fix(gate): cite zwasm ledger ids as zwasm/D-NNN; two pipefail traps

Smell-audited: 1: the checker learns one qualified spelling instead of an
allowlist of foreign ids, so the next foreign citation needs no script edit;
the two pipe fixes apply the herestring shape the repo already uses.

Three full-gate failures, all non-code, all pre-dating this session's source
change on staging. The first two would have failed PR #16's CI.

debt_id_refs: the per-call wasm write-up cites zwasm's own debt rows D-584 and
D-585. A bare `D-NNN` is a cljw row to check_debt_id_refs.sh, so D-584 read as
undefined, and D-585 passed only because cljw happens to own a D-585 of its own
(the JIT zero-result gap, ADR-0192). The two ledgers share the id shape and
already collide. zwasm's ids are now always written `zwasm/D-NNN`; the checker
strips that qualified form before extracting ids, so a bare id stays a cljw
citation and a qualified one is never mistaken for one. Retrofit: every zwasm
citation in .dev/wasm_percall_findings.md, .dev/bench/ffi_boundary/README.md,
.dev/handover.md, .dev/zwasm_capabilities.md and build.zig.zon. cljw's D-585
(engine.zig, ADR-0192, mem_kernel.wat) is untouched.

epipe_head: bench/compare_langs.sh:504 fed `sed … /proc/cpuinfo | head -1`
under pipefail (one line per core, so head closes the pipe early). Replaced by
a single awk that prints the first match and exits; no pipe.

e2e_phase16_wasm_memory: failed once in the full gate with the expected line
visibly present in the output it printed, and passed on two direct re-runs.
Its `want` helper was `echo "$out" | grep -qF` under `set -o pipefail`: grep -q
exits on the first match and the producer's EPIPE fails the pipeline. Same
class check_debt_id_refs.sh documents; same fix, `grep -qF "$1" <<<"$out"`,
applied to all three pipes in the script.

Author: BuddhiLW

.dev/bench/ffi_boundary/README.md

@@ -22,7 +22,7 @@ separates "the crossing is expensive" from "the loop is expensive".
     wasm/call :engine interp          392 ns    (2.1x a Clojure call)
     wasm/call :engine auto (JIT)   18,875 ns    (48x the interp path)
 
-The 18.9 us is not the cost of crossing. It is zwasm D-584: `computeStackLimit`
+The 18.9 us is not the cost of crossing. It is zwasm/D-584: `computeStackLimit`
 runs on every JIT invocation, and on Linux/glibc on the INITIAL thread glibc
 answers by opening and parsing `/proc/self/maps`. Confirmed with zwasm's own
 runner on this box (`zig build bench-latency`): `stack_limit_query_ns` 26,262
@@ -31,7 +31,7 @@ interpreter caches the same value, which is why it wins here.
 
 Do not re-derive this from the source. An earlier pass read the call graph, found
 `findExportFunc` re-parsing the module three times per call, and named that as
-the cause. It is real (zwasm D-585) but sits in the ~1.2 us remainder. See hive
+the cause. It is real (zwasm/D-585) but sits in the ~1.2 us remainder. See hive
 memory 20260905010714-4c94602c.
 
 ## The engine x thread matrix, measured 2026-09-05
@@ -48,14 +48,14 @@ process. Run it directly: `./zig-out/bin/cljw .dev/bench/ffi_boundary/engine_thr
 Three readings, and each names a different fix:
 
 1. **The 14x JIT penalty is entirely the initial thread.** Nothing else differs
-   between rows 1 and 2. This is D-584 and it is dodgeable without touching
+   between rows 1 and 2. This is zwasm/D-584 and it is dodgeable without touching
    zwasm: run the invocation on any thread that is not the process's first one.
    `@(future ...)` already does it today, measured at 12.5x on a separate run.
 2. **The interpreter is thread-indifferent** (399 vs 413), which confirms it
    caches the stack limit rather than re-querying per call.
 3. **Even on a worker thread the JIT is 2.9x the interpreter** on a trivial
-   callee. That residual is D-585, the per-call module re-parse, now visible
-   because D-584 has stopped swamping it.
+   callee. That residual is zwasm/D-585, the per-call module re-parse, now visible
+   because zwasm/D-584 has stopped swamping it.
 
 So the engine choice and the thread choice are independent levers, and the right
 engine still depends on call shape: the JIT wins 15.5x on compute-in-wasm

.dev/wasm_percall_findings.md

@@ -33,13 +33,13 @@ zwasm ADR-0209 (`.dev/decisions/0209_percall_latency_bench.md` in the zwasm
 tree; clone at `~/PP/referential-projects/zwasm`) names both. Do not re-report
 them upstream.
 
-- **D-584** dominates on Linux. `computeStackLimit` runs on every JIT
+- **zwasm/D-584** dominates on Linux. `computeStackLimit` runs on every JIT
   invocation, and glibc's `pthread_getattr_np` answers for the process's FIRST
   thread by opening and parsing `/proc/self/maps`. Any other thread answers from
   the thread descriptor. zwasm measures 26.8 us initial thread, 561-578 ns
   worker thread, 3.1-3.4 ns on aarch64-macos. The interpreter caches the value,
   which is why it is thread-indifferent above.
-- **D-585** is the residual. The embedding API resolves the export by name on
+- **zwasm/D-585** is the residual. The embedding API resolves the export by name on
   every call and `findExportFunc` parses the whole module to do it. Linear in
   module size (687-859 ns/KiB upstream). Public issue zwasm#208.
 
@@ -49,8 +49,8 @@ still called at `entry.zig` 248 and 272 and `entry_buffer_write.zig` 86.
 A warning worth repeating, because this session walked into it. ADR-0209 says:
 
 > "A reviewer checking this on Linux alone will find the two paths agree within
-> 2%, which reads as 'the re-parse does not matter'. That agreement is D-584's
-> constant, well over 100x larger, swamping D-585."
+> 2%, which reads as 'the re-parse does not matter'. That agreement is zwasm/D-584's
+> constant, well over 100x larger, swamping zwasm/D-585."
 
 The mirror-image error is just as easy: attributing the whole Linux cost to the
 re-parse because the re-parse is the part you read. Two costs on one path cannot
@@ -61,7 +61,7 @@ be separated by reading either one. Get a number that isolates the candidate.
 Spawn one thread in `main.zig` with an explicit stack size, run the existing
 main body on it, join. The runtime stays SINGLE-THREADED; it just stops being
 thread 1. One spawn at startup, tens of microseconds, once. It buys ~14x on
-every JIT wasm invocation on Linux and costs nothing on macOS, where D-584 does
+every JIT wasm invocation on Linux and costs nothing on macOS, where zwasm/D-584 does
 not exist.
 
 The win is already reachable from Clojure with no cljw change: wrapping
@@ -97,7 +97,7 @@ a full gate.
 ### What it does not fix
 
 Even on a worker thread the JIT is 2.9x the interpreter on a trivial callee.
-That is D-585, untouched by this change. Engine choice stays shape-dependent:
+That is zwasm/D-585, untouched by this change. Engine choice stays shape-dependent:
 the JIT wins 15.5x on compute-in-wasm (`bench/wasm_jit_vs_interp.sh`) and loses
 on crossing-heavy work at any thread. A single default cannot serve both, which
 is the open question in `[CLJW-WASM-ENGINE-DEFAULT]`.

bench/compare_langs.sh

@@ -501,7 +501,7 @@ if [[ -n "$YAML_FILE" ]]; then
       env_os="$(sw_vers -productName 2>/dev/null) $(sw_vers -productVersion 2>/dev/null) ($(sw_vers -buildVersion 2>/dev/null))"
     else
       env_machine="$(cat /sys/devices/virtual/dmi/id/product_name 2>/dev/null || uname -m)"
-      env_cpu="$(sed -n 's/^model name[[:space:]]*: //p' /proc/cpuinfo 2>/dev/null | head -1), $(nproc 2>/dev/null)-core"
+      env_cpu="$(awk -F': *' '/^model name/ {print $2; exit}' /proc/cpuinfo 2>/dev/null), $(nproc 2>/dev/null)-core"
       env_ram="$(awk '/^MemTotal:/ {printf "%d", $2/1048576}' /proc/meminfo 2>/dev/null) GB"
       env_os="$(. /etc/os-release 2>/dev/null && echo "$PRETTY_NAME")"
     fi

scripts/check_debt_id_refs.sh

@@ -62,9 +62,14 @@ phantom=$(rg -n --no-heading ${wt_globs[@]+"${wt_globs[@]}"} 'D-NEW[A-Z0-9-]*' "
 
 # 2. Real-looking D-NNN refs with no entry in debt.yaml.
 # `\b` so "PID-1" / "JDK-19"-style substrings don't masquerade as a debt ref.
+# zwasm's own ledger ids are cited as `zwasm/D-NNN` (namespace-qualified) and
+# are not cljw citations: the two ledgers share the D-NNN shape and already
+# collide on D-585, so a bare id is ALWAYS a cljw row and the qualified form is
+# stripped before extraction. The line-level `rg -v` cannot do that (a line may
+# cite both), hence the sed on the matched text.
 defined=$(rg -o '\bD-[0-9]+' "$DEBT" 2>/dev/null | sort -u || true)
-referenced=$(rg -o --no-heading ${wt_globs[@]+"${wt_globs[@]}"} '\bD-[0-9]+' "${search_paths[@]}" 2>/dev/null \
-  | rg -v "$exclude" | grep -o 'D-[0-9]\+' | sort -u || true)
+referenced=$(rg -o --no-heading ${wt_globs[@]+"${wt_globs[@]}"} '(zwasm/)?\bD-[0-9]+' "${search_paths[@]}" 2>/dev/null \
+  | rg -v "$exclude" | sed -E 's#zwasm/D-[0-9]+##' | grep -o 'D-[0-9]\+' | sort -u || true)
 missing=""
 for id in $referenced; do
   # Herestring, NOT `printf | grep -q`: grep -q exits on first match, and

test/e2e/phase16_wasm_memory.sh

@@ -24,7 +24,7 @@ out="$("$BIN" "$FIX" 2>&1)" || fail "cljw exited non-zero running $FIX:
 $out"
 
 want() {
-  echo "$out" | grep -qF "$1" || fail "expected '$1' in the probe output, got:
+  grep -qF "$1" <<<"$out" || fail "expected '$1' in the probe output, got:
 $out"
 }
 
@@ -59,7 +59,7 @@ echo "PASS wasm-memory-dtypes -> signedness + unaligned access"
 # (6) Every failure is CATCHABLE and names the fn the user wrote. A NOT-CAUGHT
 #     means the error escaped (catch …); an uncatchable one would have exited
 #     70 above and never reached here.
-echo "$out" | grep -q "NOT-CAUGHT" && fail "a wasm/mem-* error was not raised or not caught:
+grep -q "NOT-CAUGHT" <<<"$out" && fail "a wasm/mem-* error was not raised or not caught:
 $out"
 want "no-memory wasm/mem-size: this module exports no linear memory"
 want "bad-handle wasm/mem-size: the first argument must be a loaded wasm module"
@@ -74,7 +74,7 @@ want "element-range wasm/mem-write!: element 1 is outside this element type's ra
 want "element-fraction wasm/mem-write!: element 0 is not an integer"
 echo "PASS wasm-memory-catchable -> negative offset / overflow / bad element all raise, none panic"
 
-echo "$out" | grep -q "^DONE$" || fail "the probe did not run to completion:
+grep -q "^DONE$" <<<"$out" || fail "the probe did not run to completion:
 $out"
 
 echo