@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77
88## [ Unreleased]
99
10+ ## [ 0.11.45] - 2026-06-14
11+
12+ ** ON-TARGET SHIPPABILITY — gale #354 : a high-offset init segment no longer
13+ defeats the ` .bss ` split. Native-pointer mixed-memory modules (` stack ` /` msgq `
14+ decides) ship a bounded ` .data ` instead of a 64 KiB PROGBITS blob.**
15+
16+ - ** #354 — per-region ` .bss ` /` .data ` split for high-offset init segments**
17+ (#356 ): the #345 zero-init split was binary
18+ (` split_linmem_bss = native_layout.is_some() && data_segments.is_empty() ` ), so
19+ ANY initialized ` (data) ` segment fell to the one-PROGBITS arm. A small
20+ ` .rodata ` const at a HIGH linmem offset (gale's ` stack_push ` : a 12-byte
21+ ` 0xfffffff4 ` = -12/-ENOMEM at offset 65536, above the 64 KiB shadow stack)
22+ dragged the whole zero gap into a ** 65552-byte PROGBITS ` .data ` **
23+ (MCU-unshippable; ` msgq ` was 65556). ` build_relocatable_elf ` now splits the
24+ mixed case PER REGION using per-region ** symbols** : the zero reservation is a
25+ NOBITS ` .bss ` (` __synth_wasm_data ` ); each init segment is packed into a small
26+ PROGBITS ` .data ` under its own ` __synth_wasm_seg_K ` ; and every
27+ ` __synth_wasm_data + C ` static reloc whose addend ` C ` lands in segment K is
28+ retargeted to ` __synth_wasm_seg_K + (C - seg_off_K) ` — both the symbol AND the
29+ in-place REL addend word in ` .text ` (` R_ARM_ABS32 ` is ` S + A ` ). Per-region
30+ * symbols* (not just sections) let the linker place the sections
31+ independently — a single base symbol + selector-baked addends can't span the
32+ link gap (the fragility the #345 code comment deferred). The selector is
33+ untouched. ** Safe-by-construction gate:** the split fires only when every init
34+ segment sits at offset ` >= wasm_data_base ` (the SP-global init — the exact
35+ static-vs-frame boundary the selector already uses) AND every
36+ ` __synth_wasm_data ` reloc is the retargetable ` Abs32 ` form; otherwise it falls
37+ back to the one-PROGBITS arm (fat but always correct, never mis-addressed).
38+ Measured on the ` high_offset_init_segment_354 ` repro: ` .data ` ** 65552 → 16
39+ bytes** , ` .bss ` 65548 NOBITS; the reloc retargets to ` __synth_wasm_seg_0 ` with
40+ the in-place addend rewritten 65544 → 8. This is the mixed-case deferred in the
41+ #345 comment coming due — NOT a v0.11.44 regression; #350 just made
42+ ` stack_push ` compile far enough to expose it.
43+
44+ ** Falsification:** wrong if a native-pointer module with a ` (data) ` segment at
45+ offset ` >= wasm_data_base ` still emits a 64 KiB PROGBITS ` .data ` ; or if the
46+ retargeted symbol/addend mis-resolves the const (the ` native_pointer_shadow_stack `
47+ differential would drop below ORACLE PASS). The non-mixed paths stay
48+ byte-identical: ` control_step ` (non-native, ` 0x00210A55 ` ) and
49+ ` native_pointer_bss ` (the #345 all-zero NOBITS ` .bss ` shape) compile to the
50+ same SHA with/without the change; the four frozen differentials (control_step
51+ ` 0x00210A55 ` , flight_seam ` 0x07FDF307 ` , div_const 338/338, mutex_pressure)
52+ stay green. ** Closing gate is gale's on-target run** — ` stack ` /` msgq ` ` .data `
53+ bounded + ` stack_pop ` shim+silicon end-to-end, to run when this tags; synth-side
54+ is not marked verified alone.
55+
1056## [ 0.11.44] - 2026-06-14
1157
1258** ENCODER ROBUSTNESS — gale #350 : out-of-range ` ADD #imm ` now lowers instead of
0 commit comments