test(e2e): golden behavioural-equivalence harness (Tier A + B)

[avrabe]

Answers "how do I know it really works" with a differential end-to-end test of meld's central claim — fusion preserves observable behaviour:

1. Run a real component unfused under deterministic wasmtime → that result is the golden (no hand-authored expected values).
2. meld fuse it.
3. Run the fused output the same way.
4. Assert identical observable behaviour (run-ok + stdout / typed return).

Tier A — active, green (12 checks)

Single-component round-trip equivalence over the wit-bindgen ABI fixtures and real cross-language command components (hello_rust / hello_c_cli / hello_cpp_cli), both memory strategies. The hello_* cases assert byte-identical stdout — a real behavioural diff, not just "didn't trap." SharedMemory+rebasing correctly declines memory.grow fixtures (logged skip — meld refusing is not a divergence).

Tier B — discovery oracle (#[ignore] on #212)

Fuses a real two-component composition built offline with wasm-tools + wac (compose/build.sh): consumer.runner.compute() calls provider.add(20,22) = 42. The body asserts the meld-fused output computes 42 standalone — the acceptance test for #212, un-ignore when it lands.

Building Tier B surfaced three real multi-component fusion gaps (filed as #212):

1. Separate-input cross-component interface links are not internalised (fused output still imports the dependency).
2. wac-composed inputs lose their top-level export (empty world root {}).
3. Bare world-level func exports drop their result type → invalid component.

Tier A proves real wit-bindgen compositions fuse + run with identical behaviour today; Tier B marks the boundary of what multi-component fusion doesn't yet handle.

Honest boundary

Equivalence is proven under wasmtime (the reference runtime), not the synth/kiln MCU target — a module passing here can still break after synth transcodes it. That cross-repo hardware smoke is tracked separately (owner: you).

Fixtures are committed (*.wasm is gitignored; force-added like the existing fixtures) and regenerable via compose/build.sh.

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

⚠️ 36/38 verified — 2 missing regression tests

	count
Passed (≥1 test, all green)	36
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	2

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

• LS-R-13
• LS-M-6

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}