fix(drv): the cross-arch gate was green because it could not see the defect

[avrabe]

Stacked on #312 (the varve pin fix) — without it no varve-shimmed tool resolves in this repo.

The gate merged in #310 was green for the wrong reason

It asserted undefined_count > 0 over a hand-written list of 8 drivers. Both
halves were wrong, and they cancelled into a green light.

It gated 8 of 13. DRIVERS=(wdg gpio i2c timer adc dac pwm uart) while
thirteen *-thin directories exist. can, hm, mpu, spi, switch were
never checked. This is the third enumerated list this month to silently exclude
the newest thing — after check-providers.sh and the Lean target list. Now
discovered, like those.

> 0 is not the property. It is satisfied by any undefined symbol,
including a leaked one — and hm-thin imports nothing, so a correct object
has zero undefined symbols and would fail.

The rule is equality: the object's undefined set must equal the names the wasm
imports. Same rule check-driver-components.py already applies on its object
axis.

What the correct rule finds

	result
ARM	13/13 clean — undefined set == imports, exactly. No leak, no truncation.
RISC-V	0/13.

Full table (re-measured, synth 0.58.0)

driver	imports	ARM cortex-m3	RISC-V rv32imc
adc-thin	read32 write32	45 T, 2 U — complete	26 T, 3 U — 1 of 27 skipped, 1 dangling
can-thin	read32 write32	34 T, 2 U — complete	19 T, 3 U — 1 of 20 skipped, 1 dangling
dac-thin	read32 write32	43 T, 2 U — complete	24 T, 3 U — 1 of 25 skipped, 1 dangling
gpio-thin	read32 write32	30 T, 2 U — complete	17 T, 3 U — 1 of 18 skipped, 1 dangling
hm-thin	(none)	19 T, 0 U — complete	12 T, 1 U — 1 of 13 skipped, 1 dangling
i2c-thin	read32 write32	38 T, 2 U — complete	21 T, 3 U — 1 of 22 skipped, 1 dangling
mpu-thin	mpu-write	27 T, 1 U — complete	no object — exits non-zero (#952)
pwm-thin	write32	36 T, 1 U — complete	21 T, 2 U — 1 of 22 skipped, 1 dangling
spi-thin	read32 write32	34 T, 2 U — complete	19 T, 3 U — 1 of 20 skipped, 1 dangling
switch-thin	ctx-resume ctx-save region-swap	41 T, 3 U — complete	17 T, 10 U — 13 of 30 skipped, 10 dangling
timer-thin	read32 write32	30 T, 2 U — complete	17 T, 3 U — 1 of 18 skipped, 1 dangling
uart-thin	poll read32 write32	27 T, 3 U — complete	16 T, 4 U — 1 of 17 skipped, 1 dangling
wdg-thin	read32 write32	35 T, 2 U — complete	20 T, 3 U — 1 of 21 skipped, 1 dangling

Twelve RISC-V objects cannot be linked: synth's RV32 selector skips a function
it cannot select and emits the call site anyway, leaving a dangling
synth_func_N (definitions are named func_N, so it never resolves). On ARM
the same internals are emitted as local t func_N, all defined — the defect is
specific to the RISC-V backend.

gpio-thin: skipping 'func_18': RISC-V selector: immediate 1048588 too large for memory offset
mpu-thin:  skipping 'func_20': unsupported wasm op for RV32 skeleton: GlobalGet(0)

For a skipped internal function synth exits 0, so the unlinkable object
ships with only a warning. That is exactly what let > 0 read green.

Not a regression. Bisected 0.52.0 / 0.53.0 / 0.54.0 / 0.55.0 / 0.57.0 /
0.58.0 — all produce identical results on today's sources. Filing upstream
separately.

The RISC-V leg is a ledger, not a skip

If a driver starts crossing cleanly the gate fails (exit 5) until it is
removed from RISCV_KNOWN_BAD. The list shrinks to empty instead of outliving
the bug. A driver that newly breaks also fails.

CROSS-ARCH.md was stale, not wrong-at-the-time

It measured pre-componentization sources — wdg-thin had 6 functions then, 21
now — and was never re-measured when they changed. Re-measured here. The
section that justified > 0 is replaced by one explaining why it was the wrong
rule.

Also: a duplicate gate I created

check-driver-components.sh already existed — a red-first shell gate for
REQ-DRV-COMPONENT-001 — when I wrote the .py for the same requirement. Two
gates for one requirement is itself a drift hazard, and the .sh was wired to
nothing. Removed; its red-first framing is preserved in the .py.

Kill-criterion

check-cross-arch.py --self-test must reject a leaked-symbol superset and must
pass an empty expectation:

  self-test ok: leaked symbol (superset) is rejected
  self-test ok: a driver importing nothing passes with 0 undefined

Both run in CI as a step before the gate.

🤖 Generated with Claude Code

https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo

[avrabe]

Note on this PR's checks: it is currently based on fix/varve-pin-digest, and every gale workflow filters pull_request: branches: [main]. So no workflow fires on it at all — the zero-checks state here is an empty gate, not a pass, and it must not be read as green.

Retargeting to main once #312 merges, at which point the real gates run.

[avrabe]

Superseded by #316 — same branch, targeting main. GitHub auto-closed this one when fix/varve-pin-digest was deleted on #312's merge.

Worth recording why this PR was never evidence of anything: it targeted a non-main base, and every gale workflow filters pull_request: branches: [main], so no workflow ever ran on it. It sat at CLEAN with zero checks for its whole life. A stacked PR here does not get a reduced gate — it gets none.