harness: affine-parity String argument support (+ Float-wall finding)

Extend the affine-parity differential harness to pass String arguments: after
instantiation it grows linear memory by one page and writes String args as
[len:i32 LE][utf8] (matching the compiler's string layout), passing them by
pointer; the oracle still receives the JS string. Adds a `{ strings: [...] }`
arg-spec form. Float args already pass through as wasm f64 via `{ values: [...] }`.

This connects the string-wall compiler fixes to the migration harness. The demo
(examples/string_float_demo) proves slice-9 `==` against a literal AND slice-9 +
slice-10 comparing two RUNTIME-PROVIDED strings pointer-vs-pointer (22/22). No
regression on int-only configs (DeviceType/VmState/Maths/NetworkZones unchanged).

Finding: Float binops type-check but codegen emits i32 instructions on f64
operands (band_of fails wasm validation: `i32.lt_s ... found f64`). The harness
is already ready for float-input brains; the "float wall" codegen fix is the
unblocker. See EVIDENCE-float-wall-finding.adoc.

https://claude.ai/code/session_01WoKhFQePiRsAj7aqnxbG8s

Author: claude

proposals/EVIDENCE-float-wall-finding.adoc

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+= Finding: the "float wall" — Float arith/compare codegen emits i32 ops (2026-06-14)
+:toc: macro
+
+== Summary
+
+`Float`-typed binary operations (`+`, `-`, `*`, `/`, `<`, `<=`, `>`, `>=`, `==`)
+*type-check* but the wasm backend lowers them with **integer** instructions on
+f64 operands, producing a module that fails WebAssembly validation. This is the
+float analogue of the string wall (slices 8b/9/10): the type checker dispatches
+`Float` correctly, but `gen_binop` returns only the i32 instruction family.
+
+== Reproduction
+
+[source]
+----
+pub fn band_of(x: Float) -> Int {
+  if x < 10.0 { 0 } else { if x < 100.0 { 1 } else { 2 } }
+}
+----
+
+[source]
+----
+$ main.exe compile band_of.affine -o band_of.wasm      # compiles
+$ # instantiation fails:
+WebAssembly.instantiate(): Compiling function failed:
+  i32.lt_s[1] expected type i32, found f64.const of type f64
+----
+
+`codegen.ml gen_binop` maps `OpLt -> I32LtS`, `OpAdd -> I32Add`, etc., with no
+`Float` path; the `ExprBinary` lowering applies it to f64 operands.
+
+== Why it has never surfaced
+
+The entire idaptik migration corpus (94 brains) is `Int(...)->Int`: every float
+quantity is carried as a x1000 milli-unit / permille integer, precisely because
+float codegen does not work and the parity harness passes integer args. So no
+shipped artefact exercises float binops, and the gap stayed latent.
+
+== Shape of the fix (the float wall)
+
+The same type-channel pattern that closed the string wall applies. Either:
+
+* *Type-directed elaboration* (mirrors slices 8b/9/10): `synth` records
+  `Float`-typed binop nodes; an elaboration rewrites them to dedicated
+  `ExprFloatBinary` / `ExprFloatRel` nodes; codegen lowers those to the f64
+  instruction family (`F64Add`, `F64Lt`, …). Most faithful to the established
+  pattern.
+* *Operand-type threading at codegen*: give the `ExprBinary` lowering the
+  synthesised operand type so it can pick the i32 vs f64 instruction directly.
+  Smaller surface but introduces a type channel into codegen that does not yet
+  exist there.
+
+The f64 instructions already exist in `lib/wasm.ml` (`F64Const` is emitted for
+float literals today); only the binop dispatch is missing.
+
+== Harness readiness
+
+`proposals/nextgen-evangelist/affine-parity` already accepts Float arguments
+(non-integer values in a `{ values: [...] }` spec pass through as wasm f64; the
+result is read as i32). The moment float binop codegen lands, float-input brains
+(physics thresholds, geometry classifications, the ~12 float-domain modules
+marked `NO_NEW_BRAINS` in cluster C13/C14 purely for the integer-only ABI)
+become compilable and parity-testable with no further harness work.

proposals/nextgen-evangelist/affine-parity/examples/string_float_demo.affine

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// SPDX-FileCopyrightText: 2025-2026 hyperpolymath
+//
+// Demo for affine-parity String argument support. `classify` exercises slice-9
+// String `==` against a literal; `str_cmp` exercises slice-9 + slice-10
+// comparing two RUNTIME-PROVIDED strings (pointer vs pointer) — the strongest
+// check that value (not pointer) comparison holds for JS-supplied strings.
+// (A Float case is omitted: float `<`/arithmetic codegen still emits i32 ops —
+// a separate "float wall" the harness is ready for once codegen is fixed.)
+
+pub fn classify(s: String) -> Int {
+  if s == "scan" { 1 } else { if s == "exit" { 2 } else { 0 } }
+}
+
+pub fn str_cmp(a: String, b: String) -> Int {
+  if a < b { -1 } else { if a == b { 0 } else { 1 } }
+}

proposals/nextgen-evangelist/affine-parity/examples/string_float_demo.config.mjs

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: MPL-2.0
+export default {
+  affine: "string_float_demo.affine",
+  cases: [
+    { export: "classify", args: [{ strings: ["scan", "exit", "foo", "sca", "scann", ""] }],
+      oracle: (s) => (s === "scan" ? 1 : s === "exit" ? 2 : 0) },
+    { export: "str_cmp", args: [{ strings: ["a", "ab", "b", ""] }, { strings: ["a", "ab", "b", ""] }],
+      oracle: (a, b) => (a < b ? -1 : a === b ? 0 : 1) },
+  ],
+};

proposals/nextgen-evangelist/affine-parity/parity.mjs

@@ -17,15 +17,24 @@
 // which oracle.
 //
 //## ABI SCOPE (read this)
-// This runner handles the **scalar i32 ABI** only: every argument is an i32 and
-// every result is an i32. That is exactly the boundary the DESIGN-VISION
-// prescribes ("they pass primitives across the wasm boundary") and it covers
-// pure-integer co-processors such as SecurityRank. Array/string parameters use
-// a different convention -- `[len:i32 LE][utf8 bytes]` written into linear
-// memory plus an exported `__affine_alloc` -- and are a deliberate follow-on,
-// NOT implemented here. Exports taking [Int]/String params therefore can only be
-// invoked here in their nullary form (e.g. Kernel_IO's `main`, whose array
-// arguments are inlined inside the .affine source).
+// This runner handles i32 results over i32 / f64 / String arguments:
+//   * i32 args   -- swept as integer ranges/values (the original scalar ABI),
+//   * f64 args   -- any non-integer values in a `{ values: [...] }` spec are
+//                   passed through verbatim as wasm f64 (args are not coerced),
+//   * String args -- written into linear memory as `[len:i32 LE][utf8 bytes]`
+//                   and passed BY POINTER (an i32). The string layout matches
+//                   the compiler's (codegen `gen_literal`). The oracle still
+//                   receives the original JS string, not the pointer.
+// Every result is read back as an i32 (`| 0`).
+//
+// String scratch memory: after instantiation the runner grows the module's
+// linear memory by one page (64 KiB) and writes string args into that fresh
+// page (reset before each call). Because the page sits above all of the
+// module's data and bump-heap base, a read-only string consumer (the common
+// case -- a classifier that reads its String arg and returns an Int) never
+// collides with it. A module that *allocates heavily during the call* before
+// reading its String arg could in principle reach the scratch page; such cases
+// should size their sweeps modestly or write a bespoke driver.
 //
 //## CONFIG SHAPE
 // A config is a `.mjs` module with a default export:
@@ -126,11 +135,44 @@ function expandArgSpec(spec, paramIndex) {
     return out;
   }
   if (spec && Array.isArray(spec.values)) return spec.values.slice();
+  if (spec && Array.isArray(spec.strings)) return spec.strings.slice();
   throw new Error(
-    `arg spec #${paramIndex} must be a number, a [lo,hi] range, or { values: [...] }`,
+    `arg spec #${paramIndex} must be a number, a [lo,hi] range, { values: [...] }, or { strings: [...] }`,
   );
 }
 
+// Build a writer for String args. Grows the module's linear memory by one page
+// and bump-allocates `[len:i32 LE][utf8]` strings into it, 4-byte aligned, so
+// each is a valid AffineScript string the wasm can read by pointer. Returns
+// null when the module exports no memory (then String args are a usage error).
+function makeStringWriter(memory) {
+  if (!(memory instanceof WebAssembly.Memory)) return null;
+  const oldPages = memory.grow(1); // fresh page above all module data + heap
+  const base = oldPages * 65536;
+  const enc = new TextEncoder();
+  let bump = base;
+  return {
+    reset() {
+      bump = base;
+    },
+    write(s) {
+      const u = enc.encode(s);
+      const need = 4 + u.length;
+      // Grow if a long string would overrun the scratch page.
+      if (bump + need > memory.buffer.byteLength) {
+        memory.grow(Math.ceil(need / 65536) + 1);
+      }
+      const ptr = bump;
+      const dv = new DataView(memory.buffer); // re-read: grow detaches the buffer
+      dv.setInt32(ptr, u.length, true);
+      new Uint8Array(memory.buffer, ptr + 4, u.length).set(u);
+      bump = ptr + need;
+      bump += (4 - (bump & 3)) & 3; // 4-byte align the next string
+      return ptr;
+    },
+  };
+}
+
 // Cartesian product of a list of value-lists. [] -> [[]] (the single empty tuple).
 function cartesian(lists) {
   return lists.reduce(
@@ -141,7 +183,7 @@ function cartesian(lists) {
 
 // Run a single case (one export + its arg sweep + its oracle). Returns
 // { name, total, pass, failures: [{args, got, want}] }.
-function runCase(exports, kase, idx) {
+function runCase(exports, kase, idx, stringWriter) {
   const name = kase.name || kase.export || `case#${idx}`;
   const fn = exports[kase.export];
   if (typeof fn !== "function") {
@@ -159,7 +201,22 @@ function runCase(exports, kase, idx) {
   let pass = 0;
   const failures = [];
   for (const tuple of tuples) {
-    const got = fn(...tuple) | 0; // normalise to i32
+    // String args are written into scratch linear memory as [len][utf8] and
+    // passed by pointer; the oracle still sees the original JS string. i32 /
+    // f64 args pass through unchanged.
+    let wasmArgs = tuple;
+    if (tuple.some((v) => typeof v === "string")) {
+      if (!stringWriter) {
+        throw new Error(
+          `case "${name}" passes a String arg but the module exports no "memory"`,
+        );
+      }
+      stringWriter.reset();
+      wasmArgs = tuple.map((v) =>
+        typeof v === "string" ? stringWriter.write(v) : v
+      );
+    }
+    const got = fn(...wasmArgs) | 0; // normalise result to i32
     const want = kase.oracle(...tuple) | 0;
     if (got === want) {
       pass++;
@@ -206,12 +263,13 @@ export async function runParity(configPath, { verbose = false } = {}) {
   }
 
   const exports = await instantiate(outPath);
+  const stringWriter = makeStringWriter(exports.memory);
 
   let grandTotal = 0;
   let grandPass = 0;
   const results = [];
   cfg.cases.forEach((kase, i) => {
-    const r = runCase(exports, kase, i);
+    const r = runCase(exports, kase, i, stringWriter);
     results.push(r);
     grandTotal += r.total;
     grandPass += r.pass;