# Testing

## Purpose

Tests prove each low-level primitive before the runtime claims TinyLM-16M support.

## Constraints

Tests use Rust's built-in test framework only. No external crates, Python fixtures, npm harness, or generated test code are required for unit tests. The workspace denies missing public Rust documentation, and release/test helpers run strict rustdoc checks for the runtime library plus the no-crate Rust tool binaries.

## Coverage Goals

Changed code should target at least 75% automated coverage. Each new or changed method parameter should have a related automated test for its accepted behavior, rejection behavior, or boundary effect. Standalone test files should mirror the tested source filename with `_test` appended before the extension; inline Rust unit tests remain acceptable where the module already uses that pattern.

## Data Structures

The required test surface covers byte tokenizer, UTF-8 prompt handling, byte and BPE bounded decode overflow, custom BPE section parsing, deterministic BPE merge/decode behavior, BPE validator rejection, tiny BPE `.slm` runtime generation with merged token diagnostics, BPE stochastic top-k above byte-tokenizer vocabulary size, TensorView and MutableTensorView shape/index contracts, dot product known output and mismatch rejection, RMSNorm, softmax, empty softmax rejection, matvec, matmul, SiLU, SwiGLU, q8 dequant, q4 dequant, block-size-aware q4 matvec, q8/q4 re-quantization helpers, RoPE, KV cache byte-budget and page-count reporting, `.slm` header parsing, invalid magic, checksum rejection, native `.slm` admission validation, parent compatibility report generation, candidate lineage template validation, direct-parameter blend, task-delta, sparse task-delta, crossover, and bounded mutation operator validation, raw ADP1, sparse ASP1, and low-rank ALR1 adapter-delta artifact validation, trained low-rank adapter source validation, adapter-fuse candidate validation, runtime f32/q8_0/q4_0 `ADP1`, `ASP1`, and `ALR1` adapter apply, runtime assembly diagnostics for adapter apply count plus model/adapter assembly checksums and KV-cache byte/page fields, candidate artifact manifest validation, multi-parent candidate manifest validation, candidate promotion template validation, multi-parent promotion template validation, multi-parent admission record validation, generated browser multi-parent bundle writing, runtime WASM manifest writing, generated registry-carried adapter-family writing, runtime-smoke sidecar validation, selector admission record validation, promotion ledger validation, selector registry validation, optional browser selector registry intake markers, browser-served runtime manifest verification, browser-served multi-parent selector registry routing, browser-served generated multi-parent artifact routing, browser f32/q8_0/q4_0 adapter sidecar routing, browser registry-carried f32/q8_0/q4_0 adapter-family routing, trained-source layout validation, source-weight constraint rejection, trained-source conversion, BPE trained-source manifest validation, BPE trained-source q8_0 conversion, tied-output trained-source manifest validation, tied-output trained-source f32/q8_0/q4_0 conversion, native eval-case parsing and execution, native `tinyrustlm-eval` CLI sidecar execution, exact eval case-count validation, `.slm` provenance manifest validation, `.slm` quality-gate validation, per-case assistant-quality evidence validation, missing tensors, pre-resolved tensor indices, tied-output projection fallback, tied-output `.slm` validation without `output.weight`, missing-output rejection without the tied flag, tied-output runtime generation, greedy sampling, seeded temperature/top-k/top-p sampling, fixed-buffer stochastic candidate selection, runtime sampling configuration diagnostics, context-boundary acceptance and rejection, output-buffer overflow cleanup, reusable generation scratch/logits stability, allocation-free top-k diagnostic selection, EOS stopping, f32 tiny fixture generation, q8_0 tiny fixture generation, q4_0 tiny fixture generation, TinyLM-16M f32/q8_0/q4_0 smoke generation, Rust local-server request parsing and traversal rejection, Rust mini browser harness contract validation, WASM ABI invalid-prompt, invalid-sampling, step-token, adapter apply, and model-free handling, browser UI smoke generation, browser Step Token click-through, browser adapter sidecar click-through, conversation transcript rendering, desktop/mobile UI audit, malformed model UI handling, missing model UI handling, context overflow UI handling, repeated browser reload/reset/model-switch smoke, and benchmark-panel performance smoke.

Model-breeding population coverage also includes population review validation with objective-vector checksum drift rejection, parent-pool recipe validation with relatedness checksum drift rejection, sign-merge candidate validation from reviewed parent-pool recipes through recomputable candidate receipts that echo relatedness fields, multi-parent candidate manifest validation from those receipts, multi-parent promotion template validation from those manifests, multi-parent admission record validation from runtime/eval evidence, selector-registry validation from mixed selector plus multi-parent admission records, and generated browser bundle validation from parent seeds through selector routing.

Trained adapter source ALR1 coverage includes source-factor conversion for f32 and q8_0 bases, recomputed source-backed ALR1 manifests, base contract mismatch rejection, and ALR1 artifact checksum drift rejection.

Registry adapter-family coverage adds selector tests for multiple adapter routes on one admitted entry, q8_0 registry adapter route admission, selector genome id and genome lineage checksum generation, selector species id and species-fit checksum generation, selector novelty id and behavior-sketch checksum generation, selector population id and population-review checksum generation, selector mate-selection id, status, parent count, and checksum generation, selector phenotype-evidence id, status, provenance-manifest checksum, and checksum generation, selector heritable-artifact id, status, and served-artifact checksum generation, scoped fitness-vector checksum generation, genome drift rejection, species drift rejection, novelty drift rejection, population drift rejection, mate-selection drift rejection, mate-selection parent-count drift rejection, phenotype-evidence drift rejection, heritable-artifact drift rejection, fitness drift rejection, apply-status-to-quantization matching, duplicate adapter route rejection, adapter auto-apply stack-count drift rejection, module-plan route generation, module-plan count drift rejection, module-plan resource-envelope drift rejection, module-plan profile drift rejection, module-plan execution-profile drift rejection, module-plan fetch-policy drift rejection, module-plan fetch-count limit generation/missing/drift rejection, module-plan runtime scratch budget drift/missing/malformed rejection, module-plan prompt byte-limit generation and drift rejection, module-plan output-limit generation and drift rejection, module-plan KV-cache byte-budget/page-count generation and drift rejection, module-plan context token limit generation and drift rejection, module-plan tokenizer checksum generation and drift rejection, module-plan sampler candidate cap generation and drift rejection, module-plan adapter-stack byte-budget generation and drift rejection, module-plan total-budget and total-limit drift rejection, generated bundle tests for f32/q8_0/q4_0 self ADP1, family ADP1, sparse ASP1, and source-backed low-rank ALR1 sidecars, ordered stack metadata, module-plan profile metadata, execution-profile metadata, fetch-policy metadata, fetch-count-limit metadata, runtime scratch metadata, prompt-limit metadata, output-limit metadata, tokenizer metadata, sampler-cap metadata, context metadata, KV-cache metadata, total-limit metadata, module byte-count metadata, module checksum metadata, module role metadata, module assembly-slot metadata, module phase metadata, module dependency metadata, and served `.module-plan.receipt` files, browser parsing of indexed adapter fields plus selector genome/species/novelty/population/mate-selection/phenotype/artifact/fitness provenance fields, `adapter-sidecar-registry-file` proof that the module plan is requested before the generated model while the Module Plan panel displays the verified kind/resource/execution/fetch/fetch-limit/plan-fetches/actual-fetches/actual-route-set/actual-module-bytes/tokenizer/sampler-cap/context/module/model-budget/adapter-budget/stack-budget/scratch-budget/prompt-limit/output-limit/KV-budget/KV-pages/total-budget/total-limit/bytes/checksums/slot/role/phase/dependency/trace/model/stack fields and the family ADP1 plus sparse ASP1 plus source-backed low-rank ALR1 stack is applied before generation, `combined-selector-assembly` proof that one generated `all` root starts on q4_0 then switches through q8_0 and f32 while verifying each module plan before model bytes, matching browser-owned actual fetch count to planned fetch count, matching browser-observed route-set checksum to declared route-set checksum, matching browser-observed actual module bytes to receipt-declared module byte rows, rendering registry-backed provenance genome/species/novelty/population/mate-selection/phenotype/artifact/fitness rows, and auto-applying each stack before generation, `module-plan-fetch-count-drift` proof that checksum-consistent fetch-count limit drift stops before generated model bytes, adapter-family receipts, adapter manifests, or stack artifacts, `module-plan-prompt-limit-drift` proof that checksum-consistent prompt-limit drift stops before generated model bytes, adapter-family receipts, adapter manifests, or stack artifacts, and source-root `prompt-limit` proof that oversized prompt bytes stop before WASM prompt transfer.

Selector novelty, population, mate-selection, phenotype, and heritable-artifact coverage adds deterministic `entry.N.novelty_id`, `entry.N.novelty_strategy`, `entry.N.novelty_status`, `entry.N.novelty_checksum`, `entry.N.population_id`, `entry.N.population_strategy`, `entry.N.population_status`, `entry.N.population_checksum`, `entry.N.mate_selection_id`, `entry.N.mate_selection_strategy`, `entry.N.mate_selection_status`, `entry.N.mate_selection_parent_count`, `entry.N.mate_selection_checksum`, `entry.N.phenotype_evidence_id`, `entry.N.phenotype_evidence_strategy`, `entry.N.phenotype_evidence_status`, `entry.N.phenotype_evidence_checksum`, `entry.N.provenance_manifest_checksum`, `entry.N.heritable_artifact_id`, `entry.N.heritable_artifact_strategy`, `entry.N.heritable_artifact_status`, and `entry.N.heritable_artifact_checksum` generation, novelty, population, mate-selection, phenotype-evidence, and heritable-artifact drift rejection, parent-count contract rejection, generated bundle assertions, browser registry intake, the Model Provenance `Novelty`, `Population`, `Mate Selection`, `Phenotype`, and `Artifact` rows, and `combined-selector-assembly` proof that q4_0/q8_0/f32 entries render Genome, Species, Novelty, Population, Mate Selection, Phenotype, Artifact, Fitness, eval cases, and eval checksum together.

Module-plan origin policy coverage adds selector validation for `module_plan_origin_policy=same-origin-loopback-local-v1`, generated bundle receipt metadata, the Module Plan `Origin` row, and `module-plan-origin-policy-drift` proof that checksum-consistent origin drift stops before generated model bytes or adapter stack routes. Module-plan WASM export-set coverage adds selector validation for `module_plan_wasm_export_set=tinyrustlm-generate-v1`, generated bundle receipt metadata, instantiated WASM export checks, the Module Plan `WASM ABI` row, and `module-plan-wasm-export-set-drift` proof that checksum-consistent export-set drift stops before generated model bytes or adapter stack routes.

`combined-selector-cycle` also records release-before-reassembly evidence: the initial q4_0 pass uses the page's loaded model, and every later q8_0/f32/q4_0/q8_0/f32 pass must call `free_model` before the next generated stack validation begins.
`combined-selector-route-soak` extends the same path to three q4_0/q8_0/f32 cycles and requires per-pass requests for every generated self-assembly file route. `combined-selector-route-extended-soak` raises that proof to five q4_0/q8_0/f32 cycles in one page. `combined-selector-route-stress-soak` raises it to eight q4_0/q8_0/f32 cycles in one page.

`assembly-evidence-file-drift` complements `assembly-eval-case-drift` by leaving selector, module-plan, model, manifest, and assembly receipt bytes valid while mutating one fetched evidence file body; the smoke requires rejection before later evidence files, adapter-family receipt, adapter manifests, or stack adapter bytes are requested.

## Binary Formats

The tiny test models use the same `.slm` v1 format with hidden size 8, one layer, two heads, head dimension 4, ffn size 16, and context 16. The byte-tokenizer f32/q8_0/q4_0 tiny fixtures use vocab 260 and must generate the same deterministic output. The tied-output tiny fixture also uses vocab 260, omits `output.weight`, and must generate through the `tok_embeddings.weight` projection route only because the v1 tied-output flag is set. The BPE tiny fixture uses vocab 262 and must prove prompt `the` merges into token `261` before generation. The TinyLM-16M f32, q8_0, and q4_0 smoke models use hidden size 512, four layers, eight heads, ffn size 2048, and context 512.

## Failure Cases

Malformed headers, malformed tokenizer sections, BPE vocab/header drift, BPE merge outputs missing from the token table, BPE source tokenizer/shape disagreement, BPE source merge ids outside vocabulary, zero checksums, checksum mismatches, runtime WASM manifest drift, source checksum drift, source path traversal, non-finite source weights, source weight values outside the accepted range, tied source manifests that retain `output.weight`, tied-output/model-shape disagreement, untied source manifests that omit `output.weight`, zero-case eval files, undeclared eval-case keys, empty exact-case prompts or outputs, manifest checksum mismatches, manifest trained-quality overclaims, blend parent checksum drift, blend candidate byte drift, invalid blend weights, task-delta parent checksum drift, task-delta candidate byte drift, invalid task-delta weights, sparse task-delta candidate byte drift, invalid sparse delta weights, invalid sparse keep rates, crossover parent checksum drift, crossover candidate byte drift, invalid crossover seeds, invalid crossover keep rates, mutation parent checksum drift, mutation candidate byte drift, invalid mutation seeds, invalid mutation rates, invalid mutation magnitudes, adapter parent checksum drift, adapter byte drift, adapter manifest drift, adapter-fuse manifest drift, adapter-fused candidate byte drift, runtime adapter identity drift, runtime adapter checksum drift, runtime adapter non-finite deltas, runtime adapter fused-value overflow, q8/q4 adapter identity drift, runtime-smoke sidecar manifest drift, admission record evidence drift, promotion ledger entry drift, duplicate ledger candidates, duplicate ledger candidate checksums, selector registry entry drift, selector id mismatch, duplicate registry candidates, unserved registry model paths, pending quality eval templates, smoke-model assistant-quality claims, converted-trained assistant-quality claims without eval evidence or quality scope, assistant-quality sidecars without case totals, assistant-quality sidecars with mismatched per-case text, missing tensors, wrong dimensions, invalid tokenizer ids, generated decoded text above the 64 KiB result cap, invalid UTF-8 prompt bytes, null prompt pointers, zero prompt lengths, zero generation lengths, context overflow, and unloaded generation must fail with explicit error codes.

Population-review, parent-pool-recipe, sign-merge, multi-parent candidate, multi-parent promotion, and multi-parent admission cases must also reject ledger drift, admission drift, objective-vector field drift, mixed direct-parameter contracts, parent relatedness checksum drift, parent order drift, parent checksum drift, candidate byte drift, receipt drift, manifest drift, promotion drift, runtime-smoke drift, eval drift, and overbroad route claims.

## Validation Rules

Each parser test must provide concrete bytes, including checksum-bearing valid headers and deliberate checksum mismatches. Tokenizer tests must cover byte round trip, BPE ranked merge/decode behavior, and bounded decode failures that preserve the previous output string. Native validator tests must accept a generated fixture, accept a BPE tokenizer section when the model header vocab matches, reject BPE vocab drift, accept the checked-in tied-output fixture without `output.weight`, reject the same missing-output condition without the tied flag, and reject non-finite f32 payload values. Parent compatibility tests must accept matching parent layouts, reject q8_0/q4_0 direct-parameter pairs through quantization and tensor layout mismatch, reject tokenizer and shape mismatch, and reject output-head contract mismatch. Candidate lineage tests must write and validate a template from a passing compatibility report, reject failed compatibility reports, reject compatibility checksum drift, reject copied parent-field drift, and reject invalid candidate ids. Blend operator tests must write and validate weighted f32 and q8 candidates, prove receipt recomputation, reject parent checksum drift, reject candidate byte drift, and reject invalid blend weights. Task-delta operator tests must write and validate weighted f32 and q8 candidates, prove receipt recomputation for `base + weight * (target - base)`, reject parent checksum drift, reject candidate byte drift, and reject invalid signed task-delta weights. Sparse task-delta tests must write and validate f32 and q8 candidates, prove keep-all matches the target values, prove keep-zero preserves the base values, prove partial keep selects some deltas while preserving other base entries, reject candidate byte drift, and reject invalid sparse weights or keep rates. Crossover operator tests must write and validate seeded f32 and q8 candidates, prove seed changes alter candidate bytes and mask checksum, prove keep-zero selects parent 1, prove keep-all selects parent 0, reject parent checksum drift, reject candidate byte drift, and reject invalid seeds or keep rates. Mutation operator tests must write and validate seeded f32 and q8 candidates, prove seed, rate, magnitude, and reference-parent scale affect output or receipt fields, prove rate-zero and magnitude-zero boundaries preserve base values, reject parent checksum drift, reject candidate byte drift, and reject invalid seeds, rates, or magnitudes. Adapter-delta tests must write and validate f32 and q8 raw ADP1 task-delta packages, sparse ASP1 task-delta packages, and low-rank ALR1 task-delta packages, prove package and manifest recomputation, reject parent checksum drift, reject adapter byte drift, and reject adapter manifest drift. Trained adapter source tests must write and validate low-rank factor source fixtures, verify tied-output source shape handling, reject factor checksum drift, reject factor path escape, and reject non-finite factor payloads after checksum refresh. Adapter-fuse tests must fuse f32 and q8 raw adapter packages into normal `.slm` candidates, prove candidate and receipt recomputation, reject adapter manifest drift, and reject fused candidate byte drift. Runtime adapter tests must apply f32, q8_0, and q4_0 `ADP1` packages, sparse `ASP1` packages, and low-rank `ALR1` packages to loaded models, prove tensor mutation or compact zero-delta preservation, prove q8_0/q4_0 models remain compact after re-quantization, reject identity drift without mutation, reject checksum and non-finite payload drift, and prove `Runtime::apply_adapter_delta` resets generation diagnostics after success. Candidate artifact tests must write and validate a manifest from compatibility, lineage, and a candidate `.slm`, reject parent-contract mismatch, reject lineage checksum drift, reject candidate artifact drift, and reject manifest field drift. Candidate promotion tests must write and validate a promotion template, reject candidate manifest checksum drift, reject candidate artifact drift, reject promotion overclaims, and reject invalid promoter ids. Runtime-smoke sidecar tests must round-trip the sidecar and reject manifest drift. Selector admission tests must write and validate an admission record, reject runtime-smoke drift, reject eval sidecar drift, reject public-claim overreach, reject incomplete case totals, and reject invalid selector ids. Promotion ledger tests must write and validate a ledger from admission records, reject empty input, reject duplicate candidate ids, reject duplicate candidate checksums, reject entry drift, and reject unexpected ledger keys. Selector registry tests must write and validate a registry from admission records, reject empty input, reject selector id mismatch, reject duplicate candidates, reject unserved candidate paths, and reject registry entry drift. Runtime BPE tests must load the checked-in tiny BPE `.slm`, generate from prompt `the`, assert diagnostics show merged token output `256,261` with f32 quantization, and prove stochastic top_k 262 passes the fixed 1024-candidate sampler cap. Runtime tied-output tests must load the checked-in tiny tied-output `.slm` and generate locally through the token-embedding output projection path. Runtime output-buffer tests must prove `OutputBufferExceeded` writes the readable result message, clears token and generated-token state for full generation failures, and resets generated-count diagnostics to zero. Trained-source tests must validate a generated source fixture, convert it to f32, q8_0, and q4_0 `.slm` artifacts, reject source checksum drift, reject unsafe source paths, and reject non-finite source weights even when the source checksum is refreshed. BPE trained-source tests must generate `tiny-fixture-bpe`, verify `tokenizer=bpe-v1`, verify BPE token/merge records, convert the source into a q8_0 `.slm`, verify the output carries a `BPE1` tokenizer section, validate its converted-trained manifest, and reject BPE tokenizer/shape or merge-id drift. Tied trained-source tests must generate `tiny-fixture-tied`, verify `tied_output=true`, verify `tensor_count=11`, verify `output.weight` is absent, convert the source to f32, q8_0, and q4_0, verify each converted `.slm` carries the v1 tied-output flag, and validate every converted manifest. Eval-runner tests must parse valid exact cases, reject unsupported match modes, reject zero-case files, reject stray case keys outside the declared count, and the CLI smoke must produce an eval sidecar that passes assistant-quality only for the fixture scope. Manifest tests must round-trip generated fixture provenance, reject checksum drift, and reject trained-quality overclaims. Quality-gate tests must allow runtime-smoke evidence, reject deterministic-smoke assistant-quality claims, reject converted-trained assistant-quality claims without eval evidence, reject pending eval templates, reject passed eval sidecars that omit case evidence, reject sidecars with mismatched per-case actual text, and allow converted-trained artifacts only when the task-eval sidecar passes with a quality scope, positive case count, all cases passed, zero failed cases, and exact per-case matches. Model routing tests must prove loaded models expose pre-resolved tensor indices and tied-output projection flags route the output projection to token embeddings. The Rust mini browser harness must prove the optional selector registry path is local, checks for `admitted-records-only`, and keeps the checked-in smoke routes intact when no registry is present. Each math test must compare against known vectors with tight tolerances, and direct core-op tests must cover dot, matvec, matmul, RMSNorm, softmax, SiLU, SwiGLU, and shape or length rejection paths. Unit generation tests must use the tiny fixtures, not TinyLM-16M. Runtime smoke tests may load `tinylm16-f32.slm`, `tinylm16-q8.slm`, and `tinylm16-q4.slm` outside unit tests. Runtime tests must assert diagnostics show the loaded quantization mode for q8_0, q4_0, BPE, tied-output, and post-adapter f32/q8_0/q4_0 fixtures. Diagnostics tests must prove handwritten JSON escapes quotes, backslashes, control characters, line separators, and paragraph separators before browser parsing.

Sparse receipt tests must also prove the implicit mask metadata is stable and useful: density and mask checksum fields change when the selected top-k positions change.

Trained adapter source ALR1 tests must also prove `convert-adapter-source` and `validate-converted-adapter-source` rebuild the same package and manifest from source factors plus base `.slm` identity.

Population-review tests must recompute ranking, frontier selection, weighted objective-vector metadata, and per-entry objective-vector checksums from ledger plus admissions; parent-pool recipe tests must recompute shared contract fields, seed weights, relatedness metric/scope/pair count/status, shared relatedness checksum, and per-parent relatedness group fields. Sign-merge tests must write and validate receipt text, accept path-preserving parent fixtures, echo recipe relatedness fields, reject single-parent recipes, reject parent order or checksum drift, and reject candidate byte drift. Multi-parent candidate manifest tests must write and validate text and path manifests, bind the sign-merge receipt checksum plus relatedness and candidate fields, reject receipt drift, reject manifest drift, and reject candidate byte drift. Multi-parent promotion tests must write and validate text and path templates, bind candidate manifest checksum, operator receipt checksum, recipe checksum, parent count, and candidate `.slm` fields, then reject manifest drift, promotion drift, and candidate byte drift. Multi-parent admission tests must write and validate text and path records, bind the promotion template, provenance manifest, runtime-smoke sidecar, eval sidecar, eval-case evidence checksum, candidate fields, parent-pool evidence checksums, and selector-route next gate, then reject runtime-smoke drift, eval drift, route overclaim, and incomplete case totals. Selector registry tests must validate multi-parent admission records, mixed selector plus multi-parent admission registries, `entry.N.eval_case_evidence_checksum`, `entry.N.genome_id`, `entry.N.genome_lineage_checksum`, `entry.N.species_id`, `entry.N.species_fit_checksum`, `entry.N.novelty_id`, `entry.N.novelty_checksum`, `entry.N.population_id`, `entry.N.population_checksum`, `entry.N.mate_selection_id`, `entry.N.mate_selection_parent_count`, `entry.N.mate_selection_checksum`, `entry.N.phenotype_evidence_id`, `entry.N.phenotype_evidence_checksum`, `entry.N.provenance_manifest_checksum`, `entry.N.fitness_vector_checksum`, f32/q8_0/q4_0 adapter route fields, indexed adapter-family fields, stack metadata fields, module-plan resource fields, module-plan fetch policy, module-plan fetch-count limit, module-plan context token limit, module-plan byte-count, checksum, role, slot, phase, and dependency fields, duplicate adapter-route rejection, apply-status-to-quantization matching, and unsupported admission-version rejection before browser selector intake. Browser bundle tests must write the app shell, WASM runtime, runtime WASM manifest, quantization-selected `multi-parent-sign-merge-f32`, `multi-parent-sign-merge-q8`, or `multi-parent-sign-merge-q4` `.slm` files, manifests, evidence sidecars, self ADP1, family ADP1, sparse ASP1, and source-backed low-rank ALR1 packages, their manifests, selector genome/species/novelty/population/mate-selection/phenotype/fitness fields, module-plan resource receipts with context token limit, fetch policy, fetch-count limit, byte counts, checksums, roles, assembly slots, phases, and dependencies, assembly receipts with eval-case checksums, adapter-family receipts, stack fields, and `models/selector.registry`; browser smoke must then load the served files with `multi-parent-registry-file`, verify the generated module-plan request and rendered Module Plan panel fields with `adapter-sidecar-registry-file`, auto-apply the registry-supplied family ADP1 plus sparse ASP1 plus source-backed low-rank ALR1 stack for generated f32/q8_0/q4_0 roots, verify registry-backed provenance genome, species, novelty, population, mate-selection, phenotype, fitness, eval cases, and eval checksum, run `assembly-eval-case-drift` when assembly digest matching changes, and apply an intercepted q8_0 registry sidecar with `adapter-sidecar-registry-q8`.

Module-plan origin policy browser smoke must run `module-plan-origin-policy-drift` when generated selector origin fields, receipt origin validation, Module Plan `Origin` rendering, or same-origin browser assembly routes change.

Fetched assembly evidence browser smoke must run `assembly-evidence-file-drift` when evidence-file integrity or `verifyAssemblyEvidenceFiles` changes, proving a single served evidence body drift stops startup before later evidence, adapter-family, adapter manifest, or stack artifact routes.

Adapter-family receipt browser smoke must run `adapter-family-receipt-drift` when `loadAdapterFamilyReceipt`, adapter-family receipt text checks, or post-evidence auto-assembly sequencing changes, proving receipt byte drift stops before adapter manifests or stack artifacts while the accepted model remains loaded.

Adapter manifest browser smoke must run `adapter-manifest-drift` when `validateAdapterManifest`, adapter manifest checksum checks, or post-receipt auto-assembly sequencing changes, proving same-byte manifest drift stops before later manifests or stack artifacts while the accepted model remains loaded.

Adapter artifact browser smoke must run `adapter-artifact-drift` when adapter artifact checksum checks, fetched stack artifact byte transfer, or post-manifest auto-assembly sequencing changes, proving artifact byte drift stops before later stack artifacts or `apply_adapter_delta` while the accepted model remains loaded.

Adapter stack preflight browser smoke must run `adapter-stack-prefetch-drift` when auto-applied stack artifact fetch order or pre-WASM transfer changes, proving later stack drift cannot leave an earlier adapter already applied.

Adapter stack Rust validation browser smoke must run `adapter-stack-rust-validate-drift` when generated auto-stack semantic validation, checksum echo routing, or validation failure state changes, proving browser-valid stack bytes still stop at Rust validation before mutation.

Adapter-family browser smoke must show the generated self ADP1, family ADP1, sparse ASP1, and low-rank ALR1 adapter labels, render the verified Module Plan panel including fetch limit, tokenizer, sampler cap, context, prompt limit, output limit, byte, checksum, slot, role, phase, and dependency summaries, request the receipt-declared family ADP1, sparse ASP1, and low-rank ALR1 stack routes, receive three pre-generation `apply_adapter_delta` calls plus `adapter_stack_applied(3)`, verify Rust diagnostics report `adapter_apply_count=3` with nonzero `last_adapter_checksum` and `assembly_state_checksum`, and verify f32/q8_0/q4_0 generation diagnostics are cleared before generation. `module-plan-context-token-drift` must pass when selector context-token binding or receipt validation changes, `module-plan-tokenizer-drift` must pass when selector tokenizer checksum binding or receipt validation changes, `module-plan-sampler-cap-drift` must pass when sampler-cap binding or receipt validation changes, `module-plan-fetch-count-drift` must pass when generated self-assembly route-count limits change, `module-plan-prompt-limit-drift` must pass when prompt transfer caps or receipt validation changes, source-root `prompt-limit` must pass when browser prompt-copy behavior changes, and `module-plan-output-limit-drift` must pass when generated-output caps or receipt validation changes.

Public Rust API documentation is an acceptance gate. Run `cargo rustdoc -p tinyrustlm-runtime --lib -- -D missing_docs` and matching `cargo rustdoc --bin ... -- -D missing_docs` checks for `tinyrustlm-slm-pack`, `tinyrustlm-local-server`, and `tinyrustlm-browser-harness` before claiming public function documentation is complete.

## Future Expansion Path

After unit tests pass, `tools/wasm-abi-smoke.js` loads the generated WASM and local q8_0 `.slm` file, sends invalid UTF-8 bytes and bad ABI arguments through `generate`, rejects invalid sampling config through `set_sampling_config`, restores greedy defaults, checks explicit error diagnostics, verifies valid generation still recovers, steps one more token through `generate_next_token`, reloads the tiny f32 fixture, validates a zero-delta `ADP1` package through `validate_adapter_delta`, applies the same package through `apply_adapter_delta`, verifies runtime assembly diagnostics increment and carry nonzero adapter/assembly checksums, then frees the model and verifies later generation returns `ModelNotLoaded` with assembly state cleared. The Rust mini browser harness checks the static app tree for required UI ids, local-only markers, WASM boundary markers, runtime WASM manifest route and fields, adapter stack and module-plan strategy markers, Rust WASM export definitions, local model routes, local adapter routes, manifest sidecars, trained-quality non-claims, provenance eval case fields, and optional loopback content types. The Rust local server is checked directly with loopback HTTP probes for the app, WASM, runtime manifest, model, and manifest routes. `tools/browser-smoke.js` exercises the static app with a local server and the generated WASM file. Single-model mode checks one generate action plus User/TinyRustLM transcript entries and the runtime manifest request; `runtime-manifest-drift` mode serves a valid-shaped runtime manifest with a mismatched checksum, proves boot stops before any model route is requested, and leaves runtime controls disabled. `step-token` mode checks disabled-before-context Step Token state, generate `e`, Step Token appends a second `e`, transcript continuation, console output, diagnostics, benchmark generated count, and local-only requests. `adapter-sidecar` mode switches to the selected tiny f32/q8_0/q4_0 fixture, generates one token, clicks Apply Adapter for the matching zero-delta `ADP1` sidecar, then verifies `adapter applied`, matching quantization diagnostics, cleared token/KV state, `adapter_apply_count=1`, nonzero adapter and assembly checksums, and local-only requests. `adapter-sidecar-registry-q8` mode serves a registry entry for the tiny q8_0 fixture with a matching quantized adapter apply status and eval-case checksum, then verifies the registry-supplied q8_0 sidecar reaches Rust and clears diagnostics. `adapter-sidecar-checksum-mismatch` mode serves a corrupted local ADP1 response and verifies the browser rejects it before calling `apply_adapter_delta` while preserving prior generation diagnostics. `multi-parent-registry` mode serves a local `models/selector.registry` fixture for `multi-parent-sign-merge-q8`, proves the selector contains only that registry option, loads the mapped q8_0 model through `../models/tinylm16-q8.slm`, renders registry-backed eval case proof, and keeps all requests on the loopback app origin. `multi-parent-registry-file` mode uses a `browser-multi-parent-bundle` root and proves the selected generated f32/q8_0/q4_0 entry loads from served `selector.registry`, `.module-plan.receipt`, `.slm`, `.slm.manifest`, assembly receipt, and evidence files. `adapter-sidecar-registry-file` mode uses that generated root, displays the registry-supplied adapter options and provenance eval checksum, requires the module-plan request before generated model load, verifies visible Module Plan fetch-limit, model/adapter/stack/scratch/output/KV/total budget rows plus ordered byte, checksum, slot, role, phase, dependency, and trace summaries, fetches the receipt-declared family ADP1 plus sparse ASP1 plus low-rank ALR1 stack, verifies Rust validates all three packages before any apply, and verifies Rust applies all three packages before generation while preserving the selected quantization mode and reporting assembly count/checksums. `combined-selector-assembly` mode uses a generated `all` root, confirms the q4_0 default, then switches through q4_0, q8_0, and f32 generated entries while checking each module-plan route precedes model bytes, each stack validates and auto-applies before generation, each runtime diagnostics payload reports `adapter_apply_count=3`, and each registry-backed entry displays the same eval-case checksum. `combined-selector-cycle` mode uses the same generated `all` root shape, repeats q4_0/q8_0/f32 switching for the requested cycle count, and requires each pass to add fresh Rust validation, apply, stack completion, reset diagnostics, runtime assembly diagnostics, and one-token generation evidence. `assembly-eval-case-drift` mode keeps selector, module-plan, and assembly receipt checksums internally aligned while changing the assembly eval-case digest, then proves evidence and adapter-family routes are not requested. `module-plan-fetch-policy-drift` mode keeps the drifted receipt checksum consistent, changes `module_plan_fetch_policy`, and proves the browser stops before the generated `.slm`, adapter-family, adapter-manifest, or stack artifact routes. `module-plan-fetch-count-drift` mode keeps the drifted receipt checksum consistent, changes `module_plan_fetch_count_limit`, and proves the browser stops before the generated `.slm`, adapter-family, adapter-manifest, or stack artifact routes. `module-plan-resource-drift` mode keeps the drifted receipt checksum consistent, changes the receipt adapter byte budget, and proves the browser stops before the generated `.slm` route. `module-plan-output-limit-drift` mode keeps the drifted receipt checksum consistent, changes `module_plan_output_byte_limit`, and proves the browser stops at module-plan validation. `module-plan-adapter-stack-budget-drift` mode keeps the drifted receipt checksum consistent, changes the exact stack payload budget, and proves the browser stops before generated model bytes, adapter-family receipt, adapter manifests, or stack artifact routes. `module-plan-count-drift` mode keeps the drifted receipt checksum consistent, changes receipt `module_count`, and proves the browser stops before the generated `.slm`, adapter-family, adapter-manifest, or stack artifact routes. `module-plan-graph-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.0.path`, and proves the browser stops before the generated `.slm` route. `module-plan-stack-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.4.adapter_path`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `module-plan-role-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.4.role`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `module-plan-slot-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.4.assembly_slot`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `module-plan-phase-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.4.phase`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `module-plan-byte-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.0.byte_count`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `module-plan-checksum-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.4.checksum`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `module-plan-dependency-drift` mode keeps the drifted receipt checksum consistent, changes the receipt `module.4.depends_on`, and proves the browser stops before the generated `.slm`, stack adapter, and stack adapter manifest routes. `loop` mode reloads, runs q8 generation twice around reset, switches to q4, repeats generation and reset, and fails if a non-local HTTP origin is requested. `ui-audit` mode loads fresh desktop and mobile viewports, checks the product shell, footer identity, local-only notice, required panels, model controls, decoding controls, diagnostics/developer mirror, benchmark fields, Module Plan fallback budget, fetch limit, output limit, byte, checksum, slot, role, phase, dependency, and trace rows, Model Provenance fallback eval proof fields, empty/generated/cleared transcript state, Step Token state, Clear-button state, response preservation after Clear, layout overflow, generated output, default greedy sampling diagnostics, and local-only requests. `model-error` mode intercepts the local q8 model with invalid bytes and requires `invalid model magic` UI rendering plus recoverable model selection. `context-error` mode submits an over-context prompt and requires `context exceeded` UI rendering. `missing-model` mode returns a local 404 for the q8 model and requires readable fetch-error UI plus recoverable model selection. `endurance` mode repeats q8/q4 ready, generate, and reset cycles. `performance` mode runs multi-token q8/q4 generation and verifies benchmark prompt tokens, generated tokens, token speed, scratch bytes, quantization mode, reset recovery, and local-only requests. `performance-soak` mode repeats multi-token q8/q4 generation across cycles and requires every cycle to preserve benchmark fields, KV length, reset recovery, deterministic output, and local-only requests.

Browser-owned Module Plan actual-checksum changes are covered by source-root `ui-audit`, generated-root `combined-selector-assembly`, and generated-root `adapter-sidecar-registry-file`. The generated smokes require `Actual Module Checksums` to equal the declared checksum summary after accepted model, manifest, assembly receipt, adapter-family receipt, and ADP1/ASP1/ALR1 stack payloads are observed. `module-plan-payload-checksum-drift` coherently rewrites the family ADP1 payload checksum through its manifest, adapter-family receipt, assembly receipt, selector registry, and module-plan receipt while leaving the module checksum row stale, then proves the browser stops after selector plus module-plan receipt and before generated model, assembly, adapter-family, manifest, or stack routes.

For selector reuse changes, `combined-selector-cycle` specifically checks that `free_model(previous -> next) -> 0` appears once per post-initial pass and before the first `validate_adapter_delta` for the next assembled entry. For longer selector-route exercises, `combined-selector-route-soak`, `combined-selector-route-extended-soak`, and `combined-selector-route-stress-soak` specifically check repeated route counts for module plans, models, manifests, assembly receipts, evidence files, adapter-family receipts, adapter manifests, and stack artifacts.

`module-plan-operator-receipt-drift` keeps the drifted module-plan receipt checksum consistent with the selector registry while changing `operator_receipt_checksum`, then proves the browser stops after the selector registry plus module-plan receipt and before generated model bytes, assembly evidence, adapter-family receipt, adapter manifests, or stack artifacts.

`assembly-evidence-file-drift` mode leaves selector, module-plan, model, manifest, and assembly receipt bytes valid while changing one fetched evidence file body, then proves later evidence files, adapter-family routes, adapter manifests, and stack artifacts are not requested. `adapter-family-receipt-drift` mode leaves selector, module-plan, model, manifest, assembly receipt, and all evidence files valid while changing the adapter-family receipt text at the same byte length, then proves adapter manifests and stack artifacts are not requested. `adapter-manifest-drift` mode leaves that receipt chain valid while changing the family ADP1 manifest text at the same byte length, then proves later adapter manifests and stack artifacts are not requested. `adapter-artifact-drift` mode leaves manifests valid while changing the first family ADP1 artifact bytes, then proves sparse and low-rank artifacts are not requested and Rust adapter apply is not called. `adapter-stack-prefetch-drift` mode leaves manifests valid while changing the second sparse ASP1 artifact bytes, then proves family ADP1 and sparse ASP1 are fetched for preflight, low-rank ALR1 is not fetched, and Rust adapter apply is not called. `adapter-stack-rust-validate-drift` mode leaves selector, module-plan, assembly, adapter-family, manifest, and artifact checksums aligned while drifting family ADP1 identity, then proves all stack artifacts are fetched, `validate_adapter_delta` returns `shape mismatch`, and `apply_adapter_delta` is not called.