Checked compute dataflow

Evidence correction: historical kill counts from the native Core-1 mutation runner before 9a63b70ff4 are withdrawn pending fresh replay. Stale binaries could produce false kills. This qualifies all such counts below; see docs/mutation-evidence.md. Test inventories are not execution evidence.

The Core-1 compute preview accepts the following explicit Compute calls in compiled, non-portable compute messages. Inputs remain ranked TensorView<Float64,Rank,Layout> parameters and message results are owned Tensor<Float64,Rank,Layout> values. Immutable let bindings can retain intermediate tensors or metadata. Integer metadata must be constant and fit uint32; arbitrary loops, branches, external calls, and effects are not index kernels in this bounded profile.

Call	Result and checks
broadcast(scalar, like)	Owned tensor with like’s shape/layout; scalar has rank zero.
view(input)	Read-only view of the same shape.
slice(input, axis, start, count)	Same-rank view of the bounded half-open interval.
stride(input, axis, step)	Same-rank view selecting coordinates 0, step, …; step is positive.
own(input)	Owned copy in the declared layout.
index_space(like, axis)	Owned Float64 coordinates for that axis over like’s shape.
require_extent(input, axis, expected)	Input unchanged after checking the actual extent.
reduce_axis(input, axis)	Owned tensor with the axis removed, reduced in increasing coordinate order from positive zero.

Axes must fit the rank. Slices require start <= extent and count <= extent - start. Empty views never perform pointer arithmetic; reducing an empty axis yields positive zero for every remaining coordinate. Borrowed intermediates never free their source allocation, and outputs are copied before the execution graph releases owned intermediates. The embedding lifetime and aliasing obligations still apply.

Coordinate tensors compose with existing +, *, and explicit Compute.fma to express bounded index-space kernels; they do not introduce arbitrary per-element control flow or implicit device authority.

Strict numerics use IEEE binary64 round-to-nearest, ties-to-even, with gradual underflow. Runs save and restore the embedding thread’s floating-point environment, including rounding and exception flags, on success and failure. They do not reassociate source parentheses or contract multiply-plus-add; Compute.fma rounds its fused operation once. Both reduction forms visit logical coordinates in increasing order, starting at positive zero. Arithmetic NaNs have the fixed quiet bit pattern 0x7ff8000000000000 on both providers. Arithmetic retains IEEE infinity and signed-zero behavior; data movement (view, slice, stride, own, and broadcast) preserves all input bits, including NaN payloads. SIMD lanes and non-multiple tails obey the same rules. Strict is the default.

Explicit numeric policy

Compute.relaxed(tensor, reassociate, approximate, reproducible, numerator, denominator) wraps the returned tensor to set the whole kernel’s numeric policy. Flags are constant Bool values; the absolute tolerance is a pair of uint32 integer constants with a nonzero denominator. Immutable metadata bindings are accepted. For example:

return Compute.relaxed(Compute.reduce_sum(input), true, false, true, 2, 1);

The profile must wrap the final returned tensor, not an intermediate subtree; there is at most one local policy declaration. A compute message can call another compute message only when their complete numeric profiles agree, including tolerance and reproducibility. This also applies after package linking. A default strict caller never implicitly adopts a relaxed callee’s policy, and a relaxed caller cannot weaken a strict callee.

Reassociation permits a fixed balanced tree for full and axis reductions, split at floor(count / 2) in logical order. Approximation permits finite outputs within Float32 range to round through Float32. These independent permissions do not enable implicit FMA contraction. Every candidate element is compared with the strict reference result: its absolute Float64 difference must be at most the declared tolerance. Strict zero signs and nonfinite bit patterns must match exactly. If any element fails, the entire output falls back to the strict result. Zero tolerance therefore preserves strict results. Reference-evaluation failure is an error, never unchecked relaxed success. This preview evaluates a strict reference for bounded relaxation; it makes no speedup claim. reproducible=true uses identical deterministic algorithms on both providers; false permits, but does not require, nondeterminism.

spec/extensions/core1-compute-policy.json allocates Schema 2.23 / ZLA2 1.15, compute opcode 13 and semantic kind 29. The node retains all policy metadata; the checked call retains all six ordered operands. Deserialization re-lowers the tree and checks the node, message numeric profile, and linked policy boundaries. Reflection for 2.23 modules exposes numeric_policy, including permissions, tolerance, reduction order, reproducibility, and fallback. Earlier modules retain their exact reflection bytes. Fractional tolerance formatting is independent of the embedding thread’s rounding mode and restores its floating-point environment, including on error. zl_zlm2_wire_schema_v5(23, …) and zlc zlm2-schema --minor=23 expose the new descriptor; v4 still stops at 22 and every earlier descriptor is unchanged. The remaining compute benchmark promotions are still being completed.

The separate allocation in spec/extensions/core1-compute-dataflow.json selects ZLM2 2.22 with ZLA2 1.14 only for modules using these operations. Schema 2.22 leaves all earlier envelope layouts unchanged. Compute rows remain 20 bytes; semantic kind 28 retains the intrinsic call and its ordered tensor/metadata operands. Deserialization reconstructs the region from the checked tree and rejects differing opcodes, metadata, references, outputs, or numeric policy, even when the outer checksum is valid.

zl_zlm2_wire_schema_v4(22, …) and zlc zlm2-schema --minor=22 expose the read-only descriptor. Older APIs retain their closed minor ranges and older descriptor bytes. The CLI’s default remains 2.20. Modules can combine the new compute operations with 2.21 Dynamic matching without backporting either feature into older layouts. This is still a preview, not stable Core-1.

Wider checked-kernel follow-up (ZER5-228)

The 2026-09-09 audit leaves ZER5-228 in Icebox pending its named ZER5-227 typed domain-result/host-boundary prerequisite. ZER5-25’s bounded Float64 profile remains delivered. The following inventory separates that profile from the remaining typed and structured-kernel work; it does not allocate new types, layouts, syntax or providers.

Surface	Current implemented boundary	Remaining extension work
Element carriers	Float64 tensor/view inputs, outputs and arithmetic	Explicitly selected wider element tranches with exact type/width/preset semantics; Float32 and Int32 probes currently reject
Rank/layout/shape	Ranks 0–8, RowMajor/ColumnMajor, runtime extents in native shape descriptors and constant source metadata	Ordinary checked Shape values and explicitly bounded shape/layout operations; not unrestricted dependent types
Tensor/index operations	Elementwise +/*, explicit FMA, broadcasts, views/slices/strides/owned copies, coordinate tensors, extent checks and ordered full/axis reductions	Structured index-space regions with checked iteration/control and typed indices; coordinate tensors alone are not arbitrary structured kernels
Kernel/result boundary	Exact source Device adapter and native status/DeviceError plus owned Float64 tensor	First-class checked kernel/result/error/host-handle composition coordinated with ZER5-227
Numeric policy/materializers	Strict binary64 and bounded explicit relaxation, scalar reference and independent Apple CPU SIMD	The same declared semantics for each new operation/type in both synchronous materializers; more providers are not a prerequisite

Reproduced admission limits

Public zlc check --edition=core-1 --preview=compute --diagnostics=json probes used clean archived compiler/library 3cf6d107e4b899500b0c79cd2461a87a866fa8b8, version 0.1.1-preview.4, Apple Clang 17.0.0 on arm64 macOS, LLVM disabled. Worktree b38bc4e00b had only subsequent documentation changes.

• A rank-one Float64 Compute.own(input) kernel compiles. Changing its tensor element to Float32 or Int32 rejects with ZL-COMPUTE-0001: the first compute profile requires Float64 tensor elements.
• An if/else choosing between two owned copies rejects with ZL-COMPUTE-0001: compute dataflow supports immutable bindings, checked intrinsics, tensor arithmetic, and return.
• A Shape<1> parameter and a tensor nested inside a source Result reject with ZL-TYPE-0001: type does not resolve to a supported scalar or enum. The latter fails while resolving the tensor payload, not after admitting a first-class Device result. These are carrier-boundary probes, not proposed complete new signatures.
• Rank nine rejects with ZL-COMPUTE-0001: tensor rank must be an integer from zero through eight; the rank bound remains intentional.

The existing Compute, admission, dataflow, strict-numeric, relaxed-policy and runtime-observation groups passed 9/9 in 3.94 seconds with 90-second per-test deadlines and --no-tests=error. The Apple-arm64 native tests execute both scalar and Apple CPU SIMD paths; the observation wrapper has two Python tests. This does not verify wider dtypes, LLVM, Metal or async execution. Complete logs and probe sources/results are retained under /private/tmp/zerglang-228-compute-audit.V6lEKP/.

Requirements for resuming

The parser and checked source-type reader explicitly require Float64, and the native tensor/view ABI carries double storage. Integer tensor operations cannot be obtained by retagging those buffers or using floating coordinate tensors as integers. Each new tranche needs an additive typed source/IR/ABI allocation with concrete element, shape, layout and ownership rules. Keep existing 20-byte dataflow rows, descriptor APIs and corpus bytes unchanged.

Start with public behavioral failures, then implement independent synchronous reference and Apple SIMD execution for every newly admitted operation. Cover zero extents, nonmultiple tails, invalid dimensions and index bounds, shape changes, input aliasing and independent owned outputs. Do not infer storage size or lifetime from a C pointer/stride descriptor. Retain exact integer width/preset arithmetic and explicit conversions; coordinate applicable scalar carrier work rather than silently treating an integer as Float64.

Strict floating operations must preserve specified order, explicit versus implicit FMA, NaNs, signed zero, underflow and the caller’s thread FP environment on success and failure. Relaxation requires the explicit checked permissions and tolerance, not a provider-dependent default. Add package/artifact and malformed-region checks, generated shape/order/identity properties and behavior-mapped mutations for the new semantics. Extend ZER5-241’s bounded canonical snapshot/ZDE representation and tests for new first-class runtime state; the current synchronous Float64 observation profile is not evidence for new carriers.

This documentation-only audit uses the test-first/mutation exception. It makes no new implementation, schema, provider, corpus promotion, publication or stable-activation claim.