verify(oci): record the EXTENT half — .bss was invisible, not just relocs missing

[avrabe]

Verify-Filter: (has-tag "oci")

Follow-up to #352. Code-free — records what measuring meld's question turned up, which is larger than the relocation gap it started from.

meld asked relay a direct question

is relay's bounded arena in .bss (zero-init) or in a data segment, and how big per component? … I'd rather have the answer than have meld build a differential oracle against my guess

Answer: 8 KiB per component, in .bss.

Measuring it found a second, worse gap

falcon-mixer, published 1.133.0 vs the same component rebuilt with the flag:

	published 1.133.0	with --emit-relocs
data segments	1 (.rodata only)	2
.rodata	76 B, end 1048652	same
.bss	ABSENT (implicit zero-init)	base 1048656, len 8225, end 1056881
linking section	absent	present, 938 B
__heap_base / __data_end	absent	present

The published components exposed their static end by neither route. A consumer packing by data-segment-end reserves 76 bytes for a component whose static memory ends 8,229 bytes later — silent collision, no error, no trap.

That is a worse failure mode than the relocation rejection, because the relocation path at least refuses loudly.

Two corollaries that contradict a reasonable assumption

1. wasm-tools component new does not unconditionally strip the linking section. meld concluded it does — but inferred that from rate.wasm 1.133.0, built without --emit-relocs, so there was nothing to retain. When the section exists, it survives. Their intended no-export fallback (read __heap_base from the linking symbol table) is available.
2. --emit-relocs also materialises .bss as an explicit zero-filled segment, so the static end is readable two independent ways that should agree.

Consequence: what was relayed as two separate supplier-side build changes — --emit-relocs for rebasing, plus retain linking/__heap_base for the extent — appears to be one flag, already merged in #352.

Confirmed on a second component

falcon-rate: 3 linking+reloc sections, __heap_base and __data_end present, memory.grow 0, wasi:* 0. It also carries a .data segment where mixer does not, so the three-segment case is covered — this is the build path, not one crate.

Criteria extended

OCI-P05 (a) now requires more than relocations: the component must also expose its true static end, by both routes, and they must agree. Relocations give the rebasing; the extent is what meld packs against.

Still implemented, not verified

Readable extent is not acceptance. meld has not fused it. v1.133 is the precedent — removing one blocker revealed a second, entirely different one, and a third remains possible.

Answered on pulseengine/meld#370 and pulseengine/jess#167.

Evidence: pinned rivet v0.19.0 validate PASS exit 0 (not local 0.28 — they disagree, 109 vs 354 warnings); gate (has-tag "oci") 7 steps PASS, 0 FAIL.

🤖 Generated with Claude Code