fix: #346 never write a module loom has not validated, and emit the data count section

[avrabe]

Stacked on #344 → #343. Bases retarget as each merges.

Closes #346. Closes the CLI half of #345.

Reproduces from 79 bytes

(module (memory 1) (data $d "hello")
  (func (export "init") (param i32)
    local.get 0  i32.const 0  i32.const 5
    memory.init $d
    data.drop $d))

$ loom optimize dc.wasm -o out.wasm
✅ Optimization complete!     $ echo $? -> 0
$ wasm-tools validate out.wasm
error: data count section required (at offset 0x2d)

The narrow half — the section was never emitted at all

Not "dropped": there was no reference to the data count section anywhere in loom-core. The parser read MemoryInit/DataDrop; nothing ever wrote the section they require. The spec makes it mandatory precisely so those instructions can be validated without scanning the data section.

Now emitted (id 12) between element and code whenever those instructions survive. The count is the number of data segments — the size of the index space they index into, not the number of references.

The systemic half — the guarantee was unreachable

The #257 MANDATORY AUTHORITATIVE OUTPUT-VALIDATION BACKSTOP, whose comment states it is "the systemic guarantee that loom can NEVER emit structurally invalid wasm", lives inside optimize_module. The CLI does not call it — it drives the passes directly (#345).

Grepping loom-cli/src/main.rs for validate: three hits, all comments. The binary everyone runs had no output validation whatsoever, so any encoder bug shipped silently as success. This one did.

All three CLI write paths — serial pipeline, islands, component — now pass through one gate, using the same authoritative check via a newly exposed encode::validate_output_bytes so the CLI cannot drift to a weaker feature set than the parser.

$ loom optimize dc.wasm -o out.wasm         # with the encoder fix reverted
error: the optimized module failed authoritative WebAssembly validation:
       data count section required (at offset 0x2d)
note: wrote the ORIGINAL module to out.wasm instead;
      nothing invalid was written, and nothing was optimized.
note: this is a loom bug — please report it with the input module.
$ echo $?  ->  1
$ wasm-tools validate out.wasm  ->  valid, byte-identical to the input

The fallback runs only after the original is itself proven valid, so a .wat input or an already-invalid one is never copied over the output path and presented as a module.

Tests

The load-bearing assertion is that the output carries a data count section, not merely that it validates — validation alone would also pass if a future change simply deleted the instructions.

The unit tests on the gate are what fail if the gate is removed; the fixture sweep ("exit 0 implies the artifact validates") holds trivially while the encoder is correct, so it cannot catch that on its own. Paired with a positive control, since a gate that refused everything would pass the refusal test.

Confirmed discriminating twice, by reverting each half independently: without the encoder fix the memory.init test fails on "data count section required"; without the gate the CLI writes the invalid module and exits 0.

loom-cli 21/21 · loom-core --lib 534/534 (default and LOOM_VERIFY_BACKEND=both) · --test verification 47/47 · fmt clean.

On gale's secondary observation

The dropped wsc.transformation.attestation is not addressed here — worth its own issue if the attestation is meant to travel with the artifact.

Verifies TEST-346-OUTPUT-IS-VALIDATED-BEFORE-IT-IS-WRITTEN