Add uninitialized full-overwrite replay for reduction and indexed plans

[shinaoka]

Context

tenferro-rs#1516B must remove legacy typed-uninitialized pooled outputs without adding an output-sized zero-fill pass. The current erased reduction and indexed plans accept initialized destinations even when they overwrite every logical element. This blocks the safety migration.

Tracks strided-rs#149 and tensor4all/tenferro-rs#1516 / #1535.

Scope

Add explicit uninitialized destination replay for:

• ErasedReducePlan
• ErasedGatherPlan
• ErasedScatterPlan
• ErasedDynamicSlicePlan
• ErasedDynamicUpdateSlicePlan

Use the existing erased uninitialized raw descriptor/storage plumbing. Preserve explicit ExecContext, cached plans, dtype validation, wrapping integer behavior, SIMD paths, parallel thresholds, and the expected-serial additive-scatter policy.

Scatter and dynamic update must perform their initial full operand copy through an uninitialized destination, transition privately only after that copy completes, then run read-modify-write updates. Do not expose a public forgeable initialized-state receipt.

Acceptance

• no caller-side destination zero-fill or duplicate operand copy
• every successful path initializes every logical output before any typed read
• typed errors before/while writing leave ownership with the caller; partial destinations are never read/dropped as initialized values
• stale invalid bool storage tests for direct overwrite families
• error/panic and empty/zero-size coverage
• differential tests against initialized replay for every KernelDType and supported index dtype/layout
• explicit ExecContext coverage at serial and bounded-parallel settings; additive scatter remains deliberately serial
• Miri-capable lifecycle tests and >=90% coverage for new production files
• before/after focused benchmarks show no new output-sized pass or >20% regression
• worklog, fmt, fast checks, repository rules review, and Sol low/high review

Non-goals

GEMM/einsum overwrite is tracked separately because all backends must agree not to read C.

[shinaoka]

Implementation design

This item will stay one reviewable PR unless implementation proves that a new public descriptor/state type is required.

API shape

Add sibling execute_uninit entry points to the existing erased plans. The destination is &mut ErasedRawStridedUninitMut; inputs use ErasedRawStridedPtr. No descriptor representation change is planned: the existing erased uninitialized destination already carries alignment, byte-length, layout, and bounds validation.

Covered families:

• ErasedReducePlan
• ErasedGatherPlan
• ErasedDynamicSlicePlan
• ErasedDynamicUpdateSlicePlan
• ErasedScatterPlan

Execution model

• Reduction, gather, and dynamic slice share their current traversal, specialization, explicit ExecContext, SIMD/parallel thresholds, and reduction association policy with initialized replay. Only the terminal store changes to an uninitialized write.
• Dynamic update and scatter first validate the complete call, including destination/input overlap, before writing anything. They then initialize the full destination through CopyPlan::execute_uninit, create a private closure-scoped typed initialized reborrow, and run the existing update traversal.
• The initialized transition is not exposed publicly and cannot escape the closure. Failure before the transition leaves ownership with the caller; after the full copy, normal initialized semantics apply.
• Additive scatter remains deliberately serial. No threshold, association-order, or threading-policy change is part of this issue.

Constraints

• No zero fill, duplicate full copy, plan compilation, or new allocation.
• Preserve typed errors and validation-before-write ordering.
• Preserve explicit ExecContext; no ambient execution.
• Invalid/stale Bool bytes must not be read before they are overwritten.

Verification

Differential initialized-vs-uninitialized tests will cover every KernelDType, i32/i64 indices, compact and strided/offset/negative-stride layouts, rank-1 and generic paths, Serial and MaxThreads(1/2/4), reduction SIMD/tail/empty/wrapping/nonfinite/SumSquares, overlap/error ordering, and mutation after handoff. Representative Miri tests and modified-file coverage are included.

Benchmarks compare initialized and uninitialized replay below and above parallel thresholds at threads 1 and 4. Acceptance is no candidate-relative 95% upper-bound regression beyond +20%, with no output prefill hidden in the measurement.

Split condition

Split only if the implementation requires a new public descriptor/state API, changes reduction association, parallelizes scatter, or changes execution thresholds. None is expected from the current API inventory.

[shinaoka]

Design upgrade after unsafe-boundary review

This supersedes the earlier statement that update/scatter could form a typed initialized reborrow after the initial copy.

CopyPlan::execute_uninit initializes every reachable logical destination, but an arbitrary strided backing allocation may contain holes. Forming &mut [T], RawStridedMut<T>, or any initialized view over the whole backing storage would therefore be invalid even after the copy. The implementation must use a private raw logical-layout receipt instead.

Hard invariant

Direct uninitialized replay constructs only RawStridedMut<MaybeUninit<T>>. It never constructs &mut T, &mut [T], StridedViewMut<T>, or RawStridedMut<T> over destination storage. No public assume_init conversion or receipt is added.

Private writer model

Add private/crate-private monomorphized initialized and uninitialized writers. Traversals are generic over the writer; there is no runtime writer dispatch.

For copy-then-update families, add a private CopyPlan::execute_uninit_then-style helper:

1. run the uninitialized copy exactly once;
2. only after Ok, construct a sealed InitializedRawDest containing raw pointer, byte/element extent, dims, strides, offset, and an exclusive lifetime marker;
3. pass it through a higher-ranked closure so it cannot escape;
4. perform RMW only on reachable logical slots through that receipt, never through an initialized backing slice.

The receipt constructor remains private to the copy implementation. Unreachable holes stay uninitialized.

Family changes

• Gather and dynamic slice share current serial/parallel/specialized traversal generic over terminal writer. Uninitialized stores use MaybeUninit::write; contiguous copies use raw non-overlapping copy.
• Dynamic update factors only its post-copy rank-one/generic/parallel RMW traversal over the sealed logical receipt.
• Scatter factors only its post-copy deterministic serial RMW traversal over the receipt; association and expected-serial policy remain unchanged. Integer erased combine preserves wrapping addition.
• Erased reduction genericizes only terminal storage. Full and axis computation preserve the exact SIMD path, eight-lane association, identities, partition/merge order, SumSquares behavior, integer wrapping, and thresholds.

Validation order

1. destination/value/index dtype checks;
2. destination overlap checks against every raw input before shared references;
3. validate every input pointer, including Bool bytes;
4. plan layout/shape/injectivity/cardinality checks;
5. enter explicit ExecContext and create only uninitialized typed raw destination;
6. update/scatter perform one copy, receive sealed logical initialization proof, then update.

Invalid stale Bool destination bytes must never be inspected; only reachable slots are checked after success. Reduction/scatter continue rejecting Bool.

Additional stop conditions

Stop and redesign if the patch introduces destination prefill, a second operand copy, hole initialization, runtime writer dispatch, duplicated traversal, changed reduction/scatter association, changed threshold, an initialized backing slice, or a public receipt.

[shinaoka]

Unsafe review / Miri checkpoint

Sol high review and a newly installed strict-provenance Miri run found two prerequisites before this PR can be published:

1. Safe descriptor bounds validation truncates usize dimensions through as isize; a usize::MAX negative-stride layout can pass against a tiny allocation. This is now isolated as Harden erased descriptor bounds and allocation alignment validation #189 and will land first.
2. The initial Add uninitialized full-overwrite replay for reduction and indexed plans #187 Miri run exposed test storage created as Vec<MaybeUninit<u8>> for f64/complex destinations. Native allocation happened to mask the alignment problem; Miri correctly rejected the later typed reference. Harden erased descriptor bounds and allocation alignment validation #189 also hardens provenance-aware erased alignment validation. Add uninitialized full-overwrite replay for reduction and indexed plans #187 tests/benchmarks will use byte views derived from genuinely aligned MaybeUninit<T> storage.

The kernel PR remains blocked until #189 merges and is rebased. After rebase it will also:

• make the pointer-backed Bool contract explicit (arbitrary bytes are allowed only until consumer validation; every consumer must validate before typed conversion),
• add genuine-uninitialized Miri lifecycle cases and unwind/drop coverage,
• exercise above-threshold bounded-parallel raw stores,
• strengthen source guards and reachable-value/hole assertions,
• rerun Miri, modified-file coverage, and the five-family paired performance gate.

No threshold or acceptance criterion is being weakened. The first Miri failure is treated as a real validation/test-contract defect, not skipped.

[shinaoka]

Prerequisites are now merged: #189 at 2ec4584 and typed-storage safety boundary #190 via PR #192 at dcdbc3a2. The existing #187 implementation checkpoint is being rebased onto dcdbc3a2; legacy byte-slice erased constructors will not be reintroduced.

[shinaoka]

Coverage follow-up complete via PR #194 (fb6794e3847ec1b1140a7c1f0c0321b28ec54eaa). The allocation-parity test now warms typed and erased zip/map paths symmetrically before both counted windows. No production code, allocation assertion, measured loop, or threshold changed. All PR checks passed, including Ubuntu, macOS, and coverage. #187 is now complete with clean CI evidence.