fix(seedless): extend the command buffer firewall to strict, lane batch, and add a ratchet

[penta2himajin]

Refs #169. Fourth and last of the firewall series (#171 → #172 → #173 → this).

What was still open after #171

path	why it matters
runStrictLayers split CBs	strict splits the forward across many command buffers, so one failure gives a partial forward — surviving layers sitting on state the failed CB never wrote. Worse than an all-or-nothing failure because the output looks less obviously broken.
stepArgmaxBatch / forwardRowsBatch	a failed batch CB leaves tokensOut holding whatever it held, so every lane takes a token the GPU never produced.

Strict was the urgent one: the error message added in #173 recommends --lossless as the workaround, so strict failing silently would make the advice we hand users actively unsafe.

The ratchet

scripts/check_cb_guard.sh — bare waitUntilCompleted count, currently 89 (down from 94 as sites were converted). Increase fails the gate; decrease prints a reminder to lower the baseline.

Deliberately not a dataflow analysis, and the script says so: it cannot tell a fire-and-forget blit from a decode readback, and it only stops the count from growing. The upgrade path — mark intentional bare waits with // cb-unchecked: <reason> and gate on unmarked ones — is written into the script rather than left as tribal knowledge.

Still open

• prefill command buffers (SeedlessMetalForward, 40 sites) — the largest remaining block
• admission control: refuse before failing, using the thresholds measured on bolt: decode command buffer fails with GPU OOM and cb.error is never checked → unbounded token-id-0 (!) output above ~2–6K prompt tokens #169
• deadlock / watchdog: give a hung waitUntilCompleted somewhere to go, reusing this same recovery path
• the capacity bug itself — bolt: decode command buffer fails with GPU OOM and cb.error is never checked → unbounded token-id-0 (!) output above ~2–6K prompt tokens #169 stays open

Gates

RAWTESTS 99/99 · BENCHBATCHTEST PASS · COMPTEST 97/97 · CBGUARD PASS

🤖 Generated with Claude Code