@@ -0,0 +1,19 @@
+// V8 corpus lane (doc/design/0023): instantiate one compiled entry module
+// and print `result <value>` or `trap <message>`. A trap is an expected,
+// classified outcome — exit 0 either way; the harness compares it against
+// corpus/trap_table.edn. Anything else (bad file, missing export) throws
+// and exits non-zero, which the harness treats as a broken lane.
+
+import { readFileSync } from "node:fs";
+
+const [, , path] = process.argv;
+const instance = new WebAssembly.Instance(
+  new WebAssembly.Module(readFileSync(path)),
+  {},
+);
+try {
+  console.log(`result ${instance.exports.entry()}`);
+} catch (e) {
+  if (e instanceof WebAssembly.RuntimeError) console.log(`trap ${e.message}`);
+  else throw e;
+}
@@ -0,0 +1,33 @@
+;; The S3 corpus — doc/design/0022 B's committed artifact; the harness is
+;; test/cljwit/corpus_test.clj (doc/design/0023). Every special form lands
+;; with its entries in the same commit, and any "X works" claim leaves its
+;; probing expression here.
+;;
+;; Authoring rules for day one (0023):
+;;   - entries are scalar: the last form's value is a long (0022 B.3)
+;;   - literals, intermediates AND results all stay inside i31
+;;     (-2^30 .. 2^30-1) — the boxed-i64 lane is open (0022 C), and a
+;;     violation traps `unreachable`, which the harness reports as an
+;;     out-of-contract entry, not a compiler divergence
+;;   - an entry that expects a throw needs its row in trap_table.edn
+[{:id "lit"             :forms [42]}
+ {:id "lit-neg"         :forms [-7]}
+ {:id "lit-i31-max"     :forms [1073741823]}
+ {:id "lit-i31-min"     :forms [-1073741824]}
+ {:id "add-nary"        :forms [(+ 1 2 3 4)]}
+ {:id "sub-chain"       :forms [(- 100 1 2 3)]}
+ {:id "neg-unary"       :forms [(- 5)]}
+ {:id "mul"             :forms [(* 6 7)]}
+ {:id "arith-nested"    :forms [(+ (* 3 4) (- 10 (quot 9 2)))]}
+ {:id "quot-pos"        :forms [(quot 17 5)]}
+ {:id "quot-neg"        :forms [(quot -17 5)]}
+ {:id "if-lt"           :forms [(if (< 1 2) 10 20)]}
+ {:id "if-lt-false"     :forms [(if (< 2 1) 10 20)]}
+ {:id "if-nil"          :forms [(if nil 1 2)]}
+ {:id "if-false"        :forms [(if false 1 2)]}
+ {:id "if-zero-truthy"  :forms [(if 0 1 2)]}
+ {:id "if-untaken-arm"  :forms [(if true 3 (quot 1 0))]}
+ {:id "let-shadow"      :forms [(let [x 1] (let [x (+ x 1)] (* x 10)))]}
+ {:id "let-sequential"  :forms [(let [x 2 y (+ x 3)] (* x y))]}
+ {:id "top-level-forms" :forms [(+ 1 1) (+ 2 2)]}
+ {:id "trap-div-zero"   :forms [(quot 1 0)]}]
@@ -0,0 +1,15 @@
+;; The trap↔class table — doc/design/0022 B.5's numbered artifact. A wasm
+;; trap has no exception class, so an entry where the oracle threw and a
+;; compiled lane trapped compares equal only where a row says so; any
+;; other pairing is a bug or a new numbered divergence.
+;;
+;; :jvm-message narrows the class (0023, review): ArithmeticException
+;; also means long overflow ("long overflow"), which must never equate to
+;; a division trap. All strings are observed, not recalled: the JVM's is
+;; what `(quot 1 0)` actually throws, the engine strings verified
+;; 2026-07-30 on the pinned toolchain (wasmtime 47.0.1, V8/node).
+[{:row 1
+  :class "java.lang.ArithmeticException"
+  :jvm-message "/ by zero"
+  :wasmtime "integer divide by zero"
+  :v8 "divide by zero"}]
@@ -1,14 +1,14 @@
 {:paths ["src" "resources"]
- :deps {org.clojure/clojure {:mvn/version "1.12.4"}}
+ :deps {org.clojure/clojure {:mvn/version "1.12.4"}
+        ;; The S3 front end: tools.analyzer core plus our own host layer
+        ;; (doc/design/0022 E decided it, 0023 grows it into src/).
+        org.clojure/tools.analyzer {:mvn/version "1.2.2"}}
 
  :aliases
  {;; --- development -------------------------------------------------------
   :dev  {:extra-paths ["test" "dev"]
          :extra-deps  {io.github.cognitect-labs/test-runner
-                       {:git/tag "v0.5.1" :git/sha "dfb30dd"}
-                       ;; bb spike-analyzer (0022 E): the S3 front-end survey's
-                       ;; executable half.
-                       org.clojure/tools.analyzer {:mvn/version "1.2.2"}}}
+                       {:git/tag "v0.5.1" :git/sha "dfb30dd"}}}
 
   ;; `clj -M:test` — the unit lane
   :test {:extra-paths ["test"]
 
@@ -0,0 +1,153 @@
+# 0023 — The first vertical slice: corpus harness and the representation it pins
+
+**Status:** proposed · 2026-07-30 · adversarially reviewed the same day.
+The review verified the WasmGC mechanics it attacked (nullable `ref.eq`,
+`if` with a ref result, singleton identity surviving `wasm-opt -O3`) and
+changed four things, marked *(review)* below: analyzer-side namespace
+isolation, a JVM-message column in the trap table, the i31 rule extended
+from literals to intermediates and results, and an overclaimed truthiness
+example dropped.
+
+## The question
+
+`0022` decided S3's shape and named its first unit: a corpus harness plus
+scalar entries running analyze → emit → both engines, forcing none of the
+open decisions (dev-loop format, boxed-i64 lane, throw representation).
+Building it still requires pinning things `0022` deliberately left to "the
+first corpus entry": the concrete corpus artifacts, and the emitter's value
+representation for everything the slice touches.
+
+## The decision
+
+### The harness (implements `0022` B, adds nothing to it)
+
+- **`corpus/s3.edn`** — the committed corpus. An entry is
+  `{:id "…" :forms [f1 … fn]}`; forms evaluate in order, the last one's
+  value is the entry's result. Day-one entries are scalar (`0022` B.3).
+- **`test/cljwit/corpus_test.clj`** — the differential oracle, an ordinary
+  `clojure.test` so it is in `bb check` from the first entry
+  (CI-mandatory, `0022` B). The oracle lane evaluates each entry in a
+  fresh, discarded namespace in the test JVM — which *is* real `clojure`,
+  satisfying the isolation rule without a second process. **Analysis is
+  isolated the same way** *(review)*: each `analyze-forms` call gets its
+  own gensym'd namespace and `create-var` interns only there, so a `def`
+  in one entry can never resolve during another entry's analysis — the
+  oracle-lane leak rule, one lane over. Compiled lanes: emit WAT →
+  `wasm-tools parse` → `wasmtime run --invoke entry` and
+  `node corpus/run.mjs`, in both `:dev` and `:prod` modes.
+  `--invoke`'s printed result is a warned-experimental interface — the
+  same one `bench/s0` already stands on; the pinned toolchain makes that
+  acceptable, and a format change fails every entry loudly at once
+  *(review)*. On a machine without the `wasmtime` CLI on PATH that one
+  lane skips with a printed line — the exact trade the FFM tests already
+  make with `CLJWIT_WASMTIME_LIB` — while the oracle, analysis, emission
+  and the V8 lane always run; CI runs inside the flake, where nothing
+  skips.
+- **`corpus/trap_table.edn`** — the numbered trap↔class artifact
+  (`0022` B.5). Row 1: `java.lang.ArithmeticException` ↔ the engines'
+  division traps, exercised by a corpus entry in the same commit.
+  A row carries the **JVM message substring, not just the class**
+  *(review)*: `ArithmeticException` also means long overflow, which is
+  not a division trap, and class-only matching would equate them the day
+  the boxed lane lands. Stack exhaustion's row lands with the first
+  depth-sensitive entry, not before (same-commit coverage, `0022` B.1).
+- **Value comparison** is structural: the oracle's `pr-str` and the wasm
+  lane's printed integer both go through `clojure.edn/read-string` and
+  compare with `=`. An oracle value that `pr-str`→`read-string` cannot
+  round-trip is a corpus lint error (`0022` B.4) — this falls out of the
+  mechanism rather than being a separate linter.
+
+### The representation (the new pins)
+
+1. **Every Clojure value is `(ref null eq)`.** One uniform type; no
+   unboxing pass in the slice. Refinement is a prod-mode optimisation
+   later, per binaryen's lowering guidance already cited in `0022` A.
+2. **Fixnums are `i31`** — B3's measured substrate, verbatim. A literal
+   outside i31's signed 31-bit range is a **compile error** in the slice:
+   that value belongs to the boxed-i64 lane, which is open (`0022` C)
+   precisely because it is unmeasured. Runtime arithmetic computes in
+   i64 and re-boxes through one guard; a result outside i31 hits
+   `(unreachable)` — the same shape B3 measured, and the same honesty:
+   the slow path exists and no corpus entry may reach it yet. The
+   corresponding **corpus authoring rule covers intermediates and
+   results, not just literals** *(review)*: `(quot -1073741824 -1)` or an
+   overflowing left-fold would compile, run, and trap where Clojure's
+   longs succeed. The harness classifies `unreachable` and cast-failure
+   traps as "entry out of contract — fix the entry", so a violated
+   authoring rule cannot read as a compiler divergence.
+3. **nil is the null reference.** `(ref null eq)` locals default to it,
+   `ref.is_null` is the nil test, and no allocation or global is spent
+   on it.
+4. **false and true are two singleton empty-struct globals**, distinct by
+   identity (`ref.eq`), not by type. Truthiness — the thing `0022` D said
+   the first corpus entry pins — is
+   `(not (or (ref.is_null v) (ref.eq v $false)))`, emitted as a call to a
+   runtime `$truthy`. `(if 0 …)` is therefore truthy by construction,
+   matching Clojure with no special cases — and the shape extends to any
+   future non-nil, non-false value, though only fixnums can demonstrate
+   it while no other representation exists *(review)*.
+5. **The entry protocol**: each entry compiles to one self-contained
+   module exporting `entry : [] -> [i64]`, the last form's value
+   unwrapped by `ref.cast (ref i31)` + `i31.get_s`. A non-fixnum result
+   traps the cast — which is the mechanical form of `0022` B.3's rule
+   that non-scalar entries wait for printing.
+6. **Intrinsics, not a core library**: `+ - * quot <` compile from
+   `:invoke`-of-`#'clojure.core/…` (the `:inline`-off contract from
+   `0022` E) to runtime functions; `+ - *` fold n-ary to binary with
+   Clojure's identities, `<` is binary-only for now. Any other var is a
+   loud compile error naming the var.
+7. **Both modes exist from day one and currently emit identical bytes.**
+   `:dev`/`:prod` thread the whole pipeline and all four compiled lanes
+   run, but nothing in the slice's forms diverges by mode — divergence
+   starts with `def`/var emission (`0022` D). Stated here so nobody reads
+   four green lanes as mode coverage that does not exist yet.
+
+## Why
+
+- Every mechanism above is inherited from something already measured or
+  decided: the WAT→`wasm-tools`→both-engines pipeline is `bench/s0`'s,
+  the i31 substrate and the `unreachable` slow path are B3's, the oracle
+  contract is `0022` B, the analyzer front end is `0022` E's spike grown
+  into `src/`.
+- The pins themselves are chosen for *reversibility*: null-nil, singleton
+  false, and `$truthy` are each one emitter function; the boxed lane can
+  replace the `unreachable` arm without touching entry, corpus, or
+  comparison machinery.
+
+## Alternatives rejected
+
+- **false as a reserved i31 value.** Free identity test, but it steals a
+  value from fixnum space and makes every arithmetic fast-path guard also
+  a not-false guard. The sibling's lesson that dispatch guards dominate
+  makes polluting the fixnum domain the wrong default.
+- **nil as a singleton struct, refs non-nullable.** Binaryen's tips favor
+  non-nullable fields, but that is a prod-mode refinement; nullable
+  locals need no explicit init, `ref.is_null` is one instruction, and
+  nothing measured yet distinguishes them. Revisit when the optimiser
+  lane exists.
+- **Running compiled lanes through `cljwit.host` instead of spawning
+  engines.** Tempting reuse, but corpus modules are core modules, not
+  components (`0007`: components are S4's boundary), `cljwit.host` speaks
+  components only, and the V8 lane has no host at all. `bench/s0`'s spawn
+  mechanism is validated and already fails on wrong answers.
+- **A standalone corpus runner (`bb corpus`) instead of a test in the
+  gate.** `0022` B's own clause: mandatory-ness alone saved the sibling
+  nothing, but an opt-in lane is strictly worse. The gate is where the
+  oracle lives; a convenience runner can come later if iteration wants it.
+- **Waiting for `fn`/`def` so the slice "does more".** The harness is the
+  deliverable; every form it carries today has its corpus lines in the
+  same commit, and `fn`'s multi-arity contract (`0022` D) is its own
+  unit.
+
+## What would falsify this
+
+- The boxed-lane benchmark (`0022` C) pricing the i31 split out — the
+  fixnum pin and the `unreachable` arm both reopen.
+- A corpus entry whose truthiness the `$truthy` shape cannot express —
+  none is known; finding one would mean the false-singleton choice leaks.
+- The trap table failing to distinguish two JVM exception classes that
+  map to one wasm trap message — expected eventually (e.g. cast failure
+  vs NPE); the table gains columns or the entry gains a numbered
+  divergence when it happens.
+- Engine trap messages changing across pinned-toolchain upgrades — the
+  table rows carry the exact strings, so this fails loudly in the gate.
@@ -18,26 +18,30 @@ _Short by design, and printed at every session start — so findings live in
    reports tiered drift (`:stale`/`:modified`/`:missing`/`:orphans`), and
    `check` is the CI verb. What remains of S2 — the nREPL entry point and
    the watcher — waits for a compiler to serve, so:
-3. **S3 is entered** (`0022`, proposed, rewritten twice on day one).
-   Decided: prod emission as WAT text through the pinned toolchain; the
-   differential-oracle contract (isolation rule, trap↔class table,
-   comparison holes named); the numeric *fast path* (i31) and semantic
-   baseline (`+` throws, `+'` promotes; `identical?` divergence numbered);
-   **tools.analyzer core plus our own host layer** as the front end
-   (`bb spike-analyzer` is the executable half). Open, each with its
-   benchmark named: the dev-loop output format (`0009`'s precondition —
-   ~23 ms/spawn measured, candidates listed), the boxed-i64 lane (fib's
-   n = 46…92 runs entirely on it, never measured), the throw
-   representation. Next unit: the first vertical slice — corpus harness +
-   scalar entries through analyze → emit → both engines — which forces
-   none of the open decisions.
+3. **S3's first vertical slice is landed** (`0022` decided the shape,
+   `0023` the harness and representation): the differential oracle is in
+   the gate — `corpus/s3.edn` (21 scalar entries) runs through real
+   `clojure` (fresh namespace per entry) and through
+   `cljwit.analyze` → `cljwit.emit` → `wasm-tools` → **wasmtime and V8,
+   in both modes** (which emit identical bytes until `def` lands — stated,
+   not hidden), with `corpus/trap_table.edn` row 1
+   (`ArithmeticException` ↔ division trap) exercised. Representation
+   pinned in `0023`: values are `(ref null eq)`, fixnums i31, nil = null,
+   false/true = singleton structs, overflow arm `unreachable`. Still
+   open, each with its benchmark named (`0022`): the dev-loop output
+   format (before the nREPL unit), the boxed-i64 lane (before the
+   emitter grows past i31), the throw representation. Next unit:
+   **`loop`/`recur` entries and emission** (a block and a `br`, forces
+   nothing open), then `def` — which starts the real dev/prod divergence.
 
 Done since the last update: `0016` `own<T>` handles, `0017` host imports
 (A–F), `0018` host-defined resources, `0012`'s `ex-data` contract shrunk to
 what reflection can supply, `0019` libwasmtime resolution for library users,
 `0020` generated namespaces (`cljwit.host.gen` — one tagged var per export,
 instance first, `host/unwrap` as the opt-in result sugar), `host/describe`,
-and the reflection delete contracts the headers require. What is left of
+the reflection delete contracts the headers require, and `0023` — the
+compiler's first two namespaces exist and every claim they make is checked
+against `clojure` itself on every `bb check`. What is left of
 `0012` is `map`, `list<T,N>`, `stream`/`future` and `error-context`, none of
 which a shipped release can express.
 
 
@@ -0,0 +1,57 @@
+(ns cljwit.analyze
+  "The S3 front end: tools.analyzer core plus this host layer
+   (`doc/design/0022` E decided it; `0023` grew the spike into the
+   pipeline).
+
+   The one semantic decision embedded here: `macroexpand-1` applies only
+   `:macro` vars, never `:inline` — with inlining on, `(+ x 1)` becomes a
+   JVM interop form and `+`-vs-`+'` semantics leave cljwit's hands
+   (`0022` C). Without it, `+` stays an `:invoke` of `#'clojure.core/+`.
+
+   Analysis state is isolated per call: each `analyze-forms` run gets its
+   own discarded namespace and `create-var` interns only there, so a
+   `def` in one corpus entry can never resolve during another entry's
+   analysis — the oracle lane's isolation rule (`0022` B), one lane over."
+  (:refer-clojure :exclude [macroexpand-1])
+  (:require [clojure.tools.analyzer :as ana]
+            [clojure.tools.analyzer.env :refer [with-env]]
+            [clojure.tools.analyzer.utils :refer [resolve-sym]]))
+
+(set! *warn-on-reflection* true)
+
+(defn- macroexpand-1
+  "Only `:macro` vars expand; specials and locals shield; no `:inline`."
+  [form env]
+  (if (seq? form)
+    (let [op (first form)]
+      (if (ana/specials op)
+        form
+        (let [v (resolve-sym op env)]
+          (if (and (not (-> env :locals (get op)))
+                   (:macro (meta v)))
+            (apply v form env (rest form))
+            form))))
+    form))
+
+(defn analyze-forms
+  "Analyzes top-level `forms` in order as one program — later forms see
+   earlier `def`s. Returns a vector of ASTs."
+  [forms]
+  (let [ns-sym (gensym "cljwit.analysis")]
+    (create-ns ns-sym)
+    (try
+      (let [env  {:context :ctx/expr :locals {} :ns ns-sym}
+            genv (atom {:namespaces
+                        {ns-sym       {:mappings (ns-map 'clojure.core)
+                                       :aliases {} :ns ns-sym}
+                         'clojure.core {:mappings (ns-map 'clojure.core)
+                                        :aliases {} :ns 'clojure.core}}})]
+        (binding [ana/macroexpand-1 macroexpand-1
+                  ana/create-var    (fn [sym var-env]
+                                      (doto (intern (:ns var-env) sym)
+                                        (reset-meta! (meta sym))))
+                  ana/parse         ana/-parse
+                  ana/var?          var?]
+          (with-env genv
+            (mapv #(ana/analyze % env) forms))))
+      (finally (remove-ns ns-sym)))))