fix(rate): bounded arena instead of a growing allocator — remove memory.grow

[avrabe]

The problem my own v1.130 fix introduced

Making falcon-rate encode as a real component required satisfying cabi_realloc, and I did it with lol_alloc — a growing allocator, which emits memory.grow. Disassembling the shipped falcon-rate:1.130.0 confirms it: the module's only memory.grow sits inside lol_alloc.

Per gale#89 and meld#299, that is exactly what makes meld fuse --memory shared --address-rebase reject a component:

unsupported component feature: memory.grow not supported with address rebasing

So the fix that unblocked componentization partly re-blocked the MCU lowering it exists to serve.

The fix

A bounded bump arena: fixed 8 KiB store, exhaustion traps rather than growing, frees are no-ops, cursor resets at the top of each tick.

Sizing isn't arbitrary. The ABI only allocates here for the spilled parameter area: vehicle-state (14 f32) + rate-setpoint (4 f32) = 18 flat params exceeds the canonical MAX_FLAT_PARAMS (16), so the host writes arguments into our memory. Verified in the binary — the core export is (param i32) (result i32), a pointer, not 18 floats. A few hundred bytes per call; 8 KiB is ample.

That same spill rules out the alternative fix: wit-bindgen's disable_cabi_realloc (#6) elides the export only for genuinely flat worlds. Rate's params spill, so it needs realloc. The arena is the applicable answer, not elision.

Interim — deliberately

The end state is not a per-component arena. It's wit-bindgen's cabi-realloc-extern (pulseengine/wit-bindgen#4) delegating to gale's __cabi_arena_realloc — one embedder-owned arena across the fused image. A private arena per component multiplies by N once meld fuses the cascade.

This lands now because on the non-fork path no_std still requires a #[global_allocator] (wit-bindgen-rt's cabi_realloc goes through alloc::alloc), so today's real choice is which allocator — and a non-growing one is strictly better. Superseded, not made pointless, by wiring the fork.

Verified

	before	after
memory.grow	1	0
valid component	✅	✅ 0061736d0d000100
wasi:* imports	0	0
size	4,674 B	3,883 B

Closed-loop proof unchanged over 3000 ticks — converges 0.193 s, |err| 0.0059 rad/s — which also exercises the per-tick arena reset under sustained use.

Refs: gale#89, meld#299, pulseengine/wit-bindgen#4.

🤖 Generated with Claude Code