fix(dsws): route first-time wave entry through _alloc/_init (Pool-T7 brick)

The CONV=1 seed block sent first-time wave entry through the .Ldispatch
re-dispatch trampoline, which lands on _follow and deliberately skips
_alloc/_init. That is correct for RE-dispatch (a wave that already ran them
once after a bail) but fatal for first entry: the three per-wave initializers
live ONLY inside _alloc/_init --
  (a) s_alloc_vgpr 32   -- the DYNVGPR per-wave lean allocator handshake,
  (b) INITFLAG==0xACED  -- the LDS rendezvous with the claimer,
  (c) s35 = 0           -- the local last-seen-epoch baseline.
First-entry-via-_follow skipped all three, so followers read EPOCH/STI from
uninitialized LDS with a garbage s35 before the claimer published INITFLAG,
desynced from the epoch clock, never reached their _quiesce bail, and
QUIESCE_CNT never reached WAVES-1 -> the claimer spun forever in
.Lclaimer_wait_done -> GPU hang -> MODE1 reset -> desktop brick. This is why
Phase-A CONV=0 ran clean (its .else entry goes .Lbfeed/.Lafeed/.Lcompute ->
full _alloc/_init/_follow) but the first CONV=1 dispatch hung with conversions
provably dormant: seed->dispatch entry routing was the only new always-active
path. Entry and re-dispatch are NOT interchangeable.

Fix (CONV=1-only): the 3 seed arms now s_branch .Lcompute/.Lafeed/.Lbfeed
(full role entry, s59 pre-seeded) instead of .Ldispatch. Bails still go
_quiesce -> .Ldispatch -> _follow (re-dispatch unchanged). Corrected the
.Ldispatch header comment to RE-DISPATCH ONLY (and fixed its inaccurate
"already-consumed INITFLAG" note -- INITFLAG is written once and never cleared;
the real reason re-dispatch skips _init is it would reset s35).

CPU model (dsws_ctrl_model.cpp): added the first-entry contract
(WaveEntry/simulate_first_entry/entry_safe/claimer_quiesce_converges) + a
Pool-T7 repro test (TDD RED->GREEN): the buggy routing deterministically fails
to converge (reproduces the hang), the fix converges.

Offline validation: CONV=0 .text sha256 byte-identical to HEAD on all 3 mixes
(4c2a2b/6c1a1b/2c3a3b); CONV=1 .text differs as intended; RGA 0-spill,
max-live VGPR 83 <= NFV=112; CPU model ALL PASS. Independently Codex-reviewed
offline (no blocker/major). GPU re-baseline pending kmbandy greenlight.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132aDSBLwusCJ4KzHQTnvdu

Author: kmbandy

ggml/src/ggml-cuda/aiter-integration/rdna4_fp8_gemm/spike/dvgpr_occ/dsws_ctrl_model.cpp

@@ -93,3 +93,43 @@ inline bool pool_fits_lean(uint32_t n_pool, uint32_t vlean, uint32_t budget) {
 inline bool quiesce_ready_pool(uint32_t quiesce_cnt, uint32_t n_pool) {
     return quiesce_cnt >= n_pool - 1;
 }
+
+// ---- Pool-T7 root cause: first-entry contract (dispatch vs re-dispatch) ----
+//
+// A wave's FIRST-time entry and its RE-dispatch (after a per-super-tile bail) are NOT
+// interchangeable. First entry must run, in order, the per-role _alloc and _init blocks:
+//   (a) ran_alloc      -- s_alloc_vgpr 32, the DYNVGPR per-wave lean allocator handshake,
+//   (b) waited_initflag -- spin until the claimer publishes INITFLAG == 0xACED (LDS ready),
+//   (c) seeded_epoch   -- s35 = 0, the local last-seen-epoch baseline,
+// THEN falls into _follow. Re-dispatch legitimately skips (a)/(b)/(c): the wave already ran
+// them once and conv_apply already sized its footprint -- so the scalar-only .Ldispatch
+// trampoline lands straight on _follow. The bug: the seed arms pointed FIRST entry at
+// .Ldispatch too, so first-time followers skip _alloc/_init and desync from the epoch clock.
+struct WaveEntry { bool ran_alloc; bool waited_initflag; bool seeded_epoch; };
+
+// Where a wave's first-time entry lands. LAND_FOLLOW == seed arms branch to .Ldispatch (the
+// buggy routing); LAND_ROLE_ENTRY == seed arms branch to .Lbfeed/.Lafeed/.Lcompute (the fix).
+enum EntryLanding { LAND_FOLLOW, LAND_ROLE_ENTRY };
+
+inline WaveEntry simulate_first_entry(EntryLanding land) {
+    // Only the role entry labels chain _alloc -> _init -> _follow; landing on _follow skips both.
+    bool full = (land == LAND_ROLE_ENTRY);
+    return WaveEntry{full, full, full};
+}
+
+// A wave is correctly initialized for the follow/quiesce protocol iff it ran all three.
+inline bool entry_safe(const WaveEntry& w) {
+    return w.ran_alloc && w.waited_initflag && w.seeded_epoch;
+}
+
+// End-to-end handshake: does the claimer's per-super-tile QUIESCE_CNT >= WAVES-1 gate ever
+// close? Every non-claimer follower (wid0 is the claimer and never bails) must reach its
+// _quiesce bail once per super-tile; only a follower that entered safely is synced to the
+// epoch clock and reliably does. An unsafe entry is a deterministic code-path defect (garbage
+// s35 + skipped INITFLAG in identically-compiled waves), so ALL seed-entered followers desync
+// -> zero reliable bumps -> the claimer spins forever in .Lclaimer_wait_done.
+inline bool claimer_quiesce_converges(EntryLanding land, uint32_t waves) {
+    uint32_t n_followers = waves - 1;
+    uint32_t n_safe = entry_safe(simulate_first_entry(land)) ? n_followers : 0;
+    return quiesce_ready_pool(n_safe, waves);
+}

ggml/src/ggml-cuda/aiter-integration/rdna4_fp8_gemm/spike/dvgpr_occ/occ_kernel_dsws.s

@@ -657,18 +657,24 @@ occ_kernel:
 .if CONV_COOLDOWN > 0
     s_mov_b32 s66, 0                             // Task 4: init cooldown ctr (un-cooled at entry)
 .endif
+    // FIRST-time entry seeds the role reg s59 then falls into the role's FULL entry
+    //   (.Lcompute/.Lafeed/.Lbfeed -> _alloc -> _init -> _follow). It must NOT jump to
+    //   .Ldispatch: that trampoline lands on _follow and is correct ONLY for RE-dispatch
+    //   (a wave that already ran _alloc/_init once). First entry via _follow would skip the
+    //   s_alloc_vgpr 32 allocator handshake, the INITFLAG==0xACED rendezvous, and the s35=0
+    //   epoch seed -> followers desync and the claimer hangs in .Lclaimer_wait_done (Pool-T7 brick).
     s_cmp_lt_u32 s24, NBFEED
     s_cbranch_scc1 .Lseed_bfeed
     s_cmp_lt_u32 s24, (NBFEED+NAFEED)
     s_cbranch_scc1 .Lseed_afeed
     s_mov_b32 s59, NCOMP_SLOT
-    s_branch .Ldispatch
+    s_branch .Lcompute
 .Lseed_afeed:
     s_mov_b32 s59, NAFEED_SLOT
-    s_branch .Ldispatch
+    s_branch .Lafeed
 .Lseed_bfeed:
     s_mov_b32 s59, NBFEED_SLOT
-    s_branch .Ldispatch
+    s_branch .Lbfeed
 .else
     s_cmp_lt_u32 s24, NBFEED
     s_cbranch_scc1 .Lbfeed
@@ -1241,11 +1247,15 @@ occ_kernel:
 
 .if DSWS2_CONV
 // ============================================================================================
-//  Universal role dispatcher (Task 3): scalar-only trampoline. Reads the role register s59
-//    (seeded at entry / flipped by conv_apply on a role conversion) and branches to the matching
-//    role's per-epoch _follow loop. Lands on _follow (NOT _alloc/_init): the wave's VGPR footprint
-//    is already correct (seed or conv_apply set it) and INIT already ran once -- re-entering
-//    _alloc would wrongly resize, and _init would deadlock on the already-consumed INITFLAG.
+//  Role RE-DISPATCH trampoline (Task 3): scalar-only. Reads the role register s59 (flipped by
+//    conv_apply on a role conversion, else unchanged) and branches to the matching role's
+//    per-epoch _follow loop. RE-DISPATCH ONLY -- reached from a per-super-tile _quiesce bail,
+//    never from first-time entry (the seed arms fall into the full role entry so _alloc/_init
+//    run once; see the seed block). Lands on _follow (NOT _alloc/_init): the wave's VGPR
+//    footprint is already correct (conv_apply set it) and INIT already ran -- re-entering _alloc
+//    would wrongly resize, and re-running _init would reset s35=0, breaking the "wait for the
+//    NEXT epoch" contract (the wave would re-process the current super-tile). INITFLAG is written
+//    once (0xACED) and never cleared, so it is the s35 reset -- not INITFLAG -- that _follow preserves.
 //    s35 (last-seen-epoch) is untouched here, which is what makes a re-dispatched wave wait for
 //    the NEXT epoch at the top of its new role's _follow loop. Scalar-only (s59 read + s_branch) ->
 //    adds ZERO OOR/VGPR exposure.

ggml/src/ggml-cuda/aiter-integration/rdna4_fp8_gemm/spike/dvgpr_occ/test_dsws_ctrl_model.cpp

@@ -95,6 +95,29 @@ int main() {
   assert( quiesce_ready_pool(11, 12) && !quiesce_ready_pool(10, 12));
   printf("dsws_ctrl_model: dispatch/cooldown/pool OK\n");
 
+  // ---- Pool-T7 brick repro: first-time entry MUST run _alloc/_init before _follow ----
+  //   A wave's first entry has to (a) commit its lean VGPR alloc (s_alloc_vgpr 32), (b) wait the
+  //   claimer's INITFLAG==0xACED LDS rendezvous, and (c) seed its local epoch (s35=0) -- all of which
+  //   live only inside the per-role _alloc/_init blocks. Landing first entry on _follow (what the
+  //   .Ldispatch re-dispatch trampoline does) skips all three -> followers desync from the epoch clock,
+  //   never reach their _quiesce bail, and the claimer spins forever in .Lclaimer_wait_done (the brick).
+  {
+    WaveEntry via_dispatch = simulate_first_entry(LAND_FOLLOW);     // seed arms -> .Ldispatch (buggy)
+    assert(!via_dispatch.ran_alloc && !via_dispatch.waited_initflag && !via_dispatch.seeded_epoch);
+    assert(!entry_safe(via_dispatch));                              // first entry via _follow is UNSAFE
+
+    WaveEntry via_role = simulate_first_entry(LAND_ROLE_ENTRY);     // seed arms -> .Lbfeed/.Lafeed/.Lcompute
+    assert(via_role.ran_alloc && via_role.waited_initflag && via_role.seeded_epoch);
+    assert(entry_safe(via_role));                                   // first entry via role label is SAFE
+
+    // End-to-end handshake: mix 4c2a2b -> WAVES=8, so 7 non-claimer followers must each bump QUIESCE_CNT
+    // once per super-tile. Unsafe entry desyncs EVERY seed-entered follower (deterministic code-path
+    // defect, not a timing race -> all 7 lost), so the claimer's QUIESCE_CNT>=WAVES-1 gate never closes.
+    assert(!claimer_quiesce_converges(LAND_FOLLOW,    8));          // BUG: reproduces the Pool-T7 hang
+    assert( claimer_quiesce_converges(LAND_ROLE_ENTRY, 8));         // FIX: claimer advances
+  }
+  printf("dsws_ctrl_model: entry-contract (Pool-T7 repro) OK\n");
+
   printf("dsws_ctrl_model: ALL PASS\n");
   return 0;
 }