feat(#374): lower memory.copy/memory.fill (bulk-memory) — bounds-checked, trap-correct + v0.11.49 (#376)

* track(#374): memory.copy/memory.fill repro — bulk-mem lowering gap

19 falcon sites (11 fill + 8 copy). Same _ => None class as #369/#372; loud-skips
on v0.11.47. No WasmOp::MemoryCopy/MemoryFill, no decoder arm, no lowering — a real
lowering to build (decode + stack-effect + bounds-checked copy/fill loop with
memmove-overlap + OOB trap). Repro only; fix = next block, own release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#374): lower memory.copy/memory.fill (bulk-memory) — bounds-checked, trap-correct

memory.copy/memory.fill fell through the decoder `_ => None` and (since
v0.11.46/GI-FPU-001) loud-skipped the whole function — 19 falcon sites, the
largest remaining bulk-mem gap. Unlike #372 the lowering did not exist at all.

- WasmOp::MemoryCopy / MemoryFill + decoder arms (memory 0 only; non-zero
  memory index loud-skips, preserving the GI-FPU-001 honesty contract)
- stack effect: pop 3, push 0 (wasm_stack_check)
- optimizer decline -> direct selector fallback (#120/#188/#372 pattern)
- select_with_stack lowering: fill = STRB byte loop (low byte of val); copy =
  memmove byte loop with direction by dst/src order (dst>src copies backward).
  Bounds (Software mode) trap via inline UDF guarded by a LOCAL skip branch,
  end-EXCLUSIVE (off+len>size or u32-overflow traps; ==size ok), matching
  wasmtime. The 3 dead popped operands are reused as walking pointers (only R12
  extra) — no temp allocation.

Gate (value-level, no silicon): bulk_memory_374_differential.py 16/16 vs
wasmtime over discriminating vectors (forward, overlap dst>src backward, overlap
dst<src forward, self-copy, len==0, dst/src+len==size boundaries NO trap, OOB
dst/src TRAP, low-byte fill). Frozen-safe: control_step 0x00210A55 13/13,
flight_seam 0x07FDF307, div_const 338/338 byte-identical. Unit tests for
decoder/stack-check/selector. rivet GI-MEM-002 (+VER-001).

Falcon silicon (falcon-v1.56.fused.wasm) gates the release before #374 closes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(release): v0.11.49 — #374 bulk-memory (memory.copy/fill) + pin sweep + changelog

Pin sweep 0.11.48 -> 0.11.49 (workspace.package + 10 path-dep pins + MODULE.bazel
+ Cargo.lock synth-* packages). CHANGELOG v0.11.49 with falsification.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: avrabe

CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.49] - 2026-06-19
+
+**BULK-MEMORY — #374: `memory.copy` / `memory.fill` now lower to bounds-checked
+byte loops, closing the largest remaining falcon on-target gap (19 sites: 11
+fill + 8 copy).** Self-contained, value-level differential vs wasmtime (16/16);
+falcon-v1.56 silicon confirmation gates closing #374.
+
+- **#374 — `memory.copy` / `memory.fill` lowered** (was unsupported): like the
+  scalar floats (#369) and the former `i64.load/store` (#372), bulk-memory fell
+  through the decoder `_ => None` and (since v0.11.46 / GI-FPU-001) **loud-skipped
+  the whole function**. Unlike #372 the lowering did not exist at all — no
+  `WasmOp` variant, no decoder arm, no selector handler. Added:
+  - `WasmOp::MemoryCopy` / `MemoryFill` + decoder arms for **memory 0** (a
+    non-zero memory index still loud-skips — the GI-FPU-001 honesty contract);
+  - stack effect `pop 3, push 0`;
+  - optimizer **decline → direct-selector fallback** (the `#120/#188/#372`
+    pattern; the optimized path has no bulk-mem IR opcode);
+  - a bounds-checked byte-loop lowering in `select_with_stack`:
+    `memory.fill(dst,val,len)` → `STRB` loop writing the **low byte** of `val`;
+    `memory.copy(dst,src,len)` → a **memmove** byte loop whose direction follows
+    `dst`/`src` order (`dst > src` copies **backward**, so overlapping copies
+    don't corrupt the source). Under `--safety-bounds software` an **inline
+    `UDF`**, guarded by a local skip branch, traps **end-exclusive** (`off+len >
+    size`, or a `u32` overflow; `off+len == size` is in-bounds) to match
+    wasmtime. (A body branch to the external `Trap_Handler` is only relocated in
+    `--relocatable` mode, not in the self-contained image, so the trap is a
+    self-contained `UDF`; on silicon UsageFault/HardFault routes to
+    `Trap_Handler` via the vector table.) The three dead popped operands are
+    reused as walking pointers — only `R12` extra, no temp allocation.
+  - **Falsification:** `scripts/repro/bulk_memory_374_differential.py` runs 16
+    discriminating vectors against wasmtime (forward, overlap `dst>src`
+    backward, overlap `dst<src` forward, self-copy, `len==0`, `dst+len==size` &
+    `src+len==size` boundaries that must **not** trap, OOB `dst`/`src` that
+    **must** trap, fill with high bits set → only low byte written), comparing
+    the full 64 KiB image **and** the trap outcome — **16/16**. Were the
+    direction logic, the pop order, or the end-exclusive bound wrong, a vector
+    flips. The RISC-V backend continues to loud-skip bulk-mem (symbol absent,
+    warning names the op) — the silent-drop class is not reintroduced.
+  - **Frozen-safe:** `control_step` `0x00210A55` (13/13), `flight_seam`
+    `0x07FDF307`, `div_const` 338/338 stay byte-identical (no fixture uses
+    bulk-mem; the change is purely additive). rivet `GI-MEM-002` (+`VER-001`).
+
 ## [0.11.48] - 2026-06-18
 
 **ON-TARGET — #359 closed on silicon (G474RE `rc=0`): the dissolved msgq

Cargo.lock

@@ -27,7 +27,7 @@ resolver = "2"
 # semver to publish, so the convention now catches up: workspace
 # version follows the release tag, bumped pre-tag in the release
 # checklist. See docs/release-process.md.
-version = "0.11.48"
+version = "0.11.49"
 edition = "2024"
 rust-version = "1.88"
 authors = ["PulseEngine Team"]

Cargo.toml

@@ -7,7 +7,7 @@ module(
     name = "synth",
     # Kept in lockstep with [workspace.package] version in Cargo.toml.
     # Both are bumped pre-tag — see docs/release-process.md.
-    version = "0.11.48",
+    version = "0.11.49",
 )
 
 # Bazel dependencies

MODULE.bazel

@@ -785,3 +785,69 @@ artifacts:
         div_const 338/338) byte-identical; native_pointer_shadow_stack
         differential PASS; 32 cli tests green; gale G474RE silicon rc=0 +
         val=0xABCD round-trip on an empty queue (was rc=-35/val=0x0).
+
+  - id: GI-MEM-002
+    type: sw-req
+    title: Lower memory.copy/memory.fill (bulk-memory) — bounds-checked, trap-correct (#374)
+    description: >
+      gale/jess #374 (surfaced by the GI-FPU-001 loud-skip): memory.copy/
+      memory.fill were unsupported (`_ => None`) — 19 falcon sites (11 fill,
+      8 copy), the largest remaining bulk-mem gap. Unlike #372 the lowering did
+      NOT exist: no WasmOp::MemoryCopy/MemoryFill, no decoder arm, no selector
+      handler. IMPLEMENTED (next release): WasmOp::MemoryCopy/MemoryFill +
+      decoder arms (memory 0 only; non-zero memory index loud-skips) + stack
+      effect (pop 3, push 0) + optimizer decline->direct fallback (#120/#188/#372
+      pattern) + a bounds-checked byte-loop lowering in select_with_stack. fill
+      = STRB loop (low byte of val); copy = memmove byte loop with direction by
+      dst/src order (dst>src copies backward). Bounds (Software mode) trap via an
+      inline UDF guarded by a LOCAL skip branch — end-EXCLUSIVE (`off+len>size`
+      or u32-overflow trap; `==size` ok), matching wasmtime. (An external
+      Trap_Handler branch is only relocated in --relocatable mode, not the
+      self-contained image, so a self-contained UDF is used; on silicon
+      UsageFault/HardFault routes to Trap_Handler via the vector table.) The 3
+      dead popped operands are reused as walking pointers (only R12 extra), so no
+      temp allocation. Frozen-safe (no fixture uses bulk-mem). Ships its own
+      release. Same honesty class as GI-FPU-001/GI-MEM-001.
+    status: implemented
+    tags: [gale, jess, bulk-memory, memory-copy, memory-fill, falcon, release-pending]
+    links:
+      - type: derives-from
+        target: GI-005
+      - type: traces-to
+        target: gale:374
+    fields:
+      req-type: functional
+      priority: must
+      verification-criteria: >
+        scripts/repro/bulk_memory_374_differential.py: 16/16 vs wasmtime
+        (forward, overlap dst>src backward, overlap dst<src forward, self-copy,
+        len==0, dst+len==size & src+len==size boundaries NO trap, OOB dst/src
+        TRAP, low-byte fill); the three frozen fixtures (control_step 0x00210A55,
+        flight_seam 0x07FDF307, div_const 338/338) byte-identical; gale falcon
+        silicon round-trip (falcon-v1.56.fused.wasm) before verified.
+
+  - id: GI-MEM-002-VER-001
+    type: sw-verification
+    title: "Bulk-memory copy/fill (#374) — numeric differential + frozen byte-identity"
+    description: >
+      Verifies GI-MEM-002. scripts/repro/bulk_memory_374_differential.py runs
+      wasmtime (ground truth) vs unicorn (synth Thumb-2, --safety-bounds
+      software) over 16 DISCRIMINATING vectors comparing the full 64 KiB image
+      AND trap outcome: copy non-overlap (asymmetric, catches pop-order swap),
+      overlap dst>src (backward), overlap dst<src (forward), dst==src, len==0 at
+      dst==size, dst+len==size & src+len==size boundaries (must NOT trap), OOB
+      dst+len/src+len (must TRAP), fill with high bits set (only low byte
+      written). Unit tests: wasm_decoder test_decode_bulk_memory_374,
+      wasm_stack_check bulk_memory_pops_three_374, instruction_selector
+      test_bulk_memory_{fill,copy}_lowers_374. Frozen byte-identity confirmed
+      (the three oracles PASS unchanged — no fixture uses bulk-mem).
+    status: implemented
+    tags: [gale, bulk-memory, verification, differential, unit-test, frozen]
+    links:
+      - type: verifies
+        target: GI-MEM-002
+    fields:
+      method: test
+      pass-criteria: >
+        bulk_memory_374_differential.py 16/16; cargo test 374/bulk_memory green;
+        control_step / flight_seam / div_const differentials byte-identical.

artifacts/gale-integration.yaml

@@ -11,6 +11,6 @@ categories.workspace = true
 description = "aWsm backend integration for the Synth compiler"
 
 [dependencies]
-synth-core = { path = "../synth-core", version = "0.11.48" }
+synth-core = { path = "../synth-core", version = "0.11.49" }
 anyhow.workspace = true
 thiserror.workspace = true

crates/synth-backend-awsm/Cargo.toml

@@ -11,8 +11,8 @@ categories.workspace = true
 description = "RISC-V encoder, ELF builder, PMP allocator, and bare-metal startup for synth"
 
 [dependencies]
-synth-core = { path = "../synth-core", version = "0.11.48" }
-synth-synthesis = { path = "../synth-synthesis", version = "0.11.48" }
+synth-core = { path = "../synth-core", version = "0.11.49" }
+synth-synthesis = { path = "../synth-synthesis", version = "0.11.49" }
 anyhow.workspace = true
 thiserror.workspace = true
 tracing.workspace = true

crates/synth-backend-riscv/Cargo.toml

@@ -11,6 +11,6 @@ categories.workspace = true
 description = "Wasker backend integration for the Synth compiler"
 
 [dependencies]
-synth-core = { path = "../synth-core", version = "0.11.48" }
+synth-core = { path = "../synth-core", version = "0.11.49" }
 anyhow.workspace = true
 thiserror.workspace = true

crates/synth-backend-wasker/Cargo.toml

@@ -15,7 +15,7 @@ default = ["arm-cortex-m"]
 arm-cortex-m = ["synth-synthesis"]
 
 [dependencies]
-synth-core = { path = "../synth-core", version = "0.11.48" }
-synth-synthesis = { path = "../synth-synthesis", version = "0.11.48", optional = true }
+synth-core = { path = "../synth-core", version = "0.11.49" }
+synth-synthesis = { path = "../synth-synthesis", version = "0.11.49", optional = true }
 anyhow.workspace = true
 thiserror.workspace = true

crates/synth-backend/Cargo.toml

@@ -27,18 +27,18 @@ verify = ["synth-verify"]
 # Path deps carry `version` so `cargo publish` rewrites them to the
 # crates.io coordinate. Bumping the workspace version requires
 # updating these in lockstep — see docs/release-process.md.
-synth-core = { path = "../synth-core", version = "0.11.48" }
-synth-frontend = { path = "../synth-frontend", version = "0.11.48" }
-synth-synthesis = { path = "../synth-synthesis", version = "0.11.48" }
-synth-backend = { path = "../synth-backend", version = "0.11.48" }
+synth-core = { path = "../synth-core", version = "0.11.49" }
+synth-frontend = { path = "../synth-frontend", version = "0.11.49" }
+synth-synthesis = { path = "../synth-synthesis", version = "0.11.49" }
+synth-backend = { path = "../synth-backend", version = "0.11.49" }
 
 # Optional external backends
-synth-backend-awsm = { path = "../synth-backend-awsm", version = "0.11.48", optional = true }
-synth-backend-wasker = { path = "../synth-backend-wasker", version = "0.11.48", optional = true }
-synth-backend-riscv = { path = "../synth-backend-riscv", version = "0.11.48", optional = true }
+synth-backend-awsm = { path = "../synth-backend-awsm", version = "0.11.49", optional = true }
+synth-backend-wasker = { path = "../synth-backend-wasker", version = "0.11.49", optional = true }
+synth-backend-riscv = { path = "../synth-backend-riscv", version = "0.11.49", optional = true }
 
 # Optional verification (requires z3)
-synth-verify = { path = "../synth-verify", version = "0.11.48", optional = true, features = ["z3-solver", "arm"] }
+synth-verify = { path = "../synth-verify", version = "0.11.49", optional = true, features = ["z3-solver", "arm"] }
 
 # Optional PulseEngine WASM optimizer
 # Uncomment when loom crate is available: