feat: add ASLRef-backed PTO reference model

[zhoubot]

Summary

Add the public ASLRef-backed PTO reference runner and versioned C ABI used by downstream gfrun. PTO instruction semantics remain entirely in the exact locked PTO-SPEC ASL tree.

The model repository owns:

• static little-endian 0xE9 ELF64 validation and bounded PT_LOAD loading;
• exact PTO tree / ASLRef pin / sidecar identity checks;
• direct boot with both captured return state and architectural R10 initialized;
• consecutive ExecuteNextPTOInstruction() execution inside one ASLRef process;
• stop policy, result bytes, deterministic manifest, timing, and C/C++ ABI;
• model NDF and snapshot-worker performance design.

It contains no custom PTO decoder or instruction handler and applies zero parser/typechecker/interpreter semantic patches to ASLRef.

Correctness evidence

• Python runner tests: 10/10 passed
• C/C++ ABI/client CTest: 3/3 passed
• release build and git diff --check: passed
• real scalar_add_i32_lat 0xE9 ELF: final TPC 0x111e8, result 3905, exact 8192-byte independent golden
• 341 verified sidecars/goldens generated downstream: 124 scalar, 14 memory, 11 cube, 129 vector, 63 fixp
• full parameterized GTest run: in progress

Performance evidence

Measured process-per-case cold runs take 526-563 s. A persistent native prototype reaches ready in 510.271 s, then warm decode/step takes 0.284-0.983 ms at about 498 MiB peak RSS. Full reset takes 544-582 s and is rejected as a per-case strategy.

The selected acceleration design is an exact-profile pristine initialized parent with one copy-on-write child per case, a memory-bounded worker pool, Unix fd passing for the verified ELF, and a 512 MiB Darwin LC_MAIN stack. See docs/worker-snapshot-design.md. This is model lifecycle/NDF, not PTO architecture.

Linked work

• feat: unify ASLRef functional-model architecture boundary pto-spec#188
• test: publish 0xE9 cross-model microbenchmark results SuperNPUBench#100
• LinxISA/SuperScalarModel#428 (consumer only; do not merge automatically)
• [performance] Amortize ASLRef cold parse/reset across parallel GoogleTest corpus #5

Closes #1
Closes #3

[zhoubot]

Dependency chain: PTO-ISA/pto-spec#188 owns architecture; LinxISA/SuperScalarModel#428 consumes this ABI; LinxISA/linx-isa#191 pins exact heads. Keep Draft and unmerged.

[zhoubot]

Scope decision: this Draft PR intentionally exposes stop-PC-only execution for the first release. Host-exit/service termination is deferred to PTO-ISA/pto-spec#150. The accepted evidence set is the three exact scalar, block64, and Tile TADD result hashes.

[jiale-wangOwO]

A follow-up model PR is available: #4, stacked on this branch. It ports the more complete runtime design (sparse memory, host bridge, session/snapshot/PE runtime, persistent worker and tests) into the same package while retaining this PR's C ABI and runner as the sole hosted entry. It depends on PTO-SPEC#188 and should be reviewed before SuperScalarModel#428 is finalized.

[zhoubot]

Issue #3 implementation update is in c0ab531:

• verified sidecar v1 input through CLI and C ABI v2
• ELF SHA/e_machine/entry/PT_LOAD/symbol/golden validation
• high-address bounded memory and per-case Tile model bounds
• direct-boot start/return PC policy and repeated stop-PC policy
• deterministic sidecar identity and host timing fields
• 10 Python + 3 C/C++ ABI tests pass; make check and git diff --check pass
• 124 generated scalar sidecars pass model preflight

Performance/correctness evidence from the real add_i32_lat ELF:

• cold ASLRef minimal-mode direct run: ~593,250 ms before rejection
• initial ELF-entry stop at _end was a false completion; stop_after_hits closed that bug
• entry-path rejection is platform glue 0x111ee: ACRC 1, avoided by verified direct-boot main
• direct-boot reaches 0x1125c: SETC.LTUI, then rejects because _BundleBodyActive is never entered by ExecuteNextPTOInstruction

The PR remains Draft. Resolving automatic header-to-body transition is a PTO architecture decision not covered by ADR-0111; no semantic workaround was added here.

[zhoubot]

Update: added rejected-instruction fault context, corrected hosted sp/ra seeding against the PTO register map, added fresh-process reset specialization with fail-closed source matching, and documented the model NDF. The same 128 KiB TLOAD carrier fell from 600.6s to 61.0s with identical terminal PC and result SHA (about 9.8x). Manifest-backed C/C++ consumers now use quiet mode.

[jiale-wangOwO]

Cross-repository decisions and merge order are now tracked in Issue #7. Please treat #7 as the coordination source; this PR remains the public ABI/runner base.

[zhoubot]

Repinned the model lock in aeb0a49 to PTO #190 head 7b990451 (tree 03bda540), which includes the relative-generation and ordinary floating Matrix reference-profile fixes. make check BUILD_DIR=build-current passes: 14 Python tests and 3 ABI/client tests.