wcc/ww: registerstruct field offset is the checker's natural tfield.offset

wwstage carried TWO struct-layout sources. registerstruct (cgenutil.ww)
recomputed each field's `fi.foff` via fieldsize — slot-padded, round-8 —
for the WRITE (construction / field store) path, while the READ path
(cgplaceaddr / dotbaseaddr) used the checker's natural `tfield.offset`.
They diverged iff a struct had a nested sub-8 composite field
(slotsize != size) plus a successor: ww wrote the successor at the
slot-padded offset and read it at the natural offset, mis-addressing its
own field. cstage has no structinfo and reads tfield directly, self-
consistently natural (cmd/w6c/cgen.c).

Fix: make `fi.foff` a VIEW of the checker's already-built natural layout.
Lock-step walk tstruct.list (AST N_TFIELD) and ti.fields (tfield) — both
head-first declared order, both skip non-TFIELD identically — and copy
foff = tf.offset, fsz = tf.type_.size. si.totsize keeps the slot-padded
stack-slot number (ti.slotsize, already 8-rounded at check.ww:2259).
fieldsize is no longer called here (its `*p OP=` scalar-width caller is
untouched). LOUD nil-guards on tstruct.type_ / tichase / a tfield walk
desync — all unreachable post-check, never silent. fi.tnode stays the
AST node (its node-keyed readers need it); repointing the ~60 fi.foff
readers to tfield is the out-of-scope (ii-b) follow-up.

This unifies ww's second source onto the value cstage already emits, so
cs==ww is preserved, not newly created (wwstage-cgen only; no cstage
edit). The shape is corpus-absent — ww uses both sources on its own
structs, so a divergent struct would have broken the bootstrap — hence
gate-blind; 989_nestfield_run is the proof (nested inner{x:u8,y:u8} in
outer{a:u8,p:inner[,z:i64]}, every field read back == written, dual-stage
cs==ww). It also makes 681 ragged_tail_12B genuinely correct: the
predecessor #71 already shrank the whole-struct copy to the source's
natural length, so packing mark at natural offset 12 no longer clobbers.

Makefile

@@ -256,6 +256,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_tupfieldsize_run \
 	  $(BIN)/test_tagtupfieldsize_run \
+	  $(BIN)/test_nestfield_run \
 	  $(BIN)/test_arrlit_tail_zero_run \
 	  $(BIN)/test_defdim_slice_run \
 	  $(BIN)/test_trystr_run \
@@ -761,6 +762,20 @@ $(BIN)/test_tagtupfieldsize_run: test/wcc/989_tagtupfieldsize_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_nestfield_run (#44/#55): a struct with a nested sub-8 composite field
+# (inner{x:u8,y:u8}, slotsize 8 != size 2) plus a successor must address
+# every field at the checker's NATURAL offset on BOTH the write
+# (construction) and read (field-access) paths. wwstage's registerstruct
+# rebuilt fi.foff slot-padded for the write while the read used tfield
+# natural — gate-blind (the shape is corpus-absent). Builds+runs on BOTH
+# driver twins (rule-10), pinning the absolute 0 (all fields read back).
+$(BIN)/test_nestfield_run: test/wcc/989_nestfield_run.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_arrlit_tail_zero_run (#13): an under-length array literal zero-fills the
 # unspecified tail, not the last value. Builds+runs on BOTH driver twins
 # (rule-10), pinning the absolute value (pre-fix ww tail = last value).

selfhost/cmd/w6c/main.combined.ww

@@ -20402,44 +20402,60 @@ fn fieldsize(c: *cgen, tnode: *node) i32 = {
 	return 8;
 };
 
+// #44/#55: fi.foff is a VIEW of the checker's already-built NATURAL
+// `tfield.offset` (check.ww N_TSTRUCT L2234), NOT a second slot-padded
+// layout recomputed via fieldsize. The two sources diverged iff a struct
+// had a nested sub-8 composite field (slotsize != size) plus a successor:
+// the WRITE path used this slot-padded foff, the READ path
+// (cgplaceaddr/dotbaseaddr) read tfield.offset natural — ww mis-addressed
+// its own fields. cstage has no structinfo and reads tfield directly
+// (self-consistently natural); this unifies ww's second source onto it,
+// preserving cs==ww. Lock-step walk: tstruct.list N_TFIELD AST nodes and
+// ti.fields tfields share one head-first declared order (both skip
+// non-TFIELD identically), so they advance in exact step. si.totsize keeps
+// the slot-padded total (stack-slot allocator's number) from ti.slotsize,
+// already 8-rounded at check.ww:2259-2261.
 fn registerstruct(c: *cgen, name: str, srcmod: str, tstruct: *node) void = {
 	let si: *structinfo = alloc(structinfo{
 		sname = name,
 		smod = srcmod,
 	})!;
+	if (tstruct.type_ == nil) {
+		let msg: str = "#44/#55: registerstruct: struct node has no stamped tinfo\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
+	let ti: *tinfo = tichase(tstruct.type_: *tinfo);
+	if (ti == nil) {
+		let msg: str = "#44/#55: registerstruct: tichase yielded nil tinfo\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	let head: *fieldinfo = nil;
 	let tail: *fieldinfo = nil;
-	let off: i32 = 0;
 	let f: *node = tstruct.list;
+	let tf: *tfield = ti.fields;
 	for (f != nil) {
 		if (f.kind == nkind.N_TFIELD) {
-			let sz: i32 = fieldsize(c, f.lhs);
+			if (tf == nil) {
-			// Align to 8 for any field >= 4 bytes (matches our other
+				let msg: str = "#44/#55: registerstruct: AST/tfield walk desync (more TFIELDs than tinfo.fields)\n";
-			// cgen choices). i8/u8/bool may sit on odd byte offsets;
+				os.write(2, msg.ptr, msg.len: u64);
-			// the C cgen does similar best-effort packing.
+				os.exit(1);
-			let aln: i32 = 1;
-			if (sz >= 8) { aln = 8; }
-			else { if (sz >= 4) { aln = 4; }
-			else { if (sz >= 2) { aln = 2; }; }; };
-			if ((off & (aln - 1)) != 0) {
-				off = (off + aln - 1) & ~(aln - 1);
 			};
 			let fi: *fieldinfo = alloc(fieldinfo{
 				fname = f.str,
-				foff  = off,
+				foff  = tf.offset: i32,
-				fsz   = sz,
+				fsz   = tf.type_.size: i32,
 				tnode = f.lhs,
 			})!;
 			if (head == nil) { head = fi; tail = fi; }
 			else { tail.finext = fi; tail = fi; };
-			off += sz;
+			tf = tf.tnext;
 		};
 		f = f.next;
 	};
-	// Round total to 8 for stack-slot use.
-	if ((off & 7) != 0) { off = (off + 7) & ~7; };
 	si.fields = head;
-	si.totsize = off;
+	si.totsize = ti.slotsize: i32;
 	si.sinext = c.structs;
 	c.structs = si;
 };

selfhost/cmd/wcc/cgenutil.ww

@@ -2608,44 +2608,60 @@ fn fieldsize(c: *cgen, tnode: *node) i32 = {
 	return 8;
 };
 
+// #44/#55: fi.foff is a VIEW of the checker's already-built NATURAL
+// `tfield.offset` (check.ww N_TSTRUCT L2234), NOT a second slot-padded
+// layout recomputed via fieldsize. The two sources diverged iff a struct
+// had a nested sub-8 composite field (slotsize != size) plus a successor:
+// the WRITE path used this slot-padded foff, the READ path
+// (cgplaceaddr/dotbaseaddr) read tfield.offset natural — ww mis-addressed
+// its own fields. cstage has no structinfo and reads tfield directly
+// (self-consistently natural); this unifies ww's second source onto it,
+// preserving cs==ww. Lock-step walk: tstruct.list N_TFIELD AST nodes and
+// ti.fields tfields share one head-first declared order (both skip
+// non-TFIELD identically), so they advance in exact step. si.totsize keeps
+// the slot-padded total (stack-slot allocator's number) from ti.slotsize,
+// already 8-rounded at check.ww:2259-2261.
 fn registerstruct(c: *cgen, name: str, srcmod: str, tstruct: *node) void = {
 	let si: *structinfo = alloc(structinfo{
 		sname = name,
 		smod = srcmod,
 	})!;
+	if (tstruct.type_ == nil) {
+		let msg: str = "#44/#55: registerstruct: struct node has no stamped tinfo\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
+	let ti: *tinfo = tichase(tstruct.type_: *tinfo);
+	if (ti == nil) {
+		let msg: str = "#44/#55: registerstruct: tichase yielded nil tinfo\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	let head: *fieldinfo = nil;
 	let tail: *fieldinfo = nil;
-	let off: i32 = 0;
 	let f: *node = tstruct.list;
+	let tf: *tfield = ti.fields;
 	for (f != nil) {
 		if (f.kind == nkind.N_TFIELD) {
-			let sz: i32 = fieldsize(c, f.lhs);
+			if (tf == nil) {
-			// Align to 8 for any field >= 4 bytes (matches our other
+				let msg: str = "#44/#55: registerstruct: AST/tfield walk desync (more TFIELDs than tinfo.fields)\n";
-			// cgen choices). i8/u8/bool may sit on odd byte offsets;
+				os.write(2, msg.ptr, msg.len: u64);
-			// the C cgen does similar best-effort packing.
+				os.exit(1);
-			let aln: i32 = 1;
-			if (sz >= 8) { aln = 8; }
-			else { if (sz >= 4) { aln = 4; }
-			else { if (sz >= 2) { aln = 2; }; }; };
-			if ((off & (aln - 1)) != 0) {
-				off = (off + aln - 1) & ~(aln - 1);
 			};
 			let fi: *fieldinfo = alloc(fieldinfo{
 				fname = f.str,
-				foff  = off,
+				foff  = tf.offset: i32,
-				fsz   = sz,
+				fsz   = tf.type_.size: i32,
 				tnode = f.lhs,
 			})!;
 			if (head == nil) { head = fi; tail = fi; }
 			else { tail.finext = fi; tail = fi; };
-			off += sz;
+			tf = tf.tnext;
 		};
 		f = f.next;
 	};
-	// Round total to 8 for stack-slot use.
-	if ((off & 7) != 0) { off = (off + 7) & ~7; };
 	si.fields = head;
-	si.totsize = off;
+	si.totsize = ti.slotsize: i32;
 	si.sinext = c.structs;
 	c.structs = si;
 };

selfhost/cmd/wwdump/main.combined.ww

@@ -20402,44 +20402,60 @@ fn fieldsize(c: *cgen, tnode: *node) i32 = {
 	return 8;
 };
 
+// #44/#55: fi.foff is a VIEW of the checker's already-built NATURAL
+// `tfield.offset` (check.ww N_TSTRUCT L2234), NOT a second slot-padded
+// layout recomputed via fieldsize. The two sources diverged iff a struct
+// had a nested sub-8 composite field (slotsize != size) plus a successor:
+// the WRITE path used this slot-padded foff, the READ path
+// (cgplaceaddr/dotbaseaddr) read tfield.offset natural — ww mis-addressed
+// its own fields. cstage has no structinfo and reads tfield directly
+// (self-consistently natural); this unifies ww's second source onto it,
+// preserving cs==ww. Lock-step walk: tstruct.list N_TFIELD AST nodes and
+// ti.fields tfields share one head-first declared order (both skip
+// non-TFIELD identically), so they advance in exact step. si.totsize keeps
+// the slot-padded total (stack-slot allocator's number) from ti.slotsize,
+// already 8-rounded at check.ww:2259-2261.
 fn registerstruct(c: *cgen, name: str, srcmod: str, tstruct: *node) void = {
 	let si: *structinfo = alloc(structinfo{
 		sname = name,
 		smod = srcmod,
 	})!;
+	if (tstruct.type_ == nil) {
+		let msg: str = "#44/#55: registerstruct: struct node has no stamped tinfo\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
+	let ti: *tinfo = tichase(tstruct.type_: *tinfo);
+	if (ti == nil) {
+		let msg: str = "#44/#55: registerstruct: tichase yielded nil tinfo\n";
+		os.write(2, msg.ptr, msg.len: u64);
+		os.exit(1);
+	};
 	let head: *fieldinfo = nil;
 	let tail: *fieldinfo = nil;
-	let off: i32 = 0;
 	let f: *node = tstruct.list;
+	let tf: *tfield = ti.fields;
 	for (f != nil) {
 		if (f.kind == nkind.N_TFIELD) {
-			let sz: i32 = fieldsize(c, f.lhs);
+			if (tf == nil) {
-			// Align to 8 for any field >= 4 bytes (matches our other
+				let msg: str = "#44/#55: registerstruct: AST/tfield walk desync (more TFIELDs than tinfo.fields)\n";
-			// cgen choices). i8/u8/bool may sit on odd byte offsets;
+				os.write(2, msg.ptr, msg.len: u64);
-			// the C cgen does similar best-effort packing.
+				os.exit(1);
-			let aln: i32 = 1;
-			if (sz >= 8) { aln = 8; }
-			else { if (sz >= 4) { aln = 4; }
-			else { if (sz >= 2) { aln = 2; }; }; };
-			if ((off & (aln - 1)) != 0) {
-				off = (off + aln - 1) & ~(aln - 1);
 			};
 			let fi: *fieldinfo = alloc(fieldinfo{
 				fname = f.str,
-				foff  = off,
+				foff  = tf.offset: i32,
-				fsz   = sz,
+				fsz   = tf.type_.size: i32,
 				tnode = f.lhs,
 			})!;
 			if (head == nil) { head = fi; tail = fi; }
 			else { tail.finext = fi; tail = fi; };
-			off += sz;
+			tf = tf.tnext;
 		};
 		f = f.next;
 	};
-	// Round total to 8 for stack-slot use.
-	if ((off & 7) != 0) { off = (off + 7) & ~7; };
 	si.fields = head;
-	si.totsize = off;
+	si.totsize = ti.slotsize: i32;
 	si.sinext = c.structs;
 	c.structs = si;
 };

test/wcc/989_nestfield_run.c

@@ -0,0 +1,208 @@
+/*
+ * 989_nestfield_run — #44/#55 struct-layout SSoT: a struct with a nested
+ * sub-8 composite field plus a successor must address EVERY field at the
+ * checker's natural offset, identically on the write (construction) and
+ * read (field-access) paths.
+ *
+ * THE BUG (cat-A silent miscompile, gate-blind): wwstage had TWO struct-
+ * layout sources. `registerstruct` (selfhost/cmd/wcc/cgenutil.ww) rebuilt
+ * each field's `fi.foff` via `fieldsize` — SLOT-padded, so a nested
+ * `inner{x:u8,y:u8}` (size 2, slotsize 8) pushed every successor to an 8B
+ * boundary. The READ path (cgplaceaddr/dotbaseaddr) reads the checker's
+ * tfield.offset — NATURAL (inner align 1 → p at offset 1, z packed right
+ * after). So ww WROTE p/z at the slot-padded offset and READ them at the
+ * natural offset → garbage. The shape (nested sub-8 composite + a field
+ * after it) is corpus-ABSENT — ww uses both sources on its OWN structs, so
+ * if such a struct existed the bootstrap would mis-address itself and
+ * 400-green would be impossible; the gate cannot see it, this repro is the
+ * proof. cstage has no structinfo — it reads tfield directly, self-
+ * consistently natural (cmd/w6c/cgen.c). THE FIX: make ww's `fi.foff` a
+ * VIEW of tfield.offset (lock-step walk tstruct.list + ti.fields), so the
+ * second source collapses onto cstage's natural one (cs==ww preserved).
+ *
+ * Each program self-checks every field (write 1/2/3/.., read back, return
+ * the 1-based index of the first mismatch, 0 on all-correct). Pre-fix ww
+ * constructs at slot offsets and reads at natural → a non-zero return on
+ * the first composite-or-successor field, so cs(=0) != ww(!=0) AND ww !=
+ * want. Both stages build+run (rule-10); the want is the absolute 0.
+ *
+ * This is a RUNTIME cs==ww check (both stages exit 0): it proves field
+ * offsets are natural and instruction-correct RELATIVE TO the struct base.
+ * It deliberately does NOT gate the absolute .s frame, which is still
+ * cs!=ww on this shape via a SEPARATE pre-existing producer — wwstage
+ * reserves the struct LOCAL's stack slot at slot-padded slotsize, cstage
+ * at natural (task #75). The frame-absolute teeth belong to #75's fix.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_exit;	/* >= 0: pin the absolute value; -1: cs==ww only */
+};
+
+static const struct row rows[] = {
+	/* (1) nested2 — outer2{a:u8, p:inner}: the core divergence. Natural
+	 * p at offset 1; pre-fix slot-padded p at offset 8. Construction
+	 * (write) vs field-access (read) disagree → o.p.x / o.p.y read wrong.
+	 * Returns the 1-based index of the first mismatched field, 0 on ok. */
+	{ "nested2",
+	  "package main;\n"
+	  "type inner = struct { x: u8, y: u8 };\n"
+	  "type outer2 = struct { a: u8, p: inner };\n"
+	  "export fn main() int = {\n"
+	  "	let o: outer2 = outer2 { a = 5, p = inner { x = 6, y = 7 } };\n"
+	  "	if (o.a: int != 5) { return 1; };\n"
+	  "	if (o.p.x: int != 6) { return 2; };\n"
+	  "	if (o.p.y: int != 7) { return 3; };\n"
+	  "	return 0;\n"
+	  "};\n",
+	  0 },
+
+	/* (2) nested3 — outer{a:u8, p:inner, z:i64}: z proves post-composite
+	 * accumulation stays natural. Pre-fix z sat at the slot-padded offset
+	 * past the 8B-padded inner; the natural read undershoots. The wide z
+	 * value (0x44444444) is verified inside the program (the exit channel
+	 * is 8-bit), so a truncated/mis-addressed z fails the in-program cmp. */
+	{ "nested3",
+	  "package main;\n"
+	  "type inner = struct { x: u8, y: u8 };\n"
+	  "type outer = struct { a: u8, p: inner, z: i64 };\n"
+	  "export fn main() int = {\n"
+	  "	let o: outer = outer { a = 1, p = inner { x = 2, y = 3 }, z = 0x44444444i64 };\n"
+	  "	if (o.a: int != 1) { return 1; };\n"
+	  "	if (o.p.x: int != 2) { return 2; };\n"
+	  "	if (o.p.y: int != 3) { return 3; };\n"
+	  "	if (o.z != 0x44444444i64) { return 4; };\n"
+	  "	return 0;\n"
+	  "};\n",
+	  0 },
+
+	/* (3) control — flat struct {a:u8, b:i64}, no sub-8 composite field.
+	 * Natural and slot-padded layouts coincide (b lands at 8 either way);
+	 * proves the fix leaves the common case unmoved. */
+	{ "flat_ctl",
+	  "package main;\n"
+	  "type flat = struct { a: u8, b: i64 };\n"
+	  "export fn main() int = {\n"
+	  "	let o: flat = flat { a = 9, b = 0x33333333i64 };\n"
+	  "	if (o.a: int != 9) { return 1; };\n"
+	  "	if (o.b != 0x33333333i64) { return 2; };\n"
+	  "	return 0;\n"
+	  "};\n",
+	  0 },
+};
+
+/* run_build — build+run `src` via `driver`; returns the binary's exit
+ * code, or -1 on a build failure. */
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/nestfld_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/nestfld_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+	int have_ww = (access(wdrv, X_OK) == 0);
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		total++;
+		int gc = run_build(cdrv, &rows[i], i);
+		/* cstage must build+run */
+		if (gc < 0) {
+			fprintf(stderr, "nestfield_run[cstage][%s]: build/run "
+			    "failed (got %d)\n", rows[i].label, gc);
+			fail++;
+			continue;
+		}
+		if (rows[i].want_exit >= 0 && gc != rows[i].want_exit) {
+			fprintf(stderr, "nestfield_run[cstage][%s]: exit=%d "
+			    "want=%d (field mismatch)\n",
+			    rows[i].label, gc, rows[i].want_exit);
+			fail++;
+		}
+		if (!have_ww) {
+			fprintf(stderr, "nestfield_run: skip wwstage (no %s)\n",
+			    wdrv);
+			continue;
+		}
+		int gw = run_build(wdrv, &rows[i], i);
+		/* rule-10: the cat-A invariant is cs == ww */
+		if (gw != gc) {
+			fprintf(stderr, "nestfield_run[%s]: cs=%d != ww=%d "
+			    "(struct field-offset divergence — #44/#55)\n",
+			    rows[i].label, gc, gw);
+			fail++;
+		}
+		if (rows[i].want_exit >= 0 && gw != rows[i].want_exit) {
+			fprintf(stderr, "nestfield_run[wwstage][%s]: exit=%d "
+			    "want=%d (field mismatch)\n",
+			    rows[i].label, gw, rows[i].want_exit);
+			fail++;
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "nestfield_run: %d/%d checks failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("nestfield_run: %d/%d ok\n", total, total);
+	return 0;
+}