RQ-61-MVORACLE (#1097): promote the #1093-class silent-miscompile differential into a CI-wired red-first oracle

[avrabe]

RQ-61-MVORACLE — the evidence for the #1096 decline, made permanent and executable

Refs #1097. The inverse of this release's other findings: the #1096 guard is right, but the demonstration of why it is mandatory lived in a lane scratchpad. This PR promotes it into scripts/repro/, CI-wired, red-first.

What the oracle does on every CI run

Red half — the pre-#1096 compiler's own bytes, re-executed. The committed fixture param_block_silent_1097_red_pre1096.json holds the objects emitted at rev b2abf951 (c4b463f3^, one commit before the #1096 merge; regenerable via --capture, recipe in the docstring). They run under unicorn against wasmtime-first expected values, with every ABI-unassigned register seeded with a canary that names it (0xC0DE0000 | index). The four demonstrated silent miscompiles must reproduce exactly as pinned:

leg	vector	pre-#1096 returned	wasmtime
if (param i32) no else, ARM	ipe(0)	0xC0DE0003 — the uninitialized R3 canary (the issue's exact shape)	7
if (param i32) no else, RV32	ipe(0)	0xC0DE0012 — uninitialized T2 canary	7
block (param i32)+br_if, RV32	bpb(1)	0xC0DE0012 — the taken edge drops the carried param	7
loop (param i32)+back-edge, RV32	lpb(3)	2 — mis-reconciled join once the back-edge is taken	10

Negative results, pinned as such (not manufactured): block/ARM was correct pre-#1096 on all 7 probed vectors — that leg's decline is conservative, and the oracle pins it as MATCH so the honest matrix survives. loop/ARM never compiled pre-#1096 (the #509 back-edge decline predates #1096); the fixture records that refusal and the oracle needle-checks it.

Green half — current main. All six shape x backend legs decline cleanly: exit 1 (not the panic 101), no panicked at, no object written, the shared #1093 needle present. A guard module of supported neighbours (plain if (result), value-carrying forward br_if — the #483/#509 shapes) must still compile and match wasmtime on both backends, so the guard cannot silently grow past its class.

Floors, and what each cannot see

• # ci-checks: emulations >= 19 (11 fixture + 8 guard unicorn entries). Per An oracle's ci-checks floor cannot see its decline half — 4 oracles could lose that half and stay green #1113 this floor cannot see the decline half — a refused compile emulates nothing — nor whether the wrong vectors stayed wrong.
• Decline half: in-script refusals == 6 (non-zero exit at less), refusals: line grepped in ci.yml (the fix(oracle): #1104 shadowed the aarch64 builder guard and left its oracle pinned to the superseded wording #1112 pattern).
• Wrong/match partition: in-script silent-wrong vectors == 4, plus the ci.yml grep of the exact partition line — a red half that stops demonstrating the miscompile cannot stay green.

Red-first demonstrated

Pointing SYNTH at the pre-#1096 binary fails the oracle: all six legs report exit 0 (accepted); object written; missing needle, then VACUOUS: refusals=0, exit 1.

Gates run locally

cargo fmt --check 0 · cargo clippy --workspace --all-targets -- -D warnings 0 · oracle_wiring_check.py 0 (182 scripts, 0 undeclared) · claim_check.py 0 · status_evidence_check.py 0 (45 delivery commits matched) · oracle under oracle_run.py: measured=19, RESULT: PASS, exit 0.

Artifact RQ-61-MVORACLE flipped to implemented; its done-when is now the machine signature of the CI wiring (the load-bearing half of the filed manual predicate).

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!