t27b: module vars that hold a string or start undefined (Closes #7448)

[gHashTag]

Closes #7448
Part of #6063

Lane 5 of #6063. Two specs the reference runs were refused by t27b on a module-level var:

• specs/boards/xc7a100t_minimal.t27, blocked on VarDecl(module, pointer/str/slice);
• specs/vsa/similarity_search.t27, blocked on VarDecl(module, undefined).

What changed (cli/t27b/src/lower.rs)

• A module var declared = undefined starts as 0xAA in every byte. Reading it before a write has no portable reference verdict (0xAA on the x86_64 lab, not on the arm64 CI runners), so no fixture reads one before writing it.
• A module var whose type holds a str (a str, a struct with a str field, or an array of those) is written with its initial value at the start of every test, invariant and bench. The reference does the same, because each test runs in a fresh process. A data image cannot hold a string's address before the program is loaded.
• Still refused: a module var of a pointer or slice type, and a string-holding var declared undefined. Each is checked precisely in cli/t27b/tests/source.rs. Two new run tests there check that the interpreter and the JIT agree on pass and fail.

Conformance specs, written first

• specs/tri/t27b/conformance/str_module_var.t27: the reference passes it 5 of 5, with no vacuous tests.
• specs/tri/t27b/conformance/undefined_module_var.t27: the reference passes it 4 of 4, with no vacuous tests.
• Seven expected-value mutants of the two specs each fail one test in t27b. One mutant checks that a write in one test is gone in the next.

Lab evidence (Railway t27b lab, aarch64 under qemu, base 3df7065)

• cargo build 0 and cargo test -p t27b 0.
• t27b test results:
  • str_module_var 5/5;
  • undefined_module_var 4/4;
  • xc7a100t_minimal 23/23 with 15 invariants held, the same as the reference's 23/23;
  • similarity_search now stops at ExprCall(@intCast).
• Full corpus (1541 files) plus t27b.py ratchet:
  • UNEXPECTED PASS xc7a100t_minimal, MOVED similarity_search -> ExprCall(@intCast), and the two conformance specs UNLISTED with pass. These are this PR's ledger rows.
  • One UNEXPECTED FAILURE is not from this PR: specs/policy/own_language.t27 is ledger pass but stops at ExprCall(@intCast) (line 411). That line came in with policy: a foreign-line budget no label lifts, and a local list from origin/master (Closes #7371) #7399, which did not move the row, so master shows the same thing. @intCast belongs to lane 4, and the ledger bless belongs to lane 2, so this PR leaves the row alone; see t27b ratchet: specs/policy/own_language.t27 regressed to ExprCall(@intCast) with #7399 #7478.
  • The other UNEXPECTED PASS and UNLISTED rows are master's own, from other lanes.

Ledger

• Rows:
  • xc7a100t_minimal.t27: blocked -> pass;
  • similarity_search.t27: blocker VarDecl(module, undefined) -> ExprCall(@intCast);
  • new pass rows for the two conformance specs.
• After the latest merge with master (52ea09b): 824 entries, no duplicate paths, sorted. Counts are pass 539, pass_vacuous 262, not_pass 23, and max_not_pass goes from 24 to 23.

Foreign-line budget (#7371): master's check_budget() on origin/master...HEAD passes. lower.rs adds 35 lines and source.rs adds 24, 59 in total. Rust is edited under the owner's standing rule; the owner-approved-foreign label is set, and a block for #7448 is at the top of tools/policy/foreign-exceptions.txt. The master merge was made from master's side, with the hooks on.

Scope note: this was first written together with array-literal slice fields of constants (ExprArrayLiteral(to slice field), which blocks specs/automation/wrapup-auto.t27), and the two together went over the budget. That part is a different blocker and is not in this PR. Under #7371 it will not be opened as a small follow-up PR to fit under the cap; it stays parked until its logic can be written in .t27.

CI fix (ae8420c): the native ratchet on the arm64 runners called undefined_module_var.t27 STALE, because there the reference does not read 0xAA from an undefined container var (3 of 4 tests failed). The fixture now writes every var before reading it. Lab, at the new head: reference 4/4 (asserts 4, 2, 1, 2; 0 vacuous), t27b 4/4, str_module_var 5/5, xc7a100t_minimal 23/23 with 15 invariants held, cargo test --test source 51/51.

🤖 Generated with Claude Code

[gHashTag]

Merge shepherd: merged master in from master's side four times, never rebased or force-pushed. Each merge commit is a fast-forward of this branch.

• ff8ec63, master 927b1ef. cli/t27b/src/lower.rs: both struct fields kept, master's statics (t27b: array literals the reference prints as @constCast(&[_]E{ ... }) -- slice fields and constants returned as mutable slices #7680) and this PR's str_globals, in the struct and in lower_mode.
• babedd9, master b8cb93f (after specs(trios-mesh packet): serialise takes a slice, as the source's buffer has a length (Closes #7413) #7414, specs: layernorm, wrapup-auto and ternary_mac_synth test what they claim (Closes #7404) #7745 and t27b: @setEvalBranchQuota is a compile-time no-op, 823 -> 825 (Closes #7410) #7459). Only the ledger conflicted.
• 93606bd, master 01de65c (after t27b: the type mismatch family from a t27 plan -- two integer types compared, typed constants by value, the peer type, integers into floats (Closes #7740) #7747, t27b coerce_plan: reuse int_cast_plan's widens and test helpers instead of copying them (Closes #7748) #7749 and t27b: a local bound to a void fn's result runs the call and holds void's value, from a t27 plan (Closes #7690) #7725, which change lower.rs). Only the ledger conflicted.
• 0cd837a, master 579bc55 (after t27b: a local bound to the W585 scaffold is never called, as in the reference, and refused by name where it would be read (Closes #7691) #7750). lower.rs conflicted because t27b: a local bound to the W585 scaffold is never called, as in the reference, and refused by name where it would be read (Closes #7691) #7750's fns / scaffold fields sit next to str_globals. Both sides are kept, and this PR's diff against master is unchanged at +35 -12.
• cargo test -p t27b --release on the t27c lab, on the 0cd837a tree: every suite passes, and source has 55 tests.

Ledger: master's ledger with only this PR's five rows, from a tri t27b ratchet --bless of the lab run of babedd9:

• xc7a100t_minimal goes from blocked to pass.
• similarity_search goes from blocked to pass. On this branch alone, its next blocker was @setEvalBranchQuota, and t27b: @setEvalBranchQuota is a compile-time no-op, 823 -> 825 (Closes #7410) #7459 lowered that.
• The browseros agents runtime registry.t27 blocker becomes VarDecl(module, pointer/slice).
• str_module_var and undefined_module_var are new pass rows.

Foreign-line budget: master's check_budget() on git diff --numstat --no-renames origin/master...0cd837a59 allows it. lower.rs adds 35 and source.rs adds 24, 59 in total, so each file is under 40 and the PR is under 80. Master's check_all() with master's list denies only the change to tools/policy/foreign-exceptions.txt itself, which the owner-approved-foreign label covers.

Signed lane receipts (#7672), compared on the t27b lab with /work/t27c-master corpus-receipt compare BASE HEAD --challenge-head <mine> from /work/t27. The latest pair is the final head minus #7750:

• base: https://t27b-lab-production.up.railway.app/runs/01de65cbce0ac93f89abe42e4aa8a7e534b207a6.receipt.json
• head: https://t27b-lab-production.up.railway.app/runs/93606bdbad6e2a77348ad2cb3df786c8a7da8996.receipt.json

base "01de65cbce0ac93f89abe42e4aa8a7e534b207a6" AUTH_MISSING_NONE AUTHOR leaves-bound true
head "93606bdbad6e2a77348ad2cb3df786c8a7da8996" AUTH_MISSING_NONE FRESH leaves-bound true
  input only-head specs/tri/t27b/conformance/str_module_var.t27
  input only-head specs/tri/t27b/conformance/undefined_module_var.t27
  verdict changed specs/boards/xc7a100t_minimal.t27
  verdict only-head specs/tri/t27b/conformance/str_module_var.t27
  verdict only-head specs/tri/t27b/conformance/undefined_module_var.t27
  verdict changed specs/vsa/similarity_search.t27
  output only-head specs/boards/xc7a100t_minimal.t27
  output only-head specs/tri/t27b/conformance/str_module_var.t27
  output only-head specs/tri/t27b/conformance/undefined_module_var.t27
  output only-head specs/vsa/similarity_search.t27
  lane improved specs/boards/xc7a100t_minimal.t27
  lane improved specs/tri/t27b/conformance/str_module_var.t27
  lane improved specs/tri/t27b/conformance/undefined_module_var.t27
  lane improved specs/vsa/similarity_search.t27
totals false inputs false verdicts false outputs false: IMPROVED_ONLY
exit 3

The earlier pairs gave the same verdict:

• base b8cb93f against head babedd9: IMPROVED_ONLY (exit 3), the same four lanes.
• base 927b1ef against head ff8ec63: IMPROVED_ONLY (exit 3), three lanes. similarity_search was not among them, because it was still blocked at @setEvalBranchQuota then.

The final head 0cd837a differs from 93606bd only by the #7750 merge described above.

The stale base.sha was cleared (#7489). Auto-merge was off; the base was flipped to a temporary branch and back to master, and checked to be master. The ci label was re-added, the temporary branch deleted, and auto-merge then turned back on.