feat(codegen): heterogeneous funcref tables — runtime type check via the type-id sidecar (#676)

[avrabe]

Closes #676 — the terminal layer of falcon's call_indirect story, after #642 guards (#646), #650 multi-table (#653) and #664 null slots (#669).

What

A heterogeneous funcref table (mixed signatures — falcon's fused 41-slot dispatch table) can never satisfy the closed-world type check, so all 20 dispatch functions loud-declined. WASM Core §4.4.8 makes a call_indirect type mismatch a runtime trap, so the sound lowering is the runtime check itself:

• Type-id sidecar: the relocatable object now carries .synth.table_type_ids — one LE u32 structural signature class id per table slot, region order. Structurally-equal duplicate types share one dense 1-based id (the meld 31-decls/25-distinct shape); id 0 is reserved for null slots. The extended R11 layout contract (documented on CallIndirectGuards) places it at R11 + sum(all table sizes) * 4, mirroring the pointer region slot for slot; the runtime/harness copies the section's words verbatim — it never re-derives ids.
• Dispatch (both ISAs — Thumb-2 and A32), inserted between the thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642 bounds guard and the pointer load:

  mov ip, idx, lsl #2 ; add ip, r11, ip ; ldr ip, [ip, #type_off]
  cmp ip, #expected_class_id ; beq ok ; udf
  

  The compare subsumes the call_indirect on a table with null (uninitialized) funcref slots loud-declines — needs sound null-slot lowering (falcon: 20 funcs, the residual after #650) #664 null trap (id 0 never equals an expected id ≥ 1), so heterogeneous dispatches emit null_check: false. Encoding ranges decline loudly (sidecar offset > LDR imm12 4095, class id > 255).
• Homogeneous tables are untouched BY CONSTRUCTION: type_check: None emits zero bytes (the arm backend links only table 0 (R11); call_indirect through table index ≥1 loud-declines — blocks multi-table fused components (falcon: 20 funcs) #650 offset-0 / call_indirect on a table with null (uninitialized) funcref slots loud-declines — needs sound null-slot lowering (falcon: 20 funcs, the residual after #650) #664 null_check: false trick) and no sidecar section is emitted.

Oracles

• New CI-gated differential call_indirect_676_differential.py (Thumb-2 cortex-m3 + A32 cortex-r5): mixed 5-slot table, two signature classes interleaved + a structural-duplicate type + null slots. 28/28 cases: matching-class calls equal wasmtime; wrong-class, null and OOB indices all stop at a UDF; wasmtime's trap reasons are asserted per category (indirect call type mismatch / uninitialized element / undefined element). Non-vacuous red: a build without the check calls the wrong-typed function and returns a wrong value.
• Red on origin/main (capability upgrade): both dispatchers decline with exactly the issue's message; the harness reports SIDECAR MISSING / SYMBOL MISSING → ORACLE: FAIL.
• Byte identity: whole-ELF cmp of the thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642/arm backend links only table 0 (R11); call_indirect through table index ≥1 loud-declines — blocks multi-table fused components (falcon: 20 funcs) #650/call_indirect on a table with null (uninitialized) funcref slots loud-declines — needs sound null-slot lowering (falcon: 20 funcs, the residual after #650) #664 fixtures (cortex-m3 + cortex-r5, --relocatable) against an origin/main-built binary — 6/6 IDENTICAL. Frozen anchors 10/10. Encoder unit tests pin the exact splice (shared prefix/suffix byte-equal, None ≡ pre-call_indirect into a HETEROGENEOUS funcref table (mixed signatures) loud-declines — needs a runtime type-id check; the terminal layer of falcon's dispatch (20 funcs) #676 bytes).
• Object contract in cargo CI (heterogeneous_table_676.rs): heterogeneous fixture compiles with sidecar ids [1, 2, 1, 0, 0] (structural dedup + null id 0) on both targets; the three homogeneous fixtures emit no sidecar section.
• Estimator untouched — verified: CallIndirect is direct-selector-only, excluded from the test(vcr-oracle): estimator↔encoder agreement oracle for the optimized path (#498, #242) #511 estimator↔encoder agreement oracle's covered set; no estimator code changed.
• cargo test --workspace green, cargo fmt --check + cargo clippy --workspace --all-targets -- -D warnings clean; thumb-2: call_indirect emits no bounds-check and no type-check — OOB/wrong-type index does an uncontrolled indirect branch instead of trapping (WASM 4.4.8) #642/arm backend links only table 0 (R11); call_indirect through table index ≥1 loud-declines — blocks multi-table fused components (falcon: 20 funcs) #650/call_indirect on a table with null (uninitialized) funcref slots loud-declines — needs sound null-slot lowering (falcon: 20 funcs, the residual after #650) #664 differentials re-run green on this commit.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 97.09763% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/instruction_selector.rs	95.97%	6 Missing ⚠️
crates/synth-backend/src/arm_encoder.rs	95.87%	4 Missing ⚠️
crates/synth-core/src/wasm_decoder.rs	99.13%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!