dasMetal/dasLLAMA: Metal-4 tensor lane — tune-raced matmul2d twins across 12 kernel families

[borisbat]

The S3 Metal-4 tensor lane: every matmul-shaped Metal kernel family gains a tensor pso twin lowered through mpp::tensor_ops::matmul2d, raced against its shipped simdgroup kernel by the tuner per box, with the winner crowned into the tune sidecar's runtime.metal_tensor list. Pre-M5 boxes keep simdgroup everywhere (measured); M5 day is a tuner run per box, zero construction.

Emitter rail (dasMetal)

• Direct forms — tmm2d_f32_bf16_f32, tmm2d_q8_f32/tmm2d_q8_f16s (i8×i8 with per-block scale folds), tmm2d_q8b_f32 (34B-interleaved q8_0 W × raw f32 X, explicit W-row-stride-in-blocks for split-K): named-call interception emits generated MPP preamble helpers over tensor_inline views built from the existing plain buffer binds — no host MTLTensor, encode paths untouched.
• Staged-tile protocol — tmm2d_tg_begin/step/store for dequant-staged formats: flat row-major f16 tiles per K-chunk in threadgroup memory, a persistent cooperative accumulator with an explicit per-chunk fold (run() on a cooperative destination overwrites — probe-proven), the das-side accumulator array is the CPU-replay state and its declaration is suppressed on GPU.
• Runtime MSL language version pinned to 4.0 on macOS 26 (the default tracks the SDK the module binary was linked against — verified on both dev boxes).
• Conformance: tests/metal/test_metal_tensor_ops.das — every form GPU == CPU-replay bit-exact (integer-valued data + pow2 scales make all float orders exact), incl. the staged two-chunk kernel.

Twin families (dasLLAMA)

Prefill: Bf16MulMm, Q8MulMm, MoeMulMmQ8 + MoeMulMmMx4 (contiguous down-site only — bkt-gathered X cannot form a strided tensor view; gate/up fall back per dispatch), KqMulMmK4/K5/K6 (per-element kmask / qh-plane / sub-scale dequant into flat tiles), AttnQKMm/AttnAVMm (Q pre-scaled at staging; V staged transposed with pad-position zeroing; causal/window skips are threadgroup-uniform, cooperative-safe). Decode: Q8GemmB/Q8GemmBSk/Q8Gemm64B. Crowns are consulted once at pso build; the twin variant skips the tgmem bind when it has no tiles.

GEMV twins are structurally impossible: matmul2d hard-asserts M % 8 == 0 (MPPTensorOpsMatMul2dImpl.h:4257), so the skinny-M decode forms (m=1/2/4) cannot compile — the race's compile-probe eligibility handles this automatically. Revisit on M5 only via an X-pad-to-8 staging redesign if the GEMM races justify it.

Tuner race

tune_kernels runs metal_tensor_race() + metal_tensor_race_decode() after the CPU sweeps and writes the winner list into the sidecar. Races run on synthetic planes (random quant bit patterns + constant scales — the twin-vs-base envelope doubles as a layout-agreement proof of every per-element decode). Races interleave adjacent base/twin dispatch pairs per rep — sequential per-side blocks read the GPU clock ramp as a phantom winner (caught live on an M4: sequential timing manufactured +64% k-quant "wins" that the interleaved protocol and the tuner's own context both refute).

Measured verdicts: M1 Max — all 12 families stay simdgroup. M4 Pro — mulmm_bf16 tensor +2.8% (crowned), rest simdgroup. tests/metal 41/41 green on both boxes.

Also in this PR

• ast_dse.cpp fix: dead-store elimination stripped a store whose impure rhs is operator-topped to a bare op2 statement, which the top-level no-side-effect lint rejects when a reused shared module re-lints its optimized AST. Operator-topped impure stores now stay whole; optimization_dead_stores.das re-pins the behavior (35/35).
• @role is now optional everywhere: undeclared @ssbo fields derive read/write from the kernel body (the census still cross-checks declared roles). The access classifier learns the tmm2d pointer operands and suffix-matches generic-instance call names.

Gates

Force-crowned via a DAS_TUNE_MANIFEST copy: llama prefill (base/cont/dim/qkv/kq), llama decode arm+batch suites, gemma4e-E4B token parity (PLE bf16), qwen3moe matrix row (MoE down-site), gptoss matrix row (mx4). tests/metal 15 files, kernel-units suite, DSE suite. preflight --full: 16/17 — the one red is a known pre-existing untracked local test (tests/jit_tests/exe_funcptr_globals.das, not part of this PR), hence the announced no-verify push.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR extends the Metal backend and dasLLAMA Metal kernels with a “tensor lane” by introducing Metal-4 mpp::tensor_ops::matmul2d-lowered twins for matmul-shaped kernels, then adds a tuner race to crown the best variant per box. It also includes a dead-store-elimination fix to avoid generating lint-illegal “pure-op” statements, and expands PERF026’s @scratch contract to cover additional reuse patterns.

Changes:

• Add MSL emitter support + CPU-replay stubs for tmm2d_* tensor-op markers (including a staged-tile protocol) and introduce a conformance test covering GPU vs CPU replay.
• Add dasLLAMA Metal prefill/decode “twin” kernel families, plus tuner-side racing that writes winners into the sidecar runtime’s metal_tensor crown list; runtime consults crowns at PSO build.
• Fix ast_dse to keep operator-topped impure dead stores intact (avoids top-level no-side-effect lint failures) and broaden PERF026 @scratch handling (globals, table indexing, ref bindings, mid-chain nolint).

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
utils/lint/tests/perf026_hot_path_alloc.das	Updates PERF026 fixture expectations and adds new cases for @scratch globals/tables/ref bindings and mid-chain nolint.
tests/metal/test_metal_tensor_ops.das	New test validating generated MSL helpers + CPU replay vs GPU exact match for tensor/staged-tile paths.
tests/language/optimization_dead_stores.das	Adjusts test to pin the new DSE behavior for operator-topped impure RHS.
src/ast/ast_dse.cpp	Prevents DSE from stripping impure stores into pure operator statements that trip lint.
skills/perf_lint.md	Documents @scratch on globals and expanded suppression/coverage semantics.
modules/dasMetal/src/dasMetal.mm	Pins MSL language version on macOS 26+, adds non-allocating command-buffer failure probe, and exports it.
modules/dasMetal/src/dasMetal.h	Declares metal_command_buffer_failed.
modules/dasMetal/metal/msl_emit.das	Adds tensor-op lowering: generated helper emission, write-set scanning updates, staged-tile protocol emission, and MPP include injection.
modules/dasMetal/metal/metal_builtins.das	Adds CPU-replay reference implementations for tmm2d_* and staged-tile begin/step/store protocol.
modules/dasMetal/metal/das_metal_boost.das	Marks pipeline cache and buffer pool tables as @scratch to match intended reuse semantics.
modules/dasLLAMA/harness/tune_kernels.das	Runs tensor twin races and writes the metal_tensor crown list into the runtime sidecar snapshot.
modules/dasLLAMA/dasllama/dasllama_metal_prefill.das	Adds prefill-side twin kernels, crown-based PSO selection, scratch reuse of per-call arrays, and race implementations.
modules/dasLLAMA/dasllama/dasllama_metal_llama.das	Uses non-alloc failure probe + cold-path error text; expands @scratch use; annotates hot paths.
modules/dasLLAMA/dasllama/dasllama_metal_lens.das	Makes @role optional (derivation becomes authoritative) for Metal dispatch census.
modules/dasLLAMA/dasllama/dasllama_metal_kernels.das	Adds decode-side batch-GEMM tensor twins, crown-based PSO selection, and decode-side races.
modules/dasLLAMA/dasllama/dasllama_metal_common.das	Adds cold_path annotations, scratch globals for reuse, and shared race scaffolding utilities.
modules/dasLLAMA/dasllama/dasllama_math.das	Makes parallel_argmax allocation-free on the hot path via fixed-size partial buffers.
modules/dasLLAMA/dasllama/dasllama_kernel_access.das	Updates access classifier to understand tmm2d pointer operands + tg protocol and pointer-local aliasing.
modules/dasLLAMA/dasllama/dasllama_common.das	Adds runtime metal_tensor crown parsing/storage and marks rope-table builders @scratch.
doc/source/reference/language/lint.rst	Updates PERF026 docs to include @scratch globals and expanded semantics.
daslib/perf_lint.das	Extends PERF026: pop counted as sizing, @scratch globals/ref bindings recognized, scratch table indexing exempt, and nolint honored along the full call chain.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[borisbat]

Two additions since open, both from walking the release-flow end to end:

• 2b61c1e55 — races interleave adjacent base/twin pairs. Sequential per-side timing blocks read the GPU clock ramp as a phantom winner: on an M4 the sequential harness manufactured +64% k-quant tensor "wins" that its own tuner context and the interleaved protocol both refute. Verdicts are now identical from three different process contexts on that box (real M4 result: mulmm_bf16 tensor +2.8%, everything else simdgroup).
• b27b224d1 — sidecar box-identity gate (llvm_tune). daspkg release runs the scope tuners only for incomplete sidecars, so a sidecar copied from another box (CPU-complete, foreign crowns) would skip the tune and ship wrong winners. The provenance now carries a box identity stamp (platform|arch|hardware|OS-build|cpu) and a mismatched or missing stamp reads as stale — winners can't outlive the box+OS that measured them. The reset path also drops a foreign file's other-scope keys instead of re-stamping them. Manifest test gains the foreign-box arm.

Note for existing boxes: pre-identity sidecars re-tune once on the next run (they'd already be mtime-stale against a rebuilt binary, so no extra churn in practice).

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

daslib/perf_lint.das:226

• The casts in is_scratch_dest use invalid member access syntax ((expr as ExprRef2Value.subexpr) etc.). This won’t compile; the .subexpr needs to be accessed on the cast result ((expr as ExprRef2Value).subexpr).

    if (expr is ExprRef2Value) return is_scratch_dest((expr as ExprRef2Value.subexpr))
    if (expr is ExprAt) return is_scratch_dest((expr as ExprAt.subexpr))
    if (expr is ExprSafeAt) return is_scratch_dest((expr as ExprSafeAt.subexpr))
    if (expr is ExprCast) return is_scratch_dest((expr as ExprCast.subexpr))

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

daslib/perf_lint.das:227

• These casts are malformed: (expr as ExprRef2Value.subexpr) (and similar) tries to access .subexpr as part of the cast type, which should be a syntax/compile error. It looks like the intent is to recurse into the wrapper node’s subexpr field.

Fix by casting first, then accessing .subexpr (same for ExprAt/ExprSafeAt/ExprCast).

    if (expr is ExprRef2Value) return is_scratch_dest((expr as ExprRef2Value.subexpr))
    if (expr is ExprAt) return is_scratch_dest((expr as ExprAt.subexpr))
    if (expr is ExprSafeAt) return is_scratch_dest((expr as ExprSafeAt.subexpr))
    if (expr is ExprCast) return is_scratch_dest((expr as ExprCast.subexpr))
    return false

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

daslib/perf_lint.das:226

• is_scratch_dest has malformed casts like (expr as ExprRef2Value.subexpr) (missing ).subexpr). This won’t parse/compile and breaks the new @scratch-destination logic for refs/tables/globals.

    if (expr is ExprRef2Value) return is_scratch_dest((expr as ExprRef2Value.subexpr))
    if (expr is ExprAt) return is_scratch_dest((expr as ExprAt.subexpr))
    if (expr is ExprSafeAt) return is_scratch_dest((expr as ExprSafeAt.subexpr))
    if (expr is ExprCast) return is_scratch_dest((expr as ExprCast.subexpr))