docs(adr): ADR-7 — ABI & linking-strategy architecture (canonical mix-and-match vs symmetric/PIC fast lane)

[avrabe]

What

ADR-7 (open design question): how should meld support the shared-address-space
fast lane (PIC #353 + Christof's symmetric ABI) without sacrificing RFC-46
canonical mix-and-match? Drafted per the "be careful / stay true / think if we
need a rework to split" steer.

Not a code change — a decision artifact for review (@cpetig too). Status open;
humans promote.

The core argument

• Invariant: RFC fix: correct callee_defines_resource for sentinel type entries #46 canonical fusion = the mix-and-match standard; that is
  "staying true" and must not be traded away.
• Opportunity: PIC dissolves the reloc machinery (fuse --memory auto/shared silently corrupts memory across components: load/store dynamic addresses are not rebased (no memory.grow; distinct from #172/#299) #326→meld --memory shared --address-rebase skips R_WASM_MEMORY_ADDR_SLEB relocations: a rebased module's i32.const data pointer stays stale -> silent cross-component aliasing (gap in #340) #351); the symmetric
  ABI turns cross-component calls into ordinary linking of mangled symbols
  (zero-copy, no dynamic alloc — the ASIL-D property), retiring most of the
  ~16.4k-line FACT/adapter subsystem for that input class.
• Tension: the fast lane is a closed world (symmetric↔symmetric, PIC↔PIC) — it
  does not mix with stock canonical components.
• Reconciliation (recommended path-H): make ABI/linking a per-boundary
  strategy with canonical as the universal fallback — direct wiring only
  where both sides opt in, FACT adapter everywhere else. Composability is never
  lost; zero-copy is only gained.
• Rework verdict: a split, not a rewrite — grounded: adapter/FACT already
  has 0 merger refs (separable); reloc/rebasing has ~26 (extract it); the
  Rocq-proven core is untouched.
• RFC-46 convergence: the open Q1 (multiply-instantiated modules — meld today
  Error::DuplicateModuleInstantiation rejects them) is the same core-instance
  topology work Evaluate PIC / shared-everything dynamic linking as an input ABI (dissolves the #351 reloc-drift class) — revisit ADR-6 #353 needs; path-H does it once and shares it.

Paths

G bolt-on (rejected) · H clean strategy-split (recommended) · I separate tool
(rejected) · J do-nothing/canonical-only (baseline).

Does not block

#352 (canonical --emit-relocs backstop) ships regardless — it serves the
mix-and-match path today.

Refs #353, RFC-46, ADR-4, ADR-6.

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}