I've completed a thorough trace of the B2 implementation against the approved design. I verified the kernel, the device API, the sweep integration, the non-CUDA guarding, stream serialization, fold isolation, and the test — and cross-checked the actual diff against HEAD. Here is the review.

---

# Adversarial Review — B2 device-resident dual-Ridge (upload-once K + reuse-buffers Cholesky)

## VERDICT: **ship**

The implementation faithfully matches the approved `_b2_fable_design.md` §3/§4. I found no correctness bugs, no fold leakage, no ABI/scope violation, and no non-CUDA-build breakage. The numerical-equivalence argument holds and the test asserts it correctly. Two non-blocking process/style notes below. (Per the brief, the orchestrator runs the GPU tests + bench separately to confirm the numbers — this review is static.)

---

## Findings

**1. [OK] `add_scaled_identity` is bit-identical to host `K[i*n+i]+=λ`.** `cuda_kernels.cu:193-202` — adds to `A[i*n+i]` only (layout-agnostic diagonal), plain fp64 `+=` with no multiply so FMA contraction is impossible, `i>=n` guard correct. Launcher `cuda_kernels.cu:311-329`: `n==0`→`cudaSuccess`, null/`>INT_MAX` guard, grid `ceil(n/256)`, returns `cudaGetLastError()`. Diagonal index is identical in row/column-major, so the matrix fed to `potrf` is byte-for-byte the matrix `spd_solve` would upload after host-forming `K+λI`.

**2. [OK] `prepare_dual_ridge` uploads K + column-major B0 exactly once and never throws.** `cuda_dispatch.cpp:1292-1361`. Mirrors `spd_solve`'s guards (runtime/null/zero/int-range/`mul_overflows`), uploads full symmetric K (`:1331`), packs `Bcm[target*n+i]=B[i*q+target]` (`:1334-1338`), computes `potrf_bufferSize` once into `h->lwork` (`:1344-1346`) — content-independent so valid even though K has no λ yet. Every exception path (incl. `bad_alloc`) returns `nullptr` (`:1349-1360`). Caller treats `nullptr` as host fallback. Correct.

**3. [OK] `dual_ridge_solve` re-copies into work buffers each call; pristine `dB0` is never the `potrs` target.** `cuda_dispatch.cpp:1363-1449`. `copy_d2d(dK→ws.dA)` (`:1394`), `add_scaled_identity(ws.dA,λ)` (`:1396`), `copy_d2d(dB0→ws.dB)` (`:1398`) — `potrf`/`potrs` operate on `ws.dA`/`ws.dB`, so `dK`/`dB0` stay pristine for the next λ. Return contract matches `spd_solve`: `potrf` info `>0→1`, `<0→2` (`:1407-1416`); `potrs` info `≠0→2` (`:1423-1426`); column-major→row-major unpack (`:1430-1434`); try/catch→`2`. The `lwork<0` guard at `:1376` correctly precedes `ws.ensure`'s `static_cast<size_t>(lwork)` at `:1392`.

**4. [OK] No fold leakage; thread-local workspace is fully overwritten and shrink-safe.** Each materialized fold owns its own `PreparedDualRidge` (own `dK`/`dB0`) via `fold_prepared_dual[fold_ix].handle` (`sweep.cpp:2100-2105`); there is no shared persistent K. The single `thread_local ReusableDualWorkspace` (`cuda_dispatch.cpp:1388`) has all leading `n²`/`n·q` elements rewritten by the two D2D copies every call, and `ReusableDeviceBuffer::ensure` only grows (`:162-179`) while `potrf`/`potrs` use `ld=ni` on the leading region — stale tail bytes are never read. `dWork` is sized per-call to `max(seen lwork)` and each `potrf` is passed its own fold's `handle->lwork`, which is ≤ capacity regardless of fold order. Holds across separate `run_moment_sweep`/Context calls on the same thread too.

**5. [OK] Numerical equivalence + the test are real and assert the right thing.** Because the matrix into `potrf` is bit-identical to `spd_solve`'s and the same cuSOLVER runs on the same GPU, `dual_ridge_solve` reproduces `spd_solve` to ~1e-12. `test_internal_linalg.cpp:372-462` builds an un-bumped SPD gram, and for λ∈{1e-3,0.1,1.0,10.0} compares `dual_ridge_solve(h,λ)` against `spd_solve(K+λI)` (the B1 path, not host QR) with `max|Δ|≤1e-8` (`:435-443`); the singular `diag(1,…,1,0)` case asserts `dual_ridge_solve(...,0.0)==1` (`:447-459`). GPU-self-skips (`:373-376`), registered at `:476`. Solid.

**6. [OK] Stream serialization is correct — no race despite the switch to async D2D.** `spd_solve` used synchronous `copy_h2d`; `dual_ridge_solve` uses async `copy_d2d_contiguous` (`cudaMemcpyAsync`, null stream — `:528-531`) + a null-stream kernel, then `potrf` on `state().solver`. `state()` (`cuda_dispatch.cpp:48-86`) **never** calls `cusolverDnSetStream` (confirmed: no occurrence in the file), so the solver is bound to the null stream. `LocalCublasHandle` (`:559-570`) is the only `SetStream` user and is a separate per-stream handle. All ops issue to the null stream from one serial thread → D2D → kernel → `potrf` are ordered; `copy_d2h(&info)` forces the sync. Matches design trap #4.

**7. [OK] Non-CUDA build is correctly guarded — not compiling by accident.** `struct PreparedDualGpu;` is forward-declared unconditionally (`sweep.cpp:86`), defined only under `#if defined(N4M_USE_CUDA)` (`:88-114`). The three consumers take `const PreparedDualGpu* gpu = nullptr` (`:564`, `:609`, `:661`) — a pointer to an incomplete type, which is legal; `gpu` is dereferenced (`->valid()`, `->handle`) only inside the `#if` block of `solve_dual_alpha` (`:542-553`), with `(void)gpu;` in the `#else`. `fold_prepared_dual` (`:2072`) and the call-site `dual_gpu` selection (`:2239-2244`) are `#if/#else`-guarded (`nullptr` in non-CUDA). No `sizeof`/instantiation of the incomplete type in non-CUDA. Correct by construction, not by luck.

**8. [OK] Gating, fallback, and `N4M_CUDA_RIDGE_DISABLE` all preserved.** Prepare is gated on `lambdas.size()>1U && ridge_cuda_dual_enabled(n)` (`sweep.cpp:2097-2098`), reusing the n≥256 threshold + runtime check + disable-env (`:465-478`). `solve_dual_alpha` falls to the unchanged `solve_dual_spd` on `nullptr` handle, return `1`, or return `2` (`:543-556`). With `N4M_CUDA_RIDGE_DISABLE` set, no handle is prepared *and* `solve_dual_spd` also takes the host-QR branch → byte-for-byte the pre-GPU host path.

**9. [OK] Scope — only the 3 grid consumers rerouted; final fits default-null; no public/ABI surface.** The diff (`+720/−18`) is purely additive except the 18 deletions, which are exactly the three inline `K=design.K; K[i*n+i]+=λ; solve_square_qr(...)` blocks replaced by `solve_dual_alpha(...)` (verified in `git diff`). Final single-λ fits at `sweep.cpp:2625` and `:2729` omit the arg → default `nullptr` → unchanged behavior. New symbols live in `n4m::cuda_dispatch` (internal header `cpp/src/core/`, not `cpp/include/n4m/`, no `N4M_API`, hidden visibility, not in the `N4M_1` map) → not in `nm -D`; ABI stays 1.22.0. No catalog/Python/`.def`/`.map` change. (The orchestrator's `expected_symbols_*.txt` diff is the authoritative confirmation.)

**10. [STYLE] B1 and B2 are bundled in one uncommitted working tree — the "B1 already shipped" premise doesn't match git.** `spd_solve`, `solve_dual_spd`, and `ridge_cuda_dual_enabled` do **not** exist at HEAD (`fcff454`); they are added in the same uncommitted blob as B2. So "B1's spd_solve/solve_dual_spd UNCHANGED" can't be checked against a committed baseline — within this blob they're present and B2's additions don't touch them, which is functionally what matters. One real consequence to flag for the bench gate: vs HEAD, the dual CV consumers switch from **host QR** to **GPU Cholesky** in this change (a B1 decision), so the host-vs-GPU ≤1e-8 parity run must pass for the *whole* dual path, not just the prepared variant — but B2's `dual_ridge_solve` is bit-identical to `spd_solve`, so B2 adds zero new divergence on top of B1. Suggested fix: split into two commits (B1 per-call routing, then B2 prepared handle) so the parity delta is attributable; not a code defect.

**11. [STYLE] Redundant GPU attempt on the not-PD fallback (harmless, cold path).** When `dual_ridge_solve` returns `1`, `solve_dual_alpha` falls to `solve_dual_spd`, which (since `ridge_cuda_dual_enabled` is still true) re-attempts `spd_solve(K+λI)` — that also returns `1` on the same matrix — before reaching host QR (`sweep.cpp:554-556` → `:486-498`). One wasted GPU Cholesky, only on a non-PD `K+λI` (essentially never for λ>0 on a PSD gram). Optional: have the GPU fallback go straight to `solve_square_qr` when the prepared solve already reported not-PD. Not worth blocking on.

---

The core path is correct, the device/host equivalence is sound, the fallback chain is intact, and the non-CUDA build is guarded properly rather than accidentally. Ship after the orchestrator confirms the GPU equivalence test and the BERRY `nsys`/RMSEP parity bench.