chore(release): v0.38.0 — memory-strategy soundness gate + reproducible output

[avrabe]

Cuts v0.38.0 (0.37.0 → 0.38.0). rivet release status v0.38.0 → ✓ cuttable (SR-37 scoped, verified); rivet validate PASS.

Scope (already merged to main)

• fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326 shared+rebase soundness gate (auto→multi) — ⚠ default-behaviour change
• fuse: output is byte-nondeterministic — identical input yields a different sha256 each run #325 --reproducible byte-stable output
• meld fuse produces DWARF that fails llvm-dwarfdump --verify (534 out-of-parent + 480 overlapping ranges) while inputs verify clean #319 DWARF-verify trilogy (1049→0 --verify errors)
• Close the meld→kiln end-to-end seam: run a meld-fused core module on kiln and assert behavioural equivalence #297 kiln-seam tracking; chore(release): adopt rivet v0.22.0 release-handling as the readiness gate #318 rivet release-handling gate

⚠ Default-behaviour change (#326)

--memory auto no longer selects shared+rebase (it silently corrupted computed-pointer memory) — always resolves to multi-memory. This supersedes ADR-4's "Auto is not flipped" maintainer decision (which assumed shared+rebase was a sound alternative isolation model). Default output now needs --enable-multimemory; explicit --memory shared --address-rebase still works but warns loudly.

Safety-doc reconciliation (this release's traceability gate)

• SR-37 corrected — it had required the unsound shared preference; now requires Auto→multi. Scoped release: v0.38.0, verified.
• LS-M-11 added — the fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326 hazard (dynamic addresses not rebased → silent corruption) + gate mitigation + pending rewriter fix. Pinned by ls_m_11_auto_gates_unsound_shared_rebase.
• ADR-4 superseded-in-part — banner + corrected the stale "no behaviour change" note.
• SWV-37 updated to the renamed test.

Falsification

ls_m_11_auto_gates_unsound_shared_rebase (auto→multi + 2 memories), test_reproducible_attestation_is_byte_stable (+ control differs), llvm-dwarfdump --verify 1049→0.

On merge: tag v0.38.0 on green main (release.yml).

🤖 Generated with Claude Code

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}