[avrabe]

Implements the direction decided on 2026-10-20: meld keeps its own component-resolution implementation, and cross-tests it against wasmtime-environ's component translator. The oracle is pinned, dev-only, and upgraded deliberately. ADR-8 records the policy and is open for review.

What is added

• Dev-dependency wasmtime-environ = "=41.0.4". It is already in the graph through wasmtime, so no new crate and no second copy.
• Feature oracle, which gates:
  • meld-core/tests/oracle_wasmtime_environ.rs, via required-features;
  • one read-only hook, Fuser::oracle_index_maps(): a snapshot of the merger's index maps that the pipeline writes and never reads.
• When it runs: the default suite never compiles the oracle, so it is unchanged. Every --all-features run, including CI coverage, runs it, so it cannot silently stop running.
• What it compares:
  • Output side: meld's --memory multi --component output, translated by the oracle, against the source. For each exported lift and each host lower: the lifted function, memory, realloc, post-return, callback, string encoding and async flag.
  • Resolver side: meld's reading of every source lift against the oracle's.
• ADR-8, safety/adr/ADR-8-wasmtime-environ-differential-oracle.md, covers:
  • the exact pin, upgraded only together with wasmtime in its own PR;
  • the tie-break when the two disagree: the Component Model spec and wasmtime's behaviour on the unfused component;
  • what the oracle must not do: be a runtime dependency, be fed meld's output, be loosened to get green, or count as proof.

It would have caught the recent bugs

Applied to meld from just before the #481 fix (9926d47), the oracle flags:

• --component lifts every export from fused memory 0: a string export returns the wrong memory's bytes #481: lift memory, source 1 against output 0;
• --component lowers an import with an arbitrary memory: the host can receive another module's bytes, and output varies between runs #484: lower memory, encoding (utf16 against utf8) and realloc;
• fix(#484): --component lowers use the memory, realloc and encoding their source lower names #490: the alias chain.

Each WAT fixture is fused 10 times, because #484 disagreed only on some hash orders.

An off-by-one injected into meld's resolver turns the resolver-side tests red.

On current main

Every compared fact agrees: the #481, #484 and #490 fixtures, five wit-bindgen fixtures, and two compositions.

It also reached two known open bugs. Those fixtures are marked #[ignore] with the issue number until they are fixed:

• --component emits an invalid component for an export with string or list parameters, at exit 0 #486, reached through a record result on the tracked fixture compose_record/provider.wasm, not only through the string-parameter shape in the issue. meld emits a lift with no options and exits 0.
• --component export points at the wrong function when a component func alias precedes the first core module #485, the issue's reproduction.

Next comparison (not in this PR)

Compare the options of internal component-to-component calls (wasmtime's adapter modules) against meld's adapter-site resolution. That is the #489 and #504 shape, and it is where the corpus's real string, list and record traffic crosses.

The same mechanism measures P3 progress: wasmtime-environ 41 models most async built-ins as trampolines. Three meld built-ins have no counterpart there: ThreadSpawn, ThreadHwConcurrency and ResourceDropAsync.

Test plan

• cargo fmt --all -- --check: exit 0
• cargo clippy --workspace --all-targets -- -D warnings: exit 0, with and without --all-features
• cargo test --workspace: 963 passed, 0 failed (unchanged)
• cargo test --workspace --all-features: 972 passed, 0 failed
• cargo test -p meld-core --features oracle --test oracle_wasmtime_environ: 10 passed, 3 ignored (known open issues)

🤖 Generated with Claude Code

https://claude.ai/code/session_01WrmMqf1iuTS1UBEes5TmdC

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[cpetig]

wasmtime-environ =41.0.4 sounds significantly outdated to me with 50.0 already released (yesterday).

[avrabe]

Agreed, 41 is well behind 50.0.0.

Why this PR uses 41. It deliberately pins the oracle to the wasmtime meld already uses for its runtime tests (wasmtime = "41.0.1"). That way the oracle adds no second copy of wasmtime, and both always agree on one version. ADR-8 makes this the policy: the oracle moves only together with wasmtime, in its own PR, so that any new disagreement can be attributed to the upgrade.

The upgrade to 50.0.0 will follow as that PR, built on this one:

• wasmtime, wasmtime-wasi and the oracle all go to 50.0.0. All three are dev-only.
• wasmtime 50 needs Rust 1.97. CI builds on stable, so that is fine, and meld's own minimum Rust version (1.85) is unaffected.
• About 30 test files use the wasmtime API and will need porting.
• Any compared fact that changes between 41 and 50 will be reported in that PR, as either a meld bug or a semantic change in wasmtime. Catching those changes is what the oracle is for.

If you would rather land the oracle directly on 50, I can fold the upgrade into this PR instead.

[avrabe]

The upgrade to 50.0.0 is now #508, stacked on this PR. Every oracle fact is identical between 41 and 50, and the shipped meld binary produces byte-identical output with the new lockfile. The details are in #508.

[avrabe]

Review: approve (the maintainer consents to merging)

What I checked:

• Dependencies: wasmtime, wasmtime-wasi and wasmtime-environ all sit under [dev-dependencies]. cargo tree -e normal contains no wasmtime or cranelift crate.
• The oracle feature compiles only the test (required-features) and one hook, Fuser::oracle_index_maps. The hook is a cfg(feature = "oracle") snapshot of the merger's memory and function index maps. The pipeline writes it and never reads it. Reading a poisoned mutex recovers the data rather than panicking.
• Default build: unchanged. The --all-features CI runs execute the oracle, so it cannot silently stop running.
• Potency was shown in the spike: the oracle flags --component lifts every export from fused memory 0: a string export returns the wrong memory's bytes #481, --component lowers an import with an arbitrary memory: the host can receive another module's bytes, and output varies between runs #484 and fix(#484): --component lowers use the memory, realloc and encoding their source lower names #490 on the code before those fixes.
• The wasmtime 50.0.0 upgrade (chore: wasmtime, wasmtime-wasi and the ADR-8 oracle 41 → 50.0.0 #508, merged into this branch): the oracle facts are identical to 41, and the shipped binary's output is byte-identical with the new lockfile.

Non-blocking notes:

• The snapshot clones two maps on each fuse, but only under the oracle feature.
• After a failed fuse, oracle_index_maps() returns the previous snapshot. This is documented on the method.

ADR-8 is now resolved. It records the maintainer's acceptance of the policy on 2026-10-21. The pin text matches =50.0.0, and an upgrade log records #508.

[temper-pulseengine]

Automated review for PR #505

pulseengine/meld:spike/wasmtime-environ-oracle → pulseengine/meld:main

Verdict: 💬 Comment

Summary: The code changes are mostly minor and do not significantly impact the functionality of the Fuser struct. However, there is a new feature introduced that requires additional documentation and testing to ensure its correctness. The addition of the oracle_index_maps field and related methods also adds complexity to the codebase, so it's important to thoroughly test these changes before merging.

Findings: 0 mechanical (rivet) · 1 from local AI model.

Findings (1):

1. meld-core/src/lib.rs:757

   /// ADR-8: a read-only snapshot of the merger's index maps, taken just before
   

   The oracle_index_maps field is introduced to store the index maps for the differential oracle. However, it is not documented or tested thoroughly.

---

Generated by a local AI model and post-validated against a strict JSON contract. Each finding includes the verbatim line being criticised — verify by reading the file at the cited location.

Reviewed at b1c0fba