feat(pipe): correction-token hedged wait-window drafting (M25_CORRHEDGE, lossless)

[463464q435q43]

PR: Correction-token hedged wait-window drafting (M25_CORRHEDGE) — lossless, +20% on the novel/EAGLE cell

Target: leyten/shard master (based on 182e93b, applies clean — verified locally).
Branch: mosaic/correction-hedge · Files: phase0/m25_pipe.py (+121), phase0/eagle_draft.py (+124), tests/test_corrhedge.py (new, 543 lines, CPU-only).

Motivation

On novel text the EAGLE chain path runs depth-1 (the drafter needs the verified hidden state), so
the coordinator idles ~1 full ring RTT per round. Optimistically continuing the drafter's own
proposal past the frontier is void on the chain protocol — every partial accept commits a
verify-produced correction token the drafter cannot name in advance (we measured this
dead-end explicitly: full-proposal continuation 0.959 ± 0.114, pre-registered kill fired). But the
correction is the one nameable coordinate: given a rejection at depth j, the verifier's
correction lands in the drafter's rank-2..4 candidates with measured conditional mass ≈ 0.44
(rank profile measured per-depth on our ring). Hedging the wait window on those candidates
converts idle RTT into a second committed round whenever the hedge hits.

Mechanism (zero new wire ops, stages untouched)

Per novel round, while the parent verify frame is in flight:

1. draft_topk records per-step top-4 target-space candidates alongside the normal chain
   (rank-1 IS the chain — byte-identical drafting).
2. The coordinator pre-drafts K-token continuations (propose_ahead, committed drafter cache
   never mutated) for the 5 highest-mass (rejection-depth j, rank r) branches
   {(3,2),(2,2),(1,2),(1,3),(1,4)} and ships them as ordinary verify frames at
   start = anchor + j, in descending-start order — stage KV is crop-to-start, so
   lower-start writes would corrupt deeper branches' hypotheses.
3. A RESTORE frame (exact parent copy) follows, rewriting the parent rows bit-identically;
   after the hedge block the ring state is exactly post-parent, so a miss costs nothing but the
   wasted frames (which ride the B=1 idle window).
4. On a partial accept whose correction r[n] matches a sent branch, that branch's
   already-in-flight reply is the next round: two rounds' commits for ~one RTT. A RESEND
   frame repairs the hit branch's rows.
5. Misses drain lazily, overlapped with the next round's flight. This is load-bearing: our
   v1 with a synchronous drain measured 0.73× with the same healthy hit rate — the drain
   was the cost, not the hedges. (v1 raw data preserved; the fix was registered before v2 ran.)

Every commit stays verifier-greedy on a bit-identical ring prefix, so output byte-identity with
the flag OFF is structural. n-gram-matched rounds have no candidate ranking and hedge nothing
(master path). Default OFF = master bit-exact.

Measured results (pre-registered, blind-priced band)

Regime: MiniMax-M2.5 NVFP4, B=1, scattered-EU WAN 5-stage RTX 5090 ring, 274.8 ms loop RTT,
engine 182e93b, EAGLE-3 novel/reasoning cell (measured q1 = 0.566 class), K=8 depth 4,
max-new 256. Receipt mosaic-m25wan-ring2-hedge-moat-20260707.

• Paired ON/OFF ratio 1.1993 ± 0.1277 (95% CI, interleaved n=3/arm; every ratio > 1.14;
  CI excludes parity). Hedge hit rate 0.2727.
• Byte identity: output sha identical across ALL 7 runs (sentinel + 3 OFF + 3 ON); 72 real
  correction-splices, zero corruption; ON internally deterministic 3/3 (identical hedge
  trajectory).
• The ratio and hit rate both landed inside a band pre-registered blind from the rank-profile
  receipt before any A/B ran (band [1.1666, 1.2647] × [0.2295, 0.3544]; blind point prediction
  1.2114, off by <1%).
• Replicated twice more in independent sessions (receipts mosaic-m25wan-ring2-ra-record-20260707,
  mosaic-m25wan-ring2-ra2-20260707): hedge-ON 11.664 ± 0.360 (n=5) and 11.484 ± 0.147 (n=8),
  byte-identical every run (13/13), vs pristine anchor 10.87 ± 0.79; ON-vs-clean-OFF-pool
  ratios 1.195 and 1.179 — three consecutive landings within ~2% of the original 1.1993.
  (Both replication sessions ran slow — same-session pristine-path levels below the anchor
  band — so the ON rows are quoted as replications of the ratio, not as absolute records;
  a pre-registered record attempt on this cell did not clear its absolute bar, stated honestly.)
• Width sweep datum (same receipt): widening to 8 branches raises hit rate to 0.378 but NOT
  throughput (measured speedup 1.208 ± 0.055 ≈ the 5-branch point) — reply-queue slot cost eats
  the marginal mass. W=5 is the right default; M25_HEDGE_W exists in our joint build but is
  NOT included in this PR (kept minimal).

Caveats we state up front

• Cell-specific: pays on the novel/EAGLE (depth-1, RTT-idle) path only; auto-disables on
  n-gram-matched rounds. Gains scale with loop RTT — on a ~105 ms tight ring the idle window is
  ~2.6× smaller and so is the expected win.
• B=1 structure: the hedge rides idle-window capacity that batched serving would contend for.
• Saturation is known and honest: coverable-mass law caps the hedge family at ≤ ~1.44× on this
  drafter's mass profile (measured 0.4439 coverable at K=8); this is a solid +20%, not a 2×.
• The branch set was derived from OUR ring's measured rank profile; a different target/drafter
  pair should re-derive it (the by_branch histogram in the result row is there for exactly this).

Verification protocol

1. python3 -m pytest tests/test_corrhedge.py -q — CPU-only: real drafter math on a tiny random
   EAGLE head (draft_topk == chain, propose_ahead self-consistency laws, committed-cache
   immutability under hostile fuzz, hybrid matched/novel contract) + a coordinator-loop mock
   against a stateful crop-to-start ring that computes replies from its own mutated rows, so
   any protocol bug (wrong send order, missing RESTORE/RESEND, bad start) produces hostile
   garbage and fails the losslessness assert. Independent hit-accounting oracle; 40 fuzz trials.
2. On any ring: same prompt with M25_CORRHEDGE unset and =1; sha256 outputs — identical.
   The result row's hedge block reports rounds_hedged / hits / by_branch for mechanism review.

License / transfer

Contributed under the repository's Apache-2.0 license, no strings attached. Claims are ours
(Mosaic Intelligence), receipt-backed (raw per-run JSONs retained, including the v1 negative);
happy to share artifacts or support a maintainer replication before merge.

---

Prepared 2026-07-07 by the authors (Mosaic Intelligence).