Repository navigation
Umbrella: Close the post-strided safety, output-reuse, scheduling, and gated-performance queue #1535
Description
Goal
Complete the recent tenferro-rs/strided-rs safety, correctness, public-output-reuse, runtime-scheduling, and evidence-gated performance queue without weakening numerical, oracle, aliasing, threading, or benchmark policies.
Current Status
| Item | Disposition |
|---|---|
| #1502 caller-owned eager solve destination | Complete in #1551, squash 10c4e9af77fd6634712c5e13e45e943c7784c395 |
| #1542 prepared-cache poison visibility | Complete in #1552, squash b71d06a96887eb8b67a2a8d6209a816ad373a0f0 |
| #1546 Faer execution-policy audit | Complete in #1553, squash 6255590e76d21f3ec7ba2a7feaa7e160baecabc1; stale strided-einsum2 build graph removed |
| strided-rs #188 overwrite-only uninitialized GEMM | Complete for naive/system-BLAS/injected-BLAS and opteinsum in #196; feature-bound follow-up #197 also merged. Faer remains explicitly typed-unsupported pending follow-up #198 |
| strided-rs #195 Faer MaybeUninit overwrite destination | Superseded and closed; its external API prerequisite and adoption contract were refiled as strided-rs #198 |
| #1479 strided dot accumulation fallback | Evidence-deferred and closed; no >=5% representative end-to-end wall-time share was demonstrated |
| #1480 host identity-copy removal | Evidence-deferred and closed; no >=5% representative end-to-end wall-time share was demonstrated |
| strided-rs #149 | Closed; non-C-ABI Rust migration is complete. C ABI/publication is deferred to a fresh issue |
Evidence
- Benchmark campaign: post-U8 follow-up cumulative performance baseline #1490 final public-API campaign is PASS after the merged strided dynamic-slice adoption.
- The fixed baseline/candidate blocker rows improved substantially; the remaining watchlist rows stayed within the declared candidate-relative +20% upper-bound gate.
- Final oracle replay passed 9,585 records with 0 failures.
- Required CPU Faer/BLAS, coverage, clippy, docs, repository-rules, and trusted GPU gates passed for the closing PRs.
- docs/design sync: consolidate drift in einsum AD, TensorPrims API, tensor.md, and architecture.md #196/docs(design): sync docs with implementation state #197 strided CI passed rustfmt, Ubuntu/macOS workspace tests, coverage, and docs; Faer-only uninitialized calls remain a typed
EinsumError::Unsupportedby design.
Governing Decisions
- Static-audit performance candidates require a predeclared representative end-to-end profile showing at least 5% wall-time share before implementation. [Performance]: Optimize strided dot_general accumulation fallbacks #1479/[Performance]: Avoid redundant host identity copies in contiguous reads and CPU transfers #1480 did not meet that gate and were closed without speculative optimization.
ExecContext/CpuExecutionContextremains explicit; tenferro-cpu does not use ambient Rayon policy.- Destination aliasing, mutation-after-handoff coverage, uninitialized full-overwrite ownership, oracle tolerances, and benchmark thresholds were not weakened.
- Raw CopyPlan replay and additive scatter remain deliberately serial.
- No local Faer workaround may cast
MaybeUninit<T>toMatMut<T>, callassume_initbefore a proven full write, or add an output-sized zero-fill pass. The typed unsupported boundary is the current safe contract.
Explicitly Deferred
Faer must first expose a typed overwrite destination with explicit parallelism and a documented full-initialization contract before strided-rs can add the Faer backend. That work is tracked in strided-rs #198 and must be coordinated with the canonical Faer repository at https://codeberg.org/sarah-quinones/faer. GitHub faer-rs #269/#270 are only a prototype mirror and are not canonical upstream review. It must be reopened or superseded by a versioned adoption PR when the released upstream API exists.
C ABI, thread-pool/affinity controls, distribution, crates.io publication, and other long-term performance candidates require fresh focused issues with accepted designs and evidence. They are outside this completed Rust migration umbrella.
Active Child After Re-audit
| Item | State | Required next action |
|---|---|---|
strided-rs #198 Faer typed MaybeUninit overwrite API |
OPEN | Obtain a reviewed and released contract from canonical Faer (Codeberg), then add the strided-rs adoption PR and remove the typed Unsupported boundary |
The previous close-out classified #198 as outside this umbrella. That classification is corrected: #198 is a direct descendant of the Faer portion of #188/#195 and remains an independent external follow-up. The completed tenferro/strided queue is closed here; #198 remains open until canonical Faer provides the reviewed and released API required for safe adoption.
Activity
shinaoka commentedon Jul 30, 2026
Progress update:
4be1c8a82c0eaf78ee5a9f42ce4b7ac72416e86a.shinaoka commentedon Jul 30, 2026
Step 2 dependency adoption is in PR #1537: #1537
4be1c8a82c0eaf78ee5a9f42ce4b7ac72416e86afrom strided-rs [einsum][gpu] End-to-end GPU support for tenferro-einsum #183/test(chainrules): add HVP test with DAG merge point (#170) #181.docs/worklogs/2026-07-30-strided-destination-injectivity-adoption.md.shinaoka commentedon Jul 30, 2026
Design correction for Step 3: Sol audit confirmed #1516 cannot be completed safely with tenferro-only PRs while preserving current fused/multiply/broadcast/outer-product paths. Added prerequisite tensor4all/strided-rs#184 and updated the umbrella body/order. The queue is now upstream uninitialized replay -> #1516A canonical guard/internal migration -> #1516B remaining migration/API removal.
shinaoka commentedon Jul 30, 2026
Step 2 complete: tenferro-rs PR #1537 passed review bot, fmt, clippy, coverage, docs, extension/sample, heavy CPU Faer/BLAS, and RunPod CUDA gates; squash-merged as
210451b90257aa8107dc8175ad8f9f8daead2ee4. Removed its isolated ~1 GB target/worktree and the temporary #1516 planning worktree. Step 3 is now active in tensor4all/strided-rs#184.shinaoka commentedon Jul 30, 2026
Step 3 complete: upstream uninitialized full-overwrite replay
6885f52edb5fa2348fea47413bc43561e436ef63.ExecContext, full initialization onOk, drop-safe partial initialization after panic, and preservation of initialized fast paths.1.170936at t1 and1.018668at t4, both below the1.20gate..codegraph/is now ignored by strided-rs.Next: a dependency-only tenferro PR adopts the merged strided commit. #1516A starts only after that pin PR lands.
shinaoka commentedon Jul 30, 2026
Step #1516A started\n\nThe final guard/accounting contract is recorded on #1516: #1516 (comment). The canonical guard owns an exclusive pool borrow and a precise Fresh/Reused(actual-capacity) checkout token; incomplete Drop discards storage and decrements only its own reused marker, with no replacement replenishment. The existing tenferro-cpu indexing guard will be deduplicated in A only for its four already-safe users. Remaining tenferro-cpu/linalg migration and legacy API deletion stay in #1516B. Luna low implementation is now in progress on latest main.
shinaoka commentedon Jul 30, 2026
Progress: #1516A is in PR #1543. Final local evidence: internal kernels 53 tests + 26 doctests, CPU 506 tests, guard Miri 7 tests, fast gate pass, repository-rules review pass, and Sol low/high with no remaining findings. After merge/cleanup, the next item is #1516B.
shinaoka commentedon Jul 30, 2026
#1516B planning is complete. Sol high rejected blanket zeroed acquisition for full-overwrite callers. The fixed sequence after #1543 is: (1) strided uninitialized reduction/indexed replay, (2) strided overwrite-only GEMM across every backend, (3) tenferro adoption plus remaining caller migration and legacy unsafe API deletion. This preserves the umbrella rule against adding output-sized zero-fill passes.
shinaoka commentedon Jul 30, 2026
Upstream prerequisites are filed as tensor4all/strided-rs#187 (reduction/indexed uninitialized replay) and tensor4all/strided-rs#188 (overwrite-only GEMM across all backends). #1516B adoption starts only after both land.
shinaoka commentedon Jul 30, 2026
Completed: #1516A merged in #1543 (
4ed8f2ae), including 97.9% guard-module coverage, 59 internal tests + 26 doctests, CPU 506, Miri 11, heavy BLAS/Faer CI, and A100 RunPod GPU. Cleanup removed the 19 GiB isolated target/worktree. Next: strided-rs#187, then #188, then #1516B adoption/removal.shinaoka commentedon Jul 30, 2026
Completed prerequisite safety hardening: strided-rs #190 merged via PR #192 at
dcdbc3a2after workspace tests, all-target check, rustdoc warnings-as-errors, strict-provenance Miri, 53/53 coverage, Sol low/high review, and all five CI jobs. The #190 isolated worktree/target was removed. #187 is now being rebased and migrated onto the typed-storage boundary before publication.shinaoka commentedon Jul 30, 2026
#187 is now in strided-rs PR #193. Final local evidence: workspace tests; focused default/parallel 68 indexed + 11 reduction + 5 source-contract tests; strict-provenance Miri lifecycle/hole/wrapping cases; 53/53 coverage; t1/t4 affinity benchmark with every upper-95 ratio <= 1.20; Sol low/high no findings. Babysitting CI and squash merge next.
shinaoka commentedon Jul 30, 2026
#187 close-out and current queue
fe9f2cc4).fb6794e3) after Ubuntu/macOS/doc/fmt/coverage all passed.The next fixed item is strided-rs #188: overwrite-only uninitialized GEMM across naive, Faer, system BLAS, and injected BLAS, with cblas-inject 0.1.2 as the minimum dependency. tenferro-rs #1516B remains blocked on #188 and #187 adoption.
shinaoka commentedon Jul 30, 2026
#188 design audit
Faer 0.24.4 cannot currently receive
MaybeUninit<T>storage soundly:MatMut::from_raw_parts_mutrequires initialization before reference formation, andAccum::Replaceonly guarantees no old-C read. We rejected casts, earlyassume_init, and zero-fill fallbacks.strided-rs #195 records the required Faer upstream overwrite API. #188 continues with genuine uninitialized naive/system-BLAS/injected-BLAS paths; the Faer portion remains explicitly tracked and will not be silently downgraded.
shinaoka commentedon Jul 31, 2026
#1516 close-out
9da9b9f63e688eaf1bf4a78b718a01ac858b1f9.cb388a8adf953a7870aac7b3d821d5ab450d3a6a.pool_acquire -> Vec<T>surface and obsolete local allocation paths were removed.4 remaining items
shinaoka commentedon Jul 31, 2026
Queue update: #1542 complete
b71d06a96887eb8b67a2a8d6209a816ad373a0f0.PreparedPlanCache::recover_statenow documents the Drop-only poison-recovery invariant explicitly, preserves cleanup/accounting/notification, and leaves the poison bit visible to typed Result APIs. Producer, entry-waiter, and queue-ticket cleanup are covered by focused poisoned-mutex tests.203/203), docs, deterministic rules review, external LLM rules review, CPU Faer/BLAS, and trusted RunPod CUDA/PJRT gates passed.The next active queue item is #1546: explicit CpuContext/Faer execution-policy propagation and ambient Rayon isolation for ordinary
dot_general. #1479/#1480 remain evidence-gated and unchanged.shinaoka commentedon Jul 31, 2026
#1546 is complete via #1553 (
6255590e76d21f3ec7ba2a7feaa7e160baecabc1). The audit found that its reportedstrided-einsum2 -> Par::rayon(0)path was stale on currentmain; the active Faer provider already receives explicit policy fromCpuExecutionContext. We removed the stalestrided-einsum2build graph, feature wiring, CI contract assumption, active docs, and active rule text. No strided-rs PR was required.The next umbrella queue remains the evidence-gated #1479/#1480 reconciliation; no static-audit optimization is being started without the required end-to-end profile evidence.
shinaoka commentedon Jul 31, 2026
Umbrella close-out
The fixed queue is complete. #1502, #1542, and #1546 have merged SHAs and passed required checks. #1479 and #1480 were reconciled against the final #1490 campaign and closed as evidence-deferred because their predeclared >=5% end-to-end need gate was not met. strided-rs #149 is closed separately after the non-C-ABI Rust migration; C ABI/publication remains a fresh future effort.
No speculative kernel or ownership optimization was merged, and no benchmark/oracle threshold was weakened.
shinaoka commentedon Jul 31, 2026
Umbrella reconciliation
#1542 is already explicitly included and complete via #1552 (
b71d06a96887eb8b67a2a8d6209a816ad373a0f0).The strided overwrite queue is now recorded accurately: #188 is complete for the safe naive/system-BLAS/injected-BLAS and opteinsum paths via #196/#197, while Faer-only uninitialized output remains a typed
EinsumError::Unsupportedtracked in strided-rs #195. No unsafe cast, earlyassume_init, or zero-fill workaround is accepted.The umbrella remains open until the current queue close-out decision is made; #195 is explicitly external/deferred rather than silently counted as complete.
shinaoka commentedon Jul 31, 2026
Final reconciliation
#1542 is included and complete via #1552 (
b71d06a96887eb8b67a2a8d6209a816ad373a0f0).The current tenferro/strided safety queue is complete: #1502, #1542, #1546, #188/#197, #1516B, and the evidence-gated #1479/#1480 disposition all have recorded outcomes. The Faer-specific external prerequisite was not hidden or treated as complete: strided-rs #195 is superseded by the new follow-up #198, which remains outside this umbrella.
No unsafe Faer workaround, output-sized zero-fill, weakened oracle/tolerance, or weakened benchmark gate was introduced. Closing this umbrella; #198 is the explicit future adoption path.
shinaoka commentedon Jul 31, 2026
Re-audit correction
Current issue-state audit found all previously listed queue issues closed, but strided-rs #198 is an open direct descendant of the Faer portion of #188/#195. The earlier classification of #198 as outside the umbrella was too strong for the stated objective.
Reopening this umbrella and recording #198 as the active child. The next work is upstream Faer API coordination or a sound implementation path; no unsafe cast, early
assume_init, zero-fill workaround, or local fork will be used merely to close the issue.shinaoka commentedon Jul 31, 2026
#198 upstream progress
The required Faer API request is now filed as sarah-quinones/faer-rs#269. The umbrella remains open while that upstream issue and the subsequent strided-rs adoption are pending.
shinaoka commentedon Jul 31, 2026
The Faer prerequisite is now an actual upstream implementation proposal: sarah-quinones/faer-rs#270, linked from Faer #269. It adds a typed
MatUninitMutoverwrite destination, explicitPar, no pre-write destination references, and a fully initializedMatMutreturn on success. The umbrella remains open: strided-rs #198 still requires the released Faer API plus downstream adoption and evidence.shinaoka commentedon Jul 31, 2026
Canonical upstream correction
The Faer repository's Cargo metadata and current upstream activity identify
https://codeberg.org/sarah-quinones/faeras the canonical repository. The GitHub repository is a mirror: its main commit matches the Codeberg release head, but GitHub issue/PR numbers are not synchronized. In particular, Codeberg #269/#270 are unrelated closed changes.Therefore GitHub #269/#270 should be treated only as a public implementation prototype and review artifact, not as an upstream issue/PR. The current prototype head remains
276d1966b89d86bb99ca59f507ac5a0d3f8f0d7f; it has local workspace, all-target, rustdoc, focused test, and formatting evidence, but it has no canonical upstream review or release.This workspace has no Codeberg API token or accepted Codeberg SSH key, so I cannot create the canonical issue/PR from here. No strided-rs adoption or dependency pin will be made against this unreleased prototype. The downstream prerequisite remains open until the canonical Codeberg API request is reviewed, released, and adopted with the tests and t1/t4 evidence required by this issue.
shinaoka commentedon Jul 31, 2026
Umbrella close-out
The completed tenferro-rs/strided-rs queue is closed here. #1542 remains resolved in #1552, and all other completed, evidence-deferred, and explicitly gated items are recorded above.
The only remaining related work is strided-rs #198, which is now an independent external follow-up. It cannot be adopted safely until the canonical Faer repository at https://codeberg.org/sarah-quinones/faer publishes a reviewed typed MaybeUninit overwrite contract. The GitHub mirror prototype is not treated as upstream review.
No unsafe cast, early assume_init, zero-fill workaround, weakened oracle/tolerance, or weakened benchmark gate was introduced.