fix(opt): ir_to_arm returns Result — panic-free optimized path, fuzz re-gated

[avrabe]

Summary

Makes synth's optimized ARM lowering path (ir_to_arm) panic-free on malformed input — the last remaining panic site in that pipeline — and re-promotes the wasm_ops_lower_or_error fuzz harness to gating. Closes debt open since v0.3.1.

Background

wasm_to_ir was hardened across v0.3.1/v0.4.0 (returns Result, pre-flight wasm_stack_check). But ir_to_arm's get_arm_reg closure still panic!'d on an unmapped vreg (the PR #101 defensive panic). Because of that, wasm_ops_lower_or_error was demoted to gating: false in PR #117 and never re-promoted.

Part 1 — ir_to_arm panic-free

• Signature: ir_to_arm(...) -> Vec<ArmOp> → -> Result<Vec<ArmOp>>.
• get_arm_reg: the panic! became Err(Error::synthesis(...)), preserving the exact issue-memset/memcpy/memmove i64-codegen produces non-terminating loop on Cortex-M (silicon-blocking) #93 diagnostic. The mapped / spilled branches return Ok.
• Threaded ? through all 166 get_arm_reg call sites in ir_to_arm.
• Callers updated: arm_backend.rs folds ir_to_arm into the existing optimize_full().and_then(...) chain — an Err falls back to the direct selector (honest degradation, same shape as the issue-wasm_to_ir: unmapped vreg panic still trips on compiler_builtins (float::div) and gale_compute_ipi_mask after v0.2.1's #97 memset fix #120 float fallback, not a silent R0 swallow). The fuzz harness skips on Err.

The defensive check is not removed — it's converted panic→Err. A malformed-input case and a genuine internal bug both now yield a typed Err with the rich diagnostic. The harness contract ("lower or Err, never panic") is satisfied.

Part 2 — fuzz re-gated

.github/workflows/fuzz-smoke.yml: wasm_ops_lower_or_error flipped gating: false → gating: true; the issue-#121/PR-#117 demote comment replaced with a note that ir_to_arm now returns Result.

Part 3 — regression test

New crates/synth-synthesis/tests/regression_ir_to_arm_panic_free.rs, 5 tests: mixed i32 arith/shift, type-mismatched i64, i64-extend-into-shift, well-formed-program-lowers-to-Ok, and a hand-built IR instruction (Add with unproduced src vregs) that reaches get_arm_reg's defensive branch directly and confirms it yields Err (with a diagnostic-content assertion) rather than panicking.

Note: the optimize_full pre-flight catches WASM-op-level malformed shapes before ir_to_arm; the hand-built-IR test is what exercises the now-Err path directly.

Validation

• cargo test --workspace --exclude synth-verify — 0 regressions (+5 tests).
• cargo clippy --workspace --exclude synth-verify --all-targets -- -D warnings — clean.
• cargo fmt --check — clean.

Test plan

• CI green, including the now-gating wasm_ops_lower_or_error fuzz harness
• No regression in AAPCS / i64 / optimized-path suites

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 76.61692% with 47 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-synthesis/src/optimizer_bridge.rs	75.39%	47 Missing ⚠️

📢 Thoughts on this report? Let us know!

[avrabe]

Two follow-ups pushed: b47eaae fixes the leftover pop_i32_unary! macro .expect(...) (my earlier Result conversion missed it because the macro body's .expect ended with , not ;); the re-gated fuzz caught it on the first run — exactly the bug class re-gating exists to find. c16e314 updates a stale catch-all comment to match the new Err propagation. Polling the rerun.