[grantoverton]

Part of #1190.

Stacked on #1125 (the qwen27 Metal family); base for review: 30e5dcb, the #1125 head. Review the last two commits: 146a658 (the queue and the pass) and 227b961 (lean-check comments).

The qwen27 Metal lane engines take decision work beside text generation: an HTTP thread enqueues a score or decide task and the lane host's own engine thread runs the pass when the engine is idle. One resident model serves both streams.

What changes

• core/engine_api.zig: DecisionTask (.score / .decide), Decision (trunk + branches + counts + label/logit spans), and a Decider vtable entry on the lane host's backend (run only; ready arrives in the follow-up).
• core/lane_host_decide.zig (new): the host-side queue. Callers append a task and wait on h.decided; step takes the queue's head only when the engine is idle (no admitted or filling streams, nothing active on the lane core) and runs it on the engine thread.
• core/lane_host.zig / lane_rounds.zig: step is driven from the host's idle points; a stale host fails the waiters instead of hanging them.
• native/qwen27_decide.zig (new): the 27B lane backend's pass. A score prefills the prompt and reads labels' logits at the row after it (a prefill's .last head leaves them in logits row 0). A decide prefills the shared trunk once, keeps its state, and restores it a branch at a time so every branch's rows stand on the same trunk state.
• native/qwen27_served.zig: the served engine registers the decider.
• core/lane_host_decide_test.zig (new): queue/wait/step/fail coverage (3 tests).

Checks

• zig build native -Dcpu=apple_m1 -Dversion=1.0.0 passes clean on the head.
• zig build test test-golden -Dcpu=apple_m1: test-golden 0 unexpected differences (306/319 + 26/26 equal). The test step's device-dependent binaries fail on this machine while its GPU is serving a model — the same test binaries fail identically on the base head 30e5dcb (run for comparison), so the failure is inherited, not introduced by this diff.
• tools/zig/lean_check.py: 444 findings, as on the base (zero added).
• The decision pass does not touch the drafted path: drafted replies stay identical to undrafted ones (the family gate from qwen27: serve Qwen3.5-MoE (Ornith-1.5-122B) on Metal: routed experts, its DFlash2 drafter and the publisher's 4-bit weights #1125 is unaffected — this PR adds no scheduler beside the engine; the host's own thread owns the work).

Receipts (serving validation, receipts/DECIDE-RECEIPTS.md in the work's record; Apple M3 Ultra, 256 GB, macOS 26.4.1, zig 0.17.0; local Ornith-1.5-122B A1-affine 4-bit checkpoint + local DFlash2 drafter, temperature 1.0, no-think; recorded at feature-branch 98a0ce4f, which this stack replays with comment-only changes)

• Decisions return 200 with full answers while chats stream (4-way and 8-way loads, prompt_tokens=270 each).
• A decision landing mid-drafted-round does not corrupt the emitted token stream: a deterministic constrained prompt produces one token sha across solo / during / after runs.

Known limits (deliberate)

• Decisions serialize behind live generation — they run only at idle points (~12 s wait at 4-way load). The lane runner is single-owner by design; taking a free slot beside the streams is the follow-up PR in this stack.
• A long-trunk decision re-prefills the trunk per question; trunk KV reuse across questions is future work.

Not run

No GPU jobs were run for this PR cut: the numbers above are cited from the recorded serving validation named in Receipts. CONTRIBUTING's performance receipts (bench_openai / bench_concurrent / cold prefill tables) are unchanged from #1125's run — this PR adds no decode-path work; they would be re-run at file time if the maintainer wants them on this exact head.

[ashhart]

Thanks @grantoverton. Your two commits don't need the #1125 Ornith stack, so we rebased just them onto current main (one conflict in lane_host.zig, plus main's new spares argument to saveSlot). Host suites pass, including the three decide tests. Main has since landed its own decision-score queue (lane_host_score.zig), so:

1. Please build on that queue instead of adding a second one (decisions/decided): give the qwen27 lanes backend a score entry (as cuda_bound.zig does) and add decide to lane_host_score.zig.
2. The decider is set for every qwen27 host (qwen27_served.zig), so default Qwen3.8-27B serving starts answering /v1/systemone and /v1/decisions instead of 404. New routes need to be opt-in.
3. lane_host_decide.zig waits with no cancel or timeout, so a client that disconnects can't abandon a decision, and decisions can wait indefinitely under load.
4. Smaller: settle() errors are dropped in qwen27_decide.zig, and score checks r.capacity while decide checks window.

Once reworked, we'll check on a Mac that text tokens are unchanged, each branch's label logits equal a score of trunk+branch bit for bit, streams during a decision equal their solo runs, and the next reply after a decision equals a fresh server's.

[ashhart]

Review of the qwen27 decision stack (#1189 → #1191 → #1192 → #1215, tracking #1190) against main 3f408b6. It's about 860 commits behind but #1189's own two commits apply cleanly, and host checks pass on the rebase (test-lane-api-host 300/300 including the decide tests, native build, fmt, lean). The open points from the earlier review still stand, and there's a newer piece of context: gilby's #1361 (Clef) adds a hidden call that returns a prompt's final rows, and we've asked it to admit decision prompts into the shared rounds rather than running them one after another. It would be best if this stack and #1361 converge on one shared decision path in core:

• qwen27: score and decide passes queued onto the lane host's idle engine thread #1189: setting a decider takes over main's score vtable, so two queues run side by side, and it turns /v1/systemone and /v1/decisions on for every qwen27 host. Please build on main's queue, make it opt-in, add cancel/timeout, and stop dropping settle() errors. Decisions that run only when the engine is idle can wait indefinitely under steady load. Also check that each branch's logits equal score(trunk+branch) bit for bit, since trunk and branch are prefilled as separate chunk runs and recurrent state crosses a different seam.
• qwen27: a JointHead side-head scores options on post-norm hidden rows at their final-token positions #1191: the JointHead is a private format with no public trained weights, checked only with a stub head. A qwen27 implementation of clef: Cloudflare Clef decisions on /v1/systemone through its joint schema head (--clef DIR) #1361's hidden call, with any head living in the server, would fit better.
• lanes: a queued decision takes a free slot beside the live streams, as a new stream's prompt pass would #1192: the PR says decision rows join the rounds, but decide.run prefills the whole prompt outside the round planner, so live streams stall for the full pass. bind also drops settle() errors, the lone driver now yields whenever a decision is queued (changing default scheduling), and unbind can move a live stream into slot 0 mid-reply. Stepping decisions one max_rows piece at a time through main's queue would fix the stall.
• qwen27: TF_Q27_PROFILE logs the round's class GPU times, and replies carry gpu_seconds #1215: gpu_seconds is set on every reply and each stream is charged the whole shared round; please keep it off unless profiling is on. 21e0ad7 changes every drafted server's cost tables and belongs in its own PR; f8c63b6 fixes a bug from 6e03930 and should be squashed into it. f8c63b6's message also carries a tool trailer, a card id and an agent-profile line; please drop those. Note that TF_Q27_PROFILE=0 currently turns profiling on at the default interval.

[ashhart]

Thanks @grantoverton for the decision queue. We're closing this for now, as our 26 Oct review hasn't had a reply. Please do reopen it, or send a fresh PR, once it builds on main's score queue as an opt-in with cancel and timeout, ideally converging with #1361's shared decision path.