Bump wasm bundle loom (stable-2026-03 = v0.3.0) to v1.1.14 — picks up loom#172/#196/#220 correctness fixes + release binaries

[avrabe]

Bump the wasm toolchain bundle's loom (stable-2026-03 ships v0.3.0) to v1.1.14

The stable-2026-03 wasm component bundle pins loom v0.3.0 (used by wasm_optimize). That predates a series of loom correctness fixes that matter for any optimize step in the hermetic path:

• loom#172 — fused-pass element-section size mismatch (invalid module → fallback)
• loom#196 — element-table scramble (valid-but-wrong call_indirect dispatch)
• loom#220 — dead-stores eliminates a live float store on a fused control core (valid-but-wrong; run-stabilization 0.0234 → 0.329)
• and loom v1.1.14 now ships prebuilt platform binaries + cosign/SLSA/SBOM (it didn't before), so the bundle can consume a verified release artifact instead of a source build.

Impact for jess: with meld → loom → synth (loom optimizing the fused core), jess hit loom#220 via the bundle's optimize path and currently carries a defensive passes-without-dead-stores override in BUILD.bazel + the behavioral SIL gate. Bumping the bundle's loom to v1.1.14 lets jess drop that override and get correct + fully-optimized output hermetically. Verified at the CLI: loom v1.1.14 on the meld-fused falcon core, full default passes, is behaviorally exact (kiln run-stabilization 0.023399856 == reference).

Ask: bump the stable-2026-03 (or a new bundle) loom pin to v1.1.14. Happy to verify //:falcon-optimized end-to-end against the bumped bundle. Cross-ref jess AFD-023/AFD-015.

[avrabe]

Triaged — and there's a wrinkle that makes this more than a pin bump. loom v1.1.14 ships no loom.wasm. Its assets are native per-OS binaries only:

loom-v1.1.14-aarch64-apple-darwin.tar.gz
loom-v1.1.14-x86_64-apple-darwin.tar.gz
loom-v1.1.14-x86_64-unknown-linux-gnu.tar.gz
loom-v1.1.14-x86_64-pc-windows-msvc.zip
+ SHA256SUMS(.sig/.pem/.cosign.bundle), loom-1.1.14.cdx.json (SBOM)

But today wasm_optimize runs the loom.wasm component under wasmtime (via //tools/loom_wrapper, from #490), pinned through @loom_wasm = wasm_component_download(tool_name="loom", filename="loom.wasm"). v0.3.0 was the last release carrying loom.wasm; v1.x is native-only. Also the per-OS naming changed (loom-macos-x64 → loom-v{ver}-{rust-triple}).

So consuming v1.1.14 means migrating wasm_optimize to a native loom toolchain:

1. New loom toolchain that fetches loom-v{version}-{platform} per-OS (registry entry with the new naming + SHA256SUMS checksums; verify cosign/SLSA optionally).
2. Rewire wasm_optimize to invoke the native loom binary directly (it no longer needs loom_wrapper/wasmtime — the symlink/preopen problem wasm_optimize: LoomOptimize action cannot find a fetched/symlinked input (wasmtime --dir=. preopen) #490 solved was specific to running loom under wasmtime; a native binary reads inputs directly, so this also retires that wrapper for loom).
3. Drop the @loom_wasm universal-component path; bump the bundle/registry to v1.1.14.

This is the right move (gets #172/#196/#220 + signed artifacts) but it's a rule change, not a version pin. Confirm you want the native-binary direction (jess already uses the loom CLI natively, so I assume yes) and I'll implement the loom native toolchain + wasm_optimize rewire. Happy to gate it on your //:falcon-optimized end-to-end check.

[avrabe]

Confirmed direction (native binary) — implementing. Plan, mirroring the existing meld native toolchain (toolchains/meld_toolchain.bzl → MeldInfo/ToolchainInfo, consumed by meld_fuse via ctx.toolchains[...].meld):

1. checksums/tools/loom.json — add 1.1.14 with native per-OS assets + verified (signed SHA256SUMS) checksums:
   • aarch64-apple-darwin d8011653…, x86_64-apple-darwin e8b4e488…, x86_64-unknown-linux-gnu a43280bb…, x86_64-pc-windows-msvc bfbfd099… (asset loom-v{version}-{triple}.tar.gz/.zip).
2. toolchains/loom_toolchain.bzl + loom_toolchain_type — repository rule mirroring meld_repository, but extracts the tarball (meld ships a bare binary; loom ships .tar.gz/.zip) and exposes the loom binary via ToolchainInfo; stub for unsupported platforms.
3. MODULE.bazel — register the loom toolchain (like meld); drop/retire the @loom_wasm wasm_component_download.
4. wasm/private/wasm_optimize.bzl — run the native loom directly (ctx.toolchains[loom_toolchain_type].loom, loom optimize <input> -o <output> …); remove the loom_wrapper/wasmtime/@loom_wasm path (the wasm_optimize: LoomOptimize action cannot find a fetched/symlinked input (wasmtime --dir=. preopen) #490 symlink/preopen problem was specific to running loom under wasmtime — a native binary reads inputs directly, so loom_wrapper is retired for loom).
5. Bundle stable-2026-03 (or a new bundle) → loom 1.1.14.

I can verify rule analysis + a local optimize on a generated component, but the meld → loom → synth falcon path needs your //:falcon-optimized e2e — I'll gate the PR on that. Cosign/SLSA verification of the artifact: optional follow-up (checksums are already pinned).

[avrabe]

Step 1 shipped (#513: loom 1.1.14 registry, verified). Build notes for steps 2–5 (confirmed against the tarball + meld pattern), so the toolchain rewire is unambiguous:

• Tarball layout: loom-v1.1.14-{triple}.tar.gz contains ./loom (binary), ./README.md, ./LICENSE — no version subdir, so extraction strip-prefix is empty and the binary lands at loom.
• Toolchain: toolchains/loom_toolchain.bzl mirrors meld_toolchain.bzl exactly (repo rule → stub for unsupported platforms → ToolchainInfo(loom=...)), except it extracts the archive: tool_registry.download(...) already extracts non-binary:true registry entries (loom's 1.1.14 entries have no binary:true), vs meld's bare-binary output_name="meld". Add loom_toolchain_type in toolchains/BUILD.bazel (next to meld_toolchain_type) + a bzl_library.
• Registration: wasm/extensions.bzl loom_repository(...) + MODULE.bazel use_repo/register_toolchains (mirror meld lines 260/262); drop the @loom_wasm wasm_component_download.
• Rule: wasm_optimize.bzl → loom = ctx.toolchains["…loom_toolchain_type"].loom; ctx.actions.run(executable = loom, arguments=[optimize, input, -o, output, …]); remove _loom_wasm/_loom_wrapper attrs + the wasmtime toolchain. (Consumption template: meld_fuse.bzl.)
• Bundle: stable-2026-03 loom → 1.1.14.

Will implement as a focused PR and gate on your //:falcon-optimized e2e.

[avrabe]

Migration complete in #514 (toolchain + wasm_optimize rewire; builds on merged #513). Verified locally: native loom 1.1.14 optimizes a real component (4/4 core modules). No bundle loom-pin exists (loom is consumed via @loom_toolchain, not a bundle), so that step was moot. @avrabe: please run //:falcon-optimized against the #514 branch — that's the meld→loom→synth fused path that hit loom#220; with v1.1.14 you should be able to drop the dead-stores override. Windows loom (loom.exe) stubbed as a follow-up.