fix(#952): a declined REQUESTED export now exits non-zero on --all-exports

[avrabe]

Summary

A function synth DECLINES was dropped from the output object with exit 0: a build gating on $? (every build — that's the point) accepted an object silently missing a public entry point. This closes that gap while preserving the existing asymmetry: skipping a non-exported internal helper (pulled in only for #235 reachability) stays a routine warning-only skip; only a decline of a function the module actually (export ...)s now fails the build.

• compile_all_exports now tracks, per skipped function, whether func.export_name.is_some(). If any REQUESTED export was skipped, the compile anyhow::bail!s with a nonzero exit — placed after the existing compiled_funcs.is_empty() bail, so a module whose sole export was skipped keeps its pre-existing "nothing to emit" message rather than being relabeled.
• New opt-in --all-exports-scoped flag --allow-skipped-exports restores the pre-A declined export exits 0 with the symbol simply absent — the decline is honest to stderr but invisible to the build system #952 exit-0 behavior for callers who genuinely want the partial object (the --all-exports corpus-sweep shape, where per-function declines are expected and counted downstream, not treated as a build failure). Inert on the single-function --func-index/--func-name path, which already hard-errors on any decline — documented as such in the flag's doc comment.
• The gated path writes no object (the bail happens before ELF emission). Every caller updated below inspects the object only under --allow-skipped-exports, so nothing reads a missing file.

Red-first numbers

New test: crates/synth-cli/tests/skipped_export_exit_952.rs.

• RED (declined_requested_export_exits_nonzero): gale's exact [CRITICAL] thumb-2 silently miscompiles any call with an i64 parameter that is not last — args land in the wrong registers, exit 0, no warning #929 repro (f, the module's sole export, gets declined). Anchors on stderr.contains("skipping function 'f'") before asserting the exit code, so the test can't pass vacuously. Mutation-tested: reverted just the if !skipped_exports.is_empty() { gate to if false && … (anchor grep -c = 1 before mutating) — the RED test fails with the gate off, passes with it on.
• NEGATIVE CONTROL (skipped_nonexported_helper_still_exits_zero): a fixture where an exported f calls a non-exported helper that itself calls a second non-exported helper with an unsupported f64 op — both helpers get skipped (reachable_from_exports pulls them in only via the call chain), f compiles fine via an external relocation to the missing symbol. Passes both before and after the fix (verified against a separately-built pre-fix baseline binary). Anchors on the skip actually having occurred ("skipping function" + "were skipped" present) so the control isn't vacuous — a fixture where the "helper" is simply never compiled (unreached) produces no skip at all and would prove nothing.
• --allow-skipped-exports (allow_skipped_exports_restores_exit_zero): same RED fixture, flag added, exits 0, decline still warns.

Blast radius

grep -rn "all-exports" .github/workflows/ci.yml → 30 lines. Replayed every one directly against the fixed binary (28 distinct invocations, including the multi-line steps sed doesn't catch on a single-line grep) — all pass unchanged, because none of those specific fixtures currently trigger a skip of a requested export.

The real hits were not in ci.yml's inline commands but in test/oracle files that sweep corpora expecting some functions to decline while asserting overall compile success — six files needed --allow-skipped-exports added:

• crates/synth-cli/tests/call_indirect_275_selfcontained.rs — test_275_selfcontained_a32_still_declines_loudly expects the sole export entry to be loud-skipped (residual A32 arm backend compiles only exports, not the reachable call graph - blocks self-contained firmware #275 decline) with exit 0, to inspect the partial object's symtab.
• crates/synth-cli/tests/i64_call_arg_decline_929.rs — both [CRITICAL] thumb-2 silently miscompiles any call with an i64 parameter that is not last — args land in the wrong registers, exit 0, no warning #929 decline tests compile a module whose sole export is the declined function, asserting compile success to read the diagnostic text.
• crates/synth-cli/tests/rv32_local_promo_flip_472.rs — found by the workspace test run, not the ci.yml grep: its RV32 corpus includes gust_kernel.wasm, whose exported gust_poll already declines on RV32 for an unrelated pre-existing reason (GlobalGet unsupported in the RV32 skeleton) in both arms of the sweep. The gate compares per-function byte sizes across arms and is unaffected by a function absent from both.
• scripts/repro/i64_param_518_riscv_loudskip.py — literally titled "loudskip"; every I64_PARAM_FNS entry is a named export this oracle expects declined, with sys.exit(f"riscv compile failed (expected success with skips): …") on nonzero exit.
• scripts/repro/call_indirect_275_selfcontained_differential.py — python twin of the Rust A32-residual-decline case above.
• scripts/repro/wast_conformance_928_differential.py — the RQ-56-CONF corpus sweep over tests/wast/ (381 assert_return/2 assert_trap assertions), explicitly named in A declined export exits 0 with the symbol simply absent — the decline is honest to stderr but invisible to the build system #952 itself as the shape --allow-skipped-exports exists for. Verified byte-for-byte: built a separate baseline binary from origin/main's main.rs + the original (unpatched) script, ran it, then ran the fixed binary + patched script — both print exactly #928 CHECKS=240/240 executed assertions over 25 wast files; 141 declined / declined by reason: emu-error:...=18, emu-error:...=5, i64-pair=118, identical down to the reason breakdown.

Cleared without changes (each independently re-run against the fixed binary):

• Eight oracle scripts referencing "skipping function"/"were skipped" text whose healthy state has zero skips (framebacking_i64param_837, i64_spill_pool_587, rv32_label_882, aarch64_float_completion_851, vfp_spill_881, i64_param_518_differential, i64_stack_param_503, call_indirect_275_selfcontained_execution_differential) — a regression there already fails today via a different, more specific message; this PR doesn't change what they exercise.
• multi_memory_406.rs's three loud-skip tests (cross_memory_copy_loud_skips, non_default_memory_fill_loud_skips, wide_access_on_non_default_memory_loud_skips) — each fixture's sole export is the declined function, so they already fail today via the pre-existing compiled_funcs.is_empty() bail (unchanged message, unaffected by this PR's new gate since that check runs first).
• scripts/repro/vcr_ra_003_rv32_alloc_validator.py — also sweeps gust_kernel.wasm on RV32, but its own logic already treats a nonzero exit as "compile failed for a non-validator reason, skip" rather than a gate failure; re-run against the fixed binary, still 0 false-positives, gust_kernel.wasm now shows as a skip line where it previously silently attempted validation on a partial object.
• scripts/repro/fact_spec_mask_494_differential.py — fails today with identical output (28 B -> 28 B, non-shrink) against both the pre-fix baseline and the fixed binary; a pre-existing, unrelated environment gap, not a regression from this change.
• scripts/repro/{frame_slot_dce,gust_spill_fwd_390,vcr_dec_001_graph_alloc}_differential.py — also touch gust_kernel.wasm, but on the ARM backend, where the RV32-only GlobalGet gap doesn't apply; all re-run PASS unchanged (vcr_dec_001_graph_alloc_differential.py explicitly shows gust_kernel.wasm applied=2 … diverged OK).

Gates

• cargo fmt --all --check — clean
• cargo clippy --workspace --all-targets -- -D warnings — exit 0
• cargo test --workspace --no-fail-fast — 136/136 test-result blocks ok, 0 failed (this is where rv32_local_promo_flip_472 surfaced and was fixed)
• cargo test -p synth-cli --test frozen_codegen_bytes — 10/10 (no bytes changed)
• cargo build -p synth-cli --features verify / --features exports_only_275_probe / --features riscv --test async_intrinsics_gate — all clean

Closes #952

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

❌ Patch coverage is 88.23529% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/synth-cli/src/main.rs	88.23%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!