policy(POLICY-NOTHING-LANDS-DEAD): require what lands to be reached

[localai-bot]

The seam checkers ask where a capability routes. Nothing asks whether
anything reaches it. Those are different failures, and only the first
one is caught today.

What changed

AGENTS.md gains a ## Nothing lands dead section, and .agents/
gains the reachability.md task guide. The rule states three things.
What lands is reachable from a production entry point at its own merge
commit: include/vllm.h, the loader, ModelRegistry::Forward, or a
registered server or command-line path on its default configuration. The
smallest failing test enters the new code through that entry point,
because a unit test that constructs the type by hand proves that the
class works and never that anything reaches it. A staged slice may land
unreached only when the commit body and the pull request body name what
is unreached, the row ID that owns the wiring, and the issue that tracks
it, and the row spec lists it under ## Owed.

The fresh reviewer proves it by deleting the production call site in a
scratch copy and rerunning the focused gate. A gate that stays green
without the call site measures a class, not a capability.

AGENTS.md carries only what binds, because every agent loads that
file. The method, the shapes dead code takes, and the reason no checker
enforces this live in the guide. Four existing guides gain a
cross-reference rather than a restatement: verification.md,
porting.md, porting-a-model.md, and workflow.md.

Why the change is needed

Tensor parallelism shows the cost. The audit records it at
specs/tensor-parallelism-spike.md:96-101: the tp handle threaded
from LayerForward down through the Qwen3-dense forward at
qwen3.cpp:92,114,126,136 and dead-ended there. No caller above the
layer passed anything but the default nullptr. No production loader
passed tp into LoadMergedBf16RawNK, and every call site omits it.
The only tp>1 driver in the tree was a toy test. Every declared gate was
green, and no user could arrive at the feature.

check-fusion-consistency.py, check-runner-routing-consistency.py and
check-surface-coverage.py all pass a capability that routes through
the correct seam and that nothing calls.

How a reviewer verifies it

The change is Markdown under .agents/ and AGENTS.md. No checker
changes, so no gate moves.

scripts/agent-preflight.sh --staged at 62406c30e: the record gates
that govern this change are green — check-agent-record,
check-prompt-contract, check-role-discipline, check-now-current,
doc-checkpoint --staged, now-current --staged.
check-commit-style.py and check-commit-trailers.py over
origin/main..HEAD both report OK.

What remains unverified or out of scope

Eight preflight gates are red and none belong to this change. Seven of
them — check-release-binary-contract, check-release-workflow,
check-test-registration, test_check_release_binary_contract,
test_release_manifest, test_release_pipeline,
test_check_test_registration — were verified red on the clean base
commit 62406c30e itself, with this diff absent. The eighth,
test_cpu_x86_llamacpp_floor, is the load-dependent floor of #618 and
failed at loadavg 104.

No checker enforces the new rule, and that is a decision rather than an
omission. A checker that could separate a live call site from a dead one
would have to resolve overloads, templates, and registration tables
across the tree, and a floor coarse enough to write would pass the cases
that hurt. The tp handle appeared in four production files and was
still dead. The guide records the refusal and its reason.

.agents/prompts/reviewer.md gets no REV-REACHABILITY method row. That
file is a closed grammar pinned in check-prompt-contract.py, so the row
would be a semantic checker change owing its own spec and red-before
evidence. The obligation rides in the dispatched reviewer task envelope
through workflow.md instead, which is weaker because an operator can
omit it.

Closes #886

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [Claude Code]