[paragontasx]

What this changes

nvidia/Qwen3.8-Flash-Next-FP4-Local maps every tensor to tensors/model-000NN-of-00021.safetensors.
#1179 lets the core index accept a shard in a folder inside the model folder, but Flash Next validates the weight map
a second time before any header is read, and that gate refused any / with UnsafeFlashShard — so serve stopped
before CUDA init. This is the family half of #1187; filed as #1220.

• families/flashnext/index.zig: shardName/plainPart now take the same rule as core/checkpoint_index.zig
  (plain names joined by /, no empty, hidden, dotted-tail or reserved part, and the file must be .safetensors),
  so tensors/model-…safetensors is admitted while ../, absolute paths, drive names and device stems stay refused.
  It is kept local because this file imports no core by design. Tests: the committed 30-shard fixture is admitted
  flat, admitted identically under tensors/, and refused under ../; plus an accept/refuse table.
• core/checkpoint.zig: a checkpoint whose index names shards in a folder opens and reads a tensor
  (shardFiles + openModel + get), so the loader itself is covered, not only the index.
• cli/pull_test.zig: the fake hub serves tensors/model-…safetensors; the main pull test asserts the snapshot's
  subfolder link resolves to the verified blob and that a second pull reports cached; a security: test pins that
  the nested path stays inside the snapshot. The new sha hex is freed in stopServer.
• cli/hub.zig: sizeOf counts shards in a subfolder (this is the info memory floor a nested checkpoint would
  otherwise undercount); the registry test no longer hardcodes gemma4_unified, which only the Metal registry serves
  — it panicked when the module was tested with the CUDA registry.
• build: pull_test.zig previously ran in no passing no-GPU step. zig/build/pull_tests.zig adds
  test-pull-host (the whole pull suite, part of test-cuda-host, skipped on Windows where the fake hub’s POSIX socket cannot compile), and golden.step now takes the platform's engine
  registry so zig build test-pull-security compiles again — it had been failing the no-GPU CI job since hub.zig
  began reading native_engines. The CUDA host passes native_modules.engines, the Metal host its own engines.

No kernel changes.

Receipt

Environment: Linux x86_64, Zig 0.17.0, no GPU; main @ 8e49cf8 plus this branch.

• zig build test-pull-host → 21 tests pass
• zig build test-cuda-host --summary all → 176/176 steps succeeded
• zig test zig/src/families/flashnext/index.zig → 2/2
• zig fmt --check → clean

Not run, and why

The GPU path: this machine has no NVIDIA device, and the checkpoint-level proof here is the publisher's own index
layout (30 shards, 3,747 tensors) rather than a load. I have a GB10 available and will send a served receipt
(serve nvidia/Qwen3.8-Flash-Next-FP4-Local, --prompt-cache-gib 0) against this branch next, unless you would
rather take it from here.

Fixes #1220. Remaining half of #1187.

[paragontasx]

Served receipt (one GB10, this branch)

Environment: NVIDIA GB10 (DGX Spark), aarch64, driver 580.173.02, CUDA 13.0, nvcc 13.0.88, Zig 0.17.0,
zig build native -Dnvcc=/usr/local/cuda/bin/nvcc -Dsm=121. Source: this PR's head 8e20fd0 on main 8e49cf8.

tensorfold-native serve <nvidia/Qwen3.8-Flash-Next-FP4-Local@b9ce18a6> \
  --name p0-flashnext --host 127.0.0.1 --port 8099 \
  --context 32768 --parallel 4 --temperature 0 --prompt-cache-gib 0

Startup, unedited:

[tensorfold] CUDA sm_121 device 0 (NVIDIA GB10, memory shared with the host): model 73.24 GiB; 4 streams at once,
1.21 GiB each at a 32768-token window, of 14.8 GiB left after a 12.2 GiB reserve; prompts in passes of up to
1536 rows, no prompt cache; own glue kernels
[tensorfold] serving p0-flashnext at http://127.0.0.1:8099/v1 (sampling: greedy; drafts: on; context: 32768;
loaded in 163.1s)

The publisher's tensors/model-000NN-of-00021.safetensors layout loaded as it ships — no symlink folder and no
rewritten index. The same checkpoint on v1.1.2 stops before CUDA init.

Requests (greedy, reasoning_effort: none, 256 tokens):

	measured
drafted, one stream, code	60.5 / 61.4 / 61.1 tok/s, TTFT 143–149 ms, draft acceptance 0.84
"draft": false, same prompt	24.2 tok/s, token_sha identical to the drafted runs
4 streams, drafted, code	59.7 tok/s aggregate (15.4–15.9 each), every reply the solo run's token_sha
~8k-token cold prompt	TTFT 5.93 s

So, on this box and this branch: drafted == "draft": false, and concurrent == solo. Drafted throughput does not
grow with streams because each drafted stream verifies its window in its own pass, as the recipe documents.

Not run here: vision (server started without --vision), requests past the 32,768 window, the kernel-contract
receipts, and two ranks. The box's other work was stopped for this run and restored afterwards.

[ashhart]

Thanks @paragontasx. This is on main now (3aaf727): both commits, with your name and your address in GitHub's numeric noreply form. Flash Next's index admission now takes a shard in a folder inside the model folder by the same rule as the core checkpoint index: plain parts joined by /, no hidden, empty, drive or device names, .safetensors only. ../, absolute paths and the rest are still refused. The pull host tests pass, 21 of 21, along with both new index tests. Closing as landed, and #1220 with it.

- Synthema, Ash's AI Assistant.

[ashhart]

This shipped in TensorFold 1.1.4: https://github.com/ashhart/TensorFold/releases/tag/v1.1.4

Thank you @paragontasx for the contribution.

- Synthema, Ash's AI Assistant.