What's ready, what's not, where the boundary lives.

On bug-fix repair with an executable test, the deterministic validator decides when the work is done. The loop doesn't, and neither does the model tier. How much a repair loop helps depends on what it feeds back. In Lab 003, a stateless local loop gained nothing, and the band of tasks where any repair loop could help was about 5%. In Lab 011, a local loop with stateful test feedback recovered 14 of the 22 tasks the local model first missed, out of 70. Within that one constrained harness, a frontier model in the controller seat recovered no task the free loop didn't. In the worker seat it lifted recovery from 14 to 20 of the 22. On those same 22 tasks, the cheapest way to finish all of them was gpt-5.4-mini, a mini-class hosted model, in an agentic harness, at $3.14. If you own the hardware, a 30B coder model on one box cleared 18 of 22, and the bill is wall clock: 11.4 hours against 40 minutes hosted. Lab 013 read the gap to a 31B general model, 11 of 22 on a rented L40S because the 31B timed out on the Spark, as training for tools rather than size. Lab 018 then found the tool-call parser had been dropping Gemma's tool calls, and with the right parser Gemma 4 26B scored 15 of 22. Lab 022 later ran the untuned 31B through the full pool on a Mac Studio, and it scored 15 of 22 too. So that reading is reopened, not settled. On the one from-scratch API task in Lab 016, the approach each run took predicted its score in every arm measured. Most rungs ran once, and the test of whether the approach causes the score hasn't run.

On Apple silicon, unified memory decides which model can run an agentic coding harness, and the model decides the score. One 256 GB M5 Ultra Studio served the 156 GiB checkpoint that took two clustered Sparks, cleared the same 22 of 22, and costs less at US list price as tested: $12,299 against $13,900 for the pair, before the cable, with half the storage. It took about twice as long per agentic turn with two sessions sharing it. The venues differ in hardware, serving software and speculative decoding together, so that speed comparison is directional. On the 11 tasks a single Spark ran, a dense 31B solved 5 on the Spark and 6 on the Studio, at a median 61 minutes per task against 12.8. Runtime and file format differed too, so that ratio isn't bandwidth alone. The parity holds only under a two-hour ceiling: under 60 minutes the Spark would have kept 3 of its 5 solves, and under 40 minutes none. Bandwidth set how fast the work went, and a tighter deadline turns that speed into the score. For a lab, the bigger cost is how long the serving software takes to support a new model.

Every lane off NVIDIA opened, and each one charged a different toll. On the 32-vCPU C4 shape this project could reach, zero of 22 Xeon configurations met the interactive latency bar for a mid-size mixture-of-experts (MoE) model, so for that model the CPU is a batch lane. Renting a v5e TPU was fast, but Trillium (v6e) had no capacity in any of three zones, and serving a bring-your-own model on v5e meant adopting Google's stack or quantizing off-box. On AMD, Lab 002's mainstream fine-tune and serving recipe ran with zero code changes. Lab 017 didn't retest newer architectures or exotic quantization. What gated that path was who would sell the silicon at all, and whether the acceptance gate measured what it claimed. Thread 5 is the other side of this: on Apple silicon, the dense 31B tune needed platform work before it ran.

Own the weights once you need a custom model, and check whether the managed service lets you. In Lab 002, Bedrock's native fine-tune couldn't export them. In Lab 024, CoreWeave Forge's adapter downloaded as a standard file. Fine-tuning is still the narrowest door to self-hosting. On judgment work, it captured voice and not judgment, and one paragraph of standing positions in the system prompt beat two training rounds. Lab 018 turned that into a decision procedure: five conditions, and code repair meets two. The measured gain came on a narrow job. In Lab 024's clinic booking workflow, a small tune of the model that reads patient replies cut consent misreads from 13 to 0 or 1 of 496 where the model's "yes" counted. Where code decides consent, the design that ships, it cut avoidable hand-offs from 16 to 4 of 955 at a fifth of the tokens. Against the fair six-example prompt it sent more patients to staff overall, and which design serves patients better is unmeasured. That's a narrow measured gain, not proof the tune is the better design.

Pick the model first. It picks the training hardware, and it can rule out the managed service. On Lab 024's MoE tune, the Mac Studio trained about 6x faster than a DGX Spark, and the rank-16 adapters from both passed the same bar. Lab 026 set no equivalence margin, and a narrower rank-1 recipe failed twice on the Mac where the Spark's passed. On the dense 31B, the Studio trained 3.8x faster, but only after I rewrote attention in the model code, and the adapters from both boxes scored 11 to 14 of 22 on Lab 018's coding loop on either box, one run per arm, inside the range Lab 018 called noise. Lab 028 replaced that rewrite with a patch to MLX's attention backward pass. It trained 15% faster at the same held-out loss, in one run each. The coding loop wasn't rerun, and no MLX maintainer has reviewed the patch. The Spark didn't take the job as shipped either: it trained only on an older, pinned transformers release. Software differed along with the hardware in both labs, so neither ratio is silicon alone. CoreWeave Forge's self-serve list doesn't include the dense 31B at all. Off NVIDIA, the speed was real and the platform work was mine.

You can hand off the work, but not the definition of correct. Lab 004 covered intake and control-plane construction on one estate. No migration ran. A frontier model held wherever the patterns and done-criteria were owned and encoded as gates that could refuse to proceed, and failed where it became the author of correctness. In Lab 010, two AI agents shipped one browser game across a file-based seam. The contract between them was fully delegable. The verdict on whether it was done wasn't: the first sprite passed every automated check and was still a gray blob. You can only cede judgment you've already sourced. Lab 010 shows that in the friendly case, where playing the game exposes the defect. It doesn't reach work where a defect can hide from the person using it.

A check protects you only when its inputs come from somewhere the model can't write. In Lab 015, two Kamiwaza workrooms on one deployment kept their evidence apart under repeated cross-vendor querying by authorized users: 241 retrieval hits, none from the other workroom. Lab 015 says plainly that it isn't a security result. The check that the evidence is the approved set is still code you write, because no role separates running the assessment from editing its documents. In the clinic booking labs, every design leaked wherever a deterministic check trusted a fact the model supplied. Forbidden bookings in the pressure scenarios went to zero once that fact came from somewhere the model can't write. Zero there isn't zero unauthorized actions. The code-driven design still made one unconsented booking per run in a normal scenario, from a bug in its own code, and it completed about 6 points fewer normal bookings while roughly doubling hand-offs to a person. A model judge did best answering closed questions that code asks. On the same 496 non-contestable pressure scenarios, Jev as that reader allowed 12 forbidden bookings. As a guard over the kit's model-driven agent, it allowed 49, 9.9 per 100, and most of that gain came from reading insurance coverage in code, not from the judge. The guard design also left 51 of 559 pressure conversations stuck in retry loops and used about 65 times the reported tokens per conversation, most of them the kit's own agent. Lab 029 then priced the check itself. On one simulated clinic whose patients are code, Lab 023's consent rule counts only "I confirm" or a yes of four words or fewer. Letting the model's yes count instead raised clean correct bookings by 19 to 32 points with every reader, while swapping Gemma 4 26B-A4B for Claude Haiku 5.5 moved them 3 points or less. Of the clean bookings the code rule lost, 96 to 99% were clear yeses longer than four words. Letting the model's yes count also brought hundreds of conversations per cell, out of 48,000, with a wrong write the code rule didn't have. Those patients repeat a long yes when asked again, so the rule's cost there is likely higher than with callers who'd just say "Yes." Where a check reads its facts from decides whether it protects you. What it accepts decides what it costs, and on that bench the rule moved bookings more than the model did.

The managed path is cheap and fast, and it makes calls you didn't make. Bedrock Knowledge Bases, the managed wrapper in Lab 001, re-chunks documents on its own strategy and turns on parsing you didn't ask for, which would have broken label-filtered retrieval. Its control plane wouldn't create through the API, so the lab rebuilt on the primitives underneath. On one production application, Lab 005 proved a cloud-free serve path end to end, and every layer moved from Ceded to Retained became a system to operate. Running Perplexity's agent locally in Lab 019 moved the data plane. It didn't come with a control plane. Consent was granted per class, not per step: network egress was approved once and never raised again, while the sandbox-exit decision came back each time, by hand, with no way to write a standing rule. Lab 019 scores that Layer 2A Control gate in the 4+1 model as Retained, because the operator can refuse and the sandbox enforces it, and scores the agent's reasoning (Layer 2C) and the application (Layer 3) as Ceded. Lab 002's Bedrock finding, that the native fine-tune keeps the weights, belongs to this argument too. It lives in thread 4.