fix(train-inspect): info invented a model's architecture from its FILE SIZE — refuse instead of fabricating

[noahgift]

The code said so itself:

// For real implementation, would parse the actual file
// Here we return simulated data based on file size
let estimated_params = estimate_params_from_size(metadata.len(), &format);
let tensors = generate_mock_tensors(estimated_params);

It synthesised a tensor list from the file's size, then ran architecture detection over the invented shapes. Reproduced independently before changing anything — 5 KB of /dev/urandom renamed .safetensors:

Format           SafeTensors
Architecture     llama
Hidden Dimension 768
Layers           1
Vocab Size       256
Tensors          9
rc=0

A real one-tensor safetensors file gets the same nine tensors, because the answer never depended on the contents. This crate is published to crates.io, so that reached users as an "inspection".

Worth naming what it defeated: architecture.rs carries an N-05 hardening that derives hidden-dim from tensors rather than hardcoding 4096. It does derive honestly — from tensors fabricated one call earlier. The hardening sat one layer above the lie.

Fix

Return an error naming what it cannot do, pointing at the tools that actually read the file:

rc=1  Unsupported model format: SafeTensors: `inspect` cannot parse model files.
      It previously synthesised a tensor list from the file SIZE and reported that
      as the model's architecture… Use `apr inspect` or `apr tensors`, which read
      the file. Tracked in #2519.

Refusing is strictly better than fabricating. Whether this binary should exist at all is a separate question tracked in #2519 — this doesn't prejudge it.

Cleaned up rather than left behind: the two fabrication helpers are now #[cfg(test)] (retained only for the unit tests asserting their arithmetic, so no production path can call them); the ArchitectureDetector import is dropped; the metadata read is kept as _metadata with a comment, because it still surfaces a real permission/IO error — reporting the size was never the problem, inferring architecture from it was. Zero warnings in the crate.

Falsifier

test	asserts
garbage_bytes_are_not_reported_as_a_model	non-model bytes must not succeed
two_different_files_do_not_get_the_same_invented_answer	the sharp one — two different files of equal size must not yield identical architecture and tensor count, which is exactly what size-derived answers do
a_missing_file_fails_for_its_own_reason	non-vacuity

Mutation, done properly

My first attempt hand-restored the old code and did not compile (missing field total_params), so it proved nothing — the same standard I'd apply to any mutation that fails to turn RED. Redone with the real original from git:

$ git show HEAD:...inspect.rs > inspect.rs && cargo test --test falsify_...
garbage_bytes_are_not_reported_as_a_model               FAILED
two_different_files_do_not_get_the_same_invented_answer FAILED
a_missing_file_fails_for_its_own_reason                 ok

Two RED and the non-vacuity companion green — the discrimination that matters: the tests target the fabrication, not a function that refuses everything.

Verification

cargo test -p aprender-train-inspect	66 + 3 passed, 0 failed
cargo clippy --all-targets	0 errors
cargo fmt --check	rc=0

_{--no-verify per #2526. Two sibling findings from the same audit remain in #2519 — aprender-train-bench (a sweep that never trains, returning a baked-in temperature = 4.00) and aprender-train-shell (fetch does-not-exist/totally-fake-7b exits 0 reporting 7.0B, Layers: 32). Same class, not touched here.}

Refs #2519