diff --git a/.cargo/config-avx512.toml b/.cargo/config-avx512.toml
index 1a7601c2..046b453f 100644
--- a/.cargo/config-avx512.toml
+++ b/.cargo/config-avx512.toml
@@ -47,4 +47,5 @@
 # see the LazyLock runtime dispatch path in § 7.1 of the architecture
 # doc instead.
 [target.'cfg(target_arch = "x86_64")']
-rustflags = ["-Ctarget-cpu=sapphirerapids"]
+# `-Dwarnings` matches config-v4.toml, so both CI tier checks gate warnings.
+rustflags = ["-Ctarget-cpu=sapphirerapids", "-Dwarnings"]
diff --git a/.claude/blackboard.md b/.claude/blackboard.md
index 68bbc646..dcd0e27d 100644
--- a/.claude/blackboard.md
+++ b/.claude/blackboard.md
@@ -1,3 +1,10 @@
+## 2026-10-13 — CI compiles both production tiers: x86-64-v4 and Sapphire Rapids
+
+- **Change:** `tier4-avx512-check` in `ci.yaml` is now a two-entry matrix, `x86-64-v4` (`.cargo/config-v4.toml`) and `sapphirerapids` (`.cargo/config-avx512.toml`). Each entry runs both `cargo check` feature sets and the asm-only codegen witness. Neither is executed: GitHub's runners are mostly v3. `config-avx512.toml` gains `-Dwarnings`, matching `config-v4.toml`, so both entries gate warnings and the witness script (which word-splits `CARGO_ARGS`) needs no extra quoted `--config`. The job sets `CARGO_PROFILE_{DEV,TEST}_DEBUG=0`: with `--target`, build scripts take the profile's debug level.
+- **Why:** production runs on x86-64-v4 or better, and Railway hosts are Sapphire Rapids, Emerald Rapids or newer (maintainer). lance-graph's canonical deploy file now builds `sapphirerapids`, so the VNNI/BF16/FP16 code paths must at least compile in CI.
+- **Measured here (Cascade Lake host, which lacks BF16/FP16 so nothing was run):** `cargo check` at `sapphirerapids` with `-Dwarnings` passes for `approx,serde,rayon` and `+hpc-extras`; the rustc call for ndarray carries `-Ctarget-cpu=native`, then `-Ctarget-cpu=sapphirerapids` (the later one wins), then `-Dwarnings`; the codegen witness passes (1, 1 and 6 `vpternlog`).
+- **Open:** the global `RUSTFLAGS` crypto cfgs (dalek, poly1305) are dropped by this job's `env -u RUSTFLAGS`, as before; unchanged here.
+
 ## 2026-10-13 — build-time warning for target features `cpu_guard` cannot check
 
 - **Change:** new `build.rs` + `src/cpu_guard_drift.rs` (shared by `build.rs` and the tests via `include!`). On x86_64 the build script reads `CARGO_CFG_TARGET_FEATURE` and the guard's `"name" =>` rows and prints `cargo:warning=` for every enabled feature without a row. Without a row the guard never compares that feature with the running CPU, so the binary passes the guard and can still SIGILL; a toolchain bump that lets LLVM enable a newer feature is the usual cause.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2e2476c9..bd9b51e9 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -300,22 +300,46 @@ jobs:
     # own rustflags list so the warning gate is not lost. (The same global
     # env also erases the v3 pin and the dalek/poly1305 cfgs for every other
     # x86 job — a pre-existing gap, recorded in the blackboard, not this PR's.)
+    #
+    # # Two tiers (2026-10-13):
+    #
+    # Production runs on x86-64-v4 or better; the canonical deploy build is
+    # Sapphire Rapids (`.cargo/config-avx512.toml`: VNNI, BF16, FP16 on top
+    # of v4). Neither can run on GitHub's mostly-v3 runners, so both are
+    # compiled and never executed. Both config files carry `-Dwarnings`.
+    # Debug info is off for every artifact
+    # (`CARGO_PROFILE_*_DEBUG=0`): `--target` keeps RUSTFLAGS-style flags off
+    # build scripts, which then take the profile's debug level.
     runs-on: ubuntu-latest
-    name: tier4-avx512-check
+    name: tier4-avx512-check (${{ matrix.tier }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - tier: x86-64-v4
+            config: --config .cargo/config-v4.toml
+          - tier: sapphirerapids
+            config: --config .cargo/config-avx512.toml
+    env:
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+      CARGO_INCREMENTAL: "0"
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - name: cargo check (v4 / AVX-512 dispatch arm)
-        run: env -u RUSTFLAGS cargo --config .cargo/config-v4.toml check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon
-      - name: cargo check (v4 / AVX-512 + hpc-extras)
-        run: env -u RUSTFLAGS cargo --config .cargo/config-v4.toml check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon,hpc-extras
-      - name: prove the arm actually selected (a v4 build must emit vpternlog)
+        with:
+          key: ${{ matrix.tier }}
+      - name: cargo check (${{ matrix.tier }} / AVX-512 dispatch arm)
+        run: env -u RUSTFLAGS cargo ${{ matrix.config }} check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon
+      - name: cargo check (${{ matrix.tier }} / AVX-512 + hpc-extras)
+        run: env -u RUSTFLAGS cargo ${{ matrix.config }} check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon,hpc-extras
+      - name: prove the arm actually selected (an AVX-512 build must emit vpternlog)
         # Runs the witness script in asm-only mode (this runner may lack
         # avx512f, so the probe is never executed here) rather than an inline
         # copy: the script owns the stale-assembly guard (`rm -f` + `touch` of
         # the probe source, without which a rust-cache hit re-emits no `.s`).
-        run: env -u RUSTFLAGS WITNESS_NO_RUN=1 CARGO_ARGS='--config .cargo/config-v4.toml' bash scripts/codegen-witness.sh avx512
+        run: env -u RUSTFLAGS WITNESS_NO_RUN=1 CARGO_ARGS="${{ matrix.config }}" bash scripts/codegen-witness.sh avx512
 
   nightly-simd-polyfill:
     # TD-SIMD-9 from .claude/knowledge/simd-dispatch-architecture.md.