fix(decoder): float-typed global accesses loud-skip — the last silent float path (GI-FPU-001, #369)

[avrabe]

Closes the last silent-float gap of GI-FPU-001 (#369; the #619 frontier survey). jess tracks the arc as AFD-024.

Where GI-FPU-001 stood on main (verified per backend, v0.33.1)

PR #371 (decode loud-skip) + PR #556 (#554 single-function bail) already made every scalar float op loud. Verified on origin/main with a 12-module matrix (arith f32/f64, compares, trunc/convert, load/store, const, both reinterprets, float local, float global) × (ARM default, ARM --relocatable/direct, -b riscv, -b aarch64):

• f32/f64 arithmetic, compares, converts, loads/stores, const, reinterprets — all loud on all four paths: warning: skipping function 'f': contains an unsupported operator (F32Add) … / single-function Error: … refusing to emit a silent miscompile.
• Float locals/params without float ops — compile as pure 4/8-byte bit moves (bit-correct; f64 params ride the Arg-register lowering drops/shifts the first arg for calls with 5 args + struct(sret) return (cortex-m4f, --native-pointer-abi) #359 pair machinery). Deliberately not flagged.
• Float-typed GLOBALS — the remaining silent wrong-value path (ARM, both paths):

(module (global $g f32 (f32.const 2.5))
        (func (export "f") (result f32) (global.get $g)))

	origin/main	this PR
ARM default (-t cortex-m4f)	rc=0, silent — 0x40200000 (2.5f) absent from the ELF, read returns 0.0; wasmtime: 2.5	loud-skip naming GlobalGet(0) … (GI-FPU-001)
ARM --relocatable (direct)	rc=0, silent, same	loud-skip, same diagnostic
-b riscv / -b aarch64	loud only by accident (GlobalGet itself is unsupported there)	loud at decode, uniformly

Root cause: global.get/global.set are type-agnostic ops that decode fine, but init_i32 only captures a leading i32.const — an f32.const/f64.const initializer records None and the slot is zeroed (init_i32.unwrap_or(0)).

Fix

Both decode entry points (decode_wasm_module + the lighter decode_wasm_functions — the CLI compiles through both) track f32/f64-typed globals in the full index space (imported globals first) and flag any function whose GlobalGet/GlobalSet touches one, routing it through the existing #371/#556 loud-skip / honest-bail machinery. The two CLI diagnostics now also name GI-FPU-001 explicitly.

Oracles

1. New decoder tests (red on origin/main): float-global get/set flags the function with a reason naming the op + GI-FPU-001; imported f64 global shifts the index space correctly; i32-global accesses stay unflagged. Existing arm backend uses soft-float for all f32/f64 — hardware FPU never used (cortex-m4f/m7/m7dp identical); blocks REQ-PIX-001 hard-float #369/-b aarch64 silently miscompiles f32 ops (emits 'mov w0,w1' / drops constants) instead of erroring like other unsupported milestone-1 ops #554 loud-skip tests untouched and green.
2. Frozen anchors 10/10 byte-identical (frozen_codegen_bytes); the only float fixture in-tree is the -b aarch64 silently miscompiles f32 ops (emits 'mov w0,w1' / drops constants) instead of erroring like other unsupported milestone-1 ops #554 loud-skip repro.
3. cargo test --workspace rc=0 (106 suites, 0 failures), cargo fmt --check clean, cargo clippy --workspace --all-targets -- -D warnings rc=0.

Sibling finding (out of scope, filing separately)

(global i64 (i64.const 4886718345)) + global.get is also silently zeroed — same init_i32-only mechanism, integer class (#643 landed pair get/set but not non-i32 initializers). Tracked in a follow-up issue.

What GI-FPU-002 (real VFP, #619) will need

• Decode: scalar f32.*/f64.* arms in convert_operator (+ WasmOp float variants beyond the dead prototypes), float const payload capture, and float global-init capture (un-flagging the accesses this PR flags).
• Select/allocate: VFP lowering in select_with_stack (S0–S15/D0–D15 register class alongside the integer allocator; the existing f32_vfp_encoding_test/f64_vfp_encoding_test encoder is ready), FPU gating per target (m4f=fpv4-sp, m7=fpv5-sp, m7dp=fpv5-d16; honest reject on M0/M3 stays).
• ABI/metadata: AAPCS-VFP arg passing decision + Tag_FP_arch/Tag_ABI_VFP_args build attributes so the mode is verifiable from the artifact (arm backend uses soft-float for all f32/f64 — hardware FPU never used (cortex-m4f/m7/m7dp identical); blocks REQ-PIX-001 hard-float #369's ask).
• Oracle: qemu mps2-an386 hard-float semihosting differential (Make VFP f32/f64 reachable on the thumb-2 CLI path (Cortex-M4F) — encoder exists but decoder drops float ops; the M4F float frontier vs the new Cranelift arm32 backend #619 offers the probe) + falcon-v1.56 numeric gate.

Refs #369, #619, #554.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 88.18182% with 13 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-core/src/wasm_decoder.rs	88.18%	13 Missing ⚠️

📢 Thoughts on this report? Let us know!