fix(mlx): refuse non-finite and incomplete native parity output

[seonghobae]

Correctness defect

The macOS-native MLX CPU probe previously reduced output differences through f64::max, allowing one NaN or a truncated zip to produce a false exact-zero parity receipt. The permanent rejection assertions were observed failing before the finite/shape guard was added.

Scope

This PR carries only four MLX-owned paths: the private receipt/FFI boundary and regression tests, its research note, changelog fragment and documentation index entry. It does not duplicate the six-file prerequisite repair already owned by #538 (rustls advisory) and #648 (central-hourly admission).

The private native-call table preserves production pinned C ABI calls and actual handle creation/free order. Injected device/matmul/evaluation/null-data controls delegate real native frees; these are test fixtures, not observations of native hardware faults. All native tests share a cfg(test)-only mutex after a retained SIGTRAP exposed concurrent native runtime entry. Real native MLX positive execution remains required.

Verified evidence and boundaries

The complete local ten-file composition (this delta plus exact #538/#648 prerequisite slices) passed 1,448 Rust tests/doctests, warning-fatal Clippy/rustdoc, source-aware line 11,209/11,209 and folded branch 3,900/3,900 gates, native package build and whole-source independent review. These are composition-local results, not standalone PR CI or qualifying GitHub approval. The inherited sqlx_live.rs producer exclusion is unchanged; supplementary native PostgreSQL18 is not pinned16 hosted evidence. MLX CPU probe is not Metal/GPU estimator parity.

Prior failed coverage, SIGTRAP and rejected review are retained. No thresholds, exclusions, scientific target, public contract, PRD meaning or protection were weakened.

Required before main integration

• Independent source review of the exact four-file publication subset and actual subset crate tests.
• Fresh exact-head hosted foundation, documentation, security/CodeQL and qualifying independent approvals.
• Existing fix(coverage): reconcile contradictory LCOV opener counts #538/fix(actions): align hourly quality contract with central admission (#647) #648 prerequisites must land or ordinary-forward integration must preserve their canonical ownership. Protected-main baseline still has rustls0.23.43 advisory and stale local-cron contract failures; this PR does not claim to repair those gates.
• Full product/scientific/GPU/release acceptance remains separate.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head publication and hosted execution blocker

This four-path source candidate is committed as 2be0b1882a3c29a27c7dbefa81d71abb7322c7af, tree c36a9bf349308f483ef0d2ec05c148baaf0af8fb; remote branch and PR head were independently read back and match. Fresh four-file source/subtraction review PASS did not inherit the earlier ten-file verdict. The isolated exported subset executed 11 crate/integration outcomes, 0 failed/ignored, and warning-fatal Clippy PASS. All 14 outside-publication dirty paths (including independently underway receive-deadline repair) remain preserved; no borrowed #538/#648 payload was committed.

Hosted failure is currently non-execution, not a source test result: foundation job 111380947022 has runner_id=0, empty steps, and exact-head annotation The job was not started because your account is locked due to a billing issue. Job log download returned BlobNotFound404 and is retained separately. Other shown failure checks are not credited as passed or assigned this cause without their own receipts. Repository runner inventory currently reports zero runners; that does not inventory organization runners or prove a usable assigned runner group is absent.

No repeated workflow rerun, billing change, runner registration, approval, Ready transition or merge was performed. Preserve organization-wide self-hosted migration ownership and normal checks. The independent #538 rustls/#648 admission prerequisites remain separate. Prior composition-local coverage100% is not hosted current-head evidence or standalone policy approval. CodeRabbit draft skip and Devin credit-limited skip are not qualifying review.