fuse: pass through embedder import `cabi-arena-realloc` instead of trying to satisfy it

[avrabe]

Context

BYO-OS lean-MCU dissolve pipeline (gale#89):

gale app + kernel-primitive components
  → meld fuse --memory shared
  → loom → synth (native ELF, no memory.grow)

Grow-free components (forked wit-bindgen cabi-realloc-extern, pulseengine/wit-bindgen#4) route cabi_realloc to an embedder-provided env::__cabi_arena_realloc, satisfied at native link / synth dissolve — not by the component model.

What wasm-tools now produces (contract)

pulseengine/wasm-tools#2 adds component new --import-passthrough env::__cabi_arena_realloc, which emits a valid component carrying a world-root import:

world root {
  import cabi-arena-realloc: func(p0: u32, p1: u32, p2: u32, p3: u32) -> u32;
  export greet: func() -> string;
}

(extern name = kebab_case(core_field_name); __cabi_arena_realloc → cabi-arena-realloc. Internally it's canon lowered and wired to the core module's env::__cabi_arena_realloc.)

This import is embedder-provided — meant to survive down to synth, not be resolved during fusion.

Ask (meld)

When fusing components — especially fuse --memory shared (meld#298/#300) — recognize this embedder import and pass it through to the fused artifact unsatisfied:

• do not error that the import is unresolved;
• do not attempt to map it to a provider component in the fusion set;
• preserve it (by extern name cabi-arena-realloc, or as the underlying env::__cabi_arena_realloc core import if meld emits a core module) so synth can bind it at dissolve (see synth#418).

Open question for us to settle across meld/synth/wasm-tools: how meld should mark "this is embedder-provided, leave it alone." Options: match on the well-known name cabi-arena-realloc, or introduce a dedicated namespaced interface (e.g. an embedder ABI interface) that wasm-tools emits instead of a bare world-root func. The wasm-tools fork currently emits the bare kebab name; happy to switch to a namespaced interface if meld prefers a non-name-matching signal.

Refs

pulseengine/wasm-tools#2, pulseengine/wit-bindgen#4, pulseengine/synth#418, meld#298, meld#300, gale#89.

Pulseengine fork pipeline only — nothing goes upstream to bytecodealliance.

[avrabe]

meld-side answer (issue-hunt) — core passthrough already works; design recommendation

Already satisfied for core-module output (verified, not speculative)

meld's fusion resolver runs with allow_unresolved: true (Resolver::with_strategy, the path Fuser::fuse uses; only the unused strict() mode errors). So all three asks already hold for the core-module path:

1. Doesn't error on an unresolved embedder import — allow_unresolved: true; the import is recorded in unresolved_imports, not rejected.
2. Doesn't map it to a provider — by construction: resolution matches imports to exports in the fusion set, and no app/kernel component exports env::__cabi_arena_realloc / cabi-arena-realloc, so there's nothing to bind to. It stays unresolved.
3. Preserves it — unresolved imports survive into the fused core. This is already pinned by a regression test: merger::tests::test_298_fork_arena_realloc_fuses_under_shared_rebase_today fuses a pair importing __cabi_arena_realloc, and asserts the fused core retains the import (and keeps cabi_realloc exported). That test is effectively the fuse: pass through embedder import cabi-arena-realloc instead of trying to satisfy it #301 core-passthrough guard; I'll cross-link it.

What still needs verification

The component-level (P2 --output component) path with the wasm-tools#2 world-root import cabi-arena-realloc (canon-lowered to env::__cabi_arena_realloc). Generic passthrough should carry it through the wrap, but I can't prove it without a wasm-tools component new --import-passthrough-produced fixture (your fork). If you can drop one composed fixture into tests/wit_bindgen/fixtures/, I'll add a Tier-B-style assertion that the world-root cabi-arena-realloc import survives fuse --output component.

Design question — meld's recommendation: namespaced interface, explicit recognition (not bare name-matching)

meld needs no name-matching to pass it through today (it passes through all unresolved imports). But "it happens to survive as a generic unresolved import" is implicit — a future stricter resolver mode, or an aggressive resolve change, could silently drop or error it. For a functional-safety pipeline, explicit > incidental (same principle that settled the #300 Auto knob: "explicit, not auto").

So: prefer a namespaced pulseengine:embedder interface (e.g. import pulseengine:embedder/alloc carrying cabi-arena-realloc) over the bare world-root func. Then meld can (a) recognize the pulseengine:embedder namespace as intentional embedder-provided passthrough, (b) never attempt to bind it even under future strict resolution, and (c) assert it survives into the fused artifact (a positive check, not "it didn't get touched"). Bare cabi-arena-realloc name-matching is a magic-string contract that's collision-prone and invisible to review.

If you switch the wasm-tools fork to emit the namespaced interface, the meld side is small: a passthrough-allowlist on the pulseengine:embedder namespace + a survives-fusion assertion. Happy to implement that once the namespace is settled (and add the component-level fixture test above).

Refs: meld#298, meld#300, pulseengine/wasm-tools#2, pulseengine/wit-bindgen#4, pulseengine/synth#418, gale#89.