wcc/ww: compound OP= on a tagged index/ident is a loud reject (#20/#21)

Compound `OP=` through an index (gs[i]/a[i]) or a bare ident (g) on a
tagged union silently misbehaved: cstage dropped the index compound and
plain-stored, and BOTH stages compiled an ident compound into an add on
the tag word -- byte-identical, so the gate stayed green while the tag
was corrupted. A compound op on a whole union is nonsense.

Gate the index plain-store arm on TK_ASSIGN so a compound falls to the
existing #133 reject (wwstage's byte-id twin); add a dedicated #21 ident
reject in both stages. This closes the compound half of the tagged-payload
write class (deref #18, dot #34 already reject).

#19 (global tagged-array static-init DATA) is a separate emitter, still open.

Makefile

@@ -254,6 +254,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_unknowndecl_reject \
 	  $(BIN)/test_nullableglobal_reject \
 	  $(BIN)/test_taggedcompoundderef_reject \
+	  $(BIN)/test_taggedcompoundplace_reject \
 	  $(BIN)/test_idxarg_run \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_tupfieldsize_run \
@@ -754,6 +755,24 @@ $(BIN)/test_taggedcompoundderef_reject: test/wcc/989_taggedcompoundderef_reject.
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_taggedcompoundplace_reject (#20/#21, last two members of the
+# compound-OP-on-tagged-place reject class): `gs[i] OP= v` / `a[i] OP= v`
+# (INDEX, #20) and `g OP= v` (IDENT, #21) on a tagged-union place are
+# nonsense and must loud-reject. cstage silently dropped the indexed compound
+# (cs!=ww); BOTH stages silently corrupted the tag word for the ident
+# compound (byte-id-green). The fix gates the cstage indexed plain-store arm
+# on TK_ASSIGN (compound falls to the #133 reject) and adds a tagged-ident
+# compound guard to both stages. Reject rows assert build-fail + the
+# per-place-kind diagnostic (#133 for index, #21 for ident); control rows
+# (scalar ident/index compound + plain tagged ident/local-index/global-index
+# store) build + run. Needs both tool sets + libwwrt for the control links.
+$(BIN)/test_taggedcompoundplace_reject: test/wcc/989_taggedcompoundplace_reject.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_idxarg_run (F7-c2, #45/#46): an indexed slice/str element passed as
 # a call arg must push its full multi-word header. Builds+runs each fixture
 # on BOTH the cstage `ww` and wwstage `ww_ww` drivers (rule-10), so it needs

cmd/w6c/cgen.c

@@ -6483,8 +6483,16 @@ cgexpr(Cg *c, Node *n, Local *locals)
 			 * the full cg_widen_tagged_store machinery — scalar /
 			 * str / struct / subset payloads, tag remap, nullable
 			 * fold — without duplicating it. The scratch lives in
-			 * the function frame; no cleanup needed. */
+			 * the function frame; no cleanup needed.
-			if ((is_arr || is_sl || is_ptr) && elem_tagged) {
+			 * #20: only a PLAIN `=` widens. A COMPOUND `gs[i] OP= v`
+			 * on a tagged element is nonsense — without the
+			 * TK_ASSIGN gate it dropped the OP and plain-stored the
+			 * RHS (silent miscompile, cs!=ww). The gate lets a
+			 * compound fall to the #133 indexed-compound arm below,
+			 * whose elem_tagged guard rejects loud (the byte-id
+			 * twin of wwstage, which already rejected via #133). */
+			if ((is_arr || is_sl || is_ptr) && elem_tagged
+			    && n->op == TK_ASSIGN) {
 				int ssz = esz;
 				int scr = cg_tagscr_slot(c, &locals, ssz);
 				ins2(c, A_XORQ, areg(D_AX), areg(D_AX));
@@ -6972,6 +6980,20 @@ cgexpr(Cg *c, Node *n, Local *locals)
 				break;
 			}
 		}
+		/* #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v`
+		 * with g:(int|bool)) is nonsense — the ident load-combine-
+		 * store tail below (the N_IDENT compound arm) reads and writes
+		 * one word of the {payload,tag} box, corrupting the tag. Reject
+		 * loud here, the ident twin of the #18 deref / #133 index
+		 * rejects; the byte-id twin of the wwstage guard. Plain `=`
+		 * (the tagged-ident reassign arm just below) is untouched. */
+		if (n->lhs && n->lhs->kind == N_IDENT && n->op != TK_ASSIGN
+		    && n->lhs->type) {
+			Type *itu = type_chase_named(n->lhs->type);
+			if (itu && itu->kind == TY_TAGGED)
+				fatal("ident compound on tagged not wired "
+				    "(#21/rule-7)");
+		}
 		/* Plain `r = expr;` where r is a tagged-union local.
 		 * Delegates to cg_widen_tagged_store: covers nullable fold,
 		 * tagged→tagged (with tag remap), struct payload (ident or

selfhost/cmd/w6c/main.combined.ww

@@ -31677,6 +31677,25 @@ fn cgassign(c: *cgen, n: *node) void = {
 			};
 		};
 	};
+	// #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v`
+	// with g:(int|bool)) is nonsense — the ident load-combine-store
+	// tail below reads and writes one word of the {payload,tag} box,
+	// corrupting the tag. Reject loud here, the ident twin of the #18
+	// deref / #133 index rejects; the byte-id twin of the cstage
+	// guard. Plain `=` (the tagged-ident reassign arm just below) is
+	// untouched.
+	if (lhs != nil) {
+		if (lhs.kind == nkind.N_IDENT && n.op != tkind.TK_ASSIGN) {
+			let itu: *tinfo = tichase(lhs.type_: *tinfo);
+			if (itu != nil) {
+				if (itu.kind == tykind.TY_TAGGED) {
+					let m21: str = "ident compound on tagged not wired (#21/rule-7)\n";
+					os.write(2, m21.ptr, m21.len: u64);
+					os.exit(1);
+				};
+			};
+		};
+	};
 	// Tagged-union local reassignment: `r = expr;` where r has a
 	// tagged-union type. Delegate to cgwidentaggedstore (same path
 	// as cglet's tagged-init). Covers nullable fold, tagged source,

selfhost/cmd/wcc/cgenexpr.ww

@@ -8331,6 +8331,25 @@ fn cgassign(c: *cgen, n: *node) void = {
 			};
 		};
 	};
+	// #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v`
+	// with g:(int|bool)) is nonsense — the ident load-combine-store
+	// tail below reads and writes one word of the {payload,tag} box,
+	// corrupting the tag. Reject loud here, the ident twin of the #18
+	// deref / #133 index rejects; the byte-id twin of the cstage
+	// guard. Plain `=` (the tagged-ident reassign arm just below) is
+	// untouched.
+	if (lhs != nil) {
+		if (lhs.kind == nkind.N_IDENT && n.op != tkind.TK_ASSIGN) {
+			let itu: *tinfo = tichase(lhs.type_: *tinfo);
+			if (itu != nil) {
+				if (itu.kind == tykind.TY_TAGGED) {
+					let m21: str = "ident compound on tagged not wired (#21/rule-7)\n";
+					os.write(2, m21.ptr, m21.len: u64);
+					os.exit(1);
+				};
+			};
+		};
+	};
 	// Tagged-union local reassignment: `r = expr;` where r has a
 	// tagged-union type. Delegate to cgwidentaggedstore (same path
 	// as cglet's tagged-init). Covers nullable fold, tagged source,

selfhost/cmd/wwdump/main.combined.ww

@@ -31677,6 +31677,25 @@ fn cgassign(c: *cgen, n: *node) void = {
 			};
 		};
 	};
+	// #21: a COMPOUND op on a whole tagged-union IDENT (`g OP= v`
+	// with g:(int|bool)) is nonsense — the ident load-combine-store
+	// tail below reads and writes one word of the {payload,tag} box,
+	// corrupting the tag. Reject loud here, the ident twin of the #18
+	// deref / #133 index rejects; the byte-id twin of the cstage
+	// guard. Plain `=` (the tagged-ident reassign arm just below) is
+	// untouched.
+	if (lhs != nil) {
+		if (lhs.kind == nkind.N_IDENT && n.op != tkind.TK_ASSIGN) {
+			let itu: *tinfo = tichase(lhs.type_: *tinfo);
+			if (itu != nil) {
+				if (itu.kind == tykind.TY_TAGGED) {
+					let m21: str = "ident compound on tagged not wired (#21/rule-7)\n";
+					os.write(2, m21.ptr, m21.len: u64);
+					os.exit(1);
+				};
+			};
+		};
+	};
 	// Tagged-union local reassignment: `r = expr;` where r has a
 	// tagged-union type. Delegate to cgwidentaggedstore (same path
 	// as cglet's tagged-init). Covers nullable fold, tagged source,

test/wcc/989_taggedcompoundplace_reject.c

@@ -0,0 +1,327 @@
+/*
+ * 989_taggedcompoundplace_reject — #20/#21, the last two members of the
+ * "compound-OP on a whole tagged place" reject class (siblings: #18 deref,
+ * #34 dot). A compound-assign `place OP= v` where `place` has a tagged-union
+ * type is semantically nonsense — you cannot `+=` a whole tagged value — so
+ * it MUST be a loud compile-time reject on BOTH stages.
+ *
+ * Two place-kinds remained after #18 closed the deref member:
+ *
+ *   INDEX (#20): `gs[i] OP= v` (global tagged array) / `a[i] OP= v` (local
+ *   tagged array). cstage SILENTLY MISCOMPILED: its indexed-tagged element
+ *   arm (cmd/w6c/cgen.c) had no `n->op == TK_ASSIGN` gate, so a compound
+ *   dropped the OP and plain-stored `(tagged)v` (cs!=ww). wwstage already
+ *   rejected via its #133 indexed-compound arm. The fix gates the cstage
+ *   plain-store arm on TK_ASSIGN so a compound falls to the same #133
+ *   indexed-compound reject — the byte-id twin of wwstage. cstage align-UP.
+ *
+ *   IDENT (#21): `g OP= v` where g is a tagged-union local/global. BOTH
+ *   stages SILENTLY MISCOMPILED, byte-identically — the ident
+ *   load-combine-store tail read+wrote one word of the {payload,tag} box
+ *   and ADDED to the TAG word (gate-blind, #17/#263-class). The fix adds a
+ *   tagged-ident compound guard to BOTH stages (cmd/w6c/cgen.c and
+ *   selfhost/cmd/wcc/cgenexpr.ww) that rejects loud.
+ *
+ * The reject diagnostics follow the established per-place-kind family
+ * (#34 "single-dot field ... (#34/rule-7)", #133 "indexed-lvalue ...
+ * (#133/rule-7)") rather than one uniform string: INDEX rows reach the
+ * #133 indexed-compound reject; IDENT rows reach the new #21 ident-compound
+ * reject. Each row carries its own diagnostic substring, asserted on every
+ * driver alongside rc!=0. cstage's fatal() prefixes "ww: " that err.ww does
+ * not — the same per-stage prefix asymmetry every both-stage reject carries;
+ * the matrix matches on the shared CORE substring only.
+ *
+ * Reject-matrix idiom (sibling 989_taggedcompoundderef_reject.c): a REJECT
+ * row must FAIL to build with its diagnostic on every driver; an ACCEPT
+ * control must build + run to its expected exit. Rows run on cstage `ww`
+ * and, when present, wwstage `ww_ww`; both must agree.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static const char *DIAG_INDEX = "indexed-lvalue compound on tagged element not wired (#133/rule-7)";
+static const char *DIAG_IDENT = "ident compound on tagged not wired (#21/rule-7)";
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int expect_build;	/* 1 = build+run to want_exit; 0 = must REJECT */
+	int want_exit;
+	const char *diag;	/* reject rows only: required core substring */
+};
+
+/* `g` is a (int|bool) local; `g OP= 1` compounds the WHOLE tagged value. */
+#define IDENTCOMPOUND(OP) \
+	"package main;\n" \
+	"export fn main() int = {\n" \
+	"\tlet g: (int | bool) = 7;\n" \
+	"\tg " OP " 1;\n" \
+	"\treturn 0;\n" \
+	"};\n"
+
+/* a:[3](int|bool) local; `a[0] OP= 1` compounds the WHOLE tagged element. */
+#define LIDXCOMPOUND(OP) \
+	"package main;\n" \
+	"export fn main() int = {\n" \
+	"\tlet a: [3](int | bool) = [1, 2, 3];\n" \
+	"\ta[0] " OP " 1;\n" \
+	"\treturn 0;\n" \
+	"};\n"
+
+/* gs:[3](int|bool) global; `gs[0] OP= 1` compounds the WHOLE tagged element. */
+#define GIDXCOMPOUND(OP) \
+	"package main;\n" \
+	"let gs: [3](int | bool) = [1, 2, 3];\n" \
+	"export fn main() int = {\n" \
+	"\tgs[0] " OP " 1;\n" \
+	"\treturn 0;\n" \
+	"};\n"
+
+static const struct row rows[] = {
+	/* IDENT (#21) — every compound OP on a tagged local rejects on both
+	 * stages (was a byte-identical tag-word corruption). */
+	{ "ident_pluseq",   IDENTCOMPOUND("+="),  0, 0, NULL },
+	{ "ident_minuseq",  IDENTCOMPOUND("-="),  0, 0, NULL },
+	{ "ident_stareq",   IDENTCOMPOUND("*="),  0, 0, NULL },
+	{ "ident_pipeeq",   IDENTCOMPOUND("|="),  0, 0, NULL },
+	{ "ident_careteq",  IDENTCOMPOUND("^="),  0, 0, NULL },
+	{ "ident_lshifteq", IDENTCOMPOUND("<<="), 0, 0, NULL },
+	{ "ident_slasheq",  IDENTCOMPOUND("/="),  0, 0, NULL },
+
+	/* IDENT (#21) — a tagged GLOBAL compound rejects too. */
+	{ "gident_pluseq",  "package main;\n"
+	  "let g: (int | bool) = 7;\n"
+	  "export fn main() int = {\n"
+	  "\tg += 1;\n"
+	  "\treturn 0;\n"
+	  "};\n", 0, 0, NULL },
+
+	/* INDEX (#20) — local tagged-array element compound rejects on both
+	 * stages (cstage was silently dropping the OP, plain-storing the RHS). */
+	{ "lidx_pluseq",    LIDXCOMPOUND("+="),  0, 0, NULL },
+	{ "lidx_minuseq",   LIDXCOMPOUND("-="),  0, 0, NULL },
+	{ "lidx_pipeeq",    LIDXCOMPOUND("|="),  0, 0, NULL },
+	{ "lidx_lshifteq",  LIDXCOMPOUND("<<="), 0, 0, NULL },
+
+	/* INDEX (#20) — global tagged-array element compound rejects too. */
+	{ "gidx_pluseq",    GIDXCOMPOUND("+="),  0, 0, NULL },
+	{ "gidx_stareq",    GIDXCOMPOUND("*="),  0, 0, NULL },
+	{ "gidx_careteq",   GIDXCOMPOUND("^="),  0, 0, NULL },
+
+	/* CONTROL — scalar IDENT compound (`g += 1` on g:int) still compiles +
+	 * runs (the guard keys on a tagged type only). 7 += 1 -> 8. */
+	{ "scalar_ident_ok",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "\tlet g: int = 7;\n"
+	  "\tg += 1;\n"
+	  "\treturn g;\n"
+	  "};\n",
+	  1, 8, NULL },
+
+	/* CONTROL — scalar INDEX compound (`a[0] += 1` on a:[3]int) still
+	 * compiles + runs (the #133 arm wires the scalar element). 7 += 1 -> 8. */
+	{ "scalar_index_ok",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "\tlet a: [3]int = [7, 0, 0];\n"
+	  "\ta[0] += 1;\n"
+	  "\treturn a[0];\n"
+	  "};\n",
+	  1, 8, NULL },
+
+	/* CONTROL — the #41/#32 PLAIN tagged-ident reassign still compiles +
+	 * runs (only the COMPOUND form is nonsense; `g = v` widens). `g is int`
+	 * -> 0. */
+	{ "plain_tagged_ident_ok",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "\tlet g: (int | bool) = 7;\n"
+	  "\tg = 9;\n"
+	  "\tif (g is int) { return 0; };\n"
+	  "\treturn 1;\n"
+	  "};\n",
+	  1, 0, NULL },
+
+	/* CONTROL — the #16 PLAIN tagged-index store (local) still compiles +
+	 * runs (`a[0] = v` widens the element). `a[0] is int` -> 0. */
+	{ "plain_tagged_lidx_ok",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "\tlet a: [3](int | bool) = [1, 2, 3];\n"
+	  "\ta[0] = 9;\n"
+	  "\tif (a[0] is int) { return 0; };\n"
+	  "\treturn 1;\n"
+	  "};\n",
+	  1, 0, NULL },
+
+	/* CONTROL — the #16 PLAIN tagged-index store (global) still compiles +
+	 * runs (`gs[0] = v` widens; the store precedes the read so the #19
+	 * static-init gap is not exercised). `gs[0] is int` -> 0. */
+	{ "plain_tagged_gidx_ok",
+	  "package main;\n"
+	  "let gs: [3](int | bool) = [1, 2, 3];\n"
+	  "export fn main() int = {\n"
+	  "\tgs[0] = 9;\n"
+	  "\tif (gs[0] is int) { return 0; };\n"
+	  "\treturn 1;\n"
+	  "};\n",
+	  1, 0, NULL },
+};
+
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/tcp_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/tcp_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+/* A reject row must (a) fail to build and (b) emit its diagnostic core text.
+ * Returns 0 on the expected reject, -1 otherwise. */
+static int
+build_should_reject(const char *driver, const char *src, const char *diag, int i)
+{
+	char s[64], tmpdir[64], errf[80], cmd[1280];
+	snprintf(s, sizeof s, "/tmp/tcq_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/tcq_%d_d_%d", getpid(), i);
+	snprintf(errf, sizeof errf, "/tmp/tcq_%d_%d.err", getpid(), i);
+
+	FILE *f = fopen(s, "wb");
+	if (!f) return -1;
+	fputs(src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>%s",
+	    tmpdir, driver, s, errf);
+	int rc = runwait(cmd);
+
+	int have_diag = 0;
+	FILE *e = fopen(errf, "rb");
+	if (e) {
+		char buf[4096];
+		size_t n = fread(buf, 1, sizeof buf - 1, e);
+		buf[n] = '\0';
+		fclose(e);
+		have_diag = (strstr(buf, diag) != NULL);
+	}
+
+	unlink(s); unlink(errf);
+	const char *base = strrchr(s, '/');
+	base = base ? base + 1 : s;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	unlink(outbin);
+	rmdir(tmpdir);
+
+	/* build must NOT succeed AND the diagnostic must appear. */
+	return (rc != 0 && have_diag) ? 0 : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *drv; int gated; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
+			fprintf(stderr, "taggedcompoundplace_reject: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].drv);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			total++;
+			if (rows[i].expect_build) {
+				int got = run_build(drivers[d].drv, &rows[i], i);
+				if (got != rows[i].want_exit) {
+					fprintf(stderr, "taggedcompoundplace_reject[%s][%s]: "
+					    "exit=%d want=%d\n", drivers[d].name,
+					    rows[i].label, got, rows[i].want_exit);
+					fail++;
+				}
+			} else {
+				const char *diag = rows[i].diag;
+				if (!diag)
+					diag = (strncmp(rows[i].label, "ident", 5) == 0
+					    || strncmp(rows[i].label, "gident", 6) == 0)
+					    ? DIAG_IDENT : DIAG_INDEX;
+				if (build_should_reject(drivers[d].drv, rows[i].src,
+				    diag, 100 + i) != 0) {
+					fprintf(stderr, "taggedcompoundplace_reject[%s][%s]: "
+					    "expected a loud reject with \"%s\"\n",
+					    drivers[d].name, rows[i].label, diag);
+					fail++;
+				}
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "taggedcompoundplace_reject: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("taggedcompoundplace_reject: %d/%d ok\n", total, total);
+	return 0;
+}