Verifying the deterministic transistor-flip experiments

← AI Foundry lab dashboard › Worklog › E61, after E60

AI Foundry lab · experiment E61 · the night of 20–21 Oct 2026 · aifoundry1-c0, aifoundry2, aifoundry3 · 1,437 of 1,616 runs kept

An agent-written proposal, Deterministic Transistor-Flip Experiments on 1,024 RISC-V Cores (20 Oct 2026), designed seven experiments — E-D1 to E-D7 — to price one transistor flip on the ET-SoC-1's 1,024 RISC-V minions, and printed the prices it expected. We pre-registered all seven as experiment E61, rebuilt each one so that it can measure what it names, and ran them on 3 cards on the night of 20–21 October 2026: 1,437 of 1,616 runs kept across 37 passes of 42 registered, with 5 passes set aside by a rule written before the run. The arithmetic the page did on data it had was mostly right; the physics it attached to that arithmetic mostly was not. Of 15 registered rows the reduction returns 1 CONFIRMED, 1 CONFIRMED-ours, 5 OPEN, 4 REFUTED, 3 under-resolved and 1 not scored — its own labels, in its own words. Of the 7 rows where the page printed a number, 5 exclude that number at three standard errors, 1 excludes it only from above — which the registered rule does not read as an exclusion — and 1 compares against a figure the page's simulator implies rather than one it printed. The one number the page got nearly exactly is a sum it never meant to quote; the one it missed by the widest margin, the register address path, is a part of the chip it priced at 32 fJ a bit and we cannot price at all.

Names on this page. A minion is one of the chip's 1,088 small RISC-V cores in 34 shires (these kernels use 1,024); each has an 8-lane vector unit, so one 256-bit operation is 8 lanes × 32 bits. The minion rail is the supply that feeds them, metered on the card separately from the board's 12 V input. Energies are board energies (the card's 12 V input, regulator loss included) unless marked rail; the charge-equivalent capacitance and electron count of every price we quote is tabulated at the foot of this page, in both conventions, ½CV² and CV². fxor.pi, fand.pi, for.pi, fadd.pi and fnot.pi are the vector unit's bitwise and integer operations. h is the designed number of bits that flip per lane from one instruction to the next.

The short version

Every row the pre-registration registered, with the page's own number where it printed one, what the night measured, and the verdict as the reduction states it. “Card” is the card the decision rests on.

One row in this table is not scored, and one is printed under two readings. Not scored: C14 C64 asks whether d2A's read-port price lands in E60's interval, but §5.2 makes d2A the measurement of that price, so it cannot also be the test of it. The reduction reports it as AGREEMENT, with its direction kept and no verdict attached — the A/C arms ARE the measurement of e_in(fand) / e_in(for), so the equivalence to E60’s 28.10 fJ is reported as agreement or disagreement, never scored. Two readings: the carry stage's registered estimator subtracts a leg that is one rung through its own zero, and that zero changes 16 fewer 32-bit words an operation, so under §5.1's reading R2 it carries a changed-word term of 2.507 fJ a flip — the ladder intercept divided by the 16 words that reading counts (8 source plus 8 result, from the manifest's own counts), which is the same reading the multiplier is taken on. Removing it moves the carry stage from 0.975 ± 0.802 fJ to 3.482 ± 0.742 fJ, and both read CONFIRMED-ours: the verdict does not depend on the term. Both are below, in E-D3; the same intercept is the bridge's R2 correction in E-D2, 0.2283 W.

Three of the page's claims never needed a card — two against it, one for it:

• A history that never happened. Section 1 of the page recounts earlier runs — watts, slugs, dates. The desk check (README §1, written before any card ran) found the cited slugs do not exist and the quoted watts appear nowhere in the lab repository or in the day's reports: the only 12 October artefact is a plan. The measured anchor it should have cited is on record — 38.29 → 63.40 W board, +18.26 W on the minion rail — and a counted toggle is 0.121 fJ / 2,900 e⁻, not 15.6–18.6 fJ / 189–225 k.
• A table of numbers for runs that were never made. The page's decomposition rests on const measurements of bitwise operations. The corpus it cites has a const pass for three of 392 configurations, none of them bitwise, so five of the const values it prints are values for runs that do not exist — and the two that do read differently.
• The one thing its own data layer got right. Twelve of the page's claims are its mining of a corpus that does exist, and all twelve hold: three absolute energies to the third decimal, three deltas and a 24% gap, six table rows raw to ±0.01 pJ, three more opcode deltas, the one real const value on the page, and 23 of 24 bit patterns decoding correctly. That row is HOLDS, and it is the largest single group in the desk check.

The seventeen verdicts that needed no card

The pre-registration's §1 settled 17 groups over the page's 95 claims from committed files alone — the catalogue JSONs, the enercat source, the lab repository and the report trees — before a card was touched. Everything tonight's runs could add sits on top of this. Three of these groups (S3, S6, S10) were re-measured on silicon anyway, and are rows in the table above.

Two of the page's claims are scored in neither place. C38, C45 appear in none of §1's desk groups, §2's families, §3's not-testable rows or §9's decision rules — 93 of 95 claims are covered, and those two are not. We owe them a verdict or a reason, and have neither.

What we could not test, and why

A reader needs to be able to tell a claim that is wrong from one nobody could score. The pre-registration lists 10 of the second kind, and they are not a small part of the page: a sub-cycle glitch count, the capacitance fits, the millikelvin figures, the shire map, and the lock-in E-D7 was built around all need tooling this lab does not have tonight.

E-D1 · The toggle dial, the inverter and the register-file cell

What the page proposed. Alternate two source registers so that exactly k bit-slices flip per core per clock cycle, and read the price of one flip off the slope. It added that in the generated loop the eight destination registers are rewritten with the value they already hold, so the cells never flip while the result bus does — a real and useful observation.

What we ran, and why it differs. The dial itself, as a fnot.pi ladder (mode 202) at h = 8, 16 and 32, in two arms: d1n, whose operand set contains the all-zero word, and d1nz, which never holds one. The cell question needed a new shape: the page's 1A/1B pair cannot work as written, because the two arms differ in opcode and in rate as well as in cells. We rebuilt it as a 16-operation pair (modes 304 and 305) in which the two arms share their port and result counts exactly and differ only in how many register-file cell bits are rewritten, and we take the difference of the two slopes against the shared regressor, so each arm's own intercept drops out.

The two arms lie on top of each other: the zero word is worth -134 ± 72 fJ/op over the whole operation (-0.0478 ± 0.0257 W), which the reduction calls under-resolved — SE 0.0257 W exceeds one third of the rule’s separation (2% of the 2.569 W matched delta) (§9.4). The sum of an input and an output bit through the inverter is 50.681 ± 0.520 fJ on the never-zero arm and 50.687 ± 0.592 fJ on the arm with zeros.

The plan registered four replications of that zero-word term, and they do not agree, so the term is not pooled into one number. Two of the six pairs are more than the 3.85-standard-error window apart (N primary (d1n - d1nz) against miller (m_solid_z - m_phase0) at |t| = 4.53, fadd (d3p - d3) against miller (m_solid_z - m_phase0) at |t| = 4.47), and Cochran's Q over the four is 28.7 on 3 degrees of freedom. So the set is reported as opcode-dependent — §9's registered open arm — and never collapsed: the replications disagree by more than their own SEs allow, so there is no one zero-word term to apply across opcodes. The four are gathered across cards and compared there, each in femtojoules per operation at its own item's measured rate, which is the only comparison §8.6 allows; they are not averaged. An inverse-variance mean of -285.3 fJ/op exists in the file as the centre Cochran's Q is taken about and nothing reads it. What is applied, wherever the zero-word correction is used, is the form the §8.6 fit prefers — a constant per operation, -95.5 ± 53.0 fJ/op — not the single-rung watt difference this row's headline quotes.

The cell. 0.76 ± 0.32 fJ per flipped register-file cell bit on aifoundry3, rail 0.862 fJ, over 12 passes. Verdict: under-resolved — SE 0.324 fJ exceeds one third of the rule’s 0.30 fJ separation (§9.4). The registered prior was 0.30–3.0 fJ, and the measurement does land inside it; it is the resolution, not the value, that falls short.

And whether the cell term scales with the cell count is untested, not settled. A law proportional to the designed number of flipped cells needs the per-cell-bit price to be the same at both rungs and the per-operation step to double. Measured, the price is 1.129 ± 0.465 fJ at h = 16 and 0.944 ± 0.211 fJ at h = 32, a paired difference of -0.186 ± 0.341 fJ (-16.4%) where proportionality needs zero, and the per-operation step grows 1.671× where it needs 2.00×. That is |t| = 0.54 against a 3.85 window, so both readings survive: a difference of exactly zero is inside three standard errors and so is the measured 16.4% fall, which is why the reduction's own proportional_within_3SE prints True. The RECON 8 condition is therefore untested — not satisfied and not failed — and the confirmed arm's second condition is not met because it was never decided. This design has no power to tell a ratio of 0.836 from 1.000. An earlier build of this reduction recorded the condition as satisfied without running it at all, and the build after that read the same non-result as “nothing here shows the cell term scaling with h”; neither is evidence either way.

The inverter. The page's reason for liking fnot.pi — an inverter is two FETs where an XOR is ten or twelve — predicts an ordering by gate depth. At identical port counts and identical designed counts the three-opcode gate ladder spreads 2.67 ± 0.55 fJ from df.c2.for to df.c2.fxor, which is 4.88 standard errors — real, but not ordered by depth (depth 1 → 53.12 fJ (df.c2.for), depth 2 → 55.78 fJ (df.c2.fxor), depth 3 → 53.66 fJ (df.c2.fadd)). Verdict: OPEN. The error bar above is §8.4's own unit of replication, the one the row reads: the same two opcodes (df.c2.fxor − df.c2.for) differenced inside each pass, then the mean and the standard error from the scatter between 12 passes — 2.666 ± 0.546 fJ, |t| = 4.88. Two other readings of the same spread are in the file and all three fire the same arm: the cross-item form, the two opcodes' own errors added in quadrature, 2.666 ± 0.461 fJ at |t| = 5.78, and the widest-pair-per-pass form, 3.581 ± 0.647 fJ at |t| = 5.54. The one-port fnot.pi leg reads 50.68 ± 0.52 fJ against the two-port XOR's 52.00–53.10 fJ from E60: a second read port is nearly free per bit, which is a statement about ports, not about FET counts, and we report it as such.

E-D2 · The input-versus-output mask bridge

What the page proposed. Run fand.pi with the second operand held at zero, so the inputs flip and the output cannot: “zero gate outputs flip, zero pipeline latches flip, zero writeback wires flip”. Subtract that from the same operation with the operand held at all-ones, and what remains is the price of the output path alone — the page's 44.38 fJ per result bit.

What we ran, and why it differs. Two arms are not enough: the held word and the opcode both move with the mask. We ran it as a 2 × 2 — fand.pi with the operand held at 0 and at all-ones, for.pi with it held at all-ones and at 0 — at h = 0, 16 and 32, so that the opcode's own intercept cancels by construction. The page's Run A is our d2A, its Run B our d2B, its Run C our d2C.

The read-port leg. d2A reads 26.11 ± 0.13 fJ per port bit and d2C, the same shape under another opcode, 26.08 fJ — the agreement the bridge's output leg depends on. The reduction marks that row not scored against E60's 26.00–30.20 fJ interval and reports it as AGREEMENT, because §5.2 of the plan says d2A cannot both supply e_in(fand) and be tested against it — and in this build it does supply it: it is the subtrahend inside the registered estimator for e_out(add) and e_carry. §9's table nonetheless registers a confirmed arm, so the plan contradicts itself; the first builds of this reduction resolved the contradiction silently in favour of scoring, and this one drops the arm as a decision and keeps the direction. Read as agreement, the two numbers agree. Three caveats the row's own blocks carry. The value sits 0.112 fJ above the interval's lower edge, 0.85 standard errors. The four fit forms the reduction prints for it span 25.01–26.33 fJ. And where the answer lands moves with the leakage slope: the fitted slope 0.033 W/°C (PRIMARY, §8.1) → 26.112 ± 0.132 fJ, inside the strict interval; k = 0 → 26.217 ± 0.144 fJ, inside the strict interval; E60’s 0.203 W/°C → 25.567 ± 0.230 fJ, OUTSIDE the strict interval — so at E60's own 0.203 W/°C the point value is below the interval and inside it only after the ±0.885 fJ widening §5.0 rule 2 allows. That reading survives on the widening alone.

The output leg does not land where the page put it, and the routes to it disagree with each other. Measured inside family B, each leg at its own mode's rate and the opcode baseline cancelled by construction, a result bit costs 26.728 ± 0.277 fJ — 26.417 ± 0.288 fJ on the fand leg and 27.038 ± 0.472 fJ on the for leg. The raw four-cell combination reads 25.714 ± 0.859 fJ. The number the plan says to quote comes from the pooled fit instead: 29.666 ± 0.154 fJ, inside the interval E60 measured for the same quantity through another kernel (30.00–31.17 fJ) once widened by its own ±0.594 fJ window, though its point value is below that interval. And repeating E60's own cross-family subtraction on tonight's data gives 29.985 ± 0.535 fJ through the origin and 31.302 ± 0.557 fJ with a free intercept. So the route family B was built to replace is the route that reproduces E60, and the route built to cancel the opcode baseline lands about 15% below it. Against the page's 44.38 fJ every reading is a factor of 1.50 to 1.66 out, which is the one thing they agree on. The row is OPEN because a registered open-condition fired: §9 rule 4 precedence: the CONFIRMED arm is satisfied.

What the gap between the two routes is, and what it is not. The pooled fit sits 3.952 fJ a flip above the raw four-cell combination. On the bridge's own per-mode denominator — 256 × rate(d2B_h32) + 256 × rate(d2D_h32) = 186.5×10¹² bits a second — that is 0.7368 W. §5.1's changed-word term is a part of it and not the whole: the raw combination changes 16 32-bit words an operation and §5.1 prices them at the ladder intercept, 0.2283 W = 1.224 fJ a flip, which is 31.0% of the gap. The remaining 0.5085 W separates two estimators of the same quantity and is not accounted for by changed words. Priced instead at the fit's own changed-word coefficient (34.92 ± 2.09 fJ per 32-bit word × 16 words over 512 bits) the term would be 1.09 fJ, 27.6% — still a minority of the gap. Its sign is contested as well: one reading has the raw bridge high by that term and the other low by it, so correcting it moves the raw bridge to either 24.49 or 26.94 fJ, and both are still short of the fit. Something else accounts for most of the 3.952 fJ, and we cannot say what.

What the term probably is, and why it matters here. The coefficient prices a 32-bit lane word that changes on any bus, once, however many of its 32 bits move — which is the shape of a per-lane wake-up cost (a lane clock gate, an operand-valid latch, a local clock buffer), not a per-bit cost. But the pre-registration offered three readings of that intercept and tonight's family A forces a fourth it never listed: per address bit an operation fetches. The two ladders' intercepts are 0.2283 ± 0.0342 W and 0.3140 ± 0.0302 W, a ratio of 0.727 ± 0.130, and that ratio sits closest to the reading nobody registered.

One caveat retired. The first build of this reduction printed a condition number of 279,463,229,586,765 for the pooled design and called it rank-deficient, which would have disqualified the fit the row is quoted from. That figure is a units artefact — counts per second against an intercept of 1.0. Column-scaled, the design's condition number is 9.212 over 31 rows a pass, and the variance-inflation factor on e_out is 1.92. The fit is not degenerate. It is still a pooled fit whose e_out rests on one contrast, and the reduction forbids quoting a standard error for any coefficient identified by one contrast — e_addr, e_carry, e_cell are printed without one for exactly that reason. Its own note on what cannot be separated: N and V have equal port and result counts at every h: e_in and e_out are perfectly collinear WITHIN them; C’s carry and result counts differ by a constant 8, so they are collinear once a free intercept is present.

The clamp polarity. The page read the A-versus-C difference as an NMOS/PMOS asymmetry. That one is REFUTED by design rather than by data: by design, whatever the data: (B-A)-(D-C) = 2 g_op + g_res, so the A-vs-C difference carries the held-value and zero-result effects, and A and C also differ in opcode.

E-D3 · The carry-chain wave

What the page proposed. Preload one operand with L low ones and toggle the other between 0 and 1, so a single input bit flip sets off exactly L carry nodes and L + 1 sum bits. Plot power against L; the slope is “about 14 fJ per carry stage”.

What we ran, and why it differs. Exactly that, in the held-operand shape (mode 302, fadd.pi), at L = 2, 8, 16, 29, with the carry and sum counts re-derived from the operand bytes rather than assumed. The slope mixes one carry node with one sum bit, so the registered estimator subtracts an independently measured result bit — from the fadd.pi rung of the gate ladder, the same opcode, the same shape, the same pass — and what is left is the carry stage alone. Importing e_out from fand/for instead is the thing §4 forbids; that route is printed beside it and reads 2.812 ± 0.867 fJ.

The line is straight: a fit in L leaves 0.016 W rms against 0.086 W for the L·log₂L form a parallel-prefix adder would give, and the reduction prefers linear_L. A carry stage costs 0.98 ± 0.80 fJ (rail -0.10 fJ), against the page's 14.2 fJ and our own registered 1.7 fJ. Verdict: CONFIRMED-ours — e_carry lands on 1.7 fJ ± 3 SE and 14.2 fJ is excluded at ≥ 3 SE.

The second reading, and why it does not change the verdict. The leg this estimator subtracts is one rung through its own zero, and that zero changes 16 fewer 32-bit words an operation, so under §5.1's reading R2 the registered e_out(add) carries a changed-word term. The reduction prices it at the ladder intercept divided by the 16 words that reading counts — 8 source plus 8 result, which is the count the multiplier itself is taken on, so price and count come from one reading — giving 2.507 fJ a flip (0.0143 W per changed word). Remove it and e_out(add) is 25.044 ± 0.605 fJ instead of 27.551 ± 0.664 fJ, and the carry stage is 3.482 ± 0.742 fJ. That is 2.40 standard errors from our own registered 1.7 fJ, inside the 3.85 window, and it excludes the page's 14.2 fJ at |t| = 14.4: CONFIRMED-ours, the same arm as the registered form. So the row's verdict does not depend on whether the term is removed — the file says so in a field of its own, verdict_depends_on_the_R2_term = False — and the primary stays the registered estimator, because §4 registers it and §5.1's reading is itself an open row in this file. An earlier build of this reduction priced the term per source word against reading R2's count of 16, doubling it, which flipped this second reading to refuted on both sides on nothing but the mismatched reading. Both readings are in the table at the top.

E-D4 · The Miller wire law

What the page proposed. Hold the number of flipping wires at 128 and change only their neighbours' phase — all flipping together, every flipping wire flanked by quiet ones, or every wire counter-phased against its neighbours — to separate a wire's capacitance to ground from its capacitance to the wire beside it.

What we ran, and why it differs. Four occupancy-matched patterns at identical designed counts and no zero word, with a complement pair as a control, so that the only thing that moves is the neighbour phase: k_adj = 0.0310, 0.969, 1.47, 1.72. Bit index = physical wire adjacency is an assumption, and it is stated in the result rather than discovered afterwards.

The registered rule has four conditions, not one, and three of them fail.

Verdict: REFUTED — the whole spread is < 3 SE → the design did not deliver k_adj and nothing about C_gnd vs C_adj can be read from it. Two things that reads as, and one it does not. It is a null about the design: at 128 flips out of 256 wires the four patterns differ by too little for a board meter, so nothing about C_gnd against C_adj can be extracted from them. It is also a sign problem — more counter-phasing reads 0.217 W less power where the page's law predicts 0.275 W more, a disagreement of 0.492 W. It is not support for the law. And the margin is thin on its own terms: |t| = 3.68 against the 3.85 window is 95.6% of the threshold, so “the whole spread is under three standard errors” is true by 0.17 of a standard error.

On the page's own number for this row. The 0.2750 W in the table at the top is §5.4's reading of the page's simulator for one step (m_pair against m_nib), not a watt figure the page printed. The page's §6 row gives a span of about 0.6–1.4 W and the desk check computes 2.58 W from the same simulator. We compare a single simulated step against a measured four-level spread, which is the closest commensurable pair available, and say so rather than hiding it in a cell.

E-D5 · The address decoder — the night's largest effect, and the one we cannot price

What the page proposed. Hold every data register at zero so nothing flips in the datapath, and change only which registers the instruction names. What is left is the 5-bit index decoder and its wordline drivers, which the page priced at 32.0 fJ per address bit across three ports.

What we ran, and why it differs. A ladder of register-index Hamming distances (new modes 306–309) in two data regimes: gated, every data register zero, as the page specified; and live, every data register holding the same non-zero word, so that the data path is awake while the index still moves. The 5-bit rung retires at a different instruction rate from the rest of the ladder, so the amendment keeps it out of the slope and reports it beside — it is drawn hollow below.

Something very large is there. The gated ladder's slope is 368.9 ± 21.9 fJ per toggled index bit if it is fitted with a free intercept, and 452.1 ± 12.2 fJ if it is forced through the origin — two forms the plan registers, differing by 83.2 fJ a bit, far more than either standard error. It is the only one of the confirmatory five that survives Holm correction (p = 3.4 × 10⁻⁹), it is 11.5 to 14.1 times the page's 32.0 fJ, and it sits 184.5 times our own registered ceiling of 2.0 fJ.

And it is under-resolved. Not refuted: the registered arm is a ceiling test — the page claimed 32 fJ a bit and the question was whether silicon is cheaper — so excluding 32 fJ from above does not answer it, and the exclusion is read one-sided downward only. SE 21.928 fJ exceeds one third of the 32 fJ separation (§9.4). The ladder is reported descriptively and no verdict rests on the number.

Four reasons the slope is not “energy per address bit”. First, the two fit forms disagree by more than their errors, which is itself why the row cannot be scored. Second, the three rungs are three separately emitted kernels, and a per-kernel constant that a single free intercept cannot remove is measurable elsewhere on this card: the five zero rungs of other families that share the A ladder's own issue rate (d1n_h0, d1nz_h0, d2A_h0, d2B_h0, d3z_h0) span 0.0895 W, which on this ladder is 25.1 fJ a bit — 6.8% of the slope itself. A per-kernel constant of the size measured elsewhere accounts for part of this slope, not all of it, and it cannot be subtracted, because the A rungs' own spread is the ladder. Third, the cost is not one slope: a fixed step is paid the moment the source index stops being the same register twice in a row, and only the remainder grows with distance, so a single number per bit is the wrong functional form. Fourth, the design is exactly degenerate in its own regressor — we chose f1, f7 and f31, so Hamming distance equals log₂(1 + physical row distance) rung for rung (d5_a1: 2.0 index bits, row distance 1, log₂(1+distance) 1.0; d5_a3: 6.0 index bits, row distance 7, log₂(1+distance) 3.0; d5_a5: 10 index bits, row distance 31, log₂(1+distance) 5.0). A per-address-bit law and a per-decoder-tree-level law are the same arithmetic here, and the index travels in the instruction word as well as into the register file's decoder, so instruction-fetch toggles and read-port address toggles move together by construction.

What is solid: changing which register an instruction names, with every data bit held still, moves real power, and it is the most expensive bit on this page — about 19.0 times a read-port data bit (19.38 fJ). The gated and live ladders differ by -128.7 ± 22.6 fJ per bit — the registered test for data-path gating reaching the address path, and it fires — with the live arm reading 497.64 ± 8.46 fJ. The page's 32 fJ across three ports is refuted and nothing is confirmed in its place. Two rungs break the degeneracy for E62: one with high Hamming distance and small row distance, one with the reverse, and one with the two source index fields different so that the units stop being ambiguous by a factor of two.

One consequence for E-D1, which we owe the reader. The pre-registration budgeted family V's address-count difference as “0.05% of the signal”. At a price of this order it is nearer 19% of the cell signal, and in the direction that makes the cell term larger. The A2.3 slope-difference form E-D1's headline uses is immune — the address count is constant inside each arm's own ladder — so 0.76 ± 0.32 fJ stands. The cross-mode per-rung step figures are not immune. The B bridge, family C, family M, family Z and the X ladder all hold their address count constant across rungs, so they are clean.

E-D6 · The zero gate

What the page proposed. That the fused multiply-add is clock-gated on zero operands, so replacing zeros with a non-zero constant un-gates about 3,800 flip-flops and costs +8.94 pJ per operation — its single largest energy claim, and the premise of a whole section.

What we ran. The same two constants on the same instruction (mode 191), 20 seconds a pass, with every designed count zero in both arms so that only the operand's zero-ness differs.

The step is 0.23 ± 0.16 pJ/op, or 0.0875 ± 0.0600 W on the card. Verdict: REFUTED — ≤ 0.5 pJ/op → the page’s +8.94 pJ is refuted on silicon as well as in the catalogue. The desk check had already found the same step at 0.147 pJ in the corpus the page itself cites; silicon agrees with the corpus, not with the page.

Read strictly this row is a null, and the honest statement is “no step larger than about half a picojoule”. The margin deserves one line, because it is not large: the rule's boundary at 0.5 pJ an operation is 1.65 standard errors away, the three-standard-error window reaches 0.855 pJ an operation, so the rule's own OPEN band (0.5–2.5 pJ an operation) lies inside that window; and in watts the point value is 0.21 of a standard error from the 0.1 W the verdict calls a null. What the data exclude is the page's 8.94 pJ, by a very long way. What they do not do is measure a small step.

E-D7 · The half-die dipole, on the camera

What the page proposed. Give one half of the die work whose result bits flip and the other half work whose result bits cannot, swap the halves every ten seconds, and watch a thermal dipole of about 110 mK appear on the camera while total card power stays exactly flat — about 2.2 W of switching heat moving from side to side at constant total power.

What we ran, and why it differs. The page's own definition of the halves had to be replaced before the experiment could mean anything: its “West = shires 0–15, East = shires 16–31” is not a spatial split at all. The host's own mesh table puts shires 0–15 in every mesh column, so that split would modulate the whole die, and no 16/16 vertical or horizontal cut of this chip exists. We used the mesh x ≤ 2 split instead. Then a contiguous camera block on aifoundry2 (4 passes, 20 runs each, 614 frames at about 0.90 frames a second), with the two halves' masks swapped between passes so that block order is balanced rather than assumed away. The page's 0.05 Hz lock-in needs a kernel and three raised timeouts we do not have tonight, so the registered substitute is a double difference across the swap, calibrated by a permutation null over all 10,000 labellings.

The board meter first, because it carries a verdict. The registered tier-1 test is the result-path load on one half of the mesh, against a window of 1.33–1.42 W. It can be read three ways, and the plan registers all three. Half the measured combination gives 1.2462 ± 0.0111 W — outside the window, and outside it after its own ±0.0429 W widening. The plan's own formula for the same quantity, e_out × 256 result bits an operation × the rate, halved, gives 1.351 W from the pooled fit — which is inside the window — and 1.171 W from the raw bridge, which is outside it below. So this arm turns on which spelling of one quantity is used, and the row is OPEN: one arm of tier 1 is outside its window.

The same quantity on the other two cards brackets the number the page printed. The page specified 600 MHz, and the only clock-pinned card is aifoundry3, so 1.246 W is the fair comparison — but a page scored on three cards should say that the two governor-free cards at 800 MHz read 2.3391 ± 0.0287 W and 2.1443 ± 0.0594 W, on either side of the page's 2.2 W.

And the two halves are not electrically interchangeable. The registered W-against-E equality reads -0.03 ± 0.34 W in the main reduction and -0.436 W in the camera block's own telemetry pipeline — a 0.40 W difference between two implementations of one test, which we cannot reconcile and will not paper over. Inside the camera pipeline, fitting the balanced block-order term does not move that mean at all; it moves the standard error, from 0.304 W to 0.0456 W, and so |t| from 1.43 to 9.55. On that reading the two halves draw 0.436 W of different total power for the same work — about 3.0% of the 14.4 W the work itself draws, and the same sign on the quiet arm (-0.371 W). A delivery-path asymmetry is therefore not hypothetical, which matters for how the camera's picture is read. Note also that the equality arm the row scores as satisfied rests on 4 passes with a 9.22 window, so it could not have detected an asymmetry below about 3.13 W — and §9's own floor for a confirmatory item is 6 passes. That arm is an absence of evidence at low resolution, not an equality.

The numbers

statistic	value	significance	what it says
the double difference across the swap	372.9 ± 13.6 mK	p = 0.00070	null scatter 133 mK over 10000 labellings; 372.9–572.0 mK across the four registered arm choices
the quiet arm, same statistic	202.8 mK	p = 0.021	the dipole is there without the loud half
the card mean of the difference image	-13.2 mK	p = 0.96	the camera's reading of “total power does not change”
the same cut, the other way across the frame	-11.7 mK	p = 0.29	the signal lives on one axis
board meter, the two halves	-0.436 W	|t| = 9.55 with block order fitted	against 14.4 W drawn by the work itself

The camera, which is tier 2 and exploratory by design — plan §10 and §2's E-D7 row carry no confirmed or refuted arm, so nothing below is scored. The pattern moves. The double difference is 372.89 ± 13.64 mK between passes at p = 0.00070 on an enumerated permutation null over 10,000 labellings, against a null scatter of 133 mK; the quiet arm shows the same dipole in the same direction at 202.8 mK. It is a dipole and not a level shift: the card mean of the difference image — the camera's own reading of the page's “ΔP_card = 0” — is -13.2 mK at p = 0.96. It lies on one axis: the same reduction with the frame halved the other way returns -11.7 mK at p = 0.29. It survives dropping the frame's outer border (348.5 mK at p = 0.00030).

Three things the camera does not show. It is not the result path: the quiet arm flips zero result bits and still carries 54% of the amplitude, and its column profile is the same shape as the loud arm's, so what is being imaged is the half's threads and read ports with the result path adding amplitude to a pattern that is already there. The one contrast that is the result path, loud minus quiet at 170.1 mK, is the one the tool flags as biased upward, because hi ran before lo in ALL FOUR passes, so the lo arm carries the preceding hi block’s residual heat and hi_minus_lo is biased. It is not a two-lobed picture of sixteen shires: the profile is dominated by a whole-frame gradient (2.56 mK a pixel, p = 0.0030) with its hottest and coldest columns at x = 47 and x = 209, at the edges of the die's footprint rather than at the centres of the two halves. And the automatic mask covers 85.6% of the frame with a bounding box that is the frame, so the statistic is the frame halved, board and package included. Nor is it calibrated: the camera was never calibrated on this card and the automatic bbox is the whole frame, not the card, so no mm scale is established and the plan’s… So the discriminator we registered for die heat against the power-delivery path, whether the lobe moves about 11 mm, could not be run at all, and the amplitude itself moves from 372.9 to 572.0 mK (53%) across the four registered ways of removing the field's own 5.5 mK a second drift. What we can report is a sign, an axis and a p-value. The millikelvins are not a measurement yet.

What the camera block establishes.

• The pattern MOVES. Swapping which MESH half runs loud moves heat across the board by +372.9 mK on the double difference, p = 0.0007 against the registered cyclic null with all 10,000 labellings enumerated. The hub’s prescribed regulator control is PASSED: two fixed voltage regulators cannot produce a pattern that changes sides with the shire mask.
• It is a dipole, not a level shift. The card-mean of the difference image (the camera’s own read of “Delta P_card == 0”) is -13.2 mK against a +373 mK half-to-half contrast, p = 0.96.
• It lies on one axis. Halving the frame the other way returns -11.7 mK, p = 0.29.
• It is not the block order. Decomposed on the balanced 2x2, the side term is +372.9 mK and the order term +23.6 mK; once the order term is out the four passes agree to within ±2.3 mK (SE 1.16 mK on 2 df).
• The hart activity alone already carries it: the quiet lo arm shows the same dipole in the same direction (173° vs 174°) at +202.8 mK, 54% of the loud arm’s.

What it cannot show.

• Which image half is the die’s West. The camera’s orientation relative to the MESH x ≤ 2 split was never measured, so the finding is “the image half at lower x heats when the 0x3131733b mask runs” — label-blind, exactly as the tool’s own sign_note says.
• Any displacement in millimetres. No mm/px scale exists for this card, and from W-E alone a displacement is not identified in the first place (plan section 10, rule 8). The plan’s “~11 mm” is untestable from this block.
• Absolute mK, mK/W, or a die-side amplitude: the camera has never been calibrated on this card and the die-to-back coupling is unmeasured (plan section 10, “what tier 2 cannot show” iii, iv).
• The shire map. That the pattern splits where MESH says it should is consistent with the hart → shire → position map, but the halves-only resolution cannot test a single shire (section 10, ii), and the monopole’s null SD of 216 mK is far too wide to resolve the 0.44 W electrical asymmetry the board meter does see (~34 mK expected).
• Anything at constant TOTAL power. Both arms run half the chip idle, so this is a contrast at constant WORK, not the page’s constant-total-power dipole (section 10, i).

Every price here is per flip, because the issue rate is not 1.0 — and it is set by the linker

The page holds “instruction issue rate (1.0 IPC = 614.4 Gops/s)” strictly invariant across all seven experiments and converts every energy-per-operation into watts with it. Measured, the same kernels retire 0.6088–0.6089 operations per cycle per hart — 0.609× the page's 1.0. Verdict: OPEN.

But the measured rates are not a spectrum: they are two levels, and which level a kernel gets is decided by where the linker put its loop. Every one-hart shape in this campaign sits at 0.5815 or 0.6087 operations per cycle per hart at 64 operations an iteration, with nothing in between, and the same split at 128. The reduction re-derives why from the committed disassembly (enercat-df-aifoundry2.dis.txt, 84 long packed-vector loops): the level follows the loop head's address mod 32. Heads at 6 issue 0.6088 operations a cycle a hart and heads at 22 issue 0.5814 — a 4.71% difference with nothing in the data changing. The c2 family pins the map one-to-one, because its pinned third operand identifies each of its four opcodes and so each mode:

Each residue carries exactly one rate, and the two residues are distinct. The four df.addr kernels cannot be named from the bytes, so they are a count check instead, and it agrees: 1 head at the fast residue and 3 at the slow, against 1 of the four address modes at the fast rate and 3 at the slow. This is an instruction-fetch alignment effect, and it explains three things at once: why amendment A2.1 found the rate fixed by the mode rather than by h, why the same split is identical on all three cards, and why mode 179 itself moved +5.14% between E60's build and tonight's, on every card. Opcode does not predict it and neither does shape: the same opcode appears on both levels. It is reported, and it gates nothing.

Underneath that, the vector unit issues one operation per cycle per hart. Combining the 64-operation and 128-operation bodies, cycles per iteration are 0.9982·ops + 41.23 on the fast alignment and 0.9990·ops + 46.14 on the slow one: a slope of 1.00 operations a cycle, and a fixed cost of 41.2–46.1 cycles an iteration spent on the loop's own scalar instructions, four of which are performance-counter reads — our instrumentation. So the page's “1.0 IPC” is right about the issue rate and wrong only about the Gops/s, by the loop overhead. We were wrong to read the 40% as a property of the chip.

Two consequences we have to carry. The first: the same mode — same pattern, same designed counts — ran 0.5791 in E60's build and 0.6087 in tonight's, and the registered refuted arm was written against that exact number. That 5.11% is one alignment flip, not drift in the chip: inserting ten new bodies ahead of it moved it across the boundary, and E60's figure is within 0.41% of tonight's slow level. The second: it is inside the e_out bridge. The fand and for legs sit on opposite alignments, so dividing all four arms by one mode's rate reads 2.36% high — 26.32 fJ against the 25.71 fJ a per-leg denominator gives. That is why nothing on this page is quoted in watts: every price is per flip, from each run's own operation count.

The operand law, and what two harts do to it

The page's split of a flip's cost into input and output — 6.81 to 1 — comes from assuming uniform random operand bits. They are not uniform, and the catalogue's own numbers admit two readings depending on whether two harts interleave and destroy operand sharing. The registered statistic is a rate-free ratio ρ of the per-operation cost at two harts to one.

ρ = 1.1169 ± 0.0242 on aifoundry1-c0 over 8 passes: interleaving destroys sharing, so the catalogue cannot settle the split at all, and the page's 6.81:1 is the full-interleave reading arrived at by coincidence. Verdict: REFUTED. This one survived every attack we could make on it. The obvious objection — that two harts change the per-operation overhead the baseline removes — does not hold, because the baseline is removed inside each hart setting before the ratio is taken. To pull ρ to 1.000 the two-hart arm would have to shed 865 fJ an operation, 10% of its 8378.5 ± 149.0 fJ/op, and the only mechanism left is temperature — where the measured differential heating between the two arms is the same at one hart as at two, so it cannot be the cause. The leakage arms all read above 1: the board leg is 1.1169 ± 0.0242 and the minion-rail leg 1.292 ± 0.142 in the independent reduction. A phase-locking alternative pushes the wrong way: locked harts would give ρ below 1.

Two honest limits, and one correction against our own plan. The row is thinner than it looks: 1.000 is excluded at |t| = 4.82 against a 4.53 window at 8 passes — 106.5% of the threshold, so one more lost pass would reopen it — and the statistic cannot tell complete destruction of sharing from near-complete (90.3% ± 17% destroyed is consistent with all of it). It also rests on one card, one opcode. The correction: our own §0.2 argued that the catalogue's forward agreement proves sharing survives interleaving. Redone with §0.2's own interleaved counts, the five ratios move from a uniformly low 0.951 (sd 0.030) to a centred 1.002 (sd 0.045), so neither reading is excluded and the forward check discriminates nothing. ρ is the only evidence here, and the claim that the catalogue settles it is withdrawn. The model-free leg reads 61.856 ± 0.936 fJ against the 68.12–69.56 fJ that E60's measurement predicts for this card once scaled by this campaign's own measured per-bit tie (1.310, against E60's 1.216) — outside, even widened, so the operand law is not confirmed on this leg. The tie itself is 1.077× E60's, outside §8.7's registered 0.88–0.99 card-to-card band, so the scaling is a reported method choice and not a check that passed.

What the page got right

• Its arithmetic on real data — twelve claims, all holding. The largest single group in the desk check is the page's mining of a corpus that does exist, and it survives in full: 13.148 / 13.158 / 13.661 ✓; +7.353 / +5.995 / +5.859, gap 24% ✓; six rows to ±0.01 pJ ✓; fsll.pi +4.657, fswizz.ps +5.311, fbcx.ps +5.237 ✓; fadd.pi const − zeros +0.054 ✓ (the one real const value on the page); every E-D6 bit pattern decodes, 23/24 = 95.8% ✓. C39’s 2.09× is arithmetic but not a width-only comparison (the flip counts also differ… That is the page's whole data layer, and it is correct.
• The sum, to 0.43%. Its input and output prices add to 50.90 fJ per flipped bit-slice. Measured through the inverter at matched counts, an input bit plus an output bit costs 50.6810 ± 0.5203 fJ. The page split that sum wrongly — 6.81:1 against a measured ratio of 1.37:1 — but the quantity its arithmetic actually fixed, the sum, is the quantity it got nearly exactly.
• One operation retires per cycle per hart. Its “1.0 IPC” is right about the vector unit's issue rate, which we did not expect and first scored against it. What is wrong is the conversion to Gops/s, because 41 to 46 cycles an iteration go on the loop's own scalar work.
• The flip counts are deterministic. 1437 runs over 111 items passed the within-mode instruction-rate, ok and participant gates on every card, with no subtraction voided — verdict CONFIRMED. One rung is excluded by name as rate-confounded and reported beside its ladder; the on-silicon register dump that would close the last gap is not in tonight's build, which the row says in full.
• The destination cells really do stay still. The page's observation that the generated loop rewrites each destination with the value it already holds is correct, and it is what makes the cell term separable at all: the rebuilt 1A/1B pair finds a cell bit at 0.76 ± 0.32 fJ, far below a result bit.
• The address path costs energy. Changing which registers an instruction names, with every data bit held still, moves real power — the one effect tonight that survives Holm correction across the confirmatory five (e_addr, p = 3.4 × 10⁻⁹). The page was right that this is worth measuring; it was wrong about the size, and so were we, and neither of us measured it.
• The halves move heat. Giving one half of the mesh flipping result bits and the other half none does move heat across the board, it does so without changing total card power to within the camera's reading of it, and it reverses when the masks swap — exactly the qualitative claim E-D7 makes, at a size the camera cannot convert into millikelvin on an uncalibrated card, and with the halves it names replaced by halves that exist.

What we got wrong

6 of our own registered expectations, written into the pre-registration before any card ran, and what the night did to them: 3 of the 6 missed. On the address bit ours missed by more than the page's own number did.

The address prior is the worst number on either side of this exercise: we registered 0–2.0 fJ per index bit on the reasoning that a 5-bit decoder is small, and measured a slope of 368.9 to 452.1 fJ that is not a price per bit at all. The page's 32.0 fJ is nearer the truth than our ceiling was, and still refuted, because the ladder is not measuring what either of us named. Four more, for the record: we registered the camera block as able to settle a half-die amplitude in watts, and it settles a direction and a sign; we registered the bridge's number behind an intercept test that fired on 3 cross-opcode pairs and no within-opcode pair — the one term the 2 × 2 cancels by construction, so the rule was written too tightly rather than the measurement failing; we registered C14 as a scoreable arm in §9 and forbade exactly that in §5.2; and we budgeted family V's address-count difference at 0.05% of its signal when it is nearer 19%. Two arithmetic slips of our own are corrected on this page rather than quietly fixed: the changed-word price, and the four zero-word replications the file pooled against its own rule.

Where the two reductions disagree

The reduction was re-derived from the raw records by a second implementation before this page was written, and the two were then reconciled. They agree on the shape of every result and on the verdicts, and they do not agree on every number. The largest source of difference is not the estimators: it is which passes each one sets aside. This reduction keeps 12 passes on the primary card; the independent one keeps 7. The rows below are every quantity we compared where the two can be put side by side.

Nothing here changes a verdict. It does mean a reader should treat the third digit of any number on this page as a method choice rather than a measurement, and the reduction's own list of method choices — which fit form, which leakage slope, which rung, which tie — is where to look first.

The page's three explorers, and the five constants inside them

A reader of the original page meets most of its physics by clicking, not by reading: it ships a seven-rung ladder, a live kernel generator and a cycle-stepping microscope. The generator is the one that matters, because its model hard-codes the five per-flip constants this experiment set out to measure, plus an idle offset and a thermal conversion. Anyone who moved its sliders was reading those constants back out. Here is what each one became.

The ladder's rungs 0–4 are the const values the desk check found to be measurements of runs that do not exist; the microscope is a cycle-level animation, which nothing here scores. We have not rebuilt the explorers. If they are kept, those are the numbers to change.

How this was run

Pre-registered. The design, the eleven families, every prediction as an interval, the analysis and the decision rules were committed before the first measured pass: tools/claims-v3/dtf/README.md (the pre-registration commit), with two amendments, each committed before the data it touches — A1, more passes inside the claim window, decided on elapsed time alone, and A2, which fixes the issue rate by mode and so reduces families V and A within mode. 68 manifest items, seed 20261021; the analysis manifest A2 introduces, and which the reduction actually reads, is manifest-a2.json. The reduction's own record of what it departed from: the on-silicon register dump (§7 proof 6) is not implemented; modes are 300-309; anchor_pi runs first, middle and last, so the drift statistic is a fitted W/min.

The operating point is not the page's, and no card could have given the page's. The page puts all seven experiments on aifoundry2 at 600 MHz and 0.517 V. That card is governor-free at 800 MHz and about 618.0 mV; 0.517 V was its 21 September point; and the only clock-pinned card in the lab is aifoundry3, at 600 MHz and 522.0 mV. So every per-flip price the page prints is quoted at a point no card ran, and most rows here are decided on a card the page never names. Card-to-card scaling is reported, never assumed: the measured per-bit ties are aifoundry1-c0 1.310× aifoundry3 against E60's 1.216, aifoundry2 1.332× aifoundry3 against E60's 1.376, against the 0.88–0.99 band §8.7 registers — one card inside it, one not.

Passes are kept or set aside, never missing. Every registered pass ran. 5 of 42 were set aside afterwards by the rule §8.9 registers — more than 5% of a pass's runs failing a gate, with at least two runs failing, or the anchor drifting more than the pass's own threshold — and the reduction reports them as set aside rather than absent.

Proved before the first pass. Every operand image was written by the generator and its designed counts re-derived from the bytes (make_dtf.py --check); the built ELF was walked to prove it holds exactly the intended blocks; ten sys_emu runs executed the kernels with the register-file checker on; and a smoke block ran on each card (aifoundry1-c0 7 runs, every gate passed, aifoundry2 7 runs, every gate passed, aifoundry3 7 runs, every gate passed).

Protocol. E60's: each run launched as the die's reading fell to a fixed value after a heater burst, the board's power read over a fixed window once the clock had settled, every item differenced against its own zero rung inside the same pass, every error bar the scatter between passes, and a three-sigma window read as the two-sided t quantile at p = 0.0027 on that scatter. The confirmatory five (e_cell, e_carry, e_addr, phase_term, zero_word_term) are Holm-corrected at α = 0.050; everything else is exploratory and says so. Leakage is corrected with each card's own fitted slope, and because tonight's fit and E60's differ by an order of magnitude (0.0330 against 0.203 W/°C on aifoundry3, with only 23.0% of runs qualifying for the within-run fit), every quantity is also reported at a zero slope and at E60's. Two rows move: the ladder intercept and the d2A read-port price.

The intercept row, and which kind of open it is. The ladder intercept reads 0.2283 ± 0.0342 W and is open because two of the three registered mechanism readings are inside three standard errors (changed source word, any changed word) — a case §9's partition does not name. Its registered open arm, that the two ladders' intercepts disagree by more than three standard errors once scaled by their word counts, does not fire: -0.0089 ± 0.0052 W per changed source word, |t| = 1.73 against 3.85. The row is open for a reason the rules do not list, and that gap is ours.

What is missing. 20 gaps are recorded by the reduction itself, the largest being that several families ran on the pinned card only, so e_cell, e_carry, the Miller set, the address ladder and the zero gate have no second-card replicate. The on-silicon register dump is not implemented in tonight's build, so a value corruption that left the operation count and the participant count intact would not have been caught — the pre-registration says so in its §11, and the determinism row rests on the rate, ok and participant gates and on the off-card proofs instead.

Data and code. tools/claims-v3/dtf/ holds the generator, the ELF check, the runner, the reduction and this page's builder. docs/reports/data/2026-10-21-dtf/ is the record this page is built from, and it ships in the same commit: cards.json, dtf.json, facts.json, gen.sha256, manifest-a2.json, manifest.json, predictions.json, reduce.txt, runs.csv at the top; 5 proof files under proof/ (three ELF checks and a sys_emu log); the raw passes as aifoundry1-c0/dtf+dtf-smoke, aifoundry2/dtf+dtf-cam+dtf-smoke, aifoundry3/dtf+dtf-smoke, independent/ — 45 pass directories in all, each holding block.json, code.sha256, configs.json, elf.sha256, gen.sha256, manifest.txt, marks.jsonl, run.log, runs.jsonl, telemetry.jsonl.gz; the camera block's cam.json, tier1.json and 5 PNGs under aifoundry2/dtf-cam-analysis/; and the reduction's three outputs, dtf.json, reduce.txt, runs.csv. That is 491 files and 27.9 MB. Every number on this page comes out of dtf.json in that directory, or out of cam.json beside it; the page's own builder prints which file answered for each one.

Related

• Deterministic Transistor-Flip Experiments on 1,024 RISC-V Cores — the page under test, 20 Oct 2026.
• What one flipped bit costs on the ET-SoC-1 — E60, the Hamming ladder, whose intervals (30.00–31.17 fJ for a result bit, 52.00–53.10 fJ for an input plus an output bit, and 26.00–30.20 fJ for a read-port bit) every target here is tied to.
• A bit flip in microns — what a flipped bit is, in metal.
• The pre-registration, its §1 desk check, §3 what is not testable and §9 decision rules — binding, with amendments A1 and A2 at the end.