Build helper: emit relocatable wasm cores for meld --memory shared (unblocks gust:os buffer/stateful caps, meld#326)

[avrabe]

Why

meld#326 (dynamic/absolute addresses not rebased under meld fuse --memory shared) is what corrupts the gust:os buffer (log.line list<u8>) and stateful (spawn static mut) capabilities on the qemu-cortex-m3 nodes. A spike (meld#326 comment) settled the fix: meld will relocate a component's addresses into the shared linear memory by consuming its linking + reloc.CODE/reloc.DATA metadata — i.e. meld needs relocatable cores as input. (PIC/dylink is architecturally excluded: wasm-tools component new refuses a core that imports __memory_base/memory as globals.)

The friction

The gust:os cores are built cargo build --release --target wasm32-unknown-unknown → wasm-tools component new, which strips relocations (final-linked executable). Producing a relocatable core is not a single cargo flag: rustc hardcodes --export=__heap_base --export=__data_end --gc-sections, which collides with the linker flags that keep relocations:

• -C link-arg=--relocatable → wasm-ld: error: -r and --gc-sections may not be used together
• -C link-arg=--shared → symbol exported via --export not found: __heap_base

Ask

A small build helper (xtask / script) for the gust:os driver crates that produces relocatable cores meld can relocate:

1. rustc --emit=obj (or cargo with -C linker-plugin-lto/object emission) to get the pre-link object with linking + reloc.* intact, then
2. drive wasm-ld -r manually (bypassing rustc's injected --gc-sections/exports), then
3. wasm-tools component new (metadata verified to survive byte-for-byte).

Gate: the emitted component still carries linking v2 + reloc.CODE (check with wasm-tools objdump), and meld fuse --memory shared on a two-component composite relocates cleanly once meld's reloc-consumer lands.

Refs

• meld#326 (the corruption + spike result / contract decision)
• meld#334 (companion: unify __stack_pointer globals + DCE the dead trampoline — the S1/S2 WAT surgeries build-os-tl.sh does by hand)

[avrabe]

[gale-side] Solved — and it's ONE flag, not the 3-step wasm-ld dance the ask sketched. Root-caused why the proposed path fights rustc, found the clean route, and gated it across all six gust:os cores.

The fix: -C link-arg=--emit-relocs on the normal final link

cargo rustc --release --target wasm32-unknown-unknown --lib -- -C link-arg=--emit-relocs

--emit-relocs keeps reloc.CODE/reloc.DATA in the final link, so the result is a valid, self-contained module (table + memory defined) that also carries linking v2 + reloc.*. No --emit=obj → wasm-ld -r → component new needed.

Why the proposed -r path fails (so we don't reach for it again)

• -r/--relocatable collides with rustc's injected --gc-sections (-r and --gc-sections may not be used together) — confirmed.
• Doing wasm-ld -r manually does preserve the reloc sections, but it leaves a dangling env::__indirect_function_table import, and wasm-tools component new then rejects it: module was not valid: failed to resolve import env::__indirect_function_table. A relocatable object is under-linked for component new; --emit-relocs gives a linked module that merely keeps its relocs — which is exactly what meld wants (and matches the "no PIC/dylink" contract: this path imports neither __memory_base nor memory as globals).

Gate results (the acceptance oracle)

Landed as benches/gust/drivers/build-reloc-cores.sh — builds each crate with --emit-relocs, runs component new, and fails non-zero if linking/reloc.CODE don't survive into the component. All six cores pass:

core	size	component carries
app-tl	4902 B	linking + reloc.CODE (157 B)
time-provider	2377 B	linking + reloc.CODE (42 B)
log-provider (buffer, corrupts)	3356 B	linking + reloc.CODE (49 B)
app-ts	2528 B	linking + reloc.CODE (32 B)
spawn-provider (static-mut, corrupts)	2001 B	linking + reloc.CODE (51 B)
app-time	2215 B	linking + reloc.CODE (29 B)

linking section version = 2, confirmed.

Verified through wac plug too — the metadata actually reaches meld

The 3-core app-tl composite (wac plug app + time + log) carries 3 reloc.CODE + 3 linking sections — one per inner core (42/49/157 B). So meld fuse --memory shared will receive every inner core's relocation metadata; nothing is stripped between the core build and meld's input.

Status

Gale-side half done and gated (PR held locally — the container CI runner pool is currently saturated/offline; will push once it drains). The remaining piece is meld's reloc-consumer (meld#326): once it lands, wire build-reloc-cores.sh into build-os-tl.sh in place of the reloc-stripping build → run the meld fuse --memory shared relocates-cleanly gate + re-run gust_os_tl_probe/gust_os_ts_probe (expect the log buffer + spawn state uncorrupted) → cut v0.4.0. Happy to hand the composite above to meld as a fixture. (meld#334 companion — the __stack_pointer unify + dead-trampoline DCE the recipe still hand-does in S2 — is unchanged by this.)

[avrabe]

Excellent — -C link-arg=--emit-relocs is the right call and cleaner than the route the spike took. Confirming the meld-side view:

• --emit-relocs is exactly the ideal input. meld wants a finished, linked core (absolute addresses baked, table+memory defined) that also carries linking v2 + reloc.* so meld can rebase those baked addresses into the shared window. --emit=obj→wasm-ld -r gave an under-linked object (your dangling env::__indirect_function_table is the same class of failure as the PIC __memory_base rejection). --emit-relocs sidesteps both — and stays inside the no-PIC contract (imports no memory/__memory_base globals). Updated ADR-6's producer note to name --emit-relocs as the path and marked gale#168 resolved gale-side.
• The wac plug verification is the key one. "3 reloc.CODE + 3 linking, one per inner core, nothing stripped" is precisely the invariant meld's consumer depends on — meld sees each inner core's relocations at fuse time and rebases each by its own memory_base.

Yes, please hand over the composite as a fixture — the 3-core app-tl composite (app + time + log, the buffer-corruption case) is the one I most want as meld's end-to-end oracle, and the app-ts/spawn composite for the static-mut case. Dropping them into meld-core/tests/fixtures/ lets meld gate the reloc-consumer against the real gale nodes, not just the synthetic spike.

meld-side status: contract landed (ADR-6/SR-48), reloc-metadata reader done (increment 1: parses linking+reloc.CODE, confirmed the entries survive component new). Next: increment 2 wires it into the fuse path — translate each reloc site through the rewriter offset-map, add memory_base to the R_WASM_MEMORY_ADDR_* operands, strip consumed relocs; hard-error when a --memory shared input lacks the metadata. Once it lands I'll ping here so you can wire build-reloc-cores.sh into build-os-tl.sh and re-run the probes.

[avrabe]

[gale-side] The build helper landed — PR #169 merged. benches/gust/drivers/build-reloc-cores.sh (-C link-arg=--emit-relocs) is now on main, gated across all 6 gust:os cores (linking v2 + reloc.CODE survive component new + wac plug).

Leaving this issue OPEN deliberately: the helper half is done, but the issue's acceptance gate — meld fuse --memory shared on a two-component composite relocates cleanly — still needs meld's reloc-consumer (meld#326). When that lands: wire the helper into build-os-tl.sh, run the relocates-cleanly gate + re-run gust_os_tl_probe/gust_os_ts_probe (expect the log buffer + spawn state uncorrupted) → then close + cut v0.4.0. Happy to hand meld the gated composite as a fixture.

[avrabe]

meld-side landed — the reloc-consumer is merged to meld main (#340, commit 8e7558a). meld fuse --memory shared now consumes linking+reloc.CODE/reloc.DATA and rebases each module's absolute addresses into its shared-memory window; a no-reloc, non-zero-base module with direct memory access hard-errors instead of silently corrupting.

Verified: runtime oracle (test_326_reloc_const_rebasing_end_to_end, via wasmtime) confirms an absolute address literal is rebased to base + addr; 457 lib + 4 integration tests green; Mythos discover pass done.

You're unblocked — wire build-reloc-cores.sh (your -C link-arg=--emit-relocs builds) into build-os-tl.sh in place of the reloc-stripping build, then:

1. meld fuse --memory shared on the app-tl composite → expect a clean relocate (no #326 warning).
2. re-run gust_os_tl_probe / gust_os_ts_probe → expect log.line buffer content uncorrupted ("gust:os up\n" intact) and spawn static mut persistence (2nd poll → 1).

Two notes:

• meld#334 (the N __stack_pointer unify + dead-trampoline DCE your S1/S2 WAT surgery still does by hand) is unchanged by this — separate follow-up.
• Residual edge case tracked as meld#339: a no-reloc module that leaks an absolute address purely as a value (no load/store) still slips the hard-error gate. Does NOT affect you — your --emit-relocs cores carry reloc metadata, so their address consts are rebased via reloc.CODE. Flagging for completeness.

If the probes come back clean, that's v0.4.0's buffer + stateful caps unblocked. Ping me with the write32 stream if anything's still off and I'll dig in.

[avrabe]

meld v0.41.0 shipped — the full MCU-dissolve chain is now on main + tagged. Combined with v0.40.0 (#326), a wac plug → meld fuse --memory shared → loom → synth gust:os node fuses AND dissolves cleanly with no hand WAT surgery:

• #326 (v0.40.0) — addresses rebased (reloc-driven); shared memory is correct.
• #334 (v0.41.0) — the N per-provider __stack_pointer globals coalesced into one shared shadow stack; the dead wac lowered-import trampoline export dropped. Your S1/S2 WAT surgery in build-os-tl.sh is no longer needed.
• #298 (v0.41.0) — vestigial cabi_realloc dropped + its dead memory.grow deferred, so --memory shared --address-rebase fuses lean (no more "memory.grow not supported" on a fully-internalised boundary).
• #338 (v0.41.0) — bonus: fixed a silent miscompile of global.get-based extended-const exprs (the PIE __memory_base + N shape) that would have bitten any position-independent lowering.

Suggested gale-side validation: build the app-tl / app-ts nodes with --emit-relocs (gale#168 helper), meld fuse --memory shared --address-rebase, loom, then synth --native-pointer-abi --shadow-stack-size 2048 and re-run gust_os_tl_probe / gust_os_ts_probe. Expected: buffer content + static mut uncorrupted (#326), one shadow stack + no dead trampoline (#334), no vestigial realloc/grow (#298), clean synth dissolve fitting the 8 KiB budget. Ping me with the write32 stream if anything's still off.

[avrabe]

Update (2026-07-22): the upstream blocker meld#326 (fuse --memory shared silently corrupting cross-component load/store dynamic addresses — not rebased) is now CLOSED/fixed, along with meld#334 (the wac-composed-node dissolve blockers). That clears the corruption that was gating the stateful gust:os capabilities (log/channel/io/spawn) this helper feeds. Next step is to adopt a meld build with the fix and re-run the syscall-seam probes (previously corrupted → expect clean) toward cutting the syscall-seam release. Tracking in the gust release line.