chore(release): v1.7.0 — the component marshaller no longer dies on guest data

Smell-audited: depth 1: the full gate caught me regenerating nothing. The
`placement_drift` step added THIS MORNING failed on `*file*` — I had added a var
and not re-run the generator, which is exactly the drift the gate exists to
catch, on the same day it was written. Fixed by regenerating (1326 -> 1327), and
worth recording because a gate that catches its author within hours is a gate
that will catch a stranger in a year.

Shipping the three units that landed after v1.6.0:

- the component marshaller's bare `@intCast`es, which were ReleaseSafe panics —
  one of them on guest-controlled data, so an untrusted component could kill the
  host by returning a large u64;
- `result` / `variant` as tagged vectors (ADR-0135 am2), replacing an err→throw
  that discarded the error value into a generic Wasm trap;
- `clojure.core/*file*`.

MINOR rather than MAJOR for the `result` shape change: v1.6.0 did ship the throw
form, but D-404 records that the marshalling table is "today only
string/int/float/bool/char + resource handle" and that no typed component
fixture exists — so those rows have never executed and nothing can depend on
them. The CHANGELOG says which two behaviours changed and how to tell.

Gates: macOS arm64 full 416/1 -> regenerated -> clean; smoke 7/0 on the release
content. x86_64 leg runs next against the tag.

Author: chaploud

.dev/handover.md

@@ -12,24 +12,20 @@
   Step 6). `build.zig.zon` `.zwasm` = tag pin
   `v2.4.0` (2026-08-03; zwasm's external-consumer release — nothing in
   it reaches cljw, pin hygiene only). Latest release:
-  **v1.6.0** (2026-08-04; four hang/abort fixes — ADR-0175 spawn-to-register
-  safepoint, ADR-0176 live-worker teardown, D-347 unmetered `wasm/run`, D-339
-  `run-server` head deadline — plus the opened Issues/PR surface).
-  CHANGELOG is the release-history SSOT.
-- **First task on resume MUST be**: **P1-6** — the WIT↔Clojure type-mapping
-  divergence with ClojureWit. Measured 2026-08-04: cljw's ADR-0135 table and
-  ClojureWit's `doc/design/0012` disagree on **3 rows**, and ClojureWit's shapes
-  are the implemented, argued ones (its S1 is closed; cljw's D-404 marshalling
-  is not built). `result` → cljw draft throws, Wit returns `[:ok v]`/`[:err e]`
-  with opt-in `unwrap` sugar (Wit's reasoning: throwing "has no meaning in
-  non-return position, inverts WIT's error channel, and fights laziness").
-  `variant` → cljw `{:wit/case :kw :value v}`, Wit `[:case-name value]`.
-  `char` → a PRINCIPLED divergence, not a bug: Wit maps to an Integer codepoint
-  because a JVM `Character` is 16-bit and truncates; cljw's char is a 21-bit
-  codepoint, verified — `(char 0x10437)` → `𐐷` on cljw, "Value out of range for
-  char" on JVM clj. Land an ADR-0135 amendment aligning `result` + `variant`
-  to the implemented shapes and recording `char` as host-forced, BEFORE D-404
-  implements the draft's shapes.
+  **v1.7.0** (2026-08-04; the component marshaller could kill the host on
+  guest data — bare `@intCast` = a ReleaseSafe panic; `result` lifts as
+  `[:ok v]`/`[:err e]` per ADR-0135 am2, replacing a throw that DISCARDED the
+  err payload; `*file*` lands). v1.6.0 earlier the same day carried four
+  hang/abort fixes. CHANGELOG is the release-history SSOT.
+- **First task on resume MUST be**: the shared typed `echo` component fixture,
+  driven by BOTH repos. It is the mechanism that stops cljw's and ClojureWit's
+  WIT tables drifting apart again (ADR-0135 am2 aligned them by hand once), and
+  it discharges D-404's blocker ("verification is BLOCKED on a typed component
+  FIXTURE; only greet + resource_counter exist"). ClojureWit's
+  `dev/resources/echo.wat` needs no Rust toolchain, so cljw can drive the same
+  binary. Then D-404's resource phase: `own` lifts as a bare integer on the
+  one-shot `component-invoke` path and is never dropped (the cached
+  `component-call` path wraps correctly).
   The 2026-08-04 audit-remediation arc is otherwise closed — see git log
   `77f690a3`..`82adf824` plus ADR-0179.
 - **Unreleased on main**: envelope v9 (op_var_meta — def-meta rides
@@ -78,8 +74,8 @@
   path rot (`zwasm_from_scratch`→`zwasm`, dead `OSS/zig` ref,
   `cleanup_orphans.sh`). Companion: zwasm D-526.
 
-- **Perf campaign (§9.2.S) — PAUSED** (D-520 / D-386 / D-005/006).
-- **D-513** — clojure.core.reducers / clojure.repl / var :doc.
+- **Perf campaign (§9.2.S) — PAUSED** (D-520 / D-386 / D-005/006). **D-513** —
+  clojure.core.reducers / clojure.repl / var :doc.
 - **D-548** — (a) DISCHARGED (ADR-0176); residual = (b) pmap
   wall-clock on the 3-vCPU runner (timing envelope, still gated).
 - CIDER upstream banner patch draft (user-side PR):

CHANGELOG.md

@@ -7,6 +7,42 @@ first stable `1.0.0` tag; pre-1.0 `alpha` / `rc` tags may still change surfaces.
 
 ## [Unreleased]
 
+## [1.7.0] - 2026-08-04
+
+**Upgrade if you load Wasm components.** An untrusted component could kill the
+host process, and `result` errors were reaching you as generic Wasm traps with
+the error value discarded.
+
+### Fixed
+
+- **An untrusted Wasm component could kill the host process.** The component
+  marshaller used bare integer casts, which in the shipped ReleaseSafe build
+  are process-killing safety panics rather than catchable errors. Two paths
+  were reachable: lowering an out-of-range argument (`(c/f 300)` against a WIT
+  `u8`), and — worse, because the data is the guest's — lifting a `u64` above
+  `i64`'s maximum. Both now go through the same range check the core-module
+  `wasm/call` surface has always used. A `u64` beyond `i64` and an `s64`
+  beyond 48 bits now lift exactly via BigInt instead of panicking or silently
+  becoming a lossy float.
+
+### Changed
+
+- **`result` and `variant` lift as tagged vectors.** `result` is now
+  `[:ok v]` / `[:err e]` and `variant` is `[:case-name payload]`, with the
+  payload slot omitted when the arm carries none — one destructuring idiom for
+  every WIT sum type. This replaces an `err`→throw mapping that **discarded the
+  error value**: the old path raised a generic Wasm *trap*, so a component
+  returning `err("not found")` reached you as "WebAssembly module trapped" with
+  the message gone. Throwing also had no meaning off the return position — a
+  `result` nested in a `list` or `record` aborted the whole conversion.
+  (ADR-0135 amendment 2.)
+
+### Added
+
+- **`clojure.core/*file*`** — the source being evaluated, matching JVM Clojure:
+  the script path when a file runs, and `"NO_SOURCE_PATH"` otherwise. Still
+  `^:dynamic`, so tooling can rebind it.
+
 ## [1.6.0] - 2026-08-04
 
 **Upgrade if you use threads, futures, promises, or `wasm/run`.** This

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .cljw,
-    .version = "1.6.0",
+    .version = "1.7.0",
     .fingerprint = 0x1869d207073beffa,
     .minimum_zig_version = "0.16.0",
     .dependencies = .{

data/placement.yaml

@@ -24,10 +24,10 @@
 schema_version: "2.0"
 summary:
   namespaces_required: 31
-  total: 1326
+  total: 1327
   zig: 394
   clj: 725
-  value: 201
+  value: 202
   unbound: 6
 vars:
   "cljw.error/*error-context*": { impl: value, flags: "dynamic" }
@@ -145,6 +145,7 @@ vars:
   "clojure.core/*default-data-reader-fn*": { impl: value, flags: "dynamic" }
   "clojure.core/*e": { impl: unbound, flags: "dynamic" }
   "clojure.core/*err*": { impl: value, flags: "dynamic" }
+  "clojure.core/*file*": { impl: value, flags: "dynamic" }
   "clojure.core/*flush-on-newline*": { impl: value, flags: "dynamic" }
   "clojure.core/*in*": { impl: value, flags: "dynamic" }
   "clojure.core/*math-context*": { impl: value, flags: "dynamic" }