wcc/ww: is/as on a module-global tagged ident loads from g(SB)

The global tagged ident operand read saved BP instead of the global:
'is' compared garbage as the tag; 'as' never had a payload. Route the
load through the g(SB) base — tag at +0, payload at +8, cap at +16 for
str (one mechanism, both consumers). The 'is' half aligns ww UP
(cs==ww pinned); the 'as' half is a both-wrong pair — cstage spills an
uninitialized payload register (its N_TYPEASSERT assumes cgexpr filled
AX/DX/CX; filed as task #46), so its rows assert ww-runtime-correct
with the cs divergence documented until #46 lands. Review item #18.

Makefile

@@ -257,6 +257,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_tagnorm_run \
 	  $(BIN)/test_globslicefield_run \
 	  $(BIN)/test_globstrslice_run \
+	  $(BIN)/test_globtagisas_run \
 	  $(BIN)/test_arr_ptr_global \
 	  $(BIN)/test_def_arr_infer_len \
 	  $(BIN)/test_def_arr_len \
@@ -735,6 +736,17 @@ $(BIN)/test_globstrslice_run: test/wcc/989_globstrslice_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_globtagisas_run (F8-c3, #18): `is`/`as` on a module-global tagged
+# ident must read tag/payload from g(SB), not saved-BP. MIXED per-half:
+# `is` align-UP (cs==ww); `as` #263 ww-runtime-correct (cs!=ww residual,
+# cstage half = task #46). Per-driver expected rows. See the test header.
+$(BIN)/test_globtagisas_run: test/wcc/989_globtagisas_run.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_let_global: test/wcc/630_let_global.c $(BIN)/ww $(BIN)/w6c \
 		$(BIN)/w6a $(BIN)/w6l $(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<

selfhost/cmd/w6c/main.combined.ww

@@ -23353,12 +23353,20 @@ fn cgtypetest(c: *cgen, n: *node) void = {
 	let scrutoff: i32 = 0;
 	let scrutt: *node = nil;
 	let nonident: bool = false;
+	let globalident: bool = false;
 	if (lhs != nil) {
 		if (lhs.kind == nkind.N_IDENT) {
 			let lc: *local = localfindnode(c, lhs.str);
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
+			} else {
+				// #18 is-half (align-UP): global tagged ident — tag word at
+				// g(SB)+0, no BP slot. cstage N_TYPETEST is uniformly cgexpr
+				// (MOVQ g(SB),AX); pre-fix the !nonident emit read 0(BP)=saved BP.
+				let gt: *node = letvartnode(c, lhs.str);
+				scrutt = resolvetagged(c, gt);
+				globalident = true;
 			};
 		} else {
 			// #45: non-ident scrutinee (xs[i], p.field, call).
@@ -23414,9 +23422,15 @@ fn cgtypetest(c: *cgen, n: *node) void = {
 		want = cgtagvariantidx(c, scrutt, n.rhs);
 	};
 	if (!nonident) {
-		emitline("\tMOVQ\t");
+		if (globalident) {
-		emitoff(scrutoff: i64);
+			emitline("\tMOVQ\t");
-		emitline("(BP), AX\n");
+			emitsymname(c, lhs.str);
+			emitline("(SB), AX\n");
+		} else {
+			emitline("\tMOVQ\t");
+			emitoff(scrutoff: i64);
+			emitline("(BP), AX\n");
+		};
 	};
 	let nel: str = mklabel(c, "is_ne");
 	let dnl: str = mklabel(c, "is_done");
@@ -23496,6 +23510,29 @@ fn cgtypeassert(c: *cgen, n: *node) void = {
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
+			} else {
+				// #18 as-half (#263 ww-runtime-correct; cstage N_TYPEASSERT on a
+				// global tagged ident spills uninitialized DX as the payload —
+				// task #46). No BP slot: copy the box words from g(SB) into a
+				// fresh @asrt_spill so the tag-check + payload load below index
+				// off memory like a local. cs!=ww residual until #46 lands.
+				let gt: *node = letvartnode(c, lhs.str);
+				scrutt = resolvetagged(c, gt);
+				let gsz: i32 = matchspillsz(c, scrutt);
+				scrutoff = localalloc(c, "@asrt_spill", gsz, nil);
+				emitline("\tLEAQ\t");
+				emitsymname(c, lhs.str);
+				emitline("(SB), AX\n");
+				let gk: i32 = 0;
+				for (gk < gsz) {
+					emitline("\tMOVQ\t");
+					emitdispreg(gk: i64, "AX");
+					emitline(", DX\n");
+					emitline("\tMOVQ\tDX, ");
+					emitoff((scrutoff + gk): i64);
+					emitline("(BP)\n");
+					gk += 8;
+				};
 			};
 		} else {
 			// Non-ident scrutinee (call result, arr[i], p.field, ?,

selfhost/cmd/wcc/cgenexpr.ww

@@ -582,12 +582,20 @@ fn cgtypetest(c: *cgen, n: *node) void = {
 	let scrutoff: i32 = 0;
 	let scrutt: *node = nil;
 	let nonident: bool = false;
+	let globalident: bool = false;
 	if (lhs != nil) {
 		if (lhs.kind == nkind.N_IDENT) {
 			let lc: *local = localfindnode(c, lhs.str);
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
+			} else {
+				// #18 is-half (align-UP): global tagged ident — tag word at
+				// g(SB)+0, no BP slot. cstage N_TYPETEST is uniformly cgexpr
+				// (MOVQ g(SB),AX); pre-fix the !nonident emit read 0(BP)=saved BP.
+				let gt: *node = letvartnode(c, lhs.str);
+				scrutt = resolvetagged(c, gt);
+				globalident = true;
 			};
 		} else {
 			// #45: non-ident scrutinee (xs[i], p.field, call).
@@ -643,9 +651,15 @@ fn cgtypetest(c: *cgen, n: *node) void = {
 		want = cgtagvariantidx(c, scrutt, n.rhs);
 	};
 	if (!nonident) {
-		emitline("\tMOVQ\t");
+		if (globalident) {
-		emitoff(scrutoff: i64);
+			emitline("\tMOVQ\t");
-		emitline("(BP), AX\n");
+			emitsymname(c, lhs.str);
+			emitline("(SB), AX\n");
+		} else {
+			emitline("\tMOVQ\t");
+			emitoff(scrutoff: i64);
+			emitline("(BP), AX\n");
+		};
 	};
 	let nel: str = mklabel(c, "is_ne");
 	let dnl: str = mklabel(c, "is_done");
@@ -725,6 +739,29 @@ fn cgtypeassert(c: *cgen, n: *node) void = {
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
+			} else {
+				// #18 as-half (#263 ww-runtime-correct; cstage N_TYPEASSERT on a
+				// global tagged ident spills uninitialized DX as the payload —
+				// task #46). No BP slot: copy the box words from g(SB) into a
+				// fresh @asrt_spill so the tag-check + payload load below index
+				// off memory like a local. cs!=ww residual until #46 lands.
+				let gt: *node = letvartnode(c, lhs.str);
+				scrutt = resolvetagged(c, gt);
+				let gsz: i32 = matchspillsz(c, scrutt);
+				scrutoff = localalloc(c, "@asrt_spill", gsz, nil);
+				emitline("\tLEAQ\t");
+				emitsymname(c, lhs.str);
+				emitline("(SB), AX\n");
+				let gk: i32 = 0;
+				for (gk < gsz) {
+					emitline("\tMOVQ\t");
+					emitdispreg(gk: i64, "AX");
+					emitline(", DX\n");
+					emitline("\tMOVQ\tDX, ");
+					emitoff((scrutoff + gk): i64);
+					emitline("(BP)\n");
+					gk += 8;
+				};
 			};
 		} else {
 			// Non-ident scrutinee (call result, arr[i], p.field, ?,

selfhost/cmd/wwdump/main.combined.ww

@@ -23353,12 +23353,20 @@ fn cgtypetest(c: *cgen, n: *node) void = {
 	let scrutoff: i32 = 0;
 	let scrutt: *node = nil;
 	let nonident: bool = false;
+	let globalident: bool = false;
 	if (lhs != nil) {
 		if (lhs.kind == nkind.N_IDENT) {
 			let lc: *local = localfindnode(c, lhs.str);
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
+			} else {
+				// #18 is-half (align-UP): global tagged ident — tag word at
+				// g(SB)+0, no BP slot. cstage N_TYPETEST is uniformly cgexpr
+				// (MOVQ g(SB),AX); pre-fix the !nonident emit read 0(BP)=saved BP.
+				let gt: *node = letvartnode(c, lhs.str);
+				scrutt = resolvetagged(c, gt);
+				globalident = true;
 			};
 		} else {
 			// #45: non-ident scrutinee (xs[i], p.field, call).
@@ -23414,9 +23422,15 @@ fn cgtypetest(c: *cgen, n: *node) void = {
 		want = cgtagvariantidx(c, scrutt, n.rhs);
 	};
 	if (!nonident) {
-		emitline("\tMOVQ\t");
+		if (globalident) {
-		emitoff(scrutoff: i64);
+			emitline("\tMOVQ\t");
-		emitline("(BP), AX\n");
+			emitsymname(c, lhs.str);
+			emitline("(SB), AX\n");
+		} else {
+			emitline("\tMOVQ\t");
+			emitoff(scrutoff: i64);
+			emitline("(BP), AX\n");
+		};
 	};
 	let nel: str = mklabel(c, "is_ne");
 	let dnl: str = mklabel(c, "is_done");
@@ -23496,6 +23510,29 @@ fn cgtypeassert(c: *cgen, n: *node) void = {
 			if (lc != nil) {
 				scrutoff = lc.off;
 				scrutt = resolvetagged(c, lc.tnode);
+			} else {
+				// #18 as-half (#263 ww-runtime-correct; cstage N_TYPEASSERT on a
+				// global tagged ident spills uninitialized DX as the payload —
+				// task #46). No BP slot: copy the box words from g(SB) into a
+				// fresh @asrt_spill so the tag-check + payload load below index
+				// off memory like a local. cs!=ww residual until #46 lands.
+				let gt: *node = letvartnode(c, lhs.str);
+				scrutt = resolvetagged(c, gt);
+				let gsz: i32 = matchspillsz(c, scrutt);
+				scrutoff = localalloc(c, "@asrt_spill", gsz, nil);
+				emitline("\tLEAQ\t");
+				emitsymname(c, lhs.str);
+				emitline("(SB), AX\n");
+				let gk: i32 = 0;
+				for (gk < gsz) {
+					emitline("\tMOVQ\t");
+					emitdispreg(gk: i64, "AX");
+					emitline(", DX\n");
+					emitline("\tMOVQ\tDX, ");
+					emitoff((scrutoff + gk): i64);
+					emitline("(BP)\n");
+					gk += 8;
+				};
 			};
 		} else {
 			// Non-ident scrutinee (call result, arr[i], p.field, ?,

test/wcc/989_globtagisas_run.c

@@ -0,0 +1,179 @@
+/*
+ * 989_globtagisas_run — F8-c3 (report-item #18): `is`/`as` on a module-
+ * GLOBAL tagged-union ident must read the tag/payload from g(SB), not the
+ * saved-BP word.
+ *
+ * THE BUG (cat-A silent miscompile): in cgenexpr.ww cgtypetest (`is`) and
+ * cgtypeassert (`as`) resolve an N_IDENT scrutinee's slot via localfindnode.
+ * A module-global ident returns nil (no BP slot), so scrutoff stayed 0 and
+ * the tag read fell on 0(BP) = the saved-BP word (and the payload on 8(BP) =
+ * the return address). cstage N_TYPETEST is uniformly cgexpr (MOVQ g(SB),AX),
+ * so the bootstrap corpus never trips it on 990-997 — a runtime row is the net.
+ *
+ * MIXED CATEGORY (per-half, asm-verified — spec §3 principle):
+ *  • `is` half = ALIGN-UP. cstage reads the tag correctly (MOVQ g(SB),AX);
+ *    wwstage read 0(BP). FIX routes the global ident to MOVQ g(SB),AX →
+ *    cs==ww + runtime-correct (the is_* rows assert want on BOTH drivers).
+ *  • `as` half = #263 BOTH-WRONG. cstage N_TYPEASSERT on a global ident also
+ *    fails: it spills cgexpr's AX (tag only) plus UNINITIALIZED DX as the
+ *    payload (never loads g(SB)+8) → returns garbage (0). The wwstage FIX
+ *    copies the global box words from g(SB)+0/+8[/+16] into a fresh
+ *    @asrt_spill so the tag-check + payload load index off memory like a
+ *    local → ww runtime-correct, while cstage stays wrong: cs≠ww residual
+ *    BY DESIGN until the cstage half lands (ww-core TASK #46). The as_* rows
+ *    assert ww-correct AND pin cstage's documented-wrong value so the residual
+ *    is never misread as a regression.
+ *
+ * Rows (built+run on cstage `ww` and wwstage `ww_ww`; each driver checked
+ * against ITS expected — want_cs / want_ww — to encode the #263 residual):
+ *   row       | shape                                  | cs | ww | cat
+ *   ----------+----------------------------------------+----+----+--------
+ *   is_match  | g:(i64|bool)=5; if g is i64 →0 else 12   | 0  | 0  | align-UP
+ *   is_nomatch| g:(i64|bool)=5; if g is bool →13 else 0  | 0  | 0  | align-UP
+ *   as_i64    | g:(i64|bool)=42; (g as i64):int          | 0  | 42 | #263 (#46)
+ *   as_str    | g:(str|i64)="hello"; len(g as str)       | 0  | 5  | #263 (#46)
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int want_cs;
+	int want_ww;
+};
+
+static const struct row rows[] = {
+	{ "is_match",
+	  "package main;\n"
+	  "let g: (i64 | bool) = 5;\n"
+	  "fn check() int = { if (g is i64) { return 0; }; return 12; };\n"
+	  "export fn main() int = { return check(); };\n",
+	  0, 0 },
+
+	{ "is_nomatch",
+	  "package main;\n"
+	  "let g: (i64 | bool) = 5;\n"
+	  "fn check() int = { if (g is bool) { return 13; }; return 0; };\n"
+	  "export fn main() int = { return check(); };\n",
+	  0, 0 },
+
+	/* #263: cstage spills uninitialized DX as the payload (task #46) →
+	 * returns 0; wwstage copies the box from g(SB) → 42. */
+	{ "as_i64",
+	  "package main;\n"
+	  "let g: (i64 | bool) = 42;\n"
+	  "fn check() int = { let x: i64 = g as i64; return x: int; };\n"
+	  "export fn main() int = { return check(); };\n",
+	  0, 42 },
+
+	/* #263: str variant — wwstage copies the +16 cap word too (task #46). */
+	{ "as_str",
+	  "package main;\n"
+	  "let g: (str | i64) = \"hello\";\n"
+	  "fn check() int = { let s: str = g as str; return len(s): int; };\n"
+	  "export fn main() int = { return check(); };\n",
+	  0, 5 },
+};
+
+/* run_build — build+run `src` via `driver`; returns the binary's exit
+ * code, or -1 on a build failure. */
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/gtia_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/gtia_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *drv; int gated; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
+			fprintf(stderr, "globtagisas_run: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].drv);
+			continue;
+		}
+		int is_ww = (d == 1);
+		for (int i = 0; i < n; i++) {
+			total++;
+			int want = is_ww ? rows[i].want_ww : rows[i].want_cs;
+			int got = run_build(drivers[d].drv, &rows[i], i);
+			if (got != want) {
+				fprintf(stderr, "globtagisas_run[%s][%s]: exit=%d "
+				    "want=%d\n", drivers[d].name, rows[i].label,
+				    got, want);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "globtagisas_run: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("globtagisas_run: %d/%d ok\n", total, total);
+	return 0;
+}