Add overwrite-only uninitialized GEMM across all einsum2 backends

[shinaoka]

Scope and status

Implement overwrite-only uninitialized GEMM/einsum entry points without reading or preinitializing the destination. The safe strided-rs portion is complete in PR #196, with the feature-combination bound fix in PR #197.

Complete in #196/#197

• naive backend writes directly to MaybeUninit<T>;
• system BLAS and injected BLAS use the exact-zero-beta contract from cblas-inject 0.1.2;
• checked destination injectivity, checked traversal/overflow, conservative input/output overlap rejection, non-contiguous temporary/writeback, zero-k handling, and typed errors are covered;
• strided-opteinsum full-overwrite intermediates remain uninitialized until successful completion;
• explicit ExecContext and provider-owned threading are preserved;
• the faer + parallel feature combination is fixed by Fix uninitialized GEMM parallel bounds #197.

Faer boundary

Faer 0.24.4 does not expose a typed API that permits a MatMut<T> overwrite over MaybeUninit<T>. The Faer-only uninitialized entry points therefore return EinsumError::Unsupported and retain the initialized compatibility path. This issue does not use an unsafe cast, early assume_init, or output-sized zero-fill workaround.

The Faer-specific API request is tracked independently in strided-rs #198, which supersedes #195. It is outside this completed safe-backend scope and is not a reason to weaken the contract here.

Verification

• PR Add safe uninitialized GEMM overwrite paths #196 CI: rustfmt, Ubuntu/macOS workspace tests, coverage, and docs passed.
• PR Fix uninitialized GEMM parallel bounds #197 CI: rustfmt, Ubuntu/macOS workspace tests, coverage, and docs passed.
• The merged worklog records the feature matrix, poisoned-C regression, checked preflight, and typed Faer-only error coverage.

Accumulating GEMM remains on initialized destinations. Reduction and indexed replay are tracked separately.

[shinaoka]

Sol high design review

The overwrite-only API is viable, but implementation is blocked on the injected-provider contract in shinaoka/cblas-inject#9. The registered GEMM callback must explicitly guarantee BLAS beta-zero semantics: C is not read when beta is zero. We will merge/release that contract first and never pin an unmerged branch.

Stop-the-line findings

• The current injected fallback evaluates beta * C unconditionally and therefore reads C even for beta zero. It also needs complete s/d/c/z fallback registration coverage.
• Current einsum validation is insufficient for a safe uninitialized boundary: destination injectivity, input/output overlap, checked shape products, and checked BLAS integer conversion must happen before planning, materialization, pooling, or backend dispatch.
• strided-opteinsum/src/expr.rs already creates typed-uninitialized StridedArray<T> and relies on runtime beta zero. It must migrate in the same strided-rs PR.
• Faer's Accum::Replace contract already permits the required non-read behavior; no Faer API extension is needed.

Public API

Add only overwrite-specific entrypoints accepting StridedViewMut<MaybeUninit<T>> / RawStridedMut<MaybeUninit<T>> and explicit &ExecContext:

• einsum2_into_uninit
• einsum2_into_owned_uninit
• dot_general_into_uninit
• bgemm_raw_strided_into_uninit

There is no beta, unchecked public variant, or explicit-backend public variant. Backend implementation is private and sealed so external safe code cannot falsely report successful initialization.

Execution contract

• Validate ranks/labels, shapes and checked products, reachable offsets, destination injectivity, and both overlaps before writes or allocation.
• Empty output succeeds after validation with no writes.
• Zero contracting dimension bypasses every provider and writes zero through an uninitialized full-overwrite kernel under the explicit context.
• Ok(()) means every reachable logical destination is initialized; layout holes remain untouched.
• Error before dispatch writes nothing. Provider error/unwind may leave partial MaybeUninit, which remains safely droppable.
• No initialized slice/view over C is formed before backend success.
• Non-contiguous output uses a genuine StridedArray<MaybeUninit<T>> temporary followed by CopyPlan::execute_uninit; no output prefill.
• The all-batch multiplication fast path remains uninitialized and allocation-free where currently applicable.

Backend contract

• Naive: dedicated writer to MaybeUninit<T>, no runtime-beta route.
• Faer: structurally fixed Accum::Replace, with explicit context-to-Par mapping.
• System BLAS: literal zero beta after checked BLAS integer conversions.
• Injected BLAS: same only after cblas-inject#9 lands; correct all four internal fallbacks and register s/d/c/z.
• BLAS provider threads remain provider-controlled; ExecContext::serial() does not silently reconfigure OpenBLAS/MKL/Accelerate.

PR boundary

1. cblas-inject contract/test/release PR.
2. One coherent strided-rs Add overwrite-only uninitialized GEMM across all einsum2 backends #188 PR covering every backend plus strided-opteinsum; splitting by backend would expose an unsound active-feature combination.
3. Separate strided-rs-benchmark-suite PR for paired t1/t4 contiguous, batched-small, non-contiguous-writeback, and zero-k rows.

The strided implementation will include differential coverage for rank-0, empty, zero-k, batched, transposed/conjugated, negative/non-contiguous output, trace materialization, overlap/noninjective/overflow failures, naive Miri lifecycle, all feature matrices, and source-contract checks. The paired candidate-relative upper-95 ratio remains gated at 1.20.

[shinaoka]

cblas-inject prerequisite is now complete and published: PR #10 merged, tag/crates.io cblas-inject 0.1.2, contract states exact-zero beta never reads C and initializes every logical C element including k == 0. strided-rs currently declares cblas-inject = "0.1" and a local resolution can still select 0.1.1, so the #188 PR must raise the manifest minimum to 0.1.2 before relying on the contract. No git branch pin is needed.

[shinaoka]

Faer blocker identified

Sol high audited the current Faer 0.24.4 contract: MatMut::from_raw_parts_mut requires accessible values to be initialized before reads or reference formation. Accum::Replace only removes the operation's prior-C read; it is not sufficient to make MaybeUninit<T> sound.

Therefore #188 will not cast MaybeUninit<T> to T, call assume_init early, or add an output-sized zero-fill fallback. The blocker is recorded in new issue #195: #195

The #188 implementation continues for naive, system BLAS, and injected BLAS with the genuine uninitialized destination contract. The Faer path remains explicitly pending a typed upstream overwrite API or an accepted contract change; it will not be silently routed through an unsafe path.

[shinaoka]

Clarification on the Faer reference: sarah-quinones/faer-rs#195 is an unrelated merged upstream PR titled "use new gemm impl on x86_64 targets". The overwrite blocker is the Faer 0.24.4 MatMut::from_raw_parts_mut safety contract itself; tensor4all/strided-rs#195 is the coordination issue requesting a typed MaybeUninit-safe overwrite API. #188 therefore does not cast MaybeUninit<T> to MatMut<T> or zero-fill an output-sized temporary.

[shinaoka]

Audit fixes and Faer boundary

Sol high found and we reproduced two blockers in the initial implementation:

• injected zgemm read poisoned C even with beta zero; the exact-zero branch and a NaN-poison regression now cover the complex fallback;
• raw uninitialized GEMM accepted wrapping group counts and then panicked while slicing; one checked group-partition helper now guards rank/label construction before allocation or dispatch.

The Faer boundary is explicit now. With Faer-only features, the public uninitialized entry points return a typed Unsupported error referring to #195; they do not cast MaybeUninit<T>, form MatMut<T>, or silently use the naive backend. The default Faer-only strided-opteinsum frontend temporarily uses its initialized compatibility path, reusing already-initialized pool buffers where possible. This remains a follow-up until Faer exposes a typed overwrite API.

#188 is not ready to merge until the Faer acceptance is either satisfied upstream or explicitly split into #195, and the full feature/benchmark evidence is attached.

[shinaoka]

Proposed acceptance split after final audit

The implementation now has genuine MaybeUninit<T> overwrite paths for the naive, system-BLAS, and injected-BLAS backends, with shared preflight, checked output traversal, typed overlap/layout errors, and poisoned-C coverage. The Faer-only feature matrix is also verified, but its public uninitialized entry points return typed Unsupported because Faer 0.24.4 does not permit forming MatMut<T> over MaybeUninit<T> storage; Accum::Replace removes the operation's C read but does not change Rust reference validity.

I propose splitting the acceptance without weakening the safety contract:

• Add overwrite-only uninitialized GEMM across all einsum2 backends #188 closes the implemented naive/system-BLAS/injected-BLAS and strided-opteinsum ownership work, and records the Faer-only typed error as the supported interim behavior.
• [Feature] MaybeUninit-safe overwrite matmul destination for Faer #195 remains the prerequisite for a separate Faer overwrite implementation. Once Faer exposes a typed overwrite destination, add the Faer backend in its own reviewable change and then remove the interim typed error.
• No MaybeUninit<T> to MatMut<T> cast, early assume_init, or output-sized zero-fill fallback will be added to make the original wording appear green.

Verification on the current branch includes the workspace test suite, all einsum2 feature matrices (default/Faer/system BLAS/injected BLAS), opteinsum feature matrices, rustfmt, and checked-overflow/poisoned-C regression tests. The full benchmark evidence is being kept with the PR; the Faer path has no uninitialized performance claim until #195 lands.

[shinaoka]

Implementation is now in PR #196. Scope intentionally covers naive, system BLAS, injected BLAS, and safe opteinsum overwrite paths. Faer-only returns a typed until the typed upstream API tracked in #195 exists; no unsafe cast, early , or zero-fill workaround is used.

[shinaoka]

Correction to the previous comment: implementation is in PR #196. Scope covers naive, system BLAS, injected BLAS, and safe opteinsum overwrite paths. Faer-only returns a typed EinsumError::Unsupported until the typed upstream API tracked in #195 exists; no unsafe cast, early assume_init, or zero-fill workaround is used.

[shinaoka]

Close-out

The safe portion of #188 is complete in merged PR #196 (50cbaf5bfb4924be861cedf71625b7dee9); the faer + parallel compile-bound follow-up is complete in #197 (9da9b9f63e688eaf1bf4a78b718a01ac858b1f9).

The implementation covers naive, system-BLAS, injected-BLAS, and strided-opteinsum overwrite paths with typed MaybeUninit<T> ownership and no destination prefill. Faer-only callers receive a typed EinsumError::Unsupported until a sound upstream API exists; that work is isolated in #195. No unsafe cast, early assume_init, or zero-fill fallback was added.