wcc: nullable-global storage is a loud reject pending #15, both stages

A module-level nullable `(*T | void)` GLOBAL has no storage path in
either stage: let_emit_size / letemitsize returned 0 for the nullable
TY_TAGGED, so let_collect skipped registration and emit_lets skipped
DATA. The three READ paths then miscompiled SILENTLY and identically-
wrong (a #263-class both-wrong gap, not a wwstage align-up): match read
0(BP) = saved BP via the let_islet-gated #87 arm falling to localfind;
`g is *T` / `g as *T` emitted MOVQ name(SB) for a symbol with no DATA →
w6l undefined-reference. cstage's #87 match arm was itself `!is_nullable`-
gated, so both stages were wrong.

This is the silent→loud bridge: die loud at the size/storage layer the
instant a nullable global is declared, so all three read paths hit one
diagnostic instead of a silent miscompile. A silent gap here is exactly
what "stable before CSP" forbids — CSP's process/handle/chan singletons
(`let c: *Chan | void`) are THE canonical nullable-global consumer. The
full storage + read-class arc (real DATA, nil/void/address-of init, let-
registration, the three SB-resolution read arms) is deferred to task #15
(CSP-prereq); the `&`-init sub-problem additionally couples to the #48
static address-of relocation gap (which already bites a plain `*T` global
init the same way).

Diagnostic core text is identical both stages ("nullable-global storage
unimplemented (task #15)"); cstage's fatal() adds the harness-wide "ww: "
err.c prefix err.ww does not, the same per-stage asymmetry every existing
both-stage reject carries. Byte-id-neutral: the corpus declares zero
nullable globals (grep-verified), so the loud path is unreached in self-
compile and the emitted asm is zero-move; the embedded w6c/wwdump
combined.ww amalgamations are regenerated for the cgen.ww source change.

New 989_nullableglobal_reject: 6 reject rows (match/is/as on a &gv init,
plus nil-init and void-init match, plus an inline non-aliased nullable
form) prove rc!=0 + the shared diagnostic on both stages, init- and
form-invariant; 2 controls (non-nullable tagged global, plain nil-init
*T global) prove the reject is keyed on the nullable TY_TAGGED and the
#87 storage path is untouched.

Makefile

@@ -252,6 +252,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_catA_f2_reject \
 	  $(BIN)/test_intoverflow_reject \
 	  $(BIN)/test_unknowndecl_reject \
+	  $(BIN)/test_nullableglobal_reject \
 	  $(BIN)/test_idxarg_run \
 	  $(BIN)/test_chainidx_run \
 	  $(BIN)/test_tupfieldsize_run \
@@ -721,6 +722,20 @@ $(BIN)/test_unknowndecl_reject: test/wcc/989_unknowndecl_reject.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+# 989_nullableglobal_reject (#45 silent->loud bridge, task #15 prereq): a
+# module-level nullable `(*T | void)` GLOBAL has no storage path, so a
+# match/is/as on it silently miscompiled (0(BP) read / undefined ref) on
+# BOTH stages. The bridge dies LOUD at the size/storage layer; the full
+# storage + read-class arc is deferred to #15 (CSP handle-singleton
+# prereq). Needs the full cstage + wwstage tool sets plus libwwrt for the
+# control links.
+$(BIN)/test_nullableglobal_reject: test/wcc/989_nullableglobal_reject.c \
+		$(BIN)/ww $(BIN)/ww_ww \
+		$(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 # 989_idxarg_run (F7-c2, #45/#46): an indexed slice/str element passed as
 # a call arg must push its full multi-word header. Builds+runs each fixture
 # on BOTH the cstage `ww` and wwstage `ww_ww` drivers (rule-10), so it needs

cmd/w6c/cgen.c

@@ -1269,10 +1269,18 @@ let_emit_size(Type *t)
 		 * variant init via emit_tagged_data; match-scrutinee reads
 		 * resolve the box at name(SB). Pre-#87 the missing arm sized 0
 		 * → no DATA, no letvar registration, and match read saved BP
-		 * as the tag (SEGV). The nullable `(*T | void)` one-word fold
+		 * as the tag (SEGV).
-		 * stays 0 (handled, when const, by the 8B scalar arm in
+		 * #45 (silent→loud bridge, task #15): a nullable `(*T | void)`
-		 * emit_lets — adding it here would re-route that path). */
+		 * GLOBAL has no storage path. Returning 0 here made let_collect
-		return u->nullable ? 0 : (int)u->size;
+		 * + emit_lets silently skip the decl (no DATA, no letvar reg),
+		 * so a later match read 0(BP) and is/as emitted MOVQ name(SB)
+		 * for an undefined symbol — a silent miscompile in the CSP
+		 * handle-singleton substrate. Die loud at the size/storage layer
+		 * so all three read paths hit one diagnostic; the full storage +
+		 * read-class arc is task #15 (CSP-prereq). */
+		if (u->nullable)
+			fatal("nullable-global storage unimplemented (task #15)");
+		return (int)u->size;
 	default:
 		return 0;
 	}

selfhost/cmd/w6c/main.combined.ww

@@ -41821,11 +41821,22 @@ fn letemitsize(c: *cgen, d: *node) i32 = {
 			return tsum;
 		};
 		// #87: non-nullable tagged-union global — box size (tag word +
-		// max payload, mirror of the runtime local). Nullable stays 0 so
+		// max payload, mirror of the runtime local). Mirrors cstage
-		// the (*T|void) one-word fold keeps the 8B scalar arm in
+		// let_emit_size TY_TAGGED.
-		// emitletdataw. Mirrors cstage let_emit_size TY_TAGGED.
 		if (t.kind == nkind.N_TTAGGED) {
-			if (isnullabletype(t)) { return 0; };
+			// #45 (silent→loud bridge, task #15): a nullable (*T|void)
+			// GLOBAL has no storage path. Returning 0 here made
+			// letcollect + emitletdataw silently skip the decl (no DATA,
+			// no let-registration), so a later match/is/as resolved
+			// 0(BP) or an undefined symbol — a silent miscompile in the
+			// CSP handle-singleton substrate. Die loud at the size/
+			// storage layer so all three read paths hit one diagnostic;
+			// the full storage + read-class arc is task #15 (CSP-prereq).
+			if (isnullabletype(t)) {
+				let mng: str = "nullable-global storage unimplemented (task #15)\n";
+				os.write(2, mng.ptr, mng.len: u64);
+				os.exit(1);
+			};
 			return slotsize(c, t);
 		};
 		if (t.kind != nkind.N_TNAME) { return 0; };

selfhost/cmd/wcc/cgen.ww

@@ -1047,11 +1047,22 @@ fn letemitsize(c: *cgen, d: *node) i32 = {
 			return tsum;
 		};
 		// #87: non-nullable tagged-union global — box size (tag word +
-		// max payload, mirror of the runtime local). Nullable stays 0 so
+		// max payload, mirror of the runtime local). Mirrors cstage
-		// the (*T|void) one-word fold keeps the 8B scalar arm in
+		// let_emit_size TY_TAGGED.
-		// emitletdataw. Mirrors cstage let_emit_size TY_TAGGED.
 		if (t.kind == nkind.N_TTAGGED) {
-			if (isnullabletype(t)) { return 0; };
+			// #45 (silent→loud bridge, task #15): a nullable (*T|void)
+			// GLOBAL has no storage path. Returning 0 here made
+			// letcollect + emitletdataw silently skip the decl (no DATA,
+			// no let-registration), so a later match/is/as resolved
+			// 0(BP) or an undefined symbol — a silent miscompile in the
+			// CSP handle-singleton substrate. Die loud at the size/
+			// storage layer so all three read paths hit one diagnostic;
+			// the full storage + read-class arc is task #15 (CSP-prereq).
+			if (isnullabletype(t)) {
+				let mng: str = "nullable-global storage unimplemented (task #15)\n";
+				os.write(2, mng.ptr, mng.len: u64);
+				os.exit(1);
+			};
 			return slotsize(c, t);
 		};
 		if (t.kind != nkind.N_TNAME) { return 0; };

selfhost/cmd/wwdump/main.combined.ww

@@ -41821,11 +41821,22 @@ fn letemitsize(c: *cgen, d: *node) i32 = {
 			return tsum;
 		};
 		// #87: non-nullable tagged-union global — box size (tag word +
-		// max payload, mirror of the runtime local). Nullable stays 0 so
+		// max payload, mirror of the runtime local). Mirrors cstage
-		// the (*T|void) one-word fold keeps the 8B scalar arm in
+		// let_emit_size TY_TAGGED.
-		// emitletdataw. Mirrors cstage let_emit_size TY_TAGGED.
 		if (t.kind == nkind.N_TTAGGED) {
-			if (isnullabletype(t)) { return 0; };
+			// #45 (silent→loud bridge, task #15): a nullable (*T|void)
+			// GLOBAL has no storage path. Returning 0 here made
+			// letcollect + emitletdataw silently skip the decl (no DATA,
+			// no let-registration), so a later match/is/as resolved
+			// 0(BP) or an undefined symbol — a silent miscompile in the
+			// CSP handle-singleton substrate. Die loud at the size/
+			// storage layer so all three read paths hit one diagnostic;
+			// the full storage + read-class arc is task #15 (CSP-prereq).
+			if (isnullabletype(t)) {
+				let mng: str = "nullable-global storage unimplemented (task #15)\n";
+				os.write(2, mng.ptr, mng.len: u64);
+				os.exit(1);
+			};
 			return slotsize(c, t);
 		};
 		if (t.kind != nkind.N_TNAME) { return 0; };

test/wcc/989_nullableglobal_reject.c

@@ -0,0 +1,277 @@
+/*
+ * 989_nullableglobal_reject — #45 silent->loud bridge (ww-core task #15
+ * prereq). A module-level nullable `(*T | void)` GLOBAL has no storage
+ * path in either stage: letemitsize / let_emit_size returned 0 for the
+ * nullable TY_TAGGED, so let_collect skipped registration and emit_lets
+ * skipped DATA. The three READ paths then miscompiled SILENTLY:
+ *   - match (g)  : cgmatch's #87 arm is let_islet-gated; with no
+ *                  registration it fell to localfind -> read 0(BP) =
+ *                  saved BP (garbage tag).
+ *   - g is *T    : cgtypetest's nullable arm emitted MOVQ name(SB),AX
+ *                  for a symbol with no DATA -> w6l undefined-reference.
+ *   - g as *T    : cgtypeassert, same undefined-reference.
+ * cstage's #87 match arm was ALSO `!is_nullable`-gated, so BOTH stages
+ * were wrong (a #263-class both-wrong gap, not an align-up).
+ *
+ * THE BRIDGE (this commit): die LOUD at the size/storage layer
+ * (let_emit_size:1278 / letemitsize cgen.ww:1054) the instant a nullable
+ * global is declared, so all three read paths hit one diagnostic instead
+ * of a silent miscompile. The full storage + read-class arc (real DATA,
+ * nil/void/address-of init, let-registration, the three SB-resolution
+ * read arms) is deferred to task #15 — it is the CSP handle-singleton
+ * prereq (`let c: *Chan | void`), and a silent gap there is exactly what
+ * "stable before CSP" forbids. Byte-id-neutral: the corpus declares zero
+ * nullable globals (verified by grep), so the loud path is unreached in
+ * self-compile and the emitted asm is zero-move.
+ *
+ * The diagnostic core text is identical on both stages
+ * ("nullable-global storage unimplemented (task #15)"); cstage's fatal()
+ * adds the harness-wide "ww: " prefix (err.c) that err.ww does not — the
+ * same per-stage prefix asymmetry every existing both-stage reject
+ * carries (e.g. the #37 / #48 fatals). The matrix asserts rc!=0 AND the
+ * shared core substring on each driver.
+ *
+ * Reject-matrix idiom (sibling 989_catA_f2_reject.c): a REJECT row must
+ * FAIL to build with the diagnostic on every driver; an ACCEPT control
+ * must build + run to its expected exit. Rows run on cstage `ww` and,
+ * when present, wwstage `ww_ww`; both must agree.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static const char *DIAG = "nullable-global storage unimplemented (task #15)";
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row {
+	const char *label;
+	const char *src;
+	int expect_build;	/* 1 = build+run to want_exit; 0 = must REJECT */
+	int want_exit;
+};
+
+#define NP "type np = (*i64 | void);\nlet gv: i64 = 7;\n"
+
+static const struct row rows[] = {
+	/* match on a nullable global -> loud reject (was: read 0(BP)). */
+	{ "match_nullable_global",
+	  "package main;\n" NP "let g: np = &gv;\n"
+	  "fn ck() int = { match (g) { case let p: *i64 => return (*p): int; "
+	  "case void => return 9; }; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  0, 0 },
+
+	/* `g is *T` on a nullable global -> loud reject (was: undefined ref). */
+	{ "is_nullable_global",
+	  "package main;\n" NP "let g: np = &gv;\n"
+	  "fn ck() int = { if (g is *i64) { return 0; }; return 12; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  0, 0 },
+
+	/* `g as *T` on a nullable global -> loud reject (was: undefined ref). */
+	{ "as_nullable_global",
+	  "package main;\n" NP "let g: np = &gv;\n"
+	  "fn ck() int = { let p: *i64 = g as *i64; return (*p): int; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  0, 0 },
+
+	/* A void-initialised nullable global rejects too — storage is
+	 * unimplemented regardless of the initialiser (the full arc handles
+	 * nil/void as 8 zero bytes; that is task #15). */
+	{ "void_init_nullable_global",
+	  "package main;\n" NP "let g: np = void;\n"
+	  "fn ck() int = { match (g) { case let p: *i64 => return (*p): int; "
+	  "case void => return 9; }; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  0, 0 },
+
+	/* A nil-initialised nullable global rejects too — init-invariant,
+	 * same as void (the storage gate keys on the nullable TY_TAGGED, not
+	 * the initialiser; nil is the silent-match case the reconcile flagged
+	 * alongside void/&gv). */
+	{ "nil_init_nullable_global",
+	  "package main;\n" NP "let g: np = nil;\n"
+	  "fn ck() int = { match (g) { case let p: *i64 => return (*p): int; "
+	  "case void => return 9; }; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  0, 0 },
+
+	/* The INLINE nullable form (no alias) rejects identically — exercises
+	 * the storage gate's direct N_TTAGGED arm rather than the
+	 * alias-resolution hop the other rows take, proving form-invariance. */
+	{ "inline_nullable_global",
+	  "package main;\nlet gv: i64 = 7;\nlet g: (*i64 | void) = &gv;\n"
+	  "fn ck() int = { match (g) { case let p: *i64 => return (*p): int; "
+	  "case void => return 9; }; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  0, 0 },
+
+	/* CONTROL — a NON-nullable tagged global still builds + runs (the
+	 * #87 storage path is untouched). is i64 on g=5 -> 0. */
+	{ "nonnull_tagged_global_ok",
+	  "package main;\n"
+	  "let g: (i64 | bool) = 5;\n"
+	  "fn ck() int = { if (g is i64) { return 0; }; return 12; };\n"
+	  "export fn main() int = { return ck(); };\n",
+	  1, 0 },
+
+	/* CONTROL — a PLAIN `*T` global (not a nullable tagged) still builds +
+	 * runs; the reject is keyed on the nullable TY_TAGGED, not on any
+	 * pointer. nil-init (an address-of init is a separate #48-reloc gap,
+	 * out of scope here). */
+	{ "plain_ptr_global_ok",
+	  "package main;\n"
+	  "let p: *i64 = nil;\n"
+	  "export fn main() int = { if (p == nil) { return 5; }; return 9; };\n",
+	  1, 5 },
+};
+
+static int
+run_build(const char *driver, const struct row *r, int i)
+{
+	char src[64], tmpdir[64], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/nbg_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/nbg_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -2;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>/dev/null",
+	    tmpdir, driver, src);
+	int brc = runwait(cmd);
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+
+	int got = -1;
+	if (brc == 0) got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return brc == 0 ? got : -1;
+}
+
+/* A reject row must (a) fail to build and (b) emit the shared diagnostic
+ * core text. Returns 0 on the expected reject, -1 otherwise. */
+static int
+build_should_reject(const char *driver, const char *src, int i)
+{
+	char s[64], tmpdir[64], errf[80], cmd[1280];
+	snprintf(s, sizeof s, "/tmp/nbn_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/nbn_%d_d_%d", getpid(), i);
+	snprintf(errf, sizeof errf, "/tmp/nbn_%d_%d.err", getpid(), i);
+
+	FILE *f = fopen(s, "wb");
+	if (!f) return -1;
+	fputs(src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s 2>%s",
+	    tmpdir, driver, s, errf);
+	int rc = runwait(cmd);
+
+	int have_diag = 0;
+	FILE *e = fopen(errf, "rb");
+	if (e) {
+		char buf[4096];
+		size_t n = fread(buf, 1, sizeof buf - 1, e);
+		buf[n] = '\0';
+		fclose(e);
+		have_diag = (strstr(buf, DIAG) != NULL);
+	}
+
+	unlink(s); unlink(errf);
+	const char *base = strrchr(s, '/');
+	base = base ? base + 1 : s;
+	char outbin[128];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	unlink(outbin);
+	rmdir(tmpdir);
+
+	/* build must NOT succeed AND the shared diagnostic must appear. */
+	return (rc != 0 && have_diag) ? 0 : -1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[1024], wdrv[1024];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *drv; int gated; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated && access(drivers[d].drv, X_OK) != 0) {
+			fprintf(stderr, "nullableglobal_reject: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].drv);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			total++;
+			if (rows[i].expect_build) {
+				int got = run_build(drivers[d].drv, &rows[i], i);
+				if (got != rows[i].want_exit) {
+					fprintf(stderr, "nullableglobal_reject[%s][%s]: "
+					    "exit=%d want=%d\n", drivers[d].name,
+					    rows[i].label, got, rows[i].want_exit);
+					fail++;
+				}
+			} else {
+				if (build_should_reject(drivers[d].drv, rows[i].src,
+				    100 + i) != 0) {
+					fprintf(stderr, "nullableglobal_reject[%s][%s]: "
+					    "expected a loud reject with \"%s\"\n",
+					    drivers[d].name, rows[i].label, DIAG);
+					fail++;
+				}
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "nullableglobal_reject: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("nullableglobal_reject: %d/%d ok\n", total, total);
+	return 0;
+}