feat(safety): rivet init, STPA analysis, and 5 code-verified gap fixes

[avrabe]

Summary

• Initialize rivet traceability (common + stpa + dev schemas) matching sister projects kiln, meld, synth
• Full STPA safety analysis of LOOM's 12-phase optimization pipeline
• Code-verified gap analysis with 6 parallel investigation agents
• 5 confirmed gaps fixed, all tests passing

STPA Artifacts (185 total)

• 6 losses, 20 hazards, 8 sub-hazards, 19 system constraints
• 7 controllers, 3 controlled processes, 19 control actions
• 25 UCAs, 24 controller constraints, 15 loss scenarios
• 18 requirements, 7 design decisions, 14 features
• Coverage: 98.9%, rivet validate PASS

Code-Verified Gap Fixes

Gap	Fix	Files
Z3 K-induction silently passes on UNKNOWN	Return Ok(false) instead of assuming equivalent	verify.rs
HashMap non-determinism in CSE + inlining	HashMap -> BTreeMap for iteration-order-sensitive maps	lib.rs, fused_optimizer.rs
Float fold NaN not canonicalized	Canonical NaN enforcement + subnormal skip guard	loom-shared/src/lib.rs
Z3 only tested on 1 fixture in CI	Verify all .wat fixtures + .wasm files in verify job	ci.yml
No binaryen comparison in CI	New differential job: LOOM vs wasm-opt -O3 on all fixtures	ci.yml

Mitigated (guards already exist)

• CSE memory loads: is_safe_to_cse() rejects loads/stores/calls
• DCE br_if: only Return/Unreachable set reachable=false
• Inlining local remapping: proper offset + remap_locals_in_block()
• Precompute mutable globals: if global.mutable { continue; }

Still open

• H-17: Stack validation disabled (lib.rs:5732) — needs false positive investigation

Test plan

• cargo test --release — all 32 loom-core tests pass
• rivet validate — PASS (2 warnings, expected)
• cargo build --release — clean build
• CI workflows (Z3 verify, differential, self-optimization)

🤖 Generated with Claude Code