research: Qwen DeltaNet M2 design + prereg (Part of #32)

CLAIMS.md

@@ -29,6 +29,7 @@ tracked file, which both scripts resolve (they check that it exists, not what it
 | `steering-real-proofs` | Runtime steering under real cp_prove / cp_verify, small synthetic model (PR #50): exact match: 0 of 57 changed steered replies accepted (all refused by the prover), 13 of 13 unchanged accepted; shipped clipped-gap: 5 of 54 changed replies accepted `WITHIN LIMITS`, all at dose 0.05, passing on the theta mean bound (above-clip 0); Python score agreed with the real decision on 140 of 140 | measured, unreplicated (strict PASS, lenient half holds) | unreplicated | [experiments/20261104-36-steering-real-proofs/RESULTS.md](experiments/20261104-36-steering-real-proofs/RESULTS.md) | #50 |
 | `qwen-deltanet-m1` | Qwen Gated DeltaNet head at real shape, M1 (PR #47): FAIL (NO-GO for M2 as registered): 10 of 10 honest proofs accepted (prove median 51.4 s, verify 11.6 s, 50.4 MB) and 40 of 40 hostile proofs rejected, but under heavy-tailed values delta reaches 422,167 > 2^18 at F = 12 (0 of 5 seeds fit) | negative, unreplicated | unreplicated | [research/operators/qwen_deltanet/README.md](research/operators/qwen_deltanet/README.md), [experiments/20261104-11-qwen-deltanet-m1/RESULTS.md](experiments/20261104-11-qwen-deltanet-m1/RESULTS.md) | #47 |
 | `qwen-deltanet-m1b-lookup` | Qwen Gated DeltaNet head with the RNG/LKP range check, M1b (PR #63): PASS vs prereg (GO for M2 design): RNG/LKP composed with the wide product oracle in one group; 10 of 10 honest proofs (prove median 39.2 s, verify 7.1 s, 25.4 MB, table 2^21), 44 of 44 hostile rejected incl. limb-recombination and out-of-range state, and 5 of 5 R3 windows where M1 overflowed proved | measured, unreplicated | unreplicated | [experiments/20261105-32-qwen-deltanet-m1b-lookup/RESULTS.md](experiments/20261105-32-qwen-deltanet-m1b-lookup/RESULTS.md) | #63 |
+| `qwen-deltanet-m2-design` | Qwen DeltaNet M2 design: verifier-side admission, lookup-exact remainders, whole-head ranges (PR #66): PASS vs prereg (GO for an M2 build, arm B): a verifier entry that admits its own integer public inputs accepted 10 of 10 honest M1b proofs (+0.18 s on a 7.6 s verify) and rejected 34 of 34 hostile encodings, including the #63 review's R9 that the caller path accepts; counted, not built: lookup-exact remainders cut product columns per state cell per token 17.4 to 6.1 and relations 3.7x, so the M2 head at T = 16 fits 2^21; whole-head ranges fit 20 of 20 | measured, unreplicated | unreplicated | [experiments/20261105-32-qwen-deltanet-m2-design/RESULTS.md](experiments/20261105-32-qwen-deltanet-m2-design/RESULTS.md) | #66 |
 | `swap-at-verifier` | #45 attack classes through the honest cp_prove + cp_verify, small synthetic model, one H100 (PR #51): honest-prover path: Python score matched all 256 decisions (89 cp_verify accepts, 167 honest-prover refusals, 0 cp_verify rejections); one swap then greedy continuation proved and accepted 15/16 (fp2nd, 95% CI 0.70-1.00) and 13/16 (rand, 0.54-0.96) under the shipped limits; 4 swaps and random replies 0/16; cp_verify's limit check was not exercised on a forged proof | measured, unreplicated | unreplicated | [experiments/20261104-38-swap-at-verifier/RESULTS.md](experiments/20261104-38-swap-at-verifier/RESULTS.md) | #51 |
 | `signed-manifest` | Signed model manifest checked next to cp_verify, stored small example (PR #59): 137 of 137 registered tampers refused, 10 of 10 untampered verifies accepted (cp_verify YES), verify about 1.41 s; 14 of 37 fields are the trusted signer's word: 11 always (10 as a one-field change, plus commitment.kind, which a matching seed file passes even with --public-weights-seed) and 3 (upstream, committed files, seed digest) unless the caller passes the rehash flag; small-order ed25519 keys and R refused; symlinks in rehashed dirs, deep nesting and non-true none refused | measured, unreplicated | unreplicated | [experiments/20261104-58-signed-manifest/RESULTS.md](experiments/20261104-58-signed-manifest/RESULTS.md) | #59 |
 | `open-studies` | Still open: integer-vs-BF16/FP8 fidelity (#8), KDA model-scale sweep (PR #42), cost teardown and larger-memory GPU test (PR #44): none yet | in progress | n/a | [docs/research-roadmap.md](docs/research-roadmap.md) | - |

README.md

@@ -27,11 +27,12 @@ Every number below comes from a file on `main` (the one exception, a reviewer fi
 | Runtime steering under real cp_prove / cp_verify, small synthetic model (PR #50) | measured, unreplicated (strict PASS, lenient half holds) | exact match: 0 of 57 changed steered replies accepted (all refused by the prover), 13 of 13 unchanged accepted; shipped clipped-gap: 5 of 54 changed replies accepted `WITHIN LIMITS`, all at dose 0.05, passing on the theta mean bound (above-clip 0); Python score agreed with the real decision on 140 of 140 | one neuron, synthetic 8-layer model, 5 prompt seeds x 7 doses x 2 reply lengths x 2 policies, one H100 of an unverified host; honest prover only, no cheating prover tested; S and G replies are not paired (different scales) | [experiments/20261104-36-steering-real-proofs/RESULTS.md](experiments/20261104-36-steering-real-proofs/RESULTS.md) |
 | Qwen Gated DeltaNet head at real shape, M1 (PR #47) | negative, unreplicated | FAIL (NO-GO for M2 as registered): 10 of 10 honest proofs accepted (prove median 51.4 s, verify 11.6 s, 50.4 MB) and 40 of 40 hostile proofs rejected, but under heavy-tailed values delta reaches 422,167 > 2^18 at F = 12 (0 of 5 seeds fit) | one head, 128 x 128 state, T = 4, F = 12, synthetic inputs, research test security settings (target 10 bits), CPU, shared loaded VM; range study 1,024 steps x 4 distributions x 5 seeds, integer reference only | [research/operators/qwen_deltanet/](research/operators/qwen_deltanet/README.md) |
 | Qwen Gated DeltaNet head with the RNG/LKP range check, M1b (PR #63) | measured, unreplicated | PASS vs prereg (GO for M2 design): RNG/LKP composed with the wide product oracle in one group; 10 of 10 honest proofs (prove median 39.2 s, verify 7.1 s, 25.4 MB, table 2^21), 44 of 44 hostile rejected incl. limb-recombination and out-of-range state, and 5 of 5 R3 windows where M1 overflowed proved | one head, 128 x 128 state, T = 4, F = 12, two-limb delta, exact remainder bits, synthetic inputs, research security (target 10 bits, N = 10 combinations), CPU 6 cores, shared loaded VM | [experiments/20261105-32-qwen-deltanet-m1b-lookup/RESULTS.md](experiments/20261105-32-qwen-deltanet-m1b-lookup/RESULTS.md) |
+| Qwen DeltaNet M2 design: verifier-side admission, lookup-exact remainders, whole-head ranges (PR #66) | measured, unreplicated | PASS vs prereg (GO for an M2 build, arm B): a verifier entry that admits its own integer public inputs accepted 10 of 10 honest M1b proofs (+0.18 s on a 7.6 s verify) and rejected 34 of 34 hostile encodings, including the #63 review's R9 that the caller path accepts; counted, not built: lookup-exact remainders cut product columns per state cell per token 17.4 to 6.1 and relations 3.7x, so the M2 head at T = 16 fits 2^21; whole-head ranges fit 20 of 20 | design lane, no M2 proof; admission prototype on the M1b statement (one head, T = 4); counts from a model that reproduces M1/M1b exactly; ranges from an integer reference with synthetic init; research security (target 10 bits), CPU 6 cores, shared loaded VM | [experiments/20261105-32-qwen-deltanet-m2-design/RESULTS.md](experiments/20261105-32-qwen-deltanet-m2-design/RESULTS.md) |
 | #45 attack classes through the honest cp_prove + cp_verify, small synthetic model, one H100 (PR #51) | measured, unreplicated | honest-prover path: Python score matched all 256 decisions (89 cp_verify accepts, 167 honest-prover refusals, 0 cp_verify rejections); one swap then greedy continuation proved and accepted 15/16 (fp2nd, 95% CI 0.70-1.00) and 13/16 (rand, 0.54-0.96) under the shipped limits; 4 swaps and random replies 0/16; cp_verify's limit check was not exercised on a forged proof | target_small_f2_gap, shipped limits and #45's fit point (both cap 1), one fresh commitment each; #45's seed 2026 held-out replies, 16 per class, one draw; synthetic weights; soundness flag vacuous for a cheating prover | [experiments/20261104-38-swap-at-verifier/RESULTS.md](experiments/20261104-38-swap-at-verifier/RESULTS.md) |
 | Signed model manifest checked next to cp_verify, stored small example (PR #59) | measured, unreplicated | 137 of 137 registered tampers refused, 10 of 10 untampered verifies accepted (cp_verify YES), verify about 1.41 s; 14 of 37 fields are the trusted signer's word: 11 always (10 as a one-field change, plus commitment.kind, which a matching seed file passes even with --public-weights-seed) and 3 (upstream, committed files, seed digest) unless the caller passes the rehash flag; small-order ed25519 keys and R refused; symlinks in rehashed dirs, deep nesting and non-true none refused | stored synthetic example, fixture tokenizer/template/system prompt, no real model; client-side detached manifest, pure-Python ed25519 (RFC 8032 3 of 3, 64 of 64 vs cryptography); CPU only, re-measured after PREREG amendment 3 | [experiments/20261104-58-signed-manifest/RESULTS.md](experiments/20261104-58-signed-manifest/RESULTS.md) |
 | Still open: integer-vs-BF16/FP8 fidelity (#8), KDA model-scale sweep (PR #42), cost teardown and larger-memory GPU test (PR #44) | in progress | none yet | open PRs, issues and lanes, not merged | [docs/research-roadmap.md](docs/research-roadmap.md) |
 
-_Last regenerated from `research/results.yaml` on 2026-11-05 (UTC), against main `43bfa9fc`._
+_Last regenerated from `research/results.yaml` on 2026-11-05 (UTC), against main `4f7a8761`._
 <!-- results:end -->
 
 What this table does not show: no full-size (Maverick) run, no real model weights on GPU, no serving, no TEE, no production use, and no comparison with other verifiable-inference systems. The GPU rows are upstream's small example on made-up weights.