Function decode_into 

pub unsafe fn decode_into<V: DictionaryView>(
    codes: &[Token],
    dict: V,
    out: &mut [MaybeUninit<u8>],
) -> usize

Decode codes against an already-validated dict into out, returning the bytes written. It over-reads a fixed 16 bytes per token, trusting the dictionary’s offsets/lengths (validated up front). Each code is bounds-checked in the loop (a near-free, predicted-not-taken branch); an out-of-range code panics with InvalidColumn::CodeOutOfRange.

dict’s validity is a type invariant — only a trusted DictionaryView (sealed; obtained through validate/to_wide) can be passed — so it is not a precondition here.

Safety

out.len() >= decoded_len(codes, dict) + DECODE_PADDING.