[Wave 4] Low/info — Module sweep: Post-training: inference, chat, GGUF export, deploy, merging (part 3/3) #707

Wave 4 · 6 finding(s) in 6 fix package(s). Fix these whenever a pull request touches this module ("clean the module you touch").

Findings

• CR-A13-076 (code, Info) — Per-key merged.state_dict() rebuild makes delta collection O(keys^2) (H-A13-11 complexity half)
  severity Info · reachability documented-opt-in · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Failure scenario. None in practice; at most a couple of seconds per adapter on a 70B-class key count.
  Where. forgelm/merging.py:306
  Recommended fix. Hoist sd = merged.state_dict() out of the dict comprehension (one line). Gain: at most 0.3-2 s per adapter; do it together with the memory rewrite above, not on its own.

• CR-A13-078 (code, Info) — inference.adaptive_sample and logit_stats are production-dead (test-only) helpers
  severity Info · reachability default · intent intended-and-acceptable · confidence likely · independently confirmed · reproduced end to end
  Failure scenario. Maintenance and documentation burden; the docs imply wiring that does not exist.
  Where. forgelm/inference.py:347 (confirmed), forgelm/inference.py:378 (confirmed), forgelm/ingestion.py:2013, forgelm/ingestion.py:2018
  Recommended fix. Wire them into a caller, or document them as library-only, or remove them.

• CR-A13-079 (code, Info) — Export reports success and records the hash of a stale GGUF when the converter exits 0 without writing
  severity Info · reachability undocumented · intent intended-but-harmful · confidence confirmed · independently confirmed · reproduced with stubs
  Failure scenario. An operator or CI job re-exports into the same path after an earlier export. The converter exits 0 without producing the requested file. ForgeLM prints success with the old file's SHA-256 and writes that hash into model_integrity.json, so the release ships the previous model as the new export.
  Where. forgelm/export.py:344-345, forgelm/export.py:462-463, forgelm/export.py:461, forgelm/export.py:493-494
  Recommended fix. Remove or move aside any existing file at actual_output_path before running the converter, and fail when the file is missing afterwards. Add tests for the not-found branch and for a pre-existing stale file.

• CR-A13-080 (code, Info) — export.py nosec rationale overstates its safety: the '.py' filter on FORGELM_GGUF_CONVERTER is not a boundary, 'no user-supplied executable' is inaccurate, and the B607 suppression is stale
  severity Info · reachability documented-opt-in · intent intended-but-harmful · confidence likely · independently confirmed · reproduced end to end
  Where. forgelm/export.py:100-110, forgelm/export.py:313-328, forgelm/cli/subcommands/_export.py:16-23, pyproject.toml:307
  Recommended fix. Reword the comments to rest on the trust class (the operator controls the env var), drop B607 from the nosec, and either enable ruff's S rules or remove the inert noqa S-codes.

• CR-A13-081 (code, Info) — Ollama silently drops non-printable characters from any Modelfile value (ESC, ZWJ/ZWNJ, U+2028, U+0085). ForgeLM neither warns nor rejects, so such prompts cannot round-trip even after the escaping f…
  severity Info · reachability default · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end
  Where. forgelm/deploy.py:106-117
  Recommended fix. When the escaping is fixed, reject or warn on system prompts that contain characters for which str.isprintable() is false, other than tab, LF and CR.

• CR-A13-082 (code, Info) — No test drives ChatSession through a real chat template. Template rejection (system role or alternation) and the first role after trimming are unpinned.
  severity Info · reachability unreachable · intent intended-and-acceptable · confidence likely · single reviewer · not reproduced (code trace)
  Failure scenario. Suppose a regression appends history on a failed turn, or changes the slice to an odd window. The first retained message would then be an assistant turn, or user/user adjacency would appear, and every strict-alternation model would fail each turn. The current tests would stay green.
  Where. tests/test_chat.py:31, tests/test_chat.py:136, tests/test_chat.py:146, tests/test_chat.py:150
  Recommended fix. Add a ChatSession test with a tiny real tokenizer, or a minimal tokenizer stub whose apply_chat_template runs a jinja template that raises on system or on broken alternation. Assert that the first role after trimming is 'user', and that the rendered list stays valid after a failed turn and after /reset.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}