feat(#782a): implement the WASM trunc_sat family — nontrapping saturating float→int (i32 forms on ARM32, all 8 on aarch64)

[avrabe]

Part a of #782 (v0.48 wave 1, lane 1): the 0xFC-prefixed saturating-float-to-int family (i32/i64.trunc_sat_f32/f64_s/u, WASM Core §4.3.2) was never implemented — the decoder dropped all 8 ops and every containing function loud-skipped (falcon's skipping 'ts32'/'ts64' class; falcon-flight-v1.123 carries 7× i32.trunc_sat_f64_s + 1× i32.trunc_sat_f32_s).

Semantics (§4.3.2 — TOTAL, never traps)

NaN → 0; below INT_MIN → INT_MIN; above INT_MAX → INT_MAX (unsigned: negatives → 0, above UINT_MAX → UINT_MAX); else truncate toward zero.

What lands where

op	ARM32 Thumb-2	aarch64	RV32
i32.trunc_sat_f32_s/u	✅ bare RZ VCVT.{S32,U32}.F32 (m4f/m7/m7dp)	✅ bare FCVTZS/FCVTZU wd	loud-decline
i32.trunc_sat_f64_s/u	✅ bare RZ VCVT.{S32,U32}.F64 (m7dp)	✅ bare FCVTZS/FCVTZU wd, dn	loud-decline
i64.trunc_sat_* (4)	LOUD-decline (no i64 register-pair conversion path — decline > wrong)	✅ bare FCVTZS/FCVTZU xd (clang-verified sf=1 encodings)	loud-decline

The key insight both ways: ARM RZ VCVT / A64 FCVTZ saturate out-of-range and give 0 for NaN — the exact "more-total-than-WASM" behavior the #709 domain guard exists to keep away from the trapping trunc forms is the required semantics for trunc_sat, so the correct lowering is the bare convert with no guard. Both selector paths covered (with-stack = falcon's --relocatable path, and select_default parity); the with-stack lowerings reuse the trapping twins' pinned-home copy dance.

Bug the gate caught before it shipped

The optimized path silently compiled trunc_sat functions to 2-byte bx lr stubs (the #615 silent-NOP class): is_unsupported_float_op didn't list the new ops, so they fell through the IR bridge as no-ops. Fixed by bailing all 8 forms to select_with_stack; the boundary differential is what caught it.

Gates (mechanical, non-vacuous)

• scripts/repro/trunc_sat_782_differential.py (CI-wired in trap-semantics-oracle): 536 checks vs wasmtime — NaN, ±inf, exact INT_MIN/INT_MAX boundaries (incl. the f32-can't-represent-2^31−1 and f64 −2147483648.999 edges), ±0.5 fractions, in-range values — executed under unicorn (Thumb-2 m7dp and m4f, aarch64) and natively on an arm64 host (forked child so a spurious brk is observable). No case may trap anywhere. Falcon's exact flags (-t cortex-m7dp --relocatable) are compile-gated: the i32 forms must not skip; the ARM32 i64 forms must decline loudly by name.
• Rust gates: ARM32 sat = bare-VCVT/no-Udf + the trapping twins keep their thumb-2 f32: i32.trunc_f32_s/u silently saturate instead of trapping on NaN/Inf/out-of-range (bare VCVT, no guard) — WASM Core §4.3.3 soundness bug #709 Udf guard + i64 loud-declines + no-FPU/single-precision honest-rejects (synth-synthesis/tests/trunc_sat_782.rs); aarch64 one-bare-fcvtz w/x-form streams + clang-pinned x encodings; RV32 Unsupported; decoder un-drop test.
• Existing trapping-trunc differentials green (m4 trap guards untouched): f32 f32.load + i32.reinterpret_f32 not lowered on the thumb-2 FPU path — the #369 residual that actually blocks falcon (20 of its 24 float skips) #708/thumb-2 f32: i32.trunc_f32_s/u silently saturate instead of trapping on NaN/Inf/out-of-range (bare VCVT, no guard) — WASM Core §4.3.3 soundness bug #709 48/48, f64 arm backend uses soft-float for all f32/f64 — hardware FPU never used (cortex-m4f/m7/m7dp identical); blocks REQ-PIX-001 hard-float #369 339/339, aarch64 m4 167 cases.
• Frozen anchors bit-identical (10/10), full workspace 2381 passed / 0 failed, clippy -D warnings clean, claim gate 21/21.

Decline-honesty

No existing gate asserted "trunc_sat unsupported" (the drop was the decoder _ => None); the still-declining subset (ARM32 i64 targets, RV32 everything) now has named loud-decline gates in both the Rust tests and the differential.

falcon relevance (#782)

Addresses the GI-FPU-001 unsupported operator class for i32.trunc_sat_f32_s / i32.trunc_sat_f64_s — 2 of the 3 functions in that skip class (the third is f64.reinterpret_i64, a separate lane). The dominant 12× "integer popped f32" class and the rest of the #782 breakdown are out of scope for part a.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 90.17094% with 23 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/instruction_selector.rs	75.82%	22 Missing ⚠️
crates/synth-backend-riscv/src/selector.rs	94.11%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!