feat(arithmetic)!: executeOp scratch sized per converted operand + OUT_WRITE aliasing (#296 Stage 1)

[LeoBuron]

Stage 1 of the bounded-scratch design for #296 (spec: docs/superpowers/specs/2026-07-09-bounded-scratch-design.md; Stage 2 — O(chunk) conversions — follows as its own PR). Executed via SDD: per-task reviews + final whole-branch review (verdict: merge-ready).

What changes

1. executeOp prologue scratch is sized per actually-converted operand — one summed VLA, each row sized to its own operand, zero bytes when every operand already matches the arithmetic dtype (the entire FLOAT32 training path). Previously: scratch[3][maxElems·4] unconditionally — 73,728 B at HAR's conv3 even when nothing converted.
2. rawData output-aliasing: FLOAT32-arithmetic → FLOAT32-target OUT_WRITE ops let the kernel write the target directly (the epilogue there was a same-type memmove). Gated hard: never for OUT_ACC_* (accumulate must keep the intermediate distinct), never for non-FLOAT32 targets (the SYM→SYM epilogue is a load-bearing width-restoring requant), and never when the target's data pointer equals a post-prologue operand pointer — unless the new opSpec_t.writesInPlaceSafe (zero-init false) declares the kernel elementwise. The three SGD update kernels opt in (verified strictly elementwise).
3. Stack-watermark budgets recalibrated to the measured post-change peaks (+8 KiB slack policy unchanged, never-raise rule intact, Linux stays uncalibrated); the two Python fixture tests updated to the new measured values.

Measured effect (HAR, EPOCHS=1, macOS arm64)

config	before	after	Δ	new peak site
float	99,560 B	27,328 B	−72.6 %	conv3 weight-grad OUT_ACC (rawData 24,576 + ~2.7 K frames) — staging there is load-bearing, aliasing an accumulate is semantically impossible
sym8	149,008 B	100,080 B	−48,928 B	SGD param op on conv3: 1 converted row (24,576) + rawData (24,576) + the 49,152 B repack chain that Stage 2 removes (+~1.8 K frames; the removed idle rows were 49,152 B, frames grew ~224 B from the new bookkeeping)

Projection after Stage 2: sym ≈ 51 KB → total training RAM sym8 ≈ 205 KB vs float ≈ 212 KB — the #322 inversion flips in sym's favor at HAR scale.

Safety argument for the aliasing (reviewers' conjunct→killer map)

• Drop OUT_WRITE conjunct → testAccDynamicIntoFloatIsExactAndAccumulates goes RED (aliased ACC doubles the increment).
• Drop ARITH_FLOAT32 conjunct → testOutWriteSymToFloatEqualsConvertTensor goes RED (raw mantissas reach the float target).
• Drop the FLOAT32-target conjunct → testExecuteOpNeverAliasesSymTarget goes RED (SYM width-restore skipped).
• Invert the self-alias scan → testExecuteOpDoesNotAliasWhenTargetIsAnInput goes RED (mutation-verified during Task 1).

Known contract edge (documented, deferred to Stage 2's doc pass): the self-alias check is exact-base-pointer equality — overlapping sub-views (constructible only via raw-pointer tensorInitFloat wiring) are outside the contract.

Verification

• ctest --preset unit_test_debug 72/72; focused UnitTestExecuteOp 26/26 (4 new aliasing tests + 1 new 3-input mixed-dtype prologue pin); uv run pytest 29/29; cmake --build --preset examples all targets.
• Strict TDD per task with recorded mutation checks (offset-drop mutant and alias-scan-inversion mutant each flipped exactly their intended test).
• Watermark check script passes against the new budgets for both fresh measurement logs.

Refs #296 (Stage 2 PR will close it), #322 (stack narrative), #300 axis-1 addendum.

🤖 Generated with Claude Code