gqa(adr): ADR-0064/0065 second-pass review — 1024B rationale, FIFO as ordering source, robust formula-based tests, D5/D6 auto-bind alignment

ADR-0064 Revision 2 second-pass review fixes:
- D7 added 1024-byte cap rationale: explicitly framed as a *safe
  engineering limit* (intentionally above all known composites at ~322
  bytes, finite descriptor capacity placeholder), not a measured HW
  number. Default is the discipline; topology override for real HW.
- D7 segment ordering: strict FIFO is the *ordering source*; rw_handles
  is dependency metadata, not the ordering primitive. Explicit note for
  the future RW-aware reorder migration path.
- Tests rewritten around the formula (D1) instead of specific numbers:
  - Test #1 → "formula preservation" (parametrized across composites,
    asserts dispatch == FIXED + bytes × R, not anchor 43 ns).
  - Test #2 → robust "opt3 > 2 × opt2" qualitative gate; ≈ 4.0× is
    informative only, not the gate, so calibration changes don't break.
  - Test #9 → qualitative (opt2 < opt3 at all R), not a numeric ratio.
- Anchor description in D3 stays as *informative* (shows the model
  produces ≈ 43 ns at defaults), but is no longer a test gate.

ADR-0065 second-pass review:
- D5 step 5 aligned with D6.6 invariant: explicit conflict check before
  auto-binding (previously written as if auto-bind always happens).
  Mirrors D6.6 wording: error if both kernel explicit `a` and prologue
  primary_out are present.
- Test #7 made robust: `opt3 > 2 × opt2` gate (was ≈ 4.0×).
  Default-calibration model expectation (≈ 4.0×) recorded as informative
  reference, not the gate.

DDD-0065 follow-on robust thresholds:
- §1.4 success criteria: ratio condition rewritten as `opt3 > 2 × opt2`
  with model-expected ≈ 4.0× as informative.
- §9 P6 phase gate: `opt3 > 2 × opt2` (was 4.0× ± 15%).
- §10 dispatch ratio test: assert `opt3 > 2 × opt2`; record observed
  ratio for performance tracking but do not gate on it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/adr-proposed/ADR-0065-prog-flat-ops-composite-softmax-merge.md

@@ -200,7 +200,11 @@ op="gemm", ...)`:
 3. Derives the primary output P's shape from `s.shape` (identity).
 4. Expands `engine_seq` into 8 flat MATH OpSpecs with all addresses /
    sizes filled. Each OpSpec gets `scope=KERNEL`.
-5. Auto-binds head GEMM's `operands["a"] = P_handle`.
+5. **Auto-binds (with conflict check, D6.6).** If the head GEMM does
+   *not* explicitly provide `operands["a"]`, auto-bind
+   `operands["a"] = P_handle`. If the kernel *did* provide `a`
+   explicitly, emit a validation error — ambiguous primary-output
+   replacement.
 6. Emits `CompositeCmd(ops=(8 MATH + 1 GEMM + epilogue), rw_handles=
    (m, l, O))`.
 
@@ -370,10 +374,14 @@ input from #1's epilogue scratch — circular tile-loop dependency.
    `space=hbm` emits DMA_WRITE; `space=tcm` does not.
 6. **opt2 numeric parity with opt3.** In data mode, opt2's final
    `(m, l, O)` matches opt3's within fp tolerance.
-7. **opt2 dispatch ratio (after ADR-0064 Rev2).** opt3 vs opt2 per-tile
-   PE_CPU dispatch cycles ratio ≈ 4.0× at default calibration
-   (FIXED=40 cycles, R=0.0625 cycles/byte). Ratio is FIXED-dominated,
-   reflecting command-count reduction as the primary signal.
+7. **opt2 dispatch ratio (after ADR-0064 Rev2) — robust.** opt3 vs
+   opt2 per-tile PE_CPU dispatch cycles satisfies `opt3 > 2 × opt2`
+   (qualitative gate; calibration-independent). The default-calibration
+   model expectation is ≈ 4.0× (FIXED=40 cycles, R=0.0625 cycles/byte)
+   — see DDD-0065 §11 for the model-derived numbers; only the loose
+   `> 2×` bound is the test gate so it survives calibration changes.
+   Ratio is FIXED-dominated, reflecting command-count reduction as the
+   primary signal.
 8. **GEMM-count invariant.** A composite with two GEMM OpSpecs raises a
    validation error at TLContext emit.
 9. **Within composite size cap (ADR-0064 D7).** Decode opt2's `#2`