compiler: W4-EFFECTS-1 slices E2–E5 — admissible effects, from the gate to real hardware - #630

…keyed dropout its pathwise adjoint

E2a, the gate. The blanket AUTODIFF_STOCHASTIC_EFFECT refusal conflated two
independent questions: can the draw be REPLAYED, and can it be
DIFFERENTIATED. They are now separate and each refusal names which failed —
demonstrable on one op: the same dropout without a recorded product reports
AUTODIFF_STOCHASTIC_NO_PRODUCT, and with one passes that gate to be judged on
its adjoint instead. The gate stays fail-closed: absence of a product is
refusal, not permission, so every program refused before is still refused.

Admissibility is a property of the CALL FORM, not the op name — measured on
tessera.dropout, whose three forms differ: `seed=N` replays bit-identically,
ambient entropy does not, and a caller-owned generator does not because it
ADVANCES per call and its position is not in the product. That third form is
the one worth naming: it looks keyed and is not.
`stochastic_product_for_call` admits the first and refuses the others by
name, and a test pins those verdicts against the op's measured behaviour so
the table cannot drift from reality.

E2b, the adjoint. Under the declared constant_noise estimator the forward is
y = x * m/(1-p), so the Jacobian is diag(m/(1-p)) — DIAGONAL, hence its own
transpose — and the adjoint is the same operation applied to the cotangent:
dx = dropout(dout, same key). It therefore mirrors DropoutOp::buildTangent
rather than introducing a second formula (#31), and carries the same guard:
an unkeyed training draw emits no adjoint, because the backward would
otherwise apply a DIFFERENT mask than the forward and produce a plausible
but wrong gradient.

Verified exactly where exactness is the claim: J v == diag(m) v bitwise, the
forward is exactly elementwise scaling by the mask, and the emitted adjoint
equals the analytic pathwise rule bitwise. The pairing identity <Jv,u> =
<v,Ju> is checked in float64, since two dot products over different vectors
accumulate in different orders and bit equality there would be a statement
about summation rather than about the operator.

Two drift gates caught real omissions, which is what they exist for: the new
diagnostics needed diagnostic_codes.py entries, and dropout had to be
recorded in the native-adjoint ledger.

Gates: IR lit 61/61 (E2a's obsolete no-adjoint case retired into the new
adjoint fixture, so each file states one thing); 27 unit tests; full suite at
the recorded environmental baseline with no new failure site; mypy 0; ruff
clean; dashboards regenerated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…eck identity

Four findings, all real. The first two were the same defect seen from two
sides: admission was too weak, and it was implemented twice.

P1 — the gate admitted an unverified carrier. `carriesKeyedRngProduct`
checked only the class string and that the digest was 64 hex characters,
so the fixture's own placeholder digest passed. The recorded product is
supposed to be *evidence*, and evidence nobody checks is decoration. It
is now a hash chain: supported schema, lowercase 64-hex digest,
`sha256(payload) == digest`, and a payload that names THIS op and THIS
effect class — so a fabricated digest, a payload-less digest, and a valid
product copied from another operation are each refused with their own
reason. The positive fixture now carries a payload generated by the real
E1 carrier rather than a placeholder, which is what made the weakness
visible in the first place.

P2 — admission inside regions. `RegionAdjointInterface::isReplayable`
rejected every non-pure op, so the same keyed dropout that E2 admitted at
the top level failed with AUTODIFF_REGION_ADJOINT the moment it appeared
in an `scf.if` body. The newly admitted family was admissible only in
straight-line code, which is not a useful family. Rather than write a
second check, the verifier moved into `SemanticEffects.cpp` and all three
call sites — the paired pass, the structured region walk, and the
structurized-CFG body walk — call it (#31). A nested-region fixture proves
both directions: a verified draw differentiates and saves the predicate
rather than redrawing it; the same nesting with a product naming another
op is still refused, which is the teeth for the sharing claim.

P2 — mutation identity. `verify_recorded_state` compared only the content
digest, answering "do these bytes match" rather than "is this the same
state at the same version". Zero-initialised optimizer state is the
everyday counterexample: every lineage's first moment is the same bytes,
so a replay reattached to the wrong buffer verified clean. Lineage and
version are now required keyword arguments — no default, because a
defaulted identity is the permissive answer to a semantic question
(#21a) — and the two failure directions get separate messages.

P2 — the paired pass no longer emits AUTODIFF_STOCHASTIC_EFFECT, so its
metadata stops listing it and names the two codes it does emit. A listed
code the pass cannot emit is a declaration with no producer, and it reads
as "this family is still refused wholesale" (#29). The in-place
`tessera-autodiff` pass still emits the old code and keeps it.

Evidence, this box (Strix Halo, gfx1151 + Zen 5 AVX-512):
  lit tests/tessera-ir/                     414/414
  phase_f4 (incl. the new fixture)           62/62
  test_recorded_product.py                   38 passed
  test_w4_effects_physical_family.py          5 passed, native_gpu/native_cpu
  unit -m "not slow"                        failure profile unchanged from the
                                            recorded baseline (fp8 20, apple 17,
                                            scheduled_matmul 3, wmma 1 = 41)
  scripts/check_generated_docs.sh           26 in sync

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>