fix(trap-semantics): unreachable traps on every backend (#665); rv32 rem_s drops the spurious INT_MIN/-1 guard (#666)

[avrabe]

Summary

One lane, two trap-semantics bugs — same theme, disjoint files.

#665 — unreachable compiled to a NO-OP on thumb-2 AND rv32

Root cause was ONE decode drop, not per-backend misses: convert_operator (synth-core wasm_decoder.rs) returned None for Unreachable and is_intentionally_ignored whitelisted it alongside Nop, so no backend ever received the op. The selector trap arms (ARM UDF #0 in both select_with_stack and select_default, RV32 ebreak) already existed as dead code.

Per-path status after the fix:

path	before	after
decoder	dropped as "intentional no-op"	decodes to WasmOp::Unreachable
ARM direct (select_with_stack)	never received op	existing UDF #0 arm fires
ARM select_default	never received op	existing UDF #0 arm fires
ARM optimized (bridge)	lumped with Nop → IR placeholder	typed loud-DECLINE → direct selector emits UDF #0 (same pattern as #120 floats / #500 non-tail return; no new Opcode through the #513 mirror-pinned reg_effect/rewrite_op machinery, no new ArmOp so the #511 estimator oracle is untouched — Udf was already covered by the div-zero guards)
RV32	never received op	existing ebreak arm fires
aarch64	loud-decline (unknown op)	new brk #0 encoder + selector arm

Known gap kept visible (contract-compliant, never falls through): rv32 loud-declines the if/else-with-result shape whose else arm is pure unreachable (#343 arity check) — noted in the oracle.

#666 — rv32 i32.rem_s(INT_MIN,-1) spuriously trapped

The selector shared div_s's INT_MIN/-1 overflow ebreak guard with rem_s via bin_with_signed_div_traps. WASM §4.3.2: irem_s(INT_MIN,-1) = 0, NO trap — only idiv_s traps there. RISC-V M-ext rem already returns 0 for the overflow case (unprivileged spec §7.2), so rem_s now takes plain bin_with_zero_trap: zero-divisor guard KEPT, bare rem is exactly wasm-correct. Disasm-verified: rems = 1 ebreak, divs = 2 ebreaks.

The pre-existing test rv32_signed_rem_also_gets_overflow_guard pinned the bug; rewritten as the #633-twin fix-guard pins (rv32_signed_rem_carries_only_zero_guard_666 + rv32_signed_div_still_carries_both_guards_666), mirroring ARM's test_633_i64_rems_has_no_overflow_guard.

Oracles — red on origin/main, green here (new CI job trap-semantics-oracle)

scripts/repro/unreachable_665_differential.py (thumb2 + rv32 under unicorn vs wasmtime):

• red on main: boom(7,9) "returned" 7 (arg fall-through) on BOTH ISAs; guarded(-5) returned 0; guarded_br(-5) fell through — 5 FAILs
• green here: all trap cases fault like wasmtime; non-vacuity guarded(5)/guarded_br(5) return 1 normally

scripts/repro/rem_s_666_differential.py (rv32 trap table):

• red on main: rems(INT_MIN,-1) spurious TRAP (wasmtime: 0)
• green here: rems(INT_MIN,-1)→0, rems(INT_MIN,1)→0, rems(7,3)→1, rems(-7,3)→-1, rems(7,0) traps, divs(INT_MIN,-1) traps, divs(7,0) traps, divs(7,3)→2 — 8/8

Gates

• Frozen anchors 10/10 bit-identical (verified no frozen fixture — control_step / flight_seam / flight_seam_flat / signed_div_const — contains unreachable)
• cargo test --workspace: 108/108 suites green
• cargo fmt --check + cargo clippy --workspace --all-targets -- -D warnings clean

Fixes #665
Fixes #666

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 87.50000% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-backend-aarch64/src/encoder.rs	0.00%	3 Missing ⚠️
crates/synth-backend-aarch64/src/selector.rs	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!