Quantum-Inspired Thermal Equilibrium: Integration of Collective Dynamics into Real-Time Stabilization of Magnetically Confined Fusion Plasmas — Extended Edition: Full-Pulse Operation, Hardware-Bounded Adversarial Stress Benchmark and Burn Control on TORAX 1.4, Hardware-in-the-Loop on Four Microcontroller ISAs, and a Second Machine: the GOLEM Tokamak from Public Data (Validated One-Parameter TORAX Model, 500 Blind-Predicted Shots, Chip-in-the-Loop Shot-to-Shot Campaigns, Power-Setpoint Regulation of a Burning Plasma, and Balancing the Thermally Unstable Burn Point of the Canonical 0D Model in Hardware)

2026-07-30 — Unstable-branch extension of the deposit: the collective leaves the stable operating points. After stabilise (chapters 29–32), optimise (chapter 33) and regulate (chapter 34), the controller now BALANCES — it holds the thermally unstable equilibrium of the ignition curve, the inverted pendulum of burn control, on which every prior chapter's operating point sat on the stable side. The claim is deliberately placed on the canonical 0D burn model rather than on TORAX: Bosch–Hale D-T reactivity (verified against the published value at 10 keV, 1.136 × 10⁻²² m³/s), IPB98(y,2) confinement with its P^−0.69 degradation, bremsstrahlung, and profile-INTEGRATED alpha power over declared parabolic profiles (nu_T = 1.5, nu_n = 0.3) — no free parameters, so the unstable equilibrium is analytic, not asserted. At the reference point (n = 0.9 × 10²⁰ m⁻³, P_aux = 5 MW) the model has three equilibria — 0.65 keV stable, T* = 3.59 keV UNSTABLE with analytic e-folding time 30.5 s, 6.82 keV stable — and open-loop releases at ±1 % from T* e-fold away with fitted tau = 29 s (up) and 33 s (down). The controller is the unchanged five-agent Q16 chain on a FOURTH verified instruction-set architecture: a classic ESP32 (Xtensa LX6, ESP32-2432S028R 2.8-inch display board, CH340 UART, 10.4 ms measured round trip), transfer function verified against the analytic collapse formula to 6 × 10⁻⁵ — the same bound as the RISC-V reference — extending the bit-equivalence chain to ARM Cortex-M4, Xtensa LX7, RISC-V and Xtensa LX6; a new telemetry frame renders the trajectory live on the board's own panel while the control path stays byte-identical, and three sev = 5 TORAX full-pulse closed-loop seeds on the LX6 reproduce the C3 reference behaviour (two full 1 199 s pulses at Q ≈ 11.9 absorbing ~2 250 adversarial events each; one chapter-31-class ramp-window death). The battery: 380 runs, 20 seeds per case, 1 % sensor noise, 1 Hz control ticks (~30 decisions per e-folding time). Uncontrolled, the point tips in 20/20 runs. Nominal, all three controllers hold (collective, tuned single-channel PID — the literature-standard burn controller — and bang-bang, all 100 % within ±5 % of T*). Under confinement drift H98 × 0.70–1.30 WITHOUT retuning, the collective holds 100 % in-band in every case with zero lost runs across the entire battery; the PID settles off target at ×0.70, parks on the hot branch at ×1.15 and loses 20/20 at ×1.30; bang-bang loses 20/20 at ×1.30. In the release–recapture experiment (actuators frozen at the nominal point for 250 s — the identical provably-unstable free drift for every controller — then re-engaged) the collective recaptures 20/20 with mean recapture time 48 ± 14 s; the PID recaptures 12/20 and bang-bang 4/20, and the asymmetry is structural rather than statistical: on the hot branch P_aux = 0 still leaves a self-sustained 6.0 keV burn, so heating-only authority is provably powerless and descent requires the fueling and impurity brakes, which the collective engages and afterwards retires to nominal (the four bang-bang runs that happened to tip cold recover with 96 % band time, reported for completeness). One controller-design finding is documented: the first hardware release-recapture exposed a standoff — P_aux parked at 14 MW against Z_eff = 2.1 — that the float simulation had missed (int16 quantisation selects a different trajectory), resolved by a CO-ACTIVATION cleanup term proportional to the product of heating excess and brake excess, which retires opposing actuators without touching legitimate single-sided drift offsets. A 35-point TORAX 1.4 open-loop grid is shipped as an honest footnote: the bundled imposed-pedestal full-pulse scenario parks every point on the ignited branch (219–306 MW even at zero NBI) and does not resolve the unstable branch; it was not re-engineered to force one. Declared limitations, stated in full in the chapter: 0D energy balance (no transport profile dynamics, no MHD), imposed confinement scaling, helium ash not yet self-consistent, and no ITER applicability claim — the claim is the narrower one that a provably unstable burn equilibrium of the canonical model is balanced, model-free and without retuning, by five 12-byte integer agents on a 3-euro microcontroller, against baselines that demonstrably cannot. Chapter 35 of the master document (10 pages, 5 figures and a device photograph page, A4) is inline-embedded in Bernd30.07.2026.pdf and reproduces every reported number from the CSVs in 02_data/35_burn_instability/. The aggregate deposit now contains 11 208 reproducible episodes across 43 (date × study × policy) groups. All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary (DPMA Aktenzeichen 10 2025 003 906.9 and 10 2025 004 891.2). Full technical specification in chapter 35.

2026-07-27 — Burn-control extension of the deposit: the collective's third discipline. After stabilise (chapters 29–32) and optimise (chapter 33), the controller now REGULATES — it accepts an externally imposed P_fusion setpoint, entering as one additional evidence term in the lambda mappings; kernel, firmware and chip remain byte-identical. Newly instrumented: per-tick P_alpha, P_fusion, P_external and P_ohmic, and the unclamped fusion gain (the former Q = 20 reporting bound is retired after proving bit-identical control either way: all Q-dependent lambda terms saturate at the bound; the nominal burn in truth runs at Q ≈ 200–580 against a ~0.3 MW ohmic denominator, which is why absolute powers, not Q, are reported from here on). Five studies. Baseline (no objective): 130 MW. v1 unconstrained maximisation: 677 ± 19 MW at Ip = 15 MA held for 20 000 s — declared OUT of the engineering envelope (no CS flux-swing limit, no helium ash, no MHD in 1D transport) and retained only as the model's upper envelope. v2 with realism guards (Ip capped at 12 MA, q_min > 1 actively enforced, an ash proxy growing to +2.0 radiation multiplier at 5 TJ fluence): 354 ± 13 MW held flat through the entire ash ramp — the strongest quarter is the last — with the controller autonomously retiring its own impurity command one-for-one as the ash grows; declared: the proxy acts through the controllable channel, so this is a control-loop result, not an ash-physics result, and the settled operating point matching the ITER hybrid-scenario class is bounded by the circularity that the 12 MA cap comes from that literature. Capacity probe at XHARD sev = 2: the unbounded ELM radiation channel (multiplier up to 6, three times the controller's own maximum) caps the achievable burn at 26.3 ± 9.3 MW regardless of policy. Setpoint tracking at sev = 2: asked for 20 MW below the 26 MW capacity, three independent seeds deliver 18.2 / 18.3 / 18.2 (± 4.5) MW over 10 000 s each — deliberate under-delivery proving bidirectional regulation — at HALF the unregulated variance, P90 braked from 37 to 24 MW, 68 % of ticks inside the ±5 MW band, zero disruptions. Extreme severities: at sev = 8 the overlay does not impair survival (21 MW sustained where no hot burn can establish); the single disruption on record is a chapter-31-class ramp-window death at sev = 10 (t = 83 s, Greenwald criterion, before any burn existed), shipped as the survival boundary. Every reported number is computed at build time from the shipped CSVs and passed an independent recomputation audit. Also in this period: the TORAX safety_factor_fit fix (PR #2288, merged 2026-07-16 following issue #2284) was verified by the reporter against the original reproducer — negative q_min at t = 60–62 s on 1.4.0 becomes a smooth positive trace on current main ("not reproduced", exit 0); note that PyPI release 1.4.3 does not yet contain the fix; this deposit remains declared on TORAX 1.4.0 with the documented rate-gate sanitizer. Chapter 34 of the master document (8 pages, 5 figures, A4) is inline-embedded in Bernd27.07.2026.pdf and reproduces every reported number from the CSVs in 02_data/34_burn_control/. The aggregate deposit now contains 10 786 reproducible episodes across 32 (date × study × policy) groups. All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary (DPMA Aktenzeichen 10 2025 003 906.9 and 10 2025 004 891.2). Full technical specification in chapter 34.

2026-07-19 — Second-machine extension of the deposit: the GOLEM tokamak (CTU Prague, R = 0.4 m, a = 0.085 m, Bt < 0.6 T, ohmic, ~15 ms discharges — the only tokamak with fully open per-shot data publication) is studied entirely from its public shot database, with no involvement of the GOLEM team and no endorsement implied. Three artefacts. (A) Dataset: 13 549 shots mined (2019–2026, 9 771 with plasma, H and He), shipped as one compact CSV of set parameters and per-shot results; measured shot-to-shot repeatability at fixed settings is ~25 % median Ip scatter, with systematic campaign-era drift (wall conditioning) — the machine is non-stationary. (B) Model: GOLEM implemented in TORAX 1.4 (circular geometry at GOLEM scale, ohmic + equipartition sources only, no pedestal, constant chi = 1.5 m²/s calibrated on a single helium shot and then frozen; QLKNN declared out of domain at 30..300 eV). 500 stratified unseen shots are then predicted blind, each driven by its real measured Ip(t) waveform, density, gas species and field: median |deviation| 17 % in Te_0, 335/500 within ±25 %, 490/500 within a factor 1.5; standard operating regime 15 % at −6 % bias; helium bias-free (−1 %). Systematic residuals concentrate in four declared zones (weak field U_Bt < 500 V: −26 %, runaway edge Te ≥ 150 eV: −22 %, 2019 era: −21 %, strong drive U_cd ≥ 650 V: +16 %); the error distribution is statistically identical at N = 200 and N = 500. The reference Te_0 is GOLEM's own conductivity-based estimate, so the validation is model-vs-model on identical raw signals; the model is nonetheless more precise than the ~25 % repeatability of the machine it models. (C) Campaigns: the identical 2 EUR ESP32-C3/Q16 chip of chapters 29–32 performs shot-to-shot optimisation (set knobs for shot N+1 from the measurements of shot N; no millisecond real-time claim is made or possible over the internet) against a k-NN surrogate that answers each knob setting with the outcome of a real neighbouring shot — response and noise measured, not modelled. Over 100 campaigns × 60 shots per policy with full per-shot logs: the QITE collective holds the found operating point at 5.45 kA (mean of the last 10 shots) vs 5.05 kA for a greedy hill-climber at comparable failed-shot cost (1.4 vs 1.2 per campaign); random search holds 3.81 kA and wastes 5.2 shots per campaign; best-found values are statistically equal (a lottery statistic under 25 % noise). Per-knob authority (kappa) and campaign confidence (vote V) are carried in the Q16 agent fields; the chip transfer function is verified against the analytic collapse formula to within 6 × 10⁻⁵ (the Q16 quantisation grid). 5 900 fleet calls, 0 protocol errors, 526 µs mean roundtrip. GOLEM campaign data are a separate data class and are deliberately not added to the tokamak-episode index. Chapter 33 of the master document (8 pages, 5 figures, A4) is inline-embedded in Bernd19.07.2026.pdf and reproduces every reported number from the CSVs in 02_data/33_golem_torax/. All measurement data and figures released under CC-BY-4.0 / CC0; GOLEM source data remain the property of their publishers (golem.fjfi.cvut.cz);Full technical specification in chapter 33.

2026-07-17 — Endurance and statistics extension of the hardware-bounded adversarial full-pulse study (chapter 31). Two studies on the same physical 2 EUR ESP32-C3 (RISC-V) chip, blend controller, criteria generation v2. Study A, single-seed endurance at XHARD-HB sev = 2: one continuous full pulse of 129 417 s (1.5 simulated days), terminated by operator with no disruption criterion fired. After 65 187 s of quiet burn (Q ≈ 12.7, β_N 0.82, two Greenwald bursts above f_GW 1.30 in 65 ks), the first triple valve-max fault stack of the run quenches the core — and the system locks into a self-sustaining relaxation cycle: quench, autonomous gas cut, unassisted in-model re-ignition, ~350 s period, 216 cycles to end of run with the controller reaction identical and correct in every one. The lock-in mechanism is measurable in the actuator stream (post-quench refuelling raises the mean commanded gas, so the stationary multiplicative disturbance saturates the valve clamp more often: 674..755 valve-max ticks per 10 ks before, 977..1075 after), and the controller autonomously raises Ip 9.8 → 10.7 MA under sustained load — the correct defensive direction. The same ~350 s relaxation-cycle class was observed in the 2026-06-25 STM32/Q8 flat-top long pulse (1 489 cycles, 335.6 s mean period) — a different kernel, scenario, chip and disturbance model finding the same attractor class. The deepest Greenwald burst reaches f_GW = 1.496 of the 1.5 criterion; zero criterion crossings in 129 417 ticks; one raw negative-q_min fit-artifact tick (quarantined, retained — the safety_factor_fit defect of TORAX issue #2284, whose upstream fix PR #2288 was opened by the TORAX maintainers while these runs were executing). Declared: the quench/re-ignition cycles are 1D-transport model dynamics, not plasma-survivability claims. Study B, 100-seed statistics at XHARD-HB sev = 5, 5 000 s pulses: 68/100 disruption-free [Wilson 95 %: 58.3 %, 76.3 %], superseding the N = 10 ladder point of chapter 31 (9/10). All 32 deaths are the Greenwald criterion inside the early ramp (t = 4..78 s); zero deaths afterwards — the 68 survivors accumulate 333 ks of burn at sev = 5 without a single disruption while absorbing ~9 417 disturbance events each, and converge onto one operating point (q_min floor 1.776 ± 0.017 across 68 independent seeds, Q_fus mean 12.43 ± 0.39, H98 1.751 ± 0.026). Additionally documented: a 12 000 s re-execution of study A's (severity, seed) configuration, launched independently ~22 h earlier, is byte-identical to study A over all 12 000 overlapping ticks — through the full chain of TORAX/JAX numerics, USB-CDC transport and the Q16 kernel on silicon; every episode in this deposit is reproducible in this exact sense. Chapter 32 of the master document (8 pages, 5 figures, A4) is inline-embedded in Bernd17.07.2026.pdf and reproduces every reported number from the CSVs in 02_data/32_c3_q16_longpulse_hb/. The aggregate deposit now contains 10 775 reproducible episodes across 25 (date × study × policy) groups. All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary (DPMA Aktenzeichen 10 2025 003 906.9 and 10 2025 004 891.2). Full technical specification in chapter 32.

2026-07-15 — Adversarial full-pulse extension of the deposit: the XHARD disturbance cascade is applied to the complete pulse envelope of the 2026-07-13 chapter — cold 3 MA start, controller-driven current rampup, scheduled L-H transition, ignition, and self-heated burn — on the same physical 2 EUR ESP32-C3 (RISC-V) chip, and the chapter documents both a disturbance-model correction and the escalation limit of the corrected battery. The study has a three-act structure. Acts 1 and 2: unbounded XHARD at sev = 1.0 kills 10 / 10 episodes within t ≤ 10 s under the chapter-30 hard-latch phase controller, and 10 / 10 within t ≤ 14 s under a newly introduced blended controller (geometric lambda superposition of the rampup and flat-top mapping sets — equivalent to linear interpolation of the encoded ln(R) evidence — with weight driven by q95 and Q_fus headroom, latching at w = 1; a host-side change, the chip firmware byte-identical). Two independent controller architectures failing identically on the same input localise the defect in the disturbance model, not the controller: the unbounded cascade injects gas-puff commands of up to ~6 × 10²³ s⁻¹ — 10–12 × the physical maximum of the fuelling valve — during the 3 MA ramp, where the Greenwald density limit is at its smallest, and no control policy can pump particles back out of the vessel. Act 3: the corrected battery (XHARD-HB) clamps every disturbance-corrupted actuator command to the physical actuator envelope (Ip 2–15 MA, NBI 0–33 MW, ECRH 0–20 MW, gas 10¹⁹–5 × 10²² s⁻¹) — the norm-bounded-uncertainty convention of H-infinity robust control and the stuck-at-limit convention of FMEA fault taxonomies; plasma-physics events (ELM radiation spikes, Z_eff drift) remain unbounded, as they are not delivered through hardware. Under the bounded cascade the identical battery yields 10 / 10 disruption-free 1 200 s full pulses at sev = 1.0. An escalation ladder then maps the failure envelope of the bounded battery: 10 / 10 at sev = 1, 9 / 10 at sev = 5, 5 / 10 at sev = 10, 0 / 10 at sev = 120. Every death at every severity is the Greenwald criterion (f_GW > 1.5) inside the early ramp (t ≤ 83 s), and every dead seed still shows its initial-condition β_N and q_min at the moment of disruption — the plasma is healthy until a valve-stuck-fully-open event lands inside the low-Greenwald ramp window, machine-protection territory rather than plasma control. No seed at any severity ever died after the controller blend completed, and survivors are statistically indistinguishable across severities (Q_fus mean 11.66 / 11.77 / 11.76, H98 1.71 / 1.68 / 1.69, q_min floor 1.61 / 1.77 / 1.80 at sev 1 / 5 / 10) while the absorbed adversarial load triples (784 → 2 281 events per episode; at sev ≥ 5 every control tick carries an ELM and ~40 % of heating commands drop out): severity does not degrade the controller, it raises the probability of an uncontrollable window hit, and the outcome is strictly binary — die inside the ramp window or complete the full pulse. Declared limitation, stated in full in the chapter: this chapter introduces scoring-rule generation v2, which adds the single-tick Greenwald density criterion; the earlier flat-top chapters were scored under v1 without a density-limit criterion and remain unchanged under their declared rules — survival rates across chapters must be compared per rule generation. The blend controller and the hardware-bounds clamp are additive throughout; every published XHARD and nominal result is byte-for-byte unchanged. Chapter 31 of the master document (8 pages, 5 figures, A4) is inline-embedded in Bernd15.07.2026.pdf and reproduces every reported number from the CSVs in 02_data/31_c3_q16_fullpulse_hb/. The aggregate deposit now contains 10 674 reproducible episodes across 23 (date × study × policy) groups. All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary.

2026-07-13 — Full-pulse extension of the deposit: the controller drives the complete ITER pulse envelope — cold start, current rampup, L-H transition, ignition and self-heated burn — in one continuous closed-loop simulation on the same physical 2 EUR ESP32-C3 (RISC-V) chip as the 2026-07-04 chapter. Starting from the TORAX 1.4 bundled iterhybrid_rampup configuration (Ip = 3 MA, T = 6 keV core, L-mode pedestal), the deterministic five-agent QITE-Q16 controller ramps the plasma current from 3 MA to ~8 MA under its own authority (heating throttled by a dedicated rampup-phase lambda set, gas held Greenwald-aware, impurity off), hands over to the flat-top lambda set through a one-way phase latch shared coherently by all five actuator agents (trigger: q95 < 6.5), pushes 53 MW of combined heating through the scheduled L-H pedestal transition, ignites (Q_fus rises from 0.1 to the reporting bound of 20 within ~40 s), autonomously shuts NBI and ECRH back to 0 W, and then holds an α-self-heated burning-plasma equilibrium for the remainder of a 10 000 s pulse — 8 × a nominal ITER Hybrid pulse duration. Over 10 reproducible episodes (1 policy × 10 actuator-noise seeds, sev = 0.0, per-actuator noise σ = 0.05), the result is 10 / 10 disruption-free full pulses. The steady state converges across noise-perturbed seeds onto β_N = 1.45 ± 0.02, q_min = 1.41 ± 0.03, Ip = 9.0 ± 0.1 MA, H98 ≈ 1.58 — at the van Mulders (2021) design value β_N ≈ 1.5, in contrast to the flat-top-start attractor of the 2026-07-04 chapter (β_N = 2.23, q_min = 0.94), which the identical controller with identical encoded targets reaches instead when initialised hot: the path determines which equilibrium the collective finds, and the ramp path finds the design point. Noise-divergent seeds (|Δβ_N| ≈ 0.11 during the ramp) are actively contracted back onto a common trajectory (0.006 at t = 100 s, 0.003 at t = 5 000 s) — contraction onto a fixed point, not mere boundedness. Two further results are documented: first, a controller-design finding — a flat-top Ip lambda that pulls current down on Troyon approach creates a positive-feedback descent spiral once external heating is zero and the impurity multiplier is saturated (β_N = β·a·B/Ip: reducing Ip mechanically raises β_N; observed as Ip falling 15 → 4.8 MA at the slew limit with β_N climbing 2.6 → 3.02 into the kink boundary), which disappears when the Troyon envelope is placed on the push-up side of the Ip lambda; second, the ramp-path operating point (q_min ≈ 1.4) is numerically clean — zero TORAX safety_factor_fit failures across 10 × 9 400 steady-state ticks, whereas the flat-top-start attractor (q_min = 0.94) terminates every long run at ~5 200 s on that fit failure. Declared limitations, stated in full in the chapter: the L-H pedestal transition is scheduled (t = 80..100 s) rather than emergent — TORAX's set_T_ped_n_ped model cannot switch state-dependently, so the transition timing is consistent with the controller's 53 MW crossing the L-H power threshold but not caused by it; the operating-point location reflects β_N targets encoded in the lambda mappings (the path-dependent reachability is the finding, not the location); raw negative-q_min fit artifacts (84 ticks of 100 000, 0.08 %, all in the ramp/transition phase) are quarantined by a rate gate for disruption detection but retained untouched in the shipped CSVs. From t ≈ 5 200 s the controller additionally relaxes the impurity-radiation multiplier autonomously from its saturated value 2.0 to ~0.5..1.5 while Q and β_N stay constant — an unprompted late-burn behaviour not previously observed. The full-pulse code path is additive: every published XHARD and nominal flat-top result is byte-for-byte unchanged. Chapter 30 of the master document (9 pages, 5 figures, A4, with an in-operation photograph of the device under test) is inline-embedded in Bernd13.07.2026.pdf and reproduces every reported number from the CSVs in 02_data/30_c3_q16_fullpulse/. The aggregate deposit now contains 10 614 reproducible episodes across 20 (date × study × policy) groups. All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary . Full technical specification in chapter 30.

2026-07-04 — Third-ISA hardware-in-the-loop extension of the deposit, moving from the adversarial IterHybrid-XHARD stress benchmark to the peer-reviewed nominal ITER Hybrid operating point (van Mulders et al., Nucl. Fusion 61, 086019, 2021) as bundled with TORAX 1.4 (Citrin et al., 2024) under the identifier iterhybrid_predictor_corrector. The 16-bit variant of the QITE collapse kernel (Q16: 12 bytes of packed state per actuator agent — int16 log-quantised ratio at scale 12 800 plus five uint16 unit values — for 60 bytes per five-actuator fleet, ~ 9 KB flash, wire-protocol v3) is transplanted onto a physical 2 EUR ESP32-C3 SuperMini (32-bit RISC-V IMC core at 160 MHz, 400 KB SRAM, 384 KB ROM, 4 MB integrated flash, native USB-CDC) connected to the host TORAX 1.4 runner over USB-C. The 8-bit Q8 dispatch path used for every published XHARD result is retained bit-identically in the same firmware image, so the same ESP32-C3 chip additionally serves as a third-ISA bit-check for the Q8 collapse kernel behind the 2026-06-24 STM32F411 sev = 5 sweep — extending the byte-for-byte bit-equivalence chain from FP32 host reference through Q8 quantization to ARM Cortex-M4 (STM32F411), Xtensa LX7 (ESP32-S3) and RISC-V (ESP32-C3) with no source change on any target. Over 100 reproducible episodes on van Mulders nominal (1 policy × 100 actuator-noise seeds, sev = 0.0, t_final = 1 200 s = one nominal ITER Hybrid pulse, per-actuator noise σ = 0.05), the deterministic five-agent QITE-Q16 controller delivers 100 / 100 disruption-free episodes [Wilson 95 % CI: 96.3 %, 100.0 %] at Q_fus mean = 19.9339 ± 0.0005 (clamped at the postprocessing bound of 20.0 — see below), H98 = 1.569 ± 0.001, β_N max = 2.228 ± 0.028 (vs Troyon hard limit 3.0, Troyon 1984), q_min min = 0.940 ± 0.001 (above the sawtooth threshold 0.5, La Haye 2006, and characteristic of a hybrid-scenario q = 1 rational surface allowing benign sawtoothing, Polevoi 2005). Cross-seed spread of Q_mean across the 100 noise-perturbed seeds is σ / mean = 2.67 × 10⁻⁵ (< 0.01 %) — the closed-loop attractor is deterministic in the sense that per-tick actuator noise is fully damped by the collective-consensus layer within one control step. Post t ≈ 40 s in every episode the external heating actuators settle to NBI = 0 W and ECRH = 0 W and hold there until run end; the equilibrium is sustained entirely by α self-heating balanced against a saturated impurity-radiation multiplier of 2.0 and an Ip slowly relaxed by the Q16 lambda envelope from the initial 10.5 MA setpoint to ~ 9.0 MA — a self-consistent zero-external-heating burning-plasma operating point. A complementary 4-seed exploratory long-pulse observation on the same chip (1 policy × 4 seeds, sev = 0.0, per-actuator noise σ = 0.0, t_final raised to 20 000 s) ran for 5 130 / 5 181 / 5 204 / 5 205 s before terminating on a single-tick jump of the TORAX q_min postprocessing output to a mathematically impossible value (q < 0), diagnosed by the runner as a JAX float32 precision failure of the polynomial fit routine _minimum_location_value_in_interval in torax/_src/output_tools/safety_factor_fit.py at extended durations rather than as a physical disruption. Rolling 200 s means of Q, β_N, q_min and H98 across the four long-pulse runs show no observable drift toward the numerical failure. A second known TORAX 1.4 postprocessing bug is documented and clamped in the runner code shipped with this chapter: Q_fusion = P_fusion / (P_external_total + 1e-7 W) (post_processing.py, ε = 1 × 10⁻⁷ W) — when the QITE controller correctly shuts NBI and ECRH to 0 W the denominator collapses to 1 × 10⁻⁷ W and the reported Q_fusion diverges to ~ 10¹⁵; the runner clamps the reported Q_fusion to 20.0 (a physical maximum for DT fusion), which is why the 100-seed Q_mean saturates at 19.93. The Q16 code path is additive throughout: every published XHARD sev ≥ 1 result (88 / 100 flat-top host, 137 / 200 = 68.5 % STM32F411 chip, 499 999 s single-seed long-pulse observation, 6 900-episode 23-level severity sweep) is produced by the Q8 collapse and is byte-for-byte unchanged by the additions in this chapter. Chapter 29 of the master document (21 pages, 16 figures, A4) is inline-embedded in Bernd04.07.2026.pdf and reproduces every reported number from the summary CSVs in 02_data/29_c3_q16_vanmulders/. The aggregate deposit now contains 10 604 reproducible episodes across 19 (date × study × policy) groups. All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary (DPMA Aktenzeichen 10 2025 003 906.9 and 10 2025 004 891.2). Full technical specification in chapter 29.

2026-06-25 — Hardware-in-the-loop extension of the IterHybrid-XHARD adversarial control-theory stress benchmark. The same controller, same plant, same disturbance cascade are re-run with the 8-bit quantised QITE collapse kernel transplanted onto a physical 5 EUR STM32F411 Cortex-M4 microcontroller (WeAct Black Pill V3.x) connected to the host TORAX 1.4 runner (Citrin et al., 2024) over USB-CDC ACM at VID 0483 / PID 5740. The host evaluates the SDK observe() pass locally; the converged per-agent sufficient statistics (6 bytes per agent, 30 bytes per 5-actuator fleet) are shipped to the chip every control tick, and the chip returns 5 signed-int16 deltas (10 bytes) per tick. Round-trip latency p50 = 213 µs, p99 = 300 µs; per-tick kernel ~ 1.58 ns on x86_64 reference, ~ a few hundred ns on Cortex-M4. Bit-identity against the host x86_64 reference is verified over 100 000 random inputs (0 mismatches). Over 200 seeds at XHARD severity 5.0 with 1 200 s episodes, the hardware survival rate is 137 / 200 = 68.5 % [Wilson 95 % CI: 61.8 %, 74.5 %], statistically equivalent to the host x86_64 implementation of the same kernel (67 / 100 = 67.0 %) and to the FP32 reference policy (63 / 100 = 63.0 %) — bit-equivalence is preserved end-to-end from FP32 reference through Q8 host quantization to the physical Cortex-M4 silicon. A complementary extended severity sweep covers 23 disturbance-amplitude levels from XHARD sev = 1.5 to sev = 40 (the latter corresponding to up to ~ ×1800 documented ITER worst-case projection levels along the saturating disturbance channels, Snipes 2017), 100 seeds × 3 policies × 23 sev = 6 900 episodes total; the deterministic five-agent QITE policy survives 90 / 100 at sev = 1.5, 63 / 100 at sev = 5.0, 47 / 100 at sev = 10, and 6 / 100 at sev = 40, mapping the closed-loop failure envelope of the controller across two and a half orders of magnitude of disturbance amplitude. A single-seed exploratory long-pulse run on the same chip at sev = 5.0 (seed 0, t_final raised from 1 200 s to 499 999 s ≈ 5.79 days simulated, ≈ 416 × a standard ITER Hybrid pulse duration) completed without disruption at Q_fus mean = 5.155, H98 mean = 1.884, β_N max = 1.658 (vs Troyon hard limit 3.0, Troyon 1984), q_min min = 0.502 (vs sawtooth threshold 0.5, La Haye 2006), absorbing 325 494 stacked adversarial events (100 000 ELM, 108 546 ECRH dropouts, 116 948 NBI dropouts) and traversing 1 489 closed H-mode → back-transition → L-mode reset → H-mode cycles with mean period 335.6 s and no observable drift in rolling 10 000-tick means of Q, q_min, β_N or H98 across the run. The single-seed long-pulse observation is not statistically validated (N = 1) and is reported for completeness; under the working assumption that per-tick disruption probability is constant — the natural inference from the 200-seed 1 200 s pulse-survival rate — the probability of 416 sequential 1 200 s windows surviving without disruption would be 0.685^416 ≈ 10⁻⁶⁷, a discrepancy consistent with disruption probability being concentrated in transient phases (ramp-up, L→H transitions, recovery from deep resets) rather than uniformly distributed in time. No formal model is proposed. The aggregate deposit now contains 10 500 reproducible episodes across 17 (date × study × policy) groups, 8 157 per-tick CSV log files (~ 2.48 million individual plasma snapshots covering T_e, T_i, n_e, β_N, q95, q_min, Q_fus, H98, f_BS, f_GW per tick), the master episode index, four cross-study comparison figures, the consolidated 108-page master deposit document (all A4) with all measurement-paper writeups embedded inline with bookmark navigation, the device-under-test photograph, the full XHARD scenario specification and configuration metadata, and an 18-figure visualisation suite of the long-pulse observation (full trajectory, state-space attractor projections, cycle-period analysis, drift check, safety-margin time series, power spectrum of q_min, marginal histograms). All measurement data and figures released under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary (DPMA Aktenzeichen 10 2025 003 906.9 and 10 2025 004 891.2). No engine internals are required to reproduce any reported number from the included CSV logs. Full technical specification of the consolidated 108-page master deposit document.

2026-06-12 — Full ITER pulse update of the IterHybrid-XHARD adversarial control-theory stress benchmark. The same controller, the same plant, the same disturbance cascade are re-run at 1200 s of plasma flat-top — the full ITER pulse duration target (van Mulders 2021), eight times longer than the 2026-06-07 block. The only configuration difference is --t-final 1200 passed to the TORAX 1.4 runner (Citrin et al., 2024); the disturbance probabilities per control tick, the per-actuator lambda mappings, the random seeds, and the QITE Core SDK build remain byte-identical. Over 300 reproducible episodes (3 policies × 100 actuator-noise seeds), the deterministic five-agent QITE controller delivers 88 / 100 disruption-free episodes — bit-identical to the survival rate of the 150 s block — at Q_fus = 6.02 ± 1.80 in H-mode confinement (H98 = 1.88 ± 0.31), absorbing 691.6 ± 243.6 stacked adversarial events per episode (a factor of 7.6 more than the 150 s block, scaling linearly with pulse duration). Pairwise safety margins (β_N max = 1.46 ± 0.10 vs the 3.0 Troyon hard limit, q_min min = 0.52 ± 0.03 vs the 0.5 sawtooth threshold, La Haye 2006) are statistically indistinguishable from the 150 s block. The Q_mean drop from 7.94 to 6.02 across the eight-fold longer flat-top is the expected physical consequence of cumulative current-profile drift between disturbance recovery cycles; both Q values sit clearly in the burning regime (Q > 5 in the Hybrid envelope of van Mulders 2021). The open-loop reference again 'survives' 100 / 100 only by saturating in L-mode at Q = 3.61 (H98 = 0.80); the uniform-random baseline disrupts in 100 / 100 attempts. By the standard engineering stress-margin inference, the controller's survival of the IterHybrid-XHARD cascade — calibrated at one to two orders of magnitude above documented ITER worst-case projections (Snipes 2017) — over the full ITER pulse duration plausibly supports survival at nominal 1× conditions with a much larger margin. This is not a formal hardware-deployment proof; real-tokamak validation remains out of scope. The 1200 s block is published as a second data folder (1200s_full_iter_pulse/) alongside the existing 150 s block, under CC-BY-4.0 / CC0. The original 150 s data and figures from the 2026-06-07 version remain accessible via the version history of this Zenodo record. Full technical specification of the 9-page extension paper.

2026-06-07 — Adversarial control-theory stress benchmark of the QITE multi-agent plasma controller on the native Google DeepMind TORAX 1.4 step-level API (Citrin et al., 2024) under the deliberately exaggerated IterHybrid-XHARD disturbance cascade. The benchmark imposes seven simultaneously active stochastic disturbance processes on the ITER Hybrid scenario at 12 MA / 5.3 T (Polevoi 2005, van Mulders 2021), each calibrated above its real-ITER analogue by between one and two orders of magnitude: ELM crashes every 5 s with a 15 % radiation spike, NBI dropouts at 20 % per control tick, ECRH dropouts at 15 % per tick, Z_eff random walk with σ = 0.15 s⁻¹, gas-puff flow noise five times nominal, actuator command noise σ = 5 %, actuator slew rates halved relative to the ITER emergency-mode envelope (Snipes 2017 §5 Tab 3). Over 300 reproducible episodes (3 policies × 100 actuator-noise seeds), the deterministic five-agent QITE controller — implementing the ITER PCS Tier-1 hierarchy (Ip, NBI, ECRH, gas puff) plus the Tier-2 Disruption Mitigation System via the Mavrin impurity-radiation proxy (Lehnen 2015 §4, Hollmann 2015) — delivers 88 / 100 disruption-free episodes at the physically-correct Hybrid operating point Q_fus = 7.94 ± 1.26 in H-mode confinement (H98 = 2.13 ± 0.40), absorbing 90.5 ± 20.7 stacked adversarial events per episode. The open-loop reference 'survives' 100 / 100 only by saturating in L-mode at Q = 3.60 ± 0.00 (H98 = 0.80 ± 0.00); the uniform-random baseline disrupts in 100 / 100 attempts at Q = 23.32 ± 13.55. A Welch two-sample t-test on Q_mean of survivors yields p = 1.06 × 10⁻⁹⁸ against the open-loop reference, and Fisher exact on survival counts yields p < 10⁻³⁰ against the random baseline — the QITE distribution is statistically separated from every baseline at p < 10⁻¹³. Operating-point trajectories sit with substantial safety margin both below the Troyon no-wall β_N limit (β_N max = 1.41 ± 0.09 vs 3.0 hard limit) and above the sawtooth + 2/1 NTM lock threshold on q_min (La Haye 2006); the architectural advantage is shown to come from the Tier-1 + Tier-2 actuator hierarchy and the shared emergent collective field, not from threshold tuning specific to the adversarial scenario — the controller configuration is the off-the-shelf five-agent QITE emergency-mode setup with the cited per-actuator lambda mapping, applied without modification. The complete adversarial-benchmark deposit — 300 per-tick CSV logs of all episodes, configuration and run metadata, aggregate statistics, headline statistical tests, nine reproduced figures, and full disturbance-cascade and scenario specification — is published openly under CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary, and no engine internals are required to reproduce any reported number from the included CSV logs. Full technical specification of the 9-page benchmark paper.

External validation of the QITE multi-agent plasma controller against the third-party Google DeepMind TORAX simulator (Citrin et al., 2024) via the gymtorax 1.0.0 reinforcement-learning wrapper (Mouchamps et al., 2026). Over 30 reproducible episodes on gymtorax/IterHybrid-v0 (3 policies × 10 seeds, ITER-hardware-realistic actuator noise σ = 0.5 % per Hemsworth 2017, Henderson 2020, Mitchell 2008) the QITE policy delivers a mean end-of-scenario fusion gain of Q = 8.57 ± 6.34, against Q = 7.69 ± 0.03 for the open-loop IterHybridAgent reference and Q = 2.22 ± 0.79 for a uniform-random baseline — +11.5 % above the reference at simultaneously 36 % larger Troyon-limit margin (β_N = 1.25 vs 1.94) and factor 2.7 larger sawtooth-onset margin (q_min = 1.70 vs 0.625). No disruptions occurred for any policy across the 30 episodes. The QITE engines sustained 4.21 × 10⁹ decisions per second across 5.285 × 10¹¹ total decisions in 445 seconds wall time. A previously unobserved bimodal operating-point behaviour of the closed-loop QITE controller is documented and discussed. The complete external-validation deposit — application source, per-step CSV logs of all 30 episodes, aggregate statistics, and tick-by-tick replay animations — is published openly under MIT / CC-BY-4.0 / CC0; only the QITE Core SDK itself remains proprietary. Full technical specification of the 22-page companion paper

Interdisciplinary treatise on the mathematical, physical, and information-theoretic foundations of the QITE formalism and its application to the real-time stabilization of magnetically confined fusion plasmas. 258 pages, 20 chapters, 4 appendices. Topics: spectral theory, Lyapunov stability, Grad–Shafranov equilibrium, MHD stability theory, neoclassical and anomalous transport, disruption avoidance, zero-allocation C++17 implementation, CUDA parallelization, ITER baseline simulation with 1,536 coupled QITE engines on a 128×192 grid. Validation against the IPB98(y,2) scaling law, the Greenwald density limit, and experimental data (JET, DIII-D). German patent applications Az. 10 2025 003 906.9 and Az. 10 2025 004 891.2.

The deposit additionally includes the executable reference implementation tokamak_sim in two prebuilt variants — tokamak_sim.exe (CPU, MSVC x64) and tokamak_sim_cuda.exe (CUDA 13.1, GPU-accelerated 1,536-engine sensor swarm at ~10⁹ QITE decisions per second) — together with full source (C++17 + CUDA), CMake/MSVC build scripts, and a 22-page companion paper (Simulation.pdf) extending the main treatise. The simulation environment couples the deterministic plasma physics layer (Bosch–Hale D-T reactivity, Modified Rutherford NTM dynamics, peeling-ballooning ELMs, Putterich impurity radiation, Sauter bootstrap current, Connor–Hastie runaway model) to a three-tier control hierarchy: a 1,536-engine QITE sensor swarm (treatise §7.2), a six-engine actuator-agent layer (NBI, ECRH, ICRH, gas-puffing, vertical PF coils, shattered-pellet injection — companion §3) governing all physical actuators autonomously through their individual coherence dynamics, and a parallel six-mechanism stochastic perturbation channel (ELM Poisson process, NTM onset roulette, Brownian vertical drift, NBI source glitches, sensor noise, locked-mode onset — companion §4) reproducing the operationally relevant statistical character of a real tokamak plasma. Empirical validation over a 390 s flat-top run (default seed 0xC0FFEE, severity σ=1.0, all stochastic mechanisms active, no operator interventions) reproduces the steady-state envelope of treatise §11.10 essentially exactly: disruption risk 26.7 % ± 4.7 %, no excursion above 32 %, zero terminal disruptions, mean fusion power 488 MW (within 2.4 % of the ITER design point of 500 MW), β_N=1.73, and a saturated (2,1)-NTM amplitude of 0.201, consistent with stochastically driven flat-top operation. Full bit-identical replication is supported through fixed-seed semantics and the run metadata persisted in every CSV log header.