wcc/ww: &fn synthesis prefers the current module's fn

The address-of-fn synthesis used a bare lookup — import order could
bind a same-leaf fn from another module, silently LEAQ-ing the wrong
function into a fn-ptr slot. Prefer the current module (mirror
check.c:410/1305). Report item #4 (loud and silent faces pinned).

Makefile

@@ -260,6 +260,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_defdim_field_run \
 	  $(BIN)/test_defdim_argslice_run \
 	  $(BIN)/test_slttypepref_run \
+	  $(BIN)/test_ampfncollide_run \
 	  $(BIN)/test_gunsigned_run \
 	  $(BIN)/test_taggedidx_run \
 	  $(BIN)/test_fnptrcollide_run \
@@ -792,6 +793,17 @@ $(BIN)/test_slttypepref_run: test/wcc/989_slttypepref_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_ampfncollide_run (#4, c2): `&fn` synthesis (unoptype TK_AMP +
+# assignableaddrfn) prefers the current module's fn when a same-leaf fn is
+# declared in a later module. Builds/rejects on BOTH driver twins (rule-10).
+# See the test header.
+$(BIN)/test_ampfncollide_run: test/wcc/989_ampfncollide_run.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_gunsigned_run (F7-c5, #25): a module-global unsigned ident on the
 # divide/shift/relational path must pick the unsigned opcode. Builds+runs on
 # BOTH driver twins (rule-10). CLASS-M — see the test header.

selfhost/cmd/w6c/main.combined.ww

@@ -13130,7 +13130,12 @@ fn unoptype(c: *checker, e: *node) *node = {
 		// (cmd/wcc/check.c:668), so `&fn` is `*fn` natively.
 		if (e.lhs != nil) {
 			if (e.lhs.kind == nkind.N_IDENT) {
-				let fs: *sym = scopelookup(c.cur, e.lhs.str);
+				// #4: curmod preference. A bare `&handler` whose leaf
+				// also names a fn in a LATER module otherwise binds
+				// the foreign signature (scopedefineinmodule prepends);
+				// cstage types a fn ident via scope_lookup_prefer with
+				// cur_mod (cmd/wcc/check.c:1305).
+				let fs: *sym = scopelookupprefer(c.cur, c.curmod, e.lhs.str);
 				if (fs != nil) {
 					if (fs.skind == skind.SK_FN) {
 						if (fs.decl != nil) {
@@ -14635,7 +14640,13 @@ fn assignableaddrfn(c: *checker, dst: *node, rhs: *node) bool = {
 	let id: *node = rhs.lhs;
 	if (id == nil) { return false; };
 	if (id.kind != nkind.N_IDENT) { return false; };
-	let s: *sym = scopelookup(c.cur, id.str);
+	// #4: curmod preference. Without it a `&handler` whose leaf also
+	// names a fn in a later module misbinds the foreign fn's signature
+	// here (scopedefineinmodule prepends → chain-first = last module),
+	// silently admitting a *fn into a foreign-sig slot or rejecting a
+	// valid same-module &fn. cstage uses scope_lookup_prefer with
+	// cur_mod (cmd/wcc/check.c:410, assignable_addrfn).
+	let s: *sym = scopelookupprefer(c.cur, c.curmod, id.str);
 	if (s == nil) { return false; };
 	if (s.skind != skind.SK_FN) { return false; };
 	if (s.decl == nil) { return false; };

selfhost/cmd/wcc/check.ww

@@ -2690,7 +2690,12 @@ fn unoptype(c: *checker, e: *node) *node = {
 		// (cmd/wcc/check.c:668), so `&fn` is `*fn` natively.
 		if (e.lhs != nil) {
 			if (e.lhs.kind == nkind.N_IDENT) {
-				let fs: *sym = scopelookup(c.cur, e.lhs.str);
+				// #4: curmod preference. A bare `&handler` whose leaf
+				// also names a fn in a LATER module otherwise binds
+				// the foreign signature (scopedefineinmodule prepends);
+				// cstage types a fn ident via scope_lookup_prefer with
+				// cur_mod (cmd/wcc/check.c:1305).
+				let fs: *sym = scopelookupprefer(c.cur, c.curmod, e.lhs.str);
 				if (fs != nil) {
 					if (fs.skind == skind.SK_FN) {
 						if (fs.decl != nil) {
@@ -4195,7 +4200,13 @@ fn assignableaddrfn(c: *checker, dst: *node, rhs: *node) bool = {
 	let id: *node = rhs.lhs;
 	if (id == nil) { return false; };
 	if (id.kind != nkind.N_IDENT) { return false; };
-	let s: *sym = scopelookup(c.cur, id.str);
+	// #4: curmod preference. Without it a `&handler` whose leaf also
+	// names a fn in a later module misbinds the foreign fn's signature
+	// here (scopedefineinmodule prepends → chain-first = last module),
+	// silently admitting a *fn into a foreign-sig slot or rejecting a
+	// valid same-module &fn. cstage uses scope_lookup_prefer with
+	// cur_mod (cmd/wcc/check.c:410, assignable_addrfn).
+	let s: *sym = scopelookupprefer(c.cur, c.curmod, id.str);
 	if (s == nil) { return false; };
 	if (s.skind != skind.SK_FN) { return false; };
 	if (s.decl == nil) { return false; };

selfhost/cmd/wwdump/main.combined.ww

@@ -13130,7 +13130,12 @@ fn unoptype(c: *checker, e: *node) *node = {
 		// (cmd/wcc/check.c:668), so `&fn` is `*fn` natively.
 		if (e.lhs != nil) {
 			if (e.lhs.kind == nkind.N_IDENT) {
-				let fs: *sym = scopelookup(c.cur, e.lhs.str);
+				// #4: curmod preference. A bare `&handler` whose leaf
+				// also names a fn in a LATER module otherwise binds
+				// the foreign signature (scopedefineinmodule prepends);
+				// cstage types a fn ident via scope_lookup_prefer with
+				// cur_mod (cmd/wcc/check.c:1305).
+				let fs: *sym = scopelookupprefer(c.cur, c.curmod, e.lhs.str);
 				if (fs != nil) {
 					if (fs.skind == skind.SK_FN) {
 						if (fs.decl != nil) {
@@ -14635,7 +14640,13 @@ fn assignableaddrfn(c: *checker, dst: *node, rhs: *node) bool = {
 	let id: *node = rhs.lhs;
 	if (id == nil) { return false; };
 	if (id.kind != nkind.N_IDENT) { return false; };
-	let s: *sym = scopelookup(c.cur, id.str);
+	// #4: curmod preference. Without it a `&handler` whose leaf also
+	// names a fn in a later module misbinds the foreign fn's signature
+	// here (scopedefineinmodule prepends → chain-first = last module),
+	// silently admitting a *fn into a foreign-sig slot or rejecting a
+	// valid same-module &fn. cstage uses scope_lookup_prefer with
+	// cur_mod (cmd/wcc/check.c:410, assignable_addrfn).
+	let s: *sym = scopelookupprefer(c.cur, c.curmod, id.str);
 	if (s == nil) { return false; };
 	if (s.skind != skind.SK_FN) { return false; };
 	if (s.decl == nil) { return false; };

test/wcc/989_ampfncollide_run.c

@@ -0,0 +1,168 @@
+/*
+ * 989_ampfncollide_run (#4, c2) — `&fn` synthesis must prefer the current
+ * module's fn when a same-leaf fn is declared in a later module.
+ *
+ * THE BUG (review item #4, 2026-06-11): unoptype's TK_AMP fn-ident synth
+ * (check.ww ~2677) and assignableaddrfn (check.ww ~4182) looked the fn up
+ * with bare scopelookup — no (name,module) preference. scopedefineinmodule
+ * PREPENDS, so a LATER module's same-leaf fn heads the bucket chain and the
+ * bare lookup binds ITS signature. Two faces:
+ *   - LOUD: `let p: *hfn = &handler` in beta (hfn = fn(i32)i32, beta.handler
+ *     is i32->i32) is REJECTED by wwstage ("let: not assignable") because it
+ *     binds gamma.handler(str)str, while cstage (scope_lookup_prefer with
+ *     cur_mod, check.c:410/1305) binds beta.handler and accepts. Valid code
+ *     wrongly rejected.
+ *   - SILENT (cat-A): `let p: *gfn = &handler` where gfn = fn(str)str (the
+ *     FOREIGN sig) is REJECTED by cstage (beta.handler is i32->i32, not
+ *     assignable) but ACCEPTED by wwstage (it binds gamma.handler(str)str,
+ *     which matches gfn) — a type-confused fn pointer (LEAQ beta.handler
+ *     into a *fn(str)str slot) in a green build.
+ * THE FIX: both sites use scopelookupprefer(c.cur, c.curmod, ...).
+ *
+ *   row    | shape                                   | result (cs==ww)
+ *   -------+-----------------------------------------+-----------------
+ *   loud   | *hfn = &handler (own-sig slot)          | run 42 (was ww reject)
+ *   silent | *gfn = &handler (foreign-sig slot)      | build FAIL (was ww ok)
+ *
+ * Single-file multi-package source is the sanctioned shape (cmd/ww/main.c).
+ * want = -1 means "build must fail on both stages".
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	{ "loud",
+	  "package beta;\n"
+	  "export type hfn = fn(x: i32) i32;\n"
+	  "export fn handler(x: i32) i32 = { return x + 41; };\n"
+	  "export fn usebeta() i32 = {\n"
+	  "	let p: *hfn = &handler;\n"
+	  "	return (*p)(1);\n"
+	  "};\n"
+	  "package gamma;\n"
+	  "export fn handler(s: str) str = { return s; };\n"
+	  "package main;\n"
+	  "import beta;\n"
+	  "import gamma;\n"
+	  "fn main() int = { return beta.usebeta(): int; };\n",
+	  42 },
+
+	{ "silent",
+	  "package beta;\n"
+	  "export type gfn = fn(s: str) str;\n"
+	  "export fn handler(x: i32) i32 = { return x + 41; };\n"
+	  "export fn usebeta() i32 = {\n"
+	  "	let p: *gfn = &handler;\n"
+	  "	if (p == p) { return 1; };\n"
+	  "	return 0;\n"
+	  "};\n"
+	  "package gamma;\n"
+	  "export fn handler(s: str) str = { return s; };\n"
+	  "package main;\n"
+	  "import beta;\n"
+	  "import gamma;\n"
+	  "fn main() int = { return beta.usebeta(): int; };\n",
+	  -1 },
+};
+
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/afc_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/afc_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;	/* -1 == build failed */
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+	int have_ww = (access(wdrv, X_OK) == 0);
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int i = 0; i < n; i++) {
+		total++;
+		int gc = run_build(cdrv, &rows[i], i);
+		if (gc != rows[i].want) {
+			fprintf(stderr, "ampfncollide[cstage][%s]: got=%d want=%d\n",
+			    rows[i].label, gc, rows[i].want);
+			fail++;
+		}
+		if (!have_ww) {
+			fprintf(stderr, "ampfncollide: skip wwstage (no %s)\n", wdrv);
+			continue;
+		}
+		int gw = run_build(wdrv, &rows[i], i);
+		if (gw != gc) {
+			fprintf(stderr, "ampfncollide[%s]: cs=%d != ww=%d "
+			    "(&fn cross-module same-leaf misbind — #4 c2)\n",
+			    rows[i].label, gc, gw);
+			fail++;
+		}
+		if (gw != rows[i].want) {
+			fprintf(stderr, "ampfncollide[wwstage][%s]: got=%d want=%d\n",
+			    rows[i].label, gw, rows[i].want);
+			fail++;
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "ampfncollide_run: %d/%d checks failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("ampfncollide_run: %d/%d ok\n", total, total);
+	return 0;
+}