wcc/ww: paramfieldsize sizes a tagged-union destructure binding

A tagged for-range destructure binding took the 8-byte default
(paramfieldsize had no tagged arm), skipping the full-extent copy —
the wwstage twin of the just-closed cstage destructure family. Read
the stamped tinfo size through the type table (twin of the slice
arm; cstage reads tp->type->size). Task #53.

Makefile

@@ -252,6 +252,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_idxarg_run \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_tupfieldsize_run \
+	  $(BIN)/test_tagtupfieldsize_run \
 	  $(BIN)/test_gunsigned_run \
 	  $(BIN)/test_taggedidx_run \
 	  $(BIN)/test_fnptrcollide_run \
@@ -699,6 +700,17 @@ $(BIN)/test_tupfieldsize_run: test/wcc/989_tupfieldsize_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_tagtupfieldsize_run (#53, sibling of #43): a for-range destructure over
+# an array of tuples whose field is a tagged union must stride by the tuple's
+# true size and copy the field's full box. Builds+runs on BOTH driver twins
+# (rule-10), the tagged-field row pinned cs==ww at the absolute value.
+$(BIN)/test_tagtupfieldsize_run: test/wcc/989_tagtupfieldsize_run.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_gunsigned_run (F7-c5, #25): a module-global unsigned ident on the
 # divide/shift/relational path must pick the unsigned opcode. Builds+runs on
 # BOTH driver twins (rule-10). CLASS-M — see the test header.

selfhost/cmd/w6c/main.combined.ww

@@ -39221,6 +39221,22 @@ fn paramfieldsize(t: *node) i32 = {
 	// tyslicesize() is the slice-header SSoT (rule-13); cstage reads the
 	// same width via tp->type->size (cmd/w6c/cgen.c N_FORRANGE).
 	if (k == nkind.N_TSLICE) { return tyslicesize(): i32; };
+	// #53: a tagged-union tuple-field carries its full box (tag + widest
+	// payload, slot-padded), NOT the 8B scalar default — a for-range
+	// destructure binding sized 8 loaded only the tag word (cs=56/ww=9, the
+	// cat-A repro). The box width is variant-dependent, so read it from the
+	// checker-stamped tinfo (rule-13): cstage's tp->type->size reads the same
+	// resolved width. The stamp already collapsed any alias, so this also
+	// covers an N_TNAME field naming a tagged union (paramfieldsize's no-`c`
+	// structural contract can't aliaslookup-chase the node). Mirrors the
+	// N_TSLICE arm's type-table SSoT.
+	let tgi: *tinfo = t.type_: *tinfo;
+	if (tgi != nil) {
+		tgi = tichase(tgi);
+		if (tgi != nil && tgi.kind == tykind.TY_TAGGED) {
+			return tgi.size: i32;
+		};
+	};
 	// #43 (F7-c4): a nested tuple field sizes as the sum of its element
 	// SLOTS — each element floored UP to one 8B eightbyte (str/slice keep
 	// their 24B header), per the tuple-slot ruling and tupeslot's

selfhost/cmd/wcc/cgenstmt.ww

@@ -3669,6 +3669,22 @@ fn paramfieldsize(t: *node) i32 = {
 	// tyslicesize() is the slice-header SSoT (rule-13); cstage reads the
 	// same width via tp->type->size (cmd/w6c/cgen.c N_FORRANGE).
 	if (k == nkind.N_TSLICE) { return tyslicesize(): i32; };
+	// #53: a tagged-union tuple-field carries its full box (tag + widest
+	// payload, slot-padded), NOT the 8B scalar default — a for-range
+	// destructure binding sized 8 loaded only the tag word (cs=56/ww=9, the
+	// cat-A repro). The box width is variant-dependent, so read it from the
+	// checker-stamped tinfo (rule-13): cstage's tp->type->size reads the same
+	// resolved width. The stamp already collapsed any alias, so this also
+	// covers an N_TNAME field naming a tagged union (paramfieldsize's no-`c`
+	// structural contract can't aliaslookup-chase the node). Mirrors the
+	// N_TSLICE arm's type-table SSoT.
+	let tgi: *tinfo = t.type_: *tinfo;
+	if (tgi != nil) {
+		tgi = tichase(tgi);
+		if (tgi != nil && tgi.kind == tykind.TY_TAGGED) {
+			return tgi.size: i32;
+		};
+	};
 	// #43 (F7-c4): a nested tuple field sizes as the sum of its element
 	// SLOTS — each element floored UP to one 8B eightbyte (str/slice keep
 	// their 24B header), per the tuple-slot ruling and tupeslot's

selfhost/cmd/wwdump/main.combined.ww

@@ -39221,6 +39221,22 @@ fn paramfieldsize(t: *node) i32 = {
 	// tyslicesize() is the slice-header SSoT (rule-13); cstage reads the
 	// same width via tp->type->size (cmd/w6c/cgen.c N_FORRANGE).
 	if (k == nkind.N_TSLICE) { return tyslicesize(): i32; };
+	// #53: a tagged-union tuple-field carries its full box (tag + widest
+	// payload, slot-padded), NOT the 8B scalar default — a for-range
+	// destructure binding sized 8 loaded only the tag word (cs=56/ww=9, the
+	// cat-A repro). The box width is variant-dependent, so read it from the
+	// checker-stamped tinfo (rule-13): cstage's tp->type->size reads the same
+	// resolved width. The stamp already collapsed any alias, so this also
+	// covers an N_TNAME field naming a tagged union (paramfieldsize's no-`c`
+	// structural contract can't aliaslookup-chase the node). Mirrors the
+	// N_TSLICE arm's type-table SSoT.
+	let tgi: *tinfo = t.type_: *tinfo;
+	if (tgi != nil) {
+		tgi = tichase(tgi);
+		if (tgi != nil && tgi.kind == tykind.TY_TAGGED) {
+			return tgi.size: i32;
+		};
+	};
 	// #43 (F7-c4): a nested tuple field sizes as the sum of its element
 	// SLOTS — each element floored UP to one 8B eightbyte (str/slice keep
 	// their 24B header), per the tuple-slot ruling and tupeslot's

test/wcc/989_tagtupfieldsize_run.c

@@ -0,0 +1,184 @@
+/*
+ * 989_tagtupfieldsize_run (#53, sibling of #43): a for-range destructure
+ * over an array of tuples whose field is a TAGGED UNION must stride by the
+ * tuple's true size and copy the field's full box (tag + payload), not the
+ * 8B scalar default.
+ *
+ * THE BUG (cat-A silent miscompile, gate-blind): wwstage paramfieldsize
+ * (selfhost/cmd/wcc/cgenstmt.ww) — the structural sizer the for-range
+ * destructure uses for the tuple stride and each field's offset — had no
+ * tagged-union arm, so a `(i64|bool)` field sized 8 (the default) instead
+ * of its 16B box (tag + slot-padded payload). The for-range DESTRUCTURE-READ
+ * path is unguarded by the #270-1c array-literal construction gate (#43
+ * lineage; tuples built by whole-tuple element store). The 8B bind copied
+ * only the tag word and read the payload from stale stack: cs=56 (correct,
+ * cstage's tp->type->size=16) vs ww=9 — the cat-A signature. THE FIX: read
+ * the tagged box width from the checker-stamped tinfo (rule-13), mirroring
+ * the N_TSLICE arm's type-table SSoT; the stamp collapses the `tu` alias so
+ * an N_TNAME field naming a tagged union resolves too.
+ *
+ * The tagged value enters the tuple from a LOCAL ident box (the only wired
+ * tagged-tuple-element source, cgenexpr #22a); a cast source loud-rejects.
+ *
+ * Rows (cstage `ww` + wwstage `ww_ww`; rule-10; pin the absolute value):
+ *   row               | reads                                | exit (cs==ww)
+ *   ------------------+--------------------------------------+--------------
+ *   tag_payload       | match(a){i64=>v}+n, payloads 7/9     | 56  (7+10+9+30)
+ *   scalar_tuple_ctl  | for(.. [2](i64,i64)) — arm untouched | 48  (control)
+ * Pre-fix (8B bind, payload word dropped): tag_payload ww=9 != cs=56.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_exit;	/* >= 0: also pin the absolute value; -1: cs==ww only */
+};
+
+static const struct row rows[] = {
+	/* (1) tag_payload (#53 teeth): the tagged binding's payload word must
+	 * be copied. Pre-fix the 8B bind dropped it → match reads stale → 9. */
+	{ "tag_payload",
+	  "package main;\n"
+	  "type tu = (i64 | bool);\n"
+	  "export fn main() int = {\n"
+	  "	let t0: tu = 7: tu;\n"
+	  "	let t1: tu = 9: tu;\n"
+	  "	let xs: [2](tu, i64);\n"
+	  "	xs[0] = (t0, 10);\n"
+	  "	xs[1] = (t1, 30);\n"
+	  "	let sum: i64 = 0;\n"
+	  "	for (let (a, n) .. xs) {\n"
+	  "		match (a) {\n"
+	  "		case let v: i64 => sum = sum + v + n;\n"
+	  "		case let b: bool => sum = sum + 1000;\n"
+	  "		};\n"
+	  "	};\n"
+	  "	return sum: int;\n"
+	  "};\n",
+	  56 },
+
+	/* (2) control — scalar-only tuple (no tagged field): paramfieldsize
+	 * already handled it; the new tagged arm must not touch it. 3+10+5+30. */
+	{ "scalar_tuple_ctl",
+	  "package main;\n"
+	  "export fn main() int = {\n"
+	  "	let xs: [2](i64, i64);\n"
+	  "	xs[0] = (3, 10); xs[1] = (5, 30);\n"
+	  "	let sum: i64 = 0;\n"
+	  "	for (let (a, b) .. xs) { sum = sum + a + b; };\n"
+	  "	return sum: int;\n"
+	  "};\n",
+	  48 },
+};
+
+/* run_build — build+run `src` via `driver`; returns the binary's exit
+ * code, or -1 on a build failure. */
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/tagtupfs_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/tagtupfs_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+	int have_ww = (access(wdrv, X_OK) == 0);
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		total++;
+		int gc = run_build(cdrv, &rows[i], i);
+		if (gc < 0) {
+			fprintf(stderr, "tagtupfieldsize_run[cstage][%s]: build/run "
+			    "failed (got %d)\n", rows[i].label, gc);
+			fail++;
+			continue;
+		}
+		if (rows[i].want_exit >= 0 && gc != rows[i].want_exit) {
+			fprintf(stderr, "tagtupfieldsize_run[cstage][%s]: exit=%d "
+			    "want=%d\n", rows[i].label, gc, rows[i].want_exit);
+			fail++;
+		}
+		if (!have_ww) {
+			fprintf(stderr, "tagtupfieldsize_run: skip wwstage (no %s)\n",
+			    wdrv);
+			continue;
+		}
+		int gw = run_build(wdrv, &rows[i], i);
+		/* rule-10: the cat-A invariant is cs == ww */
+		if (gw != gc) {
+			fprintf(stderr, "tagtupfieldsize_run[%s]: cs=%d != ww=%d "
+			    "(tagged tuple-field stride/offset divergence — #53)\n",
+			    rows[i].label, gc, gw);
+			fail++;
+		}
+		if (rows[i].want_exit >= 0 && gw != rows[i].want_exit) {
+			fprintf(stderr, "tagtupfieldsize_run[wwstage][%s]: exit=%d "
+			    "want=%d\n", rows[i].label, gw, rows[i].want_exit);
+			fail++;
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "tagtupfieldsize_run: %d/%d checks failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("tagtupfieldsize_run: %d/%d ok\n", total, total);
+	return 0;
+}