feat(mem): VCR-MEM-001 layer-1 — native-pointer shadow-stack reservation shrink (#383, #242)

[avrabe]

What

Implements the --shadow-stack-size B shrink that PR#388 scaffolded as honest-Err. Under --native-pointer-abi, re-bases the SP global slot sp_init→B and resizes the NOBITS .bss reservation to B + static-tail — unblocking tiny-RAM targets (gale's gust kernel: declared (memory 17) ≈1 MiB → 8 KiB STM32F100). Opt-in: default unset reserves the full page.

Correctness model

Correct-by-construction for the verified gust geometry (stack-first): statics at/above sp_init are retargeted into the packed .data (#354), so the only static relocs still pointing into the .bss are addend-0 region-base pointers — stable because __synth_wasm_data stays at offset 0. Refuses honestly (typed Err) for any geometry it can't prove safe: one-PROGBITS fallback, B > sp_init, a non-zero inline static addend into the reservation (down-shift = deferred general case), a non-Abs32 reservation reloc, or an ambiguous SP global.

Verification

• Flag-off byte-identical on the fixture that actually exercises this path — msgq_put_359.wasm (--native-pointer-abi, the elf: high-offset init segment defeats the #345 .bss split — stack_push dissolves to a 64KB PROGBITS .data (MCU-unshippable) #354/Arg-register lowering drops/shifts the first arg for calls with 5 args + struct(sret) return (cortex-m4f, --native-pointer-abi) #359 mixed-split case): cmp identical vs clean main. (The non-native frozen fixtures are unaffected by construction — they take the early return.)
• Native-pointer differential passes flag-off (native_pointer_shadow_stack: frame_roundtrip correct, SP restored).
• Flag-on runtime exercised: native_pointer_shadow_stack with --shadow-stack-size 2048 (sp_init 4096→2048) → frame_roundtrip returns correct values for all inputs — the store through the re-based shadow-stack pointer lands correctly in the shrunk region (the base-pointer+offset access a reloc scan can't see). SP slot reads the re-based 2048 as intended.
• Measured on gust: --shadow-stack-size 4096 → bss 1048720 → 4240, SP slot 1048576 → 4096, text/data + all 10 relocs unchanged.
• Tests (shadow_stack_shrink_383.rs, real binary + object .bss parse): shrink→4240, no-flag→1048720, budget>sp_init→honest refuse.

Gate

This is the link-fragile native-pointer flight path (#345/#354/#359 history). gale's on-silicon reflash on this exact gust_kernel.wasm is the final runtime gate — green CI here is necessary, not sufficient. The asserted-budget contract (B must cover everything live above address 0, incl. heap; safe for no-grow MCU images) is documented in the flag help text.

Implements VCR-MEM-001 layer-1. Refs: gale#383, gale#91, #242.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-cli/src/main.rs	90.90%	5 Missing ⚠️

📢 Thoughts on this report? Let us know!