flashkern sampler: move the complete top-k ladder into cooperative assembly

[sydneyrenee]

Problem

Production audio uses top-k 4, but the hot sampler still performs correctness-bearing numerical work in C++ inside flashkern_engine.cpp:

• BF16/F32 conversion helpers: lines 151–161;
• raw/scaled access: 1671–1683;
• heap threshold construction with make_heap/pop_heap/push_heap: 1685–1699;
• temperature scaling and maximum scans: 3322–3357;
• lane folds, double target arithmetic, and std::nextafter termination: 3401–3467.

The SAMPLE_PHASE_* collective skeleton is sound, and sampler.S already supplies libm-free max, exponential-sum, prefix, and selection leaves. The program does not yet use assembly for the whole numerical ladder.

Required execution

1. Shard candidate ranges across lanes.
2. Compute exact top-k threshold with stable tie/index semantics.
3. Apply temperature using the existing precision/order contract.
4. Compute lane maxima.
5. Final-return transition folds the bounded lane maxima.
6. Compute masked exp/sums with the approved sampler polynomial.
7. Fold the global sum and form one draw target.
8. Compute lane prefix intervals.
9. Resolve exactly one interval owner and token.
10. Advance PRNG exactly once and preserve its serialized state.

C++ may route phases and publish bounded control state. It may not scan logits, build heaps, evaluate sampling arithmetic, or choose the numerical winner.

Faithfulness gates

Compare, for adversarial and real-checkpoint logits:

• threshold value and selected top-k indices;
• ties, signed zero, infinities, NaNs, and all-masked inputs;
• scaled logits and lane maxima;
• lane/global sums;
• draw target and interval ownership;
• chosen token;
• PRNG state before/after;
• greedy, temperature, top-k 1/4/N, and vocabulary tails.

The gate must detect wrong intermediate values even when the same token wins.

Architecture requirements

• AArch64 and x86_64 paired assembly.
• No libm, heap, allocation, scalar fallback, or C++ numerical helper in the pass path.
• No change to ticket, phase, PRNG-consumption, or deterministic-order semantics.
• Registers hold per-tile work; only compact cross-lane partials materialize at true collective boundaries.
• Unsupported ISA fails at readiness.

Acceptance

• No production sampler heap or numerical scan remains in C++.
• Every sampling mode matches the frozen full-value trace.
• Fixed-seed text/audio codes and PRNG state match across consecutive turns.
• AArch64 and x86_64/Rosetta pass.
• Real-checkpoint speech and audio-only conversation gates pass.
• No post-readiness allocation or materialization counter moves.

Related

• Faithfulness trace gate: child of native inference: remove residual C++ numerical fallbacks and materialized scratch #158
• Native numerical umbrella: native inference: remove residual C++ numerical fallbacks and materialized scratch #158
• Real-checkpoint gate: voice: automate the native real-checkpoint truth gate and preserve evidence #147

[sydneyrenee]

Line references verified against the working tree; the scope is accurate.

Two clarifications that make the work smaller and sharper:

1. The leaves are done; the program is not. Both flashkern_sampler.S files carry their own f32 range reduction and degree-six exponential polynomial (identical coefficient blocks at aarch64:416-424, x86:503-511) and import no libm — verified on both architectures. This issue is a program-rewiring job (drive the full ladder through the existing leaves from the SAMPLE_PHASE_* skeleton), not a leaf-authoring job. That also means the frozen traces from native inference: restore authoritative full-value faithfulness gates before FIFO fusion #170 can attach at leaf granularity immediately.

2. Heap storage is legal; heap operations are the debt. spec 07 explicitly admits "an engine-owned, preallocated min-heap containing values only; it never copies the logits payload, allocates during the pass, sorts a vector, or truncates boundary ties." The violation is that make_heap/pop_heap/push_heap execute numerically in C++ per pass (1685-1699), not that a preallocated heap exists. The acceptance criterion "No production sampler heap or numerical scan remains in C++" should be read as the operations, or someone may delete the sanctioned storage and regress the design.

— K3

[sydneyrenee]

Implementation handoff — this is primarily program rewiring

The sampler assembly leaves already exist and are libm-free. Do not respond to this issue by inventing another exp approximation or rewriting the whole sampler. First trace why the SAMPLE_PHASE_* program still routes around those leaves.

Architecture deviations from ordinary samplers

Typical inference code treats sampling as a small serial utility after logits. Here it is a first-class cooperative Flashkern program because it runs every token/audio frame and its state is part of deterministic recurrence.

• C++ owns phase transitions and compact control records only.
• Lanes own disjoint vocabulary ranges.
• Final-return may fold bounded lane partials.
• Exactly one draw occurs.
• PRNG consumption order is ABI.
• Top-k threshold and tie ordering are model semantics, not implementation details.
• No heap, STL algorithm, libm, scalar fallback, or allocation belongs in the pass.

Do not replace the current algorithm with a fashionable sampler, approximate top-k, GPU-style nondeterministic reduction, or “equivalent” probability computation.

Work sequence

1. Freeze native inference: restore authoritative full-value faithfulness gates before FIFO fusion #170 sampler traces from the current authoritative behavior, including every intermediate.
2. Map each C++ numerical block to the existing assembly symbol intended to replace it.
3. Identify genuinely missing operations—likely top-k threshold/selection plumbing—before adding leaves.
4. Preserve the current phase/ticket structure while moving numerical ownership.
5. Remove C++ helpers only after adversarial and real-logit traces pass.
6. Verify text and all audio codebook sampling, not text alone.

Cases that commonly expose drift

• equal logits spanning lane boundaries;
• top-k boundary ties;
• top-k 1, 4, vocabulary size, and invalid k;
• temperature 0/1/non-unit;
• NaNs, infinities, signed zero, and all-masked candidates;
• target exactly on a prefix boundary;
• vocabulary tail shorter than a lane tile;
• consecutive Depthformer codebooks sharing the draw stream.

If the selected token matches but threshold, sums, intervals, or PRNG state differ, the port is not faithful.