test(vcr-mem): layer-2 end-to-end budget pipeline on real gust fixture (#242, #383)

[avrabe]

What

Closes the join that the #392 scry spike and the shadow_budget unit suite (#421) each cover only half of:

• feat(vcr-mem): #383 layer-2 substrate — scry shadow-stack-depth proof verified in-tree (scry-sai-core v1.12) #392 spike → scry's raw analyze() output only.
• shadow_budget units → the budget_from_bound decision on synthetic bounds only.

layer2_budget_pipeline_msgq_end_to_end_383 (synth-cli main.rs cfg(test)) runs the full chain on the real msgq_put_359.wasm gust fixture:

scry::analyze(msgq) → StackBound::Bytes(32)
  → [adapter 1:1] → StackDepthBound::Bytes(32)
  → budget_from_bound(_, sp_init=65536, fallback=Some(4096))
  → BudgetDecision::Use { bytes: 32, source: ProvenStackDepth }

It asserts the 2048× over-reservation (the 65536-byte declared page) collapses to a proven 32-byte budget — and that with a fallback available, the proven path is preferred over the asserted one (ProvenStackDepth, not AssertedFallback).

Frozen-safe

scry-sai-core stays a dev-dependency exercised only under cfg(test), so the production binary pulls no scry and emits identical bytes — the change is entirely in #[cfg(test)] code. No MODULE.bazel pin (tests aren't in the Bazel graph). Independent of the from_cargo migration (#422) — it uses the existing dev-dep under the current resolution.

The inline 1:1 StackBound → StackDepthBound map is the adapter that becomes impl From<scry::StackBound> when step 2b promotes scry to a (feature-gated) production dep. This test is the oracle that the gated --shadow-stack-size auto wiring must match.

Verification

• cargo test -p synth-cli --bin synth layer2_budget_pipeline → pass (alongside the 9 shadow_budget units)
• cargo fmt --check clean; cargo clippy -p synth-cli --all-targets -- -D warnings clean
• rivet check → zero non-xref errors; roadmap VCR-MEM-001 updated with the end-to-end criterion

Refs #242 (VCR epic), #383 (layer-1).

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-cli/src/main.rs	90.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!