fix(elf): .ARM.attributes + thumb auto-detect disasm (#637); internal func_N STB_LOCAL, symtab locals-first + real sh_info (#656)

[avrabe]

Fixes two ELF tooling/linkability issues in one lane: #637 and #656 (+ the #430 sh_info lineage).

#637 — synth disasm decoded synth's own Thumb-2 output as A32 garbage

Two independent levers, both landed:

1. .ARM.attributes emission (elf_builder::arm_attributes_section, SHT_ARM_ATTRIBUTES): Tag_CPU_arch / Tag_CPU_arch_profile / Tag_ARM_ISA_use / Tag_THUMB_ISA_use derived from the selected -t target (cortex-m3 = v7/M/Thumb-2, thumbv7em = v7E-M, thumbv8.1m = v8.1-M, cortex-m0 = v6-M/Thumb-1, cortex-r5 = v7/R/A32-only). Emitted on the relocatable-object path and both Cortex-M image paths, appended as the LAST section so every existing section index (.text=4, .data/.bss=5/6, DWARF tail) is untouched. Synth objects are now self-describing: plain objdump -d with no --triple already prints correct Thumb-2.
2. synth disasm ISA auto-detect instead of the A32 default: .ARM.attributes Tag_THUMB_ISA_use when present → the STT_FUNC thumb bit (odd st_value, the standard interworking convention the issue pointed at) → e_entry bit 0 → A32. Non-ARM/non-ELF inputs keep the previous behavior.

$ synth disasm add.o          # cortex-m3 --relocatable
Detected triple: thumbv7m-none-eabi
00000000 <func_0>:
       0: b510   push {r4, lr}
       2: 1842   adds r2, r0, r1
...
$ arm-none-eabi-readelf -A add.o
  Tag_CPU_arch: v7
  Tag_CPU_arch_profile: Microcontroller
  Tag_THUMB_ISA_use: Thumb-2

#656 — internal func_N emitted STB_GLOBAL → multiple-definition collisions co-linking two dissolved objects

• Non-exported functions (whose only name is func_{wasm_index}) and every func_N call alias of an exported function are now STB_LOCAL; export names stay STB_GLOBAL. Both are per-object labels keyed by wasm function index — exactly the names that collided across independently-dissolved objects.
• That requires the ELF ordering rule that has blocked local symbols since the DWARF work (feat(dwarf): emit .rel.debug_* so a linker fixes up DWARF .text addresses (VCR-DBG-001 PR C, #394) #430 noted the hardcoded .symtab sh_info=1): ElfBuilder::build now stable-sorts locals before globals, sets sh_info to the first-non-local index, and rewrites every relocation symbol index through the permutation (.rel.text and the .rel.debug_* tables) — the arm backend: every wasm call lowered to __meld_dispatch_import placeholder — no inlining, no relocations, non-linkable ELF #167/arm --relocatable: import-call relocations use func_N, not the wasm import field name — won't link against a real host #173 R_ARM_THM_CALL machinery indexes symbols and stays consistent. With zero locals the permutation is the identity and sh_info stays 1: pre-Internal (non-exported) func_N emitted as GLOBAL symbols → multiple-definition collision when co-linking two dissolved .o's #656 objects byte-identical.

Kill-criterion from the issue, verified live:

$ arm-none-eabi-nm gpio.o
00000000 t func_0            # internal helper — lowercase t
00000008 t func_1            # export's call alias — local too
00000008 T gpio_configure    # export — global
$ arm-none-eabi-ld -r -o merged.o gpio.o spi.o && echo LINK OK
LINK OK                      # was: multiple definition of 'func_0'/'func_1'
$ arm-none-eabi-readelf -r merged.o   # each BL still pinned to its OWN local helper
00000018  0000040a R_ARM_THM_CALL  00000001  func_0
00000044  0000070a R_ARM_THM_CALL  00000025  func_0

Oracles

• New crates/synth-cli/tests/elf_tooling_637_656.rs (5 tests): bindings + locals-before-globals + sh_info = first-global (pyelftools-equivalent via the object crate), .rel.text reindex resolution (name + address + LOCAL), co-link via arm-none-eabi-ld/ld.lld -r (graceful skip on bare runners), .ARM.attributes bytes + SHT type, and synth disasm printing Thumb mnemonics on the thumb-2: i32.shl/shr_s/shr_u don't mask the shift amount mod 32 — amounts >=32 silently compile to 0 (VCR-SEL regression; Rocq ARM model masks like WASM so proof is vacuous) #682 masked-shift shape (skips without objdump, per the ci(vcr-oracle): CI-gate the RV32 immediate-shift-fold execution oracle (#472, #242) #489 host-dependence lesson).
• New elf_builder unit tests: locals-first sort + reloc remap + sh_info, zero-locals identity freeze, attributes blob structure (M and R profiles).
• Frozen anchors 10/10 — .text untouched (symtab/attributes only).
• ci(vcr-oracle): CI-gate the RV32 immediate-shift-fold execution oracle (#472, #242) #489-class symtab differentials re-run green on the new layout: control_step_differential.py 13/13 match (0x00210A55 cases), flight_seam_differential.py MATCH (0x07FDF307).
• Workspace: 110/110 suites, clippy -D warnings clean, fmt clean; rebased onto fix(selector): param liveness extends across loop back-edges — loop bound survives the induction increment (#663) #689 and re-verified.

Closes #637
Closes #656

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 86.14130% with 51 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-cli/src/main.rs	69.37%	49 Missing ⚠️
crates/synth-backend/src/elf_builder.rs	99.03%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!