04 — Stack

An EPU is not a chip.
It's a stack that can count.

You cannot bill a joule you cannot trace. So every layer had to be rebuilt around the same unit: a language that declares what a function may spend, a runtime that routes on that price, an operating system that schedules against it, and models small enough to run there. Four layers, all built, all tested.

The name has a history worth correcting. "EPU" has meant a power-management controller before — a small chip that throttles voltage regulators to save watts for the real processor. That is the opposite of this. An EPU in our sense is not a governor attached to compute; it is the compute, with energy as its unit of account rather than its afterthought.

01 — The language declares the cost · Joule

A Rust-shaped language where energy is part of the type system: a function can carry a joule budget and the compiler checks it, the way it checks a lifetime. The pipeline is real and tested end to end — lexer, parser, HIR, type checker, MIR, borrow checker, and codegen to eight backends, one of which is the settle fabric itself. It also compiles itself: the bootstrap compiler reaches a fixed point, where the compiler it produces emits byte-identical output to the one that produced it.

3,660#[energy_cost] annotations across 411 standard-library files — the cost is written in the source, and the compiler carries it through to codegen

stage1 ≡ stage2self-hosting, proven by byte-identical hashes — not asserted, gated in CI

8codegen backends — C, LLVM, Cranelift, CUDA, MLIR, WASM, tensorforge, and settle itself

02 — The runtime routes on it · flowg

An energy-routed dataflow VM. Every backend publishes a cost model, and the placement pass sends each operation to whichever substrate answers it for the fewest joules — or refuses outright, if none can do it honestly. Each figure carries a two-axis provenance tag: how it was obtained × what device it describes. A prediction can never be mistaken for a measurement, and a measurement on a stand-in can never be mistaken for the real target.

4backends built — CPU, WebGPU, WASM, and the settle fabric. Nine kinds are declared in the enum; these four are implemented

T=0 · T>0one fabric, two modes — deterministic settle and an exact Boltzmann sampler, graded against the same golden vectors

min · Jroutes by measured joules where a measurement exists, modeled where it doesn't — and always says which

03 — The OS schedules against it · ternaryOS

Not an operating system with power management bolted on — one where energy is the scheduling resource. It is idle by default and picks the cheapest realization that satisfies a request. Authority is an unforgeable capability token, so forging permission is a type error rather than a vulnerability. There is no RAM/disk split: a single-level ternary store runs a program at its address, and persistence is simply the word image. And settle() is a first-class operation the kernel dispatches — priced and replayable. It is not a diagram: it boots from multiboot through its own 32→64 trampoline into long mode, brings up three secondary cores and schedules across all four, keeps a filesystem on disk that survives reboots, and reaches the network through a driver it owns — ARP, DHCP, DNS, TCP — far enough to fetch a page over HTTP.

one storeno RAM/disk split — a program runs at its address, and persistence is simply the word image

4 coresa bare-metal x86-64 kernel that boots — own long-mode trampoline, no firmware beneath it, then SMP across every core

19,683three-valued logic connectives available to it, against binary's 16

04 — The models have to fit · ternary-fabric

A ternary inference engine with zero external dependencies — its own SIMD, GGUF parsing and tokenizer, because on a substrate this small the dependency tree is part of the energy budget. It loads and runs real published models — BitNet b1.58, Qwen3, LFM2, Bamba, SigLIP — each checked against a reference implementation for numerical parity. And it exports real BitNet ternary weights into the FPGA fabric, which is the seam where a published model meets the silicon.

no retrainingpublished checkpoints converted by a closed-form fit — no gradient steps, no quantization-aware training budget

0external crates — the whole engine, hand-rolled

1.58bits per weight, loaded from published checkpoints and pushed to the fabric

Why four layers instead of a chip measured · xck26 silicon

Because the claim is a receipt, and a receipt needs a chain. The language declares the budget, the VM routes on it, the OS schedules against it, the fabric spends it — and the number at the end is 0.1596 ± 0.0006 pJ per accumulate, measured on real silicon by a frequency-sweep slope, so every static and leakage term cancels exactly. No tool estimate anywhere in the path.

meter × ratean operation counts its own accumulates; the rate is measured. Nothing modeled in between

Measured × StandInreal silicon, but an FPGA standing in for the target ASIC

R² 0.9999across an 8-point sweep, reproduced to 0.03% on two independent bitstream loads

What we haven't done yet

Stated plainly, because a ledger that only records credits isn't a ledger.

the ASIC joulethe measured figure is an FPGA standing in for the target die. The ASIC number is still modeled · fab, not inference, is the gate

self-hostingthe fixed point is proven for the bootstrap compiler, not the full production one · and the joulec CLI is currently detached from its workspace

the kernelboot is verified by running it, not inferred — but nothing regression-tests it · no CI catches the commit that breaks the boot

our own modelswe run other people's ternary models well; ours are not competitive · our 27B conversion lands ~11× off the best published result

That last one deserves its own sentence, because it is the one a competitor would use. Ternary post-training quantization holds roughly 95% of quality at 70B and breaks down below 8B — confirmed independently in the 2026 literature, and reproduced in our own runs. Our quantization work is a research engine with measured findings, not a model release. When that changes, the number will be here, with its provenance attached, like every other number on this site.