release 15 - the board stops invalidating daily; the M5/M4 re-mint on one pin, serve cards, and the news

.gitignore

@@ -187,6 +187,8 @@ ZEN2.md
 web/_serve/
 web/build_pt/_deps/freetype_src-build/include/freetype/config/ftoption.h
 modules/dasLLAMA/benchmarks/modules/.daspkg.log
+# asr pybench recovery file (raw reference rows, re-minted every sweep)
+modules/dasLLAMA/benchmarks/asr/_pybench_rows.txt
 
 # python bytecode, anywhere
 __pycache__/

CLAUDE.md

@@ -168,7 +168,7 @@ Multiple skill files may apply to one task: creating a new daslib module needs `
 
 New knowledge about daslang syntax, semantics, or conventions - from compiler errors, user corrections, or experimentation - goes into **this file**, or into the relevant `skills/*.md` when it belongs to a skill area.
 
-**Lint opportunities are reportable findings - don't hold back.** When a bug, review note, or probe reveals a pattern a lint rule could catch (especially one that has bitten more than once), SAY SO in the end-of-turn summary and propose the rule to Boris; the suite keeps paying for itself precisely because rules keep getting added. Rules land in `daslib/*_lint.das` (authoring: `skills/internal/perf_lint_authoring.md` / `skills/internal/style_lint_authoring.md`), and the finding's error text must stand on its own - no per-rule doc catalog exists.
+**Lint opportunities are reportable findings - don't hold back.** When a bug, review note, or probe reveals a pattern a mechanical check could catch (especially one that has bitten more than once), SAY SO in the end-of-turn summary and propose the rule to Boris; the suite keeps paying for itself precisely because rules keep getting added. Two landing places: a pattern one folder owns (a module's kernel classes, a test-folder discipline, a fixture-sync invariant) lands as a `REVIEW.das` gate in that folder - folder-local lint, and gate code worth writing shareably; a language- or repo-wide pattern lands in `daslib/*_lint.das` (authoring: `skills/internal/perf_lint_authoring.md` / `skills/internal/style_lint_authoring.md`). Either way the finding's error text must stand on its own - no per-rule doc catalog exists.
 
 **Syntax and factual corrections are fix-in-place, always.** A compiler error, probe, or user correction showing a claim in CLAUDE.md or `skills/*.md` is wrong, incomplete, or stale gets fixed in the same session and flagged in the end-of-turn summary - never deferred to a proposal. Verify first: grammar truth is `src/parser/ds2_parser.ypp`, behavior truth is a probe-compile with the current binary.
 

LAWS.md

@@ -30,3 +30,4 @@ compacted, or cited as rules.
 | 2026-08-28 | CLAUDE.md (document system), daslib/lint_config.das, utils/lint (LINT026 reverse + LINT027 arming), modules/dasLLAMA/.lint_config (deleted), utils/lint/README.md | "remove enable_arch link option entirely. its now mandatory." + "the idea is that arch lnks replace comments, where necessary" - the [arch] reverse pass runs in every folder with no tag; the LINT027 line gate arms on any folder holding a rule document; a citation replaces the comment that would restate the section (the harvester deletes the leftovers) |
 | 2026-08-28 | REVIEW_COMMON.md (harvest duty), ARCHITECTURE_COMMON.md (anchor form), .claude/agents/harvester.md (FACT names its citer), skills/internal/make_pr.md (row 0a0) | "i would like to ensure that harvested sections of architecture.md are linked to appropriate functions. im thinking a section in REVIEW_COMMON.md should be able to cover it" - a filed FACT lands as statement + anchor + citation from the source function in the same change; the harvester ledger names the citer or the fact is not filed |
 | 2026-08-28 | ARCHITECTURE_COMMON.md (anchor form), doc/source/reference/language/lint.rst (LINT026), skills/mcp_tools.md, utils/common/arch_citations.das, .github/workflows/extended_checks.yml (changed-set glob) | "should cite own subtree. if need citation outside - make citation in architecture.md in own subtree, in text form. not like automatic cross-link we resolve, but just a paragraph" + lint updated .md on CI, "skipping should be very cheap" - an [arch] citation must target a document whose folder is the citer folder or an ancestor; CI passes changed .md to the lint (a .md positional arms its folder with no .das compiled) |
+| 2026-08-30 | CLAUDE.md (lint-opportunity routing) | "not really lint, right? review.das ... review.das is local lint in a sense - and its an interesting, potentially shareable gate code" - folder-owned patterns land as REVIEW.das gates, language/repo-wide ones in daslib/*_lint.das; the routing paragraph names both |

modules/dasLLAMA/ARCHITECTURE.md

@@ -54,7 +54,7 @@ re-transcoding `$LCPP/src/unicode-data.cpp`).
   MoE region split.
 - `ARCHITECTURE_MEDIA.md` - sec.2.13-2.16: the padded tower GEMM widths, the family GPU hooks,
   the tower weight lane, and the plain-Model ASR decoders.
-- `ARCHITECTURE_MEASUREMENT.md` - sec.2.5, 2.10: the benchmark rig, the tune gate, and the
+- `ARCHITECTURE_MEASUREMENT.md` - sec.2.5, 2.10, 2.20: the benchmark rig, the tune gate, and the
   sanctioned instrumentation rails.
 
 ## 3. Inherited invariants

modules/dasLLAMA/ARCHITECTURE_ENGINE.md

@@ -2,16 +2,23 @@
 
 Companion to `ARCHITECTURE.md`; section numbers are that document's.
 
+`REVIEW.das`'s `check_exe_fn_global_restore` walks every `dasllama/` file and licenses no
+names: each `var g_x = @@fn` declaration carries an `if (g_x == null)` boot-restore guard in
+the same file - a serialized exe restores globals as data, and only a boot-restore `[init]`
+heals the null function value.
+
 ### 1.1 Engine core
 
 - **`dasllama.das`** - the public API facade and nothing else: `load_model` -> `create_session` ->
   generate, re-exported names, the doc surface. No engine logic; a function that does work belongs
   in the module that owns the concern, and the facade re-exports it.
-- **`dasllama_version.das`** - `DASLLAMA_VERSION`, the module's own release counter, and nothing
-  else. Decoupled from the daslang version and from `LLVM_JIT_CODEGEN_VERSION`; ANY kernel work
-  bumps it (REVIEW.md), so equal versions mean an equal kernel roster - the sidecar exchange
-  keys validity on (version, box). A zero-require leaf so the tuner's noise half, the benches,
-  and the facade chain (`dasllama_common` re-exports it) all reach it without weight.
+- **`dasllama_version.das`** - `DASLLAMA_RELEASE`, the module's release number, and nothing
+  else. Decoupled from the daslang version, `LLVM_JIT_CODEGEN_VERSION` and `IMAGE_VERSION`;
+  bumped only on a declared release (REVIEW.md), so tune sidecars and board rows live for a
+  whole release - the sidecar exchange keys validity on (release, box), under the
+  schema-stable wire name `dasllama_version`. A zero-require leaf so the tuner's noise half,
+  the benches, and the facade chain (`dasllama_common` re-exports it) all reach it without
+  weight.
 - **`dasllama_common.das`** - the engine: `Model`/`Session`/`Config`, the forward loops, the
   override registries, the runtime knobs. **Not** the load walk (sec.1.3) and **not** GPU residency
   (`ARCHITECTURE_GPU.md` sec.1.5) - both left, and the seam each left behind is a registered hook,

modules/dasLLAMA/ARCHITECTURE_GPU_PREFILL.md

@@ -177,7 +177,12 @@ prologue, the staged K walk with its barrier pair, and the store; a weight forma
 owns its weight-view bindings, and overrides the staged decode (`stage_block`) - mx4 also the
 store (its per-expert bias) and the chunk shape (32-deep, 128-item quota). The q8 twin is not
 a copy of this scaffold: its whole body is the tuned `tmm2d_q8u_f32` staged helper, a
-different staging mechanism, so it stays its own template. The gather-X pass
+different staging mechanism, so it stays its own template. The scaffold fixes its own binding numbers - `xf` at 3, `y` at 4, kargs at 5, `cnt` at 6,
+`basep` at 7 - and every derived twin inherits them. Those are NOT the family tail's numbers
+(`kn_moe_mm_family_tail` binds `cnt` at 7, `basep` at 8, `bkt` at 9), so a race harness
+hand-binding a tensor twin follows the scaffold's declaration and its base arm follows the
+tail's; binding a twin at the base's numbers hands the kernel the OUTPUT buffer as X, and the
+race then crowns whichever arm computed nothing. The gather-X pass
 copies the bucket's token rows into a CONTIGUOUS f16 panel with pad rows zeroed, which lets the up
 and gate sites ride the contiguous tensor twins instead of the in-kernel gather form; the panel is
 minted once per layer and shared by both sites. An X read through the bucket index can never

modules/dasLLAMA/ARCHITECTURE_MEASUREMENT.md

@@ -56,11 +56,36 @@ full retune when no manifest is armed. `performance/last_known_good_sidecar.json
 exactly that: a frozen copy of a complete, noise-gated mint, tracked in git (the `*.tune.json`
 ignore rule deliberately does not match it). Point `DAS_TUNE_MANIFEST` at it and the framework
 never retunes; on a different box the identity mismatch just serves fallbacks, and a copy minted
-before the current `DASLLAMA_VERSION` serves fallbacks on any box - the compile says which with
+before the current `DASLLAMA_RELEASE` serves fallbacks on any box - the compile says which with
 one `WARNING DAS_TUNE_MANIFEST` line per scope. That is the whole
 contract - it suppresses the re-exec, it does not tune the box, and a number measured under it
 is not a benchmark. Benches and the rig keep minting their own; refresh the copy when a
-re-mint moves the crowns or `DASLLAMA_VERSION` bumps.
+re-mint moves the crowns or `DASLLAMA_RELEASE` bumps.
+
+### 2.20 The ASR board's GPU row pairs {#asr-gpu-pairs}
+
+The das Metal ASR leg is OPT-IN per catalog row: `AsrModelSpec.metal_served`
+(`performance/profile_common.das`) declares that the Metal driver serves that family end to
+end - tower and decoder both. An unflagged family keeps the CPU by design, and asking for its
+GPU leg trips the anti-sandbag: the `--ngl` arms assert that the tower engage counters moved,
+so a family whose tower silently falls back reds its row instead of publishing a CPU wall
+under a GPU heading.
+
+Three reference tools carry a GPU arm the board pairs against a das Metal row, each with its
+own spelling: the whisper reference exe takes `-ngl`, the media-chat reference exe takes
+`-ngl 99`, and the NeMo bench script takes `--device mps`. The remaining two reference legs
+have no pair - the parakeet exe measures slower on the GPU, and the ONNX export is CPU-only -
+so their das rows stand alone in the CPU category.
+
+The media-chat reference exe is built as the bench exe's sibling in one reference worktree:
+`benchmarks/setup_lcpp_ref.das` builds both targets, because a bench-only build leaves the
+image and audio-chat cells with no binary and the board quietly mints das-only rows. That
+sibling needs the timing patch beside it (`benchmarks/asr/patches/`) - the record parser reads
+its per-rep timing lines, and an unpatched sibling mints "no rep parsed" failures. The apply
+is guarded on the patched marker already being in the tree, and runs three-way so it rides
+pin drift. On Apple boxes `performance/setup_asr_rig.das` builds a second, Metal-ON copy of
+the same patched checkout, because `-ngl` on a Metal-OFF build is inert; `mtmd_bin_metal()`
+returns "" when it is absent and the GPU reference leg skips loudly.
 
 ### 2.10 Sanctioned instrumentation rails
 

modules/dasLLAMA/BRINGUP.md

@@ -59,8 +59,8 @@ The tuner is the detector, so the human never has to be. For a box with existing
    **Any dasLLAMA source edit between here and the sweep invalidates the exe** - it bakes both
    the sources and the tune winners, so the rig refuses a stale one and prints the rebuild line.
    Re-release with `--quick` (inherits the complete sidecar, ~85 s) and carry on; the full
-   mint is not repeated for a code edit. Exception: kernel work - its `DASLLAMA_VERSION` bump
-   makes every existing sidecar read version-stale, so that release re-mints.
+   mint is not repeated for a code edit. Exception: a declared `DASLLAMA_RELEASE` bump
+   makes every existing sidecar read release-stale, so that release re-mints.
 4. **New box only:** the same big model vs llama.cpp (section 3 references) - when the
    absolutes have no history, the RATIO is the known quantity.
 
@@ -96,8 +96,8 @@ which makes every cell silently re-bake its own duplicate images. The orchestrat
 env itself when unset, but the converter runs in step 4 need it exported in the shell.
 
 **Mint the tune BEFORE the pre-bake, and re-mint after ANY daslang rebuild.** The manifest is
-mtime-gated against the binary and version-gated against `DASLLAMA_VERSION`: a rebuild or a
-kernel-work bump turns it stale (the refusal names which) and every kernel drops to
+mtime-gated against the binary and release-gated against `DASLLAMA_RELEASE`: a rebuild or a
+release bump turns it stale (the refusal names which) and every kernel drops to
 its fallback winner - the m4 pilot pre-baked one identity, then swept a whole board on
 fallback kernels under a manifest one rebuild older. The bench cells REFUSE to measure on
 non-manifest winners (`tune gate`; `DASLLAMA_ALLOW_UNTUNED=1` is the dev-run escape - it also

modules/dasLLAMA/LAWS.md

@@ -39,3 +39,30 @@
   `ARCHITECTURE.md` subsections cited from the owning functions via `[arch(at=...)]`, and
   the `cache_via_image` return contract promoted to a `//!` doc matching its sibling's
   wording. The module arms `[docs] enforce_arch = true` so every minted anchor stays cited.
+
+- **2026-08-30** (`REVIEW.md`, `ARCHITECTURE_ENGINE.md`, `ARCHITECTURE_MEASUREMENT.md`,
+  `performance/REVIEW.md`, `BRINGUP.md`): Boris ruled the version split - "separate dasLLAMA
+  version from all other versions. current one bumps version on any change. its inpractical.
+  we need 'major release' thing. otherwise ladderboard invalidates daily", approving the
+  minimal RELEASE form: "yes. this works for sure. it gives us flexibility we were missing".
+  `DASLLAMA_VERSION` became `DASLLAMA_RELEASE`, bumped only on a declared release; the
+  kernel-work bump duty in `REVIEW.md` was replaced by the declared-release rule; wire
+  field `dasllama_version` stays schema-stable; the per-kernel-hash hardening ledgered as
+  followup_general 58.
+
+- **2026-08-30** (`REVIEW.md`, `REVIEW.das`): on the serialized-exe null-function crash
+  (the vulkan decode-mirror claim; every -jit gate green while every exe forward died),
+  Boris confirmed the rule - "likely REVIEW.md candidate?" ... "yes. excellent followup" -
+  a declaration-initialized function-typed global joins its file's boot-restore [init] in
+  the same change; check_exe_fn_global_restore is the mechanical half, test_exe_smoke the
+  end-to-end tripwire.
+
+- **2026-08-30** (`REVIEW_MEASUREMENT.md`): at the pre-PR .md stop Boris ratified the
+  figure rules' re-scoping to module-owned surfaces (ledgers, docs, code comments, PR
+  bodies), with served pages routed to the site checklists' own provenance duty - "3.
+  agreed".
+
+- **2026-08-30** (`REVIEW.md`): Boris ratified the DASLLAMA_RELEASE bump rule's paper-trail
+  clause - a bump's diff also carries the LAWS.md entry recording the declared release; the
+  declaration itself stays his call, on feel ("the intent was to bump due to major changes
+  ... i go on feel on that one" - "4. agreee").

modules/dasLLAMA/PERF_LEDGER.md

@@ -1160,3 +1160,24 @@ group; wording kept.
   per-region walk vs the dense flat sweep. Instrument: `harness/moe_kq_probe.das` (synthetic-k4
   bare-kernel cells at expert shapes, dense-shape control included); ref bar re-taken against
   the b10659 clean-cpu build at the arc-end re-mint.
+
+- **The mlxfast arena trunk is a standing M5 kernel-shape intel source - watch it, adopt
+  shamelessly (Boris, 2026-08-30: "if there are better shapes on M5 - we are shamelessly
+  adopting").** The arena (yukon.org/mlxfast, repo Layr-Labs/mlxfast-gemma4-26b-a4b-engine,
+  local clone ~/Work/mlxfast) runs a collective ratchet: every accepted submission lands on
+  `main`, so the trunk is a continuously-updated record of what 26 solvers' search found on
+  Apple silicon. Every figure in this entry is `external` (their arena composite scorer and
+  their `mlxfast-reports` engine.md - not our instruments; the composite is a two-commit
+  delta of their trunk on their box, `direction-grade`): the 2026-08 delta (+30% composite
+  in 33 commits, 100% kernel work) carries three candidates for our Metal kernels, surveyed
+  in the MTP research notes (local: ~/.claude/plans/mtp-research/mlxfast.md):
+  (1) tight-grid dispatch - launch only causally/structurally valid threadgroups instead of
+  early-returning ~75% of them (their decode step waived 158k of 211k tgs; our QK/AV grids
+  have the same triangular waste, their engine.md item 4); (2) identity `scale*q`
+  elision (~4.4 GB/prefill of traffic on their shapes); (3) a nine-dispatch norm/residual
+  fusion. External figures ground the lead only - each candidate adopts through our own race
+  or knockout plus a re-minted cell. Re-check the trunk each arc; diff since the last-read
+  sha before every adoption pass. License verified 2026-08-30: MIT top to bottom - harness + submissions (c) 2026
+  Layr Labs, vendored mlx-swift incl. Metal kernels (c) 2023 ml-explore/Apple - so adoption
+  is clean with those two attribution lines (the NAX arc's steel_attention_nax credit is the
+  house pattern); model weights are not in the repo and carry their own terms.

modules/dasLLAMA/REVIEW.das

@@ -240,12 +240,48 @@ def private check_gpu_role_partition {
     }
 }
 
+// A serialized exe restores globals as DATA - a function value assigned in a declaration
+// initializer arrives NULL, and only a boot-restore [init] heals it (dasllama_config's
+// restore_dlim_source_defaults states the law). So every `var g_x = @@fn` declaration must
+// have an `if (g_x == null)` restore guard in the SAME file, or the first exe run to reach
+// its invoke dies with `invoke null function` while every -jit gate stays green - the vulkan
+// decode-mirror claim shipped exactly that way.
+def private check_exe_fn_global_restore {
+    dir("modules/dasLLAMA/dasllama") $(name) {
+        if (!(name |> ends_with(".das"))) {
+            return
+        }
+        let path = "modules/dasLLAMA/dasllama/{name}"
+        let text = fread(path)
+        var line_no = 0
+        for (line in split(text, "\n")) {
+            line_no++
+            var rest = ""
+            if (line |> starts_with("var private ")) {
+                rest = slice(line, length("var private "))
+            } elif (line |> starts_with("var ")) {
+                rest = slice(line, length("var "))
+            } else {
+                continue
+            }
+            let gname = ident_prefix(rest)
+            continue if (!(gname |> starts_with("g_")))
+            let eq = find(line, "= @@")
+            continue if (eq < 0 || (find(line, "//") >= 0 && find(line, "//") < eq))
+            if (find(text, "if ({gname} == null)") < 0) {
+                gate_finding(path, line_no, "function global `{gname}` has a declaration initializer but no `if ({gname} == null)` boot-restore guard - a serialized exe restores it as NULL and the first invoke dies (add it to the file's restore [init])")
+            }
+        }
+    }
+}
+
 [export]
 def main() : int {
     if (!fexist("modules/dasLLAMA/REVIEW.das") || !fexist(FACADE)) {
         to_log(LOG_ERROR, "modules/dasLLAMA/REVIEW.das: run from the repo root\n")
         return 2
     }
+    check_exe_fn_global_restore()
     check_gpu_role_partition()
     check_fastmath_default()
     var inscope tut_texts : array<string>