lib/ww/parse: error on unknown top-level decl in parsefile fallback (#55)

parsefile's recovery fallback chewed an unrecognized top-level
construct to the next ';' without emitting an error or bumping p.errs,
so a typo'd keyword / stray token silently vanished from the AST and
the build succeeded rc=0 with the declared work gone — no link error
catches a dropped @test or unreferenced exported fn. The C twin
(parse.c:1395-1400) errorf+p->errs++ and rejects. Emit errmsg in the
fallback arm; wwstage now rejects in lockstep with cstage.

lib/ww embeds into the w6c/wwdump combined.ww snapshots; both regen'd.
989_unknowndecl_reject pins the reject-matrix on both driver twins.

Makefile

@@ -250,6 +250,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_callarg_typecheck \
 	  $(BIN)/test_catA_f2_reject \
 	  $(BIN)/test_intoverflow_reject \
+	  $(BIN)/test_unknowndecl_reject \
 	  $(BIN)/test_idxarg_run \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_tupfieldsize_run \
@@ -697,6 +698,17 @@ $(BIN)/test_intoverflow_reject: test/wcc/989_intoverflow_reject.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_unknowndecl_reject (F14 #55): an unrecognized top-level construct
+# must FAIL to build on BOTH driver twins (wwstage's parsefile fallback
+# silently chewed it with no error). Needs the full cstage + wwstage tool
+# sets plus libwwrt for the control links.
+$(BIN)/test_unknowndecl_reject: test/wcc/989_unknowndecl_reject.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_idxarg_run (F7-c2, #45/#46): an indexed slice/str element passed as
 # a call arg must push its full multi-word header. Builds+runs each fixture
 # on BOTH the cstage `ww` and wwstage `ww_ww` drivers (rule-10), so it needs

lib/ww/parse/parse.ww

@@ -445,6 +445,11 @@ export fn parsefile(p: *parser) *node = {
 		} else { if (p.curkind == tkind.TK_FN) {
 			d = parsefn(p, exported, attrs);
 		} else {
+			// cstage parse.c:1395-1400 errorf+p->errs++ on the
+			// default arm: an unknown top-level construct is a loud
+			// reject, not a silent skip. ww chews the whole decl at
+			// once (below), so one error per fallback entry.
+			errmsg(p, "expected top-level decl");
 			// Recovery: chew tokens until next ';' or EOF, balancing
 			// '{' '}' pairs so internal ';'s in unfamiliar forms don't
 			// derail us.

selfhost/cmd/w6c/main.combined.ww

@@ -9035,6 +9035,11 @@ export fn parsefile(p: *parser) *node = {
 		} else { if (p.curkind == tkind.TK_FN) {
 			d = parsefn(p, exported, attrs);
 		} else {
+			// cstage parse.c:1395-1400 errorf+p->errs++ on the
+			// default arm: an unknown top-level construct is a loud
+			// reject, not a silent skip. ww chews the whole decl at
+			// once (below), so one error per fallback entry.
+			errmsg(p, "expected top-level decl");
 			// Recovery: chew tokens until next ';' or EOF, balancing
 			// '{' '}' pairs so internal ';'s in unfamiliar forms don't
 			// derail us.

selfhost/cmd/wwdump/main.combined.ww

@@ -9035,6 +9035,11 @@ export fn parsefile(p: *parser) *node = {
 		} else { if (p.curkind == tkind.TK_FN) {
 			d = parsefn(p, exported, attrs);
 		} else {
+			// cstage parse.c:1395-1400 errorf+p->errs++ on the
+			// default arm: an unknown top-level construct is a loud
+			// reject, not a silent skip. ww chews the whole decl at
+			// once (below), so one error per fallback entry.
+			errmsg(p, "expected top-level decl");
 			// Recovery: chew tokens until next ';' or EOF, balancing
 			// '{' '}' pairs so internal ';'s in unfamiliar forms don't
 			// derail us.

test/wcc/989_unknowndecl_reject.c

@@ -0,0 +1,204 @@
+/*
+ * 989_unknowndecl_reject — F14 #55: parsefile's recovery fallback
+ * (lib/ww/parse/parse.ww) chewed an unrecognized top-level construct to
+ * the next ';' WITHOUT emitting an error or bumping p.errs, so a typo'd
+ * keyword / stray token / stray decl was silently dropped from the AST
+ * and the build succeeded rc=0 with the work gone. The C twin
+ * (parse.c:1395-1400) emits errorf("expected top-level decl") + p->errs++
+ * and rejects. The fix calls errmsg in the fallback arm, aligning wwstage
+ * UP to cstage.
+ *
+ * Each REJECT row carries an unknown top-level construct and must FAIL to
+ * build on BOTH driver twins; each control is well-formed and must
+ * build+run. The fn-drop row is the live silent-loss case (a whole
+ * declared fn vanished with no diagnostic pre-fix).
+ *
+ * Rule-10: every row runs on cstage `ww` and wwstage `ww_ww`; both must
+ * agree. wwstage rows are gated on out/bin/ww_ww.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int expect_build;	/* 1 = build+run to want_exit; 0 = must FAIL */
+	int want_exit;
+};
+
+static const struct row rows[] = {
+	/* REJECT — a misspelled `fn` keyword: the whole decl was silently
+	 * dropped pre-fix (grep -c helper of the .s gave 0). */
+	{ "misspelled_fn",
+	  "package main;\n"
+	  "fnn helper() i32 = { return 42; };\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0, 0 },
+
+	/* REJECT — a stray run of bare identifiers at top level. */
+	{ "stray_idents",
+	  "package main;\n"
+	  "bogus token here;\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0, 0 },
+
+	/* REJECT — a stray decl whose body has internal ';'s, exercising the
+	 * brace-balanced chew recovery (still must error, not silently skip). */
+	{ "stray_block",
+	  "package main;\n"
+	  "gizmo foo { let a = 1; let b = 2; };\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0, 0 },
+
+	/* control — a clean program builds + runs. */
+	{ "clean_ok",
+	  "package main;\n"
+	  "fn helper() i32 = { return 5; };\n"
+	  "export fn main() i32 = { return helper(); };\n",
+	  1, 5 },
+
+	/* control — a valid def/type/fn mix builds + runs. */
+	{ "decls_ok",
+	  "package main;\n"
+	  "def K: i32 = 3;\n"
+	  "type t = i32;\n"
+	  "export fn main() i32 = { let x: t = K; return x: i32; };\n",
+	  1, 3 },
+};
+
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/und_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/und_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+static int
+build_should_fail(const char *driver, const char *src, int i)
+{
+	char s[64], tmpdir[64], cmd[1024];
+	snprintf(s, sizeof s, "/tmp/undn_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/undn_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(s, "wb");
+	if (!f) return -1;
+	fputs(src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, s);
+	int rc = runwait(cmd);
+
+	unlink(s);
+	const char *base = strrchr(s, '/');
+	base = base ? base + 1 : s;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	unlink(outbin);
+	rmdir(tmpdir);
+	return rc == 0 ? -1 : 0;	/* build must NOT succeed */
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *drv; int gated; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
+			fprintf(stderr, "unknowndecl_reject: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].drv);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			total++;
+			if (rows[i].expect_build) {
+				int got = run_build(drivers[d].drv, &rows[i], i);
+				if (got != rows[i].want_exit) {
+					fprintf(stderr, "unknowndecl_reject[%s][%s]: "
+					    "exit=%d want=%d\n", drivers[d].name,
+					    rows[i].label, got, rows[i].want_exit);
+					fail++;
+				}
+			} else {
+				if (build_should_fail(drivers[d].drv, rows[i].src,
+				    100 + i) != 0) {
+					fprintf(stderr, "unknowndecl_reject[%s][%s]: "
+					    "built ok, expected a loud reject\n",
+					    drivers[d].name, rows[i].label);
+					fail++;
+				}
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "unknowndecl_reject: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("unknowndecl_reject: %d/%d ok\n", total, total);
+	return 0;
+}