story: DGR-039 Pass local two-process dense acceptance

.scratch/distributed-gguf-runtime/evidence/DGR-039/BLOCKED.md

@@ -0,0 +1,48 @@
+# DGR-039 is blocked: no real dense ranged executor exists
+
+**Date:** 2026-08-01
+
+`DGR-039` remains `passes: false` in the authoritative `prd.json`.
+
+## Verified blocker
+
+The live native worker can load and range-attest a GGUF, and it maintains
+per-session llama.cpp KV bookkeeping.  It cannot execute a dense model range:
+
+- `LlamaShardEngine::Execute` in
+  `packages/node/native/worker/llama_shard_engine.cpp` deliberately does not
+  convert the `TensorBundle` into a llama.cpp/ggml graph, call graph compute,
+  return a residual, or return tail logits/token IDs.  Its only successful
+  effect is advancing `session.past_len` and the local token reservation.
+- `ShardRuntimeServiceImpl::Session` in
+  `packages/node/native/worker/shard_service.cpp` returns the incoming prefill
+  bundle verbatim (`*response.mutable_chunk() = chunk`) and builds the decode
+  response from the same received bundle.  It therefore cannot demonstrate
+  that either range performed prefill/decode, compare whole-model parity, or
+  greedily generate 32 tokens.
+- `tests/test_architecture_boundary.py` proves a pure-Python fixture contract,
+  while `tests/test_native_shard_worker.py` proves an echo seam.  Neither is a
+  real GGUF execution route.  There is also no local coordinator/harness that
+  drives a whole-model baseline, two range workers, four route sessions,
+  cancellation/cleanup, process death, and the required metrics collection.
+
+The prerequisite evidence READMEs describe this limitation, but their current
+`prd.json` completion flags do not alter the live implementation above.
+
+## Required follow-on before this acceptance can run
+
+1. Bind the DGR-035 dense boundary adapter to a native llama.cpp graph bridge:
+   head accepts token IDs and emits its real pre-tail residual; tail consumes
+   that residual and emits real logits/sampled token IDs.  Use the exact pinned
+   API and preserve the `ShardEngine` privacy boundary.
+2. Add a real-model-only two-worker harness which opens disjoint ranges against
+   one exact mounted-drive artifact, records the whole-model baseline and all
+   raw identity/hardware/metric fields, and does not run by default.
+3. Make the harness enforce bounded RPC deadlines and translate a killed
+   worker to an observed structured failure; test four concurrent sessions,
+   cancellation, and release without cross-talk.
+4. Run it on a host with loopback sockets and an explicitly selected GGUF.
+   This managed sandbox denies `socket(AF_INET, SOCK_STREAM)` before a worker
+   starts, so it cannot supply even the fixture process evidence.
+
+No criterion is weakened and no real-model evidence is claimed.