[rvcas]

The spec says integer overflow and underflow trap for every integer type (docs/language-spec.md, "Overflow and underflow"). Codegen only checked i64 and u64. The checks in #110 predate the narrower types added in #113, and u64 went through the signed i64 checks.

What was wrong

• i8 through u32: +, - and * wrapped silently.
• u64: used signed checks, so 1 + 9223372036854775807 trapped while 18446744073709551615 + 1 wrapped to 0.
• Unary - was never checked, not even -i64::MIN.
• i8/i16 MIN / -1 left an out-of-range value, such as 128 in an i8, because it fits in the i32 it's computed in. 32- and 64-bit division traps natively.

Fix

Every checked operation now goes through get_or_create_checked(op, width) in intrinsics.rs. It keeps #110's pattern (a small check function generated once and called) and the existing i64 functions unchanged. Per operation and type, it generates:

• u64: unsigned checks: sum <u x, x <u y, and y != 0 && p /u y != x.
• i32/u32: compute exactly in i64, and trap if the result doesn't fit in 32 bits.
• 8/16-bit: compute exactly in i32, and trap if normalizing the result to the type changes it.

Negation goes through the checked 0 - x. With check_overflows: false everything still wraps as before, and narrow signed division now wraps too instead of leaving an out-of-range value.

Testing

• tests/overflow.rs gains two tests that run all eight types through add, sub, mul, div and negation at their boundaries: one in checked mode and one in wrapping mode. Both fail on main and pass with this change.
• The shared compile_program helper asserted on the parse errors twice instead of the compile errors, so codegen errors went unnoticed. It now checks the compile errors.
• One snapshot changed: score.star does u64 arithmetic, which now uses the unsigned checks.
• The starstream-to-wasm, starstream-proving-runtime, starstream-runtime and starstream-ledger tests pass.

Side effect

The trace-row census drops from 6,001 to 5,890 rows. The test contracts mostly use u64, and the correct unsigned add check costs 13 rows where the signed one cost 23. The census's checked-intrinsic columns undercount now, because its operator-pattern matcher doesn't recognize the new u64 multiply. The totals are accurate.

Not in this PR

Signed / and % truncate, but the spec says they're floored: -3 / 16 gives 0, where the spec says -1. That's a separate bug.

[SpaceManiac]

the existing i64 functions unchanged

surface thought: should the old functions also be merged in? not sure what value there is in special-casing them ("handled above" type stuff)

[SpaceManiac]

not rigorously analyzed, but looks like it gets the job done