wcc/check: #23 reject untyped-int into nested-union variant (wwstage align to cstage)

isassignable's untyped-int arm fell through *confident=false/return true,
silently accepting an untyped int into a union whose variant is itself a
nested (non-flattened) union; ww emitted tag=0 (wrong arm) where cstage
louds. Reject unless a direct variant is numeric-or-enum (N_TENUM accept
mirrors cstage type_isnum). Faithful flatten+rebox deferred (nominal
identity, post-CSP). test/wcc/835 (new) + Makefile.

Makefile

@@ -259,6 +259,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_overlong_arrlit \
 	  $(BIN)/test_tuple_elem_overlong \
 	  $(BIN)/test_tagged_arr_variant \
+	  $(BIN)/test_nested_union_int_box \
 	  $(BIN)/test_inferred_array_global \
 	  $(BIN)/test_slice_str_global_arg \
 	  $(BIN)/test_slice_str_global_zero \
@@ -730,6 +731,12 @@ $(BIN)/test_tagged_arr_variant: test/wcc/834_tagged_arr_variant.c $(BIN)/ww \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_nested_union_int_box: test/wcc/835_nested_union_int_box.c $(BIN)/ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_inferred_array_global: test/wcc/833_inferred_array_global.c $(BIN)/ww \
 		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
 		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \

selfhost/cmd/w6c/main.combined.ww

@@ -14084,11 +14084,27 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = {
 				let vu: *node = resolvealias(c, unwrapbang(v));
 				if (vu != nil) {
 					if (isnumerictname(vu)) { return true; };
+					// mirror cstage type_isnum(enum)=true (type.c:201 ->
+					// type_isint -> :178 TY_ENUM); an enum variant DOES
+					// accept an untyped int. Without this the #23 fix would
+					// flip an enum-variant union to reject while cstage
+					// accepts = a NEW divergence (A3 trap).
+					if (vu.kind == nkind.N_TENUM) { return true; };
 				};
 				v = v.next;
 			};
-			*confident = false;
+			// #23: no DIRECT variant accepts an untyped int -> confident
-			return true;
+			// reject (mirror cstage type.c:343 `return 0`). ww does NOT
+			// flatten a nested union variant (#199-alpha non-drill); an int
+			// reachable only via a nested union (e.g. (inner|str),
+			// inner=(int|bool)) would otherwise silently build tag=0/payload
+			// with no inner-tag wrapper = malformed box. *confident is
+			// already true (:3777, untouched on this path) so the caller
+			// sees ok=false,conf=true -> loud errnotassign. DEFERRED
+			// divergence (task #23 / #199b): both stages then over-reject
+			// valid Hare (expand_tagged flattens); faithful flatten+rebox
+			// is post-CSP nominal-identity work.
+			return false;
 		};
 		// Known non-numeric primitive: confidently wrong.
 		if (du.kind == nkind.N_TNAME) {

selfhost/cmd/wcc/check.ww

@@ -3803,11 +3803,27 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = {
 				let vu: *node = resolvealias(c, unwrapbang(v));
 				if (vu != nil) {
 					if (isnumerictname(vu)) { return true; };
+					// mirror cstage type_isnum(enum)=true (type.c:201 ->
+					// type_isint -> :178 TY_ENUM); an enum variant DOES
+					// accept an untyped int. Without this the #23 fix would
+					// flip an enum-variant union to reject while cstage
+					// accepts = a NEW divergence (A3 trap).
+					if (vu.kind == nkind.N_TENUM) { return true; };
 				};
 				v = v.next;
 			};
-			*confident = false;
+			// #23: no DIRECT variant accepts an untyped int -> confident
-			return true;
+			// reject (mirror cstage type.c:343 `return 0`). ww does NOT
+			// flatten a nested union variant (#199-alpha non-drill); an int
+			// reachable only via a nested union (e.g. (inner|str),
+			// inner=(int|bool)) would otherwise silently build tag=0/payload
+			// with no inner-tag wrapper = malformed box. *confident is
+			// already true (:3777, untouched on this path) so the caller
+			// sees ok=false,conf=true -> loud errnotassign. DEFERRED
+			// divergence (task #23 / #199b): both stages then over-reject
+			// valid Hare (expand_tagged flattens); faithful flatten+rebox
+			// is post-CSP nominal-identity work.
+			return false;
 		};
 		// Known non-numeric primitive: confidently wrong.
 		if (du.kind == nkind.N_TNAME) {

selfhost/cmd/wwdump/main.combined.ww

@@ -14084,11 +14084,27 @@ fn isassignable(c: *checker, dst: *node, src: *node, confident: *bool) bool = {
 				let vu: *node = resolvealias(c, unwrapbang(v));
 				if (vu != nil) {
 					if (isnumerictname(vu)) { return true; };
+					// mirror cstage type_isnum(enum)=true (type.c:201 ->
+					// type_isint -> :178 TY_ENUM); an enum variant DOES
+					// accept an untyped int. Without this the #23 fix would
+					// flip an enum-variant union to reject while cstage
+					// accepts = a NEW divergence (A3 trap).
+					if (vu.kind == nkind.N_TENUM) { return true; };
 				};
 				v = v.next;
 			};
-			*confident = false;
+			// #23: no DIRECT variant accepts an untyped int -> confident
-			return true;
+			// reject (mirror cstage type.c:343 `return 0`). ww does NOT
+			// flatten a nested union variant (#199-alpha non-drill); an int
+			// reachable only via a nested union (e.g. (inner|str),
+			// inner=(int|bool)) would otherwise silently build tag=0/payload
+			// with no inner-tag wrapper = malformed box. *confident is
+			// already true (:3777, untouched on this path) so the caller
+			// sees ok=false,conf=true -> loud errnotassign. DEFERRED
+			// divergence (task #23 / #199b): both stages then over-reject
+			// valid Hare (expand_tagged flattens); faithful flatten+rebox
+			// is post-CSP nominal-identity work.
+			return false;
 		};
 		// Known non-numeric primitive: confidently wrong.
 		if (du.kind == nkind.N_TNAME) {

test/wcc/835_nested_union_int_box.c

@@ -0,0 +1,263 @@
+/*
+ * 835_nested_union_int_box — two reject-align fixes in the nested-union /
+ * widen-subset family. Both close SILENT wwstage miscompiles by aligning
+ * ww DOWN to cstage's existing loud.
+ *
+ * #23 (drew spec .ai/drew-23-spec.md) — a bare untyped-int return/assign
+ * into a tagged union with NO DIRECT variant able to hold an int (the int
+ * is reachable only via a NESTED union, or no slot exists at all). ww's
+ * isuntypedint tagged sub-loop fell through to a permissive `*confident=
+ * false; return true;` so the caller never flagged it — ww silently built
+ * a tag=0/payload box with no inner-tag wrapper (malformed). The fix:
+ * confident-reject when no direct variant is numeric-or-enum (mirror
+ * cstage type.c:343 `return 0`), routing through errnotassign. An ENUM
+ * variant is kept ACCEPTED (new N_TENUM check, mirrors cstage type_isnum
+ * (enum)=true) — A3 is the trap: dropping it would flip an enum-variant
+ * union to reject while cstage accepts. wwstage-ONLY; check.c unchanged.
+ *
+ *   neg row      | shape                                          | gate
+ *   -------------+------------------------------------------------+------
+ *   R1_nested    | inner=(int|bool); outer=(inner|str); ret 5     | FAIL
+ *   R2_noslot    | u=(str|bool); ret 5                            | FAIL
+ *   R3_struct    | A=struct{v:int}; u=(A|str); ret 5             | FAIL
+ *
+ *   pos row      | shape                                          | want
+ *   -------------+------------------------------------------------+------
+ *   A1_direct    | u=(int|str); ret 5; match int -> n             | 5
+ *   A2_aliased   | myint=int; u=(myint|str); ret 5                | 0
+ *   A3_enum      | col=enum{RED,GREEN}; u=(col|str); ret 5 [trap] | 0
+ *   A4_unionsrc  | outer=(inner|str); mk(x:inner) outer = x       | 0
+ *   A5_subset    | sub=(int|uint); sup=(int|uint|str); ret x      | 0
+ *
+ * Diagnostic TEXT is byte-id-blind (#23 routes through errnotassign "not
+ * assignable"); both stages REJECT and emit no asm.
+ * selfhost has no such construct, so 990-997 byte-id is untouched.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	/* A1 — direct numeric variant; live runtime proof the accept path
+	 * still builds a correct box (match int -> return 5). */
+	{ "A1_direct",
+	  "package main;\n"
+	  "type u = (int | str);\n"
+	  "fn mk() u = { return 5; };\n"
+	  "export fn main() i32 = {\n"
+	  "\tlet v = mk();\n"
+	  "\tmatch (v) {\n"
+	  "\tcase let n: int => return n: i32;\n"
+	  "\tcase str => return 1;\n"
+	  "\t};\n"
+	  "\treturn 9;\n"
+	  "};\n",
+	  5 },
+
+	/* A2 — aliased numeric variant (resolvealias -> int). Compile-only:
+	 * main returns 0; the accept is proven by the build succeeding. */
+	{ "A2_aliased",
+	  "package main;\n"
+	  "type myint = int;\n"
+	  "type u = (myint | str);\n"
+	  "fn mk() u = { return 5; };\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0 },
+
+	/* A3 — enum variant (the trap): the N_TENUM accept keeps this legal,
+	 * mirroring cstage type_isnum(enum). Compile-only. */
+	{ "A3_enum",
+	  "package main;\n"
+	  "type col = enum { RED, GREEN };\n"
+	  "type u = (col | str);\n"
+	  "fn mk() u = { return 5; };\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0 },
+
+	/* A4 — src is a UNION (inner), not an untyped int -> never enters the
+	 * int arm; tagged->tagged direct-variant accept. Compile-only. */
+	{ "A4_unionsrc",
+	  "package main;\n"
+	  "type inner = (int | bool);\n"
+	  "type outer = (inner | str);\n"
+	  "fn mk(x: inner) outer = { return x; };\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0 },
+
+	/* A5 — proper-subset union widen, src union. Compile-only. */
+	{ "A5_subset",
+	  "package main;\n"
+	  "type sub = (int | uint);\n"
+	  "type sup = (int | uint | str);\n"
+	  "fn w(x: sub) sup = { return x; };\n"
+	  "export fn main() i32 = { return 0; };\n",
+	  0 },
+};
+
+/* Each neg must FAIL the build on both stages (loud reject). */
+static const char *neg[] = {
+	/* R1 — #23 canonical: int reachable only via a NESTED union. */
+	"package main;\n"
+	"type inner = (int | bool);\n"
+	"type outer = (inner | str);\n"
+	"fn mk() outer = { return 5; };\n"
+	"export fn main() i32 = { return 0; };\n",
+	/* R2 — no slot for an int at all (same fallthrough). */
+	"package main;\n"
+	"type u = (str | bool);\n"
+	"fn mk() u = { return 5; };\n"
+	"export fn main() i32 = { return 0; };\n",
+	/* R3 — int fits no variant (struct | str). */
+	"package main;\n"
+	"type A = struct { v: int };\n"
+	"type u = (A | str);\n"
+	"fn mk() u = { return 5; };\n"
+	"export fn main() i32 = { return 0; };\n",
+};
+
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/nui_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/nui_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src); rmdir(tmpdir);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+/* build_should_fail — the construct must error on `driver`; returns 0 when
+ * the build correctly FAILS, non-zero when it wrongly succeeded. */
+static int
+build_should_fail(const char *driver, const char *src, int i)
+{
+	char s[64], tmpdir[64], cmd[1024];
+	snprintf(s, sizeof s, "/tmp/nuin_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/nuin_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(s, "wb");
+	if (!f) return -1;
+	fputs(src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, s);
+	int rc = runwait(cmd);
+	unlink(s);
+	const char *base = strrchr(s, '/');
+	base = base ? base + 1 : s;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	unlink(outbin);
+	rmdir(tmpdir);
+	return rc == 0 ? -1 : 0;	/* build must NOT succeed */
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	char wdrv[1024];
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int nn = (int)(sizeof neg / sizeof neg[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr, "nested_union_int_box: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "nested_union_int_box[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+		for (int i = 0; i < nn; i++) {
+			total++;
+			if (build_should_fail(drivers[d].path, neg[i],
+			    100 + i) != 0) {
+				fprintf(stderr,
+				    "nested_union_int_box[%s][neg%d]: built ok, "
+				    "expected a loud reject\n",
+				    drivers[d].name, i);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr,
+		    "nested_union_int_box: %d/%d fixtures failed\n", fail, total);
+		return 1;
+	}
+	printf("nested_union_int_box: %d/%d ok\n", total, total);
+	return 0;
+}