colibri: add CONSIST=1 prefill/decode self-consistency check

[phreakocious]

Summary

Prefill and decode must agree on the same positions. Arm A pushes the whole sequence through step_all in one batched prefill; arm B prefills a prefix and then walks the continuation one token at a time through the KV cache, exactly as generate() does. Both arms share weights, so any disagreement beyond float accumulation order is a KV-addressing or masking defect in one of them.

It needs no reference predictions — no tf_pred, no second implementation — because it compares the engine against itself. Tokens come from either source:

SNAP=<model> REF=<ref.json> CONSIST=1 ./colibri 64 16 16   # prompt_ids/full_ids
SNAP=<model> PROMPT="..."   CONSIST=1 ./colibri            # no ref file at all

The PROMPT form is what lets this run on a model no fixture exists for — including quantizations and backends no CI runner can build a reference for. It tokenizes with the same [gMASK]<sop> prefix run_text applies (skip that and the sequence is out-of-distribution, both arms agree on garbage, and the check cannot fail), then splits at CONSIST_NP, default halfway.

It also covers COLI_PREFILL_CHUNK, which only arm B honours, and whose single-shot equivalence was previously asserted only in a comment on step().

Why the gate is the relative gap

The two failure classes separate cleanly by magnitude: reordered f32 accumulation over the hidden dim lands near D*eps, a misaddressed KV row lands at O(1). Argmax flips are reported but deliberately not gated — a flip requires |a[ia]-a[ib]| < 2*gap by construction, so "the flip is explained by the gap" holds for every flip and would be an assertion that cannot fail.

Evidence

Measured on GLM-5.2, 744B int4-gs64, D=6144, 15 tokens split 8/7, CPU path:

tolerance	worst relative gap	result	exit
1e-2 (default)	3.902e-04	CONSIST OK	0
1e-6	2.762e-04	CONSIST FAIL	1

D*eps at D=6144 is 7.3e-04, so the observed gap sits just under the float-reordering noise floor and ~3 orders of magnitude below where a KV defect would land.

The second row is a positive control: the gate fires and exits non-zero, so the passing result is not an assertion that cannot fail. The two gaps differ between runs because expert cache state changes accumulation order; both sit far below the default tolerance.

Validation

• make -C c check — 921 tests, OK (85 skipped), exit 0. Builds with 0 warnings.
• CUDA changes were tested with make -C c cuda-test — n/a, no CUDA code touched
• Performance claims include hardware, commands, and repeatable measurements — n/a, no performance claims
• Performance claims include a validated experiment manifest with raw evidence — n/a, no performance claims

Compatibility

• The default CPU build remains dependency-free — one C file, no new headers or dependencies
• No model files, generated binaries, or benchmark artifacts are included

The existing REF-driven path is unchanged; PROMPT mode previously returned before reaching the CONSIST branch, so nothing that worked before behaves differently.