fix(351): hard-fail on stale reloc.CODE offsets instead of silent miscompile

[avrabe]

What

Backstop tier of the #351 fix: meld now hard-fails with MisalignedReloc
when a reloc.CODE memory-address site does not land on a rebasable operator
immediate, instead of silently emitting a miscompiled module.

Why (grounded)

avrabe reported (#351) that meld fuse --memory shared --address-rebase left a
ptr = &data[0] i32.const un-rebased — reproduced on v0.41.1 with their exact
bytes: wasmtime --invoke ptr-b returned 65536 (aliasing component-a)
instead of the rebased 196608.

Root cause (byte-level): the producer (clang 22.1.4 + wit-component 0.245.1)
relaxed address immediates from 5-byte-padded to minimal LEB128 but did not
rewrite reloc.CODE offsets, so each site drifts +2 bytes per preceding
memory-address reloc. The memargs survive (drift stays inside their wide
immediate window); the trailing SLEB@42 drifts past ptr-b's i32.const
range [37,41) → addr_reloc never set → silently not rebased. Upstream
producer defect filed as pulseengine/wasm-tools#3.

The fix (layered — this is tier 1)

meld verifies every R_WASM_MEMORY_ADDR_* site lands on a rebasable immediate;
if any is misaligned (stale), it hard-fails rather than corrupt the shared
address space — upholding the "never silently corrupt" invariant #326 rests on.
Drift-tolerant correct rebasing (so these inputs fuse rather than fail) is
the tier-2 follow-up.

Falsification / tests

• test_351_stale_reloc_offsets_hard_error — fuses avrabe's exact components
  (tests/reloc351/{a,b}.wasm, b sha256 481c36…d3a3); asserts
  MisalignedReloc { offset: 42 }. Pre-fix this silently returned 65536.
• reloc::first_misaligned_code_reloc_detects_drift — unit oracle: aligned site
  → ok; drifted onto end / past the section → caught.
• Negative: test_326_reloc_const_rebasing_end_to_end (consistent relocs) still
  rebases correctly; a real clang-22.1.8 consistent-reloc build still fuses
  (ptr_b = 196608) — the backstop does not over-reject valid modules.

Local: cargo fmt --check, cargo clippy, full meld-core test suite green.
Traceability: SR-53 (mitigates LS-D-1).

Refs #351, pulseengine/wasm-tools#3

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/merger.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[github-actions]

Mythos delta-pass (auto)

✅ NO FINDINGS across 1 Tier-5 file(s)

File	Verdict	Hypothesis
``	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}

[avrabe]

Mythos delta-pass — findings

Two clean-room adversarial discover passes (fresh-context agents, one per changed
Tier-5 file), per scripts/mythos/discover.md. Verdict: no reportable bug
meeting the oracle bar (failing Kani + concrete PoC). Both passes are documented
below; the honest limitation they surfaced is now corrected in-tree (commit
cffdfd7).

meld-core/src/reloc.rs — first_misaligned_code_reloc / operator_is_rebasable

CLEAN. Hypotheses tested & refuted with evidence:

• Coordinate-frame consistency (H2): backstop, rewriter (extract_function_body),
  and reloc offsets all use the same code-section-content frame
  (CodeSectionReader over &bytes[start..end], base 0). Consistent.
• Multi-function over-extension (H3): the ends chain over-extends only each
  body's last operator, which is always the non-rebasable End → never added to
  rebasable_ranges. Inert.
• operator_is_rebasable completeness (H4): its set is exactly what the
  rewriter rebases (consts + non-SIMD/non-atomic loads/stores). Excluded SIMD/atomic
  memargs → hard-fail = the safe verdict (rewriter couldn't rebase them either).
• Degenerate/boundary (H5): empty offsets early-return; r==op_end excluded;
  r==len caught; no panic/overflow.
• REAL LIMITATION (H1), not a reportable bug: the backstop checks "site in some
  rebasable range", not "the correct one". A site drifted from operator A into an
  adjacent rebasable operator B is accepted (None) and the rewriter rebases the
  wrong-but-rebasable immediate. This is undecidable from (code, offsets) alone
  (no fix flips a Kani harness), so it fails the oracle bar. Now documented in the
  fn docs + SR-53 scope + pinned by first_misaligned_code_reloc_adjacent_drift_is_a_known_gap.
  Closed by the drift-tolerant tier-2 fix (symbol/value-confirmed matching).

meld-core/src/merger.rs — backstop wiring

CLEAN. Hypotheses tested & refuted:

• Guard gap (H1): code_section_range is Some for every module with a code
  section; a reloc.CODE-carrying module with no code section has zero bodies →
  nothing to mis-rebase.
• Frame mismatch (H2): all four consumers share the content frame; pinned by
  provenance.rs::code_section_ranges_rebased_to_content_start and the live
  test_351_… firing at offset 42.
• Bypass call sites (H3, highest-value): every other build_index_maps_for_module
  call passes code_addr_relocs = None (resource re-rewrite 1269, lib.rs 1622,
  p3_async 1369, p3_bridge 403) → no reloc-driven rebasing there, so no backstop
  needed. The sole Some path is gated. (Noted for future, out of scope here: the
  resource-import re-rewrite at merger.rs:1247-1294 re-extracts bodies with
  address_rebasing=false — a pre-existing fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326-class rebasing-drop concern if a
  rebased module also has redirected [resource-*] imports; not demonstrable, not meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351.)
• base 0 (H4): backstop runs regardless of memory_base_offset; validating the
  base-0 module too is fail-closed, not unsafe.
• Panic/indices (H5): slice bounds in-bounds by construction; identifiers correct;
  CodeParse propagates fail-closed.

Adding mythos-pass-done.

[avrabe]

Strategic note: #353 tracks evaluating PIC / shared-everything dynamic linking as an input ABI — if that spike succeeds it likely supersedes this PR's tier-2 (drift-tolerant reloc rebasing), since PIC inputs have no absolute address literals to rebase. This tier-1 backstop is orthogonal and still the right near-term safety net for --emit-relocs users.