compiler: string-wall slice 6 — string_find (+ interp empty-needle fix) (#572)

## Phase F slice 6 — variable-string backend wall (string_find + interp
fix)

Sixth slice of the **variable-string backend** wall
(`proposals/MIGRATION-PLAN.adoc` §"The two walls"). Follows slices 1–5
(#567–#571). Two changes:

### 1. `lib/codegen.ml` — wasm lowering for `string_find(haystack,
needle)`

A read-side **nested scan** (no allocation) returning the
first-occurrence index or `-1`. Control flow is **flat-safe** — no `Br`
out of an `If`:
- inner loop AND-accumulates a match flag over all `nlen` bytes (no
early break);
- outer loop exits at the top on `res != -1` or `i > hlen - nlen` (the
latter also covers `nlen > hlen`, where the bound is negative);
- the result update is a branchless `Select` that fires once, so `res`
keeps the **first** match.

For `nlen == 0` the inner loop runs zero times and `res = 0`.

### 2. `lib/interp.ml` — empty-needle bugfix

`string_find` called `String.get needle 0` **before** its `nlen = 0`
guard, so an empty needle **crashed the interpreter** with an uncaught
`Invalid_argument` (the `nlen = 0` branch was dead code). The length
guards (`nlen = 0 → 0`; `nlen > hlen → -1`) are reordered ahead of
`String.get`, so an empty needle returns `0` (standard). Behaviour is
identical for every non-empty needle (the `index_opt` fast-path is
preserved) — this makes the wasm and interp backends agree.

### Parity (wasm vs interp oracle) — 8/8

| Expression | interp | wasm |
|---|---|---|
| `string_find("hello", "ll")` | 2 | 2 |
| `string_find("hello", "o")` | 4 | 4 |
| `string_find("hello", "xyz")` | -1 | -1 |
| `string_find("abcabc", "bc")` (first occ) | 1 | 1 |
| `string_find("hello", "hellox")` (longer) | -1 | -1 |
| `string_find("hello", "")` (was a crash) | 0 | 0 |
| `string_find("", "x")` (empty haystack) | -1 | -1 |
| `string_find("", "")` (both empty) | 0 | 0 |

### Tests

- `test/test_e2e.ml` group **"E2E String-wall slice 6 (string_find)"** —
seven interp-oracle cases, including the empty-needle case that
previously crashed the interpreter. Runs under `dune runtest`.
- `tests/codegen/string_find.affine` +
`tests/codegen/test_string_find.mjs` — executable wasm parity via
`tools/run_codegen_wasm_tests.sh` (CI).

Local verification: full `run_codegen_wasm_tests.sh` green (all six
string harnesses, slices 1–6; no sibling regressions); interp oracle
(post-fix) confirmed against the real library API; wasm executed under
Node. `dune runtest` couldn't run in-sandbox (no `alcotest`), but the
new tests' logic + API usage was validated against the real
`affinescript` library.

### Scope

**All name-dispatched string builtins with a trap-free wasm analogue are
now lowered** (`string_length`, `string_char_code_at`, `char_to_int`,
`string_from_char_code`, `string_sub`, `to_lowercase`, `to_uppercase`,
`trim`, `string_find`).

What remains:
- **`int_to_string`** — the last clean autonomous slice (decimal digit
loop + sign; `INT_MIN` handled by extracting digits in negative space).
`float_to_string` stays host-side under the float-wall.
- **concat `++` / polymorphic `slice`** — still gated on the
**type-access design decision** (codegen has no per-expression type
info; `++` already lowers to *list* concat). Owner call: thread
typed-AST into codegen, or add a dedicated `string_concat` builtin.
- **`string_get` / `int_to_char`** — deferred (raise on out-of-range; no
trap-free wasm analogue).

Evidence: `proposals/EVIDENCE-stringwall-slice6.adoc`.

https://claude.ai/code/session_01WoKhFQePiRsAj7aqnxbG8s

---
_Generated by [Claude
Code](https://claude.ai/code/session_01WoKhFQePiRsAj7aqnxbG8s)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

lib/codegen.ml

@@ -1173,6 +1173,71 @@ let rec gen_expr (ctx : context) (expr : expr) : (context * instr list) result =
         in
         Ok (c9, code)
 
+      | ExprVar id when id.name = "string_find"
+                        && List.length args = 2 ->
+        (* PHASE-F string-wall slice 6: substring search (read-side, no
+           allocation). `string_find(haystack, needle)` returns the index of
+           the first occurrence of `needle` in `haystack`, or -1. Matches the
+           interp oracle (lib/interp.ml, fixed in this same change so an empty
+           needle returns 0 instead of crashing): nlen = 0 -> 0; nlen > hlen
+           -> -1; otherwise the first start index whose `nlen`-byte window
+           equals the needle, else -1.
+
+           Control flow is kept *flat-safe* — no `Br` out of an `If`:
+           * inner loop AND-accumulates a match flag over all `nlen` bytes
+             (no early break);
+           * outer loop exits at the top on "already found" (`res != -1`) or
+             "past the last start" (`i > hlen - nlen`, which also covers
+             nlen > hlen since the bound is then negative);
+           * the result update is the branchless `res = m ? i : res` via
+             `Select` (only fires once — the next outer iteration exits on the
+             res-check, so `res` keeps the FIRST match).
+           For nlen = 0 the inner loop runs zero times (m stays 1) and the
+           first outer iteration yields res = 0, matching the oracle. *)
+        let* (ctx1, h_code) = gen_expr ctx  (List.nth args 0) in
+        let* (ctx2, n_code) = gen_expr ctx1 (List.nth args 1) in
+        let (c3,  hay)  = alloc_local ctx2 "__sfind_hay"  in
+        let (c4,  ndl)  = alloc_local c3   "__sfind_ndl"  in
+        let (c5,  hlen) = alloc_local c4   "__sfind_hlen" in
+        let (c6,  nlen) = alloc_local c5   "__sfind_nlen" in
+        let (c7,  res)  = alloc_local c6   "__sfind_res"  in
+        let (c8,  i)    = alloc_local c7   "__sfind_i"    in
+        let (c9,  j)    = alloc_local c8   "__sfind_j"    in
+        let (c10, m)    = alloc_local c9   "__sfind_m"    in
+        (* inner: m := (haystack[i .. i+nlen) == needle), via AND-accumulation *)
+        let inner =
+          [ I32Const 1l; LocalSet m;
+            I32Const 0l; LocalSet j;
+            Block (BtEmpty, [ Loop (BtEmpty,
+              [ LocalGet j; LocalGet nlen; I32GeS; BrIf 1;
+                (* m = m & (hay[i+j] == ndl[j]) *)
+                LocalGet m;
+                LocalGet hay; LocalGet i; LocalGet j; I32Add; I32Add;
+                I32Load8U (0, 4);
+                LocalGet ndl; LocalGet j; I32Add; I32Load8U (0, 4);
+                I32Eq; I32And; LocalSet m;
+                LocalGet j; I32Const 1l; I32Add; LocalSet j;
+                Br 0 ]) ]) ] in
+        let code =
+          h_code @ [LocalSet hay] @ n_code @ [LocalSet ndl] @
+          [ LocalGet hay; I32Load (2, 0); LocalSet hlen;
+            LocalGet ndl; I32Load (2, 0); LocalSet nlen;
+            I32Const (-1l); LocalSet res;
+            I32Const 0l; LocalSet i;
+            Block (BtEmpty, [ Loop (BtEmpty,
+              [ (* exit if already found *)
+                LocalGet res; I32Const (-1l); I32Ne; BrIf 1;
+                (* exit if i > hlen - nlen (covers nlen > hlen: bound < 0) *)
+                LocalGet i; LocalGet hlen; LocalGet nlen; I32Sub; I32GtS; BrIf 1 ]
+              @ inner @
+              [ (* res = m ? i : res  (first match only) *)
+                LocalGet i; LocalGet res; LocalGet m; Select; LocalSet res;
+                LocalGet i; I32Const 1l; I32Add; LocalSet i;
+                Br 0 ]) ]);
+            LocalGet res ]
+        in
+        Ok (c10, code)
+
       | ExprVar id when (id.name = "env_at" || id.name = "arg_at")
                         && List.length args = 1 ->
         (* ADR-015 S5 (#180): env_at(i) / arg_at(i) — fetch the i-th

lib/interp.ml

@@ -565,14 +565,20 @@ let create_initial_env () : env =
     ("string_find", VBuiltin ("string_find", fun args ->
       match args with
       | [VString haystack; VString needle] ->
-        (match String.index_opt haystack (String.get needle 0) with
-         | None -> Ok (VInt (-1))
-         | Some _ ->
-           let hlen = String.length haystack in
-           let nlen = String.length needle in
-           if nlen = 0 then Ok (VInt 0)
-           else if nlen > hlen then Ok (VInt (-1))
-           else
+        let hlen = String.length haystack in
+        let nlen = String.length needle in
+        (* Length guards first: an empty needle matches at index 0 (standard),
+           and a needle longer than the haystack cannot match. Both must
+           precede `String.get needle 0` below, which raises on an empty
+           needle — the prior ordering made the nlen=0 branch dead code and
+           crashed the interp with an uncaught Invalid_argument. This keeps
+           the wasm backend (PHASE-F string-wall) and the interp in agreement. *)
+        if nlen = 0 then Ok (VInt 0)
+        else if nlen > hlen then Ok (VInt (-1))
+        else
+          (match String.index_opt haystack (String.get needle 0) with
+           | None -> Ok (VInt (-1))
+           | Some _ ->
              let found = ref (-1) in
              for i = 0 to hlen - nlen do
                if !found = -1 && String.sub haystack i nlen = needle then

proposals/EVIDENCE-stringwall-slice6.adoc

@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: MPL-2.0
+// SPDX-FileCopyrightText: 2025-2026 hyperpolymath
+= Phase F — string-wall slice 6: string_find (evidence)
+:toc: macro
+
+[IMPORTANT]
+====
+*Slice landed: substring search* (read-side, no allocation). `string_find(haystack,
+needle)` — already wired in resolve/typecheck/interp — gained a wasm-backend
+lowering: a nested scan returning the first-occurrence index or -1.
+
+*Also fixes an interp bug:* the interp's `string_find` called
+`String.get needle 0` *before* its `nlen = 0` guard, so an empty needle
+crashed the interpreter with an uncaught `Invalid_argument` (the `nlen = 0`
+branch was dead code). The guard is now reordered so an empty needle returns
+`0` (standard) — making the two backends agree.
+
+Sixth slice of the *variable-string backend* wall
+(`proposals/MIGRATION-PLAN.adoc` §"The two walls", Phase F). With this, all
+the *name-dispatched* string builtins that have a faithful trap-free wasm
+analogue are lowered.
+====
+
+toc::[]
+
+== Two changes
+
+. *`lib/interp.ml` — bugfix.* Move the length guards (`nlen = 0 -> 0`,
+  `nlen > hlen -> -1`) ahead of `String.get needle 0`. Before:
++
+----
+match String.index_opt haystack (String.get needle 0) with   (* raises on "" *)
+| None -> -1
+| Some _ -> let hlen = ... and nlen = ... in
+            if nlen = 0 then 0 else ...                       (* dead code *)
+----
++
+After: compute `hlen`/`nlen` first; `if nlen = 0 then 0 else if nlen > hlen
+then -1 else (index_opt-guarded scan)`. Behaviour is identical for every
+*non-empty* needle (the `index_opt` fast-path is preserved); only the empty
+needle changes — from *uncaught crash* to `0`.
+
+. *`lib/codegen.ml` — wasm lowering.* Nested scan, no allocation:
++
+----
+hlen = haystack[0]; nlen = needle[0]; res = -1; i = 0
+loop (outer):
+  if res != -1: break                       ;; already found
+  if i > hlen - nlen: break                 ;; past last start (covers nlen>hlen: bound < 0)
+  m = 1; j = 0
+  loop (inner): if j >= nlen: break
+                m = m & (haystack[i+j] == needle[j])   ;; AND-accumulate, no early break
+                j++
+  res = m ? i : res                          ;; branchless Select; first match only
+  i++
+return res
+----
+
+*Control flow is flat-safe* — there is no `Br` out of an `If`. The inner loop
+AND-accumulates the match over all `nlen` bytes (rather than breaking early),
+the outer loop's two exits are top-of-loop `BrIf`s, and the result update is a
+branchless `Select`. Because the outer loop exits on `res != -1` at the top of
+the *next* iteration, `res` keeps the FIRST match. For `nlen = 0` the inner
+loop runs zero times (`m` stays 1) and the first outer iteration sets
+`res = 0`, matching the fixed oracle; for `nlen > hlen` the bound is negative
+so the outer loop exits immediately with `res = -1`.
+
+== Gate evidence
+
+=== Gate 1 — builds
+
+`dune build bin/main.exe` exit 0.
+
+=== Gate 2 — parity (wasm vs interpreter oracle)
+
+Same inputs through both backends agree across found / not-found /
+first-occurrence / needle-longer / empty-needle / empty-haystack. Interp
+oracle (post-fix) confirmed against the real library API; wasm executed under
+Node.
+
+[cols="3,1,1",options="header"]
+|===
+| Expression | interp | wasm
+| `string_find("hello", "ll")` | 2 | 2
+| `string_find("hello", "o")` | 4 | 4
+| `string_find("hello", "xyz")` | -1 | -1
+| `string_find("abcabc", "bc")` (first occ) | 1 | 1
+| `string_find("hello", "hellox")` (longer) | -1 | -1
+| `string_find("hello", "")` (was a crash) | 0 | 0
+| `string_find("", "x")` (empty haystack) | -1 | -1
+| `string_find("", "")` (both empty) | 0 | 0
+|===
+
+The packed fixture `tests/codegen/string_find.affine` returns `73811` (each
+result `+1` packed as a 4-bit nibble); both backends produce it.
+
+== Tests added
+
+* `test/test_e2e.ml` — group *"E2E String-wall slice 6 (string_find)"*: seven
+  interp-oracle cases, including the empty-needle case that previously crashed
+  the interpreter. Runs under `dune runtest`.
+* `tests/codegen/string_find.affine` + `tests/codegen/test_string_find.mjs` —
+  executable wasm parity, run by `tools/run_codegen_wasm_tests.sh` (CI).
+
+Full `tools/run_codegen_wasm_tests.sh` run: *all* codegen WASM tests pass
+(slices 1-6 string harnesses), no sibling regressions.
+
+== Corpus impact
+
+Substring search (delimiter detection, `contains`-style predicates, simple
+parsing) now lowers to wasm. With slices 1-6, every *name-dispatched* string
+builtin with a faithful trap-free wasm analogue is lowered: `string_length`,
+`string_char_code_at`, `char_to_int`, `string_from_char_code`, `string_sub`,
+`to_lowercase`, `to_uppercase`, `trim`, `string_find`.
+
+== What remains (and the decision still pending)
+
+* *`int_to_string` / `float_to_string`* — name-dispatched decimal rendering.
+  `int_to_string` is the obvious next autonomous slice (digit loop + sign;
+  `INT_MIN` is the one i32 edge — handle it by extracting digits in negative
+  space to avoid the un-negatable magnitude). `float_to_string` needs the
+  float story, so it stays host-side under the float-wall convention.
+* *Concatenation (`++` / `OpConcat`) and polymorphic `slice`* — still gated on
+  the *type-access* design decision (`lib/codegen.ml` has no per-expression
+  type information; `++` already lowers to *list* concat). Owner call: thread
+  typed-AST into codegen, or add a dedicated `string_concat` builtin. See
+  `proposals/EVIDENCE-stringwall-slice5.adoc` §"remaining string ops".
+* *`string_get` / `int_to_char`* — deferred (raise on out-of-range; no
+  trap-free wasm analogue without a declared-clamp convention).
+
+== Next slices (variable-string backend wall)
+
+. *`int_to_string`* — decimal rendering (autonomous; the last clean
+  name-dispatched op).
+. *Concatenation / `slice`* — gated on the type-access design decision.
+
+Then the *effect-codegen wall* (module-state / `Date.now` / `Console.log`).

proposals/MIGRATION-PLAN.adoc

@@ -42,12 +42,13 @@ toc::[]
   (`string_char_code_at` / `char_to_int`, slice 1), single-byte *construction*
   (`string_from_char_code`, slice 2), *runtime-length substring* (`string_sub`,
   slice 3), *ASCII case-folding* (`to_lowercase` / `to_uppercase`, slice 4),
-  and *whitespace trimming* (`trim` — scan-and-copy, slice 5) now lower to wasm
-  (Phase F, see Ledger); `string_find`, `int_to_string`, concat / `++`, and
-  polymorphic `slice` do not yet (the last two are gated on a type-access
-  design decision — see Ledger F+). Gates every STRING-GATED kernel (e.g.
-  `Kernel_IO`, `DeviceType`, i18n) whose work is building/transforming strings
-  rather than scanning them. Lives in *this* repo's compiler, so it is
+  *whitespace trimming* (`trim`, slice 5), and *substring search*
+  (`string_find` — flat-safe nested scan, slice 6) now lower to wasm (Phase F,
+  see Ledger); `int_to_string`, concat / `++`, and polymorphic `slice` do not
+  yet (the last two are gated on a type-access design decision — see Ledger
+  F+). Gates every STRING-GATED kernel (e.g. `Kernel_IO`, `DeviceType`, i18n)
+  whose work is building/transforming strings rather than scanning them. Lives
+  in *this* repo's compiler, so it is
   attackable here.
 . *Effect codegen* — module-level mutable state / `Date.now` / `Console.log`
   cannot lower ("references an unbound binding"). Gates every EFFECT-GATED
@@ -212,7 +213,8 @@ Heuristic:
 | F (string slice 3) | DONE | String-wall slice 3 — *runtime-length copy op landed in the wasm backend* (2026-06-12, Opus). `string_sub(s, start, length)` (already wired in resolve/typecheck/interp) gained a wasm lowering introducing the two capabilities the rest of the wall needs: a *runtime-sized* heap allocation (`heap += 4 + length'`) and a *byte-copy loop* (`Block`/`Loop`/`BrIf`/`Br`, `I32Load8U`/`I32Store8`), both modelled on the list `++` allocate-then-copy idiom. Interp clamps reproduced exactly: `start' = max 0 (min start slen)`, `length' = max 0 (min length (slen - start'))` (`min`/`max` via `Select`). *Gates:* G1 builds; G2 parity 8/8 (interp vs wasm over extraction/length/clamp-length/clamp-start/negative-start/zero-length); round-trips with slice-1's reader. Tests: `test/test_e2e.ml` group "E2E String-wall slice 3 (string_sub)" (interp, `dune runtest`) + `tests/codegen/string_sub.{affine,…mjs}` (executable wasm parity; full `run_codegen_wasm_tests.sh` green, no regressions). Evidence: `proposals/EVIDENCE-stringwall-slice3.adoc`. Runtime alloc + copy loop now established. NEXT: concat/`string_find`/case-fold (slice 4) reuse these idioms.
 | F (string slice 4) | DONE | String-wall slice 4 — *ASCII case-folding landed in the wasm backend* (2026-06-13, Opus). `to_lowercase` / `to_uppercase` (already wired in resolve/typecheck/interp) gained wasm lowerings as a *copy-with-transform* over the slice-3 runtime-length idiom: allocate `4 + slen`, copy each byte through a *branchless* ASCII case shift (`c ± 32*((c>=lo)&(c<=hi))`, an `I32And` 0/1 product — no per-byte `If`). Matches the interp oracle (`String.{lowercase,uppercase}_ascii`): only `'A'..'Z'`/`'a'..'z'` shift; digits, punctuation, and bytes ≥128 pass through. *Gates:* G1 builds; G2 parity 7/7 (interp vs wasm), incl. the exclusive `@`(64)/`[`(91) boundary probes + length preservation. Tests: `test/test_e2e.ml` group "E2E String-wall slice 4 (case-fold)" (interp, `dune runtest`) + `tests/codegen/string_case.{affine,…mjs}` (executable wasm parity; full `run_codegen_wasm_tests.sh` green, no regressions). Evidence: `proposals/EVIDENCE-stringwall-slice4.adoc`. Proves the alloc+copy idiom carries per-byte transforms. NEXT: concat (`++`/`string_concat`), then `string_find`/`trim`/`slice`.
 | F (string slice 5) | DONE | String-wall slice 5 — *whitespace trimming landed in the wasm backend* (2026-06-13, Opus). `trim` (already wired in resolve/typecheck/interp) gained a wasm lowering: two flat scans bracket the non-whitespace core (front for `lo`, back for `hi` exclusive; whitespace set `{32,9,10,12,13}` via an `is_ws` `I32Or` chain), then a slice-3-style byte copy of `[lo, hi)`. Matches `String.trim`: internal whitespace preserved, all-whitespace -> empty. *Gates:* G1 builds; G2 parity 7/7 (interp vs wasm: both-end/leading/trailing, all-ws, empty, internal-space preservation, tab+newline). Tests: `test/test_e2e.ml` group "E2E String-wall slice 5 (trim)" (interp, `dune runtest`) + `tests/codegen/string_trim.{affine,…mjs}` (executable wasm parity; full `run_codegen_wasm_tests.sh` green, no regressions). Evidence: `proposals/EVIDENCE-stringwall-slice5.adoc`. *The clean name-dispatched builtins (read/write/copy/transform/scan) are now done.* NEXT decision point — see F+ row.
-| F+ | TODO (design decision) | Remaining string ops split: (a) *`string_find`* — clean name-dispatched substring scan (returns Int, no alloc); the next autonomous slice. (b) *`int_to_string`/`float_to_string`* — name-dispatched decimal rendering (digit loop + sign + `INT_MIN` edge); autonomous if prioritised. (c) *concat `++` / polymorphic `slice`* — **blocked on an architectural decision**: codegen has *no per-expression type access* (`ExprBinary` is untyped, no type env threaded in), so string `++` (vs the existing list `OpConcat`) and `slice` (array|string) need either typed-AST threading or a dedicated `string_concat` builtin (language-surface call). (d) *`string_get`/`int_to_char`* — deferred (raise on out-of-range; no trap-free wasm analogue). Then the *effect-codegen wall* (module-state / `Date.now` / `Console.log`). See `proposals/EVIDENCE-stringwall-slice5.adoc` §"remaining string ops". *Cluster migration complete; string slices 1-5 landed (read + single-byte write + runtime-length copy + per-byte transform + scan-and-copy).*
+| F (string slice 6) | DONE | String-wall slice 6 — *substring search landed in the wasm backend + an interp bugfix* (2026-06-13, Opus). `string_find(haystack, needle)` (already wired in resolve/typecheck/interp) gained a wasm lowering: a *flat-safe* nested scan (inner AND-accumulates a match over `nlen` bytes with no early break; outer exits at top on `res != -1` or `i > hlen - nlen`; result update is a branchless `Select`) returning the first-occurrence index or -1, no allocation. *Also fixed a latent interp bug:* `string_find` called `String.get needle 0` before its `nlen = 0` guard, so an empty needle crashed the interpreter (uncaught `Invalid_argument`); the guard is reordered so an empty needle returns `0`, making both backends agree. *Gates:* G1 builds; G2 parity 8/8 (found/not-found/first-occurrence/needle-longer/empty-needle/empty-haystack/both-empty). Tests: `test/test_e2e.ml` group "E2E String-wall slice 6 (string_find)" (interp, incl. the formerly-crashing empty-needle case, `dune runtest`) + `tests/codegen/string_find.{affine,…mjs}` (executable wasm parity; full `run_codegen_wasm_tests.sh` green, no regressions). Evidence: `proposals/EVIDENCE-stringwall-slice6.adoc`. *All name-dispatched string builtins with a trap-free wasm analogue are now lowered.* NEXT: `int_to_string` (last clean op), then the gated concat/`slice` decision.
+| F+ | TODO (design decision) | Remaining string ops: (a) *`int_to_string`/`float_to_string`* — `int_to_string` is the last clean autonomous slice (decimal digit loop + sign; handle `INT_MIN` by extracting digits in negative space); `float_to_string` stays host-side under the float-wall. (b) *concat `++` / polymorphic `slice`* — **blocked on an architectural decision**: codegen has *no per-expression type access* (`ExprBinary` is untyped, no type env threaded in), so string `++` (vs the existing list `OpConcat`) and `slice` (array|string) need either typed-AST threading or a dedicated `string_concat` builtin (language-surface call). (c) *`string_get`/`int_to_char`* — deferred (raise on out-of-range; no trap-free wasm analogue). Then the *effect-codegen wall* (module-state / `Date.now` / `Console.log`). See `proposals/EVIDENCE-stringwall-slice6.adoc` §"what remains". *Cluster migration complete; string slices 1-6 landed (read + single-byte write + runtime-length copy + per-byte transform + scan-and-copy + substring search).*
 | Ω | TODO (access-gated) | Cutover + ReScript extinction.
 |===