[leehack]

Summary

• Repin native LiteRT-LM to [email protected] (owner 82d4ae1c, upstream 7a03724c) with tool/native/sync_native_release_pins.py: hook tag, all eight bundle sha256s, companion Package.swift URLs/checksums, companion README/CHANGELOG, macOS prepare script. The rebuild links LiteRT into the Linux and Windows libLiteRtLm (litert-lm-native#112); Apple and Android binaries are byte-identical to v0.19.1.
• Remove the Reject LiteRT-LM native embeddings on unqualified platforms before native calls #1369 embeddings load gate on Linux x64, Linux arm64 and Windows x64 (liteRtLmNativeEmbeddingsQualifiedForAbi) for C API 1 runtimes; Android x86_64 stays refused. The GPU-embedding refusal no longer names v0.18.1.
• Legacy runtimes (no litert_lm_get_api_version, e.g. a v0.18.x LLAMADART_LITERT_LM_LIB_DIR) keep refusing Linux/Windows embeddings with LlamaUnsupportedException naming C API 1 / v0.19.1-1, before any native call (liteRtLmEnsureLegacyNativeEmbeddingsQualified in the legacy client; the C API 1 client keeps the widened gate). Those runtimes crash on desktop embedding creation (LiteRT-LM embeddings fail on Linux arm64 and crash on Windows x64 (all v0.18 pins) #1367); this closes the audit BLOCK where the widened shared gate let them reach native engine creation.
• Suite teardown (test/support/suite_system_temp.dart) on Windows now leaves the *.xnnpack_cache files LiteRT-LM keeps open after dispose, and still fails on any other undeletable file.
• Docs, support matrix, embeddings guide, known issues, both changelogs, llamadart-embeddings / llamadart-getting-started / llamadart-speech skills and capability_coverage.json updated.

Fixes #1367
Fixes #1795

Was published 0.18.0 (native v0.19.0) affected by #1795? Yes, runtime-verified (GCE results): v0.18.0 Qwen3 GPU crashed 3/3 on L4 on Linux (SIGSEGV in TopKWebGpuSampler teardown) and Windows (0xC0000409, same offset as v0.19.1); CPU was fine. Structurally: the v0.19.0 Linux x64 libLiteRtLm.so has DT_NEEDED libLiteRt.so, its Windows LiteRtLm.dll imports libLiteRt.dll, it already contains the source-built TopKWebGpuSampler (35 exported symbols, same as v0.19.1), and its prebuilt libLiteRt.so and libLiteRtWebGpuAccelerator.so are byte-identical to v0.19.1's. That is the exact mixed-runtime configuration that crashes on v0.19.1.

Production-readiness scope

• User-facing scope: LiteRT-LM native CPU embeddings (text, image, audio, batch) work on Linux x64/arm64 and Windows x64; explicit LiteRT-LM GPU generation on Linux x64 and Windows x64 no longer crashes at the first decode.
• Supported platforms/paths: native LiteRT-LM on macOS arm64, iOS, Android arm64 (unchanged binaries), Linux x64/arm64, Windows x64.
• Unsupported or intentionally unavailable paths: Android x86_64 embeddings throw LlamaUnsupportedException at load ("they are not qualified there"); native GPU/NPU embeddings and all Web LiteRT-LM embeddings stay refused. A legacy (v0.18.x) custom runtime on Linux/Windows is refused for embeddings before any native call. C API 1.0 custom runtimes older than v0.19.1-1 (v0.19.0, v0.19.1) cannot be told apart from v0.19.1-1 and are documented in known issues. checkLoad never opens the runtime, so it stays ABI-only and reports the bundled C API 1 runtime as supported; a legacy override fails typed at engine creation.
• Out of scope / follow-ups: owner audit follow-ups litert-lm-native#113.

Completeness checklist

• Declared scope is fully implemented, or explicitly reduced above.
• Unsupported platform/option combinations fail loudly with actionable diagnostics or are clearly documented as unavailable.
• Public API docs, README/website docs, examples, support matrices, and changelog entries are updated where relevant.
• Regression coverage covers the original issue plus key negative/version-skew paths where relevant.
• Public capability changes update the validation coverage registry (embeddings pack notes); validation_coverage_test.dart passes.
• Security/privacy review completed: no secrets, tokens or signed URLs added.
• Follow-up work tracked (litert-lm-native#113).

PR type guidance

• Bugfix PR: root cause (owner): desktop libLiteRtLm built with libstdc++/MSVC STL linked the prebuilt libc++ libLiteRt and WebGPU accelerator, so the external-weight handoff (LiteRT-LM embeddings fail on Linux arm64 and crash on Windows x64 (all v0.18 pins) #1367) and the TopK WebGPU sampler tensor teardown (LiteRT-LM desktop GPU crashes on Linux x64 and Windows x64 (v0.19.1) #1795) crossed C++ runtimes. Fixed in the owner build; this PR consumes it and lifts the gate.

Test Plan

• dart run tool/prepare_workspace.dart
• dart format --output=none --set-exit-if-changed .
• dart analyze (no issues)
• dart run tool/testing/check_platform_boundaries.dart
• dart test -p vm -j 1 --exclude-tags local-only on test/unit/tooling/ test/unit/backends/litert_lm/ test/unit/platform/ test/unit/backends/native/ test/unit/hook plus the full test/unit and test/integration (isolated TMPDIR, macOS arm64): all LiteRT/engine/tooling tests pass; 10 failures are host-environment only and unrelated (windows_registry_qualification_test needs pwsh; model_download_manager_io_concurrency_test /var vs /private/var path on macOS) — CI is authoritative for these.
• Audit fix at b09a3259: prepare_workspace, format, analyze (no issues), check_platform_boundaries OK; TMPDIR=$(mktemp -d) dart test -p vm -j 1 --exclude-tags local-only test/unit/backends/litert_lm/ test/unit/core/engine/ test/unit/platform/io/ test/unit/hook test/unit/tooling/: 5292 pass, 50 skipped, 10 fail (after merging main at 07cc2eb5: 5301 pass, same 10), all host-environment (6 windows_registry_qualification_test need pwsh; 4 model_download_manager_io_concurrency_test, which fails the same way at 84198f42 without this fix). Mutations: legacy guard removed fails 3/3 legacy refusal tests; legacy guard on the C API 1 client fails 3/3 C API 1 desktop creation tests.
• python3 -m unittest discover -s tool/native -p 'test_*.py' (188 OK)
• dart test -p chrome --exclude-tags local-only: N/A locally, CI runs it (no Web change).
• coverage-lib: N/A locally (inconclusive on macOS after the host-environment failures above); main enforces the 70% threshold after merge. The lib change only shrinks the gate (net fewer lines).
• litert-lm-multimodal-embedding on macOS arm64 against the published v0.19.1-1 bundle: 3/3 pass (control; Apple bytes unchanged).

Matrix Evidence

Matrix row	Scope covered	Platform / model / backend	Result	Evidence / notes
owner release readback	assets, SHA256SUMS, manifest, GitHub digests, tag, linkage	v0.19.1-1, all 8 platforms	PASS	21 assets; 71/71 SHA256SUMS entries verified after extraction; 71 manifest artifacts match SHA256SUMS; 20 release-result + 21 GitHub asset digests match; tag v0.19.1-1 -> 82d4ae1c; Linux x64/arm64 libLiteRtLm.so no DT_NEEDED libLiteRt.so, Windows LiteRtLm.dll no libLiteRt.dll import; Android/Apple binaries identical to v0.19.1 (only xcframework Info.plist slice order differs)
litert-lm-multimodal-embedding	text/image/audio/mixed/batch, cancel/unload/dispose of a 60-item batch, repeat bit-identity	macOS arm64 M-series, EmbeddingGemma-2 e7a8a220…7f4c, CPU	PASS 3/3	control only
litert-lm-multimodal-embedding	same	Linux arm64, Linux x64, Windows x64 (GCE)	PASS 3/3 per host; vectors bit-identical to the #112 artifact	results
Qwen3 GPU/CPU generation	#1795	Linux x64 + L4 Vulkan, Windows x64 + L4 D3D12	PASS: GPU 3/3, CPU 2/2 on both	results
high-risk-exact-head-independent-qa	exact head audit	—	PASS	fresh-agent auditor at 07cc2eb5: PASS, 0 blocking findings, 0 PR-caused P1; mutations M1-M4 killed; 8 hook sha256 pins and 7 Package.swift checksums match the v0.19.1-1 digests; vm suite +5383 ~50 -10, all 10 environmental (6 windows_registry_qualification_test need pwsh; 4 model_download_manager_io_concurrency_test fail the same on base 4d2078f6)

Real-host requalification

GCE requalification on the published v0.19.1-1 bundles (hook-fetched, sha256 matched pins) ran at head 84198f42 and passed on all five hosts: Linux arm64/x64 and Windows x64 multimodal-embedding E2E 3/3 each; L4 Linux Vulkan and Windows D3D12 Qwen3 GPU 3/3, CPU 2/2; the v0.18.0 baseline crashes 3/3 on GPU. It still applies to 07cc2eb5: the head changes since then are Dart-only guards, tests and docs plus the main merge, with no native bytes. Windows teardown passes with this PR's .xnnpack_cache handling and fails (errno = 5) with the base version. Details: results.

Review Notes

• Independent review status: the audit of 84198f42 returned BLOCK (P2: widened gate reached native embedding creation on legacy v0.18.x desktop runtimes), fixed in b09a3259. The re-audit of exact head 07cc2eb5 against base 4d2078f6 (fresh agent session, not the author) returned PASS, zero blocking findings, zero PR-caused P1, and confirms the fix complete.
• CI status / head SHA: all green / 07cc2eb. LiteRT-LM Smoke ubuntu first failed after the chat smoke answered, at LlamaEngine.dispose (LiteRT-LM worker stopped before native cleanup was confirmed); the job passed on rerun, and no lib change in this head touches the chat or worker path (run 42504531966).

High-risk regression review

• Classification: high-risk (artifactConsumer, backendRuntime)
• Implementation task: this PR
• Independent blocking QA task: fresh-agent auditor session, PASS at 07cc2eb5 (above); 0 unresolved review threads
• Exact head / current base: 07cc2eb / 4d2078f (main was merged in; it had made the PR conflict, so no PR CI ran on b09a3259)
• Production-branch deletion, bypass, or miswire proof: engine_check_load_io_test asserts checkLoad refuses Android x86_64 and admits macOS arm64, Linux x64/arm64 and Windows x64; the guard tests assert the exact qualified ABI set and that Android x86_64 / Windows arm64 refuse before any native call on a custom runtime; native creation tests run macOS/iOS/Android arm64 on the legacy fake and Linux arm64/x64 and Windows x64 through runtime selection on the C API 1 fixture; legacy-fake tests assert Linux arm64/x64 and Windows x64 refuse with the C API 1 / v0.19.1-1 message and zero native settings/allocations, both via createEmbeddingSession and through the worker backend. Mutations: swapping the legacy client back to the shared gate fails all 3 legacy refusal tests; giving the C API 1 client the legacy gate fails all 3 C API 1 desktop tests.
• Affected-family real-model/artifact evidence: EmbeddingGemma-2 multimodal embeddings on macOS arm64 (control), Linux arm64, Linux x64 and Windows x64 (GCE), 3/3 each; Qwen3 GPU 3/3 and CPU 2/2 on Linux x64 + L4 Vulkan and Windows x64 + L4 D3D12 (see Real-host requalification).
• Explicit unavailable-family or other N/A evidence: Android x86_64 unchanged and unqualified. The S24 LiteRT qualifier binding from Admit the S24 LiteRT-LM qualifier for v0.19.1 with device evidence #1797 still names runtime tag v0.19.1; its Android arm64 binaries are byte-identical in v0.19.1-1, so it is left as recorded evidence.
• Readiness evidence: tool/testing/high_risk_readiness.dart on v2 evidence for head 07cc2eb5 / base 4d2078f6 exits 2 (unverifiedPrerequisites: internally consistent; auditor authentication, GitHub App, protected environment and ruleset are not configured, as documented).
• Known PR-caused P1 regressions: 0
• Unresolved review threads: 0

[leehack]

Real-host GCE requalification: PASS (head 84198f428e7377cb724c13febd68dfe658b34893)

Every host ran this branch with the hook-fetched litert-lm-native v0.19.1-1 bundle. Each archive's sha256 matched its pin: linux-arm64 7d7520ba…, linux-x64 1c93ead8…, windows-x64 7d22e574…. No LLAMADART_LITERT_LM_LIB_DIR, no guard bypass. Models: EmbeddingGemma-2 e7a8a220…7f4c, Qwen3-0.6B 555579ff…b0b4.

Host	Check	Result
Linux arm64, c4a-standard-8, Ubuntu 24.04	litert-lm-multimodal-embedding E2E ×3 (60-item batch cancel by unload and by dispose, 10× repeat bit-identity, text/image/audio/mixed/batch)	PASS 3/3
	probe vectors, 2 load/dispose passes	Passes bit-identical, batch == single. Text, black, checker and silence are bit-exact vs the macOS arm64 control. Tone cos 0.9964, mixed cos 0.9995. All six match the #112 artifact (d1a95f1) bit-for-bit
Linux x64, c3-standard-8, Ubuntu 24.04	same E2E ×3	PASS 3/3
	probe vectors	Passes bit-identical, batch == single. vs macOS: text cos 1.000000, images ≥ 0.99862, audio ≥ 0.99558. All six match the #112 artifact bit-for-bit
Windows x64, c3-standard-8, Server 2022	same E2E ×3	PASS 3/3. No WER crash events, no dumps
	probe vectors	Passes bit-identical, batch == single. Same cos as Linux x64 except tone 0.99586 and mixed 0.99838. All six match the #112 artifact bit-for-bit
	suite teardown (suite_system_temp.dart)	PR version: tearDownAll passes and leaves only the 4 *.xnnpack_cache files in the suite root. Negative control, the base-branch file on the same host: tearDownAll fails with PathAccessException: Deletion failed … (OS Error: Access is denied, errno = 5)
Linux x64 + L4, g2-standard-8, driver 580.178.04, Vulkan	Qwen3 GPU ×3, CPU ×2	PASS. GPU 3/3 rc=0, adapter NVIDIA L4 … backend=Vulkan. GPU outputs identical across runs, CPU outputs identical across runs. GPU equals CPU on 2 of 3 prompts; the 64-token story continuation differs between GPU and CPU kernels
Windows x64 + L4, g2-standard-8, driver 596.86, D3D12	Qwen3 GPU ×3 (debug log), CPU ×2	PASS. GPU 3/3 rc=0, adapter NVIDIA L4 … backend=Direct3D 12. 0 Dawn validation lines. Outputs identical to Linux GPU and Linux CPU respectively
Linux x64 + L4: v0.18.0 (native v0.19.0) baseline	Qwen3 GPU ×3, CPU ×2	GPU crashes 3/3 (SIGSEGV in __libc_free ← ml_drift::TensorDescriptor::~TensorDescriptor ← TopKWebGpuSampler::SetInferenceFuncAndInputTensors ← InitializeSampler). CPU 2/2 OK
Windows x64 + L4: v0.18.0 baseline	same	GPU crashes 3/3 (0xC0000409 at LiteRtLm.dll+0x572fe2, the same offset as the v0.19.1 crash from the #112 lane). CPU 2/2 OK

Conclusions:

• LiteRT-LM embeddings fail on Linux arm64 and crash on Windows x64 (all v0.18 pins) #1367: desktop embeddings work on all three ABIs, with vectors identical to the owner-PR artifact that was qualified earlier.
• LiteRT-LM desktop GPU crashes on Linux x64 and Windows x64 (v0.19.1) #1795: fixed on both desktop GPU paths. Published 0.18.0 (native v0.19.0) is affected, now runtime-verified on Linux and Windows. This settles the PR body's "not runtime-verified" note.
• No Adopt LiteRT-LM native v0.19.1-1 and qualify desktop embeddings #1808 defect found.

Cleanup: every VM (5), its disk, and the job bucket were deleted. No firewall rule was created; jobs ran through startup-script agents. Evidence is in llamadart-evidence/pr1808-v01911-1/: per-host logs, JSON and comparisons.txt. The Linux L4 host ran in us-west4-c because of zone stockouts elsewhere.

[github-actions]

Chat app preview removed for leehack/llamadart-chat-pr-1808.