fix(GATE-OP-PARITY-MANIFEST): refuse a throwing golden by name instead of aborting the pass (#776)

.agents/issue-index.md

@@ -202,3 +202,4 @@ rather than merged. `scripts/check-agent-record.py` gates both.
 | [#834](https://github.com/mudler/vllm.cpp/issues/834) | — | No row owns router-lookahead prefetch for offloaded MoE experts. `ENG-EXPERT-STREAM` W3 copies router identifiers device to host and waits once per MoE layer (`specs/expert-streaming.md:377`), which is a synchronous stall. The only overlap work in that row is W6, and W6 runs `only if W3 trace shows wait dominance` and needs a separate accepted spike (`:380`). `ENG-WEIGHT-OFFLOAD` has a `PrefetchOffloader` arm, and it selects layers by position and never reads the router (`vllm/config/offload.py:48-76`). Prefetch is the lever that converts the per-layer fetch stall into an overlapped transfer, so the gap is recorded rather than left to be rediscovered | feature |
 | [#835](https://github.com/mudler/vllm.cpp/issues/835) | — | No row owns GPUDirect Storage, also called GDS or cuFile, for weight reads. `ENG-EXPERT-STREAM` W2 uses an `O_DIRECT` pool with aligned staging (`specs/expert-streaming.md:376`), which bypasses the page cache and still stages every expert through host memory. GPUDirect appears twice in the records and neither entry covers weights: `KV-MOONCAKE-STORE` names it for KV blocks over a fabric no box we own has, and `specs/lmcache-cpp-client-connector.md:305` marks GDS `NOT SCHEDULED` as an LMCache backend. The value differs by host, so a row must measure both paths before it claims a number | feature |
 | [#840](https://github.com/mudler/vllm.cpp/issues/840) | `POLICY-ISSUE-INTAKE` | The issue intake table sits inside `roadmap_v1.md`, which 51 of the last 60 commits touch, and two branches appending a row conflict under the default merge and merge cleanly under `merge=union`; a `.gitattributes` entry binds a path and never a section, so the table moves to `.agents/issue-index.md` and becomes append-only, and ownership becomes a network-free gate because 33 of the 185 rows name no owning row (spec [`issue-intake.md`](specs/issue-intake.md)) | bug |
+| [#776](https://github.com/mudler/vllm.cpp/issues/776) | `GATE-OP-PARITY-MANIFEST` | `test_op_parity` THREW `json.exception.type_error.302` out of the CPU golden pass instead of failing an assertion, so the walker's `no runner for op` guard — the check that caught #559's missing runner arm — stopped running for every golden after the offender. The artifact was `tests/parity/goldens/minimax_music3_oracle/manifest.json`, and that half is #755, already fixed by `043e56862`. #755 closed the walker's INPUT set; it did not close its EXCEPTION surface, and reproducing #776 on the fixed tree shows the difference: nulling one tensor `dtype` in `rmsnorm_f32_8x128` still threw `type_error.302` at the TEST_CASE line and cut the pass from 142 assertions to 37, leaving 45 committed goldens unchecked. Both remaining throw sites — `json::parse` and any runner field read — now funnel through `GuardGoldenStage`, which turns a `std::exception` into a `FAIL_CHECK` naming `goldens/<case>/manifest.json` and continues. `doctest::detail::TestFailureException` is deliberately not a `std::exception` (`third_party/doctest/doctest.h:2563`), so the #559 `FAIL` still aborts loudly and the widening cannot mute it. FIXED IN FLOW | bug |

tests/parity/goldens/README.md

@@ -32,6 +32,29 @@ exactly the set of manifests declaring a known op, and everything else is either
 loud-and-listed or loud-and-failing. A future oracle capture dropped into this
 tree cannot land unnoticed — it fails, by name, with the fix in the message.
 
+## A malformed golden never aborts the pass
+
+Closing the input set is not the same as closing the *exception* surface, and
+#776 is the difference. A manifest can be listed, named, and accept a runner and
+still make the walker throw: the file can be invalid JSON, or a field the runner
+reads can be absent or `null`. Either exception escaping `RunGoldenPass` aborts
+the whole test case, so **every golden the walker had not reached yet goes
+unchecked** — including the `no runner for op` check this directory depends on.
+That is a gate that has stopped gating while still looking like one red line.
+
+Both throw sites are now guarded. An exception from parsing a manifest, or from
+the runner reading it, becomes a `FAIL_CHECK` that names
+`goldens/<case>/manifest.json` and quotes the original exception, and the pass
+**continues to the next golden**. So a malformed golden costs you exactly its
+own case, and the report names the file instead of a line number in
+`test_op_parity.cpp`.
+
+The guard catches `std::exception` and nothing wider. doctest's
+`TestFailureException` is deliberately not derived from it, so a `REQUIRE` or
+`FAIL` inside a runner — the unregistered-op refusal above included — still
+aborts the pass exactly as before. The guard cannot mute an assertion; it only
+converts a thrown diagnostic that names no file into one that does.
+
 ## Adding an op-parity golden
 
 `manifest.json` carries at least: