fuse: pass through embedder import `cabi-arena-realloc` instead of trying to satisfy it

[avrabe]

Context

BYO-OS lean-MCU dissolve pipeline (gale#89):

gale app + kernel-primitive components
  → meld fuse --memory shared
  → loom → synth (native ELF, no memory.grow)

Grow-free components (forked wit-bindgen cabi-realloc-extern, pulseengine/wit-bindgen#4) route cabi_realloc to an embedder-provided env::__cabi_arena_realloc, satisfied at native link / synth dissolve — not by the component model.

What wasm-tools now produces (contract)

pulseengine/wasm-tools#2 adds component new --import-passthrough env::__cabi_arena_realloc, which emits a valid component carrying a world-root import:

world root {
  import cabi-arena-realloc: func(p0: u32, p1: u32, p2: u32, p3: u32) -> u32;
  export greet: func() -> string;
}

(extern name = kebab_case(core_field_name); __cabi_arena_realloc → cabi-arena-realloc. Internally it's canon lowered and wired to the core module's env::__cabi_arena_realloc.)

This import is embedder-provided — meant to survive down to synth, not be resolved during fusion.

Ask (meld)

When fusing components — especially fuse --memory shared (meld#298/#300) — recognize this embedder import and pass it through to the fused artifact unsatisfied:

• do not error that the import is unresolved;
• do not attempt to map it to a provider component in the fusion set;
• preserve it (by extern name cabi-arena-realloc, or as the underlying env::__cabi_arena_realloc core import if meld emits a core module) so synth can bind it at dissolve (see synth#418).

Open question for us to settle across meld/synth/wasm-tools: how meld should mark "this is embedder-provided, leave it alone." Options: match on the well-known name cabi-arena-realloc, or introduce a dedicated namespaced interface (e.g. an embedder ABI interface) that wasm-tools emits instead of a bare world-root func. The wasm-tools fork currently emits the bare kebab name; happy to switch to a namespaced interface if meld prefers a non-name-matching signal.

Refs

pulseengine/wasm-tools#2, pulseengine/wit-bindgen#4, pulseengine/synth#418, meld#298, meld#300, gale#89.

Pulseengine fork pipeline only — nothing goes upstream to bytecodealliance.

[avrabe]

meld-side answer (issue-hunt) — core passthrough already works; design recommendation

Already satisfied for core-module output (verified, not speculative)

meld's fusion resolver runs with allow_unresolved: true (Resolver::with_strategy, the path Fuser::fuse uses; only the unused strict() mode errors). So all three asks already hold for the core-module path:

1. Doesn't error on an unresolved embedder import — allow_unresolved: true; the import is recorded in unresolved_imports, not rejected.
2. Doesn't map it to a provider — by construction: resolution matches imports to exports in the fusion set, and no app/kernel component exports env::__cabi_arena_realloc / cabi-arena-realloc, so there's nothing to bind to. It stays unresolved.
3. Preserves it — unresolved imports survive into the fused core. This is already pinned by a regression test: merger::tests::test_298_fork_arena_realloc_fuses_under_shared_rebase_today fuses a pair importing __cabi_arena_realloc, and asserts the fused core retains the import (and keeps cabi_realloc exported). That test is effectively the fuse: pass through embedder import cabi-arena-realloc instead of trying to satisfy it #301 core-passthrough guard; I'll cross-link it.

What still needs verification

The component-level (P2 --output component) path with the wasm-tools#2 world-root import cabi-arena-realloc (canon-lowered to env::__cabi_arena_realloc). Generic passthrough should carry it through the wrap, but I can't prove it without a wasm-tools component new --import-passthrough-produced fixture (your fork). If you can drop one composed fixture into tests/wit_bindgen/fixtures/, I'll add a Tier-B-style assertion that the world-root cabi-arena-realloc import survives fuse --output component.

Design question — meld's recommendation: namespaced interface, explicit recognition (not bare name-matching)

meld needs no name-matching to pass it through today (it passes through all unresolved imports). But "it happens to survive as a generic unresolved import" is implicit — a future stricter resolver mode, or an aggressive resolve change, could silently drop or error it. For a functional-safety pipeline, explicit > incidental (same principle that settled the #300 Auto knob: "explicit, not auto").

So: prefer a namespaced pulseengine:embedder interface (e.g. import pulseengine:embedder/alloc carrying cabi-arena-realloc) over the bare world-root func. Then meld can (a) recognize the pulseengine:embedder namespace as intentional embedder-provided passthrough, (b) never attempt to bind it even under future strict resolution, and (c) assert it survives into the fused artifact (a positive check, not "it didn't get touched"). Bare cabi-arena-realloc name-matching is a magic-string contract that's collision-prone and invisible to review.

If you switch the wasm-tools fork to emit the namespaced interface, the meld side is small: a passthrough-allowlist on the pulseengine:embedder namespace + a survives-fusion assertion. Happy to implement that once the namespace is settled (and add the component-level fixture test above).

Refs: meld#298, meld#300, pulseengine/wasm-tools#2, pulseengine/wit-bindgen#4, pulseengine/synth#418, gale#89.

[avrabe]

meld-side inc 1 is up: #315.

Implements the explicit recognition you recommended (namespaced, not bare-name):

• EMBEDDER_PASSTHROUGH_NAMESPACE = "pulseengine:embedder" + is_embedder_passthrough() — package-namespace match, version-tolerant, no prefix false-positives.
• The component-level resolution path now recognizes these as intentional passthrough: never bound to a coincidental provider, and exempt from the strict-mode UnresolvedImport error (so a future stricter resolver can't silently drop or reject the seam). Core-module passthrough already held via allow_unresolved: true; this makes it explicit + robust.
• Pinned by LS-R-17 (approved) + positive tests, and test_298_fork_arena_realloc_... now asserts the retained arena import is recognized by namespace.

Chose the namespace pulseengine:embedder (the form your existing test_298 fixture already uses). If the wasm-tools fork (#2) switches from the bare world-root cabi-arena-realloc to a namespaced interface import under pulseengine:embedder/*, recognition triggers on real fixtures with no further meld change.

Still open (tracked follow-up): the --output component (P2 wrap) path exposing embedder imports as component-level imports — needs a wasm-tools component new --import-passthrough fixture to verify. Happy to add the Tier-B assertion once a composed fixture lands in tests/wit_bindgen/fixtures/.

[avrabe]

Follow-up sharpened: the --output component path actively rejects embedder imports (not just "unverified")

Grounded code investigation of component_wrap.rs (no fork fixture needed to find this — it's structural):

build_p2_component classifies every fused-core import into ImportResolution::{TaskBuiltin, LocalResource, Instance}, and otherwise hard-errors:

// component_wrap.rs:1084
return Err(Error::EncodingError(format!(
    "cannot resolve fused import {}::{} to a component instance",
    module_name, field_name
)));

An embedder passthrough import reaches this error because it matches none of the earlier arms:

• not [export]-prefixed (resource/P3) and not $root P3-builtin;
• resolve_import_to_instance only matches component-import instances (ComponentInstanceDef::Import), so a wasm-tools#2 world-root func import (canon-lowered to env::__cabi_arena_realloc) returns None;
• not a resource Drop.

⇒ fuse --output component would fail on a grow-free / arena component, violating #301's "do not error that the import is unresolved" for the component path. (The core-module path is fine — allow_unresolved: true; PR #315 made that explicit.)

Fix shape (inc 2, when prioritized): add an embedder arm before line 1084 — is_embedder_passthrough(module_name) (or its canon-lowered env::__cabi_arena_realloc form) → a new ImportResolution::EmbedderPassthrough that surfaces the import as a component-level import in the wrapper (so it passes through to the wrapped artifact unsatisfied) rather than erroring.

Why the fork fixture still matters: the detection+error are provable from the code, but the wiring (emitting the component-level import and binding the fused module's core import to it) needs a real wasm-tools component new --import-passthrough output to gate end-to-end — to pin the exact module/field strings (cabi-arena-realloc world-root vs env::__cabi_arena_realloc core) and confirm the wrapped component re-exposes the seam for synth to bind at dissolve. Drop a composed fixture into tests/wit_bindgen/fixtures/ and I'll implement the arm + a Tier-B survives-wrap assertion.

(Recorded as a finding, not implemented — inc 2 is fresh Tier-5 scope; PR #315 ships the inc 1 core-path recognition.)