wcc: arm asserttyped bail — a nil-typed value node is now fatal

The wwstage asserttyped pass only WARNED on a checked value-node with no
result type_, a check-bail-discipline regression that let gate-blind nil-stamp
miscompiles ship green (the whole #6 arc: tuple/struct/fn-ptr/enum/binding
nil-stamps were all invisible to the byte-id gates). With every nil-gap class
now stamped (module-qual calls, fn-ptr-field calls, computed enum value-exprs,
for-range/massign binds) the bail can finally arm: warn -> os.exit(1).

Exempt exactly the two legitimately-no-type value classes, each a positive
cited assertion (never a residual warn): the EXPR_ASSERT family (abort/assert,
guarded against a user shadow; harec check.c:877,893) and seeded pseudo-builtin
callees (len/append/free/alloc/size — a structural nil-decl-SK_FN predicate,
not a name-list). The pre-existing module-ref and dot-lhs filters stay: they
identify access-path components that aren't value exprs (harec EXPR_ACCESS),
not exemptions.

Verified clean over the broadest net — the armed checker over all five
self-build combined units (the full selfhost source) plus the 901 gap corpus —
zero out-of-class bail; fails-loud confirmed (undeclared call, abort's args, a
nil dot-base all bail). Checker-only: 990-997 byte-id hold.

selfhost/cmd/wwdump/main.combined.ww

@@ -12118,7 +12118,8 @@ fn indexresult(c: *checker, e: *node) *node = {
 // asserttyped pass at L2871 enforces the invariant on every
 // dispatched node post-checker, with gates for the residual
 // inherent-IDENT bails (SK_USE, pseudo-builtin sym.decl==nil,
-// N_DOT-LHS syntactic position) until #19 retires the bail shape.
+// N_DOT-LHS syntactic position, EXPR_ASSERT-family abort/assert) until
+// #19 retires the bail shape.
 fn exprtype(c: *checker, e: *node, hint: *node) *node = {
 	if (e == nil) { return nil; };
 	let k: nkind = e.kind;
@@ -13586,13 +13587,33 @@ fn resolvefnbody(c: *checker, fnnode: *node) void = {
 	c.cur = outer;
 };
 
+// isassertfam — `abort`/`assert` are language builtins, not value
+// calls. harec models each as a dedicated EXPR_ASSERT whose result is
+// builtin void (assert) or never (bare abort) at
+// ref/harec/src/check.c:877,893; there is no callee ident, so nothing
+// is left untyped. wwstage parses them as an N_CALL over a bare
+// N_IDENT callee that binds to no decl, so both the call and its
+// callee carry no type by design. Recognized exactly as the cstage
+// builtin intercept (cmd/wcc/check.c:1314,1328): the reserved name
+// with no shadowing user symbol.
+fn isassertfam(c: *checker, id: *node) bool = {
+	if (id == nil) { return false; };
+	if (id.kind != nkind.N_IDENT) { return false; };
+	if (!streq(id.str, "abort") && !streq(id.str, "assert")) {
+		return false;
+	};
+	return scopelookupprefer(c.cur, c.curmod, id.str) == nil;
+};
+
 // asserttyped — post-checker invariant gate (#15, A.6.2.1e). Walks the
-// file tree and fires (writes a one-line diagnostic to stderr) for any
-// node in resolvewalk's value-producing dispatch set (L474-489) whose
-// n.type_ remained nil. Mirror of harec's `assert(expr->result)` at
-// ref/harec/src/check.c:3810 — wwstage's checker is lenient (rule 7),
-// so this is a soft assertion (diagnostic, not abort) used by the
-// 990_selfhost probes to catch regressions in the stamping discipline.
+// file tree and fires for any node in resolvewalk's value-producing
+// dispatch set (L474-489) whose n.type_ remained nil. Mirror of harec's
+// `assert(expr->result)` at ref/harec/src/check.c:3810. The invariant
+// is ARMED: a non-exempt nil-typed value node writes its one-line
+// diagnostic to stderr and bails (os.exit 1), so a stamping regression
+// fails loud rather than shipping a partially-typed tree. The
+// 990_selfhost / 901 probes drive the wwstage checker over the resolved
+// units that exercise this gate.
 //
 // Gates (per Drew 2026-05-22 — "guards value-producing expression
 // nodes; SK_USE refs and bare builtin callees are syntactic positions,
@@ -13612,6 +13633,11 @@ fn resolvefnbody(c: *checker, fnnode: *node) void = {
 //      name half of a member-access expr is a lookup target, not a
 //      value-producing sub-expression. Harec's EXPR_ACCESS stores the
 //      member as a string, not a node.
+//   4. The EXPR_ASSERT family — an N_CALL whose callee is `abort` or
+//      `assert`, and the bare N_IDENT callee itself (see isassertfam).
+//      harec's EXPR_ASSERT carries a void/never result with no callee
+//      ident (ref/harec/src/check.c:877,893); wwstage's
+//      N_CALL-over-bare-ident shape leaves both nodes nil by design.
 //
 // `indot` tracks gate 3: true only when the immediate caller is an
 // N_DOT recursing into its .lhs.
@@ -13643,6 +13669,10 @@ fn asserttyped(c: *checker, n: *node, indot: bool) void = {
 				if (s.decl == nil) { skip = true; };
 			};
 		};
+		if (!skip) { if (isassertfam(c, n)) { skip = true; }; };
+	};
+	if (isexpr && k == nkind.N_CALL) {
+		if (isassertfam(c, n.lhs)) { skip = true; };
 	};
 	if (isexpr && !skip) {
 		if (n.type_ == nil) {
@@ -13662,6 +13692,7 @@ fn asserttyped(c: *checker, n: *node, indot: bool) void = {
 				os.write(2, "'".ptr, 1u64);
 			};
 			os.write(2, "\n".ptr, 1u64);
+			os.exit(1);
 		};
 	};
 	if (k == nkind.N_DOT) {