simd: nightly realization complete, codegen witness, shared masking parity, CodeRabbit round 2

Nightly (`--features nightly-simd`) now realizes the whole facade, not just
the mask family: `simd_nightly/w1a_types.rs` adds I8x16 (from_i4_packed_u64
sign-extends 0x8 -> -8, saturating_abs(i8::MIN) == i8::MAX), U16x8 +
gather_u16, U8x8, palette_lookup_u8x8, prefetch_read_t0/1/2 (documented
no-ops) and batch_packed_i4_16, re-exported through simd_nightly and the
nightly arm of simd.rs. The five W1a tests in simd_int_ops run on nightly
instead of being cfg-gated away. Lib test target and clippy are clean on
nightly (192 focused tests + 12 W1a).

Codegen witness (examples/ternlog_codegen_probe.rs, [profile.ci-codegen],
scripts/codegen-witness.sh, .cargo/config-v4.toml): a tiny opt-level-3
example whose symbols are checked for the instruction each arm must select.
Running it found that the CARGO_TARGET_<triple>_RUSTFLAGS recipe loses to
.cargo/config.toml's cfg-keyed x86-64-v3 (cargo joins both, last
-Ctarget-cpu wins; measured with cargo -v), so the tier4-avx512-check CI
job had been checking the AVX2 arm. Fixed to `--config .cargo/config-v4.toml`
and the job now asserts vpternlog is emitted. Witness PASS on avx2 (v3),
avx512 (v4, 1/1/6 vpternlog) and neon (cross, asm-only; the aarch64 build
exposed a missing U32x16::reduce_sum on the NEON and wasm backends, added).
Slice-level probes allow bounded loop-control GPR ops (cap 12, measured 9/6).

crates/simd-masking-parity: ONE parity program over the shipped facade
(all 256 ternlog tables x2 widths, U64x8 algebra, I32x16 compares,
every predicate->mask at rows 0/1/63/64/65/130 with the zero-tail and
full-overwrite contract, mask algebra + in-place forms + any/all on tails,
care-match contiguous and strided, masked sum/min/max, strided group sum,
blend). rlib + cdylib + bin; green natively (v3) and under node with and
without +simd128 (the scalar realization).

CodeRabbit round 2: the 13 mask functions that were public as
ndarray::simd_int_ops::<f> on master are re-exported from simd_int_ops
(verified complete against master's pub fn list); Group F block no longer
splits the oracle README table; a == a comparisons replaced in both parity
harnesses; neon-asm-rung3.sh fails on a build error instead of grading
stale assembly; the U32x16 ternlog doc paragraph sits on the test it
describes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X6y3drwKSE2zSgoexheLFX

Author: claude

.cargo/config-v4.toml

@@ -0,0 +1,19 @@
+[build]
+# Plain AVX-512 baseline — `x86-64-v4` (F + BW + CD + DQ + VL), nothing above
+# it. Use with:
+#   cargo --config .cargo/config-v4.toml check --lib
+#   cargo --config .cargo/config-v4.toml test --lib --no-run
+#
+# This is the deterministic AVX-512 COMPILE contract the SIMD realization
+# matrix builds against: `simd.rs` keys its arm off `target_feature = "avx512f"`,
+# so this selects `simd_avx512` and emits `vpternlogq` etc. regardless of the
+# build host's silicon — code generation and execution are separate, and a
+# GitHub runner does not need AVX-512 to prove LLVM emits it. Do NOT run the
+# resulting binary on a host without AVX-512 (SIGILL); use the v3 or native
+# configs for execution, or qemu for semantic parity.
+#
+# `config-avx512.toml` is the stricter Sapphire Rapids EXECUTION config (VNNI,
+# BF16, FP16, AMX…); it SIGILLs on any earlier AVX-512 silicon, so it is never
+# the CI compile oracle.
+[target.'cfg(target_arch = "x86_64")']
+rustflags = ["-Ctarget-cpu=x86-64-v4"]

.claude/blackboard.md

@@ -154,12 +154,15 @@ simd_{avx512,avx2,neon,wasm,scalar}.rs   each owns its realization, as a PEER
    `simd_int_ops.rs` wholesale (predicates→mask, mask algebra, ternlog,
    masked reductions, care-masked register match, blend) with its tests.
    `simd_int_ops.rs` is integer arithmetic/conversion again. Every moved
-   `pub fn` (31/31) still re-exports through `ndarray::simd`; the
-   `ndarray::simd_int_ops::<mask fn>` MODULE paths are gone (`simd_int_ops`
-   is `pub mod`, so that IS a public-path removal — "public surface
-   unchanged" was an overclaim, C2). The one known consumer of the module
-   path (`lance-graph-planner` `examples/dcr_w0_replay_budget.rs`) is moved
-   to the facade in the lance-graph PR, not in this one.
+   `pub fn` (31/31) still re-exports through `ndarray::simd`, AND the 13
+   mask functions that were public on master as `ndarray::simd_int_ops::<f>`
+   (`simd_int_ops` is `pub mod`, so those were public paths — the first
+   draft dropped them and called the surface "unchanged", C2; CodeRabbit
+   round 2 caught the downstream break) are re-exported from `simd_int_ops`
+   as a compatibility surface, verified complete by diffing master's
+   `pub fn` list against HEAD's `pub fn` + `pub use` set (0 missing). The
+   canonical path is the facade; `lance-graph-planner`
+   `examples/dcr_w0_replay_budget.rs` moves to it in the lance-graph PR.
 2. **`tools/gen_ternlog_bodies.py`** — Shannon-lowers each 8-bit table into
    two 2-input tables (`f = (!c & T0) | (c & T1)`), ≤ 7 ops (the naive
    minterm form was up to 36), self-checks all 256 tables in Python, and

.claude/knowledge/simd-codegen-oracle/README.md

@@ -78,6 +78,9 @@ Measured on x86_64 + `x86-64-v3`, rustc 1.95.0. Full narrative in
 | `cross_lane_reverse_u8x64` | 9 | 0 | `vbroadcasti128`/`vpshufb`/`vpermq` — invented a cross-lane permute from a scalar index loop |
 | **`rot_u64x8`** | **0** | 8 | scalar `rorq %cl`, one per lane |
 | **`rot_u64x4`** | **0** | 4 | scalar `rorq %cl`, one per lane |
+| **`blake2b_g_u64x8`** | 22 | ~88 | packed leading add; scalar through all four rotates |
+| `gather_lookup_u8` | 0 | 0 | `movzbl` chain, no arithmetic |
+| `serial_dependent_chain` | 0 | 27 | loop-carried dependency |
 
 Group F — the mask family (PR #306), measured 2026-09-14 on rustc 1.98.1
 through the shipped library methods. Two runs: array polyfill first, then
@@ -100,9 +103,6 @@ The two "mixed" rows are the instructive ones: a shape can be *mostly*
 packed and still carry a scalar peel, and the method's doc comment had
 claimed a clean lowering it never had. Measure the shipped symbol, not the
 look-alike.
-| **`blake2b_g_u64x8`** | 22 | ~88 | packed leading add; scalar through all four rotates |
-| `gather_lookup_u8` | 0 | 0 | `movzbl` chain, no arithmetic |
-| `serial_dependent_chain` | 0 | 27 | loop-carried dependency |
 
 **The headline:** LLVM vectorizes far more than intuition suggests —
 including cross-lane permutes, widening converts, and saturating

.github/workflows/ci.yaml

@@ -250,18 +250,31 @@ jobs:
     # to host build scripts. Combined with explicit `--target` (so cargo
     # distinguishes host from target even when they're the same triple),
     # this gives us "v4 for our crate, baseline for build scripts."
+    #
+    # # Why `--config .cargo/config-v4.toml` and NOT that env var (2026-09-14):
+    #
+    # cargo JOINS every matching `target.<triple>.rustflags` and
+    # `target.<cfg>.rustflags` entry, and the last `-Ctarget-cpu` wins.
+    # Measured with `cargo -v`: the env var form passed `x86-64-v4` and THEN
+    # `.cargo/config.toml`'s cfg-keyed `x86-64-v3`, so this job had been
+    # checking the AVX2 arm while named "tier4-avx512-check" — the codegen
+    # witness on PR #306 found 0 `vpternlog` in a "v4" build. `--config`
+    # is the same cfg key at higher precedence, placed LAST, so v4 wins;
+    # explicit `--target` still keeps build scripts on the host baseline.
     runs-on: ubuntu-latest
     name: tier4-avx512-check
-    env:
-      CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS: "-D warnings -Ctarget-cpu=x86-64-v4"
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: cargo check (v4 / AVX-512 dispatch arm)
-        run: cargo check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon
+        run: cargo --config .cargo/config-v4.toml check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon
       - name: cargo check (v4 / AVX-512 + hpc-extras)
-        run: cargo check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon,hpc-extras
+        run: cargo --config .cargo/config-v4.toml check --target=x86_64-unknown-linux-gnu -p ndarray --features approx,serde,rayon,hpc-extras
+      - name: prove the arm actually selected (a v4 build must emit vpternlog)
+        run: |
+          cargo --config .cargo/config-v4.toml rustc --profile ci-codegen --example ternlog_codegen_probe --target=x86_64-unknown-linux-gnu -- --emit=asm -C debuginfo=0
+          grep -c vpternlog target/x86_64-unknown-linux-gnu/ci-codegen/examples/ternlog_codegen_probe-*.s
 
   nightly-simd-polyfill:
     # TD-SIMD-9 from .claude/knowledge/simd-dispatch-architecture.md.

Cargo.toml

@@ -59,6 +59,10 @@ required-features = ["std"]
 name = "ternlog_amortization_probe"
 required-features = ["std"]
 
+[[example]]
+name = "ternlog_codegen_probe"
+required-features = ["std"]
+
 [[example]]
 name = "amx_gemm_bench"
 required-features = ["std"]
@@ -452,6 +456,7 @@ exclude = [
     "crates/burn",
     "crates/wasm-simd-parity",
     "crates/neon-simd-parity",
+    "crates/simd-masking-parity",
     # Cross-repo: its dev-dep is a PATH into a lance-graph sibling checkout.
     # In-workspace, a missing sibling would fail resolution for EVERY member.
     "crates/sigker-parity",
@@ -484,6 +489,19 @@ cblas-sys = { version = "0.1.4", default-features = false }
 [profile.bench]
 debug = true
 
+# The codegen-witness profile (`scripts/codegen-witness.sh`): optimized so LLVM
+# actually performs the vectorization the SIMD realization matrix certifies,
+# with no debuginfo and no LTO so it stays a TINY build of one example, not a
+# release build of the crate. The semantic arms of the matrix run at opt-level
+# 0 instead — bits are proven cheaply there, machine code is proven here.
+[profile.ci-codegen]
+inherits = "release"
+opt-level = 3
+debug = 0
+lto = false
+incremental = false
+panic = "abort"
+
 [profile.test.package.numeric-tests]
 opt-level = 2
 [profile.test.package.blas-tests]

crates/neon-simd-parity/src/main.rs

@@ -370,7 +370,7 @@ mod checks {
         if (a - b).to_array() != core::array::from_fn(|i| a_arr[i].wrapping_sub(b_arr[i])) {
             return Err(0x30D);
         }
-        if !(a == a) || a == b {
+        if !(a == U64x8::from_array(a_arr)) || a == b {
             return Err(0x30E);
         }
         Ok(())
@@ -438,7 +438,7 @@ mod checks {
         if a.to_i16_array() != core::array::from_fn(|i| a_arr[i] as i16) {
             return Err(0x40C);
         }
-        if !(a == a) || a == b {
+        if !(a == I32x16::from_array(a_arr)) || a == b {
             return Err(0x40D);
         }
         Ok(())

crates/simd-masking-parity/Cargo.toml

@@ -0,0 +1,39 @@
+# simd-masking-parity — ONE masking parity program, compiled under every SIMD
+# realization the matrix certifies (scalar / v3-avx2 / v4-avx512 / native /
+# nightly) × every platform (linux-x86 / linux-arm64 / macos-arm64 /
+# wasm32-simd128 / wasm32-without-simd128 = the scalar arm).
+#
+# It calls the SHIPPED `ndarray::simd` facade only — never a backend module,
+# never an intrinsic, never a `cfg(target_feature)` on lane data — and checks
+# every result against a bit-serial reference computed in the same module.
+# Whatever backend `simd.rs` selected for the build is the thing under test;
+# the program has no idea which one that is, and must not.
+#
+# Ships as an rlib + cdylib (`selfcheck()` for the node harness on wasm) and a
+# bin (`main.rs`, exits non-zero on the first mismatch, for native / qemu).
+# EXCLUDED from the workspace (root Cargo.toml `exclude`) so it has zero effect
+# on ordinary builds; `scripts/masking-parity.sh` builds it via --manifest-path.
+[package]
+name = "simd-masking-parity"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[[bin]]
+name = "simd-masking-parity"
+path = "src/main.rs"
+
+[dependencies]
+# `simd` + `simd_masking_ops` need only ndarray's `std` feature.
+ndarray = { path = "../..", default-features = false, features = ["std"] }
+
+[features]
+# The nightly realization: forwards to ndarray's portable-simd backend.
+nightly-simd = ["ndarray/nightly-simd"]
+
+[profile.release]
+panic = "abort"
+opt-level = 2

crates/simd-masking-parity/run.mjs

@@ -0,0 +1,18 @@
+// Node harness for the wasm arms of the masking parity matrix: instantiate the
+// .wasm and assert selfcheck() == 0. A nonzero rc names the failing group+op
+// (see src/lib.rs, `Code`).
+import { readFileSync } from 'node:fs';
+const wasmPath = process.argv[2];
+if (!wasmPath) {
+  console.error('usage: node run.mjs <path-to.wasm>');
+  process.exit(2);
+}
+const { instance } = await WebAssembly.instantiate(readFileSync(wasmPath), {});
+const rc = instance.exports.selfcheck();
+if (rc === 0) {
+  console.log('masking parity: OK (selfcheck rc=0)');
+  process.exit(0);
+} else {
+  console.error(`masking parity: FAIL — selfcheck rc=0x${rc.toString(16)} (see crates/simd-masking-parity/src/lib.rs)`);
+  process.exit(1);
+}