fix(fuse): gate the unsound shared+rebase auto path (#326)

[avrabe]

What

Stops --memory auto from silently selecting shared-memory + address rebasing — the default path that silently corrupts memory across fused components (#326). auto now resolves to multi-memory (sound); explicit --memory shared --address-rebase remains an opt-in but warns loudly.

This is the "gate now" half of the agreed plan; correct runtime dynamic-address rebasing in rewriter.rs (Tier-5) is the follow-up "fix properly" step.

Root cause (confirmed in-code + reproduced)

convert_memarg (rewriter.rs) rebases only the static memarg offset (and bulk-memory ops); needs_rebase_locals fires only for Memory{Copy,Fill,Init}. So the dynamic address operand of ordinary i32.load/i32.store is never rebased. Real components address heap/shadow-stack via computed pointers ⇒ shared fusion silently overlaps their private memory — wrong result, no trap, no error. (--memory multi fuses the same input correctly.)

Change

• resolve_auto_memory_strategy: the grow-free/≥2-memory branch now selects MultiMemory (was SharedMemory+rebase), with a log::warn! explaining the gate. LS-D-1: emit correct output or none, never plausible-but-wrong.
• Explicit --memory shared --address-rebase: proceeds but emits a loud unsoundness warning.
• Corrected docstrings/comments that claimed the shared path was "statically sound".

Tests

• auto_selects_shared_for_growfree_inputs → auto_gates_shared_for_growfree_inputs_326: asserts auto → multi + 2 separate memories (the isolation fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326 protects).
• ls_m_7_auto_reprobes_after_add_component: re-probes via memory count (2 → 3) since both resolutions are now multi.
• test_304_identity_direct_adapter_is_inlined: now requests SharedMemory explicitly — the Fusion emits identity trampolines that never inline (dead inline_adapters flag); de-export fusion-vestigial symbols #304 inlining feature runs on the shared path (orthogonal to the memory-access unsoundness), which auto no longer selects.
• Full pre-commit suite green (fmt, clippy, all tests).

Scope / follow-ups

• Not Tier-5 (lib.rs strategy selection + tests; the rewriter.rs rebasing fix is the Tier-5 follow-up).
• Safety-doc reconciliation: ADR-4, loss-scenarios.yaml, safety-requirements.yaml still describe the old auto→shared default — a traceability follow-up should update them (flagged, not done here).
• Interim regression: single-address-space (MCU) lowering via auto (fuse: drop vestigial cabi_realloc / canonical-ABI adapter once the inter-component boundary is internalized (unblocks --memory shared) #298/fuse --memory shared --address-rebase rejects components with memory.grow (default wasip2 allocator) — blocks single-address-space MCU lowering (jess/gale Pixhawk) #299/gale) now needs explicit --memory shared until the rewriter fix lands.

Refs #326.

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 58/58 approved LS entries verified

	count
Passed (≥1 test, all green)	58
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}