From 304e1c3faa33aadffc1e2d27f8151a3c41916c40 Mon Sep 17 00:00:00 2001
From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:45:30 +0800
Subject: [PATCH 1/5] build: apply checksummed CUDA NVFP4 recipe patches
---
engine/nvfp4/UPSTREAM | 4 +-
recipe/test_build_engine.py | 142 ++++++++++++++++++++++++++++++++++++
scripts/build-engine.sh | 3 +-
3 files changed, 146 insertions(+), 3 deletions(-)
create mode 100644 recipe/test_build_engine.py
diff --git a/engine/nvfp4/UPSTREAM b/engine/nvfp4/UPSTREAM
index 26219bf..6e1c2f7 100644
--- a/engine/nvfp4/UPSTREAM
+++ b/engine/nvfp4/UPSTREAM
@@ -1,5 +1,5 @@
-# The engine `scripts/build-engine.sh --weights nvfp4` builds, unpatched: the only engine that loads the NVFP4
-# pruned weights (plotarmordev/drama-3-NVFP4-Pruned). Commit b1f4b9b4 on branch drama-nvfp4 of the TensorFold fork;
+# The CUDA engine base for `scripts/build-engine.sh --weights nvfp4`, followed by patches/.
+# Commit b1f4b9b4 on branch drama-nvfp4 of the TensorFold fork loads the NVFP4 pruned weights;
# results/full-vs-quant-01 measured the same source (v1.0.11-193-g70dec469; the two differ in comments and test
# wording only).
TENSORFOLD_REPOSITORY=https://github.com/plotarmordev/TensorFold.git
diff --git a/recipe/test_build_engine.py b/recipe/test_build_engine.py
new file mode 100644
index 0000000..8540af0
--- /dev/null
+++ b/recipe/test_build_engine.py
@@ -0,0 +1,142 @@
+"""Exercise platform selection and real git-am/checksum handling without a compiler or network."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import shlex
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class BuildEngineTests(unittest.TestCase):
+ def setUp(self):
+ self.temp = tempfile.TemporaryDirectory()
+ self.addCleanup(self.temp.cleanup)
+ self.root = Path(self.temp.name)
+ self.repo = self.root / 'recipe'
+ self.source = self.root / 'source'
+ self.bin = self.root / 'bin'
+ self.bin.mkdir()
+ self.source.mkdir()
+ self.env = dict(os.environ, PATH=str(self.bin) + os.pathsep + os.environ['PATH'])
+ self.env.update(GIT_AUTHOR_NAME='Fixture Contributor', GIT_COMMITTER_NAME='Fixture Contributor',
+ GIT_AUTHOR_EMAIL='fixture@example.invalid', GIT_COMMITTER_EMAIL='fixture@example.invalid',
+ GIT_AUTHOR_DATE='2026-01-01T00:00:00Z', GIT_COMMITTER_DATE='2026-01-01T00:00:00Z')
+ self.git('init', '-q')
+ self.git('config', 'commit.gpgsign', 'false')
+ (self.source / '.zig-version').write_text('0.17.0\n')
+ self.git('add', '.zig-version')
+ self.git('commit', '-qm', 'Fixture engine base')
+ self.base = self.git('rev-parse', 'HEAD').stdout.strip()
+ script = self.repo / 'scripts' / 'build-engine.sh'
+ script.parent.mkdir(parents=True)
+ shutil.copyfile(ROOT / 'scripts' / 'build-engine.sh', script)
+ self.series = {'full': 'engine', 'cuda': 'engine/nvfp4', 'metal': 'engine/nvfp4/macos'}
+ for mode, relative in self.series.items():
+ target = self.repo / relative
+ patches = target / 'patches'
+ patches.mkdir(parents=True)
+ (target / 'UPSTREAM').write_text(
+ f'TENSORFOLD_REPOSITORY={shlex.quote(str(self.source))}\n'
+ f'TENSORFOLD_COMMIT={self.base}\n')
+ filename = f'applied-{mode}'
+ (self.source / filename).write_text(mode + '\n')
+ self.git('add', filename)
+ self.git('commit', '-qm', f'Fixture {mode} patch')
+ content = self.git('format-patch', '-1', '--stdout').stdout.encode()
+ (patches / '0001-fixture.patch').write_bytes(content)
+ digest = hashlib.sha256(content).hexdigest()
+ (patches / 'SHA256SUMS').write_text(f'{digest} 0001-fixture.patch\n')
+ self.executable('uname', '#!/bin/sh\nprintf "%s\\n" "$TEST_PLATFORM"\n')
+ self.executable('nvcc', '#!/bin/sh\nexit 0\n')
+ self.executable('zig', '''#!/usr/bin/env python3
+import json
+from pathlib import Path
+import sys
+if sys.argv[1:] == ['version']:
+ print('0.17.0')
+else:
+ Path('build-args.json').write_text(json.dumps(sys.argv[1:]))
+ for target in ('native', 'drama3-generate', 'drama3-voice'):
+ if target in sys.argv[1:]:
+ name = 'native/bin/tensorfold-native' if target == 'native' else 'bin/' + target
+ path = Path('zig-out') / name
+ path.parent.mkdir(parents=True, exist_ok=True)
+ path.write_text(target)
+''')
+
+ def git(self, *arguments):
+ return subprocess.run(['git', *arguments], cwd=self.source, env=self.env,
+ capture_output=True, text=True, check=True, timeout=20)
+
+ def executable(self, name, content):
+ path = self.bin / name
+ path.write_text(content)
+ path.chmod(0o755)
+
+ def build(self, platform, weights, name='build'):
+ target = self.root / name
+ result = subprocess.run(
+ ['bash', str(self.repo / 'scripts/build-engine.sh'), '--weights', weights, str(target)],
+ env=dict(self.env, TEST_PLATFORM=platform, ZIG=str(self.bin / 'zig'), NVCC=str(self.bin / 'nvcc')),
+ capture_output=True, text=True, timeout=30)
+ return result, target
+
+ def test_each_platform_applies_only_its_selected_patch_series(self):
+ for platform, weights, selected in [('Linux', 'nvfp4', 'cuda'), ('Darwin', 'nvfp4', 'metal'),
+ ('Linux', 'full', 'full'), ('Darwin', 'full', 'full')]:
+ with self.subTest(platform=platform, weights=weights):
+ result, target = self.build(platform, weights, platform + weights)
+ self.assertEqual(result.returncode, 0, result.stderr)
+ for mode in self.series:
+ self.assertEqual((target / f'applied-{mode}').exists(), mode == selected)
+ arguments = json.loads((target / 'build-args.json').read_text())
+ expected = ['native'] if selected == 'cuda' else ['native', 'drama3-generate']
+ if selected == 'metal':
+ expected.append('drama3-voice')
+ self.assertEqual([a for a in arguments if a in ('native', 'drama3-generate', 'drama3-voice')], expected)
+ self.assertEqual(any(a.startswith('-Dnvcc=') for a in arguments), platform == 'Linux')
+
+ def test_corrupt_cuda_patch_is_refused_before_checkout_or_build(self):
+ path = self.repo / self.series['cuda'] / 'patches/0001-fixture.patch'
+ path.write_bytes(path.read_bytes() + b'changed\n')
+ result, target = self.build('Linux', 'nvfp4')
+ self.assertNotEqual(result.returncode, 0)
+ self.assertIn('patch checksum verification failed', result.stderr)
+ self.assertFalse(target.exists())
+
+ def test_missing_cuda_series_is_refused(self):
+ (self.repo / self.series['cuda'] / 'patches/0001-fixture.patch').unlink()
+ result, target = self.build('Linux', 'nvfp4')
+ self.assertNotEqual(result.returncode, 0)
+ self.assertIn('has no *.patch files', result.stderr)
+ self.assertFalse(target.exists())
+
+ def test_rebuild_reapplies_the_same_cuda_patch(self):
+ first, target = self.build('Linux', 'nvfp4')
+ self.assertEqual(first.returncode, 0, first.stderr)
+ head = subprocess.check_output(['git', '-C', str(target), 'rev-parse', 'HEAD'], text=True).strip()
+ second, _ = self.build('Linux', 'nvfp4')
+ self.assertEqual(second.returncode, 0, second.stderr)
+ self.assertEqual(subprocess.check_output(['git', '-C', str(target), 'rev-parse', 'HEAD'], text=True).strip(), head)
+ self.assertEqual((target / 'applied-cuda').read_text(), 'cuda\n')
+
+ def test_modified_checkout_is_preserved_and_refused(self):
+ first, target = self.build('Linux', 'nvfp4')
+ self.assertEqual(first.returncode, 0, first.stderr)
+ (target / '.zig-version').write_text('operator edit\n')
+ second, _ = self.build('Linux', 'nvfp4')
+ self.assertNotEqual(second.returncode, 0)
+ self.assertIn('local changes', second.stderr)
+ self.assertEqual((target / '.zig-version').read_text(), 'operator edit\n')
+
+
+if __name__ == '__main__':
+ unittest.main()
diff --git a/scripts/build-engine.sh b/scripts/build-engine.sh
index 2565afa..714bd64 100755
--- a/scripts/build-engine.sh
+++ b/scripts/build-engine.sh
@@ -5,7 +5,7 @@
#
# --weights full (the default) upstream TensorFold at engine/UPSTREAM with the opt-in patches in
# engine/patches: the native server and drama3-generate, in build/tensorfold
-# --weights nvfp4 CUDA: engine/nvfp4/UPSTREAM, unpatched native server.
+# --weights nvfp4 CUDA: engine/nvfp4/UPSTREAM plus its patches, native server.
# Metal: engine/nvfp4/macos/UPSTREAM plus its patches, native server and voice tools.
# Both use plotarmordev/drama-3-NVFP4-Pruned, in build/tensorfold-nvfp4.
#
@@ -48,6 +48,7 @@ case $weights in
;;
nvfp4)
pin=$repo/engine/nvfp4/UPSTREAM build=${1:-$repo/build/tensorfold-nvfp4}
+ patch_dir=$repo/engine/nvfp4/patches
targets=(native)
if [[ $platform == Darwin ]]; then
pin=$repo/engine/nvfp4/macos/UPSTREAM
From a1a1651f8de2ca92ffde2c2a353b231365e4c7b3 Mon Sep 17 00:00:00 2001
From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:59:48 +0800
Subject: [PATCH 2/5] build: reject incomplete or duplicate patch checksum
manifests
---
recipe/test_build_engine.py | 18 ++++++++++++++++++
scripts/build-engine.sh | 15 +++++++++++++++
2 files changed, 33 insertions(+)
diff --git a/recipe/test_build_engine.py b/recipe/test_build_engine.py
index 8540af0..fcdebd2 100644
--- a/recipe/test_build_engine.py
+++ b/recipe/test_build_engine.py
@@ -119,6 +119,24 @@ def test_missing_cuda_series_is_refused(self):
self.assertIn('has no *.patch files', result.stderr)
self.assertFalse(target.exists())
+ def test_manifest_covers_exactly_the_selected_patches(self):
+ directory = self.repo / self.series['cuda'] / 'patches'
+ manifest = directory / 'SHA256SUMS'
+ original = manifest.read_text()
+ unlisted = directory / '0002-unlisted.patch'
+ unlisted.write_bytes((self.repo / self.series['metal'] / 'patches/0001-fixture.patch').read_bytes())
+ result, target = self.build('Linux', 'nvfp4')
+ self.assertNotEqual(result.returncode, 0, 'an unlisted patch must never be applied')
+ self.assertFalse(target.exists())
+ unlisted.unlink()
+ for content in (original + original, original.replace('0001-fixture.patch', 'missing.patch'),
+ original + hashlib.sha256(b'notes').hexdigest() + ' README.md\n'):
+ with self.subTest(manifest=content):
+ manifest.write_text(content)
+ result, target = self.build('Linux', 'nvfp4')
+ self.assertNotEqual(result.returncode, 0)
+ self.assertFalse(target.exists())
+
def test_rebuild_reapplies_the_same_cuda_patch(self):
first, target = self.build('Linux', 'nvfp4')
self.assertEqual(first.returncode, 0, first.stderr)
diff --git a/scripts/build-engine.sh b/scripts/build-engine.sh
index 714bd64..838d667 100755
--- a/scripts/build-engine.sh
+++ b/scripts/build-engine.sh
@@ -68,6 +68,21 @@ patches=()
if [[ -n $patch_dir ]]; then
patches=("$patch_dir"/*.patch)
((${#patches[@]})) || die "$patch_dir has no *.patch files"
+ [[ -f $patch_dir/SHA256SUMS ]] || die "$patch_dir has no SHA256SUMS manifest"
+ manifest_pattern='^[[:xdigit:]]{64} ([^/[:space:]]+\.patch)$'
+ listed_patches=()
+ while IFS= read -r manifest_line || [[ -n $manifest_line ]]; do
+ [[ $manifest_line =~ $manifest_pattern ]] || die "invalid patch manifest entry"
+ listed_patches+=("${BASH_REMATCH[1]}")
+ done < "$patch_dir/SHA256SUMS"
+ ((${#listed_patches[@]} == ${#patches[@]})) || die "patch manifest must list every selected patch exactly once"
+ for patch in "${patches[@]}"; do
+ matches=0
+ for listed_patch in "${listed_patches[@]}"; do
+ if [[ $listed_patch == "${patch##*/}" ]]; then matches=$((matches + 1)); fi
+ done
+ ((matches == 1)) || die "patch manifest must list every selected patch exactly once"
+ done
if command -v sha256sum >/dev/null; then
(cd "$patch_dir" && sha256sum -c SHA256SUMS) || die "patch checksum verification failed"
else
From 37a6832b94d058e67345db9dd6b0f8f07a37e4d8 Mon Sep 17 00:00:00 2001
From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
Date: Sun, 25 Oct 2026 12:05:00 +0800
Subject: [PATCH 3/5] Add protected long-form speech chunks as CUDA NVFP4 patch
0001
---
CHANGELOG.md | 7 +
README.md | 22 +-
.../0001-protected-speech-chunks.patch | 733 ++++++++++++++++++
engine/nvfp4/patches/README.md | 27 +
engine/nvfp4/patches/SHA256SUMS | 1 +
engine/patches/README.md | 3 +
recipe/README.md | 3 +
7 files changed, 794 insertions(+), 2 deletions(-)
create mode 100644 engine/nvfp4/patches/0001-protected-speech-chunks.patch
create mode 100644 engine/nvfp4/patches/README.md
create mode 100644 engine/nvfp4/patches/SHA256SUMS
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8a7bd6d..bfa6c8d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,9 @@
### Fixed
+- CUDA NVFP4 long-form splitting preserves paired delivery tags, bracketed cues and special tokens,
+ including topic-shift handling, and recognizes CJK sentence/clause punctuation. An indivisible
+ protected span may exceed the character target; existing prompt and frame limits still apply.
- Metal reference-prefill reuse now invalidates before incompatible/default prefill, compares the
complete invariant prefix plus tower lookahead, preserves original chunk boundaries, and reuses
one GPU-owned snapshot buffer pair per lane instead of allocating on every voice switch.
@@ -19,6 +22,10 @@
### Added
+- A checksummed CUDA NVFP4 engine patch series without changing its pinned upstream or weights.
+ Model-free build tests exercise real patch application, selection on Linux/macOS, corruption
+ refusal, repeat builds and preservation of modified checkouts. Manifests must cover each
+ selected patch exactly once; extra, missing and duplicate entries fail before checkout.
- Native Apple-silicon support for the pinned NVFP4-pruned checkpoint: packed experts, compact
original-ID routing and reference-conditioned semantic CFG, with independent backbone states.
The Mac engine uses `engine/nvfp4/macos/UPSTREAM` and its checksum-verified patches; the existing
diff --git a/README.md b/README.md
index 589d3f1..35e647b 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@
[TensorFold](https://github.com/ashhart/TensorFold) runs Drama 3 natively since v1.1.0. This repository pins
upstream TensorFold and adds a small series of opt-in patches for the full model. NVFP4 retains its
-measured CUDA engine pin and uses a separate upstream pin plus Metal patches on Mac. It builds the engine
+measured CUDA engine pin with a checksummed patch series and uses a separate upstream pin plus Metal patches on Mac. It builds the engine
and starts a local speech server with an OpenAI-style `/v1/audio/speech` route, whole or streamed.
**Built with Fish Audio.** The model weights are not in this repository; the launcher downloads them from
@@ -64,7 +64,8 @@ For the full model, write `--weights full` in both commands.
The first start downloads the weights at the revision pinned in [`recipe/sources.json`](recipe/sources.json),
into `drama-3-NVFP4-Pruned/` or `drama-3/`. Every start checks them against [`recipe/checksums`](recipe/checksums)
and refuses missing or changed files; for the 21 GiB NVFP4 weights that takes about 11 seconds on a GB10.
-On Linux, `--weights nvfp4` builds [`engine/nvfp4/UPSTREAM`](engine/nvfp4/UPSTREAM) and serves with
+On Linux, `--weights nvfp4` builds [`engine/nvfp4/UPSTREAM`](engine/nvfp4/UPSTREAM) plus
+[`engine/nvfp4/patches`](engine/nvfp4/patches) and serves with
guidance γ 1.5 and batched guidance, as measured; a `--cfg-gamma` of your own after `--` replaces both.
On Mac it builds [`engine/nvfp4/macos/UPSTREAM`](engine/nvfp4/macos/UPSTREAM) plus its patch series.
Metal's `--cfg-batched` pairs independent states in one command buffer, not a vectorized GEMM.
@@ -139,6 +140,23 @@ Guidance-enabled replies carry the configured γ in `X-Cfg-Gamma`; builtin voice
## The patches
+### CUDA NVFP4 long speech
+
+The CUDA NVFP4 patch series preserves delivery markup when `--long-form` splits a request.
+Paired tags such as `…`, bracketed cues and special tokens stay whole;
+Chinese/Japanese sentence and clause punctuation are recognized. A topic-shift mark inside a
+protected span does not create a cut. Plain English without these spans retains its existing cuts.
+
+`--long-form-chars` remains a code-point target, with one exception: an indivisible protected span
+may exceed it. The engine's prompt, segment-count and generated-frame limits still apply.
+The full-model and Metal NVFP4 engines do not expose this legacy long-form route.
+
+The behavioral reference is [Sogni-AI/drama3-mlx's chunking](https://github.com/Sogni-AI/drama3-mlx/blob/ecc235039ccd5f982f66a6982184f57432354ab4/drama3_mlx/chunking.py).
+The native patch extends TensorFold's own implementation; it does not copy that Fish-licensed source.
+See the [CUDA patch index](engine/nvfp4/patches/README.md) for scope and tests.
+
+### Full-model engine
+
The patches build the full-model engine (`--weights full`). Upstream TensorFold already serves Drama 3. Each patch
below adds one feature that stays off until you pass its flag, so a server started without them answers as
upstream does. The exceptions are the first two: batched prefill is on by default (`TF_DRAMA_PREFILL_ROWS=1`
diff --git a/engine/nvfp4/patches/0001-protected-speech-chunks.patch b/engine/nvfp4/patches/0001-protected-speech-chunks.patch
new file mode 100644
index 0000000..dfccd79
--- /dev/null
+++ b/engine/nvfp4/patches/0001-protected-speech-chunks.patch
@@ -0,0 +1,733 @@
+From 3babff305c51109c99d250033e3ce632edce7127 Mon Sep 17 00:00:00 2001
+From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 11:58:30 +0800
+Subject: [PATCH] server: preserve controls in long-form speech chunks
+
+Keep complete special tokens, bracketed cues and nested paired tags intact across sentence, clause, space and code-point splitting. Protect topic-shift preprocessing and recognize CJK boundaries without changing prompt or frame ceilings.
+
+Exercise exact whole and streamed prompt segments, oversized spans, malformed controls and redraws. Drain inherited socket fixtures before joining so CPU validation completes on macOS.
+
+Refs: https://github.com/plotarmordev/drama-tensorfold/issues/25
+---
+ CHANGELOG.md | 1 +
+ docs/drama-voices.md | 14 +--
+ zig/src/server/cli_speech.zig | 2 +-
+ zig/src/server/drama_joins.zig | 11 +-
+ zig/src/server/drama_long.zig | 122 ++++++++++++++++++----
+ zig/src/server/drama_shift.zig | 20 +++-
+ zig/src/server/drama_spans.zig | 128 ++++++++++++++++++++++++
+ zig/src/server/speech_long.zig | 2 +-
+ zig/src/server/speech_long_test.zig | 55 +++++++++-
+ zig/src/server/speech_mid_test.zig | 2 +-
+ zig/src/server/speech_redraw_test.zig | 10 +-
+ zig/src/server/speech_register_test.zig | 3 +-
+ zig/src/server/speech_stream_test.zig | 4 +-
+ 13 files changed, 332 insertions(+), 42 deletions(-)
+ create mode 100644 zig/src/server/drama_spans.zig
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index 2af98ce5..5dd216c0 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -4,6 +4,7 @@ Each release's page on GitHub has its notes and measurements. See [the 1.0.0 rel
+
+ ## Unreleased
+
++- speech: long-form Drama 3 splits preserve complete special tokens, bracketed cues and nested paired direction tags, even when one span exceeds the character target. CJK punctuation supplies sentence and clause boundaries without requiring spaces, and topic-shift markers inside protected spans cannot split them. Existing input, prompt-token, segment and frame limits still apply ([docs](docs/drama-voices.md#long-form-replies)).
+ - speech: Drama 3's DAC activation planes are bounded by the decode chunk and causal halo rather than the utterance limit. QKV history retains absolute frame indexing and attention tile boundaries. `zig build drama-codec-chunk` builds `oracle/bin/tf-drama-codec-chunk CHECKPOINT`, a GPU byte-equality gate against the original full-plane layout; the trace diagnostic explicitly retains that reference layout.
+ - speech: `--silence-mid-s S` (CUDA; 0 for off, or 3 to below 10; default 0) ends a Drama 3 synthesis as `silence` when its end of speech comes inside S seconds or more below -40 dBFS after 1 s or more voiced: a reply that fell silent mid-way and stopped there, its last words never spoken, as one 4-bit take did after a 9.0 s hole. Holes that recover are left alone, since a client that shortens pauses never plays them, and a reply the frame cap stops is not judged. Such a draw is redrawn under the silence redraws' rules, a long-form segment in place, and whole replies count the draws it ended in `X-Silence-Mid-Trips`. Replayed at S = 3 over 2272 draws in the engine's frame accounting, it ended 15 of the 2047 that the 10 s rule left alone; all 8 with a text to judge by had lost words, and none of them had spoken in full. With S = 0 replies are as before ([docs](docs/drama-voices.md#holes-that-end-a-reply))
+ - speech: `--register-redraw-st R` (0 to 24, default 0: off) draws a whole Drama 3 reply once more when a phrase after the first opens R semitones or more above the median of its other phrase openings with `--register-redraw-high F` percent (default 20) of its voiced frames over `--register-high-hz H` (default 210), the thin, high phrase that sounds stitched into a reply. The redraw starts only if t + d fits the silence redraws' budget and `X-Deadline-S`, and the draw with the smaller jump is sent, never one that ended in silence or short; a tie keeps the first. Replies carry `X-Register-Trip` and `X-Register-Redraws`; streams and multi-segment long-form replies are not measured, and a draw with a NaN or infinite sample fails the reply before any measure. The measure ports the numpy one it was calibrated with: on 77 takes it decided every trip the same way at R = 4, F = 20, H = 210 (evidence on that corpus, not exact parity at every threshold; those settings tripped 6 of 51 replies of a day's use), at about 1.2 ms per second of audio. With R = 0 replies are as before ([docs](docs/drama-voices.md#register-redraws))
+diff --git a/docs/drama-voices.md b/docs/drama-voices.md
+index e27e7e70..2ee8d2a9 100644
+--- a/docs/drama-voices.md
++++ b/docs/drama-voices.md
+@@ -304,19 +304,21 @@ tensorfold serve DRAMA3_DIR --voices voices/ --default-voice NAME --long-form
+
+ With `--long-form`, a speech input longer than `--long-form-chars` (default 500 code points) is spoken in segments instead of in one synthesis. Each segment hears the segments before it: the earlier segments' text and generated codes are added as references after the request's references and the voice's, with the latest last. This follows the way Fish's long-form inference keeps earlier segments in context.
+
+-- **Segments.** The input is cut into the fewest segments that fit the limit, with cuts only at sentence ends (`.` `!` `?` `…` followed by white space, keeping closing quotes and brackets, and line breaks).
++- **Segments.** The input is cut into the fewest segments that fit the character target, with cuts at sentence ends (`.` `!` `?` `…` followed by white space; `。` `！` `？` `；` without needing white space), keeping closing quotes and brackets, and at line breaks.
+ - Among the cuts that give that many segments, the server picks the most balanced lengths, and prefers a cut where the text turns.
+ - The text turns at a blank line, after a question, or where the next sentence opens a new move: it starts with So, Okay, OK, Now, Right, Anyway, Also, Next, Finally, But or Here's, or with a number and "thing"/"things" (One thing, Two things, 3 things).
+ - A turn wins over a cut that is up to about 15% of a segment better balanced.
+- - Only a sentence longer than the limit is cut inside, at `;` `:` `,`, then at spaces, then anywhere.
++ - Only a sentence longer than the target is cut inside, at `;` `:` `,` before white space or `，` `：` `、`, then at spaces, then between code points.
++ - A complete `<|...|>` token, balanced `[...]` cue or correctly nested `...` span stays whole. Simple tag names start with an ASCII letter and contain letters, digits, `_` or `-`; names match exactly, and attributes are not parsed. Nested spans stay with their outer span; adjacent controls remain separate. An unclosed or crossed delimiter is ordinary text, while complete spans inside or after it still stay whole.
++ - An indivisible span may exceed the character target; other text retains the target. Input, prompt-token, frame and segment-count limits still apply. The splitter preserves the original text and never inserts or reopens tags.
+ - **History.** `--long-form-history K` (0 to 3, default 1) sets how many earlier segments a segment hears. The oldest is dropped when the prompt would exceed the engine's prompt limit.
+ - **Joins.**
+ - **Pause.** At each join, the silence already there is measured: the end of one segment plus the start of the next, in 10 ms frames below -42 dBFS. Only the shortfall to the boundary's target is added, never cutting existing silence. Targets:
+- - `.` or `!`: 0.42 s
++ - `.` `!` `。` `！` or `；`: 0.42 s
+ - `…` or `...`: 0.55 s
+ - a turn (a question, or a sentence opening a new move): 0.60 s
+ - a blank line: 0.70 s
+- - a cut inside a sentence (at `,` `;` `:` or a space): 0.20 s
++ - a cut inside a sentence (at `,` `;` `:` `，` `：` `、` or a space): 0.20 s
+ - **Room tone.** The added pause is copied from the earlier segment's quietest 100 ms in its last second, played back and forth. It is digital silence when that segment has no quiet tail.
+ - **Level.** A segment whose speech level (the median dBFS of its frames at or above -42 dBFS) is more than 1.5 dB from the median of the earlier segments gets one constant gain. The gain brings it to 1.5 dB, is at most 3 dB either way, and never raises a peak past 0.99.
+ - **Seeds.** Each segment's seed comes from its own prompt rows, as a single synthesis's does.
+@@ -337,9 +339,9 @@ tensorfold serve DRAMA3_DIR --voices voices/ --default-voice NAME --long-form --
+
+ A client marks a topic shift with `¶` (U+00B6), sent as ` ¶ `. A caller's wrapper writes one for each blank line it collapses. With `--shift-pause-s T` (0 to 3 seconds, default 0: off; needs `--long-form`), the reply pauses for at least T seconds at each mark, and says where those pauses are.
+
+-- **Marks.** A mark counts only after `.` `!` `?` or `…` (closing quotes and brackets may sit between), and only with words on both sides of it. Here a word means a Unicode letter or number (general category L or N, so `次へ`, `Été` and `２` count, while `！！！`, `×` and `€` do not), outside `[…]` and `<…>` controls, between the mark and the last cut and between it and the next mark. A cue may open the text after a mark (`done. ¶ [curious] Should I…`), but a mark followed by punctuation, symbols or cues alone does not count. Several marks in a row count as one. Every other mark is dropped, and the server logs how many. Every mark, with the white space after it, is removed before anything else reads the input. The tokenizer, the long-form history, a plain redraw's text and the short-reply rule's character count never see one.
++- **Marks.** A mark counts only after `.` `!` `?` `…` `。` `！` `？` or `；` (closing quotes and brackets may sit between), and only with words on both sides of it. Here a word means a Unicode letter or number (general category L or N, so `次へ`, `Été` and `２` count, while `！！！`, `×` and `€` do not), outside `[…]` and `<…>` controls, between the mark and the last cut and between it and the next mark. A cue may open the text after a mark (`done. ¶ [curious] Should I…`), but a mark followed by punctuation, symbols or cues alone does not count. Marks inside an indivisible control span do not force a cut. Several marks in a row count as one. Every other mark is dropped, and the server logs how many. Every mark, with the white space after it, is removed before anything else reads the input. The tokenizer, the long-form history, a plain redraw's text and the short-reply rule's character count never see one.
+ - **Cues that trail a sentence.** Put the mark after the sentence's end and before a cue that trails it: `nights in a row now. ¶ [small laugh] The calendar`. The cue then opens the next segment. Written after the cue (`now. [small laugh] ¶`), the mark follows `]`, not a sentence end, so it is dropped.
+-- **Cuts.** Each mark that counts cuts a long-form segment there, even in an input short enough for one segment. The text between marks is split as long-form splits any input, and the segment cap still applies.
++- **Cuts.** Each mark that counts cuts a long-form segment there, even in an input short enough for one segment. The text between marks is split as long-form splits any input, including the indivisible-span exception to the character target.
+ - **Pauses.** At a mark's join, the silent 10 ms frames around the join (under -42 dBFS, counted on the reply's own grid from its first sample, as a client's pacing counts them) are made to last at least T seconds. Quiet already there counts, and is never cut. The fill is added, then measured in the audio as sent. If the crossfades or the grid leave it short, more room tone goes in its middle until it is long enough. The fill is room tone: the quietest silent 100 ms (but not digital silence, under -90 dBFS) of the earlier segment's last second. Failing that it comes from all audio earlier in the reply, then from the next segment. If none of these has one, it is noise at -65 dBFS, never zeros. Its samples are kept 6 dB under the floor, so every 10 ms of it is silent. The fill fades in from the earlier segment's last samples and out into the next segment's first samples, each over 15 ms at equal power. Both segments are mirrored at their seams, so neither segment's own audio changes.
+ - **`X-Pause-Spans: s1-e1,s2-e2,…`** lists one span per mark the reply reached, as sample offsets into the audio exactly as sent (start inclusive, end exclusive, ascending). A span runs from the start of the earlier segment's trailing quiet to the end of the next segment's leading quiet, fill included, and always contains the silent frames measured around the join, so it holds at least T seconds of them. With `stream: true` the spans come as a trailer, declared next to `X-Long-Form-Segments`. The header is absent when there are no spans.
+ - **Redraws.** Redraws work per segment as usual. The spans are measured on each segment's final take, so they always describe the audio delivered. Segments under 200 characters fall outside the short-reply rule, and only the silence guard covers them.
+diff --git a/zig/src/server/cli_speech.zig b/zig/src/server/cli_speech.zig
+index a60cac35..113c6f1e 100644
+--- a/zig/src/server/cli_speech.zig
++++ b/zig/src/server/cli_speech.zig
+@@ -47,7 +47,7 @@ pub fn flag(a: Allocator, out: *cli.Args, name: []const u8, v: []const u8, u: *c
+ const is = std.mem.eql;
+ if (is(u8, name, "--voices")) out.voices = v else if (is(u8, name, "--default-voice")) out.default_voice = v else if (is(u8, name, "--long-form")) out.long_form = true else if (is(u8, name, "--long-form-chars")) {
+ const n = try cli.int(u, a, name, v);
+- if (n < 1 or n > 4096) return cli.fail(u, a, "argument --long-form-chars: characters a segment holds, from 1 to 4096: '{s}'", .{v});
++ if (n < 1 or n > 4096) return cli.fail(u, a, "argument --long-form-chars: target characters a segment holds, from 1 to 4096: '{s}'", .{v});
+ out.long_form_chars = @intCast(n);
+ out.long_form_set = true;
+ } else if (is(u8, name, "--long-form-history")) {
+diff --git a/zig/src/server/drama_joins.zig b/zig/src/server/drama_joins.zig
+index 912eaf2a..57ee88ff 100644
+--- a/zig/src/server/drama_joins.zig
++++ b/zig/src/server/drama_joins.zig
+@@ -39,16 +39,23 @@ pub fn boundary(left: []const u8, gap: []const u8, right: []const u8) Boundary {
+ const at = lastStart(left[0..end]);
+ const cp = std.unicode.utf8Decode(left[at..end]) catch break;
+ switch (cp) {
+- '"', '\'', ')', ']', 0x201d, 0x2019, 0xbb => end = at,
++ '"', '\'', ')', ']', 0x201d, 0x2019, 0xbb, 0x300d, 0x300f, 0x3011, 0xff09 => end = at,
+ 0x2026 => return .ellipsis,
+ '.' => return if (std.mem.endsWith(u8, left[0..end], "...")) .ellipsis else .sentence,
+- '!' => return .sentence,
++ '!', 0x3002, 0xff01, 0xff1b => return .sentence,
+ else => break,
+ }
+ }
+ return if (std.mem.indexOfAny(u8, gap, "\n\r") != null) .sentence else .clause;
+ }
+
++test "CJK punctuation selects sentence, question and clause joins" {
++ for ([_][]const u8{ "\u{4f60}\u{597d}\u{3002}", "\u{4f60}\u{597d}\u{ff01}\u{300d}", "\u{4f60}\u{597d}\u{ff1b}" }) |left|
++ try std.testing.expectEqual(Boundary.sentence, boundary(left, "", "\u{4e16}\u{754c}"));
++ try std.testing.expectEqual(Boundary.topic, boundary("\u{4f60}\u{597d}\u{ff1f}\u{300d}", "", "\u{4e16}\u{754c}"));
++ try std.testing.expectEqual(Boundary.clause, boundary("\u{4f60}\u{597d}\u{ff0c}", "", "\u{4e16}\u{754c}"));
++}
++
+ /// The start of the last code point of valid UTF-8 `text`.
+ fn lastStart(text: []const u8) usize {
+ var at = text.len - 1;
+diff --git a/zig/src/server/drama_long.zig b/zig/src/server/drama_long.zig
+index 77d0aff1..e87207bc 100644
+--- a/zig/src/server/drama_long.zig
++++ b/zig/src/server/drama_long.zig
+@@ -1,10 +1,11 @@
+ //! Drama 3 long-form speech: an input cut at sentence ends into segments, each spoken after hearing those before it.
+ const std = @import("std");
+ const drama_prompt = @import("drama_prompt.zig");
++const drama_spans = @import("drama_spans.zig");
+ const Reference = drama_prompt.Reference;
+ const Allocator = std.mem.Allocator;
+
+-/// --long-form's segments of at most `chars`, each hearing `history` before it; --shift-pause-s: seconds at each `¶`.
++/// --long-form's character target; indivisible controls may exceed it. `history` sets earlier segments heard.
+ pub const Options = struct { chars: u32 = 500, history: u8 = 1, shift_pause_s: f32 = 0 };
+
+ pub const max_history = 3;
+@@ -14,13 +15,17 @@ pub const max_frames = 6000;
+
+ /// Where text may be cut, coarsest first.
+ const Level = enum { sentence, clause, space, any };
++const Protection = struct { base: [*]const u8, spans: []const drama_spans.Span };
+
+-/// The input's segments: the fewest that fit `chars`, balanced, ending where the text turns (see `balance`).
++/// Balanced slices targeting `chars`, without cutting controls; an oversized control stays whole in its own slice.
+ pub fn split(a: Allocator, input: []const u8, chars: u32) Allocator.Error![]const []const u8 {
++ const spans = try drama_spans.collect(a, input);
++ defer a.free(spans);
++ const protection: Protection = .{ .base = input.ptr, .spans = spans };
+ var out: std.ArrayList([]const u8) = .empty;
+ var run: std.ArrayList([]const u8) = .empty;
+ var at: usize = 0;
+- while (nextPiece(input, &at, .sentence, chars)) |piece| {
++ while (nextPiece(input, &at, .sentence, chars, protection)) |piece| {
+ if (count(piece) <= chars) {
+ try run.append(a, piece);
+ continue;
+@@ -28,7 +33,7 @@ pub fn split(a: Allocator, input: []const u8, chars: u32) Allocator.Error![]cons
+ try balance(a, &out, run.items, chars);
+ run.clearRetainingCapacity();
+ // a sentence over `chars` is cut at ``; : ,``, then spaces, then anywhere, into segments of its own
+- try pack(a, &out, piece, .clause, chars);
++ try pack(a, &out, piece, .clause, chars, protection);
+ }
+ try balance(a, &out, run.items, chars);
+ return out.items;
+@@ -106,15 +111,17 @@ pub fn gapBetween(left: []const u8, right: []const u8) []const u8 {
+ return left.ptr[left.len .. @intFromPtr(right.ptr) - @intFromPtr(left.ptr)];
+ }
+
+-/// Packs `text`'s pieces at `level` greedily into segments of at most `chars`; a longer piece is cut one level finer.
+-fn pack(a: Allocator, out: *std.ArrayList([]const u8), text: []const u8, level: Level, chars: u32) Allocator.Error!void {
++/// Packs free text within `chars`; the final level emits an oversized protected atom without splitting it.
++fn pack(a: Allocator, out: *std.ArrayList([]const u8), text: []const u8, level: Level, chars: u32, protection: Protection) Allocator.Error!void {
+ var current: ?[]const u8 = null;
+ var at: usize = 0;
+- while (nextPiece(text, &at, level, chars)) |piece| {
++ while (nextPiece(text, &at, level, chars, protection)) |piece| {
+ if (count(piece) > chars) {
+ if (current) |c| try out.append(a, c);
+ current = null;
+- try pack(a, out, piece, @fromBackingInt(@intCast(@backingInt(level) + 1)), chars);
++ if (level == .any) {
++ try out.append(a, piece);
++ } else try pack(a, out, piece, @fromBackingInt(@intCast(@backingInt(level) + 1)), chars, protection);
+ } else if (current) |c| {
+ const joined = c.ptr[0 .. @intFromPtr(piece.ptr) + piece.len - @intFromPtr(c.ptr)];
+ if (count(joined) <= chars) {
+@@ -139,10 +146,11 @@ pub fn turns(left: []const u8, gap: []const u8, right: []const u8) bool {
+
+ /// `text` ends in a question mark, closing quotes and brackets aside.
+ pub fn question(text: []const u8) bool {
+- return lastMark(text) == '?';
++ const cp = lastMark(text);
++ return cp == '?' or cp == 0xff1f;
+ }
+
+-/// `text`, trailing white space, closing quotes and brackets aside, ends in `.` `!` `?` or `…`.
++/// `text`, trailing white space and closing quotes/brackets aside, ends in ASCII or CJK sentence punctuation.
+ pub fn endsSentence(text: []const u8) bool {
+ return terminal(lastMark(trim(text)) orelse return false);
+ }
+@@ -200,14 +208,18 @@ fn count(text: []const u8) usize {
+ return std.unicode.utf8CountCodepoints(text) catch unreachable;
+ }
+
+-/// Ends a sentence when followed by white space or the end; closing quotes and brackets stay with it.
++/// ASCII or CJK sentence punctuation; ASCII additionally needs white space or the end at the split point.
+ fn terminal(cp: u21) bool {
+- return cp == '.' or cp == '!' or cp == '?' or cp == 0x2026;
++ return cp == '.' or cp == '!' or cp == '?' or cp == 0x2026 or cjkTerminal(cp);
++}
++
++fn cjkTerminal(cp: u21) bool {
++ return cp == 0x3002 or cp == 0xff01 or cp == 0xff1f or cp == 0xff1b;
+ }
+
+ fn closer(cp: u21) bool {
+ return switch (cp) {
+- '"', '\'', ')', ']', 0x201d, 0x2019, 0xbb => true,
++ '"', '\'', ')', ']', 0x201d, 0x2019, 0xbb, 0x300d, 0x300f, 0x3011, 0xff09 => true,
+ else => false,
+ };
+ }
+@@ -217,10 +229,10 @@ fn newline(cp: u21) bool {
+ }
+
+ /// The next non-empty piece of `text` from `at.*`, trimmed of white space, with `at.*` moved past it.
+-fn nextPiece(text: []const u8, at: *usize, level: Level, chars: u32) ?[]const u8 {
++fn nextPiece(text: []const u8, at: *usize, level: Level, chars: u32, protection: Protection) ?[]const u8 {
+ while (at.* < text.len) {
+ const begin = at.*;
+- const end = cut(text, begin, level, chars);
++ const end = cut(text, begin, level, chars, protection);
+ at.* = end;
+ const piece = trim(text[begin..end]);
+ if (piece.len > 0) return piece;
+@@ -229,25 +241,45 @@ fn nextPiece(text: []const u8, at: *usize, level: Level, chars: u32) ?[]const u8
+ }
+
+ /// Where the piece starting at `begin` ends (its cut point, or the end of `text`).
+-fn cut(text: []const u8, begin: usize, level: Level, chars: u32) usize {
++fn cut(text: []const u8, begin: usize, level: Level, chars: u32, protection: Protection) usize {
+ var it = std.unicode.Utf8View.initUnchecked(text[begin..]).iterator();
+ var seen: usize = 0;
+- while (it.nextCodepoint()) |cp| {
++ const offset = @intFromPtr(text.ptr) - @intFromPtr(protection.base);
++ var atom: usize = 0;
++ while (atom < protection.spans.len and protection.spans[atom].end <= offset + begin) atom += 1;
++ while (it.i < text.len - begin) {
++ const here = begin + it.i;
++ if (atom < protection.spans.len and protection.spans[atom].start == offset + here) {
++ const end = protection.spans[atom].end - offset;
++ const n = count(text[here..end]);
++ if (level == .any and seen > 0 and seen + n > chars) return here;
++ seen += n;
++ it.i = end - begin;
++ atom += 1;
++ if (level == .any and seen >= chars) return end;
++ continue;
++ }
++ const cp = it.nextCodepoint().?;
+ seen += 1;
+ switch (level) {
+ .sentence => {
+ if (newline(cp)) return begin + it.i;
+ if (!terminal(cp)) continue;
+ var after = it;
++ var cjk = cjkTerminal(cp);
+ while (after.peek(1).len > 0) {
+ const next = std.unicode.utf8Decode(after.peek(1)) catch unreachable;
+ if (!terminal(next) and !closer(next)) break;
++ cjk = cjk or cjkTerminal(next);
+ _ = after.nextCodepoint();
+ }
+ it = after;
+- if (endsWord(text[begin..], it.i)) return begin + it.i;
++ if (cjk or endsWord(text[begin..], it.i)) return begin + it.i;
++ },
++ .clause => {
++ const cjk = cp == 0xff0c or cp == 0xff1a or cp == 0x3001;
++ if (cjk or ((cp == ';' or cp == ':' or cp == ',') and endsWord(text[begin..], it.i))) return begin + it.i;
+ },
+- .clause => if ((cp == ';' or cp == ':' or cp == ',') and endsWord(text[begin..], it.i)) return begin + it.i,
+ .space => if (drama_prompt.isWhiteSpace(cp)) return begin + it.i,
+ .any => if (seen == chars) return begin + it.i,
+ }
+@@ -388,7 +420,7 @@ test "no segment is ever longer than the limit, and there are never more than ne
+ var greedy: usize = 0;
+ var current: usize = 0;
+ var at: usize = 0;
+- while (nextPiece(text.items, &at, .sentence, chars)) |piece| {
++ while (nextPiece(text.items, &at, .sentence, chars, .{ .base = text.items.ptr, .spans = &.{} })) |piece| {
+ const n = count(piece);
+ if (current > 0 and current + 1 + n <= chars) current += 1 + n else {
+ greedy += 1;
+@@ -408,6 +440,56 @@ test "a sentence longer than the limit is cut at clause marks, then spaces, then
+ try expectSplit("\u{3042}\u{3044}\u{3046}\u{3048}\u{304a}", 2, &.{ "\u{3042}\u{3044}", "\u{3046}\u{3048}", "\u{304a}" });
+ }
+
++test "protected chunks keep a paired direction whole when it exceeds the target" {
++ const input = "One. Two. Three.";
++ for ([_]u32{ 1, 20, input.len - 1, input.len }) |chars| try expectSplit(input, chars, &.{input});
++ try expectSplit("AB" ++ input ++ "CD", 2, &.{ "AB", input, "CD" });
++ try expectSplit("[laughs softly] Hello.", 10, &.{ "[laughs softly]", "Hello." });
++ try expectSplit("[laughs][pause]", 1, &.{ "[laughs]", "[pause]" });
++ try expectSplit("<|speaker:0|> ab", 1, &.{ "<|speaker:0|>", "a", "b" });
++}
++
++test "protected chunks preserve nested spans and recover after malformed openers" {
++ const nested = "One. Two. [pause] Three.";
++ try expectSplit(nested ++ " After.", 10, &.{ nested, "After." });
++ try expectSplit("one. two.", 10, &.{ "one.", "two." });
++ try expectSplit("[open Quiet.", 5, &.{ "[open", "Quiet." });
++ try expectSplit("[outer [inner] tail] End.", 5, &.{ "[outer [inner] tail]", "End." });
++}
++
++test "protected chunks stay in the original input and only indivisible spans may exceed the target" {
++ var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
++ defer arena.deinit();
++ const a = arena.allocator();
++ const input = "ab\u{4e59}\u{4e19}\u{4e01}\u{3002}cd [laughs softly] ef";
++ const spans = try drama_spans.collect(a, input);
++ for ([_]u32{ 1, 2, 7, 20 }) |chars| {
++ const got = try split(a, input, chars);
++ var end: usize = 0;
++ for (got) |segment| {
++ const start = @intFromPtr(segment.ptr) - @intFromPtr(input.ptr);
++ try std.testing.expect(start >= end and start + segment.len <= input.len);
++ try std.testing.expectEqual(@as(usize, 0), trim(input[end..start]).len);
++ end = start + segment.len;
++ if (count(segment) > chars) {
++ const whole = for (spans) |atom| {
++ if (start == atom.start and end == atom.end) break true;
++ } else false;
++ try std.testing.expect(whole);
++ }
++ }
++ try std.testing.expectEqual(@as(usize, 0), trim(input[end..]).len);
++ }
++}
++
++test "CJK sentence and clause punctuation does not need a following space" {
++ try expectSplit("\u{4f60}\u{597d}\u{3002}\u{4e16}\u{754c}\u{ff01}\u{518d}\u{89c1}\u{ff1f}\u{7ed3}\u{675f}\u{3002}", 6, &.{ "\u{4f60}\u{597d}\u{3002}\u{4e16}\u{754c}\u{ff01}", "\u{518d}\u{89c1}\u{ff1f}\u{7ed3}\u{675f}\u{3002}" });
++ try expectSplit("\u{7532}\u{4e59}\u{ff0c}\u{4e19}\u{4e01}\u{3001}\u{620a}\u{5df1}\u{ff1a}\u{5e9a}\u{8f9b}\u{3002}", 5, &.{ "\u{7532}\u{4e59}\u{ff0c}", "\u{4e19}\u{4e01}\u{3001}", "\u{620a}\u{5df1}\u{ff1a}", "\u{5e9a}\u{8f9b}\u{3002}" });
++ try expectSplit("\u{300c}\u{7532}\u{3002}\u{300d}\u{4e59}\u{ff1b}\u{4e19}\u{ff01}", 4, &.{ "\u{300c}\u{7532}\u{3002}\u{300d}", "\u{4e59}\u{ff1b}\u{4e19}\u{ff01}" });
++ try expectSplit("\u{7532}.\u{ff1f}\u{4e59}\u{3002}", 4, &.{ "\u{7532}.\u{ff1f}", "\u{4e59}\u{3002}" });
++ try std.testing.expect(question("\u{4f60}\u{597d}\u{ff1f}\u{300d}"));
++}
++
+ test "the segments header lists where each segment after the first starts, and its largest value fits its buffer" {
+ var buf: [segments_header_max]u8 = undefined;
+ try std.testing.expectEqualStrings("3;2048,6144", segmentsHeader(&buf, &.{ 0, 2048, 6144 }));
+diff --git a/zig/src/server/drama_shift.zig b/zig/src/server/drama_shift.zig
+index 7171ac3a..43fda1b3 100644
+--- a/zig/src/server/drama_shift.zig
++++ b/zig/src/server/drama_shift.zig
+@@ -2,6 +2,7 @@
+ const std = @import("std");
+ const drama_prompt = @import("drama_prompt.zig");
+ const drama_long = @import("drama_long.zig");
++const drama_spans = @import("drama_spans.zig");
+ const drama_joins = @import("drama_joins.zig");
+ const unicode = @import("tokenizer").unicode;
+ const Allocator = std.mem.Allocator;
+@@ -15,6 +16,9 @@ pub const Marked = struct { text: []const u8, cuts: []const usize = &.{}, droppe
+ /// `input` without its marks and the white space after each; with `honour`, its cuts (`read`'s rule, in the docs).
+ pub fn read(a: Allocator, input: []const u8, honour: bool) Allocator.Error!Marked {
+ if (std.mem.indexOf(u8, input, mark) == null) return .{ .text = input };
++ const protected = if (honour) try drama_spans.collect(a, input) else &.{};
++ defer if (honour) a.free(protected);
++ var atom: usize = 0;
+ var text: std.ArrayList(u8) = .empty;
+ var cuts: std.ArrayList(usize) = .empty;
+ var dropped: usize = 0;
+@@ -28,6 +32,11 @@ pub fn read(a: Allocator, input: []const u8, honour: bool) Allocator.Error!Marke
+ at = afterWhiteSpace(input, at + mark.len);
+ }
+ if (!honour) continue;
++ while (atom < protected.len and protected[atom].end <= found) atom += 1;
++ if (atom < protected.len and protected[atom].start < found) {
++ dropped += marks;
++ continue;
++ }
+ // the segments either side: from the cut before, and up to the next mark
+ const before = text.items[if (cuts.items.len > 0) cuts.items[cuts.items.len - 1] else 0..];
+ const after = input[at .. std.mem.indexOfPos(u8, input, at, mark) orelse input.len];
+@@ -64,7 +73,7 @@ fn hasWords(text: []const u8) bool {
+ /// A long-form input's segments, and `shifts[i]` (empty without a cut): a mark stands right before segment i.
+ pub const Segments = struct { segments: []const []const u8, shifts: []const bool = &.{} };
+
+-/// `marked`'s segments of at most `chars`.
++/// `marked`'s segments targeting `chars`, keeping indivisible controls whole.
+ pub fn split(a: Allocator, marked: Marked, chars: u32) Allocator.Error!Segments {
+ if (marked.cuts.len == 0) return .{ .segments = try drama_long.split(a, marked.text, chars) };
+ var segments: std.ArrayList([]const u8) = .empty;
+@@ -210,6 +219,15 @@ test "a mark needs words on both sides: punctuation or cues alone are no segment
+ try expectRead("One. \u{b6} [small laugh] Two.", "One. [small laugh] Two.", &.{5}, 0);
+ }
+
++test "topic shifts never cut protected spans, but a following ordinary shift still counts" {
++ try expectRead("One. \u{b6} Two.", "One. Two.", &.{}, 1);
++ try expectRead("[laughs. \u{b6} softly] End.", "[laughs. softly] End.", &.{}, 1);
++ const before = "One. Two. Three. End. ";
++ try expectRead("One. Two. \u{b6} Three. End. \u{b6} Next.", before ++ "Next.", &.{before.len}, 1);
++ try expectRead("One. \u{b6} Two.", "One. Two.", &.{15}, 0);
++ try expectRead("\u{4f60}\u{597d}\u{3002}\u{b6}\u{4e16}\u{754c}\u{3002}", "\u{4f60}\u{597d}\u{3002}\u{4e16}\u{754c}\u{3002}", &.{9}, 0);
++}
++
+ test "words are Unicode letters and numbers; full-width punctuation and symbols are none" {
+ // full-width marks, math and currency signs, an emoji, Latin-1's inverted marks
+ for ([_][]const u8{ "\u{ff01}\u{ff01}\u{ff01}", "\u{d7}", "\u{20ac} \u{2192}", "\u{1f600}", "\u{bf}\u{a1}", "\u{3002}\u{300c}\u{300d}" }) |rest| {
+diff --git a/zig/src/server/drama_spans.zig b/zig/src/server/drama_spans.zig
+new file mode 100644
+index 00000000..86905d1d
+--- /dev/null
++++ b/zig/src/server/drama_spans.zig
+@@ -0,0 +1,128 @@
++//! Indivisible speech text: special tokens, balanced brackets and correctly nested paired tags.
++const std = @import("std");
++const Allocator = std.mem.Allocator;
++
++pub const Span = struct { start: usize, end: usize };
++const Tag = struct { start: usize, end: usize, name: []const u8, closing: bool };
++
++/// Sorted, disjoint byte ranges; adjacent controls remain separate atoms and all bytes stay in the caller's input.
++pub fn collect(a: Allocator, input: []const u8) Allocator.Error![]Span {
++ var atoms: std.ArrayList(Span) = .empty;
++ defer atoms.deinit(a);
++ var brackets: std.ArrayList(usize) = .empty;
++ defer brackets.deinit(a);
++ var i: usize = 0;
++ while (i < input.len) {
++ if (specialEnd(input, i)) |end| {
++ try atoms.append(a, .{ .start = i, .end = end });
++ i = end;
++ continue;
++ }
++ if (input[i] == '[') try brackets.append(a, i) else if (input[i] == ']') {
++ if (brackets.pop()) |start| try atoms.append(a, .{ .start = start, .end = i + 1 });
++ }
++ i += 1;
++ }
++ merge(&atoms);
++
++ var spans: std.ArrayList(Span) = .empty;
++ errdefer spans.deinit(a);
++ try spans.appendSlice(a, atoms.items);
++ var tags: std.ArrayList(Tag) = .empty;
++ defer tags.deinit(a);
++ var atom: usize = 0;
++ i = 0;
++ while (i < input.len) {
++ if (atom < atoms.items.len and i == atoms.items[atom].start) {
++ i = atoms.items[atom].end;
++ atom += 1;
++ continue;
++ }
++ if (tagAt(input, i)) |tag| {
++ if (!tag.closing) {
++ try tags.append(a, tag);
++ } else if (tags.pop()) |open| {
++ if (std.mem.eql(u8, open.name, tag.name)) {
++ try spans.append(a, .{ .start = open.start, .end = tag.end });
++ } else tags.clearRetainingCapacity();
++ }
++ i = tag.end;
++ } else i += 1;
++ }
++ merge(&spans);
++ return spans.toOwnedSlice(a);
++}
++
++fn specialEnd(input: []const u8, start: usize) ?usize {
++ if (!std.mem.startsWith(u8, input[start..], "<|")) return null;
++ var i = start + 2;
++ while (i < input.len and input[i] != '|' and input[i] != '>') : (i += 1) {
++ if (input[i] == '<') return null;
++ }
++ return if (std.mem.startsWith(u8, input[i..], "|>")) i + 2 else null;
++}
++
++fn tagAt(input: []const u8, start: usize) ?Tag {
++ if (input[start] != '<') return null;
++ var i = start + 1;
++ const closing = i < input.len and input[i] == '/';
++ if (closing) i += 1;
++ const first = i;
++ if (i == input.len or !std.ascii.isAlphabetic(input[i])) return null;
++ i += 1;
++ while (i < input.len and (std.ascii.isAlphanumeric(input[i]) or input[i] == '_' or input[i] == '-')) i += 1;
++ if (i == input.len or input[i] != '>') return null;
++ return .{ .start = start, .end = i + 1, .name = input[first..i], .closing = closing };
++}
++
++fn before(_: void, left: Span, right: Span) bool {
++ return left.start < right.start or (left.start == right.start and left.end > right.end);
++}
++
++fn merge(spans: *std.ArrayList(Span)) void {
++ std.mem.sort(Span, spans.items, {}, before);
++ var n: usize = 0;
++ for (spans.items) |span| {
++ if (n > 0 and span.start < spans.items[n - 1].end) {
++ spans.items[n - 1].end = @max(spans.items[n - 1].end, span.end);
++ } else {
++ spans.items[n] = span;
++ n += 1;
++ }
++ }
++ spans.shrinkRetainingCapacity(n);
++}
++
++fn expectSpans(input: []const u8, want: []const []const u8) !void {
++ const spans = try collect(std.testing.allocator, input);
++ defer std.testing.allocator.free(spans);
++ try std.testing.expectEqual(want.len, spans.len);
++ for (spans, want) |span, expected| try std.testing.expectEqualStrings(expected, input[span.start..span.end]);
++ for (spans, 0..) |span, i| {
++ try std.testing.expect(span.start < span.end and span.end <= input.len);
++ if (i > 0) try std.testing.expect(spans[i - 1].end <= span.start);
++ }
++}
++
++test "special tokens and adjacent or nested bracketed cues are indivisible" {
++ try expectSpans("A <|speaker:0|> [soft laugh][pause] B", &.{ "<|speaker:0|>", "[soft laugh]", "[pause]" });
++ try expectSpans("[outer [inner] tail] [next]", &.{ "[outer [inner] tail]", "[next]" });
++ try expectSpans("[<|speaker:0|> [pause]]", &.{"[<|speaker:0|> [pause]]"});
++ try expectSpans("<|a|b|> <|x> <|unterminated", &.{});
++}
++
++test "paired tags nest by exact name and ignore tag-shaped text inside bracketed cues" {
++ const nested = "One. Two. Three.";
++ try expectSpans(nested ++ " Four.", &.{ nested, "Four." });
++ try expectSpans("[literal ] Quiet.", &.{"[literal ] Quiet."});
++ try expectSpans("\u{4f60}\u{597d}\u{3002}", &.{"\u{4f60}\u{597d}\u{3002}"});
++}
++
++test "unclosed and crossed controls do not hide subsequent valid controls" {
++ try expectSpans("[unclosed [pause] Hi.", &.{ "[pause]", "Hi." });
++ try expectSpans("Hi.", &.{"Hi."});
++ try expectSpans("Hi. Bye. End.", &.{"End."});
++ try expectSpans("Hi. Hi. <1>Hi.", &.{});
++ try expectSpans("<|unclosed Hi.", &.{"Hi."});
++ try expectSpans("2 < 3; a > b; [] [unfinished", &.{"[]"});
++}
+diff --git a/zig/src/server/speech_long.zig b/zig/src/server/speech_long.zig
+index b174cf8a..619e0f79 100644
+--- a/zig/src/server/speech_long.zig
++++ b/zig/src/server/speech_long.zig
+@@ -44,7 +44,7 @@ pub fn plan(srv: *Server, cx: *Cx, sp: api.SpeechInfo, marked: drama_shift.Marke
+ const segments = split.segments;
+ if (segments.len <= 1) return null;
+ if (segments.len > drama_long.max_segments)
+- return cx.fail(.request, drama_prompt.error_prefix ++ " a long-form input in {d} segments of at most {d} characters exceeds the maximum of {d} segments", .{ segments.len, options.chars, drama_long.max_segments });
++ return cx.fail(.request, drama_prompt.error_prefix ++ " a long-form input in {d} segments targeting {d} characters exceeds the maximum of {d} segments", .{ segments.len, options.chars, drama_long.max_segments });
+ for (segments) |segment| {
+ if (try drama_prompt.problem(cx.a, segment)) |message| return cx.refuse(message);
+ const rows = drama_prompt.promptRows(cx.a, srv.text, segment, references) catch |e| return switch (e) {
+diff --git a/zig/src/server/speech_long_test.zig b/zig/src/server/speech_long_test.zig
+index e0d850b4..8fb9a7ba 100644
+--- a/zig/src/server/speech_long_test.zig
++++ b/zig/src/server/speech_long_test.zig
+@@ -110,9 +110,10 @@ pub fn body(a: std.mem.Allocator, input: []const u8, stream: bool) ![]const u8 {
+ fn serve(t: *Turns, cfg: server.Config, request: []const u8) !struct { s: *Served, head: []const u8 } {
+ const s = try gpa.create(Served);
+ try s.startWith(t.engine(), cfg, "HTTP/1.1", request, 2000);
+- const head = try s.readHead();
++ const head_len = (try s.readHead()).len;
++ _ = try s.readRest(); // drain before joining: a whole reply can outgrow the socket's buffers
+ s.route.join();
+- return .{ .s = s, .head = head };
++ return .{ .s = s, .head = s.got.items[0..head_len] };
+ }
+
+ pub fn done(s: *Served) void {
+@@ -338,7 +339,7 @@ test "more than 12 segments are refused before any synthesis" {
+ const r = try serve(&t, config(.{ .chars = 20 }), try body(a, try sentences(a, 13), false));
+ defer done(r.s);
+ try std.testing.expect(std.mem.indexOf(u8, r.head, " 400 ") != null);
+- try std.testing.expect(std.mem.indexOf(u8, try r.s.readRest(), "Drama 3 request: a long-form input in 13 segments of at most 20 characters exceeds the maximum of 12 segments") != null);
++ try std.testing.expect(std.mem.indexOf(u8, try r.s.readRest(), "Drama 3 request: a long-form input in 13 segments targeting 20 characters exceeds the maximum of 12 segments") != null);
+ try std.testing.expectEqual(@as(usize, 0), t.seen);
+ }
+
+@@ -383,3 +384,51 @@ test "a failure after the first segment ends a stream incomplete and a whole rep
+ }
+ }
+ }
++
++test "protected controls reach whole and streamed speech requests without a split inside them" {
++ var arena: std.heap.ArenaAllocator = .init(gpa);
++ defer arena.deinit();
++ const a = arena.allocator();
++ var text: harness.Bytes = .{};
++ const cases = [_]struct { input: []const u8, first: []const u8, second: []const u8, chars: u32 }{
++ .{ .input = "One. Two. Three. After.", .first = "One. Two. Three.", .second = "After.", .chars = 20 },
++ .{ .input = "[laughs softly] Hello.", .first = "[laughs softly]", .second = "Hello.", .chars = 10 },
++ .{ .input = "One. \u{b6} Two. After.", .first = "One. Two.", .second = "After.", .chars = 20 },
++ };
++ for (cases) |case| for ([_]bool{ false, true }) |stream| {
++ var t: Turns = .{ .turns = &.{ .{ .frames = 3 }, .{ .frames = 4 } } };
++ defer t.deinit();
++ const options: drama_long.Options = .{ .chars = case.chars, .history = 0, .shift_pause_s = 0.5 };
++ const r = try serve(&t, config(options), try body(a, case.input, stream));
++ defer done(r.s);
++ try std.testing.expect(std.mem.indexOf(u8, r.head, "HTTP/1.1 200") != null);
++ const rest = try r.s.readRest();
++ try std.testing.expect(rest.len > 0);
++ try std.testing.expectEqual(@as(usize, 2), t.seen);
++ for ([_][]const u8{ case.first, case.second }, t.prompts.items) |segment, prompt|
++ try std.testing.expectEqualSlices(u32, try drama_prompt.encode(a, text.text(), segment), prompt);
++ try std.testing.expectEqualSlices(bool, &.{ stream, false }, t.streamed.items);
++ const metadata = if (stream) rest else r.s.got.items[0..r.head.len];
++ try std.testing.expect(std.mem.indexOf(u8, metadata, "X-Long-Form-Segments: 2;") != null);
++ try std.testing.expect(std.mem.indexOf(u8, metadata, "X-Pause-Spans:") == null);
++ if (stream) try std.testing.expect(std.mem.endsWith(u8, rest, "\r\n\r\n"));
++ };
++}
++
++test "an indivisible span above the character target still obeys the engine prompt ceiling" {
++ var arena: std.heap.ArenaAllocator = .init(gpa);
++ defer arena.deinit();
++ const a = arena.allocator();
++ var text: harness.Bytes = .{};
++ const span = "One. Two. Three.";
++ const ceiling: u32 = @intCast((try drama_prompt.encode(a, text.text(), span)).len - 1);
++ for ([_][]const u8{ span, span ++ " After." }) |input| {
++ var t: Turns = .{ .turns = &.{}, .max_prompt = ceiling };
++ defer t.deinit();
++ const r = try serve(&t, config(.{ .chars = 1 }), try body(a, input, false));
++ defer done(r.s);
++ try std.testing.expect(std.mem.indexOf(u8, r.head, "HTTP/1.1 400") != null);
++ try std.testing.expect(std.mem.indexOf(u8, try r.s.readRest(), "exceeds the maximum allowed length") != null);
++ try std.testing.expectEqual(@as(usize, 0), t.seen);
++ }
++}
+diff --git a/zig/src/server/speech_mid_test.zig b/zig/src/server/speech_mid_test.zig
+index 6ce2c377..88f19a7c 100644
+--- a/zig/src/server/speech_mid_test.zig
++++ b/zig/src/server/speech_mid_test.zig
+@@ -25,8 +25,8 @@ fn serve(t: *Turns, cfg: server.Config, deadline: ?[]const u8, request: []const
+ const first = if (deadline) |d| try std.fmt.bufPrint(&line, "POST /v1/audio/speech HTTP/1.1\r\nX-Deadline-S: {s}", .{d}) else "POST /v1/audio/speech HTTP/1.1";
+ try s.open(t.engine(), cfg, first, request, 2000);
+ _ = try s.readHead();
+- s.route.join();
+ _ = try s.readRest();
++ s.route.join();
+ // read whole first: reading more can move the bytes a head slice points into
+ const all = s.got.items;
+ return .{ .s = s, .head = all[0 .. std.mem.indexOf(u8, all, "\r\n\r\n").? + 4], .all = all };
+diff --git a/zig/src/server/speech_redraw_test.zig b/zig/src/server/speech_redraw_test.zig
+index fbb5e1fe..c661c972 100644
+--- a/zig/src/server/speech_redraw_test.zig
++++ b/zig/src/server/speech_redraw_test.zig
+@@ -24,9 +24,10 @@ fn serve(t: *Turns, cfg: server.Config, deadline: ?[]const u8, request: []const
+ const s = try gpa.create(harness.Served);
+ const first = if (deadline) |d| try std.fmt.bufPrint(&line, "POST /v1/audio/speech HTTP/1.1\r\nX-Deadline-S: {s}", .{d}) else "POST /v1/audio/speech HTTP/1.1";
+ try s.open(t.engine(), cfg, first, request, 2000);
+- const head = try s.readHead();
++ const head_len = (try s.readHead()).len;
++ _ = try s.readRest(); // drain before joining: a whole reply can outgrow the socket's buffers
+ s.route.join();
+- return .{ .s = s, .head = head };
++ return .{ .s = s, .head = s.got.items[0..head_len] };
+ }
+
+ fn has(haystack: []const u8, needle: []const u8) bool {
+@@ -423,7 +424,7 @@ test "long-form controls: a later segment that opens like a director's note keep
+ try std.testing.expectEqualSlices(u32, want, try redrawnSecond(a, "Sentence 00 is ok, and it is long enough.\\nDirection: d\\nLine: Sentence 01 [pause] ok.", 45));
+ }
+
+-test "long-form controls: a bracket span that a segment cut crosses is dropped whole, from both segments" {
++test "long-form controls: a bracket cue stays in one segment and is dropped whole on redraw" {
+ var arena: std.heap.ArenaAllocator = .init(gpa);
+ defer arena.deinit();
+ const a = arena.allocator();
+@@ -431,7 +432,8 @@ test "long-form controls: a bracket span that a segment cut crosses is dropped w
+ const input = "Sentence 00 is ok. [warmly. then] Sentence 01 ok.";
+ const segments = try drama_long.split(a, input, 30);
+ try std.testing.expectEqual(@as(usize, 2), segments.len);
+- try std.testing.expect(std.mem.endsWith(u8, segments[0], "[warmly.") and std.mem.startsWith(u8, segments[1], "then]"));
++ try std.testing.expectEqualStrings("Sentence 00 is ok.", segments[0]);
++ try std.testing.expectEqualStrings("[warmly. then] Sentence 01 ok.", segments[1]);
+ const want = try drama_prompt.encode(a, text.text(), "Sentence 01 ok.");
+ try std.testing.expectEqualSlices(u32, want, try redrawnSecond(a, input, 30));
+ }
+diff --git a/zig/src/server/speech_register_test.zig b/zig/src/server/speech_register_test.zig
+index d0bebe25..4e9d24bb 100644
+--- a/zig/src/server/speech_register_test.zig
++++ b/zig/src/server/speech_register_test.zig
+@@ -86,8 +86,9 @@ fn serve(d: *Draws, cfg: server.Config, deadline: ?[]const u8, request: []const
+ try s.open(d.engine(), cfg, first, request, 2000);
+ // the body's read may move the bytes the head lies in
+ const head = try d.a.dupe(u8, try s.readHead());
++ const rest = try s.readRest(); // drain before joining: the 16 kHz replies outgrow the socket's buffers
+ s.route.join();
+- return .{ .s = s, .head = head, .body = try s.readRest() };
++ return .{ .s = s, .head = head, .body = rest };
+ }
+
+ fn config(register: speech_register.Policy, silence: speech_redraw.Policy) server.Config {
+diff --git a/zig/src/server/speech_stream_test.zig b/zig/src/server/speech_stream_test.zig
+index 030dd3b4..5cdcad00 100644
+--- a/zig/src/server/speech_stream_test.zig
++++ b/zig/src/server/speech_stream_test.zig
+@@ -265,8 +265,8 @@ test "audio published before the route reads it goes out as one chunk" {
+ try s.start(&script, "HTTP/1.1", stream_body, 2000);
+ defer s.deinit();
+ _ = try s.readHead();
+- s.join(&script);
+ const rest = try s.readRest();
++ s.join(&script);
+ try std.testing.expect(std.mem.startsWith(u8, rest, "3000\r\n") and std.mem.endsWith(u8, rest, "\r\n0\r\n\r\n"));
+ try std.testing.expectEqualStrings(&pcm(3), rest["3000\r\n".len .. rest.len - "\r\n0\r\n\r\n".len]);
+ }
+@@ -305,8 +305,8 @@ test "audio cut short by the frame limit or the silence guard ends the stream wi
+ try s.start(&script, "HTTP/1.1", stream_body, 2000);
+ defer s.deinit();
+ try expectHeader(try s.readHead(), "Trailer: X-Finish-Reason\r\n");
+- s.join(&script);
+ const rest = try s.readRest();
++ s.join(&script);
+ var buf: [64]u8 = undefined;
+ const end = try std.fmt.bufPrint(&buf, "\r\n0\r\nX-Finish-Reason: {s}\r\n\r\n", .{@tagName(reason)});
+ try std.testing.expect(std.mem.startsWith(u8, rest, "2000\r\n") and std.mem.endsWith(u8, rest, end));
+--
+2.46.0
+
diff --git a/engine/nvfp4/patches/README.md b/engine/nvfp4/patches/README.md
new file mode 100644
index 0000000..70cc1e1
--- /dev/null
+++ b/engine/nvfp4/patches/README.md
@@ -0,0 +1,27 @@
+# CUDA NVFP4 patch series
+
+These native patches apply in filename order to the unchanged
+[`../UPSTREAM`](../UPSTREAM) pin. The builder checks that `SHA256SUMS` lists every
+selected patch exactly once, verifies its digest, then applies the series.
+
+| Patch | Scope | Source PR |
+|---|---|---|
+| `0001-protected-speech-chunks.patch` | Protected markup and CJK long-form boundaries; test fixture drain ordering | [TensorFold #5](https://github.com/plotarmordev/TensorFold/pull/5) |
+
+Protected constructs are complete model special tokens, balanced bracketed
+spans and correctly nested, exact-name ASCII tags without attributes. Unclosed
+or mismatched markup does not protect unrelated following text. Adjacent
+controls remain separate atoms. Segment slices retain their original backing
+buffer, and only a whole protected atom may exceed the code-point target.
+
+CPU validation: 364 passed, four skipped; goldens have zero unexpected
+differences. Independent adversarial testing exercised 1,680 combinations of
+markup, Unicode and character targets. Six existing socket-fixture ordering
+repairs let the macOS CPU suite drain replies before joining server threads;
+production transport is unchanged. CUDA host compilation is still blocked on
+macOS by the base's `O.DIRECT` use. No device/model or listening qualification
+is claimed by these CPU checks.
+
+The [public MLX chunker](https://github.com/Sogni-AI/drama3-mlx/blob/ecc235039ccd5f982f66a6982184f57432354ab4/drama3_mlx/chunking.py)
+is a behavior reference. This is an independent native implementation under
+the recipe's Apache-2.0 license; model weights keep their separate license.
diff --git a/engine/nvfp4/patches/SHA256SUMS b/engine/nvfp4/patches/SHA256SUMS
new file mode 100644
index 0000000..ec0229f
--- /dev/null
+++ b/engine/nvfp4/patches/SHA256SUMS
@@ -0,0 +1 @@
+c0553b2cfd231ddbbe6390edfe49546db5bef084d5bb6a5009542ccccfdd2fb9 0001-protected-speech-chunks.patch
diff --git a/engine/patches/README.md b/engine/patches/README.md
index 36e20a4..6a1f7bb 100644
--- a/engine/patches/README.md
+++ b/engine/patches/README.md
@@ -11,6 +11,9 @@ engine loads are under the Fish Audio Community License v1.0 and are downloaded
`SHA256SUMS` pins every patch.
+Linux `--weights nvfp4` uses the separate [CUDA NVFP4 series](../nvfp4/patches/README.md).
+All profiles require an exact manifest-to-patch match before applying anything.
+
Patch 0012 is corrected in place: it owns one reusable Metal recurrent-state snapshot per lane,
invalidates incompatible live KV before prefill, and uses the prompt builder's exact invariant
boundary including tower lookahead. It preserves uncached chunk cuts and CUDA execution.
diff --git a/recipe/README.md b/recipe/README.md
index e0aaf6b..d9b9f3b 100644
--- a/recipe/README.md
+++ b/recipe/README.md
@@ -7,6 +7,9 @@ On Apple silicon use [`pilot_macos.py`](README-macos.md), with the same explicit
selection and checkpoint manifests. It uses native Metal and owned process groups, not systemd.
Its NVFP4 engine pin is separate from CUDA; the full-model pin remains unchanged.
+The Linux NVFP4 build applies `engine/nvfp4/patches` after its pinned base. Its long-form
+splitter keeps delivery markup intact; see [CUDA NVFP4 long speech](../README.md#cuda-nvfp4-long-speech).
+
```sh
python3 recipe/pilot.py --weights nvfp4 \
--runtime-dir "$RUNTIME_DIR" \
From cb20bdaf6e0637bbb5860dca0c05cc1e3e703ef4 Mon Sep 17 00:00:00 2001
From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
Date: Sun, 25 Oct 2026 12:10:18 +0800
Subject: [PATCH 4/5] Add request sampling controls to all pinned Drama engines
---
CHANGELOG.md | 3 +
README.md | 14 +-
.../0004-speech-sampling-controls.patch | 539 +++++++++++++++
.../0005-sampling-json-boundaries.patch | 90 +++
engine/nvfp4/macos/patches/SHA256SUMS | 2 +
.../0002-speech-sampling-controls.patch | 630 ++++++++++++++++++
engine/nvfp4/patches/README.md | 5 +
engine/nvfp4/patches/SHA256SUMS | 1 +
.../0013-speech-sampling-controls.patch | 536 +++++++++++++++
.../0014-sampling-json-boundaries.patch | 90 +++
engine/patches/README.md | 6 +
engine/patches/SHA256SUMS | 2 +
recipe/README-sampling.md | 57 ++
13 files changed, 1969 insertions(+), 6 deletions(-)
create mode 100644 engine/nvfp4/macos/patches/0004-speech-sampling-controls.patch
create mode 100644 engine/nvfp4/macos/patches/0005-sampling-json-boundaries.patch
create mode 100644 engine/nvfp4/patches/0002-speech-sampling-controls.patch
create mode 100644 engine/patches/0013-speech-sampling-controls.patch
create mode 100644 engine/patches/0014-sampling-json-boundaries.patch
create mode 100644 recipe/README-sampling.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index bfa6c8d..820b66e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,9 @@
### Added
+- Per-request HTTP speech `temperature`, `top_p`, `top_k` and exact unsigned 64-bit
+ `seed` on all pinned profiles, with strict validation and propagation through
+ streaming, references and redraws. Omitted/null values retain existing defaults.
- A checksummed CUDA NVFP4 engine patch series without changing its pinned upstream or weights.
Model-free build tests exercise real patch application, selection on Linux/macOS, corruption
refusal, repeat builds and preservation of modified checkouts. Manifests must cover each
diff --git a/README.md b/README.md
index 35e647b..3440f74 100644
--- a/README.md
+++ b/README.md
@@ -123,7 +123,9 @@ the license's Section III(c), which needs a separate license from Fish Audio.
`POST /v1/audio/speech` takes `model` (`fishaudio/drama-3`), `input` (at most 4096 characters), `voice`
(`default`, or a name loaded with `--voices`), `response_format` (`wav` or `pcm`) and `stream` (`true` needs
-`pcm`). Request-supplied references and other synthesis modifiers are refused. `GET /v1/voices` lists the voices.
+`pcm`). Optional `temperature`, `top_p`, `top_k` and exact integer `seed` select
+request-local sampling; see [ranges, defaults and redraw behavior](recipe/README-sampling.md).
+Other synthesis modifiers are refused. `GET /v1/voices` lists the voices.
The Linux CUDA NVFP4 engine accepts its encoder's `drama3-voice` catalogs and request `references`
as codec codes (not audio). The Mac NVFP4 engine instead uses attested `drama3-http-voice/1`
catalogs and refuses request-supplied references; see the [Mac voice commands](recipe/README-macos.md#attested-reference-voices).
@@ -157,11 +159,9 @@ See the [CUDA patch index](engine/nvfp4/patches/README.md) for scope and tests.
### Full-model engine
-The patches build the full-model engine (`--weights full`). Upstream TensorFold already serves Drama 3. Each patch
-below adds one feature that stays off until you pass its flag, so a server started without them answers as
-upstream does. The exceptions are the first two: batched prefill is on by default (`TF_DRAMA_PREFILL_ROWS=1`
-restores upstream's single-row prefill) and the replay fix is a bug fix. The patches stack and apply in order;
-each one's notes are in the engine tree's `CHANGELOG.md` or `docs/`.
+These patches build the full-model engine (`--weights full`) and apply in order.
+The table lists each feature's activation; HTTP sampling fields need no additional
+launch flag. Each patch's notes are in the engine tree's `CHANGELOG.md` or `docs/`.
| Patch | Adds | Opt in with | Upstream |
|---|---|---|---|
@@ -177,6 +177,8 @@ each one's notes are in the engine tree's `CHANGELOG.md` or `docs/`.
| 0010 (K6) | Whole replies that stopped short of their text are drawn again | `--short-reply-ratio`, `--short-reply-chars-per-s` | [#1161](https://github.com/ashhart/TensorFold/pull/1161) |
| 0011 (K8) | A whole reply is drawn once more when a phrase opens far above the others | `--register-redraw-st`, `--register-redraw-high`, `--register-high-hz` | [#1162](https://github.com/ashhart/TensorFold/pull/1162) |
| 0012 | One bounded reference-prefix snapshot per Metal lane, with exact identity and safe invalidation | none (automatic) | [#1237](https://github.com/ashhart/TensorFold/pull/1237) |
+| 0013 | Request-local speech sampling and exact integer seeds | HTTP `temperature`, `top_p`, `top_k`, `seed` | [#1277](https://github.com/ashhart/TensorFold/pull/1277) |
+| 0014 | Parsed-JSON floating boundary documentation and regressions | none (tests/docs) | [#1277](https://github.com/ashhart/TensorFold/pull/1277) |
`drama3-voice`, a tool that writes attested voice files for `--voices`, is proposed upstream in
[#1153](https://github.com/ashhart/TensorFold/pull/1153); it is not part of this series.
diff --git a/engine/nvfp4/macos/patches/0004-speech-sampling-controls.patch b/engine/nvfp4/macos/patches/0004-speech-sampling-controls.patch
new file mode 100644
index 0000000..680d71d
--- /dev/null
+++ b/engine/nvfp4/macos/patches/0004-speech-sampling-controls.patch
@@ -0,0 +1,539 @@
+From 43367973c989ff8d19a6d8ffa2669c4a530bee80 Mon Sep 17 00:00:00 2001
+From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 11:48:10 +0800
+Subject: [PATCH] server: expose per-request speech sampling controls
+
+---
+ CHANGELOG.md | 2 +
+ README.md | 4 +-
+ docs/speech-redraws.md | 10 +-
+ docs/speech-sampling.md | 47 ++++++++
+ zig/src/server/root.zig | 1 +
+ zig/src/server/speech.zig | 23 ++--
+ zig/src/server/speech_register_test.zig | 28 +++++
+ zig/src/server/speech_sampling.zig | 57 +++++++++
+ zig/src/server/speech_sampling_test.zig | 140 ++++++++++++++++++++++
+ zig/src/server/speech_stream_test.zig | 3 +
+ zig/src/server/speech_unmeasured_test.zig | 2 +-
+ 11 files changed, 302 insertions(+), 15 deletions(-)
+ create mode 100644 docs/speech-sampling.md
+ create mode 100644 zig/src/server/speech_sampling.zig
+ create mode 100644 zig/src/server/speech_sampling_test.zig
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index 50a2c7ad..4f62fc5d 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -4,6 +4,8 @@ Each release's page on GitHub has its notes and measurements. See [the 1.0.0 rel
+
+ ## Unreleased
+
++- Drama speech requests accept `temperature`, `top_p`, `top_k` (1 through 64) and exact unsigned 64-bit `seed` values. Whole replies, streams, catalog voices and redraws retain the requested settings; omitted or null fields keep the existing defaults. Explicit seeds advance by the attempt number for redraws. See [speech sampling](docs/speech-sampling.md).
++
+ - Drama 3 on Metal reads the pruned NVFP4 checkpoint's packed E2M1 experts, block-16 E4M3 scales and F32 global scales without requantizing or expanding the experts. Routing masks dropped original IDs before softmax and maps selected IDs to compact slots. The full FP8-expert path retains its existing arithmetic.
+ - Metal Drama speech supports opt-in semantic classifier-free guidance with shared weights and independent conditional/unconditional backbone state. `--cfg-gamma`, `--cfg-allow-request-gamma`, `--cfg-force-guided` and `--cfg-batched` preserve builtin unguided voices, validate request gamma, and reset guidance on cancellation or reference changes. Paired mode submits both states in one command buffer, not a vectorized GEMM; admission includes the extra state. CUDA guidance is not enabled by this change.
+
+diff --git a/README.md b/README.md
+index cf69ddec..92896199 100644
+--- a/README.md
++++ b/README.md
+@@ -178,7 +178,7 @@ Conversions are explicitly marked: their upstream weights need the linked conver
+ | Step-5-Preview, converted affine | `hf download stepfun-ai/Step-5-Preview --local-dir ~/models/step5-preview-fp8` | One 256 GB Mac; text 166.9 GiB, MTP adds 2.5 GiB and vision 3.7 GiB. | [Convert and serve](docs/recipes/step-5-preview.md). The documented 256 GB setup serves converted affine weights; converting the upstream FP8 download needs Python and mlx. |
+ | Kolibri-1, block FP8 (research) | `tensorfold pull Aleph-Alpha/Kolibri-1@e52eb4627d11516b0c01de49210ab5a4e4061444` | One NVIDIA GPU; GB10 measured; 74 GB checkpoint. | [Kolibri](docs/recipes/kolibri-1.md). Text only; copy drafts, no EAGLE-3/neural drafter. |
+ | Liquid AI d1-3B, decisions | Not documented yet. | Native CUDA; RAM minimum not published. | [API section below](#serve-flags). `/v1/systemone` and `/v1/decisions`. |
+-| Fish Audio Drama 3, speech | Not documented yet. | Native Metal or CUDA; GB10 measured. | [Release audio instructions](CHANGELOG.md#110). `/v1/audio/speech`; checkpoint and `codec.pth` required. |
++| Fish Audio Drama 3, speech | Not documented yet. | Native Metal or CUDA; GB10 measured. | [Release audio instructions](CHANGELOG.md#110). `/v1/audio/speech` with [sampling controls](docs/speech-sampling.md); checkpoint and `codec.pth` required. |
+ | Drama 3 pruned NVFP4, speech | `hf download plotarmordev/drama-3-NVFP4-Pruned --revision 494db08481db952f834b2241bce63fb3dfa72554 --local-dir drama-3-NVFP4-Pruned` | Native Metal; roughly 21 GiB checkpoint plus runtime state. Not a minimum-RAM or cross-backend quality claim. | Packed experts, BF16 dense/tower weights and FP32 accumulation; no conversion. Use `serve drama-3-NVFP4-Pruned --cfg-gamma 1.5 --cfg-batched` with an attested catalog voice. |
+
+ ### GLM-5.3: one machine or two?
+@@ -298,7 +298,7 @@ The binary's `capabilities --json` response lists its supported flags and platfo
+ | `--silence-onset-voiced-s SECONDS` | Drama speech only: the voiced seconds below which `--silence-onset-s` applies; required with it, with no default. Calibrate on public or built-in speech. |
+ | `--silence-mid-s SECONDS` | Drama speech only: with the silence guard on, finish as `silence` when end of speech falls in a run this long below the floor, after the explicit voiced minimum. Whole replies carry the decimal `X-Silence-Mid-Trips` count, including zero. Must be below `--silence-seconds` and paired with `--silence-mid-min-voiced-s`. Unset by default: off. |
+ | `--silence-mid-min-voiced-s SECONDS` | Required with `--silence-mid-s`: positive finite cumulative voiced duration before the mid rule applies, including equality. No default; calibrate with the other silence thresholds. |
+-| `--silence-redraws N` | Drama speech only: draw a whole reply the silence guard ended again, up to N times, as seed salt + k; N of 1 or more needs the guard. Unset by default: off, as is 0; streams are never redrawn. See [speech redraws](docs/speech-redraws.md). |
++| `--silence-redraws N` | Drama speech only: draw a whole reply the silence guard ended again, up to N times, as seed salt + k or explicit request seed + k; N of 1 or more needs the guard. Unset by default: off, as is 0; streams are never redrawn. See [speech redraws](docs/speech-redraws.md). |
+ | `--silence-redraw-budget-s SECONDS` | Start a redraw only while elapsed time plus the last take's duration fits; a request's `X-Deadline-S` can lower it. No default budget. |
+ | `--silence-redraw-controls LIST` | Redraws speak the input filtered to the listed controls, as `--allowed-controls` filters; an empty list removes every control. |
+ | `--short-reply-ratio R` | Also redraw a whole reply that finished `stop` with less audio than R (above 0, below 1) of its text's expected length; needs `--silence-redraws` and `--short-reply-chars-per-s`. No default. |
+diff --git a/docs/speech-redraws.md b/docs/speech-redraws.md
+index 19e55165..24673a68 100644
+--- a/docs/speech-redraws.md
++++ b/docs/speech-redraws.md
+@@ -12,12 +12,18 @@ enabled silence guard; `--silence-redraw-controls` and the
+
+ ## Seeds
+
+-Redraw k (1 to N) seeds its prompt with `TENSORFOLD_SEED_SALT` plus k; the first
++Without an explicit request `seed`, redraw k (1 to N) seeds its prompt with `TENSORFOLD_SEED_SALT` plus k; the first
+ take keeps the stock seed, salt plus 0. Redraws are therefore deterministic. With
+ the same prompt, redraw k under salt s is the same draw as the first take under
+ salt s + k, so a sweep over salts should space compared salts more than N apart,
+ or N + 1 with the register guard.
+
++An explicit request `seed` instead uses that exact integer for the first take
++and seed + k modulo 2^64 for each redraw, counting both silence and register
++attempts. Requested `temperature`, `top_p` and `top_k` remain in effect through
++all redraws and control filtering; see [speech sampling](speech-sampling.md).
++The seed rule does not make timing-based redraw budgets deterministic.
++
+ ## Budget
+
+ A redraw starts only when t + d fits the budget, where t is the time since the
+@@ -119,7 +125,7 @@ below 8 kHz, all-zero audio, and takes with fewer than two retained phrases are
+ not measured. A measured take with no qualifying jump counts as zero.
+ The detector is not Praat's analysis: its values can differ from Praat's.
+
+-A take that trips is drawn once more, as the next seed, salt + k after any
++A take that trips is drawn once more, using the next seed under the [seed rule](#seeds) after any
+ silence redraws, if t + d fits the budget. The redraw is sent only if it does not
+ end as `silence` and has a strictly smaller jump; ties retain the first take.
+ A `length` redraw can replace a `stop` take. An unmeasured redraw can win only
+diff --git a/docs/speech-sampling.md b/docs/speech-sampling.md
+new file mode 100644
+index 00000000..b60515c9
+--- /dev/null
++++ b/docs/speech-sampling.md
+@@ -0,0 +1,47 @@
++# Speech sampling
++
++`POST /v1/audio/speech` accepts these optional fields for Drama 3. Omission or
++`null` keeps the existing default for that field. They apply to WAV replies,
++whole PCM replies, streamed PCM and catalog voices.
++
++| Field | Accepted JSON value | Default |
++| --- | --- | --- |
++| `temperature` | A finite number at least 0, within the `f32` range. A positive value must remain positive when converted to `f32`. | `1` |
++| `top_p` | A finite number greater than 0 and at most 1, still greater than 0 after conversion to `f32`. | `0.9` |
++| `top_k` | An integer from 1 through 64. | `30` |
++| `seed` | An integer from 0 through 18446744073709551615. | The existing hash of the prompt and `TENSORFOLD_SEED_SALT`. |
++
++Numbers encoded as strings and booleans are refused. `top_k` and `seed` must
++use integer JSON syntax: `30.0` and `1e3` are refused. Seeds are parsed as exact
++64-bit unsigned integers, including values above 9007199254740991; clients
++whose JSON number type loses precision must preserve the integer when encoding
++the request. Invalid fields return HTTP 400 before submission to the engine.
++
++```sh
++curl http://127.0.0.1:8080/v1/audio/speech \
++ -H 'Content-Type: application/json' \
++ -d '{"model":"local-model","input":"Hello there.","temperature":0.8,"top_p":0.9,"top_k":30,"seed":42}' \
++ --output speech.wav
++```
++
++The route passes these settings to the native sampler. On Metal and CUDA, `temperature`
++of 0 or `top_k` of 1 selects its existing greedy path, which bypasses repetition
++aware sampling (RAS). Other runtimes may handle repetition differently; matching
++fields and seeds do not promise identical audio across backends or checkpoints.
++The HTTP limit of 64 candidates fits both native Metal and CUDA admission.
++
++An explicit `seed` is used exactly for the first take. If configured
++[speech redraws](speech-redraws.md) admit another take, its seed is the original
++seed plus the take's attempt number (1, 2, ...), wrapping modulo 2^64. This
++number includes both silence and register redraws. All takes keep the requested
++sampling values, including when controls are stripped or a reference prompt is
++rebuilt. With no seed, the existing prompt hash and server salt plus attempt
++number are unchanged. Streams keep their existing no-redraw behavior.
++
++Seed selection is deterministic. The final take can still change if timing or
++request deadlines admit a different number of redraws.
++
++The API design references the public
++[Sogni-AI/drama3-mlx generation interface](https://github.com/Sogni-AI/drama3-mlx/blob/ecc235039ccd5f982f66a6982184f57432354ab4/drama3_mlx/model.py#L79).
++TensorFold's parsing and request propagation are an independent implementation;
++this does not change the native sampling algorithms.
+diff --git a/zig/src/server/root.zig b/zig/src/server/root.zig
+index 3fdd321a..4d46119e 100644
+--- a/zig/src/server/root.zig
++++ b/zig/src/server/root.zig
+@@ -53,6 +53,7 @@ test {
+ _ = @import("drama_cfg.zig");
+ if (comptime @import("builtin").os.tag != .windows) _ = @import("speech_cfg_test.zig");
+ if (comptime @import("builtin").os.tag != .windows) _ = @import("speech_stream_test.zig"); // over a Unix socket pair
++ if (comptime @import("builtin").os.tag != .windows) _ = @import("speech_sampling_test.zig");
+ _ = @import("drama_voice_tool.zig");
+ _ = @import("speech_redraw.zig");
+ if (comptime @import("builtin").os.tag != .windows) _ = @import("speech_redraw_test.zig"); // over a Unix socket pair
+diff --git a/zig/src/server/speech.zig b/zig/src/server/speech.zig
+index 2897cd0e..07b75904 100644
+--- a/zig/src/server/speech.zig
++++ b/zig/src/server/speech.zig
+@@ -10,6 +10,7 @@ const openai = @import("openai.zig");
+ const pyrepr = @import("pyrepr.zig");
+ const reply_text = @import("reply_text.zig");
+ const drama_prompt = @import("drama_prompt.zig");
++const speech_sampling = @import("speech_sampling.zig");
+ const speech_redraw = @import("speech_redraw.zig");
+ const speech_register = @import("speech_register_log.zig");
+ const drama_cfg = @import("drama_cfg.zig");
+@@ -30,7 +31,7 @@ pub const max_input_chars = 4096;
+ const served_fields = [_][]const u8{ "model", "input", "voice", "speaker", "response_format" };
+
+ /// The rest of the speech protocol's fields: synthesis modifiers and references this route does not honor.
+-const modifier_fields = [_][]const u8{ "speed", "task_type", "language", "instructions", "ref_audio", "ref_text", "references", "x_vector_only_mode", "stream_codec_output", "suppress_bootstrap_silence", "token_count", "duration_tokens", "initial_codec_chunk_frames", "max_new_tokens", "temperature", "top_p", "top_k", "repetition_penalty", "seed", "stage_params" };
++const modifier_fields = [_][]const u8{ "speed", "task_type", "language", "instructions", "ref_audio", "ref_text", "references", "x_vector_only_mode", "stream_codec_output", "suppress_bootstrap_silence", "token_count", "duration_tokens", "initial_codec_chunk_frames", "max_new_tokens", "repetition_penalty", "stage_params" };
+
+ pub const Format = enum {
+ wav,
+@@ -44,7 +45,7 @@ pub const Format = enum {
+ }
+ };
+
+-const Plan = struct { input: []const u8, prompt: []const u32, frames: ?[]const [11]i32 = null, refs: []const @import("drama_prompt").Reference = &.{}, reference_rows: u32 = 0, seed: u64, format: Format, stream: bool, budget_s: ?f64 = null };
++const Plan = struct { input: []const u8, prompt: []const u32, frames: ?[]const [11]i32 = null, refs: []const @import("drama_prompt").Reference = &.{}, reference_rows: u32 = 0, sampling: speech_sampling.Options, format: Format, stream: bool, budget_s: ?f64 = null };
+
+ /// One whole take: its audio, why it ended, and whether it ended in a mid-utterance silence.
+ const Take = struct { pcm: []f32, reason: api.Reason, silence_mid: bool = false, trip: bool = false, jump: ?f64 = null };
+@@ -89,6 +90,8 @@ fn checkFields(cx: *Cx, body: Value) errors.Refused!void {
+ if (value == .null or (value == .string and std.mem.eql(u8, value.string, "audio"))) continue;
+ if (value == .string and std.mem.eql(u8, value.string, "sse")) return cx.refuse("stream_format sse is not supported by this model");
+ return cx.refuse("stream_format must be one of: audio, sse");
++ } else if (speech_sampling.isField(key)) {
++ continue; // validated together before building the prompt
+ } else if (listed(&modifier_fields, key)) {
+ if (value != .null) return cx.fail(.request, "{s} is not supported by this model", .{key});
+ } else return cx.fail(.request, "unknown speech request field: {s}", .{key});
+@@ -107,6 +110,7 @@ fn responseFormat(cx: *Cx, value: []const u8) errors.Refused!Format {
+ fn prepare(srv: *Server, cx: *Cx, sp: api.SpeechInfo, raw: Value) errors.Refused!Plan {
+ if (raw != .object) return cx.refuse("speech request body must be a JSON object");
+ try checkFields(cx, raw);
++ const sampling = try speech_sampling.parse(cx, raw);
+ const model = raw.strField("model") orelse return cx.fail(.request, "model is required: send {s}", .{srv.config.served_name});
+ if (!listed(srv.config.model_ids, model))
+ return cx.fail(.request, "model {s} is not served here: send {s}", .{ try pyrepr.repr(cx.a, .{ .string = model }), srv.config.served_name });
+@@ -125,9 +129,9 @@ fn prepare(srv: *Server, cx: *Cx, sp: api.SpeechInfo, raw: Value) errors.Refused
+ return cx.fail(.request, drama_prompt.error_prefix ++ " unknown voice {s}; see /v1/voices", .{name});
+ return cx.fail(.request, drama_prompt.error_prefix ++ " unknown voice {s}; only the default voice is supported", .{name});
+ };
+- if (try @import("drama_voice.zig").requestPrompt(cx, srv.text, sp, input, refs)) |made| return .{ .input = input, .prompt = made.prompt, .frames = made.frames, .refs = refs, .reference_rows = made.reference_rows, .seed = api.seedFor(made.prompt, srv.config.seed_salt), .format = format, .stream = stream };
++ if (try @import("drama_voice.zig").requestPrompt(cx, srv.text, sp, input, refs)) |made| return .{ .input = input, .prompt = made.prompt, .frames = made.frames, .refs = refs, .reference_rows = made.reference_rows, .sampling = sampling, .format = format, .stream = stream };
+ const prompt = try promptOf(srv, cx, sp, input);
+- return .{ .input = input, .prompt = prompt, .seed = api.seedFor(prompt, srv.config.seed_salt), .format = format, .stream = stream };
++ return .{ .input = input, .prompt = prompt, .sampling = sampling, .format = format, .stream = stream };
+ }
+
+ /// The prompt ids of a valid UTF-8 input, refused when it cannot be spoken or is too long.
+@@ -167,11 +171,11 @@ fn synthesize(srv: *Server, c: *Conn, cx: *Cx, id: []const u8, sp: api.SpeechInf
+ .frames = frames,
+ .pcm = pcm,
+ .result = &result,
+- .seed = plan.seed,
++ .seed = plan.sampling.seedFor(plan.prompt, srv.config.seed_salt, 0),
+ .max_frames = sp.max_frames,
+- .temperature = drama_prompt.temperature,
+- .top_p = drama_prompt.top_p,
+- .top_k = drama_prompt.top_k,
++ .temperature = plan.sampling.temperature,
++ .top_p = plan.sampling.top_p,
++ .top_k = plan.sampling.top_k,
+ .stream = plan.stream,
+ .reference_rows = plan.reference_rows,
+ .unconditioned = guided.rows,
+@@ -250,7 +254,7 @@ fn redraw(srv: *Server, c: *Conn, cx: *Cx, id: []const u8, sp: api.SpeechInfo, p
+ const preserved = if (held) |h| h.pcm.ptr else take.pcm.ptr;
+ next.pcm = if (preserved == first.pcm.ptr) spare.* else first.pcm;
+ next.result = &result;
+- next.seed = api.seedFor(next.prompt, srv.config.seed_salt +% @as(i64, @intCast(k)));
++ next.seed = plan.sampling.seedFor(next.prompt, srv.config.seed_salt, k);
+ var box: Mailbox = .{ .io = srv.io, .gpa = srv.gpa };
+ defer box.deinit();
+ const engine_id = srv.next_id.fetchAdd(1, .monotonic);
+@@ -540,7 +544,6 @@ test "fields: unknown ones are refused even when null, modifiers when set" {
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream\": \"yes\"}", "stream must be a boolean" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream_format\": \"sse\"}", "stream_format sse is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream_format\": \"mp3\"}", "stream_format must be one of: audio, sse" },
+- .{ "{\"model\": \"m\", \"input\": \"hi\", \"temperature\": 0.7}", "temperature is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"ref_audio\": \"x.wav\"}", "ref_audio is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": 3}", "input must be a string" },
+ .{ "{\"model\": null, \"input\": \"hi\"}", "model must be a string" },
+diff --git a/zig/src/server/speech_register_test.zig b/zig/src/server/speech_register_test.zig
+index 71255370..17e32fe2 100644
+--- a/zig/src/server/speech_register_test.zig
++++ b/zig/src/server/speech_register_test.zig
+@@ -166,6 +166,34 @@ test "the register guard measures the take silence redraws leave, and off sends
+ try expectSent(a, &.{ high, flat }, &.{}, .{}, "X-Deadline-S: soon\r\n", 0, 1);
+ }
+
++test "speech sampling: silence then register redraws retain parameters and advance the explicit seed" {
++ var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
++ defer arena.deinit();
++ const a = arena.allocator();
++ const high = try tones(a, 44100, &reply(130, 330));
++ const flat = try tones(a, 44100, &reply(130, 127));
++ const n = [_]usize{flat.len};
++ var script: harness.Script = .{ .steps = &n, .audio = &.{ flat, high, flat }, .reasons = &.{ .silence, .stop, .stop }, .max_frames = @intCast(n[0] / harness.frame + 1), .inline_ = true };
++ var s: harness.Served = undefined;
++ const cfg: @import("root.zig").Config = .{ .served_name = "m", .model_ids = &.{"m"}, .redraw = .{ .max = 1, .register = rule } };
++ const body = "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8,\"seed\":9007199254740993}";
++ try s.open(&script, cfg, "", "HTTP/1.1", body, 2000);
++ defer s.deinit();
++ {
++ defer s.join(&script);
++ _ = try s.readHead();
++ _ = try s.readRest();
++ }
++ try harness.expectHeader(s.got.items, "HTTP/1.1 200");
++ try harness.expectHeader(s.got.items, "X-Silence-Redraws: 1");
++ try harness.expectHeader(s.got.items, "X-Register-Redraws: 1");
++ try std.testing.expectEqual(@as(usize, 3), script.takes);
++ for (0..script.takes) |k| {
++ try std.testing.expectEqual(@as(u64, 9007199254740993) + k, script.seeds[k]);
++ try std.testing.expectEqualDeep(harness.Sampling{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, script.sampling[k]);
++ }
++}
++
+ test "register metadata counts admission not selection and latches trips even without budget" {
+ var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
+ defer arena.deinit();
+diff --git a/zig/src/server/speech_sampling.zig b/zig/src/server/speech_sampling.zig
+new file mode 100644
+index 00000000..ef0d7777
+--- /dev/null
++++ b/zig/src/server/speech_sampling.zig
+@@ -0,0 +1,57 @@
++//! Request-local Drama sampling, checked before a speech request reaches the engine.
++const std = @import("std");
++const api = @import("engine_api");
++const Value = @import("json").Value;
++const errors = @import("errors.zig");
++const defaults = @import("drama_prompt.zig");
++
++pub const Options = struct {
++ temperature: f32 = defaults.temperature,
++ top_p: f32 = defaults.top_p,
++ top_k: u32 = defaults.top_k,
++ seed: ?u64 = null,
++
++ pub fn seedFor(o: Options, prompt: []const u32, salt: i64, attempt: usize) u64 {
++ if (o.seed) |seed| return seed +% @as(u64, @intCast(attempt));
++ return api.seedFor(prompt, salt +% @as(i64, @intCast(attempt)));
++ }
++};
++
++pub fn isField(key: []const u8) bool {
++ for ([_][]const u8{ "temperature", "top_p", "top_k", "seed" }) |name|
++ if (std.mem.eql(u8, key, name)) return true;
++ return false;
++}
++
++pub fn parse(cx: *errors.Cx, body: Value) errors.Refused!Options {
++ var out: Options = .{};
++ if (body.field("temperature")) |value|
++ out.temperature = try number(cx, value, std.math.floatMax(f32), "temperature must be a finite nonnegative f32 number");
++ if (body.field("top_p")) |value| {
++ out.top_p = try number(cx, value, 1, "top_p must be a finite f32 number greater than 0 and at most 1");
++ if (out.top_p == 0) return cx.refuse("top_p must be greater than 0");
++ }
++ if (body.field("top_k")) |value| {
++ const message = "top_k must be an integer from 1 through 64";
++ if (value != .int) return cx.refuse(message);
++ const n = std.fmt.parseInt(u32, value.int, 10) catch return cx.refuse(message);
++ if (n == 0 or n > 64) return cx.refuse(message);
++ out.top_k = n;
++ }
++ if (body.field("seed")) |value| {
++ const message = "seed must be an integer from 0 through 18446744073709551615";
++ if (value != .int) return cx.refuse(message);
++ out.seed = std.fmt.parseInt(u64, value.int, 10) catch return cx.refuse(message);
++ }
++ return out;
++}
++
++/// Check the JSON range before narrowing, then reject positive values that would become zero.
++fn number(cx: *errors.Cx, value: Value, max: f64, message: []const u8) errors.Refused!f32 {
++ if (value != .int and value != .float) return cx.refuse(message);
++ const n = value.float64() orelse return cx.refuse(message);
++ if (!std.math.isFinite(n) or n < 0 or n > max) return cx.refuse(message);
++ const narrowed: f32 = @floatCast(n);
++ if (n > 0 and narrowed == 0) return cx.refuse(message);
++ return narrowed;
++}
+diff --git a/zig/src/server/speech_sampling_test.zig b/zig/src/server/speech_sampling_test.zig
+new file mode 100644
+index 00000000..7d7b3212
+--- /dev/null
++++ b/zig/src/server/speech_sampling_test.zig
+@@ -0,0 +1,140 @@
++//! Speech sampling controls through the HTTP route and its scripted engine.
++const std = @import("std");
++const api = @import("engine_api");
++const server = @import("root.zig");
++const harness = @import("speech_stream_test.zig");
++const drama_prompt = @import("drama_prompt.zig");
++const drama_allow = @import("drama_allow.zig");
++const gpa = std.testing.allocator;
++const config: server.Config = .{ .served_name = "m", .model_ids = &.{"m"}, .seed_salt = 17 };
++const defaults: harness.Sampling = .{ .temperature = 1, .top_p = 0.9, .top_k = 30 };
++
++fn exchange(script: *harness.Script, cfg: server.Config, body: []const u8) ![]u8 {
++ var s: harness.Served = undefined;
++ try s.open(script, cfg, "", "HTTP/1.1", body, 2000);
++ defer s.deinit();
++ defer s.join(script);
++ _ = try s.readHead();
++ _ = try s.readRest();
++ return gpa.dupe(u8, s.got.items);
++}
++
++fn promptSeed(text: []const u8, attempt: i64) !u64 {
++ var arena: std.heap.ArenaAllocator = .init(gpa);
++ defer arena.deinit();
++ var bytes: harness.Bytes = .{};
++ const prompt = try drama_prompt.encode(arena.allocator(), bytes.text(), text);
++ return api.seedFor(prompt, config.seed_salt +% attempt);
++}
++
++fn expectDraw(script: *const harness.Script, index: usize, sampling: harness.Sampling, seed: u64) !void {
++ try std.testing.expectEqualDeep(sampling, script.sampling[index]);
++ try std.testing.expectEqual(seed, script.seeds[index]);
++}
++
++test "speech sampling: omitted and null controls retain default parameters and PCM" {
++ const bodies = [_][]const u8{
++ "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\"}",
++ "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"temperature\":null,\"top_p\":null,\"top_k\":null,\"seed\":null}",
++ };
++ var first: ?[]u8 = null;
++ defer if (first) |pcm| gpa.free(pcm);
++ for (bodies) |body| {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true };
++ const reply = try exchange(&script, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 1), script.takes);
++ try expectDraw(&script, 0, defaults, try promptSeed("hi", 0));
++ const pcm = reply[(std.mem.indexOf(u8, reply, "\r\n\r\n").? + 4)..];
++ if (first) |before| try std.testing.expectEqualSlices(u8, before, pcm) else first = try gpa.dupe(u8, pcm);
++ }
++}
++
++test "speech sampling: custom parameters and exact integer seeds reach whole and streamed requests" {
++ const cases = [_]struct { fields: []const u8, sampling: harness.Sampling, seed: u64 }{
++ .{ .fields = "\"temperature\":1.25,\"top_p\":0.8,\"top_k\":64,\"seed\":9007199254740993", .sampling = .{ .temperature = 1.25, .top_p = 0.8, .top_k = 64 }, .seed = 9007199254740993 },
++ .{ .fields = "\"temperature\":0,\"top_p\":1,\"top_k\":1,\"seed\":0", .sampling = .{ .temperature = 0, .top_p = 1, .top_k = 1 }, .seed = 0 },
++ .{ .fields = "\"seed\":18446744073709551615", .sampling = defaults, .seed = std.math.maxInt(u64) },
++ .{ .fields = "\"temperature\":0.5", .sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ .{ .fields = "\"temperature\":3.4028234663852886e38,\"top_p\":1e-45", .sampling = .{ .temperature = std.math.floatMax(f32), .top_p = 1e-45, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ };
++ for (cases) |case| for ([_]bool{ false, true }) |stream| {
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"stream\":{s},{s}}}", .{ if (stream) "true" else "false", case.fields });
++ defer gpa.free(body);
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true };
++ const reply = try exchange(&script, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ if (stream) try harness.expectHeader(reply, "Transfer-Encoding: chunked");
++ try std.testing.expectEqual(@as(usize, 1), script.takes);
++ try expectDraw(&script, 0, case.sampling, case.seed);
++ };
++}
++
++test "speech sampling: invalid controls fail before any engine submission" {
++ const fields = [_][]const u8{
++ "\"temperature\":true", "\"temperature\":\"1\"", "\"temperature\":[]", "\"temperature\":{}",
++ "\"temperature\":-1", "\"temperature\":NaN", "\"temperature\":Infinity", "\"temperature\":1e39",
++ "\"temperature\":1e-100", "\"top_p\":false", "\"top_p\":\"0.9\"", "\"top_p\":0",
++ "\"top_p\":-0.1", "\"top_p\":1.00000001", "\"top_p\":NaN", "\"top_p\":1e-100",
++ "\"top_p\":Infinity", "\"top_k\":true", "\"top_k\":\"30\"", "\"top_k\":1.5",
++ "\"top_k\":30.0", "\"top_k\":0", "\"top_k\":-1", "\"top_k\":65",
++ "\"top_k\":18446744073709551616", "\"seed\":true", "\"seed\":\"1\"", "\"seed\":1.5",
++ "\"seed\":1.0", "\"seed\":-1", "\"seed\":18446744073709551616", "\"seed\":NaN",
++ };
++ for (fields) |field| {
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",{s}}}", .{field});
++ defer gpa.free(body);
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true };
++ const reply = try exchange(&script, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 400");
++ try std.testing.expectEqual(@as(usize, 0), script.takes);
++ }
++}
++
++test "speech sampling: references and re-prompts retain overrides and wrap explicit retry seeds" {
++ const codes = [_][10]i32{.{ 7, 1, 2, 3, 4, 5, 6, 7, 8, 9 }};
++ const refs = [_]@import("drama_prompt").Reference{.{ .transcript = "A small cloud passes.", .codes = &codes }};
++ const voices = [_]@import("drama_voice.zig").Voice{.{ .name = "tone", .references = &refs }};
++ var cfg = config;
++ cfg.redraw = .{ .max = 2, .controls = try drama_allow.parse("sighs") };
++ for ([_]bool{ false, true }) |referenced| {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true, .reasons = &.{ .silence, .silence, .stop }, .voices = &voices };
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi [sighs] [laughs] there\",\"voice\":\"{s}\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8,\"seed\":18446744073709551615}}", .{if (referenced) "tone" else "default"});
++ defer gpa.free(body);
++ const reply = try exchange(&script, cfg, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 3), script.takes);
++ for ([_]u64{ std.math.maxInt(u64), 0, 1 }, 0..) |seed, k|
++ try expectDraw(&script, k, .{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, seed);
++ try std.testing.expectEqual(referenced, script.reference_rows[0] > 0);
++ }
++}
++
++test "speech sampling: no seed keeps prompt-keyed redraws after stripping controls" {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true, .reasons = &.{ .silence, .stop } };
++ var cfg = config;
++ cfg.redraw = .{ .max = 1, .controls = try drama_allow.parse("sighs") };
++ const reply = try exchange(&script, cfg, "{\"model\":\"m\",\"input\":\"hi [sighs] [laughs] there\",\"temperature\":0.5}");
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 2), script.takes);
++ const sampling: harness.Sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 };
++ try expectDraw(&script, 0, sampling, try promptSeed("hi [sighs] [laughs] there", 0));
++ try expectDraw(&script, 1, sampling, try promptSeed("hi [sighs] there", 1));
++}
++
++test "speech sampling: a silenced stream retains controls and does not redraw" {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true, .reason = .silence };
++ var cfg = config;
++ cfg.redraw = .{ .max = 2 };
++ const reply = try exchange(&script, cfg, "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"stream\":true,\"temperature\":0.5,\"seed\":2}");
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try harness.expectHeader(reply, "X-Finish-Reason: silence");
++ try std.testing.expectEqual(@as(usize, 1), script.takes);
++ try expectDraw(&script, 0, .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, 2);
++}
+diff --git a/zig/src/server/speech_stream_test.zig b/zig/src/server/speech_stream_test.zig
+index 647167e3..72339b0c 100644
+--- a/zig/src/server/speech_stream_test.zig
++++ b/zig/src/server/speech_stream_test.zig
+@@ -9,6 +9,7 @@ const Conn = @import("http_conn.zig").Conn;
+
+ pub const frame = 2048;
+ const gpa = std.testing.allocator;
++pub const Sampling = struct { temperature: f32, top_p: f32, top_k: u32 };
+
+ /// Publishes steps of 0.5 / (take + 1), then finishes: inside submit (`inline_`), else on a thread that may `hold`.
+ pub const Script = struct {
+@@ -32,6 +33,7 @@ pub const Script = struct {
+ cancelled: std.atomic.Value(bool) = .init(false),
+ thread: ?std.Thread = null,
+ seeds: [4]u64 = undefined,
++ sampling: [4]Sampling = undefined,
+ reference_rows: [4]u32 = undefined,
+ takes: usize = 0,
+ voices: []const @import("drama_voice.zig").Voice = &.{},
+@@ -61,6 +63,7 @@ pub const Script = struct {
+ }
+ const take = e.takes;
+ e.seeds[take] = request.seed;
++ e.sampling[take] = .{ .temperature = request.temperature, .top_p = request.top_p, .top_k = request.top_k };
+ e.reference_rows[take] = request.reference_rows;
+ e.takes += 1;
+ if (e.inline_) return run(e, id, request, sink, take);
+diff --git a/zig/src/server/speech_unmeasured_test.zig b/zig/src/server/speech_unmeasured_test.zig
+index 0ffbd52c..23a47807 100644
+--- a/zig/src/server/speech_unmeasured_test.zig
++++ b/zig/src/server/speech_unmeasured_test.zig
+@@ -29,7 +29,7 @@ pub fn check(comptime redraw: anytype) !void {
+ capture.len = 0;
+ var pcm = [_]f32{sample};
+ var metadata: Metadata = .{ .enabled = false, .register_on = true };
+- const take = redraw(&srv, &conn, &cx, "register-test", .{ .sample_rate = 44100, .frame_length = 2048, .max_frames = 1024, .max_prompt_tokens = 4096 }, .{ .input = "hi", .prompt = &.{}, .seed = 0, .format = .pcm, .stream = false }, 0, undefined, 0, .{ .pcm = &pcm, .reason = .stop }, &spare, &metadata).?;
++ const take = redraw(&srv, &conn, &cx, "register-test", .{ .sample_rate = 44100, .frame_length = 2048, .max_frames = 1024, .max_prompt_tokens = 4096 }, .{ .input = "hi", .prompt = &.{}, .sampling = .{ .seed = 0 }, .format = .pcm, .stream = false }, 0, undefined, 0, .{ .pcm = &pcm, .reason = .stop }, &spare, &metadata).?;
+ try std.testing.expect(take.jump == null);
+ try std.testing.expect(take.pcm.ptr == &pcm);
+ try std.testing.expect(!metadata.register_tripped and !metadata.register_redrawn);
+--
+2.46.0
+
diff --git a/engine/nvfp4/macos/patches/0005-sampling-json-boundaries.patch b/engine/nvfp4/macos/patches/0005-sampling-json-boundaries.patch
new file mode 100644
index 0000000..d16b0e4
--- /dev/null
+++ b/engine/nvfp4/macos/patches/0005-sampling-json-boundaries.patch
@@ -0,0 +1,90 @@
+From 2af18fbabc5a7655f36a8fc16441a4055945da84 Mon Sep 17 00:00:00 2001
+From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 11:54:45 +0800
+Subject: [PATCH] tests: cover parsed JSON sampling float boundaries
+
+---
+ docs/speech-sampling.md | 7 +++++++
+ zig/src/server/speech_sampling.zig | 2 +-
+ zig/src/server/speech_sampling_test.zig | 27 +++++++++++++++++--------
+ 3 files changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/docs/speech-sampling.md b/docs/speech-sampling.md
+index b60515c9..29f6474e 100644
+--- a/docs/speech-sampling.md
++++ b/docs/speech-sampling.md
+@@ -17,6 +17,13 @@ use integer JSON syntax: `30.0` and `1e3` are refused. Seeds are parsed as exact
+ whose JSON number type loses precision must preserve the integer when encoding
+ the request. Invalid fields return HTTP 400 before submission to the engine.
+
++For `temperature` and `top_p`, the JSON parser first produces an `f64` value;
++the bounds above apply to that value and its conversion to `f32`. Extremely
++small floating literals such as `1e-400` and `-1e-400` already become zero in
++that parser, so both request temperature 0; they are refused for `top_p`.
++A positive parsed value such as `1e-100` is refused if it becomes zero only
++when narrowed to `f32`.
++
+ ```sh
+ curl http://127.0.0.1:8080/v1/audio/speech \
+ -H 'Content-Type: application/json' \
+diff --git a/zig/src/server/speech_sampling.zig b/zig/src/server/speech_sampling.zig
+index ef0d7777..ca9b5320 100644
+--- a/zig/src/server/speech_sampling.zig
++++ b/zig/src/server/speech_sampling.zig
+@@ -46,7 +46,7 @@ pub fn parse(cx: *errors.Cx, body: Value) errors.Refused!Options {
+ return out;
+ }
+
+-/// Check the JSON range before narrowing, then reject positive values that would become zero.
++/// Check the parsed f64 range before narrowing, then reject positive values that would become zero.
+ fn number(cx: *errors.Cx, value: Value, max: f64, message: []const u8) errors.Refused!f32 {
+ if (value != .int and value != .float) return cx.refuse(message);
+ const n = value.float64() orelse return cx.refuse(message);
+diff --git a/zig/src/server/speech_sampling_test.zig b/zig/src/server/speech_sampling_test.zig
+index 7d7b3212..8029a75d 100644
+--- a/zig/src/server/speech_sampling_test.zig
++++ b/zig/src/server/speech_sampling_test.zig
+@@ -57,6 +57,8 @@ test "speech sampling: custom parameters and exact integer seeds reach whole and
+ .{ .fields = "\"temperature\":0,\"top_p\":1,\"top_k\":1,\"seed\":0", .sampling = .{ .temperature = 0, .top_p = 1, .top_k = 1 }, .seed = 0 },
+ .{ .fields = "\"seed\":18446744073709551615", .sampling = defaults, .seed = std.math.maxInt(u64) },
+ .{ .fields = "\"temperature\":0.5", .sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ .{ .fields = "\"temperature\":1e-400", .sampling = .{ .temperature = 0, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ .{ .fields = "\"temperature\":-1e-400", .sampling = .{ .temperature = -0.0, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
+ .{ .fields = "\"temperature\":3.4028234663852886e38,\"top_p\":1e-45", .sampling = .{ .temperature = std.math.floatMax(f32), .top_p = 1e-45, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
+ };
+ for (cases) |case| for ([_]bool{ false, true }) |stream| {
+@@ -74,14 +76,23 @@ test "speech sampling: custom parameters and exact integer seeds reach whole and
+
+ test "speech sampling: invalid controls fail before any engine submission" {
+ const fields = [_][]const u8{
+- "\"temperature\":true", "\"temperature\":\"1\"", "\"temperature\":[]", "\"temperature\":{}",
+- "\"temperature\":-1", "\"temperature\":NaN", "\"temperature\":Infinity", "\"temperature\":1e39",
+- "\"temperature\":1e-100", "\"top_p\":false", "\"top_p\":\"0.9\"", "\"top_p\":0",
+- "\"top_p\":-0.1", "\"top_p\":1.00000001", "\"top_p\":NaN", "\"top_p\":1e-100",
+- "\"top_p\":Infinity", "\"top_k\":true", "\"top_k\":\"30\"", "\"top_k\":1.5",
+- "\"top_k\":30.0", "\"top_k\":0", "\"top_k\":-1", "\"top_k\":65",
+- "\"top_k\":18446744073709551616", "\"seed\":true", "\"seed\":\"1\"", "\"seed\":1.5",
+- "\"seed\":1.0", "\"seed\":-1", "\"seed\":18446744073709551616", "\"seed\":NaN",
++ "\"top_p\":1e-400", "\"top_p\":-1e-400",
++ "\"temperature\":true", "\"temperature\":\"1\"",
++ "\"temperature\":[]", "\"temperature\":{}",
++ "\"temperature\":-1", "\"temperature\":NaN",
++ "\"temperature\":Infinity", "\"temperature\":1e39",
++ "\"temperature\":1e-100", "\"top_p\":false",
++ "\"top_p\":\"0.9\"", "\"top_p\":0",
++ "\"top_p\":-0.1", "\"top_p\":1.00000001",
++ "\"top_p\":NaN", "\"top_p\":1e-100",
++ "\"top_p\":Infinity", "\"top_k\":true",
++ "\"top_k\":\"30\"", "\"top_k\":1.5",
++ "\"top_k\":30.0", "\"top_k\":0",
++ "\"top_k\":-1", "\"top_k\":65",
++ "\"top_k\":18446744073709551616", "\"seed\":true",
++ "\"seed\":\"1\"", "\"seed\":1.5",
++ "\"seed\":1.0", "\"seed\":-1",
++ "\"seed\":18446744073709551616", "\"seed\":NaN",
+ };
+ for (fields) |field| {
+ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",{s}}}", .{field});
+--
+2.46.0
+
diff --git a/engine/nvfp4/macos/patches/SHA256SUMS b/engine/nvfp4/macos/patches/SHA256SUMS
index 22224d6..31ddc24 100644
--- a/engine/nvfp4/macos/patches/SHA256SUMS
+++ b/engine/nvfp4/macos/patches/SHA256SUMS
@@ -1,3 +1,5 @@
f282318f0e8dae43b19d1fa93ec05691696a0352eaeac41f9ffc334690d8b388 0001-drama3-metal-nvfp4-cfg.patch
0a68a3b66da1991f1a04980cb6958e4acc8856a88efdbe1fe10adc6df588cfc8 0002-shared-gate-stress-regression.patch
794a5b6008487ec705cadb098eb1c15737da743aee0855b610510506a0ce38db 0003-shared-cli-extension-point.patch
+c9c1406dc344ab359693b03584184119569ad05c686606d2f4c976eb667ce54d 0004-speech-sampling-controls.patch
+158ac17113ca3ffd04706782189a14706d4c63e343e40b81af287bae1b55cefc 0005-sampling-json-boundaries.patch
diff --git a/engine/nvfp4/patches/0002-speech-sampling-controls.patch b/engine/nvfp4/patches/0002-speech-sampling-controls.patch
new file mode 100644
index 0000000..8415b45
--- /dev/null
+++ b/engine/nvfp4/patches/0002-speech-sampling-controls.patch
@@ -0,0 +1,630 @@
+From 22939c2a0c028f56e46f909c462786a714ac921d Mon Sep 17 00:00:00 2001
+From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 11:59:37 +0800
+Subject: [PATCH] server: expose sampling controls in legacy CUDA speech
+
+---
+ CHANGELOG.md | 2 +
+ README.md | 3 +
+ docs/drama-voices.md | 6 +-
+ docs/speech-sampling.md | 59 +++++++++
+ zig/src/server/root.zig | 1 +
+ zig/src/server/speech.zig | 25 ++--
+ zig/src/server/speech_long.zig | 14 +-
+ zig/src/server/speech_long_test.zig | 3 +
+ zig/src/server/speech_register_test.zig | 21 +++
+ zig/src/server/speech_sampling.zig | 57 ++++++++
+ zig/src/server/speech_sampling_test.zig | 167 ++++++++++++++++++++++++
+ zig/src/server/speech_stream_test.zig | 2 +-
+ 12 files changed, 338 insertions(+), 22 deletions(-)
+ create mode 100644 docs/speech-sampling.md
+ create mode 100644 zig/src/server/speech_sampling.zig
+ create mode 100644 zig/src/server/speech_sampling_test.zig
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index 5dd216c0..8c510990 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -4,6 +4,8 @@ Each release's page on GitHub has its notes and measurements. See [the 1.0.0 rel
+
+ ## Unreleased
+
++- speech: Drama requests accept `temperature`, `top_p`, `top_k` (1 through 64) and exact unsigned 64-bit `seed`. Whole replies, streams, references, guidance and long-form segments retain the requested settings; omitted or null fields keep existing defaults. Explicit seeds advance by each segment's attempt number on redraws. See [speech sampling](docs/speech-sampling.md).
++
+ - speech: long-form Drama 3 splits preserve complete special tokens, bracketed cues and nested paired direction tags, even when one span exceeds the character target. CJK punctuation supplies sentence and clause boundaries without requiring spaces, and topic-shift markers inside protected spans cannot split them. Existing input, prompt-token, segment and frame limits still apply ([docs](docs/drama-voices.md#long-form-replies)).
+ - speech: Drama 3's DAC activation planes are bounded by the decode chunk and causal halo rather than the utterance limit. QKV history retains absolute frame indexing and attention tile boundaries. `zig build drama-codec-chunk` builds `oracle/bin/tf-drama-codec-chunk CHECKPOINT`, a GPU byte-equality gate against the original full-plane layout; the trace diagnostic explicitly retains that reference layout.
+ - speech: `--silence-mid-s S` (CUDA; 0 for off, or 3 to below 10; default 0) ends a Drama 3 synthesis as `silence` when its end of speech comes inside S seconds or more below -40 dBFS after 1 s or more voiced: a reply that fell silent mid-way and stopped there, its last words never spoken, as one 4-bit take did after a 9.0 s hole. Holes that recover are left alone, since a client that shortens pauses never plays them, and a reply the frame cap stops is not judged. Such a draw is redrawn under the silence redraws' rules, a long-form segment in place, and whole replies count the draws it ended in `X-Silence-Mid-Trips`. Replayed at S = 3 over 2272 draws in the engine's frame accounting, it ended 15 of the 2047 that the 10 s rule left alone; all 8 with a text to judge by had lost words, and none of them had spoken in full. With S = 0 replies are as before ([docs](docs/drama-voices.md#holes-that-end-a-reply))
+diff --git a/README.md b/README.md
+index d77b9f9f..0b89e4ef 100644
+--- a/README.md
++++ b/README.md
+@@ -30,6 +30,9 @@ The API listens at `http://127.0.0.1:8080/v1` by default.
+ It serves OpenAI chat completions, completions and Responses, plus Anthropic Messages.
+ Use the model ID returned by `/v1/models`, or set one with `--name`.
+
++Drama speech at `/v1/audio/speech` accepts [request sampling controls](docs/speech-sampling.md)
++for temperature, top-p, top-k and exact 64-bit seeds, including streamed and long-form replies.
++
+ ```sh
+ curl -fsS http://127.0.0.1:8080/v1/chat/completions \
+ -H 'Content-Type: application/json' \
+diff --git a/docs/drama-voices.md b/docs/drama-voices.md
+index 2ee8d2a9..06037d30 100644
+--- a/docs/drama-voices.md
++++ b/docs/drama-voices.md
+@@ -177,7 +177,7 @@ With `--long-form`, each segment may use up to N frames, and a reply may use 600
+ tensorfold serve DRAMA3_DIR --voices voices/ --default-voice NAME --cfg-gamma 2
+ ```
+
+-On CUDA, `--cfg-gamma G` (0 for off, or 1 to 5; default 0) applies classifier-free guidance to a referenced prompt's semantic head. The main token of each frame is drawn from l_c + (G − 1)(l_c − l_u) instead of l_c: l_c are the logits of the prompt as sent (the voice's references, then the input), and l_u are those of the same turn as a plain prompt, the one the built-in voice gets. So the draw moves away from what the model says without the references. The mix covers all 4097 semantic logits, the end-of-speech logit included, so guidance also moves where a draw ends. It comes before the sampler, which is unchanged and not greedy: a draw seeded per request, at temperature 1, top-p 0.9 and top-k 30, with the repetition-aware redraw (RAS: a main token that repeats one of the last 16 frames' is replaced by a second draw at top-p 0.95). The tower, and with it codebooks 1 to 9, still reads the referenced prompt's hidden row.
++On CUDA, `--cfg-gamma G` (0 for off, or 1 to 5; default 0) applies classifier-free guidance to a referenced prompt's semantic head. The main token of each frame is drawn from l_c + (G − 1)(l_c − l_u) instead of l_c: l_c are the logits of the prompt as sent (the voice's references, then the input), and l_u are those of the same turn as a plain prompt, the one the built-in voice gets. So the draw moves away from what the model says without the references. The mix covers all 4097 semantic logits, the end-of-speech logit included, so guidance also moves where a draw ends. It comes before the native sampler, using the [request sampling controls](speech-sampling.md) (defaults: temperature 1, top-p 0.9 and top-k 30), with the repetition-aware redraw (RAS: a main token that repeats one of the last 16 frames' is replaced by a second draw at top-p 0.95). The tower, and with it codebooks 1 to 9, still reads the referenced prompt's hidden row.
+
+ - **The second sequence.** The engine keeps l_u in a second backbone sequence that shares the model's weights: 0.33 GB at context 8192 (the KV caches of the 10 attention layers and the states of the 30 DeltaNet layers). It prefills the plain prompt before the referenced one, and then reads every frame the referenced one reads. That is one more backbone run per frame, and the server's startup line gives the sequence's size.
+ - **`--cfg-every K`** (default 1) would run the second sequence only every K frames, reading the K frames in one pass, its last logits guiding the draws in between. Only K = 1 is accepted for now: tests check that a catch-up run reads every frame once and in order, but nothing has yet compared its logits with K runs one frame each, so the server refuses K > 1 at startup.
+@@ -270,7 +270,7 @@ A reply can fall silent mid-way for less than 10 s and then end, its last senten
+ tensorfold serve DRAMA3_DIR --voices voices/ --silence-redraws 2 --silence-redraw-plain
+ ```
+
+-`--silence-redraws N` (0 to 8, default 0) draws a whole reply again when it trips, up to N times: when the guard ended it, or, with `--short-reply-ratio`, when it stopped far short of its text. A redraw keeps the request's voice and seeds with the server's salt plus k for the k-th redraw, so it is a different draw that is still deterministic. Salts overlap: with the same prompt, redraw k at salt s is the same draw as the first draw at salt s + k (`TENSORFOLD_SEED_SALT`), so a sweep over salts should leave N between the salts it compares.
++`--silence-redraws N` (0 to 8, default 0) draws a whole reply again when it trips, up to N times: when the guard ended it, or, with `--short-reply-ratio`, when it stopped far short of its text. A redraw keeps the request's voice and sampling controls. Without an explicit seed it uses the server's salt plus k for the k-th redraw; an explicit seed instead advances by k modulo 2^64. See [speech sampling](speech-sampling.md). Salts overlap: with the same prompt, redraw k at salt s is the same draw as the first draw at salt s + k (`TENSORFOLD_SEED_SALT`), so a sweep over salts should leave N between the salts it compares.
+
+ - **Deadline.** Each redraw starts only if it should end within the budget: the lower of the request's `X-Deadline-S` (seconds the client waits, counted from when the speech route takes the request, before it reads the body) and `--silence-redraw-budget-s` (default 120). After a draw that tripped (ended `silence`, or a short `stop`, below) at t seconds from receipt and took d seconds, the next one is started only if t + d ≤ budget, since a stalled draw's duration predicts the next one's. Otherwise the last draw is sent as it is, with its own `X-Finish-Reason`. For example, a client that allows 96 s for a 509-character reply gets a redraw after a trip at 17 s (17 + 17 = 34 ≤ 96). After a 50 s stall it gets none (50 + 50 = 100 > 96), so it receives the tripped reply within its deadline instead of a timeout. A redraw that finds the engine busy with another request waits for it only until the latest start that still fits (budget − d after receipt), then sends the tripped draw. The deadline therefore binds every start; only a draw already generating can run past it. `--silence-redraw-budget-s` and `--silence-redraw-plain` need `--silence-redraws` of 1 or more.
+ - **Plain redraws.** With `--silence-redraw-plain`, every redraw speaks the input without its cues: each `[sighs]`, `[laughs]`, `[small laugh]`, `[pause]` and `[hesitates]` becomes a space, then white space is collapsed to single spaces and trimmed (`done. [pause] Next` is spoken `done. Next`; `word [sighs].` is spoken `word .`). An input without one of those cues is redrawn as it is. A plain redraw never speaks the cues again: if nothing is left without them, or the cue-free text cannot be prompted, there is no redraw, the tripped draw is sent, and the log says why. The cues drove the trips measured: on texts that tripped the guard, a cue-free draw finished 14 of 14, a draw with the cues and a new seed 5 of 14.
+@@ -321,7 +321,7 @@ With `--long-form`, a speech input longer than `--long-form-chars` (default 500
+ - a cut inside a sentence (at `,` `;` `:` `，` `：` `、` or a space): 0.20 s
+ - **Room tone.** The added pause is copied from the earlier segment's quietest 100 ms in its last second, played back and forth. It is digital silence when that segment has no quiet tail.
+ - **Level.** A segment whose speech level (the median dBFS of its frames at or above -42 dBFS) is more than 1.5 dB from the median of the earlier segments gets one constant gain. The gain brings it to 1.5 dB, is at most 3 dB either way, and never raises a peak past 0.99.
+-- **Seeds.** Each segment's seed comes from its own prompt rows, as a single synthesis's does.
++- **Seeds.** Without an explicit request seed, each segment's seed comes from its own prompt rows, as a single synthesis's does. An explicit seed starts each segment's attempt count at zero; its redraws use seed + attempt modulo 2^64. Every segment keeps the same requested temperature, top-p and top-k; see [speech sampling](speech-sampling.md).
+ - **Limits.**
+ - More than 12 segments are refused up front.
+ - A reply may use 6000 frames in all; each segment gets at most what is left.
+diff --git a/docs/speech-sampling.md b/docs/speech-sampling.md
+new file mode 100644
+index 00000000..10f366ac
+--- /dev/null
++++ b/docs/speech-sampling.md
+@@ -0,0 +1,59 @@
++# Speech sampling
++
++`POST /v1/audio/speech` accepts these optional fields for Drama 3. Omission or
++`null` keeps the existing default for that field. They apply to WAV replies,
++whole PCM replies, streamed PCM and catalog voices.
++
++| Field | Accepted JSON value | Default |
++| --- | --- | --- |
++| `temperature` | A finite number at least 0, within the `f32` range. A positive value must remain positive when converted to `f32`. | `1` |
++| `top_p` | A finite number greater than 0 and at most 1, still greater than 0 after conversion to `f32`. | `0.9` |
++| `top_k` | An integer from 1 through 64. | `30` |
++| `seed` | An integer from 0 through 18446744073709551615. | The existing hash of the prompt and `TENSORFOLD_SEED_SALT`. |
++
++Numbers encoded as strings and booleans are refused. `top_k` and `seed` must
++use integer JSON syntax: `30.0` and `1e3` are refused. Seeds are parsed as exact
++64-bit unsigned integers, including values above 9007199254740991; clients
++whose JSON number type loses precision must preserve the integer when encoding
++the request. Invalid fields return HTTP 400 before submission to the engine.
++
++For `temperature` and `top_p`, the JSON parser first produces an `f64` value;
++the bounds above apply to that value and its conversion to `f32`. Extremely
++small floating literals such as `1e-400` and `-1e-400` already become zero in
++that parser, so both request temperature 0; they are refused for `top_p`.
++A positive parsed value such as `1e-100` is refused if it becomes zero only
++when narrowed to `f32`.
++
++```sh
++curl http://127.0.0.1:8080/v1/audio/speech \
++ -H 'Content-Type: application/json' \
++ -d '{"model":"local-model","input":"Hello there.","temperature":0.8,"top_p":0.9,"top_k":30,"seed":42}' \
++ --output speech.wav
++```
++
++The route passes these settings to the existing native sampler, including its
++repetition aware sampling (RAS) behavior. Matching fields and seeds do not
++promise identical audio across backends or checkpoints. The HTTP limit of 64
++candidates is shared with the Metal recipe.
++
++An explicit `seed` is used exactly for the first take. If configured
++[speech redraws](drama-voices.md#silence-redraws) admit another take, its seed is the original
++seed plus the take's attempt number (1, 2, ...), wrapping modulo 2^64. This
++number includes both silence and register redraws. All takes keep the requested
++sampling values, including when controls are stripped or a reference prompt is
++rebuilt. With no seed, the existing prompt hash and server salt plus attempt
++number are unchanged. Streams keep their existing no-redraw behavior.
++
++For a long-form reply, each segment starts its own attempt count at zero: its
++first take uses the explicit seed, and its redraws use seed + attempt modulo
++2^64. Sampling values stay the same across segments, reference carry-over,
++control stripping and guidance. Omitted seeds retain each segment's existing
++prompt hash and server salt plus that segment's attempt number.
++
++Seed selection is deterministic. The final take can still change if timing or
++request deadlines admit a different number of redraws.
++
++The API design references the public
++[Sogni-AI/drama3-mlx generation interface](https://github.com/Sogni-AI/drama3-mlx/blob/ecc235039ccd5f982f66a6982184f57432354ab4/drama3_mlx/model.py#L79).
++TensorFold's parsing and request propagation are an independent implementation;
++this does not change the native sampling algorithms.
+diff --git a/zig/src/server/root.zig b/zig/src/server/root.zig
+index 5e62886e..3a753858 100644
+--- a/zig/src/server/root.zig
++++ b/zig/src/server/root.zig
+@@ -56,6 +56,7 @@ test {
+ _ = @import("drama_cfg.zig");
+ _ = @import("speech_cfg_test.zig");
+ _ = @import("speech_long_test.zig");
++ _ = @import("speech_sampling_test.zig");
+ _ = @import("speech_redraw.zig");
+ _ = @import("speech_redraw_test.zig");
+ _ = @import("speech_redraw_off_test.zig");
+diff --git a/zig/src/server/speech.zig b/zig/src/server/speech.zig
+index 48ad9baf..73e55aff 100644
+--- a/zig/src/server/speech.zig
++++ b/zig/src/server/speech.zig
+@@ -10,6 +10,7 @@ const openai = @import("openai.zig");
+ const pyrepr = @import("pyrepr.zig");
+ const reply_text = @import("reply_text.zig");
+ const drama_prompt = @import("drama_prompt.zig");
++const speech_sampling = @import("speech_sampling.zig");
+ const drama_voice = @import("drama_voice.zig");
+ const drama_shift = @import("drama_shift.zig");
+ const drama_allow = @import("drama_allow.zig");
+@@ -35,7 +36,7 @@ pub const max_input_chars = 4096;
+ const served_fields = [_][]const u8{ "model", "input", "voice", "speaker", "response_format" };
+
+ /// The rest of the speech protocol's fields: synthesis modifiers and audio references this route does not honor.
+-const modifier_fields = [_][]const u8{ "speed", "task_type", "language", "instructions", "ref_audio", "ref_text", "x_vector_only_mode", "stream_codec_output", "suppress_bootstrap_silence", "token_count", "duration_tokens", "initial_codec_chunk_frames", "max_new_tokens", "temperature", "top_p", "top_k", "repetition_penalty", "seed", "stage_params" };
++const modifier_fields = [_][]const u8{ "speed", "task_type", "language", "instructions", "ref_audio", "ref_text", "x_vector_only_mode", "stream_codec_output", "suppress_bootstrap_silence", "token_count", "duration_tokens", "initial_codec_chunk_frames", "max_new_tokens", "repetition_penalty", "stage_params" };
+
+ pub const Format = enum {
+ wav,
+@@ -50,7 +51,7 @@ pub const Format = enum {
+ };
+
+ /// A synthesis's prompt and sources, or a long-form reply; `dropped`: `¶` marks not honoured; `stripped`: controls cut.
+-const Plan = struct { prompt: []const u32, codes: []const drama_prompt.Codes, input: []const u8, references: []const drama_prompt.Reference, format: Format, stream: bool, long: ?speech_long.Long = null, dropped: usize = 0, stripped: ?usize = null };
++const Plan = struct { prompt: []const u32, codes: []const drama_prompt.Codes, input: []const u8, references: []const drama_prompt.Reference, sampling: speech_sampling.Options, format: Format, stream: bool, long: ?speech_long.Long = null, dropped: usize = 0, stripped: ?usize = null };
+
+ pub fn post(srv: *Server, c: *Conn, a: Allocator) !void {
+ const sp = srv.info.speech orelse {
+@@ -94,8 +95,8 @@ fn checkFields(cx: *Cx, body: Value) errors.Refused!void {
+ if (value == .null or (value == .string and std.mem.eql(u8, value.string, "audio"))) continue;
+ if (value == .string and std.mem.eql(u8, value.string, "sse")) return cx.refuse("stream_format sse is not supported by this model");
+ return cx.refuse("stream_format must be one of: audio, sse");
+- } else if (std.mem.eql(u8, key, "references")) {
+- // lowered with the voice, after the input's checks (drama_voice.lower)
++ } else if (std.mem.eql(u8, key, "references") or speech_sampling.isField(key)) {
++ // references and sampling are checked in prepare before submission
+ } else if (listed(&modifier_fields, key)) {
+ if (value != .null) return cx.fail(.request, "{s} is not supported by this model", .{key});
+ } else return cx.fail(.request, "unknown speech request field: {s}", .{key});
+@@ -114,6 +115,7 @@ fn responseFormat(cx: *Cx, value: []const u8) errors.Refused!Format {
+ fn prepare(srv: *Server, cx: *Cx, sp: api.SpeechInfo, raw: Value) errors.Refused!Plan {
+ if (raw != .object) return cx.refuse("speech request body must be a JSON object");
+ try checkFields(cx, raw);
++ const sampling = try speech_sampling.parse(cx, raw);
+ const model = raw.strField("model") orelse return cx.fail(.request, "model is required: send {s}", .{srv.config.served_name});
+ if (!listed(srv.config.model_ids, model))
+ return cx.fail(.request, "model {s} is not served here: send {s}", .{ try pyrepr.repr(cx.a, .{ .string = model }), srv.config.served_name });
+@@ -135,15 +137,15 @@ fn prepare(srv: *Server, cx: *Cx, sp: api.SpeechInfo, raw: Value) errors.Refused
+ const voice = raw.strField("voice") orelse raw.strField("speaker") orelse "default";
+ const references = try drama_voice.lower(cx, input, raw.get("references") orelse .null, try voiceReferences(srv, cx, voice));
+ if (references.len == 0) if (try drama_prompt.problem(cx.a, input)) |message| return cx.refuse(message);
+- if (srv.config.long_form) |options| if (try speech_long.plan(srv, cx, sp, marked, references, options)) |long|
+- return .{ .prompt = &.{}, .codes = &.{}, .input = input, .references = references, .format = format, .stream = stream, .long = long, .dropped = marked.dropped, .stripped = stripped };
++ if (srv.config.long_form) |options| if (try speech_long.plan(srv, cx, sp, marked, references, options, sampling)) |long|
++ return .{ .prompt = &.{}, .codes = &.{}, .input = input, .references = references, .sampling = sampling, .format = format, .stream = stream, .long = long, .dropped = marked.dropped, .stripped = stripped };
+ const rows = drama_prompt.promptRows(cx.a, srv.text, input, references) catch |e| return switch (e) {
+ error.OutOfMemory => error.OutOfMemory,
+ error.Template => cx.other("the tokenizer cannot encode this prompt"),
+ };
+ if (rows.tokens.len > sp.max_prompt_tokens)
+ return cx.fail(.request, drama_prompt.error_prefix ++ " a prompt of {d} rows exceeds the maximum allowed length of {d} rows", .{ rows.tokens.len, sp.max_prompt_tokens });
+- return .{ .prompt = rows.tokens, .codes = rows.codes, .input = input, .references = references, .format = format, .stream = stream, .dropped = marked.dropped, .stripped = stripped };
++ return .{ .prompt = rows.tokens, .codes = rows.codes, .input = input, .references = references, .sampling = sampling, .format = format, .stream = stream, .dropped = marked.dropped, .stripped = stripped };
+ }
+
+ /// What ``voice`` names: the built-in voice (none), --default-voice's for ``default``, else a --voices file's.
+@@ -184,11 +186,11 @@ fn synthesize(srv: *Server, c: *Conn, cx: *Cx, id: []const u8, sp: api.SpeechInf
+ .codes = rows.codes,
+ .pcm = audio,
+ .result = &result,
+- .seed = api.seedFor(rows.tokens, speech_redraw.Redraws.salt(srv.config.seed_salt, k)),
++ .seed = plan.sampling.seedFor(rows.tokens, srv.config.seed_salt, k),
+ .max_frames = sp.max_frames,
+- .temperature = drama_prompt.temperature,
+- .top_p = drama_prompt.top_p,
+- .top_k = drama_prompt.top_k,
++ .temperature = plan.sampling.temperature,
++ .top_p = plan.sampling.top_p,
++ .top_k = plan.sampling.top_k,
+ .unconditioned = guided.unconditioned,
+ .cfg_gamma = guided.gamma,
+ .stream = plan.stream,
+@@ -573,7 +575,6 @@ test "fields: unknown ones are refused even when null, modifiers when set" {
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream\": \"yes\"}", "stream must be a boolean" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream_format\": \"sse\"}", "stream_format sse is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream_format\": \"mp3\"}", "stream_format must be one of: audio, sse" },
+- .{ "{\"model\": \"m\", \"input\": \"hi\", \"temperature\": 0.7}", "temperature is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"ref_audio\": \"x.wav\"}", "ref_audio is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": 3}", "input must be a string" },
+ .{ "{\"model\": null, \"input\": \"hi\"}", "model must be a string" },
+diff --git a/zig/src/server/speech_long.zig b/zig/src/server/speech_long.zig
+index 619e0f79..a19a5fdc 100644
+--- a/zig/src/server/speech_long.zig
++++ b/zig/src/server/speech_long.zig
+@@ -4,6 +4,7 @@ const api = @import("engine_api");
+ const errors = @import("errors.zig");
+ const speech = @import("speech.zig");
+ const speech_redraw = @import("speech_redraw.zig");
++const speech_sampling = @import("speech_sampling.zig");
+ const drama_prompt = @import("drama_prompt.zig");
+ const drama_long = @import("drama_long.zig");
+ const drama_joins = @import("drama_joins.zig");
+@@ -26,6 +27,7 @@ pub const Long = struct {
+ references: []const Reference,
+ history: u8,
+ shift_pause_s: f32,
++ sampling: speech_sampling.Options,
+
+ fn shifted(l: Long, i: usize) bool {
+ return i < l.shifts.len and l.shifts[i];
+@@ -37,7 +39,7 @@ const trailer = "X-Finish-Reason, X-Long-Form-Segments";
+ const shift_trailer = trailer ++ ", X-Pause-Spans";
+
+ /// The input's segments, cut at each of `marked`'s cuts, each refused now as a whole input would be; null: one reply.
+-pub fn plan(srv: *Server, cx: *Cx, sp: api.SpeechInfo, marked: drama_shift.Marked, references: []const Reference, options: drama_long.Options) errors.Refused!?Long {
++pub fn plan(srv: *Server, cx: *Cx, sp: api.SpeechInfo, marked: drama_shift.Marked, references: []const Reference, options: drama_long.Options, sampling: speech_sampling.Options) errors.Refused!?Long {
+ const input = marked.text;
+ if (marked.cuts.len == 0 and (std.unicode.utf8CountCodepoints(input) catch unreachable) <= options.chars) return null;
+ const split = try drama_shift.split(cx.a, marked, options.chars);
+@@ -54,7 +56,7 @@ pub fn plan(srv: *Server, cx: *Cx, sp: api.SpeechInfo, marked: drama_shift.Marke
+ if (rows.tokens.len > sp.max_prompt_tokens)
+ return cx.fail(.request, drama_prompt.error_prefix ++ " a prompt of {d} rows exceeds the maximum allowed length of {d} rows", .{ rows.tokens.len, sp.max_prompt_tokens });
+ }
+- return .{ .input = input, .segments = segments, .shifts = split.shifts, .references = references, .history = options.history, .shift_pause_s = options.shift_pause_s };
++ return .{ .input = input, .segments = segments, .shifts = split.shifts, .references = references, .history = options.history, .shift_pause_s = options.shift_pause_s, .sampling = sampling };
+ }
+
+ /// Speaks every segment into one reply: a WAV or PCM body, or a PCM stream from the first segment's first audio.
+@@ -156,11 +158,11 @@ const Reply = struct {
+ .generated = r.generated[r.frames..][0..room],
+ .pcm = r.scratch[0 .. room * fl],
+ .result = &result,
+- .seed = api.seedFor(rows.tokens, speech_redraw.Redraws.salt(r.srv.config.seed_salt, k)),
++ .seed = r.long.sampling.seedFor(rows.tokens, r.srv.config.seed_salt, k),
+ .max_frames = @intCast(room),
+- .temperature = drama_prompt.temperature,
+- .top_p = drama_prompt.top_p,
+- .top_k = drama_prompt.top_k,
++ .temperature = r.long.sampling.temperature,
++ .top_p = r.long.sampling.top_p,
++ .top_k = r.long.sampling.top_k,
+ .unconditioned = guided.unconditioned,
+ .cfg_gamma = guided.gamma,
+ .stream = live,
+diff --git a/zig/src/server/speech_long_test.zig b/zig/src/server/speech_long_test.zig
+index 8fb9a7ba..de6e3fef 100644
+--- a/zig/src/server/speech_long_test.zig
++++ b/zig/src/server/speech_long_test.zig
+@@ -8,6 +8,7 @@ const harness = @import("speech_stream_test.zig");
+ const Served = harness.Served;
+
+ const gpa = std.testing.allocator;
++pub const Sampling = struct { temperature: f32, top_p: f32, top_k: u32 };
+ /// 1 kHz audio in 10-sample frames: a codec frame is one 10 ms join frame, and a sentence's pause is 420 samples.
+ const rate = 1000;
+ const frame = 10;
+@@ -26,6 +27,7 @@ pub const Turns = struct {
+ prompts: std.ArrayList([]const u32) = .empty,
+ codes: std.ArrayList([]const drama_prompt.Codes) = .empty,
+ seeds: std.ArrayList(u64) = .empty,
++ sampling: std.ArrayList(Sampling) = .empty,
+ limits: std.ArrayList(u32) = .empty,
+ generated: std.ArrayList(usize) = .empty,
+ streamed: std.ArrayList(bool) = .empty,
+@@ -54,6 +56,7 @@ pub const Turns = struct {
+ t.prompts.append(a, a.dupe(u32, request.prompt) catch unreachable) catch unreachable;
+ t.codes.append(a, a.dupe(drama_prompt.Codes, request.codes) catch unreachable) catch unreachable;
+ t.seeds.append(a, request.seed) catch unreachable;
++ t.sampling.append(a, .{ .temperature = request.temperature, .top_p = request.top_p, .top_k = request.top_k }) catch unreachable;
+ t.limits.append(a, request.max_frames) catch unreachable;
+ t.generated.append(a, request.generated.len) catch unreachable;
+ t.streamed.append(a, request.stream) catch unreachable;
+diff --git a/zig/src/server/speech_register_test.zig b/zig/src/server/speech_register_test.zig
+index 4e9d24bb..031a0113 100644
+--- a/zig/src/server/speech_register_test.zig
++++ b/zig/src/server/speech_register_test.zig
+@@ -26,6 +26,7 @@ const Draws = struct {
+ refused: u8 = 0,
+ prompts: [4][]const u32 = undefined,
+ seeds: [4]u64 = undefined,
++ sampling: [4]scripted.Sampling = undefined,
+
+ fn engine(d: *Draws) api.Engine {
+ return .{ .ctx = d, .vtable = &.{ .info = info, .submit = submit, .cancel = cancel, .status = status, .memory = memory, .submit_speech = speech } };
+@@ -45,6 +46,7 @@ const Draws = struct {
+ d.refused = 0;
+ d.prompts[d.seen] = d.a.dupe(u32, request.prompt) catch unreachable;
+ d.seeds[d.seen] = request.seed;
++ d.sampling[d.seen] = .{ .temperature = request.temperature, .top_p = request.top_p, .top_k = request.top_k };
+ d.seen += 1;
+ @memcpy(request.pcm[0..draw.pcm.len], draw.pcm);
+ if (request.stream) sink.event(sink.ctx, id, &.{ .audio = draw.pcm.len });
+@@ -117,6 +119,25 @@ test "a jump trips one redraw at the next salt; the calmer redraw is sent, marke
+ try std.testing.expectEqualSlices(u32, d.prompts[0], d.prompts[1]);
+ }
+
++test "speech sampling: silence then register redraws retain settings and increment the exact seed" {
++ var arena: std.heap.ArenaAllocator = .init(gpa);
++ defer arena.deinit();
++ const a = arena.allocator();
++ const calm = try reply(a, 178);
++ var d: Draws = .{ .a = a, .draws = &.{ .{ .pcm = calm, .reason = .silence }, .{ .pcm = try reply(a, 240) }, .{ .pcm = calm } } };
++ const request = "{\"model\":\"m\",\"input\":\"One. Two.\",\"response_format\":\"pcm\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8,\"seed\":9007199254740993}";
++ const r = try serve(&d, config(on, .{ .max = 1 }), null, request);
++ defer scripted.done(r.s);
++ try harness.expectHeader(r.head, "HTTP/1.1 200");
++ try harness.expectHeader(r.head, "X-Silence-Redraws: 1");
++ try harness.expectHeader(r.head, "X-Register-Redraws: 1");
++ try std.testing.expectEqual(@as(usize, 3), d.seen);
++ for (0..d.seen) |k| {
++ try std.testing.expectEqual(@as(u64, 9007199254740993) + k, d.seeds[k]);
++ try std.testing.expectEqualDeep(scripted.Sampling{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, d.sampling[k]);
++ }
++}
++
+ test "an untripped reply is drawn once and sent byte for byte as with the guard off, marked Trip 0 and Redraws 0" {
+ var arena: std.heap.ArenaAllocator = .init(gpa);
+ defer arena.deinit();
+diff --git a/zig/src/server/speech_sampling.zig b/zig/src/server/speech_sampling.zig
+new file mode 100644
+index 00000000..46c6afff
+--- /dev/null
++++ b/zig/src/server/speech_sampling.zig
+@@ -0,0 +1,57 @@
++//! Request-local Drama sampling, checked before a speech request reaches the engine.
++const std = @import("std");
++const api = @import("engine_api");
++const Value = @import("json.zig").Value;
++const errors = @import("errors.zig");
++const defaults = @import("drama_prompt.zig");
++
++pub const Options = struct {
++ temperature: f32 = defaults.temperature,
++ top_p: f32 = defaults.top_p,
++ top_k: u32 = defaults.top_k,
++ seed: ?u64 = null,
++
++ pub fn seedFor(o: Options, prompt: []const u32, salt: i64, attempt: usize) u64 {
++ if (o.seed) |seed| return seed +% @as(u64, @intCast(attempt));
++ return api.seedFor(prompt, salt +% @as(i64, @intCast(attempt)));
++ }
++};
++
++pub fn isField(key: []const u8) bool {
++ for ([_][]const u8{ "temperature", "top_p", "top_k", "seed" }) |name|
++ if (std.mem.eql(u8, key, name)) return true;
++ return false;
++}
++
++pub fn parse(cx: *errors.Cx, body: Value) errors.Refused!Options {
++ var out: Options = .{};
++ if (body.field("temperature")) |value|
++ out.temperature = try number(cx, value, std.math.floatMax(f32), "temperature must be a finite nonnegative f32 number");
++ if (body.field("top_p")) |value| {
++ out.top_p = try number(cx, value, 1, "top_p must be a finite f32 number greater than 0 and at most 1");
++ if (out.top_p == 0) return cx.refuse("top_p must be greater than 0");
++ }
++ if (body.field("top_k")) |value| {
++ const message = "top_k must be an integer from 1 through 64";
++ if (value != .int) return cx.refuse(message);
++ const n = std.fmt.parseInt(u32, value.int, 10) catch return cx.refuse(message);
++ if (n == 0 or n > 64) return cx.refuse(message);
++ out.top_k = n;
++ }
++ if (body.field("seed")) |value| {
++ const message = "seed must be an integer from 0 through 18446744073709551615";
++ if (value != .int) return cx.refuse(message);
++ out.seed = std.fmt.parseInt(u64, value.int, 10) catch return cx.refuse(message);
++ }
++ return out;
++}
++
++/// Check the parsed f64 range before narrowing, then reject positive values that would become zero.
++fn number(cx: *errors.Cx, value: Value, max: f64, message: []const u8) errors.Refused!f32 {
++ if (value != .int and value != .float) return cx.refuse(message);
++ const n = value.float64() orelse return cx.refuse(message);
++ if (!std.math.isFinite(n) or n < 0 or n > max) return cx.refuse(message);
++ const narrowed: f32 = @floatCast(n);
++ if (n > 0 and narrowed == 0) return cx.refuse(message);
++ return narrowed;
++}
+diff --git a/zig/src/server/speech_sampling_test.zig b/zig/src/server/speech_sampling_test.zig
+new file mode 100644
+index 00000000..7fc6d406
+--- /dev/null
++++ b/zig/src/server/speech_sampling_test.zig
+@@ -0,0 +1,167 @@
++//! Speech sampling controls through the HTTP route, including long-form retries and carried reference prompts.
++const std = @import("std");
++const api = @import("engine_api");
++const server = @import("root.zig");
++const harness = @import("speech_stream_test.zig");
++const scripted = @import("speech_long_test.zig");
++const drama_prompt = @import("drama_prompt.zig");
++const gpa = std.testing.allocator;
++const config: server.Config = .{ .served_name = "m", .model_ids = &.{"m"}, .seed_salt = 17 };
++const defaults: scripted.Sampling = .{ .temperature = 1, .top_p = 0.9, .top_k = 30 };
++
++fn exchange(turns: *scripted.Turns, cfg: server.Config, body: []const u8) ![]u8 {
++ var s: harness.Served = undefined;
++ try s.startWith(turns.engine(), cfg, "HTTP/1.1", body, 2000);
++ defer s.deinit();
++ defer s.route.join();
++ _ = try s.readHead();
++ _ = try s.readRest();
++ return gpa.dupe(u8, s.got.items);
++}
++
++fn expectDraw(turns: *const scripted.Turns, index: usize, sampling: scripted.Sampling, seed: u64) !void {
++ try std.testing.expectEqualDeep(sampling, turns.sampling.items[index]);
++ try std.testing.expectEqual(seed, turns.seeds.items[index]);
++}
++
++test "speech sampling: omitted and null controls retain default parameters and PCM" {
++ const bodies = [_][]const u8{
++ "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\"}",
++ "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"temperature\":null,\"top_p\":null,\"top_k\":null,\"seed\":null}",
++ };
++ var first: ?[]u8 = null;
++ defer if (first) |pcm| gpa.free(pcm);
++ for (bodies) |body| {
++ var turns: scripted.Turns = .{ .turns = &.{.{ .frames = 5 }} };
++ defer turns.deinit();
++ const reply = try exchange(&turns, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 1), turns.seen);
++ try expectDraw(&turns, 0, defaults, api.seedFor(turns.prompts.items[0], config.seed_salt));
++ const pcm = reply[(std.mem.indexOf(u8, reply, "\r\n\r\n").? + 4)..];
++ if (first) |before| try std.testing.expectEqualSlices(u8, before, pcm) else first = try gpa.dupe(u8, pcm);
++ }
++}
++
++test "speech sampling: custom parameters and exact integer seeds reach whole and streamed requests" {
++ const cases = [_]struct { fields: []const u8, sampling: scripted.Sampling, seed: ?u64 }{
++ .{ .fields = "\"temperature\":1.25,\"top_p\":0.8,\"top_k\":64,\"seed\":9007199254740993", .sampling = .{ .temperature = 1.25, .top_p = 0.8, .top_k = 64 }, .seed = 9007199254740993 },
++ .{ .fields = "\"temperature\":0,\"top_p\":1,\"top_k\":1,\"seed\":0", .sampling = .{ .temperature = 0, .top_p = 1, .top_k = 1 }, .seed = 0 },
++ .{ .fields = "\"seed\":18446744073709551615", .sampling = defaults, .seed = std.math.maxInt(u64) },
++ .{ .fields = "\"temperature\":0.5", .sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, .seed = null },
++ .{ .fields = "\"temperature\":1e-400", .sampling = .{ .temperature = 0, .top_p = 0.9, .top_k = 30 }, .seed = null },
++ .{ .fields = "\"temperature\":-1e-400", .sampling = .{ .temperature = -0.0, .top_p = 0.9, .top_k = 30 }, .seed = null },
++ .{ .fields = "\"temperature\":3.4028234663852886e38,\"top_p\":1e-45", .sampling = .{ .temperature = std.math.floatMax(f32), .top_p = 1e-45, .top_k = 30 }, .seed = null },
++ };
++ for (cases) |case| for ([_]bool{ false, true }) |stream| {
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"stream\":{s},{s}}}", .{ if (stream) "true" else "false", case.fields });
++ defer gpa.free(body);
++ var turns: scripted.Turns = .{ .turns = &.{.{ .frames = 5 }} };
++ defer turns.deinit();
++ const reply = try exchange(&turns, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ if (stream) try harness.expectHeader(reply, "Transfer-Encoding: chunked");
++ try std.testing.expectEqual(@as(usize, 1), turns.seen);
++ try expectDraw(&turns, 0, case.sampling, case.seed orelse api.seedFor(turns.prompts.items[0], config.seed_salt));
++ };
++}
++
++test "speech sampling: invalid controls fail before any engine submission" {
++ const fields = [_][]const u8{
++ "\"top_p\":1e-400", "\"top_p\":-1e-400",
++ "\"temperature\":true", "\"temperature\":\"1\"",
++ "\"temperature\":[]", "\"temperature\":{}",
++ "\"temperature\":-1", "\"temperature\":NaN",
++ "\"temperature\":Infinity", "\"temperature\":1e39",
++ "\"temperature\":1e-100", "\"top_p\":false",
++ "\"top_p\":\"0.9\"", "\"top_p\":0",
++ "\"top_p\":-0.1", "\"top_p\":1.00000001",
++ "\"top_p\":NaN", "\"top_p\":1e-100",
++ "\"top_p\":Infinity", "\"top_k\":true",
++ "\"top_k\":\"30\"", "\"top_k\":1.5",
++ "\"top_k\":30.0", "\"top_k\":0",
++ "\"top_k\":-1", "\"top_k\":65",
++ "\"top_k\":18446744073709551616", "\"seed\":true",
++ "\"seed\":\"1\"", "\"seed\":1.5",
++ "\"seed\":1.0", "\"seed\":-1",
++ "\"seed\":18446744073709551616", "\"seed\":NaN",
++ };
++ for (fields) |field| {
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",{s}}}", .{field});
++ defer gpa.free(body);
++ var turns: scripted.Turns = .{ .turns = &.{.{ .frames = 5 }} };
++ defer turns.deinit();
++ const reply = try exchange(&turns, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 400");
++ try std.testing.expectEqual(@as(usize, 0), turns.seen);
++ }
++}
++
++test "speech sampling: referenced re-prompts keep overrides and wrap explicit retry seeds" {
++ const frames = [_]drama_prompt.Codes{@splat(7)};
++ const refs = [_]drama_prompt.Reference{.{ .text = "A small cloud passes.", .frames = &frames }};
++ const voices = [_]@import("drama_voice.zig").Voice{.{ .name = "tone", .references = &refs, .source = .@"model-invented" }};
++ var cfg = config;
++ cfg.voices = &voices;
++ cfg.cfg = .{ .gamma = 2 };
++ cfg.silence_redraw = .{ .max = 2, .plain = true };
++ var turns: scripted.Turns = .{ .turns = &.{ .{ .frames = 5, .reason = .silence }, .{ .frames = 5, .reason = .silence }, .{ .frames = 5 } } };
++ defer turns.deinit();
++ const reply = try exchange(&turns, cfg, "{\"model\":\"m\",\"input\":\"hi [sighs] [laughs] there\",\"voice\":\"tone\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8,\"seed\":18446744073709551615}");
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 3), turns.seen);
++ for ([_]u64{ std.math.maxInt(u64), 0, 1 }, 0..) |seed, k| {
++ try expectDraw(&turns, k, .{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, seed);
++ var reference_frames: usize = 0;
++ for (turns.codes.items[k]) |codes| if (std.meta.eql(frames[0], codes)) {
++ reference_frames += 1;
++ };
++ try std.testing.expectEqual(@as(usize, 1), reference_frames);
++ try std.testing.expectEqual(@as(f32, 2), turns.gammas.items[k]);
++ try std.testing.expect(turns.unconditioned.items[k].len > 0);
++ }
++ try std.testing.expect(!std.mem.eql(u32, turns.prompts.items[0], turns.prompts.items[1]));
++}
++
++test "speech sampling: long-form segment retries preserve overrides, carried prompts and per-segment seeds" {
++ var cfg = config;
++ cfg.long_form = .{ .chars = 20 };
++ cfg.silence_redraw = .{ .max = 1, .plain = true };
++ cfg.cfg = .{ .gamma = 2 };
++ for ([_]bool{ false, true }) |explicit| {
++ const seed_field = if (explicit) ",\"seed\":18446744073709551615" else "";
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"Sentence 00 is ok. Sentence [sighs] ok. Sentence 02 is ok.\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8{s}}}", .{seed_field});
++ defer gpa.free(body);
++ var turns: scripted.Turns = .{ .turns = &.{ .{ .frames = 5 }, .{ .frames = 5, .reason = .silence }, .{ .frames = 5, .busy = 1 }, .{ .frames = 5 } } };
++ defer turns.deinit();
++ const reply = try exchange(&turns, cfg, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 4), turns.seen);
++ for ([_]usize{ 0, 0, 1, 0 }, 0..) |attempt, k| {
++ const seed = if (explicit) std.math.maxInt(u64) +% @as(u64, @intCast(attempt)) else api.seedFor(turns.prompts.items[k], config.seed_salt + @as(i64, @intCast(attempt)));
++ try expectDraw(&turns, k, .{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, seed);
++ try std.testing.expectEqual(@as(f32, if (k == 0) 1 else 2), turns.gammas.items[k]);
++ }
++ try std.testing.expect(!std.mem.eql(u32, turns.prompts.items[1], turns.prompts.items[2]));
++ try std.testing.expect(turns.codes.items[3].len > 0);
++ }
++}
++
++test "speech sampling: a silenced long-form stream keeps controls without redrawing" {
++ var cfg = config;
++ cfg.long_form = .{ .chars = 20 };
++ cfg.silence_redraw = .{ .max = 2 };
++ var turns: scripted.Turns = .{ .turns = &.{ .{ .frames = 5 }, .{ .frames = 5, .reason = .silence } } };
++ defer turns.deinit();
++ const reply = try exchange(&turns, cfg, "{\"model\":\"m\",\"input\":\"Sentence 00 is ok. Sentence 01 is ok. Sentence 02 is ok.\",\"response_format\":\"pcm\",\"stream\":true,\"temperature\":0.5,\"seed\":2}");
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try harness.expectHeader(reply, "X-Finish-Reason: silence");
++ try std.testing.expectEqual(@as(usize, 2), turns.seen);
++ for (0..2) |k| try expectDraw(&turns, k, .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, 2);
++}
+diff --git a/zig/src/server/speech_stream_test.zig b/zig/src/server/speech_stream_test.zig
+index 5cdcad00..8781d280 100644
+--- a/zig/src/server/speech_stream_test.zig
++++ b/zig/src/server/speech_stream_test.zig
+@@ -236,7 +236,7 @@ fn pcm(comptime n: usize) [2 * frame * n]u8 {
+ return bytes;
+ }
+
+-fn expectHeader(head: []const u8, line: []const u8) !void {
++pub fn expectHeader(head: []const u8, line: []const u8) !void {
+ try std.testing.expect(std.mem.indexOf(u8, head, line) != null);
+ }
+
+--
+2.46.0
+
diff --git a/engine/nvfp4/patches/README.md b/engine/nvfp4/patches/README.md
index 70cc1e1..5242c7c 100644
--- a/engine/nvfp4/patches/README.md
+++ b/engine/nvfp4/patches/README.md
@@ -7,6 +7,11 @@ selected patch exactly once, verifies its digest, then applies the series.
| Patch | Scope | Source PR |
|---|---|---|
| `0001-protected-speech-chunks.patch` | Protected markup and CJK long-form boundaries; test fixture drain ordering | [TensorFold #5](https://github.com/plotarmordev/TensorFold/pull/5) |
+| `0002-speech-sampling-controls.patch` | Request sampling through whole/streamed, reference, CFG and long-form redraw paths | [TensorFold #6](https://github.com/plotarmordev/TensorFold/pull/6) |
+
+Patch 0002 adds [request sampling](../../../recipe/README-sampling.md). Each
+long-form segment starts with the supplied seed; its retries add their own
+attempt number. Omitted seeds retain the existing per-segment prompt hash.
Protected constructs are complete model special tokens, balanced bracketed
spans and correctly nested, exact-name ASCII tags without attributes. Unclosed
diff --git a/engine/nvfp4/patches/SHA256SUMS b/engine/nvfp4/patches/SHA256SUMS
index ec0229f..c27c658 100644
--- a/engine/nvfp4/patches/SHA256SUMS
+++ b/engine/nvfp4/patches/SHA256SUMS
@@ -1 +1,2 @@
c0553b2cfd231ddbbe6390edfe49546db5bef084d5bb6a5009542ccccfdd2fb9 0001-protected-speech-chunks.patch
+34e0110f8dad8382a8b592aa7d2e63fc9c2e472b6f3528cf555f770eb5bfeb25 0002-speech-sampling-controls.patch
diff --git a/engine/patches/0013-speech-sampling-controls.patch b/engine/patches/0013-speech-sampling-controls.patch
new file mode 100644
index 0000000..fc0c1ce
--- /dev/null
+++ b/engine/patches/0013-speech-sampling-controls.patch
@@ -0,0 +1,536 @@
+From c712e5f9e73c298df8f3466b717f130ec4d824b4 Mon Sep 17 00:00:00 2001
+From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 11:48:10 +0800
+Subject: [PATCH] server: expose per-request speech sampling controls
+
+---
+ CHANGELOG.md | 2 +
+ README.md | 4 +-
+ docs/speech-redraws.md | 10 +-
+ docs/speech-sampling.md | 47 ++++++++
+ zig/src/server/root.zig | 1 +
+ zig/src/server/speech.zig | 21 ++--
+ zig/src/server/speech_register_test.zig | 28 +++++
+ zig/src/server/speech_sampling.zig | 57 +++++++++
+ zig/src/server/speech_sampling_test.zig | 140 ++++++++++++++++++++++
+ zig/src/server/speech_stream_test.zig | 3 +
+ zig/src/server/speech_unmeasured_test.zig | 2 +-
+ 11 files changed, 301 insertions(+), 14 deletions(-)
+ create mode 100644 docs/speech-sampling.md
+ create mode 100644 zig/src/server/speech_sampling.zig
+ create mode 100644 zig/src/server/speech_sampling_test.zig
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index 2f408d40..f75699c3 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -4,6 +4,8 @@ Each release's page on GitHub has its notes and measurements. See [the 1.0.0 rel
+
+ ## Unreleased
+
++- Drama speech requests accept `temperature`, `top_p`, `top_k` (1 through 64) and exact unsigned 64-bit `seed` values. Whole replies, streams, catalog voices and redraws retain the requested settings; omitted or null fields keep the existing defaults. Explicit seeds advance by the attempt number for redraws. See [speech sampling](docs/speech-sampling.md).
++
+ - Combined silence onset and mid settings append their clauses to the base startup sentence in onset-then-mid order; the mid clause includes its required voiced minimum.
+ - Drama 3 on CUDA prefills bounded row chunks in each shared round. `TF_DRAMA_PREFILL_ROWS` selects 1 through 1024 rows (default 128); the generation tool uses `--max-rows`. Batched projections and attention can change rounding relative to single-row prefill; oracle checks now compare the selected prompt chunks at their reference-row offsets.
+ - Drama 3 serving accepts `--max-frames` to bound synthesis frames, preserving the stock cap when omitted.
+diff --git a/README.md b/README.md
+index 06c0f3d3..ad7633de 100644
+--- a/README.md
++++ b/README.md
+@@ -136,7 +136,7 @@ Conversions are explicitly marked: their upstream weights need the linked conver
+ | Step-5-Preview, converted affine | `hf download stepfun-ai/Step-5-Preview --local-dir ~/models/step5-preview-fp8` | One 256 GB Mac; text 166.9 GiB, MTP adds 2.5 GiB and vision 3.7 GiB. | [Convert and serve](docs/recipes/step-5-preview.md). The documented 256 GB setup serves converted affine weights; converting the upstream FP8 download needs Python and mlx. |
+ | Kolibri-1, block FP8 (research) | `tensorfold pull Aleph-Alpha/Kolibri-1@e52eb4627d11516b0c01de49210ab5a4e4061444` | One NVIDIA GPU; GB10 measured; 74 GB checkpoint. | [Kolibri](docs/recipes/kolibri-1.md). Text only; copy drafts, no EAGLE-3/neural drafter. |
+ | Liquid AI d1-3B, decisions | Not documented yet. | Native CUDA; RAM minimum not published. | [API section below](#serve-flags). `/v1/systemone` and `/v1/decisions`. |
+-| Fish Audio Drama 3, speech | Not documented yet. | Native Metal or CUDA; GB10 measured. | [Release audio instructions](CHANGELOG.md#110). `/v1/audio/speech`; checkpoint and `codec.pth` required. |
++| Fish Audio Drama 3, speech | Not documented yet. | Native Metal or CUDA; GB10 measured. | [Release audio instructions](CHANGELOG.md#110). `/v1/audio/speech` with [sampling controls](docs/speech-sampling.md); checkpoint and `codec.pth` required. |
+
+ ### GLM-5.3: one machine or two?
+
+@@ -247,7 +247,7 @@ The binary's `capabilities --json` response lists its supported flags and platfo
+ | `--silence-seconds SECONDS` | Drama speech only: stop after this continuous duration below the explicit floor, retaining audio and reporting `silence`. Unset by default: off; calibrate above intentional pauses. |
+ | `--silence-onset-s SECONDS` | Drama speech only: with the silence guard on, stop once this many seconds run below its floor while the synthesis has voiced less than `--silence-onset-voiced-s`, retaining audio and reporting `silence`. Off unless given; must be below `--silence-seconds`. |
+ | `--silence-onset-voiced-s SECONDS` | Drama speech only: the voiced seconds below which `--silence-onset-s` applies; required with it, with no default. Calibrate on public or built-in speech. |
+-| `--silence-redraws N` | Drama speech only: draw a whole reply the silence guard ended again, up to N times, as seed salt + k; N of 1 or more needs the guard. Unset by default: off, as is 0; streams are never redrawn. See [speech redraws](docs/speech-redraws.md). |
++| `--silence-redraws N` | Drama speech only: draw a whole reply the silence guard ended again, up to N times, as seed salt + k or explicit request seed + k; N of 1 or more needs the guard. Unset by default: off, as is 0; streams are never redrawn. See [speech redraws](docs/speech-redraws.md). |
+ | `--silence-redraw-budget-s SECONDS` | Start a redraw only while elapsed time plus the last take's duration fits; a request's `X-Deadline-S` can lower it. No default budget. |
+ | `--silence-redraw-controls LIST` | Redraws speak the input filtered to the listed controls, as `--allowed-controls` filters; an empty list removes every control. |
+ | `--short-reply-ratio R` | Also redraw a whole reply that finished `stop` with less audio than R (above 0, below 1) of its text's expected length; needs `--silence-redraws` and `--short-reply-chars-per-s`. No default. |
+diff --git a/docs/speech-redraws.md b/docs/speech-redraws.md
+index b396fb8d..1a2c22a4 100644
+--- a/docs/speech-redraws.md
++++ b/docs/speech-redraws.md
+@@ -12,12 +12,18 @@ needs it or the [register guard](#register).
+
+ ## Seeds
+
+-Redraw k (1 to N) seeds its prompt with `TENSORFOLD_SEED_SALT` plus k; the first
++Without an explicit request `seed`, redraw k (1 to N) seeds its prompt with `TENSORFOLD_SEED_SALT` plus k; the first
+ take keeps the stock seed, salt plus 0. Redraws are therefore deterministic. With
+ the same prompt, redraw k under salt s is the same draw as the first take under
+ salt s + k, so a sweep over salts should space compared salts more than N apart,
+ or N + 1 with the register guard.
+
++An explicit request `seed` instead uses that exact integer for the first take
++and seed + k modulo 2^64 for each redraw, counting both silence and register
++attempts. Requested `temperature`, `top_p` and `top_k` remain in effect through
++all redraws and control filtering; see [speech sampling](speech-sampling.md).
++The seed rule does not make timing-based redraw budgets deterministic.
++
+ ## Budget
+
+ A redraw starts only when t + d fits the budget, where t is the time since the
+@@ -125,7 +131,7 @@ below 8 kHz, all-zero audio, and takes with fewer than two retained phrases are
+ not measured. A measured take with no qualifying jump counts as zero.
+ The detector is not Praat's analysis: its values can differ from Praat's.
+
+-A take that trips is drawn once more, as the next seed, salt + k after any
++A take that trips is drawn once more, using the next seed under the [seed rule](#seeds) after any
+ silence redraws, if t + d fits the budget. The redraw is sent only if it does not
+ trip silence or short and has a strictly smaller jump; ties retain the first take.
+ A `length` redraw can replace a `stop` take. An unmeasured redraw can win only
+diff --git a/docs/speech-sampling.md b/docs/speech-sampling.md
+new file mode 100644
+index 00000000..b60515c9
+--- /dev/null
++++ b/docs/speech-sampling.md
+@@ -0,0 +1,47 @@
++# Speech sampling
++
++`POST /v1/audio/speech` accepts these optional fields for Drama 3. Omission or
++`null` keeps the existing default for that field. They apply to WAV replies,
++whole PCM replies, streamed PCM and catalog voices.
++
++| Field | Accepted JSON value | Default |
++| --- | --- | --- |
++| `temperature` | A finite number at least 0, within the `f32` range. A positive value must remain positive when converted to `f32`. | `1` |
++| `top_p` | A finite number greater than 0 and at most 1, still greater than 0 after conversion to `f32`. | `0.9` |
++| `top_k` | An integer from 1 through 64. | `30` |
++| `seed` | An integer from 0 through 18446744073709551615. | The existing hash of the prompt and `TENSORFOLD_SEED_SALT`. |
++
++Numbers encoded as strings and booleans are refused. `top_k` and `seed` must
++use integer JSON syntax: `30.0` and `1e3` are refused. Seeds are parsed as exact
++64-bit unsigned integers, including values above 9007199254740991; clients
++whose JSON number type loses precision must preserve the integer when encoding
++the request. Invalid fields return HTTP 400 before submission to the engine.
++
++```sh
++curl http://127.0.0.1:8080/v1/audio/speech \
++ -H 'Content-Type: application/json' \
++ -d '{"model":"local-model","input":"Hello there.","temperature":0.8,"top_p":0.9,"top_k":30,"seed":42}' \
++ --output speech.wav
++```
++
++The route passes these settings to the native sampler. On Metal and CUDA, `temperature`
++of 0 or `top_k` of 1 selects its existing greedy path, which bypasses repetition
++aware sampling (RAS). Other runtimes may handle repetition differently; matching
++fields and seeds do not promise identical audio across backends or checkpoints.
++The HTTP limit of 64 candidates fits both native Metal and CUDA admission.
++
++An explicit `seed` is used exactly for the first take. If configured
++[speech redraws](speech-redraws.md) admit another take, its seed is the original
++seed plus the take's attempt number (1, 2, ...), wrapping modulo 2^64. This
++number includes both silence and register redraws. All takes keep the requested
++sampling values, including when controls are stripped or a reference prompt is
++rebuilt. With no seed, the existing prompt hash and server salt plus attempt
++number are unchanged. Streams keep their existing no-redraw behavior.
++
++Seed selection is deterministic. The final take can still change if timing or
++request deadlines admit a different number of redraws.
++
++The API design references the public
++[Sogni-AI/drama3-mlx generation interface](https://github.com/Sogni-AI/drama3-mlx/blob/ecc235039ccd5f982f66a6982184f57432354ab4/drama3_mlx/model.py#L79).
++TensorFold's parsing and request propagation are an independent implementation;
++this does not change the native sampling algorithms.
+diff --git a/zig/src/server/root.zig b/zig/src/server/root.zig
+index 3ff11101..94097cac 100644
+--- a/zig/src/server/root.zig
++++ b/zig/src/server/root.zig
+@@ -43,6 +43,7 @@ test {
+ _ = @import("status_routes.zig");
+ _ = @import("speech.zig");
+ _ = @import("speech_stream_test.zig");
++ _ = @import("speech_sampling_test.zig");
+ _ = @import("speech_redraw.zig");
+ _ = @import("speech_redraw_test.zig");
+ _ = @import("speech_register_test.zig");
+diff --git a/zig/src/server/speech.zig b/zig/src/server/speech.zig
+index 314b1180..0a5378d8 100644
+--- a/zig/src/server/speech.zig
++++ b/zig/src/server/speech.zig
+@@ -9,6 +9,7 @@ const openai = @import("openai.zig");
+ const pyrepr = @import("pyrepr.zig");
+ const reply_text = @import("reply_text.zig");
+ const drama_prompt = @import("drama_prompt.zig");
++const speech_sampling = @import("speech_sampling.zig");
+ const speech_redraw = @import("speech_redraw.zig");
+ const speech_register = @import("speech_register_log.zig");
+ const ids = @import("ids.zig");
+@@ -28,7 +29,7 @@ pub const max_input_chars = 4096;
+ const served_fields = [_][]const u8{ "model", "input", "voice", "speaker", "response_format" };
+
+ /// The rest of the speech protocol's fields: synthesis modifiers and references this route does not honor.
+-const modifier_fields = [_][]const u8{ "speed", "task_type", "language", "instructions", "ref_audio", "ref_text", "references", "x_vector_only_mode", "stream_codec_output", "suppress_bootstrap_silence", "token_count", "duration_tokens", "initial_codec_chunk_frames", "max_new_tokens", "temperature", "top_p", "top_k", "repetition_penalty", "seed", "stage_params" };
++const modifier_fields = [_][]const u8{ "speed", "task_type", "language", "instructions", "ref_audio", "ref_text", "references", "x_vector_only_mode", "stream_codec_output", "suppress_bootstrap_silence", "token_count", "duration_tokens", "initial_codec_chunk_frames", "max_new_tokens", "repetition_penalty", "stage_params" };
+
+ pub const Format = enum {
+ wav,
+@@ -42,7 +43,7 @@ pub const Format = enum {
+ }
+ };
+
+-const Plan = struct { input: []const u8, prompt: []const u32, frames: ?[]const [11]i32 = null, refs: []const @import("drama_prompt").Reference = &.{}, reference_rows: u32 = 0, seed: u64, format: Format, stream: bool, budget_s: ?f64 = null };
++const Plan = struct { input: []const u8, prompt: []const u32, frames: ?[]const [11]i32 = null, refs: []const @import("drama_prompt").Reference = &.{}, reference_rows: u32 = 0, sampling: speech_sampling.Options, format: Format, stream: bool, budget_s: ?f64 = null };
+
+ const Take = struct { pcm: []f32, reason: api.Reason, trip: bool = false, jump: ?f64 = null };
+
+@@ -84,6 +85,8 @@ fn checkFields(cx: *Cx, body: Value) errors.Refused!void {
+ if (value == .null or (value == .string and std.mem.eql(u8, value.string, "audio"))) continue;
+ if (value == .string and std.mem.eql(u8, value.string, "sse")) return cx.refuse("stream_format sse is not supported by this model");
+ return cx.refuse("stream_format must be one of: audio, sse");
++ } else if (speech_sampling.isField(key)) {
++ continue; // validated together before building the prompt
+ } else if (listed(&modifier_fields, key)) {
+ if (value != .null) return cx.fail(.request, "{s} is not supported by this model", .{key});
+ } else return cx.fail(.request, "unknown speech request field: {s}", .{key});
+@@ -102,6 +105,7 @@ fn responseFormat(cx: *Cx, value: []const u8) errors.Refused!Format {
+ fn prepare(srv: *Server, cx: *Cx, sp: api.SpeechInfo, raw: Value) errors.Refused!Plan {
+ if (raw != .object) return cx.refuse("speech request body must be a JSON object");
+ try checkFields(cx, raw);
++ const sampling = try speech_sampling.parse(cx, raw);
+ const model = raw.strField("model") orelse return cx.fail(.request, "model is required: send {s}", .{srv.config.served_name});
+ if (!listed(srv.config.model_ids, model))
+ return cx.fail(.request, "model {s} is not served here: send {s}", .{ try pyrepr.repr(cx.a, .{ .string = model }), srv.config.served_name });
+@@ -121,7 +125,7 @@ fn prepare(srv: *Server, cx: *Cx, sp: api.SpeechInfo, raw: Value) errors.Refused
+ return cx.fail(.request, drama_prompt.error_prefix ++ " unknown voice {s}; only the default voice is supported", .{name});
+ };
+ const encoded = try promptOf(srv, cx, sp, input, refs);
+- return .{ .input = input, .prompt = encoded.prompt, .frames = encoded.frames, .refs = refs, .reference_rows = encoded.reference_rows, .seed = api.seedFor(encoded.prompt, srv.config.seed_salt), .format = format, .stream = stream };
++ return .{ .input = input, .prompt = encoded.prompt, .frames = encoded.frames, .refs = refs, .reference_rows = encoded.reference_rows, .sampling = sampling, .format = format, .stream = stream };
+ }
+
+ fn promptOf(srv: *Server, cx: *Cx, sp: api.SpeechInfo, input: []const u8, refs: []const @import("drama_prompt").Reference) errors.Refused!struct { prompt: []const u32, frames: ?[]const [11]i32 = null, reference_rows: u32 = 0 } {
+@@ -180,11 +184,11 @@ fn synthesize(srv: *Server, c: *Conn, cx: *Cx, id: []const u8, sp: api.SpeechInf
+ .frames = frames,
+ .pcm = pcm,
+ .result = &result,
+- .seed = plan.seed,
++ .seed = plan.sampling.seedFor(plan.prompt, srv.config.seed_salt, 0),
+ .max_frames = sp.max_frames,
+- .temperature = drama_prompt.temperature,
+- .top_p = drama_prompt.top_p,
+- .top_k = drama_prompt.top_k,
++ .temperature = plan.sampling.temperature,
++ .top_p = plan.sampling.top_p,
++ .top_k = plan.sampling.top_k,
+ .stream = plan.stream,
+ .reference_rows = plan.reference_rows,
+ };
+@@ -253,7 +257,7 @@ fn redraw(srv: *Server, c: *Conn, cx: *Cx, id: []const u8, sp: api.SpeechInfo, p
+ const preserved = if (held) |h| h.pcm.ptr else take.pcm.ptr;
+ next.pcm = if (preserved == first.pcm.ptr) spare.* else first.pcm;
+ next.result = &result;
+- next.seed = api.seedFor(next.prompt, srv.config.seed_salt +% @as(i64, @intCast(k)));
++ next.seed = plan.sampling.seedFor(next.prompt, srv.config.seed_salt, k);
+ var box: Mailbox = .{ .io = srv.io, .gpa = srv.gpa };
+ defer box.deinit();
+ const engine_id = srv.next_id.fetchAdd(1, .monotonic);
+@@ -555,7 +559,6 @@ test "fields: unknown ones are refused even when null, modifiers when set" {
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream\": \"yes\"}", "stream must be a boolean" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream_format\": \"sse\"}", "stream_format sse is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"stream_format\": \"mp3\"}", "stream_format must be one of: audio, sse" },
+- .{ "{\"model\": \"m\", \"input\": \"hi\", \"temperature\": 0.7}", "temperature is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": \"hi\", \"ref_audio\": \"x.wav\"}", "ref_audio is not supported by this model" },
+ .{ "{\"model\": \"m\", \"input\": 3}", "input must be a string" },
+ .{ "{\"model\": null, \"input\": \"hi\"}", "model must be a string" },
+diff --git a/zig/src/server/speech_register_test.zig b/zig/src/server/speech_register_test.zig
+index 38018541..aa613443 100644
+--- a/zig/src/server/speech_register_test.zig
++++ b/zig/src/server/speech_register_test.zig
+@@ -166,6 +166,34 @@ test "the register guard measures the take silence redraws leave, and off sends
+ try expectSent(a, &.{ high, flat }, &.{}, .{}, "X-Deadline-S: soon\r\n", 0, 1);
+ }
+
++test "speech sampling: silence then register redraws retain parameters and advance the explicit seed" {
++ var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
++ defer arena.deinit();
++ const a = arena.allocator();
++ const high = try tones(a, 44100, &reply(130, 330));
++ const flat = try tones(a, 44100, &reply(130, 127));
++ const n = [_]usize{flat.len};
++ var script: harness.Script = .{ .steps = &n, .audio = &.{ flat, high, flat }, .reasons = &.{ .silence, .stop, .stop }, .max_frames = @intCast(n[0] / harness.frame + 1), .inline_ = true };
++ var s: harness.Served = undefined;
++ const cfg: @import("root.zig").Config = .{ .served_name = "m", .model_ids = &.{"m"}, .redraw = .{ .max = 1, .register = rule } };
++ const body = "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8,\"seed\":9007199254740993}";
++ try s.open(&script, cfg, "", "HTTP/1.1", body, 2000);
++ defer s.deinit();
++ {
++ defer s.join(&script);
++ _ = try s.readHead();
++ _ = try s.readRest();
++ }
++ try harness.expectHeader(s.got.items, "HTTP/1.1 200");
++ try harness.expectHeader(s.got.items, "X-Silence-Redraws: 1");
++ try harness.expectHeader(s.got.items, "X-Register-Redraws: 1");
++ try std.testing.expectEqual(@as(usize, 3), script.takes);
++ for (0..script.takes) |k| {
++ try std.testing.expectEqual(@as(u64, 9007199254740993) + k, script.seeds[k]);
++ try std.testing.expectEqualDeep(harness.Sampling{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, script.sampling[k]);
++ }
++}
++
+ test "register metadata counts admission not selection and latches trips even without budget" {
+ var arena: std.heap.ArenaAllocator = .init(std.testing.allocator);
+ defer arena.deinit();
+diff --git a/zig/src/server/speech_sampling.zig b/zig/src/server/speech_sampling.zig
+new file mode 100644
+index 00000000..ef0d7777
+--- /dev/null
++++ b/zig/src/server/speech_sampling.zig
+@@ -0,0 +1,57 @@
++//! Request-local Drama sampling, checked before a speech request reaches the engine.
++const std = @import("std");
++const api = @import("engine_api");
++const Value = @import("json").Value;
++const errors = @import("errors.zig");
++const defaults = @import("drama_prompt.zig");
++
++pub const Options = struct {
++ temperature: f32 = defaults.temperature,
++ top_p: f32 = defaults.top_p,
++ top_k: u32 = defaults.top_k,
++ seed: ?u64 = null,
++
++ pub fn seedFor(o: Options, prompt: []const u32, salt: i64, attempt: usize) u64 {
++ if (o.seed) |seed| return seed +% @as(u64, @intCast(attempt));
++ return api.seedFor(prompt, salt +% @as(i64, @intCast(attempt)));
++ }
++};
++
++pub fn isField(key: []const u8) bool {
++ for ([_][]const u8{ "temperature", "top_p", "top_k", "seed" }) |name|
++ if (std.mem.eql(u8, key, name)) return true;
++ return false;
++}
++
++pub fn parse(cx: *errors.Cx, body: Value) errors.Refused!Options {
++ var out: Options = .{};
++ if (body.field("temperature")) |value|
++ out.temperature = try number(cx, value, std.math.floatMax(f32), "temperature must be a finite nonnegative f32 number");
++ if (body.field("top_p")) |value| {
++ out.top_p = try number(cx, value, 1, "top_p must be a finite f32 number greater than 0 and at most 1");
++ if (out.top_p == 0) return cx.refuse("top_p must be greater than 0");
++ }
++ if (body.field("top_k")) |value| {
++ const message = "top_k must be an integer from 1 through 64";
++ if (value != .int) return cx.refuse(message);
++ const n = std.fmt.parseInt(u32, value.int, 10) catch return cx.refuse(message);
++ if (n == 0 or n > 64) return cx.refuse(message);
++ out.top_k = n;
++ }
++ if (body.field("seed")) |value| {
++ const message = "seed must be an integer from 0 through 18446744073709551615";
++ if (value != .int) return cx.refuse(message);
++ out.seed = std.fmt.parseInt(u64, value.int, 10) catch return cx.refuse(message);
++ }
++ return out;
++}
++
++/// Check the JSON range before narrowing, then reject positive values that would become zero.
++fn number(cx: *errors.Cx, value: Value, max: f64, message: []const u8) errors.Refused!f32 {
++ if (value != .int and value != .float) return cx.refuse(message);
++ const n = value.float64() orelse return cx.refuse(message);
++ if (!std.math.isFinite(n) or n < 0 or n > max) return cx.refuse(message);
++ const narrowed: f32 = @floatCast(n);
++ if (n > 0 and narrowed == 0) return cx.refuse(message);
++ return narrowed;
++}
+diff --git a/zig/src/server/speech_sampling_test.zig b/zig/src/server/speech_sampling_test.zig
+new file mode 100644
+index 00000000..7d7b3212
+--- /dev/null
++++ b/zig/src/server/speech_sampling_test.zig
+@@ -0,0 +1,140 @@
++//! Speech sampling controls through the HTTP route and its scripted engine.
++const std = @import("std");
++const api = @import("engine_api");
++const server = @import("root.zig");
++const harness = @import("speech_stream_test.zig");
++const drama_prompt = @import("drama_prompt.zig");
++const drama_allow = @import("drama_allow.zig");
++const gpa = std.testing.allocator;
++const config: server.Config = .{ .served_name = "m", .model_ids = &.{"m"}, .seed_salt = 17 };
++const defaults: harness.Sampling = .{ .temperature = 1, .top_p = 0.9, .top_k = 30 };
++
++fn exchange(script: *harness.Script, cfg: server.Config, body: []const u8) ![]u8 {
++ var s: harness.Served = undefined;
++ try s.open(script, cfg, "", "HTTP/1.1", body, 2000);
++ defer s.deinit();
++ defer s.join(script);
++ _ = try s.readHead();
++ _ = try s.readRest();
++ return gpa.dupe(u8, s.got.items);
++}
++
++fn promptSeed(text: []const u8, attempt: i64) !u64 {
++ var arena: std.heap.ArenaAllocator = .init(gpa);
++ defer arena.deinit();
++ var bytes: harness.Bytes = .{};
++ const prompt = try drama_prompt.encode(arena.allocator(), bytes.text(), text);
++ return api.seedFor(prompt, config.seed_salt +% attempt);
++}
++
++fn expectDraw(script: *const harness.Script, index: usize, sampling: harness.Sampling, seed: u64) !void {
++ try std.testing.expectEqualDeep(sampling, script.sampling[index]);
++ try std.testing.expectEqual(seed, script.seeds[index]);
++}
++
++test "speech sampling: omitted and null controls retain default parameters and PCM" {
++ const bodies = [_][]const u8{
++ "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\"}",
++ "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"temperature\":null,\"top_p\":null,\"top_k\":null,\"seed\":null}",
++ };
++ var first: ?[]u8 = null;
++ defer if (first) |pcm| gpa.free(pcm);
++ for (bodies) |body| {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true };
++ const reply = try exchange(&script, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 1), script.takes);
++ try expectDraw(&script, 0, defaults, try promptSeed("hi", 0));
++ const pcm = reply[(std.mem.indexOf(u8, reply, "\r\n\r\n").? + 4)..];
++ if (first) |before| try std.testing.expectEqualSlices(u8, before, pcm) else first = try gpa.dupe(u8, pcm);
++ }
++}
++
++test "speech sampling: custom parameters and exact integer seeds reach whole and streamed requests" {
++ const cases = [_]struct { fields: []const u8, sampling: harness.Sampling, seed: u64 }{
++ .{ .fields = "\"temperature\":1.25,\"top_p\":0.8,\"top_k\":64,\"seed\":9007199254740993", .sampling = .{ .temperature = 1.25, .top_p = 0.8, .top_k = 64 }, .seed = 9007199254740993 },
++ .{ .fields = "\"temperature\":0,\"top_p\":1,\"top_k\":1,\"seed\":0", .sampling = .{ .temperature = 0, .top_p = 1, .top_k = 1 }, .seed = 0 },
++ .{ .fields = "\"seed\":18446744073709551615", .sampling = defaults, .seed = std.math.maxInt(u64) },
++ .{ .fields = "\"temperature\":0.5", .sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ .{ .fields = "\"temperature\":3.4028234663852886e38,\"top_p\":1e-45", .sampling = .{ .temperature = std.math.floatMax(f32), .top_p = 1e-45, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ };
++ for (cases) |case| for ([_]bool{ false, true }) |stream| {
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"stream\":{s},{s}}}", .{ if (stream) "true" else "false", case.fields });
++ defer gpa.free(body);
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true };
++ const reply = try exchange(&script, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ if (stream) try harness.expectHeader(reply, "Transfer-Encoding: chunked");
++ try std.testing.expectEqual(@as(usize, 1), script.takes);
++ try expectDraw(&script, 0, case.sampling, case.seed);
++ };
++}
++
++test "speech sampling: invalid controls fail before any engine submission" {
++ const fields = [_][]const u8{
++ "\"temperature\":true", "\"temperature\":\"1\"", "\"temperature\":[]", "\"temperature\":{}",
++ "\"temperature\":-1", "\"temperature\":NaN", "\"temperature\":Infinity", "\"temperature\":1e39",
++ "\"temperature\":1e-100", "\"top_p\":false", "\"top_p\":\"0.9\"", "\"top_p\":0",
++ "\"top_p\":-0.1", "\"top_p\":1.00000001", "\"top_p\":NaN", "\"top_p\":1e-100",
++ "\"top_p\":Infinity", "\"top_k\":true", "\"top_k\":\"30\"", "\"top_k\":1.5",
++ "\"top_k\":30.0", "\"top_k\":0", "\"top_k\":-1", "\"top_k\":65",
++ "\"top_k\":18446744073709551616", "\"seed\":true", "\"seed\":\"1\"", "\"seed\":1.5",
++ "\"seed\":1.0", "\"seed\":-1", "\"seed\":18446744073709551616", "\"seed\":NaN",
++ };
++ for (fields) |field| {
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",{s}}}", .{field});
++ defer gpa.free(body);
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true };
++ const reply = try exchange(&script, config, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 400");
++ try std.testing.expectEqual(@as(usize, 0), script.takes);
++ }
++}
++
++test "speech sampling: references and re-prompts retain overrides and wrap explicit retry seeds" {
++ const codes = [_][10]i32{.{ 7, 1, 2, 3, 4, 5, 6, 7, 8, 9 }};
++ const refs = [_]@import("drama_prompt").Reference{.{ .transcript = "A small cloud passes.", .codes = &codes }};
++ const voices = [_]@import("drama_voice.zig").Voice{.{ .name = "tone", .references = &refs }};
++ var cfg = config;
++ cfg.redraw = .{ .max = 2, .controls = try drama_allow.parse("sighs") };
++ for ([_]bool{ false, true }) |referenced| {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true, .reasons = &.{ .silence, .silence, .stop }, .voices = &voices };
++ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi [sighs] [laughs] there\",\"voice\":\"{s}\",\"temperature\":0.5,\"top_p\":0.75,\"top_k\":8,\"seed\":18446744073709551615}}", .{if (referenced) "tone" else "default"});
++ defer gpa.free(body);
++ const reply = try exchange(&script, cfg, body);
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 3), script.takes);
++ for ([_]u64{ std.math.maxInt(u64), 0, 1 }, 0..) |seed, k|
++ try expectDraw(&script, k, .{ .temperature = 0.5, .top_p = 0.75, .top_k = 8 }, seed);
++ try std.testing.expectEqual(referenced, script.reference_rows[0] > 0);
++ }
++}
++
++test "speech sampling: no seed keeps prompt-keyed redraws after stripping controls" {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true, .reasons = &.{ .silence, .stop } };
++ var cfg = config;
++ cfg.redraw = .{ .max = 1, .controls = try drama_allow.parse("sighs") };
++ const reply = try exchange(&script, cfg, "{\"model\":\"m\",\"input\":\"hi [sighs] [laughs] there\",\"temperature\":0.5}");
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try std.testing.expectEqual(@as(usize, 2), script.takes);
++ const sampling: harness.Sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 };
++ try expectDraw(&script, 0, sampling, try promptSeed("hi [sighs] [laughs] there", 0));
++ try expectDraw(&script, 1, sampling, try promptSeed("hi [sighs] there", 1));
++}
++
++test "speech sampling: a silenced stream retains controls and does not redraw" {
++ var script: harness.Script = .{ .steps = &.{harness.frame}, .inline_ = true, .reason = .silence };
++ var cfg = config;
++ cfg.redraw = .{ .max = 2 };
++ const reply = try exchange(&script, cfg, "{\"model\":\"m\",\"input\":\"hi\",\"response_format\":\"pcm\",\"stream\":true,\"temperature\":0.5,\"seed\":2}");
++ defer gpa.free(reply);
++ try harness.expectHeader(reply, "HTTP/1.1 200");
++ try harness.expectHeader(reply, "X-Finish-Reason: silence");
++ try std.testing.expectEqual(@as(usize, 1), script.takes);
++ try expectDraw(&script, 0, .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, 2);
++}
+diff --git a/zig/src/server/speech_stream_test.zig b/zig/src/server/speech_stream_test.zig
+index 9ee6f225..84467565 100644
+--- a/zig/src/server/speech_stream_test.zig
++++ b/zig/src/server/speech_stream_test.zig
+@@ -9,6 +9,7 @@ const Conn = @import("http_conn.zig").Conn;
+
+ pub const frame = 2048;
+ const gpa = std.testing.allocator;
++pub const Sampling = struct { temperature: f32, top_p: f32, top_k: u32 };
+
+ /// Publishes steps of 0.5 / (take + 1), then finishes: inside submit (`inline_`), else on a thread that may `hold`.
+ pub const Script = struct {
+@@ -37,6 +38,7 @@ pub const Script = struct {
+ expected_rows: ?[]const [11]i32 = null,
+ rows_equal: bool = false,
+ seeds: [4]u64 = undefined,
++ sampling: [4]Sampling = undefined,
+ reference_rows: [4]u32 = undefined,
+ takes: usize = 0,
+
+@@ -57,6 +59,7 @@ pub const Script = struct {
+ }
+ const take = e.takes;
+ e.seeds[take] = request.seed;
++ e.sampling[take] = .{ .temperature = request.temperature, .top_p = request.top_p, .top_k = request.top_k };
+ e.reference_rows[take] = request.reference_rows;
+ e.takes += 1;
+ if (e.inline_) return run(e, id, request, sink, take);
+diff --git a/zig/src/server/speech_unmeasured_test.zig b/zig/src/server/speech_unmeasured_test.zig
+index 0ffbd52c..23a47807 100644
+--- a/zig/src/server/speech_unmeasured_test.zig
++++ b/zig/src/server/speech_unmeasured_test.zig
+@@ -29,7 +29,7 @@ pub fn check(comptime redraw: anytype) !void {
+ capture.len = 0;
+ var pcm = [_]f32{sample};
+ var metadata: Metadata = .{ .enabled = false, .register_on = true };
+- const take = redraw(&srv, &conn, &cx, "register-test", .{ .sample_rate = 44100, .frame_length = 2048, .max_frames = 1024, .max_prompt_tokens = 4096 }, .{ .input = "hi", .prompt = &.{}, .seed = 0, .format = .pcm, .stream = false }, 0, undefined, 0, .{ .pcm = &pcm, .reason = .stop }, &spare, &metadata).?;
++ const take = redraw(&srv, &conn, &cx, "register-test", .{ .sample_rate = 44100, .frame_length = 2048, .max_frames = 1024, .max_prompt_tokens = 4096 }, .{ .input = "hi", .prompt = &.{}, .sampling = .{ .seed = 0 }, .format = .pcm, .stream = false }, 0, undefined, 0, .{ .pcm = &pcm, .reason = .stop }, &spare, &metadata).?;
+ try std.testing.expect(take.jump == null);
+ try std.testing.expect(take.pcm.ptr == &pcm);
+ try std.testing.expect(!metadata.register_tripped and !metadata.register_redrawn);
+--
+2.46.0
+
diff --git a/engine/patches/0014-sampling-json-boundaries.patch b/engine/patches/0014-sampling-json-boundaries.patch
new file mode 100644
index 0000000..8af3d25
--- /dev/null
+++ b/engine/patches/0014-sampling-json-boundaries.patch
@@ -0,0 +1,90 @@
+From 1c31b4d2567b6bbca7ac1b394f17566ca3c05488 Mon Sep 17 00:00:00 2001
+From: Mauvis Ledford <20738+krunkosaurus@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 11:54:45 +0800
+Subject: [PATCH] tests: cover parsed JSON sampling float boundaries
+
+---
+ docs/speech-sampling.md | 7 +++++++
+ zig/src/server/speech_sampling.zig | 2 +-
+ zig/src/server/speech_sampling_test.zig | 27 +++++++++++++++++--------
+ 3 files changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/docs/speech-sampling.md b/docs/speech-sampling.md
+index b60515c9..29f6474e 100644
+--- a/docs/speech-sampling.md
++++ b/docs/speech-sampling.md
+@@ -17,6 +17,13 @@ use integer JSON syntax: `30.0` and `1e3` are refused. Seeds are parsed as exact
+ whose JSON number type loses precision must preserve the integer when encoding
+ the request. Invalid fields return HTTP 400 before submission to the engine.
+
++For `temperature` and `top_p`, the JSON parser first produces an `f64` value;
++the bounds above apply to that value and its conversion to `f32`. Extremely
++small floating literals such as `1e-400` and `-1e-400` already become zero in
++that parser, so both request temperature 0; they are refused for `top_p`.
++A positive parsed value such as `1e-100` is refused if it becomes zero only
++when narrowed to `f32`.
++
+ ```sh
+ curl http://127.0.0.1:8080/v1/audio/speech \
+ -H 'Content-Type: application/json' \
+diff --git a/zig/src/server/speech_sampling.zig b/zig/src/server/speech_sampling.zig
+index ef0d7777..ca9b5320 100644
+--- a/zig/src/server/speech_sampling.zig
++++ b/zig/src/server/speech_sampling.zig
+@@ -46,7 +46,7 @@ pub fn parse(cx: *errors.Cx, body: Value) errors.Refused!Options {
+ return out;
+ }
+
+-/// Check the JSON range before narrowing, then reject positive values that would become zero.
++/// Check the parsed f64 range before narrowing, then reject positive values that would become zero.
+ fn number(cx: *errors.Cx, value: Value, max: f64, message: []const u8) errors.Refused!f32 {
+ if (value != .int and value != .float) return cx.refuse(message);
+ const n = value.float64() orelse return cx.refuse(message);
+diff --git a/zig/src/server/speech_sampling_test.zig b/zig/src/server/speech_sampling_test.zig
+index 7d7b3212..8029a75d 100644
+--- a/zig/src/server/speech_sampling_test.zig
++++ b/zig/src/server/speech_sampling_test.zig
+@@ -57,6 +57,8 @@ test "speech sampling: custom parameters and exact integer seeds reach whole and
+ .{ .fields = "\"temperature\":0,\"top_p\":1,\"top_k\":1,\"seed\":0", .sampling = .{ .temperature = 0, .top_p = 1, .top_k = 1 }, .seed = 0 },
+ .{ .fields = "\"seed\":18446744073709551615", .sampling = defaults, .seed = std.math.maxInt(u64) },
+ .{ .fields = "\"temperature\":0.5", .sampling = .{ .temperature = 0.5, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ .{ .fields = "\"temperature\":1e-400", .sampling = .{ .temperature = 0, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
++ .{ .fields = "\"temperature\":-1e-400", .sampling = .{ .temperature = -0.0, .top_p = 0.9, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
+ .{ .fields = "\"temperature\":3.4028234663852886e38,\"top_p\":1e-45", .sampling = .{ .temperature = std.math.floatMax(f32), .top_p = 1e-45, .top_k = 30 }, .seed = try promptSeed("hi", 0) },
+ };
+ for (cases) |case| for ([_]bool{ false, true }) |stream| {
+@@ -74,14 +76,23 @@ test "speech sampling: custom parameters and exact integer seeds reach whole and
+
+ test "speech sampling: invalid controls fail before any engine submission" {
+ const fields = [_][]const u8{
+- "\"temperature\":true", "\"temperature\":\"1\"", "\"temperature\":[]", "\"temperature\":{}",
+- "\"temperature\":-1", "\"temperature\":NaN", "\"temperature\":Infinity", "\"temperature\":1e39",
+- "\"temperature\":1e-100", "\"top_p\":false", "\"top_p\":\"0.9\"", "\"top_p\":0",
+- "\"top_p\":-0.1", "\"top_p\":1.00000001", "\"top_p\":NaN", "\"top_p\":1e-100",
+- "\"top_p\":Infinity", "\"top_k\":true", "\"top_k\":\"30\"", "\"top_k\":1.5",
+- "\"top_k\":30.0", "\"top_k\":0", "\"top_k\":-1", "\"top_k\":65",
+- "\"top_k\":18446744073709551616", "\"seed\":true", "\"seed\":\"1\"", "\"seed\":1.5",
+- "\"seed\":1.0", "\"seed\":-1", "\"seed\":18446744073709551616", "\"seed\":NaN",
++ "\"top_p\":1e-400", "\"top_p\":-1e-400",
++ "\"temperature\":true", "\"temperature\":\"1\"",
++ "\"temperature\":[]", "\"temperature\":{}",
++ "\"temperature\":-1", "\"temperature\":NaN",
++ "\"temperature\":Infinity", "\"temperature\":1e39",
++ "\"temperature\":1e-100", "\"top_p\":false",
++ "\"top_p\":\"0.9\"", "\"top_p\":0",
++ "\"top_p\":-0.1", "\"top_p\":1.00000001",
++ "\"top_p\":NaN", "\"top_p\":1e-100",
++ "\"top_p\":Infinity", "\"top_k\":true",
++ "\"top_k\":\"30\"", "\"top_k\":1.5",
++ "\"top_k\":30.0", "\"top_k\":0",
++ "\"top_k\":-1", "\"top_k\":65",
++ "\"top_k\":18446744073709551616", "\"seed\":true",
++ "\"seed\":\"1\"", "\"seed\":1.5",
++ "\"seed\":1.0", "\"seed\":-1",
++ "\"seed\":18446744073709551616", "\"seed\":NaN",
+ };
+ for (fields) |field| {
+ const body = try std.fmt.allocPrint(gpa, "{{\"model\":\"m\",\"input\":\"hi\",{s}}}", .{field});
+--
+2.46.0
+
diff --git a/engine/patches/README.md b/engine/patches/README.md
index 6a1f7bb..fb717c8 100644
--- a/engine/patches/README.md
+++ b/engine/patches/README.md
@@ -14,6 +14,10 @@ engine loads are under the Fish Audio Community License v1.0 and are downloaded
Linux `--weights nvfp4` uses the separate [CUDA NVFP4 series](../nvfp4/patches/README.md).
All profiles require an exact manifest-to-patch match before applying anything.
+Full-model patches 0013/0014 add [request sampling controls](../../recipe/README-sampling.md)
+and document the existing JSON floating-point boundary. They backport
+[TensorFold #1277](https://github.com/ashhart/TensorFold/pull/1277) without moving the pin.
+
Patch 0012 is corrected in place: it owns one reusable Metal recurrent-state snapshot per lane,
invalidates incompatible live KV before prefill, and uses the prompt builder's exact invariant
boundary including tower lookahead. It preserves uncached chunk cuts and CUDA execution.
@@ -32,6 +36,8 @@ It does not change the full-model series above or the CUDA NVFP4 pin.
| [`0001-drama3-metal-nvfp4-cfg.patch`](../nvfp4/macos/patches/0001-drama3-metal-nvfp4-cfg.patch) | Packed NVFP4 experts, compact routing, native reference CFG and registered numerical contracts | [TensorFold #1268](https://github.com/ashhart/TensorFold/pull/1268) |
| [`0002-shared-gate-stress-regression.patch`](../nvfp4/macos/patches/0002-shared-gate-stress-regression.patch) | Test-only correction that distinguishes reduced-precision accumulation after sigmoid; no kernel or tolerance change | [TensorFold #1268](https://github.com/ashhart/TensorFold/pull/1268) |
| [`0003-shared-cli-extension-point.patch`](../nvfp4/macos/patches/0003-shared-cli-extension-point.patch) | Group CFG flags beside voice selection without occupying shared CLI-table extension points; no parsing or numerical change | [TensorFold #1268](https://github.com/ashhart/TensorFold/pull/1268) |
+| [`0004-speech-sampling-controls.patch`](../nvfp4/macos/patches/0004-speech-sampling-controls.patch) | Request sampling parameters and exact seeds, retaining CFG rows | [TensorFold #1277](https://github.com/ashhart/TensorFold/pull/1277) |
+| [`0005-sampling-json-boundaries.patch`](../nvfp4/macos/patches/0005-sampling-json-boundaries.patch) | Parsed-JSON floating boundary documentation and regressions | [TensorFold #1277](https://github.com/ashhart/TensorFold/pull/1277) |
The [Mac qualification receipt](../../results/macos-nvfp4.json) separates observed GPU/model results,
the initial failed fixture and focused correction, and the final CPU-only CLI integration build.
diff --git a/engine/patches/SHA256SUMS b/engine/patches/SHA256SUMS
index 40e7b54..fe92a6c 100644
--- a/engine/patches/SHA256SUMS
+++ b/engine/patches/SHA256SUMS
@@ -10,3 +10,5 @@ a1289601a1aeccd57354320f55d6563108d40a5a048596760f8498b0cc375773 0008-feat-spee
db1a8e4bdf817ab7d92e4635453075d8ea31a0d40537dcda8ccc9bec456a69cf 0010-feat-speech-redraw-whole-replies-that-stopped-short-.patch
0bb2318e54fe7df3355b981b08c4098b3185c58a955366dccf530f93e21a11a8 0011-feat-speech-redraw-a-whole-reply-once-when-a-phrase-.patch
562b63cbae92fe004ad1ab07ea791e1f3b212c2d7d71df40898257df7ad829f8 0012-feat-drama3-reuse-a-voice-reference-s-prefill-across.patch
+b686340bc1fc0bccabdf6089bcea697ac4fee7741829fb6ffb49b3d0f15b9ab7 0013-speech-sampling-controls.patch
+3e0855a714dc5b705bed956937a9d0eac272f76a0d03021243e7aab5d1c8f753 0014-sampling-json-boundaries.patch
diff --git a/recipe/README-sampling.md b/recipe/README-sampling.md
new file mode 100644
index 0000000..6ccb238
--- /dev/null
+++ b/recipe/README-sampling.md
@@ -0,0 +1,57 @@
+# Per-request speech sampling
+
+All three pinned engine profiles accept `temperature`, `top_p`, `top_k` and `seed`
+on `POST /v1/audio/speech`, for whole and streamed responses. For example:
+
+```json
+{
+ "model": "fishaudio/drama-3",
+ "input": "The train leaves at seven fifteen.",
+ "response_format": "pcm",
+ "temperature": 0.8,
+ "top_p": 0.9,
+ "top_k": 30,
+ "seed": 42
+}
+```
+
+| Field | Accepted values | Omitted or `null` |
+|---|---|---|
+| `temperature` | Finite nonnegative number representable by the native `f32` sampler | `1.0` |
+| `top_p` | Finite number in `(0, 1]` that remains positive as `f32` | `0.9` |
+| `top_k` | JSON integer from 1 through 64 | `30` |
+| `seed` | JSON integer from 0 through 18446744073709551615 | Existing prompt-derived seed |
+
+Booleans, numeric strings, fractional integer fields and out-of-range values are
+refused before submitting to the engine. Seeds are parsed as integers without a
+floating-point conversion. Clients that cannot represent all 64-bit integers
+exactly should use a smaller seed, such as the example above.
+
+Floating fields are validated after the existing JSON parser converts them to
+`f64`. Extremely small decimals such as `1e-400` and `-1e-400` become zero there:
+both request temperature 0, while both are refused for `top_p`. A positive
+parsed value such as `1e-100` is refused when narrowing to `f32` would make it zero.
+
+An explicit seed is used unchanged for the first take. Redraws add the attempt
+number with unsigned 64-bit wraparound. The selected sampling parameters survive
+reference-prompt rebuilding and silence/register redraws. Without an explicit
+seed, prompt-derived seeding retains its existing behavior.
+
+Legacy CUDA long-form requests apply that policy separately to each segment:
+each segment starts with the supplied seed, and retries within that segment add
+their attempt number. Omitted seeds continue to hash each segment's own prompt.
+
+The HTTP limit of 64 for `top_k` is shared across the CUDA and Metal profiles.
+Sampling still uses each engine's native algorithm, including its existing
+repetition-aware behavior. Equal settings do not promise equal audio across
+backends, checkpoints or engine versions. The full-model and Metal NVFP4 profiles
+use their native greedy path for zero temperature or `top_k: 1`; the legacy CUDA
+profile retains its existing repetition-aware sampler.
+
+The public [Sogni-AI/drama3-mlx API](https://github.com/Sogni-AI/drama3-mlx/blob/ecc235039ccd5f982f66a6982184f57432354ab4/drama3_mlx/model.py#L79)
+is the behavioral reference for exposing these controls. These patches are
+independent native Zig implementations; no Python inference dependency is added.
+
+CPU regressions exercise validation and the values actually submitted through
+the HTTP route. Device/model determinism and audio-quality qualification are
+separate checks; this change makes no performance or quality claim.
From fe92285bf323ced76920e7379130914a331d2697 Mon Sep 17 00:00:00 2001
From: plotarmordev <299844489+plotarmordev@users.noreply.github.com>
Date: Sun, 25 Oct 2026 17:11:03 +0800
Subject: [PATCH 5/5] README: list request sampling fields as a flag-free
exception
Restore the "answers as upstream does without flags" rule for the
full-model patches and state the per-request temperature, top_p, top_k
and seed fields from this PR (0013/0014, CUDA 0002, Metal 0004/0005) as
the request-level exception: they need no launch flag, and requests
without them are unchanged.
---
README.md | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/README.md b/README.md
index 3440f74..c3dc9e8 100644
--- a/README.md
+++ b/README.md
@@ -159,9 +159,14 @@ See the [CUDA patch index](engine/nvfp4/patches/README.md) for scope and tests.
### Full-model engine
-These patches build the full-model engine (`--weights full`) and apply in order.
-The table lists each feature's activation; HTTP sampling fields need no additional
-launch flag. Each patch's notes are in the engine tree's `CHANGELOG.md` or `docs/`.
+These patches build the full-model engine (`--weights full`). Upstream TensorFold already serves Drama 3. Each patch
+below adds one feature that stays off until you pass its flag, so a server started without them answers as
+upstream does. The exceptions are the first two and one request-level feature: batched prefill is on by default
+(`TF_DRAMA_PREFILL_ROWS=1` restores upstream's single-row prefill), the replay fix is a bug fix, and per-request
+`temperature`, `top_p`, `top_k` and `seed` (0013/0014) need no launch flag. A request without those fields is
+answered as upstream answers it; upstream refuses them with a 400, and these patches serve them. The CUDA NVFP4
+series (0002) and the Metal NVFP4 series (0004, 0005) carry the same request-level feature. The patches stack and
+apply in order; each one's notes are in the engine tree's `CHANGELOG.md` or `docs/`.
| Patch | Adds | Opt in with | Upstream |
|---|---|---|---|