0026: the dev loop assembles next to the engine, surveyed by running it

wabt.js is out — its parser rejects (rec ...) at the first token, and
its README's proposal table has no GC row (both checked 2026-07-30).
binaryen.js 131 assembles every emitted corpus module to the same
outcome as wasm-tools, 113/113 values and traps, at 1.28 ms median per
form in-process against the 23 ms spawn 0022 A measured — so the
compiler emits WAT text in both modes, one emitter core, and the dev
loop's assembler lives where the engine lives.

The differential earned its keep before the decision landed: with no
setFeatures binaryen silently degrades eqref to anyref, with
Features.All it emits exact heap types stable V8 rejects, and stacky
local.sets materialize anyref scratch locals — so feature flags are
explicit forever, and emit-recur now rebinds through named temporaries
instead of the value stack. The adversarial review demonstrated the
load-bearing assumption instead of refuting it: rec groups survive
binaryen byte-for-byte, and a binaryen-assembled module links against a
wasm-tools-assembled one through (ref $Fn) — 0009's heap sharing holds
across assemblers.

corpus/devloop_differential.mjs is committed, and running it is part
of "done" for emitted-grammar changes until the dev lane enters the
gate; package.json pins binaryen 131 as the interim manifest. The
throw representation is the one S3 decision still open.

Claude-Session: https://claude.ai/code/session_01XF5Hfq4Ca2N2XYEzWQQuHt

Author: chaploud

.gitignore

@@ -19,3 +19,6 @@ dev/spike/rust_call_cost/target/
 # That has happened twice: a null export index passed to get_func, and a
 # recursive walk sharing its out-parameters.
 hs_err_pid*.log
+
+# npm (dev-loop assembler, doc/design/0026)
+node_modules/

corpus/devloop_differential.mjs

@@ -0,0 +1,66 @@
+// The dev-loop assembler differential (doc/design/0026): every emitted
+// corpus module, assembled by binaryen.js — the dev lane's assembler —
+// must agree with wasm-tools' binary (on disk, the oracle's reference
+// lane) on every outcome, value and trap.
+//
+// Until the dev lane itself is in the gate, running this is part of
+// "done" for any change to the emitted grammar (0026's interim rule).
+//
+//   clojure -X:test :nses '[cljwit.corpus-test]'   # regenerate target/corpus
+//   npm install binaryen                            # once, anywhere on NODE_PATH
+//   node corpus/devloop_differential.mjs
+//
+// Feature flags are explicit and must stay so: Features.All emits exact
+// heap types stable V8 rejects, and no features at all silently degrades
+// eqref to anyref — both are wrong-binary failures, not errors (0026).
+
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+const dir = "target/corpus";
+if (!existsSync(dir)) {
+  console.error("no target/corpus — run the corpus test first (it emits the modules)");
+  process.exit(1);
+}
+
+let binaryen;
+try {
+  binaryen = (await import("binaryen")).default;
+} catch {
+  console.error("binaryen.js not resolvable — npm install binaryen (see header)");
+  process.exit(1);
+}
+
+const F = binaryen.Features;
+const FEATS = F.GC | F.ReferenceTypes | F.TailCall | F.ExceptionHandling |
+              F.BulkMemory | F.Multivalue | F.SignExt | F.NontrappingFPToInt |
+              F.MutableGlobals;
+
+const run = (bin) => {
+  try {
+    const i = new WebAssembly.Instance(new WebAssembly.Module(bin), {});
+    return "result " + i.exports.entry();
+  } catch (e) {
+    if (e instanceof WebAssembly.RuntimeError || e instanceof RangeError)
+      return "trap " + e.message;
+    return "ERROR " + e.message;
+  }
+};
+
+let n = 0, agree = 0;
+for (const f of readdirSync(dir).filter((f) => f.endsWith(".wat")).sort()) {
+  const wat = readFileSync(join(dir, f), "utf8");
+  const reference = new Uint8Array(readFileSync(join(dir, f.replace(/\.wat$/, ".wasm"))));
+  const mod = binaryen.parseText(wat);
+  mod.setFeatures(FEATS);
+  const bin = mod.emitBinary();
+  mod.dispose();
+  const a = run(reference);
+  const b = run(bin);
+  n++;
+  if (a === b) agree++;
+  else console.log(`DISAGREE ${f}\n  wasm-tools: ${a}\n  binaryen:   ${b}`);
+}
+
+console.log(`${agree}/${n} modules agree (binaryen.js ${binaryen.version ?? "?"})`);
+process.exit(agree === n ? 0 : 1);

doc/design/0022-s3-compiler-shape.md

@@ -63,7 +63,9 @@ cannot instantiate text anyway, so something assembles there regardless), a
 WasmGC binary writer** (JVM-hosted, Apache-2.0, named in E — the first
 draft's "no off-the-shelf JVM WasmGC-emission library" overclaimed against
 its own section E). The dev-loop format is decided by that benchmark,
-before the nREPL unit, not here.
+before the nREPL unit, not here. *(Decided 2026-07-30: `0026` — WAT text
+in both modes, assembled next to the engine by binaryen.js at 1.28 ms per
+form; wabt.js measured unable to parse rec groups.)*
 
 ### B. The differential oracle is CI-mandatory from the first special form
 

doc/design/0026-dev-loop-assembler.md

@@ -0,0 +1,138 @@
+# 0026 — The dev loop assembles next to the engine
+
+**Status:** proposed · 2026-07-30 · adversarially reviewed the same day.
+The review demonstrated the decision's load-bearing assumption rather
+than refuting it — cross-assembler, cross-module rec-group identity
+(§3b) — and changed four things, marked *(review)*: the cold-start and
+size-scaling costs stated next to the headline median, the committed
+differential script with the interim "done" rule, the skew watcher named
+as that same rule, and the preamble-growth falsifier with its
+import-shaped exit.
+
+## The question
+
+`0009` made the dev-mode output format a decision that cannot be
+retrofitted, and its own precondition was a cost measurement before S3
+commits to one. `0022` A ran the first half — `wasm-tools parse` spawns
+at ~23 ms median per form, so a 300-form namespace `require` through a
+per-form dev loop is ~7 s of assembler spawns — and named four
+candidates, none examined: assembling near the engine (binaryen.js /
+wabt.js), a persistent assembler process, batching forms per flush, and
+TeaVM's WasmGC binary writer. This note examines them and decides.
+
+## The decision
+
+1. **The compiler emits WAT text in both modes — one emitter core.**
+   `0022` A's stated preference ("the two should share an emitter
+   core"), now affordable because:
+2. **The dev loop assembles in-process, next to the engine, with
+   binaryen.js.** Measured 2026-07-30 (binaryen.js 131.0.0 from npm,
+   node v26.3.0, Apple M4 Pro; probe in this survey's session):
+   parse+emit of a real emitted module (`fn-defn-fib.dev`, 538 B binary)
+   is **1.28 ms median** (min 1.19, max 2.52 over 50 in-process reps)
+   against the measured 23 ms spawn — **18×** — and V8
+   compile+instantiate of the result adds 0.005 ms. The 7-second
+   300-form `require` becomes ~0.4 s. Two honest costs the median hides
+   *(review)*: a session pays **~170 ms once** (importing binaryen.js
+   ~134 ms plus a ~33 ms first assemble), and the per-form cost is
+   **linear in module text** (4.0 KB → 0.92 ms, 8.7 KB → 1.94 ms) —
+   consequences under "what would falsify this". V8 cannot instantiate
+   text, so *something* must assemble on the engine side regardless
+   (`0022` A); this makes that something the whole answer.
+3. **The evidence is the whole corpus, not one module.** All 113 emitted
+   corpus modules (both modes) assembled through binaryen.js agree with
+   `wasm-tools`' binaries on every outcome — every value, every trap.
+   The probe is committed as `corpus/devloop_differential.mjs`, and
+   **re-running it is part of "done" for any change to the emitted
+   grammar** until the dev lane itself is in the gate *(review — the
+   interim rule; weak enforcement, honestly labeled, and the gate lane
+   is the recorded stronger fix the first time drift actually happens)*.
+   That differential found two silent-wrong-binary failures on the way,
+   which are now constraints:
+3b. **Cross-assembler, cross-module type identity holds — demonstrated,
+   not assumed** *(review — it is the fact `0009`'s dev-mode heap
+   sharing rests on)*: a module exporting `make : [] → (ref $Fn)` links
+   into a separately assembled importer through `call_ref`, in both
+   pairings (binaryen→binaryen and wasm-tools→binaryen), and
+   `wasm-tools print` shows binaryen preserves the rec group verbatim.
+   One caveat came with the proof: binaryen prunes unreachable types,
+   so an emitted group must stay reachable or stay absent — never
+   half-referenced.
+4. **Feature flags are explicit — never `Features.All`, never none.**
+   With no `setFeatures` call, binaryen's writer silently degrades
+   `(ref null eq)` to `anyref` and the binary fails validation on the
+   engine; with `Features.All`, the writer emits *exact* heap types
+   (custom-descriptors, off by default in stable V8) and fails the same
+   way. The dev lane sets exactly the features the emitter uses — the
+   same discipline the `wat` skill already records for `wasm-opt`, now
+   with its "All is as wrong as none" half.
+5. **The emitter stays in the folded, non-stacky subset of WAT.**
+   Binaryen's parser is an AST, not a stack machine: bare stacky
+   `local.set`s (the first `recur` emission) materialize as `anyref`
+   scratch locals, lose the eq refinement, and fail validation.
+   `emit-recur` now rebinds through explicit temporaries. The
+   constraint's mechanical pin — a binaryen.js lane in the harness —
+   lands with the nREPL unit that actually wires the dev loop; until
+   then this survey's 113/113, dated today, is the evidence.
+6. **`wasm-tools parse` stays the prod/batch assembler and the oracle's
+   reference lane.** Two independent assemblers agreeing on the corpus
+   is coverage, not redundancy — the same argument the gate already
+   makes for two clj-kondos.
+
+## Why
+
+- **wabt.js is out, checked by running it** (1.0.39, 2026-07-30): its
+  parser rejects `(rec …)` at the first token — the corpus's shared
+  fn substrate cannot be expressed. Second instrument, per the survey
+  rule on negative claims: the Supported Proposals table in wabt's own
+  README omits GC entirely
+  (<https://github.com/WebAssembly/wabt>, checked 2026-07-30).
+- **binaryen.js is the same project as the pinned `wasm-opt`** — one
+  toolchain relationship, not a new one; the skew (npm 131 vs flake's
+  129) is real and recorded below.
+- The measured per-form cost sits well below any editor-latency
+  convention, with the margin available for the compiler's own
+  analyze/emit time.
+
+## Alternatives rejected
+
+- **wabt.js** — cannot parse the output (measured; above).
+- **A persistent assembler process.** It amortizes the spawn cost that
+  in-process assembly removes entirely, and pays for it with process
+  lifecycle management in every editor session. Nothing is left for it
+  to be better at.
+- **TeaVM's WasmGC binary writer.** A second, JVM-side emitter core —
+  exactly what `0022` A's shared-core preference exists to avoid — and
+  on the wrong side of the wire: `0009`'s dev loop instantiates in the
+  engine's world, so JVM-side binaries still cross to the engine, while
+  WAT text crossing the wire keeps the payload readable in every
+  debugging session. Unneeded at 1.3 ms.
+- **An own binary writer** — already rejected with evidence in `0022` A
+  (clj.wasm's recorded stall); nothing here reopens it.
+- **Batching as the primary mechanism.** Still trivially available on
+  top (one flush, one module), but at 1.3 ms/form nothing forces it,
+  and per-form modules are what `0009`'s open world wants.
+
+## What would falsify this
+
+- **A text shape the emitter later needs that binaryen's parser lacks**
+  — it already dictated non-stacky emission once. Surfaces mechanically
+  once the dev lane is in the gate; until then,
+  `corpus/devloop_differential.mjs` is the check, and running it is
+  part of "done" for emitted-grammar changes.
+- **The version skew biting**: npm binaryen.js and the flake's binaryen
+  are different builds of one project (131 vs 129 today). `tools.json`
+  gains the dev assembler's version when the nREPL unit lands; until
+  then the committed differential is also the skew watcher — the same
+  interim rule, named once *(review)*.
+- **The margin is a function of the runtime preamble** *(review)*:
+  every per-form module re-parses the whole preamble, and assembly cost
+  is linear in it — a 100 KB core-library preamble puts the per-form
+  cost near 20 ms and the win is gone. The exit is already the shape
+  `0009`'s shared heap wants: dev-mode forms *import* the shared
+  runtime instead of re-declaring it. If that lands, this note's
+  numbers should be re-taken for the import-shaped module.
+- **A browser measurement disagreeing with node's.** This survey
+  measured node; one run characterises one path. The browser tab is the
+  nREPL/browser unit's first measurement, and 1.28 ms has enough margin
+  that only an order-of-magnitude surprise reopens the decision.

doc/status.md

@@ -46,11 +46,19 @@ _Short by design, and printed at every session start — so findings live in
    wraps at MIN∕−1 like the JVM, and the corpus runs the stop-condition
    domain iteratively — fib(46) and fib(91); the 92 entry died at the
    oracle's hands because that loop shape computes one step ahead, and
-   the corpus comment records it. Next unit: **the dev-loop output
-   format** (`0009`'s precondition, `0022` A's candidate list —
-   assembling near the engine, a persistent assembler, batching,
-   TeaVM's writer), because it gates S2's nREPL unit and is the larger
-   of the two open decisions; the throw representation follows it.
+   the corpus comment records it. **The dev-loop format is decided**
+   (`0026`, surveyed by running): WAT text in both modes, one emitter
+   core; the dev loop assembles next to the engine with binaryen.js at
+   **1.28 ms/form** (18× the spawn path; ~170 ms once per session;
+   cost linear in the preamble, exit named). wabt.js measured unable
+   to parse rec groups. The review demonstrated cross-assembler
+   rec-group identity — the fact `0009`'s heap sharing rests on — and
+   two silent-wrong-binary traps are now constraints: explicit feature
+   flags (never `Features.All`), non-stacky emission.
+   `corpus/devloop_differential.mjs` (113/113) is part of "done" for
+   emitted-grammar changes until the dev lane is in the gate.
+   Remaining open: **the throw representation** — the next unit —
+   after which S2's nREPL unit is unblocked on both sides.
 
 Done since the last update: `0016` `own<T>` handles, `0017` host imports
 (A–F), `0018` host-defined resources, `0012`'s `ex-data` contract shrunk to

package-lock.json

@@ -0,0 +1,7 @@
+{
+  "private": true,
+  "description": "npm manifest for the dev-loop assembler only (doc/design/0026). `npm install`, then `node corpus/devloop_differential.mjs`. The version pin moves into tools.json when the dev lane enters the gate.",
+  "devDependencies": {
+    "binaryen": "131.0.0"
+  }
+}

package.json

@@ -94,19 +94,24 @@
             (str/join " " sets) label (emit-expr ctx'' body))))
 
 (defn- emit-recur
-  "Rebinding is simultaneous: every argument is evaluated onto the value
-   stack under the *current* bindings, then popped into the loop locals in
-   reverse — a sequential `local.set` would let later arguments observe
-   earlier rebinds. A fn method's params register under its `:loop-id`,
-   so `recur` to the method head comes through here too (`0024`)."
+  "Rebinding is simultaneous: every argument is evaluated into a fresh
+   temporary under the *current* bindings, then the temporaries copy into
+   the loop locals — a sequential `local.set` would let later arguments
+   observe earlier rebinds. Explicit temporaries rather than the value
+   stack: bare stacky `local.set`s make binaryen's parser materialize
+   anyref scratch locals and lose the eq refinement (`0026`, found by
+   the all-corpus binaryen.js differential). A fn method's params
+   register under its `:loop-id`, so `recur` to the method head comes
+   through here too (`0024`)."
   [ctx {:keys [exprs loop-id] :as ast}]
   (let [{:keys [label locals]} (get-in ctx [:loops loop-id])]
     (when-not label
       (out-of-slice! "recur outside an enclosing loop or fn method" ast))
-    (format "(block (result (ref null eq)) %s %s (br %s))"
-            (str/join " " (map #(emit-expr ctx %) exprs))
-            (str/join " " (map #(format "(local.set %s)" %) (reverse locals)))
-            label)))
+    (let [temps (mapv (fn [_] (fresh-local! ctx)) exprs)]
+      (format "(block (result (ref null eq)) %s %s (br %s))"
+              (str/join " " (map #(format "(local.set %s %s)" %1 (emit-expr ctx %2)) temps exprs))
+              (str/join " " (map #(format "(local.set %s (local.get %s))" %1 %2) locals temps))
+              label))))
 
 (defn- emit-let [ctx {:keys [bindings body]}]
   (let [[ctx' sets]