Design the whole stack. Close the analog loop.

Schema rule: keep technology-specific data in tagged variants and expose storage type, volatility/retention, and analog signal domain independently. At minimum, use weight_storage, retention_domain, analog_signal_domain, load_mode, readback.kind/granularity, program_verify.mode, journal.durability, reset_effects, and a versioned recovery_recipe_id as separate capability fields. The label “SRAM / charge-domain ACiM” is shorthand only for Example B, not a taxonomy that makes SRAM and charge-domain synonymous. Do not require conductance, drift, or endurance fields in a generic ACiM profile, and do not apply the resistive equation Iⱼ ≈ Σᵢ VᵢGᵢⱼ to a charge-domain SRAM macro.

Compiler invariant: every lowering pass must prove legality, materialize an explicit conversion/fallback, or fail compilation. It must never silently change layout, clipping, rounding, overflow, or synchronization behavior.

1. Gate 1Is the region ACiM-shaped?

   Dense/convolutional matrix-vector work, stable shapes, enough reuse, and a useful problem size.

2. Gate 2Can it be legalized?

   Supported data layout, tensor dimensions, signed encoding, activation rules, and static parameters.

3. Gate 3Can it fit?

   Array rows/columns, tile count, precision slices, spare capacity, SRAM, routes, and converter capacity.

4. Gate 4Does accuracy survive?

   Simulate calibrated nonidealities, retrain or rescale, and compare against an explicit accuracy-loss budget.

5. Gate 5Does the system win?

   Include DMA, ADC/DAC, accumulation, transitions, calibration, programming, and digital fallback—not peak MACs alone.

Runtime predicate: usable = target_match ∧ abi_match ∧ profile_schema_match ∧ health_generation_match ∧ operating_point ∈ validity_domain ∧ not_expired. Sign the identity and compatibility fields that protect this decision.

Journal rule: only a target that declares resumable programming may use this path. Its crash-consistent record should bind operation ID, bundle/weight-image hash, device and reset generation, last verified safe progress unit, verify result, and remaining pulse/endurance budget. Firmware commits at a vendor-defined safe boundary and reconciles with device state where readback exists; “last command sent” in host memory is not recovery proof.

Reset rule: a scoped reset increments a generation and invalidates every queue, handle, residency, and profile assumption listed by reset_effects. A journal survives only when its declared durability includes that reset or power-loss class. Retry only an idempotent command or a target-declared recoverable transaction; otherwise restart/reload through the versioned vendor recipe, remap/quarantine, or fall back digitally. Never return a partial result as valid.

1. 00–05 minClarify workload and success

   Separate model, product, silicon, lifecycle, and safety constraints.

   Your turnWhich questions decide the architecture before you draw the stack?
   Reveal coaching

   Confirm whether the supplied vision/audio rates, four-context concurrency, two-second burst, percentile boundary, and drop policy reflect product intent; then state the queue boundary and require steady arrival to remain below sustained thermally limited service. Ask about model families/operators and shapes; per-model deadlines and priority; energy and accuracy-loss budgets; determinism and cold start; model size/update frequency; ACiM array geometry/device precision and fault rate; converter/SRAM/NoC limits; target temperatures and lifetime; security/isolation; and whether the stack owns training. State exclusions, such as not designing the memory device itself.

   Close the stated load: use B_peak = max(0, λ_burst − μ) × 2 s and, only when μ > 80/s, T_drain = B_peak ÷ (μ − 80/s). At μ = 80/s the backlog is 60 and never drains; at μ = 100/s it is 20, drains in one second, and can impose about 200 ms of queueing. Therefore define per-class admission/reservation and deadline behavior before claiming p95.

2. 05–10 minDefine the hardware/software contract

   Turn the accelerator into a target that a compiler can reason about.

   Your turnWhat must the target expose beyond “16 tiles”?
   Reveal coaching

   • Supported operator forms, data types, accumulator behavior, array rows/columns, cell precision and signed encoding.
   • Tile topology, SRAM banks, alignment, DMA and NoC bandwidth, converter modes, barriers, queue semantics, interrupts, reset scope, and power states.
   • Weight storage and retention domain; load granularity/idempotence; readback kind and granularity; program/verify mode; journal durability and safe commit unit; reset effects; recovery recipe/version.
   • Versioned fault/calibration profile and latency/energy/error cost models. The compiler consumes capabilities; the runtime checks compatibility.
3. 10–17 minDesign import, IR, and transforms

   Preserve model intent while progressively making hardware choices explicit.

   Your turnHow does PyTorch or ONNX become an analog-aware executable?
   Reveal coaching

   Import to a high-level graph IR; infer shapes and fold constants; canonicalize GEMM/convolution; legalize and fuse; quantize with representative data; annotate candidate ACiM regions; run noise-aware optimization; lower selected regions into a device IR with tiles, precision slices, buffers, transfers, synchronization, fallback, calibration/profile references; then emit commands and a debug map.

4. 17–25 minPartition by whole-system cost

   Show that “supported” does not automatically mean “profitable.”

   Your turnWhen should an eligible matrix operation remain digital?
   Reveal coaching

   Keep it digital when the shape underfills arrays, transfers/conversions dominate, precision or accuracy recovery is too costly, weights change too often, program time exceeds reuse, dynamic shape/control prevents stable placement, an adjacent digital fusion is cheaper, the device profile is unhealthy, or the latency/energy model predicts no end-to-end win. Minimize engine boundaries, not just operator costs.

5. 25–32 minMap, place, and schedule

   Translate selected regions into arrays, buffers, routes, and time.

   Your turnHow do precision, faults, and converters change placement?
   Reveal coaching

   • Tile input dimension K onto effective rows and output dimension M onto logical columns; bit-slice logical precision; encode signed weights; reserve target-specific spare capacity.
   • Use the fault map to avoid bad resources and co-locate producers/consumers to reduce partial-sum traffic.
   • Keep tensor quantization scales distinct from physical input-drive and sensing/ADC ranges; size digital accumulators for all slices and tiles.
   • Double-buffer SRAM and overlap DMA, ACiM, accumulation, activation, and digital-engine work with explicit events and deadlines.
6. 32–37 minDesign load and execution

   Cover the path that starts before the first inference.

   Your turnWhat happens from signed bundle to a completed result?
   Reveal coaching

   The runtime authenticates the bundle, checks ABI/firmware/capability compatibility, selects a calibration profile, and reserves resources. It asks firmware to load a volatile image, run an atomic vendor program operation, or resume program/verify only when the target explicitly supports that mode and its journal/reconciliation proof. The driver maps buffers, queues DMA/commands, and handles interrupts. Firmware owns the safe target-specific sequence, health, reset, and power state. On interruption, use declared readback and journaling where available; otherwise invalidate residency and run the vendor restart/reload recipe, remap/quarantine, or execute digital fallback.

7. 37–41 minClose the calibration loop

   Make device variation observable and actionable.

   Your turnHow does deployed evidence reach the next compilation?
   Reveal coaching

   Version profiles by device/tile, firmware, temperature band, age, and test method. Collect saturation, converter statistics, program retries, faults, temperature, latency/energy, and periodic golden/sentinel outputs. Policy selects an existing profile, triggers targeted recalibration, remaps around degradation, chooses fallback, or exports a profile for fleet-level cost/error model updates and model recompilation. Protect telemetry privacy and authenticate profile updates.

8. 41–45 minVerify and defend trade-offs

   Prove correctness, performance, resilience, and maintainability.

   Your turnWhat test pyramid and production metrics make the stack trustworthy?
   Reveal coaching

   • Unit-test graph transforms and command encoding; differential-test IR and digital reference; simulate calibrated noise/fault distributions; test firmware on emulation/silicon; run end-to-end representative datasets across devices, temperatures, and ages.
   • Track task accuracy delta, output error distribution, p50/p95/p99 latency, sustained throughput, energy/inference, ACiM and converter utilization, bytes moved, fallback rate, calibration age, verify retries, and fault growth.
   • State the central trade-off: analog efficiency is useful only when accuracy recovery, conversion, transfer, calibration, and lifecycle cost remain inside the product budget.