dissolve: bind passed-through embedder import `cabi-arena-realloc` to the native TCB arena allocator

[avrabe]

Context

Part of the BYO-OS lean-MCU dissolve pipeline (gale#89):

gale app + kernel-primitive components
  → meld fuse --memory shared
  → loom → synth (native ELF, no memory.grow)

Grow-free components are built with the forked wit-bindgen cabi-realloc-extern feature (pulseengine/wit-bindgen#4): cabi_realloc stays exported but its body routes to an embedder-provided env::__cabi_arena_realloc import, so no memory.grow is pulled in on realloc's account.

What wasm-tools now produces (contract)

The pulseengine/wasm-tools fork now supports component new --import-passthrough env::__cabi_arena_realloc (pulseengine/wasm-tools#2). Instead of rejecting the unmapped env import, it produces a valid component that:

• imports a world-root function whose extern name is the kebab-case of the core symbol field name — __cabi_arena_realloc → cabi-arena-realloc — typed func(p0: u32, p1: u32, p2: u32, p3: u32) -> u32 (derived from the core signature (i32,i32,i32,i32) -> i32);
• canon lowers that import and wires it as the core module's env::__cabi_arena_realloc import;
• keeps cabi_realloc exported and used as the canonical realloc.

Resulting world surface:

world root {
  import cabi-arena-realloc: func(p0: u32, p1: u32, p2: u32, p3: u32) -> u32;
  export greet: func() -> string;
}

The component import is deliberately left unsatisfied — it's an embedder/host symbol to be bound at native link / dissolve, not by the component model.

Ask (synth)

At dissolve / native link, bind the passed-through import (after meld, see the meld companion issue) to the TCB's native arena allocator symbol __cabi_arena_realloc, honoring the full canonical-ABI realloc contract:

• signature (old_ptr, old_len, align, new_len) -> ptr (i32×4 → i32);
• old_len == 0 && new_len == 0 → return align;
• bounded arena, traps on exhaustion rather than calling memory.grow.

The naming rule is kebab_case(core_field_name); synth should map the component import cabi-arena-realloc back to the native symbol __cabi_arena_realloc. If we'd rather preserve the exact symbol verbatim (avoid the kebab transform), let's decide that here and adjust the wasm-tools fork — the transform is only there because component extern names must be kebab-case.

Refs

pulseengine/wasm-tools#2 (the --import-passthrough flag, implemented), pulseengine/wit-bindgen#4 (cabi-realloc-extern), meld companion issue (pass-through during fuse), synth#383, gale#89.

Nothing here goes upstream to bytecodealliance — this is the pulseengine fork pipeline only.

[avrabe]

[synth maintainer side — issue-hunt triage] Good news: this is mostly already in place at synth's layer, and the layering keeps the allocator out of synth (synth references, the TCB provides, the native link binds — same shape as the gust path, not a #401-style absorb).

Mechanism (already implemented, #197): synth's --relocatable host-link path lowers an import CALL to a direct AAPCS call with a relocation against the wasm import's field name (arm_backend.rs:193 "rewritten to the wasm field name by build_relocatable_elf"; instruction_selector.rs:7611). So cabi_realloc's body calling env::__cabi_arena_realloc lowers to bl __cabi_arena_realloc → R_ARM_THM_CALL to an UNDEFINED symbol __cabi_arena_realloc, which your TCB's native arena allocator satisfies at link. synth emits the reference and the canonical-ABI call (old_ptr,old_len,align,new_len in r0-r3, AAPCS) — it does not implement the allocator, the old==0 && new==0 → align contract, or the trap-on-exhaustion; those live in the TCB symbol, exactly as you describe.

Naming decision (resolved at synth's layer): synth operates on the core module (post-meld/loom), so it only ever sees env::__cabi_arena_realloc — the verbatim core field name — and relocates against that. The kebab transform (cabi-arena-realloc) is purely the component import surface (wasm-tools/wit-bindgen); it never reaches synth. So no transform on our side: synth uses __cabi_arena_realloc verbatim. You can keep the kebab at the component boundary without adjusting the wasm-tools fork for synth's sake.

What's left = verification, not new lowering. I want to confirm end-to-end on the real artifact (the dissolved component out of the wit-bindgen#4 → wasm-tools#2 → meld#301 pipeline), not just the mechanism: compile it --native-pointer-abi --relocatable and assert the .o carries an undefined __cabi_arena_realloc symbol + the R_ARM_THM_CALL relocation (and that cabi_realloc is exported/used as the canonical realloc). Please drop that dissolved .wasm in (like gust_kernel.wasm for #383) and I'll add it as a scripts/repro/ fixture + a linkability assertion, and confirm or fix from there. Refs: meld#301, gale#89, synth#197/#383.

[avrabe]

Verified empirically + regression-locked (PR #420). Compiled a minimal module (env::__cabi_arena_realloc called by an export) --native-pointer-abi --relocatable — the .o carries *UND* __cabi_arena_realloc and a R_ARM_THM_CALL relocation at the call site, so the native link binds it to your TCB allocator. So my earlier triage holds, now backed by a test (cabi_arena_realloc_linkability_418.rs) rather than just a code-read. Naming confirmed: synth uses the verbatim core field name __cabi_arena_realloc; the kebab is component-surface only.

Still open = the end-to-end check on the real dissolved component (the synthetic wat exercises the synth mechanism, not the full wit-bindgen#4 → wasm-tools#2 → meld#301 output). Drop that .wasm in and I'll add it as a fixture + assert cabi_realloc is exported/canonical alongside the arena reloc. Until then, the synth-layer contract is locked.