feat(metal): MTP dynamic draft cap — depth-gated additive raises off acceptance streaks (#359); 26B pair @16k 92.0 -> 99.8 tok/s

The calibration curves' loudest finding converted: 40% of 26B cycles accept the whole fixed K=4 block (median end-of-block cumprod 0.995), densest exactly where verify forwards are dearest (83% acceptance at 16K depth). mtpDraftLen raises the cap 4 -> 6 -> 8 after consecutive fully-accepted cycles and resets to base on any partial cycle; raises are gated to pos >= 4096 because the live A/B priced the ungated version (+8.6% at 16K but -2.7% shallow where blocks mostly miss at 48% acceptance) — below the gate the loop is byte-identical to the fixed-K engine, pinned by test. Output is unchanged by construction (verify pins the emitted stream to the target's greedy continuation at any block length). Zero per-token cost: acceptance history only — the cumprod theta-stop (0.40, measured) stays banked in #359 for the live-prob slice. Receipts: 26B @16k 92.0 -> 99.9 ungated / 99.8 gated (twice, identical output), verify forwards 10 -> 9; shallow 123.7 preserved by the gate; kill switch LTHN_MTP_DRAFTLEN=0; suite 1942/17 pkgs green.

Co-Authored-By: Virgil <virgil@lethean.io>

Author: Snider

go/engine/metal/assistant_load.go

@@ -1724,6 +1724,7 @@ func (pair *AssistantPair) GenerateFromSessionEach(target *ArchSession, promptID
 	stopped := false
 	lowAcceptStreak := 0
 	var reng mtpReengage
+	dl := newMTPDraftLen(draftTokens)
 	// runPlainStretch runs the bounded cooldown stretch (committing a pending
 	// lead first), measures the live plain rate, and re-arms drafting into a
 	// probe window. done=true ends the outer loop (stop / maxNew / error).
@@ -1741,7 +1742,7 @@ func (pair *AssistantPair) GenerateFromSessionEach(target *ArchSession, promptID
 	}
 	for len(result.Tokens) < maxNew && !stopped {
 		remaining := maxNew - len(result.Tokens)
-		blockSize := min(draftTokens, remaining)
+		blockSize := dl.next(remaining)
 		cycleT0 := time.Now()
 		wasProbing := reng.probing()
 		diagRound := mtpDiagForTest && result.TargetVerifyCalls < 3
@@ -1819,6 +1820,7 @@ func (pair *AssistantPair) GenerateFromSessionEach(target *ArchSession, promptID
 			break
 		}
 		if verify.AllAccepted {
+			dl.cycle(true, target.pos)
 			lowAcceptStreak = 0
 			carryLead = -1
 			if !mtpConfForce && !wasProbing && reng.needsDeepBootstrap(target.pos, len(result.Tokens), maxNew) {
@@ -1849,6 +1851,7 @@ func (pair *AssistantPair) GenerateFromSessionEach(target *ArchSession, promptID
 			continue
 		}
 
+		dl.cycle(false, target.pos)
 		replacement := verify.ReplacementToken
 		if nativeAssistantEmitToken(&result, replacement, eosID, yield) {
 			stopped = true
@@ -1963,6 +1966,7 @@ func (pair *AssistantPair) GenerateSampledFromSessionEach(target *ArchSession, p
 	draftSampler := model.NewSampler(0)
 	lowAcceptStreak := 0
 	var reng mtpReengage
+	dl := newMTPDraftLen(draftTokens)
 	defer func() { target.sampleHistory = finalHistory }()
 	// runPlainStretch is the sampled twin of the greedy lane's: the bounded
 	// cooldown stretch, rate measurement, and probe re-arm (#299).
@@ -1982,7 +1986,7 @@ func (pair *AssistantPair) GenerateSampledFromSessionEach(target *ArchSession, p
 	}
 	for len(result.Tokens) < maxNew && !stopped {
 		remaining := maxNew - len(result.Tokens)
-		blockSize := min(draftTokens, remaining)
+		blockSize := dl.next(remaining)
 		cycleT0 := time.Now()
 		wasProbing := reng.probing()
 		pickParams := target.mtpSamplePickParams(params, stopTokens, len(result.Tokens))
@@ -2044,6 +2048,7 @@ func (pair *AssistantPair) GenerateSampledFromSessionEach(target *ArchSession, p
 			break
 		}
 		if verify.AllAccepted {
+			dl.cycle(true, target.pos)
 			lowAcceptStreak = 0
 			carryLead = -1
 			if !mtpConfForce && !wasProbing && reng.needsDeepBootstrap(target.pos, len(result.Tokens), maxNew) {
@@ -2074,6 +2079,7 @@ func (pair *AssistantPair) GenerateSampledFromSessionEach(target *ArchSession, p
 			continue
 		}
 
+		dl.cycle(false, target.pos)
 		replacement := verify.ReplacementToken
 		result.Tokens = append(result.Tokens, replacement)
 		yieldStopped := yield != nil && !yield(replacement)

go/engine/metal/mtp_draftlen.go

@@ -0,0 +1,81 @@
+// SPDX-Licence-Identifier: EUPL-1.2
+
+//go:build darwin && arm64
+
+package native
+
+import "os"
+
+// mtpDraftLen — #359's first live scheduling slice: an additive-only dynamic
+// draft cap driven by acceptance history. The LTHN_MTP_CONF calibration runs
+// showed 40% of 26B cycles (30% on 12B) accept the whole fixed K=4 block and
+// end with cumprod ~0.99 — the drafter wants to keep going and is right, and
+// the waste is worst exactly where drafting pays most (83% acceptance at 16K
+// depth, where every avoided verify forward is the expensive deep kind). So:
+// consecutive fully-accepted cycles raise the cap toward mtpDraftLenMax;
+// any partial cycle resets it to the caller's base. Output is unchanged by
+// construction — verification pins the emitted stream to the target's greedy
+// continuation whatever the block length; only the cycle economics move.
+// Confidence-cumprod truncation (the θ=0.40 early stop) is the next slice —
+// it needs a per-token probability on the live path, which this deliberately
+// avoids: acceptance history is free.
+//
+// LTHN_MTP_DRAFTLEN=0 restores the fixed base cap byte-exactly (the repro
+// anchor, same convention as LTHN_MTP_REENGAGE).
+var mtpDraftLenDisabled = os.Getenv("LTHN_MTP_DRAFTLEN") == "0"
+
+const (
+	// mtpDraftLenMax bounds the raised cap: DSpark ships block7 drafters and
+	// our verify lane is sized for small widths (#354), so 8 stays inside
+	// the measured-cheap regime (block + carried lead = 9 verify rows).
+	mtpDraftLenMax = 8
+	// mtpDraftLenHotBar — full-accept cycles in a row before a raise. One
+	// full block is common noise (a hot streak is not); two in a row was the
+	// calibration sample's reliable "still hot" signal.
+	mtpDraftLenHotBar = 2
+	// mtpDraftLenRaise — cap step per hot streak (4 → 6 → 8).
+	mtpDraftLenRaise = 2
+	// mtpDraftLenDeepPos gates raises to depth: the calibration curves put
+	// dense full-accept streaks at depth (83% acceptance at 16K vs 48%
+	// shallow), and the live A/B confirmed the trade — +8.6% at 16K, −2.7%
+	// shallow when raises applied everywhere. Below this position the cap
+	// stays at base and the loop is byte-identical to the fixed-K engine.
+	mtpDraftLenDeepPos = 4096
+)
+
+type mtpDraftLen struct {
+	base int // caller-resolved fixed draft tokens (flag or engine default)
+	cap  int // live cap, [base, mtpDraftLenMax]
+	hot  int // consecutive fully-accepted cycles at the current cap
+}
+
+func newMTPDraftLen(base int) mtpDraftLen {
+	return mtpDraftLen{base: base, cap: base}
+}
+
+// next returns the block size for the coming draft call.
+func (d *mtpDraftLen) next(remaining int) int {
+	return min(d.cap, remaining)
+}
+
+// cycle feeds one verify outcome. fullAccept must be the cycle's AllAccepted
+// verdict (carry-aware), not a raw count comparison; pos is the target
+// position, gating raises to the deep regime where the streaks are dense.
+func (d *mtpDraftLen) cycle(fullAccept bool, pos int) {
+	if mtpDraftLenDisabled {
+		return
+	}
+	if !fullAccept {
+		d.cap = d.base
+		d.hot = 0
+		return
+	}
+	if pos < mtpDraftLenDeepPos {
+		return
+	}
+	d.hot++
+	if d.hot >= mtpDraftLenHotBar && d.cap < mtpDraftLenMax {
+		d.cap = min(d.cap+mtpDraftLenRaise, mtpDraftLenMax)
+		d.hot = 0
+	}
+}

go/engine/metal/mtp_draftlen_test.go

@@ -0,0 +1,89 @@
+// SPDX-Licence-Identifier: EUPL-1.2
+
+//go:build darwin && arm64
+
+package native
+
+import "testing"
+
+// TestMTPDraftLenRaisesOnHotStreak pins the additive ladder: two full-accept
+// cycles raise the cap one step, two more raise it again, capped at max.
+func TestMTPDraftLenRaisesOnHotStreak(t *testing.T) {
+	if mtpDraftLenDisabled {
+		t.Skip("LTHN_MTP_DRAFTLEN=0")
+	}
+	d := newMTPDraftLen(4)
+	if got := d.next(100); got != 4 {
+		t.Fatalf("initial next = %d, want 4", got)
+	}
+	d.cycle(true, mtpDraftLenDeepPos)
+	if d.cap != 4 {
+		t.Fatalf("cap after 1 hot = %d, want 4 (bar is 2)", d.cap)
+	}
+	d.cycle(true, mtpDraftLenDeepPos)
+	if d.cap != 6 {
+		t.Fatalf("cap after 2 hot = %d, want 6", d.cap)
+	}
+	d.cycle(true, mtpDraftLenDeepPos)
+	d.cycle(true, mtpDraftLenDeepPos)
+	if d.cap != 8 {
+		t.Fatalf("cap after 4 hot = %d, want 8", d.cap)
+	}
+	d.cycle(true, mtpDraftLenDeepPos)
+	d.cycle(true, mtpDraftLenDeepPos)
+	if d.cap != 8 {
+		t.Fatalf("cap past max = %d, want 8", d.cap)
+	}
+}
+
+// TestMTPDraftLenShallowNeverRaises pins the depth gate: full-accept streaks
+// below mtpDraftLenDeepPos leave the cap at base (the shallow lane stays
+// byte-identical to the fixed-K engine).
+func TestMTPDraftLenShallowNeverRaises(t *testing.T) {
+	if mtpDraftLenDisabled {
+		t.Skip("LTHN_MTP_DRAFTLEN=0")
+	}
+	d := newMTPDraftLen(4)
+	for range 6 {
+		d.cycle(true, mtpDraftLenDeepPos-1)
+	}
+	if d.cap != 4 {
+		t.Fatalf("shallow cap = %d, want 4", d.cap)
+	}
+}
+
+// TestMTPDraftLenResetsOnPartialCycle pins the re-anchor: any non-full cycle
+// drops the cap straight back to base and clears the streak.
+func TestMTPDraftLenResetsOnPartialCycle(t *testing.T) {
+	if mtpDraftLenDisabled {
+		t.Skip("LTHN_MTP_DRAFTLEN=0")
+	}
+	d := newMTPDraftLen(4)
+	d.cycle(true, mtpDraftLenDeepPos)
+	d.cycle(true, mtpDraftLenDeepPos)
+	if d.cap != 6 {
+		t.Fatalf("setup cap = %d, want 6", d.cap)
+	}
+	d.cycle(false, mtpDraftLenDeepPos)
+	if d.cap != 4 || d.hot != 0 {
+		t.Fatalf("after partial: cap=%d hot=%d, want 4,0", d.cap, d.hot)
+	}
+	// a lone full accept after the reset must not raise (streak restarted)
+	d.cycle(true, mtpDraftLenDeepPos)
+	if d.cap != 4 {
+		t.Fatalf("cap after reset+1 hot = %d, want 4", d.cap)
+	}
+}
+
+// TestMTPDraftLenNextRespectsRemaining pins that the emitted block never
+// exceeds the tokens still wanted, whatever the cap.
+func TestMTPDraftLenNextRespectsRemaining(t *testing.T) {
+	d := newMTPDraftLen(4)
+	d.cap = 8
+	if got := d.next(3); got != 3 {
+		t.Fatalf("next(3) = %d, want 3", got)
+	}
+	if got := d.next(50); got != 8 {
+		t.Fatalf("next(50) = %d, want 8", got)
+	}
+}