cgen: str N_DOT field read -> 3-word {ptr,len,cap} -- Phase 2 C4.6 (both stages)

Reading a str-typed struct field loaded only 2 words (ptr,len), dropping the cap word. Fold the str-field read onto the adjacent proven slice-field arm by widening its kind-gate to include str (type_isstr/isstrtype, never size==24). Sites: S1 direct struct field (local BP + global CX base) and S2 field through a *struct local (pst.f). cstage==wwstage byte-identical; the slice-field arms stay unchanged for slices.

C4.6 bundles the S1 local-field fold with a FORCED global-field lift -- the rule-11 reason they cannot split: cstage reads a field with ONE unified base_reg arm, so folding str covers local AND global together. For byte-id, ww's global field path must then lift in the SAME commit -- but ww splits local/global and its global arm has no slice sibling, so it is authored as ww's own local slice-field arm retargeted to the CX base (cap->CX last, base survives). The underlying cstage-unifies / ww-splits field-arm divergence is a separate filed structural follow-up, not resolved here.

test/wcc/933: table-driven runtime .cap-survives over local/global/*struct field reads, both drivers; verified fail-before/pass-after. The local-field row interposes a CX-clobbering call so a 2-word read cannot coincidentally pass on stale CX (the field store otherwise leaves the cap word lingering in CX).

main.combined.ww regenerated via the canonical make path (md5-stable), per the 1140a59 precedent.

Makefile

@@ -255,6 +255,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_match_slice_variant_run \
 	  $(BIN)/test_str_abi_run \
 	  $(BIN)/test_str_elem_cap_run \
+	  $(BIN)/test_str_field_cap_run \
 	  $(BIN)/test_composite_call_arg \
 	  $(BIN)/test_composite_call_arg_run \
 	  $(BIN)/test_letdecl_zeroinit \
@@ -627,6 +628,12 @@ $(BIN)/test_str_elem_cap_run: test/wcc/932_str_elem_cap_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
 
+$(BIN)/test_str_field_cap_run: test/wcc/933_str_field_cap_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \
 		$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<

cmd/w6c/cgen.c

@@ -5891,24 +5891,16 @@ cgexpr(Cg *c, Node *n, Local *locals)
 					(void)is_global;
 					break;
 				}
-				/* str field: load (ptr, len) into (AX, BX) so the
+				/* str IS []u8 — same 3-word {ptr,len,cap} as a slice
-				 * value flows through the str-rhs convention. */
+				 * field: load (ptr, len, cap) into (AX, BX, CX) so the
-				Type *str_fu = (f->type && f->type->kind == TY_NAMED)
+				 * value flows through the slice-rhs convention. str
-				    ? f->type->under : f->type;
+				 * folds onto the slice arm (#1/Phase 3 collapse).
-				if (str_fu && str_fu->kind == TY_STR) {
-					ins2(c, A_MOVQ,
-					    amem(base_reg, base_disp + (int)f->offset + 0),
-					    areg(D_AX));
-					ins2(c, A_MOVQ,
-					    amem(base_reg, base_disp + (int)f->offset + 8),
-					    areg(D_BX));
-					break;
-				}
-				/* slice field: load (ptr, len, cap) into (AX, BX, CX)
-				 * so the value flows through the slice-rhs convention.
 				 * base_reg may be CX for globals; load .cap LAST so
 				 * the base survives the earlier reads. */
-				if (str_fu && str_fu->kind == TY_SLICE) {
+				Type *str_fu = (f->type && f->type->kind == TY_NAMED)
+				    ? f->type->under : f->type;
+				if ((str_fu && str_fu->kind == TY_SLICE) ||
+				    type_isstr(f->type)) {
 					ins2(c, A_MOVQ,
 					    amem(base_reg, base_disp + (int)f->offset + 0),
 					    areg(D_AX));
@@ -6008,27 +6000,16 @@ cgexpr(Cg *c, Node *n, Local *locals)
 							    areg(D_R8));
 						break;
 					}
-					/* str field through *struct: read len into a
+					/* str IS []u8 — same 3-word {ptr,len,cap} as a
-					 * scratch first (it's at +8) so loading ptr
+					 * slice field through *struct: load (ptr, len,
-					 * into AX last leaves (AX=ptr, BX=len). We
-					 * use CX as the scratch, then move CX→BX. */
-					Type *str_fu = (f->type && f->type->kind == TY_NAMED)
-					    ? f->type->under : f->type;
-					if (str_fu && str_fu->kind == TY_STR) {
-						ins2(c, A_MOVQ,
-						    amem(D_BX, (int)f->offset + 8),
-						    areg(D_CX));
-						ins2(c, A_MOVQ,
-						    amem(D_BX, (int)f->offset + 0),
-						    areg(D_AX));
-						ins2(c, A_MOVQ, areg(D_CX), areg(D_BX));
-						break;
-					}
-					/* slice field through *struct: load (ptr, len,
 					 * cap) into (AX, BX, CX). BX holds the *struct
 					 * pointer, so load .len LAST — the earlier loads
-					 * still index off the original base. */
+					 * still index off the original base. str folds
-					if (str_fu && str_fu->kind == TY_SLICE) {
+					 * onto the slice arm (#1/Phase 3 collapse). */
+					Type *str_fu = (f->type && f->type->kind == TY_NAMED)
+					    ? f->type->under : f->type;
+					if ((str_fu && str_fu->kind == TY_SLICE) ||
+					    type_isstr(f->type)) {
 						ins2(c, A_MOVQ,
 						    amem(D_BX, (int)f->offset + 0),
 						    areg(D_AX));

selfhost/cmd/w6c/main.combined.ww

@@ -15195,26 +15195,18 @@ fn cgdot(c: *cgen, n: *node) void = {
 										    fi.foff, tsz);
 										return;
 									};
-									// str field via *struct: load len into a
+									// str IS []u8 — same 3-word {ptr,len,cap}
-									// scratch first (so loading ptr into AX
+									// as a slice field via *struct: load
-									// last leaves (AX=ptr, BX=len)).
+									// (ptr, len, cap) into (AX, BX, CX). BX
+									// holds the *struct pointer, so load .len
+									// LAST so the earlier reads still index
+									// off the base. str folds onto the slice
+									// arm (#1/Phase 3 collapse; cite cstage
+									// cgen.c N_DOT *struct S2).
 									emitline("\tMOVQ\t");
 									emitoff(lc.off: i64);
 									emitline("(BP), BX\n");
-									if (isstrtype(c, fi.tnode)) {
+									if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
-										emitline("\tMOVQ\t");
-										emitdispreg((fi.foff + 8): i64, "BX");
-										emitline(", CX\n");
-										emitline("\tMOVQ\t");
-										emitdispreg(fi.foff: i64, "BX");
-										emitline(", AX\n");
-										emitline("\tMOVQ\tCX, BX\n");
-									} else { if (isslicetype(c, fi.tnode)) {
-										// slice field via *struct: load
-										// (ptr, len, cap) into (AX, BX, CX).
-										// BX holds the *struct pointer, so
-										// load .len LAST so the earlier
-										// reads still index off the base.
 										emitline("\tMOVQ\t");
 										emitdispreg(fi.foff: i64, "BX");
 										emitline(", AX\n");
@@ -15244,7 +15236,7 @@ fn cgdot(c: *cgen, n: *node) void = {
 										emitline("\t");
 										emitdispreg(fi.foff: i64, "BX");
 										emitline(", AX\n");
-									}; }; };
+									}; };
 									return;
 								};
 								fi = fi.finext;
@@ -15279,19 +15271,13 @@ fn cgdot(c: *cgen, n: *node) void = {
 									    lc.off + fi.foff, tsz);
 									return;
 								};
-								// str field: load both halves so chained
+								// str IS []u8 — same 3-word {ptr,len,cap}
-								// `.ptr` / `.len` see (AX=ptr, BX=len).
+								// as a slice field: load (ptr, len, cap)
-								if (isstrtype(c, fi.tnode)) {
+								// into (AX, BX, CX). Base is BP so no
-									emitline("\tMOVQ\t");
+								// aliasing — order doesn't matter. str
-									emitoff((lc.off + fi.foff): i64);
+								// folds onto the slice arm (#1/Phase 3
-									emitline("(BP), AX\n");
+								// collapse; cite cstage cgen.c N_DOT S1).
-									emitline("\tMOVQ\t");
+								if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
-									emitoff((lc.off + fi.foff + 8): i64);
-									emitline("(BP), BX\n");
-								} else { if (isslicetype(c, fi.tnode)) {
-									// slice field: load (ptr, len, cap)
-									// into (AX, BX, CX). Base is BP so
-									// no aliasing — order doesn't matter.
 									emitline("\tMOVQ\t");
 									emitoff((lc.off + fi.foff): i64);
 									emitline("(BP), AX\n");
@@ -15317,7 +15303,7 @@ fn cgdot(c: *cgen, n: *node) void = {
 									emitline("\t");
 									emitoff((lc.off + fi.foff): i64);
 									emitline("(BP), AX\n");
-								}; }; };
+								}; };
 								return;
 							};
 							fi = fi.finext;
@@ -15509,6 +15495,12 @@ fn cgdot(c: *cgen, n: *node) void = {
 							cgloadtaggedfield(c, "CX", fi.foff, tsz);
 							return;
 						};
+						// str IS []u8 — 3-word {ptr,len,cap}, the local
+						// slice-field arm (BP) retargeted to the CX global
+						// base. cap→CX LAST: CX is the base, so .ptr/.len
+						// must read first. cstage folds local+global in one
+						// base_reg arm; ww splits them, so this global arm
+						// carries its own lift (filed divergence task).
 						if (isstrtype(c, fi.tnode)) {
 							emitline("\tMOVQ\t");
 							emitdispreg(fi.foff: i64, "CX");
@@ -15516,6 +15508,9 @@ fn cgdot(c: *cgen, n: *node) void = {
 							emitline("\tMOVQ\t");
 							emitdispreg((fi.foff + 8): i64, "CX");
 							emitline(", BX\n");
+							emitline("\tMOVQ\t");
+							emitdispreg((fi.foff + 16): i64, "CX");
+							emitline(", CX\n");
 						} else { if (isfloattype(c, fi.tnode)) {
 							// f64/f32 global field: route through X0.
 							let mov: str = "MOVSD";

selfhost/cmd/wcc/cgenexpr.ww

@@ -1367,26 +1367,18 @@ fn cgdot(c: *cgen, n: *node) void = {
 										    fi.foff, tsz);
 										return;
 									};
-									// str field via *struct: load len into a
+									// str IS []u8 — same 3-word {ptr,len,cap}
-									// scratch first (so loading ptr into AX
+									// as a slice field via *struct: load
-									// last leaves (AX=ptr, BX=len)).
+									// (ptr, len, cap) into (AX, BX, CX). BX
+									// holds the *struct pointer, so load .len
+									// LAST so the earlier reads still index
+									// off the base. str folds onto the slice
+									// arm (#1/Phase 3 collapse; cite cstage
+									// cgen.c N_DOT *struct S2).
 									emitline("\tMOVQ\t");
 									emitoff(lc.off: i64);
 									emitline("(BP), BX\n");
-									if (isstrtype(c, fi.tnode)) {
+									if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
-										emitline("\tMOVQ\t");
-										emitdispreg((fi.foff + 8): i64, "BX");
-										emitline(", CX\n");
-										emitline("\tMOVQ\t");
-										emitdispreg(fi.foff: i64, "BX");
-										emitline(", AX\n");
-										emitline("\tMOVQ\tCX, BX\n");
-									} else { if (isslicetype(c, fi.tnode)) {
-										// slice field via *struct: load
-										// (ptr, len, cap) into (AX, BX, CX).
-										// BX holds the *struct pointer, so
-										// load .len LAST so the earlier
-										// reads still index off the base.
 										emitline("\tMOVQ\t");
 										emitdispreg(fi.foff: i64, "BX");
 										emitline(", AX\n");
@@ -1416,7 +1408,7 @@ fn cgdot(c: *cgen, n: *node) void = {
 										emitline("\t");
 										emitdispreg(fi.foff: i64, "BX");
 										emitline(", AX\n");
-									}; }; };
+									}; };
 									return;
 								};
 								fi = fi.finext;
@@ -1451,19 +1443,13 @@ fn cgdot(c: *cgen, n: *node) void = {
 									    lc.off + fi.foff, tsz);
 									return;
 								};
-								// str field: load both halves so chained
+								// str IS []u8 — same 3-word {ptr,len,cap}
-								// `.ptr` / `.len` see (AX=ptr, BX=len).
+								// as a slice field: load (ptr, len, cap)
-								if (isstrtype(c, fi.tnode)) {
+								// into (AX, BX, CX). Base is BP so no
-									emitline("\tMOVQ\t");
+								// aliasing — order doesn't matter. str
-									emitoff((lc.off + fi.foff): i64);
+								// folds onto the slice arm (#1/Phase 3
-									emitline("(BP), AX\n");
+								// collapse; cite cstage cgen.c N_DOT S1).
-									emitline("\tMOVQ\t");
+								if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
-									emitoff((lc.off + fi.foff + 8): i64);
-									emitline("(BP), BX\n");
-								} else { if (isslicetype(c, fi.tnode)) {
-									// slice field: load (ptr, len, cap)
-									// into (AX, BX, CX). Base is BP so
-									// no aliasing — order doesn't matter.
 									emitline("\tMOVQ\t");
 									emitoff((lc.off + fi.foff): i64);
 									emitline("(BP), AX\n");
@@ -1489,7 +1475,7 @@ fn cgdot(c: *cgen, n: *node) void = {
 									emitline("\t");
 									emitoff((lc.off + fi.foff): i64);
 									emitline("(BP), AX\n");
-								}; }; };
+								}; };
 								return;
 							};
 							fi = fi.finext;
@@ -1681,6 +1667,12 @@ fn cgdot(c: *cgen, n: *node) void = {
 							cgloadtaggedfield(c, "CX", fi.foff, tsz);
 							return;
 						};
+						// str IS []u8 — 3-word {ptr,len,cap}, the local
+						// slice-field arm (BP) retargeted to the CX global
+						// base. cap→CX LAST: CX is the base, so .ptr/.len
+						// must read first. cstage folds local+global in one
+						// base_reg arm; ww splits them, so this global arm
+						// carries its own lift (filed divergence task).
 						if (isstrtype(c, fi.tnode)) {
 							emitline("\tMOVQ\t");
 							emitdispreg(fi.foff: i64, "CX");
@@ -1688,6 +1680,9 @@ fn cgdot(c: *cgen, n: *node) void = {
 							emitline("\tMOVQ\t");
 							emitdispreg((fi.foff + 8): i64, "CX");
 							emitline(", BX\n");
+							emitline("\tMOVQ\t");
+							emitdispreg((fi.foff + 16): i64, "CX");
+							emitline(", CX\n");
 						} else { if (isfloattype(c, fi.tnode)) {
 							// f64/f32 global field: route through X0.
 							let mov: str = "MOVSD";

selfhost/cmd/wwdump/main.combined.ww

@@ -15195,26 +15195,18 @@ fn cgdot(c: *cgen, n: *node) void = {
 										    fi.foff, tsz);
 										return;
 									};
-									// str field via *struct: load len into a
+									// str IS []u8 — same 3-word {ptr,len,cap}
-									// scratch first (so loading ptr into AX
+									// as a slice field via *struct: load
-									// last leaves (AX=ptr, BX=len)).
+									// (ptr, len, cap) into (AX, BX, CX). BX
+									// holds the *struct pointer, so load .len
+									// LAST so the earlier reads still index
+									// off the base. str folds onto the slice
+									// arm (#1/Phase 3 collapse; cite cstage
+									// cgen.c N_DOT *struct S2).
 									emitline("\tMOVQ\t");
 									emitoff(lc.off: i64);
 									emitline("(BP), BX\n");
-									if (isstrtype(c, fi.tnode)) {
+									if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
-										emitline("\tMOVQ\t");
-										emitdispreg((fi.foff + 8): i64, "BX");
-										emitline(", CX\n");
-										emitline("\tMOVQ\t");
-										emitdispreg(fi.foff: i64, "BX");
-										emitline(", AX\n");
-										emitline("\tMOVQ\tCX, BX\n");
-									} else { if (isslicetype(c, fi.tnode)) {
-										// slice field via *struct: load
-										// (ptr, len, cap) into (AX, BX, CX).
-										// BX holds the *struct pointer, so
-										// load .len LAST so the earlier
-										// reads still index off the base.
 										emitline("\tMOVQ\t");
 										emitdispreg(fi.foff: i64, "BX");
 										emitline(", AX\n");
@@ -15244,7 +15236,7 @@ fn cgdot(c: *cgen, n: *node) void = {
 										emitline("\t");
 										emitdispreg(fi.foff: i64, "BX");
 										emitline(", AX\n");
-									}; }; };
+									}; };
 									return;
 								};
 								fi = fi.finext;
@@ -15279,19 +15271,13 @@ fn cgdot(c: *cgen, n: *node) void = {
 									    lc.off + fi.foff, tsz);
 									return;
 								};
-								// str field: load both halves so chained
+								// str IS []u8 — same 3-word {ptr,len,cap}
-								// `.ptr` / `.len` see (AX=ptr, BX=len).
+								// as a slice field: load (ptr, len, cap)
-								if (isstrtype(c, fi.tnode)) {
+								// into (AX, BX, CX). Base is BP so no
-									emitline("\tMOVQ\t");
+								// aliasing — order doesn't matter. str
-									emitoff((lc.off + fi.foff): i64);
+								// folds onto the slice arm (#1/Phase 3
-									emitline("(BP), AX\n");
+								// collapse; cite cstage cgen.c N_DOT S1).
-									emitline("\tMOVQ\t");
+								if (isstrtype(c, fi.tnode) || isslicetype(c, fi.tnode)) {
-									emitoff((lc.off + fi.foff + 8): i64);
-									emitline("(BP), BX\n");
-								} else { if (isslicetype(c, fi.tnode)) {
-									// slice field: load (ptr, len, cap)
-									// into (AX, BX, CX). Base is BP so
-									// no aliasing — order doesn't matter.
 									emitline("\tMOVQ\t");
 									emitoff((lc.off + fi.foff): i64);
 									emitline("(BP), AX\n");
@@ -15317,7 +15303,7 @@ fn cgdot(c: *cgen, n: *node) void = {
 									emitline("\t");
 									emitoff((lc.off + fi.foff): i64);
 									emitline("(BP), AX\n");
-								}; }; };
+								}; };
 								return;
 							};
 							fi = fi.finext;
@@ -15509,6 +15495,12 @@ fn cgdot(c: *cgen, n: *node) void = {
 							cgloadtaggedfield(c, "CX", fi.foff, tsz);
 							return;
 						};
+						// str IS []u8 — 3-word {ptr,len,cap}, the local
+						// slice-field arm (BP) retargeted to the CX global
+						// base. cap→CX LAST: CX is the base, so .ptr/.len
+						// must read first. cstage folds local+global in one
+						// base_reg arm; ww splits them, so this global arm
+						// carries its own lift (filed divergence task).
 						if (isstrtype(c, fi.tnode)) {
 							emitline("\tMOVQ\t");
 							emitdispreg(fi.foff: i64, "CX");
@@ -15516,6 +15508,9 @@ fn cgdot(c: *cgen, n: *node) void = {
 							emitline("\tMOVQ\t");
 							emitdispreg((fi.foff + 8): i64, "CX");
 							emitline(", BX\n");
+							emitline("\tMOVQ\t");
+							emitdispreg((fi.foff + 16): i64, "CX");
+							emitline(", CX\n");
 						} else { if (isfloattype(c, fi.tnode)) {
 							// f64/f32 global field: route through X0.
 							let mov: str = "MOVSD";

test/wcc/933_str_field_cap_run.c

@@ -0,0 +1,197 @@
+/*
+ * 933_str_field_cap_run — runtime coverage for the C4.6 fold: reading a
+ * str-typed FIELD of a struct (N_DOT value read) must load the full 24B
+ * {ptr,len,cap} header, not just {ptr,len}. str is 24B since Phase 2 (#1);
+ * pre-C4.6 the N_DOT str-field arms loaded 2 words and dropped cap.
+ *
+ * The byte-id gates (990-997) can't catch a symmetric 2-word miscompile:
+ * if both stages drop cap identically, byte-id passes silently. So this
+ * pins the *runtime* contract — build each fixture through both the cstage
+ * `ww` and the wwstage `ww_ww` driver and confirm the assertions hold
+ * (exit 0). The global row is the load-bearing case: in ww the global
+ * struct-field load is a separate arm with no slice sibling (cstage folds
+ * local+global in one base_reg arm; ww splits them), so a cap-drop there
+ * would hide from the local-field rows.
+ *
+ * Each row POISONS the source str so cap != len (a `.cap =` pseudo-field
+ * write, no malloc / no import — self-contained, so ww_ww writes
+ * intermediates only next to the /tmp source). A 2-word field read leaves
+ * cap = stale, so the read-back .cap mismatches the poison and the row
+ * fails. The cap word is observed through `let s: str = <field>` (a 3-word
+ * copy into the slot) then `s.cap` (an N_IDENT pseudo-field read off the
+ * slot) — mirrors the 932 observation shape.
+ *
+ * Sites (C4.6 S1 + S2, case A):
+ *   - s1local  : `st.f` — direct struct local field (base BP).
+ *   - s1global : `g.f`  — direct struct global field (base CX).
+ *   - s2ptr    : `pst.f` — field via a *struct local (base BX, deref).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	/* S1 local — `st.f` direct struct local field. Poison cap=8
+	 * (len=2). spoil() interposes a call between the field store and
+	 * the read: a call clobbers caller-saved CX, so a broken 2-word
+	 * read leaves cap = spoil's leftover (44), not the lingering store
+	 * value — without it CX would coincidentally still hold the poison
+	 * the `st.f = p` store left behind and the row wouldn't discriminate. */
+	{ "s1local_field",
+	  "type rec = struct { f: str };\n"
+	  "fn spoil() i32 = {\n"
+	  "    let z: str = \"zzzz\";\n"
+	  "    z.cap = 44i32;\n"
+	  "    let w: str = z;\n"
+	  "    return w.cap: i32;\n"
+	  "};\n"
+	  "export fn main() i32 = {\n"
+	  "    let p: str = \"hi\";\n"
+	  "    p.cap = 8i32;\n"
+	  "    let st: rec;\n"
+	  "    st.f = p;\n"
+	  "    let junk: i32 = spoil();\n"
+	  "    let s: str = st.f;\n"
+	  "    if (s.cap: i32 != 8) { return 1; };\n"
+	  "    if (s.len: i32 != 2) { return 2; };\n"
+	  "    if (junk != 44) { return 3; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+	/* S1 global — `g.f` direct struct global field (base CX path).
+	 * The no-local-sibling arm in ww; poison cap=9 (len=5). */
+	{ "s1global_field",
+	  "type rec = struct { f: str };\n"
+	  "let g: rec;\n"
+	  "export fn main() i32 = {\n"
+	  "    let p: str = \"world\";\n"
+	  "    p.cap = 9i32;\n"
+	  "    g.f = p;\n"
+	  "    let s: str = g.f;\n"
+	  "    if (s.cap: i32 != 9) { return 1; };\n"
+	  "    if (s.len: i32 != 5) { return 2; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+	/* S2 case A — `pst.f` field via a *struct local (deref, base BX).
+	 * Poison cap=7 (len=3). */
+	{ "s2ptr_field",
+	  "type rec = struct { f: str };\n"
+	  "export fn main() i32 = {\n"
+	  "    let p: str = \"abc\";\n"
+	  "    p.cap = 7i32;\n"
+	  "    let st: rec;\n"
+	  "    st.f = p;\n"
+	  "    let pst: *rec = &st;\n"
+	  "    let s: str = pst.f;\n"
+	  "    if (s.cap: i32 != 7) { return 1; };\n"
+	  "    if (s.len: i32 != 3) { return 2; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+};
+
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[96], tmpdir[96], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/strfieldcap_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/strfieldcap_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src); rmdir(tmpdir);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[160];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[512];
+	if (bin[0] != '/') {
+		char cwd[256];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[640];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	char wdrv[640];
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr,
+			    "str_field_cap_run: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "str_field_cap_run[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "str_field_cap_run: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("str_field_cap_run: %d/%d ok\n", total, total);
+	return 0;
+}