t27b: source-level differential fuzzer against t27c gen-zig (tri t27b fuzz) #6442

Refs #6434
Refs #6063

Problem

The only generator-based oracle, cli/t27b/tests/differential.rs, builds random IR and compares codegen with eval.rs. It never generates t27 source, never goes through lower.rs (7011 lines, where most changes land) and never runs the reference path (t27c gen-zig + zig). Its seed is fixed (0x7427, 2500 cases per mode), so CI re-tests the same programs forever. The corpus is the only check on lowering, and corpus specs were not written to stress corner cases.

Prior art: Csmith (325+ bugs) and YARPGen (221 + 122 bugs) generate UB-free programs that end in a checksum. cranelift-fuzzgen restricts generation to implemented opcodes (FUZZGEN_ALLOWED_OPS). The wasmtime differential target runs wasm-smith modules on several engines.

Change

A source-level generator, tri t27b fuzz --cases N --seed S:

• emits random .t27 modules limited to the constructs t27b accepts (allow-list derived from blockers.rs, so it grows with each lane), including integer widths, checked and wrapping arithmetic, shifts, if/switch/for, structs, arrays, optionals and f64;
• biases constants toward 0, +-1, powers of two and MIN/MAX (the YARPGen policy);
• ends every test in assert_eq(checksum, <value>), with the expected value left open so that the oracle is agreement: the same checksum or the same trap site from t27c gen-zig + zig test and from t27b;
• runs on the Railway lab with a fresh seed every run and records failing seeds; each failing case is committed as a regression spec under a fixtures directory, not under specs/;
• classifies a disagreement as a t27b bug, a reference bug (t27c gen-zig) or a semantics gap (no written rule), and files the last two kinds separately.

Done when

• tri t27b fuzz --cases 1000 runs on the lab and publishes fuzz.{cases,agree,disagree,seeds} in latest.json.
• At least one lab run of 10k cases is recorded in EPIC: t27b runs the whole corpus -- 100% of reference-passing specs, 0 mismatches, experiments on Railway #6063.

🤖 Generated with Claude Code

Boundary

• cli/t27b/tests/differential.rs