fix(#946): selector wildcard classification — the wasm_stack_effect wildcard was a LIVE executed miscompile (RQ-58-WILDCARD)

[avrabe]

RQ-58-WILDCARD (#946, epic #242) — rank first, convert the miscompile-risk set

Re-derived baselines on main after #999: selector_lines_code = 17,897, selector_wildcard_arms_code = 56 (both match the banked pins).

The live hole — found, executed, fixed

The classification pass found the hole the lane brief predicted, and it is live and executed, not latent. wasm_stack_effect — the (pops, pushes) table feeding infer_i64_locals, the i64 local width inference shared with the RV32 selector (#312) — carried wrong rows behind the wildcard and beside it:

row	table said	reality
If / BrIf / BrTable	(0, 0) "no value stack effect"	each pops one i32 (condition / index)
MemoryCopy / MemoryFill	absorbed by _ => (0, 0)	each pops 3
Call / CallIndirect	(0, 1) "approximate"	args + call_indirect's table index are popped

Every stale entry shifts the width stack, so an i64 local set past one of those shapes was inferred i32, given a 4-byte slot and a single-word STR/LDR — hi half silently dropped. Executed proof (unicorn vs wasmtime, cortex-m4 --relocatable --no-optimize, all computing 0x1_0000_0005 >> 32, expected 1):

• br_if shape → 32 · if shape → 32 · br_table shape → 32 · memory.copy shape → 0
• call-args shape: local.set of the i64 emitted a single-word str r0, [sp] (static)

All return 1 after the fix. Plain WASM-validating modules; no exotic features.

The conversion + tripwire

• wasm_stack_effect is now a fully-enumerated, no-wildcard match over all 279 WasmOp variants — a new variant fails to compile until its stack effect is stated (A32 encoder silently NOPs i64 mul/shl/shr/rotl/rotr/compare/eqz (--target cortex-r5) — returns garbage instead of computing or rejecting #615 expand-or-loud-reject).
• infer_i64_locals pops call arguments against the real func_arg_counts/type_arg_counts tables (one slot per value — the decoder's unit) plus call_indirect's index operand; empty tables degrade to the pre-existing zero-arg approximation, matching lower_call's own arm selector: call arguments not marshalled into r0-r3 (AAPCS) — blocks z_impl_k_sem_give #195 fallback. Threaded through compute_local_layout, both ARM call sites, and the RV32 selector (no type table there; call_indirect is Unsupported on RV32, so the empty slice cannot under-pop on anything that compiles).
• Tripwire tests/selector_stack_effect_no_wildcard_946.rs — same scanner set and style as the existing doc-vs-source sweep: 30 mechanically-verified disagreements, 4 of them possible defects (not doc staleness) #946 writes_sp tripwire (wcet_sp_no_wildcard_946.rs): no catch-all (_ or bare-binding) arm may regrow, every WasmOp variant must be named in the body, population pinned at 279, negative controls prove the scanner can go red, and it was demonstrated red on an injected _ => in the real function.
• Red-first behavior pins tests/i64_width_vstack_946.rs: 7 shape tests verified failing on the pre-fix behavior (temporary revert), 2 controls (v0.11.35 arm: i64 unpack miscompile — mask constants materialize into the live u64 pair (r0/r1); silent wrong-code in k_sem_give #311 i64-returning call, i32-stays-i32) green both sides.
• Executed CI coverage: scripts/repro/i64_width_vstack_946.wat (4 exports) rides the wired ARM: select on an i64-comparison condition with COMPUTED arms always returns the then-arm — reload clobbers the live else-arm register #973 ARM corpus sweep Phase B — ran locally end-to-end: 4 exports x 12 vectors compared, 0 mismatches, sweep PASS with the EXPECTED_DECLINES exact-set unchanged (no new ARM declines, so no cross-lane redness). i64_width_vstack_mem_946.wat carries the memory.copy/fill shapes (a memory section excludes a module from Phase B; Phase-A compile + unit pins cover it).

The denominator, stated honestly (56 arms classified)

• Converted (9):
  • 1 eliminated — the wasm_stack_effect wildcard (the live hole).
  • 8 silent-to-loud, count-neutral by design — six float inner maps whose _ => silently lowered as the last variant (F32Div/F32Ge/F64Div/F64Sqrt/F64Ge/F64Nearest: a widened outer arm would have become a silent wrong lowering) and the two access-size fallbacks that silently widened any unexpected width to a word load/store. All now unreachable!() — which still matches the ratchet regex, deliberately: replacing it with a bare-binding arm to game the count is exactly what the tripwire scanners flag.
• Deliberately left (47), each with a reason (recorded at the pin in claims.yaml):
  • 16 guarded-unreachable!() refinements — already loud, outer arm pins the set;
  • 7 closed-subspace WasmOp walks — only LocalGet/Set/Tee carry local indices, only Call/CallIndirect carry arg counts, only Block/Loop/If/End affect nesting;
  • 6 dispatch defaults whose fall-through is handled-elsewhere / loud-decline (incl. vfp_op_demand, whose doc pins the safe direction: an under-estimate re-raises the exhaustion decline, never a miscompile);
  • 4 lookback peepholes — the wildcard declines an optimization, conservative by direction;
  • 10 internal-enum arms with meaningful None/false/no-op semantics (incl. set_branch_offset, whose only caller resolve_branches has zero in-tree call sites — production branch resolution is arm_backend's own pass);
  • 3 genuinely total index % N maps;
  • 1 already-loud Err (if/else-with-result lowering has no result-register reconciliation — arms agree only by register-pressure luck #313) — it is the expand-or-loud-reject pattern.

Ratchet

• selector_wildcard_arms_code 56 -> 55, value + baseline banked; arms_total 91 -> 90.
• selector_lines_code 17,897 -> 17,991 (+94): waived with a written reason — the 279-variant enumeration + call-arg threading is lines traded for exhaustiveness, the exact trade this release wants. lines_total 28,495 -> 28,599.

Frozen anchors

Unmoved. The entire workspace suite (incl. all frozen-anchor differentials) is green with rc=0 — no pinned fixture contains the drift shape, so the semantic fix is byte-invisible on all anchors, and the 8 loud-conversions are byte-identical by construction. Byte movement is confined to modules with an i64 local set past a cond-consuming / bulk-memory / arg-taking-call shape — i.e. exactly the shapes proven wrong before and proven right after by execution.

Also folded in

• RQ-58-SHIPVERIFY re-graded proposed -> implemented (PR feat(#1000): ship 'synth verify' in released artifacts + non-vacuity smoke gate (RQ-58-SHIPVERIFY) #1002 merged 2026-08-19; verified via gh pr view before re-grading — the ledger had drifted behind the merge). RQ-58-WILDCARD re-graded implemented with the finding recorded.
• CLAUDE.md pin-rationale sentence no longer presents v0.57 counts as live.

Honest residuals (named, not hidden)

• The width walk is still a linear approximation: post-Br/Return/Unreachable polymorphic tracking and the Else join (an if-with-result double-counts its result across arms) need a control-frame-aware walk — stated in the code at the structural row; named follow-up.
• A void callee still pushes one phantom width entry (Call result push is unconditional, matching the ARM lowering's own unconditional result push); RV32's func_result_counts machinery is the natural donor when this is picked up.

Gates (each run without a pipe)

cargo test --workspace rc=0 (145 suites, 0 failures) · cargo clippy --workspace --all-targets -- -D warnings clean · cargo fmt --check clean · python3 scripts/claim_check.py claims.yaml 49/49 · #973 corpus sweep PASS (2327 compared, EXPECTED_DECLINES unchanged).

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 66.27907% with 29 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/instruction_selector.rs	63.75%	29 Missing ⚠️

📢 Thoughts on this report? Let us know!