feat(#406): multi-memory phase 1 — N wasm memories to N distinct native base regions (VCR-MEM-002)

[avrabe]

VCR-MEM-002 phase 1 (#406, epic #242): N wasm memories → N distinct native base regions

The meld#300 multi-memory structural-isolation model needs synth to stop dropping the memarg memory index. Pre-#406, every load/store lowered onto the ONE R11 base — a store to memory 1 silently clobbered memory 0, memory k's init data was silently dropped, and memory.size/grow on memory k read memory 0's state.

What ships

• Honest memidx threading: the decoder wraps any load/store whose memarg targets memory k > 0 in WasmOp::MultiMemory { memory, op } (memory-0 ops stay the bare variants — every existing match arm and frozen byte untouched by construction), with a mirror-pinned memarg_memory_index helper covering exactly convert_operator's memarg arms.
• Per-memory base regions (--relocatable): memory 0 keeps the runtime R11 base (and __synth_wasm_data under the native-pointer ABI — frozen-safe); memory k > 0 is addressed via its own __synth_wasm_data_<k> symbol (R_ARM_ABS32 literal pool, the dissolved --relocatable objects carry full wasm linmem (64KB .data) + absolute MOVW relocs — MCU-unshippable + link-fragile (gale mutex silicon fault) #345 link-survivable form) defined at the base of a per-memory .synth.wasm_mem_<k> reservation section — PROGBITS with init segments placed (previously silently dropped), NOBITS when pure zero-init.
• Per-memory memory.size/grow: memory 0 unchanged (R10); memory k's size is the declared constant (grow is always -1 on this backend, so initial == size), grow(k) validates the context then emits the fixed-memory -1.
• Phase-1 scope: the i32 access family (i32.load/store + 8/16 sign/zero variants) on memory k. Wider/float accesses, --safety-bounds on memory k, and cross-/non-default memory.copy/fill decline loudly, typed and precise — never a silent alias.

Capability matrix (all pinned by crates/synth-cli/tests/multi_memory_406.rs, 13/13)

shape	verdict
2 memories, ARM --relocatable	GREEN (execution differential, 29/29)
3 memories, ARM --relocatable	GREEN (generic over K; NOBITS + PROGBITS)
multi-memory, no --relocatable / self-contained --cortex-m	refuse (one R11 base)
multi-memory × --native-pointer-abi	refuse (static-region classification is memory-0-only)
multi-memory × --shadow-stack-size	refuse (shrinks memory 0's geometry)
multi-memory on riscv / aarch64	refuse (no per-memory base lowering)
cross-memory memory.copy / non-default memory.fill	loud-skip naming the op
i64/f32/f64 access on memory k > 0	loud-skip naming the phase-1 scope
non-const data-segment offset on memory k / segment overflowing memory k	refuse at decode / emit

Defense in depth: select_default and the optimized path (optimizer_bridge) decline MultiMemory + non-zero memory.size/grow explicitly, so no path can fall back into aliasing.

Evidence

• Differential oracle (CI-wired): scripts/repro/multi_memory_406_differential.py + mem406_multi_memory.wat — compiles --relocatable, maps the two memories at DISTINCT unicorn bases (0x200000 R11 / 0x400000 symbol-patched, far apart so residual aliasing faults rather than accidentally passing), 29/29 vs wasmtime multi-memory: store-both aliasing discriminators, memory-1 init-data peeks, sub-word round-trips, per-memory size/grow. Structural pins: __synth_wasm_data_1 DEFINED, .synth.wasm_mem_1 == 3 pages with segment placed, ≥1 memory-1 reloc, all in-range.
• Red-first: the same oracle exits 1 on origin/main (the object has no per-memory region — the silent-aliasing shape).
• Single-memory byte-identity: frozen codegen byte gate 10/10 green; memory_pages/the new ELF params are empty for every single-memory module by construction.
• fix(#746): i64/wide static-region loads/stores get the #744 relocation treatment #747 composition: wide_static_746_differential.py untouched and green in the four-crate sweep context (25/25 lives in its CI job); the memidx threading wraps at decode, upstream of the fix(#739): static ABOVE sp_init — relocate (never bake) + de-vacuate the in-range oracle #744/#739 residual: i64/wide static-region load not relocated under --shadow-stack-size (sub-word fixed in #744, wide arm declines) #746 static-region arms.
• fmt clean, clippy -D warnings clean, synth-core/-synthesis/-backend/-cli suites 90/90 green.

Refs #406, #242 (VCR-MEM-002 phase 1). Phase 2+ (self-contained MPU/PMP regions, cross-memory bulk ops, wide accesses) stays on the roadmap artifact.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 83.25688% with 73 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/instruction_selector.rs	74.42%	56 Missing ⚠️
crates/synth-synthesis/src/optimizer_bridge.rs	47.05%	9 Missing ⚠️
crates/synth-cli/src/main.rs	96.49%	4 Missing ⚠️
crates/synth-core/src/wasm_decoder.rs	95.06%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!