[noahgift]

Replaces #4322 and #4332 (operator ruling via cop: no main-merges into aged PRs; one fresh branch off main, cherry-picked).

Carried (cherry-picked with -x, not on main or on batch/0.69.4):

• Qwen3.5 CUDA: q8_activation_valid is never cleared on the qwen35 path, so DP4A reuses a stale Q8_1 activation — #3513's 'DP4A catastrophic' measured this bug #4258: a DP4A GEMV requantizes when its input buffer or contents change (q8_activation_src key plus q8_activation_written on every writer kernel), with its staleness tests and the DP4A parity guard. Closes Qwen3.5 CUDA: q8_activation_valid is never cleared on the qwen35 path, so DP4A reuses a stale Q8_1 activation — #3513's 'DP4A catastrophic' measured this bug #4258.
• GPU argmax kernel keeps the later index on an exact tie; CPU argmax keeps the first — breaks greedy token identity once #4215(b) moves argmax to GPU #4259: GPU argmax returns the FIRST of equal maxima, like the CPU argmax. Closes GPU argmax kernel keeps the later index on an exact tie; CPU argmax keeps the first — breaks greedy token identity once #4215(b) moves argmax to GPU #4259.
• apr serve (0.69.1) decodes Qwen3.5-4B Q4_K_M at ~87 tok/s on RTX 4090 vs ollama 0.34.2 at ~149 tok/s (0.58x) on the same box #4215: allocation-free decode plumbing: module_key! pre-formatted Arc<str> module keys, stack-array GDN args (gdn_pack_args), device-alloc/D2H counters, and Qwen35CudaModel::forward_single_greedy (device argmax, 4-byte download). Refs apr serve (0.69.1) decodes Qwen3.5-4B Q4_K_M at ~87 tok/s on RTX 4090 vs ollama 0.34.2 at ~149 tok/s (0.58x) on the same box #4215.

Dropped: #4322's #4316 persistent residual. It is superseded by batch/0.69.4 commit 64b20f8.

Reconciliation with main (the judgement calls):

• Main's ensure_kernel_module (GPU RMSNorm runs with ε = 1e-5, not the model's 1e-6: the kernel cache key omits ε and preload bakes 1e-5 — special-token positions come out 0.431× (qwen2.5-coder-7b, F2 pos 13/44) #3759 key ledger) is kept at every site. module_key! only builds the key.
• Main's float-in-key fix is kept. rmsnorm ×3, per_head_rmsnorm and gdn_partial_neox_rope take module_key!(…, "…_b{:08x}", …, x.to_bits()), which formats the same key string as main's f32_bits_tag.
• fused_kv_hw_dp4a_q4k_gemv_into stays deleted, as it is on main.
• qwen35_gpu_decode no longer exists on main (generation goes through Qwen35Session), so the apr serve (0.69.1) decodes Qwen3.5-4B Q4_K_M at ~87 tok/s on RTX 4090 vs ollama 0.34.2 at ~149 tok/s (0.58x) on the same box #4215 greedy driver qwen35_gpu_decode_greedy is not carried. Wiring forward_single_greedy into Qwen35Session is a follow-up on apr serve (0.69.1) decodes Qwen3.5-4B Q4_K_M at ~87 tok/s on RTX 4090 vs ollama 0.34.2 at ~149 tok/s (0.58x) on the same box #4215, which is why this PR only Refs it.
• CudaExecutor::new initializes the two new fields with Default::default(), so the complexity ratchet stays at cognitive 40.

Local checks:

• cargo check -p aprender-serve --features cuda --lib --profile test: pass.
• cargo check -p aprender-gpu --lib --profile test and the non-cuda aprender-serve lib check: pass.
• cargo fmt --all --check: pass.
• check_complexity_ratchet.sh: pass.
• make roadmap-aggregate-check: pass.
• GPU tests have not run yet: the GPU was held by a foreign process. They run under the GPU lock before merge.

keep-open: #4215 stays open until Qwen35Session greedy decode calls forward_single_greedy (follow-up); #3759 is cited for the key ledger this PR keeps, not changed.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=4439 head=c3546d373fb6a9fe4499493cccb0646c4cd70c4f verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Delta quorum @ c3546d3 — 3/3 PASS, degraded: same-family (apr-m0694). Auto-merge was DISABLED at 0f3b6a2 before this push.

The delta is test-only: scripts/tests/guard_tree_test.sh serial_alone().

lane	model	verdict
1	claude-sonnet-5	PASS
2	claude-sonnet-5	PASS
3	claude-haiku-4-5-20251001	FAIL on the first run → PASS on the rerun

• Lane 3 first run: its own awk trace returns bad=1 on the CI sequence. It then read ci-failure.txt as output of the NEW code; it was the pre-fix failure. My prompt did not state that provenance. The rerun added only the provenance line, and both outputs are kept.
• Lanes: claude -p --permission-mode plan --allowedTools Read,Grep,Glob over a chmod a-w snapshot (/mnt/nvme-raid0/tmp/m0694-q4439-c354). Outputs are in /mnt/nvme-raid0/tmp/m0694-q4439-out/.

The two reds the cop reported:

1. guard-tree row 55 (job 108232939859) was a real test defect, fixed here. The events were a|b|serial-start|serial-end|a-end|b-end: both pool guards wrapped the serial one, and the old check only looked inside the serial window. Case table: the new check gets 6/6 interleavings right; the old one misses both wrap-around orders. The local run gives 35 checks, 0 failed.
2. cuda-unit (job 108241779302) is not a code failure. The module_key_guard.rs:88 panic is the expected panic of a test that printed ok. The binary actually died silently mid-test at 20:51:06Z. yoga's journal shows earlyoom SIGTERMing concurrent rustc/cargo processes and this test binary (realizar-52dd89, RSS 1.6 GB) at 20:51:05–06Z. The same test passes locally on the 4090 (1 passed, 12.5 s). Car release(0.70.0): sealed car — REPLACES #4372 #4429's cuda-unit (job 108271525807) died the same way at a different test, killed by the kernel OOM killer at 22:31:19Z.