RQ-60-A64IMPORT (VCR-REACH-002 inc. 1): aarch64 import dispatch — SHN_UNDEF externals, the ARM #197 contract ported. Refs #1017, Refs #242

[avrabe]

What

The top-ranked real-world aarch64 blocker (#1017: ~121 of 805 modules, 88 of 101 components): a module that calls an imported function, or whose funcref table holds one, loud-declined wholesale. This ports synth's own ARM --relocatable design (#173/#197 — the wasm2c/Wasker undefined-symbol pattern), inventing no new policy:

• selector: an import call lowers through the SAME bl+CALL26 path as a local call; every marshalling guard (≤8 args, ≤1 result, no float result/args, exact-height stack) applies to imports identically. The now-meaningless num_imports parameter is deleted, not kept vestigially.
• substrate: a table slot holding an import emits its trampoline b <field> (JUMP26) against the import's wasm field name; an unnamed import still declines — never fabricate a symbol.
• elf: build_relocatable_object_full gains an undefined-externals allowlist (the module's import field names). A reloc against a listed name emits a GLOBAL STT_FUNC SHN_UNDEF symbol. Not a policy change: a symbol neither placed nor listed keeps the aarch64 ELF builder PANICS (exit 101) when a retained function relocates against a declined one — arm and riscv exit 1 cleanly on the identical module #1013 clean refusal — httparse still exits 1 naming func_0 (verified), so a loud-declined local callee can never silently become a link-time external.
• backend + CLI: import func_N relocs rewritten to field names via ONE shared derivation (substrate::import_func_symbols).
• CLI single-function path: ported the RISC-V riscv backend: 'external call without relocation table' blocks every seam-importing function (--relocatable) #871 guard — that wrapper ships no .rela.text, so a function carrying relocations now declines loudly instead of shipping dead bl #0 sites (latent for local calls before this PR).

Red-first

On main, both repros exit 1:

warning: skipping function 'run': ... call to imported function 0 — import dispatch is not yet supported for aarch64; loud-declining (#851)
Error: no functions compiled successfully (1 skipped) — nothing to emit          # exit 1
Error: aarch64: table slot 0 holds imported function 0; import dispatch is not supported on aarch64 ... # exit 1

After: both exit 0, and the pyelftools symtab (never disasm text) shows:

sym[3] name='host_add' shndx=SHN_UNDEF STT_FUNC/STB_GLOBAL
rela offset=0x1c type=283 (R_AARCH64_CALL26) sym='host_add'
sym[5] name='ext_inc'  shndx=SHN_UNDEF STT_FUNC/STB_GLOBAL
rela offset=0x70 type=282 (R_AARCH64_JUMP26) sym='ext_inc'   # table slot 0 trampoline

Linked and executed, not merely produced

ld.lld links both objects against a clang-assembled definition of the imports; unicorn executes the linked images: run(37)=42 through the import call; table dispatch slot 0 (import) 41→42, slot 1 (local) 21→42; out-of-range indices still TRAP exactly where wasmtime traps. The CI-wired differential (scripts/repro/aarch64_import_dispatch_1017_differential.py, emulations >= 6) repeats all of this on every run with wasmtime-first expected values plus a decline-honesty probe; oracle_wiring_check green.

The measured number

The 805-module gale corpus is not available locally (1.5 GB, gale-side). Measured instead on the org-repo corpus: 307 unique modules / 489 MB / 124 components — the same corpus RQ-59-PARTIALCENSUS (#1051) used — with a main-built baseline binary vs this branch, same harness, same command (-b aarch64 --all-exports --relocatable):

	accept	rate	crash
origin/main	60/307	19.5%	0
this branch	67/307	21.8%	0

+7, 0 regressions. The flips include real component-shaped modules (meld consumer*.wasm composites, wasi-testsuite AssemblyScript proc_exit-*, loom repro-219, synth i2c_thin_882).

Honest framing of the delta: this corpus is NOT the gale corpus — its baseline is 19.5%, not 1.6%, and its top blockers are active data segments (89) and multi-memory (64), not import dispatch, because org-repo modules are toolchain/meld artifacts rather than wasm.directory components. The 13/805 → N/805 number can only be measured by gale. What this corpus does show is the overlap finding the artifact asked for: of the 89 data-segment declines, 80 also carry function imports; of the 64 multi-memory declines, 60 do. First-blocker attribution therefore understates this increment — import dispatch is a necessary co-requisite that pays out again when the data-segment and multi-memory increments land.

Found by the census: a latent release-mode miscompile

Re-measuring exposed 6 rc=101 panics — not in the import code: the prologue's sub sp, sp, #imm12 encoder only debug_asserted its 12-bit range, so a ≥512-slot local frame panicked in debug and would encode overflow bits into neighbouring instruction fields in release — a wrong SP adjustment, the silent-miscompile class (#180/#185's A64 sibling). Latent since the prologue landed; unreachable until this PR removed the module-level import declines that had always aborted those modules first. Fixed as a loud selector decline with a two-direction regression test; all six modules now exit 1 cleanly, and the final census has 0 crashes.

Deliberately out of scope

• Multi-memory (64 local / 124 gale modules) — the second reach increment, explicitly not this lane.
• Active data segments on aarch64 (89 local / 44 gale) — the v0.59 refusal is untouched; this PR does not interact with it.
• Imported globals/tables/memories — still decline with the existing reasons.
• WASI-Virt pre-composition (named in VCR-REACH-002) — composition-layer work, not backend.

What did not port cleanly

Nothing structural. One deviation from ARM worth naming: ARM turns any unresolved reloc into an undefined external; aarch64 deliberately keeps the stricter #1013 refusal for non-import symbols (declined local callees), using an imports-only allowlist — the sibling behaviour would have erased a v0.59 guarantee.

Gates

cargo fmt --check · cargo clippy --workspace --all-targets -- -D warnings · cargo test --workspace (150 suites) · python3 scripts/claim_check.py claims.yaml (51/51) · scripts/oracle_wiring_check.py · rivet validate (errors unchanged at main's 40; warnings 233→232) — all green, gated on exit codes. ARM/RV32 frozen anchors untouched (import-free aarch64 output byte-identical, unit-tested).

Refs #1017, Refs #242 (VCR-REACH-002 increment 1)

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 91.96429% with 18 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-backend-aarch64/src/backend.rs	0.00%	11 Missing ⚠️
crates/synth-cli/src/main.rs	74.07%	7 Missing ⚠️

📢 Thoughts on this report? Let us know!