[leehack]

Summary

• Repin the default WebGPU bridge assets to v0.1.85 (immutable, bridge f1ac2fc1, native v0.9.0), for #1025 in the 0.19.10 plan.
• Map the bridge's CrossOriginIsolationError (CROSS_ORIGIN_ISOLATION_REQUIRED) to LlamaUnsupportedException naming COOP/COEP require-corp (and that credentialless does not isolate Safari), on the direct and worker paths.
• Append the bridge's gpu_unavailable:<reason> note to the "loaded the model without GPU layers" error (adapter_missing_shader_f16 names shader-f16 and NVIDIA driver 615.71+); older assets keep the current text.
• Drop the stale threads_capped_no_coi chat-app hint and fixtures (the typed load error now carries the isolation message); document the measured Safari 27, Firefox 160 and NVIDIA L4 results.

Production-readiness scope

• User-facing scope: a page without cross-origin isolation fails fast with an actionable typed error; ComputeDevice.gpu failures say why WebGPU was not used.
• Supported platforms/paths: Web (direct and worker bridge paths); docs.
• Unsupported or intentionally unavailable paths: no isolation throws LlamaUnsupportedException; assets older than v0.1.85 emit no gpu_unavailable note and keep the plain GPU error. webgpu_load_retry_policy.dart still treats threads_capped_no_coi as a thread failure (and its tests keep that note) for older assets.
• Out of scope / follow-ups: Safari one-GPU-layer default (llama-web-bridge#217). The chat app adds no separate isolation banner: the load error text is shown as is.

Completeness checklist

• Declared scope is fully implemented, or explicitly reduced above.
• Unsupported platform/option combinations fail loudly with actionable diagnostics or are clearly documented as unavailable.
• Public API docs, README/website docs, examples, support matrices, and changelog entries are updated where relevant.
• Regression coverage covers the original issue plus key negative/version-skew paths where relevant.
• Public capability changes update the validation coverage registry with a pack or a reasoned, issue-linked exemption; inventory checks pass (N/A: no capability change; validation_coverage_test.dart passes).
• Security/privacy review completed: no secrets, bearer tokens, signed URLs, or raw secret-bearing paths leak through logs, cache keys, metadata, errors, or snapshots.
• Follow-up work that is useful but not required for this PR is tracked in GitHub Issues, or explicitly marked "None" above.

PR type guidance

• Feature PR: N/A
• Bugfix PR: root cause is the bridge's silent CPU fallback and its 90 s isolation hang (bridge PR 219); tests below cover both reasons, the direct and worker error shapes and the old-asset path.
• Docs-only PR: N/A

Test Plan

• dart run tool/prepare_workspace.dart
• dart format --output=none --set-exit-if-changed .
• dart analyze
• dart test -p vm -j 1 --exclude-tags local-only (14432 pass)
• dart test -p chrome --exclude-tags local-only (all pass)
• coverage-lib matrix row: PASS: 93.93% line coverage (34422/36645). One unrelated two-process download test failed once under coverage (child could not resolve its cache dir) and passes alone
• Other: dart test -p vm test/unit/tooling/, check_webgpu_bridge_tag.dart --verify-manifest, chat app flutter test test test_vm and the Chrome list, ./tool/docs/build_site.sh

Matrix Evidence

Matrix row	Scope covered	Platform / model / backend	Result	Evidence / notes
coverage-lib	lib/ coverage	VM	PASS: 93.93% line coverage (34422/36645). One unrelated two-process download test failed once under coverage (child could not resolve its cache dir) and passes alone
web-lazy-grammar	lazy grammar, penalties, thinking-budget grammar through pinned assets, direct and worker	Chrome CPU wasm, stories15M + Qwen3.5-0.8B-Q4_K_M	PASS (16)	local
web-production-artifact-smoke	production-root chat app, --coep require-corp, real worker/GGUF	Chrome (Playwright), stories15M, assets v0.1.85	PASS	local
web-chrome-runtime-smoke	browser-safe tests	Chrome	PASS	dart test -p chrome

Mutations (each killed by the new tests): dropped GPU reason text, isolation mapping disabled, code check removed, name check removed, driver-version text changed, unknown-reason text removed.

Review Notes

• Independent review status: deep audit at 18918034 no-block; delta re-audit at 7801bdf3 no-block (fresh agents, not the author).
• CI status / head SHA: green at 7801bdf3f78c70eb46dc230c794783f1a1c51061 (33 pass, 9 skipped).

High-risk regression review

• Classification: high-risk (artifactConsumer, backendRuntime, regressionPolicy)
• Implementation task: this PR
• Independent blocking QA task: fresh-agent audits; evidence llamadart-evidence/pr-2001/ and pr-2001/delta-7801bdf3/ (readiness evaluator exit 2)
• Exact head / current base: 7801bdf3 / 1ce4565c
• Production-branch deletion, bypass, or miswire proof: N/A (pin, error mapping and docs; checked by check_webgpu_bridge_tag.dart --verify-manifest)
• Affected-family real-model/artifact evidence: stories15M and Qwen3.5-0.8B on the pinned assets (above)
• Explicit unavailable-family or other N/A evidence: Safari 27, Firefox 160, NVIDIA L4 results are doc statements from the Web: Safari llama.cpp WebGPU path, Firefox and non-Apple GPUs not validated #1025 planner evidence (nvidia-fallback/gce/gce-run2/), not re-run here
• Known PR-caused P1 regressions: 0
• Unresolved review threads: 0

Remaining P3s (tracked on #1993): v0.1.85 rows sit above v0.1.84 in two version lists; the v0.1.85 rows say a page without cross-origin isolation is rejected at once, but the check is whether shared memory is usable (flag-enabled non-isolated Chrome still loads); allowSingleThreadCore is not reachable from llamadart.

[github-actions]

Chat app preview removed for leehack/llamadart-chat-pr-2001.