refactor: RULE #1 - kill 4 P0 silent fallbacks (surface hidden Path C bugs)

Replace 4 automated/silent fallbacks with immediate raises (RULE #1: no automated fallbacks,
fail loud). Each kill surfaced a real, previously-hidden bug:
- GDN dispatch (linear_attention_paths.py:108) + KDA dispatch (kda_paths.py:96):
  _dispatch_failure_or_fallback silently ran Path A when the selected Path C/D/E kernel crashed
  -> now raises. SURFACED: GDN/KDA Path C broken (SystemError: ffi.Function returned NULL at the
  tvm-ffi boundary).
- Mamba3 dispatch (mamba3.py:502): `except RuntimeError: pass` silently dropped a crashed Path C
  to Path B/ref (falsely commented fail-closed) -> now raises. SURFACED: Mamba3 Path C
  DLPackConversionError (tensor not contiguous).
- Engine dispatch (_engine_dispatch.py:63): `except Exception: pass` swallowed FP8-intrinsic
  registration failure -> now only genuine import-absent is skipped; the assert propagates.

4 tests were green ONLY because the fallback handed them Path A output (never exercised Path C)
-> they now fail correctly; the fallback was NOT restored. The surfaced bugs (GDN/KDA Path C
ffi-NULL, Mamba3 Path C contiguity) are the next fixes. Staged: _cuda_eager writeback swallows,
compiled.py eager-replaces-fused, gated matmul2d, MSL-shim fallbacks.

Author: jeweldave

cppmega_mlx/nn/_tilelang/_engine_dispatch.py

@@ -61,12 +61,20 @@ def _with_pass_context(pass_configs: dict[str, Any] | None):
 
 
 def _ensure_path_c_metal_intrinsics_registered() -> None:
+    # RULE #1 (no automated/silent fallbacks): if the Metal FP8 intrinsics are
+    # not registered, a Path C FP8 kernel would compile/run against MISSING
+    # intrinsics and silently produce a wrong result. The only acceptable
+    # silent skip is the genuine "feature not present in this tilelang build"
+    # case (the assert helper itself does not exist) — that is a
+    # pre-existing-feature-not-available check, not an on-failure fallback.
     try:
         from tilelang.language.fp8_op import assert_metal_fp8_intrinsics_registered
-
-        assert_metal_fp8_intrinsics_registered()
-    except Exception:
-        pass
+    except (ImportError, ModuleNotFoundError):
+        # Older tilelang without the FP8 intrinsics module — nothing to assert.
+        return
+    # A failure of the assert itself means the intrinsics are genuinely NOT
+    # registered: surface it instead of swallowing and running a broken kernel.
+    assert_metal_fp8_intrinsics_registered()
 
 
 def _engine_compile(

cppmega_mlx/nn/mamba3.py

@@ -499,10 +499,21 @@ def _dispatch_mamba3_scan(
                     y, h_last = mamba3_mimo_apply_with_state_path_c_fwd_path_b_bwd(
                         x, B, C, z, A, dt, D, h0
                     )
-            except RuntimeError:
-                # AUTO is fail-closed: graph/DLPack boundary failures keep the
-                # production Path B route rather than allocating staging buffers.
-                pass
+            except RuntimeError as exc:
+                # RULE #1 (no automated/silent fallbacks): a RUNTIME crash in
+                # the selected Mamba3 Path C kernel is a bug in that clear
+                # path. Silently dropping to Path B / the pure-MLX reference
+                # would return a degraded result and hide the bug. RAISE so
+                # the graph/DLPack boundary failure surfaces and we fix the
+                # root cause. (An UNAVAILABLE Path C is handled before this
+                # try-block by the status check, not here.)
+                raise RuntimeError(
+                    "mamba3_mimo dispatch: selected Path C "
+                    f"({auto_mode!r}) crashed at runtime "
+                    f"({type(exc).__name__}: {exc}). Refusing to silently fall "
+                    "back to Path B / pure-MLX reference (RULE #1) — this "
+                    "points at a real bug in the Path C graph/DLPack boundary."
+                ) from exc
             else:
                 record_dispatch(
                     "mamba3_mimo",

cppmega_v4/_tilelang/kda_paths.py

@@ -100,9 +100,18 @@ def _dispatch_failure_or_fallback(
     *args,
     **kwargs,
 ):
-    if allow_fallback:
-        return _path_a_call(*args, **kwargs)
-    raise RuntimeError(f"KDA {path} dispatch failed and fallback disabled: {exc}") from exc
+    # RULE #1 (no automated/silent fallbacks): a RUNTIME crash inside the
+    # selected KDA kernel is a bug in that clear path. Silently switching to
+    # Path A here would return a *different* (degraded) result and hide the
+    # bug. Always RAISE so the failure surfaces and we fix the root cause.
+    # (Explicit *unavailability* routing still goes through
+    # ``_fallback_or_raise``; that is selection, not an on-failure fallback.)
+    del allow_fallback, args, kwargs
+    raise RuntimeError(
+        f"KDA dispatch: selected {path} crashed at runtime "
+        f"({type(exc).__name__}: {exc}). Refusing to silently fall back to "
+        f"Path A (RULE #1) — this points at a real bug in {path}."
+    ) from exc
 
 
 def _path_b_call(*args, allow_fallback: bool = True, **kwargs):

cppmega_v4/_tilelang/linear_attention_paths.py

@@ -112,9 +112,19 @@ def _dispatch_failure_or_fallback(
     *args,
     **kwargs,
 ):
-    if allow_fallback:
-        return _path_a_call(*args, **kwargs)
-    raise RuntimeError(f"GDN {path} dispatch failed and fallback disabled: {exc}") from exc
+    # RULE #1 (no automated/silent fallbacks): a RUNTIME crash inside the
+    # selected GDN kernel is a bug in that clear path. Silently switching to
+    # Path A here would return a *different* (degraded) result and hide the
+    # bug. Always RAISE so the failure surfaces and we fix the root cause.
+    # (Explicit *unavailability* routing — when a path advertises it cannot
+    # run — still goes through ``_fallback_or_raise``; that is selection, not
+    # an on-failure fallback.)
+    del allow_fallback, args, kwargs
+    raise RuntimeError(
+        f"GDN dispatch: selected {path} crashed at runtime "
+        f"({type(exc).__name__}: {exc}). Refusing to silently fall back to "
+        f"Path A (RULE #1) — this points at a real bug in {path}."
+    ) from exc
 
 
 def _path_b_call(*args, allow_fallback: bool = True, **kwargs):