Echo a string across the boundary, and drop the third cost estimate

status.md said the aggregate half of 0012's test needed a
wit-bindgen-generated guest, since string and friends require linear
memory and cabi_realloc. Checked the premise before building on it.

It is wrong. An *echo* copies nothing: the host has already lowered the
string into the guest's memory, so echoing it means handing back the same
(ptr, len). The whole guest is 25 lines of WAT -- a bump-allocator
cabi_realloc, an exported memory, and a function that stores the pair and
returns its address. wasm-tools component new does the rest.

    wasmtime run --invoke 'echo-string("hello")' -> "hello"

So the test now covers string too: 46 assertions, empty strings,
multi-byte UTF-8, an embedded NUL, a 1000-character string, and L6's
unpaired surrogate -- which does not survive, though not for the reason
0012 gave (UTF-8 encoding substitutes rather than failing, so it comes
back changed rather than being rejected).

**This note has now over-costed its own test three times**: "thousands of
lines of canonical ABI", then "needs a wit-bindgen guest", then 25 lines
of WAT. Over-estimating the cost of the check is how it kept talking
itself out of running it, and that is recorded in 0012 rather than
quietly fixed.

Renamed scalar_roundtrip_test to roundtrip_test, since it is no longer
scalars. Remaining: record, list, variant, option, result -- each needs
its own ABI shape in the guest and nothing this repo lacks.

Claude-Session: https://claude.ai/code/session_01XF5Hfq4Ca2N2XYEzWQQuHt

Author: chaploud

dev/resources/echo.wat

@@ -2,6 +2,29 @@
 ;; leaves Clojure, crosses the canonical ABI twice, and comes back, so
 ;; doc/design/0012's mapping is checked rather than asserted.
 (module
+  ;; Aggregates arrive already lowered into our memory by the host, so echoing
+  ;; one means handing back the same (ptr, len) — no copy. What it does need is
+  ;; the two things doc/design/0007 named: an exported memory and cabi_realloc.
+  (memory (export "memory") 1)
+  (global $next (mut i32) (i32.const 16))
+  (func (export "cabi_realloc")
+        (param $old i32) (param $old-sz i32) (param $align i32) (param $new-sz i32)
+        (result i32)
+    (local $p i32)
+    (local.set $p (i32.and (i32.add (global.get $next)
+                                    (i32.sub (local.get $align) (i32.const 1)))
+                           (i32.xor (i32.sub (local.get $align) (i32.const 1))
+                                    (i32.const -1))))
+    (global.set $next (i32.add (local.get $p) (local.get $new-sz)))
+    (local.get $p))
+
+  ;; A result wider than one core value comes back through a pointer the callee
+  ;; returns; here that is the fixed eight bytes at 0.
+  (func (export "echo-string") (param $ptr i32) (param $len i32) (result i32)
+    (i32.store (i32.const 0) (local.get $ptr))
+    (i32.store (i32.const 4) (local.get $len))
+    (i32.const 0))
+
   (func (export "echo-bool") (param $v i32) (result i32) (local.get $v))
   (func (export "echo-s32") (param $v i32) (result i32) (local.get $v))
   (func (export "echo-u64") (param $v i64) (result i64) (local.get $v))

dev/resources/echo.wit

@@ -10,4 +10,9 @@ world echo {
   export echo-f32: func(v: f32) -> f32;
   export echo-f64: func(v: f64) -> f64;
   export echo-char: func(v: char) -> char;
+
+  /// The first aggregate row. Needs an exported memory and cabi_realloc, per
+  /// doc/design/0007 — but not a Rust toolchain, which is what the note first
+  /// assumed and what this disproves.
+  export echo-string: func(v: string) -> string;
 }

test/cljwit/scalar_roundtrip_test.clj test/cljwit/roundtrip_test.cljtest/cljwit/scalar_roundtrip_test.clj renamed to test/cljwit/roundtrip_test.clj

@@ -1,10 +1,11 @@
-(ns cljwit.scalar-roundtrip-test
-  "Turns `doc/design/0012`'s scalar rows from a table into a check.
+(ns cljwit.roundtrip-test
+  "Turns `doc/design/0012`'s mapping from a table into a check.
 
-   Every WIT type whose canonical ABI needs no linear memory can be echoed by a
-   hand-written WAT guest, so the mapping is testable today without the Rust or
-   C toolchain the aggregate types will need. A value leaves Clojure, crosses
-   the canonical ABI twice, and comes back.
+   A value leaves Clojure, crosses the canonical ABI twice, and comes back. The
+   guest is hand-written WAT — including for `string`, which needs an exported
+   memory and `cabi_realloc` but, it turns out, no Rust toolchain: an echo hands
+   back the pointer the host already lowered into its memory, so the whole guest
+   is a bump allocator and a stored pair.
 
    The lossy mappings `0012` letters — L2 `u64` above 2^63, L3 `f32`
    narrowing, L4 NaN canonicalisation, L5 the `char` surrogate hole — were
@@ -14,7 +15,10 @@
 
    Skips when wasmtime is not present, the same way `bb lint` skips without
    clj-kondo: the gate stays runnable on a machine that cannot run it, and CI
-   has the full toolchain."
+   has the full toolchain.
+
+   Still missing: `record`, `list`, `variant`, `option`, `result`. Each needs
+   its own ABI shape in the guest; none needs a toolchain this repo lacks."
   (:require [clojure.java.io :as io]
             [clojure.java.shell :as shell]
             [clojure.test :refer [deftest is testing]])
@@ -34,7 +38,12 @@
 ;; inferred: wasmtime_component_val_t is 32 bytes, kind:u8 at 0, union at 8.
 (def ^:private VAL 32)
 (def ^:private UNION 8)
-(def ^:private KIND {:bool 0 :s32 5 :u64 8 :f32 9 :f64 10 :char 11})
+(def ^:private KIND {:bool 0 :s32 5 :u64 8 :f32 9 :f64 10 :char 11 :string 12})
+
+;; wasm_name_t is {size_t size; char *data;} — 16 bytes, size at 0, data at 8 —
+;; measured against the pinned headers, and it sits at the union offset.
+(def ^:private STR-SIZE 0)
+(def ^:private STR-DATA 8)
 
 (def ^:private lib (System/getenv "CLJWIT_WASMTIME_LIB"))
 
@@ -132,7 +141,12 @@
                     (.set args I32 (long UNION) (int v)))
           :u64  (.set args I64 (long UNION) (long v))
           :f32  (.set args F32 (long UNION) (float v))
-          :f64  (.set args F64 (long UNION) (double v)))
+          :f64  (.set args F64 (long UNION) (double v))
+          :string (let [b   (.getBytes ^String v "UTF-8")
+                        buf ^MemorySegment (.allocate arena (long (max 1 (alength b))))]
+                    (MemorySegment/copy ^bytes b 0 buf I8 0 (alength b))
+                    (.set args I64 (long (+ UNION STR-SIZE)) (long (alength b)))
+                    (.set args ADDR (long (+ UNION STR-DATA)) buf)))
         (ok! (str "call " export) (call fcall f ctx args (long 1) res (long 1)))
         (ok! (str "post_return " export) (call fpost f ctx))
         (case kind
@@ -141,7 +155,12 @@
           :char (.get res I32 (long UNION))
           :u64  (.get res I64 (long UNION))
           :f32  (.get res F32 (long UNION))
-          :f64  (.get res F64 (long UNION)))))))
+          :f64  (.get res F64 (long UNION))
+          :string (let [n (.get res I64 (long (+ UNION STR-SIZE)))
+                        p ^MemorySegment (.get res ADDR (long (+ UNION STR-DATA)))
+                        b (byte-array n)]
+                    (MemorySegment/copy (.reinterpret p n) I8 0 b 0 (int n))
+                    (String. b "UTF-8")))))))
 
 (defn- with-echo
   "Builds the component, opens it, and calls `f` with the echo function. A
@@ -150,7 +169,7 @@
    hook is what caught that."
   [f]
   (if-not lib
-    (println "CLJWIT_WASMTIME_LIB unset — skipping scalar round-trip test")
+    (println "CLJWIT_WASMTIME_LIB unset — skipping round-trip test")
     (let [c (build-component!)]
       (try
         (with-open [a (Arena/ofConfined)]
@@ -204,6 +223,21 @@
           (is (= (Double/doubleToRawLongBits -0.0) (Double/doubleToRawLongBits out))
               "the sign of zero does survive"))))))
 
+(deftest strings-round-trip
+  (with-echo
+    (fn [echo]
+      (testing "the first aggregate row — memory and cabi_realloc, no Rust toolchain"
+        (doseq [v ["" "hello" "日本語" "a\u0000b" (apply str (repeat 1000 "x"))]]
+          (is (= v (echo "echo-string" :string v)) (str "string " (pr-str v)))))
+      (testing "L6 — a string carrying an unpaired surrogate is not a WIT string"
+        ;; Java lets one exist; WIT's string is a sequence of scalar values.
+        ;; UTF-8 encoding replaces it rather than failing, so what comes back is
+        ;; not what went in — recorded because 0012 predicted it could not be
+        ;; lowered at all.
+        (let [lone (str (char 0xD800))]
+          (is (not= lone (echo "echo-string" :string lone))
+              "an unpaired surrogate does not survive the boundary"))))))
+
 (deftest char-boundaries
   (with-echo
     (fn [echo]