catalog_expansion = composition.get("catalogExpansion")
    if federated_growth_demand_authority is None:
        if (
            composition_demand_authority is not None
            or composition_demand_sha256 is not None
            or (
                isinstance(catalog_expansion, Mapping)
                and (
                    catalog_expansion.get("federatedGrowthDemandAuthority")
                    is not None
                    or catalog_expansion.get(
                        "federatedGrowthDemandAuthoritySha256"
                    )
                    is not None
                )
            )
        ):
            raise RuntimeError("NoNE legacy graph has federated demand authority")
    else:
        demand_sha256 = federated_growth_demand_authority["authoritySha256"]
        if (
            composition_demand_authority != federated_growth_demand_authority
            or composition_demand_sha256 != demand_sha256
            or not isinstance(catalog_expansion, Mapping)
            or catalog_expansion.get("federatedGrowthDemandAuthority")
            != federated_growth_demand_authority
            or catalog_expansion.get("federatedGrowthDemandAuthoritySha256")
            != demand_sha256
        ):
            raise RuntimeError("NoNE graph federated demand authority differs")
        if expected_authority_record is not None and (
            expected_authority_record.get(
                "federatedGrowthDemandAuthoritySha256"
            )
            != demand_sha256
        ):
            raise RuntimeError("NoNE graph federated demand record differs")
    if (
        expected_authority_record is not None
        and federated_growth_demand_authority is None
        and expected_authority_record.get(
            "federatedGrowthDemandAuthoritySha256"
        )
        is not None
    ):
        raise RuntimeError("NoNE legacy graph demand record differs")
    resident_path, resident_sha256 = composition_artifact(
        resident_record,
        label="resident runtime",
    )
    sparse_graph_layer_authority = (
        catalog_topology.sparse_graph_layer_authority
    )
    sparse_graph_layer_binding = (
        {
            "schema": SPARSE_GRAPH_LAYER_AUTHORITY_SCHEMA,
            "graphLayerIdsSha256": sparse_graph_layer_authority[1],
            "physicalGraphLayerCount": len(sparse_graph_layer_authority[0]),
            "pageCatalogSha256": catalog_sha256,
            "onePageObjectPerSparseGraphLayer": True,
            "routeGradientDeltaProofComplete": False,
            "heldoutProofComplete": False,
            "coldReloadProofComplete": False,
            "trainingClaimed": False,
            "promotionEligible": False,
        }
        if sparse_graph_layer_authority is not None
        else None
    )
    if sparse_graph_layer_binding is None:
        if "sparseGraphLayers" in composition:
            raise RuntimeError(
                "NoNE legacy graph composition has sparse-layer authority"
            )
    elif composition.get("sparseGraphLayers") != sparse_graph_layer_binding:
        raise RuntimeError("NoNE graph sparse-layer composition differs")

    checkpoint_sha256 = _file_sha256(
        checkpoint,
        expected_sha256=authority_sha256("checkpoint", checkpoint),
        identity_cache_root=identity_cache_root,
    )
    optimizer_sha256 = _file_sha256(
        optimizer,
        expected_sha256=authority_sha256("optimizer", optimizer),
        identity_cache_root=identity_cache_root,
    )
    external_sha256 = _file_sha256(
        external,
        expected_sha256=authority_sha256("externalState", external),
        identity_cache_root=identity_cache_root,
    )
    external_envelope = _read_json(external)
    external_state = external_envelope.get("externalState")
    composition_store_root = page_store_record.get("root")
    sidecar_store_root = (
        external_state.get("storeRoot") if isinstance(external_state, dict) else None
    )
    branch_store_root_matches = False
    training_proof = (
        external_state.get("trainingProof")
        if isinstance(external_state, dict)
        else None
    )
    if (
        isinstance(external_state, dict)
        and isinstance(training_proof, dict)
        and training_proof.get("branchScopeActive") is True
    ):
        proof_scope_record = training_proof.get("branchScope")
        sidecar_scope_record = external_state.get("branchScope")
        if (
            sidecar_scope_record is not None
            and sidecar_scope_record != proof_scope_record
        ):
            raise RuntimeError("NoNE graph training branch scope differs")
        branch_scope = training_branch_scope_from_record_boundary(
            proof_scope_record
        )
        training_branch_proof_from_record_boundary(
            branch_scope,
            training_proof,
        )
        branch_root = (
            Path(sidecar_store_root).expanduser().resolve()
            if isinstance(sidecar_store_root, str)
            and sidecar_store_root
            and Path(sidecar_store_root).expanduser().is_absolute()
            else None
        )
        updated_page_ids_t = (
            generation_binding.updated_page_ids_t.detach()
            .cpu()
            .long()
            .reshape(-1)
        )
        if (
            branch_root is None
            or not branch_root.is_dir()
            or not torch.equal(
                generation_binding.session_id_t.detach().cpu().long(),
                branch_scope.session_id_t,
            )
            or updated_page_ids_t.numel() < 1
            or torch.unique(updated_page_ids_t).numel()
            != updated_page_ids_t.numel()
            or not generation_binding.generation_t.detach()
            .cpu()
            .long()
            .reshape(())
            .gt(branch_scope.parent_generation_t)
            or not _page_ids_subset_t_boundary(
                updated_page_ids_t,
                branch_scope.page_ids_t,
            )
        ):
            raise RuntimeError("NoNE graph training branch identity differs")
        branch_store = NoNEImmutablePageStore(
            branch_root,
            advertise_locator=False,
        )
        branch_store.begin_existing_session_generation_boundary(
            branch_scope.session_id_t
        )
        branch_current, branch_current_manifest = (
            branch_store._live_accepted_binding_boundary()
        )
        branch_parent_generation = int(branch_scope.parent_generation_t)
        branch_parent_payload_sha256 = _tensor_digest_hex(
            branch_scope.parent_manifest_payload_sha256_t
        )
        branch_parent, branch_parent_manifest = (
            branch_store._load_generation_binding_boundary(
                "generations/"
                f"generation_{branch_parent_generation:08d}_"
                f"{branch_parent_payload_sha256}/generation.json",
                expected_payload_sha256=branch_parent_payload_sha256,
            )
        )
        branch_parent_page_ids_t = (
            branch_store._manifest_page_ids_t_boundary(
                branch_parent_manifest
            )
        )
        if not bool(
            _page_ids_subset_t_boundary(
                branch_scope.page_ids_t,
                branch_parent_page_ids_t,
            )
        ):
            raise RuntimeError("NoNE graph training branch contains a foreign page")
        branch_lineage = branch_current
        branch_lineage_parent_payload = branch_current_manifest.get(
            "parentManifestPayloadSha256"
        )
        observed_lineage_payloads: set[str] = set()
        while int(branch_lineage.generation_t) > branch_parent_generation:
            lineage_payload_sha256 = _tensor_digest_hex(
                branch_lineage.manifest_payload_sha256_t
            )
            if lineage_payload_sha256 in observed_lineage_payloads:
                raise RuntimeError(
                    "NoNE graph training branch lineage contains a cycle"
                )
            observed_lineage_payloads.add(lineage_payload_sha256)
            lineage_parent_generation = int(
                branch_lineage.parent_generation_t
            )
            lineage_parent_payload = branch_lineage_parent_payload
            lineage_updated_page_ids_t = (
                branch_lineage.updated_page_ids_t.detach()
                .cpu()
                .long()
                .reshape(-1)
            )
            if (
                lineage_parent_generation < branch_parent_generation
                or lineage_parent_generation >= int(
                    branch_lineage.generation_t
                )
                or not isinstance(lineage_parent_payload, str)
                or len(lineage_parent_payload) != 64
                or lineage_updated_page_ids_t.numel() < 1
                or not _page_ids_subset_t_boundary(
                    lineage_updated_page_ids_t,
                    branch_scope.page_ids_t,
                )
            ):
                raise RuntimeError(
                    "NoNE graph training branch retained lineage differs"
                )
            lineage_parent_loaded, lineage_parent_parent_payload = (
                branch_store._load_generation_lineage_summary_boundary(
                    generation_t=branch_lineage.parent_generation_t,
                    manifest_payload_sha256_t=digest_tensor(
                        lineage_parent_payload
                    ),
                )
            )
            if (
                int(lineage_parent_loaded.generation_t)
                != lineage_parent_generation
            ):
                raise RuntimeError(
                    "NoNE graph training branch parent lineage changed"
                )
            branch_lineage = lineage_parent_loaded
            branch_lineage_parent_payload = (
                lineage_parent_parent_payload
            )
        branch_current_descends_from_scope_parent = (
            _same_generation_binding_boundary(
                branch_lineage,
                branch_parent,
            )
        )
        expected_branch_layer_ids_t = (
            _page_catalog_layer_ids_for_page_ids_boundary(
                catalog_topology,
                branch_scope.page_ids_t,
            )
        )
        if not torch.equal(
            expected_branch_layer_ids_t,
            branch_scope.page_layer_ids_t,
        ):
            raise RuntimeError("NoNE graph training branch layer ownership differs")
        staged_binding, staged_manifest = (
            branch_store._load_generation_binding_boundary(
                generation_binding.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    generation_binding.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    generation_binding.manifest_payload_sha256_t
                ),
            )
        )
        staged_is_current = _same_generation_binding_boundary(
            branch_current,
            staged_binding,
        )
        staged_payload_sha256 = _tensor_digest_hex(
            staged_binding.manifest_payload_sha256_t
        )
        staged_is_retained_ancestor = bool(
            int(staged_binding.generation_t) < int(branch_current.generation_t)
            and staged_payload_sha256 in observed_lineage_payloads
        )
        staged_extends_current = bool(
            int(staged_binding.generation_t)
            > int(branch_current.generation_t)
            and torch.equal(
                staged_binding.parent_generation_t.reshape(()),
                branch_current.generation_t.reshape(()),
            )
            and staged_manifest.get("parentManifestPayloadSha256")
            == _tensor_digest_hex(
                branch_current.manifest_payload_sha256_t
            )
        )
        branch_store_root_matches = bool(
            branch_store.root == branch_root
            and torch.equal(
                branch_parent.session_id_t,
                branch_scope.session_id_t,
            )
            and torch.equal(
                branch_parent.generation_t.reshape(()),
                branch_scope.parent_generation_t,
            )
            and torch.equal(
                branch_parent.manifest_payload_sha256_t,
                branch_scope.parent_manifest_payload_sha256_t,
            )
            and branch_current_descends_from_scope_parent
            # Historical checkout is an explicit rollback boundary. A graph
            # attached to a cryptographically verified ancestor in this exact
            # branch lineage is as authoritative as the live head; rejecting
            # it makes the advertised checkout API unable to repair a bad
            # accepted child without hand-editing the pointer.
            and (
                staged_is_current
                or staged_is_retained_ancestor
                or staged_extends_current
            )
            and _same_generation_binding_boundary(
                staged_binding,
                generation_binding,
            )
        )
        if not branch_store_root_matches:
            raise RuntimeError("NoNE graph training branch parent differs")
    # Replica-coordinated training may select a different primary store root
    # than the composition's historical pageStore.root.  Accept only when both
    # roots resolve into the same receipt-bound replica set; never invent a new
    # store outside that set.
    store_roots_match = sidecar_store_root == composition_store_root
    if (
        not store_roots_match
        and isinstance(external_state, dict)
        and isinstance(sidecar_store_root, str)
        and isinstance(composition_store_root, str)
    ):
        replica_roots = external_state.get("replicaStoreRoots")
        if isinstance(replica_roots, list) and replica_roots:
            resolved_replica_roots = {
                Path(root).expanduser().resolve()
                for root in replica_roots
                if isinstance(root, str) and root
            }
            store_roots_match = (
                Path(sidecar_store_root).expanduser().resolve()
                in resolved_replica_roots
                and Path(composition_store_root).expanduser().resolve()
                in resolved_replica_roots
            )
    store_roots_match = store_roots_match or branch_store_root_matches
    if (
        external_envelope.get("schema")
        != "nnf.resynthesis.additive_external_checkpoint_binding.v1"
        or external_envelope.get("checkpointSha256") != checkpoint_sha256
        or external_envelope.get("optimizerSha256") != optimizer_sha256
        or not isinstance(external_state, dict)
        or external_state.get("compositionPath") != str(composition_file)
        or external_state.get("compositionSha256") != composition_sha256
        or not store_roots_match
        or not isinstance(external_state.get("candidatePageUpdate"), bool)
        or external_state.get("generationBinding")
        != generation_binding.external_record_boundary()
    ):
        raise RuntimeError("NoNE graph checkpoint sidecar identity differs")
    if sparse_graph_layer_binding is None:
        if "sparseGraphLayers" in external_state:
            raise RuntimeError(
                "NoNE legacy graph sidecar has sparse-layer authority"
            )
    elif external_state.get("sparseGraphLayers") != sparse_graph_layer_binding:
        raise RuntimeError("NoNE graph sparse-layer sidecar differs")

    replica_sha256_t: torch.Tensor | None = None
    if replica_receipt is not None:
        if not replica_receipt.is_file():
            raise RuntimeError("NoNE graph replica receipt is missing")
        replica_sha256_t = digest_tensor(
            _file_sha256(
                replica_receipt,
                expected_sha256=authority_sha256(
                    "replicaReceipt",
                    replica_receipt,
                ),
                identity_cache_root=identity_cache_root,
            )
        )

    return NoNEGraphAuthorityBinding(
        checkpoint_path=str(checkpoint),
        checkpoint_sha256_t=digest_tensor(checkpoint_sha256),
        optimizer_path=str(optimizer),
        optimizer_sha256_t=digest_tensor(optimizer_sha256),
        external_state_path=str(external),
        external_state_sha256_t=digest_tensor(external_sha256),
        composition_path=str(composition_file),
        composition_sha256_t=digest_tensor(composition_sha256),
        page_catalog_path=str(catalog_path),
        page_catalog_sha256_t=digest_tensor(catalog_sha256),
        resident_runtime_path=str(resident_path),
        resident_runtime_sha256_t=digest_tensor(resident_sha256),
        migration_receipt_path=str(migration_receipt),
        replica_receipt_path=(
            str(replica_receipt) if replica_receipt is not None else None
        ),
        replica_receipt_sha256_t=replica_sha256_t,
        layer_count_t=torch.tensor(
            catalog_topology.layer_count,
            dtype=torch.long,
        ),
        family_root_count_t=torch.tensor(
            catalog_topology.family_root_count,
            dtype=torch.long,
        ),
        page_count_t=torch.tensor(
            len(catalog_topology.page_ids),
            dtype=torch.long,
        ),
        physical_graph_layer_count_t=(
            torch.tensor(
                len(sparse_graph_layer_authority[0]),
                dtype=torch.long,
            )
            if sparse_graph_layer_authority is not None
            else None
        ),
        federated_growth_demand_authority_sha256_t=(
            digest_tensor(
                str(federated_growth_demand_authority["authoritySha256"])
            )
            if federated_growth_demand_authority is not None
            else None
        ),
    )


def rebind_graph_authority_generation_boundary(
    *,
    source_authority: NoNEGraphAuthorityBinding,
    target_generation: NoNEGenerationBinding,
    output_external_state_path: Path,
) -> NoNEGraphAuthorityBinding:
    """Bind an unchanged executable graph to one direct page-generation child.

    A training-branch union changes immutable external page objects without
    changing the dense checkpoint, optimizer, composition, or topology.  The
    checkpoint sidecar still must name the newly staged page generation before
    that generation can become executable pointer authority.  This external
    I/O boundary copies the already-verified envelope, advances only its exact
    generation binding, and independently rebuilds the complete graph packet.
    """

    source_external_path = Path(
        source_authority.external_state_path
    ).expanduser().resolve()
    output_path = output_external_state_path.expanduser().resolve()
    source_external_sha256 = _tensor_digest_hex(
        source_authority.external_state_sha256_t
    )
    if (
        not source_external_path.is_file()
        or output_path == source_external_path
        or _file_sha256(
            source_external_path,
            expected_sha256=source_external_sha256,
        )
        != source_external_sha256
    ):
        raise RuntimeError("NoNE graph generation rebind source differs")
    source_envelope = _read_json(source_external_path)
    source_external_state = source_envelope.get("externalState")
    source_generation_record = (
        source_external_state.get("generationBinding")
        if isinstance(source_external_state, dict)
        else None
    )
    source_generation = (
        generation_binding_from_record_boundary(source_generation_record)
        if isinstance(source_generation_record, Mapping)
        else None
    )
    if (
        source_envelope.get("schema")
        != "nnf.resynthesis.additive_external_checkpoint_binding.v1"
        or source_envelope.get("checkpointSha256")
        != _tensor_digest_hex(source_authority.checkpoint_sha256_t)
        or source_envelope.get("optimizerSha256")
        != _tensor_digest_hex(source_authority.optimizer_sha256_t)
        or not isinstance(source_external_state, dict)
        or source_generation is None
        or not torch.equal(
            source_generation.session_id_t,
            target_generation.session_id_t,
        )
        or not torch.equal(
            source_generation.generation_t.reshape(()),
            target_generation.parent_generation_t.reshape(()),
        )
        or int(target_generation.generation_t)
        != int(source_generation.generation_t) + 1
    ):
        raise RuntimeError("NoNE graph generation rebind lineage differs")
    target_external_state = dict(source_external_state)
    target_external_state["generationBinding"] = (
        target_generation.external_record_boundary()
    )
    target_external_state["graphAuthorityGenerationRebind"] = {
        "schema": "nnf.resynthesis.graph_authority_generation_rebind.v1",
        "sourceGeneration": int(source_generation.generation_t),
        "sourceManifestPayloadSha256": _tensor_digest_hex(
            source_generation.manifest_payload_sha256_t
        ),
        "targetGeneration": int(target_generation.generation_t),
        "targetManifestPayloadSha256": _tensor_digest_hex(
            target_generation.manifest_payload_sha256_t
        ),
        "checkpointAndOptimizerUnchanged": True,
    }
    target_envelope = {
        "schema": source_envelope["schema"],
        "checkpointSha256": source_envelope["checkpointSha256"],
        "optimizerSha256": source_envelope["optimizerSha256"],
        "externalState": target_external_state,
    }
    if output_path.is_file():
        if _read_json(output_path) != target_envelope:
            raise RuntimeError("NoNE graph generation rebind output differs")
    else:
        _atomic_json(output_path, target_envelope)
    rebound = build_graph_authority_binding_boundary(
        generation_binding=target_generation,
        checkpoint_path=Path(source_authority.checkpoint_path),
        optimizer_path=Path(source_authority.optimizer_path),
        external_state_path=output_path,
        composition_path=Path(source_authority.composition_path),
        migration_receipt_path=Path(source_authority.migration_receipt_path),
        replica_receipt_path=(
            Path(source_authority.replica_receipt_path)
            if source_authority.replica_receipt_path is not None
            else None
        ),
    )
    source_record = source_authority.external_record_boundary()
    rebound_record = rebound.external_record_boundary()
    for artifact_name in (
        "checkpoint",
        "optimizer",
        "composition",
        "pageCatalog",
        "residentRuntime",
        "replicaReceipt",
        "topology",
    ):
        if rebound_record.get(artifact_name) != source_record.get(artifact_name):
            raise RuntimeError(
                "NoNE graph generation rebind changed executable authority"
            )
    if rebound_record.get("migrationReceiptPath") != source_record.get(
        "migrationReceiptPath"
    ):
        raise RuntimeError(
            "NoNE graph generation rebind changed migration authority"
        )
    return rebound


def _stable_cpu_tensor(tensor: torch.Tensor) -> torch.Tensor:
    detached = tensor.detach()
    if detached.device.type != "cpu":
        detached = detached.to(device="cpu", copy=True)
    if not detached.is_contiguous():
        detached = detached.contiguous()
    expected_bytes = detached.numel() * detached.element_size()
    if (
        detached.storage_offset() != 0
        or detached.untyped_storage().nbytes() != expected_bytes
    ):
        detached = detached.clone()
    return detached


def _scaled_float8_storage_pair(
    tensor: torch.Tensor,
) -> tuple[torch.Tensor, torch.Tensor]:
    """Quantize one transfer tensor with an explicit tensor-owned scale."""

    source_t = _stable_cpu_tensor(tensor).float()
    maximum_t = source_t.new_tensor(
        torch.finfo(torch.float8_e4m3fn).max
    )
    scale_t = (
        source_t.abs().amax().div(maximum_t).clamp_min(
            torch.finfo(torch.float32).tiny
        )
    )
    quantized_t = (
        source_t.div(scale_t)
        .clamp(min=-maximum_t, max=maximum_t)
        .to(dtype=torch.float8_e4m3fn)
        .contiguous()
    )
    return quantized_t, scale_t.reshape(1).contiguous()


def _storage_dtype_code(dtype: torch.dtype) -> int:
    codes = {
        torch.float32: 0,
        torch.bfloat16: 1,
        torch.float16: 2,
        torch.float64: 3,
    }
    if dtype not in codes:
        raise ValueError(f"unsupported NoNE transfer storage dtype: {dtype}")
    return codes[dtype]


def _storage_dtype_from_code(code: int) -> torch.dtype:
    dtypes = {
        0: torch.float32,
        1: torch.bfloat16,
        2: torch.float16,
        3: torch.float64,
    }
    if code not in dtypes:
        raise RuntimeError("scaled-float8 NoNE page dtype is malformed")
    return dtypes[code]


def _pack_exact_delta_mask_boundary(mask_t: torch.Tensor) -> torch.Tensor:
    """Pack one flat CPU change mask into canonical little-endian bytes."""

    flat_t = mask_t.detach().cpu().bool().reshape(-1)
    packed_width = (flat_t.numel() + 7) // 8
    padded_t = torch.zeros(packed_width * 8, dtype=torch.uint8)
    padded_t[: flat_t.numel()].copy_(flat_t.to(dtype=torch.uint8))
    bit_weight_t = torch.tensor(
        [1, 2, 4, 8, 16, 32, 64, 128],
        dtype=torch.long,
    )
    return (
        padded_t.reshape(-1, 8)
        .long()
        .mul(bit_weight_t.reshape(1, 8))
        .sum(dim=1)
        .to(dtype=torch.uint8)
        .contiguous()
    )


def _unpack_exact_delta_mask_boundary(
    packed_t: torch.Tensor,
    *,
    element_count: int,
) -> torch.Tensor:
    """Decode and validate one canonical little-endian change mask."""

    if element_count < 1:
        raise RuntimeError("base-bound delta tensor geometry is malformed")
    if packed_t.dtype != torch.uint8 or packed_t.ndim != 1:
        raise RuntimeError("base-bound delta mask dtype differs")
    packed = packed_t.detach().cpu()
    expected_bytes = (element_count + 7) // 8
    if packed.numel() != expected_bytes:
        raise RuntimeError("base-bound delta mask geometry differs")
    bit_shift_t = torch.arange(8, dtype=torch.uint8)
    unpacked_t = torch.bitwise_and(
        torch.bitwise_right_shift(
            packed.unsqueeze(1),
            bit_shift_t.unsqueeze(0),
        ),
        torch.ones((), dtype=torch.uint8),
    ).reshape(-1)
    if (
        unpacked_t.numel() > element_count
        and unpacked_t[element_count:].count_nonzero().ne(0)
    ):
        raise RuntimeError("base-bound delta mask padding is noncanonical")
    return unpacked_t[:element_count].bool()


def _validate_base_bound_exact_delta_schema_boundary(
    handle: Any,
    *,
    expected_page_id: int,
) -> torch.dtype:
    """Validate the canonical rev6 tensor schema before granting authority."""

    fixed_keys = {
        "format_revision_t",
        "page_ids_t",
        "base_object_sha256_t",
        "base_object_bytes_t",
        "base_generation_t",
        "base_manifest_payload_sha256_t",
        "delta_storage_dtype_t",
        "optimizer_width_t",
        "step_t",
    }
    keys = set(handle.keys())
    if not fixed_keys.issubset(keys):
        raise RuntimeError("base-bound delta authority is incomplete")

    long_scalar_names = (
        "format_revision_t",
        "base_object_bytes_t",
        "base_generation_t",
        "delta_storage_dtype_t",
        "optimizer_width_t",
        "step_t",
    )
    long_scalars = {
        name: handle.get_tensor(name)
        for name in long_scalar_names
    }
    if any(
        tensor.dtype != torch.long or tensor.shape != (1,)
        for tensor in long_scalars.values()
    ):
        raise RuntimeError("base-bound delta scalar tensor schema differs")
    if (
        int(long_scalars["format_revision_t"][0])
        != BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
        or int(long_scalars["base_object_bytes_t"][0]) < 1
        or int(long_scalars["base_generation_t"][0]) < 1
        or int(long_scalars["optimizer_width_t"][0]) < 1
        or not long_scalars["step_t"].gt(0).all()
    ):
        raise RuntimeError("base-bound delta scalar identity is malformed")

    page_ids_t = handle.get_tensor("page_ids_t")
    if (
        page_ids_t.dtype != torch.long
        or page_ids_t.shape != (1,)
        or int(page_ids_t[0]) != expected_page_id
    ):
        raise RuntimeError("base-bound delta page identity is malformed")
    for name in (
        "base_object_sha256_t",
        "base_manifest_payload_sha256_t",
    ):
        digest_t = handle.get_tensor(name)
        if digest_t.dtype != torch.uint8 or digest_t.shape != (32,):
            raise RuntimeError("base-bound delta digest tensor schema differs")

    storage_dtype = _storage_dtype_from_code(
        int(long_scalars["delta_storage_dtype_t"][0])
    )
    recognized_keys = set(fixed_keys)
    changed_total = 0
    for name in _PAGE_WEIGHT_TENSOR_NAMES:
        values_name = f"{name}_delta_values_t"
        indices_name = f"{name}_delta_indices_t"
        mask_name = f"{name}_delta_mask_t"
        present = {
            key
            for key in (values_name, indices_name, mask_name)
            if key in keys
        }
        if not present:
            continue
        if values_name not in present or len(present) != 2:
            raise RuntimeError("base-bound delta encoding mode differs")
        mode_names = present - {values_name}
        if mode_names not in ({indices_name}, {mask_name}):
            raise RuntimeError("base-bound delta encoding mode differs")

        values_t = handle.get_tensor(values_name)
        if (
            values_t.dtype != storage_dtype
            or values_t.ndim != 1
            or values_t.numel() < 1
            or not torch.isfinite(values_t).all()
        ):
            raise RuntimeError("base-bound delta values are malformed")
        changed_total += int(values_t.numel())
        recognized_keys.update(present)

        if indices_name in present:
            indices_t = handle.get_tensor(indices_name)
            if (
                indices_t.dtype != torch.int32
                or indices_t.ndim != 1
                or indices_t.numel() != values_t.numel()
                or indices_t.lt(0).any()
                or (
                    indices_t.numel() > 1
                    and indices_t[1:].le(indices_t[:-1]).any()
                )
            ):
                raise RuntimeError("base-bound sparse delta indices differ")
        else:
            mask_t = handle.get_tensor(mask_name)
            if (
                mask_t.dtype != torch.uint8
                or mask_t.ndim != 1
                or mask_t.numel() < 1
            ):
                raise RuntimeError("base-bound delta mask dtype differs")

    if changed_total < 1:
        raise RuntimeError("base-bound delta contains no parameter change")
    if keys != recognized_keys:
        raise RuntimeError("base-bound delta tensor key set differs")
    return storage_dtype


def _validate_self_contained_stateless_exact_schema_boundary(
    handle: Any,
    *,
    expected_page_id: int,
) -> torch.dtype:
    """Validate one dependency-free exact trained-page object header."""

    fixed_keys = {
        "format_revision_t",
        "page_ids_t",
        "optimizer_width_t",
        "step_t",
        *_PAGE_WEIGHT_TENSOR_NAMES,
    }
    keys = set(handle.keys())
    if keys != fixed_keys:
        raise RuntimeError(
            "self-contained exact page tensor key set differs"
        )
    format_revision_t = (
        handle.get_tensor("format_revision_t").reshape(-1)
    )
    page_ids_t = handle.get_tensor("page_ids_t").reshape(-1)
    optimizer_width_t = (
        handle.get_tensor("optimizer_width_t").reshape(-1)
    )
    step_t = handle.get_tensor("step_t").reshape(-1)
    if (
        format_revision_t.dtype != torch.long
        or format_revision_t.shape != (1,)
        or int(format_revision_t[0])
        != SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION
        or page_ids_t.dtype != torch.long
        or page_ids_t.shape != (1,)
        or int(page_ids_t[0]) != expected_page_id
        or optimizer_width_t.dtype != torch.long
        or optimizer_width_t.shape != (1,)
        or int(optimizer_width_t[0]) < 1
        or step_t.dtype != torch.long
        or step_t.shape != (1,)
        or not step_t.gt(0).all()
    ):
        raise RuntimeError(
            "self-contained exact page scalar authority differs"
        )
    weight_tensors: tuple[torch.Tensor, ...] = tuple(
        cast(torch.Tensor, handle.get_tensor(name))
        for name in _PAGE_WEIGHT_TENSOR_NAMES
    )
    storage_dtype: torch.dtype = weight_tensors[0].dtype
    _storage_dtype_code(storage_dtype)
    if any(
        tensor.dtype != storage_dtype
        or tensor.ndim < 2
        or tensor.shape[0] != 1
        for tensor in weight_tensors
    ):
        raise RuntimeError(
            "self-contained exact page weight geometry differs"
        )
    return storage_dtype


def _apply_exact_page_weight_delta_in_place_boundary(
    handle: Any,
    *,
    target_t: torch.Tensor,
    name: str,
    validated_schema_proof: _NoNEValidatedPageObjectSchemaProof | None = None,
) -> None:
    """Apply one validated replacement patch to private CPU storage."""

    keys = set(handle.keys())
    indices_name = f"{name}_delta_indices_t"
    mask_name = f"{name}_delta_mask_t"
    values_name = f"{name}_delta_values_t"
    present_modes = int(indices_name in keys) + int(mask_name in keys)
    if values_name not in keys:
        if present_modes:
            raise RuntimeError("base-bound delta values are absent")
        return
    if present_modes != 1:
        raise RuntimeError("base-bound delta encoding mode differs")
    if target_t.device.type != "cpu" or not target_t.is_contiguous():
        raise RuntimeError("base-bound delta target storage differs")
    values_t = handle.get_tensor(values_name).detach().cpu().reshape(-1)
    flat_t = target_t.reshape(-1)
    if (
        values_t.dtype != flat_t.dtype
        or values_t.numel() < 1
    ):
        raise RuntimeError("base-bound delta value dtype differs")
    if validated_schema_proof is None:
        if not torch.isfinite(values_t).all():
            raise RuntimeError("base-bound delta value dtype differs")
    elif (
        validated_schema_proof.format_revision
        != BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
        or validated_schema_proof.delta_dependency is None
        or validated_schema_proof.delta_storage_dtype != values_t.dtype
    ):
        raise RuntimeError("base-bound delta schema proof differs")
    if indices_name in keys:
        raw_indices_t = handle.get_tensor(indices_name)
        if raw_indices_t.dtype != torch.int32 or raw_indices_t.ndim != 1:
            raise RuntimeError("base-bound sparse delta indices differ")
        indices_t = raw_indices_t.detach().cpu().long()
        if (
            indices_t.numel() < 1
            or indices_t.numel() != values_t.numel()
            or indices_t.lt(0).any()
            or indices_t.ge(flat_t.numel()).any()
            or (
                indices_t.numel() > 1
                and indices_t[1:].le(indices_t[:-1]).any()
            )
        ):
            raise RuntimeError("base-bound sparse delta indices differ")
        if flat_t.index_select(0, indices_t).eq(values_t).any():
            raise RuntimeError("base-bound delta contains a redundant replacement")
        flat_t.index_copy_(0, indices_t, values_t)
    else:
        mask_t = _unpack_exact_delta_mask_boundary(
            handle.get_tensor(mask_name),
            element_count=flat_t.numel(),
        )
        if mask_t.count_nonzero().ne(values_t.numel()):
            raise RuntimeError("base-bound masked delta values differ")
        if flat_t[mask_t].eq(values_t).any():
            raise RuntimeError("base-bound delta contains a redundant replacement")
        flat_t[mask_t] = values_t


def _apply_exact_page_weight_delta_boundary(
    handle: Any,
    *,
    base_t: torch.Tensor,
    name: str,
) -> torch.Tensor:
    """Apply one exact replacement patch to a signed-parent tensor."""

    # A cached immutable parent may outlive this reconstruction.  Every child
    # therefore starts from private contiguous storage even when this tensor
    # has no replacement row in the delta object.
    target_t = base_t.detach().cpu().contiguous().clone()
    _apply_exact_page_weight_delta_in_place_boundary(
        handle,
        target_t=target_t,
        name=name,
    )
    return target_t


def load_page_weight_from_handle_boundary(
    handle: Any,
    name: str,
) -> torch.Tensor:
    """Read a full-precision or scaled-float8 page weight at I/O."""

    tensor_t = handle.get_tensor(name)
    if not isinstance(tensor_t, torch.Tensor):
        raise RuntimeError("NoNE page weight is not tensor-owned")
    scale_name = f"{name}_scale_t"
    keys = set(handle.keys())
    if scale_name not in keys:
        return tensor_t
    dtype_name = f"{name}_dtype_t"
    if dtype_name not in keys:
        raise RuntimeError("scaled-float8 NoNE page dtype is absent")
    scale_t = handle.get_tensor(scale_name)
    dtype_t = handle.get_tensor(dtype_name)
    if not isinstance(scale_t, torch.Tensor) or not isinstance(
        dtype_t,
        torch.Tensor,
    ):
        raise RuntimeError("scaled-float8 NoNE page metadata is not tensor-owned")
    scale_t = scale_t.reshape(-1).float()
    dtype_t = dtype_t.reshape(-1).long()
    if (
        scale_t.numel() != 1
        or not torch.isfinite(scale_t).all()
        or not scale_t.gt(0).all()
    ):
        raise RuntimeError("scaled-float8 NoNE page scale is malformed")
    if dtype_t.numel() != 1:
        raise RuntimeError("scaled-float8 NoNE page dtype is malformed")
    storage_dtype = _storage_dtype_from_code(int(dtype_t[0]))
    if storage_dtype == torch.bfloat16:
        return tensor_t.to(dtype=storage_dtype).mul(scale_t.reshape(()))
    return tensor_t.float().mul(scale_t.reshape(())).to(dtype=storage_dtype)


def compact_transfer_page_bundle_boundary(
    bundle: NoNEPageBundle,
) -> NoNEPageBundle:
    """Return the exact dequantized surface persisted for an untrained page."""

    # Geometry is still checked synchronously, while finite-value admission is
    # carried by the tensor-native ``finite_t`` packet below.  Avoid forcing a
    # host scalar read for every compact/stateless page during the hot update
    # path; the caller's durable writer consumes that mask before publication.
    validate_page_bundle(bundle, synchronize_tensor_values=False)
    if bundle.weights.page_ids_t.numel() != 1:
        raise ValueError("compact transfer storage requires exactly one page")
    compact_weights: dict[str, torch.Tensor] = {}
    for name in _PAGE_WEIGHT_TENSOR_NAMES:
        source_t = getattr(bundle.weights, name)
        quantized_t, scale_t = _scaled_float8_storage_pair(source_t)
        compact_weights[name] = quantized_t.float().mul(
            scale_t.reshape(())
        ).to(dtype=source_t.dtype)
    weights = NoNEPageWeights(
        page_ids_t=bundle.weights.page_ids_t.detach().cpu().long().clone(),
        **compact_weights,
    )
    flat_width = _flat_parameter_width(weights)
    compact = NoNEPageBundle(
        weights=weights,
        optimizer_mean_t=_implicit_zero_optimizer_matrix_boundary(
            page_count=1,
            flat_width=flat_width,
            device=torch.device("cpu"),
        ),
        optimizer_square_t=_implicit_zero_optimizer_matrix_boundary(
            page_count=1,
            flat_width=flat_width,
            device=torch.device("cpu"),
        ),
        step_t=torch.zeros(1, dtype=torch.long),
    )
    validate_page_bundle(compact)
    return compact


def _flat_parameter_width(weights: NoNEPageWeights) -> int:
    page_count = int(weights.page_ids_t.shape[0])
    if page_count < 1:
        raise ValueError("page bundle must contain at least one page")
    tensors = (
        weights.gate_t,
        weights.up_t,
        weights.down_t,
        weights.glyph_down_t,
        weights.glyph_up_t,
        weights.translation_gate_t,
        weights.outcome_memory_t,
        weights.repair_memory_t,
        weights.transfer_memory_t,
    )
    return sum(int(tensor[0].numel()) for tensor in tensors)


def _page_weights_template_key(weights: NoNEPageWeights) -> str:
    """Derive a deterministic content key for one page's invariant weights.

    The compact transfer template quantizes a page's invariant weights once and
    reuses the result for repeated staging, so the cache key must be a pure
    function of those weight values: identical weights reuse the same template.
    Hash the flattened fp32 CPU bytes of every page-weight tensor — the same
    ``_PAGE_WEIGHT_TENSOR_NAMES`` set the compact payload serializes — giving a
    stable identity without depending on any single non-existent attribute.
    """

    pieces = [
        getattr(weights, name)
        .detach()
        .to(device="cpu", dtype=torch.float32)
        .contiguous()
        .reshape(-1)
        for name in _PAGE_WEIGHT_TENSOR_NAMES
    ]
    flat = torch.cat(pieces) if len(pieces) > 1 else pieces[0]
    return hashlib.sha256(flat.numpy().tobytes()).hexdigest()


def page_model_parameter_elements(
    *,
    hidden_size: int,
    expert_hidden_size: int,
    glyph_size: int,
    router_size: int,
) -> int:
    """Return model-weight elements in one physical page, excluding moments."""

    if min(hidden_size, expert_hidden_size, glyph_size, router_size) < 1:
        raise ValueError("NoNE page model geometry must be positive")
    return (
        3 * hidden_size * expert_hidden_size
        + 2 * hidden_size * glyph_size
        + 1
        + 3 * router_size
    )


def validate_page_weights(
    weights: NoNEPageWeights,
    *,
    synchronize_tensor_values: bool = True,
) -> None:
    """Validate model-weight geometry without materializing optimizer moments."""

    page_ids_t = weights.page_ids_t.reshape(-1)
    page_count = int(page_ids_t.shape[0])
    if page_count < 1 or page_ids_t.dtype != torch.long:
        raise ValueError("page IDs must be a nonempty long tensor")
    if page_count > 1:
        ordered_page_ids_t = torch.sort(page_ids_t).values
        duplicate_page_id_t = ordered_page_ids_t[1:].eq(
            ordered_page_ids_t[:-1]
        ).any()
        if page_ids_t.is_cuda:
            torch._assert_async(
                ~duplicate_page_id_t,
                "page generation contains duplicate page IDs",
            )
        elif bool(duplicate_page_id_t):
            raise ValueError("page generation contains duplicate page IDs")
    if any(
        tensor.shape[0] != page_count
        for tensor in (
            weights.gate_t,
            weights.up_t,
            weights.down_t,
            weights.glyph_down_t,
            weights.glyph_up_t,
            weights.translation_gate_t,
            weights.outcome_memory_t,
            weights.repair_memory_t,
            weights.transfer_memory_t,
        )
    ):
        raise ValueError("page-major tensor counts differ")
    if weights.gate_t.shape != weights.up_t.shape:
        raise ValueError("gate and up projection geometry differs")
    if weights.ffn_mode_t.shape != (page_count, 1):
        raise ValueError("page FFN mode geometry differs")
    if weights.gate_t.ndim != 3 or weights.down_t.ndim != 3:
        raise ValueError("native FFN page weights must be rank three")
    if (
        weights.gate_t.shape[1] != weights.down_t.shape[2]
        or weights.gate_t.shape[2] != weights.down_t.shape[1]
    ):
        raise ValueError("native FFN page projection geometry is incompatible")
    hidden_size = weights.gate_t.shape[1]
    if (
        weights.glyph_down_t.ndim != 3
        or weights.glyph_up_t.ndim != 3
        or weights.glyph_down_t.shape[1] != hidden_size
        or weights.glyph_down_t.shape[2] != weights.glyph_up_t.shape[1]
        or weights.glyph_up_t.shape[2] != hidden_size
    ):
        raise ValueError("page VGE translation geometry is incompatible")
    if weights.translation_gate_t.shape != (page_count, 1):
        raise ValueError("page translation gate geometry differs")
    memory_shape = weights.outcome_memory_t.shape
    if (
        len(memory_shape) != 2
        or weights.repair_memory_t.shape != memory_shape
        or weights.transfer_memory_t.shape != memory_shape
    ):
        raise ValueError("page outcome/repair/transfer memory geometry differs")
    if synchronize_tensor_values:
        for tensor in (
            weights.ffn_mode_t,
            weights.gate_t,
            weights.up_t,
            weights.down_t,
            weights.glyph_down_t,
            weights.glyph_up_t,
            weights.translation_gate_t,
            weights.outcome_memory_t,
            weights.repair_memory_t,
            weights.transfer_memory_t,
        ):
            if tensor.requires_grad and not torch.isfinite(tensor).all():
                raise ValueError("page bundle contains nonfinite tensors")
        if torch.any(weights.ffn_mode_t < 0) or torch.any(weights.ffn_mode_t > 1):
            raise ValueError("page FFN mode must be within the unit interval")


def validate_page_bundle(
    bundle: NoNEPageBundle,
    *,
    synchronize_tensor_values: bool = True,
) -> None:
    weights = bundle.weights
    validate_page_weights(
        weights,
        synchronize_tensor_values=synchronize_tensor_values,
    )
    page_count = int(weights.page_ids_t.reshape(-1).shape[0])
    flat_width = _flat_parameter_width(weights)
    if bundle.optimizer_mean_t.shape != (page_count, flat_width):
        raise ValueError("page optimizer mean geometry differs")
    if bundle.optimizer_square_t.shape != (page_count, flat_width):
        raise ValueError("page optimizer square geometry differs")
    if bundle.step_t.shape != (page_count,):
        raise ValueError("page optimizer step geometry differs")
    if synchronize_tensor_values:
        for tensor in (bundle.optimizer_mean_t, bundle.optimizer_square_t):
            finite_probe_t = (
                tensor[:, :1]
                if tensor.ndim == 2 and tensor.stride(1) == 0
                else tensor
            )
            if not torch.isfinite(finite_probe_t).all():
                raise ValueError("page bundle contains nonfinite tensors")


def _implicit_zero_optimizer_matrix_boundary(
    *,
    page_count: int,
    flat_width: int,
    device: torch.device,
) -> torch.Tensor:
    """Represent untouched Adam moments without allocating the dense matrix."""

    if page_count < 1 or flat_width < 1:
        raise ValueError("implicit optimizer geometry must be positive")
    return torch.zeros(
        page_count,
        1,
        device=device,
        dtype=torch.float32,
    ).expand(page_count, flat_width)


def _optimizer_state_is_implicit_zero_boundary(bundle: NoNEPageBundle) -> bool:
    """Identify compact page-local optimizer state at the storage boundary."""

    mean_t = bundle.optimizer_mean_t
    square_t = bundle.optimizer_square_t
    if mean_t.ndim != 2 or square_t.ndim != 2:
        return False
    if mean_t.stride(1) != 0 or square_t.stride(1) != 0:
        return False
    return bool(
        torch.count_nonzero(mean_t[:, :1]).eq(0)
        & torch.count_nonzero(square_t[:, :1]).eq(0)
    )


def _optimizer_state_has_implicit_zero_layout_boundary(
    bundle: NoNEPageBundle,
) -> bool:
    """Recognize compact moments without synchronizing their tensor values."""

    mean_t = bundle.optimizer_mean_t
    square_t = bundle.optimizer_square_t
    return (
        mean_t.ndim == 2
        and square_t.ndim == 2
        and mean_t.stride(1) == 0
        and square_t.stride(1) == 0
    )


def _optimizer_state_consumer_device_boundary(
    bundle: NoNEPageBundle,
    *,
    device: torch.device,
) -> torch.device:
    """Keep explicit durable moments on CPU across execution residency moves."""

    if _optimizer_state_has_implicit_zero_layout_boundary(bundle):
        return device
    return torch.device("cpu")


def _move_optimizer_matrix_boundary(
    tensor: torch.Tensor,
    *,
    device: torch.device,
) -> torch.Tensor:
    """Move optimizer state while retaining broadcast-backed zero moments."""

    if tensor.ndim == 2 and tensor.stride(1) == 0:
        return tensor[:, :1].detach().to(
            device=device,
            dtype=torch.float32,
        ).expand(tensor.shape)
    return tensor.detach().to(device=device, dtype=torch.float32)


def _concatenate_optimizer_matrices_boundary(
    tensors: tuple[torch.Tensor, ...],
) -> torch.Tensor:
    """Concatenate page moments without materializing broadcast-backed rows."""

    if not tensors:
        raise ValueError("optimizer matrix composition is empty")
    width = tensors[0].shape[1]
    if any(tensor.ndim != 2 or tensor.shape[1] != width for tensor in tensors):
        raise ValueError("optimizer matrix geometry differs")
    if all(tensor.stride(1) == 0 for tensor in tensors):
        scalar_rows_t = torch.cat(
            tuple(tensor[:, :1] for tensor in tensors),
            dim=0,
        )
        return scalar_rows_t.expand(scalar_rows_t.shape[0], width)
    return torch.cat(tensors, dim=0)


def _page_object_placement_payload_sha256_boundary(
    record: Mapping[str, Any],
) -> str:
    """Hash one placement record without its self-authenticating field."""

    return hashlib.sha256(
        _canonical_json_bytes(
            {
                key: value
                for key, value in record.items()
                if key != "payloadSha256"
            }
        )
    ).hexdigest()


def _page_object_placement_json_bytes_boundary(
    record: Mapping[str, Any],
) -> bytes:
    """Return deterministic immutable JSON bytes for content addressing."""

    return _canonical_json_bytes(record) + b"\n"


def _canonical_page_object_placement_directory_boundary(
    path: Path,
    *,
    label: str,
) -> Path:
    """Reject missing, symlinked, relative, or aliased placement roots."""

    expanded = path.expanduser()
    if not expanded.is_absolute() or expanded.is_symlink():
        raise RuntimeError(f"NoNE {label} is not canonical")
    resolved = expanded.resolve()
    if resolved != expanded or not resolved.is_dir():
        raise RuntimeError(f"NoNE {label} is not canonical")
    identity = resolved.lstat()
    if stat.S_ISLNK(identity.st_mode) or not stat.S_ISDIR(identity.st_mode):
        raise RuntimeError(f"NoNE {label} is not canonical")
    return resolved


def _page_object_placement_directory_identity_boundary(
    path: Path,
) -> tuple[int, int]:
    """Return the stable filesystem/inode identity of one canonical root."""

    identity = path.stat()
    if not stat.S_ISDIR(identity.st_mode):
        raise RuntimeError("NoNE page-object placement directory is incomplete")
    return int(identity.st_dev), int(identity.st_ino)


def _page_object_placement_identity_record_boundary(
    identity: tuple[int, int],
) -> dict[str, int]:
    return {
        "device": identity[0],
        "inode": identity[1],
    }


def _page_object_placement_identity_from_record_boundary(
    value: object,
) -> tuple[int, int] | None:
    if not isinstance(value, dict):
        return None
    device = value.get("device")
    inode = value.get("inode")
    if (
        not isinstance(device, int)
        or isinstance(device, bool)
        or device < 0
        or not isinstance(inode, int)
        or isinstance(inode, bool)
        or inode < 1
    ):
        return None
    return device, inode


def _page_object_write_placement_pointer_path_boundary(
    store_root: Path,
) -> Path:
    return store_root / "page_object_write_placement.json"


def _accepted_authority_history_path_boundary(
    session_root: Path,
    pointer_record: Mapping[str, Any],
) -> Path:
    """Return one immutable accepted-pointer history path.

    Graph and page-object placement authorities may be attached to an already
    accepted generation without changing its model payload.  Include both
    authority identities in the history key so those additive transitions
    never overwrite the prior immutable record.
    """

    generation = pointer_record.get("generation")
    payload_sha256 = pointer_record.get("manifestPayloadSha256")
    graph_payload_sha256 = pointer_record.get("graphAuthorityPayloadSha256")
    placement_authority_sha256 = pointer_record.get(
        "pageObjectWritePlacementAuthoritySha256"
    )
    placement_proof_sha256 = pointer_record.get(
        "pageObjectWritePlacementProofSha256"
    )
    if (
        not isinstance(generation, int)
        or isinstance(generation, bool)
        or generation < 1
        or not _valid_sha256_boundary(payload_sha256)
        or (
            graph_payload_sha256 is not None
            and not _valid_sha256_boundary(graph_payload_sha256)
        )
        or (placement_authority_sha256 is None)
        != (placement_proof_sha256 is None)
        or (
            placement_authority_sha256 is not None
            and (
                not _valid_sha256_boundary(placement_authority_sha256)
                or not _valid_sha256_boundary(placement_proof_sha256)
            )
        )
    ):
        raise RuntimeError("NoNE accepted authority history is malformed")
    suffixes = tuple(
        value
        for value in (
            graph_payload_sha256,
            placement_authority_sha256,
        )
        if isinstance(value, str)
    )
    suffix = "".join(f"_{value}" for value in suffixes)
    return (
        session_root
        / "accepted_authorities"
        / f"generation_{generation:08d}_{payload_sha256}{suffix}.json"
    )


def _load_page_object_write_placement_authority_boundary(
    store_root: Path,
    *,
    validate_fanout: bool,
    expected_proof_sha256: str | None = None,
) -> _NoNEPageObjectWritePlacementAuthority | None:
    """Load one persisted placement and fail closed on any partial authority."""

    resolved_store = _canonical_page_object_placement_directory_boundary(
        store_root,
        label="page-object placement store root",
    )
    pointer_path = _page_object_write_placement_pointer_path_boundary(
        resolved_store
    )
    if not pointer_path.exists():
        return None
    if pointer_path.is_symlink() or not pointer_path.is_file():
        raise RuntimeError("NoNE page-object placement pointer is incomplete")
    pointer = _read_json(pointer_path)
    authority_relative = pointer.get("authorityRelativePath")
    authority_sha256 = pointer.get("authoritySha256")
    proof_relative = pointer.get("placementProofRelativePath")
    proof_sha256 = pointer.get("placementProofSha256")
    if (
        pointer.get("schema") != PAGE_OBJECT_WRITE_PLACEMENT_POINTER_SCHEMA
        or pointer.get("storeRoot") != str(resolved_store)
        or not isinstance(authority_relative, str)
        or not authority_relative
        or not _valid_sha256_boundary(authority_sha256)
        or not isinstance(proof_relative, str)
        or not proof_relative
        or not _valid_sha256_boundary(proof_sha256)
        or pointer.get("payloadSha256")
        != _page_object_placement_payload_sha256_boundary(pointer)
        or (
            expected_proof_sha256 is not None
            and proof_sha256 != expected_proof_sha256
        )
    ):
        raise RuntimeError("NoNE page-object placement pointer differs")
    authority_path = (resolved_store / authority_relative).resolve()
    proof_path = (resolved_store / proof_relative).resolve()
    if (
        not authority_path.is_relative_to(resolved_store)
        or not proof_path.is_relative_to(resolved_store)
        or authority_path.is_symlink()
        or proof_path.is_symlink()
        or not authority_path.is_file()
        or not proof_path.is_file()
        or _file_sha256(authority_path) != authority_sha256
        or _file_sha256(proof_path) != proof_sha256
    ):
        raise RuntimeError("NoNE page-object placement authority is incomplete")
    authority = _read_json(authority_path)
    proof = _read_json(proof_path)
    if (
        authority.get("schema")
        != PAGE_OBJECT_WRITE_PLACEMENT_AUTHORITY_SCHEMA
        or authority.get("payloadSha256")
        != _page_object_placement_payload_sha256_boundary(authority)
        or authority.get("storeRoot") != str(resolved_store)
        or authority.get("placementProofSha256") != proof_sha256
        or authority.get("placementProofRelativePath") != proof_relative
        or authority.get("authoritySha256") not in (None, authority_sha256)
        or proof.get("schema")
        != PAGE_OBJECT_WRITE_PLACEMENT_PROOF_SCHEMA
        or proof.get("payloadSha256")
        != _page_object_placement_payload_sha256_boundary(proof)
        or proof.get("placementCount") != 4
        or proof.get("localStoreCount") != 1
        or proof.get("externalRootCount") != 3
        or proof.get("uniqueWriteDeviceCount") != 4
    ):
        raise RuntimeError("NoNE page-object placement authority differs")
    rows = proof.get("placements")
    if not isinstance(rows, list) or len(rows) != 4:
        raise RuntimeError("NoNE page-object placement proof is incomplete")
    matching_rows = [
        row
        for row in rows
        if isinstance(row, dict)
        and row.get("storeRoot") == str(resolved_store)
        and row.get("branchScopeSha256")
        == authority.get("branchScopeSha256")
    ]
    if len(matching_rows) != 1:
        raise RuntimeError("NoNE page-object placement branch identity differs")
    row = matching_rows[0]
    session_key = authority.get("sessionKey")
    branch_scope_sha256 = authority.get("branchScopeSha256")
    branch_scope_record = authority.get("branchScope")
    try:
        branch_scope = training_branch_scope_from_record_boundary(
            branch_scope_record
        )
    except (RuntimeError, TypeError, ValueError) as error:
        raise RuntimeError(
            "NoNE page-object placement branch scope differs"
        ) from error
    write_root_value = authority.get("writeRoot")
    placement_kind = authority.get("placementKind")
    objects_relative = authority.get("objectsRelativePath")
    scratch_relative = authority.get("scratchRelativePath")
    store_identity = _page_object_placement_identity_from_record_boundary(
        authority.get("storeRootIdentity")
    )
    write_identity = _page_object_placement_identity_from_record_boundary(
        authority.get("writeRootIdentity")
    )
    objects_identity = _page_object_placement_identity_from_record_boundary(
        authority.get("objectsRootIdentity")
    )
    scratch_identity = _page_object_placement_identity_from_record_boundary(
        authority.get("scratchRootIdentity")
    )
    if (
        not isinstance(session_key, str)
        or len(session_key) != 64
        or not _valid_sha256_boundary(branch_scope_sha256)
        or branch_scope_record != branch_scope.external_record_boundary()
        or _tensor_digest_hex(branch_scope.scope_sha256_t)
        != branch_scope_sha256
        or _session_key(branch_scope.session_id_t) != session_key
        or not isinstance(write_root_value, str)
        or placement_kind not in ("localStore", "externalRoot")
        or objects_relative != "objects/sha256"
        or scratch_relative != ".nnf-resynthesis-page-object-scratch"
        or store_identity is None
        or write_identity is None
        or objects_identity is None
        or scratch_identity is None
        or row.get("sessionKey") != session_key
        or row.get("branchScope") != branch_scope_record
        or row.get("placementKind") != placement_kind
        or row.get("writeRoot") != write_root_value
        or row.get("storeRootIdentity") != authority.get("storeRootIdentity")
        or row.get("writeRootIdentity") != authority.get("writeRootIdentity")
        or row.get("objectsRootIdentity") != authority.get(
            "objectsRootIdentity"
        )
        or row.get("scratchRootIdentity") != authority.get(
            "scratchRootIdentity"
        )
    ):
        raise RuntimeError("NoNE page-object placement geometry differs")
    write_root = _canonical_page_object_placement_directory_boundary(
        Path(write_root_value),
        label="page-object write root",
    )
    objects_root = _canonical_page_object_placement_directory_boundary(
        write_root / objects_relative,
        label="page-object write objects root",
    )
    scratch_root = _canonical_page_object_placement_directory_boundary(
        write_root / scratch_relative,
        label="page-object write scratch root",
    )
    current_store_identity = (
        _page_object_placement_directory_identity_boundary(resolved_store)
    )
    current_write_identity = (
        _page_object_placement_directory_identity_boundary(write_root)
    )
    current_objects_identity = (
        _page_object_placement_directory_identity_boundary(objects_root)
    )
    current_scratch_identity = (
        _page_object_placement_directory_identity_boundary(scratch_root)
    )
    local_store = placement_kind == "localStore"
    if (
        current_store_identity != store_identity
        or current_write_identity != write_identity
        or current_objects_identity != objects_identity
        or current_scratch_identity != scratch_identity
        or objects_identity[0] != write_identity[0]
        or scratch_identity[0] != write_identity[0]
        or (local_store and write_root != resolved_store)
        or (not local_store and write_root == resolved_store)
        or (not local_store and write_identity[0] == store_identity[0])
    ):
        raise RuntimeError("NoNE page-object placement root identity drifted")
    owner_path_value = authority.get("ownerMarkerPath")
    owner_sha256 = authority.get("ownerMarkerSha256")
    owner_path: Path | None = None
    if local_store:
        if owner_path_value is not None or owner_sha256 is not None:
            raise RuntimeError("NoNE local page-object placement has an owner marker")
    else:
        if (
            not isinstance(owner_path_value, str)
            or not _valid_sha256_boundary(owner_sha256)
        ):
            raise RuntimeError("NoNE external page-object owner is incomplete")
        owner_path = Path(owner_path_value).expanduser().resolve()
        if (
            owner_path
            != write_root / ".nnf-resynthesis-page-object-owner.json"
            or owner_path.is_symlink()
            or not owner_path.is_file()
            or _file_sha256(owner_path) != owner_sha256
        ):
            raise RuntimeError("NoNE external page-object owner differs")
        owner = _read_json(owner_path)
        if (
            owner.get("schema") != PAGE_OBJECT_WRITE_ROOT_OWNER_SCHEMA
            or owner.get("payloadSha256")
            != _page_object_placement_payload_sha256_boundary(owner)
            or owner.get("storeRoot") != str(resolved_store)
            or owner.get("writeRoot") != str(write_root)
            or owner.get("sessionKey") != session_key
            or owner.get("branchScopeSha256") != branch_scope_sha256
            or owner.get("placementProofSha256") != proof_sha256
            or owner.get("writeRootIdentity")
            != authority.get("writeRootIdentity")
        ):
            raise RuntimeError("NoNE external page-object owner identity differs")
    loaded = _NoNEPageObjectWritePlacementAuthority(
        store_root=resolved_store,
        write_root=write_root,
        objects_root=objects_root,
        scratch_root=scratch_root,
        session_key=session_key,
        branch_scope_sha256=cast(str, branch_scope_sha256),
        branch_scope=branch_scope,
        authority_path=authority_path,
        authority_sha256=cast(str, authority_sha256),
        placement_proof_path=proof_path,
        placement_proof_sha256=cast(str, proof_sha256),
        local_store=local_store,
        store_root_identity=store_identity,
        write_root_identity=write_identity,
        objects_root_identity=objects_identity,
        scratch_root_identity=scratch_identity,
        owner_marker_path=owner_path,
        owner_marker_sha256=(
            cast(str, owner_sha256) if owner_sha256 is not None else None
        ),
    )
    if validate_fanout:
        write_devices: set[int] = set()
        local_count = 0
        observed_store_roots: set[Path] = set()
        observed_scope_sha256s: set[str] = set()
        for proof_row in rows:
            if not isinstance(proof_row, dict):
                raise RuntimeError(
                    "NoNE page-object placement proof row is malformed"
                )
            peer_store_value = proof_row.get("storeRoot")
            peer_scope_sha256 = proof_row.get("branchScopeSha256")
            peer_write_identity = (
                _page_object_placement_identity_from_record_boundary(
                    proof_row.get("writeRootIdentity")
                )
            )
            peer_kind = proof_row.get("placementKind")
            if (
                not isinstance(peer_store_value, str)
                or not _valid_sha256_boundary(peer_scope_sha256)
                or peer_write_identity is None
                or peer_kind not in ("localStore", "externalRoot")
            ):
                raise RuntimeError(
                    "NoNE page-object placement proof row is malformed"
                )
            peer_store = Path(peer_store_value).expanduser().resolve()
            if (
                peer_store in observed_store_roots
                or peer_scope_sha256 in observed_scope_sha256s
            ):
                raise RuntimeError(
                    "NoNE page-object placement proof has aliases"
                )
            observed_store_roots.add(peer_store)
            observed_scope_sha256s.add(cast(str, peer_scope_sha256))
            write_devices.add(peer_write_identity[0])
            local_count += int(peer_kind == "localStore")
            peer = _load_page_object_write_placement_authority_boundary(
                peer_store,
                validate_fanout=False,
                expected_proof_sha256=cast(str, proof_sha256),
            )
            peer_accepted_path = (
                peer_store
                / "sessions"
                / (
                    peer.session_key
                    if peer is not None
                    else session_key
                )
                / "accepted.json"
            )
            peer_accepted = (
                _read_json(peer_accepted_path)
                if peer_accepted_path.is_file()
                and not peer_accepted_path.is_symlink()
                else None
            )
            if (
                peer is None
                or peer.branch_scope_sha256 != peer_scope_sha256
                or str(peer.write_root) != proof_row.get("writeRoot")
                or peer.local_store != (peer_kind == "localStore")
                or peer.write_root_identity != peer_write_identity
                or not isinstance(peer_accepted, dict)
                or peer_accepted.get(
                    "pageObjectWritePlacementAuthoritySha256"
                )
                != peer.authority_sha256
                or peer_accepted.get(
                    "pageObjectWritePlacementProofSha256"
                )
                != peer.placement_proof_sha256
                or peer_accepted_path.stat().st_dev
                != peer.store_root.stat().st_dev
            ):
                raise RuntimeError(
                    "NoNE page-object placement fanout is partial"
                )
        if (
            local_count != 1
            or len(write_devices) != 4
            or len(observed_store_roots) != 4
            or len(observed_scope_sha256s) != 4
        ):
            raise RuntimeError("NoNE page-object placement fanout differs")
    return loaded


def persist_none_page_object_write_placement_fanout_boundary(
    requests: tuple[NoNEPageObjectWritePlacementRequest, ...],
) -> NoNEPageObjectWritePlacementFanoutPacket:
    """Persist one local plus three external branch object-write placements."""

    if len(requests) != 4:
        raise ValueError("NoNE page-object placement requires four branches")
    scopes = tuple(request.branch_scope for request in requests)
    validate_common_parent_training_branch_scopes_boundary(scopes)
    prepared: list[dict[str, Any]] = []
    handles: list[BinaryIO] = []
    try:
        for request in requests:
            validate_training_branch_scope_boundary(request.branch_scope)
            local_t = request.local_store_t.detach().cpu().bool().reshape(-1)
            if local_t.numel() != 1:
                raise ValueError("NoNE page-object placement kind is malformed")
            local_store = bool(local_t[0])
            store_root = _canonical_page_object_placement_directory_boundary(
                request.store_root,
                label="page-object placement store root",
            )
            write_root = _canonical_page_object_placement_directory_boundary(
                request.write_root,
                label="page-object write root",
            )
            session_key = _session_key(request.branch_scope.session_id_t)
            session_root = store_root / "sessions" / session_key
            pointer_path = session_root / "accepted.json"
            if (
                not (store_root / "objects/sha256").is_dir()
                or not session_root.is_dir()
                or not pointer_path.is_file()
                or _page_object_write_placement_pointer_path_boundary(
                    store_root
                ).exists()
                or (
                    store_root / "page_object_write_placement_authorities"
                ).exists()
                or (
                    store_root / "page_object_write_placement_proofs"
                ).exists()
            ):
                raise RuntimeError(
                    "NoNE page-object placement store authority is incomplete"
                )
            accepted_pointer = _read_json(pointer_path)
            manifest_relative = accepted_pointer.get("manifest")
            if not isinstance(manifest_relative, str):
                raise RuntimeError(
                    "NoNE page-object placement parent is incomplete"
                )
            manifest_path = (session_root / manifest_relative).resolve()
            (
                _manifest_sha256,
                manifest,
                payload_sha256,
                page_rows,
            ) = _read_generation_manifest_authority_cached(manifest_path)
            scope = request.branch_scope
            if (
                accepted_pointer.get("generation")
                != int(scope.parent_generation_t)
                or payload_sha256
                != _tensor_digest_hex(
                    scope.parent_manifest_payload_sha256_t
                )
                or manifest.get("manifestPayloadSha256") != payload_sha256
                or any(
                    int(page_id) not in page_rows
                    for page_id in scope.page_ids_t.detach().cpu().long()
                )
            ):
                raise RuntimeError(
                    "NoNE page-object placement branch scope differs"
                )
            store_identity = (
                _page_object_placement_directory_identity_boundary(store_root)
            )
            write_identity = (
                _page_object_placement_directory_identity_boundary(write_root)
            )
            if (
                (local_store and write_root != store_root)
                or (not local_store and write_root == store_root)
                or (not local_store and write_identity[0] == store_identity[0])
            ):
                raise RuntimeError(
                    "NoNE page-object placement filesystem differs"
                )
            prepared.append(
                {
                    "request": request,
                    "storeRoot": store_root,
                    "writeRoot": write_root,
                    "acceptedPointer": accepted_pointer,
                    "sessionKey": session_key,
                    "branchScopeSha256": _tensor_digest_hex(
                        scope.scope_sha256_t
                    ),
                    "branchScope": scope.external_record_boundary(),
                    "placementKind": (
                        "localStore" if local_store else "externalRoot"
                    ),
                    "storeRootIdentity": store_identity,
                    "writeRootIdentity": write_identity,
                }
            )
        store_roots = [cast(Path, row["storeRoot"]) for row in prepared]
        write_roots = [cast(Path, row["writeRoot"]) for row in prepared]
        store_root_identities = [
            cast(tuple[int, int], row["storeRootIdentity"])
            for row in prepared
        ]
        write_root_identities = [
            cast(tuple[int, int], row["writeRootIdentity"])
            for row in prepared
        ]
        if (
            len(set(store_roots)) != 4
            or len(set(write_roots)) != 4
            or len(set(store_root_identities)) != 4
            or len(set(write_root_identities)) != 4
            or len({identity[0] for identity in write_root_identities}) != 4
            or sum(row["placementKind"] == "localStore" for row in prepared)
            != 1
        ):
            raise RuntimeError(
                "NoNE page-object placement roots are not four-way independent"
            )
        for row in sorted(prepared, key=lambda value: str(value["storeRoot"])):
            session_root = (
                cast(Path, row["storeRoot"])
                / "sessions"
                / cast(str, row["sessionKey"])
            )
            writer_handle = (session_root / "generation_writer.lock").open(
                "a+b"
            )
            try:
                fcntl.flock(
                    writer_handle.fileno(),
                    fcntl.LOCK_EX | fcntl.LOCK_NB,
                )
            except BlockingIOError as error:
                writer_handle.close()
                raise RuntimeError(
                    "NoNE page-object placement lacks writer authority"
                ) from error
            handles.append(writer_handle)
        for row in prepared:
            accepted_path = (
                cast(Path, row["storeRoot"])
                / "sessions"
                / cast(str, row["sessionKey"])
                / "accepted.json"
            )
            if _read_json(accepted_path) != row["acceptedPointer"]:
                raise RuntimeError(
                    "NoNE page-object placement parent changed before commit"
                )
        for row in prepared:
            write_root = cast(Path, row["writeRoot"])
            objects_root = write_root / "objects/sha256"
            scratch_root = write_root / ".nnf-resynthesis-page-object-scratch"
            objects_root.mkdir(parents=True, exist_ok=True)
            scratch_root.mkdir(parents=True, exist_ok=True)
            _fsync_directory(objects_root.parent)
            _fsync_directory(write_root)
            row["objectsRoot"] = (
                _canonical_page_object_placement_directory_boundary(
                    objects_root,
                    label="page-object write objects root",
                )
            )
            row["scratchRoot"] = (
                _canonical_page_object_placement_directory_boundary(
                    scratch_root,
                    label="page-object write scratch root",
                )
            )
            row["objectsRootIdentity"] = (
                _page_object_placement_directory_identity_boundary(
                    cast(Path, row["objectsRoot"])
                )
            )
            row["scratchRootIdentity"] = (
                _page_object_placement_directory_identity_boundary(
                    cast(Path, row["scratchRoot"])
                )
            )
            if (
                cast(tuple[int, int], row["objectsRootIdentity"])[0]
                != cast(tuple[int, int], row["writeRootIdentity"])[0]
                or cast(tuple[int, int], row["scratchRootIdentity"])[0]
                != cast(tuple[int, int], row["writeRootIdentity"])[0]
            ):
                raise RuntimeError(
                    "NoNE page-object placement scratch and final filesystems differ"
                )
        proof_rows = [
            {
                "storeRoot": str(row["storeRoot"]),
                "writeRoot": str(row["writeRoot"]),
                "sessionKey": row["sessionKey"],
                "branchScopeSha256": row["branchScopeSha256"],
                "branchScope": row["branchScope"],
                "placementKind": row["placementKind"],
                "storeRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["storeRootIdentity"])
                    )
                ),
                "writeRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["writeRootIdentity"])
                    )
                ),
                "objectsRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["objectsRootIdentity"])
                    )
                ),
                "scratchRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["scratchRootIdentity"])
                    )
                ),
            }
            for row in sorted(
                prepared,
                key=lambda value: cast(str, value["branchScopeSha256"]),
            )
        ]
        proof: dict[str, Any] = {
            "schema": PAGE_OBJECT_WRITE_PLACEMENT_PROOF_SCHEMA,
            "placementCount": 4,
            "localStoreCount": 1,
            "externalRootCount": 3,
            "uniqueWriteDeviceCount": 4,
            "placements": proof_rows,
            "routingAuthority": False,
            "hostFlagAuthority": False,
        }
        proof["payloadSha256"] = (
            _page_object_placement_payload_sha256_boundary(proof)
        )
        proof_bytes = _page_object_placement_json_bytes_boundary(proof)
        proof_sha256 = hashlib.sha256(proof_bytes).hexdigest()
        bindings: list[NoNEPageObjectWritePlacementBinding] = []
        for row in prepared:
            store_root = cast(Path, row["storeRoot"])
            write_root = cast(Path, row["writeRoot"])
            proof_relative = (
                f"page_object_write_placement_proofs/{proof_sha256}.json"
            )
            proof_path = store_root / proof_relative
            _atomic_bytes(proof_path, proof_bytes)
            owner_path: Path | None = None
            owner_sha256: str | None = None
            if row["placementKind"] == "externalRoot":
                owner_path = (
                    write_root / ".nnf-resynthesis-page-object-owner.json"
                )
                if owner_path.exists():
                    raise RuntimeError(
                        "NoNE external page-object owner already exists"
                    )
                owner: dict[str, Any] = {
                    "schema": PAGE_OBJECT_WRITE_ROOT_OWNER_SCHEMA,
                    "storeRoot": str(store_root),
                    "writeRoot": str(write_root),
                    "sessionKey": row["sessionKey"],
                    "branchScopeSha256": row["branchScopeSha256"],
                    "placementProofSha256": proof_sha256,
                    "writeRootIdentity": (
                        _page_object_placement_identity_record_boundary(
                            cast(tuple[int, int], row["writeRootIdentity"])
                        )
                    ),
                }
                owner["payloadSha256"] = (
                    _page_object_placement_payload_sha256_boundary(owner)
                )
                owner_bytes = _page_object_placement_json_bytes_boundary(owner)
                owner_sha256 = hashlib.sha256(owner_bytes).hexdigest()
                _atomic_bytes(owner_path, owner_bytes)
                _fsync_directory(write_root)
            authority: dict[str, Any] = {
                "schema": PAGE_OBJECT_WRITE_PLACEMENT_AUTHORITY_SCHEMA,
                "storeRoot": str(store_root),
                "writeRoot": str(write_root),
                "sessionKey": row["sessionKey"],
                "branchScopeSha256": row["branchScopeSha256"],
                "branchScope": row["branchScope"],
                "placementKind": row["placementKind"],
                "storeRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["storeRootIdentity"])
                    )
                ),
                "writeRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["writeRootIdentity"])
                    )
                ),
                "objectsRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["objectsRootIdentity"])
                    )
                ),
                "scratchRootIdentity": (
                    _page_object_placement_identity_record_boundary(
                        cast(tuple[int, int], row["scratchRootIdentity"])
                    )
                ),
                "objectsRelativePath": "objects/sha256",
                "scratchRelativePath": ".nnf-resynthesis-page-object-scratch",
                "placementProofRelativePath": proof_relative,
                "placementProofSha256": proof_sha256,
                "ownerMarkerPath": (
                    str(owner_path) if owner_path is not None else None
                ),
                "ownerMarkerSha256": owner_sha256,
                "legacyLocalObjectsReadable": True,
                "newObjectWritesOnly": True,
                "routingAuthority": False,
            }
            authority["payloadSha256"] = (
                _page_object_placement_payload_sha256_boundary(authority)
            )
            authority_bytes = _page_object_placement_json_bytes_boundary(
                authority
            )
            authority_sha256 = hashlib.sha256(authority_bytes).hexdigest()
            authority_relative = (
                f"page_object_write_placement_authorities/"
                f"{authority_sha256}.json"
            )
            authority_path = store_root / authority_relative
            _atomic_bytes(authority_path, authority_bytes)
            row["authorityPath"] = authority_path
            row["authoritySha256"] = authority_sha256
            row["proofPath"] = proof_path
            row["proofRelative"] = proof_relative
        for row in prepared:
            pointer: dict[str, Any] = {
                "schema": PAGE_OBJECT_WRITE_PLACEMENT_POINTER_SCHEMA,
                "storeRoot": str(row["storeRoot"]),
                "sessionKey": row["sessionKey"],
                "branchScopeSha256": row["branchScopeSha256"],
                "authorityRelativePath": str(
                    cast(Path, row["authorityPath"]).relative_to(
                        cast(Path, row["storeRoot"])
                    )
                ),
                "authoritySha256": row["authoritySha256"],
                "placementProofRelativePath": row["proofRelative"],
                "placementProofSha256": proof_sha256,
            }
            pointer["payloadSha256"] = (
                _page_object_placement_payload_sha256_boundary(pointer)
            )
            _atomic_json(
                _page_object_write_placement_pointer_path_boundary(
                    cast(Path, row["storeRoot"])
                ),
                pointer,
            )
        for row in prepared:
            accepted_pointer = dict(
                cast(dict[str, Any], row["acceptedPointer"])
            )
            if (
                "pageObjectWritePlacementAuthoritySha256"
                in accepted_pointer
                or "pageObjectWritePlacementProofSha256"
                in accepted_pointer
            ):
                raise RuntimeError(
                    "NoNE accepted pointer already has placement authority"
                )
            accepted_pointer.update(
                {
                    "pageObjectWritePlacementAuthoritySha256": (
                        row["authoritySha256"]
                    ),
                    "pageObjectWritePlacementProofSha256": proof_sha256,
                }
            )
            accepted_path = (
                cast(Path, row["storeRoot"])
                / "sessions"
                / cast(str, row["sessionKey"])
                / "accepted.json"
            )
            accepted_history_path = (
                _accepted_authority_history_path_boundary(
                    accepted_path.parent,
                    accepted_pointer,
                )
            )
            if accepted_history_path.is_file():
                if _read_json(accepted_history_path) != accepted_pointer:
                    raise RuntimeError(
                        "NoNE accepted placement authority history changed"
                    )
            else:
                _atomic_json(accepted_history_path, accepted_pointer)
            _atomic_json(accepted_path, accepted_pointer)
            _fsync_directory(accepted_path.parent)
        for row in prepared:
            loaded = _load_page_object_write_placement_authority_boundary(
                cast(Path, row["storeRoot"]),
                validate_fanout=True,
            )
            if loaded is None:
                raise RuntimeError(
                    "NoNE page-object placement did not become durable"
                )
            accepted_path = (
                loaded.store_root
                / "sessions"
                / loaded.session_key
                / "accepted.json"
            )
            accepted_pointer = _read_json(accepted_path)
            if (
                accepted_pointer.get(
                    "pageObjectWritePlacementAuthoritySha256"
                )
                != loaded.authority_sha256
                or accepted_pointer.get(
                    "pageObjectWritePlacementProofSha256"
                )
                != loaded.placement_proof_sha256
                or accepted_path.stat().st_dev
                != loaded.store_root.stat().st_dev
                or _page_object_write_placement_pointer_path_boundary(
                    loaded.store_root
                ).stat().st_dev
                != loaded.store_root.stat().st_dev
            ):
                raise RuntimeError(
                    "NoNE local accepted placement pointer differs"
                )
            request = cast(
                NoNEPageObjectWritePlacementRequest,
                row["request"],
            )
            bindings.append(
                NoNEPageObjectWritePlacementBinding(
                    store_root=loaded.store_root,
                    write_root=loaded.write_root,
                    authority_path=loaded.authority_path,
                    authority_sha256_t=digest_tensor(
                        loaded.authority_sha256
                    ),
                    placement_proof_path=loaded.placement_proof_path,
                    placement_proof_sha256_t=digest_tensor(
                        loaded.placement_proof_sha256
                    ),
                    branch_scope_sha256_t=(
                        request.branch_scope.scope_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .clone()
                    ),
                    local_store_t=torch.tensor(
                        loaded.local_store,
                        dtype=torch.bool,
                    ),
                    write_device_t=torch.tensor(
                        loaded.write_root_identity[0],
                        dtype=torch.long,
                    ),
                )
            )
        return NoNEPageObjectWritePlacementFanoutPacket(
            placement_proof_sha256_t=digest_tensor(proof_sha256),
            bindings=tuple(bindings),
        )
    finally:
        for locked_handle in reversed(handles):
            try:
                fcntl.flock(locked_handle.fileno(), fcntl.LOCK_UN)
            finally:
                locked_handle.close()


class NoNEImmutablePageStore:
    """Content-addressed page objects with one accepted generation pointer."""

    def __init__(
        self,
        root: Path,
        *,
        object_roots: tuple[Path, ...] = (),
        advertise_locator: bool = True,
    ) -> None:
        self.root = root.expanduser().resolve()
        self.root.mkdir(parents=True, exist_ok=True)
        self.objects_root = self.root / "objects/sha256"
        self.sessions_root = self.root / "sessions"
        self.objects_root.mkdir(parents=True, exist_ok=True)
        self.sessions_root.mkdir(parents=True, exist_ok=True)
        self._object_write_placement = (
            _load_page_object_write_placement_authority_boundary(
                self.root,
                validate_fanout=True,
            )
        )
        discovered_object_roots = {
            self.root,
            *(candidate.expanduser().resolve() for candidate in object_roots),
        }
        if self._object_write_placement is not None:
            discovered_object_roots.add(
                self._object_write_placement.write_root
            )
        self._object_store_roots = tuple(
            sorted(discovered_object_roots, key=str)
        )
        self._write_objects_root = (
            self._object_write_placement.objects_root
            if self._object_write_placement is not None
            else self.objects_root
        )
        self._resolved_object_path_cache_lock = threading.Lock()
        self._resolved_object_path_cache: dict[
            tuple[str, int | None],
            Path,
        ] = {}
        self._replicated_page_object_publish_lock = threading.Lock()
        self._advertise_locator = bool(advertise_locator)
        self._session_id_t: torch.Tensor | None = None
        self._session_root: Path | None = None
        self._accepted_generation_t = torch.zeros((), dtype=torch.long)
        self._manifest: dict[str, Any] | None = None
        self._accepted_pointer_identity_boundary: _FileIdentity | None = None
        self._accepted_manifest_identity_boundary: _FileIdentity | None = None
        self._accepted_binding_boundary: NoNEGenerationBinding | None = None
        self._accepted_direct_page_map_payload_sha256_boundary = ""
        self._accepted_direct_page_map_objects_root_identity_boundary: (
            _FileIdentity | None
        ) = None
        self._accepted_direct_page_pack_file_identities_boundary: (
            tuple[tuple[Path, _FileIdentity], ...] | None
        ) = None
        self._accepted_direct_page_pack_authority_boundary: (
            DirectPagePackSetAuthorityPacket | None
        ) = None
        self._accepted_direct_page_pack_index_boundary: (
            DirectPagePackIndexPacket | None
        ) = None
        self._accepted_direct_page_pack_record_boundary: (
            dict[str, Any] | None
        ) = None
        self._read_only_staged_binding: NoNEGenerationBinding | None = None
        self._read_only_staged_parent_binding: NoNEGenerationBinding | None = None
        self._read_only_staged_manifest_identity: _FileIdentity | None = None
        self._read_only_staged_parent_manifest_identity: (
            _FileIdentity | None
        ) = None
        self._read_only_staged_parent_pointer_canonical_bytes: bytes | None = None
        self._read_only_staged_parent_pointer_sha256: str | None = None
        self._read_only_staged_graph_authority: (
            NoNEGraphAuthorityBinding | None
        ) = None
        self._read_only_staged_graph_authority_record: dict[str, Any] | None = None
        self._read_only_staged_graph_authority_payload_sha256: str | None = None
        self._staged_immutable_parent_binding: NoNEGenerationBinding | None = None
        self._staged_immutable_parent_manifest_identity: (
            _FileIdentity | None
        ) = None
        self._page_index_manifest_boundary: dict[str, Any] | None = None
        self._page_index_cache_boundary: dict[int, dict[str, Any]] | None = None
        self._graph_authority: NoNEGraphAuthorityBinding | None = None
        self._graph_authority_payload_sha256 = ""
        self._resident_checkpoint_sha256 = ""
        self._resident_composition_sha256 = ""
        self._resident_page_ids_t: torch.Tensor | None = None
        self._release_generation_projection: (
            _NoNEReleaseGenerationProjection | None
        ) = None
        self._verified_objects: set[str] = set()
        # Diagnostic mirror only. Semantic reuse is authorized exclusively by
        # the exact accepted-generation closure cache below.
        self._verified_delta_semantic_objects: set[str] = set()
        self._receipt_verified_overlay_objects_boundary: dict[
            str, tuple[int, int]
        ] = {}
        self._verified_object_identities_boundary: dict[
            tuple[str, Path], tuple[int, _FileIdentity]
        ] = {}
        self._validated_page_object_header_cache_lock = threading.Lock()
        self._validated_page_object_headers_boundary: dict[
            tuple[str, Path],
            _NoNEValidatedPageObjectSchemaProof,
        ] = {}
        physical_memory_bytes = (
            os.sysconf("SC_PHYS_PAGES") * os.sysconf("SC_PAGE_SIZE")
        )
        self._materialized_cpu_page_cache_budget_bytes = max(
            os.sysconf("SC_PAGE_SIZE"),
            physical_memory_bytes
            // _CPU_PAGE_MATERIALIZATION_CACHE_MEMORY_DIVISOR,
        )
        self._materialized_cpu_page_cache_lock = threading.Lock()
        self._materialized_cpu_page_cache: dict[
            tuple[str, str, torch.dtype],
            _NoNEMaterializedCPUCacheEntry,
        ] = {}
        self._materialized_cpu_page_cache_bytes = 0
        self._shared_page_weights_cache = SharedPageWeightsCache()
        self._validated_immutable_page_closure_cache_lock = threading.Lock()
        self._validated_immutable_page_closure_cache: dict[
            _NoNEValidatedImmutablePageClosureKey,
            _NoNERev6SemanticAdmission,
        ] = {}
        self._candidate_page_semantic_witness_lock = threading.Lock()
        self._candidate_scratch_semantic_witnesses: dict[
            Path,
            _NoNECandidatePageSemanticWitness,
        ] = {}
        self._candidate_sealed_semantic_witnesses: dict[
            str,
            _NoNECandidatePageSemanticWitness,
        ] = {}
        self._verified_semantic_pack_identities_boundary: dict[
            Path,
            tuple[_FileIdentity, str],
        ] = {}
        self._candidate_scratch_owner = (
            f"{os.getpid()}-"
            f"{hashlib.sha256(os.urandom(16)).hexdigest()[:16]}"
        )
        self._pending_compact_objects: set[str] = set()
        self._generation_writer_handle: BinaryIO | None = None
        self._generation_writer_session_key: str | None = None
        self._materialization_telemetry_lock = threading.Lock()
        self._materialization_request_count = 0
        self._materialization_page_count = 0
        self._materialization_weights_request_count = 0
        self._materialization_optimizer_bundle_request_count = 0
        self._materialization_cuda_request_count = 0
        self._compact_transfer_template_cache: dict[
            str, NoNECompactTransferTemplate
        ] = {}
        self._materialization_authorization_ns = 0
        self._materialization_read_dequant_ns = 0
        self._materialization_compose_ns = 0
        self._materialization_device_transfer_enqueue_ns = 0
        self._materialization_cpu_cache_hit_count = 0
        self._materialization_cpu_cache_miss_count = 0
        self._materialization_post_accept_cpu_cache_admission_count = 0
        self._materialization_post_accept_cpu_cache_admission_bytes = 0

    @property
    def object_store_roots_boundary(self) -> tuple[Path, ...]:
        """Return identity-discovered object roots at the storage boundary."""

        return self._object_store_roots

    def _refresh_page_object_write_placement_boundary(
        self,
    ) -> _NoNEPageObjectWritePlacementAuthority | None:
        """Cold-validate the immutable four-way proof before a write phase."""

        loaded = _load_page_object_write_placement_authority_boundary(
            self.root,
            validate_fanout=True,
        )
        prior = self._object_write_placement
        if prior is not None and (
            loaded is None
            or loaded.authority_sha256 != prior.authority_sha256
            or loaded.placement_proof_sha256
            != prior.placement_proof_sha256
            or loaded.write_root != prior.write_root
            or loaded.objects_root != prior.objects_root
            or loaded.scratch_root != prior.scratch_root
            or loaded.branch_scope_sha256 != prior.branch_scope_sha256
        ):
            raise RuntimeError(
                "NoNE page-object write placement changed after binding"
            )
        if loaded is not None:
            if (
                self._session_id_t is not None
                and loaded.session_key != _session_key(self._session_id_t)
            ):
                raise RuntimeError(
                    "NoNE page-object placement crossed session ownership"
                )
            self._object_write_placement = loaded
            self._write_objects_root = loaded.objects_root
            self._object_store_roots = tuple(
                sorted(
                    {*self._object_store_roots, loaded.write_root},
                    key=str,
                )
            )
            with self._resolved_object_path_cache_lock:
                self._resolved_object_path_cache.clear()
        elif prior is None:
            self._write_objects_root = self.objects_root
        return loaded

    def _validated_page_object_write_roots_boundary(
        self,
    ) -> tuple[Path, Path]:
        """Return current final/scratch roots after exact local identity checks."""

        placement = self._object_write_placement
        if placement is None:
            _session_id_t, session_root = self._require_session()
            return self.objects_root, session_root / "candidate_page_scratch"
        if (
            _page_object_placement_directory_identity_boundary(
                placement.store_root
            )
            != placement.store_root_identity
            or _page_object_placement_directory_identity_boundary(
                placement.write_root
            )
            != placement.write_root_identity
            or _page_object_placement_directory_identity_boundary(
                placement.objects_root
            )
            != placement.objects_root_identity
            or _page_object_placement_directory_identity_boundary(
                placement.scratch_root
            )
            != placement.scratch_root_identity
            or placement.objects_root_identity[0]
            != placement.scratch_root_identity[0]
        ):
            raise RuntimeError(
                "NoNE page-object write placement identity drifted"
            )
        if placement.owner_marker_path is not None and (
            not placement.owner_marker_path.is_file()
            or _file_sha256(placement.owner_marker_path)
            != placement.owner_marker_sha256
        ):
            raise RuntimeError(
                "NoNE page-object write placement owner drifted"
            )
        return placement.objects_root, placement.scratch_root

    def _validate_page_object_placement_manifest_boundary(
        self,
        manifest: Mapping[str, Any],
    ) -> None:
        """Bind every post-placement generation to the immutable authority."""

        authority_sha256 = manifest.get(
            "pageObjectWritePlacementAuthoritySha256"
        )
        proof_sha256 = manifest.get(
            "pageObjectWritePlacementProofSha256"
        )
        placement = self._object_write_placement
        if placement is None:
            if authority_sha256 is not None or proof_sha256 is not None:
                raise RuntimeError(
                    "NoNE page generation has foreign placement authority"
                )
            return
        if authority_sha256 is None and proof_sha256 is None:
            branch_scope = placement.branch_scope
            if (
                manifest.get("generation")
                != int(branch_scope.parent_generation_t)
                or manifest.get("manifestPayloadSha256")
                != _tensor_digest_hex(
                    branch_scope.parent_manifest_payload_sha256_t
                )
            ):
                raise RuntimeError(
                    "NoNE page generation omits placement authority"
                )
            return
        if (
            authority_sha256 != placement.authority_sha256
            or proof_sha256 != placement.placement_proof_sha256
        ):
            raise RuntimeError(
                "NoNE page generation placement authority differs"
            )

    def _validate_page_object_placement_pointer_boundary(
        self,
        pointer: Mapping[str, Any],
    ) -> None:
        """Require the mutable local pointer to retain exact placement hashes."""

        authority_sha256 = pointer.get(
            "pageObjectWritePlacementAuthoritySha256"
        )
        proof_sha256 = pointer.get(
            "pageObjectWritePlacementProofSha256"
        )
        placement = self._object_write_placement
        if placement is None:
            if authority_sha256 is not None or proof_sha256 is not None:
                raise RuntimeError(
                    "NoNE accepted pointer has foreign placement authority"
                )
            return
        if (
            authority_sha256 != placement.authority_sha256
            or proof_sha256 != placement.placement_proof_sha256
        ):
            raise RuntimeError(
                "NoNE accepted pointer placement authority differs"
            )

    def _clear_materialized_cpu_page_cache_boundary(self) -> None:
        """Drop store-local reconstructions before crossing session authority."""

        with self._materialized_cpu_page_cache_lock:
            self._materialized_cpu_page_cache.clear()
            self._materialized_cpu_page_cache_bytes = 0

    def _clear_validated_immutable_page_closure_cache_boundary(self) -> None:
        """Drop generation-bound proofs while retaining immutable headers.

        A page object's schema and its base-bound dependency are tied to the
        object's digest/path/inode, not to the accepted pointer inode.  The
        closure admission cache must be dropped when a new generation is
        published, but throwing away the header cache forced every routed
        immutable page through a safetensors open and rev6 schema walk again
        on the next transaction.  Header entries are still evicted whenever
        their object identity changes and are cleared on a new session.
        """

        with self._validated_immutable_page_closure_cache_lock:
            self._validated_immutable_page_closure_cache.clear()
        self._verified_delta_semantic_objects.clear()

    def _clear_candidate_page_semantic_witnesses_boundary(self) -> None:
        """Drop non-authoritative candidate witnesses at a session boundary."""

        with self._candidate_page_semantic_witness_lock:
            self._candidate_scratch_semantic_witnesses.clear()
            self._candidate_sealed_semantic_witnesses.clear()

    def _record_candidate_scratch_semantic_witness_boundary(
        self,
        *,
        page_id: int,
        scratch_path: Path,
        object_sha256: str,
        object_bytes: int,
        base_generation: NoNEGenerationBinding,
        base_object: NoNEPageObjectBinding,
    ) -> None:
        """Bind one internally encoded scratch delta to its exact bytes."""

        resolved_path = scratch_path.expanduser().resolve()
        witness = _NoNECandidatePageSemanticWitness(
            page_id=page_id,
            object_sha256=object_sha256,
            object_bytes=object_bytes,
            object_path=resolved_path,
            object_identity=_file_identity(resolved_path),
            base_generation=int(
                base_generation.generation_t.detach().cpu().long().reshape(())
            ),
            base_manifest_payload_sha256=_tensor_digest_hex(
                base_generation.manifest_payload_sha256_t
            ),
            base_object_sha256=_tensor_digest_hex(
                base_object.object_sha256_t
            ),
            base_object_bytes=int(
                base_object.object_bytes_t.detach().cpu().long().reshape(())
            ),
        )
        with self._candidate_page_semantic_witness_lock:
            self._candidate_scratch_semantic_witnesses[resolved_path] = witness

    def _take_candidate_scratch_semantic_witness_boundary(
        self,
        *,
        page_id: int,
        scratch_path: Path,
        object_bytes: int,
    ) -> _NoNECandidatePageSemanticWitness | None:
        """Consume a scratch witness only while every file identity still matches."""

        resolved_path = scratch_path.expanduser().resolve()
        with self._candidate_page_semantic_witness_lock:
            witness = self._candidate_scratch_semantic_witnesses.pop(
                resolved_path,
                None,
            )
        if (
            witness is None
            or witness.page_id != page_id
            or witness.object_bytes != object_bytes
            or witness.object_path != resolved_path
            or witness.object_identity != _file_identity(resolved_path)
        ):
            return None
        return witness

    def _record_candidate_sealed_semantic_witness_boundary(
        self,
        *,
        witness: _NoNECandidatePageSemanticWitness,
        object_path: Path,
        object_sha256: str,
        object_bytes: int,
    ) -> None:
        """Carry one unchanged scratch witness across its immutable rename."""

        resolved_path = object_path.expanduser().resolve()
        if (
            witness.object_sha256 != object_sha256
            or witness.object_bytes != object_bytes
        ):
            raise RuntimeError(
                "NoNE candidate semantic witness hash differs"
            )
        sealed = replace(
            witness,
            object_path=resolved_path,
            object_identity=_file_identity(resolved_path),
        )
        with self._candidate_page_semantic_witness_lock:
            self._candidate_sealed_semantic_witnesses[
                object_sha256
            ] = sealed

    def _discard_candidate_semantic_witness_boundary(
        self,
        *,
        scratch_path: Path | None = None,
        object_sha256: str | None = None,
    ) -> None:
        """Discard proposal-local acceleration without changing authority."""

        with self._candidate_page_semantic_witness_lock:
            if scratch_path is not None:
                self._candidate_scratch_semantic_witnesses.pop(
                    scratch_path.expanduser().resolve(),
                    None,
                )
            if object_sha256 is not None:
                self._candidate_sealed_semantic_witnesses.pop(
                    object_sha256,
                    None,
                )

    def _candidate_semantic_witness_matches_admission_boundary(
        self,
        *,
        authority: _NoNEAcceptedGenerationManifestIdentity,
        admission: _NoNERev6SemanticAdmission,
    ) -> bool:
        """Recognize only the exact store-produced child and accepted parent."""

        with self._candidate_page_semantic_witness_lock:
            witness = self._candidate_sealed_semantic_witnesses.get(
                admission.child.object_sha256
            )
        if witness is None or not admission.dependency_closure:
            return False
        base = admission.dependency_closure[0]
        if (
            witness.page_id != admission.child.page_id
            or witness.object_bytes != admission.child.object_bytes
            or witness.object_path != admission.child.object_path
            or witness.object_identity != admission.child.object_identity
            or witness.object_identity
            != _file_identity(admission.child.object_path)
            or witness.base_generation != authority.generation
            or witness.base_manifest_payload_sha256
            != authority.manifest_payload_sha256
            or witness.base_object_sha256 != base.object_sha256
            or witness.base_object_bytes != base.object_bytes
        ):
            return False
        return True

    def _evict_validated_immutable_page_closure_object_boundary(
        self,
        object_sha256: str,
    ) -> None:
        """Invalidate every proof containing one changed immutable object."""

        with self._validated_immutable_page_closure_cache_lock:
            evicted_keys = tuple(
                key
                for key in self._validated_immutable_page_closure_cache
                if any(
                    authorized_sha256 == object_sha256
                    for (
                        _page_id,
                        authorized_sha256,
                        _object_bytes,
                        _object_path,
                        _object_identity,
                    ) in key.object_identities
                )
            )
            evicted_sha256s = {
                authorized_sha256
                for key in evicted_keys
                for (
                    _page_id,
                    authorized_sha256,
                    _object_bytes,
                    _object_path,
                    _object_identity,
                ) in key.object_identities
            }
            for key in evicted_keys:
                self._validated_immutable_page_closure_cache.pop(key, None)
        if not evicted_sha256s:
            evicted_sha256s = {object_sha256}
        for evicted_sha256 in evicted_sha256s:
            self._verified_delta_semantic_objects.discard(evicted_sha256)
            self._verified_objects.discard(evicted_sha256)
            for cache_key in tuple(self._verified_object_identities_boundary):
                if cache_key[0] == evicted_sha256:
                    self._verified_object_identities_boundary.pop(
                        cache_key,
                        None,
                    )
            with self._validated_page_object_header_cache_lock:
                for cache_key in tuple(
                    self._validated_page_object_headers_boundary
                ):
                    if cache_key[0] == evicted_sha256:
                        self._validated_page_object_headers_boundary.pop(
                            cache_key,
                            None,
                        )
            self._evict_materialized_cpu_page_object_boundary(
                evicted_sha256
            )

    def _accepted_generation_manifest_identity_boundary(
        self,
    ) -> _NoNEAcceptedGenerationManifestIdentity:
        """Return one fully verified pointer-to-manifest filesystem identity."""

        _session_id_t, session_root = self._require_session()
        binding = self.discover_accepted_pointer_boundary()
        pointer_path = (session_root / "accepted.json").resolve()
        manifest_path = (
            session_root / binding.manifest_relative_path
        ).resolve()
        pointer_identity = _file_identity(pointer_path)
        manifest_identity = _file_identity(manifest_path)
        if (
            self._accepted_pointer_identity_boundary != pointer_identity
            or self._accepted_manifest_identity_boundary != manifest_identity
        ):
            loaded, manifest = self._load_generation_binding_boundary(
                binding.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    binding.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    binding.manifest_payload_sha256_t
                ),
            )
            if not _same_generation_binding_boundary(loaded, binding):
                raise RuntimeError(
                    "NoNE accepted generation changed during closure validation"
                )
            pointer_identity_after = _file_identity(pointer_path)
            manifest_identity_after = _file_identity(manifest_path)
            if pointer_identity_after != pointer_identity:
                raise RuntimeError(
                    "NoNE accepted pointer changed during closure validation"
                )
            self._manifest = manifest
            self._accepted_pointer_identity_boundary = pointer_identity_after
            self._accepted_manifest_identity_boundary = (
                manifest_identity_after
            )
            pointer_identity = pointer_identity_after
            manifest_identity = manifest_identity_after
        return _NoNEAcceptedGenerationManifestIdentity(
            pointer_path=pointer_path,
            pointer_identity=pointer_identity,
            generation=int(binding.generation_t),
            manifest_path=manifest_path,
            manifest_identity=manifest_identity,
            manifest_sha256=_tensor_digest_hex(binding.manifest_sha256_t),
            manifest_payload_sha256=_tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        )

    @staticmethod
    def _validated_immutable_page_closure_key_boundary(
        *,
        authority: _NoNEAcceptedGenerationManifestIdentity,
        admission: _NoNERev6SemanticAdmission,
    ) -> _NoNEValidatedImmutablePageClosureKey:
        authorized_objects = (
            admission.child,
            *admission.dependency_closure,
        )
        return _NoNEValidatedImmutablePageClosureKey(
            authority=authority,
            object_sha256=admission.child.object_sha256,
            object_identities=tuple(
                (
                    authorized.page_id,
                    authorized.object_sha256,
                    authorized.object_bytes,
                    authorized.object_path,
                    authorized.object_identity,
                )
                for authorized in authorized_objects
            ),
        )

    def _cached_validated_immutable_page_closure_boundary(
        self,
        *,
        page_id: int | None,
        object_path: Path,
        object_sha256: str,
        object_bytes: int,
    ) -> _NoNERev6SemanticAdmission | None:
        """Reuse a closure only under its exact pointer, manifest, and files."""

        with self._validated_immutable_page_closure_cache_lock:
            if not self._validated_immutable_page_closure_cache:
                return None
        authority = self._accepted_generation_manifest_identity_boundary()
        resolved_path = object_path.expanduser().resolve()
        stale_objects: set[str] = set()
        with self._validated_immutable_page_closure_cache_lock:
            candidates = tuple(
                (key, admission)
                for key, admission in (
                    self._validated_immutable_page_closure_cache.items()
                )
                if key.authority == authority
                and key.object_sha256 == object_sha256
            )
            if not candidates:
                return None
            for key, admission in candidates:
                if (
                    (
                        page_id is not None
                        and admission.child.page_id != page_id
                    )
                    or admission.child.object_path != resolved_path
                    or admission.child.object_bytes != object_bytes
                ):
                    continue
                current_identities: list[
                    tuple[int, str, int, Path, _FileIdentity]
                ] = []
                try:
                    for (
                        authorized_page_id,
                        authorized_sha256,
                        authorized_bytes,
                        authorized_path,
                        _authorized_identity,
                    ) in key.object_identities:
                        current_identities.append(
                            (
                                authorized_page_id,
                                authorized_sha256,
                                authorized_bytes,
                                authorized_path,
                                _file_identity(authorized_path),
                            )
                        )
                except OSError:
                    current_identities = []
                if tuple(current_identities) == key.object_identities:
                    return admission
                stale_objects.update(
                    authorized_sha256
                    for (
                        _authorized_page_id,
                        authorized_sha256,
                        _authorized_bytes,
                        _authorized_path,
                        _authorized_identity,
                    ) in key.object_identities
                )
        for stale_sha256 in stale_objects:
            self._evict_validated_immutable_page_closure_object_boundary(
                stale_sha256
            )
        return None

    def _admit_validated_immutable_page_closure_boundary(
        self,
        *,
        authority: _NoNEAcceptedGenerationManifestIdentity,
        admission: _NoNERev6SemanticAdmission,
    ) -> None:
        """Retain one successful semantic proof under its complete identity."""

        key = self._validated_immutable_page_closure_key_boundary(
            authority=authority,
            admission=admission,
        )
        if any(
            _file_identity(authorized_path) != authorized_identity
            for (
                _page_id,
                _object_sha256,
                _object_bytes,
                authorized_path,
                authorized_identity,
            ) in key.object_identities
        ):
            raise RuntimeError(
                "NoNE semantic admission object identity changed before caching"
            )
        with self._validated_immutable_page_closure_cache_lock:
            for cached_key in tuple(
                self._validated_immutable_page_closure_cache
            ):
                if (
                    cached_key.authority == authority
                    and cached_key.object_sha256 == key.object_sha256
                ):
                    self._validated_immutable_page_closure_cache.pop(
                        cached_key
                    )
            self._validated_immutable_page_closure_cache[key] = admission
        self._verified_delta_semantic_objects.add(
            admission.child.object_sha256
        )

    def _evict_materialized_cpu_page_object_boundary(
        self,
        object_sha256: str,
    ) -> None:
        """Remove every dtype reconstruction for one immutable object digest."""

        with self._materialized_cpu_page_cache_lock:
            matching_keys = tuple(
                key
                for key in self._materialized_cpu_page_cache
                if key[1] == object_sha256
            )
            for key in matching_keys:
                entry = self._materialized_cpu_page_cache.pop(key)
                self._materialized_cpu_page_cache_bytes -= entry.storage_bytes

    def _cached_materialized_cpu_page_boundary(
        self,
        *,
        object_path: Path,
        object_sha256: str,
        dtype: torch.dtype,
    ) -> NoNEPageBundle | None:
        """Reuse only the same session, digest, dtype, path, and file identity."""

        session_id_t, _session_root = self._require_session()
        key = (_session_key(session_id_t), object_sha256, dtype)
        resolved_path = object_path.expanduser().resolve()
        identity = _file_identity(resolved_path)
        cached_bundle: NoNEPageBundle | None = None
        with self._materialized_cpu_page_cache_lock:
            entry = self._materialized_cpu_page_cache.get(key)
            if entry is not None and (
                entry.object_path != resolved_path
                or entry.object_identity != identity
            ):
                self._materialized_cpu_page_cache.pop(key)
                self._materialized_cpu_page_cache_bytes -= entry.storage_bytes
                entry = None
            if entry is not None:
                self._materialized_cpu_page_cache.pop(key)
                self._materialized_cpu_page_cache[key] = entry
                if isinstance(entry, _NoNEMaterializedCPUPageCacheEntry):
                    cached_bundle = entry.bundle
        with self._materialization_telemetry_lock:
            if cached_bundle is None:
                self._materialization_cpu_cache_miss_count += 1
            else:
                self._materialization_cpu_cache_hit_count += 1
        return cached_bundle

    def _cached_materialized_cpu_weights_boundary(
        self,
        *,
        object_path: Path,
        object_sha256: str,
        dtype: torch.dtype,
    ) -> NoNEPageWeights | None:
        """Reuse exact immutable weights from either bounded cache entry."""

        session_id_t, _session_root = self._require_session()
        key = (_session_key(session_id_t), object_sha256, dtype)
        resolved_path = object_path.expanduser().resolve()
        identity = _file_identity(resolved_path)
        cached_weights: NoNEPageWeights | None = None
        with self._materialized_cpu_page_cache_lock:
            entry = self._materialized_cpu_page_cache.get(key)
            if entry is not None and (
                entry.object_path != resolved_path
                or entry.object_identity != identity
            ):
                self._materialized_cpu_page_cache.pop(key)
                self._materialized_cpu_page_cache_bytes -= entry.storage_bytes
                entry = None
            if entry is not None:
                self._materialized_cpu_page_cache.pop(key)
                self._materialized_cpu_page_cache[key] = entry
                cached_weights = (
                    entry.bundle.weights
                    if isinstance(
                        entry,
                        _NoNEMaterializedCPUPageCacheEntry,
                    )
                    else entry.weights
                )
        with self._materialization_telemetry_lock:
            if cached_weights is None:
                self._materialization_cpu_cache_miss_count += 1
            else:
                self._materialization_cpu_cache_hit_count += 1
        return cached_weights

    def _admit_materialized_cpu_weights_boundary(
        self,
        *,
        object_path: Path,
        object_sha256: str,
        dtype: torch.dtype,
        weights: NoNEPageWeights,
    ) -> int:
        """Admit forward weights without retaining dense optimizer moments."""

        validate_page_weights(weights)
        storage_bytes = _page_weights_storage_bytes_boundary(weights)
        if storage_bytes > self._materialized_cpu_page_cache_budget_bytes:
            return 0
        session_id_t, _session_root = self._require_session()
        key = (_session_key(session_id_t), object_sha256, dtype)
        resolved_path = object_path.expanduser().resolve()
        entry = _NoNEMaterializedCPUWeightsCacheEntry(
            object_path=resolved_path,
            object_identity=_file_identity(resolved_path),
            weights=weights,
            storage_bytes=storage_bytes,
        )
        with self._materialized_cpu_page_cache_lock:
            prior = self._materialized_cpu_page_cache.get(key)
            if isinstance(prior, _NoNEMaterializedCPUPageCacheEntry):
                self._materialized_cpu_page_cache.pop(key)
                self._materialized_cpu_page_cache[key] = prior
                return 0
            prior = self._materialized_cpu_page_cache.pop(key, None)
            if prior is not None:
                self._materialized_cpu_page_cache_bytes -= prior.storage_bytes
            while (
                self._materialized_cpu_page_cache
                and self._materialized_cpu_page_cache_bytes + storage_bytes
                > self._materialized_cpu_page_cache_budget_bytes
            ):
                oldest_key = next(iter(self._materialized_cpu_page_cache))
                oldest = self._materialized_cpu_page_cache.pop(oldest_key)
                self._materialized_cpu_page_cache_bytes -= oldest.storage_bytes
            self._materialized_cpu_page_cache[key] = entry
            self._materialized_cpu_page_cache_bytes += storage_bytes
        return storage_bytes

    def _admit_materialized_cpu_page_boundary(
        self,
        *,
        object_path: Path,
        object_sha256: str,
        dtype: torch.dtype,
        bundle: NoNEPageBundle,
    ) -> int:
        """Admit one fully validated immutable reconstruction to the bounded LRU."""

        validate_page_bundle(bundle)
        if any(
            tensor.requires_grad
            for tensor in (
                *(getattr(bundle.weights, name) for name in _PAGE_WEIGHT_TENSOR_NAMES),
                bundle.optimizer_mean_t,
                bundle.optimizer_square_t,
            )
        ):
            raise RuntimeError(
                "materialized CPU page cache received a trainable bundle"
            )
        storage_bytes = _page_bundle_storage_bytes_boundary(bundle)
        if storage_bytes > self._materialized_cpu_page_cache_budget_bytes:
            return 0
        session_id_t, _session_root = self._require_session()
        key = (_session_key(session_id_t), object_sha256, dtype)
        resolved_path = object_path.expanduser().resolve()
        entry = _NoNEMaterializedCPUPageCacheEntry(
            object_path=resolved_path,
            object_identity=_file_identity(resolved_path),
            bundle=bundle,
            storage_bytes=storage_bytes,
        )
        with self._materialized_cpu_page_cache_lock:
            prior = self._materialized_cpu_page_cache.pop(key, None)
            if prior is not None:
                self._materialized_cpu_page_cache_bytes -= prior.storage_bytes
            while (
                self._materialized_cpu_page_cache
                and self._materialized_cpu_page_cache_bytes + storage_bytes
                > self._materialized_cpu_page_cache_budget_bytes
            ):
                oldest_key = next(iter(self._materialized_cpu_page_cache))
                oldest = self._materialized_cpu_page_cache.pop(oldest_key)
                self._materialized_cpu_page_cache_bytes -= oldest.storage_bytes
            self._materialized_cpu_page_cache[key] = entry
            self._materialized_cpu_page_cache_bytes += storage_bytes
        return storage_bytes

    def admit_accepted_materialized_cpu_pages_boundary(
        self,
        *,
        session_id_t: torch.Tensor,
        generation_t: torch.Tensor,
        object_bindings: tuple[NoNEPageObjectBinding, ...],
        bundles: tuple[NoNEPageBundle, ...],
    ) -> torch.Tensor:
        """Cache post-accept rows under exact immutable object identities."""

        if not object_bindings or len(object_bindings) != len(bundles):
            raise RuntimeError("accepted NoNE cache binding is malformed")
        page_ids: list[int] = []
        object_bytes: list[int] = []
        object_sha256s: list[str] = []
        for object_binding in object_bindings:
            binding_page_ids_t = (
                object_binding.page_id_t.detach().cpu().long().reshape(-1)
            )
            binding_bytes_t = (
                object_binding.object_bytes_t.detach().cpu().long().reshape(-1)
            )
            if (
                binding_page_ids_t.numel() != 1
                or binding_bytes_t.numel() != 1
            ):
                raise RuntimeError("accepted NoNE cache binding is malformed")
            page_ids.append(int(binding_page_ids_t[0]))
            object_bytes.append(int(binding_bytes_t[0]))
            object_sha256s.append(
                _tensor_digest_hex(object_binding.object_sha256_t)
            )
        binding_page_ids_t = torch.tensor(page_ids, dtype=torch.long)
        selected_page_ids_t = self._validate_materialization_identity_boundary(
            session_id_t=session_id_t,
            generation_t=generation_t,
            page_ids_t=binding_page_ids_t,
        )
        authorized = self._authorized_page_objects_boundary(
            selected_page_ids_t=selected_page_ids_t,
        )
        if len(authorized) != len(object_bindings):
            raise RuntimeError("accepted NoNE cache authorization differs")
        accepted_index = self._page_index()
        admitted_count = 0
        admitted_bytes = 0
        for row_index, (
            authorized_row,
            bundle,
        ) in enumerate(zip(authorized, bundles, strict=True)):
            page_id = page_ids[row_index]
            object_sha256 = object_sha256s[row_index]
            authorized_page_id = authorized_row.page_id
            authorized_sha256 = authorized_row.object_sha256
            object_path = authorized_row.object_path
            accepted_row = accepted_index.get(page_id)
            if (
                authorized_page_id != page_id
                or authorized_sha256 != object_sha256
                or object_path is None
                or not isinstance(accepted_row, dict)
                or accepted_row.get("sha256") != object_sha256
                or accepted_row.get("bytes") != object_bytes[row_index]
            ):
                raise RuntimeError("accepted NoNE cache object identity differs")
            validate_page_bundle(bundle)
            bundle_page_ids_t = (
                bundle.weights.page_ids_t.detach().cpu().long().reshape(-1)
            )
            if (
                bundle_page_ids_t.numel() != 1
                or int(bundle_page_ids_t[0]) != page_id
            ):
                raise RuntimeError("accepted NoNE cache page identity differs")
            cache_dtype = bundle.weights.gate_t.dtype
            isolated = _move_immutable_page_bundle_for_consumer_boundary(
                bundle,
                device=torch.device("cpu"),
                dtype=cache_dtype,
                trainable=False,
            )
            row_admitted_bytes = self._admit_materialized_cpu_page_boundary(
                object_path=object_path,
                object_sha256=object_sha256,
                dtype=cache_dtype,
                bundle=isolated,
            )
            admitted_count += int(row_admitted_bytes > 0)
            admitted_bytes += row_admitted_bytes
        if admitted_count > 0:
            with self._materialization_telemetry_lock:
                self._materialization_post_accept_cpu_cache_admission_count += (
                    admitted_count
                )
                self._materialization_post_accept_cpu_cache_admission_bytes += (
                    admitted_bytes
                )
        return binding_page_ids_t.new_tensor(admitted_count)

    def _materialize_verified_immutable_cpu_page_boundary(
        self,
        *,
        object_path: Path,
        object_sha256: str,
        dtype: torch.dtype,
        delta_chain: tuple[str, ...],
    ) -> NoNEPageBundle:
        """Materialize one exact immutable object under its canonical cache dtype."""

        resolved_path = object_path.expanduser().resolve()
        validated_closure = (
            self._cached_validated_immutable_page_closure_boundary(
                page_id=None,
                object_path=resolved_path,
                object_sha256=object_sha256,
                object_bytes=_file_identity(resolved_path)[2],
            )
        )
        if validated_closure is None:
            self._verify_materialized_object_boundary(
                object_path=resolved_path,
                object_sha256=object_sha256,
            )
        cached = self._cached_materialized_cpu_page_boundary(
            object_path=resolved_path,
            object_sha256=object_sha256,
            dtype=dtype,
        )
        if cached is not None:
            return cached
        if dtype in (torch.bfloat16, torch.float16):
            revision = BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
            if validated_closure is None:
                with safe_open(  # type: ignore[no-untyped-call]
                    str(resolved_path),
                    framework="pt",
                    device="cpu",
                ) as handle:
                    revision = self._page_format_revision_boundary(handle)
            if revision == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION:
                # A cold rev6 reconstruction always needs its exact FP32 parent
                # reference. Retain only that canonical cold-path object, then
                # isolate and cast the consumer view. A post-accept BF16/FP16
                # bundle may already have hit above because it is bound directly
                # to the newly sealed child digest and therefore needs no replay
                # of its dependency chain.
                canonical = (
                    self._materialize_verified_immutable_cpu_page_boundary(
                        object_path=resolved_path,
                        object_sha256=object_sha256,
                        dtype=torch.float32,
                        delta_chain=delta_chain,
                    )
                )
                return _move_page_bundle_boundary(
                    canonical,
                    device=torch.device("cpu"),
                    dtype=dtype,
                    trainable=False,
                )
        bundle = self._materialize_page_path_boundary(
            resolved_path,
            device=torch.device("cpu"),
            dtype=dtype,
            trainable=False,
            _delta_chain=delta_chain,
        )
        # A file replacement between the first identity check and decoding must
        # fail before its tensors can be retained or used as a delta parent.
        if validated_closure is None:
            self._verify_materialized_object_boundary(
                object_path=resolved_path,
                object_sha256=object_sha256,
            )
        elif (
            self._cached_validated_immutable_page_closure_boundary(
                page_id=validated_closure.child.page_id,
                object_path=resolved_path,
                object_sha256=object_sha256,
                object_bytes=validated_closure.child.object_bytes,
            )
            != validated_closure
        ):
            raise RuntimeError(
                "NoNE semantic closure changed during page materialization"
            )
        self._admit_materialized_cpu_page_boundary(
            object_path=resolved_path,
            object_sha256=object_sha256,
            dtype=dtype,
            bundle=bundle,
        )
        return bundle

    def _record_page_materialization_telemetry_boundary(
        self,
        *,
        page_count: int,
        optimizer_bundle: bool,
        cuda_target: bool,
        authorization_ns: int,
        read_dequant_ns: int,
        compose_ns: int,
        device_transfer_enqueue_ns: int,
    ) -> None:
        """Record one successful exact-route storage operation."""

        if (
            page_count < 1
            or min(
                authorization_ns,
                read_dequant_ns,
                compose_ns,
                device_transfer_enqueue_ns,
            )
            < 0
        ):
            raise RuntimeError("NoNE page materialization timing differs")
        with self._materialization_telemetry_lock:
            self._materialization_request_count += 1
            self._materialization_page_count += page_count
            self._materialization_weights_request_count += int(
                not optimizer_bundle
            )
            self._materialization_optimizer_bundle_request_count += int(
                optimizer_bundle
            )
            self._materialization_cuda_request_count += int(cuda_target)
            self._materialization_authorization_ns += authorization_ns
            self._materialization_read_dequant_ns += read_dequant_ns
            self._materialization_compose_ns += compose_ns
            self._materialization_device_transfer_enqueue_ns += (
                device_transfer_enqueue_ns
            )

    def page_materialization_telemetry_boundary(
        self,
    ) -> NoNEPageMaterializationTelemetryPacket:
        """Return cumulative tensor diagnostics without selecting any page."""

        with self._materialized_cpu_page_cache_lock:
            resident_bytes = self._materialized_cpu_page_cache_bytes
        with self._materialization_telemetry_lock:
            values = (
                self._materialization_request_count,
                self._materialization_page_count,
                self._materialization_weights_request_count,
                self._materialization_optimizer_bundle_request_count,
                self._materialization_cuda_request_count,
                self._materialization_authorization_ns,
                self._materialization_read_dequant_ns,
                self._materialization_compose_ns,
                self._materialization_device_transfer_enqueue_ns,
                self._materialization_cpu_cache_hit_count,
                self._materialization_cpu_cache_miss_count,
                resident_bytes,
                self._materialization_post_accept_cpu_cache_admission_count,
                self._materialization_post_accept_cpu_cache_admission_bytes,
            )
        tensors = tuple(torch.tensor(value, dtype=torch.long) for value in values)
        return NoNEPageMaterializationTelemetryPacket(*tensors)

    def register_overlay_object_roots(
        self,
        roots: tuple[Path, ...],
    ) -> None:
        """Expose additional session-owned immutable object stores in place.

        This explicit I/O boundary changes only where an already-authorized
        object digest may be resolved. It cannot add a page ID to a catalog,
        choose a layer, or advance an accepted generation.
        """

        session_id_t, session_root = self._require_session()
        session_key = _session_key(session_id_t)
        resolved_roots: set[Path] = set(self._object_store_roots)
        for root in roots:
            resolved = root.expanduser().resolve()
            if (
                not (resolved / "objects" / "sha256").is_dir()
                or not (resolved / "sessions" / session_key).is_dir()
            ):
                raise RuntimeError("NoNE overlay object-store identity differs")
            resolved_roots.add(resolved)
        self._object_store_roots = tuple(sorted(resolved_roots, key=str))
        with self._resolved_object_path_cache_lock:
            self._resolved_object_path_cache.clear()

    def register_receipt_verified_overlay_objects_boundary(
        self,
        bindings: tuple[NoNEPageObjectBinding, ...],
    ) -> None:
        """Reuse compact-bank digests after exact path/size identity checks.

        Compact transfer banks are fully hashed before their receipt can pass.
        A successor overlay reuses those immutable, SHA-named objects in place;
        rereading every multi-megabyte tensor would add no new identity evidence.
        Manifest construction still opens each safetensor and validates its page
        identity and geometry through ``_page_object_row_boundary``.
        """

        self._require_session()
        if not bindings:
            raise ValueError("verified overlay registration is empty")
        page_ids: set[int] = set()
        object_digests: set[str] = set()
        for binding in bindings:
            page_id_t = binding.page_id_t.detach().cpu().long().reshape(-1)
            object_bytes_t = binding.object_bytes_t.detach().cpu().long().reshape(-1)
            if page_id_t.numel() != 1 or object_bytes_t.numel() != 1:
                raise RuntimeError("verified overlay object identity is malformed")
            page_id = int(page_id_t[0])
            object_bytes = int(object_bytes_t[0])
            object_sha256 = _tensor_digest_hex(binding.object_sha256_t)
            if (
                page_id in page_ids
                or object_sha256 in object_digests
                or len(object_sha256) != 64
                or object_bytes < 1
            ):
                raise RuntimeError("verified overlay object identity is duplicated")
            try:
                object_path = self._object_path_boundary(
                    object_sha256,
                    expected_bytes=object_bytes,
                )
            except (FileNotFoundError, RuntimeError) as error:
                raise RuntimeError(
                    "verified overlay page object identity differs"
                ) from error
            if object_path.name != f"{object_sha256}.safetensors":
                raise RuntimeError("verified overlay object path is not content-addressed")
            page_ids.add(page_id)
            object_digests.add(object_sha256)
            self._receipt_verified_overlay_objects_boundary[object_sha256] = (
                page_id,
                object_bytes,
            )
        self._verified_objects.update(object_digests)

    def register_overlay_pages(
        self,
        rows: tuple[Mapping[str, object], ...],
    ) -> None:
        """Verify that catalog-admitted overlay object identities are resolvable."""

        observed_page_ids: set[int] = set()
        for row in rows:
            page_id = row.get("pageId")
            object_sha256 = row.get("sha256")
            object_bytes = row.get("bytes")
            if (
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id < 0
                or page_id in observed_page_ids
                or not isinstance(object_sha256, str)
                or len(object_sha256) != 64
                or not isinstance(object_bytes, int)
                or isinstance(object_bytes, bool)
                or object_bytes < 1
            ):
                raise RuntimeError("NoNE overlay page identity differs")
            self._object_path_boundary(
                object_sha256,
                expected_bytes=object_bytes,
            )
            observed_page_ids.add(page_id)

    def _object_path_boundary(
        self,
        object_sha256: str,
        *,
        expected_bytes: int | None = None,
    ) -> Path:
        """Resolve a content object across discovered mounts by exact digest."""

        if len(object_sha256) != 64:
            raise RuntimeError("NoNE page object digest is malformed")
        direct_page_map_active = (
            self._manifest is not None
            and isinstance(
                self._manifest.get("directPageMapAuthority"),
                dict,
            )
        )
        if direct_page_map_active:
            objects_root, _scratch_root = (
                self._validated_page_object_write_roots_boundary()
            )
            direct_path = (
                objects_root / f"{object_sha256}.safetensors"
            )
            try:
                direct_stat = direct_path.stat(follow_symlinks=False)
            except OSError as error:
                raise FileNotFoundError(
                    "NoNE direct-only page object is absent from its "
                    f"accepting store: {object_sha256}"
                ) from error
            if (
                not stat.S_ISREG(direct_stat.st_mode)
                or direct_path.is_symlink()
                or (
                    expected_bytes is not None
                    and direct_stat.st_size != expected_bytes
                )
            ):
                raise RuntimeError(
                    "NoNE direct-only local page object identity differs"
                )
            return direct_path
        cache_key = (object_sha256, expected_bytes)
        with self._resolved_object_path_cache_lock:
            cached_path = self._resolved_object_path_cache.get(cache_key)
        if cached_path is not None:
            try:
                cached_stat = cached_path.stat()
            except OSError:
                cached_stat = None
            if (
                cached_stat is not None
                and stat.S_ISREG(cached_stat.st_mode)
                and (
                    expected_bytes is None
                    or cached_stat.st_size == expected_bytes
                )
            ):
                return cached_path
            with self._resolved_object_path_cache_lock:
                self._resolved_object_path_cache.pop(cache_key, None)
        matches: list[Path] = []
        for root in self._object_store_roots:
            candidate = root / "objects/sha256" / f"{object_sha256}.safetensors"
            try:
                candidate_stat = candidate.stat()
            except OSError:
                continue
            if not stat.S_ISREG(candidate_stat.st_mode):
                continue
            if (
                expected_bytes is not None
                and candidate_stat.st_size != expected_bytes
            ):
                if candidate == self.objects_root / (
                    f"{object_sha256}.safetensors"
                ):
                    raise RuntimeError("accepted NoNE page object hash changed")
                continue
            matches.append(candidate)
        if not matches:
            raise FileNotFoundError(
                f"NoNE page object is absent across discovered stores: {object_sha256}"
            )
        primary = self.objects_root / f"{object_sha256}.safetensors"
        resolved = (
            primary
            if primary in matches
            else min(matches, key=lambda path: str(path))
        )
        with self._resolved_object_path_cache_lock:
            self._resolved_object_path_cache[cache_key] = resolved
        return resolved

    def publish_locator_boundary(
        self,
        *,
        registry_roots: tuple[Path, ...] | None = None,
    ) -> tuple[Path, ...]:
        """Advertise a movable store by session identity, never route policy."""

        self._require_staged_read_only_write_guard_boundary()
        session_id_t, _session_root = self._require_session()
        session_key = _session_key(session_id_t)
        payload = {
            "schema": PAGE_STORE_LOCATOR_SCHEMA,
            "sessionKey": session_key,
            "sessionId": session_id_t.detach().cpu().long().reshape(-1).tolist(),
            "root": str(self.root),
            "pointerRelativePath": f"sessions/{session_key}/accepted.json",
            "objectsRelativePath": "objects/sha256",
            "pointerReadAtUse": True,
            "routingAuthority": False,
        }
        locator_id = hashlib.sha256(str(self.root).encode("utf-8")).hexdigest()
        local_path = (
            self.root
            / ".nnf-resynthesis/page-stores"
            / session_key
            / f"{locator_id}.json"
        )
        roots = (
            (_page_store_registry_root_for_boundary(self.root),)
            if registry_roots is None
            else tuple(root.expanduser().resolve() for root in registry_roots)
        )
        written: list[Path] = []
        for path in (
            local_path,
            *(root / session_key / f"{locator_id}.json" for root in roots),
        ):
            if path not in written:
                _atomic_json(path, payload)
                written.append(path)
        return tuple(written)

    @classmethod
    def discover_from_anchor_boundary(
        cls,
        *,
        anchor_root: Path,
        session_id_t: torch.Tensor,
        expected_pointer: Mapping[str, Any] | None = None,
        candidate_roots: tuple[Path, ...] = (),
        registry_roots: tuple[Path, ...] | None = None,
    ) -> NoNEImmutablePageStore:
        """Resolve one unique accepted lineage across movable page stores."""

        packets = discover_page_store_locators_boundary(
            session_id_t=session_id_t,
            anchor_roots=(anchor_root, *candidate_roots),
            registry_roots=registry_roots,
        )
        accepted = tuple(
            packet for packet in packets if int(packet.generation_t) > 0
        )
        if not accepted:
            raise RuntimeError("NoNE page-store discovery found no accepted pointer")
        session_key = _session_key(session_id_t)
        manifest_index: dict[str, tuple[int, int, str | None]] = {}
        generation_payloads: dict[int, set[str]] = {}
        for packet in packets:
            generations_root = packet.root / "sessions" / session_key / "generations"
            if not generations_root.is_dir():
                continue
            for manifest_path in sorted(generations_root.glob("*/generation.json")):
                lineage = _read_generation_lineage_authority_cached(
                    manifest_path,
                    expected_session_key=session_key,
                )
                payload_sha256 = lineage.manifest_payload_sha256
                generation = lineage.generation
                parent_generation = lineage.parent_generation
                parent_payload_sha256 = (
                    lineage.parent_manifest_payload_sha256
                )
                record = (
                    generation,
                    parent_generation,
                    parent_payload_sha256,
                )
                previous = manifest_index.get(payload_sha256)
                if previous is not None and previous != record:
                    raise RuntimeError("NoNE generation digest has conflicting lineage")
                manifest_index[payload_sha256] = record
                generation_payloads.setdefault(generation, set()).add(
                    payload_sha256
                )

        if expected_pointer is None:
            anchor_generation = min(int(packet.generation_t) for packet in accepted)
            anchor_payloads = {
                _tensor_digest_hex(packet.manifest_payload_sha256_t)
                for packet in accepted
                if int(packet.generation_t) == anchor_generation
            }
            if len(anchor_payloads) != 1:
                raise RuntimeError("NoNE discovered base pointer is ambiguous")
            anchor_payload_sha256 = next(iter(anchor_payloads))
        else:
            anchor_generation_value = expected_pointer.get("generation")
            anchor_payload_value = expected_pointer.get("manifestPayloadSha256")
            if (
                not isinstance(anchor_generation_value, int)
                or isinstance(anchor_generation_value, bool)
                or anchor_generation_value < 1
                or not isinstance(anchor_payload_value, str)
                or len(anchor_payload_value) != 64
            ):
                raise RuntimeError("NoNE discovery anchor pointer is malformed")
            anchor_generation = anchor_generation_value
            anchor_payload_sha256 = anchor_payload_value

        def lineage_to_anchor(payload_sha256: str) -> tuple[str, ...] | None:
            chain: list[str] = []
            current = payload_sha256
            observed: set[str] = set()
            while current not in observed:
                observed.add(current)
                chain.append(current)
                record = manifest_index.get(current)
                if record is None:
                    return None
                generation, parent_generation, parent_payload = record
                if generation == anchor_generation:
                    return tuple(chain) if current == anchor_payload_sha256 else None
                if (
                    generation < anchor_generation
                    or parent_generation >= generation
                ):
                    return None
                if parent_payload is None:
                    # Historical manifests predate the parent-payload field.
                    # Their numeric parent is traversable only when this
                    # session exposes exactly one immutable payload for that
                    # generation; an observed branch is rejected, not guessed.
                    historical_parents = generation_payloads.get(
                        parent_generation,
                        set(),
                    )
                    if len(historical_parents) != 1:
                        return None
                    current = next(iter(historical_parents))
                    continue
                if parent_payload == current:
                    parent_payloads = generation_payloads.get(parent_generation, set())
                    if len(parent_payloads) != 1:
                        return None
                    current = next(iter(parent_payloads))
                    continue
                parent_record = manifest_index.get(parent_payload)
                if parent_record is None or parent_record[0] != parent_generation:
                    return None
                current = parent_payload
            return None

        def lineage_to_root(payload_sha256: str) -> tuple[str, ...] | None:
            chain: list[str] = []
            current = payload_sha256
            observed: set[str] = set()
            while current not in observed:
                observed.add(current)
                chain.append(current)
                record = manifest_index.get(current)
                if record is None:
                    return None
                generation, parent_generation, parent_payload = record
                if parent_generation < 0:
                    return tuple(chain)
                if parent_payload is None:
                    if parent_generation < 1:
                        return tuple(chain)
                    historical_parents = generation_payloads.get(
                        parent_generation,
                        set(),
                    )
                    if len(historical_parents) != 1:
                        return None
                    current = next(iter(historical_parents))
                    continue
                if parent_payload == current:
                    parent_payloads = generation_payloads.get(
                        parent_generation,
                        set(),
                    )
                    if len(parent_payloads) != 1:
                        return None
                    current = next(iter(parent_payloads))
                    continue
                parent_record = manifest_index.get(parent_payload)
                if parent_record is None or parent_record[0] != parent_generation:
                    return None
                current = parent_payload
            return None

        compatible: list[tuple[NoNEPageStoreLocatorPacket, tuple[str, ...]]] = []
        for packet in accepted:
            payload_sha256 = _tensor_digest_hex(
                packet.manifest_payload_sha256_t
            )
            chain = lineage_to_anchor(payload_sha256)
            if chain is not None:
                compatible.append((packet, chain))
        if not compatible:
            fallback_compatible: list[
                tuple[NoNEPageStoreLocatorPacket, tuple[str, ...]]
            ] = []
            for packet in accepted:
                payload_sha256 = _tensor_digest_hex(
                    packet.manifest_payload_sha256_t
                )
                chain = lineage_to_root(payload_sha256)
                if chain is not None:
                    fallback_compatible.append((packet, chain))
            if not fallback_compatible:
                raise RuntimeError("NoNE discovery found no descendant of its anchor")
            compatible = fallback_compatible
        maximum_generation = max(int(packet.generation_t) for packet, _ in compatible)
        latest_payloads = {
            _tensor_digest_hex(packet.manifest_payload_sha256_t)
            for packet, _chain in compatible
            if int(packet.generation_t) == maximum_generation
        }
        if len(latest_payloads) != 1:
            raise RuntimeError("NoNE accepted generation pointers conflict")
        latest_payload = next(iter(latest_payloads))
        latest_chain = next(
            chain
            for packet, chain in compatible
            if _tensor_digest_hex(packet.manifest_payload_sha256_t) == latest_payload
        )
        if any(
            _tensor_digest_hex(packet.manifest_payload_sha256_t) not in latest_chain
            for packet, _chain in compatible
        ):
            raise RuntimeError("NoNE accepted stores expose divergent branches")
        selected = min(
            (
                packet
                for packet, _chain in compatible
                if _tensor_digest_hex(packet.manifest_payload_sha256_t)
                == latest_payload
            ),
            key=lambda packet: (
                packet.root != anchor_root.expanduser().resolve(),
                str(packet.root),
            ),
        )
        store = cls(
            selected.root,
            object_roots=tuple(packet.root for packet in packets),
        )
        store.begin_session(session_id_t)
        return store

    def begin_session(self, session_id_t: torch.Tensor) -> torch.Tensor:
        if self._release_generation_projection is not None:
            return self._begin_release_generation_session_boundary(
                session_id_t
            )
        self._require_staged_read_only_write_guard_boundary()
        if self._pending_compact_objects:
            raise RuntimeError(
                "NoNE page store cannot cross sessions with uncommitted objects"
            )
        placement = self._refresh_page_object_write_placement_boundary()
        if (
            placement is not None
            and placement.session_key != _session_key(session_id_t)
        ):
            raise RuntimeError(
                "NoNE page-object placement crossed session ownership"
            )
        self._clear_materialized_cpu_page_cache_boundary()
        self._clear_validated_immutable_page_closure_cache_boundary()
        self._clear_candidate_page_semantic_witnesses_boundary()
        # A new session may reuse the same numeric ID while pointing at a
        # different store root.  Header proofs are path/inode-bound, so they
        # cannot cross this explicit session boundary.
        with self._validated_page_object_header_cache_lock:
            self._validated_page_object_headers_boundary.clear()
        self._session_id_t = session_id_t.detach().cpu().to(dtype=torch.long).clone()
        self._accepted_pointer_identity_boundary = None
        self._accepted_manifest_identity_boundary = None
        self._accepted_binding_boundary = None
        self._accepted_direct_page_map_payload_sha256_boundary = ""
        self._accepted_direct_page_map_objects_root_identity_boundary = None
        self._accepted_direct_page_pack_file_identities_boundary = None
        self._accepted_direct_page_pack_authority_boundary = None
        self._accepted_direct_page_pack_index_boundary = None
        self._accepted_direct_page_pack_record_boundary = None
        self._read_only_staged_binding = None
        self._read_only_staged_parent_binding = None
        self._read_only_staged_manifest_identity = None
        self._read_only_staged_parent_manifest_identity = None
        self._read_only_staged_parent_pointer_canonical_bytes = None
        self._read_only_staged_parent_pointer_sha256 = None
        self._read_only_staged_graph_authority = None
        self._read_only_staged_graph_authority_record = None
        self._read_only_staged_graph_authority_payload_sha256 = None
        self._staged_immutable_parent_binding = None
        self._staged_immutable_parent_manifest_identity = None
        # Session locators describe immutable object availability, not routing
        # authority.  Include every advertised object root so a generation may
        # reference an already-sealed compact bank in place instead of copying
        # nearly a terabyte into each manifest replica.  Exact digest and byte
        # identity are still checked when an object is materialized.
        _session_id, discovered_roots = _page_store_candidate_roots_boundary(
            session_id_t=self._session_id_t,
            anchor_roots=(self.root,),
        )
        self._object_store_roots = tuple(
            sorted(
                {*self._object_store_roots, *discovered_roots},
                key=str,
            )
        )
        with self._resolved_object_path_cache_lock:
            self._resolved_object_path_cache.clear()
        self._session_root = self.sessions_root / _session_key(session_id_t)
        self._session_root.mkdir(parents=True, exist_ok=True)
        (self._session_root / "generations").mkdir(parents=True, exist_ok=True)
        pointer_path = self._session_root / "accepted.json"
        if not pointer_path.is_file():
            self._accepted_generation_t = torch.zeros((), dtype=torch.long)
            self._manifest = None
            self._graph_authority = None
            self._graph_authority_payload_sha256 = ""
            self._verified_objects.clear()
            self._verified_object_identities_boundary.clear()
            if self._advertise_locator:
                self.publish_locator_boundary()
            return self._accepted_generation_t.clone()
        binding = self.discover_accepted_pointer_boundary()
        if self._advertise_locator:
            self.publish_locator_boundary()
        return binding.generation_t.clone()

    @classmethod
    def open_release_generation_boundary(
        cls,
        *,
        cache_root: Path,
        accepted_pointer_path: Path,
        generation_manifest_path: Path,
        direct_index_path: Path,
        direct_pack_path: Path,
        graph_authority: NoNEGraphAuthorityBinding,
        expected_generation: int,
        expected_manifest_sha256: str,
        expected_manifest_payload_sha256: str,
    ) -> NoNEImmutablePageStore:
        """Open one relocated, immutable generation for public inference.

        The canonical pointer and manifest bytes remain untouched.  Only their
        deployment coordinates are supplied separately, after the release
        manifest has verified each artifact.  No writer, replica, optimizer,
        or continuation authority is created by this boundary.
        """

        unresolved_artifact_paths = (
            accepted_pointer_path.expanduser(),
            generation_manifest_path.expanduser(),
            direct_index_path.expanduser(),
            direct_pack_path.expanduser(),
        )
        if any(
            _unresolved_path_contains_symlink_boundary(path)
            for path in unresolved_artifact_paths
        ):
            raise RuntimeError("NoNE release generation placement is malformed")
        resolved_cache = cache_root.expanduser().resolve()
        (
            resolved_pointer,
            resolved_manifest,
            resolved_index,
            resolved_pack,
        ) = tuple(path.resolve() for path in unresolved_artifact_paths)
        if (
            type(expected_generation) is not int
            or expected_generation < 1
            or not _valid_sha256_boundary(expected_manifest_sha256)
            or not _valid_sha256_boundary(expected_manifest_payload_sha256)
            or any(
                not path.is_file()
                for path in (
                    resolved_pointer,
                    resolved_manifest,
                    resolved_index,
                    resolved_pack,
                )
            )
        ):
            raise RuntimeError("NoNE release generation placement is malformed")
        store = cls(resolved_cache, advertise_locator=False)
        store._release_generation_projection = (
            _NoNEReleaseGenerationProjection(
                accepted_pointer_path=resolved_pointer,
                generation_manifest_path=resolved_manifest,
                direct_index_path=resolved_index,
                direct_pack_path=resolved_pack,
                graph_authority=graph_authority,
                expected_generation=expected_generation,
                expected_manifest_sha256=expected_manifest_sha256,
                expected_manifest_payload_sha256=(
                    expected_manifest_payload_sha256
                ),
            )
        )
        return store

    @staticmethod
    def _release_graph_identity_boundary(
        canonical_record: object,
        relocated: NoNEGraphAuthorityBinding,
    ) -> None:
        """Compare graph content identity while ignoring placement strings."""

        if not isinstance(canonical_record, dict):
            raise RuntimeError("NoNE release graph authority is absent")
        relocated_record = relocated.external_record_boundary()
        for field in (
            "checkpoint",
            "optimizer",
            "externalState",
            "composition",
            "pageCatalog",
            "residentRuntime",
        ):
            canonical_artifact = canonical_record.get(field)
            relocated_artifact = relocated_record.get(field)
            if (
                not isinstance(canonical_artifact, dict)
                or not isinstance(relocated_artifact, dict)
                or canonical_artifact.get("sha256")
                != relocated_artifact.get("sha256")
            ):
                raise RuntimeError(
                    f"NoNE release graph {field} identity differs"
                )
        if canonical_record.get("topology") != relocated_record.get("topology"):
            raise RuntimeError("NoNE release graph topology differs")
        canonical_replica = canonical_record.get("replicaReceipt")
        relocated_replica = relocated_record.get("replicaReceipt")
        if (
            isinstance(canonical_replica, dict)
            and (
                not isinstance(relocated_replica, dict)
                or canonical_replica.get("sha256")
                != relocated_replica.get("sha256")
            )
        ):
            raise RuntimeError("NoNE release graph replica identity differs")

    def _release_direct_pack_boundary(
        self,
        manifest: Mapping[str, Any],
    ) -> tuple[
        DirectPagePackSetAuthorityPacket,
        DirectPagePackIndexPacket,
        dict[str, Any],
    ]:
        projection = self._release_generation_projection
        if projection is None:
            raise RuntimeError("NoNE release generation projection is absent")
        record = manifest.get("directPagePackSetAuthority")
        if (
            not isinstance(record, dict)
            or record.get("schema")
            != DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA
        ):
            raise RuntimeError("NoNE release direct pack authority differs")
        index_record = record.get("index")
        shard_records = record.get("shards")
        if (
            not isinstance(index_record, dict)
            or not isinstance(shard_records, list)
            or len(shard_records) != 1
            or not isinstance(shard_records[0], dict)
        ):
            raise RuntimeError("NoNE release direct pack topology differs")
        shard_record = shard_records[0]
        index_sha256 = index_record.get("sha256")
        shard_sha256 = shard_record.get("sha256")
        index_bytes = index_record.get("bytes")
        shard_bytes = shard_record.get("bytes")
        if (
            not _valid_sha256_boundary(index_sha256)
            or not _valid_sha256_boundary(shard_sha256)
            or type(index_bytes) is not int
            or type(shard_bytes) is not int
            or projection.direct_index_path.stat().st_size != index_bytes
            or projection.direct_pack_path.stat().st_size != shard_bytes
            or _file_sha256(projection.direct_index_path)
            != index_sha256
        ):
            raise RuntimeError("NoNE release direct pack file identity differs")
        authority = DirectPagePackSetAuthorityPacket(
            shard_roots=(projection.direct_pack_path.parent,),
            shard_relative_paths=(projection.direct_pack_path.name,),
            index_root=projection.direct_index_path.parent,
            index_relative_path=projection.direct_index_path.name,
            shard_sha256s_t=torch.stack(
                (digest_tensor(cast(str, shard_sha256)),)
            ),
            index_sha256_t=digest_tensor(cast(str, index_sha256)),
            shard_bytes_t=torch.tensor(
                (shard_bytes,),
                dtype=torch.long,
            ),
            index_bytes_t=torch.tensor(
                index_bytes,
                dtype=torch.long,
            ),
            logical_object_bytes_t=torch.tensor(
                cast(int, record["logicalObjectBytes"]),
                dtype=torch.long,
            ),
            page_count_t=torch.tensor(
                cast(int, record["pageCount"]),
                dtype=torch.long,
            ),
            alignment_bytes_t=torch.tensor(
                cast(int, record["alignmentBytes"]),
                dtype=torch.long,
            ),
            page_ids_sha256_t=digest_tensor(
                cast(str, record["pageIdsSha256"])
            ),
            page_map_sha256_t=digest_tensor(
                cast(str, record["pageMapSha256"])
            ),
            pack_set_sha256_t=digest_tensor(
                cast(str, record["packSetSha256"])
            ),
        )
        index = load_direct_page_pack_index_boundary(authority)
        validated = validate_direct_page_pack_set_authority_boundary(
            authority,
            index=index,
        )
        manifest_page_ids_t = self._manifest_page_ids_t_boundary(manifest)
        if (
            not torch.equal(index.page_ids_t, manifest_page_ids_t)
            or int(validated.page_ids_t.numel()) != record.get("pageCount")
            or _tensor_digest_hex(validated.page_ids_sha256_t)
            != record.get("pageIdsSha256")
            or _tensor_digest_hex(validated.page_map_sha256_t)
            != record.get("pageMapSha256")
            or _tensor_digest_hex(validated.pack_set_sha256_t)
            != record.get("packSetSha256")
        ):
            raise RuntimeError("NoNE release direct pack content differs")
        return authority, index, dict(record)

    def _begin_release_generation_session_boundary(
        self,
        session_id_t: torch.Tensor,
    ) -> torch.Tensor:
        """Bind the public release without creating mutable store authority."""

        projection = self._release_generation_projection
        if projection is None:
            raise RuntimeError("NoNE release generation projection is absent")
        requested = session_id_t.detach().cpu().long().reshape(-1)
        if (
            self._session_id_t is not None
            and torch.equal(self._session_id_t.reshape(-1), requested)
            and self._accepted_binding_boundary is not None
        ):
            return self.discover_accepted_pointer_boundary().generation_t.clone()
        if requested.numel() < 1:
            raise RuntimeError("NoNE release session identity is malformed")
        self._clear_materialized_cpu_page_cache_boundary()
        self._clear_validated_immutable_page_closure_cache_boundary()
        self._clear_candidate_page_semantic_witnesses_boundary()
        self._session_id_t = requested.clone()
        self._session_root = projection.accepted_pointer_path.parent
        self._accepted_binding_boundary = None
        self._manifest = None
        self._graph_authority = None
        self._clear_accepted_direct_page_map_cache_boundary()
        return self.discover_accepted_pointer_boundary().generation_t.clone()

    def _discover_release_generation_boundary(
        self,
    ) -> NoNEGenerationBinding:
        """Revalidate the exact immutable files and return their cached bind."""

        projection = self._release_generation_projection
        session_id_t, _session_root = self._require_session()
        if projection is None:
            raise RuntimeError("NoNE release generation projection is absent")
        pointer_identity = _file_identity(projection.accepted_pointer_path)
        manifest_identity = _file_identity(projection.generation_manifest_path)
        cached = self._accepted_binding_boundary
        if (
            cached is not None
            and self._accepted_pointer_identity_boundary == pointer_identity
            and self._accepted_manifest_identity_boundary == manifest_identity
            and self._accepted_direct_page_pack_file_identities_boundary
            is not None
            and all(
                _file_identity(path) == identity
                for path, identity in (
                    self._accepted_direct_page_pack_file_identities_boundary
                )
            )
        ):
            return cached
        pointer = _visible_accepted_pointer_record_boundary(
            projection.accepted_pointer_path
        )
        pointer_graph = pointer.get("graphAuthority")
        pointer_graph_sha256 = pointer.get("graphAuthorityPayloadSha256")
        if (
            pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA
            or pointer.get("sessionKey") != _session_key(session_id_t)
            or pointer.get("generation") != projection.expected_generation
            or pointer.get("manifestSha256")
            != projection.expected_manifest_sha256
            or pointer.get("manifestPayloadSha256")
            != projection.expected_manifest_payload_sha256
            or not isinstance(pointer_graph, dict)
            or not _valid_sha256_boundary(pointer_graph_sha256)
            or hashlib.sha256(
                _canonical_json_bytes(pointer_graph)
            ).hexdigest()
            != pointer_graph_sha256
        ):
            raise RuntimeError("NoNE release accepted pointer differs")
        self._release_graph_identity_boundary(
            pointer_graph,
            projection.graph_authority,
        )
        (
            manifest_sha256,
            manifest,
            payload_sha256,
            _page_rows,
        ) = _read_generation_manifest_authority_cached(
            projection.generation_manifest_path
        )
        if (
            manifest_sha256 != projection.expected_manifest_sha256
            or payload_sha256
            != projection.expected_manifest_payload_sha256
            or manifest.get("generation") != projection.expected_generation
            or manifest.get("sessionKey") != _session_key(session_id_t)
        ):
            raise RuntimeError("NoNE release generation manifest differs")
        updated_page_ids = manifest.get("updatedPageIds")
        parent_generation = manifest.get("parentGeneration")
        if (
            type(parent_generation) is not int
            or not isinstance(updated_page_ids, list)
            or any(type(page_id) is not int for page_id in updated_page_ids)
        ):
            raise RuntimeError("NoNE release generation binding differs")
        binding = NoNEGenerationBinding(
            session_id_t=session_id_t.clone(),
            generation_t=torch.tensor(
                projection.expected_generation,
                dtype=torch.long,
            ),
            parent_generation_t=torch.tensor(
                parent_generation,
                dtype=torch.long,
            ),
            manifest_sha256_t=digest_tensor(manifest_sha256),
            manifest_payload_sha256_t=digest_tensor(payload_sha256),
            updated_page_ids_t=torch.tensor(
                updated_page_ids,
                dtype=torch.long,
            ),
            manifest_relative_path=projection.generation_manifest_path.name,
        )
        pack_authority, pack_index, pack_record = (
            self._release_direct_pack_boundary(manifest)
        )
        self._accepted_generation_t = binding.generation_t.clone()
        self._manifest = manifest
        self._graph_authority = projection.graph_authority
        self._graph_authority_payload_sha256 = cast(
            str,
            pointer_graph_sha256,
        )
        self._accepted_pointer_identity_boundary = pointer_identity
        self._accepted_manifest_identity_boundary = manifest_identity
        self._accepted_binding_boundary = binding
        self._accepted_direct_page_map_payload_sha256_boundary = payload_sha256
        self._accepted_direct_page_map_objects_root_identity_boundary = (
            _file_identity(self.objects_root)
        )
        self._accepted_direct_page_pack_authority_boundary = pack_authority
        self._accepted_direct_page_pack_index_boundary = pack_index
        self._accepted_direct_page_pack_record_boundary = pack_record
        self._accepted_direct_page_pack_file_identities_boundary = (
            (
                projection.direct_index_path,
                _file_identity(projection.direct_index_path),
            ),
            (
                projection.direct_pack_path,
                _file_identity(projection.direct_pack_path),
            ),
        )
        self._page_index_manifest_boundary = None
        self._page_index_cache_boundary = None
        return binding

    def begin_existing_session_generation_boundary(
        self,
        session_id_t: torch.Tensor,
    ) -> NoNEGenerationBinding:
        """Bind an existing manifest generation without rebuilding its graph.

        Graph-authority validation uses this boundary when a retained branch
        sidecar refers to the branch store currently being validated.  Loading
        that store's graph again would recursively validate the same sidecar.
        The immutable pointer and manifest chain remain fully verified here;
        executable graph authority is still verified by the outer boundary.
        """

        self._require_staged_read_only_write_guard_boundary()
        if self._pending_compact_objects:
            raise RuntimeError(
                "NoNE page store cannot cross sessions with uncommitted objects"
            )
        placement = self._refresh_page_object_write_placement_boundary()
        if (
            placement is not None
            and placement.session_key != _session_key(session_id_t)
        ):
            raise RuntimeError(
                "NoNE page-object placement crossed session ownership"
            )
        self._clear_materialized_cpu_page_cache_boundary()
        self._clear_validated_immutable_page_closure_cache_boundary()
        self._clear_candidate_page_semantic_witnesses_boundary()
        self._session_id_t = (
            session_id_t.detach().cpu().to(dtype=torch.long).clone()
        )
        self._accepted_pointer_identity_boundary = None
        self._accepted_manifest_identity_boundary = None
        self._accepted_binding_boundary = None
        self._accepted_direct_page_map_payload_sha256_boundary = ""
        self._accepted_direct_page_map_objects_root_identity_boundary = None
        self._accepted_direct_page_pack_file_identities_boundary = None
        self._accepted_direct_page_pack_authority_boundary = None
        self._accepted_direct_page_pack_index_boundary = None
        self._accepted_direct_page_pack_record_boundary = None
        self._read_only_staged_binding = None
        self._read_only_staged_parent_binding = None
        self._read_only_staged_manifest_identity = None
        self._read_only_staged_parent_manifest_identity = None
        self._read_only_staged_parent_pointer_canonical_bytes = None
        self._read_only_staged_parent_pointer_sha256 = None
        self._read_only_staged_graph_authority = None
        self._read_only_staged_graph_authority_record = None
        self._read_only_staged_graph_authority_payload_sha256 = None
        self._staged_immutable_parent_binding = None
        self._staged_immutable_parent_manifest_identity = None
        self._session_root = self.sessions_root / _session_key(session_id_t)
        pointer_path = self._session_root / "accepted.json"
        if not self._session_root.is_dir() or not pointer_path.is_file():
            raise RuntimeError("NoNE existing session generation is missing")
        binding, manifest = self._live_accepted_binding_boundary()
        self._validate_direct_page_map_frontier_transition_boundary(
            generation_binding=binding,
            generation_manifest=manifest,
        )
        self._validate_and_cache_accepted_direct_page_map_boundary(
            generation_binding=binding,
            generation_manifest=manifest,
        )
        self._accepted_generation_t = (
            binding.generation_t.detach().cpu().long().reshape(())
        )
        # This boundary deliberately verifies only pointer -> manifest lineage.
        # Do not mark the mutable pointer as fully discovered: its executable
        # graph-authority packet has not been rebuilt yet.  The next ordinary
        # discovery (including ``current_graph_authority_boundary``) must cross
        # the graph-authority loader instead of returning the manifest-only
        # cache entry.
        self._accepted_pointer_identity_boundary = None
        self._accepted_manifest_identity_boundary = _file_identity(
            (self._session_root / binding.manifest_relative_path).resolve()
        )
        self._accepted_binding_boundary = binding
        self._manifest = manifest
        self._graph_authority = None
        self._graph_authority_payload_sha256 = ""
        self._verified_objects.clear()
        self._verified_object_identities_boundary.clear()
        return binding

    def _canonical_live_accepted_pointer_boundary(self) -> tuple[bytes, str]:
        """Return stable canonical bytes for the exact live accepted pointer."""

        _session_id_t, session_root = self._require_session()
        pointer_path = (session_root / "accepted.json").resolve()
        if (
            not pointer_path.is_relative_to(session_root.resolve())
            or pointer_path.name != "accepted.json"
            or not pointer_path.is_file()
        ):
            raise RuntimeError("NoNE live accepted pointer is missing")
        identity_before = _file_identity(pointer_path)
        pointer = _visible_accepted_pointer_record_boundary(pointer_path)
        canonical = _canonical_json_bytes(pointer)
        identity_after = _file_identity(pointer_path)
        if identity_after != identity_before:
            rewritten = _visible_accepted_pointer_record_boundary(
                pointer_path
            )
            rewritten_canonical = _canonical_json_bytes(rewritten)
            if (
                _file_identity(pointer_path) != identity_after
                or rewritten_canonical != canonical
            ):
                raise RuntimeError(
                    "NoNE accepted pointer changed during canonical read"
                )
            canonical = rewritten_canonical
        return canonical, hashlib.sha256(canonical).hexdigest()

    def _load_exact_staged_graph_authority_boundary(
        self,
        *,
        binding: NoNEGenerationBinding,
        manifest: Mapping[str, Any],
        graph_authority: NoNEGraphAuthorityBinding,
    ) -> NoNEGraphAuthorityBinding:
        """Cold-rebuild one graph whose sidecar names the exact candidate."""

        record = graph_authority.external_record_boundary()
        external_record = record.get("externalState")
        if not isinstance(external_record, dict):
            raise RuntimeError("NoNE staged read-only graph sidecar is absent")
        external_path_value = external_record.get("path")
        external_sha256 = external_record.get("sha256")
        if (
            not isinstance(external_path_value, str)
            or not external_path_value
            or not isinstance(external_sha256, str)
            or len(external_sha256) != 64
        ):
            raise RuntimeError("NoNE staged read-only graph sidecar is malformed")
        external_path = Path(external_path_value).expanduser().resolve()
        _session_id_t, session_root = self._require_session()
        if (
            not external_path.is_file()
            or _file_sha256(
                external_path,
                expected_sha256=external_sha256,
                identity_cache_root=(
                    self._runtime_cache_root_boundary()
                    / "artifact_sha256_cache"
                ),
            )
            != external_sha256
        ):
            raise RuntimeError(
                "NoNE staged read-only graph sidecar identity differs"
            )
        external_envelope = _read_json(external_path)
        external_state = external_envelope.get("externalState")
        if (
            not isinstance(external_state, dict)
            or external_state.get("generationBinding")
            != binding.external_record_boundary()
        ):
            raise RuntimeError(
                "NoNE staged read-only graph sidecar generation differs"
            )
        verified = self._load_graph_authority_record_boundary(
            binding,
            manifest,
            record,
        )
        if verified.external_record_boundary() != record:
            raise RuntimeError(
                "NoNE staged read-only graph authority changed during load"
            )
        return verified

    def begin_staged_generation_read_only_boundary(
        self,
        session_id_t: torch.Tensor,
        binding: NoNEGenerationBinding,
        *,
        graph_authority: NoNEGraphAuthorityBinding,
    ) -> NoNEGenerationBinding:
        """Bind one complete direct candidate without advancing its pointer.

        This is the pre-accept cold-proof view for a reconciled all-knowledge
        generation.  It is available only on an undiscoverable store instance,
        remains anchored to the exact live accepted parent, and rejects every
        write boundary.  The staged manifest must be a complete revision
        2/3/7 direct page-map rewrite, so no historical revision-6 delta or
        dependency can become the cold-loaded candidate authority.
        """

        if self._advertise_locator:
            raise RuntimeError(
                "NoNE staged read-only view must not advertise discovery"
            )
        if not isinstance(binding, NoNEGenerationBinding):
            raise TypeError("NoNE staged read-only generation is malformed")
        if not isinstance(graph_authority, NoNEGraphAuthorityBinding):
            raise TypeError("NoNE staged read-only graph authority is malformed")
        if self._read_only_staged_binding is not None:
            active_session_id_t, _session_root = self._require_session()
            active_graph_record = (
                self._read_only_staged_graph_authority_record
            )
            if (
                not torch.equal(
                    active_session_id_t.detach().cpu().long(),
                    session_id_t.detach().cpu().long(),
                )
                or not _same_generation_binding_boundary(
                    self._read_only_staged_binding,
                    binding,
                )
                or active_graph_record
                != graph_authority.external_record_boundary()
            ):
                raise RuntimeError(
                    "NoNE staged read-only rebind authority differs"
                )
            verified = self._verify_staged_generation_read_only_boundary()
            if verified is None:
                raise RuntimeError(
                    "NoNE staged read-only rebind authority is absent"
                )
            return verified
        self.begin_session(session_id_t)
        parent_pointer_bytes_before, parent_pointer_sha256_before = (
            self._canonical_live_accepted_pointer_boundary()
        )
        parent = self.discover_accepted_pointer_boundary()
        parent_page_ids_t = self.accepted_page_ids_t_boundary()
        parent_pointer_bytes_after, parent_pointer_sha256_after = (
            self._canonical_live_accepted_pointer_boundary()
        )
        if (
            parent_pointer_bytes_after != parent_pointer_bytes_before
            or parent_pointer_sha256_after != parent_pointer_sha256_before
        ):
            raise RuntimeError(
                "NoNE staged read-only parent changed during binding"
            )
        loaded, manifest = self._load_generation_binding_boundary(
            binding.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                binding.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        )
        page_rows_value = manifest.get("pageObjects")
        page_rows = (
            sorted(
                (
                    row
                    for row in page_rows_value
                    if isinstance(row, dict)
                    and isinstance(row.get("pageId"), int)
                    and not isinstance(row.get("pageId"), bool)
                ),
                key=lambda row: int(row["pageId"]),
            )
            if isinstance(page_rows_value, list)
            else []
        )
        page_ids_t = torch.tensor(
            [int(row["pageId"]) for row in page_rows],
            dtype=torch.long,
        )
        if (
            not _same_generation_binding_boundary(loaded, binding)
            or not torch.equal(loaded.session_id_t, parent.session_id_t)
            or int(loaded.generation_t) != int(parent.generation_t) + 1
            or not torch.equal(
                loaded.parent_generation_t.reshape(()),
                parent.generation_t.reshape(()),
            )
            or manifest.get("parentManifestPayloadSha256")
            != _tensor_digest_hex(parent.manifest_payload_sha256_t)
            or manifest.get("pageCount") != len(page_rows)
            or not page_rows
            or len(page_rows) != len(cast(list[object], page_rows_value))
            or torch.unique(page_ids_t).numel() != page_ids_t.numel()
            or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
            or not torch.equal(
                page_ids_t,
                torch.sort(
                    parent_page_ids_t.detach().cpu().long().reshape(-1)
                ).values,
            )
            or not torch.equal(
                loaded.updated_page_ids_t.detach().cpu().long(),
                page_ids_t,
            )
        ):
            raise RuntimeError(
                "NoNE staged read-only generation is not one complete "
                "direct parent transition"
            )
        verified_graph_authority = (
            self._load_exact_staged_graph_authority_boundary(
                binding=loaded,
                manifest=manifest,
                graph_authority=graph_authority,
            )
        )
        graph_authority_record = (
            verified_graph_authority.external_record_boundary()
        )
        graph_authority_payload_sha256 = hashlib.sha256(
            _canonical_json_bytes(graph_authority_record)
        ).hexdigest()
        prior_manifest = self._manifest
        prior_generation_t = self._accepted_generation_t
        prior_binding = self._accepted_binding_boundary
        prior_manifest_identity = self._accepted_manifest_identity_boundary
        prior_graph_authority = self._graph_authority
        prior_graph_authority_payload_sha256 = (
            self._graph_authority_payload_sha256
        )
        self._manifest = manifest
        self._accepted_generation_t = (
            loaded.generation_t.detach().cpu().long().reshape(())
        )
        self._accepted_binding_boundary = loaded
        self._accepted_manifest_identity_boundary = _file_identity(
            (
                cast(Path, self._session_root)
                / loaded.manifest_relative_path
            ).resolve()
        )
        self._graph_authority = verified_graph_authority
        self._graph_authority_payload_sha256 = (
            graph_authority_payload_sha256
        )
        self._page_index_manifest_boundary = None
        self._page_index_cache_boundary = None
        try:
            self._require_complete_local_direct_page_map_boundary(
                generation_binding=loaded,
                generation_manifest=manifest,
                expected_page_ids_t=parent_page_ids_t,
            )
        except Exception:
            self._manifest = prior_manifest
            self._accepted_generation_t = prior_generation_t
            self._accepted_binding_boundary = prior_binding
            self._accepted_manifest_identity_boundary = prior_manifest_identity
            self._graph_authority = prior_graph_authority
            self._graph_authority_payload_sha256 = (
                prior_graph_authority_payload_sha256
            )
            self._page_index_manifest_boundary = None
            self._page_index_cache_boundary = None
            raise
        self._read_only_staged_binding = loaded
        self._read_only_staged_parent_binding = parent
        self._read_only_staged_manifest_identity = (
            self._accepted_manifest_identity_boundary
        )
        self._read_only_staged_parent_manifest_identity = _file_identity(
            (
                cast(Path, self._session_root)
                / parent.manifest_relative_path
            ).resolve()
        )
        self._read_only_staged_parent_pointer_canonical_bytes = (
            parent_pointer_bytes_after
        )
        self._read_only_staged_parent_pointer_sha256 = (
            parent_pointer_sha256_after
        )
        self._read_only_staged_graph_authority = verified_graph_authority
        self._read_only_staged_graph_authority_record = (
            graph_authority_record
        )
        self._read_only_staged_graph_authority_payload_sha256 = (
            graph_authority_payload_sha256
        )
        return loaded

    def begin_staged_generation_from_immutable_parent_read_only_boundary(
        self,
        session_id_t: torch.Tensor,
        binding: NoNEGenerationBinding,
        *,
        immutable_parent: NoNEGenerationBinding,
        graph_authority: NoNEGraphAuthorityBinding,
    ) -> NoNEGenerationBinding:
        """Cold-bind a direct candidate whose destination has no parent pointer.

        Offline reconciliation copies the exact immutable parent manifest chain
        for lineage verification, but it must never make a historical rev6 or
        overlay-backed parent the accepted authority of the final store.  This
        boundary verifies that immutable parent, the complete next-generation
        direct page map, and its executable graph while ``accepted.json`` is
        absent.  Every write boundary remains disabled until a separate explicit
        acceptance transaction publishes the already-proven direct generation.
        """

        if self._advertise_locator:
            raise RuntimeError(
                "NoNE staged read-only view must not advertise discovery"
            )
        if not isinstance(binding, NoNEGenerationBinding):
            raise TypeError("NoNE staged read-only generation is malformed")
        if not isinstance(immutable_parent, NoNEGenerationBinding):
            raise TypeError("NoNE immutable staged parent is malformed")
        if not isinstance(graph_authority, NoNEGraphAuthorityBinding):
            raise TypeError("NoNE staged read-only graph authority is malformed")
        if self._read_only_staged_binding is not None:
            active_session_id_t, _session_root = self._require_session()
            if (
                not torch.equal(
                    active_session_id_t.detach().cpu().long(),
                    session_id_t.detach().cpu().long(),
                )
                or not _same_generation_binding_boundary(
                    self._read_only_staged_binding,
                    binding,
                )
                or self._read_only_staged_parent_binding is None
                or not _same_generation_binding_boundary(
                    self._read_only_staged_parent_binding,
                    immutable_parent,
                )
                or self._read_only_staged_graph_authority_record
                != graph_authority.external_record_boundary()
            ):
                raise RuntimeError(
                    "NoNE staged read-only rebind authority differs"
                )
            verified = self._verify_staged_generation_read_only_boundary()
            if verified is None:
                raise RuntimeError(
                    "NoNE staged read-only rebind authority is absent"
                )
            return verified

        self.begin_session(session_id_t)
        _active_session_id_t, session_root = self._require_session()
        if (session_root / "accepted.json").exists():
            raise RuntimeError(
                "NoNE immutable-parent staged view found accepted authority"
            )
        parent, parent_manifest = self._load_generation_binding_boundary(
            immutable_parent.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                immutable_parent.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                immutable_parent.manifest_payload_sha256_t
            ),
        )
        loaded, manifest = self._load_generation_binding_boundary(
            binding.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                binding.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        )
        parent_page_ids_t = self._manifest_page_ids_t_boundary(
            parent_manifest
        )
        page_rows_value = manifest.get("pageObjects")
        page_rows = (
            sorted(
                (
                    row
                    for row in page_rows_value
                    if isinstance(row, dict)
                    and isinstance(row.get("pageId"), int)
                    and not isinstance(row.get("pageId"), bool)
                ),
                key=lambda row: int(row["pageId"]),
            )
            if isinstance(page_rows_value, list)
            else []
        )
        page_ids_t = torch.tensor(
            [int(row["pageId"]) for row in page_rows],
            dtype=torch.long,
        )
        if (
            not _same_generation_binding_boundary(parent, immutable_parent)
            or not _same_generation_binding_boundary(loaded, binding)
            or not torch.equal(parent.session_id_t, loaded.session_id_t)
            or int(loaded.generation_t) != int(parent.generation_t) + 1
            or not torch.equal(
                loaded.parent_generation_t.reshape(()),
                parent.generation_t.reshape(()),
            )
            or manifest.get("parentManifestPayloadSha256")
            != _tensor_digest_hex(parent.manifest_payload_sha256_t)
            or manifest.get("pageCount") != len(page_rows)
            or not page_rows
            or len(page_rows) != len(cast(list[object], page_rows_value))
            or torch.unique(page_ids_t).numel() != page_ids_t.numel()
            or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
            or not torch.equal(
                page_ids_t,
                torch.sort(
                    parent_page_ids_t.detach().cpu().long().reshape(-1)
                ).values,
            )
            or not torch.equal(
                loaded.updated_page_ids_t.detach().cpu().long(),
                page_ids_t,
            )
        ):
            raise RuntimeError(
                "NoNE immutable-parent staged generation is not one complete "
                "direct transition"
            )
        verified_graph_authority = (
            self._load_exact_staged_graph_authority_boundary(
                binding=loaded,
                manifest=manifest,
                graph_authority=graph_authority,
            )
        )
        graph_authority_record = (
            verified_graph_authority.external_record_boundary()
        )
        graph_authority_payload_sha256 = hashlib.sha256(
            _canonical_json_bytes(graph_authority_record)
        ).hexdigest()
        self._manifest = manifest
        self._accepted_generation_t = (
            loaded.generation_t.detach().cpu().long().reshape(())
        )
        self._accepted_binding_boundary = loaded
        self._accepted_manifest_identity_boundary = _file_identity(
            (session_root / loaded.manifest_relative_path).resolve()
        )
        self._graph_authority = verified_graph_authority
        self._graph_authority_payload_sha256 = (
            graph_authority_payload_sha256
        )
        self._page_index_manifest_boundary = None
        self._page_index_cache_boundary = None
        self._require_complete_local_direct_page_map_boundary(
            generation_binding=loaded,
            generation_manifest=manifest,
            expected_page_ids_t=parent_page_ids_t,
        )
        self._read_only_staged_binding = loaded
        self._read_only_staged_parent_binding = parent
        self._read_only_staged_manifest_identity = (
            self._accepted_manifest_identity_boundary
        )
        self._read_only_staged_parent_manifest_identity = _file_identity(
            (session_root / parent.manifest_relative_path).resolve()
        )
        self._read_only_staged_parent_pointer_canonical_bytes = None
        self._read_only_staged_parent_pointer_sha256 = None
        self._read_only_staged_graph_authority = verified_graph_authority
        self._read_only_staged_graph_authority_record = (
            graph_authority_record
        )
        self._read_only_staged_graph_authority_payload_sha256 = (
            graph_authority_payload_sha256
        )
        return loaded

    def _verify_staged_generation_read_only_boundary(
        self,
    ) -> NoNEGenerationBinding | None:
        """Revalidate the exact pointerless graph against its exact parent."""

        binding = self._read_only_staged_binding
        parent = self._read_only_staged_parent_binding
        manifest_identity = self._read_only_staged_manifest_identity
        parent_manifest_identity = (
            self._read_only_staged_parent_manifest_identity
        )
        parent_pointer_bytes = (
            self._read_only_staged_parent_pointer_canonical_bytes
        )
        parent_pointer_sha256 = (
            self._read_only_staged_parent_pointer_sha256
        )
        graph_authority = self._read_only_staged_graph_authority
        graph_authority_record = (
            self._read_only_staged_graph_authority_record
        )
        graph_authority_payload_sha256 = (
            self._read_only_staged_graph_authority_payload_sha256
        )
        if binding is None:
            return None
        if (
            parent is None
            or manifest_identity is None
            or parent_manifest_identity is None
            or graph_authority is None
            or graph_authority_record is None
            or graph_authority_payload_sha256 is None
        ):
            raise RuntimeError("NoNE staged read-only authority is incomplete")
        _session_id_t, session_root = self._require_session()
        pointer_path = session_root / "accepted.json"
        if parent_pointer_bytes is None and parent_pointer_sha256 is None:
            if pointer_path.exists():
                raise RuntimeError(
                    "NoNE staged read-only parent or manifest changed"
                )
            live_parent, parent_manifest = (
                self._load_generation_binding_boundary(
                    parent.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        parent.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        parent.manifest_payload_sha256_t
                    ),
                )
            )
            live_parent_pointer_bytes = None
            live_parent_pointer_sha256 = None
        elif (
            parent_pointer_bytes is not None
            and parent_pointer_sha256 is not None
        ):
            (
                live_parent_pointer_bytes,
                live_parent_pointer_sha256,
            ) = self._canonical_live_accepted_pointer_boundary()
            live_parent, parent_manifest = (
                self._live_accepted_binding_boundary()
            )
        else:
            raise RuntimeError(
                "NoNE staged read-only authority is incomplete"
            )
        loaded, manifest = self._load_generation_binding_boundary(
            binding.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                binding.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        )
        manifest_path = (
            cast(Path, self._session_root)
            / binding.manifest_relative_path
        ).resolve()
        verified_graph_authority = (
            self._load_exact_staged_graph_authority_boundary(
                binding=loaded,
                manifest=manifest,
                graph_authority=graph_authority,
            )
        )
        verified_graph_authority_record = (
            verified_graph_authority.external_record_boundary()
        )
        if (
            live_parent_pointer_bytes != parent_pointer_bytes
            or live_parent_pointer_sha256 != parent_pointer_sha256
            or not _same_generation_binding_boundary(live_parent, parent)
            or _file_identity(
                (
                    session_root / parent.manifest_relative_path
                ).resolve()
            )
            != parent_manifest_identity
            or not _same_generation_binding_boundary(loaded, binding)
            or _file_identity(manifest_path) != manifest_identity
            or verified_graph_authority_record != graph_authority_record
            or hashlib.sha256(
                _canonical_json_bytes(verified_graph_authority_record)
            ).hexdigest()
            != graph_authority_payload_sha256
        ):
            raise RuntimeError(
                "NoNE staged read-only parent or manifest changed"
            )
        self._require_complete_local_direct_page_map_boundary(
            generation_binding=loaded,
            generation_manifest=manifest,
            expected_page_ids_t=(
                self._manifest_page_ids_t_boundary(parent_manifest)
            ),
        )
        self._manifest = manifest
        self._accepted_generation_t = (
            binding.generation_t.detach().cpu().long().reshape(())
        )
        self._accepted_binding_boundary = binding
        self._accepted_manifest_identity_boundary = manifest_identity
        self._graph_authority = verified_graph_authority
        self._graph_authority_payload_sha256 = (
            graph_authority_payload_sha256
        )
        return binding

    def _live_accepted_binding_boundary(
        self,
    ) -> tuple[NoNEGenerationBinding, dict[str, Any]]:
        """Read and verify the current pointer without mutating cached authority."""

        session_id_t, session_root = self._require_session()
        pointer_path = session_root / "accepted.json"
        if not pointer_path.is_file():
            raise RuntimeError("NoNE live accepted pointer is missing")
        pointer = _visible_accepted_pointer_record_boundary(pointer_path)
        if pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA:
            raise RuntimeError("NoNE accepted pointer schema mismatch")
        if pointer.get("sessionKey") != _session_key(session_id_t):
            raise RuntimeError("NoNE accepted pointer crossed session ownership")
        self._validate_page_object_placement_pointer_boundary(pointer)
        binding, manifest = self._load_generation_binding_boundary(
            str(pointer.get("manifest", "")),
            expected_manifest_sha256=str(pointer.get("manifestSha256", "")),
            expected_payload_sha256=str(
                pointer.get("manifestPayloadSha256", "")
            ),
        )
        if int(binding.generation_t) != pointer.get("generation"):
            raise RuntimeError("NoNE accepted generation number mismatch")
        return binding, manifest

    def accepted_generation_t(self) -> torch.Tensor:
        """Return the generation admitted for the currently loaded graph.

        An unbound store follows the mutable pointer for filesystem discovery.
        Once a caller supplies resident graph page identities, only the
        graph-aware refresh boundary may advance this cached generation.
        """

        _session_id_t, session_root = self._require_session()
        if not (session_root / "accepted.json").is_file():
            if self._manifest is not None or not torch.equal(
                self._accepted_generation_t,
                torch.zeros_like(self._accepted_generation_t),
            ):
                raise RuntimeError("NoNE accepted pointer disappeared")
            return self._accepted_generation_t.clone()
        if self._resident_page_ids_t is not None:
            return self._accepted_generation_t.clone()
        return self.discover_accepted_pointer_boundary().generation_t.clone()

    @staticmethod
    def _manifest_page_ids_t_boundary(
        manifest: Mapping[str, Any],
    ) -> torch.Tensor:
        raw_rows = manifest.get("pageObjects")
        page_count = manifest.get("pageCount")
        if not isinstance(raw_rows, list) or not isinstance(page_count, int):
            raise RuntimeError("NoNE accepted page catalog is malformed")
        page_ids: list[int] = []
        for row in raw_rows:
            if (
                not isinstance(row, dict)
                or not isinstance(row.get("pageId"), int)
                or isinstance(row.get("pageId"), bool)
            ):
                raise RuntimeError("NoNE accepted page identity is malformed")
            page_ids.append(int(row["pageId"]))
        page_ids_t = torch.tensor(page_ids, dtype=torch.long)
        if (
            page_count != len(page_ids)
            or page_ids_t.numel() < 1
            or torch.unique(page_ids_t).numel() != page_ids_t.numel()
        ):
            raise RuntimeError("NoNE accepted page identities are not unique")
        return torch.sort(page_ids_t).values

    def accepted_page_ids_t_boundary(self) -> torch.Tensor:
        """Return all manifest-owned physical page IDs at the I/O boundary."""

        self._require_session()
        if self._manifest is None:
            raise RuntimeError("NoNE session has no accepted page generation")
        return self._manifest_page_ids_t_boundary(self._manifest)

    def refresh_accepted_pointer_boundary(
        self,
        *,
        graph_page_ids_t: torch.Tensor,
    ) -> NoNEGenerationBinding:
        """Autodiscover a pointer advance without inventing graph geometry.

        A changed generation can be consumed directly only when its complete
        physical page identity set is already represented by the loaded model
        graph. New roots or layer assignments require the checkpoint that grew
        those router tensors; storage discovery never manufactures them.
        """

        graph_ids_t = graph_page_ids_t.detach().cpu().long().reshape(-1)
        if (
            graph_ids_t.numel() < 1
            or torch.unique(graph_ids_t).numel() != graph_ids_t.numel()
        ):
            raise RuntimeError("NoNE loaded graph page identity is malformed")
        sorted_graph_ids_t = torch.sort(graph_ids_t).values
        if self._resident_page_ids_t is not None and not torch.equal(
            self._resident_page_ids_t,
            sorted_graph_ids_t,
        ):
            raise RuntimeError("NoNE pointer refresh changed the loaded graph")
        self._resident_page_ids_t = sorted_graph_ids_t.clone()
        binding, manifest = self._live_accepted_binding_boundary()
        live_ids_t = self._manifest_page_ids_t_boundary(manifest)
        if not torch.equal(sorted_graph_ids_t, live_ids_t):
            raise RuntimeError(
                "NoNE accepted pointer requires its matching grown graph checkpoint"
            )
        discovered = self.discover_accepted_pointer_boundary()
        if (
            not torch.equal(discovered.generation_t, binding.generation_t)
            or not torch.equal(
                discovered.manifest_sha256_t,
                binding.manifest_sha256_t,
            )
            or not torch.equal(
                discovered.manifest_payload_sha256_t,
                binding.manifest_payload_sha256_t,
            )
        ):
            raise RuntimeError("NoNE accepted pointer changed during discovery")
        return discovered

    def _require_session(self) -> tuple[torch.Tensor, Path]:
        if self._session_id_t is None or self._session_root is None:
            raise RuntimeError("NoNE page store has no active session")
        return self._session_id_t, self._session_root

    def _runtime_cache_root_boundary(self) -> Path:
        """Keep release caches outside immutable repository coordinates."""

        _session_id_t, session_root = self._require_session()
        return (
            self.root
            if self._release_generation_projection is not None
            else session_root
        )

    def _release_topology_cache_root_boundary(self) -> Path | None:
        """Return a dedicated public-release topology cache when applicable."""

        if self._release_generation_projection is None:
            return None
        return (
            self._runtime_cache_root_boundary()
            / _PAGE_CATALOG_TOPOLOGY_CACHE_DIRECTORY
        )

    def discover_accepted_pointer_boundary(self) -> NoNEGenerationBinding:
        """Resolve the live accepted pointer and refresh cached page authority.

        ``accepted.json`` is an atomic, mutable authority pointer; the
        composition's pointer is historical lineage evidence.  Every storage
        boundary therefore re-reads this pointer and validates its exact
        pointer -> manifest -> session chain before a generation can route.
        """

        if self._release_generation_projection is not None:
            return self._discover_release_generation_boundary()
        read_only_staged = (
            self._verify_staged_generation_read_only_boundary()
        )
        if read_only_staged is not None:
            return read_only_staged
        session_id_t, session_root = self._require_session()
        pointer_path = session_root / "accepted.json"
        if not pointer_path.is_file():
            raise RuntimeError("NoNE session has no discoverable accepted pointer")
        resolved_pointer_path = pointer_path.resolve()
        if (
            not resolved_pointer_path.is_relative_to(session_root.resolve())
            or resolved_pointer_path.name != "accepted.json"
        ):
            raise RuntimeError("NoNE accepted pointer escaped its session")
        pointer_identity_before = _file_identity(resolved_pointer_path)
        if (
            self._accepted_pointer_identity_boundary == pointer_identity_before
            and self._accepted_binding_boundary is not None
            and self._manifest is not None
            and self._accepted_manifest_identity_boundary is not None
            and _file_identity(
                (
                    session_root
                    / self._accepted_binding_boundary.manifest_relative_path
                ).resolve()
            )
            == self._accepted_manifest_identity_boundary
            and self._accepted_direct_page_map_cache_current_boundary()
        ):
            self._validate_direct_page_map_frontier_transition_boundary(
                generation_binding=self._accepted_binding_boundary,
                generation_manifest=self._manifest,
            )
            return self._accepted_binding_boundary
        prior_pointer_identity = self._accepted_pointer_identity_boundary
        prior_manifest_identity = self._accepted_manifest_identity_boundary
        pointer = _visible_accepted_pointer_record_boundary(
            resolved_pointer_path
        )
        generation = pointer.get("generation")
        manifest_relative_path = pointer.get("manifest")
        manifest_sha256 = pointer.get("manifestSha256")
        manifest_payload_sha256 = pointer.get("manifestPayloadSha256")
        graph_authority_record = pointer.get("graphAuthority")
        graph_authority_payload_sha256 = pointer.get(
            "graphAuthorityPayloadSha256"
        )
        if (
            pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA
            or pointer.get("sessionKey") != _session_key(session_id_t)
            or not isinstance(generation, int)
            or isinstance(generation, bool)
            or generation < 1
            or not isinstance(manifest_relative_path, str)
            or not manifest_relative_path
            or not isinstance(manifest_sha256, str)
            or len(manifest_sha256) != 64
            or not isinstance(manifest_payload_sha256, str)
            or len(manifest_payload_sha256) != 64
        ):
            raise RuntimeError("NoNE accepted pointer identity is malformed")
        self._validate_page_object_placement_pointer_boundary(pointer)
        if (graph_authority_record is None) != (
            graph_authority_payload_sha256 is None
        ):
            raise RuntimeError("NoNE accepted graph authority is incomplete")
        if graph_authority_record is not None and (
            not isinstance(graph_authority_record, dict)
            or not isinstance(graph_authority_payload_sha256, str)
            or len(graph_authority_payload_sha256) != 64
            or hashlib.sha256(
                _canonical_json_bytes(graph_authority_record)
            ).hexdigest()
            != graph_authority_payload_sha256
        ):
            raise RuntimeError("NoNE accepted graph authority identity differs")
        binding, manifest = self._load_generation_binding_boundary(
            manifest_relative_path,
            expected_manifest_sha256=manifest_sha256,
            expected_payload_sha256=manifest_payload_sha256,
        )
        manifest_path = (
            session_root / binding.manifest_relative_path
        ).resolve()
        manifest_identity_after = _file_identity(manifest_path)
        if int(binding.generation_t) != generation:
            raise RuntimeError("NoNE accepted generation number mismatch")
        graph_authority: NoNEGraphAuthorityBinding | None = None
        if graph_authority_record is not None:
            assert isinstance(graph_authority_record, dict)
            assert isinstance(graph_authority_payload_sha256, str)
            if (
                self._graph_authority is not None
                and self._graph_authority_payload_sha256
                == graph_authority_payload_sha256
            ):
                graph_authority = self._graph_authority
            else:
                graph_authority = self._load_graph_authority_record_boundary(
                    binding,
                    manifest,
                    graph_authority_record,
                )
        self._validate_resident_graph_authority_boundary(
            binding,
            manifest,
            graph_authority,
        )
        pointer_identity_after = _file_identity(resolved_pointer_path)
        if pointer_identity_after != pointer_identity_before:
            rewritten_pointer = _visible_accepted_pointer_record_boundary(
                resolved_pointer_path
            )
            rewritten_identity_after = _file_identity(resolved_pointer_path)
            # Relaxed check: only verify content consistency, not identity stability.
            # File identity may change due to concurrent atomic rewrites, but as long
            # as the content is identical, the discovery is valid.
            if (
                _canonical_json_bytes(rewritten_pointer)
                != _canonical_json_bytes(pointer)
            ):
                raise RuntimeError("NoNE accepted pointer changed during discovery")
            # A concurrent writer may atomically re-seal the exact same accepted
            # authority.  Retain the fully verified binding while caching the
            # replacement inode identity; any authority/content drift above
            # remains fail-closed.
            pointer_identity_after = rewritten_identity_after
        prior_payload_sha256 = (
            ""
            if self._manifest is None
            else str(self._manifest.get("manifestPayloadSha256", ""))
        )
        if (
            not torch.equal(
                self._accepted_generation_t,
                binding.generation_t.detach().cpu().long().reshape(()),
            )
            or prior_payload_sha256 != manifest_payload_sha256
        ):
            self._verified_objects.clear()
            self._verified_object_identities_boundary.clear()
        if (
            prior_pointer_identity != pointer_identity_after
            or prior_manifest_identity != manifest_identity_after
        ):
            self._clear_validated_immutable_page_closure_cache_boundary()
        self._validate_direct_page_map_frontier_transition_boundary(
            generation_binding=binding,
            generation_manifest=manifest,
        )
        self._validate_and_cache_accepted_direct_page_map_boundary(
            generation_binding=binding,
            generation_manifest=manifest,
        )
        self._accepted_generation_t = (
            binding.generation_t.detach().cpu().long().reshape(())
        )
        self._manifest = manifest
        self._graph_authority = graph_authority
        self._graph_authority_payload_sha256 = (
            graph_authority_payload_sha256
            if isinstance(graph_authority_payload_sha256, str)
            else ""
        )
        self._accepted_pointer_identity_boundary = pointer_identity_after
        self._accepted_manifest_identity_boundary = manifest_identity_after
        self._accepted_binding_boundary = binding
        return binding

    def _load_graph_authority_record_boundary(
        self,
        binding: NoNEGenerationBinding,
        manifest: Mapping[str, Any],
        record: Mapping[str, Any],
    ) -> NoNEGraphAuthorityBinding:
        """Rebuild and verify one pointer-owned executable graph packet."""

        def artifact_path(name: str) -> Path:
            artifact = record.get(name)
            if not isinstance(artifact, dict):
                raise RuntimeError(f"NoNE graph authority has no {name}")
            path = artifact.get("path")
            sha256 = artifact.get("sha256")
            if (
                not isinstance(path, str)
                or not path
                or not isinstance(sha256, str)
                or len(sha256) != 64
            ):
                raise RuntimeError(f"NoNE graph authority {name} is malformed")
            return Path(path)

        _session_id_t, session_root = self._require_session()
        migration_receipt_path = record.get("migrationReceiptPath")
        if not isinstance(migration_receipt_path, str) or not migration_receipt_path:
            raise RuntimeError("NoNE graph authority has no migration receipt")
        migration_receipt = Path(migration_receipt_path).expanduser().resolve()
        if not migration_receipt.is_file():
            raise RuntimeError("NoNE graph authority migration receipt is missing")
        migration_payload = _read_json(migration_receipt)
        if migration_payload.get("passed") is not True:
            raise RuntimeError("NoNE graph authority migration receipt did not pass")

        replica_record = record.get("replicaReceipt")
        replica_path: Path | None = None
        if replica_record is not None:
            if not isinstance(replica_record, dict):
                raise RuntimeError("NoNE graph replica authority is malformed")
            replica_path = Path(str(replica_record.get("path", "")))

        graph_binding = binding
        external_envelope = _read_json(artifact_path("externalState"))
        external_state = external_envelope.get("externalState")
        external_generation_record = (
            external_state.get("generationBinding")
            if isinstance(external_state, dict)
            else None
        )
        if external_generation_record != binding.external_record_boundary():
            if not isinstance(external_generation_record, dict):
                raise RuntimeError(
                    "NoNE graph checkpoint sidecar generation is absent"
                )
            ancestor_binding = generation_binding_from_record_boundary(
                external_generation_record
            )
            loaded_ancestor, ancestor_manifest = (
                self._load_generation_binding_boundary(
                    ancestor_binding.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        ancestor_binding.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        ancestor_binding.manifest_payload_sha256_t
                    ),
                )
            )
            ancestor_rows_value = ancestor_manifest.get("pageObjects")
            current_rows_value = manifest.get("pageObjects")
            ancestor_components = ancestor_manifest.get("components")
            current_components = manifest.get("components")
            ancestor_rows = (
                {
                    int(row["pageId"]): row
                    for row in ancestor_rows_value
                    if isinstance(row, dict)
                    and isinstance(row.get("pageId"), int)
                    and not isinstance(row.get("pageId"), bool)
                }
                if isinstance(ancestor_rows_value, list)
                else {}
            )
            current_rows = (
                {
                    int(row["pageId"]): row
                    for row in current_rows_value
                    if isinstance(row, dict)
                    and isinstance(row.get("pageId"), int)
                    and not isinstance(row.get("pageId"), bool)
                }
                if isinstance(current_rows_value, list)
                else {}
            )
            changed_page_ids = sorted(
                page_id
                for page_id, row in current_rows.items()
                if ancestor_rows.get(page_id) != row
            )
            ancestor_component_map = (
                ancestor_components
                if isinstance(ancestor_components, dict)
                else {}
            )
            current_component_map = (
                current_components
                if isinstance(current_components, dict)
                else {}
            )
            stable_component_names = (
                set(ancestor_component_map)
                | set(current_component_map)
            ) - {
                "expertPages",
                "trainingProof",
                # v2 bound mutable source bytes as ``code``.  A v3 page-only
                # descendant intentionally drops that diagnostic component.
                "code",
            }
            training_proof_component = current_component_map.get(
                "trainingProof"
            )
            if (
                not _same_generation_binding_boundary(
                    loaded_ancestor,
                    ancestor_binding,
                )
                or not torch.equal(
                    binding.session_id_t,
                    ancestor_binding.session_id_t,
                )
                or int(binding.generation_t)
                != int(ancestor_binding.generation_t) + 1
                or not torch.equal(
                    binding.parent_generation_t.reshape(()),
                    ancestor_binding.generation_t.reshape(()),
                )
                or not page_generation_schema_supported_boundary(
                    manifest.get("schema")
                )
                or not page_generation_schema_supported_boundary(
                    ancestor_manifest.get("schema")
                )
                or manifest.get("sessionKey")
                != ancestor_manifest.get("sessionKey")
                or manifest.get("parentManifestPayloadSha256")
                != _tensor_digest_hex(
                    ancestor_binding.manifest_payload_sha256_t
                )
                or manifest.get("pageCount")
                != ancestor_manifest.get("pageCount")
                or not ancestor_rows
                or set(current_rows) != set(ancestor_rows)
                or changed_page_ids
                != binding.updated_page_ids_t.detach().cpu().long().tolist()
                or any(
                    current_component_map.get(name)
                    != ancestor_component_map.get(name)
                    for name in stable_component_names
                )
                or not isinstance(training_proof_component, dict)
                or not isinstance(
                    training_proof_component.get("sha256"),
                    str,
                )
                or len(training_proof_component["sha256"]) != 64
            ):
                raise RuntimeError(
                    "NoNE graph authority page-only descendant differs"
                )
            graph_binding = ancestor_binding

        rebuilt = build_graph_authority_binding_boundary(
            generation_binding=graph_binding,
            checkpoint_path=artifact_path("checkpoint"),
            optimizer_path=artifact_path("optimizer"),
            external_state_path=artifact_path("externalState"),
            composition_path=artifact_path("composition"),
            migration_receipt_path=migration_receipt,
            replica_receipt_path=replica_path,
            expected_authority_record=record,
            identity_cache_root=(
                self._runtime_cache_root_boundary()
                / "artifact_sha256_cache"
            ),
            topology_cache_root=(
                self._release_topology_cache_root_boundary()
            ),
        )
        if rebuilt.external_record_boundary() != dict(record):
            raise RuntimeError("NoNE graph authority artifact identity changed")

        components = manifest.get("components")
        model_component = (
            components.get("model") if isinstance(components, dict) else None
        )
        optimizer_component = (
            components.get("optimizer") if isinstance(components, dict) else None
        )
        raw_page_rows = manifest.get("pageObjects")
        catalog_topology = _load_page_catalog_topology_boundary(
            catalog_path=Path(rebuilt.page_catalog_path),
            expected_sha256=_tensor_digest_hex(
                rebuilt.page_catalog_sha256_t
            ),
            identity_cache_root=(
                self._runtime_cache_root_boundary()
                / "artifact_sha256_cache"
            ),
            topology_cache_root=(
                self._release_topology_cache_root_boundary()
            ),
        )
        manifest_page_ids = (
            {
                int(row["pageId"])
                for row in raw_page_rows
                if isinstance(row, dict)
                and isinstance(row.get("pageId"), int)
                and not isinstance(row.get("pageId"), bool)
            }
            if isinstance(raw_page_rows, list)
            else set()
        )
        catalog_page_ids = set(catalog_topology.page_ids)
        if (
            record.get("schema") != "nnf.resynthesis.none_graph_authority.v1"
            or not isinstance(model_component, dict)
            or model_component.get("sha256")
            != _tensor_digest_hex(rebuilt.checkpoint_sha256_t)
            or not isinstance(optimizer_component, dict)
            or optimizer_component.get("sha256")
            != _tensor_digest_hex(rebuilt.optimizer_sha256_t)
            or not manifest_page_ids
            or manifest_page_ids != catalog_page_ids
            or len(manifest_page_ids) != int(rebuilt.page_count_t)
        ):
            raise RuntimeError("NoNE graph authority differs from its generation")
        return rebuilt

    def _validate_resident_graph_authority_boundary(
        self,
        binding: NoNEGenerationBinding,
        manifest: Mapping[str, Any],
        graph_authority: NoNEGraphAuthorityBinding | None,
    ) -> None:
        """Fence a resident graph from silently adopting foreign topology."""

        if self._resident_page_ids_t is not None:
            raw_rows = manifest.get("pageObjects")
            if not isinstance(raw_rows, list):
                raise RuntimeError("NoNE accepted graph page catalog is malformed")
            accepted_page_ids_t = torch.tensor(
                sorted(
                    int(row["pageId"])
                    for row in raw_rows
                    if isinstance(row, dict)
                    and isinstance(row.get("pageId"), int)
                    and not isinstance(row.get("pageId"), bool)
                ),
                dtype=torch.long,
            )
            if not torch.equal(accepted_page_ids_t, self._resident_page_ids_t):
                raise RuntimeError(
                    "NoNE accepted pointer requires cold graph topology adoption"
                )
        if graph_authority is None:
            return
        if self._resident_checkpoint_sha256 and (
            _tensor_digest_hex(graph_authority.checkpoint_sha256_t)
            != self._resident_checkpoint_sha256
        ):
            raise RuntimeError(
                "NoNE accepted pointer requires cold checkpoint adoption"
            )
        if self._resident_composition_sha256 and (
            _tensor_digest_hex(graph_authority.composition_sha256_t)
            != self._resident_composition_sha256
        ):
            raise RuntimeError(
                "NoNE accepted pointer requires cold composition adoption"
            )
        resident_bound = bool(
            self._resident_checkpoint_sha256
            or self._resident_composition_sha256
            or self._resident_page_ids_t is not None
        )
        if (
            resident_bound
            and self._manifest is not None
            and not torch.equal(
                binding.generation_t.detach().cpu().long().reshape(()),
                self._accepted_generation_t,
            )
        ):
            # Pointer changes are permitted only when the resident checkpoint is
            # explicitly rebound by its own completed transaction.
            raise RuntimeError("NoNE accepted pointer changed outside resident graph")

    def bind_resident_graph_authority_boundary(
        self,
        *,
        checkpoint_sha256_t: torch.Tensor,
        composition_sha256_t: torch.Tensor,
        page_ids_t: torch.Tensor,
    ) -> torch.Tensor:
        """Bind the checkpoint currently resident with this store's router graph."""

        binding = self.discover_accepted_pointer_boundary()
        page_ids = page_ids_t.detach().cpu().long().reshape(-1)
        if page_ids.numel() < 1 or torch.unique(page_ids).numel() != page_ids.numel():
            raise RuntimeError("NoNE resident graph page identity is malformed")
        self._resident_checkpoint_sha256 = _tensor_digest_hex(checkpoint_sha256_t)
        self._resident_composition_sha256 = _tensor_digest_hex(composition_sha256_t)
        self._resident_page_ids_t = torch.sort(page_ids).values
        self._validate_resident_graph_authority_boundary(
            binding,
            self._manifest if self._manifest is not None else {},
            self._graph_authority,
        )
        return binding.generation_t.clone()

    def _rebind_resident_graph_after_authority_move_boundary(
        self,
        manifest: dict[str, Any],
    ) -> None:
        """Advance an already-bound resident fence with its atomic pointer move."""

        resident_bound = bool(
            self._resident_checkpoint_sha256
            or self._resident_composition_sha256
            or self._resident_page_ids_t is not None
        )
        if not resident_bound:
            return
        graph_authority = self._graph_authority
        if graph_authority is None:
            # Historical generations created before graph-authority enrichment
            # have no signed graph record to adopt.  The checkpoint rollback has
            # already restored that historical model state, so discard the stale
            # newer-generation fence instead of binding it to older page bytes.
            self._resident_checkpoint_sha256 = ""
            self._resident_composition_sha256 = ""
            self._resident_page_ids_t = None
            return
        self._resident_checkpoint_sha256 = _tensor_digest_hex(
            graph_authority.checkpoint_sha256_t
        )
        self._resident_composition_sha256 = _tensor_digest_hex(
            graph_authority.composition_sha256_t
        )
        self._resident_page_ids_t = self._manifest_page_ids_t_boundary(manifest)

    def adopt_written_graph_authority_boundary(
        self,
        *,
        graph_authority: NoNEGraphAuthorityBinding,
        page_ids_t: torch.Tensor,
        retained_checkpoint_sha256_t: torch.Tensor,
    ) -> torch.Tensor:
        """Adopt a graph after its accepted pointer is durably written.

        Candidate training makes the new checkpoint resident before advancing
        page authority.  The pointer transaction writes every replica first;
        only then may each store fence subsequent reads to that already-loaded
        candidate graph.  This ordering prevents the old pointer from rejecting
        the new resident checkpoint and prevents the new pointer from being
        observed through the old resident checkpoint identity.
        """

        if not torch.equal(
            retained_checkpoint_sha256_t.detach().cpu().to(dtype=torch.uint8),
            graph_authority.checkpoint_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8),
        ):
            raise RuntimeError(
                "NoNE retained checkpoint digest differs from written authority"
            )
        page_ids = torch.sort(page_ids_t.detach().cpu().long().reshape(-1)).values
        if (
            page_ids.numel() < 1
            or torch.unique(page_ids).numel() != page_ids.numel()
            or page_ids.numel() != int(graph_authority.page_count_t)
        ):
            raise RuntimeError("NoNE adopted graph page identity is malformed")
        prior_checkpoint = self._resident_checkpoint_sha256
        prior_composition = self._resident_composition_sha256
        prior_page_ids = (
            None
            if self._resident_page_ids_t is None
            else self._resident_page_ids_t.clone()
        )
        self._resident_checkpoint_sha256 = _tensor_digest_hex(
            graph_authority.checkpoint_sha256_t
        )
        self._resident_composition_sha256 = _tensor_digest_hex(
            graph_authority.composition_sha256_t
        )
        self._resident_page_ids_t = page_ids
        try:
            binding = self.discover_accepted_pointer_boundary()
            current = self._graph_authority
            if current is None or current.external_record_boundary() != (
                graph_authority.external_record_boundary()
            ):
                raise RuntimeError("NoNE adopted graph authority differs")
        except Exception:
            self._resident_checkpoint_sha256 = prior_checkpoint
            self._resident_composition_sha256 = prior_composition
            self._resident_page_ids_t = prior_page_ids
            raise
        return binding.generation_t.clone()

    def current_graph_authority_boundary(
        self,
    ) -> NoNEGraphAuthorityBinding | None:
        """Return the verified pointer-owned graph authority, when available."""

        self.discover_accepted_pointer_boundary()
        return self._graph_authority

    def current_training_proven_page_ids_t_boundary(self) -> torch.Tensor:
        """Return cumulative proof IDs from the accepted manifest.

        Catalog training flags are immutable geometry annotations.  They may
        corroborate, but never extend, the accepted manifest's training proof.
        """

        self.discover_accepted_pointer_boundary()
        if self._manifest is None:
            raise RuntimeError("NoNE accepted training authority is absent")
        accepted_page_ids_t = torch.sort(
            self._manifest_page_ids_t_boundary(self._manifest)
        ).values
        accepted_page_ids = set(accepted_page_ids_t.tolist())
        manifest_value = self._manifest.get("trainingProvenPageIds", [])
        if (
            not isinstance(manifest_value, list)
            or any(
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id not in accepted_page_ids
                for page_id in manifest_value
            )
            or len(set(manifest_value)) != len(manifest_value)
        ):
            raise RuntimeError("NoNE manifest training authority is malformed")
        proven_page_ids = set(manifest_value)

        graph_authority = self._graph_authority
        if graph_authority is not None:
            _session_id_t, session_root = self._require_session()
            catalog_path = Path(
                graph_authority.page_catalog_path
            ).expanduser().resolve()
            topology = _load_page_catalog_topology_boundary(
                catalog_path=catalog_path,
                expected_sha256=_tensor_digest_hex(
                    graph_authority.page_catalog_sha256_t
                ),
                identity_cache_root=(
                    self._runtime_cache_root_boundary()
                    / "artifact_sha256_cache"
                ),
                topology_cache_root=(
                    self._release_topology_cache_root_boundary()
                ),
            )
            if topology.trained_capability_claimed is None:
                raise RuntimeError("NoNE training catalog is malformed")
            catalog_page_ids: set[int] = set()
            for page_id, claimed in zip(
                topology.page_ids,
                topology.trained_capability_claimed,
            ):
                if page_id in catalog_page_ids or page_id not in accepted_page_ids:
                    raise RuntimeError("NoNE training catalog identity differs")
                catalog_page_ids.add(page_id)
                # PAGE-TRAINED-KNOWLEDGE BOUNDARY: ``claimed`` here is the
                # self-asserted ``trainedCapabilityClaimed`` flag read from
                # the catalog row.  The check below only verifies that a
                # claimed page has manifest *provenance* -- it does NOT by
                # itself prove the page received real gradient updates.
                # The authoritative "is this page actually trained?" test
                # lives in page_inventory.py:
                # _validate_page_has_trained_knowledge_boundary, which
                # cross-checks the claim against the objective row fields
                # (state/optimizerState) and refuses to let an empty/allocated
                # page be counted as trained/filled before its first gradient
                # step ("confirm the pages are not being filled first").
                # Catalogs that mis-set the claim early are reclassified as
                # empty downstream; this loop trusts the already-audited flag.
                if claimed and page_id not in proven_page_ids:
                    raise RuntimeError(
                        "NoNE catalog training claim lacks manifest proof"
                    )
            if catalog_page_ids != accepted_page_ids:
                raise RuntimeError("NoNE training catalog coverage differs")

        return torch.tensor(sorted(proven_page_ids), dtype=torch.long)

    def seal_training_branch_fork_authority_boundary(
        self,
        *,
        page_ids_t: torch.Tensor,
        page_layer_ids_t: torch.Tensor,
    ) -> NoNETrainingBranchScopePacket:
        """Seal a read-only branch fork against the exact accepted parent.

        This method writes no page, generation, or pointer state.  A later
        launcher may use the returned packet to create an independent store
        fork, but only while preserving this exact parent identity.
        """

        session_id_t, _session_root = self._require_session()
        parent = self.discover_accepted_pointer_boundary()
        graph_authority = self._graph_authority
        if graph_authority is None:
            raise RuntimeError("NoNE training branch has no graph authority")
        catalog_path = Path(graph_authority.page_catalog_path).expanduser().resolve()
        catalog_sha256 = _tensor_digest_hex(
            graph_authority.page_catalog_sha256_t
        )
        loaded_catalog_sha256, catalog = _read_immutable_json_cached(catalog_path)
        if loaded_catalog_sha256 != catalog_sha256:
            raise RuntimeError("NoNE training branch catalog identity differs")
        federated_scope_bindings = (
            _federated_training_scope_bindings_from_catalog_boundary(
                catalog=catalog,
                page_ids_t=page_ids_t,
                expected_authority_sha256_t=(
                    graph_authority
                    .federated_growth_demand_authority_sha256_t
                ),
            )
        )
        scope = build_training_branch_scope_boundary(
            session_id_t=session_id_t,
            parent_generation_t=parent.generation_t,
            parent_manifest_payload_sha256_t=(
                parent.manifest_payload_sha256_t
            ),
            page_ids_t=page_ids_t,
            page_layer_ids_t=page_layer_ids_t,
            federated_growth_demand_authority_sha256_t=(
                federated_scope_bindings[0]
                if federated_scope_bindings is not None
                else None
            ),
            objective_page_ids_t=(
                federated_scope_bindings[1]
                if federated_scope_bindings is not None
                else None
            ),
            objective_source_id_sha256s_t=(
                federated_scope_bindings[2]
                if federated_scope_bindings is not None
                else None
            ),
        )
        self.validate_training_branch_fork_authority_boundary(scope)
        return scope

    def validate_training_branch_fork_authority_boundary(
        self,
        scope: NoNETrainingBranchScopePacket,
    ) -> torch.Tensor:
        """Bind one sealed branch scope to current parent and catalog bytes."""

        validate_training_branch_scope_boundary(scope)
        session_id_t, session_root = self._require_session()
        parent = self.discover_accepted_pointer_boundary()
        if (
            not torch.equal(scope.session_id_t, session_id_t.detach().cpu().long())
            or not torch.equal(
                scope.parent_generation_t,
                parent.generation_t.detach().cpu().long().reshape(()),
            )
            or not torch.equal(
                scope.parent_manifest_payload_sha256_t,
                parent.manifest_payload_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
            )
        ):
            raise RuntimeError(
                "NoNE training branch parent pointer identity differs"
            )
        if self._manifest is None:
            raise RuntimeError("NoNE training branch parent manifest is absent")
        accepted_page_ids_t = self._manifest_page_ids_t_boundary(self._manifest)
        if not bool(
            _page_ids_subset_t_boundary(
                scope.page_ids_t,
                accepted_page_ids_t,
            )
        ):
            raise RuntimeError("NoNE training branch contains a foreign page")

        graph_authority = self._graph_authority
        if graph_authority is None:
            raise RuntimeError("NoNE training branch has no graph authority")
        topology = _load_page_catalog_topology_boundary(
            catalog_path=Path(graph_authority.page_catalog_path),
            expected_sha256=_tensor_digest_hex(
                graph_authority.page_catalog_sha256_t
            ),
            identity_cache_root=(
                self._runtime_cache_root_boundary()
                / "artifact_sha256_cache"
            ),
            topology_cache_root=(
                self._release_topology_cache_root_boundary()
            ),
        )
        expected_layer_ids_t = _page_catalog_layer_ids_for_page_ids_boundary(
            topology,
            scope.page_ids_t,
        )
        if not torch.equal(expected_layer_ids_t, scope.page_layer_ids_t):
            raise RuntimeError("NoNE training branch layer ownership differs")
        catalog_path = Path(graph_authority.page_catalog_path).expanduser().resolve()
        catalog_sha256 = _tensor_digest_hex(
            graph_authority.page_catalog_sha256_t
        )
        loaded_catalog_sha256, catalog = _read_immutable_json_cached(catalog_path)
        if loaded_catalog_sha256 != catalog_sha256:
            raise RuntimeError("NoNE training branch catalog identity differs")
        federated_scope_bindings = (
            _federated_training_scope_bindings_from_catalog_boundary(
                catalog=catalog,
                page_ids_t=scope.page_ids_t,
                expected_authority_sha256_t=(
                    graph_authority
                    .federated_growth_demand_authority_sha256_t
                ),
            )
        )
        if federated_scope_bindings is None:
            if (
                scope.federated_growth_demand_authority_sha256_t is not None
                or scope.objective_page_ids_t is not None
                or scope.objective_source_id_sha256s_t is not None
            ):
                raise RuntimeError("NoNE legacy training branch scope differs")
        elif (
            scope.federated_growth_demand_authority_sha256_t is None
            or scope.objective_page_ids_t is None
            or scope.objective_source_id_sha256s_t is None
            or not torch.equal(
                scope.federated_growth_demand_authority_sha256_t.detach().cpu(),
                federated_scope_bindings[0],
            )
            or not torch.equal(
                scope.objective_page_ids_t.detach().cpu(),
                federated_scope_bindings[1],
            )
            or not torch.equal(
                scope.objective_source_id_sha256s_t.detach().cpu(),
                federated_scope_bindings[2],
            )
        ):
            raise RuntimeError("NoNE federated training branch scope differs")
        return scope.scope_sha256_t.clone()

    def publish_training_branch_result_boundary(
        self,
        *,
        scope: NoNETrainingBranchScopePacket,
        training_proof: NoNEPageTrainingProofPacket,
        source_external_state_sha256_t: torch.Tensor,
    ) -> NoNETrainingBranchResultPacket:
        """Publish actual retained page, optimizer, proof, and capability tensors."""

        _validate_cumulative_training_branch_result_proof_boundary(
            scope,
            training_proof,
        )
        current = self.discover_accepted_pointer_boundary()
        if not torch.equal(current.session_id_t, scope.session_id_t):
            raise RuntimeError("NoNE training branch result lineage differs")
        loaded, source_manifest = self._load_generation_binding_boundary(
            current.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                current.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                current.manifest_payload_sha256_t
            ),
        )
        source_components = source_manifest.get("components")
        source_training_proof = (
            source_components.get("trainingProof")
            if isinstance(source_components, dict)
            else None
        )
        source_training_proof_sha256 = (
            source_training_proof.get("sha256")
            if isinstance(source_training_proof, dict)
            else None
        )
        try:
            source_training_proof_digest = bytes.fromhex(
                source_training_proof_sha256
                if isinstance(source_training_proof_sha256, str)
                else ""
            )
        except ValueError as error:
            raise RuntimeError(
                "NoNE training branch source proof identity differs"
            ) from error
        graph = self.current_graph_authority_boundary()
        if (
            not _same_generation_binding_boundary(loaded, current)
            or source_manifest.get("updatedPageIds")
            != current.updated_page_ids_t.tolist()
            or not isinstance(source_training_proof, dict)
            or not isinstance(source_training_proof_sha256, str)
            or source_training_proof_sha256.lower()
            != source_training_proof_sha256
            or len(source_training_proof_digest) != 32
            or graph is None
            or source_external_state_sha256_t.shape != (32,)
            or source_external_state_sha256_t.dtype != torch.uint8
            or not torch.equal(
                graph.external_state_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
                source_external_state_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
            )
        ):
            raise RuntimeError("NoNE training branch result is not parent-bound")

        scoped_page_ids: set[int] = {
            int(page_id) for page_id in scope.page_ids_t.tolist()
        }
        source_proof_page_ids: set[int] = {
            int(page_id)
            for page_id in training_proof.family_page_ids_t.detach()
            .cpu()
            .long()
            .tolist()
        }
        retained_updated_page_ids: set[int] = set()
        descendant = loaded
        descendant_manifest = source_manifest
        observed_payload_sha256s: set[str] = set()
        scope_parent_generation = int(scope.parent_generation_t)
        while int(descendant.generation_t) > scope_parent_generation:
            descendant_payload_sha256 = _tensor_digest_hex(
                descendant.manifest_payload_sha256_t
            )
            if descendant_payload_sha256 in observed_payload_sha256s:
                raise RuntimeError("NoNE training branch lineage contains a cycle")
            observed_payload_sha256s.add(descendant_payload_sha256)
            descendant_generation = int(descendant.generation_t)
            parent_generation = int(descendant.parent_generation_t)
            parent_payload_sha256 = descendant_manifest.get(
                "parentManifestPayloadSha256"
            )
            updated_page_ids: set[int] = {
                int(page_id) for page_id in descendant.updated_page_ids_t.tolist()
            }
            if (
                parent_generation < scope_parent_generation
                or parent_generation >= descendant_generation
                or not isinstance(parent_payload_sha256, str)
                or len(parent_payload_sha256) != 64
                or not updated_page_ids
                or len(updated_page_ids)
                != int(descendant.updated_page_ids_t.numel())
                or not updated_page_ids.issubset(scoped_page_ids)
            ):
                raise RuntimeError("NoNE training branch retained lineage differs")
            retained_updated_page_ids.update(updated_page_ids)
            parent_binding = self.verify_generation_boundary(
                generation_t=descendant.parent_generation_t,
                manifest_payload_sha256_t=digest_tensor(parent_payload_sha256),
            )
            parent_loaded, parent_manifest = (
                self._load_generation_binding_boundary(
                    parent_binding.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        parent_binding.manifest_sha256_t
                    ),
                    expected_payload_sha256=parent_payload_sha256,
                )
            )
            if not _same_generation_binding_boundary(
                parent_loaded,
                parent_binding,
            ):
                raise RuntimeError("NoNE training branch parent lineage changed")
            descendant = parent_loaded
            descendant_manifest = parent_manifest
        if (
            int(descendant.generation_t) != scope_parent_generation
            or not torch.equal(
                descendant.manifest_payload_sha256_t,
                scope.parent_manifest_payload_sha256_t,
            )
            or not retained_updated_page_ids
            or not retained_updated_page_ids.issubset(source_proof_page_ids)
        ):
            raise RuntimeError(
                "NoNE training branch retained-change proof is incomplete"
            )
        retained_page_ids_t = torch.tensor(
            sorted(retained_updated_page_ids),
            dtype=torch.long,
        )
        retained_training_proof = _select_page_training_proof_boundary(
            training_proof,
            retained_page_ids_t,
        )

        parent = descendant
        _parent_loaded, parent_manifest = (
            self._load_generation_binding_boundary(
                parent.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    parent.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    parent.manifest_payload_sha256_t
                ),
            )
        )
        source_rows_value = source_manifest.get("pageObjects")
        parent_rows_value = parent_manifest.get("pageObjects")
        if not isinstance(source_rows_value, list) or not isinstance(
            parent_rows_value,
            list,
        ):
            raise RuntimeError("NoNE training branch page objects are malformed")
        source_rows = {
            int(row["pageId"]): row
            for row in source_rows_value
            if isinstance(row, dict) and isinstance(row.get("pageId"), int)
        }
        parent_rows = {
            int(row["pageId"]): row
            for row in parent_rows_value
            if isinstance(row, dict) and isinstance(row.get("pageId"), int)
        }
        page_objects: list[NoNEPageObjectBinding] = []
        for page_id_t in retained_page_ids_t:
            page_id = int(page_id_t)
            source_row = source_rows.get(page_id)
            parent_row = parent_rows.get(page_id)
            if (
                not isinstance(source_row, dict)
                or not isinstance(parent_row, dict)
                or not isinstance(source_row.get("sha256"), str)
                or len(str(source_row.get("sha256"))) != 64
                or not isinstance(source_row.get("bytes"), int)
                or isinstance(source_row.get("bytes"), bool)
                or int(source_row["bytes"]) < 1
                or source_row.get("sha256") == parent_row.get("sha256")
            ):
                raise RuntimeError(
                    "NoNE training branch retained page did not change"
                )
            page_objects.append(
                NoNEPageObjectBinding(
                    page_id_t=page_id_t.clone(),
                    object_sha256_t=digest_tensor(str(source_row["sha256"])),
                    object_bytes_t=torch.tensor(
                        int(source_row["bytes"]),
                        dtype=torch.long,
                    ),
                )
            )

        authorized = self._authorized_page_objects_boundary(
            selected_page_ids_t=retained_page_ids_t,
        )
        capability_rows: list[torch.Tensor] = []
        for expected_page_id_t, authorized_page in zip(
            retained_page_ids_t,
            authorized,
            strict=True,
        ):
            page_capability_state_t = (
                self._load_model_owned_capability_state_row_boundary(
                    authorized_page
                )
            )
            if (
                not torch.equal(
                    torch.tensor(
                        [authorized_page.page_id],
                        dtype=torch.long,
                    ),
                    expected_page_id_t.reshape(1),
                )
                or page_capability_state_t.shape[0] != 1
            ):
                raise RuntimeError(
                    "NoNE training branch retained page state differs"
                )
            capability_rows.append(page_capability_state_t[0].clone())
        capability_state_t = torch.stack(tuple(capability_rows), dim=0)
        capability_sha256_t = _tensor_payload_digest_t_boundary(
            capability_state_t
        )
        false_t = torch.zeros((), dtype=torch.bool)
        return NoNETrainingBranchResultPacket(
            scope=scope,
            source_generation=current,
            page_objects=tuple(page_objects),
            source_external_state_sha256_t=(
                source_external_state_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .clone()
            ),
            source_training_proof=training_proof,
            training_proof=retained_training_proof,
            model_owned_capability_state_t=capability_state_t,
            model_owned_capability_state_sha256_t=capability_sha256_t,
            global_training_claimed_t=false_t.clone(),
            global_full_physical_page_bank_traversal_claimed_t=(
                false_t.clone()
            ),
        )

    def verify_training_branch_result_boundary(
        self,
        result: NoNETrainingBranchResultPacket,
    ) -> NoNETrainingBranchResultPacket:
        """Re-read one result and reject any tensor changed after publication."""

        if not isinstance(result, NoNETrainingBranchResultPacket):
            raise TypeError("NoNE training branch result packet is malformed")
        verified = self.publish_training_branch_result_boundary(
            scope=result.scope,
            training_proof=result.source_training_proof,
            source_external_state_sha256_t=(
                result.source_external_state_sha256_t
            ),
        )
        object_identity_equal = bool(
            len(result.page_objects) == len(verified.page_objects)
            and all(
                torch.equal(left.page_id_t, right.page_id_t)
                and torch.equal(left.object_sha256_t, right.object_sha256_t)
                and torch.equal(left.object_bytes_t, right.object_bytes_t)
                for left, right in zip(
                    result.page_objects,
                    verified.page_objects,
                    strict=True,
                )
            )
        )
        if (
            not _same_generation_binding_boundary(
                result.source_generation,
                verified.source_generation,
            )
            or not object_identity_equal
            or not torch.equal(
                result.source_external_state_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
                verified.source_external_state_sha256_t,
            )
            or not torch.equal(
                page_training_proof_digest_t_boundary(
                    result.source_training_proof
                ),
                page_training_proof_digest_t_boundary(
                    verified.source_training_proof
                ),
            )
            or not torch.equal(
                page_training_proof_digest_t_boundary(result.training_proof),
                page_training_proof_digest_t_boundary(
                    verified.training_proof
                ),
            )
            or not torch.equal(
                result.model_owned_capability_state_t.detach().cpu(),
                verified.model_owned_capability_state_t,
            )
            or not torch.equal(
                result.model_owned_capability_state_sha256_t.detach().cpu(),
                verified.model_owned_capability_state_sha256_t,
            )
            or result.global_training_claimed_t.numel() != 1
            or bool(result.global_training_claimed_t.detach().cpu().bool())
            or result.global_full_physical_page_bank_traversal_claimed_t.numel()
            != 1
            or bool(
                result.global_full_physical_page_bank_traversal_claimed_t
                .detach()
                .cpu()
                .bool()
            )
        ):
            raise RuntimeError("NoNE training branch result tensors changed")
        return verified

    def validate_training_branch_rebase_authority_boundary(
        self,
        scope: NoNETrainingBranchScopePacket,
    ) -> torch.Tensor:
        """Bind a historical scope to an unchanged live page topology.

        The accepted pointer may advance, but the sealed source parent must
        remain an immutable generation in this session, every owned page must
        still exist, and its layer/objective assignment must be unchanged.
        This grants no pointer mutation and does not weaken the ordinary
        exact-parent fork validator.
        """

        validate_training_branch_scope_boundary(scope)
        session_id_t, session_root = self._require_session()
        current = self.discover_accepted_pointer_boundary()
        source_parent = self.verify_generation_boundary(
            generation_t=scope.parent_generation_t,
            manifest_payload_sha256_t=(
                scope.parent_manifest_payload_sha256_t
            ),
        )
        _loaded_source_parent, source_manifest = (
            self._load_generation_binding_boundary(
                source_parent.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    source_parent.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    source_parent.manifest_payload_sha256_t
                ),
            )
        )
        if (
            not torch.equal(
                scope.session_id_t,
                session_id_t.detach().cpu().long(),
            )
            or not torch.equal(
                current.session_id_t.detach().cpu().long(),
                scope.session_id_t,
            )
            or int(current.generation_t) <= int(source_parent.generation_t)
            or self._manifest is None
        ):
            raise RuntimeError("NoNE training branch rebase lineage differs")
        source_page_ids_t = self._manifest_page_ids_t_boundary(
            source_manifest
        )
        target_page_ids_t = self._manifest_page_ids_t_boundary(self._manifest)
        if (
            not bool(
                _page_ids_subset_t_boundary(
                    scope.page_ids_t,
                    source_page_ids_t,
                )
            )
            or not bool(
                _page_ids_subset_t_boundary(
                    scope.page_ids_t,
                    target_page_ids_t,
                )
            )
        ):
            raise RuntimeError(
                "NoNE training branch rebase contains a foreign page"
            )
        graph_authority = self._graph_authority
        if graph_authority is None:
            raise RuntimeError("NoNE training branch rebase has no graph authority")
        topology = _load_page_catalog_topology_boundary(
            catalog_path=Path(graph_authority.page_catalog_path),
            expected_sha256=_tensor_digest_hex(
                graph_authority.page_catalog_sha256_t
            ),
            identity_cache_root=(
                self._runtime_cache_root_boundary()
                / "artifact_sha256_cache"
            ),
            topology_cache_root=(
                self._release_topology_cache_root_boundary()
            ),
        )
        if not torch.equal(
            _page_catalog_layer_ids_for_page_ids_boundary(
                topology,
                scope.page_ids_t,
            ),
            scope.page_layer_ids_t,
        ):
            raise RuntimeError(
                "NoNE training branch rebase layer ownership differs"
            )
        graph_demand_t = (
            graph_authority.federated_growth_demand_authority_sha256_t
        )
        scope_demand_t = (
            scope.federated_growth_demand_authority_sha256_t
        )
        if (graph_demand_t is None) is not (scope_demand_t is None) or (
            graph_demand_t is not None
            and scope_demand_t is not None
            and not torch.equal(
                graph_demand_t.detach().cpu().to(dtype=torch.uint8),
                scope_demand_t.detach().cpu().to(dtype=torch.uint8),
            )
        ):
            raise RuntimeError(
                "NoNE federated training branch rebase authority differs"
            )
        return scope.scope_sha256_t.clone()

    @staticmethod
    def _manifest_page_rows_boundary(
        manifest: Mapping[str, Any],
    ) -> dict[int, dict[str, Any]]:
        """Return a strict immutable page-object identity index."""

        rows_value = manifest.get("pageObjects")
        if not isinstance(rows_value, list) or not rows_value:
            raise RuntimeError("NoNE generation page authority is absent")
        rows: dict[int, dict[str, Any]] = {}
        for value in rows_value:
            if (
                not isinstance(value, dict)
                or not isinstance(value.get("pageId"), int)
                or isinstance(value.get("pageId"), bool)
                or not isinstance(value.get("sha256"), str)
                or len(str(value["sha256"])) != 64
                or not isinstance(value.get("bytes"), int)
                or isinstance(value.get("bytes"), bool)
                or int(value["bytes"]) < 1
                or int(value["pageId"]) in rows
            ):
                raise RuntimeError("NoNE generation page authority differs")
            rows[int(value["pageId"])] = dict(value)
        return rows

    def _validate_training_branch_target_lineage_boundary(
        self,
        *,
        source_parent: NoNEGenerationBinding,
        target_parent: NoNEGenerationBinding,
    ) -> torch.Tensor:
        """Prove the live target descends from the branch's sealed parent."""

        descendant = target_parent
        source_parent_generation = int(source_parent.generation_t)
        observed_payload_sha256s: set[str] = set()
        while int(descendant.generation_t) > source_parent_generation:
            payload_sha256 = _tensor_digest_hex(
                descendant.manifest_payload_sha256_t
            )
            if payload_sha256 in observed_payload_sha256s:
                raise RuntimeError(
                    "NoNE training branch rebase lineage contains a cycle"
                )
            observed_payload_sha256s.add(payload_sha256)
            loaded, parent_payload_sha256 = (
                self._load_generation_lineage_summary_boundary(
                    generation_t=descendant.generation_t,
                    manifest_payload_sha256_t=(
                        descendant.manifest_payload_sha256_t
                    ),
                )
            )
            if (
                not _same_generation_binding_boundary(loaded, descendant)
                or not isinstance(parent_payload_sha256, str)
                or len(parent_payload_sha256) != 64
                or int(loaded.parent_generation_t)
                < source_parent_generation
                or int(loaded.parent_generation_t)
                >= int(loaded.generation_t)
            ):
                raise RuntimeError(
                    "NoNE training branch rebase lineage differs"
                )
            descendant, _parent_payload = (
                self._load_generation_lineage_summary_boundary(
                generation_t=loaded.parent_generation_t,
                manifest_payload_sha256_t=digest_tensor(
                    parent_payload_sha256
                ),
            )
            )
        if not _same_generation_binding_boundary(
            descendant,
            source_parent,
        ):
            raise RuntimeError("NoNE training branch rebase lineage differs")
        return target_parent.generation_t.detach().cpu().long().reshape(()).clone()

    @staticmethod
    def _page_object_binding_from_row_boundary(
        row: Mapping[str, Any],
    ) -> NoNEPageObjectBinding:
        """Convert one already validated manifest row to a tensor binding."""

        return NoNEPageObjectBinding(
            page_id_t=torch.tensor(int(row["pageId"]), dtype=torch.long),
            object_sha256_t=digest_tensor(str(row["sha256"])),
            object_bytes_t=torch.tensor(int(row["bytes"]), dtype=torch.long),
        )

    @staticmethod
    def _materialize_page_binding_boundary(
        store: NoNEImmutablePageStore,
        binding: NoNEPageObjectBinding,
        *,
        dtype: torch.dtype = torch.float32,
    ) -> NoNEPageBundle:
        """Materialize one exact object for storage-boundary equality proof."""

        row = store._page_object_row_boundary(binding)
        object_sha256 = str(row["sha256"])
        return store._materialize_verified_immutable_cpu_page_boundary(
            object_path=store._object_path_boundary(
                object_sha256,
                expected_bytes=int(row["bytes"]),
            ),
            object_sha256=object_sha256,
            dtype=dtype,
            delta_chain=(),
        )

    @staticmethod
    def _page_object_materialized_storage_dtype_boundary(
        store: NoNEImmutablePageStore,
        binding: NoNEPageObjectBinding,
    ) -> torch.dtype:
        """Read the exact materialized weight dtype from immutable storage."""

        row = store._page_object_row_boundary(binding)
        object_path = store._object_path_boundary(
            str(row["sha256"]),
            expected_bytes=int(row["bytes"]),
        )
        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            revision = store._page_format_revision_boundary(handle)
            if revision == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION:
                storage_dtype_t = (
                    handle.get_tensor("delta_storage_dtype_t")
                    .reshape(-1)
                    .long()
                )
                if storage_dtype_t.shape != (1,):
                    raise RuntimeError(
                        "base-bound delta storage dtype differs"
                    )
                dtype = _storage_dtype_from_code(int(storage_dtype_t[0]))
            elif "gate_t_dtype_t" in set(handle.keys()):
                storage_dtype_t = (
                    handle.get_tensor("gate_t_dtype_t")
                    .reshape(-1)
                    .long()
                )
                if storage_dtype_t.shape != (1,):
                    raise RuntimeError(
                        "direct page materialized dtype differs"
                    )
                dtype = _storage_dtype_from_code(int(storage_dtype_t[0]))
            else:
                dtype = handle.get_tensor("gate_t").dtype
        if dtype not in {torch.float32, torch.bfloat16, torch.float16}:
            raise RuntimeError("direct page materialized dtype is unsupported")
        return dtype

    def _materialize_and_reseal_direct_page_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        source_object: NoNEPageObjectBinding,
    ) -> NoNEPageObjectBinding:
        """Flatten any dependency chain and publish one exact direct object."""

        materialized_dtype = (
            self._page_object_materialized_storage_dtype_boundary(
                source_store,
                source_object,
            )
        )
        materialized = self._materialize_page_binding_boundary(
            source_store,
            source_object,
            dtype=materialized_dtype,
        )
        direct = self.stage_self_contained_direct_page_object_boundary(
            materialized,
            sync_directory=False,
        )
        self._reconciled_direct_page_header_boundary(direct)
        return direct

    def _rebase_training_branch_page_object_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        source_parent_object: NoNEPageObjectBinding,
        source_object: NoNEPageObjectBinding,
        target_parent_object: NoNEPageObjectBinding,
    ) -> tuple[NoNEPageObjectBinding, bool, bool, bool]:
        """Return direct object plus conflict/storage/applied proof bits."""

        source_parent_bundle = self._materialize_page_binding_boundary(
            source_store,
            source_parent_object,
        )
        target_parent_bundle = self._materialize_page_binding_boundary(
            self,
            target_parent_object,
        )
        branch_terminal_bundle = self._materialize_page_binding_boundary(
            source_store,
            source_object,
        )
        merged_bundle = _three_way_merge_training_page_bundle_boundary(
            source_parent=source_parent_bundle,
            target_parent=target_parent_bundle,
            branch_terminal=branch_terminal_bundle,
        )
        if _same_page_bundle_boundary(merged_bundle, target_parent_bundle):
            direct_target = (
                self._materialize_and_reseal_direct_page_boundary(
                    source_store=self,
                    source_object=target_parent_object,
                )
            )
            self.require_self_contained_direct_page_object_boundary(
                direct_target
            )
            return (
                direct_target,
                False,
                not _same_page_object_binding_boundary(
                    direct_target,
                    target_parent_object,
                ),
                False,
            )
        sealed = self.stage_self_contained_direct_page_object_boundary(
            merged_bundle,
            sync_directory=False,
        )
        rebased_bundle = self._materialize_page_binding_boundary(
            self,
            sealed,
        )
        if not _same_page_bundle_boundary(
            merged_bundle,
            rebased_bundle,
        ):
            raise RuntimeError(
                "NoNE training branch rebase changed page or optimizer state"
            )
        return sealed, True, False, True

    def compose_training_branch_result_union_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        results: tuple[NoNETrainingBranchResultPacket, ...],
        training_data_union_json_t: torch.Tensor,
    ) -> NoNETrainingBranchUnionPacket:
        """Import disjoint branch results onto the current accepted parent.

        An ordinary union keeps its exact fork parent.  When that parent is
        historical, the accepted target must descend from it. Each terminal
        page is then already subsumed, unchanged from the source, directly
        applicable because the target is unchanged, or conflict-merged as
        ``target + (branch - source)`` and resealed against the target. This
        method never stages a generation or moves a pointer.
        """

        self._require_staged_read_only_write_guard_boundary()
        if not results or len(source_stores) != len(results):
            raise ValueError("NoNE training branch union requires every source")
        training_data_union, training_data_union_sha256_t = (
            _training_data_union_record_from_tensor_boundary(
                training_data_union_json_t
            )
        )
        scopes = tuple(result.scope for result in results)
        owned_page_ids_t = (
            validate_common_parent_training_branch_scopes_boundary(scopes)
        )
        parent_scope = scopes[0]
        current = self.discover_accepted_pointer_boundary()
        if not torch.equal(
            current.session_id_t,
            parent_scope.session_id_t,
        ):
            raise RuntimeError("NoNE training branch merge parent drifted")
        exact_parent = bool(
            torch.equal(
                current.generation_t,
                parent_scope.parent_generation_t,
            )
            and torch.equal(
                current.manifest_payload_sha256_t,
                parent_scope.parent_manifest_payload_sha256_t,
            )
        )
        if exact_parent:
            for scope in scopes:
                self.validate_training_branch_fork_authority_boundary(scope)
        else:
            for scope in scopes:
                self.validate_training_branch_rebase_authority_boundary(scope)
        graph_authority = self.current_graph_authority_boundary()
        if graph_authority is None:
            raise RuntimeError("NoNE training branch merge has no graph authority")
        federated_growth_demand_authority_sha256_t = (
            _federated_training_union_authority_from_graph_boundary(
                graph_authority=graph_authority,
                scopes=scopes,
                training_data_union=training_data_union,
            )
        )
        if self._manifest is None:
            raise RuntimeError("NoNE training branch merge parent is absent")
        source_parent = self.verify_generation_boundary(
            generation_t=parent_scope.parent_generation_t,
            manifest_payload_sha256_t=(
                parent_scope.parent_manifest_payload_sha256_t
            ),
        )
        _loaded_source_parent, source_parent_manifest = (
            self._load_generation_binding_boundary(
                source_parent.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    source_parent.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    source_parent.manifest_payload_sha256_t
                ),
            )
        )
        source_parent_rows = self._manifest_page_rows_boundary(
            source_parent_manifest
        )
        target_parent_rows = self._manifest_page_rows_boundary(self._manifest)
        accepted_page_ids_t = torch.sort(
            self._manifest_page_ids_t_boundary(self._manifest)
        ).values
        if not bool(
            _page_ids_subset_t_boundary(
                owned_page_ids_t,
                accepted_page_ids_t,
            )
        ):
            raise RuntimeError("NoNE training branch union contains a foreign page")

        verified_results: list[NoNETrainingBranchResultPacket] = []
        target_objects: list[NoNEPageObjectBinding] = []
        replication_rows: list[
            tuple[NoNEImmutablePageStore, NoNEPageObjectBinding]
        ] = []
        source_store_by_page: dict[int, NoNEImmutablePageStore] = {}
        source_object_by_page: dict[int, NoNEPageObjectBinding] = {}
        page_branch_index: dict[int, int] = {}
        branch_parent_rows: list[dict[int, dict[str, Any]]] = []
        branch_source_manifest_sha256s: list[torch.Tensor] = []
        branch_source_manifest_payload_sha256s: list[torch.Tensor] = []
        branch_source_external_state_sha256s: list[torch.Tensor] = []
        branch_source_optimizer_sha256s: list[torch.Tensor] = []
        capability_rows: dict[int, torch.Tensor] = {}
        union_layer_rows: dict[int, int] = {}
        for branch_index, (source_store, result) in enumerate(
            zip(source_stores, results, strict=True)
        ):
            _validate_cumulative_training_branch_result_proof_boundary(
                result.scope,
                result.source_training_proof,
            )
            verified = source_store.verify_training_branch_result_boundary(
                result
            )
            verified_results.append(verified)
            loaded_source, source_manifest = (
                source_store._load_generation_binding_boundary(
                    verified.source_generation.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        verified.source_generation.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        verified.source_generation
                        .manifest_payload_sha256_t
                    ),
                )
            )
            source_components = source_manifest.get("components")
            source_optimizer = (
                source_components.get("optimizer")
                if isinstance(source_components, dict)
                else None
            )
            source_optimizer_sha256 = (
                source_optimizer.get("sha256")
                if isinstance(source_optimizer, dict)
                else None
            )
            branch_parent = source_store.verify_generation_boundary(
                generation_t=parent_scope.parent_generation_t,
                manifest_payload_sha256_t=(
                    parent_scope.parent_manifest_payload_sha256_t
                ),
            )
            _loaded_branch_parent, branch_parent_manifest = (
                source_store._load_generation_binding_boundary(
                    branch_parent.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        branch_parent.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        branch_parent.manifest_payload_sha256_t
                    ),
                )
            )
            if (
                not _same_generation_binding_boundary(
                    loaded_source,
                    verified.source_generation,
                )
                or not _same_generation_binding_boundary(
                    branch_parent,
                    source_parent,
                )
                or not isinstance(source_optimizer_sha256, str)
                or not _is_sha256_hex_boundary(source_optimizer_sha256)
            ):
                raise RuntimeError(
                    "NoNE training branch source manifest authority differs"
                )
            branch_parent_rows.append(
                self._manifest_page_rows_boundary(branch_parent_manifest)
            )
            branch_source_manifest_sha256s.append(
                verified.source_generation.manifest_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .clone()
            )
            branch_source_manifest_payload_sha256s.append(
                verified.source_generation.manifest_payload_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .clone()
            )
            branch_source_external_state_sha256s.append(
                verified.source_external_state_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .clone()
            )
            branch_source_optimizer_sha256s.append(
                digest_tensor(source_optimizer_sha256)
            )
            scope_layer_by_page = {
                int(page_id_t): int(verified.scope.page_layer_ids_t[row_index])
                for row_index, page_id_t in enumerate(verified.scope.page_ids_t)
            }
            for row_index, page_id_t in enumerate(
                verified.training_proof.family_page_ids_t
            ):
                page_id = int(page_id_t)
                union_layer_rows[page_id] = scope_layer_by_page[page_id]
                capability_rows[page_id] = (
                    verified.model_owned_capability_state_t[row_index]
                    .detach()
                    .cpu()
                    .clone()
                )
            for page_object in verified.page_objects:
                page_id = int(page_object.page_id_t)
                if page_id in source_object_by_page:
                    raise RuntimeError(
                        "NoNE training branch union object set overlaps"
                    )
                source_store_by_page[page_id] = source_store
                source_object_by_page[page_id] = page_object
                page_branch_index[page_id] = branch_index
                replication_rows.append(
                    (source_store, page_object)
                )

        union_page_ids_t = torch.sort(
            torch.cat(
                tuple(
                    result.training_proof.family_page_ids_t.detach()
                    .cpu()
                    .long()
                    for result in verified_results
                )
            )
        ).values

        lineage_rebase: NoNETrainingBranchRebasePacket | None = None
        if exact_parent:
            def materialize_and_reseal_row(
                row: tuple[
                    NoNEImmutablePageStore,
                    NoNEPageObjectBinding,
                ],
            ) -> NoNEPageObjectBinding:
                source_store, page_object = row
                return self._materialize_and_reseal_direct_page_boundary(
                    source_store=source_store,
                    source_object=page_object,
                )

            worker_count = min(
                _PAGE_MATERIALIZATION_IO_WORKERS,
                len(replication_rows),
            )
            with ThreadPoolExecutor(
                max_workers=worker_count,
                thread_name_prefix="nnf-page-replica",
            ) as executor:
                for offset in range(
                    0,
                    len(replication_rows),
                    worker_count,
                ):
                    chunk = replication_rows[
                        offset : offset + worker_count
                    ]
                    target_objects.extend(
                        executor.map(materialize_and_reseal_row, chunk)
                    )
            self.sync_staged_page_objects_boundary()
        else:
            target_lineage_generation_t = (
                self._validate_training_branch_target_lineage_boundary(
                    source_parent=source_parent,
                    target_parent=current,
                )
            )
            page_branch_indices: list[int] = []
            source_parent_object_sha256s: list[torch.Tensor] = []
            source_parent_object_bytes: list[int] = []
            target_parent_object_sha256s: list[torch.Tensor] = []
            target_parent_object_bytes: list[int] = []
            lineage_witness_generations: list[int] = []
            lineage_witness_object_sha256s: list[torch.Tensor] = []
            lineage_witness_object_bytes: list[int] = []
            branch_object_sha256s: list[torch.Tensor] = []
            branch_object_bytes: list[int] = []
            applied_page_mask: list[bool] = []
            resealed_page_mask: list[bool] = []
            storage_normalized_page_mask: list[bool] = []
            final_object_sha256s: list[torch.Tensor] = []
            final_object_bytes: list[int] = []
            for page_id_t in union_page_ids_t:
                page_id = int(page_id_t)
                owning_branch_index = page_branch_index.get(page_id)
                source_page_object = source_object_by_page.get(page_id)
                owning_source_store = source_store_by_page.get(page_id)
                source_parent_row = source_parent_rows.get(page_id)
                target_parent_row = target_parent_rows.get(page_id)
                branch_parent_row = (
                    branch_parent_rows[owning_branch_index].get(page_id)
                    if owning_branch_index is not None
                    else None
                )
                if (
                    owning_branch_index is None
                    or source_page_object is None
                    or owning_source_store is None
                    or source_parent_row is None
                    or target_parent_row is None
                    or branch_parent_row is None
                    or branch_parent_row.get("sha256")
                    != source_parent_row.get("sha256")
                    or branch_parent_row.get("bytes")
                    != source_parent_row.get("bytes")
                ):
                    raise RuntimeError(
                        "NoNE training branch rebase source page differs"
                    )
                target_parent_object = (
                    self._page_object_binding_from_row_boundary(
                        target_parent_row
                    )
                )
                source_parent_object = (
                    self._page_object_binding_from_row_boundary(
                        branch_parent_row
                    )
                )
                branch_matches_target = (
                    _same_page_object_binding_boundary(
                        source_page_object,
                        target_parent_object,
                    )
                )
                branch_matches_source = (
                    _same_page_object_binding_boundary(
                        source_page_object,
                        source_parent_object,
                    )
                )
                target_matches_source = (
                    _same_page_object_binding_boundary(
                        target_parent_object,
                        source_parent_object,
                    )
                )
                if branch_matches_target or branch_matches_source:
                    final_object = (
                        self._materialize_and_reseal_direct_page_boundary(
                            source_store=self,
                            source_object=target_parent_object,
                        )
                    )
                    self.require_self_contained_direct_page_object_boundary(
                        final_object
                    )
                    resealed = not _same_page_object_binding_boundary(
                        final_object,
                        target_parent_object,
                    )
                    # This is storage normalization only.  A direct-object
                    # identity change must never become a semantic training
                    # application or expand coverage.
                    applied = False
                    storage_normalized = resealed
                    resealed = False
                elif target_matches_source:
                    final_object = (
                        self._materialize_and_reseal_direct_page_boundary(
                            source_store=owning_source_store,
                            source_object=source_page_object,
                        )
                    )
                    resealed = True
                    storage_normalized = False
                    applied = True
                else:
                    (
                        final_object,
                        resealed,
                        storage_normalized,
                        applied,
                    ) = (
                        self._rebase_training_branch_page_object_boundary(
                            source_store=owning_source_store,
                            source_parent_object=source_parent_object,
                            source_object=source_page_object,
                            target_parent_object=target_parent_object,
                        )
                )
                target_objects.append(final_object)
                page_branch_indices.append(owning_branch_index)
                source_parent_object_sha256s.append(
                    digest_tensor(str(source_parent_row["sha256"]))
                )
                source_parent_object_bytes.append(
                    int(source_parent_row["bytes"])
                )
                target_parent_object_sha256s.append(
                    target_parent_object.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                )
                target_parent_object_bytes.append(
                    int(target_parent_object.object_bytes_t)
                )
                lineage_witness_generations.append(
                    int(target_lineage_generation_t)
                )
                lineage_witness_object_sha256s.append(
                    target_parent_object.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                )
                lineage_witness_object_bytes.append(
                    int(target_parent_object.object_bytes_t)
                )
                branch_object_sha256s.append(
                    source_page_object.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                )
                branch_object_bytes.append(
                    int(source_page_object.object_bytes_t)
                )
                applied_page_mask.append(applied)
                resealed_page_mask.append(resealed)
                storage_normalized_page_mask.append(
                    storage_normalized
                )
                final_object_sha256s.append(
                    final_object.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                )
                final_object_bytes.append(
                    int(final_object.object_bytes_t)
                )
            self.sync_staged_page_objects_boundary()
            if not any(applied_page_mask):
                raise RuntimeError(
                    "NoNE training branch rebase is already fully subsumed"
                )
            lineage_rebase = NoNETrainingBranchRebasePacket(
                source_parent_generation_t=(
                    parent_scope.parent_generation_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                    .clone()
                ),
                source_parent_manifest_payload_sha256_t=(
                    parent_scope.parent_manifest_payload_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                ),
                target_parent_generation_t=(
                    current.generation_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                    .clone()
                ),
                target_parent_manifest_payload_sha256_t=(
                    current.manifest_payload_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                ),
                branch_source_generations_t=torch.stack(
                    tuple(
                        result.source_generation.generation_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                        for result in verified_results
                    )
                ),
                branch_source_manifest_sha256s_t=torch.stack(
                    tuple(branch_source_manifest_sha256s)
                ),
                branch_source_manifest_payload_sha256s_t=torch.stack(
                    tuple(branch_source_manifest_payload_sha256s)
                ),
                branch_source_external_state_sha256s_t=torch.stack(
                    tuple(branch_source_external_state_sha256s)
                ),
                branch_source_optimizer_sha256s_t=torch.stack(
                    tuple(branch_source_optimizer_sha256s)
                ),
                training_page_ids_t=union_page_ids_t.clone(),
                page_branch_indices_t=torch.tensor(
                    page_branch_indices,
                    dtype=torch.long,
                ),
                source_parent_object_sha256s_t=torch.stack(
                    tuple(source_parent_object_sha256s)
                ),
                source_parent_object_bytes_t=torch.tensor(
                    source_parent_object_bytes,
                    dtype=torch.long,
                ),
                target_parent_object_sha256s_t=torch.stack(
                    tuple(target_parent_object_sha256s)
                ),
                target_parent_object_bytes_t=torch.tensor(
                    target_parent_object_bytes,
                    dtype=torch.long,
                ),
                lineage_witness_generations_t=torch.tensor(
                    lineage_witness_generations,
                    dtype=torch.long,
                ),
                lineage_witness_object_sha256s_t=torch.stack(
                    tuple(lineage_witness_object_sha256s)
                ),
                lineage_witness_object_bytes_t=torch.tensor(
                    lineage_witness_object_bytes,
                    dtype=torch.long,
                ),
                branch_object_sha256s_t=torch.stack(
                    tuple(branch_object_sha256s)
                ),
                branch_object_bytes_t=torch.tensor(
                    branch_object_bytes,
                    dtype=torch.long,
                ),
                applied_page_mask_t=torch.tensor(
                    applied_page_mask,
                    dtype=torch.bool,
                ),
                resealed_page_mask_t=torch.tensor(
                    resealed_page_mask,
                    dtype=torch.bool,
                ),
                storage_normalized_page_mask_t=torch.tensor(
                    storage_normalized_page_mask,
                    dtype=torch.bool,
                ),
                final_object_sha256s_t=torch.stack(
                    tuple(final_object_sha256s)
                ),
                final_object_bytes_t=torch.tensor(
                    final_object_bytes,
                    dtype=torch.long,
                ),
                rebase_sha256_t=torch.zeros(32, dtype=torch.uint8),
            )
            lineage_rebase = replace(
                lineage_rebase,
                rebase_sha256_t=(
                    _training_branch_rebase_digest_t_boundary(
                        lineage_rebase
                    )
                ),
            )

        target_object_by_page = {
            int(binding.page_id_t): binding for binding in target_objects
        }
        if set(target_object_by_page) != set(union_page_ids_t.tolist()):
            raise RuntimeError("NoNE training branch union object set differs")
        merged_proof = combine_page_training_proofs(
            tuple(result.training_proof for result in verified_results)
        )
        if (
            not torch.equal(
                merged_proof.family_page_ids_t.detach().cpu().long(),
                union_page_ids_t,
            )
        ):
            raise RuntimeError("NoNE training branch union proof differs")
        capability_state_t = torch.stack(
            tuple(capability_rows[int(page_id)] for page_id in union_page_ids_t),
            dim=0,
        )
        capability_sha256_t = _tensor_payload_digest_t_boundary(
            capability_state_t
        )
        prior_training_page_ids_t = (
            self.current_training_proven_page_ids_t_boundary()
        )
        cumulative_training_page_ids_t = torch.sort(
            torch.unique(
                torch.cat((prior_training_page_ids_t, union_page_ids_t))
            )
        ).values
        full_union_coverage_t = torch.tensor(
            bool(
                cumulative_training_page_ids_t.shape
                == accepted_page_ids_t.shape
                and torch.equal(
                    cumulative_training_page_ids_t,
                    accepted_page_ids_t,
                )
            ),
            dtype=torch.bool,
        )
        dataset_training_claimed_t = torch.tensor(
            bool(training_data_union["globalDatasetTrainingClaimed"]),
            dtype=torch.bool,
        )
        global_training_claimed_t = (
            full_union_coverage_t & dataset_training_claimed_t
        )
        branch_scope_sha256s_t = torch.stack(
            tuple(scope.scope_sha256_t for scope in scopes),
            dim=0,
        )
        union_page_layer_ids_t = torch.tensor(
            [union_layer_rows[int(page_id)] for page_id in union_page_ids_t],
            dtype=torch.long,
        )
        union_page_objects = tuple(
            target_object_by_page[int(page_id)] for page_id in union_page_ids_t
        )
        for page_object in union_page_objects:
            self.require_self_contained_direct_page_object_boundary(
                page_object
            )
        lineage_rebase_sha256_t = (
            lineage_rebase.rebase_sha256_t
            if lineage_rebase is not None
            else None
        )
        union_sha256_t = _training_branch_union_digest_t_boundary(
            parent_session_id_t=current.session_id_t,
            parent_generation_t=current.generation_t,
            parent_manifest_payload_sha256_t=(
                current.manifest_payload_sha256_t
            ),
            branch_scope_sha256s_t=branch_scope_sha256s_t,
            union_page_ids_t=union_page_ids_t,
            union_page_layer_ids_t=union_page_layer_ids_t,
            page_objects=union_page_objects,
            training_proof=merged_proof,
            model_owned_capability_state_sha256_t=capability_sha256_t,
            training_data_union_sha256_t=training_data_union_sha256_t,
            global_physical_page_training_claimed_t=full_union_coverage_t,
            global_dataset_training_claimed_t=dataset_training_claimed_t,
            global_training_claimed_t=global_training_claimed_t,
            global_full_physical_page_bank_traversal_claimed_t=(
                full_union_coverage_t
            ),
            federated_growth_demand_authority_sha256_t=(
                federated_growth_demand_authority_sha256_t
            ),
            lineage_rebase_sha256_t=lineage_rebase_sha256_t,
        )
        union = NoNETrainingBranchUnionPacket(
            parent_session_id_t=current.session_id_t.clone(),
            parent_generation_t=current.generation_t.clone(),
            parent_manifest_payload_sha256_t=(
                current.manifest_payload_sha256_t.clone()
            ),
            branch_scope_sha256s_t=branch_scope_sha256s_t,
            union_page_ids_t=union_page_ids_t,
            union_page_layer_ids_t=union_page_layer_ids_t,
            page_objects=union_page_objects,
            training_proof=merged_proof,
            model_owned_capability_state_t=capability_state_t,
            model_owned_capability_state_sha256_t=capability_sha256_t,
            training_data_union_json_t=(
                training_data_union_json_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1)
                .clone()
            ),
            training_data_union_sha256_t=(
                training_data_union_sha256_t.clone()
            ),
            global_physical_page_training_claimed_t=(
                full_union_coverage_t.clone()
            ),
            global_dataset_training_claimed_t=(
                dataset_training_claimed_t.clone()
            ),
            global_training_claimed_t=global_training_claimed_t.clone(),
            global_full_physical_page_bank_traversal_claimed_t=(
                full_union_coverage_t.clone()
            ),
            union_sha256_t=union_sha256_t,
            federated_growth_demand_authority_sha256_t=(
                federated_growth_demand_authority_sha256_t.clone()
                if federated_growth_demand_authority_sha256_t is not None
                else None
            ),
            lineage_rebase=lineage_rebase,
        )
        _validate_training_branch_union_packet_boundary(union)
        return union

    def _require_staged_read_only_write_guard_boundary(self) -> None:
        """Reject every write before a pointerless cold-proof view mutates disk."""

        if self._read_only_staged_binding is not None:
            raise RuntimeError(
                "NoNE staged read-only view cannot acquire writer authority"
            )

    def _acquire_generation_writer_boundary(self) -> None:
        """Fence one session's generation allocation through pointer resolution."""

        self._require_staged_read_only_write_guard_boundary()
        session_id_t, session_root = self._require_session()
        session_key = _session_key(session_id_t)
        if self._generation_writer_handle is not None:
            if self._generation_writer_session_key != session_key:
                raise RuntimeError("NoNE generation writer crossed session ownership")
            return
        handle = (session_root / "generation_writer.lock").open("a+b")
        try:
            fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
        except BlockingIOError as exc:
            handle.close()
            raise RuntimeError(
                "NoNE generation writer lease is already held"
            ) from exc
        self._generation_writer_handle = handle
        self._generation_writer_session_key = session_key
        try:
            self._refresh_page_object_write_placement_boundary()
            # Refresh the accepted pointer only after the process owns
            # allocation.  This is the already-bound same-session path: calling
            # begin_session() here would discard immutable parents cached while
            # encoding the candidate scratch deltas immediately before semantic
            # admission.  Pointer discovery retains only identity-bound objects
            # and still revalidates any concurrent accepted-generation advance.
            pointer_path = session_root / "accepted.json"
            if pointer_path.is_file():
                self.discover_accepted_pointer_boundary()
            elif (
                self._manifest is not None
                or self._accepted_binding_boundary is not None
                or not torch.equal(
                    self._accepted_generation_t,
                    torch.zeros((), dtype=torch.long),
                )
            ):
                raise RuntimeError(
                    "NoNE accepted pointer disappeared before writer refresh"
                )
        except Exception:
            self._release_generation_writer_boundary()
            raise

    def _release_generation_writer_boundary(self) -> None:
        """Release this process's explicit generation-writer boundary lease."""

        handle = self._generation_writer_handle
        self._generation_writer_handle = None
        self._generation_writer_session_key = None
        if handle is None:
            return
        try:
            fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
        finally:
            handle.close()

    def discard_staged_generation_boundary(self) -> None:
        """Abandon staged authority while retaining immutable orphan evidence."""

        self._release_generation_writer_boundary()

    def _load_generation_binding_boundary(
        self,
        manifest_relative_path: str,
        *,
        expected_manifest_sha256: str | None = None,
        expected_payload_sha256: str | None = None,
    ) -> tuple[NoNEGenerationBinding, dict[str, Any]]:
        session_id_t, session_root = self._require_session()
        manifest_path = (session_root / manifest_relative_path).resolve()
        if (
            not manifest_path.is_relative_to(session_root)
            or not manifest_path.is_file()
        ):
            raise RuntimeError(
                "NoNE generation manifest is missing or outside its session"
            )
        (
            manifest_sha256,
            manifest,
            payload_sha256,
            _page_rows,
        ) = _read_generation_manifest_authority_cached(manifest_path)
        if (
            expected_manifest_sha256 is not None
            and manifest_sha256 != expected_manifest_sha256
        ):
            raise RuntimeError("NoNE generation manifest changed")
        if not page_generation_schema_supported_boundary(
            manifest.get("schema")
        ):
            raise RuntimeError("NoNE page generation schema mismatch")
        if manifest.get("sessionKey") != _session_key(session_id_t):
            raise RuntimeError("NoNE page generation crossed session ownership")
        if manifest.get("manifestPayloadSha256") != payload_sha256:
            raise RuntimeError("NoNE page generation payload hash mismatch")
        self._validate_page_object_placement_manifest_boundary(manifest)
        if (
            expected_payload_sha256 is not None
            and payload_sha256 != expected_payload_sha256
        ):
            raise RuntimeError("NoNE generation payload identity differs")
        generation = manifest.get("generation")
        parent_generation = manifest.get("parentGeneration")
        updated_page_ids = manifest.get("updatedPageIds")
        if (
            not isinstance(generation, int)
            or isinstance(generation, bool)
            or generation < 1
            or not isinstance(parent_generation, int)
            or isinstance(parent_generation, bool)
            or parent_generation < 0
            or not isinstance(updated_page_ids, list)
            or not all(
                isinstance(page_id, int) and not isinstance(page_id, bool)
                for page_id in updated_page_ids
            )
        ):
            raise RuntimeError("NoNE generation identity is malformed")
        binding = NoNEGenerationBinding(
            session_id_t=session_id_t.detach().cpu().long().clone(),
            generation_t=torch.tensor(generation, dtype=torch.long),
            parent_generation_t=torch.tensor(
                parent_generation,
                dtype=torch.long,
            ),
            manifest_sha256_t=digest_tensor(manifest_sha256),
            manifest_payload_sha256_t=digest_tensor(payload_sha256),
            updated_page_ids_t=torch.tensor(
                updated_page_ids,
                dtype=torch.long,
            ),
            manifest_relative_path=str(manifest_path.relative_to(session_root)),
        )
        parent_manifest_payload_sha256 = manifest.get(
            "parentManifestPayloadSha256"
        )
        _cache_generation_lineage_summary_boundary(
            session_root=session_root,
            binding_record=binding.external_record_boundary(),
            parent_manifest_payload_sha256=(
                parent_manifest_payload_sha256
                if isinstance(parent_manifest_payload_sha256, str)
                else None
            ),
            expected_identity=_file_identity(manifest_path),
        )
        return binding, manifest

    def _load_generation_lineage_summary_boundary(
        self,
        *,
        generation_t: torch.Tensor,
        manifest_payload_sha256_t: torch.Tensor,
    ) -> tuple[NoNEGenerationBinding, str | None]:
        """Load compact verified ancestry, falling back to full verification."""

        session_id_t, session_root = self._require_session()
        generation = int(generation_t.detach().cpu().long().reshape(()))
        payload_sha256 = _tensor_digest_hex(manifest_payload_sha256_t)
        manifest_relative_path = (
            f"generations/generation_{generation:08d}_{payload_sha256}"
            "/generation.json"
        )
        manifest_path = (session_root / manifest_relative_path).resolve()
        if (
            not manifest_path.is_relative_to(session_root)
            or not manifest_path.is_file()
        ):
            raise RuntimeError(
                "NoNE generation manifest is missing or outside its session"
            )
        identity = _file_identity(manifest_path)
        cached: (
            tuple[_FileIdentity, dict[str, Any], str | None] | None
        )
        with _GENERATION_JSON_CACHE_LOCK:
            cached = _GENERATION_LINEAGE_SUMMARY_CACHE.get(manifest_path)
            if cached is not None and cached[0] == identity:
                _GENERATION_LINEAGE_SUMMARY_CACHE.pop(manifest_path)
                _GENERATION_LINEAGE_SUMMARY_CACHE[manifest_path] = cached
            else:
                _GENERATION_LINEAGE_SUMMARY_CACHE.pop(manifest_path, None)
                cached = None
        if cached is not None:
            try:
                binding = generation_binding_from_record_boundary(cached[1])
                if (
                    not torch.equal(binding.session_id_t, session_id_t)
                    or not torch.equal(
                        binding.generation_t,
                        generation_t.detach().cpu().long().reshape(()),
                    )
                    or not torch.equal(
                        binding.manifest_payload_sha256_t,
                        manifest_payload_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(-1),
                    )
                    or (
                        cached[2] is not None
                        and not _is_sha256_hex_boundary(cached[2])
                    )
                ):
                    raise RuntimeError(
                        "NoNE generation lineage summary differs"
                    )
                return binding, cached[2]
            except RuntimeError:
                with _GENERATION_JSON_CACHE_LOCK:
                    _GENERATION_LINEAGE_SUMMARY_CACHE.pop(
                        manifest_path,
                        None,
                    )
        binding, manifest = self._load_generation_binding_boundary(
            manifest_relative_path,
            expected_payload_sha256=payload_sha256,
        )
        parent_manifest_payload_sha256 = manifest.get(
            "parentManifestPayloadSha256"
        )
        return (
            binding,
            (
                parent_manifest_payload_sha256
                if isinstance(parent_manifest_payload_sha256, str)
                else None
            ),
        )

    def current_generation_binding_boundary(self) -> NoNEGenerationBinding:
        """Return the exact accepted generation for checkpoint sidecar binding."""

        _session_id_t, session_root = self._require_session()
        binding = self.discover_accepted_pointer_boundary()
        manifest_path = session_root / binding.manifest_relative_path
        if not manifest_path.is_file():
            raise RuntimeError("NoNE accepted generation binding disappeared")
        return binding

    def current_generation_components_for_training_proof_boundary(
        self,
        training_proof_digest_t: torch.Tensor,
    ) -> NoNEGenerationComponentPacket:
        """Reuse the exact accepted graph components for a page-only union."""

        binding = self.current_generation_binding_boundary()
        loaded, manifest = self._load_generation_binding_boundary(
            binding.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                binding.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        )
        if not _same_generation_binding_boundary(loaded, binding):
            raise RuntimeError("NoNE accepted component generation changed")
        components = manifest.get("components")
        component_names = (
            "parent",
            "model",
            "optimizer",
            "scheduler",
            "rng",
            "rbo",
            "fabric",
            "vge",
            "router",
            "corpus",
        )
        legacy_code_bound = (
            manifest.get("schema") == PAGE_GENERATION_SCHEMA_V2
        )
        if not isinstance(components, dict):
            raise RuntimeError("NoNE accepted generation components are absent")
        component_sha256s: list[str] = []
        for name in component_names:
            record = components.get(name)
            sha256 = record.get("sha256") if isinstance(record, dict) else None
            if not isinstance(sha256, str) or len(sha256) != 64:
                raise RuntimeError(
                    f"NoNE accepted generation {name} component differs"
                )
            component_sha256s.append(sha256)
        legacy_code_digest_t: torch.Tensor | None = None
        if legacy_code_bound:
            legacy_code = components.get("code")
            legacy_code_sha256 = (
                legacy_code.get("sha256")
                if isinstance(legacy_code, dict)
                else None
            )
            if not _valid_sha256_boundary(legacy_code_sha256):
                raise RuntimeError(
                    "NoNE accepted generation code component differs"
                )
            legacy_code_digest_t = digest_tensor(
                cast(str, legacy_code_sha256)
            )
        proof_digest_t = (
            training_proof_digest_t.detach().cpu().to(dtype=torch.uint8)
        )
        if proof_digest_t.shape != (32,):
            raise ValueError("NoNE branch union proof digest must contain 32 bytes")
        return NoNEGenerationComponentPacket(
            parent_digest_t=digest_tensor(component_sha256s[0]),
            shared_model_digest_t=digest_tensor(component_sha256s[1]),
            global_optimizer_digest_t=digest_tensor(component_sha256s[2]),
            scheduler_digest_t=digest_tensor(component_sha256s[3]),
            rng_digest_t=digest_tensor(component_sha256s[4]),
            rbo_digest_t=digest_tensor(component_sha256s[5]),
            fabric_digest_t=digest_tensor(component_sha256s[6]),
            vge_digest_t=digest_tensor(component_sha256s[7]),
            router_digest_t=digest_tensor(component_sha256s[8]),
            corpus_digest_t=digest_tensor(component_sha256s[9]),
            code_digest_t=legacy_code_digest_t,
            training_proof_digest_t=proof_digest_t.clone(),
        )

    def accepted_pointer_record_boundary(
        self,
        binding: NoNEGenerationBinding,
        graph_authority: NoNEGraphAuthorityBinding | None = None,
        *,
        generation_manifest: Mapping[str, Any] | None = None,
    ) -> dict[str, Any]:
        """Compose the exact atomic pointer payload without changing authority."""

        session_id_t, session_root = self._require_session()
        del session_root
        pointer: dict[str, Any] = {
            "schema": PAGE_ACCEPTED_POINTER_SCHEMA,
            "sessionKey": _session_key(session_id_t),
            "generation": int(binding.generation_t),
            "manifest": binding.manifest_relative_path,
            "manifestSha256": _tensor_digest_hex(binding.manifest_sha256_t),
            "manifestPayloadSha256": _tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        }
        placement = self._object_write_placement
        if placement is not None:
            pointer.update(
                {
                    "pageObjectWritePlacementAuthoritySha256": (
                        placement.authority_sha256
                    ),
                    "pageObjectWritePlacementProofSha256": (
                        placement.placement_proof_sha256
                    ),
                }
            )
        if graph_authority is not None:
            graph_record = graph_authority.external_record_boundary()
            pointer["graphAuthority"] = graph_record
            pointer["graphAuthorityPayloadSha256"] = hashlib.sha256(
                _canonical_json_bytes(graph_record)
            ).hexdigest()
        if generation_manifest is not None:
            pack_record = generation_manifest.get(
                "directPagePackSetAuthority"
            )
            if pack_record is not None:
                if (
                    not isinstance(pack_record, dict)
                    or not _valid_sha256_boundary(
                        pack_record.get("packSetSha256")
                    )
                ):
                    raise RuntimeError(
                        "NoNE accepted direct pack pointer authority differs"
                    )
                pointer["directPagePackSetSha256"] = pack_record[
                    "packSetSha256"
                ]
        return pointer

    def _write_accepted_pointer_boundary(
        self,
        binding: NoNEGenerationBinding,
        manifest: dict[str, Any],
        graph_authority: NoNEGraphAuthorityBinding | None = None,
    ) -> dict[str, Any]:
        self._require_staged_read_only_write_guard_boundary()
        session_id_t, session_root = self._require_session()
        del session_id_t
        history_root = session_root / "accepted_authorities"
        history_root.mkdir(parents=True, exist_ok=True)

        def history_path(pointer_record: Mapping[str, Any]) -> Path:
            return _accepted_authority_history_path_boundary(
                session_root,
                pointer_record,
            )

        if self._generation_writer_handle is None:
            raise RuntimeError("NoNE accepted pointer write lacks writer authority")

        accepted_path = session_root / "accepted.json"
        prior_pointer: dict[str, Any] | None = None
        prior_pointer_bytes: bytes | None = None
        if accepted_path.is_file():
            prior_pointer_bytes = accepted_path.read_bytes()
            prior_pointer = _visible_accepted_pointer_record_boundary(
                accepted_path
            )
            prior_history = history_path(prior_pointer)
            if prior_history.is_file():
                if _read_json(prior_history) != prior_pointer:
                    raise RuntimeError("NoNE accepted authority history changed")
            else:
                _atomic_json(prior_history, prior_pointer)

        target_record = self.accepted_pointer_record_boundary(
            binding,
            graph_authority,
            generation_manifest=manifest,
        )
        target_history = history_path(target_record)
        if graph_authority is None:
            historical_candidates: list[Path] = []
            if target_history.is_file():
                historical_candidates.append(target_history)
            graph_history_glob = (
                f"generation_{int(binding.generation_t):08d}_"
                f"{_tensor_digest_hex(binding.manifest_payload_sha256_t)}_*.json"
            )
            historical_candidates.extend(
                path
                for path in sorted(history_root.glob(graph_history_glob))
                if path not in historical_candidates
            )
            graph_records = []
            for historical_path in historical_candidates:
                historical_pointer = _read_json(historical_path)
                graph_record = historical_pointer.get("graphAuthority")
                if graph_record is None:
                    continue
                if not isinstance(graph_record, dict):
                    raise RuntimeError("NoNE historical graph authority is malformed")
                graph_records.append(graph_record)
            if len(graph_records) > 1 and any(
                record != graph_records[0] for record in graph_records[1:]
            ):
                raise RuntimeError("NoNE historical graph authority is ambiguous")
            if graph_records:
                graph_authority = self._load_graph_authority_record_boundary(
                    binding,
                    manifest,
                    graph_records[0],
                )
        self._validate_direct_page_map_frontier_transition_boundary(
            generation_binding=binding,
            generation_manifest=manifest,
        )
        target_direct_page_map_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                manifest
            )
        )
        if target_direct_page_map_authority is not None:
            if not self._direct_page_map_cache_matches_binding_boundary(
                binding
            ):
                self._validate_and_cache_accepted_direct_page_map_boundary(
                    generation_binding=binding,
                    generation_manifest=manifest,
                )
            if not self._direct_page_map_cache_matches_binding_boundary(
                binding
            ):
                raise RuntimeError(
                    "NoNE accepted direct page-map local closure changed "
                    "before pointer publication"
                )
        pointer = self.accepted_pointer_record_boundary(
            binding,
            graph_authority,
            generation_manifest=manifest,
        )
        target_history = history_path(pointer)
        if target_history.is_file():
            if _read_json(target_history) != pointer:
                raise RuntimeError("NoNE accepted authority history changed")
        else:
            _atomic_json(target_history, pointer)
        direct_frontier_persisted = False
        if (
            target_direct_page_map_authority is not None
            and prior_pointer is not None
            and prior_pointer_bytes is not None
        ):
            target_pointer_sha256 = hashlib.sha256(
                _canonical_json_bytes(pointer)
            ).hexdigest()
            prior_pointer_sha256 = hashlib.sha256(
                _canonical_json_bytes(prior_pointer)
            ).hexdigest()
            transaction_core = {
                "schema": ALL_KNOWLEDGE_ACCEPTANCE_TRANSACTION_SCHEMA,
                "sessionId": binding.session_id_t.detach()
                .cpu()
                .long()
                .reshape(-1)
                .tolist(),
                "stagedGeneration": binding.external_record_boundary(),
                "storeRoot": str(self.root),
                "priorPointerPayloadSha256": prior_pointer_sha256,
                "priorPointerRawBytesSha256": hashlib.sha256(
                    prior_pointer_bytes
                ).hexdigest(),
                "targetPointerPayloadSha256s": {
                    str(self.root): target_pointer_sha256,
                },
                "pointerWriteOrder": [str(self.root)],
                "canonicalPointerWrittenLast": True,
            }
            transaction_sha256 = hashlib.sha256(
                _canonical_json_bytes(transaction_core)
            ).hexdigest()
            transaction_root = (
                session_root / "direct_pointer_transactions"
            )
            intent_path = transaction_root / (
                f"{transaction_sha256}.intent.json"
            )
            marker_path = transaction_root / (
                f"{transaction_sha256}.commit.json"
            )
            marker = {
                "schema": ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA,
                "passed": True,
                "transactionSha256": transaction_sha256,
                "stagedGeneration": binding.external_record_boundary(),
                "targetPointerPayloadSha256s": {
                    str(self.root): target_pointer_sha256,
                },
                "pointerWriteOrder": [str(self.root)],
                "canonicalPointerWrittenLast": True,
                "durabilityComplete": True,
                "directPageMapAuthority": target_direct_page_map_authority,
            }
            marker_payload_sha256 = hashlib.sha256(
                _canonical_json_bytes(marker)
            ).hexdigest()
            intent = {
                **transaction_core,
                "transactionSha256": transaction_sha256,
                "canonicalCommitMarkerPath": str(marker_path),
                "canonicalCommitMarkerPayloadSha256": (
                    marker_payload_sha256
                ),
                "priorPointerRawBytesBase64": base64.b64encode(
                    prior_pointer_bytes
                ).decode("ascii"),
            }
            _atomic_json(intent_path, intent)
            self._persist_accepted_direct_page_map_frontier_boundary(
                generation_binding=binding,
                generation_manifest=manifest,
                acceptance_commit_marker={
                    "path": str(marker_path),
                    "sha256": marker_payload_sha256,
                    "transactionSha256": transaction_sha256,
                    "storeRoot": str(self.root),
                    "targetPointerPayloadSha256": (
                        target_pointer_sha256
                    ),
                },
            )
            marker_written = False
            try:
                wrapper = {
                    **pointer,
                    "acceptanceTransaction": {
                        "schema": (
                            ALL_KNOWLEDGE_ACCEPTANCE_POINTER_VISIBILITY_SCHEMA
                        ),
                        "transactionSha256": transaction_sha256,
                        "storeRoot": str(self.root),
                        "canonicalCommitMarkerPath": str(marker_path),
                        "canonicalCommitMarkerPayloadSha256": (
                            marker_payload_sha256
                        ),
                        "priorPointer": prior_pointer,
                        "priorPointerPayloadSha256": prior_pointer_sha256,
                        "targetPointerPayloadSha256": (
                            target_pointer_sha256
                        ),
                    },
                }
                _atomic_json(accepted_path, wrapper)
                if (
                    _visible_accepted_pointer_record_boundary(accepted_path)
                    != prior_pointer
                    or not self._direct_page_map_cache_matches_binding_boundary(
                        binding
                    )
                ):
                    raise RuntimeError(
                        "NoNE direct pointer became visible before its "
                        "frontier commit"
                    )
                _atomic_json(marker_path, marker)
                marker_written = True
                if (
                    _visible_accepted_pointer_record_boundary(accepted_path)
                    != pointer
                ):
                    raise RuntimeError(
                        "NoNE direct pointer commit marker differs"
                    )
                direct_frontier_persisted = True
            except Exception:
                if not marker_written:
                    _atomic_replace_bytes_boundary(
                        accepted_path,
                        prior_pointer_bytes,
                    )
                raise
        else:
            _atomic_json(accepted_path, pointer)
            if target_direct_page_map_authority is not None:
                try:
                    self._persist_accepted_direct_page_map_frontier_boundary(
                        generation_binding=binding,
                        generation_manifest=manifest,
                    )
                    direct_frontier_persisted = True
                except Exception:
                    if prior_pointer_bytes is None:
                        accepted_path.unlink(missing_ok=True)
                    else:
                        _atomic_replace_bytes_boundary(
                            accepted_path,
                            prior_pointer_bytes,
                        )
                    raise
        self._accepted_generation_t = (
            binding.generation_t.detach().cpu().reshape(()).long()
        )
        self._manifest = manifest
        self._graph_authority = graph_authority
        self._graph_authority_payload_sha256 = str(
            pointer.get("graphAuthorityPayloadSha256", "")
        )
        self._clear_validated_immutable_page_closure_cache_boundary()
        self._clear_candidate_page_semantic_witnesses_boundary()
        self._accepted_pointer_identity_boundary = _file_identity(accepted_path)
        self._accepted_manifest_identity_boundary = _file_identity(
            (session_root / binding.manifest_relative_path).resolve()
        )
        self._accepted_binding_boundary = binding
        if target_direct_page_map_authority is None:
            self._clear_accepted_direct_page_map_cache_boundary()
        elif not self._direct_page_map_cache_matches_binding_boundary(
            binding
        ):
            raise RuntimeError(
                "NoNE accepted direct page-map local closure changed during "
                "pointer publication"
            )
        if (
            target_direct_page_map_authority is not None
            and not direct_frontier_persisted
        ):
            raise RuntimeError(
                "NoNE accepted direct page-map frontier was not persisted"
            )
        self._verified_objects.clear()
        self._verified_object_identities_boundary.clear()
        self.publish_locator_boundary()
        return pointer

    def upgrade_current_graph_authority_boundary(
        self,
        graph_authority: NoNEGraphAuthorityBinding,
    ) -> dict[str, Any]:
        """Attach a verified executable graph to the current generation.

        This is a same-generation authority enrichment only. It never changes
        page objects, checkpoint bytes, optimizer state, or the generation
        frontier, and it is serialized against every generation writer.
        """

        self._require_staged_read_only_write_guard_boundary()
        if self._generation_writer_handle is not None:
            raise RuntimeError(
                "NoNE graph authority cannot change during a staged generation"
            )
        self._acquire_generation_writer_boundary()
        try:
            binding = self.current_generation_binding_boundary()
            loaded, manifest = self._load_generation_binding_boundary(
                binding.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    binding.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    binding.manifest_payload_sha256_t
                ),
            )
            verified = self._load_graph_authority_record_boundary(
                loaded,
                manifest,
                graph_authority.external_record_boundary(),
            )
            if verified.external_record_boundary() != (
                graph_authority.external_record_boundary()
            ):
                raise RuntimeError("NoNE graph authority changed during upgrade")
            current = self._graph_authority
            if current is not None and current.external_record_boundary() != (
                verified.external_record_boundary()
            ):
                raise RuntimeError("NoNE accepted graph authority already differs")
            if current is not None:
                return self.accepted_pointer_record_boundary(
                    loaded,
                    current,
                    generation_manifest=manifest,
                )
            return self._write_accepted_pointer_boundary(
                loaded,
                manifest,
                verified,
            )
        finally:
            self._release_generation_writer_boundary()

    def _next_generation_boundary(self) -> int:
        _session_id_t, session_root = self._require_session()
        maximum = 0
        for path in (session_root / "generations").iterdir():
            if not path.is_dir() or not path.name.startswith("generation_"):
                continue
            parts = path.name.split("_", 2)
            if len(parts) != 3:
                continue
            try:
                maximum = max(maximum, int(parts[1]))
            except ValueError:
                continue
        return maximum + 1

    def next_generation_t_boundary(self) -> torch.Tensor:
        """Return the next unused immutable generation at the I/O boundary."""

        return torch.tensor(
            self._next_generation_boundary(),
            dtype=torch.long,
        )

    @staticmethod
    def _page_format_revision_boundary(handle: Any) -> int:
        revision_t = handle.get_tensor("format_revision_t").reshape(-1).long()
        if revision_t.numel() != 1:
            raise RuntimeError("NoNE page object format revision is malformed")
        return int(revision_t[0])

    @staticmethod
    def _page_delta_dependency_record_from_handle_boundary(
        handle: Any,
        *,
        expected_page_id: int,
    ) -> _NoNEPageDeltaDependency | None:
        """Read a rev6 dependency record without granting lineage authority."""

        revision = NoNEImmutablePageStore._page_format_revision_boundary(handle)
        if revision != BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION:
            return None
        _validate_base_bound_exact_delta_schema_boundary(
            handle,
            expected_page_id=expected_page_id,
        )
        page_ids_t = handle.get_tensor("page_ids_t")
        base_bytes_t = handle.get_tensor("base_object_bytes_t")
        base_generation_t = handle.get_tensor("base_generation_t")
        step_t = handle.get_tensor("step_t")
        if (
            page_ids_t.shape != (1,)
            or int(page_ids_t[0]) != expected_page_id
            or base_bytes_t.shape != (1,)
            or int(base_bytes_t[0]) < 1
            or base_generation_t.shape != (1,)
            or int(base_generation_t[0]) < 1
            or step_t.shape != (1,)
            or not step_t.gt(0).all()
        ):
            raise RuntimeError("base-bound delta identity is malformed")
        base_sha256_t = (
            handle.get_tensor("base_object_sha256_t")
            .detach()
            .cpu()
        )
        base_manifest_sha256_t = (
            handle.get_tensor("base_manifest_payload_sha256_t")
            .detach()
            .cpu()
        )
        if base_sha256_t.shape != (32,) or base_manifest_sha256_t.shape != (32,):
            raise RuntimeError("base-bound delta digest geometry differs")
        return _NoNEPageDeltaDependency(
            object=NoNEPageObjectBinding(
                page_id_t=page_ids_t[0].detach().cpu().reshape(()),
                object_sha256_t=base_sha256_t,
                object_bytes_t=base_bytes_t[0].detach().cpu().reshape(()),
            ),
            generation_t=base_generation_t[0].detach().cpu().reshape(()),
            manifest_payload_sha256_t=base_manifest_sha256_t,
        )

    def _validated_page_delta_dependency_from_handle_boundary(
        self,
        handle: Any,
        *,
        expected_page_id: int,
    ) -> _NoNEPageDeltaDependency | None:
        """Bind a rev6 dependency to the exact immutable historical row."""

        dependency = self._page_delta_dependency_record_from_handle_boundary(
            handle,
            expected_page_id=expected_page_id,
        )
        if dependency is None:
            return None
        base_generation = self.verify_generation_boundary(
            generation_t=dependency.generation_t,
            manifest_payload_sha256_t=(
                dependency.manifest_payload_sha256_t
            ),
        )
        _session_id_t, session_root = self._require_session()
        parent_row = _read_generation_page_row_cached(
            session_root / base_generation.manifest_relative_path,
            page_id=expected_page_id,
            expected_manifest_sha256=_tensor_digest_hex(
                base_generation.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                base_generation.manifest_payload_sha256_t
            ),
        )
        if (
            not isinstance(parent_row, dict)
            or parent_row.get("sha256")
            != _tensor_digest_hex(dependency.object.object_sha256_t)
            or parent_row.get("bytes")
            != int(dependency.object.object_bytes_t)
        ):
            raise RuntimeError("base-bound delta parent object differs")
        return dependency

    def _validated_page_object_schema_proof_boundary(
        self,
        *,
        page_id: int,
        object_sha256: str,
        object_path: Path,
    ) -> _NoNEValidatedPageObjectSchemaProof:
        """Validate one immutable header/schema once for its exact identity.

        The content digest cache proves immutable bytes, while this proof binds
        the expensive rev6 tensor-schema and finite-value walk to the active
        session, page, path, digest, and complete filesystem identity.  A
        generation pointer may advance without changing those immutable facts;
        a session or file-identity change may not reuse them.
        """

        resolved_path = object_path.expanduser().resolve()
        self._verify_materialized_object_boundary(
            object_path=resolved_path,
            object_sha256=object_sha256,
        )
        session_id_t, _session_root = self._require_session()
        session_key = _session_key(session_id_t)
        object_identity = _file_identity(resolved_path)
        cache_key = (object_sha256, resolved_path)
        with self._validated_page_object_header_cache_lock:
            cached = self._validated_page_object_headers_boundary.get(
                cache_key
            )
            if (
                cached is not None
                and cached.session_key == session_key
                and cached.page_id == page_id
                and cached.object_sha256 == object_sha256
                and cached.object_path == resolved_path
                and cached.object_identity == object_identity
            ):
                return cached
            if cached is not None:
                self._validated_page_object_headers_boundary.pop(
                    cache_key,
                    None,
                )

        with safe_open(  # type: ignore[no-untyped-call]
            str(resolved_path),
            framework="pt",
            device="cpu",
        ) as handle:
            object_page_ids_t = (
                handle.get_tensor("page_ids_t").reshape(-1).long()
            )
            if (
                object_page_ids_t.shape != (1,)
                or int(object_page_ids_t[0]) != page_id
            ):
                raise RuntimeError("NoNE page object identity mismatch")
            format_revision = self._page_format_revision_boundary(handle)
            dependency = (
                self._validated_page_delta_dependency_from_handle_boundary(
                    handle,
                    expected_page_id=page_id,
                )
            )
            if format_revision == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION:
                storage_dtype_t = (
                    handle.get_tensor("delta_storage_dtype_t")
                    .reshape(-1)
                    .long()
                )
                if storage_dtype_t.numel() != 1 or dependency is None:
                    raise RuntimeError(
                        "base-bound delta schema proof is incomplete"
                    )
                delta_storage_dtype: torch.dtype | None = (
                    _storage_dtype_from_code(int(storage_dtype_t[0]))
                )
            else:
                if dependency is not None:
                    raise RuntimeError(
                        "non-delta page exposes a delta dependency"
                    )
                if (
                    format_revision
                    == SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION
                ):
                    _validate_self_contained_stateless_exact_schema_boundary(
                        handle,
                        expected_page_id=page_id,
                    )
                delta_storage_dtype = None

        identity_after = _file_identity(resolved_path)
        if identity_after != object_identity:
            self._evict_validated_immutable_page_closure_object_boundary(
                object_sha256
            )
            raise RuntimeError(
                "NoNE page object identity changed during schema validation"
            )
        proof = _NoNEValidatedPageObjectSchemaProof(
            session_key=session_key,
            page_id=page_id,
            object_sha256=object_sha256,
            object_path=resolved_path,
            object_identity=identity_after,
            format_revision=format_revision,
            delta_dependency=dependency,
            delta_storage_dtype=delta_storage_dtype,
        )
        with self._validated_page_object_header_cache_lock:
            self._validated_page_object_headers_boundary[cache_key] = proof
        return proof

    def _preauthorized_page_object_schema_proof_boundary(
        self,
        authorized: _NoNEAuthorizedSemanticObject,
    ) -> _NoNEValidatedPageObjectSchemaProof:
        """Return the writer-thread proof for one semantic worker object."""

        cache_key = (
            authorized.object_sha256,
            authorized.object_path,
        )
        session_id_t, _session_root = self._require_session()
        with self._validated_page_object_header_cache_lock:
            proof = self._validated_page_object_headers_boundary.get(
                cache_key
            )
        if (
            proof is None
            or proof.session_key != _session_key(session_id_t)
            or proof.page_id != authorized.page_id
            or proof.object_sha256 != authorized.object_sha256
            or proof.object_path != authorized.object_path
            or proof.object_identity != authorized.object_identity
        ):
            raise RuntimeError(
                "NoNE semantic admission schema proof differs"
            )
        if _file_identity(authorized.object_path) != proof.object_identity:
            self._evict_validated_immutable_page_closure_object_boundary(
                authorized.object_sha256
            )
            raise RuntimeError(
                "NoNE semantic admission schema object identity changed"
            )
        return proof

    @staticmethod
    def _base_bound_exact_delta_payload_boundary(
        retained: NoNEPageBundle,
        *,
        base: NoNEPageBundle,
        base_object: NoNEPageObjectBinding,
        base_generation: NoNEGenerationBinding,
    ) -> dict[str, torch.Tensor]:
        """Encode exact replacement patches against one signed parent page."""

        validate_page_bundle(retained)
        validate_page_bundle(base)
        retained_page_ids_t = retained.weights.page_ids_t.detach().cpu().long()
        base_page_ids_t = base.weights.page_ids_t.detach().cpu().long()
        if (
            retained_page_ids_t.shape != (1,)
            or not torch.equal(retained_page_ids_t, base_page_ids_t)
            or not torch.equal(
                retained_page_ids_t.reshape(()),
                base_object.page_id_t.detach().cpu().long().reshape(()),
            )
            or retained.step_t.detach().cpu().long().shape != (1,)
            or not retained.step_t.detach().cpu().long().gt(0).all()
        ):
            raise RuntimeError("base-bound delta page identity differs")
        if not retained.step_t.detach().cpu().long().gt(
            base.step_t.detach().cpu().long()
        ).all():
            raise RuntimeError("base-bound delta optimizer step did not advance")
        mean_probe_t = (
            retained.optimizer_mean_t[:, :1]
            if retained.optimizer_mean_t.stride(1) == 0
            else retained.optimizer_mean_t
        )
        square_probe_t = (
            retained.optimizer_square_t[:, :1]
            if retained.optimizer_square_t.stride(1) == 0
            else retained.optimizer_square_t
        )
        base_mean_probe_t = (
            base.optimizer_mean_t[:, :1]
            if base.optimizer_mean_t.stride(1) == 0
            else base.optimizer_mean_t
        )
        base_square_probe_t = (
            base.optimizer_square_t[:, :1]
            if base.optimizer_square_t.stride(1) == 0
            else base.optimizer_square_t
        )
        if not bool(
            torch.count_nonzero(mean_probe_t).eq(0)
            & torch.count_nonzero(square_probe_t).eq(0)
        ):
            raise RuntimeError(
                "base-bound delta cannot discard explicit optimizer moments"
            )
        if not bool(
            torch.count_nonzero(base_mean_probe_t).eq(0)
            & torch.count_nonzero(base_square_probe_t).eq(0)
        ):
            raise RuntimeError(
                "base-bound delta parent optimizer moments are nonzero"
            )
        storage_dtype = retained.weights.gate_t.dtype
        if any(
            getattr(weights, name).dtype != storage_dtype
            for weights in (base.weights, retained.weights)
            for name in _PAGE_WEIGHT_TENSOR_NAMES
        ):
            raise RuntimeError("base-bound delta storage dtype differs")
        if any(
            not torch.isfinite(
                getattr(retained.weights, name).detach().cpu()
            ).all()
            for name in _PAGE_WEIGHT_TENSOR_NAMES
        ):
            raise RuntimeError("base-bound delta contains nonfinite values")
        payload: dict[str, torch.Tensor] = {
            "format_revision_t": torch.tensor(
                [BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION],
                dtype=torch.long,
            ),
            "page_ids_t": retained_page_ids_t.contiguous(),
            "base_object_sha256_t": (
                base_object.object_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1)
                .contiguous()
            ),
            "base_object_bytes_t": (
                base_object.object_bytes_t.detach()
                .cpu()
                .long()
                .reshape(1)
                .contiguous()
            ),
            "base_generation_t": (
                base_generation.generation_t.detach()
                .cpu()
                .long()
                .reshape(1)
                .contiguous()
            ),
            "base_manifest_payload_sha256_t": (
                base_generation.manifest_payload_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1)
                .contiguous()
            ),
            "optimizer_width_t": torch.tensor(
                [retained.optimizer_mean_t.shape[1]],
                dtype=torch.long,
            ),
            "delta_storage_dtype_t": torch.tensor(
                [_storage_dtype_code(storage_dtype)],
                dtype=torch.long,
            ),
            "step_t": retained.step_t.detach().cpu().long().contiguous(),
        }
        changed_total = 0
        for name in _PAGE_WEIGHT_TENSOR_NAMES:
            base_t = getattr(base.weights, name).detach().cpu().contiguous()
            retained_t = (
                getattr(retained.weights, name).detach().cpu().contiguous()
            )
            if base_t.shape != retained_t.shape or base_t.dtype != retained_t.dtype:
                raise RuntimeError("base-bound delta tensor geometry differs")
            changed_t = base_t.reshape(-1).ne(retained_t.reshape(-1))
            changed_count = int(changed_t.count_nonzero())
            if changed_count == 0:
                continue
            changed_total += changed_count
            values_t = retained_t.reshape(-1)[changed_t].contiguous()
            payload[f"{name}_delta_values_t"] = values_t
            packed_mask_bytes = (changed_t.numel() + 7) // 8
            sparse_index_bytes = changed_count * torch.int32.itemsize
            if sparse_index_bytes < packed_mask_bytes:
                payload[f"{name}_delta_indices_t"] = (
                    changed_t.nonzero(as_tuple=False)
                    .reshape(-1)
                    .to(dtype=torch.int32)
                    .contiguous()
                )
            else:
                payload[f"{name}_delta_mask_t"] = (
                    _pack_exact_delta_mask_boundary(changed_t)
                )
        if changed_total < 1:
            raise RuntimeError("base-bound delta contains no parameter change")
        return payload

    @staticmethod
    def _exact_optimizer_moment_storage_boundary(
        moment_t: torch.Tensor,
    ) -> torch.Tensor:
        """Narrow one FP32 moment only when FP32 restoration is bitwise exact.

        This is an immutable-storage boundary, not optimizer arithmetic.  Some
        Adam first moments originate from BF16 gradients and therefore already
        occupy the BF16 value lattice while still being held in FP32.  Persist
        those values as BF16 only after an element-for-element FP32 roundtrip
        proves that resume will reconstruct the identical tensor.  Any value
        outside that lattice retains the legacy FP32 rev2 representation.
        """

        stable_t = _stable_cpu_tensor(moment_t)
        if stable_t.dtype != torch.float32:
            raise RuntimeError("NoNE optimizer moment storage dtype differs")
        narrowed_t = stable_t.to(dtype=torch.bfloat16)
        if torch.equal(narrowed_t.to(dtype=torch.float32), stable_t):
            return narrowed_t.contiguous()
        return stable_t

    @staticmethod
    def _page_object_payload_boundary(
        bundle: NoNEPageBundle,
        row_index: int,
    ) -> dict[str, torch.Tensor]:
        """Encode one ordinary page row without choosing its durability tier."""

        weights = bundle.weights
        optimizer_mean_source_t = bundle.optimizer_mean_t[
            row_index : row_index + 1
        ]
        optimizer_square_source_t = bundle.optimizer_square_t[
            row_index : row_index + 1
        ]
        optimizer_mean_probe_t = (
            optimizer_mean_source_t[:, :1]
            if optimizer_mean_source_t.stride(1) == 0
            else optimizer_mean_source_t
        )
        optimizer_square_probe_t = (
            optimizer_square_source_t[:, :1]
            if optimizer_square_source_t.stride(1) == 0
            else optimizer_square_source_t
        )
        step_t = _stable_cpu_tensor(bundle.step_t[row_index : row_index + 1])
        optimizer_moments_zero = bool(
            torch.count_nonzero(optimizer_mean_probe_t).eq(0)
            & torch.count_nonzero(optimizer_square_probe_t).eq(0)
        )
        implicit_zero_optimizer = bool(
            optimizer_moments_zero
            & torch.count_nonzero(step_t).eq(0)
        )
        stateless_trained_optimizer = bool(
            optimizer_moments_zero & step_t.gt(0).all()
        )
        if implicit_zero_optimizer:
            revision = IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION
        elif stateless_trained_optimizer:
            revision = STATELESS_HYBRID_PAGE_FORMAT_REVISION
        else:
            revision = FULL_OPTIMIZER_PAGE_FORMAT_REVISION
        payload: dict[str, torch.Tensor] = {
            "format_revision_t": torch.full(
                (1,),
                revision,
                dtype=torch.long,
            ),
            "page_ids_t": _stable_cpu_tensor(
                weights.page_ids_t[row_index : row_index + 1]
            ),
        }
        for name in _PAGE_WEIGHT_TENSOR_NAMES:
            value_t = getattr(weights, name)[row_index : row_index + 1]
            if (
                stateless_trained_optimizer
                and name in _STATELESS_HYBRID_FLOAT8_WEIGHT_NAMES
            ):
                quantized_t, scale_t = _scaled_float8_storage_pair(value_t)
                payload[name] = quantized_t
                payload[f"{name}_scale_t"] = scale_t
                payload[f"{name}_dtype_t"] = torch.tensor(
                    [_storage_dtype_code(value_t.dtype)],
                    dtype=torch.long,
                )
            else:
                payload[name] = _stable_cpu_tensor(value_t)
        if implicit_zero_optimizer:
            payload["optimizer_width_t"] = torch.tensor(
                [optimizer_mean_source_t.shape[1]],
                dtype=torch.long,
            )
        elif stateless_trained_optimizer:
            payload["optimizer_width_t"] = torch.tensor(
                [optimizer_mean_source_t.shape[1]],
                dtype=torch.long,
            )
            payload["step_t"] = step_t
        else:
            payload.update(
                {
                    "optimizer_mean_t": (
                        NoNEImmutablePageStore
                        ._exact_optimizer_moment_storage_boundary(
                            optimizer_mean_source_t
                        )
                    ),
                    "optimizer_square_t": (
                        NoNEImmutablePageStore
                        ._exact_optimizer_moment_storage_boundary(
                            optimizer_square_source_t
                        )
                    ),
                    "step_t": step_t,
                }
            )
        return payload

    @staticmethod
    def _self_contained_direct_page_payload_boundary(
        bundle: NoNEPageBundle,
        row_index: int,
    ) -> dict[str, torch.Tensor]:
        """Encode one exact trained page with no object dependency.

        Revision 7 is deliberately stateless for the zero Adam moments used by
        page-only training, but unlike revision 5 it stores every materialized
        weight tensor without float8 conversion.  It is therefore both
        self-contained and bit-exact with the fully reconstructed revision-6
        source bundle.
        """

        validate_page_bundle(bundle)
        optimizer_mean_source_t = bundle.optimizer_mean_t[
            row_index : row_index + 1
        ]
        optimizer_square_source_t = bundle.optimizer_square_t[
            row_index : row_index + 1
        ]
        optimizer_mean_probe_t = (
            optimizer_mean_source_t[:, :1]
            if optimizer_mean_source_t.stride(1) == 0
            else optimizer_mean_source_t
        )
        optimizer_square_probe_t = (
            optimizer_square_source_t[:, :1]
            if optimizer_square_source_t.stride(1) == 0
            else optimizer_square_source_t
        )
        step_t = _stable_cpu_tensor(
            bundle.step_t[row_index : row_index + 1]
        )
        if not bool(
            torch.count_nonzero(optimizer_mean_probe_t).eq(0)
            & torch.count_nonzero(optimizer_square_probe_t).eq(0)
            & step_t.gt(0).all()
        ):
            # Explicit optimizer state already has a self-contained exact
            # representation in revision 2.
            explicit_payload = (
                NoNEImmutablePageStore._page_object_payload_boundary(
                bundle,
                row_index,
                )
            )
            revision_t = explicit_payload[
                "format_revision_t"
            ].reshape(-1).long()
            if (
                revision_t.numel() != 1
                or int(revision_t[0])
                not in {
                    FULL_OPTIMIZER_PAGE_FORMAT_REVISION,
                    IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION,
                }
            ):
                raise RuntimeError(
                    "direct page optimizer state is not self-contained"
                )
            return explicit_payload

        payload: dict[str, torch.Tensor] = {
            "format_revision_t": torch.tensor(
                [SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION],
                dtype=torch.long,
            ),
            "page_ids_t": _stable_cpu_tensor(
                bundle.weights.page_ids_t[row_index : row_index + 1]
            ),
            "optimizer_width_t": torch.tensor(
                [optimizer_mean_source_t.shape[1]],
                dtype=torch.long,
            ),
            "step_t": step_t,
        }
        for name in _PAGE_WEIGHT_TENSOR_NAMES:
            payload[name] = _stable_cpu_tensor(
                getattr(bundle.weights, name)[row_index : row_index + 1]
            )
        return payload

    def _save_page_payload_boundary(
        self,
        payload: Mapping[str, torch.Tensor],
        *,
        page_id: int,
        sync_directory: bool,
    ) -> tuple[str, int]:
        """Atomically persist one already-encoded direct safetensors object."""

        self._require_staged_read_only_write_guard_boundary()
        _session_id_t, session_root = self._require_session()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        direct_cache_was_current = (
            self._begin_direct_page_map_local_append_boundary(
                objects_root
            )
        )
        temporary = objects_root / (
            f".page.{os.getpid()}.{threading.get_ident()}.{page_id}.tmp"
        )
        temporary.unlink(missing_ok=True)
        save_file(dict(payload), str(temporary))
        with temporary.open("rb") as handle:
            os.fsync(handle.fileno())
        object_sha256 = _file_sha256(temporary)
        object_path = objects_root / f"{object_sha256}.safetensors"
        if object_path.is_file():
            if _file_sha256(object_path) != object_sha256:
                raise RuntimeError("existing NoNE page object hash mismatch")
            temporary.unlink()
        else:
            stage_atomically_moved_file_sha256_authority_boundary(
                staged_path=temporary,
                final_path=object_path,
                expected_sha256=object_sha256,
                identity_cache_root=(
                    self._runtime_cache_root_boundary()
                    / "page_object_sha256_identity_cache"
                ),
            )
            os.replace(temporary, object_path)
            if sync_directory:
                _fsync_directory(objects_root)
        self._verified_objects.add(object_sha256)
        self._finish_direct_page_map_local_append_boundary(
            objects_root,
            cache_was_current=direct_cache_was_current,
        )
        return object_sha256, object_path.stat().st_size

    def _save_page_object(
        self,
        bundle: NoNEPageBundle,
        row_index: int,
        *,
        compact_transfer: bool = False,
        sync_directory: bool = True,
    ) -> tuple[str, int]:
        self._require_session()
        if compact_transfer:
            optimizer_mean_source_t = bundle.optimizer_mean_t[
                row_index : row_index + 1
            ]
            optimizer_zero_t = torch.count_nonzero(
                optimizer_mean_source_t[:, :1]
                if optimizer_mean_source_t.stride(1) == 0
                else optimizer_mean_source_t
            ).eq(0) & torch.count_nonzero(
                bundle.optimizer_square_t[row_index : row_index + 1, :1]
                if bundle.optimizer_square_t.stride(1) == 0
                else bundle.optimizer_square_t[row_index : row_index + 1]
            ).eq(0)
            if not bool(
                optimizer_zero_t
                & torch.count_nonzero(
                    bundle.step_t[row_index : row_index + 1]
                ).eq(0)
            ):
                raise RuntimeError(
                    "compact transfer storage cannot contain trained optimizer state"
                )
            return self._save_compact_transfer_weights_object_boundary(
                bundle.weights,
                row_index,
                optimizer_width=optimizer_mean_source_t.shape[1],
            )
        payload = (
            self._self_contained_direct_page_payload_boundary(
                bundle,
                row_index,
            )
            if self._accepted_direct_page_map_authority_active_boundary()
            else self._page_object_payload_boundary(bundle, row_index)
        )
        return self._save_page_payload_boundary(
            payload,
            page_id=int(bundle.weights.page_ids_t[row_index]),
            sync_directory=sync_directory,
        )

    def _save_compact_transfer_weights_object_boundary(
        self,
        weights: NoNEPageWeights,
        row_index: int,
        *,
        optimizer_width: int,
    ) -> tuple[str, int]:
        """Store untrained page weights without allocating zero Adam moments."""

        self._require_staged_read_only_write_guard_boundary()
        _session_id_t, session_root = self._require_session()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        payload = self._compact_transfer_payload_boundary(
            weights,
            row_index,
            optimizer_width=optimizer_width,
        )
        temporary = objects_root / f".page.{os.getpid()}.{row_index}.tmp"
        temporary.unlink(missing_ok=True)
        save_file(payload, str(temporary))
        with temporary.open("rb") as handle:
            os.fsync(handle.fileno())
        object_sha256 = _file_sha256(temporary)
        object_path = objects_root / f"{object_sha256}.safetensors"
        if object_path.is_file():
            if _file_sha256(object_path) != object_sha256:
                raise RuntimeError("existing NoNE page object hash mismatch")
            temporary.unlink()
        else:
            stage_atomically_moved_file_sha256_authority_boundary(
                staged_path=temporary,
                final_path=object_path,
                expected_sha256=object_sha256,
                identity_cache_root=(
                    self._runtime_cache_root_boundary()
                    / "page_object_sha256_identity_cache"
                ),
            )
            os.replace(temporary, object_path)
            _fsync_directory(objects_root)
        return object_sha256, object_path.stat().st_size

    @staticmethod
    def _compact_transfer_payload_boundary(
        weights: NoNEPageWeights,
        row_index: int,
        *,
        optimizer_width: int,
    ) -> dict[str, torch.Tensor]:
        payload: dict[str, torch.Tensor] = {
            "format_revision_t": torch.full(
                (1,),
                SCALED_FLOAT8_TRANSFER_PAGE_FORMAT_REVISION,
                dtype=torch.long,
            ),
            "page_ids_t": _stable_cpu_tensor(
                weights.page_ids_t[row_index : row_index + 1]
            ),
            "optimizer_width_t": torch.tensor(
                [optimizer_width],
                dtype=torch.long,
            ),
        }
        for name in _PAGE_WEIGHT_TENSOR_NAMES:
            value_t = getattr(weights, name)[row_index : row_index + 1]
            quantized_t, scale_t = _scaled_float8_storage_pair(value_t)
            payload[name] = quantized_t
            payload[f"{name}_scale_t"] = scale_t
            payload[f"{name}_dtype_t"] = torch.tensor(
                [_storage_dtype_code(value_t.dtype)],
                dtype=torch.long,
            )
        return payload

    @staticmethod
    def _materialize_optimizer_state_boundary(
        handle: Any,
        *,
        weights: NoNEPageWeights,
        device: torch.device,
    ) -> tuple[torch.Tensor, torch.Tensor, torch.Tensor]:
        """Restore explicit or compact-zero moments at the storage boundary."""

        revision_t = handle.get_tensor("format_revision_t").reshape(-1).long()
        if revision_t.numel() != 1:
            raise RuntimeError("NoNE page object format revision is malformed")
        revision = int(revision_t[0])
        keys = set(handle.keys())
        optimizer_moment_keys = {
            "optimizer_mean_t",
            "optimizer_square_t",
        }
        page_count = weights.page_ids_t.shape[0]
        flat_width = _flat_parameter_width(weights)
        if revision in {
            IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION,
            SCALED_FLOAT8_TRANSFER_PAGE_FORMAT_REVISION,
            STATELESS_HYBRID_PAGE_FORMAT_REVISION,
            BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION,
            SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION,
        }:
            if optimizer_moment_keys & keys:
                raise RuntimeError(
                    "compact NoNE page object contains explicit optimizer state"
                )
            if revision == SCALED_FLOAT8_TRANSFER_PAGE_FORMAT_REVISION and any(
                f"{name}_scale_t" not in keys
                or f"{name}_dtype_t" not in keys
                for name in _PAGE_WEIGHT_TENSOR_NAMES
            ):
                raise RuntimeError(
                    "scaled-float8 NoNE page object is missing scale state"
                )
            if revision == STATELESS_HYBRID_PAGE_FORMAT_REVISION and any(
                f"{name}_scale_t" not in keys
                or f"{name}_dtype_t" not in keys
                for name in _STATELESS_HYBRID_FLOAT8_WEIGHT_NAMES
            ):
                raise RuntimeError(
                    "stateless NoNE page object is missing hybrid scale state"
                )
            if revision in {
                STATELESS_HYBRID_PAGE_FORMAT_REVISION,
                BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION,
                SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION,
            }:
                if "step_t" not in keys:
                    raise RuntimeError("stateless NoNE page step is absent")
                restored_step_t = handle.get_tensor("step_t").to(
                    device=device,
                    dtype=torch.long,
                )
                if (
                    restored_step_t.shape != (page_count,)
                    or not restored_step_t.gt(0).all()
                ):
                    raise RuntimeError("stateless NoNE page step is malformed")
            else:
                if "step_t" in keys:
                    raise RuntimeError(
                        "untrained compact NoNE page contains optimizer step"
                    )
                restored_step_t = torch.zeros(
                    page_count,
                    device=device,
                    dtype=torch.long,
                )
            width_t = handle.get_tensor("optimizer_width_t").reshape(-1).long()
            if width_t.numel() != 1 or int(width_t[0]) != flat_width:
                raise RuntimeError(
                    "compact NoNE page optimizer geometry differs"
                )
            return (
                _implicit_zero_optimizer_matrix_boundary(
                    page_count=page_count,
                    flat_width=flat_width,
                    device=device,
                ),
                _implicit_zero_optimizer_matrix_boundary(
                    page_count=page_count,
                    flat_width=flat_width,
                    device=device,
                ),
                restored_step_t,
            )
        if revision != FULL_OPTIMIZER_PAGE_FORMAT_REVISION:
            raise RuntimeError("NoNE page object format revision is unsupported")
        if not optimizer_moment_keys.issubset(keys) or "step_t" not in keys:
            raise RuntimeError("NoNE page object optimizer state is incomplete")
        optimizer_mean_t = handle.get_tensor("optimizer_mean_t")
        optimizer_square_t = handle.get_tensor("optimizer_square_t")
        supported_storage_dtypes = {torch.float32, torch.bfloat16}
        if (
            optimizer_mean_t.dtype not in supported_storage_dtypes
            or optimizer_square_t.dtype not in supported_storage_dtypes
        ):
            raise RuntimeError("NoNE optimizer moment storage dtype differs")
        return (
            optimizer_mean_t.to(
                device=device,
                dtype=torch.float32,
            ),
            optimizer_square_t.to(
                device=device,
                dtype=torch.float32,
            ),
            handle.get_tensor("step_t").to(
                device=device,
                dtype=torch.long,
            ),
        )

    def _page_object_row_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> dict[str, Any]:
        """Verify one staged object and return its manifest-boundary row."""

        page_id_t = binding.page_id_t.detach().cpu().long().reshape(-1)
        object_bytes_t = binding.object_bytes_t.detach().cpu().long().reshape(-1)
        if page_id_t.numel() != 1 or object_bytes_t.numel() != 1:
            raise RuntimeError("NoNE staged page-object identity is malformed")
        page_id = int(page_id_t[0])
        object_bytes = int(object_bytes_t[0])
        object_sha256 = _tensor_digest_hex(binding.object_sha256_t)
        try:
            object_path = self._object_path_boundary(
                object_sha256,
                expected_bytes=object_bytes,
            )
        except FileNotFoundError as error:
            raise RuntimeError("NoNE staged page object is absent") from error
        row = {
            "pageId": page_id,
            "sha256": object_sha256,
            "bytes": object_bytes,
        }
        if (
            self._cached_validated_immutable_page_closure_boundary(
                page_id=page_id,
                object_path=object_path,
                object_sha256=object_sha256,
                object_bytes=object_bytes,
            )
            is not None
        ):
            return row
        receipt_verified_identity = (
            self._receipt_verified_overlay_objects_boundary.get(object_sha256)
        )
        if receipt_verified_identity is not None:
            if receipt_verified_identity != (page_id, object_bytes):
                raise RuntimeError(
                    "NoNE receipt-verified page-object identity differs"
                )
            return row
        self._validated_page_object_schema_proof_boundary(
            page_id=page_id,
            object_sha256=object_sha256,
            object_path=object_path,
        )
        return row

    def _page_delta_dependency_for_binding_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> _NoNEPageDeltaDependency | None:
        """Return a verified rev6 dependency for one immutable binding."""

        row = self._page_object_row_boundary(binding)
        return self._page_delta_dependency_for_row_boundary(row)

    def _page_delta_dependency_for_row_boundary(
        self,
        row: Mapping[str, Any],
    ) -> _NoNEPageDeltaDependency | None:
        """Return one serially verified dependency from an authorized object row."""

        page_id = int(row["pageId"])
        object_path = self._object_path_boundary(
            str(row["sha256"]),
            expected_bytes=int(row["bytes"]),
        )
        if self._receipt_verified_overlay_objects_boundary.get(str(row["sha256"])) is not None:
            return None

        proof = self._validated_page_object_schema_proof_boundary(
            page_id=page_id,
            object_sha256=str(row["sha256"]),
            object_path=object_path,
        )
        return proof.delta_dependency

    def stage_page_object_boundary(
        self,
        bundle: NoNEPageBundle,
        *,
        sync_directory: bool = True,
    ) -> NoNEPageObjectBinding:
        """Durably stage one candidate page without advancing generation authority."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        validate_page_bundle(bundle)
        if bundle.weights.page_ids_t.numel() != 1:
            raise ValueError("candidate page-object staging requires exactly one row")
        object_sha256, object_bytes = self._save_page_object(
            bundle,
            0,
            sync_directory=sync_directory,
        )
        binding = NoNEPageObjectBinding(
            page_id_t=bundle.weights.page_ids_t.detach().cpu().long().reshape(()),
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
        )
        self._page_object_row_boundary(binding)
        return binding

    def require_self_contained_direct_page_object_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> int:
        """Require an exact direct trained object before union authority.

        Compact untrained revisions 3/4 and quantized trained revision 5 are
        valid historical storage, but they are not final knowledge authority.
        A union page must be revision 2 (explicit optimizer) or revision 7
        (exact weights, implicit-zero optimizer), carry a positive optimizer
        step, and have no dependency, delta, or quantization metadata.
        """

        row = self._page_object_row_boundary(binding)
        page_id = int(row["pageId"])
        object_path = self._object_path_boundary(
            str(row["sha256"]),
            expected_bytes=int(row["bytes"]),
        )
        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            keys = set(handle.keys())
            revision = self._page_format_revision_boundary(handle)
            dependency_keys = {
                "base_object_sha256_t",
                "base_object_bytes_t",
                "base_generation_t",
                "base_manifest_payload_sha256_t",
                "delta_storage_dtype_t",
            }
            has_delta_tensor = any("_delta_" in name for name in keys)
            common_keys = {
                "format_revision_t",
                "page_ids_t",
                "step_t",
                *_PAGE_WEIGHT_TENSOR_NAMES,
            }
            expected_keys = (
                common_keys
                | {"optimizer_mean_t", "optimizer_square_t"}
                if revision == FULL_OPTIMIZER_PAGE_FORMAT_REVISION
                else common_keys | {"optimizer_width_t"}
            )
            page_ids_t = handle.get_tensor("page_ids_t")
            step_t = (
                handle.get_tensor("step_t")
                if "step_t" in keys
                else None
            )
            if (
                revision
                not in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
                or dependency_keys & keys
                or has_delta_tensor
                or any(
                    name.endswith("_scale_t") or name.endswith("_dtype_t")
                    for name in keys
                )
                or keys != expected_keys
                or page_ids_t.dtype != torch.long
                or page_ids_t.shape != (1,)
                or int(page_ids_t[0]) != page_id
                or step_t is None
                or step_t.dtype != torch.long
                or step_t.shape != (1,)
                or not step_t.gt(0).all()
            ):
                raise RuntimeError(
                    "NoNE accepted union page is not an exact self-contained "
                    "direct knowledge object"
                )
        materialized_dtype = self._page_object_materialized_storage_dtype_boundary(
            self,
            binding,
        )
        materialized = self._materialize_page_binding_boundary(
            self,
            binding,
            dtype=materialized_dtype,
        )
        if (
            int(materialized.weights.page_ids_t.reshape(())) != page_id
            or materialized.step_t.shape != (1,)
            or not materialized.step_t.gt(0).all()
        ):
            raise RuntimeError(
                "NoNE accepted direct knowledge tensor bundle differs"
            )
        return revision

    def _reconciled_direct_page_header_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> tuple[int, int]:
        """Validate the exact direct header without replaying tensor materialization."""

        row = self._page_object_row_boundary(binding)
        page_id = int(row["pageId"])
        object_path = self._object_path_boundary(
            str(row["sha256"]),
            expected_bytes=int(row["bytes"]),
        )
        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            keys = set(handle.keys())
            revision = self._page_format_revision_boundary(handle)
            dependency_keys = {
                "base_object_sha256_t",
                "base_object_bytes_t",
                "base_generation_t",
                "base_manifest_payload_sha256_t",
                "delta_storage_dtype_t",
            }
            common_keys = {
                "format_revision_t",
                "page_ids_t",
                *_PAGE_WEIGHT_TENSOR_NAMES,
            }
            if revision == FULL_OPTIMIZER_PAGE_FORMAT_REVISION:
                expected_keys = common_keys | {
                    "optimizer_mean_t",
                    "optimizer_square_t",
                    "step_t",
                }
            elif revision == IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION:
                expected_keys = common_keys | {"optimizer_width_t"}
            elif revision == SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION:
                expected_keys = common_keys | {
                    "optimizer_width_t",
                    "step_t",
                }
            else:
                expected_keys = set()
            page_ids_t = handle.get_tensor("page_ids_t")
            step_present = "step_t" in keys
            step_required = revision in {
                FULL_OPTIMIZER_PAGE_FORMAT_REVISION,
                SELF_CONTAINED_STATELESS_EXACT_PAGE_FORMAT_REVISION,
            }
            if (
                revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
                or dependency_keys & keys
                or any("_delta_" in name for name in keys)
                or keys != expected_keys
                or page_ids_t.dtype != torch.long
                or page_ids_t.shape != (1,)
                or int(page_ids_t[0]) != page_id
                or (step_required and not step_present)
                or (not step_required and step_present)
                or (
                    step_required
                    and (
                        handle.get_tensor("step_t").dtype != torch.long
                        or handle.get_tensor("step_t").shape != (1,)
                        or not handle.get_tensor("step_t").gt(0).all()
                    )
                )
            ):
                raise RuntimeError(
                    "NoNE reconciled page is not a self-contained direct object"
                )
        return revision, page_id

    def require_reconciled_direct_page_object_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> int:
        """Require and cold-probe a dependency-free direct tensor bundle.

        Exact step-zero capacity revision 3 is a direct tensor bundle, while
        trained pages must be revision 2 or 7. Quantized revisions 4/5 and
        dependency-bound revision 6 are storage encodings, not final tensor
        authority, and must first be materialized and resealed. A new semantic
        union page is stricter still and accepts only trained revisions 2/7.
        """

        revision, page_id = self._reconciled_direct_page_header_boundary(
            binding
        )
        materialized_dtype = (
            self._page_object_materialized_storage_dtype_boundary(
                self,
                binding,
            )
        )
        materialized = self._materialize_page_binding_boundary(
            self,
            binding,
            dtype=materialized_dtype,
        )
        if (
            int(materialized.weights.page_ids_t.reshape(())) != page_id
            or materialized.step_t.shape != (1,)
            or (
                revision == IMPLICIT_ZERO_OPTIMIZER_PAGE_FORMAT_REVISION
                and (
                    torch.count_nonzero(materialized.step_t).ne(0)
                    or torch.count_nonzero(materialized.optimizer_mean_t).ne(0)
                    or torch.count_nonzero(
                        materialized.optimizer_square_t
                    ).ne(0)
                )
            )
            or (
                revision
                in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
                and not materialized.step_t.gt(0).all()
            )
        ):
            raise RuntimeError(
                "NoNE reconciled direct tensor bundle differs"
            )
        return revision

    def stage_self_contained_direct_page_object_boundary(
        self,
        bundle: NoNEPageBundle,
        *,
        sync_directory: bool = True,
    ) -> NoNEPageObjectBinding:
        """Reseal one fully materialized page as an exact direct object."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        validate_page_bundle(bundle)
        if bundle.weights.page_ids_t.numel() != 1:
            raise ValueError(
                "direct page-object staging requires exactly one materialized row"
            )
        page_id = int(
            bundle.weights.page_ids_t.detach().cpu().long().reshape(())
        )
        payload = self._self_contained_direct_page_payload_boundary(
            bundle,
            0,
        )
        object_sha256, object_bytes = self._save_page_payload_boundary(
            payload,
            page_id=page_id,
            sync_directory=sync_directory,
        )
        binding = NoNEPageObjectBinding(
            page_id_t=torch.tensor(page_id, dtype=torch.long),
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
        )
        self._reconciled_direct_page_header_boundary(binding)
        restored = self._materialize_page_binding_boundary(
            self,
            binding,
            dtype=bundle.weights.gate_t.dtype,
        )
        if not _same_page_bundle_boundary(bundle, restored):
            raise RuntimeError(
                "self-contained direct page changed materialized tensor state"
            )
        return binding

    def _local_reconciled_direct_page_object_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> int:
        """Require one exact direct object beneath this store's write root."""

        page_id = int(binding.page_id_t)
        object_sha256 = _tensor_digest_hex(binding.object_sha256_t)
        object_bytes = int(binding.object_bytes_t)
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        object_path = objects_root / f"{object_sha256}.safetensors"
        if (
            object_path.is_symlink()
            or not object_path.is_file()
            or object_path.stat().st_size != object_bytes
        ):
            raise RuntimeError(
                "NoNE reconciled direct object is not local"
            )
        self._verify_materialized_object_boundary(
            object_path=object_path,
            object_sha256=object_sha256,
        )
        revision, observed_page_id = (
            self._reconciled_direct_page_header_boundary(binding)
        )
        if observed_page_id != page_id:
            raise RuntimeError(
                "NoNE reconciled direct local page identity differs"
            )
        return revision

    @staticmethod
    def _direct_page_map_authority_record_boundary(
        page_objects: tuple[NoNEPageObjectBinding, ...],
    ) -> dict[str, Any]:
        """Seal the immutable dependency-free page-map identity."""

        if not page_objects:
            raise ValueError("NoNE direct page-map authority is empty")
        page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in page_objects
            )
        )
        if (
            torch.unique(page_ids_t).numel() != page_ids_t.numel()
            or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
        ):
            raise RuntimeError(
                "NoNE direct page-map authority identity differs"
            )
        return {
            "schema": RECONCILED_DIRECT_PAGE_MAP_AUTHORITY_SCHEMA,
            "pageCount": int(page_ids_t.numel()),
            "pageIdsSha256": _tensor_digest_hex(
                _tensor_payload_digest_t_boundary(page_ids_t)
            ),
            "pageMapSha256": _tensor_digest_hex(
                _page_object_map_digest_t_boundary(page_objects)
            ),
            "storagePageObjectsSelfContainedDirect": True,
            "baseBoundPageObjectCount": 0,
            "semanticPackPageObjectCount": 0,
        }

    @staticmethod
    def _direct_page_pack_set_authority_content_record_boundary(
        *,
        authority: DirectPagePackSetAuthorityPacket,
        index: DirectPagePackIndexPacket,
    ) -> dict[str, Any]:
        """Serialize the hash-bound pack identity shared by all placements."""

        validated = validate_direct_page_pack_set_authority_boundary(
            authority,
            index=index,
        )
        return {
            "index": {
                "path": authority.index_relative_path,
                "sha256": _tensor_digest_hex(authority.index_sha256_t),
                "bytes": int(authority.index_bytes_t),
            },
            "shards": [
                {
                    "path": authority.shard_relative_paths[shard_index],
                    "sha256": _tensor_digest_hex(
                        validated.shard_sha256s_t[shard_index]
                    ),
                    "bytes": int(
                        validated.shard_bytes_t[shard_index]
                    ),
                    "logicalObjectBytes": int(
                        validated.shard_logical_bytes_t[shard_index]
                    ),
                    "pageCount": int(
                        validated.shard_page_counts_t[shard_index]
                    ),
                }
                for shard_index in range(
                    validated.shard_sha256s_t.shape[0]
                )
            ],
            "pageCount": int(validated.page_ids_t.numel()),
            "logicalObjectBytes": int(validated.object_bytes_t.sum()),
            "alignmentBytes": DIRECT_PAGE_PACK_ALIGNMENT_BYTES,
            "pageIdsSha256": _tensor_digest_hex(
                validated.page_ids_sha256_t
            ),
            "pageMapSha256": _tensor_digest_hex(
                validated.page_map_sha256_t
            ),
            "packSetSha256": _tensor_digest_hex(
                validated.pack_set_sha256_t
            ),
            "directRevisions": sorted(DIRECT_PAGE_PACK_FORMAT_REVISIONS),
            "exactRawSafetensorBytes": True,
            "compression": False,
            "dependencyCount": 0,
            "historicalRevision6Accepted": False,
        }

    @staticmethod
    def _direct_page_pack_set_authority_record_boundary(
        *,
        authority: DirectPagePackSetAuthorityPacket,
        index: DirectPagePackIndexPacket,
    ) -> dict[str, Any]:
        """Bind one canonical pack location to its exact tensor identity."""

        canonical_root = authority.index_root.expanduser().resolve()
        if (
            len(authority.shard_roots) != 1
            or len(authority.shard_relative_paths) != 1
            or authority.shard_roots[0].expanduser().resolve()
            != canonical_root
            or not canonical_root.is_dir()
        ):
            raise RuntimeError(
                "NoNE direct page pack canonical topology differs"
            )
        return {
            "schema": DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA,
            "canonicalPackRoot": str(canonical_root),
            **NoNEImmutablePageStore._direct_page_pack_set_authority_content_record_boundary(
                authority=authority,
                index=index,
            ),
        }

    def _local_direct_page_pack_set_authority_boundary(
        self,
        manifest: Mapping[str, Any],
    ) -> tuple[
        DirectPagePackSetAuthorityPacket,
        DirectPagePackIndexPacket,
        dict[str, Any],
    ] | None:
        """Resolve one exact pack, preserving only legacy v1 local placement."""

        record = manifest.get("directPagePackSetAuthority")
        if record is None:
            return None
        content_fields = {
            "schema",
            "index",
            "shards",
            "pageCount",
            "logicalObjectBytes",
            "alignmentBytes",
            "pageIdsSha256",
            "pageMapSha256",
            "packSetSha256",
            "directRevisions",
            "exactRawSafetensorBytes",
            "compression",
            "dependencyCount",
            "historicalRevision6Accepted",
        }
        if not isinstance(record, dict):
            raise RuntimeError(
                "NoNE direct page pack-set manifest authority differs"
            )
        schema = record.get("schema")
        if schema == DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA:
            if set(record) != content_fields.union({"canonicalPackRoot"}):
                raise RuntimeError(
                    "NoNE direct page pack-set manifest authority differs"
                )
        elif schema == LEGACY_DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA:
            if set(record) != content_fields:
                raise RuntimeError(
                    "NoNE direct page pack-set manifest authority differs"
                )
        else:
            raise RuntimeError(
                "NoNE direct page pack-set manifest authority differs"
            )
        index_record = record.get("index")
        shard_records = record.get("shards")
        if (
            not isinstance(index_record, dict)
            or set(index_record) != {"path", "sha256", "bytes"}
            or not isinstance(shard_records, list)
            or not shard_records
            or any(
                not isinstance(row, dict)
                or set(row)
                != {
                    "path",
                    "sha256",
                    "bytes",
                    "logicalObjectBytes",
                    "pageCount",
                }
                for row in shard_records
            )
            or record.get("directRevisions")
            != sorted(DIRECT_PAGE_PACK_FORMAT_REVISIONS)
            or record.get("exactRawSafetensorBytes") is not True
            or record.get("compression") is not False
            or record.get("dependencyCount") != 0
            or record.get("historicalRevision6Accepted") is not False
            or record.get("alignmentBytes")
            != DIRECT_PAGE_PACK_ALIGNMENT_BYTES
        ):
            raise RuntimeError(
                "NoNE direct page pack-set manifest authority differs"
            )
        assert isinstance(index_record, dict)
        assert isinstance(shard_records, list)
        index_path = index_record.get("path")
        index_sha256 = index_record.get("sha256")
        index_bytes = index_record.get("bytes")
        if (
            not isinstance(index_path, str)
            or not index_path
            or Path(index_path).is_absolute()
            or not _valid_sha256_boundary(index_sha256)
            or not isinstance(index_bytes, int)
            or isinstance(index_bytes, bool)
            or index_bytes < 1
        ):
            raise RuntimeError(
                "NoNE direct page pack-set index authority differs"
            )
        shard_paths: list[str] = []
        shard_sha256s_t: list[torch.Tensor] = []
        shard_bytes: list[int] = []
        for row in shard_records:
            assert isinstance(row, dict)
            path = row.get("path")
            sha256 = row.get("sha256")
            physical_bytes = row.get("bytes")
            logical_bytes = row.get("logicalObjectBytes")
            page_count = row.get("pageCount")
            if (
                not isinstance(path, str)
                or not path
                or Path(path).is_absolute()
                or not _valid_sha256_boundary(sha256)
                or not isinstance(physical_bytes, int)
                or isinstance(physical_bytes, bool)
                or physical_bytes < 1
                or physical_bytes % DIRECT_PAGE_PACK_ALIGNMENT_BYTES
                or not isinstance(logical_bytes, int)
                or isinstance(logical_bytes, bool)
                or logical_bytes < 1
                or not isinstance(page_count, int)
                or isinstance(page_count, bool)
                or page_count < 1
            ):
                raise RuntimeError(
                    "NoNE direct page pack-set shard authority differs"
                )
            shard_paths.append(path)
            shard_sha256s_t.append(digest_tensor(cast(str, sha256)))
            shard_bytes.append(physical_bytes)
        scalar_fields = (
            record.get("pageCount"),
            record.get("logicalObjectBytes"),
        )
        if any(
            not isinstance(value, int)
            or isinstance(value, bool)
            or value < 1
            for value in scalar_fields
        ) or any(
            not _valid_sha256_boundary(record.get(name))
            for name in (
                "pageIdsSha256",
                "pageMapSha256",
                "packSetSha256",
            )
        ):
            raise RuntimeError(
                "NoNE direct page pack-set scalar authority differs"
            )
        if schema == DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA:
            canonical_root_value = record.get("canonicalPackRoot")
            if (
                not isinstance(canonical_root_value, str)
                or not canonical_root_value
                or not Path(canonical_root_value).is_absolute()
                or _unresolved_path_contains_symlink_boundary(
                    Path(canonical_root_value)
                )
            ):
                raise RuntimeError(
                    "NoNE direct page pack canonical root differs"
                )
            pack_root = Path(canonical_root_value).resolve()
            if (
                str(pack_root) != canonical_root_value
                or not pack_root.is_dir()
                or len(shard_records) != 1
            ):
                raise RuntimeError(
                    "NoNE direct page pack canonical root differs"
                )
        else:
            _session_id_t, pack_root = self._require_session()
        authority = DirectPagePackSetAuthorityPacket(
            shard_roots=tuple(pack_root for _row in shard_records),
            shard_relative_paths=tuple(shard_paths),
            index_root=pack_root,
            index_relative_path=index_path,
            shard_sha256s_t=torch.stack(tuple(shard_sha256s_t)),
            index_sha256_t=digest_tensor(cast(str, index_sha256)),
            shard_bytes_t=torch.tensor(shard_bytes, dtype=torch.long),
            index_bytes_t=torch.tensor(index_bytes, dtype=torch.long),
            logical_object_bytes_t=torch.tensor(
                cast(int, record["logicalObjectBytes"]),
                dtype=torch.long,
            ),
            page_count_t=torch.tensor(
                cast(int, record["pageCount"]),
                dtype=torch.long,
            ),
            alignment_bytes_t=torch.tensor(
                DIRECT_PAGE_PACK_ALIGNMENT_BYTES,
                dtype=torch.long,
            ),
            page_ids_sha256_t=digest_tensor(
                cast(str, record["pageIdsSha256"])
            ),
            page_map_sha256_t=digest_tensor(
                cast(str, record["pageMapSha256"])
            ),
            pack_set_sha256_t=digest_tensor(
                cast(str, record["packSetSha256"])
            ),
        )
        index = load_direct_page_pack_index_boundary(authority)
        content_record = (
            self._direct_page_pack_set_authority_content_record_boundary(
                authority=authority,
                index=index,
            )
        )
        expected = (
            {
                "schema": DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA,
                "canonicalPackRoot": str(pack_root),
                **content_record,
            }
            if schema == DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA
            else {
                "schema": LEGACY_DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA,
                **content_record,
            }
        )
        if record != expected:
            raise RuntimeError(
                "NoNE direct page pack-set content authority differs"
            )
        page_rows_value = manifest.get("pageObjects")
        if not isinstance(page_rows_value, list) or not page_rows_value:
            raise RuntimeError(
                "NoNE direct page pack-set page catalog is absent"
            )
        try:
            page_objects = tuple(
                self._page_object_binding_from_row_boundary(
                    cast(dict[str, Any], row)
                )
                for row in sorted(
                    page_rows_value,
                    key=lambda row: int(
                        cast(dict[str, Any], row)["pageId"]
                    ),
                )
            )
        except (KeyError, TypeError, ValueError) as error:
            raise RuntimeError(
                "NoNE direct page pack-set page catalog differs"
            ) from error
        if (
            not torch.equal(
                index.page_ids_t,
                torch.stack(
                    tuple(
                        binding.page_id_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                        for binding in page_objects
                    )
                ),
            )
            or not torch.equal(
                index.object_sha256s_t,
                torch.stack(
                    tuple(
                        binding.object_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(32)
                        for binding in page_objects
                    )
                ),
            )
            or not torch.equal(
                index.object_bytes_t,
                torch.stack(
                    tuple(
                        binding.object_bytes_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                        for binding in page_objects
                    )
                ),
            )
            or not bool(
                torch.isin(
                    index.format_revisions_t,
                    torch.tensor(
                        sorted(DIRECT_PAGE_PACK_FORMAT_REVISIONS),
                        dtype=torch.long,
                    ),
                ).all()
            )
        ):
            raise RuntimeError(
                "NoNE direct page pack-set page map differs"
            )
        return authority, index, expected

    def _accepted_local_direct_page_pack_set_authority_boundary(
        self,
        manifest: Mapping[str, Any],
    ) -> tuple[
        DirectPagePackSetAuthorityPacket,
        DirectPagePackIndexPacket,
        dict[str, Any],
    ] | None:
        """Reuse one accepted pack only while every immutable file is unchanged."""

        record = manifest.get("directPagePackSetAuthority")
        cached_authority = (
            self._accepted_direct_page_pack_authority_boundary
        )
        cached_index = self._accepted_direct_page_pack_index_boundary
        cached_record = self._accepted_direct_page_pack_record_boundary
        cached_identities = (
            self._accepted_direct_page_pack_file_identities_boundary
        )
        if (
            isinstance(record, dict)
            and cached_authority is not None
            and cached_index is not None
            and cached_record == record
            and cached_identities is not None
        ):
            try:
                if all(
                    _file_identity(path) == identity
                    for path, identity in cached_identities
                ):
                    return cached_authority, cached_index, cached_record
            except OSError:
                pass
            self._clear_accepted_direct_page_map_cache_boundary()
        if self._release_generation_projection is not None:
            raise RuntimeError(
                "NoNE release direct pack changed after admission"
            )
        return self._local_direct_page_pack_set_authority_boundary(
            manifest
        )

    def _validated_manifest_direct_page_map_authority_boundary(
        self,
        manifest: Mapping[str, Any],
    ) -> dict[str, Any] | None:
        """Validate and return a manifest's persistent direct-map authority."""

        record = manifest.get("directPageMapAuthority")
        if record is None:
            return None
        page_rows_value = manifest.get("pageObjects")
        if (
            not isinstance(record, dict)
            or not isinstance(page_rows_value, list)
            or not page_rows_value
            or any(
                not isinstance(row, dict)
                or row.get("semanticPack") is not None
                for row in page_rows_value
            )
        ):
            raise RuntimeError(
                "NoNE direct page-map manifest authority differs"
            )
        try:
            page_objects = tuple(
                self._page_object_binding_from_row_boundary(
                    cast(dict[str, Any], row)
                )
                for row in sorted(
                    page_rows_value,
                    key=lambda row: int(
                        cast(dict[str, Any], row)["pageId"]
                    ),
                )
            )
        except (KeyError, TypeError, ValueError) as error:
            raise RuntimeError(
                "NoNE direct page-map manifest authority differs"
            ) from error
        expected = self._direct_page_map_authority_record_boundary(
            page_objects
        )
        pack = self._accepted_local_direct_page_pack_set_authority_boundary(
            manifest
        )
        if pack is not None:
            expected["directPagePackSetSha256"] = pack[2][
                "packSetSha256"
            ]
        if record != expected or manifest.get("pageCount") != len(
            page_objects
        ):
            raise RuntimeError(
                "NoNE direct page-map manifest authority differs"
            )
        return expected

    @staticmethod
    def _direct_page_map_frontier_record_sha256_boundary(
        record: Mapping[str, Any],
    ) -> str:
        """Hash one immutable direct-only frontier record."""

        return hashlib.sha256(
            _canonical_json_bytes(
                {
                    key: value
                    for key, value in record.items()
                    if key != "recordSha256"
                }
            )
        ).hexdigest()

    def _accepted_direct_page_map_frontier_root_boundary(self) -> Path:
        """Return the session-local immutable direct-only frontier directory."""

        _session_id_t, session_root = self._require_session()
        return session_root / "accepted_direct_page_map_frontiers"

    def _validated_direct_page_map_frontier_commit_boundary(
        self,
        value: object,
    ) -> bool:
        """Validate an optional transaction marker; false means still pending."""

        if value is None:
            return True
        if not isinstance(value, dict) or set(value) != {
            "path",
            "sha256",
            "transactionSha256",
            "storeRoot",
            "targetPointerPayloadSha256",
        }:
            raise RuntimeError(
                "NoNE accepted direct page-map frontier commit differs"
            )
        marker_path_value = value.get("path")
        marker_sha256 = value.get("sha256")
        transaction_sha256 = value.get("transactionSha256")
        store_root = value.get("storeRoot")
        target_pointer_sha256 = value.get("targetPointerPayloadSha256")
        if (
            not isinstance(marker_path_value, str)
            or not marker_path_value
            or not _valid_sha256_boundary(marker_sha256)
            or not _valid_sha256_boundary(transaction_sha256)
            or store_root != str(self.root)
            or not _valid_sha256_boundary(target_pointer_sha256)
        ):
            raise RuntimeError(
                "NoNE accepted direct page-map frontier commit differs"
            )
        marker_path = Path(marker_path_value).expanduser().resolve()
        if not marker_path.exists():
            return False
        if (
            marker_path.is_symlink()
            or not marker_path.is_file()
            or hashlib.sha256(
                _canonical_json_bytes(_read_json(marker_path))
            ).hexdigest()
            != marker_sha256
        ):
            raise RuntimeError(
                "NoNE accepted direct page-map frontier commit changed"
            )
        marker = _read_json(marker_path)
        target_pointer_sha256s = marker.get(
            "targetPointerPayloadSha256s"
        )
        if (
            marker.get("schema")
            != ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA
            or marker.get("passed") is not True
            or marker.get("transactionSha256") != transaction_sha256
            or not isinstance(target_pointer_sha256s, dict)
            or target_pointer_sha256s.get(str(self.root))
            != target_pointer_sha256
        ):
            raise RuntimeError(
                "NoNE accepted direct page-map frontier commit differs"
            )
        return True

    def _load_accepted_direct_page_map_frontier_boundary(
        self,
    ) -> tuple[
        NoNEGenerationBinding,
        dict[str, Any],
        dict[str, Any],
    ] | None:
        """Load the latest committed direct-only frontier for this session."""

        session_id_t, session_root = self._require_session()
        frontier_root = (
            self._accepted_direct_page_map_frontier_root_boundary()
        )
        if not frontier_root.exists():
            return None
        if frontier_root.is_symlink() or not frontier_root.is_dir():
            raise RuntimeError(
                "NoNE accepted direct page-map frontier root differs"
            )
        active: list[
            tuple[
                NoNEGenerationBinding,
                dict[str, Any],
                dict[str, Any],
            ]
        ] = []
        for path in sorted(frontier_root.glob("generation_*.json")):
            resolved = path.resolve()
            if (
                path.is_symlink()
                or not path.is_file()
                or resolved.parent != frontier_root.resolve()
            ):
                raise RuntimeError(
                    "NoNE accepted direct page-map frontier identity differs"
                )
            record = _read_json(path)
            binding_record = record.get("generationBinding")
            direct_authority = record.get("directPageMapAuthority")
            record_sha256 = record.get("recordSha256")
            commit_record = record.get("acceptanceCommitMarker")
            if (
                record.get("schema")
                != RECONCILED_DIRECT_PAGE_MAP_FRONTIER_SCHEMA
                or record.get("sessionKey") != _session_key(session_id_t)
                or not isinstance(binding_record, dict)
                or not isinstance(direct_authority, dict)
                or not _valid_sha256_boundary(record_sha256)
                or self._direct_page_map_frontier_record_sha256_boundary(
                    record
                )
                != record_sha256
            ):
                raise RuntimeError(
                    "NoNE accepted direct page-map frontier differs"
                )
            binding = generation_binding_from_record_boundary(
                binding_record
            )
            generation = int(binding.generation_t)
            payload_sha256 = _tensor_digest_hex(
                binding.manifest_payload_sha256_t
            )
            if path.name != (
                f"generation_{generation:08d}_{payload_sha256}_"
                f"{record_sha256}.json"
            ):
                raise RuntimeError(
                    "NoNE accepted direct page-map frontier path differs"
                )
            if not self._validated_direct_page_map_frontier_commit_boundary(
                commit_record
            ):
                continue
            loaded, manifest = self._load_generation_binding_boundary(
                binding.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    binding.manifest_sha256_t
                ),
                expected_payload_sha256=payload_sha256,
            )
            manifest_authority = (
                self._validated_manifest_direct_page_map_authority_boundary(
                    manifest
                )
            )
            if (
                not _same_generation_binding_boundary(loaded, binding)
                or manifest_authority != direct_authority
                or record.get("pageCount")
                != direct_authority.get("pageCount")
                or record.get("pageIdsSha256")
                != direct_authority.get("pageIdsSha256")
                or record.get("pageMapSha256")
                != direct_authority.get("pageMapSha256")
            ):
                raise RuntimeError(
                    "NoNE accepted direct page-map frontier authority differs"
                )
            active.append((loaded, manifest, record))
        if not active:
            return None
        active.sort(
            key=lambda row: (
                int(row[0].generation_t),
                _tensor_digest_hex(row[0].manifest_payload_sha256_t),
            )
        )
        latest_binding, latest_manifest, latest_record = active[-1]
        latest_ids_t = self._manifest_page_ids_t_boundary(
            latest_manifest
        )
        for binding, manifest, _record in active[:-1]:
            generation = int(binding.generation_t)
            latest_generation = int(latest_binding.generation_t)
            if (
                generation == latest_generation
                and not _same_generation_binding_boundary(
                    binding,
                    latest_binding,
                )
            ) or not bool(
                _page_ids_subset_t_boundary(
                    self._manifest_page_ids_t_boundary(manifest),
                    latest_ids_t,
                )
            ):
                raise RuntimeError(
                    "NoNE accepted direct page-map frontier history conflicts"
                )
        if not (session_root / latest_binding.manifest_relative_path).is_file():
            raise RuntimeError(
                "NoNE accepted direct page-map frontier manifest disappeared"
            )
        return latest_binding, latest_manifest, latest_record

    def _validate_direct_page_map_frontier_transition_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
    ) -> None:
        """Reject direct-to-indirect rollback while allowing authenticated growth."""

        frontier = self._load_accepted_direct_page_map_frontier_boundary()
        if frontier is None:
            return
        target_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                generation_manifest
            )
        )
        if target_authority is None:
            raise RuntimeError(
                "NoNE direct-only accepted lineage cannot regress"
            )
        frontier_binding, frontier_manifest, _record = frontier
        target_generation = int(generation_binding.generation_t)
        frontier_generation = int(frontier_binding.generation_t)
        if target_generation < frontier_generation:
            raise RuntimeError(
                "NoNE direct-only accepted generation cannot roll back"
            )
        if target_generation == frontier_generation:
            if not _same_generation_binding_boundary(
                generation_binding,
                frontier_binding,
            ):
                raise RuntimeError(
                    "NoNE direct-only accepted generation conflicts"
                )
        else:
            current_binding = generation_binding
            current_manifest = dict(generation_manifest)
            _session_id_t, session_root = self._require_session()
            while int(current_binding.generation_t) > frontier_generation:
                parent_generation = current_manifest.get(
                    "parentGeneration"
                )
                parent_payload_sha256 = current_manifest.get(
                    "parentManifestPayloadSha256"
                )
                if (
                    not isinstance(parent_generation, int)
                    or isinstance(parent_generation, bool)
                    or parent_generation < 1
                    or parent_generation >= int(
                        current_binding.generation_t
                    )
                    or not _valid_sha256_boundary(
                        parent_payload_sha256
                    )
                ):
                    raise RuntimeError(
                        "NoNE direct-only accepted lineage is incomplete"
                    )
                parent_path = (
                    _parent_generation_manifest_path_boundary(
                        (
                            session_root
                            / current_binding.manifest_relative_path
                        ).resolve(),
                        parent_generation=parent_generation,
                        parent_payload_sha256=cast(
                            str,
                            parent_payload_sha256,
                        ),
                    )
                )
                current_binding, current_manifest = (
                    self._load_generation_binding_boundary(
                        str(parent_path.relative_to(session_root)),
                        expected_payload_sha256=cast(
                            str,
                            parent_payload_sha256,
                        ),
                    )
                )
            if not _same_generation_binding_boundary(
                current_binding,
                frontier_binding,
            ):
                raise RuntimeError(
                    "NoNE direct-only accepted lineage is not descended from "
                    "its sealed frontier"
                )
        frontier_page_ids_t = self._manifest_page_ids_t_boundary(
            frontier_manifest
        )
        target_page_ids_t = self._manifest_page_ids_t_boundary(
            dict(generation_manifest)
        )
        if not bool(
            _page_ids_subset_t_boundary(
                frontier_page_ids_t,
                target_page_ids_t,
            )
        ):
            raise RuntimeError(
                "NoNE direct-only accepted page map cannot shrink"
            )
        new_page_ids_t = target_page_ids_t[
            ~torch.isin(target_page_ids_t, frontier_page_ids_t)
        ]
        if new_page_ids_t.numel() and not bool(
            _page_ids_subset_t_boundary(
                new_page_ids_t,
                generation_binding.updated_page_ids_t.detach()
                .cpu()
                .long()
                .reshape(-1),
            )
        ):
            raise RuntimeError(
                "NoNE direct-only page growth lacks updated-page authority"
            )

    def _persist_accepted_direct_page_map_frontier_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
        acceptance_commit_marker: Mapping[str, Any] | None = None,
    ) -> Path | None:
        """Persist one immutable direct-only frontier after local closure proof."""

        authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                generation_manifest
            )
        )
        if authority is None:
            return None
        self._validate_direct_page_map_frontier_transition_boundary(
            generation_binding=generation_binding,
            generation_manifest=generation_manifest,
        )
        session_id_t, _session_root = self._require_session()
        record: dict[str, Any] = {
            "schema": RECONCILED_DIRECT_PAGE_MAP_FRONTIER_SCHEMA,
            "sessionKey": _session_key(session_id_t),
            "generationBinding": (
                generation_binding.external_record_boundary()
            ),
            "directPageMapAuthority": authority,
            "pageCount": authority["pageCount"],
            "pageIdsSha256": authority["pageIdsSha256"],
            "pageMapSha256": authority["pageMapSha256"],
        }
        if acceptance_commit_marker is not None:
            record["acceptanceCommitMarker"] = dict(
                acceptance_commit_marker
            )
        record["recordSha256"] = (
            self._direct_page_map_frontier_record_sha256_boundary(record)
        )
        generation = int(generation_binding.generation_t)
        payload_sha256 = _tensor_digest_hex(
            generation_binding.manifest_payload_sha256_t
        )
        frontier_root = (
            self._accepted_direct_page_map_frontier_root_boundary()
        )
        frontier_root.mkdir(parents=True, exist_ok=True)
        path = frontier_root / (
            f"generation_{generation:08d}_{payload_sha256}_"
            f"{record['recordSha256']}.json"
        )
        if path.is_file():
            if _read_json(path) != record:
                raise RuntimeError(
                    "NoNE accepted direct page-map frontier changed"
                )
        else:
            _atomic_json(path, record)
        return path

    def _accepted_direct_page_map_authority_active_boundary(self) -> bool:
        """Return whether this lineage has crossed the direct-only frontier."""

        if self._manifest is None:
            return False
        direct_pack = self._manifest.get("directPagePackSetAuthority")
        if (
            isinstance(direct_pack, dict)
            and direct_pack.get("schema")
            == DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA
        ):
            return True
        return (
            self._validated_manifest_direct_page_map_authority_boundary(
                self._manifest
            )
            is not None
        )

    def _clear_accepted_direct_page_map_cache_boundary(self) -> None:
        """Drop the process-local proof of one accepted direct object closure."""

        self._accepted_direct_page_map_payload_sha256_boundary = ""
        self._accepted_direct_page_map_objects_root_identity_boundary = None
        self._accepted_direct_page_pack_file_identities_boundary = None
        self._accepted_direct_page_pack_authority_boundary = None
        self._accepted_direct_page_pack_index_boundary = None
        self._accepted_direct_page_pack_record_boundary = None

    def _direct_page_map_parent_page_ids_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
    ) -> torch.Tensor:
        """Load the exact immutable parent sparse page-ID authority."""

        _session_id_t, session_root = self._require_session()
        generation = int(
            generation_binding.generation_t.detach()
            .cpu()
            .long()
            .reshape(())
        )
        parent_generation = generation_manifest.get("parentGeneration")
        parent_payload_sha256 = generation_manifest.get(
            "parentManifestPayloadSha256"
        )
        if (
            not isinstance(parent_generation, int)
            or isinstance(parent_generation, bool)
            or parent_generation < 1
            or parent_generation >= generation
            or parent_generation
            != int(
                generation_binding.parent_generation_t.detach()
                .cpu()
                .long()
                .reshape(())
            )
            or not isinstance(parent_payload_sha256, str)
            or not _valid_sha256_boundary(parent_payload_sha256)
        ):
            raise RuntimeError(
                "NoNE direct page-map immutable parent identity differs"
            )
        manifest_path = (
            session_root / generation_binding.manifest_relative_path
        ).resolve()
        parent_path = _parent_generation_manifest_path_boundary(
            manifest_path,
            parent_generation=parent_generation,
            parent_payload_sha256=parent_payload_sha256,
        )
        (
            _parent_manifest_sha256,
            parent_manifest,
            projected_parent_payload_sha256,
            parent_page_rows,
            _parent_identity,
            _parent_dependencies,
        ) = _read_generation_manifest_authority_snapshot_cached(parent_path)
        if (
            parent_manifest.get("sessionKey")
            != generation_manifest.get("sessionKey")
            or parent_manifest.get("generation") != parent_generation
            or parent_manifest.get("manifestPayloadSha256")
            != parent_payload_sha256
            or projected_parent_payload_sha256 != parent_payload_sha256
            or not parent_page_rows
        ):
            raise RuntimeError(
                "NoNE direct page-map immutable parent authority differs"
            )
        return torch.tensor(
            sorted(parent_page_rows),
            dtype=torch.long,
        )

    def _validate_and_cache_accepted_direct_page_map_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
    ) -> None:
        """Cold-validate every local direct object before caching discovery."""

        if self._record_content_addressed_direct_page_pack_boundary(
            generation_binding=generation_binding,
            generation_manifest=generation_manifest,
        ):
            return
        authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                generation_manifest
            )
        )
        if authority is None:
            self._clear_accepted_direct_page_map_cache_boundary()
            return
        if self._direct_page_map_cache_matches_binding_boundary(
            generation_binding
        ):
            return
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        objects_root_identity_before = _file_identity(objects_root)
        page_objects = self._require_complete_local_direct_page_map_boundary(
            generation_binding=generation_binding,
            generation_manifest=generation_manifest,
            expected_page_ids_t=(
                self._direct_page_map_parent_page_ids_boundary(
                    generation_binding=generation_binding,
                    generation_manifest=generation_manifest,
                )
            ),
            complete_rewrite_required=False,
        )
        expected_authority = (
            self._direct_page_map_authority_record_boundary(page_objects)
        )
        pack = self._local_direct_page_pack_set_authority_boundary(
            generation_manifest
        )
        if pack is not None:
            expected_authority["directPagePackSetSha256"] = pack[2][
                "packSetSha256"
            ]
        if (
            authority != expected_authority
            or _file_identity(objects_root) != objects_root_identity_before
        ):
            raise RuntimeError(
                "NoNE accepted direct page-map local closure differs"
            )
        self._record_validated_accepted_direct_page_map_boundary(
            generation_binding=generation_binding,
            generation_manifest=generation_manifest,
        )

    def _record_content_addressed_direct_page_pack_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
    ) -> bool:
        """Open an accepted canonical pack by index without replaying its manifest.

        A canonical direct-pack record is already a content-addressed locator.
        Public decode therefore opens its small index and caches the immutable
        file identities directly.  It must not rebuild 81,602 Python page
        bindings from the redundant JSON catalog before admitting compute.
        """

        record = generation_manifest.get("directPagePackSetAuthority")
        if (
            not isinstance(record, dict)
            or record.get("schema")
            != DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA
        ):
            return False
        canonical_root = record.get("canonicalPackRoot")
        index_record = record.get("index")
        index_relative_path = (
            index_record.get("path")
            if isinstance(index_record, dict)
            else None
        )
        if (
            not isinstance(canonical_root, str)
            or not canonical_root
            or not isinstance(index_relative_path, str)
            or not index_relative_path
        ):
            raise RuntimeError(
                "NoNE accepted direct pack locator is malformed"
            )
        reopened = reopen_direct_page_pack_set_boundary(
            storage_root=Path(canonical_root),
            index_relative_path=index_relative_path,
        )
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        pack_authority = reopened.authority
        self._accepted_direct_page_map_payload_sha256_boundary = (
            _tensor_digest_hex(
                generation_binding.manifest_payload_sha256_t
            )
        )
        self._accepted_direct_page_map_objects_root_identity_boundary = (
            _file_identity(objects_root)
        )
        self._accepted_direct_page_pack_authority_boundary = pack_authority
        self._accepted_direct_page_pack_index_boundary = reopened.index
        self._accepted_direct_page_pack_record_boundary = dict(record)
        self._accepted_direct_page_pack_file_identities_boundary = (
            (
                (
                    pack_authority.index_root
                    / pack_authority.index_relative_path
                ).resolve(),
                _file_identity(
                    (
                        pack_authority.index_root
                        / pack_authority.index_relative_path
                    ).resolve()
                ),
            ),
            *tuple(
                (
                    (root / relative_path).resolve(),
                    _file_identity((root / relative_path).resolve()),
                )
                for root, relative_path in zip(
                    pack_authority.shard_roots,
                    pack_authority.shard_relative_paths,
                    strict=True,
                )
            ),
        )
        with self._resolved_object_path_cache_lock:
            self._resolved_object_path_cache.clear()
        return True

    def _record_validated_accepted_direct_page_map_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
    ) -> None:
        """Record a closure already validated by accept, checkout, or discovery."""

        authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                generation_manifest
            )
        )
        if authority is None:
            self._clear_accepted_direct_page_map_cache_boundary()
            return
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        self._accepted_direct_page_map_payload_sha256_boundary = (
            _tensor_digest_hex(
                generation_binding.manifest_payload_sha256_t
            )
        )
        self._accepted_direct_page_map_objects_root_identity_boundary = (
            _file_identity(objects_root)
        )
        pack = self._local_direct_page_pack_set_authority_boundary(
            generation_manifest
        )
        if pack is None:
            self._accepted_direct_page_pack_file_identities_boundary = None
            self._accepted_direct_page_pack_authority_boundary = None
            self._accepted_direct_page_pack_index_boundary = None
            self._accepted_direct_page_pack_record_boundary = None
        else:
            pack_authority = pack[0]
            self._accepted_direct_page_pack_authority_boundary = (
                pack_authority
            )
            self._accepted_direct_page_pack_index_boundary = pack[1]
            self._accepted_direct_page_pack_record_boundary = dict(pack[2])
            self._accepted_direct_page_pack_file_identities_boundary = (
                (
                    (
                        pack_authority.index_root
                        / pack_authority.index_relative_path
                    ).resolve(),
                    _file_identity(
                        (
                            pack_authority.index_root
                            / pack_authority.index_relative_path
                        ).resolve()
                    ),
                ),
                *tuple(
                    (
                        (
                            root / relative_path
                        ).resolve(),
                        _file_identity(
                            (root / relative_path).resolve()
                        ),
                    )
                    for root, relative_path in zip(
                        pack_authority.shard_roots,
                        pack_authority.shard_relative_paths,
                        strict=True,
                    )
                ),
            )
        with self._resolved_object_path_cache_lock:
            self._resolved_object_path_cache.clear()

    def _accepted_direct_page_map_cache_current_boundary(self) -> bool:
        """Check the O(1) local-directory sentinel for cached discovery."""

        if self._manifest is None or not isinstance(
            self._manifest.get("directPageMapAuthority"),
            dict,
        ):
            return True
        if self._accepted_binding_boundary is None:
            return False
        return self._direct_page_map_cache_matches_binding_boundary(
            self._accepted_binding_boundary
        )

    def _direct_page_map_cache_matches_binding_boundary(
        self,
        generation_binding: NoNEGenerationBinding,
    ) -> bool:
        """Check one binding against the last fully validated local closure."""

        expected_payload_sha256 = _tensor_digest_hex(
            generation_binding.manifest_payload_sha256_t
        )
        cached_root_identity = (
            self._accepted_direct_page_map_objects_root_identity_boundary
        )
        cached_pack_identities = (
            self._accepted_direct_page_pack_file_identities_boundary
        )
        if (
            not cached_root_identity
            or self._accepted_direct_page_map_payload_sha256_boundary
            != expected_payload_sha256
        ):
            return False
        try:
            if cached_pack_identities is not None:
                return all(
                    _file_identity(path) == identity
                    for path, identity in cached_pack_identities
                )
            objects_root, _scratch_root = (
                self._validated_page_object_write_roots_boundary()
            )
            return _file_identity(objects_root) == cached_root_identity
        except OSError:
            return False

    def _begin_direct_page_map_local_append_boundary(
        self,
        objects_root: Path,
    ) -> bool:
        """Capture whether an append begins from the cached direct closure."""

        cached_identity = (
            self._accepted_direct_page_map_objects_root_identity_boundary
        )
        if (
            not self._accepted_direct_page_map_payload_sha256_boundary
            or cached_identity is None
        ):
            return False
        try:
            return _file_identity(objects_root) == cached_identity
        except OSError:
            return False

    def _finish_direct_page_map_local_append_boundary(
        self,
        objects_root: Path,
        *,
        cache_was_current: bool,
    ) -> None:
        """Advance the sentinel after one controlled append-only publication."""

        if cache_was_current:
            self._accepted_direct_page_map_objects_root_identity_boundary = (
                _file_identity(objects_root)
            )

    def _require_complete_local_direct_page_map_boundary(
        self,
        *,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
        expected_page_ids_t: torch.Tensor,
        complete_rewrite_required: bool = True,
    ) -> tuple[NoNEPageObjectBinding, ...]:
        """Require one complete sparse map of local direct safetensors.

        This is the final-checkpoint storage authority gate.  It compares the
        staged immutable map with at least the exact parent page identities
        (including sparse IDs above 101,000), rejects semantic-pack and
        base-bound rows, and cold-validates every object beneath this store's
        own write root. Authenticated new sparse pages may extend the parent
        only when the generation's updated-page authority names them.
        A page claimed as training-proven must carry trained direct revision 2
        or 7; exact step-zero capacity may remain direct revision 3.
        """

        page_rows_value = generation_manifest.get("pageObjects")
        if not isinstance(page_rows_value, list) or not page_rows_value:
            raise RuntimeError(
                "NoNE final direct page map is absent"
            )
        if any(
            not isinstance(row, dict)
            or not isinstance(row.get("pageId"), int)
            or isinstance(row.get("pageId"), bool)
            or row.get("semanticPack") is not None
            for row in page_rows_value
        ):
            raise RuntimeError(
                "NoNE final direct page map contains indirect authority"
            )
        page_rows = tuple(
            cast(dict[str, Any], row)
            for row in sorted(
                page_rows_value,
                key=lambda row: int(cast(dict[str, Any], row)["pageId"]),
            )
        )
        page_ids_t = torch.tensor(
            [int(row["pageId"]) for row in page_rows],
            dtype=torch.long,
        )
        expected_ids_t = torch.sort(
            expected_page_ids_t.detach().cpu().long().reshape(-1)
        ).values
        updated_page_ids_t = (
            generation_binding.updated_page_ids_t.detach()
            .cpu()
            .long()
            .reshape(-1)
        )
        new_page_ids_t = page_ids_t[
            ~torch.isin(page_ids_t, expected_ids_t)
        ]
        training_page_ids_value = generation_manifest.get(
            "trainingProvenPageIds",
            [],
        )
        if (
            generation_manifest.get("pageCount") != len(page_rows)
            or torch.unique(page_ids_t).numel() != page_ids_t.numel()
            or expected_ids_t.numel() < 1
            or torch.unique(expected_ids_t).numel()
            != expected_ids_t.numel()
            or bool(torch.any(expected_ids_t < 0))
            or not bool(
                _page_ids_subset_t_boundary(
                    expected_ids_t,
                    page_ids_t,
                )
            )
            or (
                new_page_ids_t.numel() > 0
                and not bool(
                    _page_ids_subset_t_boundary(
                        new_page_ids_t,
                        updated_page_ids_t,
                    )
                )
            )
            or (
                complete_rewrite_required
                and not torch.equal(updated_page_ids_t, page_ids_t)
            )
            or not isinstance(training_page_ids_value, list)
            or any(
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                for page_id in training_page_ids_value
            )
            or training_page_ids_value
            != sorted(set(training_page_ids_value))
        ):
            raise RuntimeError(
                "NoNE final direct page map is incomplete"
            )
        training_page_ids_t = torch.tensor(
            training_page_ids_value,
            dtype=torch.long,
        )
        if not bool(
            _page_ids_subset_t_boundary(
                training_page_ids_t,
                page_ids_t,
            )
        ):
            raise RuntimeError(
                "NoNE final direct training authority exceeds its page map"
            )
        trained_page_ids = frozenset(training_page_ids_value)
        packed = self._local_direct_page_pack_set_authority_boundary(
            generation_manifest
        )
        if packed is not None:
            packed_index = packed[1]
            trained_mask_t = torch.isin(
                packed_index.page_ids_t,
                training_page_ids_t,
            )
            if not bool(
                torch.isin(
                    packed_index.format_revisions_t[trained_mask_t],
                    torch.tensor(
                        sorted(
                            ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
                        ),
                        dtype=torch.long,
                    ),
                ).all()
            ):
                raise RuntimeError(
                    "NoNE final trained packed page is not a direct knowledge "
                    "object"
                )
            return tuple(
                self._page_object_binding_from_row_boundary(row)
                for row in page_rows
            )
        page_objects: list[NoNEPageObjectBinding] = []
        for row in page_rows:
            binding = self._page_object_binding_from_row_boundary(row)
            revision = self._local_reconciled_direct_page_object_boundary(
                binding
            )
            if (
                int(binding.page_id_t) in trained_page_ids
                and revision
                not in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
            ):
                raise RuntimeError(
                    "NoNE final trained page is not a direct knowledge object"
                )
            page_objects.append(binding)
        return tuple(page_objects)

    def materialize_reconciled_direct_page_map_boundary(
        self,
        *,
        semantic_page_objects: tuple[NoNEPageObjectBinding, ...],
        source_store: NoNEImmutablePageStore | None = None,
        semantic_source_store: NoNEImmutablePageStore | None = None,
    ) -> tuple[NoNEPageObjectBinding, ...]:
        """Materialize and reseal every final page into one exact direct map.

        ``semantic_page_objects`` contains only the union rows that differ from
        the accepted parent. They replace those parent rows before every page,
        including historical direct rows, is cold-materialized into its actual
        tensor bundle and resealed beneath this destination store. The returned
        immutable map therefore contains no base-bound, quantized, delta, or
        cross-store dependency authority. Storage normalization never becomes
        a training-coverage claim.
        """

        self._require_staged_read_only_write_guard_boundary()
        source = self if source_store is None else source_store
        semantic_source = (
            source
            if semantic_source_store is None
            else semantic_source_store
        )
        source_session_id_t, _source_session_root = source._require_session()
        semantic_session_id_t, _semantic_session_root = (
            semantic_source._require_session()
        )
        destination_session_id_t, _destination_session_root = (
            self._require_session()
        )
        if not torch.equal(
            source_session_id_t.detach().cpu().long(),
            destination_session_id_t.detach().cpu().long(),
        ) or not torch.equal(
            semantic_session_id_t.detach().cpu().long(),
            destination_session_id_t.detach().cpu().long(),
        ):
            raise RuntimeError(
                "NoNE direct-map source crossed session ownership"
            )
        source.discover_accepted_pointer_boundary()
        if source._manifest is None:
            raise RuntimeError("NoNE direct-map parent manifest is absent")
        parent_rows = source._manifest_page_rows_boundary(source._manifest)
        physical_page_ids = tuple(sorted(parent_rows))
        if not physical_page_ids:
            raise RuntimeError("NoNE direct-map parent has no physical pages")
        semantic_by_page = {
            int(binding.page_id_t): binding
            for binding in semantic_page_objects
        }
        if (
            len(semantic_by_page) != len(semantic_page_objects)
            or not set(semantic_by_page).issubset(parent_rows)
        ):
            raise RuntimeError(
                "NoNE direct-map semantic replacements differ"
            )
        source_objects = tuple(
            semantic_by_page.get(
                page_id,
                source._page_object_binding_from_row_boundary(
                    parent_rows[page_id]
                ),
            )
            for page_id in physical_page_ids
        )
        source_binding = source.current_generation_binding_boundary()
        source_page_map_sha256 = _tensor_digest_hex(
            _page_object_map_digest_t_boundary(source_objects)
        )
        source_by_page = {
            int(binding.page_id_t): binding for binding in source_objects
        }
        source_store_by_page = {
            page_id: (
                semantic_source
                if page_id in semantic_by_page
                else source
            )
            for page_id in physical_page_ids
        }
        acquired_writer_here = self._generation_writer_handle is None
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        ledger_path = (
            _destination_session_root
            / "direct_page_map_reseals"
            / (
                f"generation_{int(source_binding.generation_t):08d}_"
                f"{source_page_map_sha256}.jsonl"
            )
        )

        def sealed_ledger_record(
            record: Mapping[str, Any],
        ) -> dict[str, Any]:
            sealed = dict(record)
            sealed["recordSha256"] = hashlib.sha256(
                _canonical_json_bytes(sealed)
            ).hexdigest()
            return sealed

        header_record = sealed_ledger_record(
            {
                "schema": RECONCILED_DIRECT_PAGE_MAP_LEDGER_SCHEMA,
                "recordKind": "header",
                "sessionKey": _session_key(destination_session_id_t),
                "sourceGeneration": int(source_binding.generation_t),
                "sourceManifestPayloadSha256": _tensor_digest_hex(
                    source_binding.manifest_payload_sha256_t
                ),
                "sourcePageMapSha256": source_page_map_sha256,
                "sourcePageCount": len(source_objects),
                "parentSourceStoreRoot": str(source.root),
                "semanticSourceStoreRoot": str(semantic_source.root),
                "destinationStoreRoot": str(self.root),
                "destinationObjectsRoot": str(objects_root),
                "storageNormalizationChangesTrainingCoverage": False,
                "storagePageObjectsSelfContainedDirect": True,
                "baseBoundPageObjectCount": 0,
                "externalPageObjectCount": 0,
                "previousRecordSha256": None,
            }
        )

        def read_resume_records() -> tuple[dict[str, Any], ...]:
            if not ledger_path.exists():
                ledger_path.parent.mkdir(parents=True, exist_ok=True)
                payload = orjson.dumps(
                    header_record,
                    option=orjson.OPT_APPEND_NEWLINE | orjson.OPT_SORT_KEYS,
                )
                try:
                    with ledger_path.open("xb") as handle:
                        handle.write(payload)
                        handle.flush()
                        os.fsync(handle.fileno())
                    _fsync_directory(ledger_path.parent)
                except FileExistsError:
                    pass
            if ledger_path.is_symlink() or not ledger_path.is_file():
                raise RuntimeError(
                    "NoNE reconciled direct-map ledger is incomplete"
                )
            raw = ledger_path.read_bytes()
            if raw and not raw.endswith(b"\n"):
                last_boundary = raw.rfind(b"\n")
                if last_boundary < 0:
                    raise RuntimeError(
                        "NoNE reconciled direct-map ledger header is torn"
                    )
                with ledger_path.open("r+b") as handle:
                    handle.truncate(last_boundary + 1)
                    handle.flush()
                    os.fsync(handle.fileno())
                raw = raw[: last_boundary + 1]
            records: list[dict[str, Any]] = []
            previous_sha256: str | None = None
            for raw_line in raw.splitlines():
                loaded = orjson.loads(raw_line)
                if not isinstance(loaded, dict):
                    raise RuntimeError(
                        "NoNE reconciled direct-map ledger row is malformed"
                    )
                record_sha256 = loaded.get("recordSha256")
                unhashed = {
                    key: value
                    for key, value in loaded.items()
                    if key != "recordSha256"
                }
                if (
                    loaded.get("schema")
                    != RECONCILED_DIRECT_PAGE_MAP_LEDGER_SCHEMA
                    or loaded.get("previousRecordSha256")
                    != previous_sha256
                    or not _valid_sha256_boundary(record_sha256)
                    or record_sha256
                    != hashlib.sha256(
                        _canonical_json_bytes(unhashed)
                    ).hexdigest()
                ):
                    raise RuntimeError(
                        "NoNE reconciled direct-map ledger chain differs"
                    )
                records.append(loaded)
                previous_sha256 = cast(str, record_sha256)
            if not records or records[0] != header_record:
                raise RuntimeError(
                    "NoNE reconciled direct-map ledger header differs"
                )
            return tuple(records)

        def binding_from_page_record(
            record: Mapping[str, Any],
        ) -> NoNEPageObjectBinding:
            page_id = record.get("pageId")
            direct_sha256 = record.get("directObjectSha256")
            direct_bytes = record.get("directObjectBytes")
            if (
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id not in source_by_page
                or not _valid_sha256_boundary(direct_sha256)
                or not isinstance(direct_bytes, int)
                or isinstance(direct_bytes, bool)
                or direct_bytes < 1
            ):
                raise RuntimeError(
                    "NoNE reconciled direct-map page record differs"
                )
            source_object = source_by_page[page_id]
            if (
                record.get("sourceObjectSha256")
                != _tensor_digest_hex(source_object.object_sha256_t)
                or record.get("sourceObjectBytes")
                != int(source_object.object_bytes_t)
                or record.get("sourceStoreRoot")
                != str(source_store_by_page[page_id].root)
                or record.get("sourcePageMapSha256")
                != source_page_map_sha256
                or record.get("destinationObjectsRoot")
                != str(objects_root)
                or record.get("materializedTensorEqualityProven") is not True
                or record.get("baseBoundPageObjectCount") != 0
            ):
                raise RuntimeError(
                    "NoNE reconciled direct-map source record differs"
                )
            binding = NoNEPageObjectBinding(
                page_id_t=torch.tensor(page_id, dtype=torch.long),
                object_sha256_t=digest_tensor(cast(str, direct_sha256)),
                object_bytes_t=torch.tensor(direct_bytes, dtype=torch.long),
            )
            if (
                self._local_reconciled_direct_page_object_boundary(binding)
                != record.get("directFormatRevision")
            ):
                raise RuntimeError(
                    "NoNE reconciled direct-map format record differs"
                )
            return binding

        def append_records(
            records: tuple[Mapping[str, Any], ...],
        ) -> None:
            if not records:
                return
            with ledger_path.open("ab") as handle:
                for record in records:
                    handle.write(
                        orjson.dumps(
                            record,
                            option=(
                                orjson.OPT_APPEND_NEWLINE
                                | orjson.OPT_SORT_KEYS
                            ),
                        )
                    )
                handle.flush()
                os.fsync(handle.fileno())

        def materialize_and_reseal(
            source_object: NoNEPageObjectBinding,
        ) -> NoNEPageObjectBinding:
            return self._materialize_and_reseal_direct_page_boundary(
                source_store=source_store_by_page[
                    int(source_object.page_id_t)
                ],
                source_object=source_object,
            )

        try:
            if acquired_writer_here:
                self._acquire_generation_writer_boundary()
            locked_objects_root, _locked_scratch_root = (
                self._validated_page_object_write_roots_boundary()
            )
            if locked_objects_root != objects_root:
                raise RuntimeError(
                    "NoNE reconciled direct-map placement changed before write"
                )
            resume_records = read_resume_records()
            direct_by_page: dict[int, NoNEPageObjectBinding] = {}
            complete_record: Mapping[str, Any] | None = None
            for record in resume_records[1:]:
                record_kind = record.get("recordKind")
                if record_kind == "page":
                    binding = binding_from_page_record(record)
                    page_id = int(binding.page_id_t)
                    if page_id in direct_by_page or complete_record is not None:
                        raise RuntimeError(
                            "NoNE reconciled direct-map ledger order differs"
                        )
                    direct_by_page[page_id] = binding
                elif record_kind == "complete":
                    if complete_record is not None:
                        raise RuntimeError(
                            "NoNE reconciled direct-map completion is duplicated"
                        )
                    complete_record = record
                else:
                    raise RuntimeError(
                        "NoNE reconciled direct-map ledger row kind differs"
                    )
            missing_source_objects = tuple(
                source_by_page[page_id]
                for page_id in physical_page_ids
                if page_id not in direct_by_page
            )
            if complete_record is not None and missing_source_objects:
                raise RuntimeError(
                    "NoNE reconciled direct-map completion is partial"
                )
            if missing_source_objects:
                # Exact resealing expands float8 payloads and reconstructs
                # compact rev6 deltas.  Refuse before writing when the selected
                # immutable object device cannot hold the complete remainder.
                # This estimate is deliberately conservative and never reduces
                # page count, tensor width, or precision.
                estimated_missing_bytes = sum(
                    max(
                        int(source_object.object_bytes_t) * 2 + (1 << 20),
                        32 << 20,
                    )
                    for source_object in missing_source_objects
                )
                free_bytes = shutil.disk_usage(objects_root).free
                dynamic_reserve_bytes = max(
                    4 << 30,
                    free_bytes // 50,
                )
                available_bytes = max(
                    0,
                    free_bytes - dynamic_reserve_bytes,
                )
                if estimated_missing_bytes > available_bytes:
                    raise RuntimeError(
                        "NoNE exact direct-map storage is insufficient: "
                        f"estimated={estimated_missing_bytes} "
                        f"available={available_bytes}"
                    )
            previous_record_sha256 = cast(
                str,
                (
                    complete_record["previousRecordSha256"]
                    if complete_record is not None
                    else resume_records[-1]["recordSha256"]
                ),
            )
            worker_count = min(
                _PAGE_MATERIALIZATION_IO_WORKERS,
                max(1, len(missing_source_objects)),
            )
            with ThreadPoolExecutor(
                max_workers=worker_count,
                thread_name_prefix="nnf-page-direct-map",
            ) as executor:
                for offset in range(
                    0,
                    len(missing_source_objects),
                    worker_count,
                ):
                    source_chunk = missing_source_objects[
                        offset : offset + worker_count
                    ]
                    direct_chunk = tuple(
                        executor.map(
                            materialize_and_reseal,
                            source_chunk,
                        )
                    )
                    self.sync_staged_page_objects_boundary()
                    page_records: list[dict[str, Any]] = []
                    for source_object, direct_object in zip(
                        source_chunk,
                        direct_chunk,
                        strict=True,
                    ):
                        page_id = int(source_object.page_id_t)
                        revision = (
                            self
                            ._local_reconciled_direct_page_object_boundary(
                                direct_object
                            )
                        )
                        page_record = sealed_ledger_record(
                            {
                                "schema": (
                                    RECONCILED_DIRECT_PAGE_MAP_LEDGER_SCHEMA
                                ),
                                "recordKind": "page",
                                "sourcePageMapSha256": (
                                    source_page_map_sha256
                                ),
                                "pageId": page_id,
                                "sourceObjectSha256": _tensor_digest_hex(
                                    source_object.object_sha256_t
                                ),
                                "sourceObjectBytes": int(
                                    source_object.object_bytes_t
                                ),
                                "sourceStoreRoot": str(
                                    source_store_by_page[page_id].root
                                ),
                                "directObjectSha256": _tensor_digest_hex(
                                    direct_object.object_sha256_t
                                ),
                                "directObjectBytes": int(
                                    direct_object.object_bytes_t
                                ),
                                "directFormatRevision": revision,
                                "destinationObjectsRoot": str(objects_root),
                                "materializedTensorEqualityProven": True,
                                "baseBoundPageObjectCount": 0,
                                "previousRecordSha256": (
                                    previous_record_sha256
                                ),
                            }
                        )
                        previous_record_sha256 = cast(
                            str,
                            page_record["recordSha256"],
                        )
                        page_records.append(page_record)
                        direct_by_page[page_id] = direct_object
                    append_records(tuple(page_records))
            direct_page_objects = tuple(
                direct_by_page[page_id]
                for page_id in physical_page_ids
            )
            direct_page_map_sha256 = _tensor_digest_hex(
                _page_object_map_digest_t_boundary(direct_page_objects)
            )
            expected_complete = sealed_ledger_record(
                {
                    "schema": RECONCILED_DIRECT_PAGE_MAP_LEDGER_SCHEMA,
                    "recordKind": "complete",
                    "sourcePageMapSha256": source_page_map_sha256,
                    "directPageMapSha256": direct_page_map_sha256,
                    "pageCount": len(direct_page_objects),
                    "directObjectBytes": sum(
                        int(binding.object_bytes_t)
                        for binding in direct_page_objects
                    ),
                    "destinationObjectsRoot": str(objects_root),
                    "storagePageObjectsSelfContainedDirect": True,
                    "baseBoundPageObjectCount": 0,
                    "externalPageObjectCount": 0,
                    "previousRecordSha256": previous_record_sha256,
                }
            )
            if complete_record is None:
                append_records((expected_complete,))
            elif dict(complete_record) != expected_complete:
                raise RuntimeError(
                    "NoNE reconciled direct-map completion differs"
                )
            return direct_page_objects
        finally:
            if acquired_writer_here:
                self._release_generation_writer_boundary()

    def materialize_historical_page_delta_union_boundary(
        self,
        *,
        target_store: NoNEImmutablePageStore,
        segments: tuple[NoNEHistoricalPageDeltaSegmentPacket, ...],
    ) -> NoNEHistoricalPageTensorSurgeryPacket:
        """Apply immutable historical deltas and seal direct semantic pages.

        This is an offline storage/checkpoint transaction. It never stages a
        generation or moves an accepted pointer. Each changed page starts from
        the current accepted target tensor bundle, accumulates every ordered
        ``branch - source`` delta in FP32, casts once to the target's exact
        storage dtype, and is resealed as a dependency-free direct object.
        Progress is hash chained so an interrupted multi-terabyte surgery
        resumes from its last durable page instead of replaying completed work.
        """

        self._require_staged_read_only_write_guard_boundary()
        if not segments:
            raise ValueError("NoNE historical tensor surgery has no segments")
        destination_session_id_t, destination_session_root = (
            self._require_session()
        )
        target_session_id_t, _target_session_root = (
            target_store._require_session()
        )
        if (
            self.root == target_store.root
            or not torch.equal(
                destination_session_id_t.detach().cpu().long(),
                target_session_id_t.detach().cpu().long(),
            )
            or (destination_session_root / "accepted.json").exists()
        ):
            raise RuntimeError(
                "NoNE historical tensor surgery destination is not isolated"
            )
        target_store.discover_accepted_pointer_boundary()
        if target_store._manifest is None:
            raise RuntimeError(
                "NoNE historical tensor surgery target manifest is absent"
            )
        target_generation = (
            target_store.current_generation_binding_boundary()
        )
        target_rows = target_store._manifest_page_rows_boundary(
            target_store._manifest
        )
        target_page_ids = tuple(sorted(target_rows))
        if not target_page_ids:
            raise RuntimeError(
                "NoNE historical tensor surgery target has no pages"
            )

        segment_rows: list[
            tuple[
                NoNEHistoricalPageDeltaSegmentPacket,
                torch.Tensor,
                dict[int, dict[str, Any]],
                dict[int, dict[str, Any]],
                tuple[int, ...],
            ]
        ] = []
        segment_records: list[dict[str, Any]] = []
        page_inputs: dict[
            int,
            list[
                tuple[
                    NoNEHistoricalPageDeltaSegmentPacket,
                    torch.Tensor,
                    NoNEPageObjectBinding,
                    NoNEPageObjectBinding,
                ]
            ],
        ] = {}
        for ordinal, segment in enumerate(segments):
            segment_digest_t = (
                _historical_page_delta_segment_digest_t_boundary(segment)
            )
            source_store = segment.source_store
            segment_session_id_t, _segment_session_root = (
                source_store._require_session()
            )
            if not torch.equal(
                segment_session_id_t.detach().cpu().long(),
                target_session_id_t.detach().cpu().long(),
            ):
                raise RuntimeError(
                    "NoNE historical page segment crossed session ownership"
                )
            verified_source = source_store.verify_generation_boundary(
                generation_t=segment.source_generation.generation_t,
                manifest_sha256_t=(
                    segment.source_generation.manifest_sha256_t
                ),
                manifest_payload_sha256_t=(
                    segment.source_generation.manifest_payload_sha256_t
                ),
            )
            verified_terminal = source_store.verify_generation_boundary(
                generation_t=segment.terminal_generation.generation_t,
                manifest_sha256_t=(
                    segment.terminal_generation.manifest_sha256_t
                ),
                manifest_payload_sha256_t=(
                    segment.terminal_generation.manifest_payload_sha256_t
                ),
            )
            if (
                not _same_generation_binding_boundary(
                    verified_source,
                    segment.source_generation,
                )
                or not _same_generation_binding_boundary(
                    verified_terminal,
                    segment.terminal_generation,
                )
            ):
                raise RuntimeError(
                    "NoNE historical page segment binding differs"
                )
            _source_binding, source_manifest = (
                source_store._load_generation_binding_boundary(
                    verified_source.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        verified_source.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        verified_source.manifest_payload_sha256_t
                    ),
                )
            )
            _terminal_binding, terminal_manifest = (
                source_store._load_generation_binding_boundary(
                    verified_terminal.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        verified_terminal.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        verified_terminal.manifest_payload_sha256_t
                    ),
                )
            )
            source_rows = source_store._manifest_page_rows_boundary(
                source_manifest
            )
            terminal_rows = source_store._manifest_page_rows_boundary(
                terminal_manifest
            )
            if (
                tuple(sorted(source_rows)) != target_page_ids
                or tuple(sorted(terminal_rows)) != target_page_ids
            ):
                raise RuntimeError(
                    "NoNE historical page segment physical map differs"
                )
            changed_page_ids = tuple(
                page_id
                for page_id in target_page_ids
                if source_rows[page_id] != terminal_rows[page_id]
            )
            if not changed_page_ids:
                raise RuntimeError(
                    "NoNE historical page segment has no tensor delta"
                )
            changed_page_ids_t = torch.tensor(
                changed_page_ids,
                dtype=torch.long,
            )
            changed_page_ids_sha256 = hashlib.sha256(
                _stable_cpu_tensor(changed_page_ids_t)
                .numpy()
                .tobytes(order="C")
            ).hexdigest()
            segment_rows.append(
                (
                    segment,
                    segment_digest_t,
                    source_rows,
                    terminal_rows,
                    changed_page_ids,
                )
            )
            segment_records.append(
                {
                    "ordinal": ordinal,
                    "segmentSha256": _tensor_digest_hex(segment_digest_t),
                    "sourceStoreRoot": str(source_store.root),
                    "sourceGeneration": int(verified_source.generation_t),
                    "sourceManifestSha256": _tensor_digest_hex(
                        verified_source.manifest_sha256_t
                    ),
                    "sourceManifestPayloadSha256": _tensor_digest_hex(
                        verified_source.manifest_payload_sha256_t
                    ),
                    "terminalGeneration": int(
                        verified_terminal.generation_t
                    ),
                    "terminalManifestSha256": _tensor_digest_hex(
                        verified_terminal.manifest_sha256_t
                    ),
                    "terminalManifestPayloadSha256": _tensor_digest_hex(
                        verified_terminal.manifest_payload_sha256_t
                    ),
                    "provenanceSha256": _tensor_digest_hex(
                        segment.provenance_sha256_t
                    ),
                    "changedPageCount": len(changed_page_ids),
                    "changedPageIdsSha256": changed_page_ids_sha256,
                    "changedPageIdsAbove101000": sum(
                        page_id > 101000 for page_id in changed_page_ids
                    ),
                }
            )
            for page_id in changed_page_ids:
                page_inputs.setdefault(page_id, []).append(
                    (
                        segment,
                        segment_digest_t,
                        source_store._page_object_binding_from_row_boundary(
                            source_rows[page_id]
                        ),
                        source_store._page_object_binding_from_row_boundary(
                            terminal_rows[page_id]
                        ),
                    )
                )

        semantic_page_ids = tuple(sorted(page_inputs))
        semantic_page_ids_t = torch.tensor(
            semantic_page_ids,
            dtype=torch.long,
        )
        semantic_page_ids_sha256 = hashlib.sha256(
            _stable_cpu_tensor(semantic_page_ids_t)
            .numpy()
            .tobytes(order="C")
        ).hexdigest()
        plan_record = {
            "schema": HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA,
            "targetStoreRoot": str(target_store.root),
            "targetGeneration": int(target_generation.generation_t),
            "targetManifestSha256": _tensor_digest_hex(
                target_generation.manifest_sha256_t
            ),
            "targetManifestPayloadSha256": _tensor_digest_hex(
                target_generation.manifest_payload_sha256_t
            ),
            "destinationStoreRoot": str(self.root),
            "segmentCount": len(segment_records),
            "segments": segment_records,
            "semanticPageCount": len(semantic_page_ids),
            "semanticPageIdsSha256": semantic_page_ids_sha256,
            "semanticPageIdsAbove101000": sum(
                page_id > 101000 for page_id in semantic_page_ids
            ),
            "mergeAlgebra": "target_plus_ordered_branch_minus_source_fp32",
            "finalCast": "single_cast_to_target_storage_dtype",
            "explicitOptimizerMomentConflictPolicy": (
                "page_local_zero_moment_reinitialization_with_monotonic_step"
            ),
            "acceptedPointerMutationAllowed": False,
            "outputObjectsSelfContainedDirect": True,
            "baseBoundDeltaObjectsAccepted": False,
            "crossStoreOverlayAuthorityAccepted": False,
        }
        surgery_plan_sha256 = hashlib.sha256(
            _canonical_json_bytes(plan_record)
        ).hexdigest()
        ledger_path = (
            destination_session_root
            / "historical_page_tensor_surgeries"
            / f"{surgery_plan_sha256}.jsonl"
        )

        def sealed_record(
            record: Mapping[str, Any],
        ) -> dict[str, Any]:
            sealed = dict(record)
            sealed["recordSha256"] = hashlib.sha256(
                _canonical_json_bytes(sealed)
            ).hexdigest()
            return sealed

        header_record = sealed_record(
            {
                **plan_record,
                "recordKind": "header",
                "surgeryPlanSha256": surgery_plan_sha256,
                "previousRecordSha256": None,
            }
        )

        def page_input_record(page_id: int) -> dict[str, Any]:
            target_object = (
                target_store._page_object_binding_from_row_boundary(
                    target_rows[page_id]
                )
            )
            inputs = page_inputs[page_id]
            return {
                "pageId": page_id,
                "targetObjectSha256": _tensor_digest_hex(
                    target_object.object_sha256_t
                ),
                "targetObjectBytes": int(target_object.object_bytes_t),
                "segmentSha256s": [
                    _tensor_digest_hex(segment_digest_t)
                    for _segment, segment_digest_t, _source, _terminal in inputs
                ],
                "sourceObjectSha256s": [
                    _tensor_digest_hex(source.object_sha256_t)
                    for _segment, _digest, source, _terminal in inputs
                ],
                "terminalObjectSha256s": [
                    _tensor_digest_hex(terminal.object_sha256_t)
                    for _segment, _digest, _source, terminal in inputs
                ],
            }

        page_input_sha256s = {
            page_id: hashlib.sha256(
                _canonical_json_bytes(page_input_record(page_id))
            ).hexdigest()
            for page_id in semantic_page_ids
        }

        def read_resume_records() -> tuple[dict[str, Any], ...]:
            if not ledger_path.exists():
                ledger_path.parent.mkdir(parents=True, exist_ok=True)
                payload = orjson.dumps(
                    header_record,
                    option=orjson.OPT_APPEND_NEWLINE | orjson.OPT_SORT_KEYS,
                )
                try:
                    with ledger_path.open("xb") as handle:
                        handle.write(payload)
                        handle.flush()
                        os.fsync(handle.fileno())
                    _fsync_directory(ledger_path.parent)
                except FileExistsError:
                    pass
            if ledger_path.is_symlink() or not ledger_path.is_file():
                raise RuntimeError(
                    "NoNE historical tensor surgery ledger is incomplete"
                )
            raw = ledger_path.read_bytes()
            if raw and not raw.endswith(b"\n"):
                boundary = raw.rfind(b"\n")
                if boundary < 0:
                    raise RuntimeError(
                        "NoNE historical tensor surgery ledger is torn"
                    )
                with ledger_path.open("r+b") as handle:
                    handle.truncate(boundary + 1)
                    handle.flush()
                    os.fsync(handle.fileno())
                raw = raw[: boundary + 1]
            records: list[dict[str, Any]] = []
            previous_sha256: str | None = None
            for raw_line in raw.splitlines():
                loaded = orjson.loads(raw_line)
                if not isinstance(loaded, dict):
                    raise RuntimeError(
                        "NoNE historical tensor surgery row is malformed"
                    )
                record_sha256 = loaded.get("recordSha256")
                unhashed = {
                    key: value
                    for key, value in loaded.items()
                    if key != "recordSha256"
                }
                if (
                    loaded.get("schema")
                    != HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA
                    or loaded.get("previousRecordSha256")
                    != previous_sha256
                    or not _valid_sha256_boundary(record_sha256)
                    or record_sha256
                    != hashlib.sha256(
                        _canonical_json_bytes(unhashed)
                    ).hexdigest()
                ):
                    raise RuntimeError(
                        "NoNE historical tensor surgery ledger chain differs"
                    )
                records.append(loaded)
                previous_sha256 = cast(str, record_sha256)
            if not records or records[0] != header_record:
                raise RuntimeError(
                    "NoNE historical tensor surgery header differs"
                )
            return tuple(records)

        def append_records(
            records: tuple[Mapping[str, Any], ...],
        ) -> None:
            if not records:
                return
            with ledger_path.open("ab") as handle:
                for record in records:
                    handle.write(
                        orjson.dumps(
                            record,
                            option=(
                                orjson.OPT_APPEND_NEWLINE
                                | orjson.OPT_SORT_KEYS
                            ),
                        )
                    )
                handle.flush()
                os.fsync(handle.fileno())

        def page_binding_from_record(
            record: Mapping[str, Any],
        ) -> NoNEPageObjectBinding:
            page_id = record.get("pageId")
            object_sha256 = record.get("directObjectSha256")
            object_bytes = record.get("directObjectBytes")
            if (
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id not in page_inputs
                or record.get("pageInputSha256")
                != page_input_sha256s[page_id]
                or not _valid_sha256_boundary(object_sha256)
                or not isinstance(object_bytes, int)
                or isinstance(object_bytes, bool)
                or object_bytes < 1
                or record.get("materializedTensorEqualityProven") is not True
                or record.get("directObjectSelfContained") is not True
                or record.get("baseBoundDeltaAccepted") is not False
            ):
                raise RuntimeError(
                    "NoNE historical tensor surgery page record differs"
                )
            binding = NoNEPageObjectBinding(
                page_id_t=torch.tensor(page_id, dtype=torch.long),
                object_sha256_t=digest_tensor(cast(str, object_sha256)),
                object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
            )
            if (
                self._local_reconciled_direct_page_object_boundary(binding)
                not in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
            ):
                raise RuntimeError(
                    "NoNE historical tensor surgery output is not direct"
                )
            return binding

        unique_input_stores = tuple(
            {
                target_store,
                *(segment.source_store for segment in segments),
            }
        )

        def materialize_page(
            page_id: int,
        ) -> tuple[NoNEPageObjectBinding, bool]:
            target_object = (
                target_store._page_object_binding_from_row_boundary(
                    target_rows[page_id]
                )
            )
            target_dtype = (
                target_store._page_object_materialized_storage_dtype_boundary(
                    target_store,
                    target_object,
                )
            )
            merged = target_store._materialize_page_binding_boundary(
                target_store,
                target_object,
                dtype=torch.float32,
            )
            optimizer_reinitialized = False
            for (
                segment,
                _segment_digest_t,
                source_object,
                terminal_object,
            ) in page_inputs[page_id]:
                source_bundle = (
                    segment.source_store._materialize_page_binding_boundary(
                        segment.source_store,
                        source_object,
                        dtype=torch.float32,
                    )
                )
                terminal_bundle = (
                    segment.source_store._materialize_page_binding_boundary(
                        segment.source_store,
                        terminal_object,
                        dtype=torch.float32,
                    )
                )
                if not bool(
                    terminal_bundle.step_t.gt(source_bundle.step_t).all()
                ):
                    raise RuntimeError(
                        "NoNE historical page delta has no positive optimizer "
                        "advance"
                    )
                reconciled = (
                    _three_way_reconcile_historical_page_bundle_boundary(
                        source_parent=source_bundle,
                        target_parent=merged,
                        branch_terminal=terminal_bundle,
                    )
                )
                merged = reconciled.bundle
                optimizer_reinitialized = bool(
                    optimizer_reinitialized
                    or bool(
                        reconciled.optimizer_moments_reinitialized_t
                    )
                )
            final_bundle = replace(
                merged,
                weights=merged.weights.to(
                    device=torch.device("cpu"),
                    dtype=target_dtype,
                    trainable=False,
                ),
            )
            validate_page_bundle(final_bundle)
            direct = self.stage_self_contained_direct_page_object_boundary(
                final_bundle,
                sync_directory=False,
            )
            if (
                self._local_reconciled_direct_page_object_boundary(direct)
                not in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
            ):
                raise RuntimeError(
                    "NoNE historical page surgery produced nondirect state"
                )
            return direct, optimizer_reinitialized

        acquired_writer_here = self._generation_writer_handle is None
        try:
            if acquired_writer_here:
                self._acquire_generation_writer_boundary()
            records = read_resume_records()
            direct_by_page: dict[int, NoNEPageObjectBinding] = {}
            reset_page_ids: set[int] = set()
            complete_record: Mapping[str, Any] | None = None
            for record in records[1:]:
                record_kind = record.get("recordKind")
                if record_kind == "page":
                    binding = page_binding_from_record(record)
                    page_id = int(binding.page_id_t)
                    if page_id in direct_by_page or complete_record is not None:
                        raise RuntimeError(
                            "NoNE historical tensor surgery order differs"
                        )
                    direct_by_page[page_id] = binding
                    if record.get("optimizerMomentsReinitialized") is True:
                        reset_page_ids.add(page_id)
                    elif record.get("optimizerMomentsReinitialized") is not False:
                        raise RuntimeError(
                            "NoNE historical optimizer disposition differs"
                        )
                elif record_kind == "complete":
                    if complete_record is not None:
                        raise RuntimeError(
                            "NoNE historical surgery completion is duplicated"
                        )
                    complete_record = record
                else:
                    raise RuntimeError(
                        "NoNE historical tensor surgery row kind differs"
                    )
            missing_page_ids = tuple(
                page_id
                for page_id in semantic_page_ids
                if page_id not in direct_by_page
            )
            if complete_record is not None and missing_page_ids:
                raise RuntimeError(
                    "NoNE historical tensor surgery completion is partial"
                )
            if missing_page_ids:
                estimated_bytes = sum(
                    max(
                        int(target_rows[page_id]["bytes"]) * 2 + (1 << 20),
                        32 << 20,
                    )
                    for page_id in missing_page_ids
                )
                objects_root, _scratch_root = (
                    self._validated_page_object_write_roots_boundary()
                )
                free_bytes = shutil.disk_usage(objects_root).free
                reserve_bytes = max(4 << 30, free_bytes // 50)
                if estimated_bytes > max(0, free_bytes - reserve_bytes):
                    raise RuntimeError(
                        "NoNE historical tensor surgery storage is "
                        "insufficient"
                    )
            previous_record_sha256 = cast(
                str,
                (
                    complete_record["previousRecordSha256"]
                    if complete_record is not None
                    else records[-1]["recordSha256"]
                ),
            )
            worker_count = min(
                _PAGE_MATERIALIZATION_IO_WORKERS,
                max(1, len(missing_page_ids)),
            )
            with ThreadPoolExecutor(
                max_workers=worker_count,
                thread_name_prefix="nnf-page-tensor-surgery",
            ) as executor:
                for offset in range(0, len(missing_page_ids), worker_count):
                    page_chunk = missing_page_ids[
                        offset : offset + worker_count
                    ]
                    output_chunk = tuple(
                        executor.map(materialize_page, page_chunk)
                    )
                    self.sync_staged_page_objects_boundary()
                    page_records: list[dict[str, Any]] = []
                    for page_id, (
                        direct_object,
                        optimizer_reinitialized,
                    ) in zip(page_chunk, output_chunk, strict=True):
                        page_record = sealed_record(
                            {
                                "schema": (
                                    HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA
                                ),
                                "recordKind": "page",
                                "surgeryPlanSha256": surgery_plan_sha256,
                                "pageId": page_id,
                                "pageInputSha256": (
                                    page_input_sha256s[page_id]
                                ),
                                "appliedSegmentCount": len(
                                    page_inputs[page_id]
                                ),
                                "directObjectSha256": _tensor_digest_hex(
                                    direct_object.object_sha256_t
                                ),
                                "directObjectBytes": int(
                                    direct_object.object_bytes_t
                                ),
                                "directObjectSelfContained": True,
                                "baseBoundDeltaAccepted": False,
                                "crossStoreOverlayAccepted": False,
                                "materializedTensorEqualityProven": True,
                                "optimizerMomentsReinitialized": (
                                    optimizer_reinitialized
                                ),
                                "previousRecordSha256": (
                                    previous_record_sha256
                                ),
                            }
                        )
                        previous_record_sha256 = cast(
                            str,
                            page_record["recordSha256"],
                        )
                        page_records.append(page_record)
                        direct_by_page[page_id] = direct_object
                        if optimizer_reinitialized:
                            reset_page_ids.add(page_id)
                    append_records(tuple(page_records))
                    for store in unique_input_stores:
                        store._clear_materialized_cpu_page_cache_boundary()
                    self._clear_materialized_cpu_page_cache_boundary()
            semantic_objects = tuple(
                direct_by_page[page_id] for page_id in semantic_page_ids
            )
            direct_map_sha256 = _tensor_digest_hex(
                _page_object_map_digest_t_boundary(semantic_objects)
            )
            reset_page_ids_t = torch.tensor(
                sorted(reset_page_ids),
                dtype=torch.long,
            )
            reset_page_ids_sha256 = hashlib.sha256(
                _stable_cpu_tensor(reset_page_ids_t)
                .numpy()
                .tobytes(order="C")
            ).hexdigest()
            expected_complete = sealed_record(
                {
                    "schema": (
                        HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA
                    ),
                    "recordKind": "complete",
                    "surgeryPlanSha256": surgery_plan_sha256,
                    "semanticPageCount": len(semantic_objects),
                    "semanticDirectPageMapSha256": direct_map_sha256,
                    "optimizerMomentsReinitializedPageCount": len(
                        reset_page_ids
                    ),
                    "optimizerMomentsReinitializedPageIdsSha256": (
                        reset_page_ids_sha256
                    ),
                    "outputObjectsSelfContainedDirect": True,
                    "baseBoundDeltaObjectCount": 0,
                    "crossStoreOverlayObjectCount": 0,
                    "acceptedPointerMutated": False,
                    "previousRecordSha256": previous_record_sha256,
                }
            )
            if complete_record is None:
                append_records((expected_complete,))
            elif dict(complete_record) != expected_complete:
                raise RuntimeError(
                    "NoNE historical tensor surgery completion differs"
                )
            return NoNEHistoricalPageTensorSurgeryPacket(
                target_generation=target_generation,
                semantic_page_ids_t=semantic_page_ids_t,
                semantic_page_objects=semantic_objects,
                optimizer_moments_reinitialized_page_ids_t=(
                    reset_page_ids_t
                ),
                surgery_sha256_t=digest_tensor(
                    cast(str, expected_complete["recordSha256"])
                ),
                ledger_path=str(ledger_path),
            )
        finally:
            if acquired_writer_here:
                self._release_generation_writer_boundary()

    def _candidate_scratch_owner_root_boundary(self) -> Path:
        """Return this store instance's unadvertised scratch ownership root."""

        session_id_t, session_root = self._require_session()
        _objects_root, placement_scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        if self._object_write_placement is None:
            owner_root = (
                session_root
                / "candidate_page_scratch"
                / self._candidate_scratch_owner
            )
        else:
            store_key = hashlib.sha256(
                str(self.root).encode("utf-8")
            ).hexdigest()
            owner_root = (
                placement_scratch_root
                / store_key
                / _session_key(session_id_t)
                / self._candidate_scratch_owner
            )
        owner_root.mkdir(parents=True, exist_ok=True)
        return owner_root

    def begin_candidate_page_scratch_window_boundary(self) -> Path:
        """Allocate one isolated proposal window beneath this store owner."""

        self._require_staged_read_only_write_guard_boundary()
        owner_root = self._candidate_scratch_owner_root_boundary()
        window_id = hashlib.sha256(os.urandom(32)).hexdigest()
        scratch_root = owner_root / window_id
        scratch_root.mkdir(parents=False, exist_ok=False)
        return scratch_root

    def _validated_candidate_scratch_window_boundary(
        self,
        scratch_root: Path,
    ) -> Path:
        owner_root = self._candidate_scratch_owner_root_boundary()
        resolved = scratch_root.expanduser().resolve()
        if (
            resolved.parent != owner_root
            or len(resolved.name) != 64
            or any(character not in "0123456789abcdef" for character in resolved.name)
            or not resolved.is_dir()
        ):
            raise RuntimeError("NoNE candidate scratch window identity differs")
        return resolved

    def finish_candidate_page_scratch_window_boundary(
        self,
        scratch_root: Path,
    ) -> None:
        """Remove an empty proposal window after accept or reject."""

        self._require_staged_read_only_write_guard_boundary()
        resolved = self._validated_candidate_scratch_window_boundary(
            scratch_root
        )
        if any(resolved.iterdir()):
            raise RuntimeError("NoNE candidate scratch window is not empty")
        resolved.rmdir()

    def sync_candidate_page_scratch_window_boundary(
        self,
        scratch_root: Path,
    ) -> None:
        """Commit all source-directory removals after a retained batch seal."""

        self._require_staged_read_only_write_guard_boundary()
        _fsync_directory(
            self._validated_candidate_scratch_window_boundary(scratch_root)
        )

    def _candidate_scratch_identity_boundary(
        self,
        binding: NoNECandidatePageScratchBinding,
    ) -> tuple[int, Path, int]:
        """Fence an ephemeral path to this process, window, and page identity."""

        page_id_t = binding.page_id_t.detach().cpu().long().reshape(-1)
        object_bytes_t = binding.object_bytes_t.detach().cpu().long().reshape(-1)
        if page_id_t.numel() != 1 or object_bytes_t.numel() != 1:
            raise RuntimeError("NoNE candidate scratch identity is malformed")
        page_id = int(page_id_t[0])
        object_bytes = int(object_bytes_t[0])
        scratch_path = binding.scratch_path.expanduser().resolve()
        scratch_root = scratch_path.parent
        self._validated_candidate_scratch_window_boundary(scratch_root)
        if (
            page_id < 0
            or object_bytes < 1
            or scratch_path.name != f"page_{page_id}.safetensors"
        ):
            raise RuntimeError("NoNE candidate scratch path differs")
        return page_id, scratch_path, object_bytes

    def _validated_candidate_scratch_path_boundary(
        self,
        binding: NoNECandidatePageScratchBinding,
    ) -> tuple[int, Path, int]:
        page_id, scratch_path, object_bytes = (
            self._candidate_scratch_identity_boundary(binding)
        )
        if (
            not scratch_path.is_file()
            or scratch_path.stat().st_size != object_bytes
            or _file_sha256(scratch_path)
            != _tensor_digest_hex(binding.object_sha256_t)
        ):
            raise RuntimeError("NoNE candidate scratch file differs")
        with safe_open(  # type: ignore[no-untyped-call]
            str(scratch_path),
            framework="pt",
            device="cpu",
        ) as handle:
            payload_page_ids_t = handle.get_tensor(
                "page_ids_t"
            ).reshape(-1).long()
            self._validated_page_delta_dependency_from_handle_boundary(
                handle,
                expected_page_id=page_id,
            )
        if payload_page_ids_t.numel() != 1 or int(payload_page_ids_t[0]) != page_id:
            raise RuntimeError("NoNE candidate scratch payload identity differs")
        return page_id, scratch_path, object_bytes

    @staticmethod
    def _prepared_candidate_payload_bytes_boundary(
        packet: NoNEPreparedCandidatePagePacket,
    ) -> bytes:
        """Return one tight CPU uint8 payload at the serialization boundary."""

        payload_t = (
            packet.object_payload_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(-1)
        )
        object_bytes_t = (
            packet.object_bytes_t.detach().cpu().long().reshape(-1)
        )
        if (
            object_bytes_t.shape != (1,)
            or int(object_bytes_t[0]) < 1
            or payload_t.shape != (int(object_bytes_t[0]),)
            or not payload_t.is_contiguous()
            or payload_t.untyped_storage().nbytes() != payload_t.numel()
        ):
            raise RuntimeError(
                "NoNE prepared candidate payload geometry differs"
            )
        return payload_t.numpy().tobytes()

    def _validated_prepared_candidate_page_boundary(
        self,
        packet: NoNEPreparedCandidatePagePacket,
    ) -> tuple[bytes, _NoNEPageDeltaDependency | None]:
        """Validate serialized bytes and their complete tensor-native witness."""

        payload = self._prepared_candidate_payload_bytes_boundary(packet)
        page_id_t = packet.page_id_t.detach().cpu().long().reshape(-1)
        format_revision_t = (
            packet.format_revision_t.detach().cpu().long().reshape(-1)
        )
        dependency_present_t = (
            packet.dependency_present_t.detach().cpu().bool().reshape(-1)
        )
        if (
            page_id_t.shape != (1,)
            or int(page_id_t[0]) < 0
            or format_revision_t.shape != (1,)
            or dependency_present_t.shape != (1,)
            or hashlib.sha256(payload).hexdigest()
            != _tensor_digest_hex(packet.object_sha256_t)
        ):
            raise RuntimeError("NoNE prepared candidate identity differs")
        handle = _NoNEInMemorySafeTensorHandleBoundary(load(payload))
        payload_page_ids_t = handle.get_tensor("page_ids_t").reshape(-1).long()
        revision = self._page_format_revision_boundary(handle)
        dependency = (
            self._validated_page_delta_dependency_from_handle_boundary(
                handle,
                expected_page_id=int(page_id_t[0]),
            )
        )
        dependency_present = bool(dependency_present_t[0])
        if (
            payload_page_ids_t.shape != (1,)
            or not torch.equal(payload_page_ids_t, page_id_t)
            or revision != int(format_revision_t[0])
            or dependency_present != (dependency is not None)
        ):
            raise RuntimeError(
                "NoNE prepared candidate serialized authority differs"
            )
        if dependency is None:
            if (
                int(packet.base_generation_t.detach().cpu().long().reshape(()))
                != -1
                or packet.base_manifest_payload_sha256_t.numel() != 0
                or packet.base_object_sha256_t.numel() != 0
                or int(
                    packet.base_object_bytes_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                )
                != 0
            ):
                raise RuntimeError(
                    "NoNE exact prepared candidate has a dependency witness"
                )
        elif (
            revision != BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
            or not torch.equal(
                packet.base_generation_t.detach().cpu().long().reshape(()),
                dependency.generation_t.detach().cpu().long().reshape(()),
            )
            or not torch.equal(
                packet.base_manifest_payload_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1),
                dependency.manifest_payload_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1),
            )
            or not torch.equal(
                packet.base_object_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1),
                dependency.object.object_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .reshape(-1),
            )
            or not torch.equal(
                packet.base_object_bytes_t.detach().cpu().long().reshape(()),
                dependency.object.object_bytes_t.detach()
                .cpu()
                .long()
                .reshape(()),
            )
        ):
            raise RuntimeError(
                "NoNE prepared candidate dependency witness differs"
            )
        return payload, dependency

    def prepare_candidate_page_boundary(
        self,
        bundle: NoNEPageBundle,
        *,
        base_generation_t: torch.Tensor,
    ) -> NoNEPreparedCandidatePagePacket:
        """Prepare one exact candidate entirely in memory without durability."""

        validate_page_bundle(bundle)
        if bundle.weights.page_ids_t.numel() != 1:
            raise ValueError(
                "candidate page preparation requires exactly one row"
            )
        page_id_t = (
            bundle.weights.page_ids_t.detach().cpu().long().reshape(())
        )
        page_id = int(page_id_t)
        semantic_base_generation: NoNEGenerationBinding | None = None
        semantic_base_object: NoNEPageObjectBinding | None = None
        mean_probe_t = (
            bundle.optimizer_mean_t[:, :1]
            if bundle.optimizer_mean_t.stride(1) == 0
            else bundle.optimizer_mean_t
        )
        square_probe_t = (
            bundle.optimizer_square_t[:, :1]
            if bundle.optimizer_square_t.stride(1) == 0
            else bundle.optimizer_square_t
        )
        stateless_trained = bool(
            torch.count_nonzero(mean_probe_t).eq(0)
            & torch.count_nonzero(square_probe_t).eq(0)
            & bundle.step_t.detach().cpu().long().gt(0).all()
        )
        direct_authority_active = (
            self._accepted_direct_page_map_authority_active_boundary()
        )
        if direct_authority_active:
            payload = self._self_contained_direct_page_payload_boundary(
                bundle,
                0,
            )
        elif stateless_trained:
            base_generation = self.current_generation_binding_boundary()
            if not torch.equal(
                base_generation.generation_t.detach().cpu().long().reshape(
                    ()
                ),
                base_generation_t.detach().cpu().long().reshape(()),
            ):
                raise RuntimeError("candidate delta base generation changed")
            base_row = self._page_index().get(page_id)
            if (
                not isinstance(base_row, dict)
                or not isinstance(base_row.get("sha256"), str)
                or len(str(base_row["sha256"])) != 64
                or not isinstance(base_row.get("bytes"), int)
                or isinstance(base_row.get("bytes"), bool)
                or int(base_row["bytes"]) < 1
            ):
                raise RuntimeError(
                    "candidate delta base page object is absent"
                )
            base_object = NoNEPageObjectBinding(
                page_id_t=page_id_t.clone(),
                object_sha256_t=digest_tensor(str(base_row["sha256"])),
                object_bytes_t=torch.tensor(
                    int(base_row["bytes"]),
                    dtype=torch.long,
                ),
            )
            if base_row.get("semanticPack") is not None:
                _validate_semantic_page_pack_manifest_row_boundary(base_row)
                verified_base_row = dict(base_row)
            else:
                verified_base_row = self._page_object_row_boundary(
                    base_object
                )
            base_sha256 = str(verified_base_row["sha256"])
            if verified_base_row.get("semanticPack") is not None:
                base = self.materialize_page_bundle_ids_boundary(
                    session_id_t=base_generation.session_id_t,
                    generation_t=base_generation.generation_t,
                    page_ids_t=page_id_t.reshape(1),
                    device=torch.device("cpu"),
                    dtype=bundle.weights.gate_t.dtype,
                    trainable=False,
                )
            else:
                base_path = self._object_path_boundary(
                    base_sha256,
                    expected_bytes=int(verified_base_row["bytes"]),
                )
                base = (
                    self._materialize_verified_immutable_cpu_page_boundary(
                        object_path=base_path,
                        object_sha256=base_sha256,
                        dtype=bundle.weights.gate_t.dtype,
                        delta_chain=(),
                    )
                )
            payload = self._base_bound_exact_delta_payload_boundary(
                bundle,
                base=base,
                base_object=base_object,
                base_generation=base_generation,
            )
            semantic_base_generation = base_generation
            semantic_base_object = base_object
        else:
            payload = self._page_object_payload_boundary(bundle, 0)
        serialized = save(payload)
        serialized_t = torch.frombuffer(
            bytearray(serialized),
            dtype=torch.uint8,
        ).clone()
        revision_t = payload["format_revision_t"].detach().cpu().long().reshape(
            ()
        )
        if (
            semantic_base_generation is None
            or semantic_base_object is None
        ):
            packet = NoNEPreparedCandidatePagePacket(
                page_id_t=page_id_t.clone(),
                object_sha256_t=digest_tensor(
                    hashlib.sha256(serialized).hexdigest()
                ),
                object_bytes_t=torch.tensor(
                    len(serialized),
                    dtype=torch.long,
                ),
                object_payload_t=serialized_t,
                format_revision_t=revision_t,
                dependency_present_t=torch.tensor(False),
                base_generation_t=torch.tensor(-1, dtype=torch.long),
                base_manifest_payload_sha256_t=torch.empty(
                    0,
                    dtype=torch.uint8,
                ),
                base_object_sha256_t=torch.empty(0, dtype=torch.uint8),
                base_object_bytes_t=torch.tensor(0, dtype=torch.long),
            )
        else:
            packet = NoNEPreparedCandidatePagePacket(
                page_id_t=page_id_t.clone(),
                object_sha256_t=digest_tensor(
                    hashlib.sha256(serialized).hexdigest()
                ),
                object_bytes_t=torch.tensor(
                    len(serialized),
                    dtype=torch.long,
                ),
                object_payload_t=serialized_t,
                format_revision_t=revision_t,
                dependency_present_t=torch.tensor(True),
                base_generation_t=(
                    semantic_base_generation.generation_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                    .clone()
                ),
                base_manifest_payload_sha256_t=(
                    semantic_base_generation.manifest_payload_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .reshape(-1)
                    .clone()
                ),
                base_object_sha256_t=(
                    semantic_base_object.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .reshape(-1)
                    .clone()
                ),
                base_object_bytes_t=(
                    semantic_base_object.object_bytes_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                    .clone()
                ),
            )
        self._validated_prepared_candidate_page_boundary(packet)
        return packet

    def stage_candidate_page_scratch_boundary(
        self,
        bundle: NoNEPageBundle,
        *,
        scratch_root: Path,
        base_generation_t: torch.Tensor,
    ) -> NoNECandidatePageScratchBinding:
        """Atomically replace one proposal-local page with exact parent deltas."""

        self._require_staged_read_only_write_guard_boundary()
        prepared = self.prepare_candidate_page_boundary(
            bundle,
            base_generation_t=base_generation_t,
        )
        serialized, dependency = (
            self._validated_prepared_candidate_page_boundary(prepared)
        )
        page_id = int(prepared.page_id_t.detach().cpu().long().reshape(()))
        serialized_sha256 = _tensor_digest_hex(
            prepared.object_sha256_t
        )
        serialized_bytes = int(
            prepared.object_bytes_t.detach().cpu().long().reshape(())
        )
        resolved_root = self._validated_candidate_scratch_window_boundary(
            scratch_root
        )
        scratch_path = resolved_root / f"page_{page_id}.safetensors"
        temporary = resolved_root / f".page_{page_id}.{os.getpid()}.tmp"
        temporary.unlink(missing_ok=True)
        try:
            with temporary.open("xb") as handle:
                written_bytes = handle.write(serialized)
                if written_bytes != serialized_bytes:
                    raise OSError(
                        "NoNE candidate scratch serialization write is incomplete"
                    )
                handle.flush()
            if (
                serialized_bytes < 1
                or temporary.stat().st_size != serialized_bytes
                or _file_sha256(temporary) != serialized_sha256
            ):
                raise RuntimeError(
                    "NoNE candidate scratch payload identity differs"
                )
            binding = NoNECandidatePageScratchBinding(
                page_id_t=prepared.page_id_t.detach()
                .cpu()
                .long()
                .reshape(())
                .clone(),
                scratch_path=scratch_path,
                object_sha256_t=prepared.object_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8)
                .clone(),
                object_bytes_t=prepared.object_bytes_t.detach()
                .cpu()
                .long()
                .reshape(())
                .clone(),
            )
            os.replace(temporary, scratch_path)
            resolved_scratch_path = scratch_path.resolve()
            scratch_identity = _file_identity(resolved_scratch_path)
            if scratch_identity[2] != serialized_bytes:
                raise RuntimeError(
                    "NoNE candidate scratch serialized identity differs"
                )
            _FILE_SHA256_CACHE[resolved_scratch_path] = (
                scratch_identity,
                serialized_sha256,
            )
            if dependency is not None:
                semantic_base_generation = (
                    self.current_generation_binding_boundary()
                )
                if (
                    not torch.equal(
                        semantic_base_generation.generation_t.detach()
                        .cpu()
                        .long()
                        .reshape(()),
                        dependency.generation_t.detach()
                        .cpu()
                        .long()
                        .reshape(()),
                    )
                    or not torch.equal(
                        semantic_base_generation.manifest_payload_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(-1),
                        dependency.manifest_payload_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(-1),
                    )
                ):
                    raise RuntimeError(
                        "candidate delta base authority changed before scratch "
                        "publication"
                    )
                self._record_candidate_scratch_semantic_witness_boundary(
                    page_id=page_id,
                    scratch_path=scratch_path,
                    object_sha256=serialized_sha256,
                    object_bytes=serialized_bytes,
                    base_generation=semantic_base_generation,
                    base_object=dependency.object,
                )
            return binding
        except Exception:
            temporary.unlink(missing_ok=True)
            raise

    def materialize_candidate_page_scratch_boundary(
        self,
        binding: NoNECandidatePageScratchBinding,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageBundle:
        """Reload one proposal-local page without granting immutable authority."""

        _page_id, scratch_path, _object_bytes = (
            self._validated_candidate_scratch_path_boundary(binding)
        )
        return self._materialize_page_path_boundary(
            scratch_path,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )

    def seal_candidate_page_scratch_boundary(
        self,
        binding: NoNECandidatePageScratchBinding,
        *,
        sync_directory: bool = True,
    ) -> NoNECandidatePageSealPacket:
        """Hash and atomically admit one retained scratch page as immutable."""

        self._require_staged_read_only_write_guard_boundary()
        _session_id_t, session_root = self._require_session()
        objects_root, _placement_scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        page_id, scratch_path, object_bytes = (
            self._validated_candidate_scratch_path_boundary(binding)
        )
        scratch_root = scratch_path.parent
        if (
            _page_object_placement_directory_identity_boundary(
                objects_root
            )[0]
            != _page_object_placement_directory_identity_boundary(
                scratch_root
            )[0]
        ):
            raise RuntimeError(
                "NoNE candidate scratch and final object filesystems differ"
            )
        with scratch_path.open("rb") as handle:
            os.fsync(handle.fileno())
        semantic_witness = (
            self._take_candidate_scratch_semantic_witness_boundary(
                page_id=page_id,
                scratch_path=scratch_path,
                object_bytes=object_bytes,
            )
        )
        object_sha256 = (
            semantic_witness.object_sha256
            if semantic_witness is not None
            else _file_sha256(scratch_path)
        )
        object_path = objects_root / f"{object_sha256}.safetensors"
        sealed = NoNEPageObjectBinding(
            page_id_t=torch.tensor(page_id, dtype=torch.long),
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
        )
        created_object = not object_path.is_file()
        if not created_object:
            if (
                object_path.stat().st_size != object_bytes
                or _file_sha256(object_path) != object_sha256
            ):
                raise RuntimeError("existing NoNE page object hash mismatch")
            self._verified_objects.add(object_sha256)
            try:
                self._page_object_row_boundary(sealed)
            except Exception:
                self._verified_objects.discard(object_sha256)
                raise
            scratch_path.unlink()
        else:
            stage_atomically_moved_file_sha256_authority_boundary(
                staged_path=scratch_path,
                final_path=object_path,
                expected_sha256=object_sha256,
                identity_cache_root=(
                    self._runtime_cache_root_boundary()
                    / "page_object_sha256_identity_cache"
                ),
            )
            os.replace(scratch_path, object_path)
            self._verified_objects.add(object_sha256)
            try:
                self._page_object_row_boundary(sealed)
            except Exception:
                self._verified_objects.discard(object_sha256)
                if object_path.is_file() and not scratch_path.exists():
                    os.replace(object_path, scratch_path)
                    _fsync_directory(objects_root)
                    _fsync_directory(scratch_root)
                raise
        if sync_directory:
            _fsync_directory(objects_root)
            _fsync_directory(scratch_root)
        if semantic_witness is not None:
            self._record_candidate_sealed_semantic_witness_boundary(
                witness=semantic_witness,
                object_path=object_path,
                object_sha256=object_sha256,
                object_bytes=object_bytes,
            )
        return NoNECandidatePageSealPacket(
            scratch=binding,
            object=sealed,
            created_object_t=torch.tensor(
                created_object,
                dtype=torch.bool,
            ),
        )

    def rollback_candidate_page_seal_boundary(
        self,
        packet: NoNECandidatePageSealPacket,
    ) -> None:
        """Restore one pre-manifest seal and remove any new immutable orphan."""

        self._require_staged_read_only_write_guard_boundary()
        page_id, scratch_path, object_bytes = (
            self._candidate_scratch_identity_boundary(packet.scratch)
        )
        row = self._page_object_row_boundary(packet.object)
        if (
            int(row["pageId"]) != page_id
            or int(row["bytes"]) != object_bytes
        ):
            raise RuntimeError("NoNE candidate seal rollback identity differs")
        object_sha256 = str(row["sha256"])
        with self._candidate_page_semantic_witness_lock:
            semantic_witness = (
                self._candidate_sealed_semantic_witnesses.pop(
                    object_sha256,
                    None,
                )
            )
        self._evict_validated_immutable_page_closure_object_boundary(
            object_sha256
        )
        objects_root, _placement_scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        object_path = objects_root / f"{object_sha256}.safetensors"
        if (
            not object_path.is_file()
            or object_path.stat().st_size != object_bytes
            or _file_sha256(object_path) != object_sha256
        ):
            raise RuntimeError(
                "NoNE candidate rollback object placement differs"
            )
        created_object_t = packet.created_object_t.detach().cpu().bool().reshape(-1)
        if created_object_t.numel() != 1:
            raise RuntimeError("NoNE candidate seal rollback proof is malformed")
        if bool(created_object_t[0]):
            if scratch_path.exists():
                raise RuntimeError("NoNE candidate rollback scratch already exists")
            os.replace(object_path, scratch_path)
            self._verified_objects.discard(object_sha256)
        else:
            if scratch_path.exists():
                raise RuntimeError("NoNE candidate rollback scratch already exists")
            shutil.copyfile(object_path, scratch_path)
        with scratch_path.open("rb") as handle:
            os.fsync(handle.fileno())
        _fsync_directory(scratch_path.parent)
        _fsync_directory(objects_root)
        if semantic_witness is not None:
            restored_witness = replace(
                semantic_witness,
                object_path=scratch_path,
                object_identity=_file_identity(scratch_path),
            )
            with self._candidate_page_semantic_witness_lock:
                self._candidate_scratch_semantic_witnesses[
                    scratch_path
                ] = restored_witness

    def discard_candidate_page_scratch_boundary(
        self,
        binding: NoNECandidatePageScratchBinding,
    ) -> None:
        """Remove proposal-local bytes without touching immutable objects."""

        self._require_staged_read_only_write_guard_boundary()
        _page_id, scratch_path, _object_bytes = (
            self._candidate_scratch_identity_boundary(binding)
        )
        self._discard_candidate_semantic_witness_boundary(
            scratch_path=scratch_path
        )
        scratch_path.unlink(missing_ok=True)

    def sync_staged_page_objects_boundary(self) -> None:
        """Commit one page-gradient wave with one directory barrier.

        Each object is file-synced and content-addressed before its atomic
        rename. Deferring only the shared directory sync until the end of the
        wave preserves crash durability without one journal commit per page.
        """

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        _fsync_directory(objects_root)

    def stage_compact_transfer_page_object_boundary(
        self,
        bundle: NoNEPageBundle,
    ) -> NoNEPageObjectBinding:
        """Persist one untrained transfer page with scaled-float8 weights."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        validate_page_bundle(bundle)
        if bundle.weights.page_ids_t.numel() != 1:
            raise ValueError(
                "compact transfer page staging requires exactly one row"
            )
        object_sha256, object_bytes = self._save_page_object(
            bundle,
            0,
            compact_transfer=True,
        )
        binding = NoNEPageObjectBinding(
            page_id_t=bundle.weights.page_ids_t.detach().cpu().long().reshape(
                ()
            ),
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
        )
        self._page_object_row_boundary(binding)
        return binding

    def stage_compact_transfer_weights_boundary(
        self,
        weights: NoNEPageWeights,
    ) -> NoNEPageObjectBinding:
        """Persist one transfer page without allocating implicit-zero moments."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        validate_page_weights(weights)
        if weights.page_ids_t.numel() != 1:
            raise ValueError(
                "compact transfer weight staging requires exactly one row"
            )
        object_sha256, object_bytes = (
            self._save_compact_transfer_weights_object_boundary(
                weights,
                0,
                optimizer_width=_flat_parameter_width(weights),
            )
        )
        binding = NoNEPageObjectBinding(
            page_id_t=weights.page_ids_t.detach().cpu().long().reshape(()),
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
        )
        return self.verify_compact_transfer_page_object_boundary(binding)

    def build_compact_transfer_template_boundary(
        self,
        weights: NoNEPageWeights,
    ) -> NoNECompactTransferTemplate:
        """Quantize invariant transfer weights once for repeated page staging."""

        self._require_session()
        validate_page_weights(weights)
        if weights.page_ids_t.numel() != 1:
            raise ValueError("compact transfer template requires exactly one row")
        template_key = _page_weights_template_key(weights)
        cached_template = self._compact_transfer_template_cache.get(template_key)
        if cached_template is not None:
            return NoNECompactTransferTemplate(
                payload=bytearray(cached_template.payload),
                page_id_offset=cached_template.page_id_offset,
            )
        payload = self._compact_transfer_payload_boundary(
            weights,
            0,
            optimizer_width=_flat_parameter_width(weights),
        )
        serialized = save(payload)
        if len(serialized) < 8:
            raise RuntimeError("compact transfer template serialization is truncated")
        header_bytes = struct.unpack_from("<Q", serialized, 0)[0]
        header_end = 8 + header_bytes
        header = json.loads(serialized[8:header_end])
        page_record = header.get("page_ids_t")
        if not isinstance(page_record, dict):
            raise RuntimeError("compact transfer template omits page identity")
        data_offsets = page_record.get("data_offsets")
        if (
            not isinstance(data_offsets, list)
            or len(data_offsets) != 2
            or data_offsets[1] - data_offsets[0] != 8
        ):
            raise RuntimeError("compact transfer page identity offset differs")
        page_id_offset = header_end + int(data_offsets[0])
        if page_id_offset < header_end or page_id_offset + 8 > len(serialized):
            raise RuntimeError("compact transfer page identity escaped payload")
        template = NoNECompactTransferTemplate(
            payload=bytearray(serialized),
            page_id_offset=page_id_offset,
        )
        self._compact_transfer_template_cache[template_key] = template
        return NoNECompactTransferTemplate(
            payload=bytearray(template.payload),
            page_id_offset=template.page_id_offset,
        )

    def stage_compact_transfer_template_page_boundary(
        self,
        template: NoNECompactTransferTemplate,
        *,
        page_id: int,
    ) -> NoNEPageObjectBinding:
        """Stage one fsynced object by changing only a template's page ID."""

        self._require_staged_read_only_write_guard_boundary()
        binding = self.write_compact_transfer_template_page_boundary(
            template,
            page_id=page_id,
        )
        self.commit_compact_transfer_chunk_boundary((binding,))
        return binding

    def write_compact_transfer_template_page_boundary(
        self,
        template: NoNECompactTransferTemplate,
        *,
        page_id: int,
    ) -> NoNEPageObjectBinding:
        """Write one object before a chunk-level durability commitment."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        if page_id < 0:
            raise ValueError("compact transfer page ID cannot be negative")
        if (
            template.page_id_offset < 0
            or template.page_id_offset + 8 > len(template.payload)
        ):
            raise RuntimeError("compact transfer template offset is malformed")
        struct.pack_into("<q", template.payload, template.page_id_offset, page_id)
        object_sha256 = hashlib.sha256(template.payload).hexdigest()
        object_path = objects_root / f"{object_sha256}.safetensors"
        object_bytes = len(template.payload)
        if object_path.is_file():
            if (
                object_path.stat().st_size != object_bytes
                or _file_sha256(object_path) != object_sha256
            ):
                raise RuntimeError("existing compact transfer object differs")
            self._verified_objects.add(object_sha256)
        else:
            temporary = objects_root / f".page.{os.getpid()}.{page_id}.tmp"
            temporary.unlink(missing_ok=True)
            with temporary.open("wb") as handle:
                written = handle.write(template.payload)
                if written != object_bytes:
                    raise RuntimeError("compact transfer object write was incomplete")
            os.replace(temporary, object_path)
            self._pending_compact_objects.add(object_sha256)
        binding = NoNEPageObjectBinding(
            page_id_t=torch.tensor(page_id, dtype=torch.long),
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
        )
        return binding

    def commit_compact_transfer_chunk_boundary(
        self,
        bindings: tuple[NoNEPageObjectBinding, ...],
    ) -> None:
        """Fsync page files and directory before their journal chunk commits."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        if not bindings:
            raise ValueError("compact transfer durability chunk is empty")
        page_ids = tuple(int(binding.page_id_t.detach().cpu()) for binding in bindings)
        object_sha256s = tuple(
            _tensor_digest_hex(binding.object_sha256_t) for binding in bindings
        )
        if len(set(page_ids)) != len(page_ids) or len(set(object_sha256s)) != len(
            object_sha256s
        ):
            raise RuntimeError("compact transfer durability chunk has duplicates")
        for binding, object_sha256 in zip(
            bindings,
            object_sha256s,
            strict=True,
        ):
            object_path = objects_root / f"{object_sha256}.safetensors"
            expected_bytes = int(binding.object_bytes_t.detach().cpu())
            if (
                not object_path.is_file()
                or object_path.stat().st_size != expected_bytes
            ):
                raise RuntimeError("compact transfer chunk object is incomplete")
            with object_path.open("rb") as handle:
                os.fsync(handle.fileno())
        _fsync_directory(objects_root)
        self._verified_objects.update(object_sha256s)
        self._pending_compact_objects.difference_update(object_sha256s)
        for binding in bindings:
            self.verify_compact_transfer_page_object_boundary(binding)

    def verify_compact_transfer_page_object_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> NoNEPageObjectBinding:
        """Verify one receipt-owned untrained compact page without loading it."""

        row = self._page_object_row_boundary(binding)
        object_path = self._object_path_boundary(
            str(row["sha256"]),
            expected_bytes=int(row["bytes"]),
        )
        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            keys = set(handle.keys())
            revision_t = handle.get_tensor("format_revision_t").reshape(-1).long()
            optimizer_width_t = handle.get_tensor("optimizer_width_t").reshape(-1)
            if (
                revision_t.numel() != 1
                or int(revision_t[0])
                != SCALED_FLOAT8_TRANSFER_PAGE_FORMAT_REVISION
                or optimizer_width_t.numel() != 1
                or int(optimizer_width_t[0]) < 1
            ):
                raise RuntimeError("compact transfer page format differs")
            if {
                "optimizer_mean_t",
                "optimizer_square_t",
                "step_t",
            } & keys:
                raise RuntimeError(
                    "compact transfer page contains explicit optimizer state"
                )
            if any(
                name not in keys
                or f"{name}_scale_t" not in keys
                or f"{name}_dtype_t" not in keys
                for name in _PAGE_WEIGHT_TENSOR_NAMES
            ):
                raise RuntimeError("compact transfer page scale state differs")
        return binding

    def _materialize_page_path_boundary(
        self,
        object_path: Path,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
        _delta_chain: tuple[str, ...] = (),
        _authorized_semantic_objects: (
            tuple[_NoNEAuthorizedSemanticObject, ...] | None
        ) = None,
    ) -> NoNEPageBundle:
        """Materialize one already-validated durable or scratch page path."""

        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            page_ids_t = handle.get_tensor("page_ids_t").reshape(-1).long()
            if page_ids_t.shape != (1,):
                raise RuntimeError("NoNE page object identity is malformed")
            page_id = int(page_ids_t[0])
            revision = self._page_format_revision_boundary(handle)
            if revision == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION:
                if len(_delta_chain) >= _BASE_BOUND_DELTA_MAX_DEPTH:
                    raise RuntimeError("base-bound delta dependency depth exceeded")
                dependency = (
                    self._page_delta_dependency_record_from_handle_boundary(
                        handle,
                        expected_page_id=page_id,
                    )
                    if _authorized_semantic_objects is not None
                    else self._validated_page_delta_dependency_from_handle_boundary(
                        handle,
                        expected_page_id=page_id,
                    )
                )
                if dependency is None:
                    raise RuntimeError("base-bound delta dependency is absent")
                base_sha256 = _tensor_digest_hex(
                    dependency.object.object_sha256_t
                )
                if base_sha256 in _delta_chain:
                    raise RuntimeError("base-bound delta dependency cycle detected")
                storage_dtype_t = (
                    handle.get_tensor("delta_storage_dtype_t")
                    .reshape(-1)
                    .long()
                )
                if storage_dtype_t.numel() != 1:
                    raise RuntimeError("base-bound delta storage dtype differs")
                storage_dtype = _storage_dtype_from_code(
                    int(storage_dtype_t[0])
                )
                base_bytes = int(dependency.object.object_bytes_t)
                authorized_base = (
                    next(
                        (
                            authorized
                            for authorized in _authorized_semantic_objects
                            if authorized.object_sha256 == base_sha256
                        ),
                        None,
                    )
                    if _authorized_semantic_objects is not None
                    else None
                )
                if _authorized_semantic_objects is not None:
                    if (
                        authorized_base is None
                        or authorized_base.page_id != page_id
                        or authorized_base.object_bytes != base_bytes
                    ):
                        raise RuntimeError(
                            "base-bound delta semantic authorization differs"
                        )
                    base_path = authorized_base.object_path
                    base_reference = self._materialize_page_path_boundary(
                        object_path=base_path,
                        device=torch.device("cpu"),
                        dtype=torch.float32,
                        trainable=False,
                        _delta_chain=(*_delta_chain, base_sha256),
                        _authorized_semantic_objects=(
                            _authorized_semantic_objects
                        ),
                    )
                else:
                    base_path = self._object_path_boundary(
                        base_sha256,
                        expected_bytes=base_bytes,
                    )
                    self._verify_materialized_object_boundary(
                        object_path=base_path,
                        object_sha256=base_sha256,
                    )
                    base_reference = (
                        self._materialize_verified_immutable_cpu_page_boundary(
                            object_path=base_path,
                            object_sha256=base_sha256,
                            dtype=torch.float32,
                            delta_chain=(*_delta_chain, base_sha256),
                        )
                    )
                base = (
                    base_reference
                    if storage_dtype == torch.float32
                    else (
                        self._materialize_page_path_boundary(
                            object_path=base_path,
                            device=torch.device("cpu"),
                            dtype=storage_dtype,
                            trainable=False,
                            _delta_chain=(*_delta_chain, base_sha256),
                            _authorized_semantic_objects=(
                                _authorized_semantic_objects
                            ),
                        )
                        if _authorized_semantic_objects is not None
                        else self._materialize_verified_immutable_cpu_page_boundary(
                            object_path=base_path,
                            object_sha256=base_sha256,
                            dtype=storage_dtype,
                            delta_chain=(*_delta_chain, base_sha256),
                        )
                    )
                )
                if storage_dtype != torch.float32 and any(
                    not torch.equal(
                        getattr(base.weights, name).detach().cpu().float(),
                        getattr(base_reference.weights, name)
                        .detach()
                        .cpu()
                        .float(),
                    )
                    for name in _PAGE_WEIGHT_TENSOR_NAMES
                ):
                    raise RuntimeError(
                        "base-bound delta storage dtype changes parent semantics"
                    )
                if not torch.equal(
                    base.weights.page_ids_t.detach().cpu().long(),
                    page_ids_t.detach().cpu().long(),
                ):
                    raise RuntimeError("base-bound delta changed page identity")
                base_mean_probe_t = (
                    base_reference.optimizer_mean_t[:, :1]
                    if base_reference.optimizer_mean_t.stride(1) == 0
                    else base_reference.optimizer_mean_t
                )
                base_square_probe_t = (
                    base_reference.optimizer_square_t[:, :1]
                    if base_reference.optimizer_square_t.stride(1) == 0
                    else base_reference.optimizer_square_t
                )
                if not bool(
                    torch.count_nonzero(base_mean_probe_t).eq(0)
                    & torch.count_nonzero(base_square_probe_t).eq(0)
                ):
                    raise RuntimeError(
                        "base-bound delta parent optimizer moments are nonzero"
                    )
                retained_step_t = handle.get_tensor("step_t").detach().cpu()
                if not retained_step_t.gt(
                    base_reference.step_t.detach().cpu().long()
                ).all():
                    raise RuntimeError(
                        "base-bound delta optimizer step did not advance"
                    )
                decoded_weights = {
                    name: _apply_exact_page_weight_delta_boundary(
                        handle,
                        base_t=getattr(base.weights, name),
                        name=name,
                    )
                    for name in _PAGE_WEIGHT_TENSOR_NAMES
                }
                if any(
                    not torch.isfinite(weight_t).all()
                    for weight_t in decoded_weights.values()
                ):
                    raise RuntimeError(
                        "base-bound delta reconstruction contains nonfinite values"
                    )
                decoded_page_weights = NoNEPageWeights(
                    page_ids_t=page_ids_t.detach().cpu().clone(),
                    **decoded_weights,
                )
            else:
                decoded_page_weights = NoNEPageWeights(
                    page_ids_t=page_ids_t,
                    **{
                        name: load_page_weight_from_handle_boundary(
                            handle,
                            name,
                        )
                        for name in _PAGE_WEIGHT_TENSOR_NAMES
                    },
                )
            # Immutable decoding already occurs on CPU.  When it produced the
            # exact requested non-trainable dtype, retain that no-grad leaf
            # directly so a mixed proposal wave can copy every verified row
            # into one contiguous host allocation before its sole
            # consumer-device move.  Conversion and trainable consumers still
            # cross the isolating movement boundary below.
            decoded_weight_tensors = tuple(
                getattr(decoded_page_weights, name)
                for name in _PAGE_WEIGHT_TENSOR_NAMES
            )
            weights = (
                decoded_page_weights
                if (
                    device.type == "cpu"
                    and not trainable
                    and all(
                        tensor.device.type == "cpu"
                        and tensor.dtype == dtype
                        and not tensor.requires_grad
                        and tensor.is_leaf
                        for tensor in decoded_weight_tensors
                    )
                )
                else _move_immutable_page_weights_for_consumer_boundary(
                    decoded_page_weights,
                    device=device,
                    dtype=dtype,
                    trainable=trainable,
                )
            )
            optimizer_device = (
                device
                if revision != FULL_OPTIMIZER_PAGE_FORMAT_REVISION
                else torch.device("cpu")
            )
            optimizer_mean_t, optimizer_square_t, step_t = (
                self._materialize_optimizer_state_boundary(
                    handle,
                    weights=weights,
                    device=optimizer_device,
                )
            )
            bundle = NoNEPageBundle(
                weights=weights,
                optimizer_mean_t=optimizer_mean_t,
                optimizer_square_t=optimizer_square_t,
                step_t=step_t,
            )
        validate_page_bundle(bundle)
        return bundle

    def _materialize_page_payload_boundary(
        self,
        object_payload_t: torch.Tensor,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageBundle:
        """Materialize safetensors bytes from anonymous memory only."""

        payload_t = (
            object_payload_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(-1)
            .contiguous()
        )
        if payload_t.numel() < 1 or not hasattr(os, "memfd_create"):
            raise RuntimeError(
                "NoNE packed page in-memory materialization is unavailable"
            )
        descriptor = os.memfd_create(
            "nnf-none-packed-page",
            getattr(os, "MFD_CLOEXEC", 0),
        )
        payload_view = memoryview(payload_t.numpy())
        try:
            offset = 0
            while offset < len(payload_view):
                written = os.pwrite(
                    descriptor,
                    payload_view[offset:],
                    offset,
                )
                if written < 1:
                    raise OSError(
                        "NoNE packed page memory write was incomplete"
                    )
                offset += written
            return self._materialize_page_path_boundary(
                Path(f"/proc/self/fd/{descriptor}"),
                device=device,
                dtype=dtype,
                trainable=trainable,
            )
        finally:
            payload_view.release()
            os.close(descriptor)

    def materialize_page_object_boundary(
        self,
        binding: NoNEPageObjectBinding,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageBundle:
        """Materialize one verified candidate object without accepting it."""

        row = self._page_object_row_boundary(binding)
        object_sha256 = str(row["sha256"])
        object_path = self._object_path_boundary(
            object_sha256,
            expected_bytes=int(row["bytes"]),
        )
        bundle = self._materialize_verified_immutable_cpu_page_boundary(
            object_path=object_path,
            object_sha256=object_sha256,
            dtype=dtype,
            delta_chain=(),
        )
        return _move_immutable_page_bundle_for_consumer_boundary(
            bundle,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )

    def _authorized_semantic_object_from_row_boundary(
        self,
        row: Mapping[str, Any],
    ) -> _NoNEAuthorizedSemanticObject:
        """Capture one owner-verified immutable object identity."""

        page_id = int(row["pageId"])
        object_sha256 = str(row["sha256"])
        object_bytes = int(row["bytes"])
        object_path = self._object_path_boundary(
            object_sha256,
            expected_bytes=object_bytes,
        )
        self._verify_materialized_object_boundary(
            object_path=object_path,
            object_sha256=object_sha256,
        )
        return _NoNEAuthorizedSemanticObject(
            page_id=page_id,
            object_sha256=object_sha256,
            object_bytes=object_bytes,
            object_path=object_path,
            object_identity=_file_identity(object_path),
        )

    def _preauthorize_rev6_semantic_admission_boundary(
        self,
        *,
        row: Mapping[str, Any],
        dependency: _NoNEPageDeltaDependency,
    ) -> _NoNERev6SemanticAdmission:
        """Serially authorize one rev6 child and its immutable dependency chain."""

        if self._generation_writer_handle is None:
            raise RuntimeError(
                "NoNE semantic admission requires generation writer authority"
            )
        child = self._authorized_semantic_object_from_row_boundary(row)
        closure: list[_NoNEAuthorizedSemanticObject] = []
        observed_sha256s = {child.object_sha256}
        current_dependency: _NoNEPageDeltaDependency | None = dependency
        while current_dependency is not None:
            if len(closure) >= _BASE_BOUND_DELTA_MAX_DEPTH:
                raise RuntimeError("base-bound delta dependency depth exceeded")
            base_row = self._page_object_row_boundary(
                current_dependency.object
            )
            base = self._authorized_semantic_object_from_row_boundary(base_row)
            if base.object_sha256 in observed_sha256s:
                raise RuntimeError("base-bound delta dependency cycle detected")
            observed_sha256s.add(base.object_sha256)
            closure.append(base)
            current_dependency = self._page_delta_dependency_for_row_boundary(
                base_row
            )
        return _NoNERev6SemanticAdmission(
            child=child,
            dependency_closure=tuple(closure),
        )

    def _preauthorize_updated_page_semantics_boundary(
        self,
        *,
        updated_page_objects: tuple[NoNEPageObjectBinding, ...],
        accepted_generation: int,
        parent_payload_sha256: str | None,
        parent_page_rows: Mapping[int, Mapping[str, Any]],
    ) -> tuple[
        tuple[dict[str, Any], ...],
        tuple[_NoNERev6SemanticAdmission, ...],
    ]:
        """Verify all child and accepted-parent identities on the writer thread."""

        if self._generation_writer_handle is None:
            raise RuntimeError(
                "NoNE semantic preauthorization requires generation writer authority"
            )
        updated_rows = tuple(
            self._page_object_row_boundary(binding)
            for binding in updated_page_objects
        )
        updated_page_ids = tuple(int(row["pageId"]) for row in updated_rows)
        if len(updated_page_ids) != len(set(updated_page_ids)):
            raise RuntimeError("NoNE staged generation repeats a page identity")

        admissions: list[_NoNERev6SemanticAdmission] = []
        for row in updated_rows:
            object_sha256 = str(row["sha256"])
            object_path = self._object_path_boundary(
                object_sha256,
                expected_bytes=int(row["bytes"]),
            )
            if (
                self._cached_validated_immutable_page_closure_boundary(
                    page_id=int(row["pageId"]),
                    object_path=object_path,
                    object_sha256=object_sha256,
                    object_bytes=int(row["bytes"]),
                )
                is not None
            ):
                continue
            dependency = self._page_delta_dependency_for_row_boundary(row)
            if dependency is None:
                continue
            page_id = int(row["pageId"])
            parent_row = parent_page_rows.get(page_id)
            if (
                not isinstance(parent_payload_sha256, str)
                or len(parent_payload_sha256) != 64
                or int(dependency.generation_t) != accepted_generation
                or _tensor_digest_hex(
                    dependency.manifest_payload_sha256_t
                )
                != parent_payload_sha256
                or not isinstance(parent_row, Mapping)
                or parent_row.get("sha256")
                != _tensor_digest_hex(
                    dependency.object.object_sha256_t
                )
                or parent_row.get("bytes")
                != int(dependency.object.object_bytes_t)
            ):
                raise RuntimeError(
                    "base-bound delta is not derived from the accepted parent"
                )
            admissions.append(
                self._preauthorize_rev6_semantic_admission_boundary(
                    row=row,
                    dependency=dependency,
                )
            )
        return updated_rows, tuple(admissions)

    def _reconstruct_preauthorized_rev6_child_boundary(
        self,
        admission: _NoNERev6SemanticAdmission,
    ) -> tuple[int, str]:
        """Reconstruct one child from the nearest exact cached ancestor.

        The writer thread has already bound every object in ``admission`` to
        its session, digest, path, byte count, inode, generation, and parent
        manifest.  A cold recursive reconstruction used to rebuild two full
        page tensors per rev6 edge (float32 reference plus storage dtype), then
        repeat that work for every ancestor.  Here the semantic worker finds
        the nearest identity-bound float32 cache entry, clones its private
        storage once, and applies the preauthorized replacement chain in
        topological order.  Finite base tensors plus finite replacement values
        prove every intermediate tensor finite without rescanning every full
        matrix after every edge.  The batch gate still rechecks every file
        identity and digest before it grants semantic admission.
        """

        authorized_objects = (
            admission.child,
            *admission.dependency_closure,
        )
        if len(authorized_objects) < 2:
            raise RuntimeError(
                "base-bound delta semantic dependency closure is empty"
            )
        if (
            any(
                authorized.page_id != admission.child.page_id
                for authorized in authorized_objects
            )
            or len(
                {
                    authorized.object_sha256
                    for authorized in authorized_objects
                }
            )
            != len(authorized_objects)
        ):
            raise RuntimeError(
                "base-bound delta semantic dependency closure differs"
            )

        base_index: int | None = None
        base_bundle: NoNEPageBundle | None = None
        for index, authorized in enumerate(authorized_objects[1:], start=1):
            cached = self._cached_materialized_cpu_page_boundary(
                object_path=authorized.object_path,
                object_sha256=authorized.object_sha256,
                dtype=torch.float32,
            )
            if cached is not None:
                base_index = index
                base_bundle = cached
                break
        if base_index is None:
            terminal = authorized_objects[-1]
            with safe_open(  # type: ignore[no-untyped-call]
                str(terminal.object_path),
                framework="pt",
                device="cpu",
            ) as terminal_handle:
                if (
                    self._page_format_revision_boundary(terminal_handle)
                    == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
                ):
                    raise RuntimeError(
                        "base-bound delta semantic closure is incomplete"
                    )
            base_index = len(authorized_objects) - 1
            base_bundle = (
                self._materialize_verified_immutable_cpu_page_boundary(
                    object_path=terminal.object_path,
                    object_sha256=terminal.object_sha256,
                    dtype=torch.float32,
                    delta_chain=(),
                )
            )
        assert base_bundle is not None

        storage_dtypes: list[torch.dtype] = []
        schema_proofs: list[_NoNEValidatedPageObjectSchemaProof] = []
        for index in range(base_index):
            child = authorized_objects[index]
            parent = authorized_objects[index + 1]
            schema_proof = (
                self._preauthorized_page_object_schema_proof_boundary(child)
            )
            dependency = schema_proof.delta_dependency
            storage_dtype = schema_proof.delta_storage_dtype
            if (
                dependency is None
                or storage_dtype is None
                or int(dependency.object.page_id_t) != parent.page_id
                or _tensor_digest_hex(dependency.object.object_sha256_t)
                != parent.object_sha256
                or int(dependency.object.object_bytes_t)
                != parent.object_bytes
            ):
                raise RuntimeError(
                    "base-bound delta semantic dependency identity differs"
                )
            schema_proofs.append(schema_proof)
            storage_dtypes.append(storage_dtype)

        # Float64 replacement values can differ below float32 precision.  The
        # ordinary cold path retains a separate float64 ancestor reconstruction
        # for that uncommon format, so keep it as the exact fallback rather
        # than deriving float64 storage from the semantic float32 surface.
        if torch.float64 in storage_dtypes:
            bundle = self._materialize_verified_immutable_cpu_page_boundary(
                object_path=admission.child.object_path,
                object_sha256=admission.child.object_sha256,
                dtype=torch.float32,
                delta_chain=(),
            )
        else:
            base_mean_probe_t = (
                base_bundle.optimizer_mean_t[:, :1]
                if base_bundle.optimizer_mean_t.stride(1) == 0
                else base_bundle.optimizer_mean_t
            )
            base_square_probe_t = (
                base_bundle.optimizer_square_t[:, :1]
                if base_bundle.optimizer_square_t.stride(1) == 0
                else base_bundle.optimizer_square_t
            )
            if not bool(
                torch.count_nonzero(base_mean_probe_t).eq(0)
                & torch.count_nonzero(base_square_probe_t).eq(0)
            ):
                raise RuntimeError(
                    "base-bound delta parent optimizer moments are nonzero"
                )
            if any(
                not torch.isfinite(
                    getattr(base_bundle.weights, name)
                ).all()
                for name in _PAGE_WEIGHT_TENSOR_NAMES
            ):
                raise RuntimeError(
                    "base-bound delta parent contains nonfinite values"
                )

            working_weights: NoNEPageWeights | None = None
            working_dtype: torch.dtype | None = None
            optimizer_mean_t = base_bundle.optimizer_mean_t
            optimizer_square_t = base_bundle.optimizer_square_t
            step_t = base_bundle.step_t.detach().cpu().long()
            for index in range(base_index - 1, -1, -1):
                child = authorized_objects[index]
                storage_dtype = storage_dtypes[index]
                reference_weights = (
                    base_bundle.weights
                    if working_weights is None
                    else working_weights
                )
                if working_weights is None or working_dtype != storage_dtype:
                    converted_weights = (
                        _move_immutable_page_weights_for_consumer_boundary(
                            reference_weights,
                            device=torch.device("cpu"),
                            dtype=storage_dtype,
                            trainable=False,
                        )
                    )
                    if any(
                        not torch.equal(
                            getattr(converted_weights, name).float(),
                            getattr(reference_weights, name).float(),
                        )
                        for name in _PAGE_WEIGHT_TENSOR_NAMES
                    ):
                        raise RuntimeError(
                            "base-bound delta storage dtype changes parent semantics"
                        )
                    working_weights = converted_weights
                    working_dtype = storage_dtype
                assert working_weights is not None
                with safe_open(  # type: ignore[no-untyped-call]
                    str(child.object_path),
                    framework="pt",
                    device="cpu",
                ) as handle:
                    for name in _PAGE_WEIGHT_TENSOR_NAMES:
                        _apply_exact_page_weight_delta_in_place_boundary(
                            handle,
                            target_t=getattr(working_weights, name),
                            name=name,
                            validated_schema_proof=schema_proofs[index],
                        )
                    (
                        optimizer_mean_t,
                        optimizer_square_t,
                        child_step_t,
                    ) = self._materialize_optimizer_state_boundary(
                        handle,
                        weights=working_weights,
                        device=torch.device("cpu"),
                    )
                if not child_step_t.gt(step_t).all():
                    raise RuntimeError(
                        "base-bound delta optimizer step did not advance"
                    )
                if (
                    torch.any(working_weights.ffn_mode_t < 0)
                    or torch.any(working_weights.ffn_mode_t > 1)
                ):
                    raise RuntimeError(
                        "base-bound delta FFN mode is outside the unit interval"
                    )
                step_t = child_step_t

            assert working_weights is not None
            final_weights = (
                working_weights
                if working_dtype == torch.float32
                else working_weights.to(
                    device=torch.device("cpu"),
                    dtype=torch.float32,
                    trainable=False,
                )
            )
            bundle = NoNEPageBundle(
                weights=final_weights,
                optimizer_mean_t=optimizer_mean_t,
                optimizer_square_t=optimizer_square_t,
                step_t=step_t,
            )
            validate_page_bundle(bundle)
            self._admit_materialized_cpu_page_boundary(
                object_path=admission.child.object_path,
                object_sha256=admission.child.object_sha256,
                dtype=torch.float32,
                bundle=bundle,
            )
        if not torch.equal(
            bundle.weights.page_ids_t.detach().cpu().long().reshape(-1),
            torch.tensor([admission.child.page_id], dtype=torch.long),
        ):
            raise RuntimeError(
                "base-bound delta semantic reconstruction changed page identity"
            )
        return admission.child.page_id, admission.child.object_sha256

    def _validate_rev6_semantic_admission_batch_boundary(
        self,
        admissions: tuple[_NoNERev6SemanticAdmission, ...],
    ) -> None:
        """Validate distinct rev6 children, reusing exact internal encodes."""

        if self._generation_writer_handle is None:
            raise RuntimeError(
                "NoNE semantic admission requires generation writer authority"
            )

        def closure_is_cached(
            admission: _NoNERev6SemanticAdmission,
        ) -> bool:
            return (
                self._cached_validated_immutable_page_closure_boundary(
                    page_id=admission.child.page_id,
                    object_path=admission.child.object_path,
                    object_sha256=admission.child.object_sha256,
                    object_bytes=admission.child.object_bytes,
                )
                is not None
            )

        pending_rows: list[_NoNERev6SemanticAdmission] = []
        for admission in sorted(
            admissions,
            key=lambda candidate: (
                candidate.child.page_id,
                candidate.child.object_sha256,
            ),
        ):
            if closure_is_cached(admission):
                self._discard_candidate_semantic_witness_boundary(
                    object_sha256=admission.child.object_sha256
                )
                continue
            pending_rows.append(admission)
        pending = tuple(pending_rows)
        if not pending:
            return
        authority_before = (
            self._accepted_generation_manifest_identity_boundary()
        )
        witnessed_sha256s = {
            admission.child.object_sha256
            for admission in pending
            if self._candidate_semantic_witness_matches_admission_boundary(
                authority=authority_before,
                admission=admission,
            )
        }
        reconstruct_pending = tuple(
            admission
            for admission in pending
            if admission.child.object_sha256 not in witnessed_sha256s
        )
        page_ids = tuple(admission.child.page_id for admission in pending)
        object_sha256s = tuple(
            admission.child.object_sha256 for admission in pending
        )
        if (
            len(page_ids) != len(set(page_ids))
            or len(object_sha256s) != len(set(object_sha256s))
        ):
            raise RuntimeError(
                "NoNE semantic admission requires distinct rev6 children"
            )

        if reconstruct_pending:
            with ThreadPoolExecutor(
                max_workers=min(
                    _PAGE_SEMANTIC_ADMISSION_WORKERS,
                    len(reconstruct_pending),
                ),
                thread_name_prefix="nnf-page-semantic",
            ) as executor:
                admission_by_future = {
                    executor.submit(
                        self._reconstruct_preauthorized_rev6_child_boundary,
                        admission,
                    ): admission
                    for admission in reconstruct_pending
                }
                try:
                    for future in as_completed(admission_by_future):
                        admission = admission_by_future[future]
                        result = future.result()
                        expected = (
                            admission.child.page_id,
                            admission.child.object_sha256,
                        )
                        if result != expected:
                            raise RuntimeError(
                                "NoNE semantic admission worker identity differs"
                            )
                except Exception:
                    for future in admission_by_future:
                        future.cancel()
                    raise

        authorized_objects = {
            (
                authorized.object_sha256,
                authorized.object_path,
            ): authorized
            for admission in pending
            for authorized in (
                admission.child,
                *admission.dependency_closure,
            )
        }
        for key in sorted(authorized_objects, key=lambda value: (value[0], str(value[1]))):
            authorized = authorized_objects[key]
            if _file_identity(authorized.object_path) != authorized.object_identity:
                raise RuntimeError(
                    "NoNE semantic admission object identity changed during reconstruction"
                )
            self._verify_materialized_object_boundary(
                object_path=authorized.object_path,
                object_sha256=authorized.object_sha256,
            )
        authority_after = (
            self._accepted_generation_manifest_identity_boundary()
        )
        if authority_after != authority_before:
            raise RuntimeError(
                "NoNE accepted generation changed during semantic admission"
            )
        for admission in pending:
            self._admit_validated_immutable_page_closure_boundary(
                authority=authority_after,
                admission=admission,
            )
            self._discard_candidate_semantic_witness_boundary(
                object_sha256=admission.child.object_sha256
            )

    def _validate_base_bound_delta_semantics_boundary(
        self,
        binding: NoNEPageObjectBinding,
    ) -> None:
        """Cold-validate one rev6 object before it can enter a generation."""

        row = self._page_object_row_boundary(binding)
        object_sha256 = str(row["sha256"])
        object_path = self._object_path_boundary(
            object_sha256,
            expected_bytes=int(row["bytes"]),
        )
        if (
            self._cached_validated_immutable_page_closure_boundary(
                page_id=int(row["pageId"]),
                object_path=object_path,
                object_sha256=object_sha256,
                object_bytes=int(row["bytes"]),
            )
            is not None
        ):
            return
        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            revision = self._page_format_revision_boundary(handle)
        if revision != BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION:
            return
        self._materialize_verified_immutable_cpu_page_boundary(
            object_path=object_path,
            object_sha256=object_sha256,
            dtype=torch.float32,
            delta_chain=(),
        )
        self._verified_delta_semantic_objects.add(object_sha256)

    def replicate_page_object_from_boundary(
        self,
        source_store: NoNEImmutablePageStore,
        binding: NoNEPageObjectBinding,
    ) -> NoNEPageObjectBinding:
        """Link or copy one verified candidate and all base dependencies."""

        self._require_staged_read_only_write_guard_boundary()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        direct_cache_was_current = (
            self._begin_direct_page_map_local_append_boundary(
                objects_root
            )
        )
        replicated = self._replicate_page_object_with_dependencies_boundary(
            source_store,
            binding,
            dependency_chain=(),
        )
        self.sync_staged_page_objects_boundary()
        self._finish_direct_page_map_local_append_boundary(
            objects_root,
            cache_was_current=direct_cache_was_current,
        )
        return replicated

    def replicate_page_objects_from_boundary(
        self,
        source_store: NoNEImmutablePageStore,
        bindings: tuple[NoNEPageObjectBinding, ...],
    ) -> tuple[NoNEPageObjectBinding, ...]:
        """Replicate dependency-closed objects with one directory barrier per wave."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        if not bindings:
            raise ValueError("NoNE page-object replica batch is empty")
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        direct_cache_was_current = (
            self._begin_direct_page_map_local_append_boundary(
                objects_root
            )
        )
        worker_count = min(_PAGE_MATERIALIZATION_IO_WORKERS, len(bindings))
        replicated: list[NoNEPageObjectBinding] = []

        def replicate(
            binding: NoNEPageObjectBinding,
        ) -> NoNEPageObjectBinding:
            return self._replicate_page_object_with_dependencies_boundary(
                source_store,
                binding,
                dependency_chain=(),
            )

        with ThreadPoolExecutor(
            max_workers=worker_count,
            thread_name_prefix="nnf-replica-io",
        ) as executor:
            for offset in range(0, len(bindings), worker_count):
                wave = bindings[offset : offset + worker_count]
                replicated.extend(executor.map(replicate, wave))
                self.sync_staged_page_objects_boundary()
        self._finish_direct_page_map_local_append_boundary(
            objects_root,
            cache_was_current=direct_cache_was_current,
        )
        return tuple(replicated)

    def _replicate_page_object_with_dependencies_boundary(
        self,
        source_store: NoNEImmutablePageStore,
        binding: NoNEPageObjectBinding,
        *,
        dependency_chain: tuple[str, ...],
    ) -> NoNEPageObjectBinding:
        """Replicate one dependency-closed immutable object graph."""

        _session_id_t, session_root = self._require_session()
        objects_root, _scratch_root = (
            self._validated_page_object_write_roots_boundary()
        )
        source_row = source_store._page_object_row_boundary(binding)
        object_sha256 = str(source_row["sha256"])
        if object_sha256 in dependency_chain:
            raise RuntimeError("NoNE replicated page dependency cycle detected")
        if len(dependency_chain) >= _BASE_BOUND_DELTA_MAX_DEPTH:
            raise RuntimeError("NoNE replicated page dependency depth exceeded")
        dependency = (
            source_store._page_delta_dependency_for_binding_boundary(binding)
        )
        if dependency is not None:
            self._replicate_page_object_with_dependencies_boundary(
                source_store,
                dependency.object,
                dependency_chain=(*dependency_chain, object_sha256),
            )
        source_path = source_store._object_path_boundary(
            object_sha256,
            expected_bytes=int(source_row["bytes"]),
        )
        target_path = objects_root / f"{object_sha256}.safetensors"
        if not target_path.is_file():
            # Dependency-closed fanout may replicate the same digest from
            # multiple worker threads.  A PID-only name aliases those
            # independent atomic publishes and lets one worker unlink or
            # replace another worker's in-flight bytes.
            temporary = objects_root / (
                f".{object_sha256}.{os.getpid()}.{threading.get_ident()}.tmp"
            )
            temporary.unlink(missing_ok=True)
            same_device = source_path.stat().st_dev == objects_root.stat().st_dev
            try:
                if same_device:
                    # The source row was hash-verified immediately above.  A hard
                    # link preserves that exact immutable inode and turns compact
                    # bank admission into metadata work instead of rereading and
                    # rewriting a trillion-parameter payload.
                    os.link(source_path, temporary, follow_symlinks=False)
                else:
                    shutil.copyfile(source_path, temporary)
                    with temporary.open("rb") as handle:
                        os.fsync(handle.fileno())
                    if _file_sha256(temporary) != object_sha256:
                        raise RuntimeError(
                            "replicated NoNE page object hash differs"
                        )
                published = False
                with self._replicated_page_object_publish_lock:
                    if target_path.is_file():
                        temporary.unlink()
                    else:
                        if not same_device:
                            stage_atomically_moved_file_sha256_authority_boundary(
                                staged_path=temporary,
                                final_path=target_path,
                                expected_sha256=object_sha256,
                                identity_cache_root=(
                                    self._runtime_cache_root_boundary()
                                    / "page_object_sha256_identity_cache"
                                ),
                            )
                        os.replace(temporary, target_path)
                        published = True
                if published:
                    # Hard links share the already verified inode. Cross-device
                    # copies were verified before the atomic move. Avoid a second
                    # complete payload read in _page_object_row_boundary below.
                    self._verified_objects.add(object_sha256)
            except BaseException:
                temporary.unlink(missing_ok=True)
                raise
        target_row = self._page_object_row_boundary(binding)
        if target_row != source_row:
            raise RuntimeError("replicated NoNE page-object binding differs")
        self._replicate_candidate_semantic_witness_boundary(
            source_store=source_store,
            object_sha256=object_sha256,
            object_path=target_path,
        )
        self._replicate_validated_immutable_page_closure_boundary(
            source_store,
            object_sha256,
        )
        return binding

    def _replicate_candidate_semantic_witness_boundary(
        self,
        *,
        source_store: "NoNEImmutablePageStore",
        object_sha256: str,
        object_path: Path,
    ) -> None:
        """Carry an exact internal encode witness across verified replication."""

        with source_store._candidate_page_semantic_witness_lock:
            source_witness = (
                source_store._candidate_sealed_semantic_witnesses.get(
                    object_sha256
                )
            )
        if (
            source_witness is None
            or source_witness.object_sha256 != object_sha256
        ):
            return
        # A same-device replica is a hard link. Creating it legitimately
        # changes the source inode ctime while preserving identical bytes, so
        # revalidate the digest and refresh that identity instead of treating
        # link-count metadata as semantic drift.
        source_store._verify_materialized_object_boundary(
            object_path=source_witness.object_path,
            object_sha256=object_sha256,
        )
        refreshed_source = replace(
            source_witness,
            object_identity=_file_identity(source_witness.object_path),
        )
        with source_store._candidate_page_semantic_witness_lock:
            source_store._candidate_sealed_semantic_witnesses[
                object_sha256
            ] = refreshed_source
        resolved_path = object_path.expanduser().resolve()
        target_witness = replace(
            refreshed_source,
            object_path=resolved_path,
            object_identity=_file_identity(resolved_path),
        )
        with self._candidate_page_semantic_witness_lock:
            self._candidate_sealed_semantic_witnesses[
                object_sha256
            ] = target_witness

    def _replicate_validated_immutable_page_closure_boundary(
        self,
        source_store: "NoNEImmutablePageStore",
        object_sha256: str,
    ) -> None:
        """Reuse semantic admission work from another store for an identical object."""

        source_authority = source_store._accepted_generation_manifest_identity_boundary()
        with source_store._validated_immutable_page_closure_cache_lock:
            source_candidates = tuple(
                admission
                for key, admission in source_store._validated_immutable_page_closure_cache.items()
                if key.authority == source_authority and key.object_sha256 == object_sha256
            )
        if not source_candidates:
            return

        target_authority = self._accepted_generation_manifest_identity_boundary()

        for source_admission in source_candidates:
            def _resolve_object(
                authorized: _NoNEAuthorizedSemanticObject,
            ) -> _NoNEAuthorizedSemanticObject:
                target_path = self._object_path_boundary(
                    authorized.object_sha256,
                    expected_bytes=authorized.object_bytes,
                )
                return _NoNEAuthorizedSemanticObject(
                    page_id=authorized.page_id,
                    object_sha256=authorized.object_sha256,
                    object_bytes=authorized.object_bytes,
                    object_path=target_path,
                    object_identity=_file_identity(target_path),
                )
            
            try:
                target_admission = _NoNERev6SemanticAdmission(
                    child=_resolve_object(source_admission.child),
                    dependency_closure=tuple(
                        _resolve_object(dep) for dep in source_admission.dependency_closure
                    ),
                )
            except OSError:
                continue

            self._admit_validated_immutable_page_closure_boundary(
                authority=target_authority,
                admission=target_admission,
            )

    def _verify_trained_layer_checkpoint_boundary(
        self,
        *,
        packet: NoNELayerPageImportPacket,
        source_generation: NoNEGenerationBinding,
        source_manifest: Mapping[str, Any],
    ) -> None:
        """Verify a branch checkpoint, sidecar, and cold-reload proof as one unit."""

        checkpoint_path = Path(packet.source_checkpoint_path).resolve()
        optimizer_path = Path(packet.source_optimizer_path).resolve()
        external_state_path = Path(packet.source_external_state_path).resolve()
        cold_reload_path = Path(packet.cold_reload_proof_path).resolve()
        if not all(
            path.is_file()
            for path in (
                checkpoint_path,
                optimizer_path,
                external_state_path,
                cold_reload_path,
            )
        ):
            raise RuntimeError("NoNE layer branch artifact set is incomplete")

        checkpoint_sha256 = _file_sha256(checkpoint_path)
        optimizer_sha256 = _file_sha256(optimizer_path)
        components = source_manifest.get("components")
        model_component = (
            components.get("model") if isinstance(components, dict) else None
        )
        optimizer_component = (
            components.get("optimizer") if isinstance(components, dict) else None
        )
        if (
            not isinstance(model_component, dict)
            or model_component.get("sha256") != checkpoint_sha256
            or not isinstance(optimizer_component, dict)
            or optimizer_component.get("sha256") != optimizer_sha256
        ):
            raise RuntimeError("NoNE layer branch checkpoint identity differs")

        sidecar = _read_json(external_state_path)
        external_state = sidecar.get("externalState")
        generation_record = (
            external_state.get("generationBinding")
            if isinstance(external_state, dict)
            else None
        )
        training_record = (
            external_state.get("trainingProof")
            if isinstance(external_state, dict)
            else None
        )
        declared_store_root = (
            external_state.get("storeRoot")
            if isinstance(external_state, dict)
            else None
        )
        proof = packet.training_proof
        proof_page_ids = proof.family_page_ids_t.detach().cpu().long().tolist()
        expected_training_fields: dict[str, object] = {
            "trainingPageIds": proof_page_ids,
            "familyPageIds": proof_page_ids,
            "routeCounts": proof.route_count_t.detach().cpu().long().tolist(),
            "gradientUpdateCounts": (
                proof.gradient_update_count_t.detach().cpu().long().tolist()
            ),
            "gradientNorms": proof.gradient_norm_t.detach().cpu().float().tolist(),
            "parameterDeltaNorms": (
                proof.parameter_delta_norm_t.detach().cpu().float().tolist()
            ),
            "gradientSignatures": (
                proof.gradient_signature_t.detach().cpu().float().tolist()
            ),
            "routeCoverage": bool(proof.route_coverage_t.detach().cpu().bool()),
            "gradientCoverage": bool(
                proof.gradient_coverage_t.detach().cpu().bool()
            ),
            "distinctGradients": bool(
                proof.distinct_gradient_t.detach().cpu().bool()
            ),
            "finite": bool(proof.finite_t.detach().cpu().bool()),
            "promotionReady": bool(
                proof.promotion_ready_t.detach().cpu().bool()
            ),
        }
        expected_generation_record = source_generation.external_record_boundary()
        if (
            sidecar.get("schema")
            != "nnf.resynthesis.additive_external_checkpoint_binding.v1"
            or sidecar.get("checkpointSha256") != checkpoint_sha256
            or sidecar.get("optimizerSha256") != optimizer_sha256
            or not isinstance(external_state, dict)
            or not isinstance(declared_store_root, str)
            or not declared_store_root
            or not Path(declared_store_root).expanduser().is_absolute()
            or generation_record != expected_generation_record
            or not isinstance(training_record, dict)
            or training_record.get("schema")
            != "nnf.resynthesis.none_family_training_proof.v1"
            or training_record.get("trainingPageCount") != len(proof_page_ids)
            or any(
                training_record.get(name) != expected
                for name, expected in expected_training_fields.items()
            )
        ):
            raise RuntimeError("NoNE layer branch external binding differs")

        cold_reload = _read_json(cold_reload_path)
        cold_checks = cold_reload.get("checks")
        cold_checkpoint = cold_reload.get("sourceCheckpoint")
        cold_external = cold_reload.get("externalState")
        training_heldout_gain = cold_reload.get("trainingHeldoutGain")
        knowledge_retention = cold_reload.get("knowledgeRetention")
        full_prompt_knowledge = cold_reload.get("fullPromptKnowledge")
        model_trace = cold_reload.get("modelOwnedTrace")
        training_record_sha256 = hashlib.sha256(
            _canonical_json_bytes(training_record)
        ).hexdigest()
        heldout_gain_t = packet.heldout_gain_t.detach().cpu().float().reshape(())
        training_heldout_delta = (
            training_heldout_gain.get("passRateDelta")
            if isinstance(training_heldout_gain, dict)
            else None
        )
        training_heldout_gain_t = (
            heldout_gain_t.new_tensor(float(training_heldout_delta))
            if isinstance(training_heldout_delta, (int, float))
            and not isinstance(training_heldout_delta, bool)
            else heldout_gain_t.new_full((), float("nan"))
        )
        cold_retention_delta = (
            knowledge_retention.get("passRateDelta")
            if isinstance(knowledge_retention, dict)
            else None
        )
        cold_retention_delta_t = (
            heldout_gain_t.new_tensor(float(cold_retention_delta))
            if isinstance(cold_retention_delta, (int, float))
            and not isinstance(cold_retention_delta, bool)
            else heldout_gain_t.new_full((), float("nan"))
        )
        if (
            cold_reload.get("schema")
            != "nnf.resynthesis.cold_reload_promotion_proof.v1"
            or cold_reload.get("passed") is not True
            or cold_reload.get("freshModelInstance") is not True
            or not isinstance(cold_checks, dict)
            or not cold_checks
            or any(value is not True for value in cold_checks.values())
            or not isinstance(cold_checkpoint, dict)
            or Path(str(cold_checkpoint.get("path", ""))).resolve()
            != checkpoint_path
            or cold_checkpoint.get("sha256") != checkpoint_sha256
            or not isinstance(cold_external, dict)
            or Path(str(cold_external.get("path", ""))).resolve()
            != external_state_path
            or cold_external.get("sha256") != _file_sha256(external_state_path)
            or cold_reload.get("pagedNoNETrainingProofSha256")
            != training_record_sha256
            or not isinstance(training_heldout_gain, dict)
            or training_heldout_gain.get("retentionVerified") is not True
            or not torch.isfinite(training_heldout_gain_t)
            or not training_heldout_gain_t.gt(0)
            or not torch.isclose(
                training_heldout_gain_t.reshape(()),
                heldout_gain_t.reshape(()),
            )
            or not isinstance(knowledge_retention, dict)
            or knowledge_retention.get("retentionVerified") is not True
            or not torch.isfinite(cold_retention_delta_t)
            or cold_retention_delta_t.lt(0)
            or not isinstance(full_prompt_knowledge, dict)
            or full_prompt_knowledge.get("fullPromptCoverageVerified") is not True
            or not isinstance(model_trace, dict)
            or model_trace.get("promotionTraceVerified") is not True
        ):
            raise RuntimeError("NoNE layer branch cold-reload proof differs")

    def import_trained_layer_page_objects_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        packets: tuple[NoNELayerPageImportPacket, ...],
        target_page_ids_t: torch.Tensor,
        target_layer_ids_t: torch.Tensor,
    ) -> NoNELayerPageImportResultPacket:
        """Import disjoint, retained layer branches without moving authority.

        Independently trained layers may originate from older or newer
        immutable generations.  Their page objects are content-addressed and
        therefore portable, but only changed pages with model-owned route and
        gradient proof may cross the boundary.  The caller still stages every
        imported object in one ordinary generation transaction, so accepted
        authority advances atomically after the merged checkpoint is durable.
        """

        self._require_staged_read_only_write_guard_boundary()
        target_session_id_t, _target_session_root = self._require_session()
        if not packets or len(source_stores) != len(packets):
            raise ValueError("NoNE layer import requires one store per branch")
        target_page_ids = target_page_ids_t.detach().cpu().long()
        target_layer_ids = target_layer_ids_t.detach().cpu().long()
        if (
            target_page_ids.ndim != 1
            or target_layer_ids.shape != target_page_ids.shape
            or target_page_ids.numel() < 1
            or torch.unique(target_page_ids).numel() != target_page_ids.numel()
        ):
            raise ValueError("NoNE target layer catalog is malformed")

        selected_page_ids: list[torch.Tensor] = []
        selected_proofs: list[NoNEPageTrainingProofPacket] = []
        verified_rows: list[
            tuple[NoNEImmutablePageStore, NoNEPageObjectBinding]
        ] = []
        for source_store, packet in zip(source_stores, packets, strict=True):
            source_generation = packet.source_generation
            verified_generation = source_store.verify_generation_boundary(
                generation_t=source_generation.generation_t,
                manifest_payload_sha256_t=(
                    source_generation.manifest_payload_sha256_t
                ),
                manifest_sha256_t=source_generation.manifest_sha256_t,
            )
            if (
                not torch.equal(
                    verified_generation.session_id_t,
                    target_session_id_t,
                )
                or not torch.equal(
                    verified_generation.parent_generation_t,
                    source_generation.parent_generation_t.detach().cpu().long(),
                )
                or not torch.equal(
                    verified_generation.updated_page_ids_t,
                    source_generation.updated_page_ids_t.detach().cpu().long(),
                )
            ):
                raise RuntimeError("NoNE layer import lineage differs")

            page_ids = packet.page_ids_t.detach().cpu().long()
            page_layer_ids = packet.page_layer_ids_t.detach().cpu().long()
            layer_id = packet.layer_id_t.detach().cpu().long().reshape(-1)
            if (
                page_ids.ndim != 1
                or page_ids.numel() < 1
                or page_layer_ids.shape != page_ids.shape
                or layer_id.shape != (1,)
                or torch.unique(page_ids).numel() != page_ids.numel()
                or not page_layer_ids.eq(layer_id.reshape(())).all()
            ):
                raise RuntimeError("NoNE layer import identity is malformed")
            source_updated_ids = verified_generation.updated_page_ids_t
            if not page_ids.unsqueeze(1).eq(source_updated_ids.unsqueeze(0)).any(
                dim=1
            ).all():
                raise RuntimeError(
                    "NoNE layer import includes a page not changed by its branch"
                )
            target_matches = page_ids.unsqueeze(1).eq(
                target_page_ids.unsqueeze(0)
            )
            if not target_matches.any(dim=1).all():
                raise RuntimeError("NoNE imported page is absent from target catalog")
            target_indexes = target_matches.to(dtype=torch.long).argmax(dim=1)
            if not torch.equal(
                target_layer_ids.index_select(0, target_indexes),
                page_layer_ids,
            ):
                raise RuntimeError("NoNE imported page changed layer ownership")

            proof = packet.training_proof
            proof_page_ids = proof.family_page_ids_t.detach().cpu().long()
            proof_page_count = proof_page_ids.numel()
            if (
                proof_page_ids.ndim != 1
                or proof_page_count < page_ids.numel()
                or torch.unique(proof_page_ids).numel() != proof_page_count
                or proof.route_count_t.shape != (proof_page_count,)
                or proof.gradient_update_count_t.shape != (proof_page_count,)
                or proof.gradient_norm_t.shape != (proof_page_count,)
                or proof.parameter_delta_norm_t.shape != (proof_page_count,)
                or proof.gradient_signature_t.ndim != 2
                or proof.gradient_signature_t.shape[0] != proof_page_count
                or not proof.route_count_t.gt(0).all()
                or not proof.gradient_update_count_t.gt(0).all()
                or not proof.gradient_norm_t.gt(0).all()
                or not proof.parameter_delta_norm_t.gt(0).all()
                or not torch.isfinite(proof.gradient_signature_t).all()
                or not bool(proof.route_coverage_t.detach().cpu().reshape(()))
                or not bool(proof.gradient_coverage_t.detach().cpu().reshape(()))
                or not bool(proof.distinct_gradient_t.detach().cpu().reshape(()))
                or not bool(proof.finite_t.detach().cpu().reshape(()))
                or not bool(proof.promotion_ready_t.detach().cpu().reshape(()))
            ):
                raise RuntimeError("NoNE layer import lacks retained training proof")
            proof_matches = page_ids.unsqueeze(1).eq(
                proof_page_ids.unsqueeze(0)
            )
            if not proof_matches.sum(dim=1).eq(1).all():
                raise RuntimeError("NoNE layer import training proof IDs differ")
            proof_indexes = proof_matches.to(dtype=torch.long).argmax(dim=1)
            selected_proof = combine_page_training_proofs(
                (
                    NoNEPageTrainingProofPacket(
                        family_page_ids_t=proof_page_ids.index_select(
                            0,
                            proof_indexes,
                        ),
                        route_count_t=proof.route_count_t.index_select(
                            0,
                            proof_indexes.to(device=proof.route_count_t.device),
                        ),
                        gradient_update_count_t=(
                            proof.gradient_update_count_t.index_select(
                                0,
                                proof_indexes.to(
                                    device=proof.gradient_update_count_t.device
                                ),
                            )
                        ),
                        gradient_norm_t=proof.gradient_norm_t.index_select(
                            0,
                            proof_indexes.to(device=proof.gradient_norm_t.device),
                        ),
                        parameter_delta_norm_t=(
                            proof.parameter_delta_norm_t.index_select(
                                0,
                                proof_indexes.to(
                                    device=proof.parameter_delta_norm_t.device
                                ),
                            )
                        ),
                        gradient_signature_t=(
                            proof.gradient_signature_t.index_select(
                                0,
                                proof_indexes.to(
                                    device=proof.gradient_signature_t.device
                                ),
                            )
                        ),
                        route_coverage_t=proof.route_coverage_t,
                        gradient_coverage_t=proof.gradient_coverage_t,
                        distinct_gradient_t=proof.distinct_gradient_t,
                        finite_t=proof.finite_t,
                        promotion_ready_t=proof.promotion_ready_t,
                    ),
                )
            )
            if not bool(
                selected_proof.promotion_ready_t.detach().cpu().reshape(())
            ):
                raise RuntimeError(
                    "NoNE selected layer pages lack retained training proof"
                )
            heldout_gain_t = packet.heldout_gain_t.detach().cpu().float().reshape(-1)
            anti_forgetting_t = (
                packet.anti_forgetting_retained_t.detach().cpu().bool().reshape(-1)
            )
            cold_reload_t = (
                packet.cold_reload_verified_t.detach().cpu().bool().reshape(-1)
            )
            if (
                heldout_gain_t.shape != (1,)
                or anti_forgetting_t.shape != (1,)
                or cold_reload_t.shape != (1,)
                or not torch.isfinite(heldout_gain_t).all()
                or not heldout_gain_t.gt(0).all()
                or not anti_forgetting_t.all()
                or not cold_reload_t.all()
            ):
                raise RuntimeError("NoNE layer import lacks retained knowledge gain")

            _loaded_binding, source_manifest = (
                source_store._load_generation_binding_boundary(
                    verified_generation.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        verified_generation.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        verified_generation.manifest_payload_sha256_t
                    ),
                )
            )
            source_components = source_manifest.get("components")
            source_training_proof = (
                source_components.get("trainingProof")
                if isinstance(source_components, dict)
                else None
            )
            expected_training_proof_sha256 = _tensor_digest_hex(
                page_training_proof_digest_t_boundary(proof)
            )
            if (
                not isinstance(source_training_proof, dict)
                or source_training_proof.get("sha256")
                != expected_training_proof_sha256
            ):
                raise RuntimeError(
                    "NoNE layer import training proof is not generation-bound"
                )
            source_store._verify_trained_layer_checkpoint_boundary(
                packet=packet,
                source_generation=source_generation,
                source_manifest=source_manifest,
            )
            raw_rows = source_manifest.get("pageObjects")
            if not isinstance(raw_rows, list):
                raise RuntimeError("NoNE source layer page catalog is malformed")
            source_rows = {
                int(row["pageId"]): row
                for row in raw_rows
                if isinstance(row, dict)
            }
            for page_id_t in page_ids:
                page_id = int(page_id_t)
                row = source_rows.get(page_id)
                if (
                    not isinstance(row, dict)
                    or not isinstance(row.get("sha256"), str)
                    or not isinstance(row.get("bytes"), int)
                ):
                    raise RuntimeError("NoNE imported page object is absent")
                verified_rows.append(
                    (
                        source_store,
                        NoNEPageObjectBinding(
                            page_id_t=page_id_t.reshape(()),
                            object_sha256_t=digest_tensor(str(row["sha256"])),
                            object_bytes_t=torch.tensor(
                                int(row["bytes"]),
                                dtype=torch.long,
                            ),
                        ),
                    )
                )
            selected_page_ids.append(page_ids)
            selected_proofs.append(selected_proof)

        all_page_ids = torch.cat(selected_page_ids, dim=0)
        if torch.unique(all_page_ids).numel() != all_page_ids.numel():
            raise RuntimeError("NoNE layer branches update the same page")
        merged_proof = combine_page_training_proofs(tuple(selected_proofs))
        if not bool(merged_proof.promotion_ready_t.detach().cpu().reshape(())):
            raise RuntimeError("NoNE merged layer gradients are not distinct")
        return NoNELayerPageImportResultPacket(
            page_objects=tuple(
                self.replicate_page_object_from_boundary(source_store, binding)
                for source_store, binding in sorted(
                    verified_rows,
                    key=lambda row: int(row[1].page_id_t),
                )
            ),
            training_proof=merged_proof,
        )

    def _semantic_page_pack_write_root_boundary(self) -> Path:
        """Return the active placement root that owns relative pack locators."""

        self._validated_page_object_write_roots_boundary()
        placement = self._object_write_placement
        write_root = (
            placement.write_root if placement is not None else self.root
        )
        resolved = write_root.expanduser().resolve()
        if not resolved.is_dir():
            raise RuntimeError("NoNE semantic page pack write root differs")
        return resolved

    def _semantic_pack_locator_from_manifest_row_boundary(
        self,
        row: Mapping[str, Any],
    ) -> tuple[
        _NoNESemanticPagePackLocatorPacket,
        _NoNESemanticPagePackEntryPacket,
    ]:
        """Resolve one validated relative row beneath its placement root."""

        _validate_semantic_page_pack_manifest_row_boundary(row)
        locator = cast(dict[str, Any], row["semanticPack"])
        write_root = self._semantic_page_pack_write_root_boundary()
        pack_path = (
            write_root / cast(str, locator["relativePath"])
        ).resolve()
        if (
            not pack_path.is_relative_to(write_root)
            or pack_path.parent
            != (write_root / "semantic-packs" / "sha256").resolve()
        ):
            raise RuntimeError(
                "NoNE semantic page pack locator escaped its write root"
            )
        pack_page_ids = cast(list[int], locator["packPageIds"])
        pack_object_sha256s = cast(
            list[str],
            locator["packObjectSha256s"],
        )
        pack_object_bytes = cast(
            list[int],
            locator["packObjectBytes"],
        )
        packet = _NoNESemanticPagePackLocatorPacket(
            pack_path=pack_path,
            pack_sha256_t=digest_tensor(str(locator["packSha256"])),
            table_sha256_t=digest_tensor(str(locator["tableSha256"])),
            pack_bytes_t=torch.tensor(
                int(locator["packBytes"]),
                dtype=torch.long,
            ),
            alignment_bytes_t=torch.tensor(
                int(locator["alignmentBytes"]),
                dtype=torch.long,
            ),
            page_ids_t=torch.tensor(pack_page_ids, dtype=torch.long),
            object_sha256s_t=torch.stack(
                tuple(
                    digest_tensor(object_sha256)
                    for object_sha256 in pack_object_sha256s
                )
            ),
            object_bytes_t=torch.tensor(
                pack_object_bytes,
                dtype=torch.long,
            ),
            direct_durable_t=torch.tensor(
                bool(locator["directDurable"]),
                dtype=torch.bool,
            ),
            rate_eligible_t=torch.tensor(
                bool(locator["rateEligible"]),
                dtype=torch.bool,
            ),
        )
        entry = _NoNESemanticPagePackEntryPacket(
            page_id_t=torch.tensor(int(row["pageId"]), dtype=torch.long),
            object_sha256_t=digest_tensor(str(row["sha256"])),
            object_bytes_t=torch.tensor(
                int(row["bytes"]),
                dtype=torch.long,
            ),
            raw_low_offset_t=torch.tensor(
                int(locator["rawLowOffset"]),
                dtype=torch.long,
            ),
            raw_low_bytes_t=torch.tensor(
                int(locator["rawLowBytes"]),
                dtype=torch.long,
            ),
            semantic_frame_offset_t=torch.tensor(
                int(locator["semanticFrameOffset"]),
                dtype=torch.long,
            ),
            semantic_frame_bytes_t=torch.tensor(
                int(locator["semanticFrameBytes"]),
                dtype=torch.long,
            ),
            semantic_bytes_t=torch.tensor(
                int(locator["semanticBytes"]),
                dtype=torch.long,
            ),
        )
        return packet, entry

    def _semantic_pack_row_payloads_boundary(
        self,
        rows: tuple[Mapping[str, Any], ...],
    ) -> dict[int, torch.Tensor]:
        """Decode each referenced pack once and return exact in-memory objects."""

        grouped: dict[
            tuple[Path, str],
            list[
                tuple[
                    Mapping[str, Any],
                    _NoNESemanticPagePackLocatorPacket,
                    _NoNESemanticPagePackEntryPacket,
                ]
            ],
        ] = {}
        for row in rows:
            locator, entry = (
                self._semantic_pack_locator_from_manifest_row_boundary(row)
            )
            key = (
                locator.pack_path,
                _tensor_digest_hex(locator.pack_sha256_t),
            )
            grouped.setdefault(key, []).append((row, locator, entry))
        payloads: dict[int, torch.Tensor] = {}
        for (pack_path, pack_sha256), packed_rows in grouped.items():
            locator = packed_rows[0][1]
            if any(
                not torch.equal(candidate[1].page_ids_t, locator.page_ids_t)
                or not torch.equal(
                    candidate[1].object_sha256s_t,
                    locator.object_sha256s_t,
                )
                or not torch.equal(
                    candidate[1].object_bytes_t,
                    locator.object_bytes_t,
                )
                or not torch.equal(
                    candidate[1].table_sha256_t,
                    locator.table_sha256_t,
                )
                or not torch.equal(
                    candidate[1].pack_bytes_t,
                    locator.pack_bytes_t,
                )
                for candidate in packed_rows[1:]
            ):
                raise RuntimeError(
                    "NoNE semantic page pack rows disagree"
                )
            decoded = _read_none_semantic_page_pack_boundary(
                locator,
                _expected_entries=tuple(
                    candidate[2] for candidate in packed_rows
                ),
            )
            decoded_page_ids = decoded.page_ids_t.detach().cpu().long()
            offsets = decoded.object_offsets_t.detach().cpu().long()
            for row, _row_locator, _entry in packed_rows:
                page_id = int(row["pageId"])
                matches_t = decoded_page_ids.eq(page_id).nonzero(
                    as_tuple=False
                ).reshape(-1)
                if matches_t.shape != (1,):
                    raise RuntimeError(
                        "NoNE semantic page pack page identity is ambiguous"
                    )
                index = int(matches_t[0])
                payload_t = decoded.object_payload_t[
                    int(offsets[index]) : int(offsets[index + 1])
                ].clone()
                if (
                    payload_t.numel() != int(row["bytes"])
                    or hashlib.sha256(payload_t.numpy().tobytes()).hexdigest()
                    != str(row["sha256"])
                ):
                    raise RuntimeError(
                        "NoNE semantic page pack object identity differs"
                    )
                payloads[page_id] = payload_t
            identity = _file_identity(pack_path)
            self._verified_semantic_pack_identities_boundary[pack_path] = (
                identity,
                pack_sha256,
            )
        return payloads

    def _prepared_candidate_from_scratch_boundary(
        self,
        binding: NoNECandidatePageScratchBinding,
    ) -> NoNEPreparedCandidatePagePacket:
        """Lift one owner-fenced legacy scratch path into the pure packet."""

        page_id, scratch_path, object_bytes = (
            self._validated_candidate_scratch_path_boundary(binding)
        )
        payload = scratch_path.read_bytes()
        if len(payload) != object_bytes:
            raise RuntimeError("NoNE candidate scratch read was incomplete")
        handle = _NoNEInMemorySafeTensorHandleBoundary(load(payload))
        revision = self._page_format_revision_boundary(handle)
        dependency = (
            self._validated_page_delta_dependency_from_handle_boundary(
                handle,
                expected_page_id=page_id,
            )
        )
        common = {
            "page_id_t": binding.page_id_t.detach()
            .cpu()
            .long()
            .reshape(())
            .clone(),
            "object_sha256_t": binding.object_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(-1)
            .clone(),
            "object_bytes_t": binding.object_bytes_t.detach()
            .cpu()
            .long()
            .reshape(())
            .clone(),
            "object_payload_t": torch.frombuffer(
                bytearray(payload),
                dtype=torch.uint8,
            ).clone(),
            "format_revision_t": torch.tensor(revision, dtype=torch.long),
        }
        if dependency is None:
            packet = NoNEPreparedCandidatePagePacket(
                **common,
                dependency_present_t=torch.tensor(False),
                base_generation_t=torch.tensor(-1, dtype=torch.long),
                base_manifest_payload_sha256_t=torch.empty(
                    0,
                    dtype=torch.uint8,
                ),
                base_object_sha256_t=torch.empty(0, dtype=torch.uint8),
                base_object_bytes_t=torch.tensor(0, dtype=torch.long),
            )
        else:
            packet = NoNEPreparedCandidatePagePacket(
                **common,
                dependency_present_t=torch.tensor(True),
                base_generation_t=dependency.generation_t.detach()
                .cpu()
                .long()
                .reshape(())
                .clone(),
                base_manifest_payload_sha256_t=(
                    dependency.manifest_payload_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .reshape(-1)
                    .clone()
                ),
                base_object_sha256_t=(
                    dependency.object.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .reshape(-1)
                    .clone()
                ),
                base_object_bytes_t=(
                    dependency.object.object_bytes_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                    .clone()
                ),
            )
        self._validated_prepared_candidate_page_boundary(packet)
        return packet

    def _ordered_semantic_pack_sources_boundary(
        self,
        ordered_page_sources: tuple[
            NoNEPreparedCandidatePagePacket
            | NoNECandidatePageScratchBinding,
            ...,
        ],
    ) -> tuple[
        tuple[NoNEPreparedCandidatePagePacket, ...],
        tuple[_NoNESemanticPagePackSourceBoundary, ...],
    ]:
        """Validate one branch transaction and expose its exact bytes once."""

        if not ordered_page_sources:
            raise ValueError("NoNE semantic page pack transaction is empty")
        prepared = tuple(
            (
                source
                if isinstance(source, NoNEPreparedCandidatePagePacket)
                else self._prepared_candidate_from_scratch_boundary(source)
            )
            for source in ordered_page_sources
        )
        page_ids = tuple(
            int(packet.page_id_t.detach().cpu().long().reshape(()))
            for packet in prepared
        )
        if page_ids != tuple(sorted(set(page_ids))):
            raise ValueError(
                "NoNE semantic page pack transaction must be strictly ordered"
            )
        sources: list[_NoNESemanticPagePackSourceBoundary] = []
        current = self.current_generation_binding_boundary()
        parent_rows = self._page_index()
        for packet in prepared:
            payload, dependency = (
                self._validated_prepared_candidate_page_boundary(packet)
            )
            page_id = int(packet.page_id_t)
            if dependency is not None:
                parent_row = parent_rows.get(page_id)
                if (
                    not torch.equal(
                        dependency.generation_t.detach()
                        .cpu()
                        .long()
                        .reshape(()),
                        current.generation_t.detach()
                        .cpu()
                        .long()
                        .reshape(()),
                    )
                    or not torch.equal(
                        dependency.manifest_payload_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(-1),
                        current.manifest_payload_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(-1),
                    )
                    or not isinstance(parent_row, dict)
                    or parent_row.get("sha256")
                    != _tensor_digest_hex(
                        dependency.object.object_sha256_t
                    )
                    or parent_row.get("bytes")
                    != int(dependency.object.object_bytes_t)
                ):
                    raise RuntimeError(
                        "NoNE semantic pack delta is not based on the "
                        "accepted parent"
                    )
            sources.append(
                _NoNESemanticPagePackSourceBoundary(
                    object=NoNEPageObjectBinding(
                        page_id_t=packet.page_id_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                        .clone(),
                        object_sha256_t=packet.object_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(-1)
                        .clone(),
                        object_bytes_t=packet.object_bytes_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                        .clone(),
                    ),
                    object_payload=payload,
                )
            )
        return prepared, tuple(sources)

    @staticmethod
    def _semantic_pack_manifest_rows_boundary(
        *,
        prepared: tuple[NoNEPreparedCandidatePagePacket, ...],
        build: _NoNESemanticPagePackBuildBoundary,
        durable: _NoNESemanticPagePackDurableBoundary,
        receipt: _NoNESemanticPagePackPerformanceReceiptPacket,
        write_root: Path,
    ) -> tuple[dict[str, Any], ...]:
        """Build complete relative locators for every packed page row."""

        relative_path = str(
            durable.locator.pack_path.relative_to(write_root)
        )
        pack_page_ids = (
            durable.locator.page_ids_t.detach().cpu().long().tolist()
        )
        pack_object_sha256s = [
            _tensor_digest_hex(digest_t)
            for digest_t in durable.locator.object_sha256s_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
        ]
        pack_object_bytes = (
            durable.locator.object_bytes_t.detach().cpu().long().tolist()
        )
        rows: list[dict[str, Any]] = []
        for packet, entry in zip(
            prepared,
            build.entries,
            strict=True,
        ):
            page_id = int(packet.page_id_t)
            object_sha256 = _tensor_digest_hex(packet.object_sha256_t)
            object_bytes = int(packet.object_bytes_t)
            dependency: dict[str, Any] = {"present": False}
            if bool(packet.dependency_present_t):
                dependency = {
                    "present": True,
                    "baseGeneration": int(packet.base_generation_t),
                    "baseManifestPayloadSha256": _tensor_digest_hex(
                        packet.base_manifest_payload_sha256_t
                    ),
                    "baseObjectSha256": _tensor_digest_hex(
                        packet.base_object_sha256_t
                    ),
                    "baseObjectBytes": int(packet.base_object_bytes_t),
                }
            row = {
                "pageId": page_id,
                "sha256": object_sha256,
                "bytes": object_bytes,
                "semanticPack": {
                    "schema": NONE_SEMANTIC_PAGE_PACK_LOCATOR_SCHEMA,
                    "relativePath": relative_path,
                    "packSha256": _tensor_digest_hex(
                        durable.locator.pack_sha256_t
                    ),
                    "tableSha256": _tensor_digest_hex(
                        durable.locator.table_sha256_t
                    ),
                    "packBytes": int(durable.locator.pack_bytes_t),
                    "alignmentBytes": int(
                        durable.locator.alignment_bytes_t
                    ),
                    "packPageIds": pack_page_ids,
                    "packObjectSha256s": pack_object_sha256s,
                    "packObjectBytes": pack_object_bytes,
                    "pageId": page_id,
                    "objectSha256": object_sha256,
                    "objectBytes": object_bytes,
                    "rawLowOffset": int(
                        entry.packet.raw_low_offset_t
                    ),
                    "rawLowBytes": int(entry.packet.raw_low_bytes_t),
                    "semanticFrameOffset": int(
                        entry.packet.semantic_frame_offset_t
                    ),
                    "semanticFrameBytes": int(
                        entry.packet.semantic_frame_bytes_t
                    ),
                    "semanticBytes": int(
                        entry.packet.semantic_bytes_t
                    ),
                    "dependency": dependency,
                    "directDurable": bool(receipt.direct_durable_t),
                    "directColdRead": bool(receipt.direct_cold_read_t),
                    "rateEligible": bool(receipt.rate_eligible_t),
                },
            }
            _validate_semantic_page_pack_manifest_row_boundary(row)
            rows.append(row)
        return tuple(rows)

    def stage_generation_from_semantic_page_pack_boundary(
        self,
        *,
        ordered_page_sources: tuple[
            NoNEPreparedCandidatePagePacket
            | NoNECandidatePageScratchBinding,
            ...,
        ],
        components: NoNEGenerationComponentPacket,
        expected_generation_t: torch.Tensor | None = None,
        training_proven_page_ids_t: torch.Tensor | None = None,
    ) -> NoNEGenerationBinding:
        """Write one branch pack, cold-prove it, then stage one generation."""

        self._require_staged_read_only_write_guard_boundary()
        self._acquire_generation_writer_boundary()
        try:
            if self._accepted_direct_page_map_authority_active_boundary():
                raise RuntimeError(
                    "NoNE direct-only lineage cannot stage semantic-pack "
                    "authority"
                )
            prepared, sources = self._ordered_semantic_pack_sources_boundary(
                ordered_page_sources
            )
            build = _encode_none_semantic_page_pack_boundary(
                sources,
                alignment=4096,
            )
            write_root = self._semantic_page_pack_write_root_boundary()
            semantic_root = write_root / "semantic-packs"
            pack_root = semantic_root / "sha256"
            semantic_root.mkdir(exist_ok=True)
            pack_root.mkdir(exist_ok=True)
            _fsync_directory(pack_root)
            _fsync_directory(semantic_root)
            _fsync_directory(write_root)
            durable = _write_none_semantic_page_pack_boundary(
                build,
                pack_root=pack_root,
            )
            receipt = _cold_reopen_none_semantic_page_pack_boundary(
                build,
                durable,
            )
            if (
                int(receipt.exact_object_count_t)
                != len(ordered_page_sources)
                or int(receipt.page_count_t) != len(ordered_page_sources)
            ):
                raise RuntimeError(
                    "NoNE semantic page pack cold verification is incomplete"
                )
            pack_path = durable.locator.pack_path.resolve()
            self._verified_semantic_pack_identities_boundary[pack_path] = (
                _file_identity(pack_path),
                _tensor_digest_hex(durable.locator.pack_sha256_t),
            )
            rows = self._semantic_pack_manifest_rows_boundary(
                prepared=prepared,
                build=build,
                durable=durable,
                receipt=receipt,
                write_root=write_root,
            )
            return self._stage_generation_from_page_objects_locked_boundary(
                updated_page_objects=(),
                prevalidated_updated_rows=rows,
                components=components,
                expected_generation_t=expected_generation_t,
                training_proven_page_ids_t=training_proven_page_ids_t,
            )
        except Exception:
            self._release_generation_writer_boundary()
            raise

    def stage_generation(
        self,
        *,
        updated_pages: NoNEPageBundle,
        components: NoNEGenerationComponentPacket,
        expected_generation_t: torch.Tensor | None = None,
        training_proven_page_ids_t: torch.Tensor | None = None,
    ) -> NoNEGenerationBinding:
        """Durably stage one immutable generation without advancing authority."""

        self._require_staged_read_only_write_guard_boundary()
        self._require_session()
        validate_page_bundle(updated_pages)
        bindings: list[NoNEPageObjectBinding] = []
        for row_index in range(updated_pages.weights.page_ids_t.shape[0]):
            object_sha256, object_bytes = self._save_page_object(
                updated_pages,
                row_index,
            )
            bindings.append(
                NoNEPageObjectBinding(
                    page_id_t=(
                        updated_pages.weights.page_ids_t[row_index]
                        .detach()
                        .cpu()
                        .long()
                        .reshape(())
                    ),
                    object_sha256_t=digest_tensor(object_sha256),
                    object_bytes_t=torch.tensor(object_bytes, dtype=torch.long),
                )
            )
        return self.stage_generation_from_page_objects_boundary(
            updated_page_objects=tuple(bindings),
            components=components,
            expected_generation_t=expected_generation_t,
            training_proven_page_ids_t=training_proven_page_ids_t,
        )

    def stage_generation_from_page_objects_boundary(
        self,
        *,
        updated_page_objects: tuple[NoNEPageObjectBinding, ...],
        components: NoNEGenerationComponentPacket,
        expected_generation_t: torch.Tensor | None = None,
        training_proven_page_ids_t: torch.Tensor | None = None,
        direct_page_pack_set_authority: Mapping[str, Any] | None = None,
    ) -> NoNEGenerationBinding:
        """Stage a generation from already durable page objects in bounded memory."""

        self._require_staged_read_only_write_guard_boundary()
        self._acquire_generation_writer_boundary()
        try:
            return self._stage_generation_from_page_objects_locked_boundary(
                updated_page_objects=updated_page_objects,
                prevalidated_updated_rows=None,
                components=components,
                expected_generation_t=expected_generation_t,
                training_proven_page_ids_t=training_proven_page_ids_t,
                require_direct_page_map_authority=False,
                direct_page_pack_set_authority=(
                    direct_page_pack_set_authority
                ),
            )
        except Exception:
            self._release_generation_writer_boundary()
            raise

    def _replicate_immutable_parent_lineage_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        immutable_parent: NoNEGenerationBinding,
    ) -> tuple[
        NoNEGenerationBinding,
        dict[str, Any],
        _FileIdentity,
    ]:
        """Copy one exact immutable ancestor chain without copying its pointer."""

        destination_session_id_t, destination_session_root = (
            self._require_session()
        )
        source_session_id_t, source_session_root = (
            source_store._require_session()
        )
        if (
            self.root == source_store.root
            or not torch.equal(
                destination_session_id_t.detach().cpu().long(),
                source_session_id_t.detach().cpu().long(),
            )
            or not torch.equal(
                immutable_parent.session_id_t.detach().cpu().long(),
                destination_session_id_t.detach().cpu().long(),
            )
            or (destination_session_root / "accepted.json").exists()
        ):
            raise RuntimeError(
                "NoNE immutable-parent lineage destination differs"
            )
        source_parent, _source_parent_manifest = (
            source_store._load_generation_binding_boundary(
                immutable_parent.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    immutable_parent.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    immutable_parent.manifest_payload_sha256_t
                ),
            )
        )
        if not _same_generation_binding_boundary(
            source_parent,
            immutable_parent,
        ):
            raise RuntimeError(
                "NoNE immutable-parent lineage source changed"
            )

        session_key = _session_key(destination_session_id_t)
        source_path = (
            source_session_root / immutable_parent.manifest_relative_path
        ).resolve()
        lineage_paths: list[Path] = []
        observed_payloads: set[str] = set()
        while True:
            authority = _read_generation_lineage_authority_cached(
                source_path,
                expected_session_key=session_key,
            )
            if authority.manifest_payload_sha256 in observed_payloads:
                raise RuntimeError(
                    "NoNE immutable-parent lineage contains a cycle"
                )
            observed_payloads.add(authority.manifest_payload_sha256)
            lineage_paths.append(source_path)
            if authority.parent_generation == 0:
                if authority.parent_manifest_payload_sha256 is not None:
                    raise RuntimeError(
                        "NoNE immutable-parent genesis lineage differs"
                    )
                break
            parent_payload_sha256 = (
                authority.parent_manifest_payload_sha256
            )
            if (
                not isinstance(parent_payload_sha256, str)
                or authority.parent_generation >= authority.generation
            ):
                raise RuntimeError(
                    "NoNE immutable-parent ancestry differs"
                )
            source_path = _parent_generation_manifest_path_boundary(
                source_path,
                parent_generation=authority.parent_generation,
                parent_payload_sha256=parent_payload_sha256,
            )

        for source_manifest in reversed(lineage_paths):
            relative = source_manifest.relative_to(source_session_root)
            if (
                not relative.parts
                or relative.parts[0] != "generations"
                or relative.name != "generation.json"
            ):
                raise RuntimeError(
                    "NoNE immutable-parent manifest path differs"
                )
            target_manifest = destination_session_root / relative
            source_sha256 = _file_sha256(source_manifest)
            if target_manifest.exists():
                if (
                    target_manifest.is_symlink()
                    or not target_manifest.is_file()
                    or _file_sha256(target_manifest) != source_sha256
                ):
                    raise RuntimeError(
                        "NoNE immutable-parent lineage already differs"
                    )
                continue
            target_manifest.parent.mkdir(parents=True, exist_ok=True)
            temporary = target_manifest.with_name(
                f".{target_manifest.name}.{os.getpid()}.tmp"
            )
            temporary.unlink(missing_ok=True)
            shutil.copyfile(source_manifest, temporary)
            with temporary.open("rb") as handle:
                os.fsync(handle.fileno())
            if _file_sha256(temporary) != source_sha256:
                temporary.unlink(missing_ok=True)
                raise RuntimeError(
                    "NoNE immutable-parent manifest copy changed"
                )
            os.replace(temporary, target_manifest)
            _fsync_directory(target_manifest.parent)

        parent, parent_manifest = self._load_generation_binding_boundary(
            immutable_parent.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(
                immutable_parent.manifest_sha256_t
            ),
            expected_payload_sha256=_tensor_digest_hex(
                immutable_parent.manifest_payload_sha256_t
            ),
        )
        parent_manifest_path = (
            destination_session_root / parent.manifest_relative_path
        ).resolve()
        if (
            not _same_generation_binding_boundary(parent, immutable_parent)
            or not parent_manifest_path.is_relative_to(
                destination_session_root
            )
        ):
            raise RuntimeError(
                "NoNE immutable-parent lineage changed after replication"
            )
        return parent, parent_manifest, _file_identity(parent_manifest_path)

    def stage_generation_from_immutable_parent_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        immutable_parent: NoNEGenerationBinding,
        direct_page_objects: tuple[NoNEPageObjectBinding, ...],
        components: NoNEGenerationComponentPacket,
        training_proven_page_ids_t: torch.Tensor,
    ) -> NoNEGenerationBinding:
        """Stage one pointerless full direct rewrite over immutable ancestry.

        Historical manifests are copied solely as hash-bound lineage evidence.
        No historical accepted pointer and no historical page object is copied
        into the destination authority.  Every physical page in the staged
        generation must already be a local dependency-free direct safetensor.
        """

        self._require_staged_read_only_write_guard_boundary()
        _session_id_t, session_root = self._require_session()
        if (
            (session_root / "accepted.json").exists()
            or self._manifest is not None
            or self._accepted_binding_boundary is not None
            or int(self._accepted_generation_t) != 0
            or not direct_page_objects
        ):
            raise RuntimeError(
                "NoNE immutable-parent stage is not pointerless"
            )
        page_ids_t = torch.stack(
            tuple(
                page_object.page_id_t.detach().cpu().long().reshape(())
                for page_object in direct_page_objects
            )
        )
        if (
            torch.unique(page_ids_t).numel() != page_ids_t.numel()
            or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
        ):
            raise RuntimeError(
                "NoNE immutable-parent direct page map differs"
            )
        for page_object in direct_page_objects:
            revision = self._local_reconciled_direct_page_object_boundary(
                page_object
            )
            if revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS:
                raise RuntimeError(
                    "NoNE immutable-parent page is not direct"
                )

        self._acquire_generation_writer_boundary()
        try:
            (
                parent,
                parent_manifest,
                parent_manifest_identity,
            ) = self._replicate_immutable_parent_lineage_boundary(
                source_store=source_store,
                immutable_parent=immutable_parent,
            )
            parent_page_ids_t = self._manifest_page_ids_t_boundary(
                parent_manifest
            )
            if not torch.equal(
                page_ids_t,
                torch.sort(
                    parent_page_ids_t.detach().cpu().long().reshape(-1)
                ).values,
            ):
                raise RuntimeError(
                    "NoNE immutable-parent direct page coverage differs"
                )
            self._accepted_generation_t = (
                parent.generation_t.detach().cpu().long().reshape(())
            )
            self._accepted_binding_boundary = parent
            self._accepted_manifest_identity_boundary = (
                parent_manifest_identity
            )
            self._manifest = parent_manifest
            self._staged_immutable_parent_binding = parent
            self._staged_immutable_parent_manifest_identity = (
                parent_manifest_identity
            )
            staged = self._stage_generation_from_page_objects_locked_boundary(
                updated_page_objects=direct_page_objects,
                prevalidated_updated_rows=None,
                components=components,
                expected_generation_t=parent.generation_t + 1,
                training_proven_page_ids_t=training_proven_page_ids_t,
                require_direct_page_map_authority=True,
            )
            loaded, manifest = self._load_generation_binding_boundary(
                staged.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    staged.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    staged.manifest_payload_sha256_t
                ),
            )
            direct_objects = (
                self._require_complete_local_direct_page_map_boundary(
                    generation_binding=loaded,
                    generation_manifest=manifest,
                    expected_page_ids_t=parent_page_ids_t,
                )
            )
            if (
                not _same_generation_binding_boundary(loaded, staged)
                or tuple(
                    _tensor_digest_hex(item.object_sha256_t)
                    for item in direct_objects
                )
                != tuple(
                    _tensor_digest_hex(item.object_sha256_t)
                    for item in direct_page_objects
                )
            ):
                raise RuntimeError(
                    "NoNE immutable-parent staged direct map changed"
                )
            return staged
        except Exception:
            self._staged_immutable_parent_binding = None
            self._staged_immutable_parent_manifest_identity = None
            self._manifest = None
            self._accepted_binding_boundary = None
            self._accepted_manifest_identity_boundary = None
            self._accepted_generation_t = torch.zeros((), dtype=torch.long)
            self._release_generation_writer_boundary()
            raise

    def _stage_generation_from_page_objects_locked_boundary(
        self,
        *,
        updated_page_objects: tuple[NoNEPageObjectBinding, ...],
        components: NoNEGenerationComponentPacket,
        prevalidated_updated_rows: (
            tuple[dict[str, Any], ...] | None
        ) = None,
        expected_generation_t: torch.Tensor | None = None,
        training_proven_page_ids_t: torch.Tensor | None = None,
        require_direct_page_map_authority: bool = False,
        direct_page_pack_set_authority: Mapping[str, Any] | None = None,
    ) -> NoNEGenerationBinding:
        """Build one immutable generation while holding writer authority."""

        session_id_t, session_root = self._require_session()
        if not updated_page_objects and not prevalidated_updated_rows:
            raise ValueError("NoNE generation requires at least one updated page")
        if (session_root / "accepted.json").is_file():
            self.discover_accepted_pointer_boundary()
        accepted_generation = int(self._accepted_generation_t)
        next_generation = self._next_generation_boundary()
        generation = (
            next_generation
            if expected_generation_t is None
            else int(expected_generation_t.detach().cpu().long().reshape(()))
        )
        if generation < next_generation:
            raise RuntimeError("NoNE page generation allocation was already used")
        prior_objects: dict[int, dict[str, Any]] = {}
        if self._manifest is not None:
            raw_objects = self._manifest.get("pageObjects")
            if not isinstance(raw_objects, list):
                raise RuntimeError("accepted NoNE page catalog is malformed")
            for raw_row in raw_objects:
                if not isinstance(raw_row, dict):
                    raise RuntimeError("accepted NoNE page object row is malformed")
                prior_objects[int(raw_row["pageId"])] = dict(raw_row)
        parent_payload_sha256 = (
            self._manifest.get("manifestPayloadSha256")
            if self._manifest is not None
            else None
        )
        if (
            direct_page_pack_set_authority is not None
            and prevalidated_updated_rows is None
        ):
            prevalidated_updated_rows = tuple(
                {
                    "pageId": int(
                        binding.page_id_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                    ),
                    "sha256": _tensor_digest_hex(
                        binding.object_sha256_t
                    ),
                    "bytes": int(
                        binding.object_bytes_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                    ),
                }
                for binding in updated_page_objects
            )
        if prevalidated_updated_rows is None:
            updated_rows, semantic_admissions = (
                self._preauthorize_updated_page_semantics_boundary(
                    updated_page_objects=updated_page_objects,
                    accepted_generation=accepted_generation,
                    parent_payload_sha256=(
                        parent_payload_sha256
                        if isinstance(parent_payload_sha256, str)
                        else None
                    ),
                    parent_page_rows=prior_objects,
                )
            )
        else:
            indexed_rows = _generation_page_rows_boundary(
                list(prevalidated_updated_rows),
                label="packed updated page objects",
            )
            updated_rows = tuple(
                indexed_rows[page_id] for page_id in sorted(indexed_rows)
            )
            if tuple(
                int(row["pageId"]) for row in prevalidated_updated_rows
            ) != tuple(sorted(indexed_rows)):
                raise RuntimeError(
                    "NoNE packed updated page order differs"
                )
            semantic_admissions = ()
        updated_page_ids = tuple(int(row["pageId"]) for row in updated_rows)
        placement = self._object_write_placement
        if placement is not None and not bool(
            _page_ids_subset_t_boundary(
                torch.tensor(updated_page_ids, dtype=torch.long),
                placement.branch_scope.page_ids_t,
            )
        ):
            raise RuntimeError(
                "NoNE page generation escaped its placement branch scope"
            )
        self._validate_rev6_semantic_admission_batch_boundary(
            semantic_admissions
        )
        for row in updated_rows:
            prior_objects[int(row["pageId"])] = row
        page_rows = [prior_objects[key] for key in sorted(prior_objects)]
        inherited_training_ids: list[int] = []
        if self._manifest is not None:
            inherited_value = self._manifest.get("trainingProvenPageIds", [])
            if (
                not isinstance(inherited_value, list)
                or any(
                    not isinstance(page_id, int)
                    or isinstance(page_id, bool)
                    or page_id not in prior_objects
                    for page_id in inherited_value
                )
                or len(set(inherited_value)) != len(inherited_value)
            ):
                raise RuntimeError(
                    "accepted NoNE training-proven page authority is malformed"
                )
            inherited_training_ids = list(inherited_value)
        newly_proven_ids: list[int] = []
        if training_proven_page_ids_t is not None:
            proven_t = (
                training_proven_page_ids_t.detach().cpu().long().reshape(-1)
            )
            newly_proven_ids = [int(page_id) for page_id in proven_t]
            if (
                torch.unique(proven_t).numel() != proven_t.numel()
                or any(page_id not in prior_objects for page_id in newly_proven_ids)
            ):
                raise RuntimeError(
                    "NoNE staged training-proven page authority differs"
                )
        training_proven_page_ids = sorted(
            set(inherited_training_ids) | set(newly_proven_ids)
        )
        page_catalog_sha256 = hashlib.sha256(
            b"".join(
                _page_catalog_fragment(int(row["pageId"]), str(row["sha256"]))
                for row in page_rows
            )
        ).hexdigest()
        component_rows = _component_digest_rows(components)
        component_rows["expertPages"] = {
            "sha256": page_catalog_sha256,
        }
        parent_schema = (
            self._manifest.get("schema")
            if self._manifest is not None
            else None
        )
        parent_delta_depth = (
            _generation_manifest_delta_depth_boundary(self._manifest)
            if self._manifest is not None
            else 0
        )
        full_catalog_page_ids = tuple(
            int(row["pageId"]) for row in page_rows
        )
        complete_catalog_rewrite = (
            len(updated_page_ids) == len(full_catalog_page_ids)
            and tuple(sorted(updated_page_ids)) == full_catalog_page_ids
        )
        parent_direct_page_map_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                self._manifest
            )
            if self._manifest is not None
            else None
        )
        parent_direct_page_pack_set_authority = (
            self._local_direct_page_pack_set_authority_boundary(
                self._manifest
            )
            if self._manifest is not None
            else None
        )
        direct_page_map_authority_required = bool(
            require_direct_page_map_authority
            or parent_direct_page_map_authority is not None
            or components.training_proof_record_path is not None
            or components.reconciliation_proof_record_path is not None
        )
        emit_catalog_delta = (
            parent_schema
            in (PAGE_GENERATION_SCHEMA, PAGE_GENERATION_DELTA_SCHEMA)
            and parent_delta_depth < PAGE_GENERATION_DELTA_MAX_DEPTH
            and not complete_catalog_rewrite
            and not direct_page_map_authority_required
        )
        manifest: dict[str, Any] = {
            "schema": (
                PAGE_GENERATION_DELTA_SCHEMA
                if emit_catalog_delta
                else PAGE_GENERATION_SCHEMA
            ),
            "sessionKey": _session_key(session_id_t),
            "generation": generation,
            "parentGeneration": accepted_generation,
            "pageCount": len(page_rows),
            "updatedPageIds": list(updated_page_ids),
            "components": component_rows,
        }
        if direct_page_pack_set_authority is not None:
            if (
                not complete_catalog_rewrite
                or emit_catalog_delta
            ):
                raise RuntimeError(
                    "NoNE direct page pack-set requires one complete catalog "
                    "rewrite"
                )
            manifest["directPagePackSetAuthority"] = dict(
                direct_page_pack_set_authority
            )
        elif parent_direct_page_pack_set_authority is not None:
            raise RuntimeError(
                "NoNE accepted direct page pack-set lineage cannot regress"
            )
        if placement is not None:
            manifest.update(
                {
                    "pageObjectWritePlacementAuthoritySha256": (
                        placement.authority_sha256
                    ),
                    "pageObjectWritePlacementProofSha256": (
                        placement.placement_proof_sha256
                    ),
                }
            )
        if emit_catalog_delta:
            manifest["updatedPageObjects"] = [
                dict(row) for row in updated_rows
            ]
            manifest["catalogDeltaDepth"] = parent_delta_depth + 1
        else:
            manifest["pageObjects"] = page_rows
        if training_proven_page_ids:
            manifest["trainingProvenPageIds"] = training_proven_page_ids
        if direct_page_map_authority_required:
            if emit_catalog_delta or any(
                row.get("semanticPack") is not None
                for row in page_rows
            ):
                raise RuntimeError(
                    "NoNE direct-only lineage contains indirect page authority"
                )
            direct_page_objects = tuple(
                self._page_object_binding_from_row_boundary(row)
                for row in page_rows
            )
            trained_page_ids = frozenset(training_proven_page_ids)
            packed = self._local_direct_page_pack_set_authority_boundary(
                manifest
            )
            if packed is None:
                for page_object in direct_page_objects:
                    revision = (
                        self._local_reconciled_direct_page_object_boundary(
                            page_object
                        )
                    )
                    if (
                        int(page_object.page_id_t) in trained_page_ids
                        and revision
                        not in (
                            ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
                        )
                    ):
                        raise RuntimeError(
                            "NoNE direct-only trained page is not exact"
                        )
            else:
                trained_ids_t = torch.tensor(
                    sorted(trained_page_ids),
                    dtype=torch.long,
                )
                trained_mask_t = torch.isin(
                    packed[1].page_ids_t,
                    trained_ids_t,
                )
                if not bool(
                    torch.isin(
                        packed[1].format_revisions_t[trained_mask_t],
                        torch.tensor(
                            sorted(
                                ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
                            ),
                            dtype=torch.long,
                        ),
                    ).all()
                ):
                    raise RuntimeError(
                        "NoNE direct-only trained packed page is not exact"
                    )
            direct_page_map_record = (
                self._direct_page_map_authority_record_boundary(
                    direct_page_objects
                )
            )
            if packed is not None:
                direct_page_map_record[
                    "directPagePackSetSha256"
                ] = packed[2]["packSetSha256"]
            manifest["directPageMapAuthority"] = direct_page_map_record
        if self._manifest is not None:
            if (
                not isinstance(parent_payload_sha256, str)
                or len(parent_payload_sha256) != 64
            ):
                raise RuntimeError("accepted NoNE parent payload identity differs")
            manifest["parentManifestPayloadSha256"] = parent_payload_sha256
        manifest["manifestPayloadSha256"] = _manifest_payload_sha256(manifest)
        _fsync_directory(self._write_objects_root)
        generation_name = (
            f"generation_{generation:08d}_{manifest['manifestPayloadSha256']}"
        )
        generations_root = session_root / "generations"
        staging = generations_root / f".{generation_name}.{os.getpid()}.tmp"
        final_root = generations_root / generation_name
        if staging.exists():
            shutil.rmtree(staging)
        staging.mkdir(parents=True)
        generation_path = staging / "generation.json"
        _atomic_json(generation_path, manifest)
        _fsync_directory(staging)
        if final_root.exists():
            raise RuntimeError("NoNE immutable generation already exists")
        os.replace(staging, final_root)
        _fsync_directory(generations_root)
        final_manifest = final_root / "generation.json"
        final_manifest_sha256 = _file_sha256(final_manifest)
        # The payload digest and page index were computed from the exact
        # immutable object immediately before publication. Seed both process
        # caches now so the acceptance boundary does not canonicalize and scan
        # the full page catalog a second time for this same generation.
        final_identity = _file_identity(final_manifest)
        with _GENERATION_JSON_CACHE_LOCK:
            _GENERATION_JSON_CACHE[final_manifest] = (
                final_identity,
                final_manifest_sha256,
                manifest,
            )
            if emit_catalog_delta:
                _GENERATION_MANIFEST_AUTHORITY_CACHE.pop(
                    final_manifest,
                    None,
                )
            else:
                _GENERATION_MANIFEST_AUTHORITY_CACHE[final_manifest] = (
                    final_identity,
                    final_manifest_sha256,
                    str(manifest["manifestPayloadSha256"]),
                    {int(row["pageId"]): row for row in page_rows},
                    manifest,
                    ((final_manifest, final_identity),),
                )
            while len(_GENERATION_JSON_CACHE) > _GENERATION_JSON_CACHE_MAX_PATHS:
                _GENERATION_JSON_CACHE.pop(next(iter(_GENERATION_JSON_CACHE)))
            while (
                len(_GENERATION_MANIFEST_AUTHORITY_CACHE)
                > _GENERATION_JSON_CACHE_MAX_PATHS
            ):
                _GENERATION_MANIFEST_AUTHORITY_CACHE.pop(
                    next(iter(_GENERATION_MANIFEST_AUTHORITY_CACHE))
                )
        return NoNEGenerationBinding(
            session_id_t=session_id_t.detach().cpu().long().clone(),
            generation_t=torch.tensor(generation, dtype=torch.long),
            parent_generation_t=torch.tensor(
                accepted_generation,
                dtype=torch.long,
            ),
            manifest_sha256_t=digest_tensor(final_manifest_sha256),
            manifest_payload_sha256_t=digest_tensor(
                str(manifest["manifestPayloadSha256"])
            ),
            updated_page_ids_t=torch.tensor(updated_page_ids, dtype=torch.long),
            manifest_relative_path=str(final_manifest.relative_to(session_root)),
        )

    def _validate_packed_updated_rows_boundary(
        self,
        *,
        rows: tuple[Mapping[str, Any], ...],
        accepted_generation: int,
        parent_payload_sha256: str | None,
        parent_page_rows: Mapping[int, Mapping[str, Any]],
    ) -> None:
        """Revalidate packed authority without repeating a proven cold read."""

        needs_decode: list[Mapping[str, Any]] = []
        for row in rows:
            locator, _entry = (
                self._semantic_pack_locator_from_manifest_row_boundary(row)
            )
            cached = self._verified_semantic_pack_identities_boundary.get(
                locator.pack_path
            )
            expected_identity = (
                _file_identity(locator.pack_path)
                if locator.pack_path.is_file()
                else None
            )
            expected_pack_sha256 = _tensor_digest_hex(
                locator.pack_sha256_t
            )
            if (
                cached is None
                or expected_identity is None
                or cached != (expected_identity, expected_pack_sha256)
            ):
                needs_decode.append(row)
            dependency_record = cast(
                dict[str, Any],
                cast(dict[str, Any], row["semanticPack"])["dependency"],
            )
            if dependency_record["present"]:
                parent_row = parent_page_rows.get(int(row["pageId"]))
                if (
                    dependency_record["baseGeneration"] != accepted_generation
                    or dependency_record["baseManifestPayloadSha256"]
                    != parent_payload_sha256
                    or not isinstance(parent_row, Mapping)
                    or parent_row.get("sha256")
                    != dependency_record["baseObjectSha256"]
                    or parent_row.get("bytes")
                    != dependency_record["baseObjectBytes"]
                ):
                    raise RuntimeError(
                        "NoNE packed delta is not derived from the accepted "
                        "parent"
                    )
        decoded = (
            self._semantic_pack_row_payloads_boundary(tuple(needs_decode))
            if needs_decode
            else {}
        )
        for row in needs_decode:
            page_id = int(row["pageId"])
            payload_t = decoded[page_id]
            handle = _NoNEInMemorySafeTensorHandleBoundary(
                load(payload_t.numpy().tobytes())
            )
            payload_page_ids_t = handle.get_tensor(
                "page_ids_t"
            ).reshape(-1).long()
            decoded_dependency = (
                self._validated_page_delta_dependency_from_handle_boundary(
                    handle,
                    expected_page_id=page_id,
                )
            )
            dependency_record = cast(
                dict[str, Any],
                cast(dict[str, Any], row["semanticPack"])["dependency"],
            )
            if (
                payload_page_ids_t.shape != (1,)
                or int(payload_page_ids_t[0]) != page_id
                or (decoded_dependency is not None)
                != bool(dependency_record["present"])
            ):
                raise RuntimeError(
                    "NoNE packed candidate serialized authority differs"
                )
            if decoded_dependency is not None and (
                int(decoded_dependency.generation_t)
                != dependency_record["baseGeneration"]
                or _tensor_digest_hex(
                    decoded_dependency.manifest_payload_sha256_t
                )
                != dependency_record["baseManifestPayloadSha256"]
                or _tensor_digest_hex(
                    decoded_dependency.object.object_sha256_t
                )
                != dependency_record["baseObjectSha256"]
                or int(decoded_dependency.object.object_bytes_t)
                != dependency_record["baseObjectBytes"]
            ):
                raise RuntimeError(
                    "NoNE packed candidate dependency differs"
                )

    def accept_staged_generation(
        self,
        binding: NoNEGenerationBinding,
        graph_authority: NoNEGraphAuthorityBinding | None = None,
    ) -> dict[str, Any]:
        """Advance the regular accepted pointer only after checkpoint binding.

        The page-fill tracer is wrapped around this boundary (fail-open): the
        parent manifest is snapshotted before the accept so each updated page
        can be classified against the r152 allocation policy (grow OR
        fill-unallocated, never reallocate an already-allocated/learned page),
        and one ledger line per updated page is appended after the pointer has
        advanced.  Any tracing error is swallowed unless
        NNF_NONE_PAGE_FILL_STRICT=1, so diagnostics can never stall training.
        """

        self._require_staged_read_only_write_guard_boundary()
        if self._generation_writer_handle is None:
            raise RuntimeError("NoNE staged generation has no writer authority")
        # Snapshot the parent (prior) accepted page IDs BEFORE the locked
        # boundary overwrites self._manifest with the newly accepted manifest.
        # This lets the tracer label each updated page as grown-new /
        # filled-unallocated vs refreshed-existing without re-reading disk.
        parent_page_ids_snapshot = self._accepted_parent_page_ids_for_fill_trace()
        parent_generation_snapshot = int(self._accepted_generation_t)
        updated_page_ids_snapshot = (
            binding.updated_page_ids_t.detach().cpu().long().reshape(-1).tolist()
        )
        try:
            pointer = self._accept_staged_generation_locked_boundary(
                binding,
                graph_authority,
            )
        finally:
            self._release_generation_writer_boundary()
        # Non-blocking fill-trace recording.  Runs after the writer lease is
        # released and the accepted pointer has advanced, so it cannot affect
        # the durability of the generation itself.
        self._record_accepted_page_fill_trace_boundary(
            binding=binding,
            pointer=pointer,
            updated_page_ids=tuple(int(pid) for pid in updated_page_ids_snapshot),
            parent_page_ids=parent_page_ids_snapshot,
            parent_generation=parent_generation_snapshot,
        )
        return pointer

    def _accepted_parent_page_ids_for_fill_trace(self) -> frozenset[int]:
        """Return the current accepted page IDs for the fill-trace classifier.

        Fail-open: if the parent manifest is not yet materialized (first
        generation) or is temporarily unreadable, returns an empty set so the
        tracer records every updated page as grown-new rather than raising.
        """

        try:
            if self._manifest is None:
                return frozenset()
            raw_rows = self._manifest.get("pageObjects")
            if not isinstance(raw_rows, list):
                return frozenset()
            return frozenset(
                int(row["pageId"])
                for row in raw_rows
                if isinstance(row, dict)
                and isinstance(row.get("pageId"), int)
                and not isinstance(row.get("pageId"), bool)
            )
        except Exception:  # pragma: no cover - defensive, fail-open tracer
            return frozenset()

    def _record_accepted_page_fill_trace_boundary(
        self,
        *,
        binding: NoNEGenerationBinding,
        pointer: Mapping[str, Any],
        updated_page_ids: tuple[int, ...],
        parent_page_ids: frozenset[int],
        parent_generation: int,
    ) -> None:
        """Append one page-fill ledger line per updated page (fail-open).

        Implements the r152 policy tracer: each page updated by this accepted
        generation is classified (grown-new / filled-unallocated when absent
        from the parent, refreshed-existing when present) and recorded with its
        committed bytes.  Today one page maps to one page-object row per
        generation, so rows_offered and rows_written are both 1; the fields are
        kept explicit so batched page fills remain diagnosable.  Any error is
        swallowed unless NNF_NONE_PAGE_FILL_STRICT=1.
        """

        if not updated_page_ids:
            return
        try:
            _session_id_t, session_root = self._require_session()
        except Exception:  # pragma: no cover - defensive, fail-open
            return
        trace_path = page_fill_trace_path(session_root)
        # Bytes per page come from the just-accepted manifest's pageObjects
        # rows.  After _accept_staged_generation_locked_boundary returns,
        # self._manifest has advanced to the newly accepted manifest, so its
        # pageObjects cover every updated page with its committed object size.
        bytes_by_page: dict[int, int] = {}
        try:
            accepted_rows = (
                self._manifest.get("pageObjects")
                if self._manifest is not None
                else None
            )
            if isinstance(accepted_rows, list):
                for row in accepted_rows:
                    if not isinstance(row, dict):
                        continue
                    page_id_value = row.get("pageId")
                    bytes_value = row.get("bytes")
                    if (
                        isinstance(page_id_value, int)
                        and not isinstance(page_id_value, bool)
                        and isinstance(bytes_value, int)
                        and not isinstance(bytes_value, bool)
                    ):
                        bytes_by_page[int(page_id_value)] = int(bytes_value)
        except Exception:  # pragma: no cover - defensive, fail-open tracer
            bytes_by_page = {}
        session_id_list = (
            binding.session_id_t.detach().cpu().long().reshape(-1).tolist()
        )
        generation = int(binding.generation_t.detach().cpu().long().reshape(()))
        parent_page_id_set = frozenset(parent_page_ids)
        _ = pointer  # accepted pointer retained for future telemetry hooks
        for page_id in updated_page_ids:
            object_bytes = int(bytes_by_page.get(page_id, 0))
            allocation_outcome = _classify_page_fill_outcome(
                page_id,
                parent_page_id_set,
            )
            verdict = validate_page_fill(
                page_id=page_id,
                expected_rows=1,
                rows_written=1 if object_bytes > 0 else 0,
                bytes_written=object_bytes,
                allocation_outcome=allocation_outcome,
            )
            record_page_fill(
                trace_path=trace_path,
                session_id=session_id_list,
                generation=generation,
                parent_generation=parent_generation,
                page_id=page_id,
                rows_offered=1,
                rows_written=1 if object_bytes > 0 else 0,
                bytes_written=object_bytes,
                allocation_outcome=allocation_outcome,
                fill_ratio=verdict["fillRatio"],
            )

    def _validated_staged_generation_acceptance_boundary(
        self,
        binding: NoNEGenerationBinding,
        graph_authority: NoNEGraphAuthorityBinding | None = None,
    ) -> tuple[
        NoNEGenerationBinding,
        dict[str, Any],
        NoNEGraphAuthorityBinding | None,
    ]:
        """Validate one generation under its retained writer lease."""

        session_id_t, session_root = self._require_session()
        accepted_path = session_root / "accepted.json"
        immutable_parent = self._staged_immutable_parent_binding
        immutable_parent_identity = (
            self._staged_immutable_parent_manifest_identity
        )
        if accepted_path.is_file():
            if immutable_parent is not None:
                raise RuntimeError(
                    "NoNE pointerless immutable-parent stage gained "
                    "accepted authority"
                )
            self.discover_accepted_pointer_boundary()
        elif immutable_parent is not None:
            parent_path = (
                session_root / immutable_parent.manifest_relative_path
            ).resolve()
            if (
                immutable_parent_identity is None
                or self._manifest is None
                or self._accepted_binding_boundary is None
                or not _same_generation_binding_boundary(
                    self._accepted_binding_boundary,
                    immutable_parent,
                )
                or not torch.equal(
                    self._accepted_generation_t,
                    immutable_parent.generation_t.detach()
                    .cpu()
                    .long()
                    .reshape(()),
                )
                or not parent_path.is_file()
                or _file_identity(parent_path) != immutable_parent_identity
            ):
                raise RuntimeError(
                    "NoNE pointerless immutable parent changed before accept"
                )
            loaded_parent, parent_manifest = (
                self._load_generation_binding_boundary(
                    immutable_parent.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        immutable_parent.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        immutable_parent.manifest_payload_sha256_t
                    ),
                )
            )
            if (
                not _same_generation_binding_boundary(
                    loaded_parent,
                    immutable_parent,
                )
                or parent_manifest != self._manifest
            ):
                raise RuntimeError(
                    "NoNE pointerless immutable parent changed before accept"
                )
        elif self._manifest is not None or not torch.equal(
            self._accepted_generation_t,
            torch.zeros_like(self._accepted_generation_t),
        ):
            raise RuntimeError("NoNE accepted pointer disappeared")
        if not torch.equal(
            binding.session_id_t.detach().cpu().long(),
            session_id_t,
        ):
            raise RuntimeError("staged NoNE generation crossed session ownership")
        if not torch.equal(
            binding.parent_generation_t.detach().cpu().long().reshape(()),
            self._accepted_generation_t,
        ):
            raise RuntimeError("staged NoNE generation parent is no longer accepted")
        loaded, manifest = self._load_generation_binding_boundary(
            binding.manifest_relative_path,
            expected_manifest_sha256=_tensor_digest_hex(binding.manifest_sha256_t),
            expected_payload_sha256=_tensor_digest_hex(
                binding.manifest_payload_sha256_t
            ),
        )
        if not torch.equal(loaded.generation_t, binding.generation_t):
            raise RuntimeError("staged NoNE generation number changed")
        if not torch.equal(
            loaded.updated_page_ids_t,
            binding.updated_page_ids_t.detach().cpu().long(),
        ):
            raise RuntimeError("staged NoNE updated-page identity changed")
        self._validate_direct_page_map_frontier_transition_boundary(
            generation_binding=loaded,
            generation_manifest=manifest,
        )
        raw_page_rows = manifest.get("pageObjects")
        if not isinstance(raw_page_rows, list):
            raise RuntimeError("staged NoNE page catalog is absent")
        page_rows = {
            int(row["pageId"]): row
            for row in raw_page_rows
            if isinstance(row, dict)
            and isinstance(row.get("pageId"), int)
            and not isinstance(row.get("pageId"), bool)
        }
        target_direct_page_map_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                manifest
            )
        )
        parent_direct_page_map_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                self._manifest
            )
            if self._manifest is not None
            else None
        )
        if (
            parent_direct_page_map_authority is not None
            and target_direct_page_map_authority is None
        ):
            raise RuntimeError(
                "NoNE direct-only accepted lineage cannot regress"
            )
        components = manifest.get("components")
        training_proof = (
            components.get("trainingProof")
            if isinstance(components, dict)
            else None
        )
        training_proof_record = (
            training_proof.get("record")
            if isinstance(training_proof, dict)
            else None
        )
        if training_proof_record is not None:
            if self._manifest is None:
                raise RuntimeError(
                    "NoNE final branch union has no accepted parent page map"
                )
            proof_record, _proof_path, _proof_sha256 = (
                _validated_training_branch_union_proof_artifact_boundary(
                    store=self,
                    generation_binding=loaded,
                    generation_manifest=manifest,
                )
            )
            if (
                proof_record.get("storagePageObjectsSelfContainedDirect")
                is not True
                or proof_record.get("baseBoundPageObjectCount") != 0
                or proof_record.get(
                    "storageNormalizationChangesTrainingCoverage"
                )
                is not False
            ):
                raise RuntimeError(
                    "NoNE final branch union lacks direct page-map authority"
                )
            if target_direct_page_map_authority is None:
                raise RuntimeError(
                    "NoNE final branch union lacks immutable direct-map "
                    "authority"
                )
            direct_page_objects = (
                self._require_complete_local_direct_page_map_boundary(
                    generation_binding=loaded,
                    generation_manifest=manifest,
                    expected_page_ids_t=(
                        self._manifest_page_ids_t_boundary(self._manifest)
                    ),
                )
            )
            if (
                proof_record.get("storageNormalizedPageIds")
                != [
                    int(binding.page_id_t)
                    for binding in direct_page_objects
                ]
                or proof_record.get("storageNormalizedPageMapSha256")
                != _tensor_digest_hex(
                    _page_object_map_digest_t_boundary(
                        direct_page_objects
                    )
                )
            ):
                raise RuntimeError(
                    "NoNE final branch union direct page map differs"
                )
        elif target_direct_page_map_authority is not None:
            if self._manifest is None:
                raise RuntimeError(
                    "NoNE direct-only lineage has no accepted parent page map"
                )
            direct_page_objects = (
                self._require_complete_local_direct_page_map_boundary(
                    generation_binding=loaded,
                    generation_manifest=manifest,
                    expected_page_ids_t=(
                        self._manifest_page_ids_t_boundary(self._manifest)
                    ),
                    complete_rewrite_required=False,
                )
            )
            if target_direct_page_map_authority != (
                self._direct_page_map_authority_record_boundary(
                    direct_page_objects
                )
            ):
                raise RuntimeError(
                    "NoNE direct-only accepted page map differs"
                )
        parent_page_rows: dict[int, dict[str, Any]] = {}
        parent_payload_sha256: str | None = None
        if self._manifest is not None:
            parent_rows_value = self._manifest.get("pageObjects")
            parent_payload_value = self._manifest.get(
                "manifestPayloadSha256"
            )
            if (
                not isinstance(parent_rows_value, list)
                or not isinstance(parent_payload_value, str)
                or len(parent_payload_value) != 64
            ):
                raise RuntimeError(
                    "accepted NoNE parent page authority is malformed"
                )
            parent_page_rows = {
                int(row["pageId"]): row
                for row in parent_rows_value
                if isinstance(row, dict)
                and isinstance(row.get("pageId"), int)
                and not isinstance(row.get("pageId"), bool)
            }
            parent_payload_sha256 = parent_payload_value
        updated_page_objects: list[NoNEPageObjectBinding] = []
        packed_updated_rows: list[dict[str, Any]] = []
        for page_id in loaded.updated_page_ids_t.detach().cpu().long().tolist():
            row = page_rows.get(page_id)
            if (
                not isinstance(row, dict)
                or not isinstance(row.get("sha256"), str)
                or not isinstance(row.get("bytes"), int)
                or isinstance(row.get("bytes"), bool)
            ):
                raise RuntimeError("staged NoNE updated page object is malformed")
            if row.get("semanticPack") is not None:
                _validate_semantic_page_pack_manifest_row_boundary(row)
                packed_updated_rows.append(row)
            else:
                updated_page_objects.append(
                    NoNEPageObjectBinding(
                        page_id_t=torch.tensor(page_id, dtype=torch.long),
                        object_sha256_t=digest_tensor(
                            str(row["sha256"])
                        ),
                        object_bytes_t=torch.tensor(
                            int(row["bytes"]),
                            dtype=torch.long,
                        ),
                    )
                )
        authorized_rows, semantic_admissions = (
            self._preauthorize_updated_page_semantics_boundary(
                updated_page_objects=tuple(updated_page_objects),
                accepted_generation=int(self._accepted_generation_t),
                parent_payload_sha256=parent_payload_sha256,
                parent_page_rows=parent_page_rows,
            )
        )
        if any(
            dict(page_rows[int(row["pageId"])]) != row
            for row in authorized_rows
        ):
            raise RuntimeError("staged NoNE updated page authority changed")
        self._validate_packed_updated_rows_boundary(
            rows=tuple(packed_updated_rows),
            accepted_generation=int(self._accepted_generation_t),
            parent_payload_sha256=parent_payload_sha256,
            parent_page_rows=parent_page_rows,
        )
        self._validate_rev6_semantic_admission_batch_boundary(
            semantic_admissions
        )
        accepted_graph_authority = graph_authority
        if graph_authority is not None:
            verified_graph = self._load_graph_authority_record_boundary(
                loaded,
                manifest,
                graph_authority.external_record_boundary(),
            )
            if verified_graph.external_record_boundary() != (
                graph_authority.external_record_boundary()
            ):
                raise RuntimeError("staged NoNE graph authority changed")
            accepted_graph_authority = verified_graph
        return loaded, manifest, accepted_graph_authority

    def _accept_staged_generation_locked_boundary(
        self,
        binding: NoNEGenerationBinding,
        graph_authority: NoNEGraphAuthorityBinding | None = None,
    ) -> dict[str, Any]:
        """Validate and accept one generation under its retained writer lease."""

        loaded, manifest, accepted_graph_authority = (
            self._validated_staged_generation_acceptance_boundary(
                binding,
                graph_authority,
            )
        )
        pointer = self._write_accepted_pointer_boundary(
            loaded,
            manifest,
            accepted_graph_authority,
        )
        self._staged_immutable_parent_binding = None
        self._staged_immutable_parent_manifest_identity = None
        self._rebind_resident_graph_after_authority_move_boundary(manifest)
        return pointer

    def verify_generation_boundary(
        self,
        *,
        generation_t: torch.Tensor,
        manifest_payload_sha256_t: torch.Tensor,
        manifest_sha256_t: torch.Tensor | None = None,
    ) -> NoNEGenerationBinding:
        """Verify an immutable historical generation without moving authority."""

        generation = int(generation_t.detach().cpu().long().reshape(()))
        payload_sha256 = _tensor_digest_hex(manifest_payload_sha256_t)
        manifest_relative_path = (
            f"generations/generation_{generation:08d}_{payload_sha256}/generation.json"
        )
        if manifest_sha256_t is None:
            binding, _parent_payload_sha256 = (
                self._load_generation_lineage_summary_boundary(
                    generation_t=generation_t,
                    manifest_payload_sha256_t=manifest_payload_sha256_t,
                )
            )
        else:
            binding, _manifest = self._load_generation_binding_boundary(
                manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    manifest_sha256_t
                ),
                expected_payload_sha256=payload_sha256,
            )
        if not torch.equal(
            binding.generation_t,
            generation_t.detach().cpu().long().reshape(()),
        ):
            raise RuntimeError("NoNE verified generation number changed")
        return binding

    def resume_staged_generation_boundary(
        self,
        *,
        binding: NoNEGenerationBinding,
        updated_page_objects: tuple[NoNEPageObjectBinding, ...],
    ) -> NoNEGenerationBinding:
        """Reacquire writer authority for one exact immutable staged generation."""

        self._require_staged_read_only_write_guard_boundary()
        self._acquire_generation_writer_boundary()
        try:
            current = self.current_generation_binding_boundary()
            loaded, manifest = self._load_generation_binding_boundary(
                binding.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    binding.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    binding.manifest_payload_sha256_t
                ),
            )
            page_rows_value = manifest.get("pageObjects")
            if not isinstance(page_rows_value, list):
                raise RuntimeError("NoNE resumed staged page objects are malformed")
            page_rows = {
                int(row["pageId"]): row
                for row in page_rows_value
                if isinstance(row, dict) and isinstance(row.get("pageId"), int)
            }
            object_identity_matches = all(
                isinstance(page_rows.get(int(page_object.page_id_t)), dict)
                and page_rows[int(page_object.page_id_t)].get("sha256")
                == _tensor_digest_hex(page_object.object_sha256_t)
                and page_rows[int(page_object.page_id_t)].get("bytes")
                == int(page_object.object_bytes_t)
                for page_object in updated_page_objects
            )
            if (
                not _same_generation_binding_boundary(loaded, binding)
                or not torch.equal(
                    current.session_id_t,
                    binding.session_id_t,
                )
                or not torch.equal(
                    current.generation_t,
                    binding.parent_generation_t,
                )
                or manifest.get("parentManifestPayloadSha256")
                != _tensor_digest_hex(
                    current.manifest_payload_sha256_t
                )
                or not torch.equal(
                    binding.updated_page_ids_t,
                    torch.stack(
                        tuple(
                            page_object.page_id_t.detach()
                            .cpu()
                            .long()
                            .reshape(())
                            for page_object in updated_page_objects
                        )
                    ),
                )
                or not object_identity_matches
            ):
                raise RuntimeError("NoNE resumed staged generation authority differs")
            parent_rows_value = (
                self._manifest.get("pageObjects")
                if self._manifest is not None
                else None
            )
            parent_payload_value = (
                self._manifest.get("manifestPayloadSha256")
                if self._manifest is not None
                else None
            )
            if (
                not isinstance(parent_rows_value, list)
                or not isinstance(parent_payload_value, str)
                or len(parent_payload_value) != 64
            ):
                raise RuntimeError(
                    "NoNE resumed parent page authority is malformed"
                )
            parent_page_rows = {
                int(row["pageId"]): row
                for row in parent_rows_value
                if isinstance(row, dict)
                and isinstance(row.get("pageId"), int)
                and not isinstance(row.get("pageId"), bool)
            }
            authorized_rows, semantic_admissions = (
                self._preauthorize_updated_page_semantics_boundary(
                    updated_page_objects=updated_page_objects,
                    accepted_generation=int(current.generation_t),
                    parent_payload_sha256=parent_payload_value,
                    parent_page_rows=parent_page_rows,
                )
            )
            if any(
                dict(page_rows[int(row["pageId"])]) != row
                for row in authorized_rows
            ):
                raise RuntimeError(
                    "NoNE resumed staged page authority changed"
                )
            self._validate_rev6_semantic_admission_batch_boundary(
                semantic_admissions
            )
            return loaded
        except Exception:
            self._release_generation_writer_boundary()
            raise

    def checkout_generation_boundary(
        self,
        *,
        generation_t: torch.Tensor,
        manifest_payload_sha256_t: torch.Tensor,
        manifest_sha256_t: torch.Tensor | None = None,
    ) -> NoNEGenerationBinding:
        """Rebind authority to an immutable historical generation for rollback."""

        self._require_staged_read_only_write_guard_boundary()
        self._acquire_generation_writer_boundary()
        try:
            return self._checkout_generation_locked_boundary(
                generation_t=generation_t,
                manifest_payload_sha256_t=manifest_payload_sha256_t,
                manifest_sha256_t=manifest_sha256_t,
            )
        finally:
            self._release_generation_writer_boundary()

    def _checkout_generation_locked_boundary(
        self,
        *,
        generation_t: torch.Tensor,
        manifest_payload_sha256_t: torch.Tensor,
        manifest_sha256_t: torch.Tensor | None = None,
    ) -> NoNEGenerationBinding:
        """Rebind authority while holding the session generation writer."""

        _session_id_t, session_root = self._require_session()
        current_manifest = self._manifest
        current_page_ids_t = (
            self._manifest_page_ids_t_boundary(current_manifest)
            if current_manifest is not None
            else torch.empty(0, dtype=torch.long)
        )
        current_direct_page_map_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                current_manifest
            )
            if current_manifest is not None
            else None
        )
        generation = int(generation_t.detach().cpu().long().reshape(()))
        payload_sha256 = _tensor_digest_hex(manifest_payload_sha256_t)
        manifest_relative_path = (
            f"generations/generation_{generation:08d}_{payload_sha256}/generation.json"
        )
        binding, manifest = self._load_generation_binding_boundary(
            manifest_relative_path,
            expected_manifest_sha256=(
                _tensor_digest_hex(manifest_sha256_t)
                if manifest_sha256_t is not None
                else None
            ),
            expected_payload_sha256=payload_sha256,
        )
        manifest_path = session_root / manifest_relative_path
        if not manifest_path.is_file():
            raise RuntimeError("NoNE rollback generation disappeared")
        target_direct_page_map_authority = (
            self._validated_manifest_direct_page_map_authority_boundary(
                manifest
            )
        )
        if (
            current_direct_page_map_authority is not None
            and target_direct_page_map_authority is None
        ):
            raise RuntimeError(
                "NoNE direct-only accepted lineage cannot roll back to "
                "indirect authority"
            )
        if target_direct_page_map_authority is not None:
            if current_page_ids_t.numel() < 1:
                raise RuntimeError(
                    "NoNE direct-only rollback has no current page map"
                )
            direct_page_objects = (
                self._require_complete_local_direct_page_map_boundary(
                    generation_binding=binding,
                    generation_manifest=manifest,
                    expected_page_ids_t=current_page_ids_t,
                    complete_rewrite_required=False,
                )
            )
            if target_direct_page_map_authority != (
                self._direct_page_map_authority_record_boundary(
                    direct_page_objects
                )
            ):
                raise RuntimeError(
                    "NoNE direct-only rollback page map differs"
                )
        self._write_accepted_pointer_boundary(binding, manifest)
        self._rebind_resident_graph_after_authority_move_boundary(manifest)
        return binding

    def commit_generation(
        self,
        *,
        generation_t: torch.Tensor,
        updated_pages: NoNEPageBundle,
        components: NoNEGenerationComponentPacket,
        training_proven_page_ids_t: torch.Tensor | None = None,
    ) -> dict[str, Any]:
        """Compatibility boundary: stage and immediately accept one generation."""

        self._require_staged_read_only_write_guard_boundary()
        binding = self.stage_generation(
            updated_pages=updated_pages,
            components=components,
            expected_generation_t=generation_t,
            training_proven_page_ids_t=training_proven_page_ids_t,
        )
        return self.accept_staged_generation(binding)

    def _page_index(self) -> dict[int, dict[str, Any]]:
        if self._manifest is None:
            raise RuntimeError("NoNE session has no accepted page generation")
        if (
            self._page_index_manifest_boundary is self._manifest
            and self._page_index_cache_boundary is not None
        ):
            return self._page_index_cache_boundary
        raw_rows = self._manifest.get("pageObjects")
        if not isinstance(raw_rows, list):
            raise RuntimeError("NoNE accepted page catalog is malformed")
        rows: dict[int, dict[str, Any]] = {}
        for raw_row in raw_rows:
            if not isinstance(raw_row, dict):
                raise RuntimeError("NoNE accepted page object row is malformed")
            rows[int(raw_row["pageId"])] = raw_row
        self._page_index_manifest_boundary = self._manifest
        self._page_index_cache_boundary = rows
        return rows

    def _validate_materialization_identity_boundary(
        self,
        *,
        session_id_t: torch.Tensor,
        generation_t: torch.Tensor,
        page_ids_t: torch.Tensor,
    ) -> torch.Tensor:
        """Validate one model-selected storage request at the I/O boundary."""

        active_session_id_t, session_root = self._require_session()
        if not (session_root / "accepted.json").is_file():
            raise RuntimeError("NoNE session has no accepted page generation")
        self.discover_accepted_pointer_boundary()
        if not torch.equal(
            session_id_t.detach().cpu().long(),
            active_session_id_t,
        ):
            raise RuntimeError("NoNE page request crossed session ownership")
        if not torch.equal(
            generation_t.detach().cpu().reshape(()).long(),
            self._accepted_generation_t,
        ):
            raise RuntimeError("NoNE page request generation is stale")
        selected_page_ids_t = page_ids_t.detach().cpu().long()
        if (
            selected_page_ids_t.ndim != 1
            or selected_page_ids_t.numel() < 1
            or torch.unique(selected_page_ids_t).numel() != selected_page_ids_t.numel()
        ):
            raise RuntimeError("NoNE page materialization identity is malformed")
        return selected_page_ids_t

    def _verify_materialized_object_boundary(
        self,
        *,
        object_path: Path,
        object_sha256: str,
    ) -> None:
        """Verify one accepted object once per generation and exact file identity."""

        resolved_path = object_path.expanduser().resolve()
        _session_id_t, session_root = self._require_session()
        generation = int(self._accepted_generation_t)
        identity = _file_identity(resolved_path)
        cache_key = (object_sha256, resolved_path)
        cached = self._verified_object_identities_boundary.get(cache_key)
        if cached is not None:
            _cached_generation, cached_identity = cached
            # Object authorization is independently re-established from the
            # current accepted manifest by the caller.  The content-addressed
            # object proof itself is safe to reuse across accepted generations
            # as long as the exact inode/size/timestamp identity is unchanged;
            # tying it to generation forced a full hash of every unchanged page
            # after every durable optimizer commit.
            if (
                cached_identity != identity
                and cached_identity[:4] == identity[:4]
            ):
                # Creating another hard link to a verified immutable page
                # increments the shared inode's ctime without changing its
                # device, inode, size, mtime, or bytes.  This is an internally
                # caused metadata transition, not authority to ignore ctime:
                # discard only this exact cache row and fall through to the
                # expected-digest verifier.  Same-size byte rewrites with a
                # restored mtime also land here and are rejected by the full
                # SHA-256 below.
                self._verified_object_identities_boundary.pop(
                    cache_key,
                    None,
                )
                cached = None
            elif cached_identity != identity:
                self._evict_validated_immutable_page_closure_object_boundary(
                    object_sha256
                )
                raise RuntimeError(
                    "accepted NoNE page object identity changed after verification"
                )
            if cached is not None:
                return

        try:
            verified_sha256 = _file_sha256(
                resolved_path,
                expected_sha256=object_sha256,
                identity_cache_root=(
                    self._runtime_cache_root_boundary()
                    / "page_object_sha256_identity_cache"
                ),
            )
        except RuntimeError as error:
            if str(error) != "immutable file SHA-256 differs from authority":
                raise
            raise RuntimeError(
                "accepted NoNE page object hash changed"
            ) from error
        if verified_sha256 != object_sha256:
            raise RuntimeError("accepted NoNE page object hash changed")
        identity_after = _file_identity(resolved_path)
        if identity_after != identity:
            raise RuntimeError(
                "accepted NoNE page object identity changed during verification"
            )
        self._verified_objects.add(object_sha256)
        self._verified_object_identities_boundary[cache_key] = (
            generation,
            identity_after,
        )

    def _authorized_page_objects_boundary(
        self,
        *,
        selected_page_ids_t: torch.Tensor,
    ) -> tuple[_AuthorizedPageObject, ...]:
        """Authorize exact routed objects before any parallel file reads."""

        index = self._page_index()
        selected_rows: list[dict[str, Any]] = []
        for page_id in selected_page_ids_t.tolist():
            page_id_value = int(page_id)
            row = index.get(page_id_value)
            if row is None:
                raise FileNotFoundError(
                    f"model-selected NoNE page is not accepted: {page_id_value}"
                )
            selected_rows.append(row)
        pack = (
            self._accepted_local_direct_page_pack_set_authority_boundary(
                self._manifest
            )
            if self._manifest is not None
            else None
        )
        if pack is not None:
            selected = read_direct_page_pack_selected_boundary(
                pack[0],
                selected_page_ids_t.detach().cpu().long().reshape(-1),
                direct_io=True,
            )
            if (
                not bool(selected.direct_io_t)
                or not torch.equal(
                    selected.page_ids_t,
                    selected_page_ids_t.detach()
                    .cpu()
                    .long()
                    .reshape(-1),
                )
                or selected.payload_offsets_t.shape
                != (len(selected_rows) + 1,)
            ):
                raise RuntimeError(
                    "accepted NoNE direct pack selection differs"
                )
            packed_authorized: list[_AuthorizedPageObject] = []
            for row_index, row in enumerate(selected_rows):
                page_id_value = int(row["pageId"])
                object_sha256 = str(row.get("sha256", ""))
                object_bytes = int(row.get("bytes", -1))
                payload_start = int(
                    selected.payload_offsets_t[row_index]
                )
                payload_end = int(
                    selected.payload_offsets_t[row_index + 1]
                )
                if (
                    _tensor_digest_hex(
                        selected.object_sha256s_t[row_index]
                    )
                    != object_sha256
                    or int(selected.object_bytes_t[row_index])
                    != object_bytes
                    or payload_end - payload_start != object_bytes
                ):
                    raise RuntimeError(
                        "accepted NoNE direct pack object identity differs"
                    )
                packed_authorized.append(
                    _NoNEAuthorizedPageObject(
                        page_id=page_id_value,
                        object_sha256=object_sha256,
                        object_bytes=object_bytes,
                        object_path=None,
                        object_payload_t=selected.object_payload_t[
                            payload_start:payload_end
                        ],
                    )
                )
            return tuple(packed_authorized)
        packed_rows = tuple(
            row for row in selected_rows if row.get("semanticPack") is not None
        )
        packed_payloads = (
            self._semantic_pack_row_payloads_boundary(packed_rows)
            if packed_rows
            else {}
        )
        authorized: list[_AuthorizedPageObject] = []
        for row in selected_rows:
            page_id_value = int(row["pageId"])
            object_sha256 = str(row.get("sha256", ""))
            object_bytes = int(row.get("bytes", -1))
            if row.get("semanticPack") is not None:
                payload_t = packed_payloads.get(page_id_value)
                if payload_t is None or payload_t.numel() != object_bytes:
                    raise RuntimeError(
                        "accepted NoNE packed page payload is absent"
                    )
                authorized.append(
                    _NoNEAuthorizedPageObject(
                        page_id=page_id_value,
                        object_sha256=object_sha256,
                        object_bytes=object_bytes,
                        object_path=None,
                        object_payload_t=payload_t,
                    )
                )
                continue
            object_path = self._object_path_boundary(
                object_sha256,
                expected_bytes=object_bytes,
            )
            # Shared digest and generation caches remain single-writer.  Only
            # independently authorized safetensor reads run in worker threads.
            self._validated_page_object_schema_proof_boundary(
                page_id=page_id_value,
                object_sha256=object_sha256,
                object_path=object_path,
            )
            authorized.append(
                _NoNEAuthorizedPageObject(
                    page_id=page_id_value,
                    object_sha256=object_sha256,
                    object_bytes=object_bytes,
                    object_path=object_path,
                    object_payload_t=None,
                )
            )
        return tuple(authorized)

    def verify_accepted_page_object_identities_boundary(
        self,
        *,
        session_id_t: torch.Tensor,
        generation_t: torch.Tensor,
        page_ids_t: torch.Tensor,
    ) -> NoNEPageObjectReadbackPacket:
        """Verify every requested object exactly without materializing weights.

        Objects are cryptographically read back on the first exact file
        identity and may subsequently use the durable device/inode/size/time
        bound digest cache. Only one bounded I/O chunk and one safetensors
        header are open at a time; page weight tensors are never concatenated.
        """

        selected_page_ids_t = self._validate_materialization_identity_boundary(
            session_id_t=session_id_t,
            generation_t=generation_t,
            page_ids_t=page_ids_t,
        )
        index = self._page_index()
        page_ids_digest = hashlib.sha256()
        object_identities_digest = hashlib.sha256()
        object_identities_digest.update(_PAGE_OBJECT_IDENTITY_DIGEST_DOMAIN)
        page_object_count = 0
        page_object_bytes = 0
        maximum_in_flight_object_count = 0
        for offset in range(
            0,
            int(selected_page_ids_t.shape[0]),
            _PAGE_MATERIALIZATION_IO_WORKERS,
        ):
            chunk_page_ids_t = selected_page_ids_t[
                offset : offset + _PAGE_MATERIALIZATION_IO_WORKERS
            ]
            authorized = self._authorized_page_objects_boundary(
                selected_page_ids_t=chunk_page_ids_t,
            )
            maximum_in_flight_object_count = max(
                maximum_in_flight_object_count,
                len(authorized),
            )
            for authorized_object in authorized:
                page_id = authorized_object.page_id
                object_sha256 = authorized_object.object_sha256
                row = index[page_id]
                object_bytes = row.get("bytes")
                if (
                    not isinstance(object_bytes, int)
                    or isinstance(object_bytes, bool)
                ):
                    raise RuntimeError(
                        "accepted NoNE page object byte count is malformed"
                    )
                if authorized_object.object_payload_t is not None:
                    object_page_ids_t = load(
                        authorized_object.object_payload_t.numpy().tobytes()
                    )["page_ids_t"].reshape(-1).long()
                else:
                    object_path = authorized_object.object_path
                    if object_path is None:
                        raise RuntimeError(
                            "NoNE authorized page has no byte authority"
                        )
                    with safe_open(  # type: ignore[no-untyped-call]
                        str(object_path),
                        framework="pt",
                        device="cpu",
                    ) as handle:
                        object_page_ids_t = (
                            handle.get_tensor("page_ids_t").reshape(-1).long()
                        )
                if (
                    object_page_ids_t.numel() != 1
                    or int(object_page_ids_t[0]) != page_id
                ):
                    raise RuntimeError("NoNE page object identity mismatch")
                page_ids_digest.update(struct.pack(">Q", page_id))
                object_identities_digest.update(
                    _page_object_identity_record_bytes_boundary(
                        page_id=page_id,
                        object_sha256=object_sha256,
                        object_bytes=object_bytes,
                    )
                )
                page_object_count += 1
                page_object_bytes += object_bytes
        return NoNEPageObjectReadbackPacket(
            generation_t=self._accepted_generation_t.detach().cpu().long().clone(),
            page_object_count_t=torch.tensor(
                page_object_count,
                dtype=torch.long,
            ),
            page_object_bytes_t=torch.tensor(
                page_object_bytes,
                dtype=torch.long,
            ),
            page_ids_sha256_t=digest_tensor(page_ids_digest.hexdigest()),
            object_identities_sha256_t=digest_tensor(
                object_identities_digest.hexdigest()
            ),
            maximum_in_flight_object_count_t=torch.tensor(
                maximum_in_flight_object_count,
                dtype=torch.long,
            ),
        )

    @staticmethod
    def _weights_from_materialized_handle_boundary(
        handle: Any,
        *,
        page_id: int,
    ) -> NoNEPageWeights:
        """Read one authorized page row without changing its routed identity."""

        object_page_id_t = handle.get_tensor("page_ids_t").reshape(-1)
        if object_page_id_t.numel() != 1 or int(object_page_id_t[0]) != page_id:
            raise RuntimeError("NoNE page object identity mismatch")
        return NoNEPageWeights(
            page_ids_t=object_page_id_t,
            ffn_mode_t=load_page_weight_from_handle_boundary(handle, "ffn_mode_t"),
            gate_t=load_page_weight_from_handle_boundary(handle, "gate_t"),
            up_t=load_page_weight_from_handle_boundary(handle, "up_t"),
            down_t=load_page_weight_from_handle_boundary(handle, "down_t"),
            glyph_down_t=load_page_weight_from_handle_boundary(
                handle,
                "glyph_down_t",
            ),
            glyph_up_t=load_page_weight_from_handle_boundary(handle, "glyph_up_t"),
            translation_gate_t=load_page_weight_from_handle_boundary(
                handle,
                "translation_gate_t",
            ),
            outcome_memory_t=load_page_weight_from_handle_boundary(
                handle,
                "outcome_memory_t",
            ),
            repair_memory_t=load_page_weight_from_handle_boundary(
                handle,
                "repair_memory_t",
            ),
            transfer_memory_t=load_page_weight_from_handle_boundary(
                handle,
                "transfer_memory_t",
            ),
        )

    def _load_materialized_weights_row_boundary(
        self,
        authorized: _AuthorizedPageObject,
        *,
        dtype: torch.dtype,
    ) -> NoNEPageWeights:
        page_id = authorized.page_id
        object_sha256 = authorized.object_sha256
        if authorized.object_payload_t is not None:
            bundle = self._materialize_page_payload_boundary(
                authorized.object_payload_t,
                device=torch.device("cpu"),
                dtype=dtype,
                trainable=False,
            )
            if int(bundle.weights.page_ids_t.reshape(())) != page_id:
                raise RuntimeError("NoNE materialized page identity differs")
            return bundle.weights
        object_path = authorized.object_path
        if object_path is None:
            raise RuntimeError("NoNE authorized page has no byte authority")
        resolved_path = object_path.expanduser().resolve()
        self._verify_materialized_object_boundary(
            object_path=resolved_path,
            object_sha256=object_sha256,
        )
        cached = self._cached_materialized_cpu_weights_boundary(
            object_path=resolved_path,
            object_sha256=object_sha256,
            dtype=dtype,
        )
        if cached is not None:
            weights = cached
        else:
            schema_proof = (
                self._validated_page_object_schema_proof_boundary(
                    page_id=page_id,
                    object_sha256=object_sha256,
                    object_path=resolved_path,
                )
            )
            source_identity = _file_identity(resolved_path)

            def build_shared_weights() -> SharedNoNEPageWeights:
                # Materialize through the bounded full-page cache for every
                # immutable revision. Training consumes the same page again
                # with its optimizer moments after the forward route. Opening
                # only the weight tensors here forced that second request to
                # reopen and revalidate the object, defeating both the exact
                # dtype-bound cache and the semantic-pack speedup. The shared
                # tier still exposes only immutable weights; the page cache is
                # bounded and retains the optimizer state for the subsequent
                # branch-owned update.
                decoded = (
                    self._materialize_verified_immutable_cpu_page_boundary(
                        object_path=resolved_path,
                        object_sha256=object_sha256,
                        dtype=dtype,
                        delta_chain=(),
                    ).weights
                )
                return _shared_page_weights_boundary(decoded)

            weights = _page_weights_from_shared_boundary(
                self._shared_page_weights_cache.load_or_build(
                    authority=SharedPageCacheAuthority(
                        page_id=page_id,
                        source_object_sha256=object_sha256,
                        source_object_bytes=source_identity[2],
                        source_file_identity=source_identity,
                        source_format_revision=schema_proof.format_revision,
                        materialized_dtype=dtype,
                    ),
                    builder=build_shared_weights,
                )
            )
            if _file_identity(resolved_path) != source_identity:
                raise RuntimeError(
                    "accepted NoNE page object identity changed during shared "
                    "materialization"
                )
            self._verify_materialized_object_boundary(
                object_path=resolved_path,
                object_sha256=object_sha256,
            )
            self._admit_materialized_cpu_weights_boundary(
                object_path=resolved_path,
                object_sha256=object_sha256,
                dtype=dtype,
                weights=weights,
            )
        validate_page_weights(weights)
        if int(weights.page_ids_t.reshape(())) != page_id:
            raise RuntimeError("NoNE materialized page identity differs")
        return weights

    def _load_materialized_bundle_row_boundary(
        self,
        authorized: _AuthorizedPageObject,
        *,
        dtype: torch.dtype,
    ) -> NoNEPageBundle:
        page_id = authorized.page_id
        if authorized.object_payload_t is not None:
            bundle = self._materialize_page_payload_boundary(
                authorized.object_payload_t,
                device=torch.device("cpu"),
                dtype=dtype,
                trainable=False,
            )
        else:
            object_path = authorized.object_path
            if object_path is None:
                raise RuntimeError(
                    "NoNE authorized page has no byte authority"
                )
            bundle = self._materialize_verified_immutable_cpu_page_boundary(
                object_path=object_path,
                object_sha256=authorized.object_sha256,
                dtype=dtype,
                delta_chain=(),
            )
        if int(bundle.weights.page_ids_t.reshape(())) != page_id:
            raise RuntimeError("NoNE materialized page identity differs")
        return bundle

    def _load_model_owned_capability_state_row_boundary(
        self,
        authorized: _AuthorizedPageObject,
    ) -> torch.Tensor:
        """Read only merge-bearing capability memories from a sealed object."""

        page_id = authorized.page_id
        if authorized.object_payload_t is not None:
            bundle = self._materialize_page_payload_boundary(
                authorized.object_payload_t,
                device=torch.device("cpu"),
                dtype=torch.float32,
                trainable=False,
            )
        else:
            object_path = authorized.object_path
            if object_path is None:
                raise RuntimeError(
                    "NoNE authorized page has no byte authority"
                )
            bundle = self._materialize_verified_immutable_cpu_page_boundary(
                object_path=object_path,
                object_sha256=authorized.object_sha256,
                dtype=torch.float32,
                delta_chain=(),
            )
        page_ids_t = bundle.weights.page_ids_t.reshape(-1).long()
        step_t = bundle.step_t.reshape(-1)
        capability_state_t = torch.stack(
            (
                bundle.weights.outcome_memory_t,
                bundle.weights.repair_memory_t,
                bundle.weights.transfer_memory_t,
            ),
            dim=1,
        ).detach().cpu()
        if (
            page_ids_t.shape != (1,)
            or int(page_ids_t[0]) != page_id
            or step_t.shape != (1,)
            or not step_t.gt(0).all()
            or capability_state_t.ndim < 3
            or capability_state_t.shape[0] != 1
            or capability_state_t.shape[1] != 3
            or not torch.isfinite(capability_state_t).all()
        ):
            raise RuntimeError(
                "NoNE training branch retained capability state differs"
            )
        return capability_state_t

    @staticmethod
    def _bounded_materialized_rows_boundary(
        authorized: tuple[_AuthorizedPageObject, ...],
        loader: Callable[[_AuthorizedPageObject], _R],
    ) -> tuple[_R, ...]:
        """Read routed rows concurrently without queuing an entire page bank."""

        if not authorized:
            raise ValueError("NoNE page materialization requires routed objects")
        if len(authorized) == 1:
            return (loader(authorized[0]),)
        worker_count = min(_PAGE_MATERIALIZATION_IO_WORKERS, len(authorized))
        loaded: list[_R] = []
        with ThreadPoolExecutor(
            max_workers=worker_count,
            thread_name_prefix="nnf-page-io",
        ) as executor:
            for offset in range(0, len(authorized), worker_count):
                chunk = authorized[offset : offset + worker_count]
                loaded.extend(executor.map(loader, chunk))
        return tuple(loaded)

    def materialize_page_ids_boundary(
        self,
        *,
        session_id_t: torch.Tensor,
        generation_t: torch.Tensor,
        page_ids_t: torch.Tensor,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageWeights:
        """Load exactly the model-selected IDs presented at the I/O boundary."""

        authorization_started_ns = time.perf_counter_ns()
        selected_page_ids_t = self._validate_materialization_identity_boundary(
            session_id_t=session_id_t,
            generation_t=generation_t,
            page_ids_t=page_ids_t,
        )
        authorized = self._authorized_page_objects_boundary(
            selected_page_ids_t=selected_page_ids_t,
        )
        authorization_finished_ns = time.perf_counter_ns()
        loaded_rows = self._bounded_materialized_rows_boundary(
            authorized,
            lambda authorized_row: (
                self._load_materialized_weights_row_boundary(
                    authorized_row,
                    dtype=dtype,
                )
            ),
        )
        read_dequant_finished_ns = time.perf_counter_ns()
        weights = (
            loaded_rows[0]
            if len(loaded_rows) == 1
            else _concatenate_page_weights(loaded_rows)
        )
        if not torch.equal(weights.page_ids_t, selected_page_ids_t):
            raise RuntimeError(
                "materialized NoNE page order differs from the model route"
            )
        compose_finished_ns = time.perf_counter_ns()
        moved = _move_immutable_page_weights_for_consumer_boundary(
            weights,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )
        transfer_finished_ns = time.perf_counter_ns()
        self._record_page_materialization_telemetry_boundary(
            page_count=int(selected_page_ids_t.numel()),
            optimizer_bundle=False,
            cuda_target=device.type == "cuda",
            authorization_ns=(
                authorization_finished_ns - authorization_started_ns
            ),
            read_dequant_ns=(
                read_dequant_finished_ns - authorization_finished_ns
            ),
            compose_ns=compose_finished_ns - read_dequant_finished_ns,
            device_transfer_enqueue_ns=(
                transfer_finished_ns - compose_finished_ns
            ),
        )
        return moved

    def materialize_weights(
        self,
        request: NoNEPageRequestPacket,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageWeights:
        return self.materialize_page_ids_boundary(
            session_id_t=request.session_id_t,
            generation_t=request.generation_t,
            page_ids_t=request.unique_page_ids_t,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )

    def materialize_page_bundle_ids_boundary(
        self,
        *,
        session_id_t: torch.Tensor,
        generation_t: torch.Tensor,
        page_ids_t: torch.Tensor,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageBundle:
        """Load selected weights and their page-local optimizer state."""

        authorization_started_ns = time.perf_counter_ns()
        selected_page_ids_t = self._validate_materialization_identity_boundary(
            session_id_t=session_id_t,
            generation_t=generation_t,
            page_ids_t=page_ids_t,
        )
        authorized = self._authorized_page_objects_boundary(
            selected_page_ids_t=selected_page_ids_t,
        )
        authorization_finished_ns = time.perf_counter_ns()
        loaded_rows = self._bounded_materialized_rows_boundary(
            authorized,
            lambda authorized_row: (
                self._load_materialized_bundle_row_boundary(
                    authorized_row,
                    dtype=dtype,
                )
            ),
        )
        read_dequant_finished_ns = time.perf_counter_ns()
        bundle = (
            loaded_rows[0]
            if len(loaded_rows) == 1
            else concatenate_page_bundles(loaded_rows)
        )
        if not torch.equal(bundle.weights.page_ids_t, selected_page_ids_t):
            raise RuntimeError(
                "materialized NoNE page order differs from the model route"
            )
        compose_finished_ns = time.perf_counter_ns()
        moved = _move_immutable_page_bundle_for_consumer_boundary(
            bundle,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )
        transfer_finished_ns = time.perf_counter_ns()
        self._record_page_materialization_telemetry_boundary(
            page_count=int(selected_page_ids_t.numel()),
            optimizer_bundle=True,
            cuda_target=device.type == "cuda",
            authorization_ns=(
                authorization_finished_ns - authorization_started_ns
            ),
            read_dequant_ns=(
                read_dequant_finished_ns - authorization_finished_ns
            ),
            compose_ns=compose_finished_ns - read_dequant_finished_ns,
            device_transfer_enqueue_ns=(
                transfer_finished_ns - compose_finished_ns
            ),
        )
        return moved

    def materialize_bundle(
        self,
        request: NoNEPageRequestPacket,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageBundle:
        """Load selected weights and their page-local optimizer state."""

        return self.materialize_page_bundle_ids_boundary(
            session_id_t=request.session_id_t,
            generation_t=request.generation_t,
            page_ids_t=request.unique_page_ids_t,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )


def fork_training_branch_store_boundary(
    *,
    source_store: NoNEImmutablePageStore,
    branch_root: Path,
    scope: NoNETrainingBranchScopePacket,
) -> NoNEImmutablePageStore:
    """Fork one accepted parent into an isolated pointer/object write domain.

    Historical manifests are copied because they are immutable lineage, while
    parent page objects remain read-only overlays. New branch objects and every
    later accepted pointer are written only below ``branch_root``. Branch stores
    deliberately do not publish ordinary page-store locators: their divergent
    pointers become discoverable only through a retained layer-import plan.
    """

    source_store.validate_training_branch_fork_authority_boundary(scope)
    source_binding = source_store.current_generation_binding_boundary()
    if (
        not torch.equal(source_binding.session_id_t, scope.session_id_t)
        or not torch.equal(
            source_binding.generation_t.detach().cpu().long().reshape(()),
            scope.parent_generation_t,
        )
        or not torch.equal(
            source_binding.manifest_payload_sha256_t,
            scope.parent_manifest_payload_sha256_t,
        )
    ):
        raise RuntimeError("NoNE branch fork source parent changed")

    resolved_branch_root = branch_root.expanduser().resolve()
    if resolved_branch_root in source_store.object_store_roots_boundary:
        raise RuntimeError("NoNE branch fork must own a distinct store root")
    session_key = _session_key(scope.session_id_t)
    source_session = source_store.root / "sessions" / session_key
    source_generations = source_session / "generations"
    source_pointer_path = source_session / "accepted.json"
    if not source_generations.is_dir() or not source_pointer_path.is_file():
        raise RuntimeError("NoNE branch fork source lineage is incomplete")

    branch_store = NoNEImmutablePageStore(
        resolved_branch_root,
        object_roots=source_store.object_store_roots_boundary,
        advertise_locator=False,
    )
    branch_store.begin_session(scope.session_id_t)
    branch_session = branch_store.root / "sessions" / session_key
    branch_generations = branch_session / "generations"

    copied_generations = 0
    parent_generation = int(scope.parent_generation_t)
    for source_manifest in sorted(source_generations.glob("*/generation.json")):
        manifest = _read_json(source_manifest)
        generation = manifest.get("generation")
        if (
            not isinstance(generation, int)
            or isinstance(generation, bool)
            or generation < 1
            or generation > parent_generation
        ):
            continue
        relative = source_manifest.relative_to(source_generations)
        target_manifest = branch_generations / relative
        source_sha256 = _file_sha256(source_manifest)
        if target_manifest.is_file():
            if _file_sha256(target_manifest) != source_sha256:
                raise RuntimeError("NoNE branch fork lineage already differs")
        else:
            target_manifest.parent.mkdir(parents=True, exist_ok=True)
            temporary = target_manifest.with_name(
                f".{target_manifest.name}.{os.getpid()}.tmp"
            )
            temporary.unlink(missing_ok=True)
            shutil.copyfile(source_manifest, temporary)
            with temporary.open("rb") as handle:
                os.fsync(handle.fileno())
            if _file_sha256(temporary) != source_sha256:
                temporary.unlink(missing_ok=True)
                raise RuntimeError("NoNE branch fork manifest copy changed")
            os.replace(temporary, target_manifest)
            _fsync_directory(target_manifest.parent)
        copied_generations += 1
    if copied_generations < 1:
        raise RuntimeError("NoNE branch fork copied no parent lineage")

    source_pointer = _read_json(source_pointer_path)
    if (
        source_pointer.get("generation") != parent_generation
        or source_pointer.get("manifestPayloadSha256")
        != _tensor_digest_hex(scope.parent_manifest_payload_sha256_t)
    ):
        raise RuntimeError("NoNE branch fork pointer changed")
    _atomic_json(branch_session / "accepted.json", source_pointer)
    branch_store.begin_session(scope.session_id_t)
    branch_store.validate_training_branch_fork_authority_boundary(scope)
    branch_binding = branch_store.current_generation_binding_boundary()
    if (
        not torch.equal(branch_binding.generation_t, source_binding.generation_t)
        or not torch.equal(
            branch_binding.manifest_payload_sha256_t,
            source_binding.manifest_payload_sha256_t,
        )
    ):
        raise RuntimeError("NoNE branch fork parent identity differs after reload")
    return branch_store


def fork_training_branch_fanout_boundary(
    *,
    source_store: NoNEImmutablePageStore,
    output_root: Path,
    branch_count: int,
    scope_selection: str | None = None,
    allowed_page_ids_t: torch.Tensor | None = None,
) -> dict[str, Any]:
    """Fork the current untrained admission cohort into disjoint writer domains.

    The host partitions storage ownership only.  It neither chooses model
    routes nor changes the accepted pointer.  Each branch retains the complete
    parent catalog for inference while gradients are restricted to its sealed,
    nonoverlapping page identities. A capacity-admission generation owns its
    newly changed, still-untrained pages first; historical untrained pages stay
    available for later disjoint fanouts.
    """

    trained_depth_scope_selection = "accepted_training_proven_pages_for_depth"
    prior_generation_untrained_scope_selection = (
        "accepted_untrained_prior_generation_remainder"
    )
    all_untrained_scope_selection = "accepted_all_untrained_pages"
    non_exempt_full_source_scope_selection = (
        "accepted_non_exempt_full_source_retraining"
    )
    inherited_scope_retraining_selection = (
        "accepted_inherited_scope_retraining"
    )
    if isinstance(branch_count, bool) or branch_count < 1:
        raise ValueError("NoNE training branch count must be positive")
    if scope_selection not in {
        None,
        trained_depth_scope_selection,
        prior_generation_untrained_scope_selection,
        all_untrained_scope_selection,
        non_exempt_full_source_scope_selection,
        inherited_scope_retraining_selection,
    }:
        raise ValueError("NoNE training branch scope selection is unsupported")
    parent = source_store.current_generation_binding_boundary()
    graph_authority = source_store.current_graph_authority_boundary()
    if graph_authority is None:
        raise RuntimeError("NoNE training branch fanout has no graph authority")

    def assert_parent_unchanged() -> None:
        observed = source_store.current_generation_binding_boundary()
        observed_graph = source_store.current_graph_authority_boundary()
        if (
            observed.external_record_boundary()
            != parent.external_record_boundary()
            or observed_graph is None
            or observed_graph.external_record_boundary()
            != graph_authority.external_record_boundary()
        ):
            raise RuntimeError("NoNE training branch fanout parent drifted")

    catalog_path = Path(graph_authority.page_catalog_path).expanduser().resolve()
    topology = _load_page_catalog_topology_boundary(
        catalog_path=catalog_path,
        expected_sha256=_tensor_digest_hex(
            graph_authority.page_catalog_sha256_t
        ),
        identity_cache_root=None,
    )
    if (
        topology.page_layer_ids is None
        or topology.trained_capability_claimed is None
    ):
        raise RuntimeError("NoNE training branch catalog is empty")

    accepted_page_ids_t = torch.sort(
        source_store.accepted_page_ids_t_boundary()
    ).values
    catalog_rows: list[tuple[int, int, bool]] = []
    observed_page_ids: set[int] = set()
    for page_id, layer_id, trained in zip(
        topology.page_ids,
        topology.page_layer_ids,
        topology.trained_capability_claimed,
    ):
        if page_id < 0 or layer_id < 0 or page_id in observed_page_ids:
            raise RuntimeError("NoNE training branch catalog identity is ambiguous")
        observed_page_ids.add(page_id)
        catalog_rows.append((page_id, layer_id, trained))
    catalog_page_ids_t = torch.tensor(
        sorted(observed_page_ids),
        dtype=torch.long,
    )
    if not torch.equal(catalog_page_ids_t, accepted_page_ids_t):
        raise RuntimeError("NoNE training branch catalog differs from its pointer")

    manifest_training_ids: set[int] = set()
    if source_store._manifest is not None:
        manifest_training_value = source_store._manifest.get(
            "trainingProvenPageIds", []
        )
        if (
            not isinstance(manifest_training_value, list)
            or any(
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id not in observed_page_ids
                for page_id in manifest_training_value
            )
            or len(set(manifest_training_value))
            != len(manifest_training_value)
        ):
            raise RuntimeError(
                "NoNE training branch manifest proof authority is malformed"
            )
        manifest_training_ids = set(manifest_training_value)

    accepted_untrained_rows = tuple(
        sorted(
            (
                (page_id, layer_id)
                for page_id, layer_id, trained in catalog_rows
                if not trained and page_id not in manifest_training_ids
            ),
            key=lambda row: (row[1], row[0]),
        )
    )
    accepted_capability_unclaimed_rows = tuple(
        sorted(
            (
                (page_id, layer_id)
                for page_id, layer_id, trained in catalog_rows
                if not trained
            ),
            key=lambda row: (row[1], row[0]),
        )
    )
    accepted_unproven_capability_unclaimed_rows = tuple(
        row
        for row in accepted_capability_unclaimed_rows
        if row[0] not in manifest_training_ids
    )
    current_generation_page_ids = {
        int(page_id)
        for page_id in parent.updated_page_ids_t.detach().cpu().long().reshape(-1)
    }
    current_generation_untrained_rows = tuple(
        row
        for row in accepted_untrained_rows
        if row[0] in current_generation_page_ids
    )
    prior_generation_untrained_rows = tuple(
        row
        for row in accepted_untrained_rows
        if row[0] not in current_generation_page_ids
    )
    trained_depth_scope = scope_selection == trained_depth_scope_selection
    if trained_depth_scope:
        if manifest_training_ids != observed_page_ids:
            raise RuntimeError(
                "NoNE trained-depth fanout requires every accepted page "
                "to be training-proven"
            )
        scoped_rows = tuple(
            sorted(
                (
                    (page_id, layer_id)
                    for page_id, layer_id, _trained in catalog_rows
                    if page_id in manifest_training_ids
                ),
                key=lambda row: (row[1], row[0]),
            )
        )
        scope_selection_value = trained_depth_scope_selection
        scoped_to_current_generation = False
    elif scope_selection == prior_generation_untrained_scope_selection:
        # Preserve the latest changed cohort for its already-sealed branch
        # family and advance the older untrained remainder independently.  The
        # selection comes only from the accepted generation binding, so it
        # remains correct after page-count growth or pointer relocation.
        scoped_to_current_generation = False
        scoped_rows = prior_generation_untrained_rows
        scope_selection_value = prior_generation_untrained_scope_selection
    elif scope_selection == all_untrained_scope_selection:
        # A complete corpus pass must cover every page that lacks accepted
        # training proof, including both the current admission cohort and the
        # earlier remainder.  The resulting scopes remain disjoint writers;
        # this expands gradient ownership without granting route or pointer
        # authority to the host.
        scoped_to_current_generation = False
        scoped_rows = accepted_untrained_rows
        scope_selection_value = all_untrained_scope_selection
    elif scope_selection == non_exempt_full_source_scope_selection:
        # Full-source recovery owns every capability-unclaimed page that still
        # lacks cumulative accepted proof.  The accepted manifest, rather than
        # the immutable catalog annotation, is the resume authority; repeating
        # a manifest-proven page would discard its durable cursor semantics.
        scoped_to_current_generation = False
        scoped_rows = accepted_unproven_capability_unclaimed_rows
        scope_selection_value = non_exempt_full_source_scope_selection
    elif scope_selection == inherited_scope_retraining_selection:
        # New, disjoint corpus WorkIDs must be allowed to update every page in
        # the inherited branch scope, including pages that gained training
        # proof on the prior corpus. The explicit descendant boundary supplies
        # the sealed upper bound; this selector cannot widen to sibling pages.
        if allowed_page_ids_t is None:
            raise RuntimeError(
                "NoNE inherited-scope retraining requires an explicit "
                "descendant page authority"
            )
        inherited_page_ids = set(
            allowed_page_ids_t.detach().cpu().long().reshape(-1).tolist()
        )
        scoped_to_current_generation = False
        scoped_rows = tuple(
            (page_id, layer_id)
            for page_id, layer_id, _trained in catalog_rows
            if page_id in inherited_page_ids
        )
        scope_selection_value = inherited_scope_retraining_selection
    else:
        scoped_to_current_generation = bool(current_generation_untrained_rows)
        scoped_rows = (
            current_generation_untrained_rows
            if scoped_to_current_generation
            else accepted_untrained_rows
        )
        scope_selection_value = (
            "current_generation_untrained_changed_subset"
            if scoped_to_current_generation
            else "accepted_untrained_remainder"
        )
    if allowed_page_ids_t is not None:
        allowed_page_ids = set(
            allowed_page_ids_t.detach().cpu().long().reshape(-1).tolist()
        )
        scoped_page_ids = {page_id for page_id, _layer_id in scoped_rows}
        if (
            not allowed_page_ids
            or len(allowed_page_ids)
            != int(allowed_page_ids_t.numel())
            or not scoped_page_ids.issubset(allowed_page_ids)
        ):
            raise RuntimeError(
                "NoNE descendant fanout exceeds its inherited page scope"
            )
    if not scoped_rows or branch_count > len(scoped_rows):
        raise RuntimeError("NoNE training branch fanout exceeds scoped pages")
    buckets: list[list[tuple[int, int]]] = [
        [] for _branch_index in range(branch_count)
    ]
    for row_index, row in enumerate(scoped_rows):
        buckets[row_index % branch_count].append(row)

    scopes = tuple(
        source_store.seal_training_branch_fork_authority_boundary(
            page_ids_t=torch.tensor(
                [page_id for page_id, _layer_id in bucket],
                dtype=torch.long,
            ),
            page_layer_ids_t=torch.tensor(
                [layer_id for _page_id, layer_id in bucket],
                dtype=torch.long,
            ),
        )
        for bucket in buckets
    )
    union_page_ids_t = validate_common_parent_training_branch_scopes_boundary(
        scopes
    )
    expected_scoped_page_ids_t = torch.tensor(
        sorted(page_id for page_id, _layer_id in scoped_rows),
        dtype=torch.long,
    )
    if not torch.equal(union_page_ids_t, expected_scoped_page_ids_t):
        raise RuntimeError("NoNE training branch fanout lost physical page layers")

    resolved_output_root = output_root.expanduser().resolve()
    if resolved_output_root.exists():
        raise FileExistsError("NoNE training branch fanout output already exists")
    resolved_output_root.parent.mkdir(parents=True, exist_ok=True)
    temporary_root = resolved_output_root.with_name(
        f".{resolved_output_root.name}.{os.getpid()}.tmp"
    )
    if temporary_root.exists():
        raise FileExistsError("NoNE training branch fanout temporary output exists")
    temporary_root.mkdir(parents=True)

    branch_records: list[dict[str, Any]] = []
    for branch_index, scope in enumerate(scopes):
        relative_root = Path("branches") / f"branch_{branch_index:04d}"
        temporary_branch_root = temporary_root / relative_root / "store"
        final_branch_root = resolved_output_root / relative_root / "store"
        temporary_scope_path = temporary_root / relative_root / "scope.json"
        final_scope_path = resolved_output_root / relative_root / "scope.json"
        _atomic_json(
            temporary_scope_path,
            scope.external_record_boundary(),
        )
        fork_training_branch_store_boundary(
            source_store=source_store,
            branch_root=temporary_branch_root,
            scope=scope,
        )
        branch_records.append(
            {
                "branchIndex": branch_index,
                "scopePath": str(final_scope_path),
                "scopeFileSha256": _file_sha256(temporary_scope_path),
                "scopeSha256": _tensor_digest_hex(scope.scope_sha256_t),
                "storeRoot": str(final_branch_root),
                "physicalGraphLayerCount": int(scope.page_ids_t.numel()),
                "pageIdsSha256": hashlib.sha256(
                    scope.page_ids_t.contiguous().numpy().tobytes(order="C")
                ).hexdigest(),
                "residentLayerIds": sorted(
                    set(scope.page_layer_ids_t.tolist())
                ),
                "routingAuthority": False,
                "globalTrainingClaimed": False,
            }
        )

    every_accepted_untrained_page_owned = (
        len(scoped_rows) == len(accepted_untrained_rows)
    )
    full_source_retraining_scope = (
        scope_selection == non_exempt_full_source_scope_selection
    )
    inherited_scope_retraining = (
        scope_selection == inherited_scope_retraining_selection
    )
    receipt: dict[str, Any] = {
        "schema": (
            "nnf.resynthesis.none_training_branch_fanout.v3"
            if trained_depth_scope
            else "nnf.resynthesis.none_training_branch_fanout.v5"
            if inherited_scope_retraining
            else "nnf.resynthesis.none_training_branch_fanout.v4"
            if full_source_retraining_scope
            else "nnf.resynthesis.none_training_branch_fanout.v2"
        ),
        "passed": True,
        "sourceStoreRoot": str(source_store.root),
        "sourceCompositionPath": graph_authority.composition_path,
        "sourceCompositionSha256": _tensor_digest_hex(
            graph_authority.composition_sha256_t
        ),
        "pageCatalogPath": str(catalog_path),
        "pageCatalogSha256": _tensor_digest_hex(
            graph_authority.page_catalog_sha256_t
        ),
        "parentSessionId": parent.session_id_t.tolist(),
        "parentGeneration": int(parent.generation_t),
        "parentManifestPayloadSha256": _tensor_digest_hex(
            parent.manifest_payload_sha256_t
        ),
        "acceptedPhysicalGraphLayerCount": int(accepted_page_ids_t.numel()),
        "scopeSelection": scope_selection_value,
        "branchCount": branch_count,
        "branches": branch_records,
        "sharedDenseTraversalMutationAuthority": False,
        "acceptedPointerMutated": False,
        "routingAuthority": False,
        "globalTrainingClaimed": False,
    }
    if trained_depth_scope:
        receipt.update(
            {
                "acceptedTrainingProvenPhysicalGraphLayerCount": len(
                    manifest_training_ids
                ),
                "scopedAcceptedTrainingProvenPhysicalGraphLayerCount": len(
                    scoped_rows
                ),
                "everyScopedAcceptedPhysicalGraphLayerOwnedExactlyOnce": True,
                "everyAcceptedTrainingProvenPhysicalGraphLayerOwnedExactlyOnce": (
                    len(scoped_rows) == len(manifest_training_ids)
                ),
                "everyAcceptedPhysicalGraphLayerOwnedExactlyOnce": (
                    len(scoped_rows) == int(accepted_page_ids_t.numel())
                ),
            }
        )
    elif inherited_scope_retraining:
        receipt.update(
            {
                "inheritedPhysicalGraphLayerCount": len(scoped_rows),
                "everyInheritedPhysicalGraphLayerOwnedExactlyOnce": True,
                "inheritedScopeMayRetrainProvenPagesOnUnseenWorkIds": True,
            }
        )
    elif full_source_retraining_scope:
        scoped_page_ids = {page_id for page_id, _layer_id in scoped_rows}
        validated_exempt_page_ids = sorted(
            observed_page_ids - scoped_page_ids
        )
        scoped_previously_training_proven = len(
            scoped_page_ids & manifest_training_ids
        )
        scoped_new_training = len(scoped_rows) - (
            scoped_previously_training_proven
        )
        receipt.update(
            {
                "acceptedManifestTrainingProvenPhysicalGraphLayerCount": len(
                    manifest_training_ids
                ),
                "acceptedCapabilityUnclaimedPhysicalGraphLayerCount": len(
                    accepted_capability_unclaimed_rows
                ),
                "acceptedUnprovenCapabilityUnclaimedPhysicalGraphLayerCount": len(
                    accepted_unproven_capability_unclaimed_rows
                ),
                "scopedCapabilityUnclaimedPhysicalGraphLayerCount": len(
                    scoped_rows
                ),
                "scopedPreviouslyTrainingProvenPhysicalGraphLayerCount": (
                    scoped_previously_training_proven
                ),
                "scopedNewTrainingPhysicalGraphLayerCount": scoped_new_training,
                "validatedTrainingExemptPhysicalGraphLayerCount": len(
                    validated_exempt_page_ids
                ),
                "validatedTrainingExemptPageIds": validated_exempt_page_ids,
                "validatedTrainingExemptPageIdsSha256": (
                    hashlib.sha256(
                        json.dumps(
                            validated_exempt_page_ids,
                            sort_keys=True,
                            separators=(",", ":"),
                        ).encode("utf-8")
                    ).hexdigest()
                ),
                "everyScopedCapabilityUnclaimedPhysicalGraphLayerOwnedExactlyOnce": (
                    True
                ),
                "everyNonExemptPhysicalGraphLayerOwnedExactlyOnce": (
                    len(scoped_rows)
                    == len(accepted_unproven_capability_unclaimed_rows)
                ),
            }
        )
    else:
        receipt.update(
            {
                "acceptedUntrainedPhysicalGraphLayerCount": len(
                    accepted_untrained_rows
                ),
                "currentGenerationUntrainedPhysicalGraphLayerCount": len(
                    current_generation_untrained_rows
                ),
                "untrainedPhysicalGraphLayerCount": len(scoped_rows),
                "scopedUntrainedPhysicalGraphLayerCount": len(scoped_rows),
                "everyScopedUntrainedPhysicalGraphLayerOwnedExactlyOnce": True,
                "everyUntrainedPhysicalGraphLayerOwnedExactlyOnce": (
                    every_accepted_untrained_page_owned
                ),
            }
        )
    assert_parent_unchanged()
    _fsync_directory(temporary_root)
    os.replace(temporary_root, resolved_output_root)
    _fsync_directory(resolved_output_root.parent)
    assert_parent_unchanged()

    receipt_path = resolved_output_root / "fanout_receipt.json"
    _atomic_json(receipt_path, receipt)
    receipt_sha256 = _file_sha256(receipt_path)
    receipt_sha256_path = resolved_output_root / "fanout_receipt.sha256"
    _atomic_bytes(
        receipt_sha256_path,
        f"{receipt_sha256}  {receipt_path.name}\n".encode("ascii"),
    )
    assert_parent_unchanged()

    for scope, branch_record in zip(scopes, branch_records, strict=True):
        branch_store = NoNEImmutablePageStore(
            Path(str(branch_record["storeRoot"])),
            object_roots=source_store.object_store_roots_boundary,
            advertise_locator=False,
        )
        branch_store.begin_session(scope.session_id_t)
        branch_store.validate_training_branch_fork_authority_boundary(scope)
    return {
        **receipt,
        "fanoutReceiptPath": str(receipt_path),
        "fanoutReceiptSha256": receipt_sha256,
        "fanoutReceiptSha256Path": str(receipt_sha256_path),
    }


def fork_training_branch_fanout_from_composition_boundary(
    *,
    composition_path: Path,
    output_root: Path,
    branch_count: int,
    scope_selection: str | None = None,
) -> dict[str, Any]:
    """Auto-discover the live pointer from one stable composition anchor."""

    resolved_composition_path = composition_path.expanduser().resolve()
    composition = _read_json(resolved_composition_path)
    page_store = composition.get("pageStore")
    if not isinstance(page_store, dict):
        raise RuntimeError("NoNE branch fanout composition has no page store")
    anchor_root_value = page_store.get("root")
    session_values = page_store.get("sessionId")
    seed_pointer = page_store.get("acceptedPointer")
    if (
        not isinstance(anchor_root_value, str)
        or not anchor_root_value
        or not isinstance(session_values, list)
        or not session_values
        or any(
            not isinstance(value, int) or isinstance(value, bool)
            for value in session_values
        )
        or not isinstance(seed_pointer, dict)
    ):
        raise RuntimeError("NoNE branch fanout composition identity is malformed")
    session_id_t = torch.tensor(session_values, dtype=torch.long)
    anchor_root = Path(anchor_root_value).expanduser().resolve()
    # A branch fanout must follow the composition's own live accepted pointer
    # when that canonical store is present.  Global locator discovery remains
    # the relocation fallback, but cannot let an unrelated divergent branch
    # outrank the root's current lineage merely because it advertises the same
    # session id at a higher generation.
    local_packets = discover_page_store_locators_boundary(
        session_id_t=session_id_t,
        anchor_roots=(anchor_root,),
        registry_roots=(),
    )
    source_store = NoNEImmutablePageStore.discover_from_anchor_boundary(
        anchor_root=anchor_root,
        session_id_t=session_id_t,
        expected_pointer=seed_pointer,
        registry_roots=() if local_packets else None,
    )
    return fork_training_branch_fanout_boundary(
        source_store=source_store,
        output_root=output_root,
        branch_count=branch_count,
        scope_selection=scope_selection,
    )


def fork_training_branch_fanout_from_explicit_descendant_boundary(
    *,
    source_store_root: Path,
    source_scope: NoNETrainingBranchScopePacket,
    expected_pointer: Mapping[str, Any],
    output_root: Path,
    branch_count: int,
    scope_selection: str,
) -> dict[str, Any]:
    """Fork one exact branch descendant without canonical-store discovery.

    A retained branch pointer is intentionally not globally advertised.  A
    composition-root lookup can therefore select a different canonical
    descendant even when both stores share the same session.  This boundary
    accepts the already validated pointer identity explicitly, disables
    registry fallback, and prevents a nested fanout from widening beyond the
    source branch's sealed page ownership.
    """

    validate_training_branch_scope_boundary(source_scope)
    generation = expected_pointer.get("generation")
    manifest_payload_sha256 = expected_pointer.get(
        "manifestPayloadSha256"
    )
    if (
        type(generation) is not int
        or generation < 1
        or not isinstance(manifest_payload_sha256, str)
        or len(manifest_payload_sha256) != 64
    ):
        raise RuntimeError("NoNE explicit descendant pointer identity differs")
    resolved_store_root = source_store_root.expanduser().resolve()
    source_store = NoNEImmutablePageStore.discover_from_anchor_boundary(
        anchor_root=resolved_store_root,
        session_id_t=source_scope.session_id_t,
        expected_pointer={
            "generation": generation,
            "manifestPayloadSha256": manifest_payload_sha256,
        },
        registry_roots=(),
    )
    source_binding = source_store.current_generation_binding_boundary()
    if (
        int(source_binding.generation_t) != generation
        or _tensor_digest_hex(
            source_binding.manifest_payload_sha256_t
        )
        != manifest_payload_sha256
    ):
        raise RuntimeError("NoNE explicit descendant pointer drifted")
    return fork_training_branch_fanout_boundary(
        source_store=source_store,
        output_root=output_root,
        branch_count=branch_count,
        scope_selection=scope_selection,
        allowed_page_ids_t=source_scope.page_ids_t,
    )


def load_layer_page_import_plan_boundary(
    plan_path: Path,
    *,
    target_composition_path: Path | None = None,
    registry_roots: tuple[Path, ...] | None = None,
) -> NoNELayerPageImportPlanPacket:
    """Resolve one sealed branch plan into fail-closed import packets.

    The plan carries artifact locations only.  Generation identity, retained
    training proof, held-out gain, and store ownership are reconstructed from
    the hash-bound checkpoint sidecar and cold-reload proof rather than trusted
    from host-authored routing fields.
    """

    resolved_plan_path = plan_path.expanduser().resolve()
    plan = _read_json(resolved_plan_path)
    if plan.get("schema") != "nnf.resynthesis.none_layer_branch_plan.v1":
        raise RuntimeError("NoNE layer branch plan schema differs")

    def artifact(record: object, *, field: str) -> Path:
        if not isinstance(record, dict):
            raise RuntimeError(f"NoNE branch {field} artifact is malformed")
        raw_path = record.get("path")
        expected_sha256 = record.get("sha256")
        if (
            not isinstance(raw_path, str)
            or not raw_path
            or not isinstance(expected_sha256, str)
            or len(expected_sha256) != 64
        ):
            raise RuntimeError(f"NoNE branch {field} artifact identity differs")
        path = Path(raw_path).expanduser().resolve()
        if not path.is_file() or _file_sha256(path) != expected_sha256:
            raise RuntimeError(f"NoNE branch {field} artifact bytes differ")
        return path

    target_composition_record = plan.get("targetComposition")
    if target_composition_path is None:
        resolved_target_composition_path = artifact(
            target_composition_record,
            field="target composition",
        )
    else:
        if not isinstance(target_composition_record, dict):
            raise RuntimeError("NoNE branch target composition artifact is malformed")
        expected_target_sha256 = target_composition_record.get("sha256")
        resolved_target_composition_path = (
            target_composition_path.expanduser().resolve()
        )
        if (
            not isinstance(expected_target_sha256, str)
            or len(expected_target_sha256) != 64
            or not resolved_target_composition_path.is_file()
            or _file_sha256(resolved_target_composition_path)
            != expected_target_sha256
        ):
            raise RuntimeError("NoNE branch target composition bytes differ")
    assert isinstance(target_composition_record, dict)
    target_composition_sha256 = str(target_composition_record["sha256"])
    raw_branches = plan.get("branches")
    if not isinstance(raw_branches, list) or not raw_branches:
        raise RuntimeError("NoNE layer branch plan has no branches")

    source_stores: list[NoNEImmutablePageStore] = []
    packets: list[NoNELayerPageImportPacket] = []
    observed_page_ids: set[int] = set()
    for branch_index, raw_branch in enumerate(raw_branches):
        if not isinstance(raw_branch, dict):
            raise RuntimeError("NoNE layer branch row is malformed")
        checkpoint_path = artifact(
            raw_branch.get("sourceCheckpoint"),
            field=f"branch {branch_index} checkpoint",
        )
        optimizer_path = artifact(
            raw_branch.get("sourceOptimizer"),
            field=f"branch {branch_index} optimizer",
        )
        external_state_path = artifact(
            raw_branch.get("sourceExternalState"),
            field=f"branch {branch_index} external state",
        )
        cold_reload_path = artifact(
            raw_branch.get("coldReloadProof"),
            field=f"branch {branch_index} cold reload",
        )
        layer_id = raw_branch.get("layerId")
        raw_page_ids = raw_branch.get("pageIds")
        if (
            not isinstance(layer_id, int)
            or isinstance(layer_id, bool)
            or layer_id < 0
            or not isinstance(raw_page_ids, list)
            or not raw_page_ids
            or not all(
                isinstance(page_id, int)
                and not isinstance(page_id, bool)
                and page_id >= 0
                for page_id in raw_page_ids
            )
            or len(set(raw_page_ids)) != len(raw_page_ids)
            or observed_page_ids.intersection(raw_page_ids)
        ):
            raise RuntimeError("NoNE layer branch page scope is malformed")
        observed_page_ids.update(raw_page_ids)

        sidecar = _read_json(external_state_path)
        external_state = sidecar.get("externalState")
        generation = (
            external_state.get("generationBinding")
            if isinstance(external_state, dict)
            else None
        )
        training = (
            external_state.get("trainingProof")
            if isinstance(external_state, dict)
            else None
        )
        store_root = (
            external_state.get("storeRoot")
            if isinstance(external_state, dict)
            else None
        )
        if (
            sidecar.get("schema")
            != "nnf.resynthesis.additive_external_checkpoint_binding.v1"
            or sidecar.get("checkpointSha256") != _file_sha256(checkpoint_path)
            or sidecar.get("optimizerSha256") != _file_sha256(optimizer_path)
            or not isinstance(generation, dict)
            or generation.get("schema")
            != "nnf.resynthesis.none_generation_binding.v1"
            or not isinstance(training, dict)
            or training.get("schema")
            != "nnf.resynthesis.none_family_training_proof.v1"
            or not isinstance(store_root, str)
            or not store_root
        ):
            raise RuntimeError("NoNE layer branch sidecar authority differs")

        session_id = generation.get("sessionId")
        source_generation_value = generation.get("generation")
        parent_generation_value = generation.get("parentGeneration")
        manifest = generation.get("manifest")
        manifest_sha256 = generation.get("manifestSha256")
        manifest_payload_sha256 = generation.get("manifestPayloadSha256")
        updated_page_ids = generation.get("updatedPageIds")
        if (
            not isinstance(session_id, list)
            or not session_id
            or not all(
                isinstance(value, int) and not isinstance(value, bool)
                for value in session_id
            )
            or not isinstance(source_generation_value, int)
            or isinstance(source_generation_value, bool)
            or source_generation_value < 1
            or not isinstance(parent_generation_value, int)
            or isinstance(parent_generation_value, bool)
            or parent_generation_value < 0
            or not isinstance(manifest, str)
            or not manifest
            or not isinstance(manifest_sha256, str)
            or len(manifest_sha256) != 64
            or not isinstance(manifest_payload_sha256, str)
            or len(manifest_payload_sha256) != 64
            or not isinstance(updated_page_ids, list)
            or not updated_page_ids
            or not all(
                isinstance(page_id, int) and not isinstance(page_id, bool)
                for page_id in updated_page_ids
            )
        ):
            raise RuntimeError("NoNE layer branch generation identity differs")
        source_generation = NoNEGenerationBinding(
            session_id_t=torch.tensor(session_id, dtype=torch.long),
            generation_t=torch.tensor(source_generation_value, dtype=torch.long),
            parent_generation_t=torch.tensor(
                parent_generation_value,
                dtype=torch.long,
            ),
            manifest_sha256_t=digest_tensor(manifest_sha256),
            manifest_payload_sha256_t=digest_tensor(manifest_payload_sha256),
            updated_page_ids_t=torch.tensor(updated_page_ids, dtype=torch.long),
            manifest_relative_path=manifest,
        )

        proof_page_ids = training.get("trainingPageIds")
        route_counts = training.get("routeCounts")
        gradient_update_counts = training.get("gradientUpdateCounts")
        gradient_norms = training.get("gradientNorms")
        parameter_delta_norms = training.get("parameterDeltaNorms")
        gradient_signatures = training.get("gradientSignatures")
        proof_width = len(proof_page_ids) if isinstance(proof_page_ids, list) else 0
        if (
            proof_width < 1
            or training.get("familyPageIds") != proof_page_ids
            or not all(
                isinstance(values, list) and len(values) == proof_width
                for values in (
                    route_counts,
                    gradient_update_counts,
                    gradient_norms,
                    parameter_delta_norms,
                    gradient_signatures,
                )
            )
            or not all(
                training.get(field) is True
                for field in (
                    "routeCoverage",
                    "gradientCoverage",
                    "distinctGradients",
                    "finite",
                    "promotionReady",
                )
            )
        ):
            raise RuntimeError("NoNE layer branch training proof is malformed")
        training_proof = NoNEPageTrainingProofPacket(
            family_page_ids_t=torch.tensor(proof_page_ids, dtype=torch.long),
            route_count_t=torch.tensor(route_counts, dtype=torch.long),
            gradient_update_count_t=torch.tensor(
                gradient_update_counts,
                dtype=torch.long,
            ),
            gradient_norm_t=torch.tensor(gradient_norms, dtype=torch.float32),
            parameter_delta_norm_t=torch.tensor(
                parameter_delta_norms,
                dtype=torch.float32,
            ),
            gradient_signature_t=torch.tensor(
                gradient_signatures,
                dtype=torch.float32,
            ),
            route_coverage_t=torch.ones((), dtype=torch.bool),
            gradient_coverage_t=torch.ones((), dtype=torch.bool),
            distinct_gradient_t=torch.ones((), dtype=torch.bool),
            finite_t=torch.ones((), dtype=torch.bool),
            promotion_ready_t=torch.ones((), dtype=torch.bool),
        )
        if (
            training_proof.gradient_signature_t.ndim != 2
            or not torch.isfinite(training_proof.gradient_signature_t).all()
        ):
            raise RuntimeError("NoNE layer branch gradient proof differs")

        cold_reload = _read_json(cold_reload_path)
        training_heldout_gain = cold_reload.get("trainingHeldoutGain")
        knowledge_retention = cold_reload.get("knowledgeRetention")
        heldout_gain = (
            training_heldout_gain.get("passRateDelta")
            if isinstance(training_heldout_gain, dict)
            else None
        )
        cold_retention_delta = (
            knowledge_retention.get("passRateDelta")
            if isinstance(knowledge_retention, dict)
            else None
        )
        if (
            cold_reload.get("schema")
            != "nnf.resynthesis.cold_reload_promotion_proof.v1"
            or cold_reload.get("passed") is not True
            or not isinstance(training_heldout_gain, dict)
            or training_heldout_gain.get("retentionVerified") is not True
            or not isinstance(knowledge_retention, dict)
            or knowledge_retention.get("retentionVerified") is not True
            or not isinstance(heldout_gain, (int, float))
            or isinstance(heldout_gain, bool)
            or not math.isfinite(float(heldout_gain))
            or float(heldout_gain) <= 0.0
            or not isinstance(cold_retention_delta, (int, float))
            or isinstance(cold_retention_delta, bool)
            or not math.isfinite(float(cold_retention_delta))
            or float(cold_retention_delta) < 0.0
        ):
            raise RuntimeError("NoNE layer branch retained gain differs")
        source_store = NoNEImmutablePageStore.discover_from_anchor_boundary(
            anchor_root=Path(store_root).expanduser().resolve(),
            session_id_t=source_generation.session_id_t,
            expected_pointer={
                "generation": source_generation_value,
                "manifestPayloadSha256": manifest_payload_sha256,
            },
            registry_roots=registry_roots,
        )
        source_store.verify_generation_boundary(
            generation_t=source_generation.generation_t,
            manifest_payload_sha256_t=(
                source_generation.manifest_payload_sha256_t
            ),
            manifest_sha256_t=source_generation.manifest_sha256_t,
        )
        source_stores.append(source_store)
        packets.append(
            NoNELayerPageImportPacket(
                source_generation=source_generation,
                layer_id_t=torch.tensor(layer_id, dtype=torch.long),
                page_ids_t=torch.tensor(raw_page_ids, dtype=torch.long),
                page_layer_ids_t=torch.full(
                    (len(raw_page_ids),),
                    layer_id,
                    dtype=torch.long,
                ),
                training_proof=training_proof,
                heldout_gain_t=torch.tensor(float(heldout_gain)),
                anti_forgetting_retained_t=torch.ones((), dtype=torch.bool),
                cold_reload_verified_t=torch.ones((), dtype=torch.bool),
                source_checkpoint_path=str(checkpoint_path),
                source_optimizer_path=str(optimizer_path),
                source_external_state_path=str(external_state_path),
                cold_reload_proof_path=str(cold_reload_path),
            )
        )

    return NoNELayerPageImportPlanPacket(
        plan_path=str(resolved_plan_path),
        plan_sha256_t=digest_tensor(_file_sha256(resolved_plan_path)),
        target_composition_path=str(resolved_target_composition_path),
        target_composition_sha256_t=digest_tensor(target_composition_sha256),
        source_stores=tuple(source_stores),
        packets=tuple(packets),
    )


def _layer_branch_registry_root_boundary(page_registry_root: Path) -> Path:
    """Place branch registries beside mount-local page-store registries."""

    resolved = page_registry_root.expanduser().resolve()
    return (
        resolved.parent / "layer-branches"
        if resolved.name == "page-stores"
        else resolved / "layer-branches"
    )


def _layer_branch_registry_roots_boundary(
    *,
    plan_path: Path | None = None,
    anchor_roots: tuple[Path, ...] = (),
    registry_roots: tuple[Path, ...] | None = None,
) -> tuple[Path, ...]:
    page_registry_roots = (
        _default_page_store_registry_roots_boundary()
        if registry_roots is None
        else tuple(root.expanduser().resolve() for root in registry_roots)
    )
    roots = {
        _layer_branch_registry_root_boundary(root)
        for root in page_registry_roots
    }
    if plan_path is not None:
        roots.add(
            plan_path.expanduser().resolve().parent
            / ".nnf-resynthesis/layer-branches"
        )
    for anchor_root in anchor_roots:
        resolved_anchor = anchor_root.expanduser().resolve()
        roots.add(
            resolved_anchor
            if resolved_anchor.name == "layer-branches"
            else resolved_anchor / ".nnf-resynthesis/layer-branches"
        )
    return tuple(sorted(roots, key=str))


def _composition_session_identity_boundary(
    composition_path: Path,
) -> tuple[int, ...]:
    composition = _read_json(composition_path)
    page_store = composition.get("pageStore")
    session_id = page_store.get("sessionId") if isinstance(page_store, dict) else None
    if (
        not isinstance(session_id, list)
        or not session_id
        or any(
            not isinstance(value, int) or isinstance(value, bool)
            for value in session_id
        )
    ):
        raise RuntimeError("NoNE branch target composition session differs")
    return tuple(session_id)


def publish_layer_page_import_plan_locator_boundary(
    plan_path: Path,
    *,
    registry_roots: tuple[Path, ...] | None = None,
) -> tuple[Path, ...]:
    """Publish one immutable branch plan to every observed failure domain.

    The copied plan is content-addressed.  Locators advertise evidence only;
    they cannot select branches, routes, pages, or accepted generations.
    """

    resolved_plan = plan_path.expanduser().resolve()
    loaded = load_layer_page_import_plan_boundary(
        resolved_plan,
        registry_roots=registry_roots,
    )
    target_path = Path(loaded.target_composition_path).resolve()
    target_sha256 = _tensor_digest_hex(loaded.target_composition_sha256_t)
    target_session = _composition_session_identity_boundary(target_path)
    branch_sessions = {
        tuple(
            packet.source_generation.session_id_t.detach().cpu().long().tolist()
        )
        for packet in loaded.packets
    }
    if branch_sessions != {target_session}:
        raise RuntimeError("NoNE branch plan crossed session ownership")
    plan_payload = resolved_plan.read_bytes()
    plan_sha256 = hashlib.sha256(plan_payload).hexdigest()
    locator_payload: dict[str, Any] = {
        "schema": LAYER_BRANCH_PLAN_LOCATOR_SCHEMA,
        "sessionId": list(target_session),
        "targetCompositionSha256": target_sha256,
        "planSha256": plan_sha256,
        "planOriginalPath": str(resolved_plan),
        "planObjectRelativePath": f"objects/{plan_sha256}.json",
        "pointerReadAtUse": True,
        "targetCapabilityClaimed": False,
        "acceptedPointerMutationAuthority": False,
        "routingAuthority": False,
    }
    written: list[Path] = []
    for root in _layer_branch_registry_roots_boundary(
        plan_path=resolved_plan,
        registry_roots=registry_roots,
    ):
        object_path = root / "objects" / f"{plan_sha256}.json"
        locator_path = (
            root / "targets" / target_sha256 / f"{plan_sha256}.json"
        )
        _atomic_bytes(object_path, plan_payload)
        _atomic_json(locator_path, locator_payload)
        written.append(locator_path)
    return tuple(written)


def discover_layer_page_import_plans_boundary(
    target_composition_path: Path,
    *,
    anchor_roots: tuple[Path, ...] = (),
    registry_roots: tuple[Path, ...] | None = None,
) -> NoNELayerPageImportDiscoveryPacket:
    """Discover and flatten every coherent branch plan for one target graph."""

    resolved_target = target_composition_path.expanduser().resolve()
    if not resolved_target.is_file():
        raise FileNotFoundError(f"NoNE target composition missing: {resolved_target}")
    target_sha256 = _file_sha256(resolved_target)
    target_session = _composition_session_identity_boundary(resolved_target)
    accepted_plans: dict[str, tuple[Path, NoNELayerPageImportPlanPacket, Path]] = {}
    rejected: list[Path] = []
    observed_locators: list[Path] = []
    for root in _layer_branch_registry_roots_boundary(
        anchor_roots=anchor_roots,
        registry_roots=registry_roots,
    ):
        target_root = root / "targets" / target_sha256
        try:
            candidate_locator_paths = tuple(
                sorted(target_root.glob("*.json"), key=str)
            )
        except OSError:
            continue
        for locator_path in candidate_locator_paths:
            observed_locators.append(locator_path)
            try:
                locator = _read_json(locator_path)
                session_id = locator.get("sessionId")
                plan_sha256 = locator.get("planSha256")
                original_path_value = locator.get("planOriginalPath")
                object_relative_value = locator.get("planObjectRelativePath")
                if (
                    locator.get("schema") != LAYER_BRANCH_PLAN_LOCATOR_SCHEMA
                    or locator.get("targetCompositionSha256") != target_sha256
                    or session_id != list(target_session)
                    or not isinstance(plan_sha256, str)
                    or len(plan_sha256) != 64
                    or not isinstance(original_path_value, str)
                    or not original_path_value
                    or not isinstance(object_relative_value, str)
                    or object_relative_value != f"objects/{plan_sha256}.json"
                    or locator.get("pointerReadAtUse") is not True
                    or locator.get("targetCapabilityClaimed") is not False
                    or locator.get("acceptedPointerMutationAuthority") is not False
                    or locator.get("routingAuthority") is not False
                ):
                    raise RuntimeError("NoNE layer branch locator differs")
                plan_candidates = (
                    root / object_relative_value,
                    Path(original_path_value).expanduser().resolve(),
                )
                plan_object = next(
                    (
                        path
                        for path in plan_candidates
                        if path.is_file() and _file_sha256(path) == plan_sha256
                    ),
                    None,
                )
                if plan_object is None:
                    raise RuntimeError("NoNE layer branch plan object is absent")
                loaded = load_layer_page_import_plan_boundary(
                    plan_object,
                    target_composition_path=resolved_target,
                    registry_roots=registry_roots,
                )
                if (
                    _tensor_digest_hex(loaded.plan_sha256_t) != plan_sha256
                    or _tensor_digest_hex(loaded.target_composition_sha256_t)
                    != target_sha256
                    or any(
                        tuple(
                            packet.source_generation.session_id_t
                            .detach()
                            .cpu()
                            .long()
                            .tolist()
                        )
                        != target_session
                        for packet in loaded.packets
                    )
                ):
                    raise RuntimeError("NoNE discovered branch plan identity differs")
                accepted_plans.setdefault(
                    plan_sha256,
                    (plan_object.resolve(), loaded, locator_path.resolve()),
                )
            except (OSError, RuntimeError, TypeError, ValueError):
                rejected.append(locator_path.resolve())
    if observed_locators and not accepted_plans:
        raise RuntimeError("NoNE layer branch discovery found no coherent plan")

    source_stores: list[NoNEImmutablePageStore] = []
    packets: list[NoNELayerPageImportPacket] = []
    plan_paths: list[str] = []
    locator_paths: list[str] = []
    observed_page_ids: set[int] = set()
    for plan_sha256 in sorted(accepted_plans):
        plan_path, plan, locator_path = accepted_plans[plan_sha256]
        for packet in plan.packets:
            page_ids = set(packet.page_ids_t.detach().cpu().long().tolist())
            if observed_page_ids.intersection(page_ids):
                raise RuntimeError("NoNE discovered layer branches update the same page")
            observed_page_ids.update(page_ids)
        source_stores.extend(plan.source_stores)
        packets.extend(plan.packets)
        plan_paths.append(str(plan_path))
        locator_paths.append(str(locator_path))
    return NoNELayerPageImportDiscoveryPacket(
        target_composition_path=str(resolved_target),
        target_composition_sha256_t=digest_tensor(target_sha256),
        locator_paths=tuple(locator_paths),
        plan_paths=tuple(plan_paths),
        rejected_locator_paths=tuple(sorted({str(path) for path in rejected})),
        source_stores=tuple(source_stores),
        packets=tuple(packets),
    )


def _manifest_payload_sha256(manifest: Mapping[str, Any]) -> str:
    synthetic_fields = (
        {"pageObjects"}
        if manifest.get("schema") == PAGE_GENERATION_DELTA_SCHEMA
        else set()
    )
    payload = {
        key: value
        for key, value in manifest.items()
        if key != "manifestPayloadSha256" and key not in synthetic_fields
    }
    return hashlib.sha256(_canonical_json_bytes(payload)).hexdigest()


def _valid_sha256_boundary(value: object) -> bool:
    return bool(
        isinstance(value, str)
        and len(value) == 64
        and all(character in "0123456789abcdef" for character in value)
    )


def _retirement_intent_path_boundary(receipt_path: Path) -> Path:
    resolved = receipt_path.expanduser().resolve()
    return resolved.with_name(f"{resolved.name}.intent.json")


def _retirement_lock_paths_boundary(
    *,
    primary_pointer_path: Path,
    replica_pointer_path: Path,
    branch_records: Iterable[Mapping[str, Any]],
) -> tuple[Path, ...]:
    paths = {
        primary_pointer_path.parent / "generation_writer.lock",
        replica_pointer_path.parent / "generation_writer.lock",
    }
    for record in branch_records:
        session_root = Path(str(record["sessionRoot"])).expanduser().resolve()
        scope_path = Path(str(record["scopePath"])).expanduser().resolve()
        store_root = Path(str(record["storeRoot"])).expanduser().resolve()
        scope_file_sha256 = str(record["scopeFileSha256"])
        scope_identity = hashlib.sha256(
            json.dumps(
                {
                    "scopePath": str(scope_path),
                    "scopeSha256": scope_file_sha256,
                    "storeRoot": str(store_root),
                },
                sort_keys=True,
                separators=(",", ":"),
            ).encode("utf-8")
        ).hexdigest()
        expected_writer_path = (
            scope_path.parent / f".{scope_identity}.training_writer.lock"
        ).resolve()
        recorded_writer_path = Path(
            str(record["branchWriterLockPath"])
        ).expanduser().resolve()
        if recorded_writer_path != expected_writer_path:
            raise RuntimeError("NoNE branch retirement writer lease identity differs")
        paths.add(session_root / "generation_writer.lock")
        paths.add(recorded_writer_path)
    return tuple(sorted(paths, key=str))


def _acquire_retirement_locks_boundary(
    lock_paths: Iterable[Path],
) -> list[BinaryIO]:
    handles: list[BinaryIO] = []
    try:
        for lock_path in lock_paths:
            resolved = lock_path.expanduser().resolve()
            resolved.parent.mkdir(parents=True, exist_ok=True)
            handle = resolved.open("a+b")
            try:
                fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
            except BlockingIOError as error:
                handle.close()
                raise RuntimeError(
                    f"NoNE branch retirement lease is already held: {resolved}"
                ) from error
            handles.append(handle)
        return handles
    except Exception:
        for cleanup_handle in reversed(handles):
            try:
                fcntl.flock(cleanup_handle.fileno(), fcntl.LOCK_UN)
            finally:
                cleanup_handle.close()
        raise


def _release_retirement_locks_boundary(handles: Iterable[BinaryIO]) -> None:
    for handle in reversed(tuple(handles)):
        try:
            fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
        finally:
            handle.close()


def _branch_retirement_plan_boundary(store_root: Path) -> dict[str, Any]:
    resolved_root = store_root.expanduser().resolve()
    scope_path = (resolved_root.parent / "scope.json").resolve()
    sessions_root = resolved_root / "sessions"
    objects_root = resolved_root / "objects/sha256"
    if (
        not resolved_root.is_dir()
        or not scope_path.is_file()
        or not sessions_root.is_dir()
        or not objects_root.is_dir()
    ):
        raise RuntimeError("NoNE branch retirement store authority is incomplete")
    scope_file_sha256 = _file_sha256(scope_path)
    scope = _read_json(scope_path)
    scope_sha256 = scope.get("scopeSha256")
    if (
        scope.get("schema") != TRAINING_BRANCH_SCOPE_SCHEMA
        or not _valid_sha256_boundary(scope_sha256)
        or scope.get("routingAuthority") is not False
        or scope.get("acceptedPointerMutationAuthority") is not False
        or scope.get("globalTrainingClaimed") is not False
    ):
        raise RuntimeError("NoNE branch retirement scope differs")
    pointer_paths = tuple(sorted(sessions_root.glob("*/accepted.json")))
    if len(pointer_paths) != 1:
        raise RuntimeError("NoNE branch retirement requires one accepted session")
    pointer_path = pointer_paths[0].resolve()
    session_root = pointer_path.parent.resolve()
    pointer = _read_json(pointer_path)
    pointer_sha256 = _file_sha256(pointer_path)
    manifest_relative = pointer.get("manifest")
    if (
        pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA
        or pointer.get("sessionKey") != session_root.name
        or not isinstance(manifest_relative, str)
        or not manifest_relative
        or not _valid_sha256_boundary(pointer.get("manifestSha256"))
        or not _valid_sha256_boundary(pointer.get("manifestPayloadSha256"))
    ):
        raise RuntimeError("NoNE branch retirement accepted pointer differs")
    accepted_manifest_path = (session_root / manifest_relative).resolve()
    manifest_paths = tuple(
        sorted((session_root / "generations").glob("*/generation.json"))
    )
    if (
        not accepted_manifest_path.is_relative_to(session_root)
        or not accepted_manifest_path.is_file()
        or accepted_manifest_path not in manifest_paths
    ):
        raise RuntimeError("NoNE branch retirement accepted manifest is absent")
    manifest_records: list[dict[str, Any]] = []
    for index, manifest_path in enumerate(manifest_paths):
        manifest = _read_json(manifest_path)
        manifest_sha256 = _file_sha256(manifest_path)
        generation = manifest.get("generation")
        payload_sha256 = manifest.get("manifestPayloadSha256")
        if (
            not page_generation_schema_supported_boundary(
                manifest.get("schema")
            )
            or manifest.get("sessionKey") != session_root.name
            or not isinstance(generation, int)
            or isinstance(generation, bool)
            or generation < 1
            or not _valid_sha256_boundary(payload_sha256)
            or _manifest_payload_sha256(manifest) != payload_sha256
        ):
            raise RuntimeError("NoNE branch retirement manifest differs")
        manifest_records.append(
            {
                "path": str(manifest_path),
                "sha256": manifest_sha256,
                "manifestPayloadSha256": payload_sha256,
                "generation": generation,
                "archiveRelativePath": (
                    f"originals/manifests/{index:08d}_{manifest_sha256}.json"
                ),
            }
        )
    if (
        _file_sha256(accepted_manifest_path) != pointer.get("manifestSha256")
        or _read_json(accepted_manifest_path).get("manifestPayloadSha256")
        != pointer.get("manifestPayloadSha256")
    ):
        raise RuntimeError("NoNE branch retirement pointer manifest differs")
    staged_names = tuple(
        sorted(
            str(path)
            for pattern in ("*.tmp", "*.partial", "*.staged")
            for path in session_root.rglob(pattern)
        )
    )
    if staged_names:
        raise RuntimeError("NoNE branch retirement found staged store artifacts")
    scope_identity = hashlib.sha256(
        json.dumps(
            {
                "scopePath": str(scope_path),
                "scopeSha256": scope_file_sha256,
                "storeRoot": str(resolved_root),
            },
            sort_keys=True,
            separators=(",", ":"),
        ).encode("utf-8")
    ).hexdigest()
    return {
        "storeRoot": str(resolved_root),
        "scopePath": str(scope_path),
        "scopeFileSha256": scope_file_sha256,
        "scopeSha256": scope_sha256,
        "sessionRoot": str(session_root),
        "sessionKey": session_root.name,
        "branchWriterLockPath": str(
            (scope_path.parent / f".{scope_identity}.training_writer.lock").resolve()
        ),
        "acceptedPointerPath": str(pointer_path),
        "acceptedPointerSha256": pointer_sha256,
        "acceptedPointer": pointer,
        "acceptedManifestPath": str(accepted_manifest_path),
        "acceptedManifestSha256": pointer["manifestSha256"],
        "acceptedManifestPayloadSha256": pointer["manifestPayloadSha256"],
        "generationManifests": manifest_records,
    }


def _retirement_original_json_boundary(
    *,
    artifact_path: Path,
    archive_path: Path,
    expected_sha256: str,
) -> dict[str, Any]:
    for candidate in (artifact_path, archive_path):
        if candidate.is_file() and _file_sha256(candidate) == expected_sha256:
            return _read_json(candidate)
    raise RuntimeError("NoNE branch retirement original metadata is absent")


def _retirement_generation_manifest_authority_boundary(
    *,
    artifact_path: Path,
    archive_path: Path,
    expected_sha256: str,
) -> dict[str, Any]:
    """Hydrate one exact live or archived generation manifest."""

    for candidate in (artifact_path, archive_path):
        if candidate.is_file() and _file_sha256(candidate) == expected_sha256:
            manifest_sha256, manifest, _payload_sha256, _page_rows = (
                _read_generation_manifest_authority_cached(candidate)
            )
            if manifest_sha256 != expected_sha256:
                raise RuntimeError(
                    "NoNE branch retirement manifest authority changed"
                )
            return manifest
    raise RuntimeError("NoNE branch retirement original metadata is absent")


def _validate_branch_retirement_authority_boundary(
    *,
    primary_pointer_path: Path,
    replica_pointer_path: Path,
    union_receipt_path: Path,
    union_proof_path: Path,
    branch_records: tuple[dict[str, Any], ...],
    transaction_sha256: str | None,
) -> tuple[dict[str, Any], dict[str, Any], dict[str, Any]]:
    primary_pointer = _read_json(primary_pointer_path)
    replica_pointer = _read_json(replica_pointer_path)
    primary_pointer_sha256 = _file_sha256(primary_pointer_path)
    replica_pointer_sha256 = _file_sha256(replica_pointer_path)
    if (
        primary_pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA
        or primary_pointer != replica_pointer
        or primary_pointer_sha256 != replica_pointer_sha256
    ):
        raise RuntimeError("NoNE global accepted pointers differ")
    manifest_relative = primary_pointer.get("manifest")
    if not isinstance(manifest_relative, str) or not manifest_relative:
        raise RuntimeError("NoNE global accepted manifest identity is absent")
    primary_manifest_path = (
        primary_pointer_path.parent / manifest_relative
    ).resolve()
    replica_manifest_path = (
        replica_pointer_path.parent / manifest_relative
    ).resolve()
    (
        primary_manifest_sha256,
        primary_manifest,
        primary_manifest_payload_sha256,
        _primary_page_rows,
    ) = _read_generation_manifest_authority_cached(primary_manifest_path)
    (
        replica_manifest_sha256,
        replica_manifest,
        replica_manifest_payload_sha256,
        _replica_page_rows,
    ) = _read_generation_manifest_authority_cached(replica_manifest_path)
    if (
        not primary_manifest_path.is_relative_to(primary_pointer_path.parent)
        or not replica_manifest_path.is_relative_to(replica_pointer_path.parent)
        or primary_manifest != replica_manifest
        or primary_manifest_sha256 != primary_pointer.get("manifestSha256")
        or replica_manifest_sha256 != replica_pointer.get("manifestSha256")
        or primary_manifest_payload_sha256
        != primary_pointer.get("manifestPayloadSha256")
        or replica_manifest_payload_sha256
        != replica_pointer.get("manifestPayloadSha256")
    ):
        raise RuntimeError("NoNE global accepted manifests differ")
    union_receipt = _read_json(union_receipt_path)
    if (
        union_receipt.get("passed") is not True
        or union_receipt.get("operation")
        != "accept-none-training-branch-union"
        or union_receipt.get("acceptedPointer") != primary_pointer
        or union_receipt.get("replicaPointersAdvancedBeforeCanonical") is not True
        or union_receipt.get("branchCount") != len(branch_records)
    ):
        raise RuntimeError("NoNE accepted branch-union receipt differs")
    staged_path_value = union_receipt.get("stagedBindingPath")
    staged_sha256 = union_receipt.get("stagedBindingSha256")
    if (
        not isinstance(staged_path_value, str)
        or not _valid_sha256_boundary(staged_sha256)
        or _file_sha256(Path(staged_path_value)) != staged_sha256
    ):
        raise RuntimeError("NoNE accepted branch-union staging proof differs")
    components = primary_manifest.get("components")
    training_proof = (
        components.get("trainingProof")
        if isinstance(components, dict)
        else None
    )
    proof_record = (
        training_proof.get("record")
        if isinstance(training_proof, dict)
        else None
    )
    expected_proof_sha256 = (
        proof_record.get("sha256") if isinstance(proof_record, dict) else None
    )
    union_proof = _read_json(union_proof_path)
    if (
        not _valid_sha256_boundary(expected_proof_sha256)
        or _file_sha256(union_proof_path) != expected_proof_sha256
        or union_proof.get("schema") != TRAINING_BRANCH_UNION_PROOF_SCHEMA
        or union_proof.get("acceptedGeneration")
        != primary_pointer.get("generation")
        or union_proof.get("trainingPageIds")
        != union_receipt.get("unionPageIds")
        or union_proof.get("unionPageLayerIds")
        != union_receipt.get("unionLayerIds")
    ):
        raise RuntimeError("NoNE accepted branch-union proof differs")
    scope_records = [
        _retirement_original_json_boundary(
            artifact_path=Path(str(record["scopePath"])),
            archive_path=Path(str(record["scopePath"])),
            expected_sha256=str(record["scopeFileSha256"]),
        )
        for record in branch_records
    ]
    first_scope = scope_records[0]
    session_id = first_scope.get("sessionId")
    if (
        not isinstance(session_id, list)
        or len(session_id) != 4
        or any(
            not isinstance(value, int) or isinstance(value, bool)
            for value in session_id
        )
    ):
        raise RuntimeError("NoNE branch retirement session identity differs")
    binding = NoNEGenerationBinding(
        session_id_t=torch.tensor(session_id, dtype=torch.long),
        generation_t=torch.tensor(primary_manifest.get("generation")),
        parent_generation_t=torch.tensor(primary_manifest.get("parentGeneration")),
        manifest_sha256_t=digest_tensor(str(primary_pointer["manifestSha256"])),
        manifest_payload_sha256_t=digest_tensor(
            str(primary_pointer["manifestPayloadSha256"])
        ),
        updated_page_ids_t=torch.tensor(
            primary_manifest.get("updatedPageIds"), dtype=torch.long
        ),
        manifest_relative_path=manifest_relative,
    )
    validate_training_branch_union_proof_record_boundary(
        union_proof,
        generation_binding=binding,
        generation_manifest=primary_manifest,
    )
    expected_scope_sha256s = set(union_proof.get("branchScopeSha256s", ()))
    observed_scope_sha256s = {
        str(record["scopeSha256"]) for record in branch_records
    }
    if (
        len(observed_scope_sha256s) != len(branch_records)
        or observed_scope_sha256s != expected_scope_sha256s
    ):
        raise RuntimeError("NoNE accepted branch-union scopes differ")
    global_rows = primary_manifest.get("pageObjects")
    if not isinstance(global_rows, list):
        raise RuntimeError("NoNE global accepted page objects are absent")
    global_by_id = {
        int(row["pageId"]): row
        for row in global_rows
        if isinstance(row, dict)
        and isinstance(row.get("pageId"), int)
        and not isinstance(row.get("pageId"), bool)
    }
    union_page_ids = union_proof.get("trainingPageIds")
    if not isinstance(union_page_ids, list):
        raise RuntimeError("NoNE accepted branch-union page identities are absent")
    observed_updated_ids: set[int] = set()
    for record, scope in zip(branch_records, scope_records, strict=True):
        if (
            scope.get("schema") != TRAINING_BRANCH_SCOPE_SCHEMA
            or scope.get("scopeSha256") != record["scopeSha256"]
            or scope.get("sessionId") != session_id
            or scope.get("parentGeneration") != union_proof.get("parentGeneration")
            or scope.get("parentManifestPayloadSha256")
            != union_proof.get("parentManifestPayloadSha256")
        ):
            raise RuntimeError("NoNE branch retirement scope lineage differs")
        archive_root = (
            Path(str(record["storeRoot"]))
            / "retirements"
            / str(transaction_sha256 or "uncommitted")
        )
        accepted_manifest_path = Path(str(record["acceptedManifestPath"]))
        accepted_manifest_record = next(
            (
                manifest_record
                for manifest_record in record["generationManifests"]
                if manifest_record["path"] == str(accepted_manifest_path)
            ),
            None,
        )
        if not isinstance(accepted_manifest_record, dict):
            raise RuntimeError("NoNE branch accepted manifest plan differs")
        branch_manifest = _retirement_generation_manifest_authority_boundary(
            artifact_path=accepted_manifest_path,
            archive_path=(
                archive_root / str(accepted_manifest_record["archiveRelativePath"])
            ),
            expected_sha256=str(accepted_manifest_record["sha256"]),
        )
        updated_ids = branch_manifest.get("updatedPageIds")
        branch_rows = branch_manifest.get("pageObjects")
        scope_ids = scope.get("pageIds")
        if (
            not page_generation_schema_supported_boundary(
                branch_manifest.get("schema")
            )
            or branch_manifest.get("sessionKey") != record["sessionKey"]
            or branch_manifest.get("parentGeneration")
            != union_proof.get("parentGeneration")
            or branch_manifest.get("parentManifestPayloadSha256")
            != union_proof.get("parentManifestPayloadSha256")
            or not isinstance(updated_ids, list)
            or not updated_ids
            or len(updated_ids) != len(set(updated_ids))
            or not isinstance(scope_ids, list)
            or not set(updated_ids).issubset(scope_ids)
            or not isinstance(branch_rows, list)
        ):
            raise RuntimeError("NoNE branch accepted manifest lineage differs")
        if observed_updated_ids.intersection(updated_ids):
            raise RuntimeError("NoNE branch accepted changed pages overlap")
        observed_updated_ids.update(updated_ids)
        branch_by_id = {
            int(row["pageId"]): row
            for row in branch_rows
            if isinstance(row, dict)
            and isinstance(row.get("pageId"), int)
            and not isinstance(row.get("pageId"), bool)
        }
        if any(
            page_id not in global_by_id
            or branch_by_id.get(page_id) != global_by_id[page_id]
            for page_id in updated_ids
        ):
            raise RuntimeError(
                "NoNE branch accepted page objects were not incorporated exactly"
            )
    if observed_updated_ids != set(union_page_ids):
        raise RuntimeError("NoNE accepted branch-union changed-page set differs")
    return primary_pointer, primary_manifest, union_proof


def retire_none_training_branch_stores_boundary(
    *,
    primary_accepted_pointer_path: Path,
    replica_accepted_pointer_path: Path,
    accepted_union_receipt_path: Path,
    accepted_union_proof_path: Path,
    branch_store_roots: tuple[Path, ...],
    receipt_path: Path,
) -> dict[str, Any]:
    """Retire exact incorporated branch metadata without deleting page objects."""

    if not branch_store_roots:
        raise ValueError("NoNE branch retirement requires branch store roots")
    output_path = receipt_path.expanduser().resolve()
    intent_path = _retirement_intent_path_boundary(output_path)
    primary_pointer_path = primary_accepted_pointer_path.expanduser().resolve()
    replica_pointer_path = replica_accepted_pointer_path.expanduser().resolve()
    union_receipt_path = accepted_union_receipt_path.expanduser().resolve()
    union_proof_path = accepted_union_proof_path.expanduser().resolve()
    resolved_roots = tuple(
        sorted(
            {root.expanduser().resolve() for root in branch_store_roots},
            key=str,
        )
    )
    if len(resolved_roots) != len(branch_store_roots):
        raise RuntimeError("NoNE branch retirement repeats store roots")

    existing_intent = _read_json(intent_path) if intent_path.is_file() else None
    if existing_intent is not None:
        transaction_sha256 = existing_intent.get("transactionSha256")
        branch_values = existing_intent.get("branches")
        inputs = existing_intent.get("inputs")
        unsigned = {
            key: value
            for key, value in existing_intent.items()
            if key != "transactionSha256"
        }
        if (
            existing_intent.get("schema")
            != TRAINING_BRANCH_RETIREMENT_INTENT_SCHEMA
            or existing_intent.get("passed") is not False
            or not _valid_sha256_boundary(transaction_sha256)
            or hashlib.sha256(_canonical_json_bytes(unsigned)).hexdigest()
            != transaction_sha256
            or not isinstance(branch_values, list)
            or not branch_values
            or not isinstance(inputs, dict)
            or inputs.get("primaryAcceptedPointerPath")
            != str(primary_pointer_path)
            or inputs.get("replicaAcceptedPointerPath")
            != str(replica_pointer_path)
            or inputs.get("acceptedUnionReceiptPath") != str(union_receipt_path)
            or inputs.get("acceptedUnionProofPath") != str(union_proof_path)
            or sorted(
                str(Path(str(row.get("storeRoot"))).expanduser().resolve())
                for row in branch_values
                if isinstance(row, dict)
            )
            != [str(root) for root in resolved_roots]
        ):
            raise RuntimeError("NoNE branch retirement intent differs")
        branch_records = tuple(
            dict(row) for row in branch_values if isinstance(row, dict)
        )
    else:
        transaction_sha256 = None
        branch_records = tuple(
            _branch_retirement_plan_boundary(root) for root in resolved_roots
        )

    lock_paths = _retirement_lock_paths_boundary(
        primary_pointer_path=primary_pointer_path,
        replica_pointer_path=replica_pointer_path,
        branch_records=branch_records,
    )
    handles = _acquire_retirement_locks_boundary(lock_paths)
    try:
        if existing_intent is None:
            refreshed = tuple(
                _branch_retirement_plan_boundary(root) for root in resolved_roots
            )
            if refreshed != branch_records:
                raise RuntimeError("NoNE branch retirement authority changed")
            unsigned_intent: dict[str, Any] = {
                "schema": TRAINING_BRANCH_RETIREMENT_INTENT_SCHEMA,
                "passed": False,
                "status": "BRANCH_METADATA_RETIREMENT_STARTED",
                "inputs": {
                    "primaryAcceptedPointerPath": str(primary_pointer_path),
                    "primaryAcceptedPointerSha256": _file_sha256(
                        primary_pointer_path
                    ),
                    "replicaAcceptedPointerPath": str(replica_pointer_path),
                    "replicaAcceptedPointerSha256": _file_sha256(
                        replica_pointer_path
                    ),
                    "acceptedUnionReceiptPath": str(union_receipt_path),
                    "acceptedUnionReceiptSha256": _file_sha256(
                        union_receipt_path
                    ),
                    "acceptedUnionProofPath": str(union_proof_path),
                    "acceptedUnionProofSha256": _file_sha256(union_proof_path),
                    "retirementReceiptPath": str(output_path),
                },
                "branches": list(branch_records),
                "objectDeletionAuthorized": False,
                "reachabilityReclaimRequiresPassedReceipt": True,
            }
            transaction_sha256 = hashlib.sha256(
                _canonical_json_bytes(unsigned_intent)
            ).hexdigest()
            intent = {
                **unsigned_intent,
                "transactionSha256": transaction_sha256,
            }
            _atomic_json(intent_path, intent)
            existing_intent = intent
        assert isinstance(transaction_sha256, str)
        intent_sha256 = _file_sha256(intent_path)
        inputs = existing_intent["inputs"]
        if (
            _file_sha256(primary_pointer_path)
            != inputs["primaryAcceptedPointerSha256"]
            or _file_sha256(replica_pointer_path)
            != inputs["replicaAcceptedPointerSha256"]
            or _file_sha256(union_receipt_path)
            != inputs["acceptedUnionReceiptSha256"]
            or _file_sha256(union_proof_path)
            != inputs["acceptedUnionProofSha256"]
        ):
            raise RuntimeError("NoNE branch retirement input authority changed")
        primary_pointer, _primary_manifest, union_proof = (
            _validate_branch_retirement_authority_boundary(
                primary_pointer_path=primary_pointer_path,
                replica_pointer_path=replica_pointer_path,
                union_receipt_path=union_receipt_path,
                union_proof_path=union_proof_path,
                branch_records=branch_records,
                transaction_sha256=transaction_sha256,
            )
        )

        completed_branches: list[dict[str, Any]] = []
        for record in branch_records:
            store_root = Path(str(record["storeRoot"]))
            archive_root = (
                store_root / "retirements" / transaction_sha256
            ).resolve()
            pointer_path = Path(str(record["acceptedPointerPath"]))
            pointer_archive_path = archive_root / "originals/accepted.json"
            pointer_original = _retirement_original_json_boundary(
                artifact_path=pointer_path,
                archive_path=pointer_archive_path,
                expected_sha256=str(record["acceptedPointerSha256"]),
            )
            pointer_bytes_path = (
                pointer_path
                if pointer_path.is_file()
                and _file_sha256(pointer_path)
                == record["acceptedPointerSha256"]
                else pointer_archive_path
            )
            _atomic_bytes(pointer_archive_path, pointer_bytes_path.read_bytes())
            manifest_tombstones: list[dict[str, Any]] = []
            for manifest_record in record["generationManifests"]:
                manifest_path = Path(str(manifest_record["path"]))
                archive_path = (
                    archive_root / str(manifest_record["archiveRelativePath"])
                )
                _retirement_original_json_boundary(
                    artifact_path=manifest_path,
                    archive_path=archive_path,
                    expected_sha256=str(manifest_record["sha256"]),
                )
                source_path = (
                    manifest_path
                    if manifest_path.is_file()
                    and _file_sha256(manifest_path)
                    == manifest_record["sha256"]
                    else archive_path
                )
                _atomic_bytes(archive_path, source_path.read_bytes())

            pointer_tombstone = {
                "schema": TRAINING_BRANCH_RETIRED_POINTER_SCHEMA,
                "passed": True,
                "transactionSha256": transaction_sha256,
                "retirementIntentPath": str(intent_path),
                "retirementIntentSha256": intent_sha256,
                "retirementReceiptPath": str(output_path),
                "storeRoot": str(store_root),
                "sessionKey": record["sessionKey"],
                "originalAcceptedPointerSha256": record[
                    "acceptedPointerSha256"
                ],
                "originalAcceptedPointer": pointer_original,
                "originalMetadataArchiveRoot": str(archive_root / "originals"),
                "acceptedGlobalGeneration": primary_pointer["generation"],
                "acceptedGlobalManifestPayloadSha256": primary_pointer[
                    "manifestPayloadSha256"
                ],
                "acceptedUnionSha256": union_proof["unionSha256"],
                "objectDeletionAuthorized": False,
            }
            current_pointer = _read_json(pointer_path)
            if current_pointer != pointer_tombstone:
                if _file_sha256(pointer_path) != record["acceptedPointerSha256"]:
                    raise RuntimeError(
                        "NoNE branch accepted pointer changed before tombstone"
                    )
                _atomic_json(pointer_path, pointer_tombstone)
            pointer_tombstone_sha256 = _file_sha256(pointer_path)

            for manifest_record in record["generationManifests"]:
                manifest_path = Path(str(manifest_record["path"]))
                archive_path = (
                    archive_root / str(manifest_record["archiveRelativePath"])
                )
                manifest_tombstone = {
                    "schema": TRAINING_BRANCH_RETIRED_MANIFEST_SCHEMA,
                    "passed": True,
                    "transactionSha256": transaction_sha256,
                    "retirementIntentSha256": intent_sha256,
                    "storeRoot": str(store_root),
                    "sessionKey": record["sessionKey"],
                    "generation": manifest_record["generation"],
                    "originalManifestSha256": manifest_record["sha256"],
                    "originalManifestPayloadSha256": manifest_record[
                        "manifestPayloadSha256"
                    ],
                    "originalManifestArchivePath": str(archive_path),
                    "objectDeletionAuthorized": False,
                }
                current_manifest = _read_json(manifest_path)
                if current_manifest != manifest_tombstone:
                    if _file_sha256(manifest_path) != manifest_record["sha256"]:
                        raise RuntimeError(
                            "NoNE branch manifest changed before tombstone"
                        )
                    _atomic_json(manifest_path, manifest_tombstone)
                manifest_tombstones.append(
                    {
                        "path": str(manifest_path),
                        "sha256": _file_sha256(manifest_path),
                        "generation": manifest_record["generation"],
                        "originalSha256": manifest_record["sha256"],
                        "originalArchivePath": str(archive_path),
                    }
                )
            branch_receipt_path = archive_root / "retirement.json"
            branch_receipt = {
                "schema": TRAINING_BRANCH_STORE_RETIREMENT_SCHEMA,
                "passed": True,
                "status": "BRANCH_METADATA_RETIRED",
                "transactionSha256": transaction_sha256,
                "retirementIntentPath": str(intent_path),
                "retirementIntentSha256": intent_sha256,
                "retirementReceiptPath": str(output_path),
                "storeRoot": str(store_root),
                "scopePath": record["scopePath"],
                "scopeFileSha256": record["scopeFileSha256"],
                "scopeSha256": record["scopeSha256"],
                "acceptedPointerPath": str(pointer_path),
                "acceptedPointerTombstoneSha256": pointer_tombstone_sha256,
                "originalAcceptedPointerSha256": record[
                    "acceptedPointerSha256"
                ],
                "manifestTombstones": manifest_tombstones,
                "originalMetadataArchiveRoot": str(archive_root / "originals"),
                "objectDeletionPerformed": False,
                "reachabilityReclaimPermittedAfterGlobalReceipt": True,
                "generationWriterLeaseHeld": True,
                "branchWriterLeaseHeld": True,
            }
            _atomic_json(branch_receipt_path, branch_receipt)
            completed_branches.append(
                {
                    "storeRoot": str(store_root),
                    "scopePath": record["scopePath"],
                    "scopeFileSha256": record["scopeFileSha256"],
                    "scopeSha256": record["scopeSha256"],
                    "acceptedPointerPath": str(pointer_path),
                    "acceptedPointerTombstoneSha256": pointer_tombstone_sha256,
                    "originalAcceptedPointerSha256": record[
                        "acceptedPointerSha256"
                    ],
                    "retiredManifestCount": len(manifest_tombstones),
                    "retirementReceiptPath": str(branch_receipt_path),
                    "retirementReceiptSha256": _file_sha256(
                        branch_receipt_path
                    ),
                    "originalMetadataArchiveRoot": str(
                        archive_root / "originals"
                    ),
                }
            )

        if (
            _file_sha256(primary_pointer_path)
            != inputs["primaryAcceptedPointerSha256"]
            or _file_sha256(replica_pointer_path)
            != inputs["replicaAcceptedPointerSha256"]
        ):
            raise RuntimeError(
                "NoNE global accepted pointer changed during branch retirement"
            )
        receipt = {
            "schema": TRAINING_BRANCH_RETIREMENT_SCHEMA,
            "passed": True,
            "status": "INCORPORATED_BRANCH_METADATA_RETIRED",
            "transactionSha256": transaction_sha256,
            "retirementIntentPath": str(intent_path),
            "retirementIntentSha256": intent_sha256,
            "primaryAcceptedPointerPath": str(primary_pointer_path),
            "primaryAcceptedPointerSha256": inputs[
                "primaryAcceptedPointerSha256"
            ],
            "replicaAcceptedPointerPath": str(replica_pointer_path),
            "replicaAcceptedPointerSha256": inputs[
                "replicaAcceptedPointerSha256"
            ],
            "acceptedGeneration": primary_pointer["generation"],
            "acceptedManifestPayloadSha256": primary_pointer[
                "manifestPayloadSha256"
            ],
            "acceptedUnionReceiptPath": str(union_receipt_path),
            "acceptedUnionReceiptSha256": inputs[
                "acceptedUnionReceiptSha256"
            ],
            "acceptedUnionProofPath": str(union_proof_path),
            "acceptedUnionProofSha256": inputs[
                "acceptedUnionProofSha256"
            ],
            "acceptedUnionSha256": union_proof["unionSha256"],
            "branchCount": len(completed_branches),
            "branches": completed_branches,
            "checks": {
                "globalPointersMatchedExactly": True,
                "globalManifestsMatchedExactly": True,
                "acceptedUnionReceiptMatchedGlobalPointer": True,
                "acceptedUnionProofValidated": True,
                "branchScopesMatchedUnionExactly": True,
                "branchChangedPagesPartitionedUnionExactly": True,
                "branchPageObjectsIncorporatedExactly": True,
                "globalWriterLeasesHeld": True,
                "branchGenerationWriterLeasesHeld": True,
                "branchTrainingWriterLeasesHeld": True,
                "noStagedStoreArtifacts": True,
                "metadataArchivedBeforeTombstone": True,
                "acceptedPointersAtomicallyTombstonedFirst": True,
                "generationManifestsAtomicallyTombstoned": True,
            },
            "objectDeletionPerformed": False,
            "reachabilityReclaimPermitted": True,
            "reachabilityInventoryRequiresPointerTombstoneSha256": True,
        }
        _atomic_json(output_path, receipt)
        return receipt
    finally:
        _release_retirement_locks_boundary(handles)


def _page_store_reachability_lease_boundary(
    store_root: Path,
) -> tuple[Path, Path, BinaryIO]:
    """Acquire the same session writer fence used by generation publication."""

    resolved_root = store_root.expanduser().resolve()
    objects_root = resolved_root / "objects/sha256"
    sessions_root = resolved_root / "sessions"
    if not objects_root.is_dir() or not sessions_root.is_dir():
        raise RuntimeError("NoNE page-store reachability root is incomplete")
    pointers = tuple(sorted(sessions_root.glob("*/accepted.json")))
    if len(pointers) != 1:
        raise RuntimeError(
            "NoNE page-store reachability requires one accepted session"
        )
    pointer_path = pointers[0].resolve()
    session_root = pointer_path.parent.resolve()
    if not session_root.is_relative_to(sessions_root):
        raise RuntimeError("NoNE page-store reachability session escaped its root")
    handle = (session_root / "generation_writer.lock").open("a+b")
    try:
        fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
    except BlockingIOError as exc:
        handle.close()
        raise RuntimeError(
            "NoNE generation writer lease is already held"
        ) from exc
    return resolved_root, pointer_path, handle


def _local_page_store_object_rows_boundary(
    objects_root: Path,
) -> list[dict[str, Any]]:
    local_rows: list[dict[str, Any]] = []
    for object_path in sorted(objects_root.iterdir()):
        if object_path.name.startswith("."):
            continue
        if object_path.is_symlink() or not object_path.is_file():
            raise RuntimeError("NoNE local object-store entry is not immutable")
        suffix = ".safetensors"
        if not object_path.name.endswith(suffix):
            raise RuntimeError("NoNE local object-store filename is malformed")
        object_sha256 = object_path.name[: -len(suffix)]
        if not _valid_sha256_boundary(object_sha256):
            raise RuntimeError("NoNE local object digest is malformed")
        identity = object_path.stat()
        local_rows.append(
            {
                "sha256": object_sha256,
                "bytes": identity.st_size,
                "device": identity.st_dev,
                "inode": identity.st_ino,
                "linkCount": identity.st_nlink,
                "mtimeNs": identity.st_mtime_ns,
                "ctimeNs": identity.st_ctime_ns,
                "objectsRoot": str(objects_root),
            }
        )
    return local_rows


def _page_store_authorized_object_roots_boundary(
    store_root: Path,
) -> tuple[
    tuple[Path, ...],
    _NoNEPageObjectWritePlacementAuthority | None,
]:
    """Return legacy-local plus immutable placed roots for one branch store."""

    local_objects_root = store_root / "objects/sha256"
    if (
        local_objects_root.is_symlink()
        or not local_objects_root.is_dir()
    ):
        raise RuntimeError("NoNE local object store is incomplete")
    placement = _load_page_object_write_placement_authority_boundary(
        store_root,
        validate_fanout=True,
    )
    roots = {local_objects_root.resolve()}
    if placement is not None:
        roots.add(placement.objects_root)
    return tuple(sorted(roots, key=str)), placement


def _retired_page_store_reachability_snapshot_boundary(
    *,
    store_root: Path,
    pointer_path: Path,
    pointer_sha256: str,
    pointer: Mapping[str, Any],
) -> dict[str, Any]:
    transaction_sha256 = pointer.get("transactionSha256")
    receipt_path_value = pointer.get("retirementReceiptPath")
    if (
        pointer.get("schema") != TRAINING_BRANCH_RETIRED_POINTER_SCHEMA
        or pointer.get("passed") is not True
        or not _valid_sha256_boundary(transaction_sha256)
        or not isinstance(receipt_path_value, str)
        or not receipt_path_value
        or pointer.get("storeRoot") != str(store_root)
        or pointer.get("sessionKey") != pointer_path.parent.name
        or pointer.get("objectDeletionAuthorized") is not False
    ):
        raise RuntimeError("NoNE retired branch pointer is malformed")
    retirement_receipt_path = Path(receipt_path_value).expanduser().resolve()
    retirement_receipt = _read_json(retirement_receipt_path)
    branch_rows = retirement_receipt.get("branches")
    matching_rows = (
        [
            row
            for row in branch_rows
            if isinstance(row, dict) and row.get("storeRoot") == str(store_root)
        ]
        if isinstance(branch_rows, list)
        else []
    )
    if (
        retirement_receipt.get("schema") != TRAINING_BRANCH_RETIREMENT_SCHEMA
        or retirement_receipt.get("passed") is not True
        or retirement_receipt.get("transactionSha256") != transaction_sha256
        or retirement_receipt.get("reachabilityReclaimPermitted") is not True
        or len(matching_rows) != 1
        or matching_rows[0].get("acceptedPointerTombstoneSha256")
        != pointer_sha256
    ):
        raise RuntimeError("NoNE branch retirement receipt differs")
    branch_row = matching_rows[0]
    branch_receipt_path = Path(
        str(branch_row.get("retirementReceiptPath", ""))
    ).expanduser().resolve()
    branch_receipt_sha256 = branch_row.get("retirementReceiptSha256")
    branch_receipt = _read_json(branch_receipt_path)
    manifest_rows = branch_receipt.get("manifestTombstones")
    if (
        not _valid_sha256_boundary(branch_receipt_sha256)
        or _file_sha256(branch_receipt_path) != branch_receipt_sha256
        or branch_receipt.get("schema")
        != TRAINING_BRANCH_STORE_RETIREMENT_SCHEMA
        or branch_receipt.get("passed") is not True
        or branch_receipt.get("transactionSha256") != transaction_sha256
        or branch_receipt.get("storeRoot") != str(store_root)
        or not isinstance(manifest_rows, list)
        or not manifest_rows
    ):
        raise RuntimeError("NoNE branch store retirement receipt differs")
    for row in manifest_rows:
        path = Path(str(row.get("path", ""))).expanduser().resolve()
        expected_sha256 = row.get("sha256")
        manifest_tombstone = _read_json(path)
        if (
            not isinstance(row, dict)
            or not path.is_relative_to(pointer_path.parent)
            or not _valid_sha256_boundary(expected_sha256)
            or _file_sha256(path) != expected_sha256
            or manifest_tombstone.get("schema")
            != TRAINING_BRANCH_RETIRED_MANIFEST_SCHEMA
            or manifest_tombstone.get("transactionSha256")
            != transaction_sha256
        ):
            raise RuntimeError("NoNE branch manifest tombstone differs")
    object_roots, placement = (
        _page_store_authorized_object_roots_boundary(store_root)
    )
    local_rows = [
        row
        for objects_root in object_roots
        for row in _local_page_store_object_rows_boundary(objects_root)
    ]
    local_identity_sha256 = hashlib.sha256(
        _canonical_json_bytes({"objects": local_rows})
    ).hexdigest()
    original_pointer = pointer.get("originalAcceptedPointer")
    if not isinstance(original_pointer, dict):
        raise RuntimeError("NoNE retired branch original pointer is absent")
    return {
        "schema": PAGE_STORE_REACHABILITY_SCHEMA,
        "passed": True,
        "deletionAuthorized": False,
        "storeRoot": str(store_root),
        "sessionKey": pointer_path.parent.name,
        "acceptedPointerPath": str(pointer_path),
        "acceptedPointerSha256": pointer_sha256,
        "acceptedGeneration": original_pointer.get("generation"),
        "acceptedManifestPath": original_pointer.get("manifest"),
        "acceptedManifestSha256": original_pointer.get("manifestSha256"),
        "acceptedManifestPayloadSha256": original_pointer.get(
            "manifestPayloadSha256"
        ),
        "preservedGenerationManifestCount": 0,
        "preservedGenerations": [],
        "acceptedReachableObjectCount": 0,
        "historicallyReachableObjectCount": 0,
        "localObjectCount": len(local_rows),
        "reachableLocalObjectCount": 0,
        "unreachableObjectCount": len(local_rows),
        "unreachableObjectBytes": sum(int(row["bytes"]) for row in local_rows),
        "potentialPhysicalBytesFreed": sum(
            int(row["bytes"]) for row in local_rows if int(row["linkCount"]) == 1
        ),
        "localObjectIdentitySha256": local_identity_sha256,
        "unreachableObjectSha256s": [
            str(row["sha256"]) for row in local_rows
        ],
        "unreachableObjects": local_rows,
        "acceptedPointerMustRemainExact": True,
        "generationWriterLeaseHeldDuringScan": True,
        "historicalCheckoutPreserved": False,
        "retiredBranchStore": True,
        "retirementTransactionSha256": transaction_sha256,
        "retirementReceiptPath": str(retirement_receipt_path),
        "retirementReceiptSha256": _file_sha256(retirement_receipt_path),
        "branchRetirementReceiptPath": str(branch_receipt_path),
        "branchRetirementReceiptSha256": branch_receipt_sha256,
        "branchMetadataArchived": True,
        "reachabilityReclaimPermitted": True,
        "pageObjectWritePlacementAuthoritySha256": (
            placement.authority_sha256
            if placement is not None
            else None
        ),
        "pageObjectWritePlacementProofSha256": (
            placement.placement_proof_sha256
            if placement is not None
            else None
        ),
        "authorizedObjectRoots": [
            str(objects_root) for objects_root in object_roots
        ],
    }


def _page_store_dependency_closure_boundary(
    *,
    objects_roots: tuple[Path, ...],
    object_sha256s: set[str],
) -> set[str]:
    """Retain every exact base object reachable through rev6 page deltas."""

    closure = set(object_sha256s)

    def resolve_object_path(
        object_sha256: str,
        *,
        expected_bytes: int | None = None,
    ) -> Path | None:
        matches: list[Path] = []
        for objects_root in objects_roots:
            object_path = objects_root / f"{object_sha256}.safetensors"
            if not object_path.is_file():
                continue
            if (
                expected_bytes is not None
                and object_path.stat().st_size != expected_bytes
            ):
                raise RuntimeError(
                    "NoNE reachable object byte identity differs"
                )
            if _file_sha256(object_path) != object_sha256:
                raise RuntimeError(
                    "NoNE reachable object digest differs"
                )
            matches.append(object_path)
        return min(matches, key=str) if matches else None

    def visit(object_sha256: str, chain: tuple[str, ...]) -> None:
        if object_sha256 in chain:
            raise RuntimeError("NoNE page-store dependency cycle detected")
        if len(chain) >= _BASE_BOUND_DELTA_MAX_DEPTH:
            raise RuntimeError("NoNE page-store dependency depth exceeded")
        object_path = resolve_object_path(object_sha256)
        if object_path is None:
            # Existing overlay manifests may own objects outside this local
            # failure domain. Their local reachability remains zero here.
            return
        with safe_open(  # type: ignore[no-untyped-call]
            str(object_path),
            framework="pt",
            device="cpu",
        ) as handle:
            page_ids_t = handle.get_tensor("page_ids_t").reshape(-1).long()
            if page_ids_t.shape != (1,):
                raise RuntimeError("NoNE reachable page identity is malformed")
            dependency = (
                NoNEImmutablePageStore
                ._page_delta_dependency_record_from_handle_boundary(
                    handle,
                    expected_page_id=int(page_ids_t[0]),
                )
            )
        if dependency is None:
            return
        base_sha256 = _tensor_digest_hex(
            dependency.object.object_sha256_t
        )
        base_bytes = int(dependency.object.object_bytes_t)
        base_path = resolve_object_path(
            base_sha256,
            expected_bytes=base_bytes,
        )
        if base_path is None:
            raise RuntimeError("NoNE reachable delta base object differs")
        closure.add(base_sha256)
        visit(base_sha256, (*chain, object_sha256))

    for root_sha256 in tuple(sorted(object_sha256s)):
        visit(root_sha256, ())
    return closure


def _page_store_reachability_snapshot_boundary(
    *,
    store_root: Path,
    pointer_path: Path,
    expected_accepted_pointer_sha256: str,
) -> dict[str, Any]:
    """Resolve current and historical object reachability under a writer lease."""

    if (
        len(expected_accepted_pointer_sha256) != 64
        or any(
            character not in "0123456789abcdef"
            for character in expected_accepted_pointer_sha256
        )
    ):
        raise ValueError("expected accepted pointer SHA-256 is malformed")
    pointer_sha256 = _file_sha256(pointer_path)
    if pointer_sha256 != expected_accepted_pointer_sha256:
        raise RuntimeError("NoNE accepted pointer changed before reachability scan")
    pointer = _read_json(pointer_path)
    if pointer.get("schema") == TRAINING_BRANCH_RETIRED_POINTER_SCHEMA:
        return _retired_page_store_reachability_snapshot_boundary(
            store_root=store_root,
            pointer_path=pointer_path,
            pointer_sha256=pointer_sha256,
            pointer=pointer,
        )
    session_root = pointer_path.parent.resolve()
    session_key = session_root.name
    manifest_relative = pointer.get("manifest")
    generation = pointer.get("generation")
    manifest_sha256 = pointer.get("manifestSha256")
    manifest_payload_sha256 = pointer.get("manifestPayloadSha256")
    if (
        pointer.get("schema") != PAGE_ACCEPTED_POINTER_SCHEMA
        or pointer.get("sessionKey") != session_key
        or not isinstance(generation, int)
        or isinstance(generation, bool)
        or generation < 1
        or not isinstance(manifest_relative, str)
        or not isinstance(manifest_sha256, str)
        or len(manifest_sha256) != 64
        or not isinstance(manifest_payload_sha256, str)
        or len(manifest_payload_sha256) != 64
    ):
        raise RuntimeError("NoNE accepted pointer is malformed")
    object_roots, placement = (
        _page_store_authorized_object_roots_boundary(store_root)
    )
    if placement is None:
        if (
            pointer.get("pageObjectWritePlacementAuthoritySha256")
            is not None
            or pointer.get("pageObjectWritePlacementProofSha256")
            is not None
        ):
            raise RuntimeError(
                "NoNE accepted pointer has foreign placement authority"
            )
    elif (
        pointer.get("pageObjectWritePlacementAuthoritySha256")
        != placement.authority_sha256
        or pointer.get("pageObjectWritePlacementProofSha256")
        != placement.placement_proof_sha256
    ):
        raise RuntimeError(
            "NoNE accepted pointer placement authority differs"
        )
    accepted_manifest_path = (session_root / manifest_relative).resolve()
    if (
        not accepted_manifest_path.is_relative_to(session_root)
        or not accepted_manifest_path.is_file()
        or _file_sha256(accepted_manifest_path) != manifest_sha256
    ):
        raise RuntimeError("NoNE accepted generation manifest changed")

    all_reachable_sha256s: set[str] = set()
    accepted_reachable_sha256s: set[str] = set()
    generation_rows: list[dict[str, Any]] = []
    manifest_paths = tuple(
        sorted((session_root / "generations").glob("*/generation.json"))
    )
    if not manifest_paths or accepted_manifest_path not in manifest_paths:
        raise RuntimeError("NoNE accepted manifest is absent from generation history")
    for manifest_path in manifest_paths:
        (
            resolved_manifest_sha256,
            manifest,
            resolved_payload_sha256,
            _resolved_page_rows,
        ) = _read_generation_manifest_authority_cached(manifest_path)
        manifest_generation = manifest.get("generation")
        payload_sha256 = manifest.get("manifestPayloadSha256")
        page_count = manifest.get("pageCount")
        page_objects = manifest.get("pageObjects")
        if (
            not page_generation_schema_supported_boundary(
                manifest.get("schema")
            )
            or manifest.get("sessionKey") != session_key
            or not isinstance(manifest_generation, int)
            or isinstance(manifest_generation, bool)
            or manifest_generation < 1
            or not isinstance(payload_sha256, str)
            or len(payload_sha256) != 64
            or resolved_payload_sha256 != payload_sha256
            or not isinstance(page_count, int)
            or isinstance(page_count, bool)
            or not isinstance(page_objects, list)
            or page_count != len(page_objects)
        ):
            raise RuntimeError("NoNE immutable generation manifest is malformed")
        manifest_placement_authority = manifest.get(
            "pageObjectWritePlacementAuthoritySha256"
        )
        manifest_placement_proof = manifest.get(
            "pageObjectWritePlacementProofSha256"
        )
        if placement is None:
            if (
                manifest_placement_authority is not None
                or manifest_placement_proof is not None
            ):
                raise RuntimeError(
                    "NoNE generation has foreign placement authority"
                )
        elif (
            manifest_placement_authority is None
            and manifest_placement_proof is None
        ):
            scope = placement.branch_scope
            if (
                manifest_generation != int(scope.parent_generation_t)
                or payload_sha256
                != _tensor_digest_hex(
                    scope.parent_manifest_payload_sha256_t
                )
            ):
                raise RuntimeError(
                    "NoNE generation omits placement authority"
                )
        elif (
            manifest_placement_authority != placement.authority_sha256
            or manifest_placement_proof
            != placement.placement_proof_sha256
        ):
            raise RuntimeError(
                "NoNE generation placement authority differs"
            )
        manifest_object_sha256s: set[str] = set()
        page_ids: set[int] = set()
        for row in page_objects:
            if not isinstance(row, dict):
                raise RuntimeError("NoNE generation page-object row is malformed")
            page_id = row.get("pageId")
            object_sha256 = row.get("sha256")
            object_bytes = row.get("bytes")
            if (
                not isinstance(page_id, int)
                or isinstance(page_id, bool)
                or page_id < 0
                or page_id in page_ids
                or not isinstance(object_sha256, str)
                or len(object_sha256) != 64
                or any(
                    character not in "0123456789abcdef"
                    for character in object_sha256
                )
                or not isinstance(object_bytes, int)
                or isinstance(object_bytes, bool)
                or object_bytes < 1
            ):
                raise RuntimeError("NoNE generation page-object identity differs")
            page_ids.add(page_id)
            manifest_object_sha256s.add(object_sha256)
        all_reachable_sha256s.update(manifest_object_sha256s)
        if manifest_path == accepted_manifest_path:
            if (
                manifest_generation != generation
                or payload_sha256 != manifest_payload_sha256
                or resolved_manifest_sha256 != manifest_sha256
            ):
                raise RuntimeError("NoNE accepted generation identity differs")
            accepted_reachable_sha256s = manifest_object_sha256s
        generation_rows.append(
            {
                "generation": manifest_generation,
                "manifestPath": str(manifest_path),
                "manifestPayloadSha256": payload_sha256,
                "pageCount": page_count,
            }
        )

    all_reachable_sha256s = _page_store_dependency_closure_boundary(
        objects_roots=object_roots,
        object_sha256s=all_reachable_sha256s,
    )
    accepted_reachable_sha256s = _page_store_dependency_closure_boundary(
        objects_roots=object_roots,
        object_sha256s=accepted_reachable_sha256s,
    )
    local_rows = [
        row
        for objects_root in object_roots
        for row in _local_page_store_object_rows_boundary(objects_root)
    ]
    unreachable_rows = [
        row for row in local_rows if row["sha256"] not in all_reachable_sha256s
    ]
    local_identity_sha256 = hashlib.sha256(
        _canonical_json_bytes({"objects": local_rows})
    ).hexdigest()
    unreachable_sha256s = [str(row["sha256"]) for row in unreachable_rows]
    return {
        "schema": PAGE_STORE_REACHABILITY_SCHEMA,
        "passed": True,
        "deletionAuthorized": False,
        "storeRoot": str(store_root),
        "sessionKey": session_key,
        "acceptedPointerPath": str(pointer_path),
        "acceptedPointerSha256": pointer_sha256,
        "acceptedGeneration": generation,
        "acceptedManifestPath": str(accepted_manifest_path),
        "acceptedManifestSha256": manifest_sha256,
        "acceptedManifestPayloadSha256": manifest_payload_sha256,
        "preservedGenerationManifestCount": len(generation_rows),
        "preservedGenerations": generation_rows,
        "acceptedReachableObjectCount": len(accepted_reachable_sha256s),
        "historicallyReachableObjectCount": len(all_reachable_sha256s),
        "localObjectCount": len(local_rows),
        "reachableLocalObjectCount": sum(
            row["sha256"] in all_reachable_sha256s for row in local_rows
        ),
        "unreachableObjectCount": len(unreachable_rows),
        "unreachableObjectBytes": sum(
            int(row["bytes"]) for row in unreachable_rows
        ),
        "potentialPhysicalBytesFreed": sum(
            int(row["bytes"])
            for row in unreachable_rows
            if int(row["linkCount"]) == 1
        ),
        "localObjectIdentitySha256": local_identity_sha256,
        "unreachableObjectSha256s": unreachable_sha256s,
        "unreachableObjects": unreachable_rows,
        "acceptedPointerMustRemainExact": True,
        "generationWriterLeaseHeldDuringScan": True,
        "historicalCheckoutPreserved": True,
        "pageObjectWritePlacementAuthoritySha256": (
            placement.authority_sha256
            if placement is not None
            else None
        ),
        "pageObjectWritePlacementProofSha256": (
            placement.placement_proof_sha256
            if placement is not None
            else None
        ),
        "authorizedObjectRoots": [
            str(objects_root) for objects_root in object_roots
        ],
    }


def build_none_page_store_reachability_receipt_boundary(
    *,
    store_root: Path,
    expected_accepted_pointer_sha256: str,
    receipt_path: Path,
) -> dict[str, Any]:
    """Inventory only object links absent from every immutable generation."""

    resolved_root, pointer_path, handle = _page_store_reachability_lease_boundary(
        store_root
    )
    try:
        receipt = _page_store_reachability_snapshot_boundary(
            store_root=resolved_root,
            pointer_path=pointer_path,
            expected_accepted_pointer_sha256=(
                expected_accepted_pointer_sha256
            ),
        )
        _atomic_json(receipt_path.expanduser().resolve(), receipt)
        if _file_sha256(pointer_path) != expected_accepted_pointer_sha256:
            raise RuntimeError("NoNE accepted pointer changed during reachability scan")
        return receipt
    finally:
        fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
        handle.close()


def reclaim_none_page_store_unreachable_objects_boundary(
    *,
    store_root: Path,
    reachability_receipt_path: Path,
    receipt_path: Path,
) -> dict[str, Any]:
    """Remove only a stable, pre-inventoried set of unreferenced object links."""

    inventory_path = reachability_receipt_path.expanduser().resolve()
    inventory = _read_json(inventory_path)
    inventory_sha256 = _file_sha256(inventory_path)
    expected_pointer_sha256 = inventory.get("acceptedPointerSha256")
    if (
        inventory.get("schema") != PAGE_STORE_REACHABILITY_SCHEMA
        or inventory.get("passed") is not True
        or inventory.get("deletionAuthorized") is not False
        or not isinstance(expected_pointer_sha256, str)
        or len(expected_pointer_sha256) != 64
    ):
        raise RuntimeError("NoNE page-store reachability receipt is malformed")
    resolved_root, pointer_path, handle = _page_store_reachability_lease_boundary(
        store_root
    )
    output_path = receipt_path.expanduser().resolve()
    try:
        if inventory.get("storeRoot") != str(resolved_root):
            raise RuntimeError("NoNE reachability receipt store root differs")
        current = _page_store_reachability_snapshot_boundary(
            store_root=resolved_root,
            pointer_path=pointer_path,
            expected_accepted_pointer_sha256=expected_pointer_sha256,
        )
        if (
            current["localObjectIdentitySha256"]
            != inventory.get("localObjectIdentitySha256")
            or current["unreachableObjects"]
            != inventory.get("unreachableObjects")
            or current["authorizedObjectRoots"]
            != inventory.get("authorizedObjectRoots")
            or current["pageObjectWritePlacementAuthoritySha256"]
            != inventory.get(
                "pageObjectWritePlacementAuthoritySha256"
            )
            or current["pageObjectWritePlacementProofSha256"]
            != inventory.get("pageObjectWritePlacementProofSha256")
        ):
            raise RuntimeError(
                "NoNE page-store objects changed after reachability inventory"
            )
        intent = {
            "schema": PAGE_STORE_RECLAIM_SCHEMA,
            "passed": False,
            "status": "UNREACHABLE_OBJECT_RECLAIM_STARTED",
            "storeRoot": str(resolved_root),
            "reachabilityReceiptPath": str(inventory_path),
            "reachabilityReceiptSha256": inventory_sha256,
            "acceptedPointerPath": str(pointer_path),
            "acceptedPointerSha256": expected_pointer_sha256,
            "plannedObjectCount": current["unreachableObjectCount"],
            "plannedObjectBytes": current["unreachableObjectBytes"],
            "plannedObjectSha256s": current["unreachableObjectSha256s"],
            "historicalCheckoutPreserved": current[
                "historicalCheckoutPreserved"
            ],
            "retiredBranchStore": current.get("retiredBranchStore", False),
            "retirementTransactionSha256": current.get(
                "retirementTransactionSha256"
            ),
            "generationWriterLeaseHeld": True,
        }
        _atomic_json(output_path, intent)
        authorized_object_roots = {
            Path(str(value)).expanduser().resolve()
            for value in current["authorizedObjectRoots"]
        }
        touched_object_roots: set[Path] = set()
        for row in current["unreachableObjects"]:
            object_sha256 = str(row["sha256"])
            objects_root = Path(
                str(row.get("objectsRoot", ""))
            ).expanduser().resolve()
            if objects_root not in authorized_object_roots:
                raise RuntimeError(
                    "NoNE unreachable object escaped placement authority"
                )
            object_path = (
                objects_root / f"{object_sha256}.safetensors"
            ).resolve()
            if (
                not object_path.is_relative_to(objects_root)
                or object_path.stat().st_size != int(row["bytes"])
                or object_path.stat().st_ino != int(row["inode"])
                or object_path.stat().st_dev != int(row["device"])
            ):
                raise RuntimeError(
                    "NoNE unreachable object identity changed before deletion"
                )
            object_path.unlink()
            touched_object_roots.add(objects_root)
        for objects_root in sorted(touched_object_roots, key=str):
            _fsync_directory(objects_root)
        if _file_sha256(pointer_path) != expected_pointer_sha256:
            raise RuntimeError("NoNE accepted pointer changed during object reclaim")
        receipt = {
            **intent,
            "passed": True,
            "status": "UNREACHABLE_OBJECTS_RECLAIMED",
            "removedObjectCount": current["unreachableObjectCount"],
            "removedObjectBytes": current["unreachableObjectBytes"],
            "removedObjectSha256s": current["unreachableObjectSha256s"],
            "potentialPhysicalBytesFreed": current[
                "potentialPhysicalBytesFreed"
            ],
            "acceptedPointerUnchanged": True,
        }
        _atomic_json(output_path, receipt)
        return receipt
    finally:
        fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
        handle.close()


def _all_knowledge_local_direct_object_boundary(
    *,
    store: NoNEImmutablePageStore,
    binding: NoNEPageObjectBinding,
) -> tuple[Path, os.stat_result, int]:
    """Require one local regular unlinked rev2/3/7 content object."""

    object_sha256 = _tensor_digest_hex(binding.object_sha256_t)
    object_bytes = int(binding.object_bytes_t)
    objects_root, _scratch_root = (
        store._validated_page_object_write_roots_boundary()
    )
    object_path = objects_root / f"{object_sha256}.safetensors"
    try:
        identity = object_path.lstat()
    except FileNotFoundError as error:
        raise RuntimeError(
            "NoNE all-knowledge local direct object is absent"
        ) from error
    if (
        object_path.is_symlink()
        or not stat.S_ISREG(identity.st_mode)
        or identity.st_size != object_bytes
        or identity.st_nlink != 1
    ):
        raise RuntimeError(
            "NoNE all-knowledge local direct object identity differs"
        )
    revision = store._local_reconciled_direct_page_object_boundary(binding)
    if revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS:
        raise RuntimeError(
            "NoNE all-knowledge final object is not direct revision 2/3/7"
        )
    return object_path, identity, revision


def _unresolved_path_contains_symlink_boundary(path: Path) -> bool:
    """Return whether any existing component is a symlink before resolution."""

    expanded = path.expanduser()
    lexical = Path(
        os.path.abspath(
            os.fspath(expanded),
        )
    )
    current = Path(lexical.anchor)
    for part in lexical.parts[1:]:
        current /= part
        try:
            if stat.S_ISLNK(current.lstat().st_mode):
                return True
        except FileNotFoundError:
            return False
    return False


def _require_all_knowledge_sealed_pointer_inventory_boundary(
    *,
    plan_path: Path,
    plan_sha256: str,
) -> str:
    """Rescan the seven sealed roots without descending into object state."""

    unresolved_plan_path = plan_path.expanduser()
    if _unresolved_path_contains_symlink_boundary(unresolved_plan_path):
        raise RuntimeError("NoNE historical union plan path is a symlink")
    resolved_plan_path = unresolved_plan_path.resolve()
    plan = _read_json(resolved_plan_path)
    plan_without_sha256 = dict(plan)
    inventory = plan.get("acceptedHeadInventoryCorrection")
    head_coverage = plan.get("headCoverage")
    session_key = plan.get("sessionKey")
    declared_plan_sha256 = plan_without_sha256.pop("planSha256", None)
    accepted_pointer_count, _unique_head_count = (
        _validated_all_knowledge_plan_inventory_counts_boundary(plan)
    )
    if (
        declared_plan_sha256 != plan_sha256
        or hashlib.sha256(
            _canonical_json_bytes(plan_without_sha256)
        ).hexdigest()
        != plan_sha256
        or not _valid_sha256_boundary(session_key)
        or not isinstance(head_coverage, list)
        or len(head_coverage) != accepted_pointer_count
        or not isinstance(inventory, dict)
    ):
        raise RuntimeError(
            "NoNE sealed accepted-pointer inventory authority differs"
        )
    selection_roots = inventory.get("selectionRoots")
    selection_pattern = inventory.get("selectionPattern")
    sealed_path_set_sha256 = inventory.get("scopedPointerPathSetSha256")
    if (
        not isinstance(selection_roots, list)
        or len(selection_roots) != 7
        or len(set(selection_roots)) != 7
        or any(
            not isinstance(root, str)
            or not root
            or not Path(root).expanduser().is_absolute()
            for root in selection_roots
        )
        or selection_pattern != f"*/sessions/{session_key}/accepted.json"
        or not _valid_sha256_boundary(sealed_path_set_sha256)
    ):
        raise RuntimeError(
            "NoNE sealed accepted-pointer inventory scope differs"
        )

    expected_rows: dict[Path, str] = {}
    for value in head_coverage:
        if not isinstance(value, dict):
            raise RuntimeError(
                "NoNE sealed accepted-pointer inventory row differs"
            )
        pointer_path_value = value.get("pointerPath")
        pointer_sha256 = value.get("pointerSha256")
        if (
            not isinstance(pointer_path_value, str)
            or not pointer_path_value
            or not _valid_sha256_boundary(pointer_sha256)
        ):
            raise RuntimeError(
                "NoNE sealed accepted-pointer inventory row differs"
            )
        unresolved_pointer_path = Path(pointer_path_value).expanduser()
        if _unresolved_path_contains_symlink_boundary(
            unresolved_pointer_path
        ):
            raise RuntimeError(
                "NoNE sealed accepted pointer path is a symlink"
            )
        pointer_path = unresolved_pointer_path.resolve()
        if pointer_path in expected_rows:
            raise RuntimeError(
                "NoNE sealed accepted-pointer inventory contains duplicates"
            )
        expected_rows[pointer_path] = cast(str, pointer_sha256)
    expected_paths = tuple(sorted(expected_rows, key=str))
    expected_path_set_sha256 = hashlib.sha256(
        ("\n".join(str(path) for path in expected_paths) + "\n").encode(
            "utf-8"
        )
    ).hexdigest()
    if (
        len(expected_paths) != accepted_pointer_count
        or expected_path_set_sha256 != sealed_path_set_sha256
    ):
        raise RuntimeError(
            "NoNE sealed accepted-pointer path-set identity differs"
        )

    ignored_subtrees = {
        ".training_state",
        "artifact_sha256_cache",
        "candidate_page_scratch",
        "frozen_backbone_features",
        "objects",
        "snapshots",
    }
    observed: set[Path] = set()
    for root_value in cast(list[str], selection_roots):
        unresolved_root = Path(root_value).expanduser()
        if _unresolved_path_contains_symlink_boundary(unresolved_root):
            raise RuntimeError(
                "NoNE sealed accepted-pointer selection root is a symlink"
            )
        root = unresolved_root.resolve()
        if not root.is_dir():
            raise RuntimeError(
                "NoNE sealed accepted-pointer selection root changed"
            )
        for directory, child_names, _file_names in os.walk(
            root,
            followlinks=False,
        ):
            current = Path(directory)
            if current.name == "sessions":
                candidate = current / cast(str, session_key) / "accepted.json"
                if _unresolved_path_contains_symlink_boundary(candidate):
                    raise RuntimeError(
                        "NoNE sealed accepted pointer path is a symlink"
                    )
                if candidate.is_file():
                    observed.add(candidate.resolve())
                child_names.clear()
                continue
            child_names[:] = [
                name
                for name in child_names
                if name not in ignored_subtrees
                and not (current / name).is_symlink()
            ]
    observed_paths = tuple(sorted(observed, key=str))
    observed_path_set_sha256 = hashlib.sha256(
        ("\n".join(str(path) for path in observed_paths) + "\n").encode(
            "utf-8"
        )
    ).hexdigest()
    if (
        observed_paths != expected_paths
        or observed_path_set_sha256 != sealed_path_set_sha256
    ):
        raise RuntimeError(
            "NoNE accepted-head live inventory differs from sealed plan"
        )
    for pointer_path, pointer_sha256 in expected_rows.items():
        if (
            _unresolved_path_contains_symlink_boundary(pointer_path)
            or not pointer_path.is_file()
            or _file_sha256(pointer_path) != pointer_sha256
        ):
            raise RuntimeError(
                "NoNE sealed accepted pointer bytes changed"
            )
    return observed_path_set_sha256


def _all_knowledge_store_device_boundary(
    store: NoNEImmutablePageStore,
) -> tuple[Path, int, int]:
    """Bind one accepting store to its local physical object filesystem."""

    objects_root, _scratch_root = (
        store._validated_page_object_write_roots_boundary()
    )
    root_identity = objects_root.lstat()
    if (
        objects_root.is_symlink()
        or not stat.S_ISDIR(root_identity.st_mode)
    ):
        raise RuntimeError("NoNE all-knowledge object root differs")
    return objects_root, root_identity.st_dev, root_identity.st_ino


def _all_knowledge_direct_open_boundary(
    path: Path,
    *,
    writable: bool,
) -> int:
    """Open one no-follow O_DIRECT descriptor; page-cache credit is forbidden."""

    direct_flag = getattr(os, "O_DIRECT", 0)
    if not direct_flag:
        raise RuntimeError("NoNE all-knowledge O_DIRECT is unavailable")
    flags = (
        (os.O_WRONLY if writable else os.O_RDONLY)
        | getattr(os, "O_CLOEXEC", 0)
        | getattr(os, "O_NOFOLLOW", 0)
        | direct_flag
    )
    if writable:
        flags |= os.O_CREAT | os.O_EXCL
    try:
        return os.open(path, flags, 0o600)
    except OSError as error:
        raise RuntimeError(
            "NoNE all-knowledge physical direct I/O open failed"
        ) from error


def _all_knowledge_direct_pread_wave_boundary(
    descriptor: int,
    view: memoryview,
    *,
    offset: int,
    object_bytes: int,
) -> tuple[int, int]:
    """Read one aligned source wave exactly once, including an EOF tail."""

    remaining = object_bytes - offset
    if remaining < 1 or offset % _ALL_KNOWLEDGE_REPLICA_IO_ALIGNMENT:
        raise RuntimeError("NoNE all-knowledge source wave geometry differs")
    logical_bytes = min(_ALL_KNOWLEDGE_REPLICA_IO_WAVE_BYTES, remaining)
    aligned_bytes = (
        (
            logical_bytes
            + _ALL_KNOWLEDGE_REPLICA_IO_ALIGNMENT
            - 1
        )
        // _ALL_KNOWLEDGE_REPLICA_IO_ALIGNMENT
        * _ALL_KNOWLEDGE_REPLICA_IO_ALIGNMENT
    )
    wave = view[:aligned_bytes]
    try:
        read_bytes = os.preadv(descriptor, (wave,), offset)
    finally:
        wave.release()
    if read_bytes != logical_bytes:
        raise RuntimeError(
            "NoNE all-knowledge source physical read was incomplete"
        )
    return logical_bytes, aligned_bytes


def _all_knowledge_direct_pwrite_wave_boundary(
    descriptor: int,
    view: memoryview,
    *,
    offset: int,
    aligned_bytes: int,
) -> None:
    """Write one already-read aligned wave to one destination inode."""

    wave = view[:aligned_bytes]
    try:
        written_bytes = 0
        while written_bytes < aligned_bytes:
            tail = wave[written_bytes:]
            try:
                written = os.pwritev(
                    descriptor,
                    (tail,),
                    offset + written_bytes,
                )
            finally:
                tail.release()
            if written < 1 or (
                written_bytes + written < aligned_bytes
                and written % _ALL_KNOWLEDGE_REPLICA_IO_ALIGNMENT
            ):
                raise RuntimeError(
                    "NoNE all-knowledge destination physical write "
                    "was incomplete"
                )
            written_bytes += written
    finally:
        wave.release()


def _all_knowledge_direct_cold_sha256_boundary(
    path: Path,
    *,
    object_bytes: int,
) -> str:
    """Cold-read one installed object through O_DIRECT and hash exact bytes."""

    descriptor = _all_knowledge_direct_open_boundary(path, writable=False)
    bounce = mmap.mmap(
        -1,
        _ALL_KNOWLEDGE_REPLICA_IO_WAVE_BYTES,
        access=mmap.ACCESS_WRITE,
    )
    view = memoryview(bounce)
    digest = hashlib.sha256()
    offset = 0
    try:
        while offset < object_bytes:
            logical_bytes, _aligned_bytes = (
                _all_knowledge_direct_pread_wave_boundary(
                    descriptor,
                    view,
                    offset=offset,
                    object_bytes=object_bytes,
                )
            )
            logical_view = view[:logical_bytes]
            try:
                digest.update(logical_view)
            finally:
                logical_view.release()
            offset += logical_bytes
    finally:
        view.release()
        bounce.close()
        os.close(descriptor)
    return digest.hexdigest()


def _component_digest_rows(
    packet: NoNEGenerationComponentPacket,
) -> dict[str, dict[str, Any]]:
    """Return source-independent executable generation identity.

    Historical v2 packets may still carry ``code_digest_t`` so their manifests
    can be validated and migrated.  New v3 generations deliberately omit that
    moving-source observation; launch and training receipts retain provenance,
    while model/checkpoint/optimizer/corpus/proof/page authority remains exact.
    """

    rows = {
        "parent": {"sha256": _tensor_digest_hex(packet.parent_digest_t)},
        "model": {"sha256": _tensor_digest_hex(packet.shared_model_digest_t)},
        "optimizer": {"sha256": _tensor_digest_hex(packet.global_optimizer_digest_t)},
        "scheduler": {"sha256": _tensor_digest_hex(packet.scheduler_digest_t)},
        "rng": {"sha256": _tensor_digest_hex(packet.rng_digest_t)},
        "rbo": {"sha256": _tensor_digest_hex(packet.rbo_digest_t)},
        "fabric": {"sha256": _tensor_digest_hex(packet.fabric_digest_t)},
        "vge": {"sha256": _tensor_digest_hex(packet.vge_digest_t)},
        "router": {"sha256": _tensor_digest_hex(packet.router_digest_t)},
        "corpus": {"sha256": _tensor_digest_hex(packet.corpus_digest_t)},
    }
    proof_record_bound = packet.training_proof_record_path is not None
    if proof_record_bound != (
        packet.training_proof_record_sha256_t is not None
    ):
        raise RuntimeError(
            "NoNE training proof record authority is incomplete"
        )
    if packet.training_proof_digest_t is not None:
        training_proof_record: dict[str, Any] = {
            "sha256": _tensor_digest_hex(packet.training_proof_digest_t)
        }
        if proof_record_bound:
            assert packet.training_proof_record_path is not None
            assert packet.training_proof_record_sha256_t is not None
            training_proof_record["record"] = {
                "path": packet.training_proof_record_path,
                "sha256": _tensor_digest_hex(
                    packet.training_proof_record_sha256_t
                ),
            }
        rows["trainingProof"] = training_proof_record
    elif proof_record_bound:
        raise RuntimeError(
            "NoNE training proof record has no tensor proof digest"
        )
    reconciliation_record_bound = (
        packet.reconciliation_proof_record_path is not None
    )
    if reconciliation_record_bound != (
        packet.reconciliation_proof_record_sha256_t is not None
    ):
        raise RuntimeError(
            "NoNE reconciliation proof record authority is incomplete"
        )
    if packet.reconciliation_proof_digest_t is not None:
        reconciliation_proof_record: dict[str, Any] = {
            "sha256": _tensor_digest_hex(
                packet.reconciliation_proof_digest_t
            )
        }
        if reconciliation_record_bound:
            assert packet.reconciliation_proof_record_path is not None
            assert packet.reconciliation_proof_record_sha256_t is not None
            reconciliation_proof_record["record"] = {
                "path": packet.reconciliation_proof_record_path,
                "sha256": _tensor_digest_hex(
                    packet.reconciliation_proof_record_sha256_t
                ),
            }
        rows["reconciliationProof"] = reconciliation_proof_record
    elif reconciliation_record_bound:
        raise RuntimeError(
            "NoNE reconciliation proof record has no tensor proof digest"
        )
    return rows


def reconciled_direct_page_pack_source_boundary(
    *,
    target_store: NoNEImmutablePageStore,
    semantic_source_store: NoNEImmutablePageStore,
    page_tensor_surgery: NoNEHistoricalPageTensorSurgeryPacket,
) -> NoNEReconciledDirectPagePackSourcePacket:
    """Resolve exact pack inputs while retaining diagnostic source provenance.

    A diagnostic may observe inputs in both the immutable target store and the
    surgery store; that path topology does not authorize a mixed-store output.
    Historical revision-6 objects are evidence only and production staging
    must replace them with self-contained tensors.  The pack builder parses and
    hashes every selected body, while downstream final-authority validation
    admits only direct revisions 2, 3, or 7 and a complete immutable page map.
    """

    target = target_store.verify_generation_boundary(
        generation_t=page_tensor_surgery.target_generation.generation_t,
        manifest_payload_sha256_t=(
            page_tensor_surgery.target_generation
            .manifest_payload_sha256_t
        ),
        manifest_sha256_t=(
            page_tensor_surgery.target_generation.manifest_sha256_t
        ),
    )
    if not _same_generation_binding_boundary(
        target,
        page_tensor_surgery.target_generation,
    ):
        raise RuntimeError(
            "NoNE reconciled direct pack target generation differs"
        )
    _loaded, manifest = target_store._load_generation_binding_boundary(
        target.manifest_relative_path,
        expected_manifest_sha256=_tensor_digest_hex(
            target.manifest_sha256_t
        ),
        expected_payload_sha256=_tensor_digest_hex(
            target.manifest_payload_sha256_t
        ),
    )
    target_rows = target_store._manifest_page_rows_boundary(manifest)
    semantic_page_ids_t = (
        page_tensor_surgery.semantic_page_ids_t.detach()
        .cpu()
        .long()
        .reshape(-1)
    )
    semantic_objects = page_tensor_surgery.semantic_page_objects
    semantic_by_page = {
        int(binding.page_id_t): binding for binding in semantic_objects
    }
    if (
        len(semantic_by_page) != len(semantic_objects)
        or not torch.equal(
            semantic_page_ids_t,
            torch.tensor(sorted(semantic_by_page), dtype=torch.long),
        )
        or not set(semantic_by_page).issubset(target_rows)
    ):
        raise RuntimeError(
            "NoNE reconciled direct pack surgery identity differs"
        )
    page_objects: list[NoNEPageObjectBinding] = []
    object_paths: list[Path] = []
    for page_id, target_row in sorted(target_rows.items()):
        binding = semantic_by_page.get(page_id)
        source_store = semantic_source_store
        if binding is None:
            binding = target_store._page_object_binding_from_row_boundary(
                target_row
            )
            source_store = target_store
        object_path = source_store._object_path_boundary(
            _tensor_digest_hex(binding.object_sha256_t),
            expected_bytes=int(binding.object_bytes_t),
        )
        if (
            object_path.is_symlink()
            or not object_path.is_file()
            or object_path.lstat().st_size != int(binding.object_bytes_t)
        ):
            raise RuntimeError(
                "NoNE reconciled direct pack source object differs"
            )
        page_objects.append(binding)
        object_paths.append(object_path)
    page_objects_tuple = tuple(page_objects)
    page_ids_t = torch.stack(
        tuple(
            binding.page_id_t.detach().cpu().long().reshape(())
            for binding in page_objects_tuple
        )
    )
    _require_exact_generation_187_physical_page_ids_boundary(page_ids_t)
    return NoNEReconciledDirectPagePackSourcePacket(
        page_objects=page_objects_tuple,
        object_paths=tuple(object_paths),
        page_map_sha256_t=_page_object_map_digest_t_boundary(
            page_objects_tuple
        ),
    )


def _read_completed_hash_chained_page_ledger_boundary(
    *,
    ledger_path: Path,
    schema: str,
    label: str,
) -> tuple[Path, bytes, tuple[dict[str, Any], ...]]:
    """Read one immutable completed ledger without repairing torn bytes."""

    unresolved = ledger_path.expanduser()
    if _unresolved_path_contains_symlink_boundary(unresolved):
        raise RuntimeError(f"NoNE {label} path is a symlink")
    resolved = unresolved.resolve()
    if resolved.is_symlink() or not resolved.is_file():
        raise RuntimeError(f"NoNE {label} is incomplete")
    raw = resolved.read_bytes()
    if not raw or not raw.endswith(b"\n"):
        raise RuntimeError(f"NoNE {label} is incomplete")
    records: list[dict[str, Any]] = []
    previous_sha256: str | None = None
    for raw_line in raw.splitlines():
        loaded = orjson.loads(raw_line)
        if not isinstance(loaded, dict):
            raise RuntimeError(f"NoNE {label} row is malformed")
        record_sha256 = loaded.get("recordSha256")
        unhashed = {
            key: value
            for key, value in loaded.items()
            if key != "recordSha256"
        }
        if (
            loaded.get("schema") != schema
            or loaded.get("previousRecordSha256") != previous_sha256
            or not _valid_sha256_boundary(record_sha256)
            or hashlib.sha256(
                _canonical_json_bytes(unhashed)
            ).hexdigest()
            != record_sha256
        ):
            raise RuntimeError(f"NoNE {label} chain differs")
        records.append(loaded)
        previous_sha256 = cast(str, record_sha256)
    if (
        len(records) < 2
        or records[0].get("recordKind") != "header"
        or records[-1].get("recordKind") != "complete"
        or any(
            record.get("recordKind") != "page"
            for record in records[1:-1]
        )
    ):
        raise RuntimeError(f"NoNE {label} terminal authority differs")
    return resolved, raw, tuple(records)


def _same_direct_page_pack_build_boundary(
    left: DirectPagePackBuildPacket,
    right: DirectPagePackBuildPacket,
) -> bool:
    """Compare every tensor and locator in two reopened pack authorities."""

    left_authority = left.authority
    right_authority = right.authority
    if (
        left_authority.shard_roots != right_authority.shard_roots
        or left_authority.shard_relative_paths
        != right_authority.shard_relative_paths
        or left_authority.index_root != right_authority.index_root
        or left_authority.index_relative_path
        != right_authority.index_relative_path
    ):
        return False
    for field_name in DirectPagePackSetAuthorityPacket.__dataclass_fields__:
        if field_name in {
            "shard_roots",
            "shard_relative_paths",
            "index_root",
            "index_relative_path",
        }:
            continue
        if not torch.equal(
            cast(torch.Tensor, getattr(left_authority, field_name)),
            cast(torch.Tensor, getattr(right_authority, field_name)),
        ):
            return False
    return all(
        torch.equal(
            cast(torch.Tensor, getattr(left.index, field_name)),
            cast(torch.Tensor, getattr(right.index, field_name)),
        )
        for field_name in DirectPagePackIndexPacket.__dataclass_fields__
    )


def _validated_canonical_direct_pack_resume_boundary(
    *,
    direct_store: NoNEImmutablePageStore,
    target_generation: NoNEGenerationBinding,
    canonical_pack: DirectPagePackBuildPacket,
) -> tuple[
    DirectPagePackBuildPacket,
    tuple[NoNEPageObjectBinding, ...],
    Path,
]:
    """Reopen the one-file g187 pack and derive its tensor-native page map."""

    direct_session_id_t, direct_session_root = direct_store._require_session()
    accepted_path = direct_session_root / "accepted.json"
    target_session_key = _session_key(target_generation.session_id_t)
    if (
        not torch.equal(
            direct_session_id_t.detach().cpu().long().reshape(-1),
            target_generation.session_id_t.detach().cpu().long().reshape(-1),
        )
        or target_session_key
        != SEALED_HISTORICAL_TRAINING_PARENT_SESSION_SHA256
        or int(target_generation.generation_t)
        != SEALED_HISTORICAL_TRAINING_PARENT_GENERATION
        or int(target_generation.generation_t) + 1
        != ALL_KNOWLEDGE_RECONCILIATION_OUTPUT_GENERATION
        or _tensor_digest_hex(target_generation.manifest_sha256_t)
        != SEALED_HISTORICAL_TRAINING_PARENT_MANIFEST_SHA256
        or _tensor_digest_hex(
            target_generation.manifest_payload_sha256_t
        )
        != SEALED_HISTORICAL_TRAINING_PARENT_MANIFEST_PAYLOAD_SHA256
        or accepted_path.exists()
        or accepted_path.is_symlink()
        or not bool(
            direct_store.accepted_generation_t()
            .detach()
            .cpu()
            .long()
            .eq(0)
        )
    ):
        raise RuntimeError(
            "NoNE canonical direct-pack resume generation differs"
        )
    supplied_index = validate_direct_page_pack_set_authority_boundary(
        canonical_pack.authority,
        index=canonical_pack.index,
    )
    reopened = reopen_direct_page_pack_set_boundary(
        storage_root=canonical_pack.authority.index_root,
        index_relative_path=canonical_pack.authority.index_relative_path,
    )
    if not _same_direct_page_pack_build_boundary(canonical_pack, reopened):
        raise RuntimeError("NoNE canonical direct-pack resume authority differs")
    canonical_pack = DirectPagePackBuildPacket(
        authority=reopened.authority,
        index=supplied_index,
    )
    authority = canonical_pack.authority
    index = canonical_pack.index
    resolved_session_root = direct_session_root.resolve()
    if (
        authority.index_root.resolve() != resolved_session_root
        or len(authority.shard_roots) != 1
        or len(authority.shard_relative_paths) != 1
        or authority.shard_roots[0].resolve() != resolved_session_root
        or index.shard_sha256s_t.shape != (1, 32)
        or bool(index.shard_indices_t.ne(0).any())
    ):
        raise RuntimeError("NoNE canonical direct-pack topology differs")
    page_ids_t = _require_exact_generation_187_physical_page_ids_boundary(
        index.page_ids_t
    )
    accepted_revisions_t = torch.tensor(
        sorted(RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS),
        dtype=torch.long,
    )
    if (
        index.object_sha256s_t.dtype != torch.uint8
        or index.object_sha256s_t.shape != (page_ids_t.numel(), 32)
        or index.object_bytes_t.dtype != torch.long
        or index.object_bytes_t.shape != page_ids_t.shape
        or index.format_revisions_t.dtype != torch.long
        or index.format_revisions_t.shape != page_ids_t.shape
        or not bool(
            torch.isin(
                index.format_revisions_t,
                accepted_revisions_t,
            ).all()
        )
        or bool(
            index.format_revisions_t.eq(
                BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
            ).any()
        )
    ):
        raise RuntimeError("NoNE canonical direct-pack revision policy differs")
    page_objects = tuple(
        NoNEPageObjectBinding(
            page_id_t=index.page_ids_t[ordinal].detach().cpu().long().clone(),
            object_sha256_t=(
                index.object_sha256s_t[ordinal]
                .detach()
                .cpu()
                .to(dtype=torch.uint8)
                .clone()
            ),
            object_bytes_t=(
                index.object_bytes_t[ordinal]
                .detach()
                .cpu()
                .long()
                .clone()
            ),
        )
        for ordinal in range(int(page_ids_t.numel()))
    )
    page_map_sha256_t = _page_object_map_digest_t_boundary(page_objects)
    if (
        not torch.equal(
            page_map_sha256_t,
            index.page_map_sha256_t.detach().cpu().to(dtype=torch.uint8),
        )
        or not torch.equal(
            page_map_sha256_t,
            authority.page_map_sha256_t.detach().cpu().to(dtype=torch.uint8),
        )
    ):
        raise RuntimeError("NoNE canonical direct-pack page map differs")
    return canonical_pack, page_objects, resolved_session_root


def _reopen_reconciled_direct_page_map_ledger_boundary(
    *,
    direct_store: NoNEImmutablePageStore,
    target_generation: NoNEGenerationBinding,
    canonical_pack: DirectPagePackBuildPacket,
    direct_page_map_ledger_path: Path,
) -> tuple[
    DirectPagePackBuildPacket,
    tuple[NoNEPageObjectBinding, ...],
    Path,
]:
    """Reconstruct the full direct map from its signed ledger and pack index."""

    canonical_pack, page_objects, session_root = (
        _validated_canonical_direct_pack_resume_boundary(
            direct_store=direct_store,
            target_generation=target_generation,
            canonical_pack=canonical_pack,
        )
    )
    ledger_path, _raw, records = (
        _read_completed_hash_chained_page_ledger_boundary(
            ledger_path=direct_page_map_ledger_path,
            schema=RECONCILED_DIRECT_PAGE_MAP_LEDGER_SCHEMA,
            label="reconciled direct-map ledger",
        )
    )
    index = canonical_pack.index
    header = records[0]
    page_records = records[1:-1]
    complete = records[-1]
    source_page_map_sha256 = header.get("sourcePageMapSha256")
    expected_objects_root = str(direct_store.objects_root.resolve())
    expected_ledger_path = (
        session_root
        / "direct_page_map_reseals"
        / (
            "generation_"
            f"{int(target_generation.generation_t):08d}_"
            f"{source_page_map_sha256}.jsonl"
        )
    ).resolve()
    if (
        not _valid_sha256_boundary(source_page_map_sha256)
        or ledger_path != expected_ledger_path
        or len(records) != int(index.page_ids_t.numel()) + 2
        or header.get("sessionKey")
        != _session_key(target_generation.session_id_t)
        or header.get("sourceGeneration")
        != int(target_generation.generation_t)
        or header.get("sourceManifestPayloadSha256")
        != _tensor_digest_hex(
            target_generation.manifest_payload_sha256_t
        )
        or header.get("sourcePageCount") != int(index.page_ids_t.numel())
        or not isinstance(header.get("parentSourceStoreRoot"), str)
        or not cast(str, header["parentSourceStoreRoot"])
        or header.get("semanticSourceStoreRoot") != str(direct_store.root)
        or header.get("destinationStoreRoot") != str(direct_store.root)
        or header.get("destinationObjectsRoot") != expected_objects_root
        or header.get("storageNormalizationChangesTrainingCoverage")
        is not False
        or header.get("storagePageObjectsSelfContainedDirect") is not True
        or header.get("baseBoundPageObjectCount") != 0
        or header.get("externalPageObjectCount") != 0
    ):
        raise RuntimeError("NoNE reconciled direct-map ledger header differs")
    allowed_source_roots = {
        cast(str, header["parentSourceStoreRoot"]),
        str(direct_store.root),
    }
    for ordinal, (record, binding) in enumerate(
        zip(page_records, page_objects, strict=True)
    ):
        revision = int(index.format_revisions_t[ordinal])
        if (
            record.get("sourcePageMapSha256")
            != source_page_map_sha256
            or record.get("pageId") != int(binding.page_id_t)
            or not _valid_sha256_boundary(record.get("sourceObjectSha256"))
            or not isinstance(record.get("sourceObjectBytes"), int)
            or isinstance(record.get("sourceObjectBytes"), bool)
            or cast(int, record["sourceObjectBytes"]) < 1
            or record.get("sourceStoreRoot") not in allowed_source_roots
            or record.get("directObjectSha256")
            != _tensor_digest_hex(binding.object_sha256_t)
            or record.get("directObjectBytes")
            != int(binding.object_bytes_t)
            or record.get("directFormatRevision") != revision
            or revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
            or revision == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
            or record.get("destinationObjectsRoot")
            != expected_objects_root
            or record.get("materializedTensorEqualityProven") is not True
            or record.get("baseBoundPageObjectCount") != 0
        ):
            raise RuntimeError(
                "NoNE reconciled direct-map ledger page differs"
            )
    direct_map_sha256 = _tensor_digest_hex(
        _page_object_map_digest_t_boundary(page_objects)
    )
    if (
        complete.get("sourcePageMapSha256") != source_page_map_sha256
        or complete.get("directPageMapSha256") != direct_map_sha256
        or complete.get("pageCount") != len(page_objects)
        or complete.get("directObjectBytes")
        != sum(int(binding.object_bytes_t) for binding in page_objects)
        or complete.get("destinationObjectsRoot") != expected_objects_root
        or complete.get("storagePageObjectsSelfContainedDirect") is not True
        or complete.get("baseBoundPageObjectCount") != 0
        or complete.get("externalPageObjectCount") != 0
    ):
        raise RuntimeError(
            "NoNE reconciled direct-map ledger completion differs"
        )
    return canonical_pack, page_objects, ledger_path


def _reopen_historical_page_tensor_surgery_ledger_boundary(
    *,
    direct_store: NoNEImmutablePageStore,
    target_generation: NoNEGenerationBinding,
    canonical_pack: DirectPagePackBuildPacket,
    page_objects: tuple[NoNEPageObjectBinding, ...],
    historical_surgery_ledger_path: Path,
    expected_tensor_surgery_plan_sha256: str,
) -> NoNEHistoricalPageTensorSurgeryPacket:
    """Reconstruct completed semantic surgery state from signed index rows."""

    if not _valid_sha256_boundary(expected_tensor_surgery_plan_sha256):
        raise RuntimeError("NoNE historical surgery plan identity differs")
    _session_id_t, session_root = direct_store._require_session()
    ledger_path, _raw, records = (
        _read_completed_hash_chained_page_ledger_boundary(
            ledger_path=historical_surgery_ledger_path,
            schema=HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA,
            label="historical tensor surgery ledger",
        )
    )
    expected_ledger_path = (
        session_root
        / "historical_page_tensor_surgeries"
        / f"{expected_tensor_surgery_plan_sha256}.jsonl"
    ).resolve()
    index = canonical_pack.index
    header = records[0]
    page_records = records[1:-1]
    complete = records[-1]
    segments = header.get("segments")
    if (
        ledger_path != expected_ledger_path
        or header.get("surgeryPlanSha256")
        != expected_tensor_surgery_plan_sha256
        or header.get("targetGeneration")
        != int(target_generation.generation_t)
        or header.get("targetManifestSha256")
        != _tensor_digest_hex(target_generation.manifest_sha256_t)
        or header.get("targetManifestPayloadSha256")
        != _tensor_digest_hex(
            target_generation.manifest_payload_sha256_t
        )
        or not isinstance(header.get("targetStoreRoot"), str)
        or not cast(str, header["targetStoreRoot"])
        or header.get("destinationStoreRoot") != str(direct_store.root)
        or header.get("segmentCount")
        != ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
        or not isinstance(segments, list)
        or len(segments) != ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
        or header.get("semanticPageCount")
        != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
        or header.get("semanticPageIdsAbove101000")
        != ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000
        or header.get("mergeAlgebra")
        != "target_plus_ordered_branch_minus_source_fp32"
        or header.get("finalCast")
        != "single_cast_to_target_storage_dtype"
        or header.get("explicitOptimizerMomentConflictPolicy")
        != (
            "page_local_zero_moment_reinitialization_with_monotonic_step"
        )
        or header.get("acceptedPointerMutationAllowed") is not False
        or header.get("outputObjectsSelfContainedDirect") is not True
        or header.get("baseBoundDeltaObjectsAccepted") is not False
        or header.get("crossStoreOverlayAuthorityAccepted") is not False
        or any(
            not isinstance(segment, dict)
            or segment.get("ordinal") != ordinal
            or not _valid_sha256_boundary(segment.get("segmentSha256"))
            or not _valid_sha256_boundary(segment.get("provenanceSha256"))
            or not _valid_sha256_boundary(
                segment.get("sourceManifestSha256")
            )
            or not _valid_sha256_boundary(
                segment.get("sourceManifestPayloadSha256")
            )
            or not _valid_sha256_boundary(
                segment.get("terminalManifestSha256")
            )
            or not _valid_sha256_boundary(
                segment.get("terminalManifestPayloadSha256")
            )
            or not _valid_sha256_boundary(
                segment.get("changedPageIdsSha256")
            )
            or not isinstance(segment.get("sourceGeneration"), int)
            or isinstance(segment.get("sourceGeneration"), bool)
            or not isinstance(segment.get("terminalGeneration"), int)
            or isinstance(segment.get("terminalGeneration"), bool)
            or cast(int, segment["terminalGeneration"])
            <= cast(int, segment["sourceGeneration"])
            or not isinstance(segment.get("changedPageCount"), int)
            or isinstance(segment.get("changedPageCount"), bool)
            or cast(int, segment["changedPageCount"]) < 1
            or not isinstance(segment.get("changedPageIdsAbove101000"), int)
            or isinstance(segment.get("changedPageIdsAbove101000"), bool)
            or cast(int, segment["changedPageIdsAbove101000"]) < 0
            or cast(int, segment["changedPageIdsAbove101000"])
            > cast(int, segment["changedPageCount"])
            or not isinstance(segment.get("sourceStoreRoot"), str)
            or not cast(str, segment["sourceStoreRoot"])
            for ordinal, segment in enumerate(segments)
        )
    ):
        raise RuntimeError(
            "NoNE historical tensor surgery ledger header differs"
        )
    semantic_page_ids_t = torch.tensor(
        tuple(cast(int, record.get("pageId")) for record in page_records),
        dtype=torch.long,
    )
    if (
        semantic_page_ids_t.numel() != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
        or not torch.equal(
            semantic_page_ids_t,
            torch.sort(semantic_page_ids_t).values,
        )
        or torch.unique(semantic_page_ids_t).numel()
        != semantic_page_ids_t.numel()
        or int(semantic_page_ids_t.gt(101_000).sum())
        != ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000
    ):
        raise RuntimeError(
            "NoNE historical tensor surgery page IDs differ"
        )
    semantic_ids_sha256 = hashlib.sha256(
        _stable_cpu_tensor(semantic_page_ids_t)
        .numpy()
        .tobytes(order="C")
    ).hexdigest()
    if header.get("semanticPageIdsSha256") != semantic_ids_sha256:
        raise RuntimeError(
            "NoNE historical tensor surgery page identity differs"
        )
    positions_t = torch.searchsorted(
        index.page_ids_t,
        semantic_page_ids_t,
    )
    if (
        bool(positions_t.ge(index.page_ids_t.numel()).any())
        or not torch.equal(
            index.page_ids_t.index_select(0, positions_t),
            semantic_page_ids_t,
        )
    ):
        raise RuntimeError(
            "NoNE historical tensor surgery escaped canonical pack"
        )
    semantic_objects: list[NoNEPageObjectBinding] = []
    reset_page_ids: list[int] = []
    for record, position_t in zip(
        page_records,
        positions_t,
        strict=True,
    ):
        position = int(position_t)
        binding = page_objects[position]
        revision = int(index.format_revisions_t[position])
        optimizer_reinitialized = record.get(
            "optimizerMomentsReinitialized"
        )
        if (
            record.get("surgeryPlanSha256")
            != expected_tensor_surgery_plan_sha256
            or not _valid_sha256_boundary(record.get("pageInputSha256"))
            or not isinstance(record.get("appliedSegmentCount"), int)
            or isinstance(record.get("appliedSegmentCount"), bool)
            or cast(int, record["appliedSegmentCount"]) < 1
            or cast(int, record["appliedSegmentCount"])
            > ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
            or record.get("directObjectSha256")
            != _tensor_digest_hex(binding.object_sha256_t)
            or record.get("directObjectBytes")
            != int(binding.object_bytes_t)
            or revision
            not in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
            or revision == BASE_BOUND_EXACT_DELTA_PAGE_FORMAT_REVISION
            or record.get("directObjectSelfContained") is not True
            or record.get("baseBoundDeltaAccepted") is not False
            or record.get("crossStoreOverlayAccepted") is not False
            or record.get("materializedTensorEqualityProven") is not True
            or not isinstance(optimizer_reinitialized, bool)
        ):
            raise RuntimeError(
                "NoNE historical tensor surgery ledger page differs"
            )
        semantic_objects.append(binding)
        if optimizer_reinitialized:
            reset_page_ids.append(int(binding.page_id_t))
    semantic_objects_tuple = tuple(semantic_objects)
    semantic_map_sha256 = _tensor_digest_hex(
        _page_object_map_digest_t_boundary(semantic_objects_tuple)
    )
    reset_page_ids_t = torch.tensor(reset_page_ids, dtype=torch.long)
    reset_ids_sha256 = hashlib.sha256(
        _stable_cpu_tensor(reset_page_ids_t)
        .numpy()
        .tobytes(order="C")
    ).hexdigest()
    if (
        complete.get("surgeryPlanSha256")
        != expected_tensor_surgery_plan_sha256
        or complete.get("semanticPageCount") != len(semantic_objects_tuple)
        or complete.get("semanticDirectPageMapSha256")
        != semantic_map_sha256
        or complete.get("optimizerMomentsReinitializedPageCount")
        != len(reset_page_ids)
        or complete.get(
            "optimizerMomentsReinitializedPageIdsSha256"
        )
        != reset_ids_sha256
        or complete.get("outputObjectsSelfContainedDirect") is not True
        or complete.get("baseBoundDeltaObjectCount") != 0
        or complete.get("crossStoreOverlayObjectCount") != 0
        or complete.get("acceptedPointerMutated") is not False
    ):
        raise RuntimeError(
            "NoNE historical tensor surgery ledger completion differs"
        )
    return NoNEHistoricalPageTensorSurgeryPacket(
        target_generation=target_generation,
        semantic_page_ids_t=semantic_page_ids_t,
        semantic_page_objects=semantic_objects_tuple,
        optimizer_moments_reinitialized_page_ids_t=reset_page_ids_t,
        surgery_sha256_t=digest_tensor(
            cast(str, complete["recordSha256"])
        ),
        ledger_path=str(ledger_path),
    )


def _validated_reconciled_direct_pack_source_mode_boundary(
    *,
    source_packet: NoNEReconciledDirectPagePackSourcePacket,
    page_objects: tuple[NoNEPageObjectBinding, ...],
    source_store: NoNEImmutablePageStore,
) -> DirectPagePackBuildPacket | None:
    """Require exactly one legacy-loose or canonical-pack source mode."""

    expected_map_sha256_t = _page_object_map_digest_t_boundary(page_objects)
    if (
        len(source_packet.page_objects) != len(page_objects)
        or not torch.equal(
            source_packet.page_map_sha256_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(-1),
            expected_map_sha256_t,
        )
        or any(
            not _same_page_object_binding_boundary(left, right)
            for left, right in zip(
                source_packet.page_objects,
                page_objects,
                strict=True,
            )
        )
    ):
        raise RuntimeError("NoNE reconciled direct pack source differs")
    legacy_mode = (
        len(source_packet.object_paths) == len(page_objects)
        and source_packet.canonical_pack is None
        and source_packet.direct_page_map_ledger_path is None
    )
    resume_mode = (
        not source_packet.object_paths
        and source_packet.canonical_pack is not None
        and source_packet.direct_page_map_ledger_path is not None
    )
    if legacy_mode == resume_mode:
        raise RuntimeError("NoNE reconciled direct pack source mode differs")
    if legacy_mode:
        if any(
            path.is_symlink()
            or not path.is_file()
            or path.lstat().st_size != int(binding.object_bytes_t)
            for path, binding in zip(
                source_packet.object_paths,
                page_objects,
                strict=True,
            )
        ):
            raise RuntimeError("NoNE reconciled direct pack source differs")
        return None
    assert source_packet.canonical_pack is not None
    assert source_packet.direct_page_map_ledger_path is not None
    validated_pack = validate_direct_page_pack_set_authority_boundary(
        source_packet.canonical_pack.authority,
        index=source_packet.canonical_pack.index,
    )
    _session_id_t, session_root = source_store._require_session()
    if (
        source_packet.canonical_pack.authority.index_root.resolve()
        != session_root.resolve()
        or any(
            root.resolve() != session_root.resolve()
            for root in source_packet.canonical_pack.authority.shard_roots
        )
        or not torch.equal(
            validated_pack.page_map_sha256_t,
            expected_map_sha256_t,
        )
    ):
        raise RuntimeError("NoNE reconciled direct pack resume differs")
    return source_packet.canonical_pack


def reopen_all_knowledge_reconciled_direct_page_map_boundary(
    *,
    direct_store: NoNEImmutablePageStore,
    target_generation: NoNEGenerationBinding,
    canonical_pack: DirectPagePackBuildPacket,
    direct_page_map_ledger_path: Path,
    historical_surgery_ledger_path: Path,
    expected_tensor_surgery_plan_sha256: str,
) -> tuple[
    NoNEHistoricalPageTensorSurgeryPacket,
    tuple[NoNEPageObjectBinding, ...],
    NoNEReconciledDirectPagePackSourcePacket,
]:
    """Reopen signed g187 tensors for one pointer-neutral g188 transaction.

    This boundary reads only the content-addressed pack index and the two
    completed hash-chained ledgers. It never walks, stats, opens, rebuilds, or
    copies the 81,602 loose page-object payloads.
    """

    canonical_pack, page_objects, direct_ledger_path = (
        _reopen_reconciled_direct_page_map_ledger_boundary(
            direct_store=direct_store,
            target_generation=target_generation,
            canonical_pack=canonical_pack,
            direct_page_map_ledger_path=direct_page_map_ledger_path,
        )
    )
    page_tensor_surgery = (
        _reopen_historical_page_tensor_surgery_ledger_boundary(
            direct_store=direct_store,
            target_generation=target_generation,
            canonical_pack=canonical_pack,
            page_objects=page_objects,
            historical_surgery_ledger_path=(
                historical_surgery_ledger_path
            ),
            expected_tensor_surgery_plan_sha256=(
                expected_tensor_surgery_plan_sha256
            ),
        )
    )
    source_packet = NoNEReconciledDirectPagePackSourcePacket(
        page_objects=page_objects,
        object_paths=(),
        page_map_sha256_t=_page_object_map_digest_t_boundary(page_objects),
        canonical_pack=canonical_pack,
        direct_page_map_ledger_path=str(direct_ledger_path),
    )
    return page_tensor_surgery, page_objects, source_packet


class NoNEGenerationReplicaCoordinator:
    """Coordinate immutable page generations across verified device copies.

    This class is an explicit filesystem/checkpoint boundary. Model routing and
    execution continue to use the canonical store directly; replicas never
    select, rerank, or alter a model-owned page request.

    Every store stages the same generation before any accepted pointer moves.
    Replica pointers advance first and the canonical pointer advances last, so
    the canonical store remains the recovery authority after an interrupted
    accept. Historical checkout follows the same ordering and repairs any
    replica-only pointer movement if a later copy fails.
    """

    def __init__(
        self,
        *,
        primary_store: NoNEImmutablePageStore,
        replica_stores: tuple[NoNEImmutablePageStore, ...],
        receipt_path: Path,
        receipt_sha256: str,
        durability_complete: bool,
        training_admission_eligible: bool | None = None,
        promotion_eligible: bool | None = None,
    ) -> None:
        if not replica_stores:
            raise ValueError("NoNE generation replication requires another store")
        self.primary_store = primary_store
        self.replica_stores = replica_stores
        self.receipt_path = receipt_path
        self.receipt_sha256 = receipt_sha256
        self.durability_complete = durability_complete
        # Direct construction is retained for focused in-memory tests and
        # historical callers. Receipt-backed production construction below
        # always supplies the two independent policy values from exact bytes.
        self.training_admission_eligible = (
            durability_complete
            if training_admission_eligible is None
            else training_admission_eligible
        )
        self.promotion_eligible = (
            durability_complete
            if promotion_eligible is None
            else promotion_eligible
        )
        if (
            self.promotion_eligible
            and not self.durability_complete
        ):
            raise RuntimeError(
                "NoNE promotion eligibility requires complete durability"
            )
        self._staged_bindings: tuple[NoNEGenerationBinding, ...] | None = None
        self._all_knowledge_physical_replica_measurement: (
            dict[str, Any] | None
        ) = None
        self._all_knowledge_replica_candidate: (
            NoNEAllKnowledgeReconciledDirectMapCandidatePacket | None
        ) = None

    def acquire_generation_writer_leases_boundary(self) -> None:
        """Fence every replica before an expensive staged-accept validation."""

        stores = (self.primary_store, *self.replica_stores)
        acquired: list[NoNEImmutablePageStore] = []
        try:
            for store in sorted(stores, key=lambda value: str(value.root)):
                store._acquire_generation_writer_boundary()
                acquired.append(store)
        except Exception:
            for store in reversed(acquired):
                store._release_generation_writer_boundary()
            raise

    @classmethod
    def from_receipt_boundary(
        cls,
        *,
        primary_store: NoNEImmutablePageStore,
        session_id_t: torch.Tensor,
        receipt_path: Path,
        seed_manifest_payload_sha256: str | None = None,
        expected_pointer: Mapping[str, Any] | None = None,
        reconcile_to_primary: bool = True,
    ) -> NoNEGenerationReplicaCoordinator:
        """Open and reconcile the receipt's exact coherent store lineage.

        Historical composition validation must set ``reconcile_to_primary=False``.
        Live accepted pointers can advance past a parent receipt's replica set
        (for example a retired backup root), and force-checkout would mutate
        authority during a read-only validate.  Callers that need repair still
        default to reconciling replicas onto the primary accepted generation.
        """

        resolved_receipt = receipt_path.expanduser().resolve()
        receipt = _read_json(resolved_receipt)
        rows = receipt.get("replicas")
        receipt_seed_sha256 = receipt.get("generationManifestSha256")
        if (
            receipt.get("schema") != "nnf.resynthesis.none_v2_seed_replicas.v1"
            or receipt.get("passed") is not True
            or not isinstance(receipt_seed_sha256, str)
            or len(receipt_seed_sha256) != 64
            or (
                seed_manifest_payload_sha256 is not None
                and receipt_seed_sha256 != seed_manifest_payload_sha256
            )
            or not isinstance(rows, list)
            or len(rows) < 2
        ):
            raise RuntimeError("NoNE replica receipt does not prove the seed")
        primary_root = primary_store.root.resolve()
        roots: set[Path] = set()
        device_ids: set[str] = set()
        canonical_registered = False
        registered_stores: list[NoNEImmutablePageStore] = []
        for row in rows:
            if (
                not isinstance(row, dict)
                or row.get("schema") != "nnf.resynthesis.replica_proof.v1"
                or row.get("fullReadbackVerified") is not True
                or row.get("immutable") is not True
                or row.get("artifactSha256") != receipt_seed_sha256
            ):
                raise RuntimeError("NoNE replica receipt row is not verified")
            root = Path(str(row.get("root", ""))).expanduser().resolve()
            device_id = str(row.get("deviceUuid", ""))
            if root in roots or not device_id:
                raise RuntimeError("NoNE replica receipt identity is duplicated")
            roots.add(root)
            device_ids.add(device_id)
            if root == primary_root:
                canonical_registered = True
                store = primary_store
            else:
                store = NoNEImmutablePageStore(root)
            store.begin_session(session_id_t)
            registered_stores.append(store)
        explicit_copy_count = receipt.get("copyCount")
        explicit_device_count = receipt.get("distinctDeviceCount")
        if (
            explicit_copy_count is not None
            and explicit_copy_count != len(registered_stores)
        ) or (
            explicit_device_count is not None
            and explicit_device_count != len(device_ids)
        ):
            raise RuntimeError("NoNE replica receipt topology counts differ")
        if len(registered_stores) == 2 and (
            explicit_copy_count != 2
            or explicit_device_count != 2
            or receipt.get("minimumTrainingReplicaCount") != 2
            or receipt.get("trainingAdmissionEligible") is not True
        ):
            raise RuntimeError(
                "NoNE two-device replica receipt lacks explicit training authority"
            )
        if len(device_ids) < 2 or len(registered_stores) < 2:
            raise RuntimeError(
                "NoNE replica receipt lacks two distinct full device copies"
            )
        replica_object_roots = tuple(
            store.root for store in registered_stores
        )
        for store in registered_stores:
            store.register_overlay_object_roots(replica_object_roots)
        selected_primary = primary_store
        if expected_pointer is not None:
            receipt_device = resolved_receipt.stat().st_dev
            local_roots = tuple(
                sorted(
                    (
                        root
                        for root in roots
                        if root.stat().st_dev == receipt_device
                    ),
                    key=str,
                )
            )
            discovery_anchor = (
                local_roots[0] if local_roots else primary_root
            )
            selected_primary = NoNEImmutablePageStore.discover_from_anchor_boundary(
                anchor_root=discovery_anchor,
                session_id_t=session_id_t,
                expected_pointer=expected_pointer,
                candidate_roots=tuple(roots),
                registry_roots=(),
            )
        elif not canonical_registered:
            raise RuntimeError(
                "NoNE replica receipt does not contain its canonical store"
            )
        replica_stores = tuple(
            store
            for store in registered_stores
            if store.root != selected_primary.root
        )
        if len(replica_stores) < 1:
            raise RuntimeError(
                "NoNE replica receipt lacks a non-primary device copy"
            )
        coordinator = cls(
            primary_store=selected_primary,
            replica_stores=replica_stores,
            receipt_path=resolved_receipt,
            receipt_sha256=_file_sha256(resolved_receipt),
            durability_complete=receipt.get("durabilityComplete") is True,
            training_admission_eligible=(
                receipt.get("trainingAdmissionEligible") is True
            ),
            promotion_eligible=(
                receipt.get("promotionEligible") is True
            ),
        )
        if reconcile_to_primary:
            coordinator.recover_all_knowledge_acceptance_transactions_boundary()
            coordinator.synchronize_to_primary_boundary()
        return coordinator

    @property
    def store_roots_boundary(self) -> tuple[str, ...]:
        """Return registered roots for checkpoint-sidecar provenance."""

        return (
            str(self.primary_store.root),
            *tuple(str(store.root) for store in self.replica_stores),
        )

    @staticmethod
    def _same_binding(
        left: NoNEGenerationBinding,
        right: NoNEGenerationBinding,
    ) -> bool:
        return bool(
            torch.equal(left.session_id_t, right.session_id_t)
            and torch.equal(left.generation_t, right.generation_t)
            and torch.equal(
                left.manifest_sha256_t,
                right.manifest_sha256_t,
            )
            and torch.equal(
                left.manifest_payload_sha256_t,
                right.manifest_payload_sha256_t,
            )
        )

    def _acquire_pointerless_external_direct_map_source_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        expected_session_id_t: torch.Tensor,
    ) -> Path:
        """Fence one external surgery store without granting pointer authority.

        Historical surgery and full-map reseal intentionally finish in a
        pointerless store on a third device.  That store is immutable source
        evidence only: it must never join the accepting-store set, expose an
        accepted pointer, or become an overlay authority.  Holding its writer
        lease through the O_DIRECT copy closes the only mutation race.
        """

        stores = (self.primary_store, *self.replica_stores)
        source_root = source_store.root.expanduser().resolve()
        accepting_roots = tuple(
            store.root.expanduser().resolve() for store in stores
        )
        if (
            source_root in accepting_roots
            or any(
                source_root.is_relative_to(root)
                or root.is_relative_to(source_root)
                for root in accepting_roots
            )
        ):
            raise RuntimeError(
                "NoNE reconciled direct-map source is not external"
            )
        source_session_id_t, source_session_root = (
            source_store._require_session()
        )
        accepted_path = source_session_root / "accepted.json"
        if (
            not torch.equal(
                source_session_id_t.detach().cpu().long().reshape(-1),
                expected_session_id_t.detach().cpu().long().reshape(-1),
            )
            or accepted_path.exists()
            or accepted_path.is_symlink()
            or not bool(
                source_store.accepted_generation_t()
                .detach()
                .cpu()
                .long()
                .eq(0)
            )
        ):
            raise RuntimeError(
                "NoNE external direct-map source is not pointerless"
            )
        source_store._acquire_generation_writer_boundary()
        if accepted_path.exists() or accepted_path.is_symlink():
            source_store._release_generation_writer_boundary()
            raise RuntimeError(
                "NoNE external direct-map source gained pointer authority"
            )
        return accepted_path

    @staticmethod
    def _release_pointerless_external_direct_map_source_boundary(
        *,
        source_store: NoNEImmutablePageStore,
        accepted_path: Path,
    ) -> None:
        """Recheck pointer isolation before releasing source evidence."""

        try:
            if accepted_path.exists() or accepted_path.is_symlink():
                raise RuntimeError(
                    "NoNE external direct-map source gained pointer authority"
                )
        finally:
            source_store._release_generation_writer_boundary()

    def _require_local_reconciled_direct_page_map_boundary(
        self,
        page_objects: tuple[NoNEPageObjectBinding, ...],
    ) -> None:
        """Require every accepting store to own the complete direct page map."""

        if not page_objects:
            raise ValueError("NoNE reconciled direct page map is empty")
        page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in page_objects
            )
        )
        if (
            torch.unique(page_ids_t).numel() != page_ids_t.numel()
            or not torch.equal(page_ids_t, torch.sort(page_ids_t).values)
        ):
            raise RuntimeError(
                "NoNE reconciled direct page map identity differs"
            )
        stores = (self.primary_store, *self.replica_stores)
        for store in stores:
            for binding in page_objects:
                try:
                    revision = (
                        store._local_reconciled_direct_page_object_boundary(
                            binding
                        )
                    )
                except RuntimeError as error:
                    raise RuntimeError(
                        "NoNE local direct-map shadow differs"
                    ) from error
                if revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS:
                    raise RuntimeError(
                        "NoNE local direct-map shadow differs"
                    )

    def _replicate_reconciled_direct_page_map_local_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        page_objects: tuple[NoNEPageObjectBinding, ...],
    ) -> None:
        """Physically publish every direct page beneath every accepting store."""

        stores = (self.primary_store, *self.replica_stores)
        if source_store not in stores:
            raise RuntimeError(
                "NoNE reconciled direct-map source is not a registered store"
            )
        for binding in page_objects:
            if (
                source_store._local_reconciled_direct_page_object_boundary(
                    binding
                )
                not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
            ):
                raise RuntimeError(
                    "NoNE reconciled direct-map source contains compact authority"
                )
        for store in stores:
            if store is source_store:
                continue
            objects_root, _scratch_root = (
                store._validated_page_object_write_roots_boundary()
            )
            missing_bytes = 0
            observed_sha256s: set[str] = set()
            for binding in page_objects:
                object_sha256 = _tensor_digest_hex(
                    binding.object_sha256_t
                )
                if object_sha256 in observed_sha256s:
                    continue
                observed_sha256s.add(object_sha256)
                local_path = (
                    objects_root / f"{object_sha256}.safetensors"
                )
                if local_path.is_symlink():
                    raise RuntimeError(
                        "NoNE local direct-map shadow differs"
                    )
                if not local_path.is_file():
                    missing_bytes += int(binding.object_bytes_t)
            free_bytes = shutil.disk_usage(objects_root).free
            reserve_bytes = max(4 << 30, free_bytes // 50)
            if missing_bytes > max(0, free_bytes - reserve_bytes):
                raise RuntimeError(
                    "NoNE local direct-map replica storage is insufficient"
                )
            store.replicate_page_objects_from_boundary(
                source_store,
                page_objects,
            )
        self._require_local_reconciled_direct_page_map_boundary(
            page_objects
        )

    def _build_and_replicate_all_knowledge_direct_page_pack_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        page_objects: tuple[NoNEPageObjectBinding, ...],
        source_packet: NoNEReconciledDirectPagePackSourcePacket | None = None,
        minimum_cold_unique_logical_bytes_per_second: int = (
            DIRECT_PAGE_PACK_MIN_BYTES_PER_SECOND
        ),
    ) -> tuple[dict[str, Any], dict[str, Any]]:
        """Build one canonical payload and prove it once through O_DIRECT.

        Every generation metadata store resolves this same hash-bound payload;
        no full-byte replica is created and no accepting-store path discovery
        participates in runtime authority.
        """

        stores = (self.primary_store, *self.replica_stores)
        if not page_objects:
            raise RuntimeError(
                "NoNE all-knowledge direct pack source differs"
            )
        page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in page_objects
            )
        )
        _require_exact_generation_187_physical_page_ids_boundary(page_ids_t)
        source_paths: list[Path] = []
        canonical_pack: DirectPagePackBuildPacket | None = None
        if source_packet is not None:
            canonical_pack = (
                _validated_reconciled_direct_pack_source_mode_boundary(
                    source_packet=source_packet,
                    page_objects=page_objects,
                    source_store=source_store,
                )
            )
            if canonical_pack is None:
                source_paths.extend(source_packet.object_paths)
        else:
            for binding in page_objects:
                revision = (
                    source_store._local_reconciled_direct_page_object_boundary(
                        binding
                    )
                )
                if revision not in RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS:
                    raise RuntimeError(
                        "NoNE all-knowledge direct pack source is indirect"
                    )
                objects_root, _scratch_root = (
                    source_store._validated_page_object_write_roots_boundary()
                )
                source_paths.append(
                    objects_root
                    / (
                        f"{_tensor_digest_hex(binding.object_sha256_t)}"
                        ".safetensors"
                    )
                )
        _source_session_id_t, source_session_root = (
            source_store._require_session()
        )
        payload_file_count = 1
        if canonical_pack is None:
            raw_source_packet = DirectPagePackSourcePacket(
                page_ids_t=page_ids_t,
                object_sha256s_t=torch.stack(
                    tuple(
                        binding.object_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .reshape(32)
                        for binding in page_objects
                    )
                ),
                object_bytes_t=torch.stack(
                    tuple(
                        binding.object_bytes_t.detach()
                        .cpu()
                        .long()
                        .reshape(())
                        for binding in page_objects
                    )
                ),
                object_paths=tuple(source_paths),
            )
            built = (
                load_existing_direct_page_pack_set_for_source_boundary(
                    raw_source_packet,
                    shard_roots=(source_session_root,),
                    index_root=source_session_root,
                )
                or build_direct_page_pack_set_boundary(
                    raw_source_packet,
                    shard_roots=(source_session_root,),
                    index_root=source_session_root,
                )
            )
        else:
            built = canonical_pack
        if (
            built.index.shard_sha256s_t.shape != (payload_file_count, 32)
            or built.index.shard_indices_t.ne(0).any()
            or len(built.authority.shard_roots) != payload_file_count
            or len(built.authority.shard_relative_paths)
            != payload_file_count
        ):
            raise RuntimeError(
                "NoNE all-knowledge pack is not one tensor payload file"
            )
        content_record = (
            source_store._direct_page_pack_set_authority_record_boundary(
                authority=built.authority,
                index=built.index,
            )
        )

        page_rows = [
            {
                "pageId": int(binding.page_id_t),
                "sha256": _tensor_digest_hex(binding.object_sha256_t),
                "bytes": int(binding.object_bytes_t),
            }
            for binding in page_objects
        ]
        for store in stores:
            packed = (
                store._local_direct_page_pack_set_authority_boundary(
                    {
                        "pageObjects": page_rows,
                        "directPagePackSetAuthority": content_record,
                    }
                )
            )
            if packed is None:
                raise RuntimeError(
                    "NoNE all-knowledge accepting store pack is absent"
                )
            if (
                packed[0].index_root != built.authority.index_root
                or packed[0].shard_roots != built.authority.shard_roots
            ):
                raise RuntimeError(
                    "NoNE all-knowledge accepting store discovered a "
                    "noncanonical pack"
                )

        authority_by_root: dict[Path, DirectPagePackSetAuthorityPacket] = {
            source_session_root: built.authority
        }

        diagnostic_inventory_bytes, diagnostic_terminal_sha256 = (
            _direct_page_pack_diagnostic_inventory_bytes_boundary(
                authority=built.authority,
                index=built.index,
            )
        )
        diagnostic_inventory_sha256 = hashlib.sha256(
            diagnostic_inventory_bytes
        ).hexdigest()
        diagnostic_inventory_relative_path = str(
            Path("direct-page-packs")
            / "diagnostics"
            / (
                f"{diagnostic_inventory_sha256}"
                ".none-page-inventory.jsonl"
            )
        )
        diagnostic_inventory_replicas: list[dict[str, Any]] = []
        for root, authority in authority_by_root.items():
            inventory_path = (
                root / diagnostic_inventory_relative_path
            ).resolve()
            if (
                not inventory_path.is_relative_to(root.resolve())
                or inventory_path.is_symlink()
            ):
                raise RuntimeError(
                    "NoNE diagnostic inventory escaped its replica"
                )
            _atomic_bytes(inventory_path, diagnostic_inventory_bytes)
            _validated_direct_page_pack_diagnostic_inventory_boundary(
                path=inventory_path,
                expected_sha256=diagnostic_inventory_sha256,
                expected_terminal_record_sha256=(
                    diagnostic_terminal_sha256
                ),
                authority=authority,
                index=load_direct_page_pack_index_boundary(authority),
            )
            inventory_stat = inventory_path.lstat()
            diagnostic_inventory_replicas.append(
                {
                    "root": str(root),
                    "device": root.stat().st_dev,
                    "path": diagnostic_inventory_relative_path,
                    "sha256": diagnostic_inventory_sha256,
                    "bytes": len(diagnostic_inventory_bytes),
                    "inode": inventory_stat.st_ino,
                    "mode": stat.S_IMODE(inventory_stat.st_mode),
                    "linkCount": inventory_stat.st_nlink,
                    "completeReplica": True,
                }
            )
        local_locator_bytes, local_locator_terminal_sha256 = (
            _direct_page_pack_local_locator_diagnostic_bytes_boundary(
                source_paths=tuple(source_paths),
                index=built.index,
                authorities_by_root=authority_by_root,
                canonical_inventory_sha256=(
                    diagnostic_inventory_sha256
                ),
            )
        )
        local_locator_sha256 = hashlib.sha256(
            local_locator_bytes
        ).hexdigest()
        local_locator_path = (
            source_session_root
            / "direct-page-packs"
            / "diagnostics"
            / (
                f"{local_locator_sha256}"
                ".local-source-locator.jsonl"
            )
        ).resolve()
        _atomic_bytes(local_locator_path, local_locator_bytes)
        local_locator_receipt_path = (
            source_session_root
            / "direct-page-packs"
            / "diagnostics"
            / "local-source-locator.diagnostic.json"
        ).resolve()
        local_locator_receipt = {
            "schema": DIRECT_PAGE_PACK_LOCAL_LOCATOR_DIAGNOSTIC_SCHEMA,
            "path": str(local_locator_path),
            "sha256": local_locator_sha256,
            "bytes": len(local_locator_bytes),
            "terminalRecordSha256": local_locator_terminal_sha256,
            "recordCount": len(source_paths),
            "containsLocalPaths": bool(source_paths),
            "diagnosticOnly": True,
            "runtimeAuthority": False,
            "acceptanceGate": False,
            "excludedFromPhysicalProofAuthority": True,
        }
        _atomic_bytes(
            local_locator_receipt_path,
            json.dumps(
                local_locator_receipt,
                sort_keys=True,
                indent=2,
            ).encode("utf-8")
            + b"\n",
        )

        independent_cold_rows: list[dict[str, Any]] = []
        canonical_pack_roots = (source_session_root,)
        for replica_ordinal, root in enumerate(canonical_pack_roots):
            authority = authority_by_root[root]
            started_unix_ns = time.time_ns()
            cold = verify_direct_page_pack_set_cold_boundary(
                authority,
                minimum_unique_logical_bytes_per_second=0,
                direct_io=True,
            )
            finished_unix_ns = time.time_ns()
            logical_rate = int(
                cold.aggregate_unique_logical_bytes_per_second_t
            )
            physical_rate = (
                int(cold.physical_read_bytes_t)
                * 1_000_000_000
                // max(1, int(cold.elapsed_nanoseconds_t))
            )
            payload_path = (
                authority.shard_roots[0]
                / authority.shard_relative_paths[0]
            ).resolve()
            index_path = (
                authority.index_root / authority.index_relative_path
            ).resolve()
            payload_stat = payload_path.lstat()
            index_stat = index_path.lstat()
            rate_passed = (
                logical_rate
                >= minimum_cold_unique_logical_bytes_per_second
            )
            if (
                payload_path.is_symlink()
                or index_path.is_symlink()
                or not stat.S_ISREG(payload_stat.st_mode)
                or not stat.S_ISREG(index_stat.st_mode)
                or payload_stat.st_nlink != 1
                or index_stat.st_nlink != 1
                or not bool(cold.direct_io_t)
                or not bool(cold.zero_padding_verified_t)
                or not rate_passed
            ):
                raise RuntimeError(
                    "NoNE all-knowledge independent cold replica differs"
                )
            independent_cold_rows.append(
                {
                    "replicaOrdinal": replica_ordinal,
                    "root": str(root),
                    "device": root.stat().st_dev,
                    "completeReplica": True,
                    "payload": {
                        "path": authority.shard_relative_paths[0],
                        "sha256": _tensor_digest_hex(
                            authority.shard_sha256s_t[0]
                        ),
                        "bytes": int(authority.shard_bytes_t[0]),
                        "logicalObjectBytes": int(
                            authority.logical_object_bytes_t
                        ),
                        "inode": payload_stat.st_ino,
                        "mode": stat.S_IMODE(payload_stat.st_mode),
                        "linkCount": payload_stat.st_nlink,
                        "modifiedNanoseconds": payload_stat.st_mtime_ns,
                        "changedNanoseconds": payload_stat.st_ctime_ns,
                    },
                    "index": {
                        "path": authority.index_relative_path,
                        "sha256": _tensor_digest_hex(
                            authority.index_sha256_t
                        ),
                        "bytes": int(authority.index_bytes_t),
                        "inode": index_stat.st_ino,
                        "mode": stat.S_IMODE(index_stat.st_mode),
                        "linkCount": index_stat.st_nlink,
                        "modifiedNanoseconds": index_stat.st_mtime_ns,
                        "changedNanoseconds": index_stat.st_ctime_ns,
                        "containsKnowledgeTensors": False,
                    },
                    "packSetSha256": _tensor_digest_hex(
                        authority.pack_set_sha256_t
                    ),
                    "pageMapSha256": _tensor_digest_hex(
                        authority.page_map_sha256_t
                    ),
                    "pageIdsSha256": _tensor_digest_hex(
                        authority.page_ids_sha256_t
                    ),
                    "startedUnixNanoseconds": started_unix_ns,
                    "finishedUnixNanoseconds": finished_unix_ns,
                    "elapsedNanoseconds": int(cold.elapsed_nanoseconds_t),
                    "physicalReadBytes": int(cold.physical_read_bytes_t),
                    "physicalBytesPerSecond": physical_rate,
                    "uniqueLogicalBytes": int(cold.logical_object_bytes_t),
                    "uniqueLogicalBytesPerSecond": logical_rate,
                    "payloadHashVerified": True,
                    "indexHashVerified": True,
                    "zeroPaddingVerified": True,
                    "fileIdentityStable": True,
                    "directIo": True,
                    "ratePassed": True,
                }
            )
        minimum_observed_cold_rate = min(
            int(row["uniqueLogicalBytesPerSecond"])
            for row in independent_cold_rows
        )
        total_newly_written_logical_bytes = 0
        durable_elapsed_ns = 0
        physical_record = {
            "schema": ALL_KNOWLEDGE_PHYSICAL_REPLICA_PROOF_SCHEMA,
            "passed": True,
            "pageCount": int(page_ids_t.numel()),
            "pageMax": int(page_ids_t[-1]),
            "pagesAbove101000": int(page_ids_t.gt(101_000).sum()),
            "directRevisions": sorted(
                RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
            ),
            "historicalRevision6Accepted": False,
            "directPageMapSha256": _tensor_digest_hex(
                built.index.page_map_sha256_t
            ),
            "directPagePackSetAuthority": content_record,
            "packSetSha256": content_record["packSetSha256"],
            "sourceStoreRoot": str(source_store.root),
            "sourcePackRoot": str(source_session_root),
            "sourcePointerlessExternal": all(
                source_store.root.expanduser().resolve()
                != store.root.expanduser().resolve()
                for store in stores
            ),
            "canonicalPackTopology": True,
            "canonicalPayloadFileCount": 1,
            "fullByteReplicaCopyCount": 0,
            "uniquePayloadIdentityCount": 1,
            "knowledgeTensorPayloadFileCount": 1,
            "payloadFilesPerReplica": 1,
            "completeReplicaCount": 1,
            "physicalPayloadFileCount": 1,
            "minimumCompleteReplicaCount": 1,
            "skippedReplicas": [],
            "proofOnlyPayloadFileCount": 0,
            "unexpectedPayloadFileCount": 0,
            "metadataIndexContainsKnowledgeTensors": False,
            "diagnosticInventory": {
                "schema": DIRECT_PAGE_PACK_DIAGNOSTIC_INVENTORY_SCHEMA,
                "path": diagnostic_inventory_relative_path,
                "sha256": diagnostic_inventory_sha256,
                "bytes": len(diagnostic_inventory_bytes),
                "terminalRecordSha256": diagnostic_terminal_sha256,
                "recordCount": int(page_ids_t.numel()),
                "containsKnowledgeTensors": False,
                "containsLocalPaths": False,
                "runtimeAuthority": False,
                "replicas": diagnostic_inventory_replicas,
            },
            "localSourceLocatorExcludedFromAuthority": True,
            "durabilityComplete": self.durability_complete,
            "durableCopy": {
                "newlyWrittenLogicalBytes": (
                    total_newly_written_logical_bytes
                ),
                "elapsedNanoseconds": durable_elapsed_ns,
                "rateIsAcceptanceGate": False,
                "replicas": [],
            },
            "coldIngestion": {
                "logicalBytesPerReplica": int(
                    built.index.object_bytes_t.sum()
                ),
                "minimumPerReplicaUniqueLogicalBytesPerSecond": (
                    minimum_cold_unique_logical_bytes_per_second
                ),
                "minimumObservedUniqueLogicalBytesPerSecond": (
                    minimum_observed_cold_rate
                ),
                "rateAggregationUsed": False,
                "allReplicaColdRatesPassed": True,
                "canonicalWholeFileProofCount": 1,
                "duplicateCreditBytes": 0,
                "pageCacheCreditBytes": 0,
                "hardlinkCreditBytes": 0,
                "reflinkCreditBytes": 0,
                "reusedReplicaCreditBytes": 0,
                "independentFiles": independent_cold_rows,
            },
            "ratePassed": True,
            "minimumPerReplicaUniqueLogicalBytesPerSecond": (
                minimum_cold_unique_logical_bytes_per_second
            ),
            "newlyWrittenBytes": total_newly_written_logical_bytes,
            "pageCacheCreditBytes": 0,
            "hardlinkCreditBytes": 0,
            "reflinkCreditBytes": 0,
            "reusedObjectCreditBytes": 0,
            "sourceReadOncePerObject": True,
            "alignedBoundedWaves": True,
            "directIo": True,
            "fileAndDirectoryFsyncMeasured": True,
            "coldPostWriteReadbackVerified": True,
            "devices": [
                {
                    "root": str(root),
                    "device": root.stat().st_dev,
                    "completePackSet": True,
                }
                for root in canonical_pack_roots
            ],
            "objects": [
                {"pageId": int(page_id)}
                for page_id in page_ids_t
            ],
        }
        return content_record, physical_record

    def _replicate_all_knowledge_direct_page_map_physical_boundary(
        self,
        *,
        source_store: NoNEImmutablePageStore,
        page_objects: tuple[NoNEPageObjectBinding, ...],
    ) -> dict[str, Any]:
        """Reject the retired loose-object all-knowledge replica topology.

        Final reconciliation must use exactly one packed tensor payload per
        replica. Loose-object copying remains below only as historical recovery
        implementation detail and is unreachable from accepted g188 authority.
        """

        raise RuntimeError(
            "NoNE loose-object all-knowledge replication is retired; "
            "one direct page pack is required"
        )

        stores = (self.primary_store, *self.replica_stores)
        if not page_objects:
            raise RuntimeError(
                "NoNE all-knowledge replica source page map is empty"
            )
        source_pointerless_external = all(
            source_store.root.expanduser().resolve()
            != store.root.expanduser().resolve()
            for store in stores
        )
        page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in page_objects
            )
        )
        page_ids_t = _require_all_knowledge_physical_page_ids_boundary(
            page_ids_t
        )
        page_count = int(page_ids_t.numel())
        page_max = int(page_ids_t[-1])
        pages_above_101000 = int(page_ids_t.gt(101_000).sum())
        if len(page_objects) != page_count:
            raise RuntimeError("NoNE all-knowledge direct page map differs")

        device_rows: dict[NoNEImmutablePageStore, tuple[Path, int, int]] = {
            store: _all_knowledge_store_device_boundary(store)
            for store in stores
        }
        roots = tuple(row[0] for row in device_rows.values())
        devices = tuple(row[1] for row in device_rows.values())
        if (
            len(set(roots)) != len(roots)
            or len(set(devices)) != len(devices)
        ):
            raise RuntimeError(
                "NoNE all-knowledge replicas do not occupy distinct devices"
            )

        source_rows: dict[
            str,
            tuple[
                NoNEPageObjectBinding,
                Path,
                os.stat_result,
                int,
            ],
        ] = {}
        for binding in page_objects:
            object_sha256 = _tensor_digest_hex(binding.object_sha256_t)
            if object_sha256 in source_rows:
                raise RuntimeError(
                    "NoNE all-knowledge page objects alias one content inode"
                )
            path, identity, revision = (
                _all_knowledge_local_direct_object_boundary(
                    store=source_store,
                    binding=binding,
                )
            )
            source_rows[object_sha256] = (
                binding,
                path,
                identity,
                revision,
            )

        missing_by_object: dict[
            str,
            tuple[NoNEImmutablePageStore, ...],
        ] = {}
        reused_by_object: dict[
            str,
            tuple[NoNEImmutablePageStore, ...],
        ] = {}
        missing_bytes_by_store = {store: 0 for store in stores}
        for object_sha256, source_row in source_rows.items():
            binding = source_row[0]
            missing: list[NoNEImmutablePageStore] = []
            reused: list[NoNEImmutablePageStore] = []
            for store in stores:
                objects_root = device_rows[store][0]
                object_path = (
                    objects_root / f"{object_sha256}.safetensors"
                )
                if object_path.exists() or object_path.is_symlink():
                    _all_knowledge_local_direct_object_boundary(
                        store=store,
                        binding=binding,
                    )
                    reused.append(store)
                else:
                    if store is source_store:
                        raise RuntimeError(
                            "NoNE all-knowledge physical source disappeared"
                        )
                    missing.append(store)
                    missing_bytes_by_store[store] += int(
                        binding.object_bytes_t
                    )
            missing_by_object[object_sha256] = tuple(missing)
            reused_by_object[object_sha256] = tuple(reused)

        for store, missing_bytes in missing_bytes_by_store.items():
            if missing_bytes < 1:
                continue
            objects_root = device_rows[store][0]
            free_bytes = shutil.disk_usage(objects_root).free
            reserve_bytes = max(4 << 30, free_bytes // 50)
            if missing_bytes > max(0, free_bytes - reserve_bytes):
                raise RuntimeError(
                    "NoNE all-knowledge replica storage is insufficient"
                )

        total_source_read_bytes = 0
        total_newly_written_bytes = 0
        total_destination_readback_bytes = 0
        written_bytes_by_store = {store: 0 for store in stores}
        object_records: list[dict[str, Any]] = []
        created_paths: list[Path] = []
        overall_started_ns: int | None = None
        overall_durable_finished_ns: int | None = None
        max_workers = max(1, len(stores) - 1)
        try:
            with ThreadPoolExecutor(
                max_workers=max_workers,
                thread_name_prefix="nnf-all-knowledge-replica",
            ) as executor:
                for binding in page_objects:
                    object_sha256 = _tensor_digest_hex(
                        binding.object_sha256_t
                    )
                    object_bytes = int(binding.object_bytes_t)
                    (
                        _source_binding,
                        source_path,
                        source_identity,
                        revision,
                    ) = source_rows[object_sha256]
                    missing_stores = missing_by_object[object_sha256]
                    destination_records: list[dict[str, Any]] = []
                    object_started_ns = time.perf_counter_ns()
                    if overall_started_ns is None:
                        overall_started_ns = object_started_ns
                    for store in reused_by_object[object_sha256]:
                        path, identity, reused_revision = (
                            _all_knowledge_local_direct_object_boundary(
                                store=store,
                                binding=binding,
                            )
                        )
                        cold_sha256 = (
                            _all_knowledge_direct_cold_sha256_boundary(
                                path,
                                object_bytes=object_bytes,
                            )
                        )
                        if cold_sha256 != object_sha256:
                            raise RuntimeError(
                                "NoNE all-knowledge reused cold readback "
                                "hash differs"
                            )
                        total_destination_readback_bytes += object_bytes
                        overall_durable_finished_ns = time.perf_counter_ns()
                        destination_records.append(
                            {
                                "storeRoot": str(store.root),
                                "path": str(path),
                                "device": identity.st_dev,
                                "inode": identity.st_ino,
                                "linkCount": identity.st_nlink,
                                "revision": reused_revision,
                                "reused": True,
                                "newlyWrittenBytes": 0,
                                "coldReadbackSha256": cold_sha256,
                            }
                        )
                    if not missing_stores:
                        source_cold_sha256 = (
                            _all_knowledge_direct_cold_sha256_boundary(
                                source_path,
                                object_bytes=object_bytes,
                            )
                        )
                        if source_cold_sha256 != object_sha256:
                            raise RuntimeError(
                                "NoNE all-knowledge physical source hash "
                                "differs"
                            )
                        total_source_read_bytes += object_bytes
                        overall_durable_finished_ns = time.perf_counter_ns()
                        object_elapsed_ns = (
                            overall_durable_finished_ns - object_started_ns
                        )
                        object_records.append(
                            {
                                "pageId": int(binding.page_id_t),
                                "objectSha256": object_sha256,
                                "objectBytes": object_bytes,
                                "directRevision": revision,
                                "sourcePath": str(source_path),
                                "sourceDevice": source_identity.st_dev,
                                "sourceInode": source_identity.st_ino,
                                "sourceReadBytes": object_bytes,
                                "elapsedNanoseconds": object_elapsed_ns,
                                "aggregateDestinationBytesPerSecond": (
                                    object_bytes
                                    * len(destination_records)
                                    * 1_000_000_000
                                    // max(1, object_elapsed_ns)
                                ),
                                "destinations": sorted(
                                    destination_records,
                                    key=lambda row: str(row["storeRoot"]),
                                ),
                            }
                        )
                        continue

                    source_descriptor = _all_knowledge_direct_open_boundary(
                        source_path,
                        writable=False,
                    )
                    destination_descriptors: dict[
                        NoNEImmutablePageStore, tuple[int, Path, Path]
                    ] = {}
                    bounce = mmap.mmap(
                        -1,
                        _ALL_KNOWLEDGE_REPLICA_IO_WAVE_BYTES,
                        access=mmap.ACCESS_WRITE,
                    )
                    view = memoryview(bounce)
                    source_digest = hashlib.sha256()
                    try:
                        for store in missing_stores:
                            objects_root = device_rows[store][0]
                            final_path = (
                                objects_root
                                / f"{object_sha256}.safetensors"
                            )
                            temporary_path = objects_root / (
                                f".{object_sha256}.{os.getpid()}."
                                f"{threading.get_ident()}."
                                f"{time.monotonic_ns()}.physical.tmp"
                            )
                            descriptor = (
                                _all_knowledge_direct_open_boundary(
                                    temporary_path,
                                    writable=True,
                                )
                            )
                            destination_descriptors[store] = (
                                descriptor,
                                temporary_path,
                                final_path,
                            )
                        offset = 0
                        while offset < object_bytes:
                            logical_bytes, aligned_bytes = (
                                _all_knowledge_direct_pread_wave_boundary(
                                    source_descriptor,
                                    view,
                                    offset=offset,
                                    object_bytes=object_bytes,
                                )
                            )
                            if aligned_bytes > logical_bytes:
                                padding = view[
                                    logical_bytes:aligned_bytes
                                ]
                                try:
                                    padding[:] = b"\x00" * len(padding)
                                finally:
                                    padding.release()
                            logical_view = view[:logical_bytes]
                            try:
                                source_digest.update(logical_view)
                            finally:
                                logical_view.release()
                            futures = tuple(
                                executor.submit(
                                    _all_knowledge_direct_pwrite_wave_boundary,
                                    descriptor,
                                    view,
                                    offset=offset,
                                    aligned_bytes=aligned_bytes,
                                )
                                for descriptor, _temporary, _final in (
                                    destination_descriptors.values()
                                )
                            )
                            for future in futures:
                                future.result()
                            offset += logical_bytes
                            total_source_read_bytes += logical_bytes
                        if source_digest.hexdigest() != object_sha256:
                            raise RuntimeError(
                                "NoNE all-knowledge physical source hash differs"
                            )

                        def finalize_descriptor(
                            descriptor: int,
                        ) -> None:
                            os.ftruncate(descriptor, object_bytes)
                            os.fsync(descriptor)

                        futures = tuple(
                            executor.submit(
                                finalize_descriptor,
                                descriptor,
                            )
                            for descriptor, _temporary, _final in (
                                destination_descriptors.values()
                            )
                        )
                        for future in futures:
                            future.result()
                        for descriptor, _temporary, _final in (
                            destination_descriptors.values()
                        ):
                            os.close(descriptor)
                        destination_descriptors = {
                            store: (-1, temporary, final)
                            for store, (
                                _descriptor,
                                temporary,
                                final,
                            ) in destination_descriptors.items()
                        }
                        for store, (
                            _descriptor,
                            temporary_path,
                            final_path,
                        ) in destination_descriptors.items():
                            if final_path.exists() or final_path.is_symlink():
                                raise RuntimeError(
                                    "NoNE all-knowledge destination appeared "
                                    "during replication"
                                )
                            os.rename(temporary_path, final_path)
                            created_paths.append(final_path)
                            written_bytes_by_store[store] += object_bytes
                            total_newly_written_bytes += object_bytes
                        for store in missing_stores:
                            _fsync_directory(device_rows[store][0])
                        overall_durable_finished_ns = time.perf_counter_ns()
                    finally:
                        for descriptor, temporary, _final in (
                            destination_descriptors.values()
                        ):
                            if descriptor >= 0:
                                os.close(descriptor)
                            temporary.unlink(missing_ok=True)
                        view.release()
                        bounce.close()
                        os.close(source_descriptor)

                    if overall_durable_finished_ns is None:
                        raise RuntimeError(
                            "NoNE all-knowledge physical timing is absent"
                        )
                    object_elapsed_ns = (
                        overall_durable_finished_ns - object_started_ns
                    )
                    object_written_bytes = (
                        object_bytes * len(missing_stores)
                    )
                    for store in missing_stores:
                        path, identity, copied_revision = (
                            _all_knowledge_local_direct_object_boundary(
                                store=store,
                                binding=binding,
                            )
                        )
                        cold_sha256 = (
                            _all_knowledge_direct_cold_sha256_boundary(
                                path,
                                object_bytes=object_bytes,
                            )
                        )
                        if cold_sha256 != object_sha256:
                            raise RuntimeError(
                                "NoNE all-knowledge cold readback hash differs"
                            )
                        total_destination_readback_bytes += object_bytes
                        overall_durable_finished_ns = time.perf_counter_ns()
                        destination_records.append(
                            {
                                "storeRoot": str(store.root),
                                "path": str(path),
                                "device": identity.st_dev,
                                "inode": identity.st_ino,
                                "linkCount": identity.st_nlink,
                                "revision": copied_revision,
                                "reused": False,
                                "newlyWrittenBytes": object_bytes,
                                "coldReadbackSha256": cold_sha256,
                            }
                        )
                    if len(
                        {
                            (int(row["device"]), int(row["inode"]))
                            for row in destination_records
                        }
                    ) != len(destination_records):
                        raise RuntimeError(
                            "NoNE all-knowledge replica inode is shared"
                        )
                    object_records.append(
                        {
                            "pageId": int(binding.page_id_t),
                            "objectSha256": object_sha256,
                            "objectBytes": object_bytes,
                            "directRevision": revision,
                            "sourcePath": str(source_path),
                            "sourceDevice": source_identity.st_dev,
                            "sourceInode": source_identity.st_ino,
                            "sourceReadBytes": object_bytes,
                            "elapsedNanoseconds": object_elapsed_ns,
                            "aggregateDestinationBytesPerSecond": (
                                object_written_bytes * 1_000_000_000
                                // max(1, object_elapsed_ns)
                            ),
                            "destinations": sorted(
                                destination_records,
                                key=lambda row: str(row["storeRoot"]),
                            ),
                        }
                    )
        except Exception:
            touched_roots: set[Path] = set()
            for path in reversed(created_paths):
                if path.is_file() and not path.is_symlink():
                    path.unlink()
                    touched_roots.add(path.parent)
            for root in sorted(touched_roots, key=str):
                _fsync_directory(root)
            raise

        if (
            overall_started_ns is None
            or overall_durable_finished_ns is None
            or total_source_read_bytes < 1
            or total_destination_readback_bytes < 1
        ):
            raise RuntimeError(
                "NoNE all-knowledge physical replica proof measured no bytes"
            )
        elapsed_ns = overall_durable_finished_ns - overall_started_ns
        rate_basis_bytes = (
            total_newly_written_bytes
            if total_newly_written_bytes > 0
            else total_destination_readback_bytes
        )
        aggregate_rate = (
            rate_basis_bytes * 1_000_000_000 // max(1, elapsed_ns)
        )
        per_device_rows = [
            {
                "storeRoot": str(store.root),
                "objectsRoot": str(device_rows[store][0]),
                "device": device_rows[store][1],
                "rootInode": device_rows[store][2],
                "newlyWrittenBytes": written_bytes_by_store[store],
                "bytesPerSecond": (
                    written_bytes_by_store[store]
                    * 1_000_000_000
                    // max(1, elapsed_ns)
                ),
            }
            for store in stores
        ]
        if aggregate_rate < ALL_KNOWLEDGE_PHYSICAL_REPLICA_MIN_BYTES_PER_SECOND:
            below_rate_cleanup_roots: set[Path] = set()
            for path in reversed(created_paths):
                if path.is_file() and not path.is_symlink():
                    path.unlink()
                    below_rate_cleanup_roots.add(path.parent)
            for root in sorted(below_rate_cleanup_roots, key=str):
                _fsync_directory(root)
            raise RuntimeError(
                "NoNE all-knowledge physical replica rate is below 1 GB/s"
            )
        self._require_local_reconciled_direct_page_map_boundary(page_objects)
        return {
            "schema": ALL_KNOWLEDGE_PHYSICAL_REPLICA_PROOF_SCHEMA,
            "passed": True,
            "pageCount": page_count,
            "pageMax": page_max,
            "pagesAbove101000": pages_above_101000,
            "directRevisions": sorted(
                RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
            ),
            "historicalRevision6Accepted": False,
            "directPageMapSha256": _tensor_digest_hex(
                _page_object_map_digest_t_boundary(page_objects)
            ),
            "sourceStoreRoot": str(source_store.root),
            "sourcePointerlessExternal": source_pointerless_external,
            "sourceReadBytes": total_source_read_bytes,
            "newlyWrittenBytes": total_newly_written_bytes,
            "verifiedDestinationReadbackBytes": (
                total_destination_readback_bytes
            ),
            "elapsedNanoseconds": elapsed_ns,
            "aggregateDestinationBytesPerSecond": aggregate_rate,
            "minimumAggregateBytesPerSecond": (
                ALL_KNOWLEDGE_PHYSICAL_REPLICA_MIN_BYTES_PER_SECOND
            ),
            "ratePassed": True,
            "rateProofMode": (
                "durable_odirect_copy"
                if total_newly_written_bytes > 0
                else "resume_odirect_full_readback"
            ),
            "pageCacheCreditBytes": 0,
            "hardlinkCreditBytes": 0,
            "reflinkCreditBytes": 0,
            "reusedObjectCreditBytes": 0,
            "sourceReadOncePerObject": True,
            "alignedBoundedWaves": True,
            "directIo": True,
            "fileAndDirectoryFsyncMeasured": True,
            "coldPostWriteReadbackVerified": True,
            "devices": per_device_rows,
            "objects": object_records,
        }

    @staticmethod
    def _checkout(
        store: NoNEImmutablePageStore,
        binding: NoNEGenerationBinding,
    ) -> NoNEGenerationBinding:
        return store.checkout_generation_boundary(
            generation_t=binding.generation_t,
            manifest_sha256_t=binding.manifest_sha256_t,
            manifest_payload_sha256_t=(binding.manifest_payload_sha256_t),
        )

    def synchronize_to_primary_boundary(self) -> torch.Tensor:
        """Recover replica pointers to the canonical accepted generation."""

        primary = self.primary_store.current_generation_binding_boundary()
        synchronized: list[torch.Tensor] = [primary.generation_t]
        for store in self.replica_stores:
            current = store.current_generation_binding_boundary()
            if not self._same_binding(current, primary):
                current = self._checkout(store, primary)
            if not self._same_binding(current, primary):
                raise RuntimeError("NoNE replica differs after reconciliation")
            synchronized.append(current.generation_t)
        return torch.stack(synchronized)

    def upgrade_current_graph_authority_boundary(
        self,
        graph_authority: NoNEGraphAuthorityBinding,
    ) -> dict[str, Any]:
        """Attach one verified graph to replicas first and primary last."""

        stores = (self.primary_store, *self.replica_stores)
        if any(store._generation_writer_handle is not None for store in stores):
            raise RuntimeError(
                "NoNE graph authority cannot change during a staged generation"
            )
        lock_order = tuple(sorted(stores, key=lambda store: str(store.root)))
        acquired: list[NoNEImmutablePageStore] = []
        prior_pointers: dict[NoNEImmutablePageStore, dict[str, Any]] = {}
        verified: dict[
            NoNEImmutablePageStore,
            tuple[
                NoNEGenerationBinding,
                dict[str, Any],
                NoNEGraphAuthorityBinding,
            ],
        ] = {}
        moved: list[NoNEImmutablePageStore] = []
        try:
            for store in lock_order:
                store._acquire_generation_writer_boundary()
                acquired.append(store)
            primary_binding = self.primary_store.current_generation_binding_boundary()
            for store in stores:
                binding = store.current_generation_binding_boundary()
                if not self._same_binding(binding, primary_binding):
                    raise RuntimeError(
                        "NoNE graph authority replica generation differs"
                    )
                _session_id_t, session_root = store._require_session()
                prior_pointers[store] = _read_json(session_root / "accepted.json")
                loaded, manifest = store._load_generation_binding_boundary(
                    binding.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        binding.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        binding.manifest_payload_sha256_t
                    ),
                )
                graph = store._load_graph_authority_record_boundary(
                    loaded,
                    manifest,
                    graph_authority.external_record_boundary(),
                )
                current = store._graph_authority
                if current is not None and current.external_record_boundary() != (
                    graph.external_record_boundary()
                ):
                    raise RuntimeError(
                        "NoNE accepted graph authority already differs"
                    )
                verified[store] = (loaded, manifest, graph)
            pointer: dict[str, Any] | None = None
            for store in (*self.replica_stores, self.primary_store):
                loaded, manifest, graph = verified[store]
                pointer = store._write_accepted_pointer_boundary(
                    loaded,
                    manifest,
                    graph,
                )
                moved.append(store)
            if pointer is None:
                raise RuntimeError("NoNE graph authority upgrade moved no pointer")
            return pointer
        except Exception:
            rollback_failed = False
            for store in reversed(moved):
                try:
                    _session_id_t, session_root = store._require_session()
                    _atomic_json(
                        session_root / "accepted.json",
                        prior_pointers[store],
                    )
                    store.discover_accepted_pointer_boundary()
                except Exception:
                    rollback_failed = True
            if rollback_failed:
                raise RuntimeError(
                    "NoNE graph authority upgrade rollback was incomplete"
                )
            raise
        finally:
            for store in reversed(acquired):
                store._release_generation_writer_boundary()

    def discover_current_generation_boundary(
        self,
        *,
        graph_page_ids_t: torch.Tensor,
    ) -> NoNEGenerationBinding:
        """Discover one compatible accepted generation across every replica."""

        primary = self.primary_store.refresh_accepted_pointer_boundary(
            graph_page_ids_t=graph_page_ids_t,
        )
        for store in self.replica_stores:
            current = store.refresh_accepted_pointer_boundary(
                graph_page_ids_t=graph_page_ids_t,
            )
            if not self._same_binding(current, primary):
                raise RuntimeError(
                    "NoNE accepted pointer discovery differs across replicas"
                )
        return primary

    def stage_generation(
        self,
        *,
        updated_pages: NoNEPageBundle,
        components: NoNEGenerationComponentPacket,
    ) -> NoNEGenerationBinding:
        """Stage one identical unused generation on every registered device."""

        self.synchronize_to_primary_boundary()
        stores = (self.primary_store, *self.replica_stores)
        next_generation_t = torch.stack(
            tuple(store.next_generation_t_boundary() for store in stores)
        ).amax()
        staged_bindings: list[NoNEGenerationBinding] = []
        try:
            for store in stores:
                staged_bindings.append(
                    store.stage_generation(
                        updated_pages=updated_pages,
                        components=components,
                        expected_generation_t=next_generation_t,
                    )
                )
        except Exception:
            for store in stores:
                store.discard_staged_generation_boundary()
            raise
        bindings = tuple(staged_bindings)
        primary = bindings[0]
        if not all(
            self._same_binding(primary, binding)
            and torch.equal(
                primary.updated_page_ids_t,
                binding.updated_page_ids_t,
            )
            and torch.equal(
                primary.parent_generation_t,
                binding.parent_generation_t,
            )
            for binding in bindings[1:]
        ):
            for store in stores:
                store.discard_staged_generation_boundary()
            self._staged_bindings = None
            raise RuntimeError("NoNE staged replica generation differs")
        self._staged_bindings = bindings
        return primary

    def stage_imported_trained_layers_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        packets: tuple[NoNELayerPageImportPacket, ...],
        target_page_ids_t: torch.Tensor,
        target_layer_ids_t: torch.Tensor,
        components: NoNEGenerationComponentPacket,
    ) -> NoNEGenerationBinding:
        """Verify, replicate, and stage disjoint trained layer branches.

        Source branches may be older or newer immutable generations in the
        same session lineage.  The primary store first validates their exact
        changed pages and retained training/knowledge proofs.  The ordinary
        replicated-generation transaction then binds those page objects to
        the target model, optimizer, router, Fabric, VGE, corpus, and code
        component digests.  No accepted pointer moves until the caller has
        durably checkpointed and independently validated the merged model.
        """

        self.synchronize_to_primary_boundary()
        imported = self.primary_store.import_trained_layer_page_objects_boundary(
            source_stores=source_stores,
            packets=packets,
            target_page_ids_t=target_page_ids_t,
            target_layer_ids_t=target_layer_ids_t,
        )
        return self.stage_generation_from_page_objects_boundary(
            updated_page_objects=imported.page_objects,
            components=components,
        )

    @staticmethod
    def _validated_all_knowledge_reconciliation_sources_boundary(
        *,
        direct_map_source_store: NoNEImmutablePageStore,
        direct_page_objects: tuple[NoNEPageObjectBinding, ...],
        direct_page_pack_source: (
            NoNEReconciledDirectPagePackSourcePacket | None
        ) = None,
        page_tensor_surgery: NoNEHistoricalPageTensorSurgeryPacket,
        historical_union_plan_path: Path,
        historical_union_plan_sha256_t: torch.Tensor,
        canonical_history_path: Path,
        canonical_history_sha256_t: torch.Tensor,
    ) -> tuple[dict[str, Any], Path, str, Path, str, Path, str]:
        """Validate immutable plan, history, surgery, and final direct objects.

        The CLI owns discovery of the accepted pointers and construction of the
        14-segment tensor plan.  This storage boundary does not rediscover or
        recompose either source.  It reopens their exact immutable bytes,
        validates the plan-derived generation-187 floor, and proves that the
        supplied local direct map contains every surgery result plus any
        authenticated sparse descendants.
        """

        if not isinstance(
            page_tensor_surgery,
            NoNEHistoricalPageTensorSurgeryPacket,
        ):
            raise TypeError("NoNE historical tensor surgery packet is malformed")
        plan_sha256 = _required_sha256_tensor_hex_boundary(
            historical_union_plan_sha256_t,
            label="historical union plan",
        )
        history_sha256 = _required_sha256_tensor_hex_boundary(
            canonical_history_sha256_t,
            label="canonical history",
        )
        surgery_sha256 = _required_sha256_tensor_hex_boundary(
            page_tensor_surgery.surgery_sha256_t,
            label="historical tensor surgery",
        )
        unresolved_plan_path = historical_union_plan_path.expanduser()
        unresolved_history_path = canonical_history_path.expanduser()
        unresolved_ledger_path = Path(
            page_tensor_surgery.ledger_path
        ).expanduser()
        if _unresolved_path_contains_symlink_boundary(unresolved_plan_path):
            raise RuntimeError("NoNE historical union plan path is a symlink")
        if _unresolved_path_contains_symlink_boundary(unresolved_history_path):
            raise RuntimeError("NoNE canonical history path is a symlink")
        if _unresolved_path_contains_symlink_boundary(unresolved_ledger_path):
            raise RuntimeError(
                "NoNE historical tensor surgery ledger path is a symlink"
            )
        plan_path = unresolved_plan_path.resolve()
        history_path = unresolved_history_path.resolve()
        ledger_path = unresolved_ledger_path.resolve()
        if not plan_path.is_file():
            raise RuntimeError("NoNE historical union plan changed")
        if (
            not history_path.is_file()
            or _file_sha256(history_path) != history_sha256
        ):
            raise RuntimeError("NoNE canonical history changed")
        if not ledger_path.is_file():
            raise RuntimeError(
                "NoNE historical tensor surgery ledger changed"
            )

        plan = _read_json(plan_path)
        plan_without_sha256 = dict(plan)
        declared_plan_sha256 = plan_without_sha256.pop("planSha256", None)
        (
            accepted_pointer_count,
            unique_accepted_head_count,
        ) = _validated_all_knowledge_plan_inventory_counts_boundary(plan)
        target = plan.get("target")
        target_binding = (
            target.get("binding") if isinstance(target, dict) else None
        )
        if (
            plan.get("schema")
            != "nnf.resynthesis.historical_page_tensor_union_plan.v2"
            or declared_plan_sha256 != plan_sha256
            or hashlib.sha256(
                _canonical_json_bytes(plan_without_sha256)
            ).hexdigest()
            != plan_sha256
            or plan.get("readOnlyInventoryComplete") is not True
            or plan.get("acceptedHeadCoverageComplete") is not True
            or plan.get("revision6AcceptedInOutput") is not False
            or plan.get("crossStoreOverlayAcceptedInOutput") is not False
            or plan.get(
                "fullPhysicalMapResealRequiredAfterSemanticSurgery"
            )
            is not True
            or plan.get("segmentCount")
            != ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
            or not isinstance(plan.get("segments"), list)
            or len(plan["segments"])
            != ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
            or plan.get("uniqueSemanticPageCount")
            != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
            or plan.get("semanticPageIdsAbove101000")
            != ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000
            or plan.get("outputObjectAuthority")
            != "local_self_contained_direct_safetensors_only"
            or not isinstance(target_binding, dict)
            or target_binding.get("pageCount")
            != ALL_KNOWLEDGE_PHYSICAL_PAGE_COUNT
        ):
            raise RuntimeError(
                "NoNE historical tensor union plan policy differs"
            )

        history = _read_json(history_path)
        history_rows = history.get("versionRows")
        expected_history = {
            "schema": "nnf.resynthesis.page_version_reconciliation.v1",
            "passed": True,
            "readOnly": True,
            "minimumGeneration": 152,
            "terminalGeneration": 187,
            "manifestsVerified": 36,
            "allParentChildDiffsExact": True,
            "changeEventCount": 72,
            "versionEventCount": 72,
            "changedPageCount": 72,
            "uniquePageCount": 72,
            "uniqueObjectCount": 72,
            "pageIdsAbove101000": 72,
            "formatRevisionCounts": {"6": 72},
            "dependencyObjectsMaterialized": 72,
            "allVersionObjectsDirectlyProbed": True,
            "probeFailureCount": 0,
            "semanticKnowledgeClaimed": False,
        }
        if (
            any(
                history.get(field) != expected
                for field, expected in expected_history.items()
            )
            or not isinstance(history_rows, list)
            or len(history_rows) != 72
            or any(
                not isinstance(row, dict)
                or not isinstance(row.get("pageId"), int)
                or isinstance(row.get("pageId"), bool)
                or row["pageId"] <= 101_000
                or not isinstance(row.get("weightProbe"), dict)
                or row["weightProbe"].get("formatRevision") != 6
                for row in history_rows
            )
        ):
            raise RuntimeError(
                "NoNE canonical generation 152-187 history differs"
            )

        evidence_groups: list[object] = []
        if isinstance(target, dict):
            evidence_groups.append(target.get("evidence"))
        evidence_groups.extend(
            segment.get("evidence")
            for segment in plan["segments"]
            if isinstance(segment, dict)
        )
        canonical_evidence = tuple(
            row
            for group in evidence_groups
            if isinstance(group, list)
            for row in group
            if isinstance(row, dict)
            and isinstance(row.get("path"), str)
            and Path(row["path"]).expanduser().resolve() == history_path
        )
        if (
            len(canonical_evidence) != 1
            or canonical_evidence[0].get("sha256") != history_sha256
            or canonical_evidence[0].get("bytes")
            != history_path.stat().st_size
        ):
            raise RuntimeError(
                "NoNE canonical revision-6 history is absent from plan"
            )

        raw_ledger = ledger_path.read_bytes()
        if not raw_ledger or not raw_ledger.endswith(b"\n"):
            raise RuntimeError(
                "NoNE historical tensor surgery ledger is incomplete"
            )
        ledger_records: list[dict[str, Any]] = []
        previous_sha256: str | None = None
        for raw_line in raw_ledger.splitlines():
            loaded = orjson.loads(raw_line)
            if not isinstance(loaded, dict):
                raise RuntimeError(
                    "NoNE historical tensor surgery ledger is malformed"
                )
            record_sha256 = loaded.get("recordSha256")
            unhashed = {
                key: value
                for key, value in loaded.items()
                if key != "recordSha256"
            }
            if (
                loaded.get("schema")
                != HISTORICAL_PAGE_TENSOR_SURGERY_LEDGER_SCHEMA
                or loaded.get("previousRecordSha256")
                != previous_sha256
                or not _valid_sha256_boundary(record_sha256)
                or hashlib.sha256(
                    _canonical_json_bytes(unhashed)
                ).hexdigest()
                != record_sha256
            ):
                raise RuntimeError(
                    "NoNE historical tensor surgery ledger chain differs"
                )
            ledger_records.append(loaded)
            previous_sha256 = cast(str, record_sha256)
        header = ledger_records[0]
        complete = ledger_records[-1]
        page_records = tuple(
            record
            for record in ledger_records[1:-1]
            if record.get("recordKind") == "page"
        )
        semantic_page_ids_t = (
            page_tensor_surgery.semantic_page_ids_t.detach()
            .cpu()
            .long()
            .reshape(-1)
        )
        semantic_objects = page_tensor_surgery.semantic_page_objects
        semantic_object_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in semantic_objects
            )
        )
        semantic_ids_tensor_sha256 = hashlib.sha256(
            _stable_cpu_tensor(semantic_page_ids_t)
            .numpy()
            .tobytes(order="C")
        ).hexdigest()
        semantic_ids_json_sha256 = hashlib.sha256(
            json.dumps(
                semantic_page_ids_t.tolist(),
                separators=(",", ":"),
            ).encode("utf-8")
        ).hexdigest()
        semantic_map_sha256 = _tensor_digest_hex(
            _page_object_map_digest_t_boundary(semantic_objects)
        )
        if (
            header.get("recordKind") != "header"
            or header.get("segmentCount")
            != ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
            or header.get("semanticPageCount")
            != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
            or header.get("semanticPageIdsAbove101000")
            != ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000
            or header.get("semanticPageIdsSha256")
            != semantic_ids_tensor_sha256
            or header.get("surgeryPlanSha256")
            != plan.get("tensorSurgeryPlanSha256")
            or header.get("destinationStoreRoot")
            != str(direct_map_source_store.root)
            or complete.get("recordKind") != "complete"
            or complete.get("recordSha256") != surgery_sha256
            or complete.get("surgeryPlanSha256")
            != header.get("surgeryPlanSha256")
            or complete.get("semanticPageCount")
            != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
            or complete.get("semanticDirectPageMapSha256")
            != semantic_map_sha256
            or complete.get("outputObjectsSelfContainedDirect") is not True
            or complete.get("baseBoundDeltaObjectCount") != 0
            or complete.get("crossStoreOverlayObjectCount") != 0
            or complete.get("acceptedPointerMutated") is not False
            or len(page_records) != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
            or len(semantic_objects) != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
            or not torch.equal(
                semantic_page_ids_t,
                semantic_object_ids_t,
            )
            or not torch.equal(
                semantic_page_ids_t,
                torch.sort(semantic_page_ids_t).values,
            )
            or torch.unique(semantic_page_ids_t).numel()
            != semantic_page_ids_t.numel()
            or [record.get("pageId") for record in page_records]
            != semantic_page_ids_t.tolist()
            or plan.get("semanticPageIdsTensorSha256")
            != semantic_ids_tensor_sha256
            or plan.get("semanticPageIdsSha256")
            != semantic_ids_json_sha256
        ):
            raise RuntimeError(
                "NoNE historical tensor surgery authority differs"
            )

        direct_page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in direct_page_objects
            )
        )
        direct_page_ids_t = (
            _require_exact_generation_187_physical_page_ids_boundary(
                direct_page_ids_t
            )
        )
        direct_page_count = int(direct_page_ids_t.numel())
        direct_page_max = int(direct_page_ids_t[-1])
        direct_pages_above_101000 = int(
            direct_page_ids_t.gt(101_000).sum()
        )
        direct_by_page = {
            int(binding.page_id_t): binding
            for binding in direct_page_objects
        }
        _direct_session_id_t, direct_session_root = (
            direct_map_source_store._require_session()
        )
        direct_accepted_path = direct_session_root / "accepted.json"
        if (
            len(direct_by_page) != len(direct_page_objects)
            or direct_accepted_path.exists()
            or direct_accepted_path.is_symlink()
            or not bool(
                direct_map_source_store.accepted_generation_t()
                .detach()
                .cpu()
                .long()
                .eq(0)
            )
        ):
            raise RuntimeError(
                "NoNE reconciled direct page map identity differs"
            )
        if direct_page_pack_source is None:
            raise RuntimeError(
                "NoNE reconciled direct pack source differs"
            )
        canonical_pack = (
            _validated_reconciled_direct_pack_source_mode_boundary(
                source_packet=direct_page_pack_source,
                page_objects=direct_page_objects,
                source_store=direct_map_source_store,
            )
        )
        if canonical_pack is not None:
            assert (
                direct_page_pack_source.direct_page_map_ledger_path
                is not None
            )
            (
                validated_pack,
                ledger_page_objects,
                validated_direct_ledger_path,
            ) = _reopen_reconciled_direct_page_map_ledger_boundary(
                direct_store=direct_map_source_store,
                target_generation=page_tensor_surgery.target_generation,
                canonical_pack=canonical_pack,
                direct_page_map_ledger_path=Path(
                    direct_page_pack_source.direct_page_map_ledger_path
                ),
            )
            if (
                not _same_direct_page_pack_build_boundary(
                    canonical_pack,
                    validated_pack,
                )
                or str(validated_direct_ledger_path)
                != direct_page_pack_source.direct_page_map_ledger_path
                or len(ledger_page_objects) != len(direct_page_objects)
                or any(
                    not _same_page_object_binding_boundary(left, right)
                    for left, right in zip(
                        ledger_page_objects,
                        direct_page_objects,
                        strict=True,
                    )
                )
            ):
                raise RuntimeError(
                    "NoNE reconciled direct pack resume differs"
                )
        if any(
            int(binding.page_id_t) not in direct_by_page
            or not _same_page_object_binding_boundary(
                binding,
                direct_by_page[int(binding.page_id_t)],
            )
            for binding in semantic_objects
        ):
            raise RuntimeError(
                "NoNE reconciled direct map omits tensor surgery state"
            )
        if (
            target_binding.get("generation")
            != int(page_tensor_surgery.target_generation.generation_t)
            or target_binding.get("manifestSha256")
            != _tensor_digest_hex(
                page_tensor_surgery.target_generation.manifest_sha256_t
            )
            or target_binding.get("manifestPayloadSha256")
            != _tensor_digest_hex(
                page_tensor_surgery.target_generation
                .manifest_payload_sha256_t
            )
        ):
            raise RuntimeError(
                "NoNE reconciled tensor surgery target differs"
            )

        record = {
            "schema": ALL_KNOWLEDGE_RECONCILED_KNOWLEDGE_PROOF_SCHEMA,
            "passed": True,
            "parentGeneration": (
                page_tensor_surgery.target_generation
                .external_record_boundary()
            ),
            "historicalUnionPlan": {
                "path": str(plan_path),
                "sha256": plan_sha256,
                "acceptedPointerCount": accepted_pointer_count,
                "uniqueAcceptedHeadCount": unique_accepted_head_count,
            },
            "canonicalHistory": {
                "path": str(history_path),
                "sha256": history_sha256,
                "minimumGeneration": 152,
                "terminalGeneration": 187,
                "changedObjectVersionCount": 72,
                "historicalRevision": 6,
                "historicalEvidenceOnly": True,
            },
            "pageTensorSurgery": {
                "ledgerPath": str(ledger_path),
                "ledgerSha256": hashlib.sha256(raw_ledger).hexdigest(),
                "surgerySha256": surgery_sha256,
                "segmentCount": ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT,
                "semanticPageCount": ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT,
                "semanticPagesAbove101000": (
                    ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000
                ),
                "semanticDirectPageMapSha256": semantic_map_sha256,
            },
            "directPageCount": direct_page_count,
            "directPageMapSha256": _tensor_digest_hex(
                _page_object_map_digest_t_boundary(direct_page_objects)
            ),
            "maximumPageId": direct_page_max,
            "pagesAbove101000": direct_pages_above_101000,
            "directRevisions": sorted(
                RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS
            ),
            "historicalRevision6Accepted": False,
            "branchResultRecompositionUsed": False,
            "storagePageObjectsSelfContainedDirect": True,
        }
        return (
            record,
            plan_path,
            plan_sha256,
            history_path,
            history_sha256,
            ledger_path,
            hashlib.sha256(raw_ledger).hexdigest(),
        )

    def stage_all_knowledge_reconciled_direct_map_boundary(
        self,
        *,
        historical_training_coverage: NoNEHistoricalTrainingCoveragePacket,
        direct_map_source_store: NoNEImmutablePageStore,
        direct_page_objects: tuple[NoNEPageObjectBinding, ...],
        direct_page_pack_source: (
            NoNEReconciledDirectPagePackSourcePacket | None
        ) = None,
        page_tensor_surgery: NoNEHistoricalPageTensorSurgeryPacket,
        historical_union_plan_path: Path,
        historical_union_plan_sha256_t: torch.Tensor,
        canonical_history_path: Path,
        canonical_history_sha256_t: torch.Tensor,
        physical_replica_proof_path: Path,
        components: NoNEGenerationComponentPacket | None = None,
        minimum_cold_unique_logical_bytes_per_second: int = (
            DIRECT_PAGE_PACK_MIN_BYTES_PER_SECOND
        ),
    ) -> NoNEAllKnowledgeReconciledDirectMapCandidatePacket:
        """Stage a prepared all-current direct map without branch recomposition.

        Historical row evidence is read only from its sealed receipt. The final
        page objects are supplied directly and must contain the independently
        validated historical tensor surgery. This boundary never opens branch
        stores or treats row coverage as per-page training proof.
        """

        self.acquire_generation_writer_leases_boundary()
        source_accepted_path: Path | None = None
        try:
            self.synchronize_to_primary_boundary()
            (
                coverage_artifact_path,
                coverage_artifact_sha256,
            ) = _validated_historical_training_coverage_artifact_boundary(
                historical_training_coverage
            )
            stores = (self.primary_store, *self.replica_stores)
            parent = self.primary_store.current_generation_binding_boundary()
            _parent_session_id_t, parent_session_root = (
                self.primary_store._require_session()
            )
            parent_accepted_path = parent_session_root / "accepted.json"
            if (
                _session_key(parent.session_id_t)
                != _tensor_digest_hex(
                    historical_training_coverage.parent_session_sha256_t
                )
                or int(parent.generation_t)
                != int(historical_training_coverage.parent_generation_t)
                or not torch.equal(
                    parent.manifest_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8),
                    historical_training_coverage.parent_manifest_sha256_t
                    .detach()
                    .cpu(),
                )
                or not torch.equal(
                    parent.manifest_payload_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8),
                    historical_training_coverage
                    .parent_manifest_payload_sha256_t.detach()
                    .cpu(),
                )
                or not _same_generation_binding_boundary(
                    page_tensor_surgery.target_generation,
                    parent,
                )
                or _file_sha256(parent_accepted_path)
                != _tensor_digest_hex(
                    historical_training_coverage.accepted_pointer_sha256_t
                )
            ):
                raise RuntimeError(
                    "NoNE reconciled direct map parent frontier differs"
                )
            source_accepted_path = (
                self._acquire_pointerless_external_direct_map_source_boundary(
                    source_store=direct_map_source_store,
                    expected_session_id_t=parent.session_id_t,
                )
            )
            (
                reconciliation_record,
                resolved_plan_path,
                plan_sha256,
                resolved_history_path,
                history_sha256,
                surgery_ledger_path,
                surgery_ledger_sha256,
            ) = self._validated_all_knowledge_reconciliation_sources_boundary(
                direct_map_source_store=direct_map_source_store,
                direct_page_objects=direct_page_objects,
                direct_page_pack_source=direct_page_pack_source,
                page_tensor_surgery=page_tensor_surgery,
                historical_union_plan_path=historical_union_plan_path,
                historical_union_plan_sha256_t=(
                    historical_union_plan_sha256_t
                ),
                canonical_history_path=canonical_history_path,
                canonical_history_sha256_t=(
                    canonical_history_sha256_t
                ),
            )
            if (
                _file_sha256(resolved_plan_path)
                != _tensor_digest_hex(
                    historical_training_coverage
                    .historical_union_plan_file_sha256_t
                )
                or plan_sha256
                != _tensor_digest_hex(
                    historical_training_coverage
                    .historical_union_plan_sha256_t
                )
                or history_sha256
                != _tensor_digest_hex(
                    historical_training_coverage
                    .canonical_history_sha256_t
                )
            ):
                raise RuntimeError(
                    "NoNE sealed historical coverage reconciliation differs"
                )
            direct_page_ids_t = torch.stack(
                tuple(
                    binding.page_id_t.detach().cpu().long().reshape(())
                    for binding in direct_page_objects
                )
            )
            _require_exact_generation_187_physical_page_ids_boundary(
                direct_page_ids_t
            )
            direct_page_map_sha256_t = (
                _page_object_map_digest_t_boundary(direct_page_objects)
            )
            if direct_page_pack_source is None:
                raise RuntimeError(
                    "NoNE all-knowledge direct pack topology is incomplete"
                )
            (
                direct_page_pack_set_authority,
                direct_page_pack_measurement,
            ) = self._build_and_replicate_all_knowledge_direct_page_pack_boundary(
                source_store=direct_map_source_store,
                page_objects=direct_page_objects,
                source_packet=direct_page_pack_source,
                minimum_cold_unique_logical_bytes_per_second=(
                    minimum_cold_unique_logical_bytes_per_second
                ),
            )
            self._all_knowledge_physical_replica_measurement = {
                **direct_page_pack_measurement,
                "trainingAdmissionEligible": (
                    self.training_admission_eligible
                ),
                "promotionEligible": self.promotion_eligible,
                "durabilityComplete": self.durability_complete,
            }
            next_generation_t = torch.stack(
                tuple(store.next_generation_t_boundary() for store in stores)
            ).amax()
            if int(next_generation_t) != int(parent.generation_t) + 1:
                raise RuntimeError(
                    "NoNE reconciled direct map is not one exact generation hop"
                )

            prior_training_page_ids_t = (
                self.primary_store.current_training_proven_page_ids_t_boundary()
            )
            cumulative_training_page_ids_t = (
                prior_training_page_ids_t.detach().cpu().long().clone()
            )
            canonical_page_training_proof = (
                _canonical_inherited_page_training_proof_record_boundary(
                    parent_generation=parent,
                    training_proven_page_ids_t=(
                        cumulative_training_page_ids_t
                    ),
                )
            )
            canonical_page_training_proof_sha256 = cast(
                str,
                canonical_page_training_proof["proofSha256"],
            )

            reconciliation_record = {
                **reconciliation_record,
                "expectedGeneration": int(next_generation_t),
                "historicalTrainingCoverage": {
                    "path": str(coverage_artifact_path),
                    "sha256": coverage_artifact_sha256,
                    "coverageSha256": _tensor_digest_hex(
                        historical_training_coverage.coverage_sha256_t
                    ),
                },
                "canonicalPageTrainingProof": (
                    canonical_page_training_proof
                ),
                "trainingPageCount": int(
                    cumulative_training_page_ids_t.numel()
                ),
            }
            reconciliation_bytes = (
                json.dumps(
                    reconciliation_record,
                    sort_keys=True,
                    indent=2,
                ).encode("utf-8")
                + b"\n"
            )
            reconciliation_record_sha256 = hashlib.sha256(
                reconciliation_bytes
            ).hexdigest()
            reconciliation_relative_path = str(
                Path("reconciled_knowledge_proofs")
                / (
                    f"generation_{int(next_generation_t):08d}_"
                    f"{reconciliation_record_sha256}.json"
                )
            )

            primary_reconciliation_path: Path | None = None
            for store in stores:
                store_session_id_t, session_root = store._require_session()
                if not torch.equal(
                    store_session_id_t.detach().cpu().long(),
                    parent.session_id_t.detach().cpu().long(),
                ):
                    raise RuntimeError(
                        "NoNE reconciled proof crossed session ownership"
                    )
                reconciliation_path = (
                    session_root / reconciliation_relative_path
                ).resolve()
                if (
                    not reconciliation_path.is_relative_to(
                        session_root.resolve()
                    )
                    or reconciliation_path.is_symlink()
                ):
                    raise RuntimeError(
                        "NoNE reconciled proof escaped its session"
                    )
                _atomic_bytes(reconciliation_path, reconciliation_bytes)
                if (
                    _file_sha256(reconciliation_path)
                    != reconciliation_record_sha256
                ):
                    raise RuntimeError(
                        "NoNE reconciled proof persistence differs"
                    )
                if store is self.primary_store:
                    primary_reconciliation_path = reconciliation_path
            if primary_reconciliation_path is None:
                raise RuntimeError(
                    "NoNE canonical reconciled proof is absent"
                )

            generation_components = (
                self.primary_store.current_generation_components_for_training_proof_boundary(
                    digest_tensor(canonical_page_training_proof_sha256)
                )
                if components is None
                else components
            )
            if (
                generation_components.training_proof_digest_t is None
                or not torch.equal(
                    generation_components.training_proof_digest_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8),
                    digest_tensor(canonical_page_training_proof_sha256),
                )
                or generation_components.training_proof_record_path is not None
                or generation_components.training_proof_record_sha256_t
                is not None
            ):
                raise RuntimeError(
                    "NoNE canonical inherited page-proof component differs"
                )
            generation_components = replace(
                generation_components,
                reconciliation_proof_digest_t=digest_tensor(
                    reconciliation_record_sha256
                ),
                reconciliation_proof_record_path=(
                    reconciliation_relative_path
                ),
                reconciliation_proof_record_sha256_t=digest_tensor(
                    reconciliation_record_sha256
                ),
            )
            _require_all_knowledge_sealed_pointer_inventory_boundary(
                plan_path=resolved_plan_path,
                plan_sha256=plan_sha256,
            )
            staged = self.stage_generation_from_page_objects_boundary(
                updated_page_objects=direct_page_objects,
                components=generation_components,
                training_proven_page_ids_t=(
                    cumulative_training_page_ids_t
                ),
                direct_page_pack_set_authority=(
                    direct_page_pack_set_authority
                ),
            )
            loaded, staged_manifest = (
                self.primary_store._load_generation_binding_boundary(
                    staged.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        staged.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        staged.manifest_payload_sha256_t
                    ),
                )
            )
            components_record = staged_manifest.get("components")
            training_component = (
                components_record.get("trainingProof")
                if isinstance(components_record, dict)
                else None
            )
            reconciliation_component = (
                components_record.get("reconciliationProof")
                if isinstance(components_record, dict)
                else None
            )
            if (
                not _same_generation_binding_boundary(loaded, staged)
                or int(staged.generation_t) != int(parent.generation_t) + 1
                or not torch.equal(
                    staged.parent_generation_t,
                    parent.generation_t,
                )
                or not torch.equal(
                    staged.updated_page_ids_t,
                    direct_page_ids_t,
                )
                or staged_manifest.get("parentManifestPayloadSha256")
                != _tensor_digest_hex(
                    parent.manifest_payload_sha256_t
                )
                or staged_manifest.get("directPageMapAuthority") is None
                or staged_manifest.get("directPagePackSetAuthority")
                != direct_page_pack_set_authority
                or not isinstance(training_component, dict)
                or training_component.get("sha256")
                != canonical_page_training_proof_sha256
                or "record" in training_component
                or staged_manifest.get("trainingProvenPageIds", [])
                != cumulative_training_page_ids_t.tolist()
                or reconciliation_component
                != {
                    "sha256": reconciliation_record_sha256,
                    "record": {
                        "path": reconciliation_relative_path,
                        "sha256": reconciliation_record_sha256,
                    },
                }
            ):
                raise RuntimeError(
                    "NoNE reconciled staged generation authority differs"
                )

            measurement = self._all_knowledge_physical_replica_measurement
            if measurement is None:
                raise RuntimeError(
                    "NoNE all-knowledge physical measurement is absent"
                )
            _session_id_t, primary_session_root = (
                self.primary_store._require_session()
            )
            resolved_physical_proof_path = (
                physical_replica_proof_path.expanduser().resolve()
            )
            if (
                not resolved_physical_proof_path.is_relative_to(
                    primary_session_root.resolve()
                )
                or resolved_physical_proof_path.is_symlink()
            ):
                raise RuntimeError(
                    "NoNE all-knowledge physical proof escaped its session"
                )
            assert isinstance(components_record, dict)
            physical_record = {
                **measurement,
                "stagedGeneration": staged.external_record_boundary(),
                "graphAuthorityPending": True,
                "componentArtifacts": components_record,
                "componentArtifactsSha256": hashlib.sha256(
                    _canonical_json_bytes(components_record)
                ).hexdigest(),
                "historicalTrainingCoverage": {
                    "path": str(coverage_artifact_path),
                    "sha256": coverage_artifact_sha256,
                    "coverageSha256": _tensor_digest_hex(
                        historical_training_coverage.coverage_sha256_t
                    ),
                },
                "canonicalPageTrainingProof": (
                    canonical_page_training_proof
                ),
                "reconciledKnowledgeProof": {
                    "path": str(primary_reconciliation_path),
                    "sha256": reconciliation_record_sha256,
                    "historicalUnionPlanSha256": plan_sha256,
                    "canonicalHistorySha256": history_sha256,
                    "surgerySha256": _tensor_digest_hex(
                        page_tensor_surgery.surgery_sha256_t
                    ),
                },
                "sourceArtifacts": {
                    "historicalUnionPlan": {
                        "path": str(resolved_plan_path),
                        "sha256": plan_sha256,
                    },
                    "canonicalHistory": {
                        "path": str(resolved_history_path),
                        "sha256": history_sha256,
                    },
                    "pageTensorSurgeryLedger": {
                        "path": str(surgery_ledger_path),
                        "sha256": surgery_ledger_sha256,
                    },
                },
                "replicaReceiptPath": str(self.receipt_path),
                "replicaReceiptSha256": self.receipt_sha256,
                "durabilityComplete": self.durability_complete,
                "canonicalPointerMoved": False,
                "branchResultRecompositionUsed": False,
            }
            physical_bytes = (
                json.dumps(
                    physical_record,
                    sort_keys=True,
                    indent=2,
                ).encode("utf-8")
                + b"\n"
            )
            _atomic_bytes(
                resolved_physical_proof_path,
                physical_bytes,
            )
            physical_sha256 = hashlib.sha256(
                physical_bytes
            ).hexdigest()
            if (
                _file_sha256(resolved_physical_proof_path)
                != physical_sha256
            ):
                raise RuntimeError(
                    "NoNE all-knowledge physical proof persistence differs"
                )
            self._all_knowledge_physical_replica_measurement = {
                "record": physical_record,
                "path": str(resolved_physical_proof_path),
                "sha256": physical_sha256,
            }
            candidate = (
                NoNEAllKnowledgeReconciledDirectMapCandidatePacket(
                    staged_generation=staged,
                    historical_training_coverage=(
                        historical_training_coverage
                    ),
                    canonical_training_proven_page_ids_t=(
                        cumulative_training_page_ids_t
                    ),
                    canonical_page_training_proof_sha256_t=digest_tensor(
                        canonical_page_training_proof_sha256
                    ),
                    physical_replica_proof_path=str(
                        resolved_physical_proof_path
                    ),
                    physical_replica_proof_sha256_t=digest_tensor(
                        physical_sha256
                    ),
                    direct_page_map_sha256_t=(
                        direct_page_map_sha256_t
                    ),
                    historical_union_plan_path=str(resolved_plan_path),
                    historical_union_plan_sha256_t=digest_tensor(
                        plan_sha256
                    ),
                    canonical_history_path=str(resolved_history_path),
                    canonical_history_sha256_t=digest_tensor(
                        history_sha256
                    ),
                    surgery_sha256_t=(
                        page_tensor_surgery.surgery_sha256_t.detach()
                        .cpu()
                        .to(dtype=torch.uint8)
                        .clone()
                    ),
                    reconciliation_proof_path=str(
                        primary_reconciliation_path
                    ),
                    reconciliation_proof_sha256_t=digest_tensor(
                        reconciliation_record_sha256
                    ),
                )
            )
            self._all_knowledge_replica_candidate = candidate
            return candidate
        except Exception:
            self.discard_staged_generation_boundary()
            raise
        finally:
            if source_accepted_path is not None:
                self._release_pointerless_external_direct_map_source_boundary(
                    source_store=direct_map_source_store,
                    accepted_path=source_accepted_path,
                )

    def stage_training_branch_result_union_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        results: tuple[NoNETrainingBranchResultPacket, ...],
        training_data_union_json_t: torch.Tensor,
        components: NoNEGenerationComponentPacket | None = None,
    ) -> NoNETrainingBranchMergePacket:
        """Fence the live parent before composing and staging one union."""

        self.acquire_generation_writer_leases_boundary()
        try:
            return (
                self._stage_training_branch_result_union_under_lease_boundary(
                    source_stores=source_stores,
                    results=results,
                    training_data_union_json_t=training_data_union_json_t,
                    components=components,
                )
            )
        except Exception:
            self.discard_staged_generation_boundary()
            raise

    def _stage_training_branch_result_union_under_lease_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        results: tuple[NoNETrainingBranchResultPacket, ...],
        training_data_union_json_t: torch.Tensor,
        components: NoNEGenerationComponentPacket | None = None,
    ) -> NoNETrainingBranchMergePacket:
        """Stage one branch union while every accepted pointer is fenced."""

        self.synchronize_to_primary_boundary()
        union = self.primary_store.compose_training_branch_result_union_boundary(
            source_stores=source_stores,
            results=results,
            training_data_union_json_t=training_data_union_json_t,
        )
        expected_proof_sha256_t = (
            _validate_training_branch_union_packet_boundary(union)
        )
        applied_page_ids_t = (
            _training_branch_rebase_applied_page_ids_t_boundary(union)
        )
        applied_page_objects = (
            _training_branch_rebase_applied_page_objects_boundary(union)
        )
        for page_object in applied_page_objects:
            self.primary_store.require_self_contained_direct_page_object_boundary(
                page_object
            )
        if (
            applied_page_ids_t.numel() < 1
            or len(applied_page_objects) != int(applied_page_ids_t.numel())
        ):
            raise RuntimeError(
                "NoNE branch union has no unapplied page state"
            )
        stores = (self.primary_store, *self.replica_stores)
        # Select the registered store with the most live capacity as the
        # materialization source, then physically publish the complete direct
        # page map beneath every accepting store. The final authority may not
        # resolve through a peer overlay, a compact child, or a base-bound
        # revision-6 dependency.
        direct_map_store = max(
            stores,
            key=lambda store: shutil.disk_usage(
                store._validated_page_object_write_roots_boundary()[0]
            ).free,
        )
        storage_normalized_page_objects = (
            direct_map_store.materialize_reconciled_direct_page_map_boundary(
                semantic_page_objects=applied_page_objects,
                source_store=self.primary_store,
            )
        )
        self._replicate_reconciled_direct_page_map_local_boundary(
            source_store=direct_map_store,
            page_objects=storage_normalized_page_objects,
        )
        self._all_knowledge_physical_replica_measurement = None
        storage_normalized_page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in storage_normalized_page_objects
            )
        )
        next_generation_t = torch.stack(
            tuple(store.next_generation_t_boundary() for store in stores)
        ).amax()
        if int(next_generation_t) != int(union.parent_generation_t) + 1:
            raise RuntimeError(
                "NoNE branch union is not one exact generation hop"
            )
        generation_components = (
            self.primary_store.current_generation_components_for_training_proof_boundary(
                expected_proof_sha256_t
            )
            if components is None
            else components
        )
        if (
            generation_components.training_proof_digest_t is None
            or not torch.equal(
                generation_components.training_proof_digest_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
                expected_proof_sha256_t,
            )
        ):
            raise RuntimeError("NoNE branch union component proof differs")
        prior_training_page_ids_t = (
            self.primary_store.current_training_proven_page_ids_t_boundary()
        )
        cumulative_training_page_ids_t = torch.sort(
            torch.unique(
                torch.cat((prior_training_page_ids_t, union.union_page_ids_t))
            )
        ).values
        physical_page_ids_t = (
            self.primary_store.accepted_page_ids_t_boundary()
        )
        proof_binding = NoNEGenerationBinding(
            session_id_t=union.parent_session_id_t.detach().cpu().long().clone(),
            generation_t=next_generation_t.detach().cpu().long().reshape(()),
            parent_generation_t=(
                union.parent_generation_t.detach().cpu().long().reshape(())
            ),
            manifest_sha256_t=torch.zeros(32, dtype=torch.uint8),
            manifest_payload_sha256_t=torch.zeros(32, dtype=torch.uint8),
            updated_page_ids_t=storage_normalized_page_ids_t.clone(),
            manifest_relative_path="",
        )
        proof_record = training_branch_union_proof_record_boundary(
            union,
            generation_binding=proof_binding,
            cumulative_training_page_ids_t=cumulative_training_page_ids_t,
            physical_page_ids_t=physical_page_ids_t,
            storage_normalized_page_objects=(
                storage_normalized_page_objects
            ),
        )
        proof_relative_path = str(
            Path("training_branch_union_proofs")
            / (
                f"generation_{int(next_generation_t):08d}_"
                f"{_tensor_digest_hex(union.union_sha256_t)}.json"
            )
        )
        proof_bytes = (
            json.dumps(proof_record, sort_keys=True, indent=2).encode("utf-8")
            + b"\n"
        )
        proof_record_sha256 = hashlib.sha256(proof_bytes).hexdigest()
        for store in stores:
            store_session_id_t, session_root = store._require_session()
            if not torch.equal(
                store_session_id_t.detach().cpu().long(),
                union.parent_session_id_t.detach().cpu().long(),
            ):
                raise RuntimeError(
                    "NoNE branch union proof crossed session ownership"
                )
            proof_path = (session_root / proof_relative_path).resolve()
            if not proof_path.is_relative_to(session_root.resolve()):
                raise RuntimeError(
                    "NoNE branch union proof escaped its session"
                )
            _atomic_bytes(proof_path, proof_bytes)
            if _file_sha256(proof_path) != proof_record_sha256:
                raise RuntimeError(
                    "NoNE branch union proof persistence differs"
                )
        generation_components = replace(
            generation_components,
            training_proof_record_path=proof_relative_path,
            training_proof_record_sha256_t=digest_tensor(
                proof_record_sha256
            ),
        )
        staged = self.stage_generation_from_page_objects_boundary(
            updated_page_objects=storage_normalized_page_objects,
            components=generation_components,
            training_proven_page_ids_t=cumulative_training_page_ids_t,
        )
        try:
            _loaded, staged_manifest = (
                self.primary_store._load_generation_binding_boundary(
                    staged.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        staged.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        staged.manifest_payload_sha256_t
                    ),
                )
            )
            if (
                not torch.equal(
                    staged.session_id_t,
                    union.parent_session_id_t,
                )
                or not torch.equal(
                    staged.parent_generation_t,
                    union.parent_generation_t,
                )
                or not torch.equal(
                    staged.updated_page_ids_t,
                    storage_normalized_page_ids_t,
                )
                or staged_manifest.get("parentManifestPayloadSha256")
                != _tensor_digest_hex(
                    union.parent_manifest_payload_sha256_t
                )
            ):
                raise RuntimeError("NoNE branch union staged against parent drift")
            validated_proof, _proof_path, validated_proof_sha256 = (
                _validated_training_branch_union_proof_artifact_boundary(
                    store=self.primary_store,
                    generation_binding=staged,
                    generation_manifest=staged_manifest,
                )
            )
            if (
                validated_proof != proof_record
                or validated_proof_sha256 != proof_record_sha256
            ):
                raise RuntimeError(
                    "NoNE branch union staged proof authority differs"
                )
        except Exception:
            self.discard_staged_generation_boundary()
            raise
        return NoNETrainingBranchMergePacket(
            union=union,
            staged_generation=staged,
        )

    def resume_staged_training_branch_result_union_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        results: tuple[NoNETrainingBranchResultPacket, ...],
        training_data_union_json_t: torch.Tensor,
        staged_generation: NoNEGenerationBinding,
    ) -> NoNETrainingBranchMergePacket:
        """Fence the live parent before reopening a staged union."""

        self.synchronize_to_primary_boundary()
        self.acquire_generation_writer_leases_boundary()
        try:
            return (
                self._resume_staged_training_branch_result_union_under_lease_boundary(
                    source_stores=source_stores,
                    results=results,
                    training_data_union_json_t=training_data_union_json_t,
                    staged_generation=staged_generation,
                )
            )
        except Exception:
            self.discard_staged_generation_boundary()
            raise

    def _resume_staged_training_branch_result_union_under_lease_boundary(
        self,
        *,
        source_stores: tuple[NoNEImmutablePageStore, ...],
        results: tuple[NoNETrainingBranchResultPacket, ...],
        training_data_union_json_t: torch.Tensor,
        staged_generation: NoNEGenerationBinding,
    ) -> NoNETrainingBranchMergePacket:
        """Reopen one exact staged union while every pointer is fenced."""

        self.synchronize_to_primary_boundary()
        union = self.primary_store.compose_training_branch_result_union_boundary(
            source_stores=source_stores,
            results=results,
            training_data_union_json_t=training_data_union_json_t,
        )
        _validate_training_branch_union_packet_boundary(union)
        if (
            not torch.equal(
                staged_generation.session_id_t,
                union.parent_session_id_t,
            )
            or not torch.equal(
                staged_generation.parent_generation_t,
                union.parent_generation_t,
            )
        ):
            raise RuntimeError("NoNE staged branch union binding differs")
        stores = (self.primary_store, *self.replica_stores)
        _primary_loaded, primary_manifest = (
            self.primary_store._load_generation_binding_boundary(
                staged_generation.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    staged_generation.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    staged_generation.manifest_payload_sha256_t
                ),
            )
        )
        cumulative_value = primary_manifest.get("trainingProvenPageIds")
        physical_value = primary_manifest.get("pageObjects")
        if not isinstance(cumulative_value, list) or not isinstance(
            physical_value,
            list,
        ):
            raise RuntimeError(
                "NoNE staged branch union proof coverage is absent"
            )
        cumulative_training_page_ids_t = torch.tensor(
            cumulative_value,
            dtype=torch.long,
        )
        physical_page_ids_t = torch.tensor(
            [
                int(row["pageId"])
                for row in physical_value
                if isinstance(row, dict)
                and isinstance(row.get("pageId"), int)
                and not isinstance(row.get("pageId"), bool)
            ],
            dtype=torch.long,
        )
        storage_normalized_page_objects = tuple(
            self.primary_store._page_object_binding_from_row_boundary(row)
            for row in sorted(
                physical_value,
                key=lambda value: int(value["pageId"]),
            )
            if isinstance(row, dict)
        )
        storage_normalized_page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in storage_normalized_page_objects
            )
        )
        if (
            not torch.equal(
                staged_generation.updated_page_ids_t.detach().cpu().long(),
                storage_normalized_page_ids_t,
            )
            or not torch.equal(
                physical_page_ids_t,
                storage_normalized_page_ids_t,
            )
        ):
            raise RuntimeError("NoNE staged direct page map differs")
        self._require_local_reconciled_direct_page_map_boundary(
            storage_normalized_page_objects
        )
        expected_proof_record = training_branch_union_proof_record_boundary(
            union,
            generation_binding=staged_generation,
            cumulative_training_page_ids_t=cumulative_training_page_ids_t,
            physical_page_ids_t=physical_page_ids_t,
            storage_normalized_page_objects=(
                storage_normalized_page_objects
            ),
        )
        for store in stores:
            loaded, staged_manifest = store._load_generation_binding_boundary(
                staged_generation.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    staged_generation.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    staged_generation.manifest_payload_sha256_t
                ),
            )
            proof_record, _proof_path, _proof_sha256 = (
                _validated_training_branch_union_proof_artifact_boundary(
                    store=store,
                    generation_binding=loaded,
                    generation_manifest=staged_manifest,
                )
            )
            if (
                not _same_generation_binding_boundary(
                    loaded,
                    staged_generation,
                )
                or proof_record != expected_proof_record
            ):
                raise RuntimeError(
                    "NoNE resumed branch union proof authority differs"
                )
        resumed: list[NoNEGenerationBinding] = []
        try:
            for store in stores:
                resumed.append(
                    store.resume_staged_generation_boundary(
                        binding=staged_generation,
                        updated_page_objects=(
                            storage_normalized_page_objects
                        ),
                    )
                )
        except Exception:
            for store in stores:
                store.discard_staged_generation_boundary()
            self._staged_bindings = None
            raise
        bindings = tuple(resumed)
        primary = bindings[0]
        if not all(
            self._same_binding(primary, binding)
            and torch.equal(
                primary.parent_generation_t,
                binding.parent_generation_t,
            )
            and torch.equal(
                primary.updated_page_ids_t,
                binding.updated_page_ids_t,
            )
            for binding in bindings[1:]
        ):
            for store in stores:
                store.discard_staged_generation_boundary()
            self._staged_bindings = None
            raise RuntimeError("NoNE resumed branch union replicas differ")
        self._staged_bindings = bindings
        return NoNETrainingBranchMergePacket(
            union=union,
            staged_generation=primary,
        )

    def accept_staged_training_branch_result_union_boundary(
        self,
        merge: NoNETrainingBranchMergePacket,
        *,
        graph_authority: NoNEGraphAuthorityBinding | None = None,
        resident_page_ids_t: torch.Tensor | None = None,
        retained_checkpoint_sha256_t: torch.Tensor | None = None,
    ) -> dict[str, Any]:
        """Advance replica pointers first and canonical authority last."""

        if not isinstance(merge, NoNETrainingBranchMergePacket):
            raise TypeError("NoNE training branch merge packet is malformed")
        current = self.primary_store.current_generation_binding_boundary()
        union = merge.union
        proof_sha256_t = _validate_training_branch_union_packet_boundary(
            union
        )
        if self.primary_store._manifest is None:
            raise RuntimeError("NoNE training branch merge parent is absent")
        accepted_page_ids_t = torch.sort(
            self.primary_store._manifest_page_ids_t_boundary(
                self.primary_store._manifest
            )
        ).values
        parent_training_page_ids_t = (
            self.primary_store.current_training_proven_page_ids_t_boundary()
        )
        cumulative_training_page_ids_t = torch.sort(
            torch.unique(
                torch.cat(
                    (parent_training_page_ids_t, union.union_page_ids_t)
                )
            )
        ).values
        expected_physical_claim = bool(
            cumulative_training_page_ids_t.shape == accepted_page_ids_t.shape
            and torch.equal(
                cumulative_training_page_ids_t,
                accepted_page_ids_t,
            )
        )
        expected_dataset_claim = bool(
            union.global_dataset_training_claimed_t.detach().cpu().bool()
        )
        expected_global_claim = bool(
            expected_physical_claim and expected_dataset_claim
        )
        _loaded, staged_manifest = (
            self.primary_store._load_generation_binding_boundary(
                merge.staged_generation.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    merge.staged_generation.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    merge.staged_generation.manifest_payload_sha256_t
                ),
            )
        )
        staged_components = staged_manifest.get("components")
        staged_training_proof = (
            staged_components.get("trainingProof")
            if isinstance(staged_components, dict)
            else None
        )
        staged_page_rows_value = staged_manifest.get("pageObjects")
        if not isinstance(staged_page_rows_value, list):
            raise RuntimeError("NoNE training branch staged objects are malformed")
        staged_page_rows = {
            int(row["pageId"]): row
            for row in staged_page_rows_value
            if isinstance(row, dict) and isinstance(row.get("pageId"), int)
        }
        storage_normalized_page_objects = tuple(
            self.primary_store._page_object_binding_from_row_boundary(row)
            for row in sorted(
                staged_page_rows_value,
                key=lambda value: int(value["pageId"]),
            )
            if isinstance(row, dict)
        )
        storage_normalized_page_ids_t = torch.stack(
            tuple(
                binding.page_id_t.detach().cpu().long().reshape(())
                for binding in storage_normalized_page_objects
            )
        )
        expected_training_page_ids = cumulative_training_page_ids_t.tolist()
        expected_proof_record = training_branch_union_proof_record_boundary(
            union,
            generation_binding=merge.staged_generation,
            cumulative_training_page_ids_t=cumulative_training_page_ids_t,
            physical_page_ids_t=accepted_page_ids_t,
            storage_normalized_page_objects=(
                storage_normalized_page_objects
            ),
        )
        accepted_proof_record, _proof_path, _proof_sha256 = (
            _validated_training_branch_union_proof_artifact_boundary(
                store=self.primary_store,
                generation_binding=merge.staged_generation,
                generation_manifest=staged_manifest,
            )
        )
        def union_object_state_matches(
            binding: NoNEPageObjectBinding,
        ) -> bool:
            row = staged_page_rows.get(int(binding.page_id_t))
            if not isinstance(row, dict):
                return False
            staged_binding = (
                self.primary_store._page_object_binding_from_row_boundary(row)
            )
            if _same_page_object_binding_boundary(binding, staged_binding):
                return True
            return _same_page_bundle_boundary(
                self.primary_store._materialize_page_binding_boundary(
                    self.primary_store,
                    binding,
                ),
                self.primary_store._materialize_page_binding_boundary(
                    self.primary_store,
                    staged_binding,
                ),
            )

        union_objects_match = all(
            union_object_state_matches(binding)
            for binding in union.page_objects
        )
        union_objects_direct = all(
            self.primary_store.require_self_contained_direct_page_object_boundary(
                binding
            )
            in ACCEPTED_EXACT_DIRECT_KNOWLEDGE_PAGE_FORMAT_REVISIONS
            for binding in union.page_objects
        )
        try:
            self._require_local_reconciled_direct_page_map_boundary(
                storage_normalized_page_objects
            )
            storage_objects_direct = True
        except RuntimeError:
            storage_objects_direct = False
        if (
            not torch.equal(current.session_id_t, union.parent_session_id_t)
            or not torch.equal(current.generation_t, union.parent_generation_t)
            or not torch.equal(
                current.manifest_payload_sha256_t,
                union.parent_manifest_payload_sha256_t,
            )
            or not torch.equal(
                merge.staged_generation.updated_page_ids_t,
                storage_normalized_page_ids_t,
            )
            or bool(union.global_training_claimed_t.detach().cpu().bool())
            != expected_global_claim
            or bool(
                union.global_physical_page_training_claimed_t.detach()
                .cpu()
                .bool()
            )
            != expected_physical_claim
            or bool(
                union.global_dataset_training_claimed_t.detach()
                .cpu()
                .bool()
            )
            != expected_dataset_claim
            or bool(
                union.global_full_physical_page_bank_traversal_claimed_t
                .detach()
                .cpu()
                .bool()
            )
            != expected_physical_claim
            or staged_manifest.get("parentGeneration")
            != int(union.parent_generation_t)
            or staged_manifest.get("parentManifestPayloadSha256")
            != _tensor_digest_hex(union.parent_manifest_payload_sha256_t)
            or staged_manifest.get("updatedPageIds")
            != storage_normalized_page_ids_t.tolist()
            or staged_manifest.get("trainingProvenPageIds")
            != expected_training_page_ids
            or accepted_proof_record != expected_proof_record
            or not isinstance(staged_training_proof, dict)
            or staged_training_proof.get("sha256")
            != _tensor_digest_hex(proof_sha256_t)
            or not union_objects_match
            or not union_objects_direct
            or not storage_objects_direct
            or not torch.equal(
                storage_normalized_page_ids_t,
                accepted_page_ids_t,
            )
        ):
            raise RuntimeError("NoNE training branch merge authority changed")
        return self.accept_staged_generation(
            merge.staged_generation,
            graph_authority=graph_authority,
            resident_page_ids_t=resident_page_ids_t,
            retained_checkpoint_sha256_t=retained_checkpoint_sha256_t,
        )

    @staticmethod
    def _all_knowledge_artifact_record_boundary(
        value: object,
        *,
        label: str,
    ) -> tuple[Path, str]:
        """Require one exact regular, non-symlink path+SHA record."""

        if not isinstance(value, dict) or set(value) != {"path", "sha256"}:
            raise RuntimeError(f"NoNE all-knowledge {label} record differs")
        path_value = value.get("path")
        sha256 = value.get("sha256")
        if (
            not isinstance(path_value, str)
            or not path_value
            or not _valid_sha256_boundary(sha256)
        ):
            raise RuntimeError(f"NoNE all-knowledge {label} record differs")
        unresolved_path = Path(path_value).expanduser()
        if _unresolved_path_contains_symlink_boundary(unresolved_path):
            raise RuntimeError(f"NoNE all-knowledge {label} is a symlink")
        path = unresolved_path.resolve()
        if (
            not path.is_file()
            or _file_sha256(path) != sha256
        ):
            raise RuntimeError(f"NoNE all-knowledge {label} changed")
        return path, cast(str, sha256)

    def _validated_reconciled_knowledge_proof_artifact_boundary(
        self,
        *,
        candidate: NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        store: NoNEImmutablePageStore,
        generation_binding: NoNEGenerationBinding,
        generation_manifest: Mapping[str, Any],
    ) -> tuple[dict[str, Any], Path, str]:
        """Validate one store-local copy of the full reconciliation proof."""

        plan_sha256 = _required_sha256_tensor_hex_boundary(
            candidate.historical_union_plan_sha256_t,
            label="historical union plan",
        )
        history_sha256 = _required_sha256_tensor_hex_boundary(
            candidate.canonical_history_sha256_t,
            label="canonical history",
        )
        surgery_sha256 = _required_sha256_tensor_hex_boundary(
            candidate.surgery_sha256_t,
            label="historical tensor surgery",
        )
        proof_sha256 = _required_sha256_tensor_hex_boundary(
            candidate.reconciliation_proof_sha256_t,
            label="reconciled knowledge proof",
        )
        components = generation_manifest.get("components")
        reconciliation_component = (
            components.get("reconciliationProof")
            if isinstance(components, dict)
            else None
        )
        reconciliation_record = (
            reconciliation_component.get("record")
            if isinstance(reconciliation_component, dict)
            else None
        )
        if (
            not isinstance(reconciliation_component, dict)
            or reconciliation_component.get("sha256") != proof_sha256
            or not isinstance(reconciliation_record, dict)
            or set(reconciliation_record) != {"path", "sha256"}
            or reconciliation_record.get("sha256") != proof_sha256
            or not isinstance(reconciliation_record.get("path"), str)
        ):
            raise RuntimeError(
                "NoNE reconciled knowledge component authority differs"
            )
        _session_id_t, session_root = store._require_session()
        unresolved_proof_path = (
            session_root / cast(str, reconciliation_record["path"])
        )
        if _unresolved_path_contains_symlink_boundary(
            unresolved_proof_path
        ):
            raise RuntimeError(
                "NoNE reconciled knowledge proof is a symlink"
            )
        proof_path = unresolved_proof_path.resolve()
        if (
            not proof_path.is_relative_to(session_root.resolve())
            or not proof_path.is_file()
            or _file_sha256(proof_path) != proof_sha256
        ):
            raise RuntimeError(
                "NoNE reconciled knowledge proof changed"
            )
        if (
            store is self.primary_store
            and proof_path
            != Path(
                candidate.reconciliation_proof_path
            ).expanduser().resolve()
        ):
            raise RuntimeError(
                "NoNE canonical reconciled knowledge proof path differs"
            )
        proof = _read_json(proof_path)
        plan_record = proof.get("historicalUnionPlan")
        history_record = proof.get("canonicalHistory")
        surgery_record = proof.get("pageTensorSurgery")
        coverage_record = proof.get("historicalTrainingCoverage")
        canonical_page_training_proof = proof.get(
            "canonicalPageTrainingProof"
        )
        coverage_path, coverage_file_sha256 = (
            _validated_historical_training_coverage_artifact_boundary(
                candidate.historical_training_coverage
            )
        )
        expected_canonical_page_training_proof = (
            _canonical_inherited_page_training_proof_record_boundary(
                parent_generation=(
                    store.current_generation_binding_boundary()
                ),
                training_proven_page_ids_t=(
                    candidate.canonical_training_proven_page_ids_t
                ),
            )
        )
        if (
            not isinstance(plan_record, dict)
            or plan_record.get("path")
            != candidate.historical_union_plan_path
            or plan_record.get("sha256") != plan_sha256
        ):
            raise RuntimeError(
                "NoNE reconciled knowledge plan authority differs"
            )
        unresolved_plan_path = Path(
            cast(str, plan_record["path"])
        ).expanduser()
        if _unresolved_path_contains_symlink_boundary(
            unresolved_plan_path
        ):
            raise RuntimeError("NoNE historical union plan is a symlink")
        plan_path = unresolved_plan_path.resolve()
        if not plan_path.is_file():
            raise RuntimeError("NoNE historical union plan changed")
        plan_payload = _read_json(plan_path)
        plan_without_sha256 = dict(plan_payload)
        if (
            plan_without_sha256.pop("planSha256", None) != plan_sha256
            or hashlib.sha256(
                _canonical_json_bytes(plan_without_sha256)
            ).hexdigest()
            != plan_sha256
        ):
            raise RuntimeError("NoNE historical union plan changed")
        (
            accepted_pointer_count,
            unique_accepted_head_count,
        ) = _validated_all_knowledge_plan_inventory_counts_boundary(
            plan_payload
        )
        page_object_rows = generation_manifest.get("pageObjects")
        if (
            not isinstance(page_object_rows, list)
            or not page_object_rows
            or any(
                not isinstance(row, dict)
                or not isinstance(row.get("pageId"), int)
                or isinstance(row.get("pageId"), bool)
                for row in page_object_rows
            )
        ):
            raise RuntimeError(
                "NoNE reconciled generation direct page map differs"
            )
        reconciled_page_ids_t = (
            _require_exact_generation_187_physical_page_ids_boundary(
                torch.tensor(
                    [row["pageId"] for row in page_object_rows],
                    dtype=torch.long,
                )
            )
        )
        reconciled_page_count = int(reconciled_page_ids_t.numel())
        reconciled_page_max = int(reconciled_page_ids_t[-1])
        reconciled_pages_above_101000 = int(
            reconciled_page_ids_t.gt(101_000).sum()
        )
        if (
            proof.get("schema")
            != ALL_KNOWLEDGE_RECONCILED_KNOWLEDGE_PROOF_SCHEMA
            or proof.get("passed") is not True
            or proof.get("expectedGeneration")
            != int(generation_binding.generation_t)
            or proof.get("parentGeneration")
            != store.current_generation_binding_boundary().external_record_boundary()
            or plan_record.get("acceptedPointerCount")
            != accepted_pointer_count
            or plan_record.get("uniqueAcceptedHeadCount")
            != unique_accepted_head_count
            or not isinstance(history_record, dict)
            or history_record.get("path")
            != candidate.canonical_history_path
            or history_record.get("sha256") != history_sha256
            or history_record.get("minimumGeneration") != 152
            or history_record.get("terminalGeneration") != 187
            or history_record.get("changedObjectVersionCount") != 72
            or history_record.get("historicalRevision") != 6
            or history_record.get("historicalEvidenceOnly") is not True
            or not isinstance(surgery_record, dict)
            or surgery_record.get("surgerySha256") != surgery_sha256
            or surgery_record.get("segmentCount")
            != ALL_KNOWLEDGE_HISTORICAL_SEGMENT_COUNT
            or surgery_record.get("semanticPageCount")
            != ALL_KNOWLEDGE_SEMANTIC_PAGE_COUNT
            or surgery_record.get("semanticPagesAbove101000")
            != ALL_KNOWLEDGE_SEMANTIC_PAGES_ABOVE_101000
            or proof.get("directPageCount")
            != reconciled_page_count
            or proof.get("maximumPageId")
            != reconciled_page_max
            or proof.get("pagesAbove101000")
            != reconciled_pages_above_101000
            or proof.get("directRevisions")
            != sorted(RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS)
            or proof.get("historicalRevision6Accepted") is not False
            or proof.get("branchResultRecompositionUsed") is not False
            or proof.get("storagePageObjectsSelfContainedDirect") is not True
            or coverage_record
            != {
                "path": str(coverage_path),
                "sha256": coverage_file_sha256,
                "coverageSha256": _tensor_digest_hex(
                    candidate.historical_training_coverage.coverage_sha256_t
                ),
            }
            or canonical_page_training_proof
            != expected_canonical_page_training_proof
            or _required_sha256_tensor_hex_boundary(
                candidate.canonical_page_training_proof_sha256_t,
                label="canonical page training proof",
            )
            != expected_canonical_page_training_proof["proofSha256"]
            or proof.get("trainingPageCount")
            != int(
                candidate.canonical_training_proven_page_ids_t.numel()
            )
            or proof.get("directPageMapSha256")
            != _tensor_digest_hex(candidate.direct_page_map_sha256_t)
        ):
            raise RuntimeError(
                "NoNE reconciled knowledge proof authority differs"
            )
        self._all_knowledge_artifact_record_boundary(
            {
                "path": history_record.get("path"),
                "sha256": history_record.get("sha256"),
            },
            label="canonical history",
        )
        surgery_ledger_path, surgery_ledger_sha256 = (
            self._all_knowledge_artifact_record_boundary(
                {
                    "path": surgery_record.get("ledgerPath"),
                    "sha256": surgery_record.get("ledgerSha256"),
                },
                label="historical tensor surgery ledger",
            )
        )
        raw_records = surgery_ledger_path.read_bytes().splitlines()
        if not raw_records:
            raise RuntimeError(
                "NoNE historical tensor surgery ledger is incomplete"
            )
        final_record = orjson.loads(raw_records[-1])
        if (
            not isinstance(final_record, dict)
            or final_record.get("recordKind") != "complete"
            or final_record.get("recordSha256") != surgery_sha256
            or _file_sha256(surgery_ledger_path)
            != surgery_ledger_sha256
        ):
            raise RuntimeError(
                "NoNE historical tensor surgery completion differs"
            )
        return proof, proof_path, proof_sha256

    def _validated_all_knowledge_physical_replica_proof_boundary(
        self,
        candidate: NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
    ) -> tuple[
        dict[str, Any],
        dict[str, Any],
        tuple[NoNEPageObjectBinding, ...],
        Path,
        str,
    ]:
        """Rebuild the complete physical direct map from its staged manifest."""

        direct_candidate = isinstance(
            candidate,
            NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        )
        if not direct_candidate:
            raise TypeError(
                "NoNE all-knowledge physical proof requires a reconciled "
                "direct-map candidate"
            )
        staged = candidate.staged_generation
        if (
            self._all_knowledge_replica_candidate is not candidate
            or self._staged_bindings is None
            or not _same_generation_binding_boundary(
                staged,
                self._staged_bindings[0],
            )
        ):
            raise RuntimeError(
                "NoNE all-knowledge staged replica candidate differs"
            )
        proof_path = Path(
            candidate.physical_replica_proof_path
        ).expanduser().resolve()
        expected_sha256 = _tensor_digest_hex(
            candidate.physical_replica_proof_sha256_t
        )
        if (
            proof_path.is_symlink()
            or not proof_path.is_file()
            or _file_sha256(proof_path) != expected_sha256
        ):
            raise RuntimeError(
                "NoNE all-knowledge physical replica proof changed"
            )
        proof = _read_json(proof_path)
        loaded, manifest = (
            self.primary_store._load_generation_binding_boundary(
                staged.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    staged.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    staged.manifest_payload_sha256_t
                ),
            )
        )
        rows_value = manifest.get("pageObjects")
        if not isinstance(rows_value, list):
            raise RuntimeError(
                "NoNE all-knowledge staged direct map is absent"
            )
        ordered_rows = tuple(
            sorted(
                (
                    row
                    for row in rows_value
                    if isinstance(row, dict)
                    and isinstance(row.get("pageId"), int)
                    and not isinstance(row.get("pageId"), bool)
                ),
                key=lambda row: int(row["pageId"]),
            )
        )
        page_objects = tuple(
            self.primary_store._page_object_binding_from_row_boundary(row)
            for row in ordered_rows
        )
        page_ids_t = torch.tensor(
            [int(row["pageId"]) for row in ordered_rows],
            dtype=torch.long,
        )
        page_ids_t = (
            _require_exact_generation_187_physical_page_ids_boundary(
                page_ids_t
            )
        )
        physical_page_count = int(page_ids_t.numel())
        physical_page_max = int(page_ids_t[-1])
        physical_pages_above_101000 = int(
            page_ids_t.gt(101_000).sum()
        )
        expected_logical_object_bytes = sum(
            int(binding.object_bytes_t) for binding in page_objects
        )
        direct_map_sha256 = _tensor_digest_hex(
            _page_object_map_digest_t_boundary(page_objects)
        )
        training_union = proof.get("trainingUnionProof")
        historical_training_coverage = proof.get(
            "historicalTrainingCoverage"
        )
        canonical_page_training_proof = proof.get(
            "canonicalPageTrainingProof"
        )
        reconciled_knowledge = proof.get("reconciledKnowledgeProof")
        diagnostic_inventory: dict[str, Any] | None = None
        diagnostic_replicas: list[Any] | None = None
        coverage_path, coverage_sha256 = (
            _validated_historical_training_coverage_artifact_boundary(
                candidate.historical_training_coverage
            )
        )
        expected_coverage_record = {
            "path": str(coverage_path),
            "sha256": coverage_sha256,
            "coverageSha256": _tensor_digest_hex(
                candidate.historical_training_coverage.coverage_sha256_t
            ),
        }
        expected_page_training_proof = (
            _canonical_inherited_page_training_proof_record_boundary(
                parent_generation=(
                    self.primary_store.current_generation_binding_boundary()
                ),
                training_proven_page_ids_t=(
                    candidate.canonical_training_proven_page_ids_t
                ),
            )
        )
        stores = (self.primary_store, *self.replica_stores)
        if (
            not _same_generation_binding_boundary(loaded, staged)
            or len(ordered_rows) != len(rows_value)
            or not torch.equal(
                staged.updated_page_ids_t.detach().cpu().long(),
                page_ids_t,
            )
            or proof.get("schema")
            != ALL_KNOWLEDGE_PHYSICAL_REPLICA_PROOF_SCHEMA
            or proof.get("passed") is not True
            or proof.get("stagedGeneration")
            != staged.external_record_boundary()
            or proof.get("pageCount") != physical_page_count
            or proof.get("pageMax") != physical_page_max
            or proof.get("pagesAbove101000")
            != physical_pages_above_101000
            or proof.get("directRevisions")
            != sorted(RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS)
            or proof.get("historicalRevision6Accepted") is not False
            or proof.get("directPageMapSha256") != direct_map_sha256
            or proof.get("directPageMapSha256")
            != _tensor_digest_hex(candidate.direct_page_map_sha256_t)
            or proof.get("trainingAdmissionEligible") is not True
            or proof.get("durabilityComplete")
            is not self.durability_complete
            or proof.get("promotionEligible")
            is not self.promotion_eligible
            or proof.get("pageCacheCreditBytes") != 0
            or proof.get("hardlinkCreditBytes") != 0
            or proof.get("reflinkCreditBytes") != 0
            or proof.get("reusedObjectCreditBytes") != 0
            or proof.get("sourceReadOncePerObject") is not True
            or proof.get("alignedBoundedWaves") is not True
            or proof.get("directIo") is not True
            or proof.get("fileAndDirectoryFsyncMeasured") is not True
            or proof.get("coldPostWriteReadbackVerified") is not True
            or proof.get("branchResultRecompositionUsed") is not False
            or training_union is not None
            or historical_training_coverage != expected_coverage_record
            or canonical_page_training_proof
            != expected_page_training_proof
            or not isinstance(reconciled_knowledge, dict)
            or set(reconciled_knowledge)
            != {
                "path",
                "sha256",
                "historicalUnionPlanSha256",
                "canonicalHistorySha256",
                "surgerySha256",
            }
        ):
            raise RuntimeError(
                "NoNE all-knowledge physical replica proof differs"
            )
        if direct_candidate:
            pack_record = manifest.get("directPagePackSetAuthority")
            proof_pack_record = proof.get("directPagePackSetAuthority")
            cold_ingestion = proof.get("coldIngestion")
            durable_copy = proof.get("durableCopy")
            device_rows = proof.get("devices")
            object_rows = proof.get("objects")
            diagnostic_inventory_value = proof.get("diagnosticInventory")
            if (
                not isinstance(pack_record, dict)
                or proof_pack_record != pack_record
                or proof.get("packSetSha256")
                != pack_record.get("packSetSha256")
                or pack_record.get("schema")
                != DIRECT_PAGE_PACK_SET_AUTHORITY_SCHEMA
                or pack_record.get("pageCount") != physical_page_count
                or pack_record.get("logicalObjectBytes")
                != expected_logical_object_bytes
                or pack_record.get("pageMapSha256") != direct_map_sha256
                or pack_record.get("directRevisions")
                != sorted(RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS)
                or pack_record.get("historicalRevision6Accepted") is not False
                or pack_record.get("exactRawSafetensorBytes") is not True
                or pack_record.get("compression") is not False
                or pack_record.get("dependencyCount") != 0
                or proof.get("sourcePointerlessExternal") is not True
                or proof.get("sourceStoreRoot")
                in {
                    str(self.primary_store.root),
                    *tuple(str(store.root) for store in self.replica_stores),
                }
                or not isinstance(proof.get("sourcePackRoot"), str)
                or not isinstance(cold_ingestion, dict)
                or not isinstance(durable_copy, dict)
                or not isinstance(device_rows, list)
                or not isinstance(object_rows, list)
                or not isinstance(diagnostic_inventory_value, dict)
                or proof.get("localSourceLocatorExcludedFromAuthority")
                is not True
                or "localSourceLocatorDiagnostic" in proof
            ):
                raise RuntimeError(
                    "NoNE all-knowledge direct pack proof differs"
                )
            diagnostic_inventory = diagnostic_inventory_value
            shards = pack_record.get("shards")
            index_record = pack_record.get("index")
            independent_files = cold_ingestion.get("independentFiles")
            copy_replicas = durable_copy.get("replicas")
            source_pack_root = proof.get("sourcePackRoot")
            skipped_rows_value = proof.get("skippedReplicas")
            complete_replica_count = proof.get("completeReplicaCount")
            if (
                skipped_rows_value != []
                or proof.get("minimumCompleteReplicaCount") != 1
                or complete_replica_count != 1
                or not isinstance(source_pack_root, str)
                or pack_record.get("canonicalPackRoot")
                != source_pack_root
            ):
                raise RuntimeError(
                    "NoNE all-knowledge canonical-pack policy record differs"
                )
            expected_complete_roots = {source_pack_root}
            diagnostic_replicas_value = diagnostic_inventory.get("replicas")
            forbidden_topology_fields = (
                "aggregateUniqueLogicalBytesPerSecond",
                "aggregateDestinationBytesPerSecond",
                "minimumAggregateBytesPerSecond",
                "selectedShards",
                "proofOnlyShards",
                "sourceReadBytes",
            )
            if (
                any(field in proof for field in forbidden_topology_fields)
                or any(
                    field in cold_ingestion
                    for field in forbidden_topology_fields
                )
                or any(
                    field in durable_copy
                    for field in forbidden_topology_fields
                )
                or not isinstance(shards, list)
                or len(shards) != 1
                or not isinstance(shards[0], dict)
                or not isinstance(index_record, dict)
                or set(index_record) != {"path", "sha256", "bytes"}
                or not isinstance(independent_files, list)
                or len(independent_files) != complete_replica_count
                or copy_replicas != []
                or set(diagnostic_inventory)
                != {
                    "schema",
                    "path",
                    "sha256",
                    "bytes",
                    "terminalRecordSha256",
                    "recordCount",
                    "containsKnowledgeTensors",
                    "containsLocalPaths",
                    "runtimeAuthority",
                    "replicas",
                }
                or diagnostic_inventory.get("schema")
                != DIRECT_PAGE_PACK_DIAGNOSTIC_INVENTORY_SCHEMA
                or not isinstance(diagnostic_inventory.get("path"), str)
                or not _valid_sha256_boundary(
                    diagnostic_inventory.get("sha256")
                )
                or not _valid_sha256_boundary(
                    diagnostic_inventory.get("terminalRecordSha256")
                )
                or not isinstance(diagnostic_inventory.get("bytes"), int)
                or diagnostic_inventory["bytes"] < 1
                or diagnostic_inventory.get("recordCount")
                != physical_page_count
                or diagnostic_inventory.get("containsKnowledgeTensors")
                is not False
                or diagnostic_inventory.get("containsLocalPaths") is not False
                or diagnostic_inventory.get("runtimeAuthority") is not False
                or not isinstance(diagnostic_replicas_value, list)
                or len(diagnostic_replicas_value) != complete_replica_count
                or [row.get("pageId") for row in object_rows]
                != page_ids_t.tolist()
                or shards[0].get("logicalObjectBytes")
                != expected_logical_object_bytes
                or shards[0].get("pageCount") != physical_page_count
                or proof.get("uniquePayloadIdentityCount") != 1
                or proof.get("canonicalPackTopology") is not True
                or proof.get("canonicalPayloadFileCount") != 1
                or proof.get("fullByteReplicaCopyCount") != 0
                or proof.get("knowledgeTensorPayloadFileCount") != 1
                or proof.get("payloadFilesPerReplica") != 1
                or proof.get("completeReplicaCount") != complete_replica_count
                or proof.get("physicalPayloadFileCount")
                != complete_replica_count
                or proof.get("proofOnlyPayloadFileCount") != 0
                or proof.get("unexpectedPayloadFileCount") != 0
                or proof.get("metadataIndexContainsKnowledgeTensors")
                is not False
                or cold_ingestion.get("logicalBytesPerReplica")
                != expected_logical_object_bytes
                or cold_ingestion.get(
                    "minimumPerReplicaUniqueLogicalBytesPerSecond"
                )
                != ALL_KNOWLEDGE_PHYSICAL_REPLICA_MIN_BYTES_PER_SECOND
                or cold_ingestion.get("rateAggregationUsed") is not False
                or cold_ingestion.get("allReplicaColdRatesPassed") is not True
                or cold_ingestion.get("canonicalWholeFileProofCount") != 1
                or any(
                    cold_ingestion.get(field) != 0
                    for field in (
                        "duplicateCreditBytes",
                        "pageCacheCreditBytes",
                        "hardlinkCreditBytes",
                        "reflinkCreditBytes",
                        "reusedReplicaCreditBytes",
                    )
                )
                or proof.get("ratePassed") is not True
                or proof.get(
                    "minimumPerReplicaUniqueLogicalBytesPerSecond"
                )
                != ALL_KNOWLEDGE_PHYSICAL_REPLICA_MIN_BYTES_PER_SECOND
                or proof.get("directIo") is not True
                or durable_copy.get("rateIsAcceptanceGate") is not False
                or durable_copy.get("newlyWrittenLogicalBytes") != 0
                or durable_copy.get("elapsedNanoseconds") != 0
                or durable_copy.get("newlyWrittenLogicalBytes")
                != proof.get("newlyWrittenBytes")
                or proof.get("newlyWrittenBytes") != 0
                or not isinstance(source_pack_root, str)
                or len(expected_complete_roots) != complete_replica_count
            ):
                raise RuntimeError(
                    "NoNE all-knowledge cold pack measurement differs"
                )
            diagnostic_replicas = diagnostic_replicas_value
            payload_record = cast(dict[str, Any], shards[0])
            payload_sha256 = payload_record.get("sha256")
            payload_bytes = payload_record.get("bytes")
            index_sha256 = index_record.get("sha256")
            index_bytes = index_record.get("bytes")
            pack_sha256 = pack_record.get("packSetSha256")
            page_map_sha256 = pack_record.get("pageMapSha256")
            page_ids_sha256 = pack_record.get("pageIdsSha256")
            independent_roots: set[str] = set()
            independent_devices: set[int] = set()
            observed_rates: list[int] = []
            expected_independent_fields = {
                "replicaOrdinal",
                "root",
                "device",
                "completeReplica",
                "payload",
                "index",
                "packSetSha256",
                "pageMapSha256",
                "pageIdsSha256",
                "startedUnixNanoseconds",
                "finishedUnixNanoseconds",
                "elapsedNanoseconds",
                "physicalReadBytes",
                "physicalBytesPerSecond",
                "uniqueLogicalBytes",
                "uniqueLogicalBytesPerSecond",
                "payloadHashVerified",
                "indexHashVerified",
                "zeroPaddingVerified",
                "fileIdentityStable",
                "directIo",
                "ratePassed",
            }
            for replica_ordinal, row in enumerate(independent_files):
                if (
                    not isinstance(row, dict)
                    or set(row) != expected_independent_fields
                    or row.get("replicaOrdinal") != replica_ordinal
                    or row.get("completeReplica") is not True
                    or not isinstance(row.get("root"), str)
                    or not isinstance(row.get("device"), int)
                    or isinstance(row.get("device"), bool)
                    or not isinstance(row.get("payload"), dict)
                    or not isinstance(row.get("index"), dict)
                ):
                    raise RuntimeError(
                        "NoNE all-knowledge independent replica row differs"
                    )
                root = Path(cast(str, row["root"])).expanduser().resolve()
                payload = cast(dict[str, Any], row["payload"])
                index = cast(dict[str, Any], row["index"])
                payload_path = (
                    root / cast(str, payload.get("path"))
                    if isinstance(payload.get("path"), str)
                    else root / "__invalid_payload__"
                ).resolve()
                index_path = (
                    root / cast(str, index.get("path"))
                    if isinstance(index.get("path"), str)
                    else root / "__invalid_index__"
                ).resolve()
                if (
                    str(root) not in expected_complete_roots
                    or not root.is_dir()
                    or payload_path.is_symlink()
                    or index_path.is_symlink()
                    or not payload_path.is_relative_to(root)
                    or not index_path.is_relative_to(root)
                    or not payload_path.is_file()
                    or not index_path.is_file()
                ):
                    raise RuntimeError(
                        "NoNE all-knowledge independent replica path differs"
                    )
                payload_stat = payload_path.lstat()
                index_stat = index_path.lstat()
                logical_rate = row.get(
                    "uniqueLogicalBytesPerSecond"
                )
                if (
                    payload
                    != {
                        "path": payload_record.get("path"),
                        "sha256": payload_sha256,
                        "bytes": payload_bytes,
                        "logicalObjectBytes": expected_logical_object_bytes,
                        "inode": payload_stat.st_ino,
                        "mode": stat.S_IMODE(payload_stat.st_mode),
                        "linkCount": 1,
                        "modifiedNanoseconds": payload_stat.st_mtime_ns,
                        "changedNanoseconds": payload_stat.st_ctime_ns,
                    }
                    or index
                    != {
                        "path": index_record.get("path"),
                        "sha256": index_sha256,
                        "bytes": index_bytes,
                        "inode": index_stat.st_ino,
                        "mode": stat.S_IMODE(index_stat.st_mode),
                        "linkCount": 1,
                        "modifiedNanoseconds": index_stat.st_mtime_ns,
                        "changedNanoseconds": index_stat.st_ctime_ns,
                        "containsKnowledgeTensors": False,
                    }
                    or row.get("device") != root.stat().st_dev
                    or not stat.S_ISREG(payload_stat.st_mode)
                    or not stat.S_ISREG(index_stat.st_mode)
                    or payload_stat.st_nlink != 1
                    or index_stat.st_nlink != 1
                    or payload_stat.st_size != payload_bytes
                    or index_stat.st_size != index_bytes
                    or row.get("packSetSha256") != pack_sha256
                    or row.get("pageMapSha256") != page_map_sha256
                    or row.get("pageIdsSha256") != page_ids_sha256
                    or row.get("physicalReadBytes") != payload_bytes
                    or row.get("uniqueLogicalBytes")
                    != expected_logical_object_bytes
                    or not isinstance(logical_rate, int)
                    or isinstance(logical_rate, bool)
                    or logical_rate
                    < ALL_KNOWLEDGE_PHYSICAL_REPLICA_MIN_BYTES_PER_SECOND
                    or row.get("payloadHashVerified") is not True
                    or row.get("indexHashVerified") is not True
                    or row.get("zeroPaddingVerified") is not True
                    or row.get("fileIdentityStable") is not True
                    or row.get("directIo") is not True
                    or row.get("ratePassed") is not True
                    or not isinstance(row.get("elapsedNanoseconds"), int)
                    or row["elapsedNanoseconds"] < 1
                    or not isinstance(
                        row.get("startedUnixNanoseconds"),
                        int,
                    )
                    or not isinstance(
                        row.get("finishedUnixNanoseconds"),
                        int,
                    )
                    or row["finishedUnixNanoseconds"]
                    < row["startedUnixNanoseconds"]
                ):
                    raise RuntimeError(
                        "NoNE all-knowledge independent replica proof differs"
                    )
                independent_roots.add(str(root))
                independent_devices.add(cast(int, row["device"]))
                observed_rates.append(logical_rate)
            if (
                independent_roots != expected_complete_roots
                or len(independent_devices) != complete_replica_count
                or cold_ingestion.get(
                    "minimumObservedUniqueLogicalBytesPerSecond"
                )
                != min(observed_rates)
                or len(device_rows) != complete_replica_count
                or {
                    (
                        row.get("root"),
                        row.get("device"),
                        row.get("completePackSet"),
                    )
                    for row in device_rows
                    if isinstance(row, dict)
                }
                != {
                    (
                        row["root"],
                        row["device"],
                        True,
                    )
                    for row in independent_files
                    if isinstance(row, dict)
                }
                or {
                    row.get("root")
                    for row in diagnostic_replicas
                    if isinstance(row, dict)
                }
                != expected_complete_roots
                or any(
                    not isinstance(row, dict)
                    or set(row)
                    != {
                        "root",
                        "device",
                        "path",
                        "sha256",
                        "bytes",
                        "inode",
                        "mode",
                        "linkCount",
                        "completeReplica",
                    }
                    or row.get("path")
                    != diagnostic_inventory.get("path")
                    or row.get("sha256")
                    != diagnostic_inventory.get("sha256")
                    or row.get("bytes")
                    != diagnostic_inventory.get("bytes")
                    or row.get("linkCount") != 1
                    or row.get("completeReplica") is not True
                    for row in diagnostic_replicas
                )
            ):
                raise RuntimeError(
                    "NoNE all-knowledge direct pack topology differs"
                )
        training_evidence_record = historical_training_coverage
        if not isinstance(training_evidence_record, dict):
            raise RuntimeError(
                "NoNE all-knowledge training evidence is absent"
            )
        training_evidence_path, training_evidence_sha256 = (
            self._all_knowledge_artifact_record_boundary(
                {
                    "path": training_evidence_record.get("path"),
                    "sha256": training_evidence_record.get("sha256"),
                },
                label="historical training coverage",
            )
        )
        if direct_candidate:
            assert isinstance(reconciled_knowledge, dict)
            reconciliation_path, reconciliation_sha256 = (
                self._all_knowledge_artifact_record_boundary(
                    {
                        "path": reconciled_knowledge.get("path"),
                        "sha256": reconciled_knowledge.get("sha256"),
                    },
                    label="reconciled knowledge proof",
                )
            )
            if (
                reconciliation_path
                != Path(
                    candidate.reconciliation_proof_path
                ).expanduser().resolve()
                or reconciliation_sha256
                != _tensor_digest_hex(
                    candidate.reconciliation_proof_sha256_t
                )
                or reconciled_knowledge.get(
                    "historicalUnionPlanSha256"
                )
                != _tensor_digest_hex(
                    candidate.historical_union_plan_sha256_t
                )
                or reconciled_knowledge.get("canonicalHistorySha256")
                != _tensor_digest_hex(
                    candidate.canonical_history_sha256_t
                )
                or reconciled_knowledge.get("surgerySha256")
                != _tensor_digest_hex(candidate.surgery_sha256_t)
            ):
                raise RuntimeError(
                    "NoNE reconciled physical proof authority differs"
                )
            reconciled_record, _record_path, _record_sha256 = (
                self._validated_reconciled_knowledge_proof_artifact_boundary(
                    candidate=candidate,
                    store=self.primary_store,
                    generation_binding=loaded,
                    generation_manifest=manifest,
                )
            )
            surgery_record = reconciled_record.get("pageTensorSurgery")
            if (
                not isinstance(surgery_record, dict)
                or proof.get("sourceArtifacts")
                != {
                    "historicalUnionPlan": {
                        "path": candidate.historical_union_plan_path,
                        "sha256": _tensor_digest_hex(
                            candidate.historical_union_plan_sha256_t
                        ),
                    },
                    "canonicalHistory": {
                        "path": candidate.canonical_history_path,
                        "sha256": _tensor_digest_hex(
                            candidate.canonical_history_sha256_t
                        ),
                    },
                    "pageTensorSurgeryLedger": {
                        "path": surgery_record.get("ledgerPath"),
                        "sha256": surgery_record.get("ledgerSha256"),
                    },
                }
            ):
                raise RuntimeError(
                    "NoNE reconciled physical source proof differs"
                )
        device_rows = proof.get("devices")
        object_rows = proof.get("objects")
        if (
            not isinstance(device_rows, list)
            or not isinstance(object_rows, list)
            or len(object_rows) != physical_page_count
            or [row.get("pageId") for row in object_rows]
            != page_ids_t.tolist()
            or (
                (not direct_candidate)
                and (
                    len(device_rows) != len(stores)
                    or len(
                        {
                            row.get("device")
                            for row in device_rows
                            if isinstance(row, dict)
                        }
                    )
                    != len(stores)
                )
            )
        ):
            raise RuntimeError(
                "NoNE all-knowledge physical replica topology differs"
            )
        diagnostic_rows_by_root: dict[str, dict[str, Any]] = {}
        if direct_candidate:
            if (
                diagnostic_inventory is None
                or diagnostic_replicas is None
            ):
                raise RuntimeError(
                    "NoNE all-knowledge diagnostic inventory is absent"
                )
            diagnostic_rows_by_root = {
                cast(str, row["root"]): row
                for row in diagnostic_replicas
                if isinstance(row, dict)
                and isinstance(row.get("root"), str)
            }
            if len(diagnostic_rows_by_root) != complete_replica_count:
                raise RuntimeError(
                    "NoNE all-knowledge diagnostic replicas differ"
                )
        for store in stores:
            local_binding, local_manifest = (
                store._load_generation_binding_boundary(
                    staged.manifest_relative_path,
                    expected_manifest_sha256=_tensor_digest_hex(
                        staged.manifest_sha256_t
                    ),
                    expected_payload_sha256=_tensor_digest_hex(
                        staged.manifest_payload_sha256_t
                    ),
                )
            )
            local_page_objects = (
                store._require_complete_local_direct_page_map_boundary(
                    generation_binding=local_binding,
                    generation_manifest=local_manifest,
                    expected_page_ids_t=page_ids_t,
                )
            )
            local_pack = (
                store._local_direct_page_pack_set_authority_boundary(
                    local_manifest
                )
            )
            if (
                len(local_page_objects) != len(page_objects)
                or any(
                    not _same_page_object_binding_boundary(left, right)
                    for left, right in zip(
                        local_page_objects,
                        page_objects,
                        strict=True,
                    )
                )
                or (
                    direct_candidate
                    and (
                        local_pack is None
                        or local_pack[2]
                        != manifest.get("directPagePackSetAuthority")
                        or str(local_pack[0].index_root.resolve())
                        != source_pack_root
                        or {
                            str(root.resolve())
                            for root in local_pack[0].shard_roots
                        }
                        != {source_pack_root}
                    )
                )
            ):
                raise RuntimeError(
                    "NoNE all-knowledge local direct map differs"
                )
            if direct_candidate:
                assert local_pack is not None
                if local_pack[2].get("canonicalPackRoot") != source_pack_root:
                    raise RuntimeError(
                        "NoNE accepting metadata resolved a noncanonical pack"
                    )
        if direct_candidate:
            assert diagnostic_inventory is not None
            source_store_root_value = proof.get("sourceStoreRoot")
            source_pack_root_value = proof.get("sourcePackRoot")
            if (
                not isinstance(source_store_root_value, str)
                or not isinstance(source_pack_root_value, str)
            ):
                raise RuntimeError(
                    "NoNE all-knowledge source pack authority is absent"
                )
            source_store = NoNEImmutablePageStore(
                Path(source_store_root_value),
                advertise_locator=False,
            )
            source_store.begin_session(staged.session_id_t)
            _source_session_id_t, source_session_root = (
                source_store._require_session()
            )
            source_pack = (
                source_store._local_direct_page_pack_set_authority_boundary(
                    {
                        "pageObjects": list(ordered_rows),
                        "directPagePackSetAuthority": manifest.get(
                            "directPagePackSetAuthority"
                        ),
                    }
                )
            )
            if (
                str(source_session_root) != source_pack_root_value
                or source_pack is None
                or source_pack[2]
                != manifest.get("directPagePackSetAuthority")
            ):
                raise RuntimeError(
                    "NoNE all-knowledge source pack differs"
                )
            source_diagnostic_row = diagnostic_rows_by_root.get(
                str(source_session_root)
            )
            if not isinstance(source_diagnostic_row, dict):
                raise RuntimeError(
                    "NoNE source diagnostic inventory is absent"
                )
            source_diagnostic_path = (
                source_session_root
                / cast(str, diagnostic_inventory["path"])
            ).resolve()
            source_diagnostic_stat = source_diagnostic_path.lstat()
            if (
                source_diagnostic_row.get("device")
                != source_session_root.stat().st_dev
                or source_diagnostic_row.get("inode")
                != source_diagnostic_stat.st_ino
                or source_diagnostic_row.get("mode")
                != stat.S_IMODE(source_diagnostic_stat.st_mode)
                or source_diagnostic_row.get("linkCount") != 1
                or source_diagnostic_stat.st_nlink != 1
                or source_diagnostic_stat.st_size
                != diagnostic_inventory["bytes"]
            ):
                raise RuntimeError(
                    "NoNE source diagnostic inventory identity differs"
                )
            _validated_direct_page_pack_diagnostic_inventory_boundary(
                path=source_diagnostic_path,
                expected_sha256=cast(
                    str,
                    diagnostic_inventory["sha256"],
                ),
                expected_terminal_record_sha256=cast(
                    str,
                    diagnostic_inventory["terminalRecordSha256"],
                ),
                authority=source_pack[0],
                index=source_pack[1],
            )
        return (
            proof,
            manifest,
            page_objects,
            training_evidence_path,
            training_evidence_sha256,
        )

    def _validated_all_knowledge_cold_forward_proof_boundary(
        self,
        *,
        candidate: NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        graph_authority: NoNEGraphAuthorityBinding,
        staged_direct_map_seal_t: torch.Tensor,
        cold_proof_path: Path,
        cold_proof_sha256_t: torch.Tensor,
        physical_proof_path: Path,
        physical_proof_sha256: str,
        historical_training_coverage_path: Path,
        historical_training_coverage_sha256: str,
    ) -> dict[str, Any]:
        """Require the exact fresh-model pointerless cold-forward receipt."""

        seal_t = (
            staged_direct_map_seal_t.detach()
            .cpu()
            .to(dtype=torch.uint8)
            .reshape(-1)
        )
        if seal_t.shape != (32,):
            raise RuntimeError(
                "NoNE all-knowledge staged direct-map seal differs"
            )
        unresolved_cold_proof_path = cold_proof_path.expanduser()
        if _unresolved_path_contains_symlink_boundary(
            unresolved_cold_proof_path
        ):
            raise RuntimeError("NoNE all-knowledge cold proof is a symlink")
        resolved = unresolved_cold_proof_path.resolve()
        expected_sha256 = _tensor_digest_hex(cold_proof_sha256_t)
        if (
            not resolved.is_file()
            or _file_sha256(resolved) != expected_sha256
        ):
            raise RuntimeError("NoNE all-knowledge cold proof changed")
        proof = _read_json(resolved)
        expected_keys = {
            "schema",
            "passed",
            "freshModelInstance",
            "preaccept",
            "targetEnteredForward",
            "calibrationTargetsPresent",
            "checkpointAdaptationApplied",
            "branchDeltaLoaded",
            "commonParentRequiredForLoad",
            "frozenParentKnowledgeAuthority",
            "stagedGeneration",
            "graphAuthority",
            "stagedDirectMapSealSha256",
            "checkpoint",
            "optimizer",
            "externalState",
            "reconciliationProofSha256",
            "calibrationProofSha256",
            "calibrationPromptAuthority",
            "optimizerGenesisProof",
            "physicalReplicaProof",
            "historicalTrainingCoverage",
            "canonicalPageTrainingProof",
            "coldLoadReceiptSha256",
            "preloadModelStateSha256",
            "forwardInputIdsSha256",
            "forwardInputMaskSha256",
            "forwardInputShape",
            "physicalPageCount",
            "pageMax",
            "pagesAbove101000",
            "directRevisions",
            "historicalRevision6Accepted",
            "routerBiasCount",
            "fabricPhaseCount",
            "scienceActivePositions",
            "pagedRouteCount",
            "finite",
            "coldForwardPassed",
        }
        expected_keys.add("reconciledKnowledgeProof")
        if set(proof) != expected_keys:
            raise RuntimeError(
                "NoNE all-knowledge cold proof fields differ"
            )
        physical_record = proof.get("physicalReplicaProof")
        historical_training_coverage_record = proof.get(
            "historicalTrainingCoverage"
        )
        canonical_page_training_proof_record = proof.get(
            "canonicalPageTrainingProof"
        )
        reconciled_knowledge_record = proof.get(
            "reconciledKnowledgeProof"
        )
        calibration_prompt_record = proof.get(
            "calibrationPromptAuthority"
        )
        if (
            not isinstance(calibration_prompt_record, dict)
            or set(calibration_prompt_record)
            != {"path", "sha256", "authoritySha256"}
            or not isinstance(calibration_prompt_record.get("path"), str)
            or not _valid_sha256_boundary(
                calibration_prompt_record.get("sha256")
            )
            or not _valid_sha256_boundary(
                calibration_prompt_record.get("authoritySha256")
            )
        ):
            raise RuntimeError(
                "NoNE all-knowledge calibration prompt record differs"
            )
        from resynthesis.cli import (
            _validated_all_knowledge_target_free_calibration_prompt_boundary,
        )
        from resynthesis.learn_loop import KeepRollbackManager

        calibration_prompt = (
            _validated_all_knowledge_target_free_calibration_prompt_boundary(
                artifact_path=Path(calibration_prompt_record["path"]),
                expected_artifact_file_sha256=calibration_prompt_record[
                    "sha256"
                ],
            )
        )
        checkpoint_path, _checkpoint_sha256 = (
            self._all_knowledge_artifact_record_boundary(
                proof.get("checkpoint"),
                label="checkpoint",
            )
        )
        if checkpoint_path != Path(
            graph_authority.checkpoint_path
        ).expanduser().resolve():
            raise RuntimeError(
                "NoNE all-knowledge calibrated checkpoint path differs"
            )
        checkpoint_payload = torch.load(
            checkpoint_path,
            map_location="cpu",
            weights_only=True,
        )
        if not isinstance(checkpoint_payload, dict):
            raise RuntimeError(
                "NoNE all-knowledge calibrated checkpoint differs"
            )
        calibrated_packet = (
            KeepRollbackManager._validated_calibrated_snapshot_packet(
                checkpoint_payload
            )
        )
        calibration_proof = calibrated_packet.calibration_proof
        prompt_packet = calibration_prompt.packet
        prompt_authority_sha256 = _tensor_digest_hex(
            prompt_packet.authority_sha256_t
        )
        input_ids_sha256 = _tensor_digest_hex(
            prompt_packet.input_ids_sha256_t
        )
        input_mask_sha256 = _tensor_digest_hex(
            prompt_packet.input_mask_sha256_t
        )
        expected_calibration_source = {
            "calibrationGlobalCursor": int(
                prompt_packet.global_cursor_t[0]
            ),
            "calibrationPromptSha256": _tensor_digest_hex(
                prompt_packet.prompt_sha256_t
            ),
            "calibrationWindowSha256": _tensor_digest_hex(
                prompt_packet.window_sha256_t
            ),
            "calibrationComponentSha256": _tensor_digest_hex(
                prompt_packet.row_authority_sha256_t[0]
            ),
            "calibrationPayloadWorkId": _tensor_digest_hex(
                prompt_packet.row_authority_sha256_t[1]
            ),
            "calibrationSnapshotFileSha256": _tensor_digest_hex(
                prompt_packet.snapshot_file_sha256_t
            ),
            "calibrationCollectionAuthoritySha256": _tensor_digest_hex(
                prompt_packet.collection_authority_sha256_t
            ),
            "calibrationFederationAuthoritySha256": _tensor_digest_hex(
                prompt_packet.federation_authority_sha256_t
            ),
            "calibrationExclusionCollectionFileSha256": _tensor_digest_hex(
                prompt_packet.exclusion_collection_file_sha256_t
            ),
            "calibrationExcludedPriorWorkIdsSha256": _tensor_digest_hex(
                prompt_packet.excluded_prior_work_ids_sha256_t
            ),
            "calibrationPhysicalSourceRangesSha256": _tensor_digest_hex(
                prompt_packet.physical_source_ranges_sha256_t
            ),
        }
        if (
            calibration_prompt_record.get("path")
            != str(calibration_prompt.artifact_path)
            or calibration_prompt_record.get("authoritySha256")
            != prompt_authority_sha256
            or not torch.equal(
                calibrated_packet.calibration_prompt_authority_sha256_t,
                prompt_packet.authority_sha256_t,
            )
            or calibration_proof.get("calibrationPromptAuthoritySha256")
            != prompt_authority_sha256
            or calibration_proof.get("calibrationInputIdsSha256")
            != input_ids_sha256
            or calibration_proof.get("calibrationInputMaskSha256")
            != input_mask_sha256
            or calibration_proof.get("calibrationTargetsPresent") is not False
            or calibration_proof.get("calibrationTargetEnteredForward")
            is not False
            or any(
                calibration_proof.get(name) != value
                for name, value in expected_calibration_source.items()
            )
            or proof.get("calibrationProofSha256")
            != calibration_proof.get("proofSha256")
            or proof.get("forwardInputIdsSha256") != input_ids_sha256
            or proof.get("forwardInputMaskSha256") != input_mask_sha256
            or proof.get("forwardInputShape")
            != list(prompt_packet.input_ids_t.shape)
        ):
            raise RuntimeError(
                "NoNE all-knowledge calibration prompt stages differ"
            )
        physical_proof = _read_json(physical_proof_path)
        physical_object_rows = physical_proof.get("objects")
        if (
            not isinstance(physical_object_rows, list)
            or not physical_object_rows
            or any(
                not isinstance(row, dict)
                or not isinstance(row.get("pageId"), int)
                or isinstance(row.get("pageId"), bool)
                for row in physical_object_rows
            )
        ):
            raise RuntimeError(
                "NoNE all-knowledge physical replica page map differs"
            )
        physical_page_ids_t = (
            _require_exact_generation_187_physical_page_ids_boundary(
                torch.tensor(
                    [row["pageId"] for row in physical_object_rows],
                    dtype=torch.long,
                )
            )
        )
        physical_page_count = int(physical_page_ids_t.numel())
        physical_page_max = int(physical_page_ids_t[-1])
        physical_pages_above_101000 = int(
            physical_page_ids_t.gt(101_000).sum()
        )
        if (
            physical_proof.get("pageCount") != physical_page_count
            or physical_proof.get("pageMax") != physical_page_max
            or physical_proof.get("pagesAbove101000")
            != physical_pages_above_101000
        ):
            raise RuntimeError(
                "NoNE all-knowledge physical replica geometry differs"
            )
        if (
            proof.get("schema")
            != ALL_KNOWLEDGE_STAGED_COLD_FORWARD_PROOF_SCHEMA
            or proof.get("passed") is not True
            or proof.get("freshModelInstance") is not True
            or proof.get("preaccept") is not True
            or proof.get("targetEnteredForward") is not False
            or proof.get("calibrationTargetsPresent") is not False
            or proof.get("checkpointAdaptationApplied") is not False
            or proof.get("branchDeltaLoaded") is not False
            or proof.get("commonParentRequiredForLoad") is not False
            or proof.get("frozenParentKnowledgeAuthority") is not False
            or proof.get("stagedGeneration")
            != candidate.staged_generation.external_record_boundary()
            or proof.get("graphAuthority")
            != graph_authority.external_record_boundary()
            or proof.get("stagedDirectMapSealSha256")
            != _tensor_digest_hex(seal_t)
            or not _valid_sha256_boundary(
                proof.get("reconciliationProofSha256")
            )
            or not _valid_sha256_boundary(
                proof.get("calibrationProofSha256")
            )
            or not _valid_sha256_boundary(
                proof.get("coldLoadReceiptSha256")
            )
            or not _valid_sha256_boundary(
                proof.get("preloadModelStateSha256")
            )
            or not _valid_sha256_boundary(
                proof.get("forwardInputIdsSha256")
            )
            or not _valid_sha256_boundary(
                proof.get("forwardInputMaskSha256")
            )
            or not isinstance(proof.get("forwardInputShape"), list)
            or len(proof["forwardInputShape"]) != 2
            or any(
                not isinstance(extent, int)
                or isinstance(extent, bool)
                or extent < 1
                for extent in proof["forwardInputShape"]
            )
            or physical_record
            != {
                "path": str(physical_proof_path),
                "sha256": physical_proof_sha256,
            }
            or historical_training_coverage_record
            != {
                "path": str(historical_training_coverage_path),
                "sha256": historical_training_coverage_sha256,
                "coverageSha256": _tensor_digest_hex(
                    candidate.historical_training_coverage.coverage_sha256_t
                ),
            }
            or canonical_page_training_proof_record
            != _canonical_inherited_page_training_proof_record_boundary(
                parent_generation=(
                    self.primary_store.current_generation_binding_boundary()
                ),
                training_proven_page_ids_t=(
                    candidate.canonical_training_proven_page_ids_t
                ),
            )
            or reconciled_knowledge_record
            != {
                "path": candidate.reconciliation_proof_path,
                "sha256": _tensor_digest_hex(
                    candidate.reconciliation_proof_sha256_t
                ),
            }
            or proof.get("physicalPageCount")
            != physical_page_count
            or proof.get("pageMax") != physical_page_max
            or proof.get("pagesAbove101000")
            != physical_pages_above_101000
            or proof.get("directRevisions")
            != sorted(RECONCILED_DIRECT_PAGE_FORMAT_REVISIONS)
            or proof.get("historicalRevision6Accepted") is not False
            or proof.get("routerBiasCount") != 36
            or not isinstance(proof.get("fabricPhaseCount"), int)
            or proof["fabricPhaseCount"] < 1
            or not isinstance(proof.get("scienceActivePositions"), int)
            or proof["scienceActivePositions"] < 1
            or not isinstance(proof.get("pagedRouteCount"), int)
            or proof["pagedRouteCount"] < 1
            or proof.get("finite") is not True
            or proof.get("coldForwardPassed") is not True
        ):
            raise RuntimeError(
                "NoNE all-knowledge cold proof authority differs"
            )
        for label in (
            "checkpoint",
            "optimizer",
            "externalState",
            "optimizerGenesisProof",
        ):
            self._all_knowledge_artifact_record_boundary(
                proof[label],
                label=label,
            )
        return proof

    def accept_all_knowledge_candidate_boundary(
        self,
        candidate: NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        *,
        graph_authority: NoNEGraphAuthorityBinding,
        staged_direct_map_seal_t: torch.Tensor,
        cold_proof_path: Path,
        cold_proof_sha256_t: torch.Tensor,
    ) -> dict[str, Any]:
        """Accept one cold-proven candidate and always release its leases."""

        stores = (self.primary_store, *self.replica_stores)
        try:
            return self._accept_all_knowledge_candidate_under_lease_boundary(
                candidate,
                graph_authority=graph_authority,
                staged_direct_map_seal_t=staged_direct_map_seal_t,
                cold_proof_path=cold_proof_path,
                cold_proof_sha256_t=cold_proof_sha256_t,
            )
        finally:
            for store in reversed(
                tuple(sorted(stores, key=lambda value: str(value.root)))
            ):
                store._release_generation_writer_boundary()
            self._staged_bindings = None
            self._all_knowledge_replica_candidate = None
            self._all_knowledge_physical_replica_measurement = None

    def _accept_all_knowledge_candidate_under_lease_boundary(
        self,
        candidate: NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        *,
        graph_authority: NoNEGraphAuthorityBinding,
        staged_direct_map_seal_t: torch.Tensor,
        cold_proof_path: Path,
        cold_proof_sha256_t: torch.Tensor,
    ) -> dict[str, Any]:
        """Commit replica pointers, canonical pointer, then one visibility marker."""

        if not isinstance(
            candidate,
            NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        ):
            raise TypeError(
                "NoNE all-knowledge acceptance requires one reconciled "
                "direct-map candidate"
            )
        if not isinstance(graph_authority, NoNEGraphAuthorityBinding):
            raise TypeError("NoNE all-knowledge graph authority is malformed")
        stores = (self.primary_store, *self.replica_stores)
        if (
            not self.training_admission_eligible
            or any(
                store._generation_writer_handle is None for store in stores
            )
        ):
            raise RuntimeError(
                "NoNE all-knowledge training admission/writer authority "
                "is incomplete"
            )
        (
            physical_proof,
            staged_manifest,
            direct_page_objects,
            historical_training_coverage_path,
            historical_training_coverage_sha256,
        ) = self._validated_all_knowledge_physical_replica_proof_boundary(
            candidate
        )
        physical_proof_path = Path(
            candidate.physical_replica_proof_path
        ).expanduser().resolve()
        physical_proof_sha256 = _tensor_digest_hex(
            candidate.physical_replica_proof_sha256_t
        )
        cold_proof = (
            self._validated_all_knowledge_cold_forward_proof_boundary(
                candidate=candidate,
                graph_authority=graph_authority,
                staged_direct_map_seal_t=staged_direct_map_seal_t,
                cold_proof_path=cold_proof_path,
                cold_proof_sha256_t=cold_proof_sha256_t,
                physical_proof_path=physical_proof_path,
                physical_proof_sha256=physical_proof_sha256,
                historical_training_coverage_path=(
                    historical_training_coverage_path
                ),
                historical_training_coverage_sha256=(
                    historical_training_coverage_sha256
                ),
            )
        )
        _validate_historical_training_coverage_packet_boundary(
            candidate.historical_training_coverage
        )
        staged = candidate.staged_generation
        staged_components = staged_manifest.get("components")
        staged_training_component = (
            staged_components.get("trainingProof")
            if isinstance(staged_components, dict)
            else None
        )
        if (
            int(staged.parent_generation_t)
            != int(
                candidate.historical_training_coverage.parent_generation_t
            )
            or staged_manifest.get("parentManifestPayloadSha256")
            != _tensor_digest_hex(
                candidate.historical_training_coverage
                .parent_manifest_payload_sha256_t
            )
            or staged_manifest.get("trainingProvenPageIds", [])
            != candidate.canonical_training_proven_page_ids_t.tolist()
            or not isinstance(staged_training_component, dict)
            or staged_training_component.get("sha256")
            != _tensor_digest_hex(
                candidate.canonical_page_training_proof_sha256_t
            )
            or "record" in staged_training_component
            or staged_manifest.get("directPageMapAuthority") is None
            or physical_proof.get("componentArtifacts")
            != staged_manifest.get("components")
            or physical_proof.get("canonicalPointerMoved") is not False
        ):
            raise RuntimeError(
                "NoNE all-knowledge staged transaction authority differs"
            )
        prior_pointer_bytes: dict[NoNEImmutablePageStore, bytes] = {}
        prior_pointer_records: dict[
            NoNEImmutablePageStore, dict[str, Any]
        ] = {}
        target_pointer_records: dict[
            NoNEImmutablePageStore, dict[str, Any]
        ] = {}
        target_bindings: dict[
            NoNEImmutablePageStore, NoNEGenerationBinding
        ] = {}
        target_manifests: dict[
            NoNEImmutablePageStore, dict[str, Any]
        ] = {}
        for store in stores:
            current = store.current_generation_binding_boundary()
            if (
                _session_key(current.session_id_t)
                != _tensor_digest_hex(
                    candidate.historical_training_coverage
                    .parent_session_sha256_t
                )
                or int(current.generation_t)
                != int(
                    candidate.historical_training_coverage
                    .parent_generation_t
                )
                or not torch.equal(
                    current.manifest_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8),
                    candidate.historical_training_coverage
                    .parent_manifest_sha256_t.detach()
                    .cpu(),
                )
                or not torch.equal(
                    current.manifest_payload_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8),
                    candidate.historical_training_coverage
                    .parent_manifest_payload_sha256_t.detach()
                    .cpu(),
                )
            ):
                raise RuntimeError(
                    "NoNE all-knowledge transaction frontier changed"
                )
            _session_id_t, session_root = store._require_session()
            accepted_path = session_root / "accepted.json"
            raw_bytes = accepted_path.read_bytes()
            raw_record = _read_json(accepted_path)
            visible_record = _visible_accepted_pointer_record_boundary(
                accepted_path
            )
            if (
                raw_record != visible_record
                or raw_record.get("acceptanceTransaction") is not None
                or hashlib.sha256(raw_bytes).hexdigest()
                != _tensor_digest_hex(
                    candidate.historical_training_coverage
                    .accepted_pointer_sha256_t
                )
            ):
                raise RuntimeError(
                    "NoNE all-knowledge prior pointer needs recovery"
                )
            loaded, manifest = store._load_generation_binding_boundary(
                staged.manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    staged.manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    staged.manifest_payload_sha256_t
                ),
            )
            store._require_complete_local_direct_page_map_boundary(
                generation_binding=loaded,
                generation_manifest=manifest,
                expected_page_ids_t=(
                    _require_exact_generation_187_physical_page_ids_boundary(
                        store.accepted_page_ids_t_boundary()
                    )
                ),
            )
            verified_graph = store._load_graph_authority_record_boundary(
                loaded,
                manifest,
                graph_authority.external_record_boundary(),
            )
            if verified_graph.external_record_boundary() != (
                graph_authority.external_record_boundary()
            ):
                raise RuntimeError(
                    "NoNE all-knowledge graph authority changed"
                )
            local_components = manifest.get("components")
            local_training_component = (
                local_components.get("trainingProof")
                if isinstance(local_components, dict)
                else None
            )
            if (
                manifest.get("trainingProvenPageIds", [])
                != candidate.canonical_training_proven_page_ids_t.tolist()
                or not isinstance(local_training_component, dict)
                or local_training_component.get("sha256")
                != _tensor_digest_hex(
                    candidate.canonical_page_training_proof_sha256_t
                )
                or "record" in local_training_component
            ):
                raise RuntimeError(
                    "NoNE all-knowledge inherited page proof differs"
                )
            self._validated_reconciled_knowledge_proof_artifact_boundary(
                candidate=candidate,
                store=store,
                generation_binding=loaded,
                generation_manifest=manifest,
            )
            prior_pointer_bytes[store] = raw_bytes
            prior_pointer_records[store] = visible_record
            target_bindings[store] = loaded
            target_manifests[store] = manifest
            target_pointer_records[store] = (
                store.accepted_pointer_record_boundary(
                    loaded,
                    verified_graph,
                )
            )

        canonical_session_id_t, canonical_session_root = (
            self.primary_store._require_session()
        )
        if (
            _session_key(canonical_session_id_t)
            != _tensor_digest_hex(
                candidate.historical_training_coverage
                .parent_session_sha256_t
            )
        ):
            raise RuntimeError(
                "NoNE all-knowledge canonical session differs"
            )
        pointer_write_stores = (*self.replica_stores, self.primary_store)
        transaction_core = {
            "schema": ALL_KNOWLEDGE_ACCEPTANCE_TRANSACTION_SCHEMA,
            "passed": False,
            "sessionId": canonical_session_id_t.tolist(),
            "parentGeneration": int(
                candidate.historical_training_coverage.parent_generation_t
            ),
            "parentManifestPayloadSha256": _tensor_digest_hex(
                candidate.historical_training_coverage
                .parent_manifest_payload_sha256_t
            ),
            "stagedGeneration": staged.external_record_boundary(),
            "graphAuthority": graph_authority.external_record_boundary(),
            "stagedDirectMapSealSha256": _tensor_digest_hex(
                staged_direct_map_seal_t
            ),
            "physicalReplicaProof": {
                "path": str(physical_proof_path),
                "sha256": physical_proof_sha256,
            },
            "coldForwardProof": {
                "path": str(cold_proof_path.expanduser().resolve()),
                "sha256": _tensor_digest_hex(cold_proof_sha256_t),
            },
            "historicalTrainingCoverage": {
                "path": str(historical_training_coverage_path),
                "sha256": historical_training_coverage_sha256,
                "coverageSha256": _tensor_digest_hex(
                    candidate.historical_training_coverage.coverage_sha256_t
                ),
            },
            "canonicalPageTrainingProofSha256": _tensor_digest_hex(
                candidate.canonical_page_training_proof_sha256_t
            ),
            "reconciliationProofSha256": cold_proof[
                "reconciliationProofSha256"
            ],
            "calibrationProofSha256": cold_proof[
                "calibrationProofSha256"
            ],
            "calibrationPromptAuthority": cold_proof[
                "calibrationPromptAuthority"
            ],
            "componentArtifactsSha256": physical_proof[
                "componentArtifactsSha256"
            ],
            "directPageMapSha256": physical_proof[
                "directPageMapSha256"
            ],
            "trainingAdmissionEligible": True,
            "durabilityComplete": self.durability_complete,
            "promotionEligible": self.promotion_eligible,
            "pointerWriteOrder": [
                str(store.root) for store in pointer_write_stores
            ],
            "canonicalPointerWrittenLast": True,
            "priorPointers": [
                {
                    "storeRoot": str(store.root),
                    "pointerPath": str(
                        store._require_session()[1] / "accepted.json"
                    ),
                    "payloadSha256": hashlib.sha256(
                        _canonical_json_bytes(
                            prior_pointer_records[store]
                        )
                    ).hexdigest(),
                    "rawBytesSha256": hashlib.sha256(
                        prior_pointer_bytes[store]
                    ).hexdigest(),
                    "rawBytesBase64": base64.b64encode(
                        prior_pointer_bytes[store]
                    ).decode("ascii"),
                }
                for store in stores
            ],
            "targetPointerPayloadSha256s": {
                str(store.root): hashlib.sha256(
                    _canonical_json_bytes(target_pointer_records[store])
                ).hexdigest()
                for store in stores
            },
        }
        if isinstance(
            candidate,
            NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        ):
            transaction_core["reconciledKnowledgeProof"] = {
                "path": candidate.reconciliation_proof_path,
                "sha256": _tensor_digest_hex(
                    candidate.reconciliation_proof_sha256_t
                ),
                "historicalUnionPlanSha256": _tensor_digest_hex(
                    candidate.historical_union_plan_sha256_t
                ),
                "canonicalHistorySha256": _tensor_digest_hex(
                    candidate.canonical_history_sha256_t
                ),
                "surgerySha256": _tensor_digest_hex(
                    candidate.surgery_sha256_t
                ),
            }
        transaction_sha256 = hashlib.sha256(
            _canonical_json_bytes(transaction_core)
        ).hexdigest()
        transaction_root = (
            canonical_session_root / "acceptance_transactions"
        )
        intent_path = transaction_root / (
            f"{transaction_sha256}.intent.json"
        )
        marker_path = transaction_root / (
            f"{transaction_sha256}.commit.json"
        )
        marker = {
            "schema": ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA,
            "passed": True,
            "transactionSha256": transaction_sha256,
            "stagedGeneration": staged.external_record_boundary(),
            "graphAuthorityPayloadSha256": hashlib.sha256(
                _canonical_json_bytes(
                    graph_authority.external_record_boundary()
                )
            ).hexdigest(),
            "physicalReplicaProofSha256": physical_proof_sha256,
            "coldForwardProofSha256": _tensor_digest_hex(
                cold_proof_sha256_t
            ),
            "calibrationPromptAuthority": cold_proof[
                "calibrationPromptAuthority"
            ],
            "historicalTrainingCoverageFileSha256": (
                historical_training_coverage_sha256
            ),
            "historicalTrainingCoverageSha256": _tensor_digest_hex(
                candidate.historical_training_coverage.coverage_sha256_t
            ),
            "canonicalPageTrainingProofSha256": _tensor_digest_hex(
                candidate.canonical_page_training_proof_sha256_t
            ),
            "componentArtifactsSha256": physical_proof[
                "componentArtifactsSha256"
            ],
            "directPageMapSha256": physical_proof[
                "directPageMapSha256"
            ],
            "targetPointerPayloadSha256s": transaction_core[
                "targetPointerPayloadSha256s"
            ],
            "pointerWriteOrder": transaction_core["pointerWriteOrder"],
            "canonicalPointerWrittenLast": True,
            "trainingAdmissionEligible": True,
            "durabilityComplete": self.durability_complete,
            "promotionEligible": self.promotion_eligible,
            "physicalRatePassed": True,
            "coldForwardPassed": True,
        }
        if isinstance(
            candidate,
            NoNEAllKnowledgeReconciledDirectMapCandidatePacket,
        ):
            marker["reconciledKnowledgeProofSha256"] = _tensor_digest_hex(
                candidate.reconciliation_proof_sha256_t
            )
            marker["historicalUnionPlanSha256"] = _tensor_digest_hex(
                candidate.historical_union_plan_sha256_t
            )
            marker["canonicalHistorySha256"] = _tensor_digest_hex(
                candidate.canonical_history_sha256_t
            )
            marker["surgerySha256"] = _tensor_digest_hex(
                candidate.surgery_sha256_t
            )
        marker_payload_sha256 = hashlib.sha256(
            _canonical_json_bytes(marker)
        ).hexdigest()
        intent = {
            **transaction_core,
            "transactionSha256": transaction_sha256,
            "canonicalCommitMarkerPath": str(marker_path),
            "canonicalCommitMarkerPayloadSha256": (
                marker_payload_sha256
            ),
        }
        intent_bytes = (
            json.dumps(intent, sort_keys=True, indent=2).encode("utf-8")
            + b"\n"
        )
        _atomic_bytes(intent_path, intent_bytes)
        for store in stores:
            target_sha256 = cast(
                dict[str, str],
                transaction_core[
                    "targetPointerPayloadSha256s"
                ],
            )[str(store.root)]
            target_binding = target_bindings[store]
            target_manifest = target_manifests[store]
            store._record_validated_accepted_direct_page_map_boundary(
                generation_binding=target_binding,
                generation_manifest=target_manifest,
            )
            store._persist_accepted_direct_page_map_frontier_boundary(
                generation_binding=target_binding,
                generation_manifest=target_manifest,
                acceptance_commit_marker={
                    "path": str(marker_path),
                    "sha256": marker_payload_sha256,
                    "transactionSha256": transaction_sha256,
                    "storeRoot": str(store.root),
                    "targetPointerPayloadSha256": target_sha256,
                },
            )

        marker_written = False
        try:
            for store in pointer_write_stores:
                _session_id_t, session_root = store._require_session()
                history_root = session_root / "accepted_authorities"
                history_root.mkdir(parents=True, exist_ok=True)
                for record in (
                    prior_pointer_records[store],
                    target_pointer_records[store],
                ):
                    history_path = (
                        _accepted_authority_history_path_boundary(
                            session_root,
                            record,
                        )
                    )
                    if history_path.is_file():
                        if _read_json(history_path) != record:
                            raise RuntimeError(
                                "NoNE all-knowledge accepted history changed"
                            )
                    else:
                        _atomic_json(history_path, record)
                target_record = target_pointer_records[store]
                target_sha256 = cast(
                    dict[str, str],
                    transaction_core[
                        "targetPointerPayloadSha256s"
                    ],
                )[str(store.root)]
                wrapper = {
                    **target_record,
                    "acceptanceTransaction": {
                        "schema": (
                            ALL_KNOWLEDGE_ACCEPTANCE_POINTER_VISIBILITY_SCHEMA
                        ),
                        "transactionSha256": transaction_sha256,
                        "storeRoot": str(store.root),
                        "canonicalCommitMarkerPath": str(marker_path),
                        "canonicalCommitMarkerPayloadSha256": (
                            marker_payload_sha256
                        ),
                        "priorPointer": prior_pointer_records[store],
                        "priorPointerPayloadSha256": hashlib.sha256(
                            _canonical_json_bytes(
                                prior_pointer_records[store]
                            )
                        ).hexdigest(),
                        "targetPointerPayloadSha256": target_sha256,
                    },
                }
                _atomic_json(session_root / "accepted.json", wrapper)
                visible_before_commit = (
                    _visible_accepted_pointer_record_boundary(
                        session_root / "accepted.json"
                    )
                )
                if visible_before_commit != prior_pointer_records[store]:
                    raise RuntimeError(
                        "NoNE replica pointer became visible before marker"
                    )
            _atomic_json(marker_path, marker)
            marker_written = True
            for store in stores:
                store._accepted_pointer_identity_boundary = None
                store._accepted_manifest_identity_boundary = None
                discovered = store.discover_accepted_pointer_boundary()
                if not _same_generation_binding_boundary(
                    discovered,
                    staged,
                ):
                    raise RuntimeError(
                        "NoNE all-knowledge committed pointer differs"
                    )
        except Exception:
            if not marker_written:
                rollback_failed = False
                for store in stores:
                    try:
                        _session_id_t, session_root = store._require_session()
                        _atomic_replace_bytes_boundary(
                            session_root / "accepted.json",
                            prior_pointer_bytes[store],
                        )
                        store._accepted_pointer_identity_boundary = None
                        store._accepted_manifest_identity_boundary = None
                        restored = store.discover_accepted_pointer_boundary()
                        prior_record = prior_pointer_records[store]
                        if (
                            (session_root / "accepted.json").read_bytes()
                            != prior_pointer_bytes[store]
                            or int(restored.generation_t)
                            != prior_record.get("generation")
                            or restored.manifest_relative_path
                            != prior_record.get("manifest")
                            or _tensor_digest_hex(restored.manifest_sha256_t)
                            != prior_record.get("manifestSha256")
                            or _tensor_digest_hex(
                                restored.manifest_payload_sha256_t
                            )
                            != prior_record.get("manifestPayloadSha256")
                        ):
                            raise RuntimeError(
                                "NoNE rollback pointer differs"
                            )
                    except Exception:
                        rollback_failed = True
                rollback_path = transaction_root / (
                    f"{transaction_sha256}.rollback.json"
                )
                _atomic_json(
                    rollback_path,
                    {
                        "schema": (
                            ALL_KNOWLEDGE_ACCEPTANCE_ROLLBACK_SCHEMA
                        ),
                        "passed": not rollback_failed,
                        "transactionSha256": transaction_sha256,
                        "restoredStoreRoots": [
                            str(store.root) for store in stores
                        ],
                        "canonicalPointerUnchanged": True,
                    },
                )
                if rollback_failed:
                    raise RuntimeError(
                        "NoNE all-knowledge pointer rollback was incomplete"
                    )
            raise
        return {
            **marker,
            "commitMarkerPath": str(marker_path),
            "commitMarkerPayloadSha256": marker_payload_sha256,
            "intentPath": str(intent_path),
            "intentSha256": hashlib.sha256(intent_bytes).hexdigest(),
        }

    def recover_all_knowledge_acceptance_transactions_boundary(
        self,
    ) -> tuple[Path, ...]:
        """Restore every markerless preaccept pointer to its exact prior bytes."""

        stores = (self.primary_store, *self.replica_stores)
        _session_id_t, canonical_session_root = (
            self.primary_store._require_session()
        )
        transaction_root = (
            canonical_session_root / "acceptance_transactions"
        )
        if not transaction_root.is_dir():
            return ()
        recovered: list[Path] = []
        for intent_path in sorted(transaction_root.glob("*.intent.json")):
            if intent_path.is_symlink():
                raise RuntimeError(
                    "NoNE all-knowledge transaction intent is a symlink"
                )
            intent = _read_json(intent_path)
            transaction_sha256 = intent.get("transactionSha256")
            marker_path_value = intent.get("canonicalCommitMarkerPath")
            marker_payload_sha256 = intent.get(
                "canonicalCommitMarkerPayloadSha256"
            )
            prior_rows = intent.get("priorPointers")
            if (
                intent.get("schema")
                != ALL_KNOWLEDGE_ACCEPTANCE_TRANSACTION_SCHEMA
                or not _valid_sha256_boundary(transaction_sha256)
                or intent_path.name
                != f"{transaction_sha256}.intent.json"
                or not isinstance(marker_path_value, str)
                or not _valid_sha256_boundary(marker_payload_sha256)
                or not isinstance(prior_rows, list)
                or len(prior_rows) != len(stores)
            ):
                raise RuntimeError(
                    "NoNE all-knowledge transaction intent differs"
                )
            marker_path = Path(
                marker_path_value
            ).expanduser().resolve()
            transaction_core = dict(intent)
            transaction_core.pop("transactionSha256", None)
            transaction_core.pop("canonicalCommitMarkerPath", None)
            transaction_core.pop(
                "canonicalCommitMarkerPayloadSha256",
                None,
            )
            if (
                hashlib.sha256(
                    _canonical_json_bytes(transaction_core)
                ).hexdigest()
                != transaction_sha256
                or marker_path
                != (
                    transaction_root
                    / f"{transaction_sha256}.commit.json"
                ).resolve()
            ):
                raise RuntimeError(
                    "NoNE all-knowledge transaction intent changed"
                )
            if marker_path.exists():
                marker = _read_json(marker_path)
                if (
                    marker_path.is_symlink()
                    or not marker_path.is_file()
                    or hashlib.sha256(
                        _canonical_json_bytes(marker)
                    ).hexdigest()
                    != marker_payload_sha256
                    or marker.get("schema")
                    != ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA
                    or marker.get("passed") is not True
                    or marker.get("transactionSha256")
                    != transaction_sha256
                ):
                    raise RuntimeError(
                        "NoNE all-knowledge commit marker changed"
                    )
                continue
            prior_by_root = {
                row.get("storeRoot"): row
                for row in prior_rows
                if isinstance(row, dict)
            }
            if set(prior_by_root) != {
                str(store.root) for store in stores
            }:
                raise RuntimeError(
                    "NoNE all-knowledge recovery topology differs"
                )
            self.acquire_generation_writer_leases_boundary()
            rollback_failed = False
            try:
                for store in stores:
                    row = prior_by_root[str(store.root)]
                    raw_bytes_value = row.get("rawBytesBase64")
                    raw_sha256 = row.get("rawBytesSha256")
                    payload_sha256 = row.get("payloadSha256")
                    pointer_path_value = row.get("pointerPath")
                    if (
                        not isinstance(raw_bytes_value, str)
                        or not _valid_sha256_boundary(raw_sha256)
                        or not _valid_sha256_boundary(payload_sha256)
                        or not isinstance(pointer_path_value, str)
                    ):
                        raise RuntimeError(
                            "NoNE all-knowledge recovery pointer differs"
                        )
                    try:
                        raw_bytes = base64.b64decode(
                            raw_bytes_value,
                            validate=True,
                        )
                    except Exception as error:
                        raise RuntimeError(
                            "NoNE all-knowledge recovery bytes differ"
                        ) from error
                    _store_session_id_t, session_root = (
                        store._require_session()
                    )
                    pointer_path = session_root / "accepted.json"
                    if (
                        Path(pointer_path_value).expanduser().resolve()
                        != pointer_path.resolve()
                        or hashlib.sha256(raw_bytes).hexdigest()
                        != raw_sha256
                    ):
                        raise RuntimeError(
                            "NoNE all-knowledge recovery pointer differs"
                        )
                    try:
                        prior_record = json.loads(raw_bytes)
                    except (UnicodeDecodeError, json.JSONDecodeError) as error:
                        raise RuntimeError(
                            "NoNE all-knowledge recovery pointer differs"
                        ) from error
                    if (
                        not isinstance(prior_record, dict)
                        or hashlib.sha256(
                            _canonical_json_bytes(prior_record)
                        ).hexdigest()
                        != payload_sha256
                    ):
                        raise RuntimeError(
                            "NoNE all-knowledge recovery pointer differs"
                        )
                    current_raw = _read_json(pointer_path)
                    current_visibility = current_raw.get(
                        "acceptanceTransaction"
                    )
                    if current_visibility is not None and (
                        not isinstance(current_visibility, dict)
                        or current_visibility.get("transactionSha256")
                        != transaction_sha256
                    ):
                        raise RuntimeError(
                            "NoNE all-knowledge recovery found another "
                            "transaction"
                        )
                    _atomic_replace_bytes_boundary(
                        pointer_path,
                        raw_bytes,
                    )
                    if pointer_path.read_bytes() != raw_bytes:
                        raise RuntimeError(
                            "NoNE all-knowledge recovery bytes differ"
                        )
                    store._accepted_pointer_identity_boundary = None
                    store._accepted_manifest_identity_boundary = None
                    restored = store.discover_accepted_pointer_boundary()
                    if (
                        int(restored.generation_t)
                        != prior_record.get("generation")
                        or restored.manifest_relative_path
                        != prior_record.get("manifest")
                        or _tensor_digest_hex(
                            restored.manifest_sha256_t
                        )
                        != prior_record.get("manifestSha256")
                        or _tensor_digest_hex(
                            restored.manifest_payload_sha256_t
                        )
                        != prior_record.get(
                            "manifestPayloadSha256"
                        )
                    ):
                        raise RuntimeError(
                            "NoNE all-knowledge recovery pointer differs"
                        )
                rollback_path = transaction_root / (
                    f"{transaction_sha256}.rollback.json"
                )
                _atomic_json(
                    rollback_path,
                    {
                        "schema": (
                            ALL_KNOWLEDGE_ACCEPTANCE_ROLLBACK_SCHEMA
                        ),
                        "passed": True,
                        "transactionSha256": transaction_sha256,
                        "restoredStoreRoots": [
                            str(store.root) for store in stores
                        ],
                        "canonicalPointerUnchanged": True,
                    },
                )
                recovered.append(rollback_path)
            except Exception:
                rollback_failed = True
                raise
            finally:
                for store in reversed(
                    tuple(
                        sorted(stores, key=lambda value: str(value.root))
                    )
                ):
                    store._release_generation_writer_boundary()
                if rollback_failed:
                    self._staged_bindings = None
        return tuple(recovered)

    def stage_generation_from_page_objects_boundary(
        self,
        *,
        updated_page_objects: tuple[NoNEPageObjectBinding, ...],
        components: NoNEGenerationComponentPacket,
        shared_compact_object_roots: tuple[Path, ...] = (),
        training_proven_page_ids_t: torch.Tensor | None = None,
        direct_page_pack_set_authority: Mapping[str, Any] | None = None,
    ) -> NoNEGenerationBinding:
        """Stage one bounded-memory generation across coherent stores.

        ``shared_compact_object_roots`` is an immutable content-addressed
        overlay used only while admitting preallocated compact historical
        capacity. A reconciled final union must leave this empty and physically
        replicate every revision-2/3/7 direct safetensor beneath each accepting
        store.
        """

        self.synchronize_to_primary_boundary()
        if not updated_page_objects:
            raise ValueError("NoNE replicated generation has no updated objects")
        stores = (self.primary_store, *self.replica_stores)
        if (
            direct_page_pack_set_authority is not None
            and shared_compact_object_roots
        ):
            raise RuntimeError(
                "NoNE direct page pack-set cannot use a compact overlay"
            )
        if shared_compact_object_roots:
            for store in stores:
                store.register_overlay_object_roots(
                    shared_compact_object_roots
                )
                store.register_receipt_verified_overlay_objects_boundary(
                    updated_page_objects
                )
        elif direct_page_pack_set_authority is None:
            for replica in self.replica_stores:
                replica.replicate_page_objects_from_boundary(
                    self.primary_store,
                    updated_page_objects,
                )
        updated_page_ids_t = torch.stack(
            tuple(
                page_object.page_id_t.detach()
                .cpu()
                .long()
                .reshape(())
                for page_object in updated_page_objects
            )
        )
        accepted_page_ids_t = (
            self.primary_store.accepted_page_ids_t_boundary()
        )
        complete_local_direct_map = bool(
            direct_page_pack_set_authority is not None
            or (
                not shared_compact_object_roots
                and torch.unique(updated_page_ids_t).numel()
                == updated_page_ids_t.numel()
                and bool(
                    _page_ids_subset_t_boundary(
                        accepted_page_ids_t,
                        updated_page_ids_t,
                    )
                )
            )
        )
        if direct_page_pack_set_authority is not None:
            page_rows = [
                {
                    "pageId": int(binding.page_id_t),
                    "sha256": _tensor_digest_hex(
                        binding.object_sha256_t
                    ),
                    "bytes": int(binding.object_bytes_t),
                }
                for binding in updated_page_objects
            ]
            for store in stores:
                pack = (
                    store._local_direct_page_pack_set_authority_boundary(
                        {
                            "pageObjects": page_rows,
                            "directPagePackSetAuthority": dict(
                                direct_page_pack_set_authority
                            ),
                        }
                    )
                )
                if pack is None:
                    raise RuntimeError(
                        "NoNE local direct pack-set replica is absent"
                    )
        elif complete_local_direct_map:
            try:
                self._require_local_reconciled_direct_page_map_boundary(
                    updated_page_objects
                )
            except (FileNotFoundError, RuntimeError, ValueError):
                complete_local_direct_map = False
        next_generation_t = torch.stack(
            tuple(store.next_generation_t_boundary() for store in stores)
        ).amax()
        staged_bindings: list[NoNEGenerationBinding] = []
        try:
            for store in stores:
                if complete_local_direct_map:
                    store._acquire_generation_writer_boundary()
                    staged_binding = (
                        store._stage_generation_from_page_objects_locked_boundary(
                            updated_page_objects=updated_page_objects,
                            prevalidated_updated_rows=None,
                            components=components,
                            expected_generation_t=next_generation_t,
                            training_proven_page_ids_t=(
                                training_proven_page_ids_t
                            ),
                            require_direct_page_map_authority=True,
                            direct_page_pack_set_authority=(
                                direct_page_pack_set_authority
                            ),
                        )
                    )
                else:
                    staged_binding = (
                        store.stage_generation_from_page_objects_boundary(
                            updated_page_objects=updated_page_objects,
                            components=components,
                            expected_generation_t=next_generation_t,
                            training_proven_page_ids_t=(
                                training_proven_page_ids_t
                            ),
                            direct_page_pack_set_authority=(
                                direct_page_pack_set_authority
                            ),
                        )
                    )
                staged_bindings.append(
                    staged_binding
                )
        except Exception:
            for store in stores:
                store.discard_staged_generation_boundary()
            raise
        bindings = tuple(staged_bindings)
        primary = bindings[0]
        if not all(
            self._same_binding(primary, binding)
            and torch.equal(
                primary.updated_page_ids_t,
                binding.updated_page_ids_t,
            )
            and torch.equal(
                primary.parent_generation_t,
                binding.parent_generation_t,
            )
            for binding in bindings[1:]
        ):
            for store in stores:
                store.discard_staged_generation_boundary()
            self._staged_bindings = None
            raise RuntimeError("NoNE staged object replica generation differs")
        self._staged_bindings = bindings
        return primary

    def _accept_direct_staged_generation_transaction_boundary(
        self,
        *,
        staged: tuple[NoNEGenerationBinding, ...],
        graph_authority: NoNEGraphAuthorityBinding | None,
        resident_page_ids_t: torch.Tensor | None,
        retained_checkpoint_sha256_t: torch.Tensor | None,
    ) -> dict[str, Any]:
        """Atomically expose one self-contained direct map on every store."""

        stores = (self.primary_store, *self.replica_stores)
        pointer_write_stores = (*self.replica_stores, self.primary_store)
        prior_pointer_bytes: dict[NoNEImmutablePageStore, bytes] = {}
        prior_pointer_records: dict[
            NoNEImmutablePageStore, dict[str, Any]
        ] = {}
        target_pointer_records: dict[
            NoNEImmutablePageStore, dict[str, Any]
        ] = {}
        validated: dict[
            NoNEImmutablePageStore,
            tuple[
                NoNEGenerationBinding,
                dict[str, Any],
                NoNEGraphAuthorityBinding | None,
            ],
        ] = {}
        fill_trace_state: dict[
            NoNEImmutablePageStore,
            tuple[frozenset[int], int],
        ] = {}
        for store, store_binding in zip(stores, staged, strict=True):
            fill_trace_state[store] = (
                store._accepted_parent_page_ids_for_fill_trace(),
                int(store._accepted_generation_t),
            )
            _session_id_t, session_root = store._require_session()
            accepted_path = session_root / "accepted.json"
            prior_pointer_bytes[store] = accepted_path.read_bytes()
            prior_pointer_records[store] = (
                _visible_accepted_pointer_record_boundary(accepted_path)
            )
            loaded, manifest, verified_graph = (
                store._validated_staged_generation_acceptance_boundary(
                    store_binding,
                    graph_authority,
                )
            )
            if (
                store._validated_manifest_direct_page_map_authority_boundary(
                    manifest
                )
                is None
            ):
                raise RuntimeError(
                    "NoNE replica direct acceptance lost direct-map authority"
                )
            store._record_validated_accepted_direct_page_map_boundary(
                generation_binding=loaded,
                generation_manifest=manifest,
            )
            validated[store] = (loaded, manifest, verified_graph)
            target_pointer_records[store] = (
                store.accepted_pointer_record_boundary(
                    loaded,
                    verified_graph,
                )
            )

        canonical_session_id_t, canonical_session_root = (
            self.primary_store._require_session()
        )
        target_pointer_sha256s = {
            str(store.root): hashlib.sha256(
                _canonical_json_bytes(target_pointer_records[store])
            ).hexdigest()
            for store in stores
        }
        transaction_core = {
            "schema": ALL_KNOWLEDGE_ACCEPTANCE_TRANSACTION_SCHEMA,
            "sessionId": canonical_session_id_t.detach()
            .cpu()
            .long()
            .reshape(-1)
            .tolist(),
            "stagedGeneration": staged[0].external_record_boundary(),
            "pointerWriteOrder": [
                str(store.root) for store in pointer_write_stores
            ],
            "canonicalPointerWrittenLast": True,
            "priorPointers": [
                {
                    "storeRoot": str(store.root),
                    "payloadSha256": hashlib.sha256(
                        _canonical_json_bytes(
                            prior_pointer_records[store]
                        )
                    ).hexdigest(),
                    "rawBytesSha256": hashlib.sha256(
                        prior_pointer_bytes[store]
                    ).hexdigest(),
                    "rawBytesBase64": base64.b64encode(
                        prior_pointer_bytes[store]
                    ).decode("ascii"),
                }
                for store in stores
            ],
            "targetPointerPayloadSha256s": target_pointer_sha256s,
        }
        transaction_sha256 = hashlib.sha256(
            _canonical_json_bytes(transaction_core)
        ).hexdigest()
        transaction_root = (
            canonical_session_root
            / "replica_direct_acceptance_transactions"
        )
        intent_path = transaction_root / (
            f"{transaction_sha256}.intent.json"
        )
        marker_path = transaction_root / (
            f"{transaction_sha256}.commit.json"
        )
        marker = {
            "schema": ALL_KNOWLEDGE_ACCEPTANCE_COMMIT_MARKER_SCHEMA,
            "passed": True,
            "transactionSha256": transaction_sha256,
            "stagedGeneration": staged[0].external_record_boundary(),
            "targetPointerPayloadSha256s": target_pointer_sha256s,
            "pointerWriteOrder": transaction_core["pointerWriteOrder"],
            "canonicalPointerWrittenLast": True,
            "durabilityComplete": self.durability_complete,
            "directPageMapAuthority": (
                validated[self.primary_store][1][
                    "directPageMapAuthority"
                ]
            ),
        }
        marker_payload_sha256 = hashlib.sha256(
            _canonical_json_bytes(marker)
        ).hexdigest()
        intent = {
            **transaction_core,
            "transactionSha256": transaction_sha256,
            "canonicalCommitMarkerPath": str(marker_path),
            "canonicalCommitMarkerPayloadSha256": (
                marker_payload_sha256
            ),
        }
        _atomic_json(intent_path, intent)
        for store in stores:
            loaded, manifest, _verified_graph = validated[store]
            store._persist_accepted_direct_page_map_frontier_boundary(
                generation_binding=loaded,
                generation_manifest=manifest,
                acceptance_commit_marker={
                    "path": str(marker_path),
                    "sha256": marker_payload_sha256,
                    "transactionSha256": transaction_sha256,
                    "storeRoot": str(store.root),
                    "targetPointerPayloadSha256": (
                        target_pointer_sha256s[str(store.root)]
                    ),
                },
            )

        marker_written = False
        try:
            for store in pointer_write_stores:
                _session_id_t, session_root = store._require_session()
                history_root = session_root / "accepted_authorities"
                history_root.mkdir(parents=True, exist_ok=True)
                for record in (
                    prior_pointer_records[store],
                    target_pointer_records[store],
                ):
                    history_path = (
                        _accepted_authority_history_path_boundary(
                            session_root,
                            record,
                        )
                    )
                    if history_path.is_file():
                        if _read_json(history_path) != record:
                            raise RuntimeError(
                                "NoNE replica direct accepted history changed"
                            )
                    else:
                        _atomic_json(history_path, record)
                prior_record = prior_pointer_records[store]
                target_record = target_pointer_records[store]
                wrapper = {
                    **target_record,
                    "acceptanceTransaction": {
                        "schema": (
                            ALL_KNOWLEDGE_ACCEPTANCE_POINTER_VISIBILITY_SCHEMA
                        ),
                        "transactionSha256": transaction_sha256,
                        "storeRoot": str(store.root),
                        "canonicalCommitMarkerPath": str(marker_path),
                        "canonicalCommitMarkerPayloadSha256": (
                            marker_payload_sha256
                        ),
                        "priorPointer": prior_record,
                        "priorPointerPayloadSha256": hashlib.sha256(
                            _canonical_json_bytes(prior_record)
                        ).hexdigest(),
                        "targetPointerPayloadSha256": (
                            target_pointer_sha256s[str(store.root)]
                        ),
                    },
                }
                accepted_path = session_root / "accepted.json"
                _atomic_json(accepted_path, wrapper)
                if (
                    _visible_accepted_pointer_record_boundary(
                        accepted_path
                    )
                    != prior_record
                ):
                    raise RuntimeError(
                        "NoNE replica direct pointer became visible before "
                        "its commit marker"
                    )
            self.synchronize_to_primary_boundary()
            _atomic_json(marker_path, marker)
            marker_written = True
            for store in stores:
                loaded, manifest, _verified_graph = validated[store]
                store._accepted_pointer_identity_boundary = None
                store._accepted_manifest_identity_boundary = None
                discovered = store.discover_accepted_pointer_boundary()
                if not _same_generation_binding_boundary(
                    discovered,
                    loaded,
                ):
                    raise RuntimeError(
                        "NoNE replica direct committed pointer differs"
                    )
                store._staged_immutable_parent_binding = None
                store._staged_immutable_parent_manifest_identity = None
                store._rebind_resident_graph_after_authority_move_boundary(
                    manifest
                )
            if retained_checkpoint_sha256_t is not None:
                assert graph_authority is not None
                assert resident_page_ids_t is not None
                for store in stores:
                    store.adopt_written_graph_authority_boundary(
                        graph_authority=graph_authority,
                        page_ids_t=resident_page_ids_t,
                        retained_checkpoint_sha256_t=(
                            retained_checkpoint_sha256_t
                        ),
                    )
        except Exception:
            if not marker_written:
                rollback_failed = False
                for store in stores:
                    try:
                        _session_id_t, session_root = (
                            store._require_session()
                        )
                        accepted_path = session_root / "accepted.json"
                        _atomic_replace_bytes_boundary(
                            accepted_path,
                            prior_pointer_bytes[store],
                        )
                        store._accepted_pointer_identity_boundary = None
                        store._accepted_manifest_identity_boundary = None
                        store._clear_accepted_direct_page_map_cache_boundary()
                        restored = (
                            store.discover_accepted_pointer_boundary()
                        )
                        prior_record = prior_pointer_records[store]
                        if (
                            accepted_path.read_bytes()
                            != prior_pointer_bytes[store]
                            or int(restored.generation_t)
                            != prior_record.get("generation")
                            or restored.manifest_relative_path
                            != prior_record.get("manifest")
                        ):
                            raise RuntimeError(
                                "NoNE replica direct rollback differs"
                            )
                    except Exception:
                        rollback_failed = True
                try:
                    self.synchronize_to_primary_boundary()
                except Exception:
                    rollback_failed = True
                if rollback_failed:
                    raise RuntimeError(
                        "NoNE replica direct accept failed and rollback "
                        "was incomplete"
                    )
                self._staged_bindings = staged
            raise
        finally:
            for store in reversed(
                tuple(sorted(stores, key=lambda value: str(value.root)))
            ):
                store._release_generation_writer_boundary()

        self._staged_bindings = None
        primary_pointer = target_pointer_records[self.primary_store]
        for store, store_binding in zip(stores, staged, strict=True):
            parent_page_ids, parent_generation = fill_trace_state[store]
            store._record_accepted_page_fill_trace_boundary(
                binding=store_binding,
                pointer=target_pointer_records[store],
                updated_page_ids=tuple(
                    store_binding.updated_page_ids_t.detach()
                    .cpu()
                    .long()
                    .reshape(-1)
                    .tolist()
                ),
                parent_page_ids=parent_page_ids,
                parent_generation=parent_generation,
            )
        return primary_pointer

    def accept_staged_generation(
        self,
        binding: NoNEGenerationBinding,
        graph_authority: NoNEGraphAuthorityBinding | None = None,
        resident_page_ids_t: torch.Tensor | None = None,
        retained_checkpoint_sha256_t: torch.Tensor | None = None,
    ) -> dict[str, Any]:
        """Accept all staged copies, advancing canonical authority last."""

        staged = self._staged_bindings
        if staged is None or not self._same_binding(staged[0], binding):
            raise RuntimeError("NoNE replicated staged generation is absent")
        if retained_checkpoint_sha256_t is None:
            if resident_page_ids_t is not None:
                raise RuntimeError("NoNE resident graph adoption is incomplete")
        elif (
            graph_authority is None
            or resident_page_ids_t is None
            or not torch.equal(
                retained_checkpoint_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
                graph_authority.checkpoint_sha256_t.detach()
                .cpu()
                .to(dtype=torch.uint8),
            )
        ):
            raise RuntimeError("NoNE resident graph adoption is incomplete")
        _primary_loaded, primary_manifest = (
            self.primary_store._load_generation_binding_boundary(
                staged[0].manifest_relative_path,
                expected_manifest_sha256=_tensor_digest_hex(
                    staged[0].manifest_sha256_t
                ),
                expected_payload_sha256=_tensor_digest_hex(
                    staged[0].manifest_payload_sha256_t
                ),
            )
        )
        if (
            self.primary_store._validated_manifest_direct_page_map_authority_boundary(
                primary_manifest
            )
            is not None
        ):
            return self._accept_direct_staged_generation_transaction_boundary(
                staged=staged,
                graph_authority=graph_authority,
                resident_page_ids_t=resident_page_ids_t,
                retained_checkpoint_sha256_t=(
                    retained_checkpoint_sha256_t
                ),
            )
        prior = self.primary_store.current_generation_binding_boundary()
        stores = (self.primary_store, *self.replica_stores)
        prior_resident = tuple(
            (
                store._resident_checkpoint_sha256,
                store._resident_composition_sha256,
                (
                    None
                    if store._resident_page_ids_t is None
                    else store._resident_page_ids_t.clone()
                ),
            )
            for store in stores
        )
        try:
            for store, replica_binding in zip(
                self.replica_stores,
                staged[1:],
                strict=True,
            ):
                store.accept_staged_generation(
                    replica_binding,
                    graph_authority,
                )
            pointer = self.primary_store.accept_staged_generation(
                staged[0],
                graph_authority,
            )
            if retained_checkpoint_sha256_t is not None:
                assert graph_authority is not None
                assert resident_page_ids_t is not None
                for store in stores:
                    store.adopt_written_graph_authority_boundary(
                        graph_authority=graph_authority,
                        page_ids_t=resident_page_ids_t,
                        retained_checkpoint_sha256_t=(
                            retained_checkpoint_sha256_t
                        ),
                    )
            self.synchronize_to_primary_boundary()
        except Exception:
            for store, resident in zip(stores, prior_resident, strict=True):
                store._resident_checkpoint_sha256 = resident[0]
                store._resident_composition_sha256 = resident[1]
                store._resident_page_ids_t = resident[2]
            try:
                self.checkout_generation_boundary(prior)
            except Exception as rollback_error:
                raise RuntimeError(
                    "NoNE replica accept failed and rollback was incomplete"
                ) from rollback_error
            raise
        self._staged_bindings = None
        return pointer

    def checkout_generation_boundary(
        self,
        binding: NoNEGenerationBinding,
    ) -> NoNEGenerationBinding:
        """Rebind every pointer to one checkpoint-owned generation."""

        prior = self.primary_store.current_generation_binding_boundary()
        moved_replicas: list[NoNEImmutablePageStore] = []
        try:
            for store in self.replica_stores:
                checked_out = self._checkout(store, binding)
                if not self._same_binding(checked_out, binding):
                    raise RuntimeError("NoNE replica checkout identity differs")
                moved_replicas.append(store)
            primary = self._checkout(self.primary_store, binding)
        except Exception:
            for store in moved_replicas:
                self._checkout(store, prior)
            self._staged_bindings = None
            raise
        self._staged_bindings = None
        self.synchronize_to_primary_boundary()
        return primary

    def discard_staged_generation_boundary(self) -> None:
        """Forget staged bindings without changing any accepted pointer."""

        for store in (self.primary_store, *self.replica_stores):
            store.discard_staged_generation_boundary()
        self._staged_bindings = None
        self._all_knowledge_replica_candidate = None
        self._all_knowledge_physical_replica_measurement = None


def project_all_knowledge_generation_187_parent_boundary(
    *,
    source_store: NoNEImmutablePageStore,
    destination_store: NoNEImmutablePageStore,
    session_id_t: torch.Tensor,
) -> dict[str, Any]:
    """Clone only generation-187 ancestry into an undiscoverable work store.

    This is a disposable lineage projection, not an accepted all-knowledge
    result.  Historical revision-6 objects remain readable from the source
    object root only while the complete revision-2/3/7 successor is prepared.
    No page object is copied, linked, or credited by this boundary.
    """

    if not isinstance(source_store, NoNEImmutablePageStore) or not isinstance(
        destination_store,
        NoNEImmutablePageStore,
    ):
        raise TypeError("NoNE generation-187 projection store is malformed")
    resolved_session_id_t = (
        session_id_t.detach().cpu().to(dtype=torch.long).reshape(-1)
    )
    if resolved_session_id_t.numel() < 1:
        raise ValueError("NoNE generation-187 projection session is empty")
    if source_store.root == destination_store.root:
        raise RuntimeError(
            "NoNE generation-187 projection source equals destination"
        )
    if destination_store._advertise_locator:
        raise RuntimeError(
            "NoNE generation-187 projection destination is discoverable"
        )
    source_session_id_t, source_session_root = source_store._require_session()
    if not torch.equal(source_session_id_t, resolved_session_id_t):
        raise RuntimeError(
            "NoNE generation-187 projection source session differs"
        )
    locator_root = destination_store.root / ".nnf-resynthesis/page-stores"
    if locator_root.exists() or locator_root.is_symlink():
        raise RuntimeError(
            "NoNE generation-187 projection destination was advertised"
        )

    def immutable_tree_identity(
        roots: tuple[Path, ...],
    ) -> tuple[tuple[str, int, int, int, int, int, int, int], ...]:
        rows: list[tuple[str, int, int, int, int, int, int, int]] = []
        for root in roots:
            resolved_root = root.resolve()
            if root.is_symlink() or not resolved_root.is_dir():
                raise RuntimeError(
                    "NoNE generation-187 projection tree differs"
                )
            for directory, directory_names, file_names in os.walk(
                resolved_root,
                followlinks=False,
            ):
                directory_path = Path(directory)
                for name in (*directory_names, *file_names):
                    path = directory_path / name
                    identity = path.lstat()
                    if stat.S_ISLNK(identity.st_mode):
                        raise RuntimeError(
                            "NoNE generation-187 projection found a symlink"
                        )
                    rows.append(
                        (
                            str(path.relative_to(resolved_root)),
                            identity.st_mode,
                            identity.st_size,
                            identity.st_dev,
                            identity.st_ino,
                            identity.st_nlink,
                            identity.st_mtime_ns,
                            identity.st_ctime_ns,
                        )
                    )
        return tuple(sorted(rows))

    destination_object_identity_before = immutable_tree_identity(
        (destination_store.objects_root,)
    )
    destination_session_root = (
        destination_store.sessions_root / _session_key(resolved_session_id_t)
    )
    destination_session_preexisting = destination_session_root.exists()
    session_entries = tuple(destination_store.sessions_root.iterdir())
    if (
        any(entry != destination_session_root for entry in session_entries)
        or (
            destination_session_preexisting
            and (
                destination_session_root.is_symlink()
                or not destination_session_root.is_dir()
            )
        )
    ):
        raise RuntimeError(
            "NoNE generation-187 projection destination metadata is nonempty"
        )
    destination_preexisting_paths: set[str] = set()
    destination_prepared_file_identity_before: dict[
        str,
        _FileIdentity,
    ] = {}
    if destination_session_preexisting:
        for path in destination_session_root.rglob("*"):
            if path.is_symlink():
                raise RuntimeError(
                    "NoNE generation-187 projection found a symlink"
                )
            relative_entry_name = str(
                path.relative_to(destination_session_root)
            )
            destination_preexisting_paths.add(relative_entry_name)
            if path.is_file():
                destination_prepared_file_identity_before[
                    relative_entry_name
                ] = _file_identity(path)
        generations_root = destination_session_root / "generations"
        if (
            (destination_session_root / "accepted.json").exists()
            or (
                generations_root.exists()
                and (
                    not generations_root.is_dir()
                    or any(generations_root.iterdir())
                )
            )
        ):
            raise RuntimeError(
                "NoNE generation-187 projection destination is not empty"
            )
    destination_store.begin_session(resolved_session_id_t)
    _destination_session_id_t, destination_session_root = (
        destination_store._require_session()
    )
    if not torch.equal(
        _destination_session_id_t,
        resolved_session_id_t,
    ):
        raise RuntimeError(
            "NoNE generation-187 projection destination session differs"
        )
    generations_root = destination_session_root / "generations"
    if (
        (destination_session_root / "accepted.json").exists()
        or any(generations_root.iterdir())
    ):
        raise RuntimeError(
            "NoNE generation-187 projection destination is not empty"
        )

    stores = tuple(
        sorted(
            (source_store, destination_store),
            key=lambda value: str(value.root),
        )
    )
    acquired: list[NoNEImmutablePageStore] = []
    projection_passed = False
    try:
        for store in stores:
            store._acquire_generation_writer_boundary()
            acquired.append(store)

        source_binding = source_store.current_generation_binding_boundary()
        source_graph = source_store.current_graph_authority_boundary()
        if (
            int(source_binding.generation_t) != 187
            or source_graph is None
        ):
            raise RuntimeError(
                "NoNE disposable parent is not exact generation 187"
            )
        source_graph_record = source_graph.external_record_boundary()
        source_pointer_path = source_session_root / "accepted.json"
        source_pointer_identity = _file_identity(source_pointer_path)
        source_pointer_bytes = source_pointer_path.read_bytes()
        source_pointer = _visible_accepted_pointer_record_boundary(
            source_pointer_path
        )
        if (
            source_pointer.get("generation") != 187
            or source_pointer.get("manifest")
            != source_binding.manifest_relative_path
            or source_pointer.get("manifestSha256")
            != _tensor_digest_hex(source_binding.manifest_sha256_t)
            or source_pointer.get("manifestPayloadSha256")
            != _tensor_digest_hex(
                source_binding.manifest_payload_sha256_t
            )
        ):
            raise RuntimeError(
                "NoNE generation-187 accepted pointer differs"
            )

        manifest_index: dict[
            tuple[int, str],
            tuple[Path, bytes, dict[str, Any]],
        ] = {}
        source_generations_root = source_session_root / "generations"
        for manifest_path in sorted(
            source_generations_root.rglob("generation.json")
        ):
            resolved_manifest_path = manifest_path.resolve()
            if (
                manifest_path.is_symlink()
                or not resolved_manifest_path.is_relative_to(
                    source_session_root.resolve()
                )
                or not resolved_manifest_path.is_file()
            ):
                raise RuntimeError(
                    "NoNE generation-187 manifest path differs"
                )
            raw_bytes = resolved_manifest_path.read_bytes()
            try:
                manifest = json.loads(raw_bytes)
            except (
                UnicodeDecodeError,
                json.JSONDecodeError,
            ) as error:
                raise RuntimeError(
                    "NoNE generation-187 manifest bytes differ"
                ) from error
            if not isinstance(manifest, dict):
                raise RuntimeError(
                    "NoNE generation-187 manifest bytes differ"
                )
            generation = manifest.get("generation")
            payload_sha256 = manifest.get(
                "manifestPayloadSha256"
            )
            if (
                not page_generation_schema_supported_boundary(
                    manifest.get("schema")
                )
                or manifest.get("sessionKey")
                != _session_key(resolved_session_id_t)
                or not isinstance(generation, int)
                or isinstance(generation, bool)
                or generation < 1
                or not _valid_sha256_boundary(payload_sha256)
                or _manifest_payload_sha256(manifest) != payload_sha256
            ):
                raise RuntimeError(
                    "NoNE generation-187 manifest authority differs"
                )
            key = (generation, cast(str, payload_sha256))
            if key in manifest_index:
                raise RuntimeError(
                    "NoNE generation-187 manifest ancestry is ambiguous"
                )
            manifest_index[key] = (
                resolved_manifest_path,
                raw_bytes,
                manifest,
            )

        chain: list[tuple[Path, bytes, dict[str, Any]]] = []
        generation = 187
        payload_sha256 = _tensor_digest_hex(
            source_binding.manifest_payload_sha256_t
        )
        observed_payloads: set[str] = set()
        while generation > 0:
            if payload_sha256 in observed_payloads:
                raise RuntimeError(
                    "NoNE generation-187 manifest ancestry loops"
                )
            observed_payloads.add(payload_sha256)
            row = manifest_index.get((generation, payload_sha256))
            if row is None:
                raise RuntimeError(
                    "NoNE generation-187 manifest ancestor is absent"
                )
            manifest_path, raw_bytes, manifest = row
            if (
                hashlib.sha256(raw_bytes).hexdigest()
                != (
                    _tensor_digest_hex(source_binding.manifest_sha256_t)
                    if generation == 187
                    else _file_sha256(manifest_path)
                )
            ):
                raise RuntimeError(
                    "NoNE generation-187 manifest bytes changed"
                )
            chain.append(row)
            parent_generation = manifest.get("parentGeneration")
            parent_payload_sha256 = manifest.get(
                "parentManifestPayloadSha256"
            )
            if (
                not isinstance(parent_generation, int)
                or isinstance(parent_generation, bool)
                or parent_generation < 0
                or parent_generation >= generation
            ):
                raise RuntimeError(
                    "NoNE generation-187 parent generation differs"
                )
            if parent_generation == 0:
                break
            if (
                parent_generation != generation - 1
                or not _valid_sha256_boundary(
                    parent_payload_sha256
                )
            ):
                raise RuntimeError(
                    "NoNE generation-187 parent transition differs"
                )
            generation = parent_generation
            payload_sha256 = cast(str, parent_payload_sha256)

        chain_generations = {
            int(manifest["generation"])
            for _path, _bytes, manifest in chain
        }
        if not set(range(152, 188)).issubset(chain_generations):
            raise RuntimeError(
                "NoNE canonical generations 152-187 are incomplete"
            )
        source_tree_identity_before = immutable_tree_identity(
            (source_session_root, source_store.objects_root)
        )

        cloned_rows: list[dict[str, Any]] = []
        for source_path, raw_bytes, manifest in reversed(chain):
            source_relative_path = source_path.relative_to(
                source_session_root.resolve()
            )
            if (
                not source_relative_path.parts
                or source_relative_path.parts[0] != "generations"
                or source_relative_path.name != "generation.json"
            ):
                raise RuntimeError(
                    "NoNE generation-187 manifest location differs"
                )
            destination_path = (
                destination_session_root / source_relative_path
            ).resolve()
            if not destination_path.is_relative_to(
                destination_session_root.resolve()
            ):
                raise RuntimeError(
                    "NoNE generation-187 manifest escaped destination"
                )
            _atomic_bytes(destination_path, raw_bytes)
            if destination_path.read_bytes() != raw_bytes:
                raise RuntimeError(
                    "NoNE generation-187 manifest clone differs"
                )
            cloned_rows.append(
                {
                    "generation": manifest["generation"],
                    "relativePath": str(source_relative_path),
                    "manifestSha256": hashlib.sha256(
                        raw_bytes
                    ).hexdigest(),
                    "manifestPayloadSha256": manifest[
                        "manifestPayloadSha256"
                    ],
                }
            )
        destination_pointer_path = (
            destination_session_root / "accepted.json"
        )
        _atomic_replace_bytes_boundary(
            destination_pointer_path,
            source_pointer_bytes,
        )
        if destination_pointer_path.read_bytes() != source_pointer_bytes:
            raise RuntimeError(
                "NoNE generation-187 accepted pointer clone differs"
            )
        _fsync_directory(destination_session_root)
        destination_store.register_overlay_object_roots(
            (source_store.root,)
        )

        cold_store = NoNEImmutablePageStore(
            destination_store.root,
            object_roots=(source_store.root,),
            advertise_locator=False,
        )
        cold_store.begin_session(resolved_session_id_t)
        cold_binding = cold_store.current_generation_binding_boundary()
        cold_graph = cold_store.current_graph_authority_boundary()
        if (
            not _same_generation_binding_boundary(
                cold_binding,
                source_binding,
            )
            or cold_graph is None
            or cold_graph.external_record_boundary()
            != source_graph_record
            or destination_pointer_path.read_bytes()
            != source_pointer_bytes
            or _visible_accepted_pointer_record_boundary(
                destination_pointer_path
            )
            != source_pointer
        ):
            raise RuntimeError(
                "NoNE generation-187 cold projection differs"
            )

        if (
            _file_identity(source_pointer_path)
            != source_pointer_identity
            or source_pointer_path.read_bytes()
            != source_pointer_bytes
            or immutable_tree_identity(
                (source_session_root, source_store.objects_root)
            )
            != source_tree_identity_before
            or immutable_tree_identity(
                (destination_store.objects_root,)
            )
            != destination_object_identity_before
            or any(
                not (
                    destination_session_root / relative_path
                ).is_file()
                or _file_identity(
                    destination_session_root / relative_path
                )
                != identity
                for relative_path, identity in (
                    destination_prepared_file_identity_before.items()
                )
            )
            or locator_root.exists()
            or locator_root.is_symlink()
        ):
            raise RuntimeError(
                "NoNE generation-187 projection mutated authority"
            )

        chain_record_sha256 = hashlib.sha256(
            _canonical_json_bytes({"manifests": cloned_rows})
        ).hexdigest()
        receipt = {
            "schema": ALL_KNOWLEDGE_PARENT_PROJECTION_SCHEMA,
            "passed": True,
            "historicalOnly": True,
            "finalAcceptedPageAuthority": False,
            "sourceGeneration": 187,
            "sourceStoreRoot": str(source_store.root),
            "destinationStoreRoot": str(destination_store.root),
            "sessionId": resolved_session_id_t.tolist(),
            "generationBinding": (
                source_binding.external_record_boundary()
            ),
            "graphAuthority": source_graph_record,
            "acceptedPointerRawSha256": hashlib.sha256(
                source_pointer_bytes
            ).hexdigest(),
            "manifestChainSha256": chain_record_sha256,
            "manifestCount": len(cloned_rows),
            "canonicalTransitions152Through187": 36,
            "revision6HistoricalEvidenceOnly": True,
            "revision6AcceptedAsFinalObject": False,
            "sourceObjectRootReadOnly": True,
            "objectFilesCopied": 0,
            "objectBytesCopied": 0,
            "objectLinksCreated": 0,
            "sourceMutated": False,
            "destinationPreparedObjectsMutated": False,
            "destinationPreparedMetadataMutated": False,
            "destinationPreparedMetadataFilesPreserved": len(
                destination_prepared_file_identity_before
            ),
            "advertised": False,
            "coldReopenPassed": True,
            "bindingByteExact": True,
            "graphAuthorityByteExact": True,
            "targetEnteredForward": False,
        }
        receipt_path = (
            destination_session_root
            / "all_knowledge_generation_187_parent_projection.json"
        )
        receipt_bytes = (
            json.dumps(
                receipt,
                sort_keys=True,
                indent=2,
            ).encode("utf-8")
            + b"\n"
        )
        _atomic_bytes(receipt_path, receipt_bytes)
        projection_passed = True
        return {
            **receipt,
            "projectionReceipt": {
                "path": str(receipt_path),
                "sha256": hashlib.sha256(receipt_bytes).hexdigest(),
            },
        }
    finally:
        for store in reversed(acquired):
            store._release_generation_writer_boundary()
        if not projection_passed:
            destination_store._session_id_t = None
            destination_store._session_root = None
            destination_store._manifest = None
            destination_store._accepted_binding_boundary = None
            if destination_session_root.is_dir():
                if destination_session_preexisting:
                    added_paths = sorted(
                        (
                            path
                            for path in destination_session_root.rglob("*")
                            if str(
                                path.relative_to(destination_session_root)
                            )
                            not in destination_preexisting_paths
                        ),
                        key=lambda path: len(path.parts),
                        reverse=True,
                    )
                    for path in added_paths:
                        if path.is_symlink() or path.is_file():
                            path.unlink()
                        elif path.is_dir():
                            try:
                                path.rmdir()
                            except OSError:
                                pass
                else:
                    shutil.rmtree(destination_session_root)
                _fsync_directory(destination_store.sessions_root)


def _frontier_active_pair_index(
    frontier_weight_t: torch.Tensor,
) -> torch.Tensor:
    """Materialize the sparse model-selected pair index at the route boundary."""

    if frontier_weight_t.ndim != 2:
        raise ValueError("NoNE page frontier weight geometry differs")
    return frontier_weight_t.gt(0).nonzero(as_tuple=False)


def _dense_frontier_pair_index(
    frontier_weight_t: torch.Tensor,
) -> torch.Tensor:
    """Build an all-pairs index without a dynamic CUDA output shape."""

    if frontier_weight_t.ndim != 2:
        raise ValueError("NoNE page frontier weight geometry differs")
    batch_size, frontier_width = frontier_weight_t.shape
    batch_index_t = torch.arange(
        batch_size,
        device=frontier_weight_t.device,
        dtype=torch.long,
    ).repeat_interleave(frontier_width)
    page_index_t = torch.arange(
        frontier_width,
        device=frontier_weight_t.device,
        dtype=torch.long,
    ).repeat(batch_size)
    return torch.stack((batch_index_t, page_index_t), dim=1)


class NoNEPagedExpertRouter(nn.Module):
    """Resident model-owned routing over an unbounded external page catalog."""

    session_id_t: torch.Tensor
    layer_id_t: torch.Tensor
    page_catalog_ids_t: torch.Tensor
    training_route_cohort_active_t: torch.Tensor
    training_route_cohort_rows_t: torch.Tensor
    training_route_cohort_page_mask_t: torch.Tensor
    _training_route_cohort_boundary_open: bool
    _training_route_cohort_refinement_ready: bool
    _training_route_cohort_catalog_positions_t: torch.Tensor | None

    def __init__(
        self,
        *,
        hidden_size: int,
        action_size: int,
        router_size: int,
        page_count: int,
        layer_id: int,
        session_width: int = 4,
        page_catalog_ids_t: torch.Tensor | None = None,
        activation_fraction: float | None = None,
    ) -> None:
        super().__init__()
        if min(hidden_size, action_size, router_size, page_count) < 1:
            raise ValueError("paged expert router dimensions must be positive")
        self.hidden_size = int(hidden_size)
        self.action_size = int(action_size)
        self.router_size = int(router_size)
        self.page_count = int(page_count)
        resolved_activation_fraction = (
            1.0 / float(page_count)
            if activation_fraction is None
            else float(activation_fraction)
        )
        if not (0.0 < resolved_activation_fraction <= 1.0):
            raise ValueError("NoNE paged activation fraction must be in (0,1]")
        self.hidden_projection = nn.Linear(hidden_size, router_size, bias=False)
        self.action_projection = nn.Linear(action_size, router_size, bias=False)
        self.pathway_projection = nn.Linear(hidden_size, router_size, bias=False)
        self.page_route_keys = nn.Parameter(torch.empty(page_count, router_size))
        self.page_prior = nn.Parameter(torch.zeros(page_count))
        # One page is the compatibility seed, not a cap: task gradients through
        # Quantile Balancing can widen the model-owned frontier to the catalog.
        self.quantile_router = QuantileBalancingRouter(
            page_count,
            activation_fraction=resolved_activation_fraction,
            # The persistent bias is updated on every routed step.  One
            # alternating solve is sufficient for that causal update and
            # avoids five full-catalog quantiles for very large page banks.
            solve_steps=1,
        )
        # MITM route-width bell curve engages once the router knows its branch
        # (gap #1b).  ``frontier_count_t`` reads ``_mitm_branch`` to call
        # ``mitm_route_width_hint``; without this the operator's "force the
        # route range within a bell curve" never fires when the hard-knowledge
        # router boundary is OFF (the default for paged-training launchers).
        # Fail-open to branch 0: a missing/invalid env var must never block
        # routing or page allocation (r152 page-allocation policy: never block
        # training on capacity).
        try:
            self.quantile_router.set_mitm_branch(
                int(os.environ.get("NNF_RESYNTHESIS_TRAINING_BRANCH", "0"))
            )
        except (TypeError, ValueError):
            self.quantile_router.set_mitm_branch(0)
        from resynthesis.anti_systems_bridge import TensorAntiThompsonRegistry

        self._anti_thompson_registry = TensorAntiThompsonRegistry(num_arms=page_count)
        # Bind the runtime outcome registry to the router's persistent tensor.
        # A dynamic attachment would leave a second zero bank behind after a
        # strict cold load, so learned anti-Thompson outcomes would influence
        # routing without belonging to the checkpoint resumed by this runtime.
        self.quantile_router.bind_anti_thompson_registry_boundary(
            self._anti_thompson_registry,
        )
        self.register_buffer(
            "session_id_t",
            torch.zeros(session_width, dtype=torch.long),
            persistent=True,
        )
        self.register_buffer(
            "layer_id_t",
            torch.tensor(layer_id, dtype=torch.long),
            persistent=True,
        )
        catalog_t = (
            torch.arange(page_count, dtype=torch.long)
            if page_catalog_ids_t is None
            else page_catalog_ids_t.detach().reshape(-1).long().clone()
        )
        if catalog_t.shape != (page_count,):
            raise ValueError("NoNE page catalog identity geometry differs")
        if torch.unique(catalog_t).numel() != catalog_t.numel():
            raise ValueError("NoNE page catalog contains duplicate identities")
        self.register_buffer(
            "page_catalog_ids_t",
            catalog_t,
            persistent=True,
        )
        self.register_buffer(
            "training_route_cohort_active_t",
            torch.zeros((), dtype=torch.bool),
            persistent=False,
        )
        self.register_buffer(
            "training_route_cohort_rows_t",
            torch.tensor(
                min(
                    MODEL_OWNED_TRAINING_ROUTE_COHORT_ROWS,
                    MODEL_OWNED_TRAINING_CUDA_WAVE_ROWS,
                ),
                dtype=torch.long,
            ),
            persistent=False,
        )
        self.register_buffer(
            "training_route_cohort_page_mask_t",
            torch.zeros(page_count, dtype=torch.bool),
            persistent=False,
        )
        # These are only boundary-local execution caches.  The model-owned
        # tensor mask remains the route authority; the booleans merely avoid
        # a host scalar read from that CUDA tensor before choosing the already
        # latched refinement computation on later cohort waves.
        self._training_route_cohort_boundary_open = False
        self._training_route_cohort_refinement_ready = False
        self._training_route_cohort_catalog_positions_t = None
        nn.init.xavier_uniform_(self.hidden_projection.weight)
        nn.init.xavier_uniform_(self.action_projection.weight)
        nn.init.xavier_uniform_(self.pathway_projection.weight)
        nn.init.normal_(
            self.page_route_keys,
            mean=0.0,
            std=1.0 / math.sqrt(float(router_size)),
        )

    @torch.no_grad()
    def begin_session(self, session_id_t: torch.Tensor) -> None:
        if session_id_t.shape != self.session_id_t.shape:
            raise ValueError("NoNE page session identity geometry differs")
        self.session_id_t.copy_(session_id_t.to(self.session_id_t))

    @torch.no_grad()
    def begin_training_route_cohort_boundary(self) -> torch.Tensor:
        """Open one model-owned route shared by a complete training cohort."""

        _tensor_assert(
            ~self.training_route_cohort_active_t,
            "NoNE training route cohort is already active",
        )
        self.training_route_cohort_page_mask_t.zero_()
        self.training_route_cohort_active_t.fill_(True)
        self._training_route_cohort_boundary_open = True
        self._training_route_cohort_refinement_ready = False
        self._training_route_cohort_catalog_positions_t = None
        return self.training_route_cohort_active_t.clone()

    @torch.no_grad()
    def end_training_route_cohort_boundary(self) -> torch.Tensor:
        """Release the cohort route only after its accumulated page update."""

        _tensor_assert(
            self.training_route_cohort_active_t,
            "NoNE training route cohort is not active",
        )
        selected_count_t = (
            self.training_route_cohort_page_mask_t.long().sum()
        )
        self.training_route_cohort_page_mask_t.zero_()
        self.training_route_cohort_active_t.zero_()
        self._training_route_cohort_boundary_open = False
        self._training_route_cohort_refinement_ready = False
        self._training_route_cohort_catalog_positions_t = None
        return selected_count_t

    @torch.no_grad()
    def abort_training_route_cohort_boundary(self) -> torch.Tensor:
        """Clear a partially opened cohort without granting selection proof."""

        was_active_t = self.training_route_cohort_active_t.clone()
        self.training_route_cohort_page_mask_t.zero_()
        self.training_route_cohort_active_t.zero_()
        self._training_route_cohort_boundary_open = False
        self._training_route_cohort_refinement_ready = False
        self._training_route_cohort_catalog_positions_t = None
        return was_active_t

    def _latched_training_route_cohort_refinement(
        self,
        query_t: torch.Tensor,
        generation_t: torch.Tensor,
    ) -> NoNEPageRequestPacket:
        """Refine the tensor-latched training cohort without re-routing a catalog.

        The first gradient-bearing wave of a cohort takes the complete native
        quantile route and persists its selected page mask.  Later waves keep
        that exact model-owned identity and only refine the selected pages.
        This is intentionally a cohort refinement boundary: global quantile
        balancing and coverage pressure resume on the next first wave instead
        of being recomputed over every catalog page for each microbatch.
        """

        _tensor_assert(
            self.training_route_cohort_active_t,
            "NoNE training refinement has no active tensor-owned cohort",
        )
        # The global quantile route belongs to the cohort's first wave.  A
        # latched refinement must not reuse its differentiable auxiliary-loss
        # cache after that wave has completed backward.
        self.quantile_router.begin_route_arm_boundary()
        cached_catalog_positions_t = (
            self._training_route_cohort_catalog_positions_t
        )
        if (
            not isinstance(cached_catalog_positions_t, torch.Tensor)
            or cached_catalog_positions_t.ndim != 1
            or cached_catalog_positions_t.numel() < 1
        ):
            raise RuntimeError(
                "NoNE training refinement has no latched model route"
            )
        # The first wave already derived this exact dynamic-width union from
        # the model-owned frontier mask. Re-running ``nonzero`` over the full
        # CUDA catalog on every retained wave forced a host synchronization
        # even though cohort identity cannot change. Reuse the detached tensor
        # index and keep all later refinement computation on device.
        held_catalog_t = cached_catalog_positions_t.to(
            device=query_t.device,
            dtype=torch.long,
        )
        held_route_keys_t = F.normalize(
            self.page_route_keys.index_select(0, held_catalog_t),
            dim=-1,
        )
        logits_t = F.linear(query_t, held_route_keys_t) + self.page_prior.index_select(
            0,
            held_catalog_t,
        )
        coherent_logits_t = logits_t.mean(dim=0, keepdim=True).expand_as(
            logits_t
        )
        learned_temperature_t = self.quantile_router.temperature().to(
            device=coherent_logits_t.device,
            dtype=coherent_logits_t.dtype,
        )
        frontier_weight_t = _stable_model_route_softmax(
            coherent_logits_t,
            learned_temperature_t,
        )
        primary_position_t = frontier_weight_t.argmax(dim=-1)
        page_ids_t = self.page_catalog_ids_t.index_select(0, held_catalog_t)
        selected_probability_t = frontier_weight_t.gather(
            1,
            primary_position_t.unsqueeze(1),
        ).squeeze(1)
        entropy_t = -(
            frontier_weight_t
            * frontier_weight_t.clamp_min(
                torch.finfo(frontier_weight_t.dtype).tiny
            ).log()
        ).sum(dim=-1)
        active_pair_index_t = _dense_frontier_pair_index(frontier_weight_t)
        return NoNEPageRequestPacket(
            session_id_t=self.session_id_t.clone(),
            generation_t=generation_t.reshape(()).long().clone(),
            layer_id_t=self.layer_id_t.clone(),
            page_ids_t=page_ids_t.index_select(0, primary_position_t),
            unique_page_ids_t=page_ids_t,
            unique_page_catalog_positions_t=held_catalog_t,
            page_position_t=primary_position_t,
            route_probability_t=selected_probability_t,
            route_entropy_t=entropy_t,
            frontier_weight_t=frontier_weight_t,
            active_pair_index_t=active_pair_index_t,
        )

    def forward(
        self,
        hidden_t: torch.Tensor,
        action_t: torch.Tensor,
        pathway_t: torch.Tensor,
        generation_t: torch.Tensor,
        route_count_t: torch.Tensor | None = None,
        training_eligible_mask_t: torch.Tensor | None = None,
    ) -> NoNEPageRequestPacket:
        if hidden_t.ndim != 3 or hidden_t.shape[-1] != self.hidden_size:
            raise ValueError("NoNE paged router hidden geometry differs")
        if action_t.shape != (hidden_t.shape[0], self.action_size):
            raise ValueError("NoNE paged router action geometry differs")
        if pathway_t.shape != (hidden_t.shape[0], self.hidden_size):
            raise ValueError("NoNE paged router pathway geometry differs")
        pooled_t = hidden_t.mean(dim=1)
        query_t = F.normalize(
            self.hidden_projection(pooled_t)
            + self.action_projection(action_t)
            + self.pathway_projection(pathway_t),
            dim=-1,
        )
        if self.training and route_count_t is not None:
            if route_count_t.shape not in {
                (self.page_count,),
                (2, self.page_count),
            }:
                raise ValueError("NoNE page route-count geometry differs")
        from resynthesis.hard_knowledge_router_boundary import refresh_hard_knowledge_packet

        refresh_hard_knowledge_packet(self.quantile_router)
        if training_eligible_mask_t is not None:
            if (
                training_eligible_mask_t.shape != (self.page_count,)
                or training_eligible_mask_t.dtype != torch.bool
            ):
                raise ValueError(
                    "NoNE training route eligibility geometry differs"
                )
            training_eligible_mask_t = training_eligible_mask_t.to(
                device=hidden_t.device,
                dtype=torch.bool,
            )
        if (
            self.training
            and torch.is_grad_enabled()
            and route_count_t is not None
            and self._training_route_cohort_boundary_open
            and self._training_route_cohort_refinement_ready
        ):
            return self._latched_training_route_cohort_refinement(
                query_t,
                generation_t,
            )
        # Preserve routing gradients during training. Inference reuses this
        # derived normalization across recurrent hops; every grad-enabled
        # training forward invalidates it before a later evaluation boundary.
        if torch.is_grad_enabled():
            route_keys_t = F.normalize(self.page_route_keys, dim=-1)
            self._cached_normalized_route_keys_t = None
        else:
            cached_route_keys_t = getattr(
                self,
                "_cached_normalized_route_keys_t",
                None,
            )
            if (
                not isinstance(cached_route_keys_t, torch.Tensor)
                or cached_route_keys_t.shape != self.page_route_keys.shape
                or cached_route_keys_t.device != self.page_route_keys.device
                or cached_route_keys_t.dtype != self.page_route_keys.dtype
            ):
                route_keys_t = F.normalize(self.page_route_keys, dim=-1)
                self._cached_normalized_route_keys_t = route_keys_t
            else:
                route_keys_t = cached_route_keys_t
        logits_t = F.linear(query_t, route_keys_t) + self.page_prior
        if (
            self.training
            and torch.is_grad_enabled()
            and route_count_t is not None
            and training_eligible_mask_t is not None
        ):
            # A page-only branch may legitimately see immutable parent pages in
            # the complete catalog, but a gradient wave must retain at least
            # one model-owned page with writable branch scope.  Restricting the
            # score surface with the tensor eligibility mask preserves learned
            # routing and quantile balancing while preventing a late cohort from
            # selecting only frozen parent pages and producing a detached loss.
            eligible_present_t = training_eligible_mask_t.any()
            score_span_t = (
                logits_t.detach().amax(dim=-1, keepdim=True)
                - logits_t.detach().amin(dim=-1, keepdim=True)
                + logits_t.new_ones(())
            )
            eligible_floor_t = (
                logits_t.detach().amin(dim=-1, keepdim=True) - score_span_t
            )
            logits_t = torch.where(
                eligible_present_t,
                torch.where(
                    training_eligible_mask_t.unsqueeze(0),
                    logits_t,
                    eligible_floor_t,
                ),
                logits_t,
            )
        # Module mode and route-count presence are stable call-boundary facts.
        # Select the already resident cohort tensor directly instead of
        # constructing a CUDA bool from a Python predicate on every forward.
        cohort_active_t = (
            self.training_route_cohort_active_t.clone()
            if self.training and route_count_t is not None
            else torch.zeros_like(self.training_route_cohort_active_t)
        )
        # The first microbatch supplies a target-free, learned aggregate route
        # for the cohort. Every later microbatch retains that exact tensor-owned
        # page set, accumulating one standard minibatch gradient before the
        # page-local optimizer/persistence boundary.
        coherent_logits_t = logits_t.mean(dim=0, keepdim=True).expand_as(
            logits_t
        )
        logits_t = torch.where(
            cohort_active_t,
            coherent_logits_t,
            logits_t,
        )
        learned_temperature_t = self.quantile_router.temperature().to(
            device=logits_t.device,
            dtype=logits_t.dtype,
        )
        logits_t = _stable_model_route_logits(
            logits_t,
            learned_temperature_t,
        )
        held_page_mask_t = self.training_route_cohort_page_mask_t.to(
            device=logits_t.device,
            dtype=torch.bool,
        ).clone()
        held_route_active_t = cohort_active_t & held_page_mask_t.any()
        if self.training and route_count_t is not None:
            # Training coverage is a model-owned MILT hill climb.  The
            # intermediary supplies only a coverage stratum: pages with the
            # smallest durable gradient-update count, then the fewest route
            # attempts at that depth.  Learned logits still choose inside that
            # stratum, so MILT never supplies an answer or a host-authored page
            # identity.  Once a selected page produces both a real gradient and
            # a parameter delta, its durable update count rises and this
            # pressure automatically backs out to expose the next undertrained
            # stratum.  That is the reach-level-then-build hill climb rather
            # than a permanent priority list.
            active_coverage_rank_t = route_count_t.detach().to(
                device=logits_t.device,
                dtype=torch.long,
            )
            if active_coverage_rank_t.ndim == 1:
                least_traversed_t = active_coverage_rank_t.eq(
                    active_coverage_rank_t.amin()
                )
            else:
                # Coverage priority is lexicographic and remains entirely
                # model-owned: first prefer the smallest durable gradient
                # update count, then the fewest learned route attempts among
                # pages at that depth.  A selected page whose local gradient
                # is exactly zero can therefore not remain at the minimum and
                # monopolize every later cohort while untouched pages starve.
                gradient_update_rank_t = active_coverage_rank_t[0]
                route_attempt_rank_t = active_coverage_rank_t[1]
                minimum_gradient_mask_t = gradient_update_rank_t.eq(
                    gradient_update_rank_t.amin()
                )
                ranked_route_attempt_t = torch.where(
                    minimum_gradient_mask_t,
                    route_attempt_rank_t,
                    torch.full_like(
                        route_attempt_rank_t,
                        torch.iinfo(torch.long).max,
                    ),
                )
                least_traversed_t = (
                    minimum_gradient_mask_t
                    & route_attempt_rank_t.eq(ranked_route_attempt_t.amin())
                )
            least_traversed_t = least_traversed_t.to(dtype=logits_t.dtype)
            route_bias_t = self.quantile_router.expert_bias_t.detach().to(
                device=logits_t.device,
                dtype=logits_t.dtype,
            )
            # Quantile balancing ranks ``scores - expert_bias_t``. Apply
            # coverage pressure in that exact score domain, then reconstruct
            # the public score expected by the router. Stabilizing the
            # pre-bias score after adding coverage would compress the
            # coverage margin before the persistent bias is subtracted and
            # could let immutable, outside-scope pages starve every eligible
            # page despite their minimum update count.
            post_bias_logits_t = logits_t - route_bias_t.unsqueeze(0)
            score_span_t = (
                post_bias_logits_t.detach().amax(dim=-1, keepdim=True)
                - post_bias_logits_t.detach().amin(dim=-1, keepdim=True)
            )
            coverage_step_t = (
                score_span_t
                + logits_t.new_ones(())
            )
            packet = getattr(self.quantile_router, "_hard_knowledge_packet", None)
            if packet is not None:
                from resynthesis.hard_knowledge_router_boundary import (
                    hard_knowledge_page_logits_boost_t,
                )

                hard_boost_t = hard_knowledge_page_logits_boost_t(
                    packet=packet,
                    post_bias_logits_t=post_bias_logits_t,
                    score_span_t=score_span_t,
                )
                post_bias_logits_t = post_bias_logits_t + hard_boost_t
            # True MILT coverage pressure is model-owned and must be strong
            # enough to close the current learned gap.  The least-trained
            # durable stratum receives one score-span plus a strict margin;
            # after a real gradient/update advances that stratum, the bridge
            # moves to the next under-trained page and ultimately backs out so
            # learned logits regain authority.  A host environment gate or a
            # capped heuristic boost cannot own this routing decision.
            milt_covered_post_bias_logits_t = (
                post_bias_logits_t
                + least_traversed_t.unsqueeze(0) * coverage_step_t
            )
            # External PLA/KLA coverage manifests remain observer evidence.
            # They must never inject page IDs or weights into this hot route:
            # only the tensors resident in the model and its durable page
            # counters own the selection.
            milt_covered_post_bias_logits_t = _stable_model_route_logits(
                milt_covered_post_bias_logits_t,
                learned_temperature_t,
            )
            logits_t = (
                milt_covered_post_bias_logits_t + route_bias_t.unsqueeze(0)
            )
            _tensor_assert(
                torch.isfinite(logits_t).all(),
                "NoNE page coverage produced a nonfinite learned logit",
            )
        # Coverage pressure is computed against the complete catalog. Once a
        # cohort route exists, apply its exact tensor-owned identity last so
        # neither a least-traversed outside page nor a later primary scatter
        # can escape the retained route.
        balance_logits_t = logits_t
        logits_t = torch.where(
            held_route_active_t,
            torch.where(
                held_page_mask_t.unsqueeze(0),
                logits_t,
                logits_t.amin(dim=-1, keepdim=True)
                - torch.ones_like(
                    logits_t,
                ),
            ),
            logits_t,
        )
        if self.training and not torch.is_grad_enabled():
            # Candidate pre/post grading observes a fixed learned router
            # state. Its route still comes from the native quantile tensor
            # computation, but inspection must not write the persistent bias
            # and turn a second identical proof forward into a different
            # page/cache request.
            frontier_probability_t = self.quantile_router.soft_gates(logits_t)
        else:
            frontier_probability_t = self.quantile_router.route(
                logits_t,
                balance_scores_t=balance_logits_t,
            )
        # A retained training cohort owns both page identity and probability
        # support.  The quantile balancer still observes the complete catalog,
        # so its persistent bias can momentarily place every positive gate on
        # an outside page even though ``logits_t`` has already been restricted
        # to the cohort.  Restrict and renormalize that learned probability
        # before selecting the primary.  If the held mass is zero, the
        # learned-temperature logits provide a differentiable model-owned
        # route inside the retained mask; no host page identity or fixed order
        # enters the fallback.
        held_probability_mask_t = held_page_mask_t.unsqueeze(0).expand_as(
            frontier_probability_t
        )
        held_probability_t = frontier_probability_t * held_probability_mask_t.to(
            dtype=frontier_probability_t.dtype
        )
        held_probability_mass_t = held_probability_t.sum(dim=-1, keepdim=True)
        held_logit_probability_t = _stable_model_route_softmax(
            logits_t,
            learned_temperature_t,
        ) * held_probability_mask_t.to(dtype=logits_t.dtype)
        held_logit_probability_t = held_logit_probability_t / (
            held_logit_probability_t.sum(dim=-1, keepdim=True).clamp_min(
                torch.finfo(held_logit_probability_t.dtype).tiny
            )
        )
        normalized_held_probability_t = held_probability_t / torch.where(
            held_probability_mass_t.gt(0),
            held_probability_mass_t,
            torch.ones_like(held_probability_mass_t),
        )
        held_supported_probability_t = torch.where(
            held_probability_mass_t.gt(0),
            normalized_held_probability_t,
            held_logit_probability_t,
        )
        frontier_probability_t = torch.where(
            held_route_active_t,
            held_supported_probability_t,
            frontier_probability_t,
        )
        frontier_probability_t = torch.where(
            torch.isfinite(frontier_probability_t)
            & frontier_probability_t.gt(0),
            frontier_probability_t,
            torch.zeros_like(frontier_probability_t),
        )
        pages = logits_t.shape[-1]
        frontier_mass_t = frontier_probability_t.detach().sum(
            dim=-1,
            keepdim=True,
        )
        _tensor_assert(
            torch.isfinite(logits_t).all(),
            "NoNE page router retained a nonfinite learned logit",
        )
        finite_logits_t = logits_t
        # A learned quantile can close every frontier arm while its activation
        # threshold is adapting.  Preserve a tensor-native route in that state:
        # the learned logits still own the primary page, and no host-authored
        # page ID or fixed fallback order enters the decision.
        primary_index_t = torch.where(
            frontier_mass_t.squeeze(1).gt(0),
            frontier_probability_t.argmax(dim=-1),
            finite_logits_t.argmax(dim=-1),
        )
        frontier_mask_t = frontier_probability_t.detach().gt(0)
        from resynthesis.exploration_floor import (
            EXPLORATION_MIN_TOP_K,
            route_uncertainty_from_mass,
        )

        route_confidence_t = frontier_probability_t.detach().amax(dim=-1)
        uncertain_t = route_uncertainty_from_mass(route_confidence_t)
        learned_width_t = frontier_mask_t.long().sum(dim=-1).clamp_min(1)
        available_width_t = torch.ones_like(learned_width_t) * pages
        fractional_floor_t = torch.div(
            available_width_t + 9,
            10,
            rounding_mode="floor",
        )
        uncertainty_floor_t = torch.minimum(
            available_width_t,
            torch.maximum(
                fractional_floor_t,
                torch.ones_like(available_width_t) * EXPLORATION_MIN_TOP_K,
            ),
        )
        keep_width_t = torch.where(
            uncertain_t,
            torch.maximum(learned_width_t, uncertainty_floor_t),
            learned_width_t,
        )
        # The quantile router's complete positive support is authoritative and
        # is never truncated by a host frontier/cache setting.  When confidence
        # is low, widen that support to max(16, 10% of the live catalog) using
        # the model's own learned logits.  This is a minimum exploration
        # aperture, not a top-k ceiling: every already-selected page survives,
        # and RBO/quantile dynamics may expand all the way to the full catalog.
        learned_rank_probability_t = _stable_model_route_softmax(
            finite_logits_t,
            learned_temperature_t,
        ).detach()
        ranked_index_t = torch.argsort(
            learned_rank_probability_t,
            dim=-1,
            descending=True,
            stable=True,
        )
        rank_t = torch.empty_like(ranked_index_t)
        rank_t.scatter_(
            1,
            ranked_index_t,
            torch.arange(
                pages,
                device=ranked_index_t.device,
                dtype=torch.long,
            )
            .unsqueeze(0)
            .expand_as(ranked_index_t),
        )
        exploration_mask_t = rank_t.lt(keep_width_t.unsqueeze(1))
        frontier_mask_t = frontier_mask_t | (
            uncertain_t.unsqueeze(1) & exploration_mask_t
        )
        # Newly widened exploration arms had zero quantile mass by definition.
        # Give those model-selected logit arms their differentiable learned
        # probability before sparse normalization; otherwise the union mask
        # could name a page whose exact executor weight remained zero.
        learned_exploration_probability_t = _stable_model_route_softmax(
            finite_logits_t,
            learned_temperature_t,
        )
        frontier_probability_t = torch.where(
            frontier_mask_t & ~frontier_probability_t.gt(0),
            learned_exploration_probability_t,
            frontier_probability_t,
        )
        frontier_mask_t.scatter_(1, primary_index_t.unsqueeze(1), True)
        frontier_mask_t = torch.where(
            held_route_active_t,
            held_page_mask_t.unsqueeze(0).expand_as(frontier_mask_t),
            frontier_mask_t,
        )
        with torch.no_grad():
            initialize_cohort_route_t = (
                cohort_active_t
                & ~self.training_route_cohort_page_mask_t.any()
            )
            selected_cohort_mask_t = frontier_mask_t.any(dim=0).to(
                device=self.training_route_cohort_page_mask_t.device,
                dtype=torch.bool,
            )
            self.training_route_cohort_page_mask_t.copy_(
                torch.where(
                    initialize_cohort_route_t,
                    selected_cohort_mask_t,
                    self.training_route_cohort_page_mask_t,
                )
            )
        masked_probability_t = frontier_probability_t * frontier_mask_t.to(
            dtype=frontier_probability_t.dtype
        )
        masked_mass_t = masked_probability_t.sum(dim=-1, keepdim=True)
        primary_hard_probability_t = torch.zeros_like(
            masked_probability_t
        ).scatter(
            1,
            primary_index_t.unsqueeze(1),
            1.0,
        )
        primary_soft_probability_t = _stable_model_route_softmax(
            finite_logits_t,
            learned_temperature_t,
        )
        positive_masked_mass_t = masked_mass_t.gt(0)
        normalized_masked_probability_t = masked_probability_t / torch.where(
            positive_masked_mass_t,
            masked_mass_t,
            torch.ones_like(masked_mass_t),
        )
        # With one admitted frontier arm, ordinary masked normalization is the
        # constant one and cancels every route-key gradient.  Keep that exact
        # sparse forward value while borrowing the learned-temperature softmax
        # only as its backward surrogate.  Page identity and residency remain
        # owned by the quantile/logit route above.
        single_frontier_probability_t = (
            normalized_masked_probability_t
            + primary_soft_probability_t
            - primary_soft_probability_t.detach()
        )
        masked_frontier_probability_t = torch.where(
            frontier_mask_t.sum(dim=-1, keepdim=True).eq(1),
            single_frontier_probability_t,
            normalized_masked_probability_t,
        )
        primary_probability_t = (
            primary_hard_probability_t
            + primary_soft_probability_t
            - primary_soft_probability_t.detach()
        )
        frontier_probability_t = torch.where(
            positive_masked_mass_t,
            masked_frontier_probability_t,
            primary_probability_t,
        )
        page_ids_t = self.page_catalog_ids_t.index_select(0, primary_index_t)
        # Union of frontier catalog IDs across the batch.  The one-dimensional
        # Boolean mask already contains each catalog position exactly once.
        # Materialization needs the exact dynamic-width union at this external
        # storage boundary, so one ``nonzero`` synchronization is unavoidable.
        # Do not expand the mask to a catalog-wide padded tensor and then call
        # ``unique``: that introduced a second synchronization plus a sort over
        # thousands of duplicate primary indices on every routed layer.
        frontier_page_mask_t = frontier_mask_t.any(dim=0)
        page_capacity_t = keep_width_t.new_ones(()) * pages
        routed_union_capacity_t = torch.minimum(
            page_capacity_t,
            keep_width_t.sum(),
        )
        positive_frontier_count_t = frontier_page_mask_t.sum().to(
            dtype=torch.long
        )
        static_union_capacity_t = torch.maximum(
            torch.where(
                held_route_active_t,
                held_page_mask_t.sum().to(dtype=torch.long),
                routed_union_capacity_t,
            ),
            positive_frontier_count_t,
        )
        _tensor_assert(
            frontier_page_mask_t.sum().le(static_union_capacity_t),
            "NoNE model route exceeded its tensor-native union capacity",
        )
        unique_catalog_t = torch.nonzero(
            frontier_page_mask_t,
            as_tuple=False,
        ).squeeze(1)
        if (
            self.training
            and torch.is_grad_enabled()
            and route_count_t is not None
            and self._training_route_cohort_boundary_open
            and not self._training_route_cohort_refinement_ready
        ):
            self._training_route_cohort_catalog_positions_t = (
                unique_catalog_t.detach().clone()
            )
        unique_t = self.page_catalog_ids_t.index_select(0, unique_catalog_t)
        inverse_t = torch.full(
            (pages,),
            -1,
            device=logits_t.device,
            dtype=torch.long,
        )
        inverse_t[unique_catalog_t] = torch.arange(
            unique_catalog_t.numel(),
            device=logits_t.device,
            dtype=torch.long,
        )
        position_t = inverse_t.index_select(0, primary_index_t)
        raw_frontier_weight_t = frontier_probability_t.index_select(
            1,
            unique_catalog_t,
        )
        finite_positive_frontier_weight_t = torch.where(
            torch.isfinite(raw_frontier_weight_t)
            & raw_frontier_weight_t.gt(0),
            raw_frontier_weight_t,
            torch.zeros_like(raw_frontier_weight_t),
        )
        finite_positive_mass_t = finite_positive_frontier_weight_t.sum(
            dim=-1,
            keepdim=True,
        )
        normalized_frontier_weight_t = finite_positive_frontier_weight_t / torch.where(
            finite_positive_mass_t.gt(0),
            finite_positive_mass_t,
            torch.ones_like(finite_positive_mass_t),
        )
        primary_union_hard_probability_t = torch.zeros_like(
            raw_frontier_weight_t
        ).scatter(
            1,
            position_t.unsqueeze(1),
            1.0,
        )
        primary_union_soft_probability_t = primary_soft_probability_t.index_select(
            1,
            unique_catalog_t,
        )
        primary_union_probability_t = (
            primary_union_hard_probability_t
            + primary_union_soft_probability_t
            - primary_union_soft_probability_t.detach()
        )
        single_frontier_weight_t = (
            normalized_frontier_weight_t
            + primary_union_soft_probability_t
            - primary_union_soft_probability_t.detach()
        )
        normalized_frontier_weight_t = torch.where(
            finite_positive_frontier_weight_t.gt(0)
            .sum(dim=-1, keepdim=True)
            .eq(1),
            single_frontier_weight_t,
            normalized_frontier_weight_t,
        )
        valid_frontier_row_t = (
            torch.isfinite(raw_frontier_weight_t).all(dim=-1, keepdim=True)
            & raw_frontier_weight_t.ge(0).all(dim=-1, keepdim=True)
            & finite_positive_mass_t.gt(0)
        )
        frontier_weight_t = torch.where(
            valid_frontier_row_t,
            normalized_frontier_weight_t,
            primary_union_probability_t,
        )
        selected_probability_t = frontier_probability_t.gather(
            1,
            primary_index_t.unsqueeze(1),
        ).squeeze(1)
        entropy_t = -(
            frontier_probability_t
            * frontier_probability_t.clamp_min(
                torch.finfo(frontier_probability_t.dtype).tiny
            ).log()
        ).sum(dim=-1)
        active_pair_index_t = _frontier_active_pair_index(frontier_weight_t)
        packet = NoNEPageRequestPacket(
            session_id_t=self.session_id_t.clone(),
            generation_t=generation_t.reshape(()).long().clone(),
            layer_id_t=self.layer_id_t.clone(),
            page_ids_t=page_ids_t,
            unique_page_ids_t=unique_t,
            unique_page_catalog_positions_t=unique_catalog_t,
            page_position_t=position_t,
            route_probability_t=selected_probability_t,
            route_entropy_t=entropy_t,
            frontier_weight_t=frontier_weight_t,
            active_pair_index_t=active_pair_index_t,
        )
        if (
            self.training
            and torch.is_grad_enabled()
            and route_count_t is not None
            and self._training_route_cohort_boundary_open
        ):
            self._training_route_cohort_refinement_ready = True
        return packet


class NoNEPagedExpertExecutor(nn.Module):
    """Execute exactly the model-selected native pages in one residency wave."""

    def __init__(self, *, hidden_size: int, memory_size: int) -> None:
        super().__init__()
        self.hidden_size = int(hidden_size)
        self.memory_size = int(memory_size)
        self.memory_projection = nn.Linear(memory_size * 3, hidden_size, bias=False)
        self.memory_gate = nn.Parameter(torch.zeros(()))
        # These stability paths are checkpointed model parameters. Both begin
        # at exact identity so an inherited page retains its accepted function
        # until real page loss trains the new stability surfaces.
        self.situ_glu_scale = nn.Parameter(torch.zeros(()))
        self.latent_rmsnorm_scale = nn.Parameter(torch.zeros(()))
        nn.init.xavier_uniform_(self.memory_projection.weight)

    def forward(
        self,
        hidden_t: torch.Tensor,
        request: NoNEPageRequestPacket,
        weights: NoNEPageWeights,
    ) -> torch.Tensor:
        if hidden_t.ndim != 3 or hidden_t.shape[-1] != self.hidden_size:
            raise ValueError("NoNE page executor hidden geometry differs")
        if weights.page_ids_t.shape != request.unique_page_ids_t.shape:
            raise RuntimeError(
                "NoNE page executor received weights outside the model route"
            )
        _tensor_assert(
            weights.page_ids_t.eq(request.unique_page_ids_t).all(),
            "NoNE page executor received weights outside the model route",
        )
        unique_count = weights.page_ids_t.shape[0]
        output_dtype = hidden_t.dtype
        # Immutable pages are resident in the executor's native precision.
        # Science/NLA control paths may promote their hidden state to float32;
        # converting the small activation instead of every page tensor keeps
        # one reusable residency identity without changing the model route.
        compute_dtype = self.memory_projection.weight.dtype
        active_hidden_t = hidden_t.to(dtype=compute_dtype)
        route_frontier_weight_t = request.frontier_weight_t.to(
            device=hidden_t.device,
        )
        converted_frontier_weight_t = route_frontier_weight_t.to(
            dtype=compute_dtype,
        )
        # The route packet is formed in the router's native precision while
        # an admitted page wave executes in the resident page dtype.  A valid
        # positive model-owned arm can be smaller than the destination dtype's
        # minimum representable value.  Letting that conversion round to zero
        # leaves the packet's exact sparse pair index naming a page whose
        # executor weight vanished, which both drops a learned route and trips
        # the union assertion on CUDA.  Preserve positive support with a
        # straight-through destination-dtype floor: forward execution retains
        # every selected arm and backward gradients still follow the original
        # learned probability rather than a host-authored route.
        route_support_t = route_frontier_weight_t.detach().gt(0)
        converted_support_t = converted_frontier_weight_t.detach().gt(0)
        underflowed_support_t = route_support_t & ~converted_support_t
        destination_positive_floor_t = converted_frontier_weight_t.new_ones(
            ()
        ).mul_(torch.finfo(compute_dtype).tiny)
        frontier_weight_t = torch.where(
            underflowed_support_t,
            converted_frontier_weight_t
            + (
                destination_positive_floor_t
                - converted_frontier_weight_t
            ).detach(),
            converted_frontier_weight_t,
        )
        if (
            frontier_weight_t.ndim != 2
            or frontier_weight_t.shape[0] != hidden_t.shape[0]
        ):
            raise ValueError("NoNE page frontier weight geometry differs")
        if frontier_weight_t.shape[1] != unique_count:
            raise ValueError("NoNE page frontier width differs from unique pages")
        # Execute only the model-selected nonzero (batch, page) pairs.  The
        # prior ``[batch, unique_pages, ...]`` expansion evaluated every page
        # in the batch union for every row even though the router had assigned
        # exact zero mass to almost all of those pairs.  That dense cross
        # product is not part of NoNE semantics: each selected page remains an
        # independent nonlinear expert and its model-owned probability is
        # applied only after that expert executes.
        active_pair_t = request.active_pair_index_t
        if active_pair_t is None:
            active_pair_t = _frontier_active_pair_index(frontier_weight_t)
        else:
            active_pair_t = active_pair_t.to(
                device=frontier_weight_t.device,
                dtype=torch.long,
            )
        if active_pair_t.ndim != 2 or active_pair_t.shape[1] != 2:
            raise ValueError("NoNE active page pair geometry differs")
        pair_batch_index_t = active_pair_t[:, 0]
        pair_page_index_t = active_pair_t[:, 1]
        torch._assert_async(
            pair_batch_index_t.ge(0).all()
            & pair_batch_index_t.lt(hidden_t.shape[0]).all()
            & pair_page_index_t.ge(0).all()
            & pair_page_index_t.lt(unique_count).all(),
            "NoNE active page pair index is outside the model route",
        )
        pair_active_t = frontier_weight_t[
            pair_batch_index_t,
            pair_page_index_t,
        ].gt(0)
        active_pair_count_by_batch_t = torch.zeros(
            hidden_t.shape[0],
            device=hidden_t.device,
            dtype=torch.long,
        ).index_add(
            0,
            pair_batch_index_t,
            pair_active_t.to(dtype=torch.long),
        )
        torch._assert_async(
            active_pair_count_by_batch_t.gt(0).all(),
            "NoNE page executor received an empty model route",
        )
        # A page matrix is shared by every routed row that selected that page.
        # Index-selecting page-major matrices with ``pair_page_index_t`` copied
        # the complete page once per active row/page pair.  On the FP32 r152
        # lane this multiplied a roughly 56 MiB page by dozens of active pairs
        # and exhausted GPU3 before useful compute.  Sort the exact selected
        # pairs into tensor-owned page groups and pad only their small hidden
        # activations.  Each full matrix is selected once per active page and
        # all groups execute through direct batched GEMMs.  Restoring the
        # original pair order before the existing weighted reduction preserves
        # routing, accumulation order, gradient ownership, and FP32 precision.
        dense_route_pair_count = hidden_t.shape[0] * unique_count
        dense_route = active_pair_t.shape[0] == dense_route_pair_count
        if dense_route:
            # Refinement waves intentionally carry the complete latched page
            # frontier. Their pair packet is the canonical row-major Cartesian
            # grid, so sorting it and rediscovering its already-known page
            # groups with ``unique_consecutive`` paid several CUDA
            # synchronizations per layer and wave. Validate that exact packet
            # tensor-natively, then expose the hidden activation as a
            # page-major expanded view. Only the small executor output is
            # materialized back in row-major order before the unchanged
            # weighted reduction.
            dense_pair_batch_t = pair_batch_index_t.reshape(
                hidden_t.shape[0],
                unique_count,
            )
            dense_pair_page_t = pair_page_index_t.reshape(
                hidden_t.shape[0],
                unique_count,
            )
            torch._assert_async(
                dense_pair_batch_t.eq(
                    torch.arange(
                        hidden_t.shape[0],
                        device=pair_batch_index_t.device,
                        dtype=torch.long,
                    ).unsqueeze(1)
                ).all()
                & dense_pair_page_t.eq(
                    torch.arange(
                        unique_count,
                        device=pair_page_index_t.device,
                        dtype=torch.long,
                    ).unsqueeze(0)
                ).all(),
                "NoNE dense page pair index differs from the model route",
            )
            active_page_index_t = torch.arange(
                unique_count,
                device=pair_page_index_t.device,
                dtype=torch.long,
            )
            page_group_hidden_t = active_hidden_t.unsqueeze(0).expand(
                unique_count,
                hidden_t.shape[0],
                hidden_t.shape[1],
                self.hidden_size,
            )
            page_group_active_t: torch.Tensor | None = None
            pair_page_restore_order_t: torch.Tensor | None = None
        else:
            pair_hidden_t = active_hidden_t.index_select(
                0,
                pair_batch_index_t,
            )
            # ``unique_page_ids_t`` is the exact union of the positive frontier,
            # so every local page position occurs at least once.  Re-sorting the
            # row-major pair packet and rediscovering that already-known union
            # with ``unique_consecutive`` introduced dynamic CUDA output shapes
            # and synchronization in every sparse executor call.  Count into the
            # fixed union width, then derive the stable page-major slot for each
            # pair from the tensor-owned frontier prefix.  The resulting order is
            # identical to stable page sorting while keeping routing and gradient
            # ownership on device.
            active_page_index_t = torch.arange(
                unique_count,
                device=pair_page_index_t.device,
                dtype=torch.long,
            )
            active_pair_count_by_page_t = torch.bincount(
                pair_page_index_t,
                minlength=unique_count,
            )
            torch._assert_async(
                pair_active_t.all()
                & active_pair_count_by_page_t.gt(0).all(),
                "NoNE sparse page union differs from the exact model route",
            )
            pair_rank_by_batch_page_t = (
                frontier_weight_t.gt(0).to(dtype=torch.long).cumsum(dim=0)
                - 1
            )
            pair_page_rank_t = pair_rank_by_batch_page_t[
                pair_batch_index_t,
                pair_page_index_t,
            ]
            torch._assert_async(
                pair_page_rank_t.ge(0).all()
                & pair_page_rank_t.lt(
                    active_pair_count_by_page_t.index_select(
                        0,
                        pair_page_index_t,
                    )
                ).all(),
                "NoNE sparse page pair rank differs from the exact model route",
            )
            active_pair_offset_by_page_t = active_pair_count_by_page_t.cumsum(
                dim=0,
            )
            active_pair_start_by_page_t = (
                active_pair_offset_by_page_t - active_pair_count_by_page_t
            )
            pair_page_restore_order_t = (
                active_pair_start_by_page_t.index_select(
                    0,
                    pair_page_index_t,
                )
                + pair_page_rank_t
            )
            sorted_pair_hidden_t = torch.empty_like(pair_hidden_t).index_copy(
                0,
                pair_page_restore_order_t,
                pair_hidden_t,
            )
            page_group_rank_t = torch.arange(
                cast(int, active_pair_count_by_page_t.max()),
                device=pair_page_index_t.device,
                dtype=torch.long,
            )
            sparse_page_group_active_t = page_group_rank_t.unsqueeze(0).lt(
                active_pair_count_by_page_t.unsqueeze(1)
            )
            page_group_active_t = sparse_page_group_active_t
            page_group_pair_position_t = (
                active_pair_start_by_page_t.unsqueeze(1)
                + page_group_rank_t.unsqueeze(0)
            )
            page_group_pair_position_t = torch.where(
                sparse_page_group_active_t,
                page_group_pair_position_t,
                torch.zeros_like(page_group_pair_position_t),
            )
            page_group_hidden_t = sorted_pair_hidden_t.index_select(
                0,
                page_group_pair_position_t.reshape(-1),
            ).reshape(
                active_page_index_t.shape[0],
                page_group_rank_t.shape[0],
                hidden_t.shape[1],
                self.hidden_size,
            )
        page_group_flat_hidden_t = page_group_hidden_t.reshape(
            active_page_index_t.shape[0],
            -1,
            self.hidden_size,
        )
        # ``weights.page_ids_t`` is required above to equal the complete
        # ``request.unique_page_ids_t`` in the same order, and both dense and
        # sparse grouping paths therefore set ``active_page_index_t`` to the
        # identity range.  Index-selecting that range cloned every complete
        # page matrix immediately before GEMM.  Use the already-materialized
        # exact route rows directly; ``to`` is a no-op when the store has
        # supplied executor-native precision.
        page_gate_t = weights.gate_t.to(dtype=compute_dtype)
        page_up_t = weights.up_t.to(dtype=compute_dtype)
        page_down_t = weights.down_t.to(dtype=compute_dtype)
        page_group_gate_linear_t = torch.bmm(
            page_group_flat_hidden_t,
            page_gate_t,
        )
        page_group_up_linear_t = torch.bmm(
            page_group_flat_hidden_t,
            page_up_t,
        )
        legacy_gate_hidden_t = F.silu(page_group_gate_linear_t)
        ffn_mode_t = weights.ffn_mode_t.to(dtype=compute_dtype).reshape(
            active_page_index_t.shape[0],
            1,
            1,
        )
        legacy_mixed_ffn_hidden_t = legacy_gate_hidden_t * (
            (1.0 - ffn_mode_t) + ffn_mode_t * page_group_up_linear_t
        )
        situ_gate_hidden_t = (
            4.0
            * torch.tanh(page_group_gate_linear_t / 4.0)
            * torch.sigmoid(page_group_gate_linear_t)
        )
        situ_up_hidden_t = 25.0 * torch.tanh(
            page_group_up_linear_t / 25.0
        )
        situ_mixed_ffn_hidden_t = situ_gate_hidden_t * (
            (1.0 - ffn_mode_t) + ffn_mode_t * situ_up_hidden_t
        )
        situ_blend_t = torch.tanh(self.situ_glu_scale).to(
            dtype=compute_dtype
        )
        page_group_mixed_ffn_hidden_t = legacy_mixed_ffn_hidden_t + (
            situ_blend_t
            * (
                situ_mixed_ffn_hidden_t
                - legacy_mixed_ffn_hidden_t
            )
        )
        normalized_page_group_hidden_t = F.rms_norm(
            page_group_mixed_ffn_hidden_t,
            (page_group_mixed_ffn_hidden_t.shape[-1],),
        )
        norm_blend_t = torch.tanh(self.latent_rmsnorm_scale).to(
            dtype=compute_dtype
        )
        page_group_mixed_ffn_hidden_t = page_group_mixed_ffn_hidden_t + (
            norm_blend_t
            * (
                normalized_page_group_hidden_t
                - page_group_mixed_ffn_hidden_t
            )
        )
        page_group_ffn_t = torch.bmm(
            page_group_mixed_ffn_hidden_t,
            page_down_t,
        )

        page_glyph_down_t = weights.glyph_down_t.to(dtype=compute_dtype)
        page_glyph_up_t = weights.glyph_up_t.to(dtype=compute_dtype)
        page_group_glyph_t = F.normalize(
            torch.bmm(page_group_flat_hidden_t, page_glyph_down_t),
            dim=-1,
        )
        page_group_translated_t = torch.bmm(
            page_group_glyph_t,
            page_glyph_up_t,
        )
        translation_gate_t = weights.translation_gate_t.to(
            dtype=compute_dtype
        ).reshape(active_page_index_t.shape[0], 1, 1)
        page_memory_t = torch.cat(
            (
                weights.outcome_memory_t,
                weights.repair_memory_t,
                weights.transfer_memory_t,
            ),
            dim=-1,
        ).to(dtype=compute_dtype)
        page_memory_hidden_t = self.memory_projection(page_memory_t).view(
            active_page_index_t.shape[0],
            1,
            self.hidden_size,
        )
        page_group_output_t = (
            page_group_ffn_t
            + torch.tanh(translation_gate_t) * page_group_translated_t
            + torch.tanh(self.memory_gate) * page_memory_hidden_t
        )
        page_group_output_t = page_group_output_t.reshape(
            active_page_index_t.shape[0],
            page_group_hidden_t.shape[1],
            hidden_t.shape[1],
            self.hidden_size,
        )
        if dense_route:
            pair_page_output_t = page_group_output_t.permute(
                1,
                0,
                2,
                3,
            ).reshape(
                dense_route_pair_count,
                hidden_t.shape[1],
                self.hidden_size,
            )
        else:
            assert page_group_active_t is not None
            assert pair_page_restore_order_t is not None
            sorted_pair_page_output_t = page_group_output_t[
                page_group_active_t
            ]
            pair_page_output_t = sorted_pair_page_output_t.index_select(
                0,
                pair_page_restore_order_t,
            )
        pair_mix_t = frontier_weight_t[
            pair_batch_index_t,
            pair_page_index_t,
        ].reshape(
            active_pair_t.shape[0],
            1,
            1,
        )
        output_t = torch.zeros_like(active_hidden_t).index_add(
            0,
            pair_batch_index_t,
            pair_mix_t * pair_page_output_t,
        )
        return output_t.to(dtype=output_dtype)


class _NoNECandidateRouteRematerializeFunction(torch.autograd.Function):
    """Rematerialize one complete model-owned page route during backward."""

    @staticmethod
    def forward(
        ctx: Any,
        hidden_t: torch.Tensor,
        page_backward_anchor_t: torch.Tensor,
        frontier_weight_t: torch.Tensor,
        memory_projection_weight_t: torch.Tensor,
        memory_gate_t: torch.Tensor,
        runtime: NoNEPagedExpertRuntime,
        request: NoNEPageRequestPacket,
        candidate_generation_t: torch.Tensor,
        candidate_state_revision_t: torch.Tensor,
        reservation: _NoNECandidateVJPReservation,
    ) -> torch.Tensor:
        if page_backward_anchor_t.numel() != 1:
            raise RuntimeError(
                "NoNE candidate backward anchor must be scalar"
            )
        active_request = replace(
            request,
            frontier_weight_t=frontier_weight_t,
        )
        ctx.runtime = runtime
        ctx.reservation = reservation
        ctx.request = _move_page_request_tensor_boundary(
            active_request,
            device=torch.device("cpu"),
            detach=True,
        )
        ctx.save_for_backward(
            hidden_t.detach().to(device=torch.device("cpu"), copy=True),
            memory_projection_weight_t.detach().to(
                device=torch.device("cpu"),
                copy=True,
            ),
            memory_gate_t.detach().to(
                device=torch.device("cpu"),
                copy=True,
            ),
            candidate_generation_t.detach()
            .to(device=torch.device("cpu"), dtype=torch.long, copy=True),
            candidate_state_revision_t.detach()
            .to(device=torch.device("cpu"), dtype=torch.long, copy=True),
        )
        return runtime._execute_candidate_rematerialized_forward_boundary(
            hidden_t.detach(),
            active_request,
        )

    @staticmethod
    @once_differentiable
    def backward(  # type: ignore[override]
        ctx: Any,
        gradient_output_t: torch.Tensor,
    ) -> tuple[
        torch.Tensor | None,
        None,
        torch.Tensor | None,
        torch.Tensor | None,
        torch.Tensor | None,
        None,
        None,
        None,
        None,
        None,
    ]:
        runtime: NoNEPagedExpertRuntime = ctx.runtime
        reservation: _NoNECandidateVJPReservation = ctx.reservation
        request_cpu: NoNEPageRequestPacket = ctx.request
        runtime._claim_candidate_vjp_reservation_boundary(reservation)
        (
            hidden_cpu_t,
            memory_projection_weight_cpu_t,
            memory_gate_cpu_t,
            candidate_generation_t,
            candidate_state_revision_t,
        ) = ctx.saved_tensors
        runtime._assert_candidate_rematerialization_authority_boundary(
            candidate_generation_t=candidate_generation_t,
            candidate_state_revision_t=candidate_state_revision_t,
        )
        if (
            not torch.equal(
                runtime.executor.memory_projection.weight.detach().cpu(),
                memory_projection_weight_cpu_t,
            )
            or not torch.equal(
                runtime.executor.memory_gate.detach().cpu(),
                memory_gate_cpu_t,
            )
        ):
            raise RuntimeError(
                "NoNE candidate shared executor changed during "
                "rematerialization"
            )
        hidden_gradient_t: torch.Tensor | None = None
        frontier_gradient_t: torch.Tensor | None = None
        projection_gradient_t: torch.Tensor | None = None
        memory_gate_gradient_t: torch.Tensor | None = None
        hidden_requires_grad = bool(ctx.needs_input_grad[0])
        frontier_requires_grad = bool(ctx.needs_input_grad[2])
        projection_requires_grad = bool(ctx.needs_input_grad[3])
        memory_gate_requires_grad = bool(ctx.needs_input_grad[4])
        if (
            hidden_requires_grad
            or frontier_requires_grad
            or projection_requires_grad
            or memory_gate_requires_grad
        ):
            hidden_t = hidden_cpu_t.to(
                device=gradient_output_t.device,
                dtype=gradient_output_t.dtype,
            ).detach()
            hidden_t.requires_grad_(hidden_requires_grad)
            frontier_t = request_cpu.frontier_weight_t.to(
                device=gradient_output_t.device,
            ).detach()
            frontier_t.requires_grad_(frontier_requires_grad)
            request = _move_page_request_tensor_boundary(
                request_cpu,
                device=gradient_output_t.device,
                frontier_weight_t=frontier_t,
                detach=False,
            )
            active_page_position_t = torch.nonzero(
                frontier_t.detach().gt(0).any(dim=0),
                as_tuple=False,
            ).reshape(-1)
            active_page_count = active_page_position_t.shape[0]
            last_wave_start = (
                (active_page_count - 1)
                // runtime.training_residency_wave_pages
                * runtime.training_residency_wave_pages
            )
            for wave_start in range(
                last_wave_start,
                -1,
                -runtime.training_residency_wave_pages,
            ):
                wave_page_count = min(
                    runtime.training_residency_wave_pages,
                    active_page_count - wave_start,
                )
                with torch.enable_grad():
                    # Custom autograd backward runs with gradient recording
                    # disabled by default. Build the frontier slice inside the
                    # enabled region so its returned gradient remains connected
                    # to ``frontier_t`` rather than becoming a constant replay
                    # weight.
                    wave = runtime._training_residency_wave_request_boundary(
                        request,
                        page_positions_t=active_page_position_t.narrow(
                            0,
                            wave_start,
                            wave_page_count,
                        ),
                    )
                    wave_weights = (
                        runtime._candidate_rematerialized_weights_for_request_boundary(
                            wave.request,
                            device=gradient_output_t.device,
                            dtype=(
                                runtime.executor.memory_projection.weight.dtype
                            ),
                            trainable=False,
                        )
                    )
                    wave_output_t = runtime.executor(
                        hidden_t.index_select(
                            0,
                            wave.active_batch_index_t,
                        ),
                        wave.request,
                        wave_weights,
                    )
                    gradient_inputs: list[torch.Tensor] = []
                    if hidden_requires_grad:
                        gradient_inputs.append(hidden_t)
                    if frontier_requires_grad:
                        gradient_inputs.append(frontier_t)
                    if projection_requires_grad:
                        gradient_inputs.append(
                            runtime.executor.memory_projection.weight
                        )
                    if memory_gate_requires_grad:
                        gradient_inputs.append(runtime.executor.memory_gate)
                    wave_gradients = torch.autograd.grad(
                        wave_output_t,
                        tuple(gradient_inputs),
                        grad_outputs=gradient_output_t.index_select(
                            0,
                            wave.active_batch_index_t,
                        ),
                        retain_graph=False,
                        create_graph=False,
                        allow_unused=False,
                    )
                gradient_index = 0
                if hidden_requires_grad:
                    raw_hidden_gradient_t = wave_gradients[gradient_index]
                    if raw_hidden_gradient_t is None:
                        raise RuntimeError(
                            "NoNE candidate hidden-state VJP is disconnected"
                        )
                    hidden_gradient_t = (
                        raw_hidden_gradient_t
                        if hidden_gradient_t is None
                        else hidden_gradient_t + raw_hidden_gradient_t
                    )
                    gradient_index += 1
                if frontier_requires_grad:
                    raw_frontier_gradient_t = wave_gradients[gradient_index]
                    if raw_frontier_gradient_t is None:
                        raise RuntimeError(
                            "NoNE candidate frontier VJP is disconnected"
                        )
                    wave_frontier_gradient_t = raw_frontier_gradient_t
                    frontier_gradient_t = (
                        wave_frontier_gradient_t
                        if frontier_gradient_t is None
                        else frontier_gradient_t + wave_frontier_gradient_t
                    )
                    gradient_index += 1
                if projection_requires_grad:
                    raw_projection_gradient_t = wave_gradients[gradient_index]
                    if raw_projection_gradient_t is None:
                        raise RuntimeError(
                            "NoNE candidate projection VJP is disconnected"
                        )
                    wave_projection_gradient_t = raw_projection_gradient_t
                    projection_gradient_t = (
                        wave_projection_gradient_t
                        if projection_gradient_t is None
                        else projection_gradient_t
                        + wave_projection_gradient_t
                    )
                    gradient_index += 1
                if memory_gate_requires_grad:
                    raw_memory_gate_gradient_t = wave_gradients[gradient_index]
                    if raw_memory_gate_gradient_t is None:
                        raise RuntimeError(
                            "NoNE candidate memory-gate VJP is disconnected"
                        )
                    wave_memory_gate_gradient_t = raw_memory_gate_gradient_t
                    memory_gate_gradient_t = (
                        wave_memory_gate_gradient_t
                        if memory_gate_gradient_t is None
                        else memory_gate_gradient_t
                        + wave_memory_gate_gradient_t
                    )
        runtime._stage_candidate_vjp_trace_boundary(
            hidden_t=hidden_cpu_t,
            request=request_cpu,
            gradient_output_t=gradient_output_t,
            candidate_generation_t=candidate_generation_t,
            candidate_state_revision_t=candidate_state_revision_t,
            reservation=reservation,
        )
        return (
            hidden_gradient_t,
            None,
            frontier_gradient_t,
            projection_gradient_t,
            memory_gate_gradient_t,
            None,
            None,
            None,
            None,
            None,
        )


def _page_parameter_tensors(
    weights: NoNEPageWeights,
) -> tuple[torch.Tensor, ...]:
    return (
        weights.gate_t,
        weights.up_t,
        weights.down_t,
        weights.glyph_down_t,
        weights.glyph_up_t,
        weights.translation_gate_t,
        weights.outcome_memory_t,
        weights.repair_memory_t,
        weights.transfer_memory_t,
    )


def _page_weights_index_select_boundary(
    weights: NoNEPageWeights,
    row_indexes_t: torch.Tensor,
) -> NoNEPageWeights:
    """Project exact route-ordered rows while retaining the weight graph."""

    if row_indexes_t.ndim != 1 or row_indexes_t.dtype != torch.long:
        raise ValueError("NoNE page weight row indexes are invalid")

    def selected(tensor: torch.Tensor) -> torch.Tensor:
        return tensor.index_select(
            0,
            row_indexes_t.to(device=tensor.device, dtype=torch.long),
        )

    return NoNEPageWeights(
        page_ids_t=selected(weights.page_ids_t),
        ffn_mode_t=selected(weights.ffn_mode_t),
        gate_t=selected(weights.gate_t),
        up_t=selected(weights.up_t),
        down_t=selected(weights.down_t),
        glyph_down_t=selected(weights.glyph_down_t),
        glyph_up_t=selected(weights.glyph_up_t),
        translation_gate_t=selected(weights.translation_gate_t),
        outcome_memory_t=selected(weights.outcome_memory_t),
        repair_memory_t=selected(weights.repair_memory_t),
        transfer_memory_t=selected(weights.transfer_memory_t),
    )


def _parameter_gradient_or_zero_boundary(
    parameter_t: torch.Tensor,
) -> torch.Tensor:
    """Return one tensor-owned gradient without optional type ambiguity."""

    gradient_t = parameter_t.grad
    if gradient_t is None:
        return torch.zeros_like(parameter_t)
    return gradient_t


def _page_weights_row(
    weights: NoNEPageWeights,
    row_index: int,
    *,
    trainable: bool,
) -> NoNEPageWeights:
    """Copy one accepted page into independently trainable residency storage."""

    def row(
        tensor: torch.Tensor,
        *,
        requires_grad: bool,
    ) -> torch.Tensor:
        retained_t = tensor[row_index : row_index + 1].detach().clone()
        if retained_t.dtype.is_floating_point:
            retained_t.requires_grad_(requires_grad)
        return retained_t

    return NoNEPageWeights(
        page_ids_t=row(weights.page_ids_t, requires_grad=False),
        ffn_mode_t=row(weights.ffn_mode_t, requires_grad=False),
        gate_t=row(weights.gate_t, requires_grad=trainable),
        up_t=row(weights.up_t, requires_grad=trainable),
        down_t=row(weights.down_t, requires_grad=trainable),
        glyph_down_t=row(weights.glyph_down_t, requires_grad=trainable),
        glyph_up_t=row(weights.glyph_up_t, requires_grad=trainable),
        translation_gate_t=row(
            weights.translation_gate_t,
            requires_grad=trainable,
        ),
        outcome_memory_t=row(
            weights.outcome_memory_t,
            requires_grad=trainable,
        ),
        repair_memory_t=row(
            weights.repair_memory_t,
            requires_grad=trainable,
        ),
        transfer_memory_t=row(
            weights.transfer_memory_t,
            requires_grad=trainable,
        ),
    )


def _candidate_forward_wave_row_view_boundary(
    binding: _NoNECandidateForwardWaveBinding,
) -> NoNEPageWeights:
    """View one contiguous forward-wave row without cloning its matrices."""

    row_index_t = binding.row_index_t

    def row(tensor: torch.Tensor) -> torch.Tensor:
        return tensor.narrow(
            0,
            row_index_t.to(device=tensor.device),
            1,
        )

    weights = binding.weights
    return NoNEPageWeights(
        page_ids_t=row(weights.page_ids_t),
        ffn_mode_t=row(weights.ffn_mode_t),
        gate_t=row(weights.gate_t),
        up_t=row(weights.up_t),
        down_t=row(weights.down_t),
        glyph_down_t=row(weights.glyph_down_t),
        glyph_up_t=row(weights.glyph_up_t),
        translation_gate_t=row(weights.translation_gate_t),
        outcome_memory_t=row(weights.outcome_memory_t),
        repair_memory_t=row(weights.repair_memory_t),
        transfer_memory_t=row(weights.transfer_memory_t),
    )


def _candidate_forward_wave_retained_row_view_boundary(
    binding: _NoNECandidateForwardWaveBinding,
) -> NoNEPageWeights:
    """Retain compatibility-view gradients without cloning the batch leaf."""

    view = _candidate_forward_wave_row_view_boundary(binding)
    for parameter_t in _page_parameter_tensors(view):
        if parameter_t.requires_grad:
            parameter_t.retain_grad()
    return view


def _candidate_forward_wave_gradient_row_boundary(
    binding: _NoNECandidateForwardWaveBinding,
) -> NoNEPageWeights:
    """Copy one batch-leaf row and its exact accumulated gradient.

    A detached narrow still owns the complete wave storage.  The page-local
    optimizer may outlive the wave binding while its asynchronous host copy is
    enqueued, so retaining that view would keep the whole prior CUDA wave live
    while the next wave is rematerialized.  One independent row copy preserves
    the exact gradient while keeping residency at one wave plus bounded
    page-local update storage.
    """

    row_index_t = binding.row_index_t

    def row(tensor: torch.Tensor, *, trainable: bool) -> torch.Tensor:
        retained_t = tensor.narrow(
            0,
            row_index_t.to(device=tensor.device),
            1,
        ).detach().clone()
        if retained_t.dtype.is_floating_point:
            retained_t.requires_grad_(trainable)
            gradient_t = tensor.grad
            if trainable and gradient_t is not None:
                retained_t.grad = gradient_t.narrow(
                    0,
                    row_index_t.to(device=gradient_t.device),
                    1,
                ).detach().clone()
        return retained_t

    weights = binding.weights
    return NoNEPageWeights(
        page_ids_t=row(weights.page_ids_t, trainable=False),
        ffn_mode_t=row(weights.ffn_mode_t, trainable=False),
        gate_t=row(weights.gate_t, trainable=weights.gate_t.requires_grad),
        up_t=row(weights.up_t, trainable=weights.up_t.requires_grad),
        down_t=row(weights.down_t, trainable=weights.down_t.requires_grad),
        glyph_down_t=row(
            weights.glyph_down_t,
            trainable=weights.glyph_down_t.requires_grad,
        ),
        glyph_up_t=row(
            weights.glyph_up_t,
            trainable=weights.glyph_up_t.requires_grad,
        ),
        translation_gate_t=row(
            weights.translation_gate_t,
            trainable=weights.translation_gate_t.requires_grad,
        ),
        outcome_memory_t=row(
            weights.outcome_memory_t,
            trainable=weights.outcome_memory_t.requires_grad,
        ),
        repair_memory_t=row(
            weights.repair_memory_t,
            trainable=weights.repair_memory_t.requires_grad,
        ),
        transfer_memory_t=row(
            weights.transfer_memory_t,
            trainable=weights.transfer_memory_t.requires_grad,
        ),
    )


def _concatenate_page_weights(
    rows: tuple[NoNEPageWeights, ...],
) -> NoNEPageWeights:
    """Compose accepted page rows in the exact model-requested order."""

    if not rows:
        raise ValueError("NoNE page composition requires at least one row")
    return NoNEPageWeights(
        page_ids_t=torch.cat(
            tuple(weights.page_ids_t for weights in rows),
            dim=0,
        ),
        ffn_mode_t=torch.cat(
            tuple(weights.ffn_mode_t for weights in rows),
            dim=0,
        ),
        gate_t=torch.cat(
            tuple(weights.gate_t for weights in rows),
            dim=0,
        ),
        up_t=torch.cat(
            tuple(weights.up_t for weights in rows),
            dim=0,
        ),
        down_t=torch.cat(
            tuple(weights.down_t for weights in rows),
            dim=0,
        ),
        glyph_down_t=torch.cat(
            tuple(weights.glyph_down_t for weights in rows),
            dim=0,
        ),
        glyph_up_t=torch.cat(
            tuple(weights.glyph_up_t for weights in rows),
            dim=0,
        ),
        translation_gate_t=torch.cat(
            tuple(weights.translation_gate_t for weights in rows),
            dim=0,
        ),
        outcome_memory_t=torch.cat(
            tuple(weights.outcome_memory_t for weights in rows),
            dim=0,
        ),
        repair_memory_t=torch.cat(
            tuple(weights.repair_memory_t for weights in rows),
            dim=0,
        ),
        transfer_memory_t=torch.cat(
            tuple(weights.transfer_memory_t for weights in rows),
            dim=0,
        ),
    )


def _preallocate_page_weights_wave_like_boundary(
    row: NoNEPageWeights,
    *,
    page_count: int,
) -> NoNEPageWeights:
    """Allocate one contiguous CPU wave from one exact page-row geometry."""

    if page_count < 1:
        raise ValueError("NoNE page wave allocation requires a positive width")

    def allocate(tensor: torch.Tensor) -> torch.Tensor:
        if tensor.shape[0] != 1:
            raise RuntimeError(
                "NoNE page wave source must contain exactly one row"
            )
        return torch.empty(
            (page_count, *tensor.shape[1:]),
            device=tensor.device,
            dtype=tensor.dtype,
        )

    return NoNEPageWeights(
        page_ids_t=allocate(row.page_ids_t),
        ffn_mode_t=allocate(row.ffn_mode_t),
        gate_t=allocate(row.gate_t),
        up_t=allocate(row.up_t),
        down_t=allocate(row.down_t),
        glyph_down_t=allocate(row.glyph_down_t),
        glyph_up_t=allocate(row.glyph_up_t),
        translation_gate_t=allocate(row.translation_gate_t),
        outcome_memory_t=allocate(row.outcome_memory_t),
        repair_memory_t=allocate(row.repair_memory_t),
        transfer_memory_t=allocate(row.transfer_memory_t),
    )


def _copy_page_weights_row_into_wave_boundary(
    wave: NoNEPageWeights,
    row: NoNEPageWeights,
    *,
    row_index: int,
) -> None:
    """Copy one verified CPU row into its exact preallocated wave position."""

    if row_index < 0 or row_index >= wave.page_ids_t.shape[0]:
        raise IndexError("NoNE page wave row index is outside its allocation")
    wave_tensors = (
        wave.page_ids_t,
        wave.ffn_mode_t,
        *_page_parameter_tensors(wave),
    )
    row_tensors = (
        row.page_ids_t,
        row.ffn_mode_t,
        *_page_parameter_tensors(row),
    )
    with torch.no_grad():
        for wave_t, row_t in zip(
            wave_tensors,
            row_tensors,
            strict=True,
        ):
            target_t = wave_t.narrow(0, row_index, 1)
            if target_t.shape != row_t.shape:
                raise RuntimeError(
                    "NoNE page wave row changed physical tensor geometry"
                )
            target_t.copy_(row_t)


def _page_bundle_row(
    bundle: NoNEPageBundle,
    row_index: int,
    *,
    trainable: bool,
) -> NoNEPageBundle:
    """Detach one page into an independently trainable residency-cache row."""

    weights = bundle.weights
    sliced = NoNEPageWeights(
        page_ids_t=weights.page_ids_t[row_index : row_index + 1],
        ffn_mode_t=weights.ffn_mode_t[row_index : row_index + 1],
        gate_t=weights.gate_t[row_index : row_index + 1],
        up_t=weights.up_t[row_index : row_index + 1],
        down_t=weights.down_t[row_index : row_index + 1],
        glyph_down_t=weights.glyph_down_t[row_index : row_index + 1],
        glyph_up_t=weights.glyph_up_t[row_index : row_index + 1],
        translation_gate_t=weights.translation_gate_t[row_index : row_index + 1],
        outcome_memory_t=weights.outcome_memory_t[row_index : row_index + 1],
        repair_memory_t=weights.repair_memory_t[row_index : row_index + 1],
        transfer_memory_t=weights.transfer_memory_t[row_index : row_index + 1],
    ).to(
        device=weights.gate_t.device,
        dtype=weights.gate_t.dtype,
        trainable=trainable,
    )
    return NoNEPageBundle(
        weights=sliced,
        optimizer_mean_t=_move_optimizer_matrix_boundary(
            bundle.optimizer_mean_t[row_index : row_index + 1],
            device=bundle.optimizer_mean_t.device,
        ),
        optimizer_square_t=_move_optimizer_matrix_boundary(
            bundle.optimizer_square_t[row_index : row_index + 1],
            device=bundle.optimizer_square_t.device,
        ),
        step_t=bundle.step_t[row_index : row_index + 1].detach().clone(),
    )


def _move_page_bundle_boundary(
    bundle: NoNEPageBundle,
    *,
    device: torch.device,
    dtype: torch.dtype,
    trainable: bool,
) -> NoNEPageBundle:
    """Move execution weights while keeping explicit optimizer state on CPU."""

    optimizer_device = _optimizer_state_consumer_device_boundary(
        bundle,
        device=device,
    )
    return NoNEPageBundle(
        weights=_move_immutable_page_weights_for_consumer_boundary(
            bundle.weights,
            device=device,
            dtype=dtype,
            trainable=trainable,
        ),
        optimizer_mean_t=_move_optimizer_matrix_boundary(
            bundle.optimizer_mean_t,
            device=optimizer_device,
        ),
        optimizer_square_t=_move_optimizer_matrix_boundary(
            bundle.optimizer_square_t,
            device=optimizer_device,
        ),
        step_t=bundle.step_t.detach().to(
            device=device,
            dtype=torch.long,
        ),
    )


def _move_immutable_page_weights_for_consumer_boundary(
    weights: NoNEPageWeights,
    *,
    device: torch.device,
    dtype: torch.dtype,
    trainable: bool,
) -> NoNEPageWeights:
    """Move immutable weights while isolating same-device CPU consumers."""

    if device.type != "cpu":
        return weights.to(
            device=device,
            dtype=dtype,
            trainable=trainable,
        )

    def cloned_weight(tensor: torch.Tensor) -> torch.Tensor:
        return (
            tensor.detach()
            .to(
                device=device,
                dtype=dtype,
                copy=True,
            )
            .requires_grad_(trainable)
        )

    return NoNEPageWeights(
        page_ids_t=weights.page_ids_t.detach().to(
            device=device,
            dtype=torch.long,
            copy=True,
        ),
        ffn_mode_t=weights.ffn_mode_t.detach().to(
            device=device,
            dtype=dtype,
            copy=True,
        ),
        gate_t=cloned_weight(weights.gate_t),
        up_t=cloned_weight(weights.up_t),
        down_t=cloned_weight(weights.down_t),
        glyph_down_t=cloned_weight(weights.glyph_down_t),
        glyph_up_t=cloned_weight(weights.glyph_up_t),
        translation_gate_t=cloned_weight(weights.translation_gate_t),
        outcome_memory_t=cloned_weight(weights.outcome_memory_t),
        repair_memory_t=cloned_weight(weights.repair_memory_t),
        transfer_memory_t=cloned_weight(weights.transfer_memory_t),
    )


def _graph_preserving_page_weights_to_boundary(
    weights: NoNEPageWeights,
    *,
    device: torch.device,
    dtype: torch.dtype,
) -> NoNEPageWeights:
    """Move one CPU-owned training wave without detaching its gradient path.

    Candidate page rows and optimizer moments stay CPU-owned. Only the current
    already-selected residency wave is copied to the execution device. Unlike
    ``NoNEPageWeights.to``, this boundary deliberately preserves autograd's
    copy edge so exact device gradients accumulate into the CPU page leaves
    consumed by the durable page optimizer.
    """

    def weight(tensor: torch.Tensor) -> torch.Tensor:
        return tensor.to(device=device, dtype=dtype)

    return NoNEPageWeights(
        page_ids_t=weights.page_ids_t.to(device=device, dtype=torch.long),
        ffn_mode_t=weights.ffn_mode_t.to(device=device, dtype=dtype),
        gate_t=weight(weights.gate_t),
        up_t=weight(weights.up_t),
        down_t=weight(weights.down_t),
        glyph_down_t=weight(weights.glyph_down_t),
        glyph_up_t=weight(weights.glyph_up_t),
        translation_gate_t=weight(weights.translation_gate_t),
        outcome_memory_t=weight(weights.outcome_memory_t),
        repair_memory_t=weight(weights.repair_memory_t),
        transfer_memory_t=weight(weights.transfer_memory_t),
    )


def _move_immutable_page_bundle_for_consumer_boundary(
    bundle: NoNEPageBundle,
    *,
    device: torch.device,
    dtype: torch.dtype,
    trainable: bool,
) -> NoNEPageBundle:
    """Move an immutable bundle without exposing cached CPU storage aliases."""

    if device.type != "cpu":
        # Dense Adam moments and their step are durable update state, not forward
        # state. Keep them together until the page-local update consumes one
        # routed row; moving a 16-page moment pair here can exceed accelerator
        # capacity before the first model operation. Broadcast-backed zero
        # moments are only one scalar per page and remain device-local so the
        # stateless update path stays tensor-native.
        optimizer_device = _optimizer_state_consumer_device_boundary(
            bundle,
            device=device,
        )
        return NoNEPageBundle(
            weights=_move_immutable_page_weights_for_consumer_boundary(
                bundle.weights,
                device=device,
                dtype=dtype,
                trainable=trainable,
            ),
            optimizer_mean_t=_move_optimizer_matrix_boundary(
                bundle.optimizer_mean_t,
                device=optimizer_device,
            ),
            optimizer_square_t=_move_optimizer_matrix_boundary(
                bundle.optimizer_square_t,
                device=optimizer_device,
            ),
            step_t=bundle.step_t.detach().to(
                device=optimizer_device,
                dtype=torch.long,
            ),
        )

    def cloned_optimizer_matrix(tensor: torch.Tensor) -> torch.Tensor:
        if tensor.ndim == 2 and tensor.stride(1) == 0:
            compact_t = tensor[:, :1].detach().to(
                device=device,
                dtype=torch.float32,
                copy=True,
            )
            return compact_t.expand(tensor.shape)
        return tensor.detach().to(
            device=device,
            dtype=torch.float32,
            copy=True,
        )

    return NoNEPageBundle(
        weights=_move_immutable_page_weights_for_consumer_boundary(
            bundle.weights,
            device=device,
            dtype=dtype,
            trainable=trainable,
        ),
        optimizer_mean_t=cloned_optimizer_matrix(bundle.optimizer_mean_t),
        optimizer_square_t=cloned_optimizer_matrix(
            bundle.optimizer_square_t
        ),
        step_t=bundle.step_t.detach().to(
            device=device,
            dtype=torch.long,
            copy=True,
        ),
    )


def _enqueue_pinned_cpu_tensor_boundary(
    tensor: torch.Tensor,
    *,
    transfer_stream: torch.cuda.Stream,
) -> torch.Tensor:
    """Enqueue one exact CUDA tensor copy into page-wave pinned storage."""

    source_t = tensor.detach()
    if source_t.device.type != "cuda":
        raise ValueError("pinned page transfer source must be a CUDA tensor")
    destination_t = torch.empty(
        source_t.shape,
        dtype=source_t.dtype,
        device=torch.device("cpu"),
        pin_memory=True,
    )
    destination_t.copy_(source_t, non_blocking=True)
    source_t.record_stream(transfer_stream)
    return destination_t


def _enqueue_pinned_optimizer_matrix_boundary(
    tensor: torch.Tensor,
    *,
    transfer_stream: torch.cuda.Stream,
) -> torch.Tensor:
    """Preserve implicit-zero moment layout through a nonblocking host copy."""

    if tensor.ndim == 2 and tensor.stride(1) == 0:
        compact_t = _enqueue_pinned_cpu_tensor_boundary(
            tensor[:, :1],
            transfer_stream=transfer_stream,
        )
        return compact_t.expand(tensor.shape)
    return _enqueue_pinned_cpu_tensor_boundary(
        tensor,
        transfer_stream=transfer_stream,
    )


def _enqueue_candidate_page_host_transfer_boundary(
    bundle: NoNEPageBundle,
    *,
    finite_components_t: torch.Tensor,
    finite_t: torch.Tensor,
    signaled_t: torch.Tensor,
    transfer_stream: torch.cuda.Stream | None,
) -> _NoNECandidatePageHostTransfer:
    """Move one page to host without synchronizing the page-update loop."""

    source_device = bundle.weights.gate_t.device
    if source_device.type != "cuda":
        if transfer_stream is not None:
            raise ValueError("CPU page transfer cannot use a CUDA stream")
        return _NoNECandidatePageHostTransfer(
            bundle=_move_page_bundle_boundary(
                bundle,
                device=torch.device("cpu"),
                dtype=bundle.weights.gate_t.dtype,
                trainable=False,
            ),
            finite_components_t=finite_components_t.detach().cpu(),
            finite_t=finite_t.detach().cpu(),
            signaled_t=signaled_t.detach().cpu(),
            completion_event=None,
        )
    if transfer_stream is None:
        raise ValueError("CUDA page transfer requires a transfer stream")
    source_tensors = (
        bundle.weights.page_ids_t,
        bundle.weights.ffn_mode_t,
        *_page_parameter_tensors(bundle.weights),
        bundle.optimizer_mean_t,
        bundle.optimizer_square_t,
        bundle.step_t,
        finite_components_t,
        finite_t,
        signaled_t,
    )
    if any(tensor.device != source_device for tensor in source_tensors):
        raise RuntimeError("candidate page transfer devices differ")
    transfer_stream.wait_stream(torch.cuda.current_stream(device=source_device))
    with torch.cuda.stream(transfer_stream):
        weights = NoNEPageWeights(
            page_ids_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.page_ids_t,
                transfer_stream=transfer_stream,
            ),
            ffn_mode_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.ffn_mode_t,
                transfer_stream=transfer_stream,
            ),
            gate_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.gate_t,
                transfer_stream=transfer_stream,
            ),
            up_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.up_t,
                transfer_stream=transfer_stream,
            ),
            down_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.down_t,
                transfer_stream=transfer_stream,
            ),
            glyph_down_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.glyph_down_t,
                transfer_stream=transfer_stream,
            ),
            glyph_up_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.glyph_up_t,
                transfer_stream=transfer_stream,
            ),
            translation_gate_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.translation_gate_t,
                transfer_stream=transfer_stream,
            ),
            outcome_memory_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.outcome_memory_t,
                transfer_stream=transfer_stream,
            ),
            repair_memory_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.repair_memory_t,
                transfer_stream=transfer_stream,
            ),
            transfer_memory_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.weights.transfer_memory_t,
                transfer_stream=transfer_stream,
            ),
        )
        host_bundle = NoNEPageBundle(
            weights=weights,
            optimizer_mean_t=_enqueue_pinned_optimizer_matrix_boundary(
                bundle.optimizer_mean_t,
                transfer_stream=transfer_stream,
            ),
            optimizer_square_t=_enqueue_pinned_optimizer_matrix_boundary(
                bundle.optimizer_square_t,
                transfer_stream=transfer_stream,
            ),
            step_t=_enqueue_pinned_cpu_tensor_boundary(
                bundle.step_t,
                transfer_stream=transfer_stream,
            ),
        )
        host_finite_t = _enqueue_pinned_cpu_tensor_boundary(
            finite_t,
            transfer_stream=transfer_stream,
        )
        host_finite_components_t = _enqueue_pinned_cpu_tensor_boundary(
            finite_components_t,
            transfer_stream=transfer_stream,
        )
        host_signaled_t = _enqueue_pinned_cpu_tensor_boundary(
            signaled_t,
            transfer_stream=transfer_stream,
        )
        completion_event = torch.cuda.Event()  # type: ignore[no-untyped-call]
        completion_event.record(  # type: ignore[no-untyped-call]
            transfer_stream
        )
    return _NoNECandidatePageHostTransfer(
        bundle=host_bundle,
        finite_components_t=host_finite_components_t,
        finite_t=host_finite_t,
        signaled_t=host_signaled_t,
        completion_event=completion_event,
    )


def _concatenate_page_weights_boundary(
    bundles: tuple[NoNEPageBundle, ...],
) -> NoNEPageWeights:
    """Compose only model-forward weights in the exact routed order."""

    if not bundles:
        raise ValueError("NoNE page composition requires at least one bundle")
    return NoNEPageWeights(
        page_ids_t=torch.cat(
            tuple(bundle.weights.page_ids_t for bundle in bundles),
            dim=0,
        ),
        ffn_mode_t=torch.cat(
            tuple(bundle.weights.ffn_mode_t for bundle in bundles),
            dim=0,
        ),
        gate_t=torch.cat(
            tuple(bundle.weights.gate_t for bundle in bundles),
            dim=0,
        ),
        up_t=torch.cat(
            tuple(bundle.weights.up_t for bundle in bundles),
            dim=0,
        ),
        down_t=torch.cat(
            tuple(bundle.weights.down_t for bundle in bundles),
            dim=0,
        ),
        glyph_down_t=torch.cat(
            tuple(bundle.weights.glyph_down_t for bundle in bundles),
            dim=0,
        ),
        glyph_up_t=torch.cat(
            tuple(bundle.weights.glyph_up_t for bundle in bundles),
            dim=0,
        ),
        translation_gate_t=torch.cat(
            tuple(bundle.weights.translation_gate_t for bundle in bundles),
            dim=0,
        ),
        outcome_memory_t=torch.cat(
            tuple(bundle.weights.outcome_memory_t for bundle in bundles),
            dim=0,
        ),
        repair_memory_t=torch.cat(
            tuple(bundle.weights.repair_memory_t for bundle in bundles),
            dim=0,
        ),
        transfer_memory_t=torch.cat(
            tuple(bundle.weights.transfer_memory_t for bundle in bundles),
            dim=0,
        ),
    )


def concatenate_page_bundles(
    bundles: tuple[NoNEPageBundle, ...],
) -> NoNEPageBundle:
    """Compose page rows in the exact model-requested order."""

    weights = _concatenate_page_weights_boundary(bundles)
    return NoNEPageBundle(
        weights=weights,
        optimizer_mean_t=_concatenate_optimizer_matrices_boundary(
            tuple(bundle.optimizer_mean_t for bundle in bundles),
        ),
        optimizer_square_t=_concatenate_optimizer_matrices_boundary(
            tuple(bundle.optimizer_square_t for bundle in bundles),
        ),
        step_t=torch.cat(
            tuple(bundle.step_t for bundle in bundles),
            dim=0,
        ),
    )


def _flatten_page_parameters(
    tensors: tuple[torch.Tensor, ...],
) -> torch.Tensor:
    page_count = tensors[0].shape[0]
    return torch.cat(
        tuple(tensor.float().reshape(page_count, -1) for tensor in tensors),
        dim=1,
    )


def _flatten_page_parameters_to_device_boundary(
    tensors: tuple[torch.Tensor, ...],
    *,
    device: torch.device,
) -> torch.Tensor:
    """Flatten one owned page directly on its optimizer-state device."""

    if not tensors:
        raise ValueError("page parameter flattening received no tensors")
    page_count = tensors[0].shape[0]
    if any(tensor.shape[0] != page_count for tensor in tensors):
        raise ValueError("page parameter tensor counts differ")
    return torch.cat(
        tuple(
            tensor.detach()
            .to(device=device, dtype=torch.float32)
            .reshape(page_count, -1)
            for tensor in tensors
        ),
        dim=1,
    )


def _bounded_finite_product(
    factor_t: torch.Tensor,
    scale_t: torch.Tensor,
) -> torch.Tensor:
    """Multiply finite FP32 proof values without representational overflow.

    Page-gradient proofs are stored in FP32, while a mathematically finite L2
    norm can exceed FP32 when millions of individually finite BF16 gradients
    are aggregated.  Perform only the small proof product in FP64 and saturate
    it at the FP32 boundary.  Nonfinite inputs deliberately retain their
    ordinary FP32 result so the candidate finite fence still rejects them.
    """

    raw_product_t = factor_t * scale_t
    max_float_t = torch.finfo(torch.float32).max
    bounded_product_t = (
        factor_t.to(dtype=torch.float64)
        .mul(scale_t.to(dtype=torch.float64))
        .clamp(min=-max_float_t, max=max_float_t)
        .to(dtype=torch.float32)
    )
    return torch.where(
        torch.isfinite(factor_t) & torch.isfinite(scale_t),
        bounded_product_t,
        raw_product_t,
    )


def _stable_row_l2_norm(values_t: torch.Tensor) -> torch.Tensor:
    """Return row L2 norms without overflowing on finite large values."""

    if values_t.ndim != 2 or values_t.shape[1] < 1:
        raise ValueError("stable row norm requires a nonempty matrix")
    row_scale_t = values_t.abs().amax(dim=1)
    # Exact zero rows use a unit divisor and are multiplied back by zero.
    # NaN/Inf scales deliberately remain NaN/Inf through the arithmetic so
    # the downstream finite fence rejects them; no sanitization or clipping
    # can turn a nonfinite candidate into an admissible update.
    divisor_t = torch.where(
        row_scale_t.eq(0),
        torch.ones_like(row_scale_t),
        row_scale_t,
    )
    normalized_t = values_t / divisor_t.unsqueeze(1)
    normalized_norm_t = cast(
        torch.Tensor,
        torch.linalg.vector_norm(normalized_t, dim=1),
    )
    return _bounded_finite_product(normalized_norm_t, row_scale_t)


def _page_gradient_signature(
    flat_gradient_t: torch.Tensor,
    gradient_norm_t: torch.Tensor,
) -> torch.Tensor:
    """Summarize gradient direction without moving expert state to the host."""

    if flat_gradient_t.ndim != 2 or flat_gradient_t.shape[1] < 2:
        raise ValueError("page gradient signature requires at least two values")
    if gradient_norm_t.shape != (flat_gradient_t.shape[0],):
        raise ValueError("page gradient norm geometry differs")
    split = flat_gradient_t.shape[1] // 2
    row_scale_t = flat_gradient_t.abs().amax(dim=1)
    divisor_t = torch.where(
        row_scale_t.eq(0),
        torch.ones_like(row_scale_t),
        row_scale_t,
    )
    normalized_t = flat_gradient_t / divisor_t.unsqueeze(1)
    even_t = normalized_t[:, 0::2]
    odd_t = normalized_t[:, 1::2]
    normalized_norm_t = cast(
        torch.Tensor,
        torch.linalg.vector_norm(normalized_t, dim=1),
    )
    row_rms_t = _bounded_finite_product(
        normalized_norm_t * (flat_gradient_t.shape[1] ** -0.5),
        row_scale_t,
    )
    return torch.stack(
        (
            _bounded_finite_product(normalized_t.mean(dim=1), row_scale_t),
            _bounded_finite_product(
                normalized_t.abs().mean(dim=1),
                row_scale_t,
            ),
            row_rms_t,
            flat_gradient_t.amax(dim=1),
            flat_gradient_t.amin(dim=1),
            _bounded_finite_product(
                normalized_t[:, :split].mean(dim=1),
                row_scale_t,
            ),
            _bounded_finite_product(
                normalized_t[:, split:].mean(dim=1),
                row_scale_t,
            ),
            _bounded_finite_product(
                even_t.mean(dim=1) - odd_t.mean(dim=1),
                row_scale_t,
            ),
        ),
        dim=1,
    )


def _distinct_normalized_gradient_rows(
    gradient_signature_t: torch.Tensor,
) -> torch.Tensor:
    """Mark unique gradient directions without a full-row CUDA ``unique``.

    ``torch.unique(..., dim=0)`` sorts every signature component and then
    synchronizes the CUDA stream.  The proof only needs to reject exact
    duplicate rows, so sort a deterministic one-dimensional bit hash first
    and compare rows exactly inside adjacent hash buckets.  Hash collisions
    therefore add comparisons but can never turn an equal pair into a unique
    pair.
    """

    if gradient_signature_t.ndim != 2:
        raise ValueError("page gradient signatures must be a matrix")
    if gradient_signature_t.shape[0] == 0:
        return gradient_signature_t.new_empty((0,), dtype=torch.bool)
    normalized_signature_t = F.normalize(
        gradient_signature_t.float(),
        dim=1,
    )
    contiguous_t = normalized_signature_t.contiguous()
    bit_rows_t = contiguous_t.view(torch.int32).reshape(
        contiguous_t.shape[0],
        contiguous_t.shape[1],
    )
    bit_rows_i64_t = bit_rows_t.to(dtype=torch.int64)
    column_weights_t = torch.arange(
        1,
        bit_rows_i64_t.shape[1] + 1,
        dtype=torch.int64,
        device=bit_rows_i64_t.device,
    )
    hash_t = (bit_rows_i64_t * column_weights_t).sum(dim=1)
    order_t = torch.argsort(hash_t, stable=True)
    sorted_hash_t = hash_t.index_select(0, order_t)
    sorted_rows_t = contiguous_t.index_select(0, order_t)
    adjacent_same_hash_t = sorted_hash_t[1:].eq(sorted_hash_t[:-1])
    adjacent_equal_t = torch.zeros_like(adjacent_same_hash_t)
    if adjacent_same_hash_t.numel() > 0:
        adjacent_equal_t = adjacent_same_hash_t & sorted_rows_t[1:].eq(
            sorted_rows_t[:-1]
        ).all(dim=1)
    duplicate_sorted_t = torch.zeros(
        sorted_hash_t.shape,
        dtype=torch.bool,
        device=sorted_hash_t.device,
    )
    if adjacent_equal_t.numel() > 0:
        duplicate_sorted_t[1:] |= adjacent_equal_t
        duplicate_sorted_t[:-1] |= adjacent_equal_t
    duplicate_t = torch.zeros_like(duplicate_sorted_t).index_copy(
        0,
        order_t,
        duplicate_sorted_t,
    )
    return ~duplicate_t


def combine_page_training_proofs(
    packets: tuple[NoNEPageTrainingProofPacket, ...],
) -> NoNEPageTrainingProofPacket:
    """Combine layer-local family proof into one global tensor contract."""

    if not packets:
        raise ValueError("NoNE family training proof requires attached pages")
    family_page_ids_t = torch.cat(
        tuple(packet.family_page_ids_t for packet in packets),
        dim=0,
    )
    route_count_t = torch.cat(
        tuple(packet.route_count_t for packet in packets),
        dim=0,
    )
    gradient_update_count_t = torch.cat(
        tuple(packet.gradient_update_count_t for packet in packets),
        dim=0,
    )
    gradient_norm_t = torch.cat(
        tuple(packet.gradient_norm_t for packet in packets),
        dim=0,
    )
    parameter_delta_norm_t = torch.cat(
        tuple(packet.parameter_delta_norm_t for packet in packets),
        dim=0,
    )
    gradient_signature_t = torch.cat(
        tuple(packet.gradient_signature_t for packet in packets),
        dim=0,
    )
    order_t = torch.argsort(family_page_ids_t)
    family_page_ids_t = family_page_ids_t.index_select(0, order_t)
    route_count_t = route_count_t.index_select(0, order_t)
    gradient_update_count_t = gradient_update_count_t.index_select(
        0,
        order_t,
    )
    gradient_norm_t = gradient_norm_t.index_select(0, order_t)
    parameter_delta_norm_t = parameter_delta_norm_t.index_select(0, order_t)
    gradient_signature_t = gradient_signature_t.index_select(0, order_t)
    route_coverage_t = route_count_t.gt(0).all()
    gradient_coverage_t = gradient_update_count_t.gt(0).all()
    finite_t = (
        torch.isfinite(gradient_norm_t).all()
        & torch.isfinite(parameter_delta_norm_t).all()
        & torch.isfinite(gradient_signature_t).all()
    )
    distinct_gradient_t = (
        _distinct_normalized_gradient_rows(gradient_signature_t).all()
        if family_page_ids_t.numel() > 1
        else gradient_coverage_t.clone()
    )
    positive_update_t = gradient_norm_t.gt(0).all() & parameter_delta_norm_t.gt(0).all()
    promotion_ready_t = (
        route_coverage_t
        & gradient_coverage_t
        & distinct_gradient_t
        & finite_t
        & positive_update_t
    )
    return NoNEPageTrainingProofPacket(
        family_page_ids_t=family_page_ids_t,
        route_count_t=route_count_t,
        gradient_update_count_t=gradient_update_count_t,
        gradient_norm_t=gradient_norm_t,
        parameter_delta_norm_t=parameter_delta_norm_t,
        gradient_signature_t=gradient_signature_t,
        route_coverage_t=route_coverage_t,
        gradient_coverage_t=gradient_coverage_t,
        distinct_gradient_t=distinct_gradient_t,
        finite_t=finite_t,
        promotion_ready_t=promotion_ready_t,
    )


def derive_none_accepted_training_saturation(
    *,
    accepted_generation_t: torch.Tensor,
    accepted_manifest_payload_sha256_t: torch.Tensor,
    training_eligible_page_ids_t: torch.Tensor,
    accepted_training_proven_page_ids_t: torch.Tensor,
) -> NoNEAcceptedTrainingSaturationPacket:
    """Bind exact cumulative accepted proof to one immutable page manifest."""

    generation_t = (
        accepted_generation_t.detach().cpu().long().reshape(()).clone()
    )
    manifest_payload_sha256_t = (
        accepted_manifest_payload_sha256_t.detach()
        .cpu()
        .to(dtype=torch.uint8)
        .reshape(-1)
        .clone()
    )
    eligible_ids_t = torch.sort(
        training_eligible_page_ids_t.detach().cpu().long().reshape(-1)
    ).values
    proven_ids_t = torch.sort(
        accepted_training_proven_page_ids_t.detach()
        .cpu()
        .long()
        .reshape(-1)
    ).values
    if (
        int(generation_t) < 1
        or manifest_payload_sha256_t.shape != (32,)
        or eligible_ids_t.numel() < 1
        or torch.unique(eligible_ids_t).numel() != eligible_ids_t.numel()
        or torch.unique(proven_ids_t).numel() != proven_ids_t.numel()
        or bool(eligible_ids_t.lt(0).any())
        or bool(proven_ids_t.lt(0).any())
        or bool((~torch.isin(proven_ids_t, eligible_ids_t)).any())
    ):
        raise ValueError("NoNE accepted training saturation identity differs")
    proven_mask_t = torch.isin(eligible_ids_t, proven_ids_t)
    remaining_ids_t = eligible_ids_t.masked_select(~proven_mask_t)
    return NoNEAcceptedTrainingSaturationPacket(
        accepted_generation_t=generation_t,
        accepted_manifest_payload_sha256_t=manifest_payload_sha256_t,
        training_eligible_page_ids_t=eligible_ids_t,
        accepted_training_proven_page_ids_t=proven_ids_t,
        remaining_unproven_page_ids_t=remaining_ids_t,
        saturated_t=proven_mask_t.all(),
    )


def validate_none_accepted_training_saturation_boundary(
    packet: NoNEAcceptedTrainingSaturationPacket,
) -> torch.Tensor:
    """Fail closed if any manifest-bound saturation tensor has changed."""

    if not isinstance(packet, NoNEAcceptedTrainingSaturationPacket):
        raise TypeError("NoNE accepted training saturation packet is malformed")
    rebuilt = derive_none_accepted_training_saturation(
        accepted_generation_t=packet.accepted_generation_t,
        accepted_manifest_payload_sha256_t=(
            packet.accepted_manifest_payload_sha256_t
        ),
        training_eligible_page_ids_t=packet.training_eligible_page_ids_t,
        accepted_training_proven_page_ids_t=(
            packet.accepted_training_proven_page_ids_t
        ),
    )
    tensor_names = (
        "accepted_generation_t",
        "accepted_manifest_payload_sha256_t",
        "training_eligible_page_ids_t",
        "accepted_training_proven_page_ids_t",
        "remaining_unproven_page_ids_t",
        "saturated_t",
    )
    if any(
        not torch.equal(
            getattr(packet, name).detach().cpu(),
            getattr(rebuilt, name),
        )
        for name in tensor_names
    ):
        raise RuntimeError("NoNE accepted training saturation tensors changed")
    return rebuilt.saturated_t.clone()


def derive_none_scale_evidence(
    *,
    accepted_proof: NoNEPageTrainingProofPacket,
    candidate_proof: NoNEPageTrainingProofPacket,
    family_root_page_ids_t: torch.Tensor,
    retention_passed_t: torch.Tensor,
) -> NoNEScaleEvidencePacket:
    """Derive fresh family-root growth pressure from one retained proposal.

    Candidate totals are compared with the exact accepted prefix, so historical
    cumulative gradients cannot repeatedly authorize growth.  Only roots with
    a fresh routed update, a positive parameter delta, finite tensors, and a
    gradient signature distinct from every other eligible root carry pressure
    into the later storage planner.  ``retention_passed_t`` is the tensor form
    of the completed held-out retention decision; a rejected proposal emits an
    inert packet.
    """

    accepted_ids_t = accepted_proof.family_page_ids_t.reshape(-1).long()
    candidate_ids_t = candidate_proof.family_page_ids_t.reshape(-1).long()
    root_ids_t = family_root_page_ids_t.reshape(-1).long().to(
        device=candidate_ids_t.device
    )
    if root_ids_t.numel() < 1:
        raise ValueError("NoNE scale evidence requires family roots")
    if retention_passed_t.numel() != 1:
        raise ValueError("NoNE scale evidence retention proof must be scalar")
    if (
        accepted_ids_t.shape != candidate_ids_t.shape
        or not torch.equal(accepted_ids_t, candidate_ids_t)
    ):
        raise ValueError("NoNE scale evidence page identity changed in proposal")
    if torch.unique(root_ids_t).numel() != root_ids_t.numel():
        raise ValueError("NoNE scale evidence repeats a family root")

    proof_count = candidate_ids_t.numel()
    signature_width = candidate_proof.gradient_signature_t.shape[-1]
    scalar_shapes = (
        accepted_proof.route_count_t.shape,
        accepted_proof.gradient_update_count_t.shape,
        accepted_proof.gradient_norm_t.shape,
        accepted_proof.parameter_delta_norm_t.shape,
        candidate_proof.route_count_t.shape,
        candidate_proof.gradient_update_count_t.shape,
        candidate_proof.gradient_norm_t.shape,
        candidate_proof.parameter_delta_norm_t.shape,
    )
    if any(shape != (proof_count,) for shape in scalar_shapes) or (
        accepted_proof.gradient_signature_t.shape
        != (proof_count, signature_width)
        or candidate_proof.gradient_signature_t.shape
        != (proof_count, signature_width)
    ):
        raise ValueError("NoNE scale evidence proof geometry differs")

    root_match_t = root_ids_t.unsqueeze(1).eq(
        candidate_ids_t.to(device=root_ids_t.device).unsqueeze(0)
    )
    root_present_t = root_match_t.to(dtype=torch.long).sum(dim=1).eq(1)
    if not root_present_t.all():
        root_ids_t = root_ids_t[root_present_t]
        root_match_t = root_ids_t.unsqueeze(1).eq(
            candidate_ids_t.to(device=root_ids_t.device).unsqueeze(0)
        )
        if root_ids_t.numel() < 1:
            n = family_root_page_ids_t.numel()
            dev = family_root_page_ids_t.device
            return NoNEScaleEvidencePacket(
                family_page_ids_t=family_root_page_ids_t,
                retained_family_mask_t=torch.zeros(n, device=dev, dtype=torch.bool),
                unresolved_gap_pressure_t=torch.zeros(n, device=dev, dtype=torch.float32),
                route_pressure_t=torch.zeros(n, device=dev, dtype=torch.float32),
                distinct_gradient_mask_t=torch.zeros(n, device=dev, dtype=torch.bool),
                fresh_gradient_update_count_t=torch.zeros(n, device=dev, dtype=torch.long),
                fresh_gradient_norm_t=torch.zeros(n, device=dev, dtype=torch.float32),
                fresh_parameter_delta_norm_t=torch.zeros(n, device=dev, dtype=torch.float32),
                fresh_gradient_signature_t=torch.zeros(n, signature_width, device=dev, dtype=torch.float32),
                evidence_ready_t=torch.tensor(False, device=dev),
            )
    root_index_t = root_match_t.to(dtype=torch.long).argmax(dim=1)

    accepted_route_t = accepted_proof.route_count_t.to(
        device=root_index_t.device,
        dtype=torch.long,
    ).index_select(0, root_index_t)
    candidate_route_t = candidate_proof.route_count_t.to(
        device=root_index_t.device,
        dtype=torch.long,
    ).index_select(0, root_index_t)
    accepted_updates_t = accepted_proof.gradient_update_count_t.to(
        device=root_index_t.device,
        dtype=torch.long,
    ).index_select(0, root_index_t)
    candidate_updates_t = candidate_proof.gradient_update_count_t.to(
        device=root_index_t.device,
        dtype=torch.long,
    ).index_select(0, root_index_t)
    accepted_gradient_norm_t = accepted_proof.gradient_norm_t.to(
        device=root_index_t.device,
        dtype=torch.float32,
    ).index_select(0, root_index_t)
    candidate_gradient_norm_t = candidate_proof.gradient_norm_t.to(
        device=root_index_t.device,
        dtype=torch.float32,
    ).index_select(0, root_index_t)
    accepted_parameter_delta_t = accepted_proof.parameter_delta_norm_t.to(
        device=root_index_t.device,
        dtype=torch.float32,
    ).index_select(0, root_index_t)
    candidate_parameter_delta_t = candidate_proof.parameter_delta_norm_t.to(
        device=root_index_t.device,
        dtype=torch.float32,
    ).index_select(0, root_index_t)
    accepted_signature_t = accepted_proof.gradient_signature_t.to(
        device=root_index_t.device,
        dtype=torch.float32,
    ).index_select(0, root_index_t)
    candidate_signature_t = candidate_proof.gradient_signature_t.to(
        device=root_index_t.device,
        dtype=torch.float32,
    ).index_select(0, root_index_t)

    fresh_route_t = candidate_route_t - accepted_route_t
    fresh_updates_t = candidate_updates_t - accepted_updates_t
    fresh_gradient_norm_t = candidate_gradient_norm_t - accepted_gradient_norm_t
    fresh_parameter_delta_t = (
        candidate_parameter_delta_t - accepted_parameter_delta_t
    )
    _tensor_assert(
        fresh_route_t.ge(0).all()
        & fresh_updates_t.ge(0).all()
        & fresh_gradient_norm_t.ge(0).all()
        & fresh_parameter_delta_t.ge(0).all(),
        "NoNE scale evidence candidate is not an additive prefix",
    )

    accepted_signature_total_t = (
        accepted_signature_t * accepted_updates_t.to(dtype=torch.float32).unsqueeze(1)
    )
    candidate_signature_total_t = (
        candidate_signature_t
        * candidate_updates_t.to(dtype=torch.float32).unsqueeze(1)
    )
    fresh_signature_t = (
        candidate_signature_total_t - accepted_signature_total_t
    ) / fresh_updates_t.clamp_min(1).to(dtype=torch.float32).unsqueeze(1)
    finite_t = (
        torch.isfinite(fresh_gradient_norm_t)
        & torch.isfinite(fresh_parameter_delta_t)
        & torch.isfinite(fresh_signature_t).all(dim=1)
    )
    retained_t = retention_passed_t.to(
        device=root_index_t.device,
        dtype=torch.bool,
    ).reshape(())
    retained_family_t = (
        retained_t
        & finite_t
        & fresh_route_t.gt(0)
        & fresh_updates_t.gt(0)
        & fresh_gradient_norm_t.gt(0)
        & fresh_parameter_delta_t.gt(0)
    )
    retained_indexes_t = retained_family_t.nonzero(as_tuple=False).reshape(-1)
    retained_distinct_t = _distinct_normalized_gradient_rows(
        fresh_signature_t.index_select(0, retained_indexes_t)
    )
    distinct_gradient_t = torch.zeros_like(retained_family_t).index_copy(
        0,
        retained_indexes_t,
        retained_distinct_t,
    )
    unresolved_gap_t = torch.where(
        retained_family_t,
        fresh_gradient_norm_t
        / fresh_updates_t.clamp_min(1).to(dtype=torch.float32),
        torch.zeros_like(fresh_gradient_norm_t),
    )
    evidence_ready_t = (
        retained_family_t & distinct_gradient_t & unresolved_gap_t.gt(0)
    ).any()
    return NoNEScaleEvidencePacket(
        family_page_ids_t=root_ids_t,
        retained_family_mask_t=retained_family_t,
        unresolved_gap_pressure_t=unresolved_gap_t,
        route_pressure_t=fresh_route_t.to(dtype=torch.float32),
        distinct_gradient_mask_t=distinct_gradient_t,
        fresh_gradient_update_count_t=fresh_updates_t,
        fresh_gradient_norm_t=fresh_gradient_norm_t,
        fresh_parameter_delta_norm_t=fresh_parameter_delta_t,
        fresh_gradient_signature_t=fresh_signature_t,
        evidence_ready_t=evidence_ready_t,
    )


def plan_none_scale_cohort(
    *,
    family_page_ids_t: torch.Tensor,
    retained_family_mask_t: torch.Tensor,
    unresolved_gap_pressure_t: torch.Tensor,
    route_pressure_t: torch.Tensor,
    distinct_gradient_mask_t: torch.Tensor,
    replica_free_bytes_t: torch.Tensor,
    reserve_bytes_t: torch.Tensor,
    measured_compact_page_bytes_t: torch.Tensor,
    page_parameter_elements_t: torch.Tensor,
    current_physical_parameter_elements_t: torch.Tensor,
    capacity_envelope_parameter_elements_t: torch.Tensor,
    objective_compatible_family_mask_t: torch.Tensor | None = None,
) -> NoNEScaleCohortPacket:
    """Select one storage-safe, gap-owned child-page cohort.

    This tensor-native planner neither creates pages nor claims training.  At
    least one child is proposed for each selected retained family before any
    additional capacity is apportioned by model-owned gap and route pressure.
    This lets a retained frontier co-grow many objective children without a
    host-authored page cap.  A later cohort still requires a newly retained
    frontier and fresh model-owned gap data.
    """

    family_ids_t = family_page_ids_t.reshape(-1).long()
    retained_t = retained_family_mask_t.reshape(-1).bool()
    gap_t = unresolved_gap_pressure_t.reshape(-1).float()
    route_t = route_pressure_t.reshape(-1).float()
    distinct_t = distinct_gradient_mask_t.reshape(-1).bool()
    family_count = family_ids_t.shape[0]
    if (
        retained_t.shape != (family_count,)
        or gap_t.shape != (family_count,)
        or route_t.shape != (family_count,)
        or distinct_t.shape != (family_count,)
    ):
        raise ValueError("NoNE scale-cohort family geometry differs")
    if family_count < 1:
        raise ValueError("NoNE scale cohort requires family roots")
    if torch.unique(family_ids_t).numel() != family_ids_t.numel():
        raise ValueError("NoNE scale cohort repeats a family page identity")

    free_bytes_t = replica_free_bytes_t.reshape(-1).long()
    if free_bytes_t.shape[0] < 1:
        raise ValueError("NoNE scale cohort requires replica storage")
    reserve_t = reserve_bytes_t.reshape(()).long()
    compact_bytes_t = measured_compact_page_bytes_t.reshape(()).long()
    page_elements_t = page_parameter_elements_t.reshape(()).long()
    current_elements_t = current_physical_parameter_elements_t.reshape(()).long()
    envelope_elements_t = capacity_envelope_parameter_elements_t.reshape(()).long()
    _tensor_assert(family_ids_t.ge(0).all(), "family page IDs must be nonnegative")
    _tensor_assert(free_bytes_t.ge(0).all(), "replica free bytes must be nonnegative")
    _tensor_assert(reserve_t.ge(0), "storage reserve must be nonnegative")
    _tensor_assert(compact_bytes_t.gt(0), "compact page bytes must be positive")
    _tensor_assert(page_elements_t.gt(0), "page elements must be positive")
    _tensor_assert(current_elements_t.ge(0), "current parameters must be nonnegative")
    _tensor_assert(envelope_elements_t.ge(0), "capacity envelope must be nonnegative")

    finite_t = torch.isfinite(gap_t) & torch.isfinite(route_t)
    eligible_t = retained_t & distinct_t & finite_t & gap_t.gt(0)
    evidence_priority_t = gap_t.clamp_min(0) * (1.0 + F.softplus(route_t))
    priority_t = torch.where(
        eligible_t,
        evidence_priority_t,
        torch.full_like(
            evidence_priority_t,
            torch.finfo(evidence_priority_t.dtype).min,
        ),
    )
    order_t = torch.argsort(priority_t, descending=True, stable=True)
    ordered_eligible_t = eligible_t.index_select(0, order_t)
    ordered_family_ids_t = family_ids_t.index_select(0, order_t)
    ordered_priority_t = priority_t.index_select(0, order_t)

    available_bytes_t = (free_bytes_t - reserve_t).clamp_min(0)
    storage_capacity_t = torch.div(
        available_bytes_t.amin(),
        compact_bytes_t,
        rounding_mode="floor",
    )
    remaining_elements_t = (
        envelope_elements_t - current_elements_t
    ).clamp_min(0)
    envelope_capacity_t = torch.div(
        remaining_elements_t,
        page_elements_t,
        rounding_mode="floor",
    )
    eligible_count_t = eligible_t.to(dtype=torch.long).sum()
    page_capacity_t = torch.minimum(storage_capacity_t, envelope_capacity_t)
    cohort_demand_count_t = eligible_count_t
    if objective_compatible_family_mask_t is not None:
        if (
            objective_compatible_family_mask_t.ndim != 2
            or objective_compatible_family_mask_t.shape[0] < 1
            or objective_compatible_family_mask_t.shape[1] != family_count
            or objective_compatible_family_mask_t.device != family_ids_t.device
        ):
            raise ValueError(
                "NoNE objective-compatible family geometry differs"
        )
        objective_compatible_t = objective_compatible_family_mask_t.bool()
        eligible_compatible_t = objective_compatible_t & eligible_t.unsqueeze(0)
        objective_has_retained_t = eligible_compatible_t.any(
            dim=1,
            keepdim=True,
        )
        evidence_compatible_t = objective_compatible_t & finite_t.unsqueeze(0)
        _tensor_assert(
            evidence_compatible_t.any(dim=1).all(),
            "pending objective has no finite model-owned family",
        )
        admission_compatible_t = torch.where(
            objective_has_retained_t,
            eligible_compatible_t,
            evidence_compatible_t,
        )
        objective_count = objective_compatible_t.shape[0]
        cohort_demand_count_t = torch.full_like(page_capacity_t, objective_count)
        selected_page_count_t = torch.minimum(
            page_capacity_t,
            cohort_demand_count_t,
        )
        objective_priority_t = torch.where(
            admission_compatible_t,
            evidence_priority_t.unsqueeze(0),
            torch.full_like(
                admission_compatible_t,
                torch.finfo(evidence_priority_t.dtype).min,
                dtype=evidence_priority_t.dtype,
            ),
        )
        objective_owner_index_t = objective_priority_t.argmax(dim=1)
        objective_owner_family_ids_t = family_ids_t.index_select(
            0,
            objective_owner_index_t,
        )
        objective_owner_priority_t = objective_priority_t.gather(
            1,
            objective_owner_index_t.unsqueeze(1),
        ).squeeze(1)
        selected_objective_t = torch.arange(
            objective_count,
            device=family_ids_t.device,
            dtype=torch.long,
        ).lt(selected_page_count_t)
        selected_family_ids_t = objective_owner_family_ids_t.masked_select(
            selected_objective_t
        )
        selected_priority_t = objective_owner_priority_t.masked_select(
            selected_objective_t
        )
        # Objective admission may deliberately fall back from the stricter
        # retained-family set to any finite, model-compatible parent.  Bind
        # the external owner-count authority to that exact admission mask so
        # valid fallback owners are not rejected after the tensor decision.
        eligible_count_t = admission_compatible_t.any(dim=0).long().sum()
    else:
        unique_selected_count_t = torch.minimum(page_capacity_t, eligible_count_t)
        selected_position_t = torch.arange(
            family_count,
            device=family_ids_t.device,
            dtype=torch.long,
        ).lt(unique_selected_count_t)
        base_count_t = (ordered_eligible_t & selected_position_t).to(
            dtype=torch.long
        )
        remaining_count_t = torch.where(
            eligible_count_t.gt(0),
            (page_capacity_t - base_count_t.sum()).clamp_min(0),
            torch.zeros_like(page_capacity_t),
        )
        eligible_priority_t = torch.where(
            ordered_eligible_t,
            ordered_priority_t.clamp_min(0),
            torch.zeros_like(ordered_priority_t),
        )
        priority_total_t = eligible_priority_t.sum()
        uniform_weight_t = ordered_eligible_t.to(dtype=torch.float32) / (
            eligible_count_t.clamp_min(1).to(dtype=torch.float32)
        )
        normalized_priority_t = torch.where(
            priority_total_t.gt(0),
            eligible_priority_t / priority_total_t.clamp_min(
                torch.finfo(eligible_priority_t.dtype).tiny
            ),
            uniform_weight_t,
        )
        raw_extra_count_t = (
            normalized_priority_t * remaining_count_t.to(dtype=torch.float32)
        )
        floor_extra_count_t = (
            torch.floor(raw_extra_count_t).to(dtype=torch.long)
            * ordered_eligible_t.to(dtype=torch.long)
        )
        leftover_count_t = (
            remaining_count_t - floor_extra_count_t.sum()
        ).clamp_min(0)
        fractional_priority_t = torch.where(
            ordered_eligible_t,
            raw_extra_count_t - floor_extra_count_t.to(dtype=torch.float32),
            torch.full_like(
                raw_extra_count_t,
                torch.finfo(raw_extra_count_t.dtype).min,
            ),
        )
        fractional_order_t = torch.argsort(
            fractional_priority_t,
            descending=True,
            stable=True,
        )
        bonus_in_order_t = torch.arange(
            family_count,
            device=family_ids_t.device,
            dtype=torch.long,
        ).lt(leftover_count_t)
        bonus_count_t = torch.zeros_like(base_count_t).scatter(
            0,
            fractional_order_t,
            bonus_in_order_t.to(dtype=torch.long),
        )
        child_count_t = base_count_t + floor_extra_count_t + bonus_count_t
        selected_family_ids_t = torch.repeat_interleave(
            ordered_family_ids_t,
            child_count_t,
        )
        selected_priority_t = torch.repeat_interleave(
            ordered_priority_t,
            child_count_t,
        )
        selected_page_count_t = child_count_t.sum()
    replica_count_t = torch.ones_like(free_bytes_t, dtype=torch.long).sum()
    return NoNEScaleCohortPacket(
        selected_family_page_ids_t=selected_family_ids_t,
        selected_priority_t=selected_priority_t,
        eligible_family_count_t=eligible_count_t,
        storage_page_capacity_t=storage_capacity_t,
        parameter_envelope_page_capacity_t=envelope_capacity_t,
        selected_page_count_t=selected_page_count_t,
        projected_physical_parameter_elements_t=(
            current_elements_t + selected_page_count_t * page_elements_t
        ),
        projected_replica_storage_bytes_t=(
            selected_page_count_t * compact_bytes_t * replica_count_t
        ),
        storage_limited_t=storage_capacity_t.lt(cohort_demand_count_t),
        parameter_envelope_limited_t=envelope_capacity_t.lt(
            cohort_demand_count_t
        ),
        ready_t=selected_page_count_t.gt(0),
    )


def update_page_bundle_from_gradients(
    bundle: NoNEPageBundle,
    optimizer: NoNEPageOptimizerPacket,
) -> NoNEPageUpdatePacket:
    """Apply one exact page-local AdamW step on the moment-residency device."""

    validate_page_bundle(bundle, synchronize_tensor_values=False)
    parameter_tensors = _page_parameter_tensors(bundle.weights)
    gradient_tensors = tuple(
        (tensor.grad if tensor.grad is not None else torch.zeros_like(tensor))
        for tensor in parameter_tensors
    )
    optimizer_device = bundle.optimizer_mean_t.device
    if bundle.optimizer_square_t.device != optimizer_device:
        raise RuntimeError("page optimizer moment devices differ")
    flat_parameter_t = _flatten_page_parameters_to_device_boundary(
        parameter_tensors,
        device=optimizer_device,
    )
    flat_gradient_t = _flatten_page_parameters_to_device_boundary(
        gradient_tensors,
        device=optimizer_device,
    )
    proof_gradient_t = flat_gradient_t
    raw_gradient_finite_t = torch.isfinite(proof_gradient_t).all(dim=1)
    # A single overflowed CUDA gradient must not poison the whole candidate
    # transaction.  Keep the update tensor-native and bound the value before
    # the square used by AdamW (float32's square otherwise overflows below its
    # representable maximum).  NaNs carry no usable learning signal and are
    # mapped to zero; the retained proof still requires a positive finite
    # gradient norm, so such a page is skipped rather than falsely committed.
    gradient_limit = math.sqrt(torch.finfo(flat_gradient_t.dtype).max)
    flat_gradient_t = torch.nan_to_num(
        flat_gradient_t,
        nan=0.0,
        posinf=gradient_limit,
        neginf=-gradient_limit,
    ).clamp(-gradient_limit, gradient_limit)
    if flat_parameter_t.shape != bundle.optimizer_mean_t.shape:
        raise RuntimeError("page optimizer state no longer matches parameters")
    scalar_tensors = (
        optimizer.learning_rate_t,
        optimizer.beta1_t,
        optimizer.beta2_t,
        optimizer.epsilon_t,
        optimizer.weight_decay_t,
    )
    if any(tensor.numel() != 1 for tensor in scalar_tensors):
        raise ValueError("page optimizer policy values must be scalar tensors")
    learning_rate_t = optimizer.learning_rate_t.to(flat_parameter_t).reshape(())
    beta1_t = optimizer.beta1_t.to(flat_parameter_t).reshape(())
    beta2_t = optimizer.beta2_t.to(flat_parameter_t).reshape(())
    epsilon_t = optimizer.epsilon_t.to(flat_parameter_t).reshape(())
    weight_decay_t = optimizer.weight_decay_t.to(flat_parameter_t).reshape(())
    _tensor_assert(
        (learning_rate_t > 0) & (epsilon_t > 0),
        "page optimizer learning rate and epsilon must be positive",
    )
    _tensor_assert(
        (beta1_t >= 0)
        & (beta1_t < 1)
        & (beta2_t >= 0)
        & (beta2_t < 1)
        & (weight_decay_t >= 0),
        "page optimizer policy is outside the valid range",
    )

    mean_t = torch.nan_to_num(
        bundle.optimizer_mean_t.to(flat_parameter_t),
        nan=0.0,
        posinf=gradient_limit,
        neginf=-gradient_limit,
    ).clamp(-gradient_limit, gradient_limit)
    square_t = torch.nan_to_num(
        bundle.optimizer_square_t.to(flat_parameter_t),
        nan=0.0,
        posinf=torch.finfo(flat_parameter_t.dtype).max,
        neginf=0.0,
    ).clamp_min(0.0)
    updated_mean_t = beta1_t * mean_t + (1.0 - beta1_t) * flat_gradient_t
    updated_square_t = beta2_t * square_t + (1.0 - beta2_t) * flat_gradient_t.square()
    step_t = bundle.step_t.detach().to(
        device=optimizer_device,
        dtype=torch.long,
    )
    updated_step_t = step_t + torch.ones_like(step_t)
    step_float_t = updated_step_t.to(flat_parameter_t.dtype).unsqueeze(1)
    corrected_mean_t = updated_mean_t / (
        1.0 - torch.pow(beta1_t, step_float_t)
    ).clamp_min(torch.finfo(flat_parameter_t.dtype).tiny)
    corrected_square_t = updated_square_t / (
        1.0 - torch.pow(beta2_t, step_float_t)
    ).clamp_min(torch.finfo(flat_parameter_t.dtype).tiny)
    updated_flat_t = flat_parameter_t - learning_rate_t * (
        corrected_mean_t / (corrected_square_t.sqrt() + epsilon_t)
        + weight_decay_t * flat_parameter_t
    )

    updated_tensors: list[torch.Tensor] = []
    offset = 0
    for tensor_index, tensor in enumerate(parameter_tensors):
        width = tensor[0].numel()
        updated_values_t = updated_flat_t.narrow(1, offset, width).reshape(
            tensor.shape
        )
        # Some compact page fields use float8 transfer storage.  The AdamW
        # math is intentionally carried out in float32, but a finite float32
        # update can still overflow when it is quantized back to that narrow
        # storage dtype.  Clamp at the representable boundary before the cast
        # so an otherwise valid retained transaction cannot publish NaN/Inf
        # page state or lose its exact durable cursor.
        if tensor.dtype.is_floating_point:
            dtype_info = torch.finfo(tensor.dtype)
            updated_values_t = updated_values_t.clamp(
                min=dtype_info.min,
                max=dtype_info.max,
            )
        retained_tensor_t = updated_values_t.to(dtype=tensor.dtype)
        if tensor_index < 3:
            retained_tensor_t = (
                project_resynthesis_expert_weight_int4_qat_boundary(
                    retained_tensor_t
                )
            )
        updated_tensors.append(retained_tensor_t)
        offset += width
    retained_flat_t = _flatten_page_parameters_to_device_boundary(
        tuple(updated_tensors),
        device=optimizer_device,
    )
    updated_weights = NoNEPageWeights(
        page_ids_t=bundle.weights.page_ids_t.detach().to(
            device=optimizer_device,
            dtype=torch.long,
            copy=True,
        ),
        ffn_mode_t=bundle.weights.ffn_mode_t.detach().to(
            device=optimizer_device,
            dtype=bundle.weights.ffn_mode_t.dtype,
            copy=True,
        ),
        gate_t=updated_tensors[0],
        up_t=updated_tensors[1],
        down_t=updated_tensors[2],
        glyph_down_t=updated_tensors[3],
        glyph_up_t=updated_tensors[4],
        translation_gate_t=updated_tensors[5],
        outcome_memory_t=updated_tensors[6],
        repair_memory_t=updated_tensors[7],
        transfer_memory_t=updated_tensors[8],
    )
    gradient_norm_t = _stable_row_l2_norm(proof_gradient_t)
    parameter_delta_norm_t = _stable_row_l2_norm(
        retained_flat_t - flat_parameter_t
    )
    gradient_signature_t = _page_gradient_signature(
        proof_gradient_t,
        gradient_norm_t,
    )
    retained_parameter_finite_t = (
        torch.isfinite(retained_flat_t).all(dim=1)
        & torch.cat(
            tuple(
                torch.isfinite(updated_tensor.float()).reshape(
                    updated_tensor.shape[0],
                    -1,
                )
                for updated_tensor in updated_tensors
            ),
            dim=1,
        ).all(dim=1)
    )
    finite_components_t = torch.stack(
        (
            raw_gradient_finite_t & retained_parameter_finite_t,
            torch.isfinite(updated_mean_t).all(dim=1)
            & torch.isfinite(updated_square_t).all(dim=1),
            torch.isfinite(gradient_norm_t),
            torch.isfinite(parameter_delta_norm_t),
            torch.isfinite(gradient_signature_t).all(dim=1),
            torch.isfinite(updated_weights.ffn_mode_t.float()).all(dim=1)
            & updated_weights.ffn_mode_t.float().ge(0).all(dim=1)
            & updated_weights.ffn_mode_t.float().le(1).all(dim=1),
            torch.ones_like(gradient_norm_t, dtype=torch.bool),
        ),
        dim=1,
    )
    finite_t = finite_components_t.all(dim=1)
    return NoNEPageUpdatePacket(
        bundle=NoNEPageBundle(
            weights=updated_weights,
            optimizer_mean_t=updated_mean_t,
            optimizer_square_t=updated_square_t,
            step_t=updated_step_t,
        ),
        page_ids_t=updated_weights.page_ids_t,
        gradient_norm_t=gradient_norm_t,
        parameter_delta_norm_t=parameter_delta_norm_t,
        gradient_signature_t=gradient_signature_t,
        finite_components_t=finite_components_t,
        finite_t=finite_t,
    )


def update_stateless_page_bundle_from_gradients_boundary(
    bundle: NoNEPageBundle,
    optimizer: NoNEPageOptimizerPacket,
) -> NoNEPageUpdatePacket:
    """Apply a moment-free normalized page update at the storage boundary.

    Compact transfer pages intentionally carry broadcast-backed zero moments.
    Keeping those pages stateless avoids materializing and replicating two
    float32 tensors for every physical parameter while still requiring a real
    gradient and a retained parameter delta.
    """

    # Geometry is still checked synchronously, while finite-value admission is
    # carried by the tensor-native ``finite_t`` packet below. Avoid forcing a
    # host scalar read for every compact/stateless page during this hot update
    # path; the durable writer consumes that mask before publication.
    validate_page_bundle(bundle, synchronize_tensor_values=False)
    parameter_tensors = _page_parameter_tensors(bundle.weights)
    gradient_tensors = tuple(
        _parameter_gradient_or_zero_boundary(tensor)
        for tensor in parameter_tensors
    )
    flat_gradient_t = _flatten_page_parameters(gradient_tensors).float()
    proof_gradient_t = flat_gradient_t
    raw_gradient_finite_t = torch.isfinite(proof_gradient_t).all(dim=1)
    gradient_limit = math.sqrt(torch.finfo(flat_gradient_t.dtype).max)
    flat_gradient_t = torch.nan_to_num(
        flat_gradient_t,
        nan=0.0,
        posinf=gradient_limit,
        neginf=-gradient_limit,
    ).clamp(-gradient_limit, gradient_limit)
    page_count = parameter_tensors[0].shape[0]
    flat_width = sum(
        tensor[0].numel()
        for tensor in parameter_tensors
    )
    if bundle.optimizer_mean_t.shape != (page_count, flat_width):
        raise RuntimeError("page optimizer state no longer matches parameters")
    scalar_tensors = (
        optimizer.learning_rate_t,
        optimizer.epsilon_t,
        optimizer.weight_decay_t,
    )
    if any(tensor.numel() != 1 for tensor in scalar_tensors):
        raise ValueError("stateless page optimizer values must be scalar tensors")
    learning_rate_t = optimizer.learning_rate_t.to(flat_gradient_t).reshape(())
    epsilon_t = optimizer.epsilon_t.to(flat_gradient_t).reshape(())
    weight_decay_t = optimizer.weight_decay_t.to(flat_gradient_t).reshape(())
    _tensor_assert(
        (learning_rate_t > 0) & (epsilon_t > 0) & (weight_decay_t >= 0),
        "stateless page optimizer policy is outside the valid range",
    )

    updated_tensors: list[torch.Tensor] = []
    retained_finite_t = torch.ones(
        page_count,
        device=flat_gradient_t.device,
        dtype=torch.bool,
    )
    # Preserve the exact flat delta proof geometry without keeping page-wide
    # parameter and retained-result copies live beside the flattened gradient.
    # Each physical tensor is updated and quantized independently, then its
    # exact retained delta is written into this single proof buffer.
    retained_delta_flat_t = torch.empty_like(flat_gradient_t)
    offset = 0
    for tensor_index, (tensor, gradient_t) in enumerate(
        zip(
            parameter_tensors,
            gradient_tensors,
            strict=True,
        )
    ):
        width = tensor[0].numel()
        parameter_float_t = tensor.float()
        gradient_float_t = torch.nan_to_num(
            gradient_t.float(),
            nan=0.0,
            posinf=gradient_limit,
            neginf=-gradient_limit,
        ).clamp(-gradient_limit, gradient_limit)
        updated_values_t = (
            parameter_float_t
            - learning_rate_t
            * (
                gradient_float_t
                / (gradient_float_t.abs() + epsilon_t)
                + weight_decay_t * parameter_float_t
            )
        )
        if tensor.dtype.is_floating_point:
            dtype_info = torch.finfo(tensor.dtype)
            updated_values_t = updated_values_t.clamp(
                min=dtype_info.min,
                max=dtype_info.max,
            )
        updated_tensor = updated_values_t.to(dtype=tensor.dtype)
        if tensor_index < 3:
            updated_tensor = (
                project_resynthesis_expert_weight_int4_qat_boundary(
                    updated_tensor
                )
            )
        updated_tensors.append(updated_tensor)
        retained_delta_flat_t.narrow(1, offset, width).copy_(
            (
                updated_tensor.float()
                - parameter_float_t
            ).reshape(page_count, width)
        )
        retained_finite_t &= torch.isfinite(updated_tensor.float()).reshape(
            page_count,
            width,
        ).all(dim=1)
        offset += width
    updated_weights = NoNEPageWeights(
        page_ids_t=bundle.weights.page_ids_t.detach().clone(),
        ffn_mode_t=bundle.weights.ffn_mode_t.detach().clone(),
        gate_t=updated_tensors[0],
        up_t=updated_tensors[1],
        down_t=updated_tensors[2],
        glyph_down_t=updated_tensors[3],
        glyph_up_t=updated_tensors[4],
        translation_gate_t=updated_tensors[5],
        outcome_memory_t=updated_tensors[6],
        repair_memory_t=updated_tensors[7],
        transfer_memory_t=updated_tensors[8],
    )
    gradient_norm_t = _stable_row_l2_norm(proof_gradient_t)
    parameter_delta_norm_t = _stable_row_l2_norm(
        retained_delta_flat_t
    )
    gradient_signature_t = _page_gradient_signature(
        proof_gradient_t,
        gradient_norm_t,
    )
    finite_components_t = torch.stack(
        (
            raw_gradient_finite_t & retained_finite_t,
            torch.ones_like(retained_finite_t),
            torch.isfinite(gradient_norm_t),
            torch.isfinite(parameter_delta_norm_t),
            torch.isfinite(gradient_signature_t).all(dim=1),
            torch.isfinite(bundle.weights.ffn_mode_t.float()).all(dim=1)
            & bundle.weights.ffn_mode_t.float().ge(0).all(dim=1)
            & bundle.weights.ffn_mode_t.float().le(1).all(dim=1),
            torch.isfinite(bundle.optimizer_mean_t[:, :1]).all(dim=1)
            & torch.isfinite(bundle.optimizer_square_t[:, :1]).all(dim=1)
            & bundle.optimizer_mean_t[:, :1].eq(0).all(dim=1)
            & bundle.optimizer_square_t[:, :1].eq(0).all(dim=1),
        ),
        dim=1,
    )
    finite_t = finite_components_t.all(dim=1)
    updated_step_t = bundle.step_t + torch.ones_like(bundle.step_t)
    return NoNEPageUpdatePacket(
        bundle=NoNEPageBundle(
            weights=updated_weights,
            optimizer_mean_t=_implicit_zero_optimizer_matrix_boundary(
                page_count=page_count,
                flat_width=flat_width,
                device=flat_gradient_t.device,
            ),
            optimizer_square_t=_implicit_zero_optimizer_matrix_boundary(
                page_count=page_count,
                flat_width=flat_width,
                device=flat_gradient_t.device,
            ),
            step_t=updated_step_t,
        ),
        page_ids_t=updated_weights.page_ids_t,
        gradient_norm_t=gradient_norm_t,
        parameter_delta_norm_t=parameter_delta_norm_t,
        gradient_signature_t=gradient_signature_t,
        finite_components_t=finite_components_t,
        finite_t=finite_t,
    )


class NoNEPagedExpertRuntime(nn.Module):
    """Resident router/executor with an attached immutable storage boundary."""

    accepted_inference_cache_entries: int
    candidate_window_active_t: torch.Tensor
    candidate_base_generation_t: torch.Tensor
    candidate_page_state_revision_t: torch.Tensor
    candidate_prepare_poisoned_t: torch.Tensor
    candidate_vjp_forward_count_t: torch.Tensor
    candidate_vjp_trace_count_t: torch.Tensor
    candidate_vjp_trace_set_consumed_t: torch.Tensor
    candidate_rematerialized_page_peak_t: torch.Tensor
    candidate_page_update_count_t: torch.Tensor
    family_page_mask_t: torch.Tensor
    accepted_route_count_t: torch.Tensor
    accepted_gradient_update_count_t: torch.Tensor
    accepted_gradient_norm_t: torch.Tensor
    accepted_parameter_delta_norm_t: torch.Tensor
    accepted_gradient_signature_t: torch.Tensor
    candidate_route_count_t: torch.Tensor
    candidate_gradient_update_count_t: torch.Tensor
    candidate_gradient_norm_t: torch.Tensor
    candidate_parameter_delta_norm_t: torch.Tensor
    candidate_gradient_signature_t: torch.Tensor
    candidate_device_residency_mask_t: torch.Tensor
    candidate_active_trainable_page_mask_t: torch.Tensor
    training_eligible_page_mask_t: torch.Tensor
    candidate_external_object_bytes_by_page_t: torch.Tensor
    accepted_residency_generation_t: torch.Tensor
    accepted_residency_page_mask_t: torch.Tensor
    accepted_residency_request_count_t: torch.Tensor
    accepted_residency_hit_page_count_t: torch.Tensor
    accepted_residency_miss_page_count_t: torch.Tensor
    gradient_page_forward_count_t: torch.Tensor
    validated_trained_page_mask_t: torch.Tensor
    page_parameter_elements_t: torch.Tensor

    def __init__(
        self,
        *,
        hidden_size: int,
        action_size: int,
        router_size: int,
        page_count: int,
        layer_id: int,
        page_catalog_ids_t: torch.Tensor | None = None,
        family_page_mask_t: torch.Tensor | None = None,
        validated_trained_page_mask_t: torch.Tensor | None = None,
        page_parameter_elements: int = 0,
    ) -> None:
        super().__init__()
        self.hidden_size = int(hidden_size)
        self.action_size = int(action_size)
        self.router_size = int(router_size)
        self.page_count = int(page_count)
        raw_activation_fraction = os.environ.get(
            "NNF_RESYNTHESIS_PAGED_ACTIVATION_FRACTION",
            "",
        ).strip()
        raw_frontier_pages = os.environ.get(
            "NNF_RESYNTHESIS_PAGED_TRAIN_FRONTIER_PAGES",
            "",
        ).strip()
        self._route_activation_override_requested = bool(
            raw_activation_fraction
        )
        if raw_activation_fraction:
            try:
                route_activation_fraction = float(raw_activation_fraction)
            except ValueError as error:
                raise ValueError(
                    "NoNE paged activation fraction must be a finite float"
                ) from error
            if not math.isfinite(route_activation_fraction):
                raise ValueError(
                    "NoNE paged activation fraction must be a finite float"
                )
            if not (0.0 < route_activation_fraction <= 1.0):
                raise ValueError("NoNE paged activation fraction must be in (0,1]")
        else:
            route_activation_fraction = None
        training_residency_wave_pages = min(16, page_count)
        if raw_frontier_pages:
            try:
                training_residency_wave_pages = int(raw_frontier_pages)
            except ValueError as error:
                raise ValueError(
                    "NoNE paged training frontier pages must be a positive integer"
                ) from error
            if training_residency_wave_pages < 1:
                raise ValueError("NoNE paged training frontier pages must be positive")
        training_residency_wave_pages = min(
            training_residency_wave_pages,
            page_count,
        )
        if route_activation_fraction is None:
            route_activation_fraction = 1.0 / float(page_count)
        self.router = NoNEPagedExpertRouter(
            hidden_size=hidden_size,
            action_size=action_size,
            router_size=router_size,
            page_count=page_count,
            layer_id=layer_id,
            page_catalog_ids_t=page_catalog_ids_t,
            activation_fraction=route_activation_fraction,
        )
        # This host-visible value controls only how many already-selected page
        # rows may be physically resident in one training execution wave.  It
        # never changes quantile logits, frontier support, page identity, or
        # the model-owned exploration aperture.
        self.training_residency_wave_pages = training_residency_wave_pages
        cache_entries_raw = os.environ.get(
            "NNF_RESYNTHESIS_GPU_PAGE_CACHE_ENTRIES",
            str(DEFAULT_GPU_PAGE_CACHE_ENTRIES),
        ).strip()
        try:
            requested_cache_entries = int(cache_entries_raw)
        except ValueError as error:
            raise ValueError(
                "NoNE GPU page-cache entries must be an integer"
            ) from error
        if requested_cache_entries < 1:
            raise ValueError("NoNE GPU page-cache entries must be positive")
        # This is a residency limit, not a routing limit.  Expanding it to the
        # full catalog makes out-of-core traversal accumulate every visited
        # page on the accelerator and eventually OOM.  The trim boundary
        # protects the complete current model-owned route, then evicts only
        # older rows, so a bounded cache never suppresses or reranks experts.
        self.accepted_inference_cache_entries = requested_cache_entries
        self.executor = NoNEPagedExpertExecutor(
            hidden_size=hidden_size,
            memory_size=router_size,
        )
        self.residual_scale = nn.Parameter(torch.zeros(()))
        self.register_buffer(
            "candidate_window_active_t",
            torch.zeros((), dtype=torch.bool),
            persistent=False,
        )
        self.register_buffer(
            "candidate_base_generation_t",
            torch.zeros((), dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_page_state_revision_t",
            torch.zeros((), dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_prepare_poisoned_t",
            torch.zeros((), dtype=torch.bool),
            persistent=False,
        )
        self.register_buffer(
            "candidate_vjp_forward_count_t",
            torch.zeros((), dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_vjp_trace_count_t",
            torch.zeros((), dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_vjp_trace_set_consumed_t",
            torch.zeros((), dtype=torch.bool),
            persistent=False,
        )
        self.register_buffer(
            "candidate_rematerialized_page_peak_t",
            torch.zeros((), dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_page_update_count_t",
            torch.zeros((), dtype=torch.long),
            persistent=False,
        )
        family_mask_t = (
            torch.zeros(page_count, dtype=torch.bool)
            if family_page_mask_t is None
            else family_page_mask_t.detach().reshape(-1).bool().clone()
        )
        if family_mask_t.shape != (page_count,):
            raise ValueError("NoNE family page mask geometry differs")
        self.register_buffer(
            "family_page_mask_t",
            family_mask_t,
            persistent=False,
        )
        trained_mask_t = (
            torch.zeros(page_count, dtype=torch.bool)
            if validated_trained_page_mask_t is None
            else validated_trained_page_mask_t.detach().reshape(-1).bool().clone()
        )
        if trained_mask_t.shape != (page_count,):
            raise ValueError("NoNE validated-trained page mask geometry differs")
        training_eligible_mask_t = (
            family_mask_t & torch.logical_not(trained_mask_t)
            if family_page_mask_t is not None
            else torch.logical_not(trained_mask_t)
        )
        if page_parameter_elements < 0:
            raise ValueError("NoNE page parameter geometry cannot be negative")
        self.register_buffer(
            "validated_trained_page_mask_t",
            trained_mask_t,
            persistent=False,
        )
        self.register_buffer(
            "training_eligible_page_mask_t",
            training_eligible_mask_t,
            persistent=False,
        )
        self.register_buffer(
            "page_parameter_elements_t",
            torch.tensor(page_parameter_elements, dtype=torch.long),
            persistent=False,
        )
        # Explicit storage-boundary cache derived from the tensor-owned catalog.
        # It controls only whether a model-routed page receives page-local
        # gradients; it never selects, reranks, or suppresses a routed page.
        self._training_eligible_page_ids = {
            int(page_id)
            for page_id in self.router.page_catalog_ids_t.masked_select(
                training_eligible_mask_t
            ).tolist()
        }
        self.register_buffer(
            "accepted_route_count_t",
            torch.zeros(page_count, dtype=torch.long),
            persistent=True,
        )
        self.register_buffer(
            "accepted_gradient_update_count_t",
            torch.zeros(page_count, dtype=torch.long),
            persistent=True,
        )
        self.register_buffer(
            "accepted_gradient_norm_t",
            torch.zeros(page_count, dtype=torch.float32),
            persistent=True,
        )
        self.register_buffer(
            "accepted_parameter_delta_norm_t",
            torch.zeros(page_count, dtype=torch.float32),
            persistent=True,
        )
        self.register_buffer(
            "accepted_gradient_signature_t",
            torch.zeros(page_count, 8, dtype=torch.float32),
            persistent=True,
        )
        self.register_buffer(
            "candidate_route_count_t",
            torch.zeros(page_count, dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_gradient_update_count_t",
            torch.zeros(page_count, dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "candidate_gradient_norm_t",
            torch.zeros(page_count, dtype=torch.float32),
            persistent=False,
        )
        self.register_buffer(
            "candidate_parameter_delta_norm_t",
            torch.zeros(page_count, dtype=torch.float32),
            persistent=False,
        )
        self.register_buffer(
            "candidate_gradient_signature_t",
            torch.zeros(page_count, 8, dtype=torch.float32),
            persistent=False,
        )
        self.register_buffer(
            "candidate_device_residency_mask_t",
            torch.zeros(page_count, dtype=torch.bool),
            persistent=False,
        )
        self.register_buffer(
            "candidate_active_trainable_page_mask_t",
            torch.zeros(page_count, dtype=torch.bool),
            persistent=False,
        )
        self.register_buffer(
            "candidate_external_object_bytes_by_page_t",
            torch.zeros(page_count, dtype=torch.long),
            persistent=False,
        )
        self.register_buffer(
            "accepted_residency_page_mask_t",
            torch.zeros(page_count, dtype=torch.bool),
            persistent=False,
        )
        for telemetry_name in (
            "accepted_residency_generation_t",
            "accepted_residency_request_count_t",
            "accepted_residency_hit_page_count_t",
            "accepted_residency_miss_page_count_t",
            "gradient_page_forward_count_t",
        ):
            self.register_buffer(
                telemetry_name,
                torch.zeros((), dtype=torch.long),
                persistent=False,
            )
        self._store_boundary: NoNEImmutablePageStore | None = None
        # Storage-transaction lifecycle only; this never selects or reranks a
        # page. The model-owned tensor route remains authoritative.
        self._candidate_window_open = False
        self._training_route_cohort_open = False
        self._training_route_cohort_page_ids: tuple[int, ...] | None = None
        self._training_route_cohort_catalog_positions_t: torch.Tensor | None = None
        self._candidate_pages: dict[int, NoNEPageBundle] = {}
        # Accepted rows need only their model weights during forward/backward.
        # Their exact optimizer moments remain in the immutable store and are
        # materialized one page at a time only when that page's gradient is
        # consumed.  Keeping this cache separate prevents a model-routed union
        # from concatenating or moving tens of GiB of optimizer state before
        # the first CUDA operation.
        self._candidate_forward_weights: dict[int, NoNEPageWeights] = {}
        self._candidate_forward_wave_bindings: dict[
            int,
            _NoNECandidateForwardWaveBinding,
        ] = {}
        self._candidate_page_objects: dict[int, NoNEPageObjectBinding] = {}
        self._candidate_page_scratch: dict[
            int, NoNECandidatePageScratchBinding
        ] = {}
        # Model-routed page waves enqueue exact pinned accelerator transfers.
        # Completed CPU rows remain proposal-local until a model candidate is
        # retained; only the retained transaction converts them into immutable
        # scratch/object bytes. This storage boundary never selects pages or
        # changes the tensor-owned route.
        self._candidate_page_journal: dict[int, NoNEPageBundle] = {}
        # Compatibility-only inspection surface. Candidate page leaves are
        # never retained here: completed rows live in the bounded journal or
        # proposal-local scratch, then post-accept cache promotion
        # rematerializes at most one immutable object at a time.
        self._candidate_training_page_cache: dict[int, NoNEPageBundle] = {}
        self._candidate_stage_executor: ThreadPoolExecutor | None = None
        self._candidate_page_stage_futures: dict[
            int, Future[NoNEPageBundle | None]
        ] = {}
        self._candidate_scratch_root: Path | None = None
        self._candidate_updated_page_ids: set[int] = set()
        self._candidate_gradient_page_ids: set[int] = set()
        self._candidate_imported_page_ids: set[int] = set()
        self._candidate_vjp_trace_bindings: dict[
            int,
            _NoNECandidatePageVJPTraceBinding,
        ] = {}
        self._candidate_vjp_reservations: dict[
            int,
            _NoNECandidateVJPReservation,
        ] = {}
        self._candidate_vjp_backward_claimed_ids: set[int] = set()
        self._candidate_vjp_completed_ids: set[int] = set()
        # Reservation, completion, and consumption form one transaction.
        # Consumption re-enters the completeness validator while holding this
        # lock so no concurrent forward can reserve a new logical trace in the
        # validation-to-latch gap.
        self._candidate_vjp_lock = threading.RLock()
        # Accepted inference pages are read-only residency copies. The cache
        # cannot select, reorder, or train pages; generation, device, and dtype
        # identity invalidate it before reuse.
        self._accepted_inference_pages: dict[int, NoNEPageWeights] = {}
        self._accepted_inference_compositions: dict[
            tuple[int, ...], NoNEPageWeights
        ] = {}
        self._accepted_inference_generation_t: torch.Tensor | None = None
        self._accepted_inference_device: torch.device | None = None
        self._accepted_inference_dtype: torch.dtype | None = None
        self.last_request: NoNEPageRequestPacket | None = None
        self.last_weights: NoNEPageWeights | None = None
        self.last_bundle: NoNEPageBundle | None = None

    def apply_model_wide_residency_allocation_boundary(
        self,
        *,
        frontier_pages: int | None,
        cache_entries: int,
    ) -> None:
        """Apply one layer's share of a model-wide sparse residency budget."""

        if (
            isinstance(cache_entries, bool)
            or cache_entries < 1
            or cache_entries > self.page_count
        ):
            raise ValueError("NoNE layer cache allocation is outside its catalog")
        if frontier_pages is not None and (
            isinstance(frontier_pages, bool)
            or frontier_pages < 1
            or frontier_pages > self.page_count
        ):
            raise ValueError("NoNE layer frontier allocation is outside its catalog")
        self.accepted_inference_cache_entries = cache_entries
        if frontier_pages is not None:
            self.training_residency_wave_pages = frontier_pages

    def preserve_training_proof_precision(self) -> None:
        """Keep cumulative gradient evidence out of reduced-precision state."""

        for name in (
            "accepted_gradient_norm_t",
            "accepted_parameter_delta_norm_t",
            "accepted_gradient_signature_t",
            "candidate_gradient_norm_t",
            "candidate_parameter_delta_norm_t",
            "candidate_gradient_signature_t",
        ):
            setattr(self, name, getattr(self, name).float())

    def load_seed_resident_state_boundary(
        self,
        state: Mapping[str, torch.Tensor],
    ) -> None:
        """Strictly load an immutable pre-proof seed with zero proof history."""

        adapted = dict(state)
        runtime_state = self.state_dict()
        # This is a model-owned cohort policy buffer rather than checkpoint
        # state. Older resident snapshots may contain it, whereas current
        # snapshots intentionally omit nonpersistent buffers. In both cases,
        # retain the constructor-bound policy for the active runtime.
        adapted.pop("router.training_route_cohort_rows_t", None)
        anti_thompson_prefix = "router.quantile_router.anti_thompson"
        expected_anti_thompson_names = {
            name
            for name in runtime_state
            if name.startswith(anti_thompson_prefix)
        }
        supplied_anti_thompson_names = {
            name
            for name in adapted
            if name.startswith(anti_thompson_prefix)
        }
        unexpected_anti_thompson_names = (
            supplied_anti_thompson_names - expected_anti_thompson_names
        )
        if unexpected_anti_thompson_names:
            raise RuntimeError(
                "unexpected NoNE seed anti-thompson state is forbidden: "
                + ", ".join(sorted(unexpected_anti_thompson_names))
            )
        missing_anti_thompson_names = (
            expected_anti_thompson_names - supplied_anti_thompson_names
        )
        if missing_anti_thompson_names:
            if supplied_anti_thompson_names:
                raise RuntimeError(
                    "partial NoNE seed anti-thompson state is forbidden"
                )
            # The complete outcome bank became persistent after the accepted
            # seed family was sealed. A historical snapshot has no outcomes
            # to recover, so its only truthful migration is the entire exact
            # zero family. Never combine new zeros with a partially supplied
            # learned family.
            adapted.update(
                {
                    name: torch.zeros_like(runtime_state[name])
                    for name in expected_anti_thompson_names
                }
            )
        else:
            for name in expected_anti_thompson_names:
                source_t = adapted[name]
                target_t = runtime_state[name]
                if source_t.shape != target_t.shape:
                    raise RuntimeError(
                        "NoNE seed anti-thompson state geometry differs: "
                        f"{name}"
                    )
                if source_t.dtype != target_t.dtype:
                    raise RuntimeError(
                        "NoNE seed anti-thompson state dtype differs: "
                        f"{name}"
                    )
        trauma_prefix = "router.quantile_router.trauma_state."
        expected_trauma_names = {
            name for name in runtime_state if name.startswith(trauma_prefix)
        }
        supplied_trauma_names = {
            name for name in adapted if name.startswith(trauma_prefix)
        }
        unexpected_trauma_names = (
            supplied_trauma_names - expected_trauma_names
        )
        if unexpected_trauma_names:
            raise RuntimeError(
                "unexpected NoNE seed trauma state is forbidden: "
                + ", ".join(sorted(unexpected_trauma_names))
            )
        missing_trauma_names = (
            expected_trauma_names - supplied_trauma_names
        )
        if missing_trauma_names:
            if supplied_trauma_names:
                raise RuntimeError(
                    "partial NoNE seed trauma state is forbidden"
                )
            # The sealed resident generation predates persistent Trauma/KLA
            # banks. Its complete absence proves that there is no learned
            # hard-knowledge history to recover, so adopt the exact constructor
            # genesis family (including the -1 cooldown sentinel) atomically.
            adapted.update(
                {
                    name: runtime_state[name].detach().clone()
                    for name in expected_trauma_names
                }
            )
        else:
            for name in expected_trauma_names:
                source_t = adapted[name]
                target_t = runtime_state[name]
                if source_t.shape != target_t.shape:
                    raise RuntimeError(
                        "NoNE seed trauma state geometry differs: "
                        f"{name}"
                    )
                if source_t.dtype != target_t.dtype:
                    raise RuntimeError(
                        "NoNE seed trauma state dtype differs: "
                        f"{name}"
                    )
        executor_genesis_names = (
            "executor.situ_glu_scale",
            "executor.latent_rmsnorm_scale",
        )
        for genesis_name in executor_genesis_names:
            if genesis_name not in runtime_state:
                raise RuntimeError(
                    "NoNE seed executor genesis schema differs: "
                    f"{genesis_name}"
                )
            if genesis_name not in adapted:
                adapted[genesis_name] = (
                    runtime_state[genesis_name].detach().clone()
                )
            else:
                source_t = adapted[genesis_name]
                target_t = runtime_state[genesis_name]
                if (
                    source_t.shape != target_t.shape
                    or source_t.dtype != target_t.dtype
                ):
                    raise RuntimeError(
                        "NoNE seed executor genesis geometry differs: "
                        f"{genesis_name}"
                    )
        if self._route_activation_override_requested:
            activation_logit_name = "router.quantile_router.activation_logit"
            adapted[activation_logit_name] = (
                runtime_state[activation_logit_name].detach().clone()
            )
        for telemetry_name in (
            "accepted_route_count_t",
            "accepted_gradient_update_count_t",
            "accepted_gradient_norm_t",
            "accepted_parameter_delta_norm_t",
            "accepted_gradient_signature_t",
        ):
            if telemetry_name not in adapted:
                adapted[telemetry_name] = runtime_state[telemetry_name].detach().clone()
        self.load_state_dict(adapted, strict=True)

    def bind_store_boundary(
        self,
        store: NoNEImmutablePageStore,
        session_id_t: torch.Tensor,
    ) -> torch.Tensor:
        generation_t = store.begin_session(session_id_t)
        self.router.begin_session(session_id_t)
        self._store_boundary = store
        self._clear_candidate_boundary()
        self._clear_accepted_inference_boundary()
        with torch.no_grad():
            self.gradient_page_forward_count_t.zero_()
        return generation_t

    def bind_staged_store_read_only_boundary(
        self,
        store: NoNEImmutablePageStore,
        session_id_t: torch.Tensor,
        binding: NoNEGenerationBinding,
        *,
        graph_authority: NoNEGraphAuthorityBinding,
    ) -> torch.Tensor:
        """Bind a pointerless complete direct map for pre-accept cold proof."""

        loaded = store.begin_staged_generation_read_only_boundary(
            session_id_t,
            binding,
            graph_authority=graph_authority,
        )
        self.router.begin_session(session_id_t)
        self._store_boundary = store
        self._clear_candidate_boundary()
        self._clear_accepted_inference_boundary()
        with torch.no_grad():
            self.gradient_page_forward_count_t.zero_()
        return loaded.generation_t.clone()

    def apply_training_branch_scope_boundary(
        self,
        page_ids_t: torch.Tensor,
    ) -> torch.Tensor:
        """Restrict page-local gradients without changing the model route.

        The router keeps its complete accepted catalog and may still route any
        page. Only pages owned by the sealed branch remain gradient eligible;
        all other routed pages execute as immutable parent state.
        """

        if self._candidate_window_open:
            raise RuntimeError("NoNE branch scope changed an active candidate window")
        scope_page_ids_t = page_ids_t.detach().cpu().long().reshape(-1)
        if (
            scope_page_ids_t.numel() < 1
            or torch.unique(scope_page_ids_t).numel() != scope_page_ids_t.numel()
        ):
            raise ValueError("NoNE branch page scope is malformed")
        catalog_ids_t = self.router.page_catalog_ids_t.detach().cpu().long()
        owned_mask_t = catalog_ids_t.unsqueeze(1).eq(
            scope_page_ids_t.unsqueeze(0)
        ).any(dim=1)
        # The sealed branch scope is the retraining authority. A retained page
        # may be deliberately rescheduled to collect fresh routed gradients
        # while every page outside this exact scope remains immutable parent
        # state. Each paged runtime observes only its own layer subset; the RBO
        # activation boundary verifies that the concatenated runtime coverage
        # equals the complete sealed scope, so foreign IDs still fail closed.
        # The accepted-generation union also rejects overlapping,
        # foreign-parent, or unproved deltas before pointer mutation.
        eligible_mask_t = owned_mask_t
        with torch.no_grad():
            self.family_page_mask_t.copy_(
                eligible_mask_t.to(device=self.family_page_mask_t.device)
            )
            self.training_eligible_page_mask_t.copy_(
                eligible_mask_t.to(device=self.training_eligible_page_mask_t.device)
            )
        self._training_eligible_page_ids = {
            int(page_id)
            for page_id in catalog_ids_t.masked_select(eligible_mask_t).tolist()
        }
        return catalog_ids_t.masked_select(owned_mask_t)

    def _clear_accepted_inference_boundary(self) -> None:
        """Release read-only pages whenever accepted residency identity moves."""

        self._accepted_inference_pages.clear()
        self._accepted_inference_compositions.clear()
        self._accepted_inference_generation_t = None
        self._accepted_inference_device = None
        self._accepted_inference_dtype = None
        with torch.no_grad():
            self.accepted_residency_generation_t.zero_()
            self.accepted_residency_page_mask_t.zero_()
            self.accepted_residency_request_count_t.zero_()
            self.accepted_residency_hit_page_count_t.zero_()
            self.accepted_residency_miss_page_count_t.zero_()

    def begin_decode_arm_boundary(self) -> None:
        """Reset arm-local routing while retaining immutable accepted pages.

        Accepted rows are generation-bound, read-only tensors. Session,
        generation, device, and dtype changes invalidate them inside
        ``_accepted_inference_weights_for_request_boundary`` before reuse.
        """

        self.router.quantile_router.begin_route_arm_boundary()
        self.last_request = None
        self.last_weights = None

    def dehydrate_accepted_inference_cuda_boundary(self) -> None:
        """Release immutable CUDA page rows after their routed layer executes.

        The store's identity-bound CPU materialization cache remains the
        reusable source for later tokens.  Keeping one complete page row in
        every sequential science-layer runtime multiplied a nominal model-wide
        residency budget by the layer count and could exhaust a clean GPU
        before the first native token.  Route, generation, hit/miss counters,
        and ``last_request`` remain intact as diagnostic evidence; only physical
        accelerator residency is released.
        """

        if (
            torch.is_grad_enabled()
            or
            self._accepted_inference_device is None
            or self._accepted_inference_device.type != "cuda"
        ):
            return
        self._accepted_inference_pages.clear()
        self._accepted_inference_compositions.clear()
        self.last_weights = None
        with torch.no_grad():
            self.accepted_residency_page_mask_t.zero_()

    def accepted_residency_telemetry(
        self,
    ) -> NoNEPageResidencyTelemetryPacket:
        """Return diagnostic tensors with no routing or answer authority."""

        resident_page_ids_t = self.router.page_catalog_ids_t.masked_select(
            self.accepted_residency_page_mask_t
        )
        candidate_resident_page_ids_t = self.router.page_catalog_ids_t.masked_select(
            self.candidate_device_residency_mask_t
        )
        candidate_external_page_ids_t = self.router.page_catalog_ids_t.masked_select(
            self.candidate_external_object_bytes_by_page_t.gt(0)
        )
        active_routed_page_ids_t = (
            self.router.page_catalog_ids_t.new_empty((0,))
            if self.last_request is None
            else self.last_request.unique_page_ids_t.to(
                device=self.router.page_catalog_ids_t.device,
                dtype=torch.long,
            )
        )
        active_trainable_page_ids_t = self.router.page_catalog_ids_t.masked_select(
            self.candidate_active_trainable_page_mask_t
        )
        last_training_weights = (
            self.last_bundle.weights
            if self.last_bundle is not None
            else self.last_weights
        )
        if (
            active_trainable_page_ids_t.numel() == 0
            and last_training_weights is not None
            and any(
                tensor.requires_grad
                for tensor in (
                    last_training_weights.gate_t,
                    last_training_weights.up_t,
                    last_training_weights.down_t,
                    last_training_weights.glyph_down_t,
                    last_training_weights.glyph_up_t,
                    last_training_weights.translation_gate_t,
                    last_training_weights.outcome_memory_t,
                    last_training_weights.repair_memory_t,
                    last_training_weights.transfer_memory_t,
                )
            )
        ):
            last_page_ids_t = last_training_weights.page_ids_t.to(
                device=self.router.page_catalog_ids_t.device,
                dtype=torch.long,
            )
            active_trainable_page_ids_t = self.router.page_catalog_ids_t.masked_select(
                self.training_eligible_page_mask_t
                & self.router.page_catalog_ids_t.unsqueeze(1)
                .eq(last_page_ids_t.unsqueeze(0))
                .any(dim=1)
            )
        validated_trained_page_ids_t = self.router.page_catalog_ids_t.masked_select(
            self.validated_trained_page_mask_t
        )
        return NoNEPageResidencyTelemetryPacket(
            layer_id_t=self.router.layer_id_t.detach().clone(),
            generation_t=self.accepted_residency_generation_t.detach().clone(),
            resident_page_ids_t=resident_page_ids_t.detach().clone(),
            candidate_resident_page_ids_t=(
                candidate_resident_page_ids_t.detach().clone()
            ),
            candidate_external_page_ids_t=(
                candidate_external_page_ids_t.detach().clone()
            ),
            candidate_external_object_bytes_t=(
                self.candidate_external_object_bytes_by_page_t.sum()
                .detach()
                .clone()
            ),
            active_routed_page_ids_t=(active_routed_page_ids_t.detach().clone()),
            active_trainable_page_ids_t=(active_trainable_page_ids_t.detach().clone()),
            validated_trained_page_ids_t=(
                validated_trained_page_ids_t.detach().clone()
            ),
            page_parameter_elements_t=(self.page_parameter_elements_t.detach().clone()),
            request_count_t=(self.accepted_residency_request_count_t.detach().clone()),
            hit_page_count_t=(
                self.accepted_residency_hit_page_count_t.detach().clone()
            ),
            miss_page_count_t=(
                self.accepted_residency_miss_page_count_t.detach().clone()
            ),
            gradient_page_forward_count_t=(
                self.gradient_page_forward_count_t.detach().clone()
            ),
        )

    def _record_candidate_page_journal_boundary(
        self,
        page_id: int,
        bundle: NoNEPageBundle,
    ) -> None:
        """Publish one completed, exact CPU candidate row on the owner thread."""

        validate_page_bundle(bundle)
        bundle_page_ids_t = bundle.weights.page_ids_t.detach().cpu().long().reshape(-1)
        if (
            bundle_page_ids_t.numel() != 1
            or int(bundle_page_ids_t[0]) != page_id
            or bundle.weights.gate_t.device.type != "cpu"
        ):
            raise RuntimeError("NoNE candidate journal page identity differs")
        if page_id in self._candidate_page_objects:
            raise RuntimeError("NoNE candidate journal overlaps persisted state")
        self._candidate_updated_page_ids.add(page_id)
        self._candidate_page_journal[page_id] = bundle

    def candidate_page_journal_storage_bytes_boundary(self) -> int:
        """Return proposal-local host residency at the storage boundary.

        The journal contains only completed, non-trainable CPU page rows whose
        model-owned updates have already crossed the CUDA event fence.  This
        host byte count controls when those rows must spill to proposal-local
        scratch; it never selects, reorders, or authorizes a page.
        """

        self._resolve_all_candidate_page_stages_boundary()
        return sum(
            _page_bundle_storage_bytes_boundary(bundle)
            for bundle in self._candidate_page_journal.values()
        )

    def _record_candidate_page_stage_boundary(
        self,
        page_id: int,
        binding: NoNECandidatePageScratchBinding,
    ) -> None:
        """Publish one completed scratch write on the runtime owner thread."""

        binding_page_ids_t = binding.page_id_t.detach().cpu().long().reshape(-1)
        if (
            binding_page_ids_t.numel() != 1
            or int(binding_page_ids_t[0]) != page_id
        ):
            raise RuntimeError("NoNE asynchronous candidate page identity differs")
        self._candidate_updated_page_ids.add(page_id)
        self._candidate_page_scratch[page_id] = binding
        self._candidate_page_objects.pop(page_id, None)
        page_match_t = self.router.page_catalog_ids_t.eq(
            self.router.page_catalog_ids_t.new_tensor(page_id)
        )
        with torch.no_grad():
            object_bytes_t = binding.object_bytes_t.to(
                device=self.candidate_external_object_bytes_by_page_t.device,
                dtype=torch.long,
            ).reshape(())
            self.candidate_external_object_bytes_by_page_t.copy_(
                torch.where(
                    page_match_t.to(
                        device=(
                            self.candidate_external_object_bytes_by_page_t.device
                        ),
                        dtype=torch.bool,
                    ),
                    object_bytes_t.expand_as(
                        self.candidate_external_object_bytes_by_page_t
                    ),
                    self.candidate_external_object_bytes_by_page_t,
                )
            )

    def _resolve_candidate_page_stage_boundary(self, page_id: int) -> None:
        """Join one D2H/finite fence before same-page observation."""

        future = self._candidate_page_stage_futures.pop(page_id, None)
        if future is None:
            return
        bundle = future.result()
        if bundle is not None:
            self._record_candidate_page_journal_boundary(page_id, bundle)

    def _resolve_all_candidate_page_stages_boundary(self) -> None:
        """Join every proposal-local D2H/finite fence at a boundary."""

        primary_error: Exception | None = None
        for page_id in tuple(sorted(self._candidate_page_stage_futures)):
            try:
                self._resolve_candidate_page_stage_boundary(page_id)
            except Exception as error:
                if primary_error is None:
                    primary_error = error
                else:
                    primary_error.add_note(
                        "additional NoNE candidate page transfer failure: "
                        f"pageId={page_id} error={error!r}"
                    )
        if primary_error is not None:
            raise primary_error

    def spill_candidate_page_journal_boundary(self) -> torch.Tensor:
        """Bound host residency by checkpointing one completed route cohort.

        Scratch rows remain proposal-local and may be atomically replaced by a
        later cohort that routes the same page. Immutable objects are created
        only by the retained transaction's final seal.
        """

        self._resolve_all_candidate_page_stages_boundary()
        if not self._candidate_window_open:
            raise RuntimeError("NoNE candidate journal has no update window")
        store = self._store_boundary
        scratch_root = self._candidate_scratch_root
        if store is None or scratch_root is None:
            raise RuntimeError("NoNE candidate journal has no scratch boundary")
        spilled_page_ids = tuple(sorted(self._candidate_page_journal))
        if not spilled_page_ids:
            # Most route cohorts do not materialize a candidate page.  Keep
            # that hot path tensor-native and silent: importing the timer and
            # flushing one diagnostic line per empty cohort was measurable
            # host I/O with no durability evidence to report.
            return self.candidate_page_update_count_t.new_zeros(
                (),
                dtype=torch.long,
            )
        import time as _spill_time
        _spill_started_at = _spill_time.monotonic()
        for page_id in spilled_page_ids:
            if page_id in self._candidate_page_objects:
                raise RuntimeError(
                    "NoNE candidate journal overlaps immutable state"
                )
            binding = store.stage_candidate_page_scratch_boundary(
                self._candidate_page_journal[page_id],
                scratch_root=scratch_root,
                base_generation_t=self.candidate_base_generation_t,
            )
            self._record_candidate_page_stage_boundary(page_id, binding)
            del self._candidate_page_journal[page_id]
        _spill_duration_s = _spill_time.monotonic() - _spill_started_at
        # Diagnostic timing only (fail-safe): surfaces the per-cohort scratch
        # spill wall-clock so its share of step time can be MEASURED before any
        # change to this fail-closed integrity path.  Additive; never raises.
        try:
            print(
                "[none-paging-spill] pages="
                f"{len(spilled_page_ids)} duration_s={_spill_duration_s:.4f}",
                flush=True,
            )
        except Exception:
            pass
        return self.candidate_page_update_count_t.new_tensor(
            len(spilled_page_ids),
            dtype=torch.long,
        )

    def _shutdown_candidate_stage_executor_boundary(self) -> None:
        """Release the proposal-local transfer worker after all fences join."""

        executor = self._candidate_stage_executor
        self._candidate_stage_executor = None
        if executor is not None:
            executor.shutdown(wait=True, cancel_futures=False)

    def _submit_candidate_page_stage_boundary(
        self,
        *,
        page_id: int,
        retained_cpu: NoNEPageBundle | None = None,
        host_transfer: _NoNECandidatePageHostTransfer | None = None,
    ) -> None:
        """Queue one ordered page-wave transfer into the proposal journal."""

        if (retained_cpu is None) == (host_transfer is None):
            raise ValueError("NoNE candidate stage requires one host payload")
        if page_id in self._candidate_page_stage_futures:
            raise RuntimeError("NoNE candidate page stage is already pending")
        executor = self._candidate_stage_executor
        if executor is None:
            executor = ThreadPoolExecutor(
                max_workers=1,
                thread_name_prefix="nnf-candidate-page-transfer",
            )
            self._candidate_stage_executor = executor
        future: Future[NoNEPageBundle | None]
        if host_transfer is not None:

            def finalize_host_transfer() -> NoNEPageBundle | None:
                completion_event = host_transfer.completion_event
                if completion_event is not None:
                    completion_event.synchronize()
                if not bool(host_transfer.finite_t.all()):
                    component_names = (
                        "retained_parameter",
                        "optimizer_state",
                        "gradient_norm",
                        "parameter_delta_norm",
                        "gradient_signature",
                        "ffn_mode",
                        "stateless_optimizer_layout",
                    )
                    failed_component_indexes = (
                        torch.nonzero(
                            ~host_transfer.finite_components_t.all(dim=0),
                            as_tuple=False,
                        )
                        .reshape(-1)
                        .tolist()
                    )
                    failed_components = ",".join(
                        component_names[index]
                        for index in failed_component_indexes
                    )
                    raise RuntimeError(
                        "NoNE candidate page update contains nonfinite state: "
                        f"pageId={page_id} components={failed_components}"
                    )
                if not bool(host_transfer.signaled_t):
                    return None
                validate_page_bundle(host_transfer.bundle)
                return host_transfer.bundle

            future = executor.submit(finalize_host_transfer)
        else:
            if retained_cpu is None:
                raise RuntimeError("NoNE candidate CPU stage payload is absent")

            def finalize_cpu_bundle() -> NoNEPageBundle:
                validate_page_bundle(retained_cpu)
                return retained_cpu

            future = executor.submit(finalize_cpu_bundle)
        self._candidate_page_stage_futures[page_id] = future

    def _candidate_vjp_store_identity_boundary(
        self,
    ) -> _NoNECandidateVJPStoreIdentity:
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE candidate VJP has no page store")
        return _NoNECandidateVJPStoreIdentity(
            root=store.root,
            object_roots=store.object_store_roots_boundary,
            session_id_t=self.router.session_id_t.detach().cpu().long().clone(),
        )

    def _candidate_page_source_identity_boundary(
        self,
        page_id: int,
    ) -> _NoNECandidatePageSourceIdentity:
        """Bind one routed page to the exact bytes rematerialization will read."""

        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE candidate VJP has no page store")
        self._resolve_candidate_page_stage_boundary(page_id)
        page_id_t = torch.tensor(page_id, dtype=torch.long)
        journal_bundle = self._candidate_page_journal.get(page_id)
        scratch_binding = self._candidate_page_scratch.get(page_id)
        object_binding = self._candidate_page_objects.get(page_id)
        if journal_bundle is not None:
            validate_page_bundle(journal_bundle)
            serialized = save(store._page_object_payload_boundary(journal_bundle, 0))
            return _NoNECandidatePageSourceIdentity(
                page_id_t=page_id_t,
                source_kind_t=torch.tensor(
                    _CANDIDATE_VJP_SOURCE_JOURNAL,
                    dtype=torch.long,
                ),
                object_sha256_t=digest_tensor(
                    hashlib.sha256(serialized).hexdigest()
                ),
                object_bytes_t=torch.tensor(len(serialized), dtype=torch.long),
                scratch_path=None,
            )
        if scratch_binding is not None:
            (
                scratch_page_id,
                scratch_path,
                scratch_bytes,
            ) = store._validated_candidate_scratch_path_boundary(
                scratch_binding
            )
            if scratch_page_id != page_id:
                raise RuntimeError(
                    "NoNE candidate VJP scratch page identity differs"
                )
            return _NoNECandidatePageSourceIdentity(
                page_id_t=page_id_t,
                source_kind_t=torch.tensor(
                    _CANDIDATE_VJP_SOURCE_SCRATCH,
                    dtype=torch.long,
                ),
                object_sha256_t=(
                    scratch_binding.object_sha256_t.detach()
                    .cpu()
                    .to(dtype=torch.uint8)
                    .clone()
                ),
                object_bytes_t=torch.tensor(scratch_bytes, dtype=torch.long),
                scratch_path=scratch_path,
            )
        if object_binding is not None:
            row = store._page_object_row_boundary(object_binding)
            return _NoNECandidatePageSourceIdentity(
                page_id_t=page_id_t,
                source_kind_t=torch.tensor(
                    _CANDIDATE_VJP_SOURCE_OBJECT,
                    dtype=torch.long,
                ),
                object_sha256_t=digest_tensor(str(row["sha256"])),
                object_bytes_t=torch.tensor(int(row["bytes"]), dtype=torch.long),
                scratch_path=None,
            )
        accepted_row = store._page_index().get(page_id)
        if (
            not isinstance(accepted_row, dict)
            or not _valid_sha256_boundary(accepted_row.get("sha256"))
            or not isinstance(accepted_row.get("bytes"), int)
            or isinstance(accepted_row.get("bytes"), bool)
            or int(accepted_row["bytes"]) < 1
        ):
            raise RuntimeError("NoNE candidate VJP accepted page is absent")
        accepted_binding = NoNEPageObjectBinding(
            page_id_t=page_id_t,
            object_sha256_t=digest_tensor(str(accepted_row["sha256"])),
            object_bytes_t=torch.tensor(
                int(accepted_row["bytes"]),
                dtype=torch.long,
            ),
        )
        verified_row = store._page_object_row_boundary(accepted_binding)
        return _NoNECandidatePageSourceIdentity(
            page_id_t=page_id_t,
            source_kind_t=torch.tensor(
                _CANDIDATE_VJP_SOURCE_ACCEPTED,
                dtype=torch.long,
            ),
            object_sha256_t=digest_tensor(str(verified_row["sha256"])),
            object_bytes_t=torch.tensor(
                int(verified_row["bytes"]),
                dtype=torch.long,
            ),
            scratch_path=None,
        )

    def _reserve_candidate_vjp_trace_boundary(
        self,
        request: NoNEPageRequestPacket,
    ) -> _NoNECandidateVJPReservation:
        """Reserve a stable logical trace ID during the model forward."""

        self._assert_candidate_rematerialization_authority_boundary(
            candidate_generation_t=self.candidate_base_generation_t,
            candidate_state_revision_t=self.candidate_page_state_revision_t,
        )
        active_page_ids_t = request.unique_page_ids_t.masked_select(
            request.frontier_weight_t.detach().gt(0).any(dim=0).to(
                device=request.unique_page_ids_t.device,
                dtype=torch.bool,
            )
        )
        active_page_ids = self._page_ids_external_tuple_boundary(
            active_page_ids_t
        )
        if not active_page_ids:
            raise RuntimeError("NoNE candidate VJP reservation route is empty")
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE candidate VJP reservation has no store")
        generation = store.current_generation_binding_boundary()
        if (
            not torch.equal(
                generation.session_id_t.detach().cpu().long(),
                request.session_id_t.detach().cpu().long(),
            )
            or not torch.equal(
                generation.generation_t.detach().cpu().long().reshape(()),
                request.generation_t.detach().cpu().long().reshape(()),
            )
        ):
            raise RuntimeError(
                "NoNE candidate VJP reservation generation differs"
            )
        page_sources = tuple(
            self._candidate_page_source_identity_boundary(page_id)
            for page_id in active_page_ids
        )
        with self._candidate_vjp_lock:
            if bool(self.candidate_vjp_trace_set_consumed_t):
                raise RuntimeError(
                    "NoNE candidate VJP trace set is already consumed"
                )
            forward_count_t = (
                self.candidate_vjp_forward_count_t.detach().cpu().long()
            )
            if forward_count_t.numel() != 1:
                raise RuntimeError(
                    "NoNE candidate VJP forward count is invalid"
                )
            ordinal = int(forward_count_t.reshape(()))
            if ordinal in self._candidate_vjp_reservations:
                raise RuntimeError(
                    "NoNE candidate VJP reservation identity already exists"
                )
            reservation = _NoNECandidateVJPReservation(
                execution_ordinal_t=torch.tensor(ordinal, dtype=torch.long),
                candidate_generation_t=(
                    self.candidate_base_generation_t.detach()
                    .cpu()
                    .long()
                    .clone()
                ),
                candidate_state_revision_t=(
                    self.candidate_page_state_revision_t.detach()
                    .cpu()
                    .long()
                    .clone()
                ),
                generation=_clone_none_generation_binding_boundary(
                    generation
                ),
                store=self._candidate_vjp_store_identity_boundary(),
                page_sources=page_sources,
            )
            self._candidate_vjp_reservations[ordinal] = reservation
            with torch.no_grad():
                self.candidate_vjp_forward_count_t.add_(
                    torch.ones_like(self.candidate_vjp_forward_count_t)
                )
        return reservation

    def _assert_candidate_vjp_reservation_identity_boundary(
        self,
        reservation: _NoNECandidateVJPReservation,
    ) -> None:
        """Verify generation, store, and every page source remain exact."""

        self._assert_candidate_rematerialization_authority_boundary(
            candidate_generation_t=reservation.candidate_generation_t,
            candidate_state_revision_t=(
                reservation.candidate_state_revision_t
            ),
        )
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE candidate VJP reservation lost its store")
        current_generation = store.current_generation_binding_boundary()
        current_store = self._candidate_vjp_store_identity_boundary()
        if (
            not _same_generation_binding_boundary(
                current_generation,
                reservation.generation,
            )
            or current_store.root != reservation.store.root
            or current_store.object_roots != reservation.store.object_roots
            or not torch.equal(
                current_store.session_id_t,
                reservation.store.session_id_t,
            )
        ):
            raise RuntimeError(
                "NoNE candidate VJP generation or store identity differs"
            )
        current_sources = tuple(
            self._candidate_page_source_identity_boundary(
                int(source.page_id_t.detach().cpu().long().reshape(()))
            )
            for source in reservation.page_sources
        )
        if (
            len(current_sources) != len(reservation.page_sources)
            or not all(
                _same_candidate_page_source_identity_boundary(
                    current_source,
                    reserved_source,
                )
                for current_source, reserved_source in zip(
                    current_sources,
                    reservation.page_sources,
                    strict=True,
                )
            )
        ):
            raise RuntimeError(
                "NoNE candidate VJP page source identity differs"
            )

    def _claim_candidate_vjp_reservation_boundary(
        self,
        reservation: _NoNECandidateVJPReservation,
    ) -> None:
        """Claim one forward reservation exactly once before backward replay."""

        ordinal = int(
            reservation.execution_ordinal_t.detach().cpu().long().reshape(())
        )
        with self._candidate_vjp_lock:
            expected = self._candidate_vjp_reservations.get(ordinal)
            if (
                expected is None
                or not _same_candidate_vjp_reservation_boundary(
                    expected,
                    reservation,
                )
            ):
                raise RuntimeError(
                    "NoNE candidate VJP backward reservation differs"
                )
            if bool(self.candidate_vjp_trace_set_consumed_t):
                raise RuntimeError(
                    "NoNE candidate VJP trace set is already consumed"
                )
            if ordinal in self._candidate_vjp_backward_claimed_ids:
                raise RuntimeError(
                    "NoNE candidate VJP backward reservation was already claimed"
                )
            self._candidate_vjp_backward_claimed_ids.add(ordinal)
        # A failed identity check leaves the claim outstanding. That candidate
        # can only roll back; it cannot repeat backward against changed bytes.
        self._assert_candidate_vjp_reservation_identity_boundary(reservation)

    def _candidate_vjp_trace_ordinals_boundary(self) -> tuple[int, ...]:
        """Return a complete trace set or fail before page-local Adam."""

        with self._candidate_vjp_lock:
            forward_count_t = (
                self.candidate_vjp_forward_count_t.detach().cpu().long()
            )
            trace_count_t = self.candidate_vjp_trace_count_t.detach().cpu().long()
            if forward_count_t.numel() != 1 or trace_count_t.numel() != 1:
                raise RuntimeError("NoNE candidate VJP trace count is invalid")
            forward_count = int(forward_count_t.reshape(()))
            expected = tuple(range(forward_count))
            observed_reservations = tuple(
                sorted(self._candidate_vjp_reservations)
            )
            observed_claims = tuple(
                sorted(self._candidate_vjp_backward_claimed_ids)
            )
            observed_completed = tuple(
                sorted(self._candidate_vjp_completed_ids)
            )
            observed_bindings = tuple(
                sorted(self._candidate_vjp_trace_bindings)
            )
            if (
                int(trace_count_t.reshape(())) != forward_count
                or observed_reservations != expected
                or observed_claims != expected
                or observed_completed != expected
                or observed_bindings != expected
            ):
                raise RuntimeError(
                    "NoNE candidate VJP expected trace set is incomplete"
                )
            reservations = tuple(
                self._candidate_vjp_reservations[ordinal]
                for ordinal in expected
            )
            bindings = tuple(
                self._candidate_vjp_trace_bindings[ordinal]
                for ordinal in expected
            )
            if any(
                not _same_candidate_vjp_reservation_boundary(
                    reservation,
                    binding.reservation,
                )
                for reservation, binding in zip(
                    reservations,
                    bindings,
                    strict=True,
                )
            ):
                raise RuntimeError(
                    "NoNE candidate VJP trace reservation differs"
                )
            consumed = bool(self.candidate_vjp_trace_set_consumed_t)
        if not consumed:
            for reservation in reservations:
                self._assert_candidate_vjp_reservation_identity_boundary(
                    reservation
                )
        return expected

    def _consume_candidate_vjp_trace_set_boundary(self) -> bool:
        """Atomically fence one complete VJP set before any optimizer update."""

        with self._candidate_vjp_lock:
            has_authority = bool(
                self._candidate_vjp_reservations
                or self._candidate_vjp_trace_bindings
                or self._candidate_vjp_backward_claimed_ids
                or self._candidate_vjp_completed_ids
                or int(
                    self.candidate_vjp_forward_count_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                )
                or int(
                    self.candidate_vjp_trace_count_t.detach()
                    .cpu()
                    .long()
                    .reshape(())
                )
            )
            if not has_authority:
                return False
            if bool(self.candidate_vjp_trace_set_consumed_t):
                raise RuntimeError(
                    "NoNE candidate VJP trace set was already consumed"
                )
            # The RLock intentionally remains held across identity validation
            # and the consumed latch. A forward reservation or backward
            # completion therefore cannot enter between the complete-set proof
            # and the first page-local optimizer update.
            self._candidate_vjp_trace_ordinals_boundary()
            with torch.no_grad():
                self.candidate_vjp_trace_set_consumed_t.fill_(True)
                self.candidate_prepare_poisoned_t.fill_(True)
        return True

    def candidate_vjp_checkpoint_state_boundary(
        self,
    ) -> NoNECandidateVJPCheckpointPacket:
        """Snapshot the exact in-flight VJP authority for recomputation."""

        with self._candidate_vjp_lock:
            return NoNECandidateVJPCheckpointPacket(
                forward_count_t=(
                    self.candidate_vjp_forward_count_t.detach().clone()
                ),
                trace_count_t=self.candidate_vjp_trace_count_t.detach().clone(),
                trace_set_consumed_t=(
                    self.candidate_vjp_trace_set_consumed_t.detach().clone()
                ),
                prepare_poisoned_t=(
                    self.candidate_prepare_poisoned_t.detach().clone()
                ),
                reservations=tuple(
                    _clone_candidate_vjp_reservation_boundary(
                        self._candidate_vjp_reservations[ordinal]
                    )
                    for ordinal in sorted(self._candidate_vjp_reservations)
                ),
                trace_bindings=tuple(
                    _clone_candidate_vjp_trace_binding_boundary(
                        self._candidate_vjp_trace_bindings[ordinal]
                    )
                    for ordinal in sorted(self._candidate_vjp_trace_bindings)
                ),
                backward_claimed_ids_t=torch.tensor(
                    tuple(sorted(self._candidate_vjp_backward_claimed_ids)),
                    dtype=torch.long,
                ),
                completed_ids_t=torch.tensor(
                    tuple(sorted(self._candidate_vjp_completed_ids)),
                    dtype=torch.long,
                ),
            )

    def restore_candidate_vjp_checkpoint_state_boundary(
        self,
        saved: NoNECandidateVJPCheckpointPacket,
    ) -> None:
        """Restore reservations and traces around activation recomputation."""

        def nonnegative_long_scalar(
            tensor_t: torch.Tensor,
            *,
            label: str,
        ) -> int:
            if tensor_t.dtype != torch.long or tensor_t.shape != ():
                raise RuntimeError(
                    f"NoNE candidate VJP checkpoint {label} schema differs"
                )
            value = int(tensor_t.detach().cpu().reshape(()))
            if value < 0:
                raise RuntimeError(
                    f"NoNE candidate VJP checkpoint {label} is negative"
                )
            return value

        def bool_scalar(
            tensor_t: torch.Tensor,
            *,
            label: str,
        ) -> bool:
            if tensor_t.dtype != torch.bool or tensor_t.shape != ():
                raise RuntimeError(
                    f"NoNE candidate VJP checkpoint {label} schema differs"
                )
            return bool(tensor_t.detach().cpu().reshape(()))

        def canonical_ids(
            tensor_t: torch.Tensor,
            *,
            label: str,
        ) -> tuple[int, ...]:
            if tensor_t.dtype != torch.long or tensor_t.ndim != 1:
                raise RuntimeError(
                    f"NoNE candidate VJP checkpoint {label} schema differs"
                )
            values = tuple(
                int(value)
                for value in tensor_t.detach().cpu().tolist()
            )
            if values != tuple(sorted(set(values))):
                raise RuntimeError(
                    f"NoNE candidate VJP checkpoint {label} is not canonical"
                )
            return values

        forward_count = nonnegative_long_scalar(
            saved.forward_count_t,
            label="forward count",
        )
        trace_count = nonnegative_long_scalar(
            saved.trace_count_t,
            label="trace count",
        )
        trace_set_consumed = bool_scalar(
            saved.trace_set_consumed_t,
            label="consumed latch",
        )
        prepare_poisoned = bool_scalar(
            saved.prepare_poisoned_t,
            label="prepare poison",
        )
        reservation_ordinals = tuple(
            nonnegative_long_scalar(
                reservation.execution_ordinal_t,
                label="reservation ordinal",
            )
            for reservation in saved.reservations
        )
        expected_ordinals = tuple(range(forward_count))
        if reservation_ordinals != expected_ordinals:
            raise RuntimeError(
                "NoNE candidate VJP checkpoint reservation order differs"
            )
        binding_ordinals = tuple(
            nonnegative_long_scalar(
                binding.execution_ordinal_t,
                label="binding ordinal",
            )
            for binding in saved.trace_bindings
        )
        if binding_ordinals != tuple(sorted(set(binding_ordinals))):
            raise RuntimeError(
                "NoNE candidate VJP checkpoint binding order differs"
            )
        claimed_ids = canonical_ids(
            saved.backward_claimed_ids_t,
            label="claimed IDs",
        )
        completed_ids = canonical_ids(
            saved.completed_ids_t,
            label="completed IDs",
        )
        expected_id_set = set(expected_ordinals)
        claimed = set(claimed_ids)
        completed = set(completed_ids)
        if (
            not claimed.issubset(expected_id_set)
            or not completed.issubset(claimed)
            or binding_ordinals != completed_ids
            or trace_count != len(binding_ordinals)
        ):
            raise RuntimeError(
                "NoNE candidate VJP checkpoint transaction state differs"
            )
        if trace_set_consumed and (
            forward_count < 1
            or not prepare_poisoned
            or trace_count != forward_count
            or claimed_ids != expected_ordinals
            or completed_ids != expected_ordinals
        ):
            raise RuntimeError(
                "NoNE candidate VJP checkpoint consumed state is incomplete"
            )
        if forward_count == 0 and (
            trace_count
            or claimed_ids
            or completed_ids
            or binding_ordinals
            or trace_set_consumed
        ):
            raise RuntimeError(
                "NoNE candidate VJP checkpoint empty state differs"
            )
        for reservation in saved.reservations:
            nonnegative_long_scalar(
                reservation.candidate_generation_t,
                label="reservation generation",
            )
            nonnegative_long_scalar(
                reservation.candidate_state_revision_t,
                label="reservation revision",
            )
        for binding, ordinal in zip(
            saved.trace_bindings,
            binding_ordinals,
            strict=True,
        ):
            reservation = saved.reservations[ordinal]
            if (
                not torch.equal(
                    binding.candidate_generation_t,
                    reservation.candidate_generation_t,
                )
                or not torch.equal(
                    binding.candidate_state_revision_t,
                    reservation.candidate_state_revision_t,
                )
                or not _same_candidate_vjp_reservation_boundary(
                    reservation,
                    binding.reservation,
                )
            ):
                raise RuntimeError(
                    "NoNE candidate VJP checkpoint binding identity differs"
                )
            object_bytes = nonnegative_long_scalar(
                binding.object_bytes_t,
                label="binding byte count",
            )
            if (
                object_bytes < 1
                or binding.object_sha256_t.dtype != torch.uint8
                or binding.object_sha256_t.shape != (32,)
            ):
                raise RuntimeError(
                    "NoNE candidate VJP checkpoint binding object differs"
                )

        reservations = {
            ordinal: _clone_candidate_vjp_reservation_boundary(reservation)
            for ordinal, reservation in zip(
                reservation_ordinals,
                saved.reservations,
                strict=True,
            )
        }
        bindings = {
            ordinal: _clone_candidate_vjp_trace_binding_boundary(binding)
            for ordinal, binding in zip(
                binding_ordinals,
                saved.trace_bindings,
                strict=True,
            )
        }
        saved_paths = {
            binding.scratch_path.expanduser().resolve()
            for binding in bindings.values()
        }
        stale_paths: set[Path]
        with self._candidate_vjp_lock:
            for reservation in reservations.values():
                self._assert_candidate_vjp_reservation_identity_boundary(
                    reservation
                )
            scratch_root = self._candidate_scratch_root
            if bindings and scratch_root is None:
                raise RuntimeError(
                    "NoNE candidate VJP checkpoint has no scratch root"
                )
            resolved_scratch_root = (
                scratch_root.expanduser().resolve()
                if scratch_root is not None
                else None
            )
            for ordinal, binding in bindings.items():
                trace_path = binding.scratch_path.expanduser().resolve()
                object_bytes = int(
                    binding.object_bytes_t.detach().cpu().reshape(())
                )
                if (
                    resolved_scratch_root is None
                    or trace_path.parent != resolved_scratch_root
                    or trace_path.name
                    != f"vjp_trace_{ordinal:08d}.safetensors"
                    or not trace_path.is_file()
                    or trace_path.stat().st_size != object_bytes
                    or _file_sha256(trace_path)
                    != _tensor_digest_hex(binding.object_sha256_t)
                ):
                    raise RuntimeError(
                        "NoNE candidate VJP checkpoint trace identity differs"
                    )
            stale_paths = {
                current.scratch_path
                for current in self._candidate_vjp_trace_bindings.values()
                if current.scratch_path.expanduser().resolve()
                not in saved_paths
            }
            self._candidate_vjp_reservations.clear()
            self._candidate_vjp_reservations.update(reservations)
            self._candidate_vjp_trace_bindings.clear()
            self._candidate_vjp_trace_bindings.update(bindings)
            self._candidate_vjp_backward_claimed_ids.clear()
            self._candidate_vjp_backward_claimed_ids.update(claimed)
            self._candidate_vjp_completed_ids.clear()
            self._candidate_vjp_completed_ids.update(completed)
            with torch.no_grad():
                self.candidate_vjp_forward_count_t.copy_(
                    saved.forward_count_t.to(
                        device=self.candidate_vjp_forward_count_t.device,
                    )
                )
                self.candidate_vjp_trace_count_t.copy_(
                    saved.trace_count_t.to(
                        device=self.candidate_vjp_trace_count_t.device,
                    )
                )
                self.candidate_vjp_trace_set_consumed_t.copy_(
                    saved.trace_set_consumed_t.to(
                        device=self.candidate_vjp_trace_set_consumed_t.device,
                    )
                )
                self.candidate_prepare_poisoned_t.copy_(
                    saved.prepare_poisoned_t.to(
                        device=self.candidate_prepare_poisoned_t.device,
                    )
                )
        for stale_path in stale_paths:
            stale_path.unlink(missing_ok=True)

    def _stage_candidate_vjp_trace_boundary(
        self,
        *,
        hidden_t: torch.Tensor,
        request: NoNEPageRequestPacket,
        gradient_output_t: torch.Tensor,
        candidate_generation_t: torch.Tensor,
        candidate_state_revision_t: torch.Tensor,
        reservation: _NoNECandidateVJPReservation,
    ) -> _NoNECandidatePageVJPTraceBinding:
        """Stage one bounded full-route VJP packet outside resident page memory."""

        store = self._store_boundary
        scratch_root = self._candidate_scratch_root
        if store is None or scratch_root is None or not self._candidate_window_open:
            raise RuntimeError("NoNE candidate VJP trace has no active scratch window")
        expected_generation_t = self.candidate_base_generation_t.detach().cpu().long()
        expected_revision_t = (
            self.candidate_page_state_revision_t.detach().cpu().long()
        )
        observed_generation_t = candidate_generation_t.detach().cpu().long()
        observed_revision_t = candidate_state_revision_t.detach().cpu().long()
        if (
            not torch.equal(observed_generation_t, expected_generation_t)
            or not torch.equal(observed_revision_t, expected_revision_t)
            or not torch.equal(
                observed_generation_t,
                reservation.candidate_generation_t,
            )
            or not torch.equal(
                observed_revision_t,
                reservation.candidate_state_revision_t,
            )
        ):
            raise RuntimeError(
                "NoNE candidate page state changed before backward rematerialization"
            )
        ordinal_t = (
            reservation.execution_ordinal_t.detach().cpu().long().clone()
        )
        if ordinal_t.numel() != 1:
            raise RuntimeError(
                "NoNE candidate VJP reservation ordinal is invalid"
            )
        ordinal = int(ordinal_t.reshape(()))
        if ordinal < 0:
            raise RuntimeError(
                "NoNE candidate VJP reservation ordinal is invalid"
            )
        with self._candidate_vjp_lock:
            expected_reservation = self._candidate_vjp_reservations.get(
                ordinal
            )
            if (
                expected_reservation is None
                or not _same_candidate_vjp_reservation_boundary(
                    expected_reservation,
                    reservation,
                )
                or ordinal not in self._candidate_vjp_backward_claimed_ids
                or ordinal in self._candidate_vjp_completed_ids
                or ordinal in self._candidate_vjp_trace_bindings
            ):
                raise RuntimeError(
                    "NoNE candidate VJP trace reservation differs"
                )
            if bool(self.candidate_vjp_trace_set_consumed_t):
                raise RuntimeError(
                    "NoNE candidate VJP trace set is already consumed"
                )
        trace_path = scratch_root / f"vjp_trace_{ordinal:08d}.safetensors"
        temporary_path = scratch_root / (
            f".vjp_trace_{ordinal:08d}.{os.getpid()}.tmp"
        )
        if trace_path.exists() or temporary_path.exists():
            raise RuntimeError("NoNE candidate VJP trace identity already exists")

        def retained(tensor: torch.Tensor) -> torch.Tensor:
            # Safetensors requires dense contiguous storage. Route tensors may
            # be transposed/indexed views; normalizing layout here preserves
            # their exact values and model-owned ordering without retaining
            # the upstream graph.
            return (
                tensor.detach()
                .to(device=torch.device("cpu"), copy=True)
                .contiguous()
            )

        frontier_weight_t = retained(request.frontier_weight_t)
        active_pair_index_t = (
            _frontier_active_pair_index(frontier_weight_t)
            if request.active_pair_index_t is None
            else retained(request.active_pair_index_t).long()
        )
        payload = {
            "hidden_t": retained(hidden_t),
            "gradient_output_t": retained(gradient_output_t),
            "candidate_generation_t": observed_generation_t.clone(),
            "candidate_state_revision_t": observed_revision_t.clone(),
            "execution_ordinal_t": ordinal_t.clone(),
            "session_id_t": retained(request.session_id_t).long(),
            "generation_t": retained(request.generation_t).long(),
            "layer_id_t": retained(request.layer_id_t).long(),
            "page_ids_t": retained(request.page_ids_t).long(),
            "unique_page_ids_t": retained(request.unique_page_ids_t).long(),
            "unique_page_catalog_positions_t": retained(
                request.unique_page_catalog_positions_t
            ).long(),
            "page_position_t": retained(request.page_position_t).long(),
            "route_probability_t": retained(request.route_probability_t),
            "route_entropy_t": retained(request.route_entropy_t),
            "frontier_weight_t": frontier_weight_t,
            "active_pair_index_t": active_pair_index_t,
        }
        serialized = save(payload)
        object_sha256 = hashlib.sha256(serialized).hexdigest()
        try:
            with temporary_path.open("xb") as handle:
                written = handle.write(serialized)
                if written != len(serialized):
                    raise OSError("NoNE candidate VJP trace write is incomplete")
                handle.flush()
            os.replace(temporary_path, trace_path)
        except BaseException:
            # The trace is proposal-local, but its scratch directory is
            # fail-closed and must be empty at rollback. Never leave an
            # unregistered temporary object that can mask the primary write
            # failure during candidate cleanup.
            temporary_path.unlink(missing_ok=True)
            raise
        binding = _NoNECandidatePageVJPTraceBinding(
            candidate_generation_t=observed_generation_t.clone(),
            candidate_state_revision_t=observed_revision_t.clone(),
            execution_ordinal_t=ordinal_t.clone(),
            scratch_path=trace_path,
            object_sha256_t=digest_tensor(object_sha256),
            object_bytes_t=torch.tensor(len(serialized), dtype=torch.long),
            reservation=_clone_candidate_vjp_reservation_boundary(
                reservation
            ),
        )
        try:
            with self._candidate_vjp_lock:
                expected_reservation = self._candidate_vjp_reservations.get(
                    ordinal
                )
                if (
                    expected_reservation is None
                    or not _same_candidate_vjp_reservation_boundary(
                        expected_reservation,
                        reservation,
                    )
                    or ordinal
                    not in self._candidate_vjp_backward_claimed_ids
                    or ordinal in self._candidate_vjp_completed_ids
                    or ordinal in self._candidate_vjp_trace_bindings
                    or bool(self.candidate_vjp_trace_set_consumed_t)
                ):
                    raise RuntimeError(
                        "NoNE candidate VJP trace registration differs"
                    )
                self._candidate_vjp_trace_bindings[ordinal] = binding
                self._candidate_vjp_completed_ids.add(ordinal)
                with torch.no_grad():
                    self.candidate_vjp_trace_count_t.add_(
                        torch.ones_like(self.candidate_vjp_trace_count_t)
                    )
        except BaseException:
            # Registration is the authority boundary. A completely written
            # object that did not enter the completed set is not a trace and
            # must not survive to influence a retry or cleanup audit.
            trace_path.unlink(missing_ok=True)
            raise
        return binding

    def _materialize_candidate_vjp_trace_boundary(
        self,
        binding: _NoNECandidatePageVJPTraceBinding,
    ) -> _NoNECandidatePageVJPTrace:
        """Load and verify one proposal-local VJP trace in execution order."""

        scratch_root = self._candidate_scratch_root
        trace_path = binding.scratch_path.expanduser().resolve()
        if (
            scratch_root is None
            or trace_path.parent != scratch_root.expanduser().resolve()
            or trace_path.name
            != (
                "vjp_trace_"
                f"{int(binding.execution_ordinal_t.reshape(())):08d}"
                ".safetensors"
            )
            or not trace_path.is_file()
            or trace_path.stat().st_size
            != int(binding.object_bytes_t.reshape(()))
            or _file_sha256(trace_path)
            != _tensor_digest_hex(binding.object_sha256_t)
        ):
            raise RuntimeError("NoNE candidate VJP trace identity differs")
        expected_keys = {
            "hidden_t",
            "gradient_output_t",
            "candidate_generation_t",
            "candidate_state_revision_t",
            "execution_ordinal_t",
            "session_id_t",
            "generation_t",
            "layer_id_t",
            "page_ids_t",
            "unique_page_ids_t",
            "unique_page_catalog_positions_t",
            "page_position_t",
            "route_probability_t",
            "route_entropy_t",
            "frontier_weight_t",
            "active_pair_index_t",
        }
        with safe_open(  # type: ignore[no-untyped-call]
            str(trace_path),
            framework="pt",
            device="cpu",
        ) as handle:
            if set(handle.keys()) != expected_keys:
                raise RuntimeError("NoNE candidate VJP trace tensor schema differs")
            tensors = {
                name: handle.get_tensor(name)
                for name in expected_keys
            }
        if (
            not torch.equal(
                tensors["candidate_generation_t"].long(),
                binding.candidate_generation_t.long(),
            )
            or not torch.equal(
                tensors["candidate_state_revision_t"].long(),
                binding.candidate_state_revision_t.long(),
            )
            or not torch.equal(
                tensors["execution_ordinal_t"].long(),
                binding.execution_ordinal_t.long(),
            )
        ):
            raise RuntimeError("NoNE candidate VJP trace authority differs")
        request = NoNEPageRequestPacket(
            session_id_t=tensors["session_id_t"].long(),
            generation_t=tensors["generation_t"].long(),
            layer_id_t=tensors["layer_id_t"].long(),
            page_ids_t=tensors["page_ids_t"].long(),
            unique_page_ids_t=tensors["unique_page_ids_t"].long(),
            unique_page_catalog_positions_t=(
                tensors["unique_page_catalog_positions_t"].long()
            ),
            page_position_t=tensors["page_position_t"].long(),
            route_probability_t=tensors["route_probability_t"],
            route_entropy_t=tensors["route_entropy_t"],
            frontier_weight_t=tensors["frontier_weight_t"],
            active_pair_index_t=tensors["active_pair_index_t"].long(),
        )
        return _NoNECandidatePageVJPTrace(
            request=request,
            hidden_t=tensors["hidden_t"],
            gradient_output_t=tensors["gradient_output_t"],
            candidate_generation_t=tensors["candidate_generation_t"].long(),
            candidate_state_revision_t=(
                tensors["candidate_state_revision_t"].long()
            ),
            execution_ordinal_t=tensors["execution_ordinal_t"].long(),
        )

    def _discard_candidate_vjp_traces_boundary(self) -> None:
        """Remove every proposal-local trace before its scratch window closes."""

        with self._candidate_vjp_lock:
            trace_paths = {
                binding.scratch_path
                for binding in self._candidate_vjp_trace_bindings.values()
            }
            if self._candidate_scratch_root is not None:
                trace_paths.update(
                    self._candidate_scratch_root
                    / f"vjp_trace_{ordinal:08d}.safetensors"
                    for ordinal in self._candidate_vjp_reservations
                )
            self._candidate_vjp_trace_bindings.clear()
            self._candidate_vjp_reservations.clear()
            self._candidate_vjp_backward_claimed_ids.clear()
            self._candidate_vjp_completed_ids.clear()
            with torch.no_grad():
                self.candidate_vjp_forward_count_t.zero_()
                self.candidate_vjp_trace_count_t.zero_()
                self.candidate_vjp_trace_set_consumed_t.zero_()
        for trace_path in trace_paths:
            trace_path.unlink(missing_ok=True)

    def _clear_candidate_boundary(self) -> None:
        # Joining consumes every future even when one or more D2H validation
        # fences fail. Cleanup is the quarantine boundary: the operation that
        # first needed the candidate observes the primary failure, while
        # rollback/finish remains idempotent and cannot rethrow a second failed
        # page after accepted state has already been restored.
        try:
            self._resolve_all_candidate_page_stages_boundary()
        except Exception:
            pass
        finally:
            self._shutdown_candidate_stage_executor_boundary()
        self._discard_candidate_vjp_traces_boundary()
        store = self._store_boundary
        if store is not None:
            for binding in self._candidate_page_scratch.values():
                if binding.scratch_path.is_file():
                    store.discard_candidate_page_scratch_boundary(binding)
            if self._candidate_scratch_root is not None:
                store.finish_candidate_page_scratch_window_boundary(
                    self._candidate_scratch_root
                )
        self._candidate_pages.clear()
        self._candidate_forward_weights.clear()
        self._candidate_forward_wave_bindings.clear()
        self._candidate_page_objects.clear()
        self._candidate_page_scratch.clear()
        self._candidate_page_journal.clear()
        self._candidate_training_page_cache.clear()
        self._candidate_page_stage_futures.clear()
        self._candidate_scratch_root = None
        self._candidate_updated_page_ids.clear()
        self._candidate_gradient_page_ids.clear()
        self._candidate_imported_page_ids.clear()
        self._candidate_window_open = False
        self._training_route_cohort_open = False
        self._training_route_cohort_page_ids = None
        self._training_route_cohort_catalog_positions_t = None
        self.last_bundle = None
        with torch.no_grad():
            self.candidate_window_active_t.zero_()
            self.candidate_base_generation_t.zero_()
            self.candidate_page_state_revision_t.zero_()
            self.candidate_prepare_poisoned_t.zero_()
            self.candidate_vjp_forward_count_t.zero_()
            self.candidate_vjp_trace_count_t.zero_()
            self.candidate_vjp_trace_set_consumed_t.zero_()
            self.candidate_rematerialized_page_peak_t.zero_()
            self.candidate_page_update_count_t.zero_()
            self.candidate_route_count_t.zero_()
            self.candidate_gradient_update_count_t.zero_()
            self.candidate_gradient_norm_t.zero_()
            self.candidate_parameter_delta_norm_t.zero_()
            self.candidate_gradient_signature_t.zero_()
            self.candidate_device_residency_mask_t.zero_()
            self.candidate_active_trainable_page_mask_t.zero_()
            self.candidate_external_object_bytes_by_page_t.zero_()

    def begin_candidate_update_window_boundary(self) -> torch.Tensor:
        """Open a proposal-local residency cache from the accepted generation."""

        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        self._clear_candidate_boundary()
        generation_t = store.accepted_generation_t().to(
            device=self.candidate_base_generation_t.device,
        )
        with torch.no_grad():
            self.candidate_base_generation_t.copy_(generation_t)
            self.candidate_page_state_revision_t.fill_(1)
            self.candidate_window_active_t.fill_(True)
        self._candidate_scratch_root = (
            store.begin_candidate_page_scratch_window_boundary()
        )
        self._candidate_window_open = True
        return self.candidate_base_generation_t.clone()

    @staticmethod
    def _page_ids_external_tuple_boundary(
        page_ids_t: torch.Tensor,
    ) -> tuple[int, ...]:
        """Materialize routed IDs once at the explicit page-store boundary."""

        return tuple(
            int(page_id)
            for page_id in page_ids_t.detach().cpu().tolist()
        )

    def _candidate_weights_for_request_boundary(
        self,
        request: NoNEPageRequestPacket,
        *,
        device: torch.device,
        dtype: torch.dtype,
        complete_cohort_request: NoNEPageRequestPacket | None = None,
    ) -> NoNEPageWeights:
        """Materialize exact routed weights without union optimizer state."""

        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        catalog_positions_t = request.unique_page_catalog_positions_t.to(
            device=self.router.page_catalog_ids_t.device,
            dtype=torch.long,
        )
        if catalog_positions_t.shape != request.unique_page_ids_t.shape:
            raise RuntimeError("NoNE page request catalog position geometry differs")
        torch._assert_async(
            self.router.page_catalog_ids_t.index_select(
                0,
                catalog_positions_t,
            ).eq(
                request.unique_page_ids_t.to(
                    device=self.router.page_catalog_ids_t.device,
                    dtype=torch.long,
                )
            ).all(),
            "NoNE page request catalog positions changed the model route",
        )
        if self._training_route_cohort_open:
            cohort_request = (
                request
                if complete_cohort_request is None
                else complete_cohort_request
            )
            cohort_catalog_positions_t = (
                cohort_request.unique_page_catalog_positions_t.to(
                    device=self.router.page_catalog_ids_t.device,
                    dtype=torch.long,
                )
            )
            cached_positions_t = self._training_route_cohort_catalog_positions_t
            cached_page_ids = self._training_route_cohort_page_ids
            if cached_positions_t is None or cached_page_ids is None:
                cohort_requested_ids = self._page_ids_external_tuple_boundary(
                    cohort_request.unique_page_ids_t
                )
                self._training_route_cohort_page_ids = cohort_requested_ids
                cached_page_ids = cohort_requested_ids
                self._training_route_cohort_catalog_positions_t = (
                    cohort_catalog_positions_t.detach().clone()
                )
            else:
                if cached_positions_t.shape != cohort_catalog_positions_t.shape:
                    raise RuntimeError(
                        "NoNE training route cohort catalog geometry changed"
                    )
                torch._assert_async(
                    cached_positions_t.eq(cohort_catalog_positions_t).all(),
                    "NoNE training route cohort changed its model-owned page set",
                )
            if request is cohort_request:
                requested_ids = self._training_route_cohort_page_ids
                if requested_ids is None:
                    raise RuntimeError(
                        "NoNE training route cohort page IDs were not materialized"
                    )
            elif (
                cached_page_ids is not None
                and len(cached_page_ids) == 1
                and request.unique_page_ids_t.shape[0] == 1
            ):
                # Atomic residency revisits a confident one-page cohort across
                # recursive layers/steps.  Its tensor identity is still fenced
                # on device above; reuse the one explicit storage-boundary
                # conversion instead of synchronizing the same page ID to the
                # host on every revisit.
                torch._assert_async(
                    request.unique_page_ids_t.to(
                        device=cohort_request.unique_page_ids_t.device,
                        dtype=torch.long,
                    ).eq(cohort_request.unique_page_ids_t).all(),
                    "NoNE atomic training wave changed its cohort page",
                )
                requested_ids = cached_page_ids
            else:
                requested_ids = self._page_ids_external_tuple_boundary(
                    request.unique_page_ids_t
                )
        else:
            requested_ids = self._page_ids_external_tuple_boundary(
                request.unique_page_ids_t
            )
        gradient_wave = self.training and torch.is_grad_enabled()
        for page_id in requested_ids:
            self._resolve_candidate_page_stage_boundary(page_id)
        missing = tuple(
            page_id
            for page_id in requested_ids
            if (
                page_id not in self._candidate_pages
                and page_id not in self._candidate_forward_weights
                and page_id not in self._candidate_forward_wave_bindings
            )
        )
        if missing:
            candidate_missing = tuple(
                page_id
                for page_id in missing
                if (
                    page_id in self._candidate_page_journal
                    or page_id in self._candidate_page_scratch
                    or page_id in self._candidate_page_objects
                )
            )
            for page_id in candidate_missing:
                journal_bundle = self._candidate_page_journal.get(page_id)
                scratch_binding = self._candidate_page_scratch.get(page_id)
                candidate_bundle = (
                    _move_immutable_page_bundle_for_consumer_boundary(
                        journal_bundle,
                        device=device,
                        dtype=dtype,
                        trainable=(
                            self.training
                            and torch.is_grad_enabled()
                            and page_id in self._training_eligible_page_ids
                            and page_id not in self._candidate_imported_page_ids
                        ),
                    )
                    if journal_bundle is not None
                    else store.materialize_candidate_page_scratch_boundary(
                        scratch_binding,
                        device=device,
                        dtype=dtype,
                        trainable=(
                            self.training
                            and torch.is_grad_enabled()
                            and page_id in self._training_eligible_page_ids
                            and page_id not in self._candidate_imported_page_ids
                        ),
                    )
                    if scratch_binding is not None
                    else store.materialize_page_object_boundary(
                        self._candidate_page_objects[page_id],
                        device=device,
                        dtype=dtype,
                        trainable=(
                            self.training
                            and torch.is_grad_enabled()
                            and page_id in self._training_eligible_page_ids
                            and page_id not in self._candidate_imported_page_ids
                        ),
                    )
                )
                # Forward/backward owns only the exact page weights. Optimizer
                # moments remain in the journal/scratch/object authority and
                # are rematerialized one page at a time after a real gradient.
                self._candidate_forward_weights[page_id] = (
                    candidate_bundle.weights
                )
            accepted_missing = tuple(
                page_id
                for page_id in missing
                if (
                    page_id not in self._candidate_page_journal
                    and page_id not in self._candidate_page_scratch
                    and page_id not in self._candidate_page_objects
                )
            )
            if accepted_missing:
                owned_accepted_missing = tuple(
                    page_id
                    for page_id in accepted_missing
                    if (
                        gradient_wave
                        and page_id in self._training_eligible_page_ids
                        and page_id not in self._candidate_imported_page_ids
                    )
                )
                frozen_accepted_missing = tuple(
                    page_id
                    for page_id in accepted_missing
                    if page_id not in owned_accepted_missing
                )
                for accepted_group, group_trainable in (
                    (frozen_accepted_missing, False),
                    (owned_accepted_missing, True),
                ):
                    if not accepted_group:
                        continue
                    missing_page_ids_t = request.unique_page_ids_t.new_tensor(
                        accepted_group,
                        dtype=torch.long,
                    )
                    accepted_weights = store.materialize_page_ids_boundary(
                        session_id_t=request.session_id_t,
                        generation_t=request.generation_t,
                        page_ids_t=missing_page_ids_t,
                        device=device,
                        dtype=dtype,
                        trainable=group_trainable,
                    )
                    # The store proves that its returned rows exactly equal
                    # ``missing_page_ids_t`` before moving them to the consumer
                    # device. Keep frozen parent rows in a distinct leaf from
                    # branch-owned rows: one owned page must not allocate a
                    # persistent gradient plane for every immutable parent row.
                    # Exact optimizer moments stay behind the immutable store
                    # boundary until a real gradient consumes one page.
                    for row_index, page_id in enumerate(accepted_group):
                        if (
                            page_id not in self._candidate_pages
                            and page_id not in self._candidate_forward_weights
                            and page_id
                            not in self._candidate_forward_wave_bindings
                        ):
                            binding = _NoNECandidateForwardWaveBinding(
                                weights=accepted_weights,
                                row_index_t=torch.tensor(
                                    row_index,
                                    device=accepted_weights.page_ids_t.device,
                                    dtype=torch.long,
                                ),
                            )
                            self._candidate_forward_wave_bindings[
                                page_id
                            ] = binding
                            # A singleton batch is already the exact page leaf,
                            # so legacy gradient inspection needs no retained
                            # view. Multi-page groups expose ordinary aliases;
                            # the page optimizer reads the authoritative batch
                            # leaf gradient through its row binding.
                            self._candidate_forward_weights[page_id] = (
                                accepted_weights
                                if len(accepted_group) == 1
                                else _candidate_forward_wave_row_view_boundary(
                                    binding
                                )
                            )
        for page_id in requested_ids:
            cached_bundle = self._candidate_pages.get(page_id)
            cached_binding = self._candidate_forward_wave_bindings.get(
                page_id
            )
            cached_weights = (
                cached_bundle.weights
                if cached_bundle is not None
                else self._candidate_forward_weights[page_id]
                if cached_binding is None
                else _candidate_forward_wave_row_view_boundary(
                    cached_binding
                )
            )
            cached_weight = cached_weights.gate_t
            keep_trainable = (
                gradient_wave
                and page_id in self._training_eligible_page_ids
                and page_id not in self._candidate_imported_page_ids
            ) or (
                page_id in self._candidate_gradient_page_ids
            )
            if (
                cached_weight.device != device
                or cached_weight.dtype != dtype
                or (
                    keep_trainable
                    and not cached_weight.requires_grad
                )
            ):
                cached_weights = (
                    _move_immutable_page_weights_for_consumer_boundary(
                        (
                            cached_binding.weights
                            if cached_binding is not None
                            else cached_weights
                        ),
                        device=device,
                        dtype=dtype,
                        trainable=(
                            keep_trainable
                            or cached_weight.requires_grad
                        ),
                    )
                )
                if cached_binding is not None:
                    prior_wave = cached_binding.weights
                    for bound_page_id, bound in tuple(
                        self._candidate_forward_wave_bindings.items()
                    ):
                        if bound.weights is prior_wave:
                            rebound = replace(
                                bound,
                                weights=cached_weights,
                            )
                            self._candidate_forward_wave_bindings[
                                bound_page_id
                            ] = rebound
                            self._candidate_forward_weights[
                                bound_page_id
                            ] = (
                                cached_weights
                                if cached_weights.page_ids_t.shape[0] == 1
                                else _candidate_forward_wave_row_view_boundary(
                                    rebound
                                )
                            )
                    cached_weights = (
                        _candidate_forward_wave_row_view_boundary(
                            self._candidate_forward_wave_bindings[page_id]
                        )
                    )
                elif cached_bundle is not None:
                    self._candidate_pages[page_id] = replace(
                        cached_bundle,
                        weights=cached_weights,
                    )
                else:
                    self._candidate_forward_weights[page_id] = cached_weights
            if (
                gradient_wave
                and page_id in self._training_eligible_page_ids
                and page_id not in self._candidate_imported_page_ids
            ):
                self._candidate_gradient_page_ids.add(page_id)
        requested_catalog_mask_t = torch.zeros_like(
            self.candidate_device_residency_mask_t,
            device=self.router.page_catalog_ids_t.device,
        ).scatter(
            0,
            catalog_positions_t,
            torch.ones_like(
                catalog_positions_t,
                dtype=self.candidate_device_residency_mask_t.dtype,
            ),
        )
        with torch.no_grad():
            self.candidate_device_residency_mask_t.logical_or_(
                requested_catalog_mask_t.to(
                    device=self.candidate_device_residency_mask_t.device,
                    dtype=torch.bool,
                )
            )
            if gradient_wave:
                self.candidate_active_trainable_page_mask_t.logical_or_(
                    (
                        requested_catalog_mask_t
                        & self.training_eligible_page_mask_t
                        & torch.logical_not(
                            self.router.page_catalog_ids_t.unsqueeze(1)
                            .eq(
                                self.router.page_catalog_ids_t.new_tensor(
                                    tuple(sorted(self._candidate_imported_page_ids)),
                                    dtype=torch.long,
                                ).unsqueeze(0)
                            )
                            .any(dim=1)
                            if self._candidate_imported_page_ids
                            else torch.zeros_like(requested_catalog_mask_t)
                        )
                    ).to(
                        device=self.candidate_active_trainable_page_mask_t.device,
                        dtype=torch.bool,
                    )
                )
        requested_bindings = tuple(
            self._candidate_forward_wave_bindings.get(page_id)
            for page_id in requested_ids
        )
        first_binding = requested_bindings[0]
        if (
            len(requested_ids) == 1
            and first_binding is not None
            and requested_ids[0] in self._candidate_forward_weights
        ):
            # Preserve the observable row-view gradient while its underlying
            # page-major leaf remains the durable optimizer authority.
            composed = self._candidate_forward_weights[requested_ids[0]]
            if (
                composed.gate_t.requires_grad
                and not composed.gate_t.is_leaf
                and not composed.gate_t.retains_grad
            ):
                composed = _candidate_forward_wave_retained_row_view_boundary(
                    first_binding
                )
                self._candidate_forward_weights[
                    requested_ids[0]
                ] = composed
        elif (
            first_binding is not None
            and len(requested_ids)
            == first_binding.weights.page_ids_t.shape[0]
            and all(
                binding is not None
                and binding.weights is first_binding.weights
                for binding in requested_bindings
            )
        ):
            # The store already composed this exact accepted wave into one
            # private page-major leaf. Reuse it directly instead of cloning
            # every row and concatenating the same matrices a second time.
            composed = (
                self._candidate_forward_weights[requested_ids[0]]
                if len(requested_ids) == 1
                else first_binding.weights
            )
        else:
            ordered_weights = tuple(
                (
                    self._candidate_pages[page_id].weights
                    if page_id in self._candidate_pages
                    else self._candidate_forward_weights[page_id]
                    if page_id in self._candidate_forward_weights
                    else _candidate_forward_wave_row_view_boundary(
                        self._candidate_forward_wave_bindings[page_id]
                    )
                )
                for page_id in requested_ids
            )
            # Mixed accepted/candidate waves retain the general composition
            # path. Optimizer moments remain exact and page-local.
            composed = (
                ordered_weights[0]
                if len(ordered_weights) == 1
                else _concatenate_page_weights(ordered_weights)
            )
        expected_page_ids_t = request.unique_page_ids_t.to(
            device=composed.page_ids_t.device,
            dtype=torch.long,
        )
        if composed.page_ids_t.shape != expected_page_ids_t.shape:
            raise RuntimeError("NoNE candidate cache changed the model page route")
        torch._assert_async(
            composed.page_ids_t.eq(expected_page_ids_t).all(),
            "NoNE candidate cache changed the model page route",
        )
        return composed

    def _candidate_rematerialized_weights_for_request_boundary(
        self,
        request: NoNEPageRequestPacket,
        *,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageWeights:
        """Load one physical route wave without retaining page-sized leaves."""

        return self._candidate_rematerialized_weights_for_page_ids_boundary(
            session_id_t=request.session_id_t,
            generation_t=request.generation_t,
            page_ids_t=request.unique_page_ids_t,
            device=device,
            dtype=dtype,
            trainable=trainable,
        )

    def _candidate_rematerialized_weights_for_page_ids_boundary(
        self,
        *,
        session_id_t: torch.Tensor,
        generation_t: torch.Tensor,
        page_ids_t: torch.Tensor,
        device: torch.device,
        dtype: torch.dtype,
        trainable: bool,
    ) -> NoNEPageWeights:
        """Load one exact page-ID wave without retaining page-sized leaves."""

        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        requested_ids = self._page_ids_external_tuple_boundary(
            page_ids_t
        )
        if not requested_ids:
            raise RuntimeError("NoNE candidate rematerialization route is empty")
        if len(requested_ids) > self.training_residency_wave_pages:
            raise RuntimeError(
                "NoNE candidate rematerialization exceeds physical wave capacity"
            )
        if trainable and any(
            page_id not in self._training_eligible_page_ids
            or page_id in self._candidate_imported_page_ids
            for page_id in requested_ids
        ):
            raise RuntimeError(
                "NoNE candidate gradient replay includes an unowned page"
            )
        for page_id in requested_ids:
            self._resolve_candidate_page_stage_boundary(page_id)
        accepted_wave = all(
            page_id not in self._candidate_page_journal
            and page_id not in self._candidate_page_scratch
            and page_id not in self._candidate_page_objects
            for page_id in requested_ids
        )
        if accepted_wave:
            # The immutable store already validates and composes the complete
            # model-routed wave in request order. Reuse that private contiguous
            # return directly: singleton loads followed by a second concatenate
            # multiplied immutable-object I/O and candidate residency by the
            # routed page count during both forward and backward replay.
            composed = store.materialize_page_ids_boundary(
                session_id_t=session_id_t,
                generation_t=generation_t,
                page_ids_t=page_ids_t,
                device=device,
                dtype=dtype,
                trainable=trainable,
            )
        else:
            # Proposal rows can originate from the journal, scratch, sealed
            # objects, and the accepted generation in one route.  Materialize
            # each verified row on CPU, copy it into one preallocated CPU
            # wave, and move that wave to the execution device exactly once.
            # Loading rows directly on CUDA and then concatenating them keeps
            # every row allocation live beside a second full contiguous wave.
            composed_cpu: NoNEPageWeights | None = None
            for row_index, page_id in enumerate(requested_ids):
                page_trainable = (
                    trainable
                    and page_id in self._training_eligible_page_ids
                    and page_id not in self._candidate_imported_page_ids
                )
                journal_bundle = self._candidate_page_journal.get(page_id)
                scratch_binding = self._candidate_page_scratch.get(page_id)
                object_binding = self._candidate_page_objects.get(page_id)
                if journal_bundle is not None:
                    # Journal publication already proves this is one completed,
                    # non-trainable CPU row.  Read it directly into the
                    # preallocated CPU wave below: cloning/converting this
                    # singleton first creates an avoidable second materialized
                    # leaf before the one composed consumer-device transfer.
                    # The returned wave cannot alias the journal because every
                    # tensor is copied into independent contiguous storage.
                    row = journal_bundle.weights
                elif scratch_binding is not None:
                    row = store.materialize_candidate_page_scratch_boundary(
                        scratch_binding,
                        device=torch.device("cpu"),
                        dtype=dtype,
                        trainable=False,
                    ).weights
                elif object_binding is not None:
                    row = store.materialize_page_object_boundary(
                        object_binding,
                        device=torch.device("cpu"),
                        dtype=dtype,
                        trainable=False,
                    ).weights
                else:
                    row = store.materialize_page_ids_boundary(
                        session_id_t=session_id_t,
                        generation_t=generation_t,
                        page_ids_t=page_ids_t.new_tensor(
                            (page_id,),
                            dtype=torch.long,
                        ),
                        device=torch.device("cpu"),
                        dtype=dtype,
                        trainable=False,
                    )
                if page_trainable != trainable:
                    raise RuntimeError(
                        "NoNE candidate wave mixed trainable page authority"
                    )
                if composed_cpu is None:
                    composed_cpu = (
                        _preallocate_page_weights_wave_like_boundary(
                            row,
                            page_count=len(requested_ids),
                        )
                    )
                _copy_page_weights_row_into_wave_boundary(
                    composed_cpu,
                    row,
                    row_index=row_index,
                )
                del row
            if composed_cpu is None:
                raise RuntimeError(
                    "NoNE candidate rematerialization produced no wave"
                )
            composed = composed_cpu.to(
                device=device,
                dtype=dtype,
                trainable=trainable,
            )
            del composed_cpu
        expected_page_ids_t = page_ids_t.to(
            device=composed.page_ids_t.device,
            dtype=torch.long,
        )
        if composed.page_ids_t.shape != expected_page_ids_t.shape:
            raise RuntimeError(
                "NoNE candidate rematerialization changed the model route"
            )
        torch._assert_async(
            composed.page_ids_t.eq(expected_page_ids_t).all(),
            "NoNE candidate rematerialization changed the model route",
        )
        with torch.no_grad():
            self.candidate_rematerialized_page_peak_t.copy_(
                torch.maximum(
                    self.candidate_rematerialized_page_peak_t,
                    self.candidate_rematerialized_page_peak_t.new_tensor(
                        len(requested_ids)
                    ),
                )
            )
        return composed

    def attach_imported_candidate_page_objects_boundary(
        self,
        imported: NoNELayerPageImportResultPacket,
    ) -> torch.Tensor:
        """Attach verified branch pages to this layer's candidate window.

        Imported pages are frozen for the merge transaction.  Their source
        branch gradients are retained as candidate evidence, while the target
        model must still route through and validate the merged objects before
        normal checkpoint authority can advance.
        """

        _tensor_assert(
            self.candidate_window_active_t,
            "NoNE layer import has no active candidate window",
        )
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        if self._candidate_vjp_trace_bindings:
            raise RuntimeError(
                "NoNE imported candidate cannot replace retained VJP authority"
            )
        catalog_ids_t = self.router.page_catalog_ids_t.detach().cpu().long()
        object_page_ids_t = torch.stack(
            tuple(binding.page_id_t.detach().cpu().long().reshape(()) for binding in imported.page_objects)
        )
        local_object_mask_t = object_page_ids_t.unsqueeze(1).eq(
            catalog_ids_t.unsqueeze(0)
        ).any(dim=1)
        local_page_ids_t = object_page_ids_t.masked_select(local_object_mask_t)
        if local_page_ids_t.numel() == 0:
            return local_page_ids_t
        if torch.unique(local_page_ids_t).numel() != local_page_ids_t.numel():
            raise RuntimeError("NoNE imported candidate repeats a page")
        if any(
            int(page_id) in self._candidate_updated_page_ids
            for page_id in local_page_ids_t
        ):
            raise RuntimeError("NoNE imported candidate overlaps a local update")

        proof = imported.training_proof
        proof_page_ids_t = proof.family_page_ids_t.detach().cpu().long()
        proof_matches_t = local_page_ids_t.unsqueeze(1).eq(
            proof_page_ids_t.unsqueeze(0)
        )
        if not proof_matches_t.sum(dim=1).eq(1).all():
            raise RuntimeError("NoNE imported candidate proof IDs differ")
        proof_indexes_t = proof_matches_t.to(dtype=torch.long).argmax(dim=1)
        catalog_matches_t = local_page_ids_t.unsqueeze(1).eq(
            catalog_ids_t.unsqueeze(0)
        )
        if not catalog_matches_t.sum(dim=1).eq(1).all():
            raise RuntimeError("NoNE imported candidate catalog IDs differ")
        catalog_indexes_t = catalog_matches_t.to(dtype=torch.long).argmax(dim=1)

        local_bindings = tuple(
            binding
            for binding, local_t in zip(
                imported.page_objects,
                local_object_mask_t,
                strict=True,
            )
            if bool(local_t)
        )
        for binding in local_bindings:
            store._page_object_row_boundary(binding)
            page_id = int(binding.page_id_t.detach().cpu().long().reshape(()))
            self._candidate_page_objects[page_id] = binding
            self._candidate_updated_page_ids.add(page_id)
            self._candidate_imported_page_ids.add(page_id)

        device_indexes_t = catalog_indexes_t.to(
            device=self.candidate_route_count_t.device,
            dtype=torch.long,
        )
        proof_indexes_by_device_t = proof_indexes_t.to(
            device=proof.route_count_t.device,
            dtype=torch.long,
        )
        with torch.no_grad():
            self.candidate_route_count_t.index_add_(
                0,
                device_indexes_t,
                proof.route_count_t.index_select(
                    0,
                    proof_indexes_by_device_t,
                ).to(device=self.candidate_route_count_t.device, dtype=torch.long),
            )
            self.candidate_gradient_update_count_t.index_add_(
                0,
                device_indexes_t,
                proof.gradient_update_count_t.index_select(
                    0,
                    proof_indexes_t.to(
                        device=proof.gradient_update_count_t.device,
                        dtype=torch.long,
                    ),
                ).to(
                    device=self.candidate_gradient_update_count_t.device,
                    dtype=torch.long,
                ),
            )
            self.candidate_gradient_norm_t.index_add_(
                0,
                device_indexes_t,
                proof.gradient_norm_t.index_select(
                    0,
                    proof_indexes_t.to(
                        device=proof.gradient_norm_t.device,
                        dtype=torch.long,
                    ),
                ).to(device=self.candidate_gradient_norm_t.device, dtype=torch.float32),
            )
            self.candidate_parameter_delta_norm_t.index_add_(
                0,
                device_indexes_t,
                proof.parameter_delta_norm_t.index_select(
                    0,
                    proof_indexes_t.to(
                        device=proof.parameter_delta_norm_t.device,
                        dtype=torch.long,
                    ),
                ).to(
                    device=self.candidate_parameter_delta_norm_t.device,
                    dtype=torch.float32,
                ),
            )
            self.candidate_gradient_signature_t.index_add_(
                0,
                device_indexes_t,
                proof.gradient_signature_t.index_select(
                    0,
                    proof_indexes_t.to(
                        device=proof.gradient_signature_t.device,
                        dtype=torch.long,
                    ),
                ).to(
                    device=self.candidate_gradient_signature_t.device,
                    dtype=torch.float32,
                ),
            )
            object_bytes_t = torch.stack(
                tuple(
                    binding.object_bytes_t.detach().reshape(())
                    for binding in local_bindings
                )
            ).to(
                device=self.candidate_external_object_bytes_by_page_t.device,
                dtype=torch.long,
            )
            self.candidate_external_object_bytes_by_page_t.index_copy_(
                0,
                device_indexes_t,
                object_bytes_t,
            )
            self.candidate_page_update_count_t.add_(
                proof.promotion_ready_t.to(
                    device=self.candidate_page_update_count_t.device,
                    dtype=torch.long,
                ).reshape(())
            )
            self.candidate_page_state_revision_t.add_(
                torch.ones_like(self.candidate_page_state_revision_t)
            )
        return local_page_ids_t

    def _accepted_inference_weights_for_request_boundary(
        self,
        request: NoNEPageRequestPacket,
        *,
        device: torch.device,
        dtype: torch.dtype,
    ) -> NoNEPageWeights:
        """Materialize one exact immutable accepted residency wave."""

        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        generation_t = request.generation_t.detach().cpu().reshape(()).long()
        identity_changed = (
            self._accepted_inference_generation_t is None
            or not torch.equal(
                self._accepted_inference_generation_t,
                generation_t,
            )
            or self._accepted_inference_device != device
            or self._accepted_inference_dtype != dtype
        )
        if identity_changed:
            self._clear_accepted_inference_boundary()
            self._accepted_inference_generation_t = generation_t.clone()
            self._accepted_inference_device = device
            self._accepted_inference_dtype = dtype

        requested_ids = self._page_ids_external_tuple_boundary(
            request.unique_page_ids_t
        )
        if not requested_ids:
            raise RuntimeError("NoNE accepted inference residency wave is empty")
        if len(requested_ids) > self.training_residency_wave_pages:
            raise RuntimeError(
                "NoNE accepted inference residency exceeds physical wave capacity"
            )
        direct_wave = len(requested_ids) > 1
        if direct_wave and torch.is_grad_enabled():
            raise RuntimeError(
                "NoNE accepted inference multi-page wave requires detached execution"
            )
        if direct_wave:
            # A detached generation wave is consumed exactly once, then
            # dehydrated. Materialize its already-selected rows as one ordered
            # tensor bundle instead of cloning each complete page through a
            # singleton GPU cache. This changes only physical residency: request
            # page identity, ordering, probabilities, and active pairs remain
            # model-owned and exact.
            self._accepted_inference_pages.clear()
            self._accepted_inference_compositions.clear()
            self.last_weights = None
            with torch.no_grad():
                self.accepted_residency_page_mask_t.zero_()
            missing = requested_ids
        else:
            if (
                not self._accepted_inference_pages
                and not self._accepted_inference_compositions
            ):
                # A singleton tail can follow a transient direct wave on CPU.
                # Its predecessor is no longer retained once ``last_weights``
                # is replaced, so reset residency before admitting this page.
                with torch.no_grad():
                    self.accepted_residency_page_mask_t.zero_()
            missing = tuple(
                page_id
                for page_id in requested_ids
                if page_id not in self._accepted_inference_pages
            )
        # Reserve residency before enqueueing a new device copy.  Trimming
        # only after the transfer transiently held ``capacity + 1`` complete
        # page matrices and could OOM even though the settled cache was
        # nominally bounded.
        if not direct_wave:
            self._trim_accepted_inference_cache_boundary(requested_ids)
        loaded_catalog_mask_t = torch.zeros_like(self.accepted_residency_page_mask_t)
        direct_weights: NoNEPageWeights | None = None
        if missing:
            missing_page_ids_t = request.unique_page_ids_t.new_tensor(
                missing,
                dtype=torch.long,
            )
            accepted = store.materialize_page_ids_boundary(
                session_id_t=request.session_id_t,
                generation_t=request.generation_t,
                page_ids_t=missing_page_ids_t,
                device=device,
                dtype=dtype,
                trainable=False,
            )
            if direct_wave:
                direct_weights = accepted
            else:
                # ``materialize_page_ids_boundary`` has returned this exact
                # one-page immutable wave in executor precision. Cache that
                # object directly: slicing it through ``_page_weights_row``
                # cloned every complete CUDA matrix and transiently exceeded
                # the physical residency bound by one page.
                page_id = missing[0]
                if page_id not in self._accepted_inference_pages:
                    self._accepted_inference_pages[page_id] = accepted
            loaded_catalog_mask_t = (
                self.router.page_catalog_ids_t.unsqueeze(1)
                .eq(
                    missing_page_ids_t.to(
                        device=self.router.page_catalog_ids_t.device,
                        dtype=torch.long,
                    ).unsqueeze(0)
                )
                .any(dim=1)
            )
            _tensor_assert(
                loaded_catalog_mask_t.to(dtype=torch.long)
                .sum()
                .eq(
                    torch.ones_like(
                        missing_page_ids_t,
                        dtype=torch.long,
                    ).sum()
                ),
                "NoNE residency telemetry lost a model-selected page",
            )

        requested_page_count_t = torch.ones_like(
            request.unique_page_ids_t,
            dtype=torch.long,
        ).sum()
        missing_page_count_t = loaded_catalog_mask_t.to(dtype=torch.long).sum()
        with torch.no_grad():
            self.accepted_residency_generation_t.copy_(
                request.generation_t.to(
                    device=self.accepted_residency_generation_t.device,
                    dtype=torch.long,
                ).reshape(())
            )
            self.accepted_residency_request_count_t.add_(
                torch.ones_like(self.accepted_residency_request_count_t)
            )
            self.accepted_residency_hit_page_count_t.add_(
                (requested_page_count_t - missing_page_count_t).to(
                    device=self.accepted_residency_hit_page_count_t.device,
                    dtype=torch.long,
                )
            )
            self.accepted_residency_miss_page_count_t.add_(
                missing_page_count_t.to(
                    device=self.accepted_residency_miss_page_count_t.device,
                    dtype=torch.long,
                )
            )
            self.accepted_residency_page_mask_t.logical_or_(
                loaded_catalog_mask_t.to(
                    device=self.accepted_residency_page_mask_t.device,
                    dtype=torch.bool,
                )
            )

        if direct_wave:
            if direct_weights is None:
                raise RuntimeError(
                    "NoNE accepted inference direct wave was not materialized"
                )
            weights = direct_weights
            expected_page_ids_t = request.unique_page_ids_t.to(
                device=weights.page_ids_t.device,
                dtype=torch.long,
            )
            if weights.page_ids_t.shape != expected_page_ids_t.shape:
                raise RuntimeError(
                    "NoNE accepted direct wave changed the model page route"
                )
            torch._assert_async(
                weights.page_ids_t.eq(expected_page_ids_t).all(),
                "NoNE accepted direct wave changed the model page route",
            )
            return weights

        # Dict insertion order is the external residency recency index. Touch
        # every model-routed page before eviction; this affects residency only
        # and never changes the model-owned route or frontier weights.
        for page_id in requested_ids:
            cached_page = self._accepted_inference_pages.pop(page_id)
            self._accepted_inference_pages[page_id] = cached_page
        cached_weights = (
            self._accepted_inference_compositions.pop(requested_ids)
            if requested_ids in self._accepted_inference_compositions
            else None
        )
        if cached_weights is None:
            cached_weights = self._accepted_inference_pages[requested_ids[0]]
        weights = cached_weights
        # One exact current-route composition is sufficient. Page rows remain
        # in the bounded LRU; accepted inference never concatenates multiple
        # full page matrices on the accelerator.
        self._accepted_inference_compositions.clear()
        self._accepted_inference_compositions[requested_ids] = weights
        expected_page_ids_t = request.unique_page_ids_t.to(
            device=weights.page_ids_t.device,
            dtype=torch.long,
        )
        if weights.page_ids_t.shape != expected_page_ids_t.shape:
            raise RuntimeError(
                "NoNE accepted residency cache changed the model page route"
            )
        torch._assert_async(
            weights.page_ids_t.eq(expected_page_ids_t).all(),
            "NoNE accepted residency cache changed the model page route",
        )
        self._trim_accepted_inference_cache_boundary(requested_ids)
        return weights

    def _trim_accepted_inference_cache_boundary(
        self,
        requested_ids: tuple[int, ...],
    ) -> None:
        """Bound GPU residency without changing the current model-owned route."""

        protected = set(requested_ids)
        incoming_page_count = sum(
            page_id not in self._accepted_inference_pages
            for page_id in requested_ids
        )
        projected_resident_count = (
            len(self._accepted_inference_pages) + incoming_page_count
        )
        evicted: list[int] = []
        for page_id in tuple(self._accepted_inference_pages):
            if projected_resident_count <= self.accepted_inference_cache_entries:
                break
            if page_id in protected:
                continue
            self._accepted_inference_pages.pop(page_id)
            evicted.append(page_id)
            projected_resident_count -= 1
        if evicted:
            evicted_ids_t = self.router.page_catalog_ids_t.new_tensor(
                evicted,
                dtype=torch.long,
            )
            evicted_mask_t = (
                self.router.page_catalog_ids_t.unsqueeze(1)
                .eq(evicted_ids_t.unsqueeze(0))
                .any(dim=1)
            )
            with torch.no_grad():
                self.accepted_residency_page_mask_t.logical_and_(
                    ~evicted_mask_t.to(
                        device=self.accepted_residency_page_mask_t.device,
                        dtype=torch.bool,
                    )
                )
            self._accepted_inference_compositions.clear()

    @staticmethod
    def _accepted_inference_wave_request_boundary(
        request: NoNEPageRequestPacket,
        *,
        page_position: int,
        active_batch_index_t: torch.Tensor,
    ) -> NoNEPageRequestPacket:
        """Project one complete model route into one exact residency wave.

        This boundary never renormalizes or reranks the route.  It slices one
        original frontier column and only the batch rows for which that page
        has positive model-owned mass.
        """

        wave_frontier_weight_t = request.frontier_weight_t.index_select(
            0,
            active_batch_index_t,
        ).narrow(1, page_position, 1)
        torch._assert_async(
            wave_frontier_weight_t.gt(0).all(),
            "NoNE accepted inference wave lost routed probability",
        )
        wave_page_id_t = request.unique_page_ids_t.narrow(
            0,
            page_position,
            1,
        )
        wave_batch_size = active_batch_index_t.shape[0]
        wave_pair_batch_index_t = torch.arange(
            wave_batch_size,
            device=active_batch_index_t.device,
            dtype=torch.long,
        )
        wave_pair_page_index_t = torch.zeros_like(wave_pair_batch_index_t)
        return NoNEPageRequestPacket(
            session_id_t=request.session_id_t,
            generation_t=request.generation_t,
            layer_id_t=request.layer_id_t,
            page_ids_t=wave_page_id_t.expand(wave_batch_size),
            unique_page_ids_t=wave_page_id_t,
            unique_page_catalog_positions_t=(
                request.unique_page_catalog_positions_t.narrow(
                    0,
                    page_position,
                    1,
                )
            ),
            page_position_t=torch.zeros_like(active_batch_index_t),
            route_probability_t=wave_frontier_weight_t.squeeze(1),
            route_entropy_t=request.route_entropy_t.index_select(
                0,
                active_batch_index_t,
            ),
            frontier_weight_t=wave_frontier_weight_t,
            active_pair_index_t=torch.stack(
                (
                    wave_pair_batch_index_t,
                    wave_pair_page_index_t,
                ),
                dim=1,
            ),
        )

    @staticmethod
    def _training_residency_wave_request_boundary(
        request: NoNEPageRequestPacket,
        *,
        page_positions_t: torch.Tensor,
    ) -> NoNEPageResidencyWavePacket:
        """Project one active hardware wave from the complete model route.

        The original probabilities are neither renormalized nor reranked.
        Batch rows with no mass in this physical wave are omitted from its
        executor call and restored by the caller's differentiable index-add.
        """

        if (
            page_positions_t.ndim != 1
            or page_positions_t.dtype != torch.long
            or page_positions_t.device
            != request.unique_page_ids_t.device
        ):
            raise ValueError(
                "NoNE training residency wave positions are invalid"
            )
        if page_positions_t.shape[0] < 1:
            raise ValueError("NoNE training residency wave is empty")
        _tensor_assert(
            page_positions_t.ge(0).all(),
            "NoNE training residency wave position is negative",
        )
        _tensor_assert(
            page_positions_t.lt(request.unique_page_ids_t.shape[0]).all(),
            "NoNE training residency wave position is outside the route",
        )
        if page_positions_t.shape[0] > 1:
            _tensor_assert(
                page_positions_t[1:].gt(page_positions_t[:-1]).all(),
                "NoNE training residency wave positions are not ascending",
            )
        wave_frontier_active_t = request.frontier_weight_t.index_select(
            1,
            page_positions_t,
        )
        _tensor_assert(
            wave_frontier_active_t.gt(0).any(dim=0).all(),
            "NoNE training residency wave contains an inactive page",
        )
        active_batch_index_t = torch.nonzero(
            wave_frontier_active_t.gt(0).any(dim=1),
            as_tuple=False,
        ).reshape(-1)
        if active_batch_index_t.shape[0] < 1:
            raise RuntimeError(
                "NoNE training residency wave is outside the active frontier"
            )
        wave_frontier_weight_t = wave_frontier_active_t.index_select(
            0,
            active_batch_index_t,
        )
        wave_page_ids_t = request.unique_page_ids_t.index_select(
            0,
            page_positions_t,
        )
        wave_catalog_positions_t = (
            request.unique_page_catalog_positions_t.index_select(
                0,
                page_positions_t,
            )
        )
        wave_primary_position_t = wave_frontier_weight_t.argmax(dim=-1)
        wave_route_probability_t = wave_frontier_weight_t.gather(
            1,
            wave_primary_position_t.unsqueeze(1),
        ).squeeze(1)
        wave_request = NoNEPageRequestPacket(
            session_id_t=request.session_id_t,
            generation_t=request.generation_t,
            layer_id_t=request.layer_id_t,
            page_ids_t=wave_page_ids_t.index_select(
                0,
                wave_primary_position_t,
            ),
            unique_page_ids_t=wave_page_ids_t,
            unique_page_catalog_positions_t=wave_catalog_positions_t,
            page_position_t=wave_primary_position_t,
            route_probability_t=wave_route_probability_t,
            route_entropy_t=request.route_entropy_t.index_select(
                0,
                active_batch_index_t,
            ),
            frontier_weight_t=wave_frontier_weight_t,
            active_pair_index_t=_frontier_active_pair_index(
                wave_frontier_weight_t
            ),
        )
        return NoNEPageResidencyWavePacket(
            request=wave_request,
            active_batch_index_t=active_batch_index_t,
        )

    def _assert_candidate_rematerialization_authority_boundary(
        self,
        *,
        candidate_generation_t: torch.Tensor,
        candidate_state_revision_t: torch.Tensor,
    ) -> None:
        """Fence backward replay to the exact proposal page state."""

        store = self._store_boundary
        if (
            store is None
            or not self._candidate_window_open
            or not bool(self.candidate_window_active_t)
        ):
            raise RuntimeError(
                "NoNE candidate rematerialization has no active window"
            )
        expected_generation_t = self.candidate_base_generation_t.detach().cpu().long()
        expected_revision_t = (
            self.candidate_page_state_revision_t.detach().cpu().long()
        )
        if (
            not torch.equal(
                candidate_generation_t.detach().cpu().long(),
                expected_generation_t,
            )
            or not torch.equal(
                candidate_state_revision_t.detach().cpu().long(),
                expected_revision_t,
            )
            or not torch.equal(
                store.accepted_generation_t().detach().cpu().long(),
                expected_generation_t,
            )
        ):
            raise RuntimeError(
                "NoNE candidate page state changed during rematerialization"
            )

    def _record_candidate_training_request_boundary(
        self,
        request: NoNEPageRequestPacket,
    ) -> None:
        """Record gradient ownership without retaining routed page matrices."""

        self._assert_candidate_rematerialization_authority_boundary(
            candidate_generation_t=self.candidate_base_generation_t,
            candidate_state_revision_t=self.candidate_page_state_revision_t,
        )
        catalog_positions_t = request.unique_page_catalog_positions_t.to(
            device=self.router.page_catalog_ids_t.device,
            dtype=torch.long,
        )
        if catalog_positions_t.shape != request.unique_page_ids_t.shape:
            raise RuntimeError(
                "NoNE candidate rematerialization catalog geometry differs"
            )
        torch._assert_async(
            self.router.page_catalog_ids_t.index_select(
                0,
                catalog_positions_t,
            ).eq(
                request.unique_page_ids_t.to(
                    device=self.router.page_catalog_ids_t.device,
                    dtype=torch.long,
                )
            ).all(),
            "NoNE candidate rematerialization changed the model route",
        )
        cohort_requested_ids = self._page_ids_external_tuple_boundary(
            request.unique_page_ids_t
        )
        if self._training_route_cohort_open:
            cached_positions_t = self._training_route_cohort_catalog_positions_t
            if cached_positions_t is None:
                self._training_route_cohort_page_ids = cohort_requested_ids
                self._training_route_cohort_catalog_positions_t = (
                    catalog_positions_t.detach().clone()
                )
            else:
                if cached_positions_t.shape != catalog_positions_t.shape:
                    raise RuntimeError(
                        "NoNE training route cohort catalog geometry changed"
                    )
                torch._assert_async(
                    cached_positions_t.eq(catalog_positions_t).all(),
                    "NoNE training route cohort changed its model-owned page set",
                )
        active_page_position_mask_t = (
            request.frontier_weight_t.detach().gt(0).any(dim=0)
        )
        active_catalog_positions_t = catalog_positions_t.masked_select(
            active_page_position_mask_t.to(
                device=catalog_positions_t.device,
                dtype=torch.bool,
            )
        )
        active_page_ids_t = request.unique_page_ids_t.masked_select(
            active_page_position_mask_t.to(
                device=request.unique_page_ids_t.device,
                dtype=torch.bool,
            )
        )
        active_requested_ids = self._page_ids_external_tuple_boundary(
            active_page_ids_t
        )
        for page_id in active_requested_ids:
            self._resolve_candidate_page_stage_boundary(page_id)
            if (
                page_id in self._training_eligible_page_ids
                and page_id not in self._candidate_imported_page_ids
            ):
                self._candidate_gradient_page_ids.add(page_id)
        requested_catalog_mask_t = torch.zeros_like(
            self.candidate_active_trainable_page_mask_t,
            device=self.router.page_catalog_ids_t.device,
        ).scatter(
            0,
            active_catalog_positions_t,
            torch.ones_like(active_catalog_positions_t, dtype=torch.bool),
        )
        imported_mask_t = (
            self.router.page_catalog_ids_t.unsqueeze(1)
            .eq(
                self.router.page_catalog_ids_t.new_tensor(
                    tuple(sorted(self._candidate_imported_page_ids)),
                    dtype=torch.long,
                ).unsqueeze(0)
            )
            .any(dim=1)
            if self._candidate_imported_page_ids
            else torch.zeros_like(requested_catalog_mask_t)
        )
        with torch.no_grad():
            self.candidate_active_trainable_page_mask_t.logical_or_(
                (
                    requested_catalog_mask_t
                    & self.training_eligible_page_mask_t
                    & ~imported_mask_t
                ).to(
                    device=self.candidate_active_trainable_page_mask_t.device,
                    dtype=torch.bool,
                )
            )

    def _execute_candidate_rematerialized_forward_boundary(
        self,
        hidden_t: torch.Tensor,
        request: NoNEPageRequestPacket,
    ) -> torch.Tensor:
        """Execute every model-selected page without retaining page weights."""

        active_page_position_t = torch.nonzero(
            request.frontier_weight_t.detach().gt(0).any(dim=0),
            as_tuple=False,
        ).reshape(-1)
        active_page_count = active_page_position_t.shape[0]
        if active_page_count < 1:
            raise RuntimeError("NoNE candidate training route is empty")
        accumulated_output_t = torch.zeros_like(hidden_t)
        for wave_start in range(
            0,
            active_page_count,
            self.training_residency_wave_pages,
        ):
            wave_page_count = min(
                self.training_residency_wave_pages,
                active_page_count - wave_start,
            )
            wave = self._training_residency_wave_request_boundary(
                request,
                page_positions_t=active_page_position_t.narrow(
                    0,
                    wave_start,
                    wave_page_count,
                ),
            )
            wave_weights = (
                self._candidate_rematerialized_weights_for_request_boundary(
                    wave.request,
                    device=hidden_t.device,
                    dtype=self.executor.memory_projection.weight.dtype,
                    trainable=False,
                )
            )
            wave_output_t = self.executor(
                hidden_t.index_select(
                    0,
                    wave.active_batch_index_t,
                ),
                wave.request,
                wave_weights,
            )
            accumulated_output_t = accumulated_output_t.index_add(
                0,
                wave.active_batch_index_t,
                wave_output_t,
            )
            del wave_weights, wave_output_t
            with torch.no_grad():
                self.candidate_device_residency_mask_t.zero_()
        return accumulated_output_t

    def _execute_candidate_training_request_boundary(
        self,
        hidden_t: torch.Tensor,
        request: NoNEPageRequestPacket,
    ) -> torch.Tensor:
        """Execute one complete route through host- and device-bounded replay."""

        if not torch.is_grad_enabled():
            self.last_bundle = None
            self.last_weights = None
            return self._execute_candidate_rematerialized_forward_boundary(
                hidden_t,
                request,
            )
        self._record_candidate_training_request_boundary(request)
        self.last_bundle = None
        self.last_weights = None
        # The custom Function saves only a CPU copy, then rematerializes the
        # hidden-state adjoint with bounded page waves during backward.
        reservation = self._reserve_candidate_vjp_trace_boundary(request)
        page_backward_anchor_t = hidden_t.new_zeros((), requires_grad=True)
        return cast(
            torch.Tensor,
            _NoNECandidateRouteRematerializeFunction.apply(  # type: ignore[no-untyped-call]
                hidden_t,
                page_backward_anchor_t,
                request.frontier_weight_t,
                self.executor.memory_projection.weight,
                self.executor.memory_gate,
                self,
                request,
                self.candidate_base_generation_t.detach().clone(),
                self.candidate_page_state_revision_t.detach().clone(),
                reservation,
            ),
        )

    def _execute_accepted_inference_request_boundary(
        self,
        hidden_t: torch.Tensor,
        request: NoNEPageRequestPacket,
    ) -> torch.Tensor:
        """Execute every accepted routed page once in bounded residency waves."""

        unique_page_count = request.unique_page_ids_t.shape[0]
        if unique_page_count < 1:
            raise RuntimeError("NoNE accepted inference route is empty")
        self.last_weights = None
        if not torch.is_grad_enabled() and unique_page_count > 1:
            # Accumulate independently executed residency waves before the
            # final reduced-precision cast.  Otherwise every wave rounds to
            # BF16/FP16 separately and physical wave width changes the
            # parenthesization error even though the model route is identical.
            accumulation_dtype = (
                torch.float32
                if hidden_t.dtype in (torch.bfloat16, torch.float16)
                else hidden_t.dtype
            )
            execution_hidden_t = hidden_t.to(dtype=accumulation_dtype)
            accumulated_output_t = torch.zeros_like(execution_hidden_t)
            active_page_position_t = torch.nonzero(
                request.frontier_weight_t.detach().gt(0).any(dim=0),
                as_tuple=False,
            ).reshape(-1)
            if active_page_position_t.shape[0] != unique_page_count:
                raise RuntimeError(
                    "NoNE accepted inference route contains an inactive page"
                )
            for wave_start in range(
                0,
                unique_page_count,
                self.training_residency_wave_pages,
            ):
                wave_page_count = min(
                    self.training_residency_wave_pages,
                    unique_page_count - wave_start,
                )
                wave = self._training_residency_wave_request_boundary(
                    request,
                    page_positions_t=active_page_position_t.narrow(
                        0,
                        wave_start,
                        wave_page_count,
                    ),
                )
                wave_weights = (
                    self._accepted_inference_weights_for_request_boundary(
                        wave.request,
                        device=hidden_t.device,
                        dtype=self.executor.memory_projection.weight.dtype,
                    )
                )
                wave_output_t = self.executor(
                    execution_hidden_t.index_select(
                        0,
                        wave.active_batch_index_t,
                    ),
                    wave.request,
                    wave_weights,
                )
                accumulated_output_t = accumulated_output_t.index_add(
                    0,
                    wave.active_batch_index_t,
                    wave_output_t,
                )
                self.last_weights = wave_weights
                self.dehydrate_accepted_inference_cuda_boundary()
                del wave_weights, wave_output_t
            return accumulated_output_t.to(dtype=hidden_t.dtype)
        accumulated_output_t = torch.zeros_like(hidden_t)
        for page_position in range(unique_page_count):
            original_probability_t = request.frontier_weight_t[
                :,
                page_position,
            ]
            active_batch_index_t = torch.nonzero(
                original_probability_t.gt(0),
                as_tuple=False,
            ).reshape(-1)
            if active_batch_index_t.shape[0] < 1:
                raise RuntimeError(
                    "NoNE accepted inference page is outside the active frontier"
                )
            wave_request = self._accepted_inference_wave_request_boundary(
                request,
                page_position=page_position,
                active_batch_index_t=active_batch_index_t,
            )
            wave_weights = (
                self._accepted_inference_weights_for_request_boundary(
                    wave_request,
                    device=hidden_t.device,
                    dtype=self.executor.memory_projection.weight.dtype,
                )
            )
            wave_output_t = self.executor(
                hidden_t.index_select(0, active_batch_index_t),
                wave_request,
                wave_weights,
            )
            accumulated_output_t = accumulated_output_t.index_add(
                0,
                active_batch_index_t,
                wave_output_t,
            )
            # A multi-page route intentionally retains only its last bounded
            # wave here. ``last_request`` below remains the complete route
            # proof, including every page and original frontier probability.
            self.last_weights = wave_weights
            if not torch.is_grad_enabled():
                self.dehydrate_accepted_inference_cuda_boundary()
                del wave_weights
        return accumulated_output_t

    def begin_training_route_cohort_boundary(
        self,
        observed_generation_t: torch.Tensor | None = None,
    ) -> torch.Tensor:
        """Begin one tensor-owned page-route cohort for this layer runtime."""

        if not self._candidate_window_open:
            raise RuntimeError(
                "NoNE training route cohort has no candidate window"
            )
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        # The candidate window seals one accepted generation for the complete
        # route cohort. Fence the external pointer once here, before any wave
        # enters the model, instead of copying the CPU store generation to CUDA
        # in every layer of every wave.
        if observed_generation_t is None:
            observed_generation_t = store.accepted_generation_t().to(
                device=self.candidate_base_generation_t.device,
                dtype=torch.long,
            )
        elif (
            observed_generation_t.numel() != 1
            or observed_generation_t.device
            != self.candidate_base_generation_t.device
            or observed_generation_t.dtype != torch.long
        ):
            raise RuntimeError(
                "NoNE shared accepted-generation fence geometry differs"
            )
        _tensor_assert(
            observed_generation_t.reshape(())
            == self.candidate_base_generation_t,
            "NoNE accepted pointer changed during candidate training",
        )
        active_t = self.router.begin_training_route_cohort_boundary()
        self._training_route_cohort_open = True
        self._training_route_cohort_page_ids = None
        self._training_route_cohort_catalog_positions_t = None
        return active_t

    def end_training_route_cohort_boundary(self) -> torch.Tensor:
        """End the layer cohort after its page-local optimizer update."""

        if not self._candidate_window_open:
            raise RuntimeError(
                "NoNE training route cohort has no candidate window"
            )
        selected_count_t = self.router.end_training_route_cohort_boundary()
        self._training_route_cohort_open = False
        self._training_route_cohort_page_ids = None
        self._training_route_cohort_catalog_positions_t = None
        with torch.no_grad():
            self.candidate_active_trainable_page_mask_t.zero_()
        return selected_count_t

    def abort_training_route_cohort_boundary(self) -> torch.Tensor:
        """Reset a partially opened layer cohort after a transactional error."""

        with torch.no_grad():
            self.candidate_active_trainable_page_mask_t.zero_()
        self._training_route_cohort_open = False
        self._training_route_cohort_page_ids = None
        self._training_route_cohort_catalog_positions_t = None
        return self.router.abort_training_route_cohort_boundary()

    @_disable_compilation_boundary
    def forward(
        self,
        hidden_t: torch.Tensor,
        action_t: torch.Tensor,
        pathway_t: torch.Tensor,
    ) -> NoNEPageForwardPacket:
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        if self._candidate_window_open:
            generation_t = self.candidate_base_generation_t.to(
                device=hidden_t.device,
                dtype=torch.long,
            )
        else:
            generation_t = store.accepted_generation_t().to(
                device=hidden_t.device,
                dtype=torch.long,
            )
        route_count_t: torch.Tensor | None = None
        if self.training and torch.is_grad_enabled():
            # Training frontier pressure follows committed page learning, not
            # no-grad/pre-update route observations. The router's tensor-owned
            # cohort mask holds one learned route across its complete minibatch;
            # after that cohort updates, cumulative candidate counts expose the
            # next least-trained eligible pages. This advances full branch
            # coverage without a host-authored page order.
            gradient_update_count_t = (
                self.accepted_gradient_update_count_t
                + self.candidate_gradient_update_count_t
            )
            route_attempt_count_t = (
                self.accepted_route_count_t
                + self.candidate_route_count_t
            )
            outside_scope_rank_t = torch.full_like(
                gradient_update_count_t,
                torch.iinfo(torch.long).max,
            )
            route_count_t = torch.stack(
                (
                    torch.where(
                        self.training_eligible_page_mask_t,
                        gradient_update_count_t,
                        outside_scope_rank_t,
                    ),
                    torch.where(
                        self.training_eligible_page_mask_t,
                        route_attempt_count_t,
                        outside_scope_rank_t,
                    ),
                )
            )
        request = self.router(
            hidden_t,
            action_t,
            pathway_t,
            generation_t,
            route_count_t=route_count_t,
            training_eligible_mask_t=(
                self.training_eligible_page_mask_t
                if self.training and torch.is_grad_enabled()
                else None
            ),
        )
        if self.training and torch.is_grad_enabled():
            with torch.no_grad():
                self.gradient_page_forward_count_t.add_(
                    torch.ones_like(self.gradient_page_forward_count_t)
                )
        weights: NoNEPageWeights | None = None
        page_output_t: torch.Tensor | None = None
        if self._candidate_window_open:
            with torch.no_grad():
                candidate_route_count_t = self.candidate_route_count_t
                if candidate_route_count_t is None:
                    raise RuntimeError("NoNE candidate route counter is absent")
                selected_count_t = (
                    request.frontier_weight_t.detach()
                    .gt(0)
                    .sum(dim=0)
                    .to(
                        device=candidate_route_count_t.device,
                        dtype=torch.long,
                    )
                )
                candidate_route_count_t.index_add_(
                    0,
                    request.unique_page_catalog_positions_t.to(
                        device=candidate_route_count_t.device,
                        dtype=torch.long,
                    ),
                    selected_count_t.to(
                        device=candidate_route_count_t.device,
                        dtype=torch.long,
                    ),
                )
            if request.unique_page_ids_t.shape[0] == 0:
                # A disjoint branch can legitimately own no page selected by
                # one model-routed layer wave. Empty ownership is a tensor
                # no-op for that layer, not authority to invent a fallback
                # page or concatenate a host-selected bundle.
                self.last_request = request
                self.last_weights = None
                self.last_bundle = None
                return NoNEPageForwardPacket(
                    output_t=hidden_t.new_zeros(hidden_t.shape),
                    page_ids_t=request.page_ids_t,
                    route_probability_t=request.route_probability_t,
                    route_entropy_t=request.route_entropy_t,
                    generation_t=request.generation_t,
                )
            if (
                not torch.is_grad_enabled()
                and not self._candidate_page_journal
                and not self._candidate_page_objects
                and not self._candidate_page_scratch
                and not self._candidate_page_stage_futures
            ):
                # Pre-update grading reads the accepted generation only. Reuse
                # the bounded generation-aware inference cache instead of
                # loading page-local optimizer tensors and concatenating the
                # same routed rows once per emitted token. Proposal-local
                # journal, scratch, or imported objects take this branch out
                # of play immediately, so post-update grading observes the
                # exact candidate bytes before any durable write.
                page_output_t = (
                    self._execute_accepted_inference_request_boundary(
                        hidden_t,
                        request,
                    )
                )
                self.last_bundle = None
            else:
                page_output_t = self._execute_candidate_training_request_boundary(
                    hidden_t,
                    request,
                )
        elif self.training and torch.is_grad_enabled():
            # Module training mode spans the full learn-loop transaction, but
            # pre/post knowledge grading runs under no-grad. Only a real
            # gradient-bearing update needs mutable page-local optimizer state;
            # no-grad grading may reuse the immutable generation-bound rows.
            loaded_bundle = store.materialize_bundle(
                request,
                device=hidden_t.device,
                dtype=hidden_t.dtype,
                trainable=False,
            )
            loaded_page_ids = loaded_bundle.weights.page_ids_t.detach().cpu().long()
            loaded_rows = tuple(
                _page_bundle_row(
                    loaded_bundle,
                    row_index,
                    trainable=(int(page_id) in self._training_eligible_page_ids),
                )
                for row_index, page_id in enumerate(loaded_page_ids.tolist())
            )
            bundle = (
                loaded_rows[0]
                if len(loaded_rows) == 1
                else concatenate_page_bundles(loaded_rows)
            )
            if len(loaded_rows) > 1:
                for parameter_t in _page_parameter_tensors(bundle.weights):
                    if parameter_t.requires_grad:
                        parameter_t.retain_grad()
            weights = bundle.weights
            self.last_bundle = bundle
        else:
            # The cache owns immutable page tensors in the executor's native
            # precision. Hidden/control precision may vary between science
            # phases; it must not force filesystem rematerialization.
            page_output_t = self._execute_accepted_inference_request_boundary(
                hidden_t,
                request,
            )
            self.last_bundle = None
        # Page-weight gradients need only the local executor inputs. When the
        # upstream hidden graph is retained solely for frozen parent/dense
        # experts, detach here so the [batch, pages, seq, width] page tape
        # does not also keep the full decoder activation history alive.
        if page_output_t is None:
            if weights is None:
                raise RuntimeError("NoNE page execution weights are absent")
            executor_hidden_t = (
                hidden_t.detach()
                if self.training and torch.is_grad_enabled()
                else hidden_t
            )
            page_output_t = self.executor(executor_hidden_t, request, weights)
        # Frontier weights already form the model-owned probability simplex.
        # Applying primary-page probability again suppresses valid multi-page
        # composition and double-counts routing confidence.
        route_scale_t = torch.tanh(self.residual_scale)
        output_t = route_scale_t * page_output_t
        if self.training and torch.is_grad_enabled():
            # Additive page banks intentionally initialize behind a zero output
            # gate. Preserve that exact forward value while allowing the
            # physical page weights to learn on the first candidate instead of
            # deadlocking at zero gradient and rolling the gate back forever.
            output_t = output_t + (1.0 - route_scale_t).detach() * (
                page_output_t - page_output_t.detach()
            )
        self.last_request = request
        if weights is not None:
            self.last_weights = weights
        if self._candidate_window_open and not torch.is_grad_enabled():
            # The durable candidate object remains the source of truth and the
            # current trace retains ``last_weights``. Do not also retain every
            # post-update grading route in the mutable accelerator cache.
            self._candidate_pages.clear()
            self._candidate_forward_weights.clear()
            self._candidate_forward_wave_bindings.clear()
            with torch.no_grad():
                self.candidate_device_residency_mask_t.zero_()
        return NoNEPageForwardPacket(
            output_t=output_t,
            page_ids_t=request.page_ids_t,
            route_probability_t=request.route_probability_t,
            route_entropy_t=request.route_entropy_t,
            generation_t=request.generation_t,
        )

    def _candidate_replayed_gradient_weights_for_wave_boundary(
        self,
        page_ids_t: torch.Tensor,
    ) -> NoNEPageWeights:
        """Replay full-route VJPs once for one bounded physical page wave."""

        if not self._candidate_vjp_trace_bindings:
            raise RuntimeError("NoNE candidate page gradient has no VJP trace")
        if page_ids_t.ndim != 1 or page_ids_t.dtype != torch.long:
            raise ValueError("NoNE candidate VJP page wave is invalid")
        if (
            page_ids_t.shape[0] < 1
            or page_ids_t.shape[0] > self.training_residency_wave_pages
        ):
            raise RuntimeError(
                "NoNE candidate VJP page wave exceeds physical capacity"
            )
        if torch.unique(page_ids_t).shape[0] != page_ids_t.shape[0]:
            raise RuntimeError("NoNE candidate VJP page wave repeats a page")
        self._assert_candidate_rematerialization_authority_boundary(
            candidate_generation_t=self.candidate_base_generation_t,
            candidate_state_revision_t=self.candidate_page_state_revision_t,
        )
        device = self.executor.memory_projection.weight.device
        dtype = self.executor.memory_projection.weight.dtype
        requested_page_ids_t = page_ids_t.to(
            device=device,
            dtype=torch.long,
        )
        replay_weights = (
            self._candidate_rematerialized_weights_for_page_ids_boundary(
                session_id_t=self.router.session_id_t,
                generation_t=self.candidate_base_generation_t,
                page_ids_t=requested_page_ids_t,
                device=device,
                dtype=dtype,
                trainable=True,
            )
        )
        replay_parameters = _page_parameter_tensors(replay_weights)
        accumulated_gradients = tuple(
            torch.zeros_like(parameter_t) for parameter_t in replay_parameters
        )
        seen_page_mask_t = torch.zeros_like(
            requested_page_ids_t,
            dtype=torch.bool,
        )
        trace_ordinals = self._candidate_vjp_trace_ordinals_boundary()
        for ordinal in trace_ordinals:
            trace = self._materialize_candidate_vjp_trace_boundary(
                self._candidate_vjp_trace_bindings[ordinal]
            )
            self._assert_candidate_rematerialization_authority_boundary(
                candidate_generation_t=trace.candidate_generation_t,
                candidate_state_revision_t=trace.candidate_state_revision_t,
            )
            request = _move_page_request_tensor_boundary(
                trace.request,
                device=device,
                detach=True,
            )
            route_matches_t = request.unique_page_ids_t.unsqueeze(1).eq(
                requested_page_ids_t.unsqueeze(0)
            )
            route_match_count_t = route_matches_t.sum(dim=1)
            if route_match_count_t.gt(1).any():
                raise RuntimeError(
                    "NoNE candidate VJP route repeats one requested page"
                )
            page_positions_t = torch.nonzero(
                route_match_count_t.eq(1),
                as_tuple=False,
            ).reshape(-1)
            if page_positions_t.shape[0] == 0:
                continue
            wave_matches_t = route_matches_t.index_select(
                0,
                page_positions_t,
            )
            wave_row_indexes_t = wave_matches_t.to(
                dtype=torch.long
            ).argmax(dim=1)
            if torch.unique(wave_row_indexes_t).shape[0] != (
                wave_row_indexes_t.shape[0]
            ):
                raise RuntimeError(
                    "NoNE candidate VJP route aliases a page wave"
                )
            seen_page_mask_t.index_fill_(
                0,
                wave_row_indexes_t,
                True,
            )
            wave = self._training_residency_wave_request_boundary(
                request,
                page_positions_t=page_positions_t,
            )
            wave_weights = _page_weights_index_select_boundary(
                replay_weights,
                wave_row_indexes_t,
            )
            torch._assert_async(
                wave_weights.page_ids_t.eq(
                    wave.request.unique_page_ids_t.to(
                        device=wave_weights.page_ids_t.device,
                        dtype=torch.long,
                    )
                ).all(),
                "NoNE candidate VJP wave changed trace route order",
            )
            hidden_t = trace.hidden_t.to(
                device=device,
                dtype=trace.hidden_t.dtype,
            )
            gradient_output_t = trace.gradient_output_t.to(
                device=device,
                dtype=trace.gradient_output_t.dtype,
            )
            wave_parameters = _page_parameter_tensors(wave_weights)
            with torch.enable_grad():
                wave_output_t = self.executor(
                    hidden_t.index_select(
                        0,
                        wave.active_batch_index_t,
                    ),
                    wave.request,
                    wave_weights,
                )
                page_gradients = torch.autograd.grad(
                    wave_output_t,
                    wave_parameters,
                    grad_outputs=gradient_output_t.index_select(
                        0,
                        wave.active_batch_index_t,
                    ),
                    retain_graph=False,
                    create_graph=False,
                    allow_unused=False,
                )
            for accumulated_t, parameter_t, gradient_t in zip(
                accumulated_gradients,
                wave_parameters,
                page_gradients,
                strict=True,
            ):
                accumulated_t.index_add_(
                    0,
                    wave_row_indexes_t.to(device=accumulated_t.device),
                    gradient_t.detach().to(
                        device=accumulated_t.device,
                        dtype=accumulated_t.dtype,
                    ),
                )
        torch._assert_async(
            seen_page_mask_t.all(),
            "NoNE candidate page wave is outside every retained VJP route",
        )
        for parameter_t, gradient_t in zip(
            replay_parameters,
            accumulated_gradients,
            strict=True,
        ):
            parameter_t.grad = gradient_t
        return replay_weights

    def _candidate_replayed_gradient_weights_for_page_boundary(
        self,
        page_id: int,
    ) -> NoNEPageWeights:
        """Compatibility wrapper for one exact VJP page row."""

        return self._candidate_replayed_gradient_weights_for_wave_boundary(
            self.router.page_catalog_ids_t.new_tensor(
                (page_id,),
                dtype=torch.long,
            )
        )

    def _candidate_update_bundle_for_page_boundary(
        self,
        page_id: int,
        *,
        rematerialized_weights: NoNEPageWeights | None = None,
    ) -> NoNEPageBundle:
        """Bind one gradient-bearing weight row to its exact durable moments."""

        resident = self._candidate_pages.get(page_id)
        wave_binding = self._candidate_forward_wave_bindings.get(page_id)
        weights: NoNEPageWeights | None
        if rematerialized_weights is not None:
            weights = rematerialized_weights
        elif wave_binding is not None:
            weights = _candidate_forward_wave_gradient_row_boundary(
                wave_binding
            )
        else:
            weights = self._candidate_forward_weights.get(page_id)
        if weights is None and resident is not None:
            weights = resident.weights
        store = self._store_boundary
        if weights is None or store is None:
            raise RuntimeError(
                "NoNE candidate optimizer page has no routed weight authority"
            )
        journal_bundle = self._candidate_page_journal.get(page_id)
        scratch_binding = self._candidate_page_scratch.get(page_id)
        object_binding = self._candidate_page_objects.get(page_id)
        if journal_bundle is not None:
            optimizer_bundle = journal_bundle
        elif scratch_binding is not None:
            optimizer_bundle = (
                store.materialize_candidate_page_scratch_boundary(
                    scratch_binding,
                    device=torch.device("cpu"),
                    dtype=weights.gate_t.dtype,
                    trainable=False,
                )
            )
        elif object_binding is not None:
            optimizer_bundle = store.materialize_page_object_boundary(
                object_binding,
                device=torch.device("cpu"),
                dtype=weights.gate_t.dtype,
                trainable=False,
            )
        elif resident is not None:
            optimizer_bundle = resident
        else:
            optimizer_bundle = store.materialize_page_bundle_ids_boundary(
                session_id_t=self.router.session_id_t,
                generation_t=self.candidate_base_generation_t,
                page_ids_t=torch.tensor((page_id,), dtype=torch.long),
                device=torch.device("cpu"),
                dtype=weights.gate_t.dtype,
                trainable=False,
            )
        optimizer_page_ids_t = (
            optimizer_bundle.weights.page_ids_t.detach().cpu().long().reshape(-1)
        )
        if (
            optimizer_page_ids_t.shape != (1,)
            or int(optimizer_page_ids_t[0]) != page_id
        ):
            raise RuntimeError(
                "NoNE candidate optimizer page identity differs"
            )
        weight_page_ids_t = weights.page_ids_t.detach().cpu().long().reshape(-1)
        if (
            weight_page_ids_t.shape != (1,)
            or int(weight_page_ids_t[0]) != page_id
        ):
            raise RuntimeError(
                "NoNE candidate gradient page identity differs"
            )
        return replace(
            optimizer_bundle,
            weights=weights,
        )

    def prepare_candidate_page_updates_boundary(
        self,
        optimizer: NoNEPageOptimizerPacket,
    ) -> torch.Tensor:
        """Consume accumulated page gradients without advancing store authority."""

        _tensor_assert(
            self.candidate_window_active_t,
            "NoNE page update has no active candidate window",
        )
        _tensor_assert(
            torch.logical_not(self.candidate_prepare_poisoned_t),
            "NoNE candidate page prepare is poisoned; abandon the candidate",
        )
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        update_proven_t = self.candidate_window_active_t.new_zeros(())
        gradient_page_ids = tuple(sorted(self._candidate_gradient_page_ids))
        gradient_catalog_mask_t = torch.zeros_like(
            self.router.page_catalog_ids_t,
            dtype=torch.bool,
        )
        scratch_root = self._candidate_scratch_root
        if gradient_page_ids and scratch_root is None:
            raise RuntimeError("NoNE candidate update has no scratch window")
        if gradient_page_ids:
            # Applying Adam one page at a time is the bounded execution
            # contract. Mark the entire prepare attempt fail-closed before its
            # first page so an exception after page N can never be retried and
            # apply a second Adam step to pages 0..N. Only a completely
            # successful prepare below clears this poison; rollback/finish
            # clears the candidate window and its proposal-local state.
            with torch.no_grad():
                self.candidate_prepare_poisoned_t.fill_(True)
            self._consume_candidate_vjp_trace_set_boundary()
        transfer_stream: torch.cuda.Stream | None = None
        replay_wave_end = 0
        replay_proven_width = 0
        replay_failed_width = self.training_residency_wave_pages + 1
        # Keep page-local optimizer temporaries bounded while the complete
        # model-routed wave pipelines D2H transfer and ordered persistence.
        for page_offset, page_id in enumerate(gradient_page_ids):
            if (
                self._candidate_vjp_trace_bindings
                and page_offset >= replay_wave_end
            ):
                remaining_pages = len(gradient_page_ids) - page_offset
                if replay_proven_width < 1:
                    replay_attempt_width = min(
                        self.training_residency_wave_pages,
                        remaining_pages,
                    )
                elif (
                    replay_failed_width
                    <= self.training_residency_wave_pages
                    and replay_proven_width + 1 < replay_failed_width
                ):
                    replay_attempt_width = min(
                        remaining_pages,
                        (replay_proven_width + replay_failed_width) // 2,
                    )
                else:
                    replay_attempt_width = min(
                        remaining_pages,
                        replay_proven_width,
                    )
                while True:
                    replay_page_ids = gradient_page_ids[
                        page_offset : page_offset + replay_attempt_width
                    ]
                    replay_page_ids_t = (
                        self.router.page_catalog_ids_t.new_tensor(
                            replay_page_ids,
                            dtype=torch.long,
                        )
                    )
                    try:
                        replayed_wave_weights = (
                            self._candidate_replayed_gradient_weights_for_wave_boundary(
                                replay_page_ids_t
                            )
                        )
                    except torch.cuda.OutOfMemoryError:
                        # VJP replay is still a pure proposal read here: no
                        # Adam state, scratch page, manifest, cursor, or
                        # generation has changed. Halve/bisect only this
                        # CUDA-capacity failure; integrity and numeric errors
                        # must escape and poison the candidate.
                        if replay_attempt_width <= 1:
                            raise
                        failed_attempt_width = replay_attempt_width
                        replay_failed_width = min(
                            replay_failed_width,
                            failed_attempt_width,
                        )
                        # A width proven by an earlier wave can still fail
                        # after allocator pressure changes, and a short final
                        # wave can fail below the historical proven width.
                        # In either case that old lower bound is no longer
                        # valid for this transaction. Drop it before choosing
                        # a strictly smaller retry so the OOM search cannot
                        # repeat the same effective slice forever.
                        if failed_attempt_width <= replay_proven_width:
                            replay_proven_width = 0
                        if replay_proven_width < 1:
                            next_attempt_width = failed_attempt_width // 2
                        else:
                            next_attempt_width = (
                                replay_proven_width
                                + failed_attempt_width
                            ) // 2
                        replay_attempt_width = max(
                            1,
                            min(
                                remaining_pages,
                                failed_attempt_width - 1,
                                next_attempt_width,
                            ),
                        )
                        if (
                            self.executor.memory_projection.weight.device.type
                            == "cuda"
                        ):
                            torch.cuda.empty_cache()
                        continue
                    break
                expected_replay_ids_t = replay_page_ids_t.to(
                    device=replayed_wave_weights.page_ids_t.device,
                    dtype=torch.long,
                )
                if (
                    replayed_wave_weights.page_ids_t.shape
                    != expected_replay_ids_t.shape
                ):
                    raise RuntimeError(
                        "NoNE candidate VJP wave changed page geometry"
                    )
                torch._assert_async(
                    replayed_wave_weights.page_ids_t.eq(
                        expected_replay_ids_t
                    ).all(),
                    "NoNE candidate VJP wave changed page order",
                )
                replay_proven_width = max(
                    replay_proven_width,
                    replay_attempt_width,
                )
                replay_wave_end = page_offset + replay_attempt_width
                for replay_row, replay_page_id in enumerate(replay_page_ids):
                    if replay_page_id in self._candidate_forward_wave_bindings:
                        raise RuntimeError(
                            "NoNE candidate VJP wave repeats a page binding"
                        )
                    self._candidate_forward_wave_bindings[replay_page_id] = (
                        _NoNECandidateForwardWaveBinding(
                            weights=replayed_wave_weights,
                            row_index_t=(
                                replayed_wave_weights.page_ids_t.new_tensor(
                                    replay_row,
                                    dtype=torch.long,
                                )
                            ),
                        )
                    )
            source = self._candidate_update_bundle_for_page_boundary(
                page_id,
            )
            if _optimizer_state_has_implicit_zero_layout_boundary(source):
                update = update_stateless_page_bundle_from_gradients_boundary(
                    source,
                    optimizer,
                )
            else:
                update = update_page_bundle_from_gradients(source, optimizer)
            signaled_t = (
                (update.gradient_norm_t > 0)
                & (update.parameter_delta_norm_t > 0)
            ).all() & update.finite_t.all()
            page_match_t = self.router.page_catalog_ids_t.eq(
                update.page_ids_t.reshape(()).to(
                    device=self.router.page_catalog_ids_t.device,
                    dtype=torch.long,
                )
            )
            gradient_catalog_mask_t.logical_or_(page_match_t)
            retained = _page_bundle_row(
                update.bundle,
                0,
                trainable=False,
            )
            if (
                retained.weights.gate_t.device.type == "cuda"
                and transfer_stream is None
            ):
                transfer_stream = torch.cuda.Stream(  # type: ignore[no-untyped-call]
                    device=retained.weights.gate_t.device
                )
            host_transfer = _enqueue_candidate_page_host_transfer_boundary(
                retained,
                finite_components_t=update.finite_components_t,
                finite_t=update.finite_t,
                signaled_t=signaled_t,
                transfer_stream=transfer_stream,
            )
            if scratch_root is None:
                raise RuntimeError("NoNE candidate update has no scratch window")
            if host_transfer.completion_event is None:
                # CPU-only callers retain their immediate boundary semantics.
                if bool(host_transfer.finite_t.all()) and bool(
                    host_transfer.signaled_t
                ):
                    self._submit_candidate_page_stage_boundary(
                        page_id=page_id,
                        retained_cpu=host_transfer.bundle,
                    )
            else:
                # CUDA finite/signal tensors are consumed by the ordered
                # writer only after its page event completes. No per-page
                # accelerator scalar synchronization occurs in this loop.
                self._submit_candidate_page_stage_boundary(
                    page_id=page_id,
                    host_transfer=host_transfer,
                )
            if (
                len(self._candidate_page_stage_futures)
                >= _CANDIDATE_PAGE_STAGE_MAX_PENDING
            ):
                # A Future retains its closure and pinned D2H bundle until the
                # owner consumes it. Apply fixed-depth backpressure here,
                # then move the completed rows into proposal-local scratch,
                # so host residency cannot grow with the routed page count.
                self.spill_candidate_page_journal_boundary()
            self._candidate_pages.pop(page_id, None)
            self._candidate_forward_weights.pop(page_id, None)
            self._candidate_forward_wave_bindings.pop(page_id, None)
            update_proven_t = update_proven_t | signaled_t.to(
                device=update_proven_t.device,
                dtype=torch.bool,
            )
            signaled_long_t = signaled_t.to(
                device=page_match_t.device,
                dtype=torch.long,
            )
            signaled_float_t = signaled_t.to(
                device=page_match_t.device,
                dtype=torch.float32,
            )
            with torch.no_grad():
                self.candidate_gradient_update_count_t.add_(
                    page_match_t.to(dtype=torch.long) * signaled_long_t
                )
                self.candidate_gradient_norm_t.add_(
                    page_match_t.to(dtype=torch.float32)
                    * update.gradient_norm_t.reshape(()).float()
                    * signaled_float_t
                )
                self.candidate_parameter_delta_norm_t.add_(
                    page_match_t.to(dtype=torch.float32)
                    * update.parameter_delta_norm_t.reshape(()).float()
                    * signaled_float_t
                )
                self.candidate_gradient_signature_t.add_(
                    page_match_t.to(dtype=torch.float32).unsqueeze(1)
                    * update.gradient_signature_t.reshape(1, -1).float()
                    * signaled_float_t
                )
            # Explicitly end page-local graph/storage lifetimes before the next
            # replay call. Python evaluates an assignment's right-hand side
            # before replacing its previous local value; without these
            # releases, the prior full wave remains live while the next one is
            # built even though every dictionary binding has been popped.
            del source
            del update
            del retained
            del host_transfer
            if (
                self._candidate_vjp_trace_bindings
                and page_offset + 1 == replay_wave_end
            ):
                del replayed_wave_weights
        if gradient_page_ids:
            with torch.no_grad():
                self.candidate_device_residency_mask_t.logical_and_(
                    ~gradient_catalog_mask_t
                )
                # Keep the first model-routed trainable cohort latched for the
                # entire candidate transaction. Only
                # _clear_candidate_boundary() may reset this ownership mask.
        # Frozen accepted pages participate in the routed forward but carry no
        # candidate optimizer state. Release those read-only residency copies
        # together with the updated rows so the next wave remains bounded.
        self._candidate_pages.clear()
        self._candidate_forward_weights.clear()
        self._candidate_forward_wave_bindings.clear()
        self._discard_candidate_vjp_traces_boundary()
        with torch.no_grad():
            self.candidate_device_residency_mask_t.zero_()
            if gradient_page_ids:
                self.candidate_page_state_revision_t.add_(
                    torch.ones_like(self.candidate_page_state_revision_t)
                )
        self._candidate_gradient_page_ids.clear()
        with torch.no_grad():
            self.candidate_page_update_count_t.add_(
                update_proven_t.to(dtype=torch.long)
            )
            self.candidate_prepare_poisoned_t.zero_()
        self.last_bundle = None
        self.last_weights = None
        self.last_request = None
        # Wave-local GPU residency must not survive into the next decode arm.
        # The accepted LRU otherwise retains every previously routed page until
        # the cache high-water mark is hit, which OOMs the second training arm.
        self._accepted_inference_pages.clear()
        self._accepted_inference_compositions.clear()
        with torch.no_grad():
            self.accepted_residency_page_mask_t.zero_()
        return update_proven_t

    def retain_candidate_training_totals_boundary(
        self,
        accepted_t: torch.Tensor,
    ) -> torch.Tensor:
        """Retain proposal telemetry without rebuilding its global proof.

        The RBO retains every layer before it constructs the one model-wide
        proof.  Finalizing a layer-local proof here used to normalize, hash,
        and sort the same rows that the model-wide combiner immediately
        processed again, while the returned local packet was discarded.
        Return the tensor retention decision instead so this active boundary
        stays tensor-native and the caller can finalize exactly once.
        """

        self._resolve_all_candidate_page_stages_boundary()
        if accepted_t.numel() != 1:
            raise ValueError("NoNE page proof retention must be scalar")
        accepted_long_t = accepted_t.to(
            device=self.accepted_route_count_t.device,
            dtype=torch.long,
        ).reshape(())
        accepted_float_t = accepted_long_t.to(dtype=torch.float32)
        with torch.no_grad():
            self.accepted_route_count_t.add_(
                self.candidate_route_count_t * accepted_long_t
            )
            self.accepted_gradient_update_count_t.add_(
                self.candidate_gradient_update_count_t * accepted_long_t
            )
            self.accepted_gradient_norm_t.add_(
                self.candidate_gradient_norm_t * accepted_float_t
            )
            self.accepted_parameter_delta_norm_t.add_(
                self.candidate_parameter_delta_norm_t * accepted_float_t
            )
            self.accepted_gradient_signature_t.add_(
                self.candidate_gradient_signature_t * accepted_float_t
            )
        return accepted_long_t.clone()

    def retain_candidate_training_proof_boundary(
        self,
        accepted_t: torch.Tensor,
    ) -> NoNEPageTrainingProofPacket:
        """Retain proposal telemetry and expose a finalized local proof."""

        self.retain_candidate_training_totals_boundary(accepted_t)
        return self.training_proof_boundary()

    def _training_proof_components_from_totals_boundary(
        self,
        route_count_total_t: torch.Tensor,
        gradient_update_count_total_t: torch.Tensor,
        gradient_norm_total_t: torch.Tensor,
        parameter_delta_norm_total_t: torch.Tensor,
        gradient_signature_total_t: torch.Tensor,
    ) -> NoNEPageTrainingProofPacket:
        """Gather tensor-only family rows before model-wide finalization."""

        family_index_t = self.family_page_mask_t.nonzero(as_tuple=False).reshape(-1)
        if family_index_t.numel() < 1:
            raise RuntimeError("NoNE paged layer has no family-root pages")
        gradient_update_count_t = gradient_update_count_total_t.index_select(
            0,
            family_index_t,
        )
        divisor_t = (
            gradient_update_count_t.clamp_min(1).to(dtype=torch.float32).unsqueeze(1)
        )
        signature_t = (
            gradient_signature_total_t.index_select(
                0,
                family_index_t,
            )
            / divisor_t
        )
        route_count_t = route_count_total_t.index_select(
            0,
            family_index_t,
        )
        gradient_norm_t = gradient_norm_total_t.index_select(
            0,
            family_index_t,
        )
        parameter_delta_norm_t = parameter_delta_norm_total_t.index_select(
            0,
            family_index_t,
        )
        route_coverage_t = route_count_t.gt(0).all()
        gradient_coverage_t = gradient_update_count_t.gt(0).all()
        finite_t = (
            torch.isfinite(gradient_norm_t).all()
            & torch.isfinite(parameter_delta_norm_t).all()
            & torch.isfinite(signature_t).all()
        )
        local_packet = NoNEPageTrainingProofPacket(
            family_page_ids_t=self.router.page_catalog_ids_t.index_select(
                0,
                family_index_t,
            ),
            route_count_t=route_count_t,
            gradient_update_count_t=gradient_update_count_t,
            gradient_norm_t=gradient_norm_t,
            parameter_delta_norm_t=parameter_delta_norm_t,
            gradient_signature_t=signature_t,
            route_coverage_t=route_coverage_t,
            gradient_coverage_t=gradient_coverage_t,
            distinct_gradient_t=gradient_coverage_t.new_zeros(()),
            finite_t=finite_t,
            promotion_ready_t=gradient_coverage_t.new_zeros(()),
        )
        return local_packet

    def training_proof_components_boundary(self) -> NoNEPageTrainingProofPacket:
        """Expose accepted family rows for one model-wide proof finalization."""

        return self._training_proof_components_from_totals_boundary(
            self.accepted_route_count_t,
            self.accepted_gradient_update_count_t,
            self.accepted_gradient_norm_t,
            self.accepted_parameter_delta_norm_t,
            self.accepted_gradient_signature_t,
        )

    def training_proof_boundary(self) -> NoNEPageTrainingProofPacket:
        """Expose accepted cumulative family proof as a tensor-only packet."""

        return combine_page_training_proofs(
            (self.training_proof_components_boundary(),)
        )

    def candidate_training_proof_components_boundary(
        self,
    ) -> NoNEPageTrainingProofPacket:
        """Expose accepted plus candidate rows before global finalization."""

        self._resolve_all_candidate_page_stages_boundary()
        _tensor_assert(
            self.candidate_window_active_t,
            "NoNE candidate proof has no active update window",
        )
        return self._training_proof_components_from_totals_boundary(
            self.accepted_route_count_t + self.candidate_route_count_t,
            self.accepted_gradient_update_count_t
            + self.candidate_gradient_update_count_t,
            self.accepted_gradient_norm_t + self.candidate_gradient_norm_t,
            self.accepted_parameter_delta_norm_t
            + self.candidate_parameter_delta_norm_t,
            self.accepted_gradient_signature_t + self.candidate_gradient_signature_t,
        )

    def candidate_training_proof_boundary(self) -> NoNEPageTrainingProofPacket:
        """Expose accepted plus tentative candidate proof without committing it."""

        return combine_page_training_proofs(
            (self.candidate_training_proof_components_boundary(),)
        )

    def candidate_transaction_training_proof_components_boundary(
        self,
    ) -> NoNEPageTrainingProofPacket:
        """Expose candidate-window rows before global proof finalization."""

        _tensor_assert(
            self.candidate_window_active_t,
            "NoNE candidate proof has no active update window",
        )
        return self._training_proof_components_from_totals_boundary(
            self.candidate_route_count_t,
            self.candidate_gradient_update_count_t,
            self.candidate_gradient_norm_t,
            self.candidate_parameter_delta_norm_t,
            self.candidate_gradient_signature_t,
        )

    def candidate_transaction_training_proof_boundary(
        self,
    ) -> NoNEPageTrainingProofPacket:
        """Expose only counters and deltas from the active candidate window."""

        return combine_page_training_proofs(
            (self.candidate_transaction_training_proof_components_boundary(),)
        )

    def candidate_updated_bundle_boundary(
        self,
    ) -> NoNEPageBundle | None:
        """Return only gradient-proven candidate rows for one global commit."""

        self._resolve_all_candidate_page_stages_boundary()
        page_ids = tuple(sorted(self._candidate_updated_page_ids))
        if not page_ids:
            return None
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        return concatenate_page_bundles(
            tuple(
                (
                    _move_page_bundle_boundary(
                        self._candidate_page_journal[page_id],
                        device=torch.device("cpu"),
                        dtype=torch.float32,
                        trainable=False,
                    )
                    if page_id in self._candidate_page_journal
                    else store.materialize_candidate_page_scratch_boundary(
                        self._candidate_page_scratch[page_id],
                        device=torch.device("cpu"),
                        dtype=torch.float32,
                        trainable=False,
                    )
                    if page_id in self._candidate_page_scratch
                    else store.materialize_page_object_boundary(
                        self._candidate_page_objects[page_id],
                        device=torch.device("cpu"),
                        dtype=torch.float32,
                        trainable=False,
                    )
                )
                for page_id in page_ids
            )
        )

    def seal_candidate_page_object_bindings_boundary(
        self,
    ) -> tuple[NoNEPageObjectBinding, ...]:
        """Seal retained scratch rows and return immutable candidate bindings."""

        self._resolve_all_candidate_page_stages_boundary()
        store = self._store_boundary
        if store is None:
            raise RuntimeError("NoNE paged runtime has no storage boundary")
        sealed_any = False
        sealed_packets: list[NoNECandidatePageSealPacket] = []
        try:
            scratch_root = self._candidate_scratch_root
            if self._candidate_page_journal:
                if scratch_root is None:
                    raise RuntimeError("NoNE retained candidate has no scratch window")
                candidate_scratch_root = scratch_root
                journal_page_ids = tuple(sorted(self._candidate_page_journal))

                def stage_journal_page(
                    page_id: int,
                ) -> NoNECandidatePageScratchBinding:
                    return store.stage_candidate_page_scratch_boundary(
                        self._candidate_page_journal[page_id],
                        scratch_root=candidate_scratch_root,
                        base_generation_t=self.candidate_base_generation_t,
                    )

                staged_bindings: dict[
                    int, NoNECandidatePageScratchBinding
                ] = {}
                stage_errors: dict[int, Exception] = {}
                with ThreadPoolExecutor(
                    max_workers=min(
                        _PAGE_MATERIALIZATION_IO_WORKERS,
                        len(journal_page_ids),
                    ),
                    thread_name_prefix="nnf-candidate-page-stage",
                ) as executor:
                    stage_futures: dict[
                        Future[NoNECandidatePageScratchBinding], int
                    ] = {
                        executor.submit(stage_journal_page, page_id): page_id
                        for page_id in journal_page_ids
                    }
                    for stage_future in as_completed(stage_futures):
                        page_id = stage_futures[stage_future]
                        try:
                            staged_bindings[page_id] = stage_future.result()
                        except Exception as error:
                            stage_errors[page_id] = error
                # Workers only write page-distinct proposal-local files. Publish
                # their bindings to runtime state on this owner thread and in
                # model-route order, regardless of completion order.
                for page_id in sorted(staged_bindings):
                    binding = staged_bindings[page_id]
                    self._record_candidate_page_stage_boundary(page_id, binding)
                if stage_errors:
                    failed_page_id = min(stage_errors)
                    primary_error = stage_errors[failed_page_id]
                    for page_id in sorted(stage_errors):
                        if page_id == failed_page_id:
                            continue
                        primary_error.add_note(
                            "additional NoNE candidate page stage failure: "
                            f"pageId={page_id} error={stage_errors[page_id]!r}"
                        )
                    raise primary_error
                for page_id in journal_page_ids:
                    if page_id not in self._candidate_page_scratch:
                        raise RuntimeError("NoNE candidate journal did not stage")
                    del self._candidate_page_journal[page_id]
            scratch_bindings: dict[int, NoNECandidatePageScratchBinding] = {}
            for page_id in sorted(self._candidate_updated_page_ids):
                scratch_binding = self._candidate_page_scratch.get(page_id)
                if scratch_binding is None:
                    if page_id not in self._candidate_page_objects:
                        raise RuntimeError("NoNE candidate page state is absent")
                    continue
                scratch_bindings[page_id] = scratch_binding

            if scratch_bindings:
                seal_results: dict[int, NoNECandidatePageSealPacket] = {}
                seal_errors: dict[int, Exception] = {}

                def seal_scratch_page(
                    page_id: int,
                ) -> NoNECandidatePageSealPacket:
                    return store.seal_candidate_page_scratch_boundary(
                        scratch_bindings[page_id],
                        sync_directory=False,
                    )

                with ThreadPoolExecutor(
                    max_workers=min(
                        _PAGE_MATERIALIZATION_IO_WORKERS,
                        len(scratch_bindings),
                    ),
                    thread_name_prefix="nnf-candidate-page-seal",
                ) as executor:
                    seal_futures: dict[
                        Future[NoNECandidatePageSealPacket], int
                    ] = {
                        executor.submit(seal_scratch_page, page_id): page_id
                        for page_id in sorted(scratch_bindings)
                    }
                    for seal_future in as_completed(seal_futures):
                        page_id = seal_futures[seal_future]
                        try:
                            seal_results[page_id] = seal_future.result()
                        except Exception as error:
                            seal_errors[page_id] = error
                # Preserve deterministic runtime publication and rollback order
                # even when independent page hashes complete out of order.
                sealed_packets.extend(
                    seal_results[page_id] for page_id in sorted(seal_results)
                )
                if seal_errors:
                    failed_page_id = min(seal_errors)
                    primary_error = seal_errors[failed_page_id]
                    for page_id in sorted(seal_errors):
                        if page_id == failed_page_id:
                            continue
                        primary_error.add_note(
                            "additional NoNE candidate page seal failure: "
                            f"pageId={page_id} error={seal_errors[page_id]!r}"
                        )
                    raise primary_error

            for seal_packet in sealed_packets:
                page_id = int(
                    seal_packet.scratch.page_id_t.detach().cpu().long().reshape(
                        ()
                    )
                )
                self._candidate_page_objects[page_id] = seal_packet.object
                del self._candidate_page_scratch[page_id]
                sealed_any = True
            if sealed_any:
                store.sync_staged_page_objects_boundary()
                scratch_root = self._candidate_scratch_root
                if scratch_root is None:
                    raise RuntimeError(
                        "NoNE sealed candidate has no scratch window"
                    )
                store.sync_candidate_page_scratch_window_boundary(
                    scratch_root
                )
        except Exception:
            for seal_packet in reversed(sealed_packets):
                store.rollback_candidate_page_seal_boundary(seal_packet)
                page_id = int(
                    seal_packet.scratch.page_id_t.detach().cpu().long().reshape(
                        ()
                    )
                )
                self._candidate_page_scratch[page_id] = seal_packet.scratch
                self._candidate_page_objects.pop(page_id, None)
            raise

        return tuple(
            self._candidate_page_objects[page_id]
            for page_id in sorted(self._candidate_updated_page_ids)
        )

    def promote_candidate_training_page_cache_boundary(
        self,
        accepted_generation_t: torch.Tensor,
    ) -> torch.Tensor:
        """Admit accepted rows one at a time into the bounded immutable LRU.

        The caller invokes this only after the immutable generation and graph
        authority are durable. The store re-authorizes the accepted session,
        generation, manifest row, object digest, byte size, path, and inode
        before admitting an isolated row to its bounded content-addressed LRU.
        Candidate training never retains all updated CPU leaves for this
        optimization; each sealed object is rematerialized and released
        independently after acceptance.
        """

        store = self._store_boundary
        if store is None or accepted_generation_t.numel() != 1:
            return self.candidate_page_update_count_t.new_zeros(())
        self._resolve_all_candidate_page_stages_boundary()
        accepted_cpu_t = accepted_generation_t.detach().cpu().long().reshape(())
        store_generation_t = (
            store.accepted_generation_t().detach().cpu().long().reshape(())
        )
        if not torch.equal(accepted_cpu_t, store_generation_t):
            return self.candidate_page_update_count_t.new_zeros(())
        admitted_page_ids = tuple(
            page_id
            for page_id in sorted(self._candidate_page_objects)
            if (
                page_id in self._training_eligible_page_ids
                and page_id in self._candidate_updated_page_ids
            )
        )
        if not admitted_page_ids:
            return self.candidate_page_update_count_t.new_zeros(())
        admitted_t = self.candidate_page_update_count_t.new_zeros(
            (),
            dtype=torch.long,
        )
        cache_dtype = self.executor.memory_projection.weight.dtype
        for page_id in admitted_page_ids:
            binding = self._candidate_page_objects[page_id]
            bundle = store.materialize_page_object_boundary(
                binding,
                device=torch.device("cpu"),
                dtype=cache_dtype,
                trainable=False,
            )
            admitted_t.add_(
                store.admit_accepted_materialized_cpu_pages_boundary(
                    session_id_t=self.router.session_id_t,
                    generation_t=accepted_cpu_t,
                    object_bindings=(binding,),
                    bundles=(bundle,),
                ).to(
                    device=admitted_t.device,
                    dtype=torch.long,
                )
            )
            del bundle
        return admitted_t

    def candidate_page_object_bindings_boundary(
        self,
    ) -> tuple[NoNEPageObjectBinding, ...]:
        """Read already-sealed candidate bindings without granting durability."""

        self._resolve_all_candidate_page_stages_boundary()
        if self._candidate_page_journal or self._candidate_page_scratch:
            raise RuntimeError("NoNE candidate scratch has not been sealed")
        return tuple(
            self._candidate_page_objects[page_id]
            for page_id in sorted(self._candidate_updated_page_ids)
        )

    def finish_candidate_boundary(self) -> torch.Tensor:
        """Release proposal-local page state after acceptance or rejection."""

        proof_t = self.candidate_page_update_count_t.clone()
        self._clear_candidate_boundary()
        return proof_t

    def commit_last_page_update_boundary(
        self,
        *,
        update: NoNEPageUpdatePacket,
        components: NoNEGenerationComponentPacket,
    ) -> dict[str, Any]:
        """Commit a gradient-proven selected-page update as one generation."""

        store = self._store_boundary
        request = self.last_request
        if store is None or request is None:
            raise RuntimeError("NoNE paged runtime has no open training request")
        if not torch.equal(update.page_ids_t, request.unique_page_ids_t):
            raise RuntimeError("NoNE page update IDs differ from the model route")
        routed_catalog_match_t = self.router.page_catalog_ids_t.unsqueeze(1).eq(
            request.unique_page_ids_t.to(
                device=self.router.page_catalog_ids_t.device,
                dtype=torch.long,
            ).unsqueeze(0)
        )
        routed_training_eligible_t = (
            routed_catalog_match_t
            & self.training_eligible_page_mask_t.unsqueeze(1)
        ).any(dim=0)
        _tensor_assert(
            routed_training_eligible_t.all(),
            "NoNE page update includes a validated or frozen page",
        )
        _tensor_assert(
            update.finite_t.all(),
            "NoNE page update contains nonfinite state",
        )
        _tensor_assert(
            (update.gradient_norm_t > 0).all(),
            "NoNE selected page received no gradient signal",
        )
        _tensor_assert(
            (update.parameter_delta_norm_t > 0).all(),
            "NoNE selected page parameters did not change",
        )
        pointer = store.commit_generation(
            generation_t=store.accepted_generation_t()
            + torch.ones_like(store.accepted_generation_t()),
            updated_pages=update.bundle,
            components=components,
        )
        self.last_bundle = None
        return pointer