fix(vision): stop VLM wrappers re-enabling a padded prefill their backbone refuses

[inureyes]

Summary

LanguageModel::supports_padded_prefill defaults to true. Every hybrid and recurrent text model in this tree overrides it to false, with the reason in the comment:

nemotron_h  false // Hybrid SSM model: padding tokens corrupt Mamba recurrent state
mamba2      false // Padding tokens corrupt Mamba2 recurrent state
jamba       false // Padding tokens corrupt Mamba recurrent state in hybrid architecture
kimi_linear false // Padding tokens corrupt DeltaCache recurrent state
rwkv7       false // Padding tokens corrupt RWKV recurrent state

Qwen35Model is one of them. Qwen35VLModel and MiniCPMV46VLModel each hold one in a text_model field and each already forward four other capability predicates (supports_batching, supports_batched_prefill, supports_paged_decode_backend, supports_snapshot_reuse) while leaving these two defaulted.

The result is a wrapper that answers true where its own backbone answers false, re-enabling an optimization the backbone disabled for correctness. The causal mask and trim_caches_to_actual_len undo the pad positions' effect on the KV caches; a GatedDeltaNet state that has already absorbed them cannot be rewound.

Impact

Silent. It compiles, it runs, and greedy output changes, on:

• Neural Accelerator hardware only (should_align_prefill() requires has_neural_accelerator && macos_supports_na), so M5-class and not M1 Ultra, and
• prompts whose token count is not already a multiple of 32, since align_to_na_tile is otherwise a no-op.

qwen3.8-27b-4bit is affected because its architectures field is Qwen3_5ForConditionalGeneration, so detect_text_or_vlm routes even a text-only run through Qwen35VLModel.

Measured on M5 Max, 75-token prompt, --temp 0 -n 120:

arm	generated	verdict
classic, before	630 chars	padded to 96, recurrent state corrupted
classic, MLXCEL_NO_PADDED_PREFILL=1	611 chars	correct
classic, after this change	611 chars	correct
MTP speculative, any config	611 chars	never padded, correct all along

With a 1312-token prompt (41 x 32) every arm agrees before and after, which is the control that isolates tile alignment as the variable.

How it was found

#1201, from a disagreement rather than from a crash. MTP's prefill_and_seed forwards the raw prompt length, classic padded it, and their temperature-0 outputs diverged at one token. The first four hypotheses were all wrong (the #1199 qmv_wide split, block width, the GDN chain-parity kernel, nondeterminism); each was ruled out by a control before this one was found. The instrumented build settled it:

[PROBE] should_align_prefill: true (na=true macos=true)
[PROBE] PADDED branch #1: actual=75 padded=96
[PROBE] UNPADDED branch: actual=75 supports_padded=true   <- with the env override

supports_padded=true on a model whose own impl returns false is the whole bug in one line.

The guard

tests/vlm_wrapper_capability_delegation.rs fails when a wrapper in src/vision/ holds a backbone that refuses padded prefill and does not forward the predicate.

It is source-level rather than runtime because constructing every wrapper needs weights, and the property is about which methods an impl block carries, which the source states directly. Two things keep it from rotting:

• The refusing-backbone set is derived by scanning src/models for impls that answer a bare false, not hard-coded, so a hybrid family added next month is covered the day it lands.
• "Wraps" means a field type, not a mention, so a doc comment naming a backbone the wrapper does not embed will not trip it.

Verified to fail: removing the Qwen35VLModel override reproduces the exact diagnostic naming the file, the wrapper, and the backbone.

Test plan

• -p mlxcel --lib fails the same 13 tests over two runs, matching the baseline; -p mlxcel-core --lib is 1472 passed / 4 failed. All are the pre-existing M5 reduced-precision failures of fix(core): f32 matmul and single-query SDPA lose ~fp16 precision on M5, breaking four numeric tests #1065.
• The new guard passes, and fails when the override is removed.
• cargo fmt --check and cargo clippy --all-targets --features metal,accelerate -- -D warnings clean.
• Behavior confirmed end to end: after the change classic decode and MTP produce byte-identical text with no environment variables set.

Not covered

Only the two wrappers the scan flags are changed. Every other wrapper in src/vision/ holds a plain transformer, where the true default is correct, and the guard now says so mechanically rather than by inspection.

Whether the server path has the same gap is not checked here: src/server/batch/scheduler.rs has its own should_align_prefill() and four align_to_na_tile sites, and whether those consult the model predicate at all is a separate question worth its own look.

Fixes #1201