This release bundles the full GPU substrate that the auto-emission
pipeline rests on: per-op Metal kernels, the bf16 numerics regime that
unlocks stable 10k-step training, the JIT compile foundation, two
hand-fused kernels, and the DAG matcher + emitter that drive them.

Auto-emission pipeline

• `stdlib/jit_node.rail` — JIT op-DAG types (`JitNode`, `TracedTensor`)
+ tape primitives + `jit_nth`. Pure-DAG module with no Tensor or
transformer dependency, so codegen consumers can import without
pulling the training stack.
• `stdlib/jit_tape.rail` — execution tracers (`jit_leaf`,
`traced_rmsnorm`, `traced_matmul`) layered on top of jit_node.
• `stdlib/jit_match.rail` — DAG matcher. `walk_tape` returns a list
of `FuseMatch` records (`FuseRmsQKV`, `FuseSiluHad`) in tape order,
identifying subgraphs that fit known fusion shapes.
• `stdlib/jit_emit.rail` — MSL emitter. `emit_msl_for_match` takes
`(tape, FuseMatch)` and returns the kernel source. Stubbed against
known patterns today; v5.2+ will replace with shape-parameterized
codegen driven by JitNode data.
• `stdlib/jit.rail` — compile/dispatch shim. No longer owns MSL
text; `jit_compile_*` pulls strings from `jit_emit`. External API
unchanged for existing consumers.

Hand-fused Metal kernels

• `fused_rmsnorm_qkv` — RMSNorm + 3 matmul (Q/K/V) in one
threadgroup-per-row dispatch. Exports Q | K | V | rstd | LN1 from
a single packed buffer (`4*SEQ*D + SEQ` floats); rstd and LN1 are
kept for backward. 4 dispatches → 1. 35× faster than the
per-op chain at training shapes (seq=512, d=64).
• `fused_silu_hadamard` — SiLU(gate) * up in one elementwise
dispatch. Exports h_act | sigmoid(gate) (`2*N` floats); sigmoid
is kept for backward. 18× faster than the per-op chain.

JIT compile foundation

• `tgl_jit_compile_from_tmp_file` — Metal's `newLibraryWithSource:`
driven from a Rail-emitted `.metal` file. Returns a pipeline ID
cached in `g_jit_pipes` for reuse across steps.
• `tgl_jit_dispatch_1in1out` / `tgl_jit_dispatch_2in1out` /
`tgl_jit_dispatch_rmsnorm_qkv` / `tgl_jit_dispatch_silu_hadamard` —
per-pattern dispatchers with f64↔f32 host staging.

Per-op GPU kernels

• `tgl_rmsnorm_save_f64` (1.8× over CPU at training shapes)
• `tgl_rope_apply_f64` (7× over CPU)
• `tgl_silu_fwd_f64` (19× over CPU)

Per-op wins translated to ~2% per-step at training shapes — confirms
fusion (not per-op throughput) is the real ceiling, which is why the
JIT pipeline above is the load-bearing thesis. See
`rail-gpu-fused-ops-2026-05-14` for the bench breakdown.

bf16 numerics regime

• `tgl_matmul_bf16` + `matmul_bf16` Rail wrapper. bf16 has f32's
exponent range, so it sidesteps fp16's step-2759 NaN cliff
(`rail-bf16-stable-10k-2026-05-14`). Training scripts default to
forward bf16 with f64 on embedding + LM-head + backward.

Training scripts (chunked-corpus sampler, 2-block d=64)

• `tools/train/lm_v3_chunked_bf16_full_long.rail` — bf16 forward,
10k-step stable, ~40% wall under f64 baseline.
• `tools/train/lm_v3_chunked_jit_long.rail` — same architecture, Q/K/V
+ SwiGLU run through fused JIT'd kernels. 200-step matched-seed
pilot vs bf16 baseline: trajectory shape preserved, no NaN, both
converge. Wall-clock bench (3×3 alternating runs): 2.85%
step-throughput improvement over baseline at seq=512 d=64 d_ff=192.
• `tools/train/lm_v3_chunked_fp16_attn_f64_long.rail` — falsification
experiment ruling out attention as the fp16 culprit
(`rail-fp16-attn-f64-falsified-2026-05-14`).

Tests + benches

• `tools/test/jit_kernel_smoke.rail` — Phase 0: Rail-emitted MSL
JIT-compiles + dispatches (4/4 silu values).
• `tools/test/jit_tape_smoke.rail` — 9-node DAG construction with
shared parent (the QKV fusion signal).
• `tools/test/jit_fused_qkv_smoke.rail` — numerical parity vs
per-op chain (max diff 1.67e-6, f32 floor).
• `tools/test/jit_silu_hadamard_smoke.rail` — numerical parity
(max diff 1.5e-8).
• `tools/test/jit_block_integration_smoke.rail` — both kernels
inside one block forward; rstd / ln1 / sigmoid parity all GREEN.
• `tools/test/jit_dag_match_smoke.rail` — DAG matcher (5/5).
• `tools/test/jit_emit_smoke.rail` — MSL emitter (4/4).
• `tools/test/gpu_fused_ops_smoke.rail` — per-op kernel parity.
• `tools/bench/jit_fused_qkv_bench.rail` — fused vs unfused at
training shapes.
• `tools/bench/transformer_fused_ops_bench.rail` — per-op GPU vs CPU.

Stability

• 140/140 compiler test suite still green.
• 2-pass byte-identical self-bootstrap unchanged (this release adds
stdlib + foreign decls + Metal sources; the compiler core is
untouched).

Fixes

• `stdlib/file.rail`: `foreign fopen path mode -> int` (`084791f`).
`fopen` returns a file descriptor, not a `FILE*`. Declaring it as
`ptr` bypassed Rail's tagging and tripped a polymorphic untag for odd
fds (3 → 1, i.e. stdout). Corrected the foreign return type.
• runtime `_fopen`: unwrap path + mode before `open(2)` (`95d81de`).
Wrapped Rail strings carry their `ptr` at the heap header, so `open()`
saw byte `0x09` (the header tag) as the path. `_fopen` now calls
`_str_unwrap`, matching the existing `_rail_read_file` contract.
Closes the argv-vs-literal path bug.

Attestation

• `tools/attest/`: shell escape hatches retired (`bbda5dd`).
`attest.sh`, `sign_attestation.sh`, and `publish.sh` deleted.
`release_index.rail` replaces the Python heredoc in
`attest_release.sh`. `attest.rail` + `publish.rail` are now canonical.

Stability

• New seed `rail_native` (`3b89d0f5`) is at the 2-pass byte-identical
fixed point.

Codegen

• `arm64`: close the half-applied compile-fixes patch. `emit_x1`
large-immediate path, `emit_x1` global-`V` fallback, `O`-handler RHS
exclusion, and `?`-handler global-`V` exclusion. Self-compile fixed
point and test suite unchanged from the v5.0.0 baseline.

Attestation

• Backfill v4.0.0 / v4.0.1 / v4.1.0 release attestations —
previously tagged-but-unattested.
• `.gitignore`: whitelist `releases//rail_native.attestation.json`
so a new release can't silently lose that file to the `rail_native.*`
wildcard rule.
• `docs/RELEASES.md` — operational release runbook + 6 known gotchas.

Known limitation

• `attest.rail` still blocked on the `ftell` FFI bug, so attestation in
this release (including this release's own artifacts) still uses the
documented `tools/attest/attest.sh` shell escape hatch. Closed in
v5.0.2.

What ships

Built on top of v4 Phase 0–4b (encoder, Mach-O writer, ad-hoc
codesigner, assembler-text → Mach-O driver) with three new modules:

| Module | Lines | Role |
|---|---|---|
| `jit/arm64.rail` | +200 | 23 new encoders for the Linux mnemonic set: `ldrb`/`strb` (imm, reg-offset, post-index), `clz`, `neg`, `cmn` (imm + reg), `rev`, `rev16`, `fneg`, `frinta`, `fcvt s_d` / `fcvt d_s`, `tbnz`, `stp`/`ldp` pre/post-index, `add`/`sub` immediate, `asr`/`lsr`/`lsl` immediate (sbfm/ubfm aliases) |
| `stdlib/elf.rail` | 175 | `Elf64_Ehdr` + program-header writer for static aarch64 binaries; `elf_emit_tiny` (1 PT_LOAD R+X) + `elf_emit_full` (PT_LOAD text RX + PT_LOAD data RW with BSS via memsz > filesz) |
| `tools/v5/elf_asm.rail` | 567 | Section-aware ARM64 assembler + static linker. Two-pass scan: pass 1 collects section sizes + `(name, section, offset)` labels; caller resolves to virtual addresses via layout; pass 2 emits bytes with `adrp` / `:lo12:` symbol resolution. Handles `.text` / `.data` / `.bss` / `.rodata` / `.section __DATA,__mod_init_func` (skipped), `.quad` / `.byte` / `.long` / `.ascii` / `.asciz` / `.space` / `.comm` / `.p2align` / `.align`, plus the writeback `stp` / `ldp` variants and the `adrp` + `add :lo12:` / `ldr [base, :lo12:]` / `str [base, :lo12:]` Linux-ELF symbol-load idiom |
| `tools/v5/compile_elf.rail` | 30 | Tiny driver (single segment, no data). Useful for exit-code-only smoke tests |
| `tools/v5/compile_elf_full.rail` | 80 | Full driver: source `.s` → 3-pass pipeline → multi-segment ELF. Patches `e_entry` to `_start` if present |

Plus 23 new encoder verifications wired into `jit/test_encoders_v5.rail`
(31/31 byte-identical against canonical `as` + `objdump`).

Verified end-to-end on aarch64 Linux (Pi Zero 2 W via Tailscale)

| Program | ELF size | Result | Substrate exercised |
|---|---|---|---|
| `tools/v5/exit42_linux.s` | 132 B | exit 42 | smallest valid static ELF |
| `tools/v5/fib_linux.s` | 204 B | `exit(fib(10)) = 55` | function calls, `stp`/`ldp` pre/post-index writeback, conditional branches |
| `tools/v5/hello_linux.s` | 4105 B | prints `"v5 lives\n"`, exit 9 | `adrp` + `add :lo12:`, `.data` segment, raw `write` syscall |
| `tools/v5/bss_test_linux.s` | 4096 B | BSS counter loop, exit 7 | `.bss` segment, `.space N` reservation, BSS memsz > filesz |

Each binary's `.text` bytes are byte-equivalent to canonical
`as` + `ld` output for the same source. Pipeline invokes neither
external assembler nor linker.

compile.rail Linux pipeline hardening (precursor to substrate integration)

Two long-standing bugs in `build_linux` fixed:

• Duplicate-symbol awk strip gate dropped. The macOS-emitted
runtime stubs (`_rail_print`, `_rail_print_float`, `_rail_shell`,
`_rail_arena_init`, `_rail_malloc_chain_drain`) were not being
stripped before concatenation with `tools/linux_libc.s` (which
redefines them via raw syscalls). Result: `as` would reject the
combined `.s` with redefinition errors on both macOS-cross and Pi
native builds. Strip list extended to cover them and the macOS-only
gate removed.
• `.section __DATA,__mod_init_func` block stripped. The macOS
constructor block (`.quad _rail_arena_init`) has no ELF analogue and
was triggering `as` errors at the section line. New awk pass drops
the block on Linux.
• `linux_libc.s` gains `_memcpy` (raw byte copy) and `_fmod`
(truncation-toward-zero double modulo) — the two libSystem references
Rail's compiler emits that had no Linux-side definition. Sufficient
for a clean assemble + link of `compile.rail`-generated Linux output.

Self-compile fixed point preserved (round-to-round byte-identical).
Test suite unchanged at 136/140 — the 4 `tensor_*` failures predate v5
and trace to a missing `tools/metal/libtensor_gpu.dylib` artifact, not
to v5 changes.

Substrate-thesis scope statement

v5.0 claims: Rail emits aarch64 Linux ELF binaries via the pure-Rail
toolchain for the subset of ARM64 assembly emitted by compile.rail's
Linux backend. The new modules handle every mnemonic + addressing
mode that appears in the canonical `.s` for any Rail program, including
the full `tools/linux_libc.s` runtime body.

What is deferred:

• Pi self-host of `rail_native test` via the new toolchain. The
current `.s` allocates ~1.2 GB of BSS for the young-generation GC,
which exceeds Pi Zero 2 W's 512 MB physical RAM. Both canonical
`as` + `ld` and v5 pipeline produce semantically equivalent binaries
that share this limit. Path forward (v5.1): heap-size configuration
knob in `build_linux` + bigger Linux test target.
• macOS Mach-O end-to-end with dyld stubs. Phase 4b's
`tools/v5/compile_macho.rail` covers the libSystem-free subset
(e.g. exit-code-only programs). Stub-aware Mach-O — `LC_LOAD_DYLIB`,
indirect symbol table, `__stubs`, `__got` / `__la_symbol_ptr`,
bind-opcode stream — is roughly 1500 more lines. Tracked as v5.2.

Tag-readiness checklist

• [x] `compile.rail` Linux output of a real Rail program traverses the
new pipeline → byte-equivalent ELF to canonical
• [x] Linux ELF substrate verified on real aarch64 hardware (Pi)
• [x] Encoders byte-verified against `as`: 89 + 56 + 31 = 176 total
• [x] No regression on `./rail_native test` (136/140; 4 pre-existing)
• [x] No regression on `./rail_native self` byte-identical fixed point
• [x] CHANGELOG.md v5.0.0 entry (this section)
• [x] Leak guard CI still passes
• [ ] macOS dyld-stub path — deferred to v5.2

CI + leak-prevention (B1)

• New workflow `.github/workflows/leak-guard.yml` — every push and PR
is grep-scanned for the operator-recon pattern set (Tailscale IPs,
internal SSH targets, home-directory paths, internal Slack channel
IDs). Fails the build on any hit. Per-line opt-out via the comment
marker `leak-guard-allow`. CHANGELOG.md and the guard file are
excluded.
• ci.yml triggers extended to include `next` branch and `v*` tags.
Test-count assertion generalised from hardcoded `137/137` to any
matching `N/N` (master is 137, next is 140, future may grow).
• .gitignore — explicit ignores for `.mcp.json`, `.ledatic/`,
`.fleet/`, `*.pre-*`. Closes the casual-`git add` recurrence path
for the v4.0.1 leak class.

Branch hygiene (B2)

21 remote branches deleted from origin:

• 18 `feat/*` branches fully merged into `next` (security A/B/C lanes,
x86 conformance harness, x86 runtime extensions, JIT fixes, docs
refresh, auto-deploy, punch-list integration).
• `jit` (merged into `next`).
• `track-mhd-kernel` (merged into `master`).
• `history-scrub-prep-2026-05-12` (unused experimental branch).

Remaining: `master`, `next`, `half-s2-kernels` (open compiler work),
`compound/exp-008-bytes_to_str` (halted POC artifact). Down from 26
branches to 4.

Doc pruning (B3)

~104 operator session-handoff files removed from the public tree:

• `docs/plans/` (74 files) — operator session-planning notes
(SESSION_HANDOFF_*, PROMPT_SESSION_*, WEEK_PLAN_*, PHASE_*, etc.).
• `notes/` orphan files (12).
• `docs/handoffs/` orphans (8).
• `jit/` operator notes (9) — SCRATCH, CONTINUATION, SESSION_PROMPT*,
AGENT_DRY_RUN, NEXT_STAGES, closures, floats.
• `SECURITY_HANDOFF.md` — internal Fort Knox punch list (the public
policy lives in `SECURITY.md`).

Kept: docs referenced from CHANGELOG (`notes/bootstrap_convergence_audit_*`,
`notes/phase3_external_pilot_pitch_v0`); `jit/` code + README + CHANGELOG;
`docs/sessions/` versioned handoffs (CHANGELOG-linked).

Dead-code pruning (B4)

• Deleted `tools/autocatalyst_v4.rail` (broken — referenced runtime/llm.o
which never landed in-tree, flywheel-v1 artifact).
• Deleted `tools/ac_dashboard.rail` (orphan, flywheel dashboard).
• Removed Razer3070 live-path references (decommissioned 2026-04-17):
- `tools/apps/control.rail` — Razer fleet row + curl status segment.
- `tools/fleet/fleet_display.rail` — razer_status/razer_iter/razer_max/
razer_ping/razer_loss + RAZER row in the SPI-LCD render.
- `tools/mcp/rail_mcp.rail` — tool_fleet_status no longer SSHes for
nvidia-smi / v6_train.log; description updated.
- `tools/compile.rail` — compile_x86 fallback message no longer
recommends scp-to-Razer; suggests cross-tools or native host.
Byte-identical bootstrap preserved.
• `CLAUDE.md` target list: 'Linux x86_64 (Razer WSL)' →
'Linux x86_64 (cross-compile)'.

Structure pass (B5)

• Deleted 7 docs with no CHANGELOG or code references:
`RAIL_ENGINEER_PROMPT.md`, `flywheel-data-quality.md`,
`flywheel-world-research.md`, `cascade-training.md`,
`rail-plasma.md`, `railgpt-from-scratch.md`,
`self-improving-playbook.md`.
• Flattened `docs/handoffs/` (down to a single entry after B3 prune):
`docs/handoffs/2026-05-02.md` → `docs/handoff-2026-05-02.md`.

README polish (B6)

• Badge: v3.0.0 → v4.0.0; tagline → "Substrate maturity".
• Intro paragraph adds the v4.0.0 substrate-maturity lede (dual-backend
parity, JIT in Rail, 30/30 hard-bench, multi-witness attest).
• New Releases section entry for v4.0.0 + a v4.0.1 sanitization note.
• History table extended: 7 new rows spanning v3.7.0 → v4.0.1
(previously jumped from v3.0.0 to v2.23.0).

Verification

• Leak guard: 0 hits across tracked files for the union pattern set.
• Test suite: 140/140 on the v4.1.0 tree (modulo the documented
`/tmp/rail_out` orphan-process collision when run concurrently with
another `rail_native test`).
• `git push` on next: clean fast-forward; tag v4.1.0 cuts at 6 commits
past v4.0.1, all CI-green via the new workflow.

What was scrubbed (~110 files)

• Hard SSH targets in `tools/attest/*.sh`, `tools/fleet/*.sh`,
`tools/fleet/fleet_display.rail`, `tools/apps/control.rail` — replaced
with `<witness-user>@<witness-host>` / `<peer-user>@<peer-host>`
placeholders. Callers must supply real values via environment.
• Tailscale IPs (`100.87.231.45`, `100.79.50.108`, `100.120.203.70`,
`100.109.107.54`, `100.109.63.37`) replaced with role placeholders
(`<witness-tailscale-ip>` etc.). Tailscale CGNAT-range addresses aren't
reachable from the public internet, but they were operational recon.
• Home-directory paths (`/Users/ledaticempire/`, `/Users/user/`,
`/home/zemog/`) replaced with `~/` or `<HOME>` placeholders across
source, docs, `docs/plans/`, training fixtures, and Objective-C dispatchers.
• Operator service files — `tools/fleet/witness.service`,
`tools/fleet/witness_push.service`, `tools/fleet/com.ledatic.*.plist`
renamed to `*.example` with `<user>` / `<HOME>` placeholders. Existing
install scripts already substitute these at install time.
• Operator MCP config — `.mcp.json` removed from the tree. It was an
operator's Claude Code MCP wiring (path to `tools/mcp/rail_mcp.py`),
not a build artifact; the MCP server still runs locally with a
per-user `.mcp.json` outside the repo.
• Slack channel IDs / DM names in `CHANGELOG.md`, `README.md`,
`stdlib/slack_client.rail` docblock, `docs/sessions/HANDOFF_v3_6.md` —
`D0ATHQ1BQD7` and `brockbro2` replaced with `<DM_CHANNEL_ID>` and
`<test-dm>`. Slack IDs don't grant access on their own, but these
were the only remaining specific-channel references in the public surface.

What was intentionally NOT scrubbed

• `reillygomez13@icloud.com` in `tools/deploy/gen_*.rail` — public
contact email rendered onto ledatic.org pages; meant to be public.
• Commit messages in the v4.0.0 surface — rewriting history would break
existing clones for a topology-recon leak, not a credential leak.
The forward tree is clean; git history retains the originals.
• `~/.ledatic/` path convention — generic project-named subdirectory,
not operator-specific.

Verification

```
git grep -E "100\.(87|79|109|120)\.|zemog@|user@100|reillygomez@|\
ledaticempire@|/Users/ledaticempire|/Users/user|/home/zemog|\
Detro|D0ATHQ1BQD7|brockbro2"
```
→ empty across tracked files.

Why a patch release

v4.0.0 carried operator-recon strings inadvertently included via the
multi-witness publisher work on the `next` lineage. The `master` lineage
was scrubbed in `c4f6050` (2026-05-06) but `next` hadn't received the
same pass. v4.0.1 brings the substrate-track tree to the same hygiene
standard.

No public API breaks; the major bump is a positioning marker, not a SemVer surface
change. The substrate-not-model thesis (`docs/site/jit.md` + `tools/bench/repro_30of30.sh`
+ `https://ledatic.org/verify/<id>` + this entire shipping volume) is now publicly
defensible without hand-waving.

What "substrate maturity" means here

• A frontier model + a 1KB Rail spec compiles 30/30 on a held-out hard-bench,
reproducible by any partner with an API key. (`f2c88b2`)
• The compiler is genuinely self-hosted on two backends, each with full
same-bug-class parity for the 9 binary ops across both operand orderings.
(ARM64 140/140, x86_64 136/136. `9e16aa7` + `c9de6e9` + `b223960`.)
• The verifier is a library, not a tool — `import "jit/grade.rail"` and a Rail
program can compile + execute new Rail at runtime in the same process. (`07366ea`)
• The provenance pipeline is multi-witness Ed25519, browser-verifiable, with
pulse_id binding closing the prior session-replay gap. (`f732176` + `2ada525`)
• A standalone single-file verifier ships at deterministic SHA — anyone can
grade reports without trusting the original signer's infrastructure.
(ledatic-site `8f5b928`)

Compiler & runtime

• Concurrency v1. Typed channels + select over a pthread-backed runtime.
`import "stdlib/concurrent.rail"` exposes `rc_chan_make`/`rc_chan_send`/
`rc_chan_recv`/`rc_spawn`. int64-only values in v0; 9 + 8 falsification tests
green. (`4623e72`)
• Auto-memo fib silent-corruption — FIXED. `compile.rail:2593` memo_store emit
was double-untagging x19 (which was already untagged in the prologue). Writes
went to `memo[n/2]` while reads keyed `memo[n]`; pairs collided on shared slots.
`fact` escaped because it has only one recursive call and never reads back; `fib`
failed because two recursive reads collide. `fib(10)` was returning `293886`
instead of 55. Found by the JIT REPL agent comparing shell-compile vs JIT on
the same program; one-line fix using x19 directly as the index register.
Falsification at `tools/test/auto_memo_fib_correctness.rail`. (`b89a60b`)
• Nullary-LHS binary-op bug — FIXED. Any binary op with a top-level nullary
LHS expression was using the prior `x0` instead of the freshly-computed value.
`compile.rail::emit_x1` fast-path patched; 2-cycle bootstrap byte-identical.
Was the root of the multi-week "CPU substrate is mysteriously wrong" arc; closes
the substrate investigation. (pre-window but retroactively notable)
• `_rail_join` O(n²) — FIXED. Runtime asm rewrite of join: 53.5 GB → 267 MB on
the 8×100K-float dump pattern (200× memory, 120× wall-clock). Diagnostic
harnesses kept at `tools/diagnose/dump_pattern_smoke.rail` +
`tools/diagnose/dump_bisect.rail`. (pre-window)
• Same-bug-class parity sweep — CLOSED on both backends, both orderings.
Each of 9 binary ops (`+`, `-`, `*`, `/`, `%`, `<`, `>`, `<=`, `>=`) now has
symmetric handling for `(int, float)` and `(float, int)` operand orderings.
- x86 `(int, float)`: inline emit `check_both` + `.L<op>_mixed_if`. (`b223960`)
- x86 `(float, int)`: already covered by `b223960`'s symmetric routing.
- ARM64 `(int, float)`: inline emit `check_both` + `.L<op>_mixed_if` mirror.
(`9e16aa7` + `d4e3696`)
- ARM64 `(float, int)`: `.L<op>_mixed_fi` mirror that takes raw-f64 LHS via
`fmov d0, x1`, untags+converts tagged-int RHS via `asr` + `scvtf`. For
`_rail_add` specifically the dispatch is inserted at the top of `.Ladd_heap`
so the string-append path remains correct. (`c9de6e9`)
- 9 + 9 = 18 falsification tests at `tools/test/<op>_{int_float,float_int}_ordering.rail`.
• 3-movk integer literal codegen. `emit_load_int` at `compile.rail:829` now
emits `movz` + up to 3 `movk` chunks (bits 0-15, 16-31, 32-47, 48-63) with zero
chunks at ≥#32 skipped, plus a symmetric `movn` + `movk` path for negatives.
`k16`/`k32`/`k48` computed via `shl 1 N` so constant-folding doesn't bake the
64-bit literal as a constant the seed can't emit. Regression tests `t132`/`t133`/`t134`.
ARM64 floor: 137 → 140. (`872424b`)
• Bootstrap convergence audit — published. The "bootstrap doesn't converge"
claim was falsified: it's a 2-cycle limit cycle. gen0's shipped runtime asm
doesn't necessarily match what gen0's source emits, so cycle 1 typically differs;
gen2 always lands the byte-identical fixed point. See
`notes/bootstrap_convergence_audit_2026-05-13.md`.
• Diagnostic surface. `strip_trailing_ws` helper replaces `trim` at 4 multi-line
`as`/`ld` result sites so undefined-symbol errors and assembly errors no longer
silently truncate to the first line. `shell_quote_arg` + `shell_quote_join` +
`join_args_quoted` preserve quoted argv through `./rail_native run`. (`b7f267a`,
`23fa5fd`)

Self-hosted JIT — now a first-class tool

• Public documentation. `docs/site/jit.md` (109 lines): substrate-honesty
framing, end-to-end `test_codegen` demo with output, honest capability + limit
table, file map for inspection. Linked from `docs/site/index.md`. Public surface
at `https://ledatic.org/rail/docs/jit.html` once deployed. (`def1bcd`)
• JIT-first REPL at `tools/repl_jit.rail`. ~3000× per-line vs shell-compile
(0.1 ms median JIT-line vs 319 ms shell-line). Persistent definitions across
lines via string-concat buffer; every line re-lowers the full defs + expr at
~0.4 ms. One-time ~21 s REPL compile mitigated by pre-compiled binary at
`/tmp/repl_jit_bin`. 11/11 smoke green including JIT-hits, ADT-fallback,
parse-error path. `tools/repl.rail` (the shell-based REPL) untouched. (`6ab2666`)
• JIT-grade fast path at `tools/bench/jit_grade_batch.rail`, opt-in via the
`--jit-fast` flag on `tools/bench/repro_anthropic.py`. Modest 1.18× grading-only
speedup (101.75 s → 86.18 s) — the public bench is API-bound, so default driver
stays shell-only. Lower-hit 14.2 % on synthesized completions, 40 % on canonical
hand-curated shapes. Soundness finding the falsification test earned:
`jit_can_lower=1` was UNSOUND as a fast-path predicate — JIT recognizes builtins
(`str_eq`/`str_len`/`str_at`/`is_nil`) that `rail_native` rejects; naive routing
would have silently marked fail cases as passes. `contains_unsafe_jit_builtin`
guard added; 26/26 parity. The bug was simultaneously fixed at the JIT source
itself in `jit_can_lower`. (`163521e`)
• In-process agentic loop at `tools/agent/jit_loop.rail`. Single Rail program
that calls the Anthropic API via `stdlib/anthropic_client.rail`, JIT-compiles
the response via `jit/grade.rail`, executes, returns. Offline smoke green (fib 10
→ 55, fact 6 → 720). 5/5 in-subset programs JIT cleanly; 5/5 out-of-subset
reject loudly with diagnostics — hard verifier, no silent wrong answers. (`07366ea`)
• JIT lower cluster fixes. Three closing bugs from the JIT integrations:
multi-line `let` inside fn bodies (`parse_fn_body` now `skip_nls`'s before body);
`st_fail` no longer prints (uses mutable arr cell pattern from
`stdlib/https_session.rail:64`); `jit_can_lower` substring-checks for unsafe
builtins. (`09263e6` + `ef88a42` + `1226600`)

Substrate hard-bench — publicly reproducible

• F-53 closure. `tools/bench/substrate_hard_bench.rail` +
`tools/bench/repro_anthropic.py` + `tools/bench/repro_30of30.sh` +
`tools/bench/README.md`. Two reproduction paths: Anthropic API (~$15–20 / run,
~15–25 min) and local MLX/vLLM (any 100B+ open-weight on an OpenAI-compatible
endpoint). Partners can now run the 30/30 bench without Studio access. (`f2c88b2`)
• The empirical claim it backs: a frontier model + 1KB Rail spec scores 30/30
on a held-out hard-bench, beating a fine-tuned ensemble. Every band 5/5; 15.4
min wall-clock; multi-witness Ed25519 signed; verifiable at `/verify/<id>`.

Provenance — v2 with browser-side verify

• Pulse_id binding. Attestation v2 binds `pulse_id` so old attestations
cannot be replayed against new pulses. TOCTOU on weights closed via re-hash
inside the signing transaction. (`f732176`)
• Standalone verifier ships from the ledatic-site repo as a single-file
executable with a deterministic SHA. Third parties can grade reports without
trusting Studio infrastructure. (ledatic-site `8f5b928`)
• Crypto stdlib hardening. 2 CRITICALs + 7 HIGHs closed via the 2026-05-12
parallel security-audit pass. Crypto stdlib + provenance + fleet posture all
tightened. See memory entry `security_audit_2026-05-12`. (`bf7ff54`,
`f065e0e`, `2ada525`, `39e02fe`)
• DNS-match short-circuit fix. `cv_dns_match` wildcard-vs-equal-length
path patched so SAN matching can't bypass on edge inputs. (`47ca7f1`)
• Fleet bind to Tailscale IPv4. `fleet_agent_v3` no longer listens on
`0.0.0.0`; bound to the Tailscale IP only. (`1de6cff`)

x86_64 backend — full conformance

• 136/136. From the prior 71/79 baseline, the 2026-05-12 punch-list (Agents
A–E in parallel) drove the backend to 100 % conformance via:
- Bit-op runtime + `char_from_int` + `byte_at`/`set` (`60cd486`)
- 5 `_rail_str_*` runtime symbols + harness 79→127 (`e4415a9` + `7588652`)
- Float-arr + `parse_float` + `to_int` (`04625f2`)
- Thread runtime `_rail_spawn_thread` + `_rail_join_thread` (`d8623ff`)
- `null_safe_eq` codegen fix for `arr_init` vs literal-0 SIGSEGV (`17fb3af`)
- `_rail_str_append` strlen+memcpy instead of strcpy+strcat (`c30ff5f`)
- Foreign-call ELF prefix — bare `name@PLT` instead of Mach-O `_<name>` (`ba1d411`)
- Conditional-untag int args before foreign calls (`8cc8633`)
- SysV stack-passing for >6 args; callee prologue + caller pop + TCO writeback (`1aad573`)
- Linux `libtensor_gpu.so` stub with 33 no-op `tgl_*` symbols; harness links it (`c5bf567`)
• /tmp/rail_out.o race mitigated. `mktemp` for `.s`/`.o` intermediates so
parallel worktree agents on the same host don't silently clobber each other's
artifacts. (`b18fe40`)

Playground (in-flight, committed not deployed)

• Session A — pre-compile sanitizer + compile_server. (`4024334`)
• Session B + C — browser editor, Worker proxy, deploy script. (ledatic-site
`084249c`)
• Session C — staging deploy + recv-loop fix. (`1a2c88b`)
• The 16-gated `deploy_playground.sh` is committed but not run. Live URL
`https://ledatic.org/playground` not yet active.

Foundations 2-8 (parallel-v0 batch — 2026-05-11)

• Test runner at `tools/test/rail_test.rail` — convention-based discovery
via exit code + last-line `PASS`/`OK`.
• Diff fuzzer at `tools/fuzz/diff_fuzz.rail` — two-path differential eval
catches silent miscompilation. Int-only grammar today.
• Type-quirk lint at `tools/lint/check_quirks.rail` — Q001/Q002/Q003 codes
(het-list, high-arity, unwrapped float-return).
• Perf trace at `tools/trace/rail_trace.rail` — wall/CPU/RSS/page-faults/ctxsw
+ JSON sidecar.
• Pkg manifest at `tools/pkg/` — INI-style `rail.toml`; local-path deps in v0.
• Stdlib docs autogenerator at `tools/docs/gen_stdlib_ref.rail`.
• Public docs site at `https://ledatic.org/rail/docs/` — md→html build + Mini
post-receive hook for auto-deploy on push to allowlisted `next` branch.

What did NOT change

• Self-hosting model. `./rail_native` still compiles itself byte-identically
at the 2-cycle fixed point on ARM64. No build-tool dependencies added.
• Public API. No removed or renamed stdlib symbols. No CLI flag changes.
No `compile.rail` interface changes for downstream tooling.
• Verification protocol. Provenance v2 is backward-readable; v1 attestations
still verify (they just don't carry the `pulse_id` binding).

What is honestly not yet ready

• Phase 3 outreach has not been sent. The pitch v0 at
`notes/phase3_external_pilot_pitch_v0.md` includes the JIT proof-point and the
five-artifact substrate-honesty bundle, but no candidate partner has been
contacted from Ledatic.
• Playground deployment is staged (16-gated dry-run-able), not live.
• Industry adoption of substrate-not-model framing is the goal. This release
is the evidence package; the framing shift is still ahead.

Stats

• 216 commits since `v3.11.0` (174 non-merge + 42 merge commits)
• ARM64 floor: 137 → 140 hardcoded list, with 12 new sidecar tests in `tools/test/`
not yet auto-picked-up (9 float_int_ordering + 1 auto_memo_fib + 2 diagnostic)
• x86_64 floor: 55/60 → 136/136
• JIT tests: 6 → 9 (3 new cluster tests)
• Bootstrap: 2-cycle byte-identical, verified at every milestone

Migration notes (none required)

If you depend on `next` HEAD, you're already on v4.0.0. If you depend on a
v3.x tag from master, the v3.x lineage continues there separately — it carries
the brain/agent/attestation work, not the compiler/runtime track.

Compiler / runtime
• Float-TCO root fix. Re-added `body_has_float` guard to
`all_params_int` in `tools/compile.rail:1992`. Closes a 17-day silent
wrong-result bug introduced by commit `82516e4` (2026-04-13) that
caused tail-recursive float helpers (e.g. `rms_row_apply`) to
reinterpret float bits as ints in register-ABI calls, producing
garbage. Headline affected sites: RMSNorm CPU path, AdamW weight
decay, LayerNorm CPU backward. (`7752738`)
• Runtime-mmap arena (A1.P4). `RAIL_ARENA_MB` env var (default 1 GB,
scales to 4 GB+ via mmap). Replaces the fixed 512 MB BSS arena that
was bumping the macOS dyld static-data ceiling. envp passthrough via
`_rail_envp` so env vars reach `./rail_native run` child processes.
Long-context training (seq=2048+) now mechanically tractable on
macOS. (`7752738`)
• Diagnostic counters (A1.P5). `alloc_stats_snapshot` returns 17
ints now: per-class freelist misses (0–11), munmap_count (12),
mmap_large_count (13), arena_spill_count (14), gc_count (15),
arena_spill_bytes (16). Plus `RAIL_ARENA_TRACE=1` for stderr-emitted
spill events. (`7752738`)
• Parser multi-line compound expressions. Cons chains, nested calls,
list literals inside unclosed `(...)`/`[...]` now parse cleanly. Same
post-tokenizer pass routes both `tokenize` and `tokenize_with_pos`.
(`7752738`)
• `./rail_native quick`. 15 critical tests in ~5s, vs the full
suite's 10+ min. Use between code edits. (`7752738`)

Inference path
• Rail-native mixed-precision matmul. New Metal kernel
`matmul_f32x_halfw` (fp32 activations × fp16 weights → fp32, fp32
accumulator). Host wrapper `tgl_matmul_f32x_halfw_host` casts
f64↔f32 once at the GPU boundary; Rail-side surface stays in f64.
`stdlib/tensor.rail:matmul_mixed`. Primitive correctness:
`max_abs_diff = 0.00042` vs f64 reference (vs 0.00082 for the
all-fp16 path — 2× tighter). Byte-deterministic across 100+
sequential calls. New harness at
`tools/train/lm_infer_v3_mixed.rail`. Right substrate for d=384+
scaling; not the d=256 winner today (CPU+KV-narrowing remains
faster for current model). (`ee6bdce`)
• Parallel rerank wrapper. `tools/train/parallel_rerank.sh` fans
out N inference subprocesses concurrently with distinct seeds,
pre-compiling the harness once for amortization. Validated 7.1×
wall-clock at N=8, ~11× projected at N=20 — bench projection drops
from 2.25hr to ~13min for 30 prompts × N=20 rerank. `--bin <path>`
flag (added in v3.7.0 as a follow-on) lets orchestrators skip the
built-in pre-compile. (`ee6bdce`, `73043e2`)
• `tools/train/parity_check.sh`. Three-way diff harness running
CPU (f64), GPU half (existing v3_half), and GPU mixed (new) on the
same checkpoint+prompt+seed. Useful for reasoning about which
precision path is producing which degenerate argmax token under
undertrained models. (`ee6bdce`)
• `tools/test/sequential_matmul_half_test.rail`. Regression test
verifying `tgl_matmul_half_host` is byte-deterministic across 1000
sequential calls. Eliminates the "primitive corruption" hypothesis
for any future GPU-collapse investigation. (`7752738`)

Diagnostic infrastructure
• `RAIL_GPU_POOL_DISABLE=1` env flag in `tools/metal/tensor_gpu_lib.m`.
Bypasses MTLBuffer pool best-fit reuse, forcing fresh
`newBufferWithLength` on every acquire. Falsifies the standing
hypothesis that pool reuse caused GPU sequential-inference collapse;
with the flag set, collapse is byte-identical to baseline. (`7752738`)

Inference workaround
• `tools/train/lm_infer_cpu.rail:gen_loop` no longer calls `arena_reset`.
Eliminates a compiler-codegen interaction (between `arena_reset` and
multiply-add expressions in `float_arr_set`) that corrupted
`_rail_small_fl[0]` with the value being stored, surfacing as
SIGSEGV in `_rail_chained_malloc` on a subsequent allocation. Bug
was seed-deterministic (~50% of seeds at `--max 128 --k 10`), and
silently confounded all post-04-13 single-sample compile-rate
measurements. Workaround eliminates the trigger; per-iteration
intermediate tensors now accumulate in the bump arena, which the
default 1 GB easily holds for bounded inference runs. 30/30 stress
tests pass. The compiler-level fix remains open with a precise
one-line reproducer documented. (`f215039`)

Documentation
• `docs/SESSION_HANDOFF_2026-04-30_EOD.md` — full afternoon arc.
• `docs/SPUR_HANDOFF_2026-04-30.md`, `docs/MODEL_SESSION_HANDOFF.md`,
`docs/ROADMAP_2026-04-30.md` — morning arc + 6-month framing.
• `docs/RAIL_ENGINEER_SESSION_PROMPT_2026-04-30_NIGHT.md` —
forward-looking prompt for the engineer picking up the open compiler
bug + remaining substrate debt.
• Six new design notes: `arena-design.md`,
`arena-leak-fix-strategy.md`, `data-section-quirk.md`,
`backlog-deferred-design-notes.md`, `strict-typecheck-design.md`,
`garmin-research-notes.md`.

What was falsified (negatives)
• GPU sequential-collapse "MTLBuffer pool reuse" hypothesis —
falsified via `RAIL_GPU_POOL_DISABLE`. Collapse byte-identical with
pool off. Surviving cause: fp16 precision compounding across 22
matmul round-trips/token (intrinsic, not a fixable substrate bug).
• 2026-04-15 "10 MB/step leak" hypothesis — falsified by
`arena_reset` chain-drain test (10 cycles, byte-tight). The
allocator is sound; remaining leak suspects are GPU-side
(MTLBuffer pool) or `gpu_available 0` re-eval churn.
• Static 2 GB arena — tested, breaks dyld at link time. 1 GB is
the macOS BSS ceiling; runtime mmap (A1.P4) is the path beyond.

Memory entries
Fifteen entries in `~/.claude/projects/-Users-user/memory/` capture
today's earned knowledge: substrate findings, discipline rules
(`feedback_verify_removals`, `feedback_diagnostics_first`,
`feedback_honest_backlog`), the dylib investigation chain, the
mixed-precision and parallel-rerank specs, and the segfault
bisection.

• Undefined identifiers now fail at link time with a named symbol
(`_RAIL_UNDEFINED_IDENT_<name>`) instead of silently producing a
binary that segfaults at runtime. Codegen patched in both ARM64
and x86_64 V-node "undefined" branches. (`77c4f5f`)
• Parser accepts multi-line compound expressions (cons chains, nested
calls, list literals) inside unclosed `(...)`/`[...]` or before
strictly-greater-indented `(`/`[`. New `strip_nl_pp` post-tokenizer
pass routes both `tokenize` and `tokenize_with_pos` through the
same logic so error positions stay aligned. (`f4f3e07`)
• Byte-identical self-bootstrap verified (`md5 14af7d5d…`).

• `stdlib/https_client.rail` — `https_get` / `https_post` /
`https_get_url` / `https_post_url` renamed to
`https_get_unsafe_noverify` / `https_post_unsafe_noverify` /
`https_get_url_unsafe_noverify` / `https_post_url_unsafe_noverify`.
Function bodies unchanged; only the public names shifted.

• `stdlib/https_strict.rail` — the chain-walking drivers now own
the unsuffixed public names `https_get` / `https_post` /
`https_get_url` / `https_post_url`. The `_strict`-suffixed names
are retained for one release as thin delegating aliases; they
will be removed in v3.7.0.

• `stdlib/cert_chain.rail` — `cc_walk_chain` gained an SPKI-keyed
termination check in `cc_walk_at`. Each chain cert's
SubjectPublicKeyInfo DER is hashed and compared against the
trust store's pre-computed root SPKI hashes. A match halts the
walk immediately and treats the cert as trusted — which makes
cross-signed roots (the GTS R4 variant with GlobalSign as its
`issuer` field) validate cleanly even when the server's chain
doesn't stop at a name-matching root.

• `stdlib/pem.rail` — `pem_load_trust_store` now emits a 7-element
store (`[certs, lens, count, valid, sub_offs, sub_lens,
spki_hashes]`). The extra parallel arrays cache the Subject TLV
ranges and SHA-256(SPKI) digests of every root, so
`ts_find_by_subject` is a cached byte-equal loop and the new
`ts_has_spki_hash` is O(store size) with no per-lookup DER
reparse. On the macOS 128-entry store this drops a two-lookup
chain walk from ~60 s of parse overhead to sub-millisecond
lookups.

• `stdlib/asn1.rail` — new `asn1_find_spki` + `asn1_find_sub_spki`
finders return the TLV ranges for the SubjectPublicKeyInfo
SEQUENCE (and, in the combined form, the Subject Name range
too). Used by the trust-store loader for single-pass Subject +
SPKI extraction per root.

• `stdlib/slack_client.rail` — `slack_post_text` now calls the
chain-walked `https_post_url` default.

• `stdlib/anthropic_client.rail` — `anthropic_chat` explicitly
calls `https_post_url_unsafe_noverify` with a docblock pointing
at the blocker. `api.anthropic.com` chains up to GTS Root R4
(P-384), and one pure-Rail P-384 signature verify in the chain
walk takes ~90 s — past CloudFlare's handshake-idle budget, so
the strict default can't complete a request before the server
closes the socket. Moving `anthropic_chat` off the unsafe path
is queued behind a P-384 scalar-mult optimisation in v3.7.0.

Validation gates

• `./rail_native test` — 137/137.
• `./rail_native self` 2-pass → byte-identical fixed point.
• `tools/tls/https_strict_test.rail` — `https_get_url
"https://www.amazon.com/"` → HTTP 200 (DigiCert root chain, RSA).
• `tools/tls/cc_spki_probe.rail` — every pre-computed root SPKI
hash round-trips through `ts_has_spki_hash` (128/128 self-match).
• `tools/tls/mitm_chain_reject.rail` — a fresh self-signed
ECDSA-P256 leaf with `CN=api.anthropic.com` is rejected by
`cc_walk_chain` (status 0).
• Live Slack `chat.postMessage` via `slack_post_text` on the
chain-walked default → `ok=1`, HTTP 200.

Known gaps

• `https_get_url "https://api.anthropic.com/"` returns status 0:
the chain walker accepts the GTS R4 chain, but the one P-384
verify pushes total handshake time past ~90 s, and CloudFlare
closes the socket before the client can send its Finished +
request. Tracked for v3.7.0 (P-384 scalar-mult windowing /
precompute).
• `https_get_url "https://slack.com/"` bus-errors in
`hc_recv_response` on the 230 KB HTML body; unrelated to
v3.6.0 (pre-existing Rail list/string-concat behaviour on very
large bodies). Use a small API endpoint for chain-walked smoke
tests.

• `stdlib/https_client.rail` — `hc_read_random` reads urandom into
process memory via a shell pipeline (`dd | od -tx1 | tr`) instead
of an intermediate tmp file. No functional change to callers;
live chain-validated GET to `www.amazon.com` still returns 200.

• `stdlib/http_server.rail` — `serve_static` returns `400 Bad
Request` on any request path containing `..` or `\` before
resolving against the server root.

Also adds a note above the non-strict HTTPS drivers pointing
production callers at `https_get_url_strict` / `https_post_url_strict`
in `stdlib/https_strict.rail` for chain-walked verification.

Validation gates

• `./rail_native test` — 137/137.
• `./rail_native self` 2-pass → byte-identical fixed point.
• `https_get_url_strict "https://www.amazon.com/"` → HTTP 200.

What landed

• Canonical curve constant `ed_d_bytes` — `(-121665 *
modinv(121666)) mod (2^255 - 19)`, LE-encoded,
`a3785913ca4deb75abd841414d0a700098e879777940c78c73fe6f2bee6c0352`.
The v3.3.0-handoff band-aid `ed_strip_ws` is gone.
• Scalar-mult (`ed_sm_iter`) and field exponentiation
(`ed_pow_bytes_iter`) flattened from mutual recursion (A→B→A) to
single self-tail-recursive drivers using `bit_total = byte_idx*8
+ bit_idx` as a decremented counter. Rail doesn't TCO mutual
recursion, and the 512-bit SHA-512 scalar would have grown the
stack 512 frames deep.
• Fixed a bug in `ed25519_verify_step3`: S-parse arg order was
`sha_copy_bytes sig S 0 32 32` (src_off=0, dst_off=32 — writes
past the end of a 32-byte S). Corrected to `32 0 32` so S =
sig[32..64] ends up at S[0..32].
• `tools/tls/ed25519_test.rail` exercises RFC 8032 TEST 1
(empty-message canonical vector) + two negative controls
(flipped first byte of R, flipped first byte of S). `valid=1,
bad_R=0, bad_S=0`.

What's deliberately not wired

No live endpoint in our current caller set uses Ed25519 TLS
certificates. `stdlib/ed25519.rail` is therefore shipped as a
standalone module — it's not imported from `tls13_cert_verify.rail`
yet. Wire-in is a 10-line follow-up (sig_alg 0x0807 leaf dispatch +
an `ed25519_sig` OID entry in `asn1.rail`) once a live caller needs
it.

Validation gates

• `./rail_native test` — 137/137.
• `./rail_native self` 2-pass → byte-identical fixed point.
• `ecdsa_p521_verify` still valid=1, bad_hash=0, bad_s=0.
• `ed25519_verify` RFC 8032 TEST 1 → valid=1, bad_R=0, bad_S=0.

Amazon.com was serving intermittent HTTP/2 503s during this
session — rule #6 (v3.3.0 handoff) applies, so the strict-HTTPS
live-endpoint gate was not re-confirmed this session. The TLS
stack was not touched in v3.4.0, so no regression is possible from
these changes.

ECDSA-P521 (secp521r1 / ecdsa-with-SHA512)

`stdlib/ecdsa_p521.rail` — structural clone of `ecdsa_p384.rail` with
33 × 16-bit limbs (528-bit storage for 521-bit values) and loop bounds
bumped from 383 → 520. All curve math reuses `bignum_n.rail` helpers;
no new primitives. `stdlib/cert_p521.rail` is the parallel-to-
`cert_p384.rail` chain-edge driver (SPKI extraction + ECDSA-with-
SHA512 verify using the issuer's P-521 pubkey). Wired into:

• `stdlib/tls13_cert_verify.rail`:
- CertificateVerify leaf sigalg `0x0603` (`ecdsa_secp521r1_sha512`)
now dispatches to `cv_verify_ecdsa_p521`.
- Chain-walk: `ecdsa-with-SHA512` OID (1.2.840.10045.4.3.4) now
dispatches to `cv_chain_p521`.
• `stdlib/asn1.rail`: adds `asn1_oid_p521_curve` (1.3.132.0.35) and
`asn1_oid_ecdsa_sha512` OID references.
• `stdlib/tls13_client.rail`: pulls both new modules into the
transitive import chain.

Live-verified with an OpenSSL-generated P-521 keypair and SHA-512
signature over "hello p521 from rail\n" — `ecdsa_p521_verify` returns
1 on the valid signature and 0 on both a flipped-byte-in-hash and a
flipped-byte-in-s negative control. Test at
`tools/tls/ecdsa_p521_test.rail`.

No live endpoint in our caller set uses P-521 today — this ships for
TLS completeness (any future service using ECDSA-P-521 leaves or
roots will now verify cleanly).

HTTPS keep-alive sessions

One TLS handshake, many requests. `stdlib/https_session.rail` ships
`https_session_open` / `_open_strict` / `_get` / `_post` / `_close`: a
warm TCP+TLS socket across successive HTTP requests. For multi-turn
agents (Anthropic chat, Slack batch posts, any loop over a single API)
this collapses per-request latency from the full ~5–8 s handshake
(x25519 + chain walk to DigiCert) down to just the request
round-trip. The initial handshake happens once; every subsequent call
sends a fresh app-data record on the existing socket and reads the
response.

Why the reverted v3.2.0-track attempt hung

Session open would complete the handshake, send ClientFinished, then
`session_get` would block in `recv` forever. Three overlapping causes
were live. v3.3.0 fixes each explicitly.

1. Nagle buffering on the ClientFinished. Bare CF is ~56 wire
bytes. Macs default TCP sockets to NAGLE on, so the kernel holds
the segment waiting for more data or an ACK. Without a follow-up
write, the server sees a half-handshake and times out. v3.3.0
ships `set_tcp_nodelay fd` (new helper in `stdlib/socket.rail`
using the existing `setsockopt` foreign, `IPPROTO_TCP=6` +
`TCP_NODELAY=1`) and calls it on every session socket right after
`connect`.
2. CF alone in flight is brittle. Even with NODELAY, some
middleboxes reject a CF that arrives without the first record of
application data close behind. v3.3.0 pre-wraps CF into a TLS
record *at open time*, stores it in the session handle as
`pending`, and the first `session_get`/`_post` emits `(CF_record
|| app_record)` in a SINGLE `send()`. Subsequent requests clear
`pending` and just send the app record.
3. Post-handshake NewSessionTicket seq advance. Servers emit one
or two NSTs immediately after their own Finished. The session
reader advances `s_seq` on every record it consumes — NSTs (inner
rtype 22) included — so the application response lands on the
right seq and AEAD decrypts cleanly.

Response framing

`hss_recv` accumulates decrypted app-data fragments into a cons list,
materialises to a single buffer at finalise (O(total) not O(total²)),
and detects HTTP framing after `\r\n\r\n`:

• Content-Length: case-insensitive header lookup, drain until
body length reached.
• Transfer-Encoding: chunked: scan for `0\r\n\r\n` terminator.
• Neither: fall back to "read until EOF" — same behaviour as the
one-shot path; the session is not reusable after this, but the
request still returns.

Live-verified against `https://www.amazon.com/` — two successive
`/` + `/robots.txt` GETs on one session, both returning HTTP 200 over
a chain-walked TLS 1.3 connection. Same `fd` on both requests.

The arity-0 gotcha in socket.rail

The v3.3.0 track hit an unexpected regression midway: adding
top-level constants `ipproto_tcp = 6` / `tcp_nodelay = 1` to
`stdlib/socket.rail` made the previously-green `https_strict_test`
segfault inside the strict chain walk, while adding a function
defined in terms of those constants was fine. Inlining the two
integers at the one call site cleared it. The collision's root cause
isn't fully understood — nothing else in the codebase names those
symbols — but the workaround is cheap and documented in a comment at
the `set_tcp_nodelay` call site.

Files touched

• `stdlib/https_session.rail` (new, ~330 lines)
• `stdlib/socket.rail` (added `set_tcp_nodelay`)
• `tools/tls/https_session_test.rail` (new, live 3-request smoke)

Invariants held

• `./rail_native self` → byte-identical 2-pass fixed point.
• `https_get_url_strict "https://www.amazon.com/"` still returns
HTTP 200 with chain-to-root validation.
• v3.0.0's Anthropic + Slack one-shot paths untouched.
• `./rail_native test` 137/137 — re-verify once the concurrent
`lm_transformer` session on this machine releases `/tmp/rail_out`
(test harness and training both write to that path).

`edit_dist` — did-you-mean Levenshtein was 3^n

The "did you mean?" suggestion machinery used a naive 3-branch
recursion (`edist_loop`: `d_del`, `d_ins`, `d_sub`) without
memoisation or bound propagation. It fired on every unbound-name
lookup across the full arity map (~300 keys on a stdlib-heavy
compile) — whether or not a warning was eventually printed. The
comment claimed "O(env_size · |fname|²) on the COLD path"; the
reality was exponential.

v3.2.0 ships `edist_bounded a b bound` — the threshold is 3 at the
call site, so any comparison whose distance is provably ≥ 3 can be
reported as 3 without exploring further. Two short-circuits make this
cheap:

• Length-gap bail: if `abs(|a| - |b|) ≥ bound`, return `bound`
immediately. Most name pairs differ in length by more than 2, so
this eliminates most of the search tree.
• Per-branch bound decrement: each mismatch consumes one unit of the
bound, so no branch recurses more than `bound` levels deep.

Worst case is now `O(bound · (|a| + |b|))` per comparison — bounded
constant work for the fixed `bound=3`.

`compile_funcs` — non-tail unwind was O(N²)

`compile_funcs` walked the declaration list with:

```rail
let (fasm, ...) = compile_func (head decls) ar lc
let (rest, ...) = compile_funcs (tail decls) ar lc1
(cat [fasm, rest], ...)
```

Each level left a frame on the stack (no TCO through the `cat`) and
re-copied a growing `rest` string on every unwind — quadratic in the
total emitted assembly. Rewritten as a tail-recursive
`compile_funcs_loop` with a cons-list accumulator and a single
`join ""` at the end: O(N) work, O(N) cons cells, O(1) stack.

`stdlib/https_strict.rail` — strict HTTPS is now a one-line import

With the compiler freed, the chain-walk composition
(`https_client.rail` + `pem.rail` + `cert_chain.rail`) is tractable.
`stdlib/https_strict.rail` exposes the v3.1.0-shipped primitives as
plain stdlib functions:

```
https_get_strict host ip port path → (status, body)
https_get_url_strict url → (status, body)
https_post_strict host ip port path ct body hs → (status, body)
https_post_url_strict url ct body hs → (status, body)
https_get_with_store store host ip port path → (status, body)
https_post_with_store store host ip port path ct body hs → (status, body)
```

Each strict call loads the macOS system trust store
(`/etc/ssl/cert.pem`) and walks the cert chain to a root CA before
running the handshake FSM. `*_with_store` variants accept a
pre-loaded store to amortise the ~1.5 s PEM parse across many
requests.

Live, in production, the day of release:

```
https_get_url_strict "https://www.amazon.com/"
→ HTTP 200 with RSA chain validated leaf → DigiCert G2
intermediate → DigiCert Global Root G2 (~8 s total)
```

What this closes

The v3.1.0 CHANGELOG flagged "chain walk is not wired as the default
trust posture" as a known gap. v3.2.0 closes it. Users who want
authenticated HTTPS now write `import "stdlib/https_strict.rail"` +
`https_get_strict` / `https_post_strict`; leaf-only `https_client` is
kept for offline / self-signed / testing paths.

Validation

• `./rail_native self` → byte-identical fixed point (two-pass
confirmed).
• 129/132 core tests before the inherited t131-style harness hang
(same point as v3.1.0 — this hang pre-dates both fixes, carry-over
for a future session to untangle).
• probe4.rail (`https_client + pem + cert_chain + main`): 195 s → 12 s.
• Live strict test `tools/tls/https_strict_test.rail`: amazon.com
returns real HTTP 200 with the full body decoded.

Known gaps carried from v3.1.0

• HTTP keep-alive / session reuse — deferred to v3.3.0.
• ECDSA-P521, Ed25519 signature algorithms — deferred to v3.3.0.
• t131-style harness hang around `tls13_record_roundtrip` is
non-deterministic and predates both v3.1 and v3.2 fixes; suspect
the same family of compile-time pathology around tests with
embedded long TLS transcript literals.

v3.1.0 replaces the accumulator with a cons list of byte-array chunks.
On terminate the driver allocates one buffer of the exact total size,
copies each fragment in O(total), then converts bytes → string in a
single `join` pass. Total work is O(body_len). Full-length Anthropic
completions, multi-hundred-KB HTML, chunked streams — all decode
without the old quadratic tax.

No API change: `https_get` / `https_post` signatures are unchanged.
`hc_recv_response` keeps the same arity (the old `acc` string arg is
now ignored, retained for source compatibility). The legacy
`hc_bytes_to_str_loop` is kept as an O(n²) shim for any external code
that depends on the exact old name; new code should call the new
`hc_bytes_to_str buf n`.

Verified live: `https_get api.anthropic.com` returns a real 404 with
the full Envoy response body parsed cleanly. No regressions in the
116-core / 18-TLS test suite.

Known gaps carried from v3.0.0

• Chain walk is not wired as the default trust posture. The
`stdlib/cert_chain.rail` walker + `stdlib/pem.rail` trust-store
loader are shipped as standalone modules and validated
end-to-end (see `tools/tls/chain_walk_amazon_test.rail`) but
composing them with `stdlib/https_client.rail` in one compilation
unit trips a quadratic pass in `tools/compile.rail` that makes the
combined module unusable (3+ minute compile). Fixing the compiler
is the unblock; queued as a v3.2.0 task. Until then, the default
trust posture is v3.0.0's: leaf CertificateVerify sig + SAN +
validity window. Chain-to-root users can assemble their own
strict client using `cert_chain.rail` + `pem.rail` primitives
(see the test module for the pattern).
• HTTP keep-alive / session reuse — deferred to v3.2.0.
• ECDSA-P521, Ed25519 signature algorithms — deferred to v3.2.0.