wcc/check: GAP-A .cap-on-array loud-reject; .ptr-on-array ratified valid (#12)

.cap on a fixed-size array is invalid (Hare has no capacity-read; arrays
can't grow) -> both stages now loud-reject at the checker. wwstage was
silently returning frame garbage for a local array's .cap; cstage typed
it then vaguely rejected at use. Unified to one early checker reject with
an identical diagnostic both stages.

.ptr on a fixed-size array is ratified VALID: array.ptr is &A[0], a
sanctioned ww spelling divergence from Hare; see task #13. The toolchain
already relies on it in 14 backing-pointer sites. WHY-doc added at both
checker .ptr-on-array sites. The def-global .ptr cgen base-selection bug
(#11) is a separate following commit.

Valid-program asm unchanged (byte-id 990-997 8/8); w6c/w6c_ww binaries
move (checker code changed). test/wcc/817 table-driven, model 684.

Makefile

@@ -243,6 +243,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_arr_strslice_elem \
 	  $(BIN)/test_arr_tagged_elem \
 	  $(BIN)/test_arr_infer_len \
+	  $(BIN)/test_arr_cap_reject \
 	  $(BIN)/test_def_arr_infer_len \
 	  $(BIN)/test_def_arr_len \
 	  $(BIN)/test_slice_str_global_zero \
@@ -635,6 +636,12 @@ $(BIN)/test_arr_infer_len: test/wcc/684_arr_infer_len.c $(BIN)/ww \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_arr_cap_reject: test/wcc/817_arr_cap_reject.c $(BIN)/ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_def_arr_infer_len: test/wcc/814_def_arr_infer_len.c $(BIN)/ww \
 		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \

cmd/wcc/check.c

@@ -1361,7 +1361,20 @@ cexpr(Checker *c, Node *n)
 		if (u && (u->kind == TY_SLICE || u->kind == TY_ARRAY ||
 		    u->kind == TY_STR)) {
 			if (strcmp(n->str, "len") == 0) return n->type = ty_i32;
+			/* A fixed array has no capacity word — .cap is invalid
+			 * (drew ruling; arrays expose .len + .ptr only). Pre-fix
+			 * cstage typed it i32 → cgen vague-rejected; wwstage
+			 * link-errored / read garbage. Reject loud + early. */
+			if (u->kind == TY_ARRAY && strcmp(n->str, "cap") == 0)
+				return n->type = err(c, n->pos,
+				    "no field 'cap' on a fixed-size array "
+				    "(arrays have no capacity; use .len)");
 			if (strcmp(n->str, "cap") == 0) return n->type = ty_i32;
+			/* rule-9 divergence-doc (drew, task #13): `array.ptr` is a
+			 * sanctioned ww spelling for `&A[0]` — a faithful Hare
+			 * desugaring (arrays expose .len + .ptr; not .cap). 14 live
+			 * consumers (lib/ww + cmd/wcc/cgen.ww). See
+			 * .ai/drew-gapa-ptr-ruling.md. */
 			if (strcmp(n->str, "ptr") == 0) {
 				Type *elem = (u->kind == TY_STR) ? ty_u8 : u->sub;
 				return n->type = type_ptr(c->a, elem);

selfhost/cmd/w6c/main.combined.ww

@@ -13409,11 +13409,24 @@ fn exprtype(c: *checker, e: *node, hint: *node) *node = {
 						e.type_ = tinfofornode(c, tn): *void;
 						return tn;
 					};
+					// A fixed array has no capacity word — .cap is
+					// invalid (drew ruling). cstage check.c errs
+					// symmetrically. c.errs>0 gates cgen off → build
+					// fails (the #11 inferarraylen idiom).
+					if (bu.kind == nkind.N_TARRAY && streq(e.str, "cap")) {
+						cerr("error: no field 'cap' on a fixed-size array (arrays have no capacity; use .len)\n");
+						c.errs += 1;
+						return nil;
+					};
 					if (streq(e.str, "cap")) {
 						let tn: *node = mktname(c, "i32");
 						e.type_ = tinfofornode(c, tn): *void;
 						return tn;
 					};
+					// rule-9 divergence-doc (drew, task #13): array.ptr ≡
+					// &A[0], a sanctioned ww spelling / faithful Hare
+					// desugaring (14 live consumers). KEEP — .ptr valid.
+					// See .ai/drew-gapa-ptr-ruling.md.
 					if (streq(e.str, "ptr")) {
 						let elem: *node = bu.lhs;
 						if (isstr) { elem = mktname(c, "u8"); };

selfhost/cmd/wcc/check.ww

@@ -3128,11 +3128,24 @@ fn exprtype(c: *checker, e: *node, hint: *node) *node = {
 						e.type_ = tinfofornode(c, tn): *void;
 						return tn;
 					};
+					// A fixed array has no capacity word — .cap is
+					// invalid (drew ruling). cstage check.c errs
+					// symmetrically. c.errs>0 gates cgen off → build
+					// fails (the #11 inferarraylen idiom).
+					if (bu.kind == nkind.N_TARRAY && streq(e.str, "cap")) {
+						cerr("error: no field 'cap' on a fixed-size array (arrays have no capacity; use .len)\n");
+						c.errs += 1;
+						return nil;
+					};
 					if (streq(e.str, "cap")) {
 						let tn: *node = mktname(c, "i32");
 						e.type_ = tinfofornode(c, tn): *void;
 						return tn;
 					};
+					// rule-9 divergence-doc (drew, task #13): array.ptr ≡
+					// &A[0], a sanctioned ww spelling / faithful Hare
+					// desugaring (14 live consumers). KEEP — .ptr valid.
+					// See .ai/drew-gapa-ptr-ruling.md.
 					if (streq(e.str, "ptr")) {
 						let elem: *node = bu.lhs;
 						if (isstr) { elem = mktname(c, "u8"); };

selfhost/cmd/wwdump/main.combined.ww

@@ -13409,11 +13409,24 @@ fn exprtype(c: *checker, e: *node, hint: *node) *node = {
 						e.type_ = tinfofornode(c, tn): *void;
 						return tn;
 					};
+					// A fixed array has no capacity word — .cap is
+					// invalid (drew ruling). cstage check.c errs
+					// symmetrically. c.errs>0 gates cgen off → build
+					// fails (the #11 inferarraylen idiom).
+					if (bu.kind == nkind.N_TARRAY && streq(e.str, "cap")) {
+						cerr("error: no field 'cap' on a fixed-size array (arrays have no capacity; use .len)\n");
+						c.errs += 1;
+						return nil;
+					};
 					if (streq(e.str, "cap")) {
 						let tn: *node = mktname(c, "i32");
 						e.type_ = tinfofornode(c, tn): *void;
 						return tn;
 					};
+					// rule-9 divergence-doc (drew, task #13): array.ptr ≡
+					// &A[0], a sanctioned ww spelling / faithful Hare
+					// desugaring (14 live consumers). KEEP — .ptr valid.
+					// See .ai/drew-gapa-ptr-ruling.md.
 					if (streq(e.str, "ptr")) {
 						let elem: *node = bu.lhs;
 						if (isstr) { elem = mktname(c, "u8"); };

test/wcc/817_arr_cap_reject.c

@@ -0,0 +1,314 @@
+/*
+ * 817_arr_cap_reject — a fixed-size array has NO capacity word; `.cap` on an
+ * array is INVALID ww and BOTH stages must LOUDLY REJECT at check time
+ * (GAP-A.cap, task #12; drew ruling .ai/drew-gapa-ptr-ruling.md). `.len`
+ * (GAP-A.len, 7b0e09e) AND `.ptr` (≡ &A[0], the sanctioned ww backing-
+ * pointer spelling, task #13 divergence-record) stay VALID on an array —
+ * only `.cap` is rejected.
+ *
+ * The bug (each stage misbehaved DIFFERENTLY on the same invalid construct,
+ * hence both-stage):
+ *   - cstage check.c typed `.cap` on a TY_ARRAY as i32 → cgen then hard-
+ *     rejected with a generic "unsupported field-read shape" (loud but at
+ *     the WRONG layer, vague message).
+ *   - wwstage check.ww stamped `.cap` → cgen link-error (def-global
+ *     `A.cap` → w6l undefined 'cap') or SILENT garbage (local `a.cap`→30).
+ *
+ * The fix (BOTH checkers, one `.cap`-on-array gate each, byte-identical
+ * diagnostic body): reject early with "no field 'cap' on a fixed-size array
+ * (arrays have no capacity; use .len)". Checker-only: the reject makes the
+ * buggy cgen `.cap` array paths unreachable (close by construction).
+ *
+ * Mutation-sanity: the genuinely-silent pre-fix case is wwstage's LOCAL
+ * .cap, which BUILT and returned garbage (30) — neg_local_cap is the row
+ * with real mutation power (built-ok pre-fix → caught here). The other
+ * neg rows were already loud pre-fix but at the WRONG layer (cstage cgen
+ * vague-reject on use; wwstage global link-error); this commit converges
+ * all of them onto one early checker diagnostic.
+ *
+ *   neg row          | shape                                  | gate
+ *   -----------------+----------------------------------------+----------
+ *   neg_local_cap    | local [3]int, a.cap                     | build FAIL
+ *   neg_def_cap      | def A:[3]int, A.cap                     | build FAIL
+ *   neg_let_glob_cap | let G:[3]int (module), G.cap            | build FAIL
+ *   neg_infer_cap    | def A:[_]int, A.cap (#11 infer path)    | build FAIL
+ *
+ *   pos row          | shape                                  | want
+ *   -----------------+----------------------------------------+------
+ *   pos_local_len    | local [3]int, a.len                     | 3
+ *   pos_def_len      | def A:[_]int, A.len                      | 3
+ *   pos_local_ptr    | local [3]int, *a.ptr (sanctioned idiom) | 10
+ *
+ * The pos_local_ptr row pins that `.ptr`-on-array stays VALID (cgen
+ * unchanged in this commit; the def-global `.ptr` cgen fix + its build+run
+ * pin are task #11 / test 818, NOT here — so this control uses a LOCAL
+ * array `.ptr`, which is correct in both stages today).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	{ "pos_local_len",
+	  "package main;\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet a: [3]int = [10, 20, 30];\n"
+	  "\treturn a.len: i32;\n"
+	  "};\n",
+	  3 },
+
+	{ "pos_def_len",
+	  "package main;\n"
+	  "def A: [_]int = [10, 20, 30];\n"
+	  "export fn main() i32 = {\n"
+	  "\treturn A.len: i32;\n"
+	  "};\n",
+	  3 },
+
+	/* `.ptr`-on-array is the sanctioned ww spelling for &a[0] (task #13).
+	 * LOCAL array `.ptr` is correct in BOTH stages today (cgen unchanged
+	 * here); the def-global `.ptr` cgen fix is task #11 / test 818. */
+	{ "pos_local_ptr",
+	  "package main;\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet a: [3]int = [10, 20, 30];\n"
+	  "\tlet p: *int = a.ptr;\n"
+	  "\treturn (*p): i32;\n"
+	  "};\n",
+	  10 },
+};
+
+/* `.cap` on a fixed array — both stages must FAIL the build (loud checker
+ * diagnostic, not silent garbage / link-error). */
+static const char *neg[] = {
+	/* neg_local_cap */
+	"package main;\n"
+	"export fn main() i32 = {\n"
+	"\tlet a: [3]int = [1, 2, 3];\n"
+	"\treturn a.cap: i32;\n"
+	"};\n",
+	/* neg_def_cap */
+	"package main;\n"
+	"def A: [3]int = [1, 2, 3];\n"
+	"export fn main() i32 = {\n"
+	"\treturn A.cap: i32;\n"
+	"};\n",
+	/* neg_let_glob_cap */
+	"package main;\n"
+	"let G: [3]int = [1, 2, 3];\n"
+	"export fn main() i32 = {\n"
+	"\treturn G.cap: i32;\n"
+	"};\n",
+	/* neg_infer_cap — the #11 [_] infer path */
+	"package main;\n"
+	"def A: [_]int = [1, 2, 3];\n"
+	"export fn main() i32 = {\n"
+	"\treturn A.cap: i32;\n"
+	"};\n",
+};
+
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/acr_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/acr_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src); rmdir(tmpdir);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+/* build_should_fail — `.cap` on an array must error on `driver`; returns 0
+ * when the build correctly FAILS, non-zero when it wrongly succeeded. */
+static int
+build_should_fail(const char *driver, const char *src, int i)
+{
+	char s[64], tmpdir[64], cmd[1024];
+	snprintf(s, sizeof s, "/tmp/acrn_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/acrn_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(s, "wb");
+	if (!f) return -1;
+	fputs(src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, s);
+	int rc = runwait(cmd);
+	unlink(s);
+	/* clean any emitted binary */
+	const char *base = strrchr(s, '/');
+	base = base ? base + 1 : s;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	unlink(outbin);
+	rmdir(tmpdir);
+	return rc == 0 ? -1 : 0;	/* build must NOT succeed */
+}
+
+/* asm_byte_identical — w6c vs w6c_ww .s for the same source must match. */
+static int
+asm_byte_identical(const char *bin, const struct row *r, int i)
+{
+	char src[64], cs[64], ws[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/acr_asm_%d_%d.ww", getpid(), i);
+	snprintf(cs,  sizeof cs,  "/tmp/acr_asm_%d_%d_c.s", getpid(), i);
+	snprintf(ws,  sizeof ws,  "/tmp/acr_asm_%d_%d_w.s", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	snprintf(cmd, sizeof cmd, "%s/w6c -o %s %s 2>/dev/null", bin, cs, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: w6c errored\n", r->label);
+		unlink(src);
+		return -1;
+	}
+	snprintf(cmd, sizeof cmd, "%s/w6c_ww -o %s %s 2>/dev/null",
+	    bin, ws, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: w6c_ww errored\n", r->label);
+		unlink(src); unlink(cs);
+		return -1;
+	}
+
+	FILE *fc = fopen(cs, "rb");
+	FILE *fw = fopen(ws, "rb");
+	int rc = 0;
+	if (!fc || !fw) {
+		rc = -1;
+	} else {
+		for (;;) {
+			int a = fgetc(fc);
+			int b = fgetc(fw);
+			if (a != b) { rc = -1; break; }
+			if (a == EOF) break;
+		}
+	}
+	if (fc) fclose(fc);
+	if (fw) fclose(fw);
+	if (rc != 0)
+		fprintf(stderr, "row[%s]: cstage vs wwstage asm differs\n",
+		    r->label);
+	unlink(src); unlink(cs); unlink(ws);
+	return rc;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	char wdrv[1024];
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int nn = (int)(sizeof neg / sizeof neg[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr, "arr_cap_reject: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "arr_cap_reject[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+		for (int i = 0; i < nn; i++) {
+			total++;
+			if (build_should_fail(drivers[d].path, neg[i],
+			    100 + i) != 0) {
+				fprintf(stderr,
+				    "arr_cap_reject[%s][neg%d]: built ok, "
+				    "expected a loud error\n",
+				    drivers[d].name, i);
+				fail++;
+			}
+		}
+	}
+
+	if (access(wdrv, X_OK) == 0) {
+		for (int i = 0; i < n; i++) {
+			total++;
+			if (asm_byte_identical(bin, &rows[i], i) != 0)
+				fail++;
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr,
+		    "arr_cap_reject: %d/%d fixtures failed\n", fail, total);
+		return 1;
+	}
+	printf("arr_cap_reject: %d/%d ok\n", total, total);
+	return 0;
+}