fix(serve): the four P0s from the serve audit, two guards, and a 367x cancellation proof on GPU

[noahgift]

Six agents fixed the four verified P0s from #2465 plus two guard-blindness findings; every fix then went to an independent agent whose job was to refute it. All six were mutation-verified. Five SOLID, one NEEDS_WORK (recorded below).

The Q4K P0, proven fixed on GPU

The implementer could only compile-check the CUDA path and said so. The verifier closed that gap: built with --features cuda-batch, served a real model on the RTX 4090 with the scheduler proven engaged (Q4K GPU inference ready (ALB-095), binary reporting its own SHA), aborted a 400-token /v1/completions at 5s, then timed the next request — the scheduler thread is serial, so that latency is the abandoned request's remaining GPU work:

fixed	0.234s
control (poll deleted)	85.97s
	367x

It also ran a mutation the implementer never did — moving the poll to the bottom of the loop — which also goes RED. So "the poll must be at the top" is enforced, not just asserted in prose.

Corrections to #2465, which I filed

I overstated the blast radius. The Q4K path is gated on --features cuda-batch; a plain --features cuda build logs Q4K pool-allocator path declined and never reaches the decode loop. My ticket claimed five live routes with no mention of that gate.

Prefill is still not polled. An already-cancelled request costs prompt_len forward passes before q4k_decode is entered. The falsifier's text says "ZERO forward passes" — true of q4k_decode only. It matches the sibling loops (generate_quantized.rs polls after prefill too), so it is a convention rather than a regression, but the assertion claims more than the code delivers.

The other three P0s

• /v1/completions could not end a completion — stop_tokens never reached the generate config. Now funnelled through completion_resp. Honest limit: 2 of 8 backends bypass that funnel, and passing None still compiles, so the guarantee is positional-reminder strength, not type-level.
• Batch completions computed from UTF-8 byte values — p.bytes().map(|b| b as u32) under a // In production, use a proper tokenizer comment. "世界" became six ids naming six unrelated vocabulary entries; ASCII was wrong too. Now uses the server's tokenizer, and an empty prompt is refused rather than handed to the model as empty context.
• MCP spawned a literal "apr" at three sites fix(mcp,code): apr 0.63.0 ran apr 0.60.0 — both subprocess backends resolved a bare apr through PATH #2424 missed, while apr_bin.rs documented that it covered "all eight subprocess tools". Code and comment now agree.

Two guards

• Route surface: deleting three entries from OPENAI_ROUTES previously passed all 15,706 tests. The guard now checks both directions — advertised ⇒ mounted and mounted ⇒ advertised.
• Contract test binding: pv validate passed a contract naming a nonexistent test, because strict_test_binding.rs:57-63 skips entries lacking a test: field.

One flake fixed along the way

test_commutativity_execute_corroborated failed the workspace run with ExecutableFileBusy. create_mock_apr writes a script and hands it to code that spawns it; a concurrent fork inherits the write fd and holds it past our close. Same ETXTBSY class as the aprender-mcp fix earlier today, in a different crate — the pattern was fixed once and the sibling copy kept it. Fixed in the fixture, not in production: the code under test still spawns once, as it does in the field.

create_mock_apr exists in two copies (17 call sites); both now wait. Unifying them is consolidation debt tracked separately — doing it here would make the flake fix unreviewable.

What is NOT in this batch

fix/serve-completions-eos-and-surface-drift was dropped. Two agents independently fixed the batch tokenizer and the router's advertised list, and hand-merging two implementations of one fix is how a silent defect ships. Its unique surface-drift work is covered by the route-surface guard. It can land separately if anything is missing.

Verification

• cargo test -p aprender-serve --lib — 15,654 passed, 0 failed
• cargo test -p aprender-qa-runner --lib — 1,896 passed, 0 failed
• scripts/check_assertions_exclude.sh — clean, delta 0
• contract count 1771 matches the README row; cargo fmt --all --check clean

A full cargo test --workspace --lib was attempted twice and both runs were killed by resource exhaustion (SIGKILL on libc, syn, serde_core — third-party crates that compile fine) while three agent workflows saturated the box: load average 21-52, 19 concurrent cargo processes. Rather than quote a number from a killed run, the per-crate figures above are what completed. CI runs the full workspace on this PR regardless.

Closes #2465