plan(v0.62): reach stays but stops being the headline, and gets a gating rule (9 -> 10)

[avrabe]

Resolving the fork jess opened on #1132, against the test "would it hurt anyone, or might others be in need of it".

Others might need it — so reach stays

jess measured synth's reach at 100% for the falcon cascade (5/5 stages on cortex-m7dp and cortex-m4f, bit-exact against relay's SIL reference on emulated RT1176) and argued the compile rate was never their binding constraint.

That is correct about jess, and it is n=1. Their pipeline is curated on a pinned toolchain; the 805-module census measures modules nobody curated for us. A consumer who hasn't filed yet cannot argue for themselves.

But "would it hurt anyone" has a real answer, and it is not no

#1072's own framing: "increasing reach converts latent encoder defects into reachable ones, and a backend that accepts 1.6% of real input has most of its encoder untested by real programs."

That is not a worry — it is what happened. The release-invisible immediate-range defect, where a NULL table slot passes the type check it must trap on, was latent only because those modules declined at module level before reaching the encoder. Widening acceptance made it live. We found it by going to look; a consumer would have found it by flying it.

The gating rule

Every reach increment ships with the oracle that makes the newly-accepted input safe, and the oracle lands first.

An accepted module that silently returns a wrong value is strictly worse for a consumer than a loud decline — that is synth's whole differentiator, and trading it for an acceptance percentage is the flattery the compliance-envelope section forbids. RQ-62-MVLOWER already had this shape; it now applies to multi-memory and AArch64 import dispatch too.

Headline demoted, work kept. The acceptance rate is published as the denominator beside capability claims, not as an objective.

New, and it takes the priority reach gives up

RQ-62-VERIFYEMBED (must). #1131 made our side of the ABI checkable; nothing checks the consumer's. jess conformed correctly by luck on two independent counts — a 1-in-2 guess on which of two linear-memory bases was authoritative, and a C shim that happened to compile to a bare tail-branch so GCC never allocated R11 as a frame pointer — and found both only by reading the document after their code was green.

The ask: a check that refuses an embedder object writing R9/R10/R11. They've offered to validate any prototype against a real fused image on emulated RT1176 before we ship it.

Also recorded so it isn't re-litigated: the func_N alias does not solve the @-in-export-name papercut. Measured — it is emitted STB_LOCAL, so an external bl func_0 cannot resolve to it. jess's objcopy workaround is still load-bearing.

ARTIFACT_FLOOR 518 → 519, re-derived with rivet list.

Refs #242, #1132, #1131

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!