[avrabe]

Closes #488.

Defect

Element segment items were remapped when their module was merged. For an import that crosses a component boundary through an adapter, the function map still named the callee at that point. Adapter wiring rewrote the map entry afterwards, but rebuilt only function bodies. The result:

• Active segment: the table slot kept the callee, so a call through the table bypassed the canonical-ABI adapter. A cross-memory string arrived uncopied: 3000 instead of 3090, at exit 0.
• Declarative segment: the body's ref.func named the adapter, but the declaration still named the callee, so the output failed validation.

Fix

• Recorded origins. Each element item (active, passive and declarative; function-index and ref.func expression) records its origin (component, module, module-local function).
• One refresh before encoding. MergedModule::refresh_out_of_body_func_refs re-resolves those origins from the final function map, together with the A global's ref.func initialiser keeps its module-local function index and names another module's function #482 global ref.func refresh. It runs once immediately before encoding, and once before dissolve_fixups, which reads element items.
• No identity fallback. An origin that is not mapped by then is an error.
• Trap stubs stay stubs. Unmapped-import stubs (wac shim trampolines survive fusion as exports "0", "1" and "$imports", so synth refuses (split from #461) #462) are left as they are.
• Task-return shims. The refresh reapplies the task-return shim substitution, so the earlier element patch is not undone.
• fix(#462): an unmapped fixup import is a trap stub, never the identity index #477's refusal replaced. fix(#462): an unmapped fixup import is a trap stub, never the identity index #477 refused a late-wired import in an element slot, because element items were never re-indexed. That refusal is replaced by the refresh, since an import still unmapped at refresh time now errors. No test reaches that path: it needs a cyclic intra-component dependency, which the resolver rejects before merging.

Evidence (meld-core/tests/elem_refresh_488.rs)

case	before	after
active segment, function index	3000	3090 (= unfused)
active segment, ref.func expression	3000	3090
declarative segment + body ref.func	invalid output	validates, 3090
table slot and body call name the same function (two structural tests)	fail	pass
direct-call control	3090	3090

• Potency: with the element half of the refresh disabled, 5 of the 6 tests fail and the control passes.
• Corpus: all 49 wit-bindgen fixtures are byte-identical to main. None of them places an adapted import in an element segment.
• Traceability: SR-101 (derives from SYS-2; refines SR-10, SR-98 and SR-96) and SWV-113, with reviewed-by: avrabe.

Test plan

• cargo fmt --all -- --check: exit 0
• cargo clippy --workspace --all-targets -- -D warnings: exit 0, with and without --all-features
• cargo test --workspace: exit 0, 969 passed, 0 failed
• cargo test --workspace --all-features: exit 0, 968 passed, 0 failed
• Mythos delta-pass (auto-merge stays off until it is clean)

🤖 Generated with Claude Code

https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/merger/index_maps.rs
meld-core/src/merger/merge_core.rs
meld-core/src/merger/mod.rs
meld-core/src/rewriter.rs
meld-core/src/segments.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[avrabe]

Mythos delta-pass: NO FINDINGS for this change

Examined and sound:

• Element origins: comp_idx/mod_idx are threaded correctly, function-index and ref.func items both record origins, passive and declarative segments are covered, and meld creates no element segments of its own.
• P3 ordering: the P3 shift runs before the refresh and shifts the function map consistently.
• Trap stubs: they have no origin and stay stubs.
• Task-return shims: their reapplication is idempotent and matches the old patch.
• dissolve_fixups: it now sees post-wiring values.
• Pending imports: they are resolved from the same map as bodies, or error.
• Encoding: a single encode path, with the refresh before it.

Beyond the PR's own tests, two more shapes are fixed by this change:

• a passive segment with table.init;
• a table filled by one module, exported, and called through by another.

Both return 3000 on main and 3090 here, matching unfused.

Pre-existing, filed separately: an adapted import that is re-exported by one core module and imported by another bypasses the adapter in both the body call and the element slot. This happens on main and on this branch alike, so it is not introduced here.

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[github-actions]

Mythos delta-pass (auto)

❌ 1 finding(s) across 5 Tier-5 file(s)

File	Verdict	Hypothesis
meld-core/src/merger/index_maps.rs	✅ NO FINDINGS	—
meld-core/src/merger/merge_core.rs	✅ NO FINDINGS	—
meld-core/src/merger/mod.rs	❌ FINDING	discover step failed before emitting structured output — see workflow logs
meld-core/src/rewriter.rs	✅ NO FINDINGS	—
meld-core/src/segments.rs	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}