Finding (from QA review of PR #93, 2026-08-08)
Both restore paths (STATE_PUT :3457-3458 and now DECODE_APPLY :4628-4629) fall back to create_checkpoint(*slot, 0, 0, n_past-1) AFTER the full n_past-token state is already restored. The registered checkpoint's snapshot actually contains n_past tokens but is labeled pos_max = n_past - 1.
Impact
Traced consumer: update_slots checkpoint search (:6357/:6387). If the mislabeled checkpoint gets matched on a second decode turn on the same slot, it forces re-decode of a token already baked into the recurrent state — the same mechanism as previously-confirmed ggml-org#469 corruption. Risk is already documented in-repo (:6489-6493).
Suggested fix (fast-follow)
When has_chkpt == false, leave slot->prompt.checkpoints EMPTY instead of fabricating a mislabeled checkpoint — fails safe (forced re-prefill) instead of failing corrupt. Applies to BOTH call sites (STATE_PUT + DECODE_APPLY).
Status
Non-blocking for PR #93 (which strictly improves the status quo — DECODE_APPLY previously dropped the checkpoint entirely). Follow-up for epic 470.
Finding (from QA review of PR #93, 2026-08-08)
Both restore paths (STATE_PUT
:3457-3458and now DECODE_APPLY:4628-4629) fall back tocreate_checkpoint(*slot, 0, 0, n_past-1)AFTER the fulln_past-token state is already restored. The registered checkpoint's snapshot actually containsn_pasttokens but is labeledpos_max = n_past - 1.Impact
Traced consumer:
update_slotscheckpoint search (:6357/:6387). If the mislabeled checkpoint gets matched on a second decode turn on the same slot, it forces re-decode of a token already baked into the recurrent state — the same mechanism as previously-confirmed ggml-org#469 corruption. Risk is already documented in-repo (:6489-6493).Suggested fix (fast-follow)
When
has_chkpt == false, leaveslot->prompt.checkpointsEMPTY instead of fabricating a mislabeled checkpoint — fails safe (forced re-prefill) instead of failing corrupt. Applies to BOTH call sites (STATE_PUT + DECODE_APPLY).Status
Non-blocking for PR #93 (which strictly improves the status quo — DECODE_APPLY previously dropped the checkpoint entirely). Follow-up for epic 470.