chore(deps): zwasm pin v2.3.0 -> v2.4.0 (pin hygiene, no behaviour follow)

zwasm v2.4.0 is its external-consumer release: `-Dcompiler-rt` so a
static libzwasm.a links from rustc/gcc/clang (zwasm #153/#154, reported
by @jtakakura against zwasm-rust-sdk), plus a DCE fix keeping the WasmGC
cohort out of sub-3.0 builds (zwasm #150, v1_0 .text -11.6%).

Neither reaches cljw, and the ledger says so rather than implying a
follow: cljw links zwasm through Zig (`b.lazyDependency`), which supplies
its own compiler-rt, and it passes no `-Dwasm` override so it builds at
zwasm's default 3.0 — where #150's guard is `if (comptime false)` and the
real helper bodies run unchanged. No cljw-side size or output delta is
claimed, because none was measured.

Verified on the new pin: `zig build -Dwasm`, phase16 wasm e2e (ffi /
engine_select / run / component / require_component) 5/5, smoke gate
7 passed / 0 failed.

No version bump: v1.5.1 already has ten unreleased commits behind it
(ADR-0175/0176 GC work, the build-stdout fix, the CI full-gate change),
so cutting a cljw release is a separate decision from this pin.

Author: chaploud

.dev/handover.md

@@ -10,7 +10,8 @@
   == the local full gate, all e2e), so a red push CI is the immediate
   e2e signal, not a next-day nightly. Commit **and** push (atomic
   Step 6). `build.zig.zon` `.zwasm` = tag pin
-  `v2.3.0` (2026-07-17 engine follow, no API change). Latest release:
+  `v2.4.0` (2026-08-03; zwasm's external-consumer release — nothing in
+  it reaches cljw, pin hygiene only). Latest release:
   **v1.5.1** (2026-07-17; zwasm-pin patch release on top of v1.5.0 =
   the ADR-0174 host-class campaign + Thread lifecycle; tap carries
   cljw 1.5.1 + zwasm). CHANGELOG is the release-history SSOT.

.dev/zwasm_capabilities.md

@@ -2,9 +2,10 @@
 
 > **SSOT for "what does the zwasm we embed offer, and what has cljw adopted".**
 > cljw embeds **zwasm v2** (F-001, unavoidable). The dep is a **tag pin** —
-> **v2.3.0** (see § Pin), pinned 2026-07-17 — the WASI-0.3.0-official
-> inventory-sweep release (no embedding-API/JIT-output change); prior v2.2.1
-> (2026-07-16) was the binary-size campaign, v2.2.0 (`cf5d20d7`, 2026-07-09)
+> **v2.4.0** (see § Pin), pinned 2026-08-03 — the external-consumer release,
+> none of which reaches cljw; prior v2.3.0 (2026-07-17) was the
+> WASI-0.3.0-official inventory sweep, v2.2.1 (2026-07-16) the binary-size
+> campaign, v2.2.0 (`cf5d20d7`, 2026-07-09)
 > the AOT-full-fidelity release (ADR-0203). zwasm is itself under active
 > co-development (`~/Documents/MyProducts/zwasm`) and its embedding API is
 > *growing* — notably a **JIT-backed
@@ -44,16 +45,24 @@ a cljw-side shim.
 
 ## Pin
 
-- **TAG PIN — v2.3.0, pinned 2026-07-17.** `build.zig.zon`
-  `.zwasm` = `.url = "git+…/zwasm.git#v2.3.0"` + `.hash = "zwasm-2.3.0-FT1Fv8Qh…"`,
-  resolved from GitHub. The WASI-0.3.0-official inventory-sweep release:
-  docs truth-sweep vs the officially released WASI 0.3.0 (2026-06-11),
+- **TAG PIN — v2.4.0, pinned 2026-08-03.** `build.zig.zon`
+  `.zwasm` = `.url = "git+…/zwasm.git#v2.4.0"` + `.hash = "zwasm-2.4.0-FT1Fv9E0…"`,
+  resolved from GitHub. The external-consumer release: `-Dcompiler-rt`
+  bundles Zig's compiler-rt into `libzwasm.a` for non-Zig linkers
+  (zwasm #153/#154), and a DCE fix keeps the WasmGC cohort out of
+  sub-3.0 builds (zwasm #150). **Neither reaches cljw, structurally**:
+  cljw links zwasm through Zig (`b.lazyDependency`), which supplies its
+  own compiler-rt, and it passes no `-Dwasm` override so it builds at
+  zwasm's default `3.0` — where the DCE guard is `if (comptime false)`
+  and the real helper bodies run unchanged. So this pin is hygiene, not
+  a behaviour follow; no cljw-side size or output delta is claimed.
+  Verified: `zig build -Dwasm` + phase16 wasm e2e (ffi / engine_select /
+  run / component / require_component) all green on the new pin.
+  Executed under the user's standing tag-watch directive, user-
+  directed this session. Prior: **v2.3.0** (2026-07-17), the
+  WASI-0.3.0-official inventory sweep (docs truth-sweep,
   `wasi:clocks/system-clock` + `get-resolution` component-host support,
-  Homebrew packaging (`brew install clojurewasm/tap/zwasm`). NO
-  embedding-API / behaviour / JIT-output change — a pure engine follow
-  for cljw (the new surface is component-host-level, which cljw does not
-  use). Executed under the user's standing tag-watch directive, user-
-  directed this session. Prior: **v2.2.1** (2026-07-16), the binary-size
+  Homebrew packaging) — also a pure engine follow. Prior: **v2.2.1** (2026-07-16), the binary-size
   campaign (zwasm ADR-0204 / D-522 stage 1: JIT host-callback thunk
   collapse, `api.jit_host_bridge` 1,311 KB → 232 KB, zwasm CLI −21%;
   measured cljw effect: shipped binary 8,583,352 → **7,499,896 B

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to ClojureWasm are documented here. The format follows
 [SemVer](https://semver.org/). SemVer compatibility guarantees start at the
 first stable `1.0.0` tag; pre-1.0 `alpha` / `rc` tags may still change surfaces.
 
+## [Unreleased]
+
+### Changed
+
+- **zwasm pinned to v2.4.0** (its external-consumer release:
+  `-Dcompiler-rt` for linking `libzwasm.a` from a non-Zig toolchain, and
+  a DCE fix that keeps the WasmGC cohort out of sub-3.0 builds). Neither
+  reaches cljw — cljw links zwasm through Zig, which supplies its own
+  compiler-rt, and it builds at zwasm's default Wasm 3.0 level where the
+  DCE guard is inert. Pin hygiene, not a behaviour follow; `-Dwasm`
+  build + the phase16 wasm e2e suite verified green on the new pin.
+
 ## [1.5.1] - 2026-07-17
 
 Patch release: dependency follow.

build.zig.zon

@@ -10,20 +10,22 @@
         },
         // zwasm v2 embedding API (F-001 / D-037). `lazy` so the DEFAULT build +
         // gate never resolve it — only `-Dwasm` (b.lazyDependency) does.
-        // PINNED to STABLE tag **v2.3.0** (2026-07-17): the WASI-0.3.0-official
-        // inventory-sweep release (docs truth-sweep + wasi:clocks/system-clock
-        // host support + Homebrew packaging). NO embedding-API or JIT-output
-        // change — a pure engine follow for cljw (the new surface is
-        // component-host-level WASI 0.3.0 clocks). Prior v2.2.1 (2026-07-16)
-        // was the binary-size-campaign release (zwasm ADR-0204 / D-522: JIT
-        // host-callback thunk collapse, zwasm CLI -21% — to_cljw_06);
-        // v2.2.0 (2026-07-09) the AOT-full-fidelity release (ADR-0203).
-        // cljw's embedding surface (Engine/Module/Instance via `.auto`
-        // =JIT-default, D-488) is unchanged. lazy + flag-guard means a
+        // PINNED to STABLE tag **v2.4.0** (2026-08-03): the external-consumer
+        // release — `-Dcompiler-rt` for linking libzwasm.a from a non-Zig
+        // toolchain, plus a DCE fix keeping the WasmGC cohort out of sub-3.0
+        // builds. NEITHER reaches cljw: cljw links zwasm through Zig
+        // (`b.lazyDependency`), which supplies its own compiler-rt, and it
+        // builds at zwasm's default `-Dwasm=3.0`, so the sub-3.0 DCE fix is
+        // out of scope. This pin is hygiene — keeping the tag current, not
+        // chasing a behaviour change. Prior v2.3.0 (2026-07-17) = WASI-0.3.0
+        // inventory sweep; v2.2.1 (2026-07-16) = binary-size campaign (zwasm
+        // ADR-0204 / D-522, CLI -21%); v2.2.0 (2026-07-09) = AOT full fidelity
+        // (ADR-0203). cljw's embedding surface (Engine/Module/Instance via
+        // `.auto` =JIT-default, D-488) is unchanged. lazy + flag-guard means a
         // churning dep cannot break the default gate.
         .zwasm = .{
-            .url = "git+https://github.com/clojurewasm/zwasm.git#v2.3.0",
-            .hash = "zwasm-2.3.0-FT1Fv8QhjQB0rGBMyCP2GebQU-A4xxuXl-6WF0EXo-ao",
+            .url = "git+https://github.com/clojurewasm/zwasm.git#v2.4.0",
+            .hash = "zwasm-2.4.0-FT1Fv9E0jQCqP2Pd8DiSEWZMwqmdl-uPzntoEnBxDlro",
             .lazy = true,
         },
     },