lib/math+encoding: restore Hare loud preconditions (F-Q)

Three lib functions had lost their Hare loud-abort preconditions, so an
out-of-domain argument silently returned garbage instead of aborting:

  random.u32n / random.u64n  assert(n != 0)    ref/hare/math/random/random.ha:26,42
  base64.decodedsize         assert(sz%4 == 0) ref/hare/encoding/base64/base64.ha:597

Source-bundled lib change, identical on both stages (byte-id neutral).
989_libprecond_abort pins each precondition: n=0 / sz%4!=0 abort (rc!=0),
valid args return 0, run on cstage and wwstage.

Makefile

@@ -259,6 +259,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_nullableglobal_reject \
 	  $(BIN)/test_taggedcompoundderef_reject \
 	  $(BIN)/test_taggedcompoundplace_reject \
+	  $(BIN)/test_libprecond_abort \
 	  $(BIN)/test_idxarg_run \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_tupfieldsize_run \
@@ -766,6 +767,13 @@ $(BIN)/test_taggedcompoundderef_reject: test/wcc/989_taggedcompoundderef_reject.
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_libprecond_abort: test/wcc/989_libprecond_abort.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_taggedcompoundplace_reject (#20/#21, last two members of the
 # compound-OP-on-tagged-place reject class): `gs[i] OP= v` / `a[i] OP= v`
 # (INDEX, #20) and `g OP= v` (IDENT, #21) on a tagged-union place are

lib/encoding/base64/base64.ww

@@ -413,5 +413,6 @@ export fn encodedsize(sz: i32) i32 = {
 // length is up to 2 bytes shorter, depending on padding). `sz` must be a
 // multiple of 4. ref/hare/encoding/base64/base64.ha:596-599.
 export fn decodedsize(sz: i32) i32 = {
+	assert(sz % 4i32 == 0i32);	// ref/hare/encoding/base64/base64.ha:597
 	return sz / 4 * 3;
 };

lib/math/random/random.ww

@@ -28,6 +28,7 @@ export fn next(r: *random) u64 = {
 // fast unbiased mapping (mulhi-then-leftover-reject). Mirrors Hare's
 // random::u32n.
 export fn u32n(r: *random, n: u32) u32 = {
+	assert(n != 0u32);	// ref/hare/math/random/random.ha:26
 	let x: u32 = next(r): u32;
 	let prod: u64 = (x: u64) * (n: u64);
 	let leftover: u32 = prod: u32;
@@ -48,6 +49,7 @@ export fn u32n(r: *random, n: u32) u32 = {
 // path; otherwise rejection-sample to avoid modulo bias. Mirrors
 // Hare's random::u64n.
 export fn u64n(r: *random, n: u64) u64 = {
+	assert(n != 0u64);	// ref/hare/math/random/random.ha:42
 	if ((n & (n - 1u64)) == 0u64) { return next(r) & (n - 1u64); };
 	// max = U64_MAX - (U64_MAX+1) % n = -1 - (-n % n)
 	let neg: u64 = (0u64 - n);

test/wcc/989_libprecond_abort.c

@@ -0,0 +1,202 @@
+/*
+ * 989_libprecond_abort (F-Q) — three lib functions had lost their Hare
+ * loud-abort PRECONDITIONS, so an out-of-domain argument silently returned
+ * garbage instead of aborting. This pins the restored asserts:
+ *
+ *   lib/math/random/random.ww  u32n  assert(n != 0)   ref/hare/.../random.ha:26
+ *   lib/math/random/random.ww  u64n  assert(n != 0)   ref/hare/.../random.ha:42
+ *   lib/encoding/base64/...    decodedsize  assert(sz % 4 == 0)  base64.ha:597
+ *
+ * Pre-fix every abort row BUILT rc=0 and RAN rc=0 (the precondition was
+ * absent — silent garbage). The fix is a lib source change, source-bundled
+ * into each build, so it takes effect identically on both stages with no
+ * codegen change (byte-id NEUTRAL).
+ *
+ *   row                       | call                  | result (cs == ww)
+ *   --------------------------+-----------------------+-------------------
+ *   u32n_zero_abort           | u32n(&g, 0)           | run aborts (rc!=0)
+ *   u32n_valid_ok             | u32n(&g, 10) in [0,10)| run rc == 0
+ *   u32n_one_ok               | u32n(&g, 1)  in [0,1) | run rc == 0
+ *   u64n_zero_abort           | u64n(&g, 0)           | run aborts (rc!=0)
+ *   u64n_valid_ok             | u64n(&g, 10) in [0,10)| run rc == 0
+ *   u64n_one_ok               | u64n(&g, 1)  in [0,1) | run rc == 0
+ *   decodedsize_unalign_abort | decodedsize(5)        | run aborts (rc!=0)
+ *   decodedsize_align_ok      | decodedsize(8) == 6   | run rc == 0
+ *
+ * The abort rows BUILD clean and abort at RUNTIME (unlike a reject row,
+ * which fails the build) — this harness builds then runs each fixture and
+ * checks the run exit, not the build exit. Rows run on cstage `ww` and,
+ * when present, wwstage `ww_ww`; both must agree. Sibling idiom:
+ * 989_taggedcompoundderef_reject.c (driver loop, /tmp fixture scaffolding).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_abort;		/* 1 = run must abort (rc!=0); 0 = run rc==want_exit */
+	int want_exit;
+};
+
+#define RNG_HDR \
+	"package main;\n" \
+	"import random;\n" \
+	"export fn main() int = {\n" \
+	"\tlet g: random.random = random.init(1u64);\n"
+
+#define B64_HDR \
+	"package main;\n" \
+	"import base64;\n" \
+	"export fn main() int = {\n"
+
+static const struct row rows[] = {
+	{ "u32n_zero_abort",
+	  RNG_HDR "\tlet x: u32 = random.u32n(&g, 0u32);\n\treturn 0;\n};\n",
+	  1, 0 },
+	{ "u32n_valid_ok",
+	  RNG_HDR "\tlet x: u32 = random.u32n(&g, 10u32);\n"
+	  "\tif (x >= 10u32) { return 1; };\n\treturn 0;\n};\n",
+	  0, 0 },
+	{ "u32n_one_ok",		/* boundary: n=1 is the smallest VALID arg */
+	  RNG_HDR "\tlet x: u32 = random.u32n(&g, 1u32);\n"
+	  "\tif (x >= 1u32) { return 1; };\n\treturn 0;\n};\n",
+	  0, 0 },
+	{ "u64n_zero_abort",
+	  RNG_HDR "\tlet x: u64 = random.u64n(&g, 0u64);\n\treturn 0;\n};\n",
+	  1, 0 },
+	{ "u64n_valid_ok",
+	  RNG_HDR "\tlet x: u64 = random.u64n(&g, 10u64);\n"
+	  "\tif (x >= 10u64) { return 1; };\n\treturn 0;\n};\n",
+	  0, 0 },
+	{ "u64n_one_ok",		/* boundary: n=1 is the smallest VALID arg */
+	  RNG_HDR "\tlet x: u64 = random.u64n(&g, 1u64);\n"
+	  "\tif (x >= 1u64) { return 1; };\n\treturn 0;\n};\n",
+	  0, 0 },
+	{ "decodedsize_unalign_abort",
+	  B64_HDR "\tlet c: i32 = base64.decodedsize(5i32);\n\treturn 0;\n};\n",
+	  1, 0 },
+	{ "decodedsize_align_ok",
+	  B64_HDR "\tlet c: i32 = base64.decodedsize(8i32);\n"
+	  "\tif (c != 6i32) { return 1; };\n\treturn 0;\n};\n",
+	  0, 0 },
+};
+
+/* Build `r->src` with `driver`, then run it. Returns the RUN exit code, or
+ * -1 if the build failed (the harness treats a build miss as a hard error:
+ * every row here must build clean — only the RUN may abort). `incs` is the
+ * colon-free `-I a -I b ...` include flag string already composed by main. */
+static int
+build_and_run(const char *driver, const char *incs, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[2048];
+	snprintf(src, sizeof src, "/tmp/lpc_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/lpc_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s %s 2>/dev/null",
+	    tmpdir, driver, incs, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[160];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = (brc == 0) ? runwait(outbin) : -1;
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+	char absbin[1024];
+	if (bin[0] != '/') {
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	/* random lives at lib/math/random, base64 at lib/encoding/base64;
+	 * the leaf-only imports resolve via these -I dirs (base64's own
+	 * bytes/io/... deps resolve via the driver's default lib srcdir).
+	 * Absolute so the per-row `cd <tmpdir>` does not break resolution. */
+	char incs[1024];
+	snprintf(incs, sizeof incs, "-I %s/lib -I %s/lib/math -I %s/lib/encoding",
+	    cwd, cwd, cwd);
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *drv; int gated; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
+			fprintf(stderr, "libprecond_abort: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].drv);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			total++;
+			int got = build_and_run(drivers[d].drv, incs, &rows[i], i);
+			if (rows[i].want_abort) {
+				if (got == 0 || got < 0) {
+					fprintf(stderr, "libprecond_abort[%s][%s]: run rc=%d, "
+					    "expected a loud abort (rc!=0)%s\n",
+					    drivers[d].name, rows[i].label, got,
+					    got < 0 ? " [build failed]" : "");
+					fail++;
+				}
+			} else {
+				if (got != rows[i].want_exit) {
+					fprintf(stderr, "libprecond_abort[%s][%s]: run rc=%d "
+					    "want=%d\n", drivers[d].name, rows[i].label, got,
+					    rows[i].want_exit);
+					fail++;
+				}
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "libprecond_abort: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("libprecond_abort: %d/%d ok\n", total, total);
+	return 0;
+}