Fix: Python-side acquire/release on mailbox state

[ChaoWao]

Summary

Part 3 of splitting #571. Already landed: L1a (#592 HCCL platform C API), L1b (#597 sim+ChipWorker+Python), L4 (#605 error propagation). Independent follow-ups (L2 DistChipBootstrapChannel, L5/L6/L7) are separate PRs.

The C++ side of the mailbox handshake (WorkerThread::read_mailbox_state / write_mailbox_state in worker_manager.cpp) uses ldar/stlr on aarch64 and a compiler-barriered plain store on x86_64 for MAILBOX_OFF_STATE. The Python side — three worker loops, _chip_control, and init/close — used plain struct.pack_into("i", buf, _OFF_STATE, …) / unpack_from with no memory barrier.

On aarch64 that lets the child's OFF_STATE = TASK_DONE release-store pass the preceding OFF_ERROR / OFF_ERROR_MSG plain writes, so a parent that acquire-loads TASK_DONE can read stale error text. Program order is not memory order on a weakly-consistent CPU.

Changes

• python/bindings/worker_bind.h: add inline mailbox_load_i32 / mailbox_store_i32 (aarch64 ldar/stlr first per codestyle.md support extern func define in aicore #6, x86_64 compiler barrier + plain access, __atomic_{load,store} with ACQUIRE / RELEASE fallback). Expose on _task_interface as _mailbox_load_i32 / _mailbox_store_i32. Underscore prefix keeps them out of task_interface.__all__; only simpler.worker imports them.
• python/simpler/worker.py: every OFF_STATE read/write (18 sites across _sub_worker_loop, _chip_process_loop, _child_worker_loop, _chip_control, _init_hierarchical, close()) now goes through the helper. Error-path fields stay plain — they are published by the subsequent release-store. Adds _buffer_field_addr(buf, offset) helper.
• tests/ut/py/test_worker/test_mailbox_atomics.py: 4 cases
  • single-process roundtrip (binding signatures, negative values, offset disambiguation)
  • fork cross-process visibility (parent observes child's final state value)
  • 1000-iteration payload-before-state ordering — child writes 0xDEADBEEFCAFEBABE payload then release-stores state=1; parent acquire-loads state==1 then must observe the sentinel. Exercises the exact invariant the three loops rely on to publish OFF_ERROR_MSG with TASK_DONE.
  • sub-worker dispatch smoke using a MAP_SHARED counter to verify the refactored loop round-trips cleanly.

Design decisions

1. Exposure: C++ inline helpers in worker_bind.h bound via nanobind — one implementation, one ABI, no ctypes wrapper on the Python side.
2. ABI ordering: __aarch64__ → __x86_64__ → fallback, per codestyle.md support extern func define in aicore #6.
3. Address type: uint64_t. Python computes ctypes.addressof(ctypes.c_char.from_buffer(buf)) + offset; C++ reinterpret_casts to volatile int32_t*. No void* (nanobind would treat it as a Python object).
4. Invariant: in every loop and _chip_control, the state store is the last mailbox write of a transition; the state load is the first mailbox read. No field other than state needs atomic helpers.

Test plan

• pytest tests/ut/py/test_worker/ — 48 passed, 1 skipped (platform_comm needs hw), 0 regressions
• test_mailbox_atomics.py — 6 passed including 1000-iter fork race
• test_error_propagation.py — 5 passed (L4 paths exercise every refactored site end-to-end)
• CI on aarch64 self-hosted runner — this is where the race would actually show up if the invariant broke

[gemini-code-assist]

Code Review

This pull request introduces atomic acquire-load and release-store helpers in C++ and exposes them to Python to ensure correct memory ordering for mailbox state transitions across multiple processes. By replacing standard struct packing and unpacking with these helpers, the implementation guarantees that payload writes, such as error messages, are visible to other processes before state changes are observed, which is critical for weakly-ordered architectures like aarch64. The changes include a new test suite to verify these atomic invariants and cross-process visibility. I have no feedback to provide as the existing review comments were purely validating the implementation.