RQ-62-TABLEDANGLE (#1102 residual): refuse a funcref table naming a DECLINED function on the host-linked paths

[avrabe]

RQ-62-TABLEDANGLE — the funcref-table residual of #1102

Refs #1102

#1102's gate matches direct-call relocation index labels, which is complete for
direct calls (verified in #1116). An elem segment naming a declined function
puts it in the table with no direct call site, so no relocation carries its
index label and the gate sees nothing.

Red-first, measured per backend (unfixed binary, main @ b552fb4)

Fixture: a dynamic-index call_indirect over (elem $good $bad) where
$bad declines on every backend (decoder-marked v128 op). The dynamic index
matters: with i32.const 0 the ARM relocatable path folds the dispatch into a
direct call and the table never materializes.

path	exit	object	dangling UNDEF	link (arm-none-eabi-ld / builder)
ARM Thumb-2 --relocatable	0	ships	none	links CLEAN — R11 table region is embedder-populated; the declined function's code+symbol are in NO object, so slot 1 is unpopulatable. THE LIVE HOLE.
A32 cortex-r5 --relocatable	0	ships	none	identical shape
ARM --cortex-m self-contained	1	none	n/a	already refuses: #275 broken-dispatch-table bail (slot-precise, test-pinned)
RV32 (esp32c3 / rv32imac)	1	none	n/a	call_indirect itself loud-declines → export skipped → #952
aarch64	1	none	n/a	substrate table's b func_N trampoline hits the ELF builder's #851/#1013 refusal

Note the table shape differs from #1102's direct-call shape: the object is NOT
unlinkable — it links clean, and the defect is a live dispatch table slot whose
function exists in no object anywhere. Same class (exit 0 for a module-defined
function synth silently dropped), different symptom.

The fix

One driver-level gate beside the #1102 one (the site where skipped_funcs,
compiled_funcs and the decoded funcref slots already meet for all four
backends): a RETAINED function performing call_indirect plus a funcref slot
naming a skipped function refuses the compile, naming the dead slot(s).

• Not a widened index-label match — the gate keys on the decoded
  funcref-slot image (funcref_region_slots) and the wasm op stream; the fix(#1040): A32 BL sites carry R_ARM_CALL with a -8 addend — a real linker turned the pre-fix call into a plain branch to garbage #1116
  completeness claim is neither reused nor extended.
• Stands down on the self-contained path, whose image builder's arm backend compiles only exports, not the reachable call graph - blocks self-contained firmware #275 bail is
  slot-precise and pinned by call_indirect_275_selfcontained.rs — no pinned
  message changes.
• On aarch64 it fires before the ELF builder; the builder's aarch64 backend completeness: execution-verified capability map + remaining gaps (memory, non-param locals, calls, if/loop/return, div/rem, popcnt) #851 refusal stays
  as defense-in-depth (the same layering as the direct-call class).
• Scoped to a retained dispatch: a skipped elem target in a module whose
  compiled code never dispatches stays a routine partial-object skip.
• Not waived by --allow-skipped-exports — that flag accepts a PARTIAL
  object, not one whose dispatch table cannot be populated (the rv32: a retained function relocating against a declined INTERNAL emits a dangling synth_func_N and exits 0 — the #851 guard #1013 gave aarch64 is not on the RISC-V path #1102 reason).

Controls

• All-good table module: exit 0 on ARM-rel / aarch64 / self-contained,
  unchanged.
• Declined function outside the table + retained dispatch: gate does not fire.
• RV32 leg pinned bidirectionally: if RV32 ever gains call_indirect, the
  test goes red and forces the table-dangle question to be re-answered there
  rather than silently inheriting coverage (rv32: a retained function relocating against a declined INTERNAL emits a dangling synth_func_N and exits 0 — the #851 guard #1013 gave aarch64 is not on the RISC-V path #1102's own history on this).
• Sweep-shape control: all 171 scripts/repro fixtures compiled under the
  arm_corpus_sweep_973 leg (cortex-m4f --relocatable --all-exports --embedder-*) — 0 hit the new gate, so EXPECTED_DECLINES is untouched
  and no corpus acceptance flips.

Gates

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --features riscv
• python3 scripts/claim_check.py claims.yaml, scripts/status_evidence_check.py
• New test: crates/synth-cli/tests/tabledangle_1102_elem.rs (8 legs)

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!