refactor(adr7): extract the per-boundary call-lowering seam (path-H inc 2)

[avrabe]

Executes ADR-7 path-H, increment 2 (#354): lift the "how is this
cross-component call boundary lowered" decision out of
FactStyleGenerator::generate_adapter into a dedicated adapter::call_lowering
module. The call-lowering counterpart of the address-strategy seam (#359, inc 1).

What

• adapter/call_lowering.rs — BoundaryFacts + CallLoweringPlan +
  resolve_call_lowering_plan. The three-way class dispatch
  (crosses_memory / needs_transcoding → Direct / MemoryCopy /
  Transcode) and the Fusion emits identity trampolines that never inline (dead inline_adapters flag); de-export fusion-vestigial symbols #304 inline-eligibility guard are resolved together
  (they are coupled — see the module doc). 9 unit tests cover the class + inline
  truth table and the hard-fail below.
• adapter/fact.rs — generate_adapter resolves the plan, matches on the
  class for body generation, and reads inline_eligible for the Fusion emits identity trampolines that never inline (dead inline_adapters flag); de-export fusion-vestigial symbols #304 bypass.
• adapter/mod.rs — register the module.

One deliberate behavior change: a silent-corruption backstop (#361)

The extraction is otherwise behavior-preserving. But the auto-Mythos delta-pass
surfaced a real, pre-existing latent bug that the original inline dispatch
carried: a sync call that needs transcoding but does not cross memory
(needs_transcoding && !crosses_memory — e.g. --memory shared fusion of a
UTF-8 caller and a UTF-16 callee) routed to Direct, a shim that does not
transcode → string bytes delivered verbatim in the wrong encoding, silently.

meld already fails loud on the identical async case
(guard_async_cross_encoding_strings, fact.rs:12139, #272). This PR adds the
sync twin: resolve_call_lowering_plan hard-fails with AdapterGeneration
rather than emit a silently mis-transcoding adapter — the #351/#352/#355
silent-corruption-vs-loud-failure choice, applied consistently. Actually
supporting same-memory transcoding is tracked in #361.

The guard fires on no existing fixture (the path was silently latent); full
meld-core suite green (0 failures), fmt + clippy clean.

Async is unaffected

Async boundaries are dispatched before generate_adapter (the
is_async_lift branch in generate), so they never flow through this seam; the
AdapterClass::Async match arm is unreachable! and documents that.

Why this is the seam ADR-7 wants

Future per-boundary ABI strategies — symmetric ABI (cpetig/Aptiv) and
static-base PIC (#353) — and same-memory transcoding (#361) become new
inputs/outputs of resolve_call_lowering_plan rather than new branches threaded
through the adapter hot path.

Tier-5 (adapter/fact.rs + new fusion-critical module) → Mythos delta-pass
below.

Refs #354 (ADR-7), #361, #272

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/adapter/call_lowering.rs
meld-core/src/adapter/fact.rs
meld-core/src/adapter/mod.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[avrabe]

Mythos discover pass — NO FINDINGS

This PR is a single logical extraction (the per-boundary call-lowering decision) spanning the three touched Tier-5 files, so it was reviewed as one adversarial unit with the highest prior on the refactor failure mode: does the extracted resolve_call_lowering_plan diverge from the original inline dispatch for any input? A divergence would silently mis-lower a boundary (wrong AdapterClass = wrong ABI/semantic drift, or wrong inline_eligible = skipped post-return / resource cleanup).

meld-core/src/adapter/call_lowering.rs (new) — NO FINDINGS

meld-core/src/adapter/fact.rs (wiring) — NO FINDINGS

Term-by-term equivalence vs the removed inline code (old fact.rs:5297-5332):

• Class selection — identical predicates, identical order, identical else-fallthrough: crosses_memory && needs_transcoding → Transcode; crosses_memory → MemoryCopy; else → Direct. Fields mapped from the exact same source expressions (site.crosses_memory, options.needs_transcoding()).
• Body dispatch — the new match class calls the same generator per class, and the resource_rep_imports 4th argument to generate_memory_copy_adapter survived.
• Inline guard — the three negations are correct De Morgan duals: has_resource_rep_calls = !resource_rep_calls.is_empty() ⟹ !has_… = is_empty() (and likewise resource_new, and has_post_return = callee_post_return.is_some() ⟹ !has_… = is_none()). The && chain is pure conjunction over side-effect-free reads, so short-circuit order cannot change the result.
• AdapterClass::Async unreachable! — verified genuinely unreachable: the generate loop (fact.rs ~12196) tests is_async_lift first and continues before the generate_adapter call, so Async never flows into the seam.
• Truth-table equivalence — for all 2⁶ BoundaryFacts combinations, the new (class, inline_eligible) equals the original inline dispatch's output (class is a 4-row table on (crosses_memory, needs_transcoding); inline_eligible is the same conjunction post-De-Morgan). The 8 in-module unit tests exercise every branch of that table.

meld-core/src/adapter/mod.rs — NO FINDINGS

Change is inert: a one-line pub(crate) mod call_lowering; registration. The AdapterClass enum (the only fusion-relevant content) is unchanged by this PR.

Per the Mythos honesty bar, no finding is reported (nothing to report — the extraction is a mechanical boolean identity, verified by inspection and by the exhaustive branch tests). No Kani/PoC pair is attached because there is no bug to reproduce.

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[github-actions]

Mythos delta-pass (auto)

✅ NO FINDINGS across 3 Tier-5 file(s)

File	Verdict	Hypothesis
``	✅ NO FINDINGS	—
``	✅ NO FINDINGS	—
``	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}

[avrabe]

Triage of the auto-Mythos finding (crosses_memory=false, needs_transcoding=true)

The auto gate is doing its job — but two things need separating:

1. This is NOT a regression from this PR. The extraction is behavior-preserving. The flagged path (same memory, different encoding → Direct → transcoding skipped) is identical to main's removed inline code: the old dispatch's else → Direct branch also caught crosses_memory=false regardless of needs_transcoding, and inlined it under the same guard. Verified term-by-term + 2⁶ truth-table (see the NO-FINDINGS comment above). So resolve_call_lowering_plan faithfully preserves the decision; it did not introduce the gap.

2. The finding does surface a REAL, pre-existing latent bug in main. Grounded:

• crosses_memory is set purely from memory strategy (resolver.rs:2866-2879): under --memory shared it is always false, independent of encoding.
• needs_transcoding = caller_encoding != callee_encoding, set independently (resolver.rs:2972, analyze_call_site fact.rs:5394-5403).
• The class dispatch only reaches Transcode when site.crosses_memory is true, so a sync, same-memory, mixed-encoding call routes to Direct — which is a thin shim that does not transcode. No upstream validation rejects mixed encodings under shared memory (only the LS-P-17 warning).
• Net: meld fuse --memory shared of a UTF-8 component calling a UTF-16 component silently delivers untranscoded bytes.

3. meld already hard-fails the analogous ASYNC case. guard_async_cross_encoding_strings (fact.rs:12139, #272) fails loud — "async cross-encoding string transcoding is not yet supported" — rather than emit a silent mis-copy. The sync same-memory path is the unguarded twin of that exact decision, and silent-corruption-vs-loud-failure is the call meld made in #351/#352/#355.

Resolution: the honest fix is to add the sync counterpart of the async guard — a hard-fail on needs_transcoding && !crosses_memory — turning the silent miscompile into a loud, tested error and clearing this finding legitimately (rather than overriding the gate on a known silent-corruption path). Doing that as part of this PR since the seam is precisely where the decision lives.

[avrabe]

Mythos update — finding resolved by the #361 hard-fail

The auto-gate finding is addressed at the source: resolve_call_lowering_plan now hard-fails (AdapterGeneration) on needs_transcoding && !crosses_memory instead of returning {Direct, inline_eligible}. So the silent-skip the auto-agent flagged can no longer occur — the seam refuses that boundary rather than mis-lower it.

Re-verified on the new commit (a1d7d0c):

• Guard is exact — fires iff needs_transcoding && !crosses_memory. Same-encoding calls (needs_transcoding == false) don't fire; legitimate cross-memory transcode (crosses_memory == true) still routes to Transcode. No over- or under-firing.
• Threaded correctly — generate_adapter propagates the seam's Result via ?.
• Fires on no existing fixture — full meld-core suite green (0 failures across all suites); the new same_memory_transcoding_hard_fails unit test covers the guard; the other 8 truth-table tests are unchanged.

The class + inline-eligibility decision is otherwise the same behavior-preserving extraction verified earlier (2⁶ truth-table equivalence).