Module kernel_audit 

Startup kernel-resolution audit + embedded-kernel-set table.

Two halves, both printed once at model-load time:

1. The EMBEDDED kernel set — every (module, ptx) compiled into this binary, with a per-kernel PTX content hash and the overall kernel-set hash. The count here is ground truth (e.g. 98 vs 99 modules), and the hashes pin exactly which kernel binary is loaded — so a stale/dropped kernel from a build-codegen regression is visible at a glance.
2. The RESOLUTION audit — every GpuBackend::kernel(module, func) lookup, whether it resolved, and WHERE it was issued from. A MISSING optional kernel (try_kernel → handle 0) silently falls back to a slower dispatch path with no error; this surfaces it (see the 2026-06-04 pipelined-GEMM regression where w8a16_gemm_pipelined resolved to 0 and QKVZ fell back to the ~4.6× slower w8a16_gemm).

Every kernel lookup in Atlas is EAGER: each one sits in a constructor on the serve_phases::build_model path, so by the time the model is built the audit holds the COMPLETE (module, func) set this model asks for. That is what makes seal meaningful — after it, a lookup is by definition a late one, and a late MISS is a silent slow path nobody would ever see. Sealing turns the invariant from a belief into an assertion.

Structs

AuditRow

One deduped kernel-resolution row.

FailureSplit

The failed lookups, split by whether the operator must act.

Functions

audit_rows

Structured resolution rows for observers (log table, TUI kernel table, the boot gate): deduped (module, func), sorted, loaded true if ANY lookup of that pair resolved.

classify_failures

Split audit_rows’s failures against a target’s [expected_absent] declaration (TargetPtxSet::expected_absent).

record

Record one kernel lookup. Cheap; called from GpuBackend::kernel.

render_kernel_table

Render the embedded kernel set (embedded = the LOADED target’s TargetPtxSet::modules) plus the runtime resolution overlay. set_hash is atlas_kernels::KERNEL_SET_HASH. shadowed_dropped drives the SHADOWED column; expected_absent is the target’s MODEL.toml declaration and drives the required-vs-expected split (via super::classify_failures — this file does not own that rule).

seal

Close the audit for this run: the boot gate has run and every eager lookup has been made. unresolved is the gate’s own count (rows that failed and were not classified expected-absent); allow is --dangerously-allow-unresolved-kernel-lookups.

split_failures

classify_failures over rows the caller already has.

unresolved_lookups

Unresolved kernel lookups for the live model. Exported on /metrics as atlas_kernel_lookups_unresolved so a gate can assert == 0 without parsing logs.

unresolved_report

The unresolved-lookup report: the enumerated list FIRST, then the remediation block ONCE at the end.

unseal

Re-open the audit for a new model load. Called from crate::run_metrics::reset_for_new_run, which is where a run begins — the next model runs its own eager lookups and gets its own gate.