fix(#931): reconcile RV32 br exit edges onto the block's result register (CRITICAL)

[avrabe]

The bug

br out of a value-producing block discarded its value on RV32. The branch
computed into one register; the merge read a different one — the fallthrough
register. So the block yielded the not-taken path's value. synth compile
exited 0 with no warning.

(block $exit (result i32) (br $exit (i32.const 1)) (i32.const 0))

wasmtime → 1. RV32 → 0.

This is the most basic form of structured control flow carrying a value, so the
blast radius covers block, switch-style dispatch and label shadowing alike
(8 labels.wast assertions). Found by executing the official testsuite (#928).

Root cause

lower_br emitted a bare jal and moved nothing — and br does not pop. The
branch's value stayed on the vstack, so the fallthrough expression allocated a
different register to avoid the live one, and the merge read that one. The
stale vstack entry is the miscompile.

#343 already built this exact join for if/else arms (then_results /
reconcile_if_result). It was simply never applied to br edges. br_table's
own doc comment records that "plain Br/BrIf share the underlying
limitation" — br_table LOUD-DECLINES it, br shipped silent.

Fix

Every exit edge reconciles onto the frame's canonical result registers
(ControlFrame::br_results), and lower_br truncates the vstack to the
target's checkpoint so the fallthrough's own results are identifiable at end.

The fallthrough's moves are emitted before end_label, so they sit on the
fallthrough path only and the taken edge jumps over them — the same argument
#343 relies on. The first edge donates its own register where it safely can, so
the common single-br block emits no move at all.

Arity is the vstack delta above the frame checkpoint, so no block-type threading
(#509) is needed — the same delta br_table already uses. Edges that disagree
on arity LOUD-DECLINE rather than emit a half-reconciled join.

live_regs now also reserves open frames' br_results: after truncation the
canonical register is pinned by no vstack entry, and the fallthrough would
otherwise hand it straight back out as scratch.

Evidence — red-first, executed

scripts/repro/rv32_br_value_931_differential.py, CI-wired: 17 vectors run
under unicorn (RV32 ILP32) and compared against wasmtime.

	result
pre-fix	9/17 FAIL
post-fix	17/17 PASS

Pre-fix failures are not all obvious: br64 returned 0x900000004 instead of
0x900000005 (subtly wrong i64, not visibly broken), carried returned 1
instead of 6, outer returned 0 instead of 42.

Vectors cover both edges of each shape — a fix that reconciled only one
direction would pass a single-edge vector: br_if taken/not-taken, two
value-carrying edges into one frame, i64 (both halves), a value live across
the block, arity-0 br, br 1 to an outer frame, and #930's nested shape
(correct on RV32 today by luck — pinned so it stays correct rather than lucky).

• Frozen anchors 10/10 byte-identical (--test frozen_codegen_bytes)
• cargo clippy --workspace --all-targets -- -D warnings → exit 0, 0 diagnostics
• cargo test -p synth-backend-riscv → 257 passed, 0 failed

Two doc-vs-source defects found in the touched code

1. live_regs claimed "locals/params are always copied into a fresh temp by
   lower_local_get". False — lower_local_get aliases a Port the ARM perf levers (cmp→select, local-promotion, imm-shift-fold) to the RISC-V backend — RV dissolved code is now behind ARM (2.12× vs 1.66× on silicon) #472-promoted
   local's s-register directly onto the vstack. Corrected.

2. That aliasing is justified by "any op consuming this value allocates a fresh
   dst, so the s-reg is never clobbered by a consumer" — an argument that does
   not cover a br edge, which writes back into its operand at end.
   Donating a promoted local's register would clobber the local itself.

   What blocks it today is a rule in a different pass: promotion requires
   all_depth0, and br exists only at depth ≥ 1.
   canonicalize_edge_value guards it locally rather than borrowing soundness
   from that rule, and promotion_stays_depth0_or_931_guard_goes_live pins the
   coupling so relaxing all_depth0 reports here instead of silently
   miscompiling.

Not in scope

#930 (the thumb-2 sibling) is not fixed here. ARM has two codegen paths
(select_default vs select_with_stack, and --relocatable forces the direct
selector), so it needs its own red-first measurement to establish which path
is wrong. Separate PR — bundling it would make any frozen-byte movement
ambiguous to bisect.

Refs #931, #928

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[avrabe]

The chore: commit in this PR also un-reds main

main has been failing VCR-VER-004 instrument independence since 3eec0d37
(the wit-component 0.254→0.255 bump). Not a required context, so nothing was
blocked — but the cause is worth naming, because the oracle is fine and the
cleanup assertion is what fails:

OK   (1) validate_cfg_rewrite ACCEPTS the mutated rewrite
OK   (3) VCR-VER-004 REJECTS: result register R0 holds a different value ...
RESULT: PASS — the v0.53 mutation is now caught STATICALLY
##[group]Run git diff --exit-code
##[error]Process completed with exit code 1

The job asserts the mutation never persists, via git diff --exit-code. The
mutation was restored. What dirties the tree is Cargo.lock: the bump
changed the manifest but left an orphaned wasm-encoder 0.254.0 entry, so the
job's first cargo invocation regenerates the lock and the tree is no longer
clean.

Reproduced on a pristine origin/main worktree — clean before, and one
cargo metadata is enough:

before:  (clean)
after:   M Cargo.lock
         1 file changed, 21 deletions(-)

That is exactly the 21 lines the chore: commit here removes, so landing this
PR should restore that job. Worth watching on the next main run rather than
assuming.

It also makes #924's case concretely: the Version Pin Sweep does not gate
Cargo.lock, so a manifest bump can leave the lock stale, and the symptom
surfaces two commits later in an unrelated job's cleanup step.

[codecov]

Codecov Report

❌ Patch coverage is 75.47170% with 39 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-backend-riscv/src/selector.rs	75.47%	39 Missing ⚠️

📢 Thoughts on this report? Let us know!