Tune the existing r51 backend for Zen 5 cold verification

[7layermagik]

Summary

This PR improves cold-signature performance in Narya's existing forced r51 backend, focusing on the native x8 path and the packed n=1/n=2 tails on Zen 5. The changes reduce field-arithmetic call overhead and memory traffic, specialize recoding and scalar reduction, improve partial-batch scheduling, and add measured CPU-specific dispatch choices. The public API and acceptance predicate are unchanged; automatic selection remains generic, and r51 remains opt-in and unaudited.

The published main release numbers for 1,232-byte cold verification on the same Ryzen 7 9700X were:

signatures per call	published main µs/signature
1	15.085
2	14.960
4	9.139
8	4.850
64	4.673

At the final live-path implementation commit (bbc6c2194438090b0c48ac9bd95eab6b92602d6f), the same public cold benchmark measured:

signatures per call	final µs/signature	change vs published main row	signatures/s/core
1	13.590	-9.9%	~73,600
2	11.620	-22.3%	~86,100
4	7.872	-13.9%	~127,000
8	3.850	-20.6%	~259,700
64	3.623	-22.5%	~276,100

The cumulative table compares two documented public release snapshots; use it for the overall before/after, not causal attribution. The exact-parent and same-binary timeline below supplies the per-change evidence. All reported Narya rows were allocation-free and recorded zero internal-fault fallbacks. Exact commands, environment details, raw output, and checksums are committed under docs/results/.

Review tracks

The implementation and its exact-parent measurements were developed as one
interleaved, tested history. To preserve that history without rebasing,
squashing, or duplicating commits, review is split into three passes rather
than three independently mergeable branches:

1. Executable cold-path optimizations. Review the production-reachable
   r51 changes through bbc6c21: x8 arithmetic, recoding and reduction,
   packed n=1/n=2 tails, CPU policy, and exported-backend routing. This pass
   answers whether the optimized implementation preserves the field, point,
   lane-ownership, predicate, and fallback contracts.
2. CI, tests, and contract hardening. Review .github/workflows/ci.yml,
   the new and changed *_test.go files, assembly declaration/layout
   contracts, and the follow-up hardening commits 3321a9c and 59cf0c3.
   This pass answers whether every native path is exercised under SDE or real
   hardware and whether unsafe workspace/ABI assumptions are compiler-checked
   or stated explicitly.
3. Formal evidence, benchmark artifacts, and experimental records. Review
   docs/**, tools/formal/**, the non-dispatched whole-window boundary,
   checksums, negative results, and proof-scope statements. This pass validates
   provenance and claimed measurements; it does not expand the supported
   runtime contract.

The passes are dependency-ordered: review the executable formulas and routing
first, use the validation track to challenge them second, and then audit
whether the evidence accurately supports the surviving claims. All three
passes resolve against the same final SHA.

Changes introduced by this PR

Existing x8 cold route

• Replace the scalar-Go pre-signed table layout loop with a native x8 transpose-store leaf.
• Specialize the internally generated, full-lane fixed-base selector while keeping the checked selector as its oracle/fallback.
• Collapse four independent final products and raw products into compound assembly leaves.
• Tail-chain compound doubling and Niels leaves into their existing Stage-2/final consumers, removing intermediate ABI transitions without changing field formulas.
• Add full-x8 specializations for radix-32 and radix-256 recoding.
• Add an x8 native challenge reducer.
• Re-enable the pre-existing dedicated raw-square schedule on Zen 5 after a current-kernel complete-verifier A/B overturned its stale negative result.
• Use a distinct P2 representation to omit T across the first four doublings of each five-doubling run.
• Inject width-10 fixed-base generator digits into the existing x8 variable-base doubling chain instead of running the separate radix-256 comb.
• Widen literal-Q batch encoding to x8 at the measured Zen 5 crossover.
• Continue the doubling Stage-2 leaf directly into final products.

Existing x4/packed tail routes

• Route four-to-seven-signature Zen 5 tails through the existing x4 curve path but the x8 hash/reduction path.
• Fuse the packed cached-add final linear layer with its consuming multiply.
• Fuse packed doubling input permutations with the first multiply.
• Select the measured Zen 5 VPMULLQ fold for packed-x4 products.
• Add a two-signature strict tail that runs one existing coordinate-packed verification equation in each independent 256-bit half of a ZMM register.

Dispatch and evidence

• Add separate Zen 5 policy bits for each measured choice rather than treating AVX512-IFMA support as one universal schedule.
• Extend SDE functional coverage for the packed-pair route.
• Commit the complete public A/Bs, profiles, checksums, negative results, safety freeze, and bounded whole-window certificate.

Measured optimization timeline

These rows are chronological, exact-parent or same-binary A/Bs for changes retained by this PR. They are not additive: each row measures its change at its own checkpoint, and host drift, link layout, and earlier changes alter later baselines. Unless noted, values are complete cold-verifier changes for 1,232-byte messages.

implementation commit	retained change	measured route	complete-path change
e6370a5	native pre-signed x8 table transpose/store	n=8 / n=64	-1.6% / -1.7%
7b22c5b	unchecked internally generated full-lane fixed-base selector	n=8 / n=64	-0.8% / -0.6%
a238847	shared four-result point final-product leaf	n=8 / n=64	-4.8% / -4.8%
13a6179	shared projective-Niels raw-product leaf	n=8 / n=64	-0.37% / -0.24%
5c773f3	shared doubling raw-product leaf	n=8 / n=64	-0.53% / -0.61%
22d3a68	doubling raw-products → Stage-2 tail continuation	n=8 / n=64	-1.15% / -1.29%
c995f4e	Niels raw-products → Stage-2 tail continuation	n=8 / n=64	-3.08% / -3.05%
b1c1ccc	specialized full-x8 radix-32 recoder	n=8 / n=64	-1.2% / -1.5%
f0a1bbb	specialized full-x8 radix-256 recoder	n=8 / n=64	about -0.3% / sub-0.6%
45da721	x4 curve with x8 hash/reduction for Zen 5 tails	n=4	-7.99%
90384db	packed cached-add final-stage fusion	n=1	-1.33%
9f9df33	packed doubling input/multiply fusion	n=1	-4.9%
daaa776	enable the existing raw-square schedule on Zen 5	n=8 / n=64	-1.26% / -1.10%
e1c253a	x8 literal-Q batch encoder	n=16 / n=64	-0.41% / -0.37%
d11db24	intermediate P2 doublings omit T	n=8 / n=64	-1.43% / -1.48%
f1de35e	Stage-2 → final-products continuation	n=8 / n=64	-2.0% / -1.4%
55f4362	merge width-10 fixed B into the x8 A chain	n=8 / n=64	-6.2% / -7.0%
db0a239	reuse specialized radix-32 recoding in merged B10	n=8 / n=64	-1.2% / -1.5%
54d6430	native x8 scalar reduction	n=8 / n=64	-0.86% / -0.85%
985a3b8	Zen 5 packed-x4 multiply-by-19 fold	n=1 / n=2	approximately -2% to -3%
bbc6c21	two packed equations in one ZMM	n=2	-13.1%

The fixed-base affine Stage-2 continuation at b2f40c8 is retained because its same-binary comb component improved 4.33%, but it is omitted from the table above because no trustworthy isolated complete-verifier percentage was established. Neutral and rejected candidates are documented but are not counted as speedups.

Which PR changes transfer beyond Go?

This section describes only changes introduced by this branch, not the inherited Narya architecture.

Broadly reusable algorithm or representation changes

• The intermediate-P2 schedule that omits T across consecutive doublings.
• Merging the fixed-base B term into the existing variable-base doubling chain with independent window parameters.
• x8 batch inversion for literal-Q projective-to-affine conversion.
• Running two independent coordinate-packed equations in the halves of one native 512-bit register.
• Width-specialized recoding and structure-of-arrays scalar reduction.
• Mixing x4 curve arithmetic with x8 hashing when complete-path measurements favor different SIMD widths for the two phases.

These can transfer to C, C++, Rust, or another implementation, subject to re-proving the representation/range contracts and remeasuring the complete verifier.

Language-neutral but AVX-512/CPU-specific changes

• Zen 5 VPMULLQ fold selection.
• The current Zen 5 raw-square dispatch decision.
• ZMM transpose/store networks, full-lane selectors, x8 scalar-reduction assembly, and packed-pair register layout.
• The exact B10 table width and x8 batch-encoding crossover.

The mechanisms transfer, but the winning schedule is microarchitecture-dependent.

Go-specific or Go-amplified changes

• Compound raw/final-product leaves and assembly tail continuations remove repeated Go ABI transitions, argument spills, and VZEROUPPER boundaries. Another language may have a much smaller call-boundary cost.
• The native transpose/store replaces a scalar Go layout loop.
• Specialized native selectors, recoders, and scalar reduction replace Go hot loops that the compiler cannot auto-vectorize.
• Explicit assembly-text alignment controls Go linker placement effects observed during the A/Bs.

The no-cgo API, original Plan 9 assembly wrappers, pooled workspaces, and broader zero-allocation architecture predate this PR and are not claimed here.

Predicate and failure behavior

The acceptance contract is inherited and unchanged:

• every SIMD lane retains its own complete equation and deterministic verdict;
• DalekStrict still rejects non-canonical S, small-order A, small-order R, and non-canonical R while accepting the target predicate's non-canonical A encodings;
• native/platform faults still recompute through generic and increment InternalFaultFallbacks;
• forced unsupported activation still fails synchronously;
• automatic backend selection remains generic.

New tests specifically pin packed-pair lane ownership, result indexing, invalid-equation isolation, scalar/recode equivalence, and the new CPU-policy decisions.

Tests and evidence

Current HEAD: 59cf0c3cc7b139e05caa3f389ee87dfbbbac19be

Checks rerun locally at HEAD:

• go test -count=1 ./...
• go test -tags purego -count=1 ./...
• go test -race ./ed25519 ./sha512mb
• go vet ./...
• GOOS=linux GOARCH=amd64 go vet ./...
• source and authored-document git diff --check

Pinned native Zen 5 evidence additionally covers:

• full repository and race-detector suites;
• the compile-time AMD-policy/SDE coverage build;
• zero-allocation gates;
• CCTV and Wycheproof corpora through the exact packed n=2 route;
• valid/invalid mixtures and result-index preservation across relevant widths;
• injected singleton, packed-pair, and wider-batch faults with generic recomputation;
• scalar-reduction, range, aliasing, active-mask, and assembly/model differentials.

Raw benchmark/profiler artifacts are preserved with checksums. Their fixed-width tool output contains alignment whitespace, so the authored source/document diff check excludes docs/results/** rather than rewriting the evidence bytes.

Supported versus experimental

The supported change ends at bbc6c21. The following additions remain explicitly non-dispatched research evidence:

• the certified Edwards whole-window boundary, measured at about 0.53% in the prepared evaluator;
• HEEA and alternate radix/window schedules;
• other Experimental* symbols and negative/neutral A/B results.

The whole-window search, certificates, source archive, implementation mapping, and remaining source-to-machine refinement gap are indexed under docs/formal/.

Review focus

1. exact predicate preservation across the newly routed paths;
2. x8 and packed-pair lane ownership, masks, and verdict indexing;
3. IFMA source bounds, carry/fold schedules, alias contracts, and P2/extended-coordinate state separation;
4. scalar reduction and recoding equivalence;
5. CPU-family policy and unsupported-hardware behavior;
6. internal-fault fallback and accounting;
7. native SHA/reduction routing for partial groups;
8. attribution and proof boundaries.

Remaining gates

This remains a draft and r51 remains forced-only pending:

• independent cryptographic and assembly review;
• the planned ~10^9-execution differential fuzz soak;
• Intel-silicon and server-part measurements;
• machine-linked assembly register/memory refinement proofs;
• traffic-specific warm-cache policy work.

See docs/SAFETY_FREEZE_2026-07-29.md and docs/results/zen5-packed-pair-whole-window-2026-07-29/.