fix(#851): home written parameters on aarch64 — and fix the conditional-param-write silent miscompile

[avrabe]

Closes the aarch64 local.set/local.tee-on-a-parameter decline by HOMING written params — and fixes a silent miscompile found while writing the fixture.

Two changes

1. Param homing (the requested capability). crates/synth-backend-aarch64/src/selector.rs widens the homing predicate from is_non_leaf && references_param to (is_non_leaf && references_param) || writes_param. A written param gets an 8-byte home slot filled from its argument register in the prologue; local.get loads a fresh copy, so a param write cannot alias a stacked value — the exact hazard the old decline guarded. writes_param ⊆ references_param, so exactly one class changes: leaf functions that write a param, all of which declined before. Non-leaf homing is byte-identical. The now-unreachable decline arms are kept as loud internal-invariant errors rather than deleted.

2. A silent miscompile in backend.rs (not in the original scope). num_params was min(count_params(ops), declared), and count_params counts only indices read before written in linear op order. A param written before it is read — but only conditionally — was demoted to a zero-init non-param local and compiled wrong instead of declining. Now min(highest REFERENCED index + 1, declared); the min preserves the >8-declared-params leniency that plain declared would have broken (verified: a hard num_params > 8 guard sits above the indexing, so plain declared would turn a lenient compile into a decline).

Evidence

Negative control — the most important artifact here. Reverting only the referenced_locals line and rebuilding:

BUG cond_write_param('0x0', '0x2a'): wasmtime=42 unicorn=0 native=0
BUG cond_write_param('0x0', '0xffffffff'): wasmtime=-1 unicorn=0 native=0
BUG cond_write_param('0x0', '0x2a') [poisoned upper halves]: wasmtime=42 unicorn=0
41/44 cases matched wasmtime — RESULT: FAIL (3)

All three failures are cond_write_param, the exact shape the fix guards; the other 41 stay green, so the control is specific rather than a blanket break. They are miscompiles, not declines — which is the point: a decline-matrix probe could never have caught this, only an execution oracle. Both oracles (unicorn and the native arm64 MAP_JIT path) agree on the wrong value. Restored, and back to 44/44.

Pre-edit RED on both gates (captured before touching them — each gate self-reds, no new assertion needed):

• cross_backend_op_parity.rs flagged both entries stale by its own check:
  local.set+get(param) — ledgered as an ARM/aarch64 divergence but both now agree (arm_ok=true, aarch64_ok=true); delete the entry (same for local.tee(param)).
• aarch64_m2_decline_538.py printed BUG local.set on a param: compiled — expected a LOUD decline → RESULT: FAIL (1 silent).

Both are green after the ledger edits.

Ledger, decline honesty, and floors

Deleted the two stale parity entries; "leaving the FOUR below" is now TWO (both halves of bulk memory). Removed the closed local.set on a param decline entry.

The FLOAT-param decline MOVED rather than disappeared. Homing on writes_param makes a leaf function that writes a param hit the float check too, so a declared float param now declines from a second direction. Added as its own decline-probe entry and a unit test, both asserting the FLOAT parameter machine reason. The old label ("homing needs an FP store") was false — the encoder has str s/d since v0.54 L2; the real reason is that the home-slot model is single-register-file. Corrected in the probe, the selector message, and the module doc.

Three floors were vacuous — each tolerated a large silent regression. Raised to measured values:

gate	old	new
aarch64 parity leg (at_parity)	60	108
decline matrix	12	14
matrix accepted ops	32	61

The old parity floor was ~half the real count, so the entire param-write class could have regressed to a decline unnoticed. Caveat: the matrix floor was measured locally by running the script (61 accepted, 355 checks, PASS, empty declined frontier), but the CI-side sed extraction around it is unchanged and not exercised locally.

Also wires aarch64_param_homing_851_differential.py into CI — it was marked ci-status: wired but had no step — and corrects a stale comment block in selector.rs that still read "params stay read-only, see the LocalSet/LocalTee decline below".

Decline list re-verified, not assumed

I removed call_indirect and "reading own params across a call" from the selector module doc's decline list. Both verified by compiling the shapes (exit 0 each), not by inspection.

Residual

The None branch of current_func_param_count still uses the unsound count_params heuristic. Unreachable from the CLI — func_arg_counts is populated for every function index (imports first, then local), so .get(func.index) is always Some — but the direct compile_function API can still reach it. Documented at the function; not fixed here.

Related finding — filed separately as #970

The same count_params(ops).min(declared) shape exists in ARM (arm_backend.rs:393) and RISC-V (effective_num_params). RISC-V is confirmed broken by execution: on the fall-through path it reads an uninitialised stack slot (returns the 0xDEADBEEF poison under unicorn), which is an information-disclosure shape on top of the miscompile — worse than the aarch64 instance, which returned a deterministic 0. ARM is incidentally correct on the simple shape and miscompiles once the param register is clobbered by a call. Not fixed here — each backend has a different local/slot model and needs its own differential.

Gates

• cargo test --workspace — exit 0, 2909 tests, 0 failures (re-run without a pipe; the earlier ambiguous result was tail's exit code, not cargo's)
• cargo clippy --workspace --all-targets -- -D warnings — exit 0, no warnings
• cargo fmt --check — exit 0
• python3 scripts/claim_check.py claims.yaml — 43/43
• param-homing differential — 44/44, unicorn + native arm64
• decline matrix — 14/14
• aarch64 matrix — 61 ops, 355 checks, PASS, empty declined frontier

Base is current with origin/main (merged eea92e11, #967).

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 89.39394% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-backend-aarch64/src/selector.rs	89.09%	6 Missing ⚠️
crates/synth-backend-aarch64/src/backend.rs	90.90%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!