v0.36.0 — unreachable traps, sparse tables, 40 verified rules, 81 bridge Qed

unreachable finally traps (it was decode-dropped as an 'intentional no-op' on every backend); RV32 rem_s stops over-trapping; sparse funcref tables dispatch with null-slot traps (falcon's dispatch story complete); the verified selector DSL reaches 40 rules; the Sail/ASL bridge reaches 81 Qed and caught two latent bugs in our own hand-written model; post-exhaustion spill quality halves-to-reverses the VER-gate regressions.

Fixed

• WASM unreachable was a no-op on thumb-2 AND rv32 (#665, PR #668) — one decode drop (whitelisted next to Nop); every backend's trap arm was dead code. 5 red → green.
• RV32 i32.rem_s(INT_MIN,-1) spuriously trapped (#666, PR #668) — rem_s inherited div_s's overflow guard; #633 twin-pins now on RV32.

Added

• Null-funcref-slot call_indirect (#664, PR #669) — sparse tables dispatch; null slots trap; fully-initialized tables whole-ELF byte-identical (24/24).
• VCR-SEL-001 inc-4 (PR #670): 40 rules / 40 Qed + the DSL-coverage metric (26% served / 62% model-only / 12% unverified — #73 retires by measurable subtraction).
• VCR-ISA-001 round 2 (PR #671): SailArmBridge.v → 81 Qed; found two latent hand-model divergences from ARM's ASL; VCR-ISA-001 → approved.

Changed

• Post-exhaustion code quality (PR #672): spill_rung +32.4%→+8.8%, two fixtures now BEAT the decline path; residual = the Track-A allocator replacement itself. Flip stays held.

Platform binaries attach ~10 min after the tag.

🤖 Generated with Claude Code