fix(selector): RQ-65-ALIASCLASS (#1189) — enumerate every uncopied home-register consumer on four legs; fix aarch64 rotl (#1221) and i64-param local.set (#1222) red-first; pin #1223/#1226 open

[avrabe]

RQ-65-ALIASCLASS (#1189) — the home-register alias class, enumerated on all four legs; two new miscompiles fixed red-first (#1221, #1222), two adjacent defects filed and pinned open (#1223 IR fold, #1226 multi-module .wast widths)

local.get of a register-homed local pushes THE HOME REGISTER uncopied. #677, #989 and #1189 were three consumers that wrote it, each a silent wrong answer found one at a time and fixed at its own site. This artifact asks the question none of the fixes asked — how many others are there? — and answers it mechanically, over emitted instructions and by execution, rather than by re-reading selector arms.

The enumeration, per leg and per consumer, with each site's disposition (GUARD / PIN / FIXED) and the stated bound of the search: docs/analysis/HOME_REGISTER_ALIAS_CLASS_1189.md.

What was built

1. Static audit, ARM direct selector — crates/synth-synthesis/src/home_alias.rs: an exhaustive, wildcard-free register-writes table for all 222 ArmOp variants (gp_defs / vfp_defs, pinned by a doc-vs-source sweep: 30 mechanically-verified disagreements, 4 of them possible defects (not doc staleness) #946-style source scan) plus a loop-back-edge-extended liveness walk, independent of the selector's own param_last_read. Hooked at the tail of select_with_stack under SYNTH_HOME_ALIAS_AUDIT; a write to a live local's home that is not the local's own set/tee, and not proven straight-line into an inline epilogue ON THE STREAM, is a loud decline naming op, instruction, register and local. Byte-invisible otherwise (objects identical with and without the variable).
   • scripts/repro/home_alias_audit_corpus_1189.py sweeps it over the pinned spec testsuite + tests/wast + tests/wat + fixtures + scripts/repro on {relocatable, self-contained} x {cortex-m4, cortex-m4f}: 4,628 functions, 2,372 homes, 227,150 attributed instructions, 0 unexplained hits (floors on work done, pinned in-script and grepped exactly in CI job home-alias-audit-1189). It carries 16 hits pinned KNOWN-OPEN against .wast driver path threads NO declared param/result width tables — every i64/f32/f64 param or result in ANY .wast module (single-module too) is homed as i32 unless body inference recovers it (was: multi-module merge / representative table) #1226 (below), a defect the arm direct selector: local.set/local.tee of a register-homed i64 PARAM writes only the lo half (leaf functions), and the #989 snapshot can land on val's hi #1222 fix made visible.
   • Potency against the real history: the same audit built at the pre-fix(#1189): if/else join register aliased a local's home register on the ARM direct selector — measured, oracle red-first, one-site fix, corpus byte-identical #1190 commit flags exactly the 10 functions fix(#1189): if/else join register aliased a local's home register on the ARM direct selector — measured, oracle red-first, one-site fix, corpus byte-identical #1190 recorded as silently wrong (bif iboth iloop inest ir0 ir1 ir2 ir3 isets + i64p) naming Mov { rd: R0, op2: Reg(R1) } at End, and none of its 7 pinned-clean ones. Its first corpus run also produced 30 return-in-arm and 2 VFP-first-def false positives; both became checked exemptions with unit tests for the exempt AND the still-flagged shapes.
2. Execution oracle, four legs — scripts/repro/home_alias_class_1189_differential.py + three generated modules (scripts/gen_home_alias_class_1189.py): 117 consumer-family functions (i32, i64, promoted-local) that feed register-homed params to one op and RE-READ every home into the result, on ARM relocatable, ARM self-contained (the optimized selector aliases too — vreg_to_arm[dest] = param_reg), RV32 and AArch64; every expected value from wasmtime; declines pinned EXACTLY per (module, leg). Permanent red half: main's own objects for the five affected (module, leg) pairs, 10 pinned wrong vectors that must reproduce every run. CI job home-alias-class-1189-oracle, 1,629 emulations; emulation floor re-derived 325121 -> 326750.
3. Structural pins for the clean legs, as tests: RV32 params COPY on local.get (the "accident of implementation" the artifact names — a future "alias params on the vstack" change must get past param_local_get_copies_and_no_consumer_writes_the_home_1189 and the oracle's rv32 leg) and a promoted s8 is written only by its own set and the epilogue; AArch64's temp pool is disjoint from x0..x7 and 21 families never write a param home; the optimized path's local vregs are never freed (18 families walked with the same gp_defs table).

What it found — red-first transcript on main (af81978)

live vectors: 990 matched, 9 diverged, RESULT: FAIL (9), every failure naming its value:

leg	shape	synth (main)	wasmtime	issue
aarch64	b_rotl(7,3) = rotl(a,b)+a+b	0x3c	0x42	#1221 — rotl negates the count IN PLACE (neg k, k, the #776 fix's "now-dead register" is a param home in a leaf function); 7 vectors, i32 and i64, all exactly rotl + a - b
arm-reloc / arm-self	war64 = get, set, get, add on an i64 param	0x5_0000000e	0x7_0000000e	#1222 — local.set/tee of a register-homed i64 param writes only the LO half, at index_to_reg(i) not the AAPCS pair, with the #989 snapshot reserving only val_lo
arm-self	same_twice = (x - x) + x	0x0	0x7	#1223 — the optimized path's IR fold drops the surviving use of x. Not this class; filed, pinned KNOWN_OPEN in the oracle (the recorded wrong value must persist until the fix flips the pin)

#1226 (open, pinned in the sweep) — surfaced BY the #1222 fix: in a multi-module .wast the #1168 merge hands a later module's function the representative module's param-width table (arg counts are re-threaded per module, width masks are not), so an i64 param is homed as i32 and its pair overlaps the next param — (i64 i64 i32): $to at R1:R2. Reproduced with a two-module file; the standalone module is correct. 4 spec-suite functions x 4 legs (memory_{copy,fill,init}64 checkRange, memory_grow64 check-memory-zero) are pinned exactly (function, op, register, local, per leg) until the fix flips the pin. A CLI-merge defect, not the alias class, not fixed here.

None of the 10 open PARITY defects (#1204–#1215) is this class; the closest, #1210, is a vstack temp across a call, not a home register.

The fixes, one site each

• aarch64: i32.rotl/i64.rotl negate the count IN PLACE — a param homed in that register reads back as -count (the #776 fix moved the clobber from n to k) #1221 (crates/synth-backend-aarch64/src/selector.rs, the rotl closure): a param count is negated into a scratch chosen with n, k and dst all held live; a TEMP count keeps the aarch64: i32.rotl/i64.rotl clobbers a computed rotate operand (neg scratch aliases n) — silent wrong result #776 in-place bytes (a popped temp is dead — each temp is pushed once by its producer; only params are pushed by reference). Tests: i32_rotl_is_neg_then_rorv (updated — it pinned the miscompile), i32_rotl_temp_count_keeps_in_place_neg_1221.
• arm direct selector: local.set/local.tee of a register-homed i64 PARAM writes only the lo half (leaf functions), and the #989 snapshot can land on val's hi #1222 (select_with_stack.rs, write_i64_param_home called from the LocalSet/LocalTee register-homed-param arms): both halves moved at the local_to_reg home (even-aligned pair, shifted by a preceding wide param), ordered so a partially overlapping pair never reads a clobbered half, both halves of val reserved for the alias snapshot. Test: i64_param_set_writes_both_halves_at_the_aapcs_home_1222 (four shapes incl. (i64 i64) targeting R2:R3 and the get→set→use snapshot).

After the fixes: live vectors: 999 matched, 0 diverged, silent-wrong vectors: 10 (of 10 pinned) from main's captured bytes, known-open vectors: 1 (of 1), RESULT: PASS.

Byte-identity pre-fix vs post-fix over 1,419 compiles / 10,725 functions (spec suite + local corpus, per function from the ELF symtab, arm-reloc + arm-self + aarch64): 58 functions changed, every one an aarch64 function containing rotl or an ARM function that local.set/tees an i64 param; 0 newly declined, 0 newly accepted, 0 rc changes, no skip-set moved. The ARM ones were silently wrong on main and include spec-suite functions the census counted as compiled: fac.wast fac-opt, loop.wast while, local_set/local_tee.wast type-param-i64, the 64-bit bulk-memory checkRanges, memory_grow64 check-memory-zero.

Ledger

• selector_lines_code 19740 -> 19917 by waiver (+177: the arm direct selector: local.set/local.tee of a register-homed i64 PARAM writes only the lo half (leaf functions), and the #989 snapshot can land on val's hi #1222 fix + the audit hook; the class had no handling to delete); tracked totals 30565 -> 30857 and 91 -> 93 (two _ => None inside the new test).
• Emulation floor 325121 -> 326750, ci.yml and claims.yaml in lockstep, re-derived by oracle_wiring_check.py. The generator lives in scripts/ (not scripts/repro/), so the manual surface stays at its cap of 7.
• Artifact RQ-65-ALIASCLASS: status: implemented, landed/verified-by filled with what was run; done-when resolvable (contains:.github/workflows/ci.yml:home_alias_class_1189_differential.py).
• CHANGELOG [Unreleased] entry.

Not verified, stated

The 805-module real-world census is not on the lane machine. Hidden encoder-expansion scratch (#1021/#1048 class) is outside the ArmOp-level audit (the expansion-canary gates own it). VFP homes are audited on the m4f sweep legs but not executed under unicorn here. The other three legs have no per-op attribution and are pinned structurally plus by execution, not by an audit of every emitted word.

Refs #1189, #1221, #1222, #1223, #1226, #776, #989, #677

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[avrabe]

Coordinator rebase onto dfbcb5bf — both cumulative counters RE-DERIVED, not carried

Three conflicts, none resolvable textually.

Emulation floor — this one mattered. The branch carried --exact-emulation-floor 326750,
correctly derived on its own base (pre-PARITY, 325121). main had since moved to 345122 via
RQ-65-PARITY's +20000 and RQ-65-FUNCN's +1. Taking either side wholesale would have been wrong, and
taking the branch's side would have silently dropped 18,372 emulations from the enforced floor —
a gate weakening that no test would have caught, since the equality would still have held against
the number it was given.

Re-derived from oracle_wiring_check.py on the merged tree: 346751. Both the ci.yml and
claims.yaml pins moved to it, and the provenance comment was rewritten — the lane's 325121 -> 326750 line was stale the instant the rebase landed.

A duplicate key I nearly shipped. My first resolution of the claims.yaml conflict kept both sides
of the provenance block, which left two text: keys in one claim. An assertion caught it. Worth
recording because the obvious verification does not work: yaml.safe_load silently keeps the LAST
value on a duplicate key, so it reports a clean single claim either way. Confirmed clean with a
duplicate-key-strict loader, plus claim_check.py itself.

Ratchet. selector_lines_code re-derives to the pinned 19917 on the merged tree. The waiver
is proportionate and reads honestly — +177 lines, two named causes, and "Nothing could be deleted in
exchange: the class had NO handling." That is the justification the ratchet asks for. Noted for the
release notes: this pin now carries 18 waivers and sits +2020 above its baseline on a metric whose
declared direction is FALL.

CHANGELOG. main gained the ## [Unreleased] header from #1220. Both bodies kept under the one
header, ALIASCLASS first. Never --ours/--theirs here — nothing in CI reads this file, so a
dropped entry would never redden.

Gates on the rebased tree: ci.yml parses, exact-floor PASS at 346751, status_evidence_check 0
failures, claim_check OK, no duplicate keys.

Refs #1189

[codecov]

Codecov Report

❌ Patch coverage is 92.32633% with 95 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/home_alias.rs	89.82%	87 Missing ⚠️
...esis/src/instruction_selector/select_with_stack.rs	93.26%	7 Missing ⚠️
crates/synth-synthesis/src/instruction_selector.rs	99.09%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[avrabe]

Finishing lane — the third red, classified: all 12 hits were the WALK, fixed in the walk; #1226's 16 went silent, not fixed (21574841)

Rebased onto 761c6922 (main incl. RQ-65-DECLINE #1228). Submodule present
(257 .wast). Reproduced the coordinator's red first: hits: 12 (unexplained: 12), 16 pinned #1226 hits missing, RESULT: FAIL (3).

Classification of the 12

shape	hits	verdict	evidence
A: Pop {R4..R8, PC} at Return (cabi_arena_{bind,realloc} func_0, m4/m4f self) and at function-level BrIf(0) (promo p_brif, 4 legs)	8	audit FALSE POSITIVE — walk fixed	the pop restores a promoted local's r4 and RETURNS in the same instruction (mov r0,r4; add sp; pop {r4-r8,pc} then the next op / the br_if's skip:); write_is_terminal scanned only PAST the writer, never asked whether the writer IS the terminator. The previous lane's "pinned safe" exemption was applied — to the mov before the pop, whose scan sees the pop ahead — while the pop's own write fell through. Pop has no conditional form in ArmOp; both encoders emit it unconditionally. The old unit test planted the home at R0, never at the register the pop restores; the new one plants R4
B: F32Load S0 ← [SP,#24/#28] at Call(11) (f32_ops_719 xhome/xcall2, m4f-reloc/-self)	4	LEGITIMATE-BUT-SAFE — proven on the stream, not pinned	vstr s0,[sp,#0x18] … bl … vldr s0,[sp,#0x18]: the caller-save restore of the home from the slot the same op saved it to. Root cause of the report: vfp_defs did not state the AAPCS VFP caller-saved clobber (s0–s15) on calls, so the bl was invisible, its restore looked like the write, and a MISSING restore would have been invisible too. Calls now carry s0–s15; write_is_bracketed_by_save_restore discharges the round trip only for identical register + static slot, save before any other write of the home in the op, nothing between touching the slot/base/control flow. 9 broken variants unit-tested as still-flagged. Re-swept with the clobber stated: 0 new hits — every VFP home live across a call on this corpus is saved and restored. Executed: the CI-wired f32_ops_719_differential.py runs exactly this shape on m4f under unicorn, 238/238 bit-exact (the doc's "VFP homes audited but not executed" was true of THIS artifact's oracle only)

Negative controls, each exemption off in turn on the four affected modules:
pop check off → 8 pop hits, 0 other; round trip off (clobber stated) →
the 4 VFP functions, now reported at the Bl, 0 other. Both on → 0. The
fixed walk sweeps the IDENTICAL population as the red run (1045 pairs / 8317 /
8776 / 261440 attributed) to 0 hits.

#1226 verdict: the gate removed the HIT, not the MISCOMPILE — stays open.
declared_wide_params reads self.params_i64, the same stale width table
#1226 describes, so on checkRange the pair-write no longer fires and
nothing writes R1. Bytes at the PR head (m4-reloc): cmp r0,r1; it eq; cmpeq r1,r2 ($to still at R1:R2, AAPCS says R2:R3); local.set $from is
back to adds r5,r0,r3; adc r6,r1,r4; mov r0,r5 (hi half dropped — the
#1222 single-half shape on this stale-width function); i64.const -1
return sets R0 only. Pins removed from the script (the rule: the PR that
moved the hit moves the pin), table left empty with the reason; the issue
carries the bytes and the note that no sweep line can see it any more.

Re-pinned to the real corpus (submodule present): in-script FLOORS
1045/8317/8776/261440, ci-checks: stdout … >= 8317, ci.yml greps
functions audited: 8317 / homes watched: 8776 / hits: 0 (known-open: 0 [none], unexplained: 0); CI-form run through oracle_run.py with the four
exact greps: ALL MATCH, RESULT: PASS. Exact emulation floor re-derived on
the rebased tree: 346751, unchanged (ci.yml + claims.yaml untouched).
Selector ratchets untouched (home_alias.rs is outside the ceiling;
claim_check --metric 63/63, --emit-status no drift). Artifact
verified-by, the docs table (its VFP call-clobber row was wrong — "no
home exists to alias" holds for core registers only), CHANGELOG and the
waiver prose now say what was measured.

Green on the tree: fmt, clippy -D warnings, synth-synthesis 766 + suites,
home_alias_class_1189_differential.py 999/0/1629 PASS,
status_evidence_check, duplicate-key-strict YAML. No new issue filed —
nothing in the 12 was a miscompile. Not merged (coordinator gates).

Refs #1189, #1222, #1226

[avrabe]

Coordinator verification — hits: 0 is a meaningful claim, proven by mutation

I flagged a concern on this branch: the job asserts hits: 0 on a walk that had just been relaxed to
clear 12 false positives, and the job block itself (71 lines) contains no potency / self-test /
red-first mechanism. The functions audited >= 8317 stdout floor proves the sweep RAN; it does not
prove the DETECTOR FIRES. Those are different properties.

The concern is answered, and the answer is in the unit tests rather than the job. The exemptions
are paired positive/negative by construction — terminal_return_write_is_exempt_conditional_is_not,
call_save_restore_round_trip_of_a_vfp_home_is_exempt_every_break_is_not,
own_set_is_exempt_other_locals_set_is_not — with 26 assertions that a hit is produced. Those run
in cargo test on every CI run, so the potency is wired, not measured once at authoring.

Verified by mutation rather than by reading the names. Making each exemption unconditional:

mutation	result
write_is_terminal always exempt	FAILED — 8 of 14
write_is_bracketed_by_save_restore always exempt	FAILED — 8 of 14
restored	ok, 14/14; file byte-identical

A walk that stops discriminating reddens. That is what makes hits: 0 a claim rather than a silence.

On the two findings behind the 12, both worth recording because neither is "the audit was noisy":

• Shape A: the previous lane's terminal-return pin WAS applied — to the mov before the pop — but
  write_is_terminal scanned only from k+1, so when the writer is the pop it fell through. The
  old unit test planted the home at R0, never at the register the pop restores, which is exactly why
  it never caught this. The new test plants R4.
• Shape B is the more interesting one: vfp_defs stated no VFP clobber on calls, so a bl that
  really does clobber s0–s15 was invisible to the walk. The restore looked like the write — and a
  missing restore would have been invisible too. That is a blind spot in the detector, not noise,
  and closing it is worth more than the four hits it explained.

#1226 verdict, which is the honest one: declared_wide_params removed the HIT, not the
MISCOMPILE. It reads self.params_i64, the same stale width table #1226 describes, so on checkRange
the pair-write no longer fires and nothing lands on R1 — the wrong bytes are still emitted, just
differently wrong. #1226 stays open, the 16 pins are removed with that reason recorded, and no sweep
line can see it any more. That is a coverage loss stated as one rather than left as a parenthetical.

Refs #1189, #1226

[avrabe]

Coordinator review addressed (6f25b977): potency wired and pinned exactly; #1226 stated plainly — and its mechanism corrected while pinning it

1. Potency, wired. SYNTH_HOME_ALIAS_AUDIT=verbose,plant makes
home_alias::plant_probe plant ONE synthetic write of a watched home at op 0
of every function that has a home still read later (mov <home>, r12 /
F32Const into the S-slot, on a COPY of the stream — shipped bytes untouched;
unit-tested for the exempt and the no-plant cases). The corpus script's
self-test phase runs BEFORE the sweep and requires, per (fixture, leg),
EXACTLY the pinned number of declines carrying the needle at op 0, through
the same decline / needle / parse path the sweep relies on — and 0 declines
without the plant:

fixture (home kind)	m4-reloc	m4-self	m4f-reloc	m4f-self
home_alias_class_1189_i32.wat (i32 params r0–r3)	58	7	58	7
home_alias_class_1189_promo.wat (promoted r4–r8)	11	9	11	9
f32_ops_719.wat (VFP homes; soft-float m4 has none)	0	0	11	11

192 planted writes reported, 0 without the plant. ci.yml greps
^POTENCY: PASS (192 planted writes reported, 0 without the plant, over 3 fixtures x 4 legs)$ exactly; fewer → the detector went quiet, more → the walk
over-reports again. (My first draft said 172 — hand-added; the pin is the
script's derived number.) The selector's audit hook collapsed to one call into
home_alias::selector_hook (63 → 12 lines): selector_lines_code 19945 →
19896, a FALL, waiver bound to the value as the engine requires;
selector_lines_total 30943 → 30894.

2. #1226 in one sentence: it was never a home-register write this audit
could see — it is a mis-homing the audit cannot see by construction (it trusts
the selector's home table), the 16 hits were a symptom the declared-width gate
removed by changing the emission, no coverage of home writes was lost, and it
is now pinned red-first on the audit's homes= count (same module text as
.wast vs .wat, 6 < 8 relocatable / 4 < 8 self-contained, WIDTH-1226: known-open grepped in ci.yml) until a fix makes them equal and flips the pin.

The correction that fell out of pinning it. The issue's mechanism is
wrong. Merged vs standalone .wast are EQUALLY wrong; the discriminator is
the extension: second3 ((param i64 i64 i32) (local.get 1)) as .wat →
mov r0, r2; mov r1, r3, homes=4; as ANY .wast, single-module included →
mov r0, r1, homes=2. Cause, in synth-cli/src/main.rs: the .wast decode
arm returns Vec::new() for every declared-width table (params/returns
i64/f32/f64), each annotated "WAST fixture suite is i32-only"; the compile
loop's .get(index) && !p.is_empty() never fires, "assume i32". Body
inference rescues some (fac-opt sets its param → a pair), which is why it
looked module-position-dependent. Static upper bound: 1393 exported
spec-suite functions in 74 files. #1226 retitled + commented with the bytes.

Consequence for #1222, recorded in CHANGELOG / artifact / docs: the
pair-write is gated on the DECLARED width, so on .wast input it never fires
— the spec-suite functions the #1222 entry named as fixed (fac-opt, loop
while, type-param-i64, the 64-bit checkRanges) are NOT fixed; they are
wrong for #1226's reason until #1226 is. #1222 holds for .wat/.wasm input
(its own fixtures, executed).

Artifact verified-by now carries the real numbers (1045 / 8317 / 8776 /
0), the potency evidence and counts, the #1226 statement + pin, and the #1222
caveat. Emulation floor re-derived: 346751, unchanged (the self-test is
stdout-declared). Green: fmt, clippy -D warnings, synth-synthesis 766 +
suites, CI-form sweep with all SIX exact greps, claim_check 63/63 +
status.json regenerated, status_evidence_check, strict YAML. Not merged.

Refs #1189, #1222, #1226

[avrabe]

Coordinator: merge-order hazard between #1227 and #1232 — do not merge these in either order without re-deriving

Measured, not reasoned. Both PRs are green on their own base; together they break main.

#1227 pins #1226 red-first on an observable:

grep -Eq '^WIDTH-1226: known-open \(\.wast homes < \.wat homes for the same module text on 4 legs\)$'

Its fixture scripts/repro/home_alias_width_1226.wast is a two-module .wast — deliberately, because
the mis-homing lives in the multi-module merge path.

#1232 makes that merge path REFUSE any module it would mis-home (any(&module.func_params_i64) →
"signature tables are i32-only, so an i64 parameter pair is mis-homed"). Compiling #1227's fixture with
#1232's binary:

exit=1   Refused ... i32-only ... mis-homed

So once #1232 lands, the fixture no longer compiles, the audit cannot measure homes= on it, and
#1227's WIDTH-1226 grep fails. Green PR CI on a stale base, merges clean, reddens main.

A correction to my own first reading, recorded because it changes the conclusion. I initially tested a
single-module (param i64 i64) (result i64) local.get 1 and found #1232 emitting the correct pair
(mov r0,r2; mov r1,r3), and concluded #1232 had fixed the mis-homing. Then I ran the same input on
main's binary and got identical bytes — body inference recovers the width in that shape, so the test
discriminated nothing. The defect is specific to the merge path, which is exactly why the fixture is
two-module. #1232 converts a silent mis-homing into a loud refusal; it does not thread the widths.

Consequences to settle before either merge:

1. Merge order: feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 first, then fix(selector): RQ-65-ALIASCLASS (#1189) — enumerate every uncopied home-register consumer on four legs; fix aarch64 rotl (#1221) and i64-param local.set (#1222) red-first; pin #1223/#1226 open #1227 rebases and re-derives its #1226 observable against a tree
   where the multi-module fixture is refused. A refusal is not a homes= count, so the pin needs a
   different expression — or the fixture needs to reach the defect by a route feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 still compiles.
2. Is .wast driver path threads NO declared param/result width tables — every i64/f32/f64 param or result in ANY .wast module (single-module too) is homed as i32 unless body inference recovers it (was: multi-module merge / representative table) #1226 still open? After feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 the multi-module path emits no wrong bytes because it emits
   nothing. That is decline-honesty, which this project counts as the correct trade — but it is a reach
   loss, not a width fix. My reading is that .wast driver path threads NO declared param/result width tables — every i64/f32/f64 param or result in ANY .wast module (single-module too) is homed as i32 unless body inference recovers it (was: multi-module merge / representative table) #1226 stays open and changes character from "silent wrong
   answer" to "refused", and fix(selector): RQ-65-ALIASCLASS (#1189) — enumerate every uncopied home-register consumer on four legs; fix aarch64 rotl (#1221) and i64-param local.set (#1222) red-first; pin #1223/#1226 open #1227's note that the arm direct selector: local.set/local.tee of a register-homed i64 PARAM writes only the lo half (leaf functions), and the #989 snapshot can land on val's hi #1222 pair-write never fires on .wast still stands.
   The lane that owns it should confirm on the merged tree rather than take my word.

Refs #1226, #1225, #1222

[avrabe]

Correction: my earlier "correction" was wrong — #1232 DOES fix the single-module .wast mis-homing

I posted a hazard note saying I had first concluded #1232 fixes the mis-homing, then "corrected"
myself after finding main emitting identical bytes, and concluded the defect was specific to the
multi-module merge path. That correction was the error. The original reading was right.

Cause: both worktrees shared one CARGO_TARGET_DIR, so ./target/debug/synth belonged to whichever
tree built last. When I believed I was running main's binary I was running #1232's.

Re-measured with each branch built into its own target dir, same input
((module (func (export "f") (param i64 i64) (result i64) local.get 1)), a single-module .wast):

binary	.text	verdict
main	e92d4010 e1a00001 e8bd8010	mov r0, r1 — mis-homed
#1232	e92d4010 e1a00002 e1a01003 e8bd8010	mov r0, r2; mov r1, r3 — correct pair

So the ALIASCLASS lane's mechanism note was accurate as written: ANY .wast mis-homes on main,
single-module included, because the .wast decode arm threads no declared-width tables. #1232 fixes
the single-module case outright and refuses the multi-module case.

What this does and does not change:

• The merge-order hazard STANDS, for the reason I first gave. fix(selector): RQ-65-ALIASCLASS (#1189) — enumerate every uncopied home-register consumer on four legs; fix aarch64 rotl (#1221) and i64-param local.set (#1222) red-first; pin #1223/#1226 open #1227's WIDTH-1226 red-first pin
  needs its two-module fixture to COMPILE so it can compare homes= counts; feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 refuses it. Merge
  feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 first, then rebase fix(selector): RQ-65-ALIASCLASS (#1189) — enumerate every uncopied home-register consumer on four legs; fix aarch64 rotl (#1221) and i64-param local.set (#1222) red-first; pin #1223/#1226 open #1227 and re-derive that observable.
• .wast driver path threads NO declared param/result width tables — every i64/f32/f64 param or result in ANY .wast module (single-module too) is homed as i32 unless body inference recovers it (was: multi-module merge / representative table) #1226's disposition changes. After feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 the single-module path emits correct bytes and the
  multi-module path emits nothing, so the wrong-bytes symptom is closed on both routes — one by a fix,
  one by a refusal. fix(selector): RQ-65-ALIASCLASS (#1189) — enumerate every uncopied home-register consumer on four legs; fix aarch64 rotl (#1221) and i64-param local.set (#1222) red-first; pin #1223/#1226 open #1227 should re-state whether .wast driver path threads NO declared param/result width tables — every i64/f32/f64 param or result in ANY .wast module (single-module too) is homed as i32 unless body inference recovers it (was: multi-module merge / representative table) #1226 remains open as a reach issue (the merge
  path declining input it used to accept) rather than a correctness one.
• Note a single-module fixture would NOT reproduce the defect after feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 either, since feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 fixes
  that route. If the pin must survive, it needs a shape feat(reach): RQ-65-MVPCORE (#1017) — MVP core re-derived on the executed path: single-module .wast routing (oracle first), merge refusals, start-function invocation; 14/114 -> 12/80 #1232 still compiles AND still mis-homes — and
  it is a legitimate outcome to conclude no such shape exists and retire the pin with that reason.

Method note, since it cost two wrong claims: never compare two branches' binaries through a shared
CARGO_TARGET_DIR. Build each into its own, or you are comparing a tree against itself.

Refs #1226, #1225, #1017