docs(iommu): record the executed flip to iommu=pt and its measured cost of nothing

Window 01:24-01:35. Byte-identical A/B (rebuild proved it: same 1,287,656 B corpus,
same billed token counts 59,024 / 21,568): cold prefill 1,585.1 -> 1,616.0 t/s
(+2.0 %), warm 208,531 -> 214,131, needle hit/hit both boots. The 13-16 % that
justified amd_iommu=off since 2026-09-11 does not exist on this host; the decode
delta (-9.7 %) is instrument noise -- three repeats of one request on the same boot
gave 31.8/46.9/47.8 t/s.

NPU precondition restored: amdxdna bound 0000:c6:00.1 (driver 0.7.0, firmware
amdnpu/17f0_11/npu_7.sbin), group 26 identity, PASID width 10, /dev/accel/accel0
root:render with dank in render. No endpoint deployed, so frank-npu stays retired
-- only its rationale changes. Gates: 0 failed units, 32 groups (31 identity + the
SD reader's DMA quirk), iGPU c5:00.0 identity with ATS, dragoon ledger unchanged
(74.1 GiB, no clamp, listening at 39.8 s).

Deferred on purpose: the pp_dpm_fclk pin (changes iGPU timing for everyone, nothing
co-runs yet) and PerfOpt (7.0.0-38 has zero perfopt symbols, 26.04 caps at 7.0.0-38.38).
Re-keyed: decision record banner/front matter/verification/revert + new execution
section, frank-npu rationale, AGENTS key lesson, both index pages.

serverAppConfigs-docs/log.md

@@ -2066,3 +2066,45 @@ every restart since the cutover.
   vendor number, and the plan posted to Gitea issue #3 (comment 23, then edited).
   bats 371/371; commits `7643381` plus this correction. Nothing deployed — no
   service was touched.
+
+## 2026-10-18 — boot line flipped: Dankclaw now boots `iommu=pt`
+
+- Window executed 01:24–01:35 on Frank's go-ahead, with the A/B the research
+  demanded. Provenance first: `/etc/default/grub` had never been in the repo
+  while the IOMMU line was the most consequential kernel decision on the box, so
+  it is now tracked at `dankclaw/host/grub` (fetched byte-exact, 1581 B) and moves
+  only through `scripts/set-dankclaw-bootline.sh` — diff, install 0644 root:root,
+  `update-grub`, **verify the default `grub.cfg` entry**, reboot on `--reboot`
+  only. The deployer plans nothing under `dankclaw/host/`: kernel state is not a
+  container restart.
+- **Measured arms, byte-identical traffic.** OFF arm at uptime 2 d 23 h: cold
+  prefill **1,585.1 t/s** (59,024 tok), warm 208,531, cache ratio 131.6×, needle
+  hit/hit @21,568, decode 37.3 t/s. PT arm after the reboot: **1,616.0 t/s
+  (+2.0 %)**, warm 214,131, ratio 132.5×, needle hit/hit, decode 33.7 t/s. The
+  corpus was rebuilt after the reboot deleted `/tmp` (tmpfs) and is provably the
+  same input: 2,891 lines, **1,287,656 B**, and the engine billed identical token
+  counts. Verdict: **identity DMA costs nothing on this host** — the 13–16 % that
+  justified `amd_iommu=off` for five weeks never existed here. Decode's −9.7 % is
+  instrument noise: three repeats of the same request on the same boot gave 31.8,
+  46.9, 47.8 t/s.
+- Gates after boot: 0 failed units, systemd running, 32 IOMMU groups (31 identity
+  + 1 DMA = the Genesys Logic SD reader `c2:00.0`, a kernel quirk), iGPU `c5:00.0`
+  identity group 20 with ATS, interrupt remapping on. frank-dragoon's ledger is
+  byte-for-byte the same shape (62.9 + 5.5 + 5.7 = 74.1 GiB, 2 slots over ONE
+  200,704 pool, MTP depth 2, prompt cache ON, no clamp; listening at 39.8 s), and
+  Gitea / Caddy edge / Grafana answered 200.
+- **The XDNA2 NPU is back:** `amdxdna` bound `0000:c6:00.1`, firmware
+  `amdnpu/17f0_11/npu_7.sbin`, `amdxdna_accel_driver 0.7.0 … minor 0`, group 26
+  `identity`, PASID width 10. `/dev/accel/accel0` `crw-rw---- root:render 261,0`
+  with `dank` in `render`. No endpoint deployed — revival needs a quadlet with
+  `AddDevice=/dev/accel/accel0` + `GroupAdd=keep-groups`.
+- Deliberately NOT done: the `pp_dpm_fclk` level-7 pin (it changes iGPU timing for
+  every workload and nothing co-runs on the NPU yet) and any PerfOpt work (kernel
+  `7.0.0-38` has zero `perfopt` symbols; the 26.04 archive caps at `7.0.0-38.38`).
+- New tool: `scripts/stage-frank-dragoon-eval.sh` rebuilds `/tmp/halogen-eval`
+  byte-identically (corpus + probe PNG + battery) — run it through `bash -lc`,
+  `uv` is in `~/.local/bin`. Docs re-keyed: decision record (banner, front matter,
+  verification/revert, new § *2026-10-18 execution*), `frank-npu.md` (precondition
+  satisfied, endpoint still absent), AGENTS.md key lesson, both index pages.
+  bats 371/371. frank-dragoon and frank-zealot were live the whole window; only
+  the reboot interrupted them (~40 s to listen, health 200).