Close the meld→kiln end-to-end seam: run a meld-fused core module on kiln and assert behavioural equivalence

[avrabe]

Why

meld's test suite verifies fusion/adapters/transcoding via synthetic two-memory wasmtime modules + real-adapter wasmparser::Validator checks, but repeatedly discloses (CHANGELOG v0.32.0/v0.33.0, SR-41/SR-32 verification notes) that the full async-lift / resource / stream e2e is "kiln-gated" and out of scope for this repo's tests. That seam — meld lowers a composed component → the fused core module runs on a real runtime → an export is invoked and returns the expected result — is currently unproven end-to-end for meld output specifically.

This is the highest-value missing verification: every adapter/transcode/resource/stream guarantee meld ships is a structural/synthetic claim until a real runtime executes the fused module and the observed behaviour matches the un-fused composition.

Grounding (not speculative)

• meld side: no e2e/integration-on-runtime test exists; the kiln-gated disclosure is explicit in the CHANGELOG and SR verification descriptions.
• kiln side: hosting-and-invoking a composed component is itself still open — kiln#344 ("Enable Component Model hosting in kilnd: run an external composed component + invoke an export"). kiln**#317** covers a synth-lowered async core module e2e, not a meld-lowered one. kiln**chore: release v0.8.0 #149** (linking/call_indirect/exception execution failures) may block first.

Proposed scope (incremental)

1. Tier A (sync): a fixture of 2–3 small components with a cross-component pointer-passing call (string/list param+result). Fuse with meld → run the core module on kiln (kilnd --component or the core-module path) → assert the export's result equals the behavioural oracle (the same call across the un-fused components). Gate on kiln#344.
2. Tier B (resource): a borrow/own handle crossing a fused boundary (exercises the resource_graph attribution + handle pass-through, SR-25/resource_graph: two latent resource-attribution weaknesses (reachability unconfirmed) — Mythos sweep 2026-06-17 #295).
3. Tier C (async/stream): a guest-to-guest stream<T> (SR-33) and an async-lift export (SR-32), once kiln#317-class async e2e lands.

Dependencies / coordination

Blocked on kiln#344 (host+invoke) and likely kiln#149 (execution failures). Suggest a shared golden-fixture set reusable by both repos' CI. This issue tracks the meld-output half; kiln#344/#317 track the runtime half.

Note

This is verification-closure, not a known defect — meld's structural oracles are strong and adversarially gated. But "the synthetic oracle passed" is not "a real runtime ran it correctly"; this issue exists to convert the kiln-gated disclosure into an actual green e2e.

[avrabe]

Correction — the seam is PARTIALLY proven on real hardware (via jess), not unproven

My original framing ("nobody has demonstrated a meld-fused module on a real runtime/hardware") was overstated — it looked only at meld's repo-local tests. The cross-project e2e already exists in jess (the hardware-integration / HIL hub):

relay (falcon flight component, CCSDS + relay-sec)
  → meld (fuse) → loom (optimize fused whole) → synth (wasm → ARM Cortex-M)
  → falcon firmware (Cortex-M ELF)
  → kiln (QM validation runtime) + Renode (HIL emulation)
  on gale (Verus+Rocq-verified Zephyr RTOS primitives)
  → Pixhawk 6X-RT (i.MX RT1176)

So meld output is exercised end-to-end through a real wasm→embedded pipeline toward real drone hardware (Renode HIL now; on-FMU/real flight in progress — jess#62, Phase 2). meld is also used to fuse gale/kiln themselves as wasm in some configs.

Rescoped: what's genuinely still missing (not "the whole seam")

1. meld-repo-local e2e smoke — meld's own CI still has no execution test; the behavioural proof currently lives in jess, not here. A small in-repo "fuse → run → assert export" smoke (even via kiln QM-runtime or Renode) would let meld catch a fusion regression at its PR time instead of at the jess integration boundary. This is the real meld-side gap.
2. Tier coverage on the real path — confirm which of {sync cross-component call, resource handle, guest-to-guest stream (SR-33), async-lift (SR-32)} the relay/falcon component actually exercises through jess, and add fixtures for the tiers it doesn't.
3. Keep this issue as the meld-output verification-closure tracker; the hardware/HIL half is owned by jess (and kiln#344/#317). Cross-linking jess here.

Net: downgrade severity — this is "tighten meld's local verification + map tier coverage," not "the pipeline is unproven."