cgen: str N_INDEX read -> 3-word {ptr,len,cap} -- Phase 2 F2 (both stages)

str element value read at N_INDEX dropped the cap word (2-word ptr,len load); str is 24B {ptr,len,cap} since 1140a59. A new named helper cgslicehdr (both stages) loads the full 3-word header and is called by the N_INDEX str-element sites, kind-gated type_isstr/elemisstr -- never size==24, since str and slice collide at 24B. The base-targeting word loads last (clobber-safe). cstage==wwstage byte-identical. The #9 typeassert leaf is split out to F2b (it needs a wwstage spill twin first). test/wcc/932: table-driven runtime .cap-survives probe over both N_INDEX base forms and both drivers; verified fail-before/pass-after. NNN<950 mirrors the 928 precedent -- the fixtures are self-contained (/tmp, no imports), so rule-14's selfhost-sibling race does not apply. main.combined.ww regenerated via the canonical make path (md5-stable) and committed alongside source, per the 1140a59 precedent.
2026-05-24 12:27:15 +09:00
parent fb4c567e0d
commit 97707155ae
7 changed files with 318 additions and 53 deletions
--- a/7
+++ b/7
@@ -254,6 +254,7 @@ TESTS	= $(BIN)/test_smoke $(BIN)/test_lex $(BIN)/test_parse $(BIN)/test_check \
 	  $(BIN)/test_match_slice_variant \
 	  $(BIN)/test_match_slice_variant_run \
 	  $(BIN)/test_str_abi_run \
+	  $(BIN)/test_str_elem_cap_run \
 	  $(BIN)/test_composite_call_arg \
 	  $(BIN)/test_composite_call_arg_run \
 	  $(BIN)/test_letdecl_zeroinit \
@@ -620,6 +621,12 @@ $(BIN)/test_str_abi_run: test/wcc/928_str_abi_run.c \
 		$(LIB)/libwwrt.a | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<

+$(BIN)/test_str_elem_cap_run: test/wcc/932_str_elem_cap_run.c \
+		$(BIN)/ww $(BIN)/w6c $(BIN)/w6a $(BIN)/w6l \
+		$(BIN)/ww_ww $(BIN)/w6c_ww $(BIN)/w6a_ww $(BIN)/w6l_ww \
+		$(LIB)/libwwrt.a | $(BIN)
+	$(CC) $(CFLAGS) -o $@ $<
+
 $(BIN)/test_composite_call_arg: test/wcc/723_composite_call_arg.c \
 		$(BIN)/w6c $(BIN)/w6c_ww | $(BIN)
 	$(CC) $(CFLAGS) -o $@ $<
--- a/cmd/w6c/cgen.c
+++ b/cmd/w6c/cgen.c
@@ -1078,6 +1078,23 @@ label(Cg *c, const char *s)
 	emit(c, p);
 }

+/* cgslicehdr — load the 24B slice/str header at `base`+0 into the
+ * (AX=ptr, BX=len, CX=cap) triple. `base` holds the element address;
+ * the load that targets `base` destroys it, so that word is emitted
+ * LAST. Order otherwise mirrors the slice-FIELD arm (len, cap, ptr).
+ * Shared by the N_INDEX str-element arms (caller does the kind-gate)
+ * and, later, the typeassert str-variant leaf (#9). */
+static void
+cgslicehdr(Cg *c, int base)
+{
+	if (base != D_BX) ins2(c, A_MOVQ, amem(base, 8), areg(D_BX));
+	if (base != D_CX) ins2(c, A_MOVQ, amem(base, 16), areg(D_CX));
+	if (base != D_AX) ins2(c, A_MOVQ, amem(base, 0), areg(D_AX));
+	if (base == D_BX) ins2(c, A_MOVQ, amem(base, 8), areg(D_BX));
+	else if (base == D_CX) ins2(c, A_MOVQ, amem(base, 16), areg(D_CX));
+	else if (base == D_AX) ins2(c, A_MOVQ, amem(base, 0), areg(D_AX));
+}
+
 /* ------------------------------------------------------------------ */
 /* per-fn local table: name → stack offset (positive = below FP) */

@@ -6257,12 +6274,13 @@ cgexpr(Cg *c, Node *n, Local *locals)
 				ins2(c, A_MOVQ, amem(D_BP, off), areg(D_BX));
 			}
 			ins2(c, A_ADDQ, areg(D_AX), areg(D_BX));
-			/* str element: load (ptr, len) into (AX, BX) so the
-			 * value flows through the str-rhs convention. */
+			/* str element: load the full (ptr, len, cap) header
+			 * into (AX, BX, CX) — str is 24B since #1, so the cap
+			 * word must survive. Kind-gate on type_isstr, never
+			 * size==24 (slices are 24B too; a size gate bleeds into
+			 * the general >16B struct path, #10). Base is BX. */
 			if (u->sub && type_isstr(u->sub)) {
-				ins2(c, A_MOVQ, amem(D_BX, 8), areg(D_CX));
-				ins2(c, A_MOVQ, amem(D_BX, 0), areg(D_AX));
-				ins2(c, A_MOVQ, areg(D_CX), areg(D_BX));
+				cgslicehdr(c, D_BX);
 				break;
 			}
 			/* tagged element: load slot words into (AX=tag,
@@ -6305,10 +6323,11 @@ cgexpr(Cg *c, Node *n, Local *locals)
 		cgexpr(c, n->lhs, locals);
 		ins1(c, A_POPQ, areg(D_BX));
 		ins2(c, A_ADDQ, areg(D_BX), areg(D_AX));
-		/* str element: load (ptr, len) into (AX, BX). */
+		/* str element via fallback base: load the full (ptr, len,
+		 * cap) header into (AX, BX, CX). Kind-gate on type_isstr,
+		 * never size==24 (see Site A). Base is AX. */
 		if (u && u->sub && type_isstr(u->sub)) {
-			ins2(c, A_MOVQ, amem(D_AX, 8), areg(D_BX));
-			ins2(c, A_MOVQ, amem(D_AX, 0), areg(D_AX));
+			cgslicehdr(c, D_AX);
 			break;
 		}
 		/* tagged element via fallback base: AX holds the element
--- a/selfhost/cmd/w6c/main.combined.ww
+++ b/selfhost/cmd/w6c/main.combined.ww
@@ -14527,6 +14527,22 @@ fn cgident(c: *cgen, n: *node) void = {
 	return;
 };

+// cgslicehdr — load the 24B slice/str header at base+0 into the
+// (AX=ptr, BX=len, CX=cap) triple. base holds the element address;
+// the load that targets base destroys it, so that word is emitted
+// LAST. Order otherwise mirrors the slice-field arm (len, cap, ptr).
+// Shared by the cgindex str-element arms (caller does the kind-gate)
+// and, later, the typeassert str-variant leaf (#9). c retained unused
+// for callsite symmetry with cstage cgslicehdr.
+fn cgslicehdr(c: *cgen, base: str) void = {
+	if (!streq(base, "BX")) { emitmovqload(8i64, base, "BX"); };
+	if (!streq(base, "CX")) { emitmovqload(16i64, base, "CX"); };
+	if (!streq(base, "AX")) { emitmovqload(0i64, base, "AX"); };
+	if (streq(base, "BX")) { emitmovqload(8i64, base, "BX"); };
+	if (streq(base, "CX")) { emitmovqload(16i64, base, "CX"); };
+	if (streq(base, "AX")) { emitmovqload(0i64, base, "AX"); };
+};
+
 fn cgindex(c: *cgen, n: *node) void = {
 	// Element-size-aware load: u8 → MOVZBQ, i32 → MOVSXD, u32 → MOVL,
 	// str → (ptr, len) into (AX, BX), everything else → MOVQ. Fast
@@ -14665,12 +14681,11 @@ fn cgindex(c: *cgen, n: *node) void = {
 			emitline("\tMOVQ\t(BX), AX\n");
 			return;
 		};
-		// #43: str element-stride routes through primtypesize so the
-		// 16-vs-24 dispatch tracks ty_str.size for #1.
+		// str element: load the full (ptr, len, cap) header into
+		// (AX, BX, CX) — str is 24B since #1, so cap must survive.
+		// Kind-gate on isstrtype, never size==24. Base is BX.
 		if (elemisstr) {
-			emitline("\tMOVQ\t8(BX), CX\n");
-			emitline("\tMOVQ\t(BX), AX\n");
-			emitline("\tMOVQ\tCX, BX\n");
+			cgslicehdr(c, "BX");
 			return;
 		};
 		let lop1: str = loadopsz(signed_elem, esz);
@@ -14706,13 +14721,10 @@ fn cgindex(c: *cgen, n: *node) void = {
 			emitline("\tMOVQ\t(BX), AX\n");
 			return;
 		};
-		// str element (16B today): load (ptr, len) into (AX, BX) so
-		// the value flows through the str-rhs convention.
-		// #43: route via primtypesize so the stride tracks #1.
+		// str element: full (ptr, len, cap) header into (AX, BX, CX);
+		// cap must survive (#1). Kind-gate, never size==24. Base BX.
 		if (elemisstr) {
-			emitline("\tMOVQ\t8(BX), CX\n");
-			emitline("\tMOVQ\t(BX), AX\n");
-			emitline("\tMOVQ\tCX, BX\n");
+			cgslicehdr(c, "BX");
 			return;
 		};
 		let lop2: str = loadopsz(signed_elem, esz);
@@ -14739,11 +14751,11 @@ fn cgindex(c: *cgen, n: *node) void = {
 		emitline("\tMOVQ\t(BX), AX\n");
 		return;
 	};
-	// #43: str element-stride routes through primtypesize so the
-	// 16-vs-24 dispatch tracks ty_str.size for #1.
+	// str element via fallback base: full (ptr, len, cap) header
+	// into (AX, BX, CX); cap must survive (#1). Kind-gate, never
+	// size==24. Base AX.
 	if (elemisstr) {
-		emitline("\tMOVQ\t8(AX), BX\n");
-		emitline("\tMOVQ\t(AX), AX\n");
+		cgslicehdr(c, "AX");
 		return;
 	};
 	let lop3: str = loadopsz(signed_elem, esz);
@@ -22725,6 +22737,16 @@ fn emitdispreg(off: i64, reg: str) void = {
 	emitline(")");
 };

+// emitmovqload — `MOVQ off(base), dst`, the per-word unit of a
+// 3-word slice/str header load (cgslicehdr).
+fn emitmovqload(off: i64, base: str, dst: str) void = {
+	emitline("\tMOVQ\t");
+	emitdispreg(off, base);
+	emitline(", ");
+	emitline(dst);
+	emitline("\n");
+};
+
 // emitoff — print an integer offset, suppressing it entirely when 0.
 // Use before any emitline("(BP)...") or emitline("(SB)...") sequence.
 // Plan 9 cc convention: "(BP)" not "0(BP)".
--- a/selfhost/cmd/wcc/cgen.ww
+++ b/selfhost/cmd/wcc/cgen.ww
@@ -747,6 +747,16 @@ fn emitdispreg(off: i64, reg: str) void = {
 	emitline(")");
 };

+// emitmovqload — `MOVQ off(base), dst`, the per-word unit of a
+// 3-word slice/str header load (cgslicehdr).
+fn emitmovqload(off: i64, base: str, dst: str) void = {
+	emitline("\tMOVQ\t");
+	emitdispreg(off, base);
+	emitline(", ");
+	emitline(dst);
+	emitline("\n");
+};
+
 // emitoff — print an integer offset, suppressing it entirely when 0.
 // Use before any emitline("(BP)...") or emitline("(SB)...") sequence.
 // Plan 9 cc convention: "(BP)" not "0(BP)".
--- a/selfhost/cmd/wcc/cgenexpr.ww
+++ b/selfhost/cmd/wcc/cgenexpr.ww
@@ -699,6 +699,22 @@ fn cgident(c: *cgen, n: *node) void = {
 	return;
 };

+// cgslicehdr — load the 24B slice/str header at base+0 into the
+// (AX=ptr, BX=len, CX=cap) triple. base holds the element address;
+// the load that targets base destroys it, so that word is emitted
+// LAST. Order otherwise mirrors the slice-field arm (len, cap, ptr).
+// Shared by the cgindex str-element arms (caller does the kind-gate)
+// and, later, the typeassert str-variant leaf (#9). c retained unused
+// for callsite symmetry with cstage cgslicehdr.
+fn cgslicehdr(c: *cgen, base: str) void = {
+	if (!streq(base, "BX")) { emitmovqload(8i64, base, "BX"); };
+	if (!streq(base, "CX")) { emitmovqload(16i64, base, "CX"); };
+	if (!streq(base, "AX")) { emitmovqload(0i64, base, "AX"); };
+	if (streq(base, "BX")) { emitmovqload(8i64, base, "BX"); };
+	if (streq(base, "CX")) { emitmovqload(16i64, base, "CX"); };
+	if (streq(base, "AX")) { emitmovqload(0i64, base, "AX"); };
+};
+
 fn cgindex(c: *cgen, n: *node) void = {
 	// Element-size-aware load: u8 → MOVZBQ, i32 → MOVSXD, u32 → MOVL,
 	// str → (ptr, len) into (AX, BX), everything else → MOVQ. Fast
@@ -837,12 +853,11 @@ fn cgindex(c: *cgen, n: *node) void = {
 			emitline("\tMOVQ\t(BX), AX\n");
 			return;
 		};
-		// #43: str element-stride routes through primtypesize so the
-		// 16-vs-24 dispatch tracks ty_str.size for #1.
+		// str element: load the full (ptr, len, cap) header into
+		// (AX, BX, CX) — str is 24B since #1, so cap must survive.
+		// Kind-gate on isstrtype, never size==24. Base is BX.
 		if (elemisstr) {
-			emitline("\tMOVQ\t8(BX), CX\n");
-			emitline("\tMOVQ\t(BX), AX\n");
-			emitline("\tMOVQ\tCX, BX\n");
+			cgslicehdr(c, "BX");
 			return;
 		};
 		let lop1: str = loadopsz(signed_elem, esz);
@@ -878,13 +893,10 @@ fn cgindex(c: *cgen, n: *node) void = {
 			emitline("\tMOVQ\t(BX), AX\n");
 			return;
 		};
-		// str element (16B today): load (ptr, len) into (AX, BX) so
-		// the value flows through the str-rhs convention.
-		// #43: route via primtypesize so the stride tracks #1.
+		// str element: full (ptr, len, cap) header into (AX, BX, CX);
+		// cap must survive (#1). Kind-gate, never size==24. Base BX.
 		if (elemisstr) {
-			emitline("\tMOVQ\t8(BX), CX\n");
-			emitline("\tMOVQ\t(BX), AX\n");
-			emitline("\tMOVQ\tCX, BX\n");
+			cgslicehdr(c, "BX");
 			return;
 		};
 		let lop2: str = loadopsz(signed_elem, esz);
@@ -911,11 +923,11 @@ fn cgindex(c: *cgen, n: *node) void = {
 		emitline("\tMOVQ\t(BX), AX\n");
 		return;
 	};
-	// #43: str element-stride routes through primtypesize so the
-	// 16-vs-24 dispatch tracks ty_str.size for #1.
+	// str element via fallback base: full (ptr, len, cap) header
+	// into (AX, BX, CX); cap must survive (#1). Kind-gate, never
+	// size==24. Base AX.
 	if (elemisstr) {
-		emitline("\tMOVQ\t8(AX), BX\n");
-		emitline("\tMOVQ\t(AX), AX\n");
+		cgslicehdr(c, "AX");
 		return;
 	};
 	let lop3: str = loadopsz(signed_elem, esz);
--- a/selfhost/cmd/wwdump/main.combined.ww
+++ b/selfhost/cmd/wwdump/main.combined.ww
@@ -14527,6 +14527,22 @@ fn cgident(c: *cgen, n: *node) void = {
 	return;
 };

+// cgslicehdr — load the 24B slice/str header at base+0 into the
+// (AX=ptr, BX=len, CX=cap) triple. base holds the element address;
+// the load that targets base destroys it, so that word is emitted
+// LAST. Order otherwise mirrors the slice-field arm (len, cap, ptr).
+// Shared by the cgindex str-element arms (caller does the kind-gate)
+// and, later, the typeassert str-variant leaf (#9). c retained unused
+// for callsite symmetry with cstage cgslicehdr.
+fn cgslicehdr(c: *cgen, base: str) void = {
+	if (!streq(base, "BX")) { emitmovqload(8i64, base, "BX"); };
+	if (!streq(base, "CX")) { emitmovqload(16i64, base, "CX"); };
+	if (!streq(base, "AX")) { emitmovqload(0i64, base, "AX"); };
+	if (streq(base, "BX")) { emitmovqload(8i64, base, "BX"); };
+	if (streq(base, "CX")) { emitmovqload(16i64, base, "CX"); };
+	if (streq(base, "AX")) { emitmovqload(0i64, base, "AX"); };
+};
+
 fn cgindex(c: *cgen, n: *node) void = {
 	// Element-size-aware load: u8 → MOVZBQ, i32 → MOVSXD, u32 → MOVL,
 	// str → (ptr, len) into (AX, BX), everything else → MOVQ. Fast
@@ -14665,12 +14681,11 @@ fn cgindex(c: *cgen, n: *node) void = {
 			emitline("\tMOVQ\t(BX), AX\n");
 			return;
 		};
-		// #43: str element-stride routes through primtypesize so the
-		// 16-vs-24 dispatch tracks ty_str.size for #1.
+		// str element: load the full (ptr, len, cap) header into
+		// (AX, BX, CX) — str is 24B since #1, so cap must survive.
+		// Kind-gate on isstrtype, never size==24. Base is BX.
 		if (elemisstr) {
-			emitline("\tMOVQ\t8(BX), CX\n");
-			emitline("\tMOVQ\t(BX), AX\n");
-			emitline("\tMOVQ\tCX, BX\n");
+			cgslicehdr(c, "BX");
 			return;
 		};
 		let lop1: str = loadopsz(signed_elem, esz);
@@ -14706,13 +14721,10 @@ fn cgindex(c: *cgen, n: *node) void = {
 			emitline("\tMOVQ\t(BX), AX\n");
 			return;
 		};
-		// str element (16B today): load (ptr, len) into (AX, BX) so
-		// the value flows through the str-rhs convention.
-		// #43: route via primtypesize so the stride tracks #1.
+		// str element: full (ptr, len, cap) header into (AX, BX, CX);
+		// cap must survive (#1). Kind-gate, never size==24. Base BX.
 		if (elemisstr) {
-			emitline("\tMOVQ\t8(BX), CX\n");
-			emitline("\tMOVQ\t(BX), AX\n");
-			emitline("\tMOVQ\tCX, BX\n");
+			cgslicehdr(c, "BX");
 			return;
 		};
 		let lop2: str = loadopsz(signed_elem, esz);
@@ -14739,11 +14751,11 @@ fn cgindex(c: *cgen, n: *node) void = {
 		emitline("\tMOVQ\t(BX), AX\n");
 		return;
 	};
-	// #43: str element-stride routes through primtypesize so the
-	// 16-vs-24 dispatch tracks ty_str.size for #1.
+	// str element via fallback base: full (ptr, len, cap) header
+	// into (AX, BX, CX); cap must survive (#1). Kind-gate, never
+	// size==24. Base AX.
 	if (elemisstr) {
-		emitline("\tMOVQ\t8(AX), BX\n");
-		emitline("\tMOVQ\t(AX), AX\n");
+		cgslicehdr(c, "AX");
 		return;
 	};
 	let lop3: str = loadopsz(signed_elem, esz);
@@ -22725,6 +22737,16 @@ fn emitdispreg(off: i64, reg: str) void = {
 	emitline(")");
 };

+// emitmovqload — `MOVQ off(base), dst`, the per-word unit of a
+// 3-word slice/str header load (cgslicehdr).
+fn emitmovqload(off: i64, base: str, dst: str) void = {
+	emitline("\tMOVQ\t");
+	emitdispreg(off, base);
+	emitline(", ");
+	emitline(dst);
+	emitline("\n");
+};
+
 // emitoff — print an integer offset, suppressing it entirely when 0.
 // Use before any emitline("(BP)...") or emitline("(SB)...") sequence.
 // Plan 9 cc convention: "(BP)" not "0(BP)".
--- a/test/wcc/932_str_elem_cap_run.c
+++ b/test/wcc/932_str_elem_cap_run.c
@@ -0,0 +1,173 @@
+/*
+ * 932_str_elem_cap_run — runtime coverage for the F2 fold: a str-element
+ * VALUE read via N_INDEX must load the full 24B {ptr,len,cap} header, not
+ * just {ptr,len}. str is 24B since Phase 2 (#1); pre-F2 the N_INDEX
+ * str-element arms dropped the cap word.
+ *
+ * The existing byte-id gates (990-997) can't catch a no-op fold here: a
+ * shared 2-word miscompile passes byte-id silently. So this pins the
+ * *runtime* contract — build each fixture through both the cstage `ww`
+ * and the wwstage `ww_ww` driver and confirm the program's assertions
+ * hold (exit 0).
+ *
+ * Each row POISONS the element so cap != len (a `.cap =` pseudo-field
+ * write, no malloc / no import — keeps the fixture self-contained so
+ * ww_ww writes intermediates only next to the /tmp source, not lib/).
+ * A 2-word read leaves cap = len (Site A) or a stale slice-cap (Site B),
+ * so the read-back .cap mismatches the poisoned value and the row fails.
+ *
+ * Both N_INDEX base forms are covered:
+ *   - Site A: N_IDENT base — `xs[0]` on a local `[N]str`.
+ *   - Site B: fallback base — `b.items[0]` where the base `b.items` is
+ *     an N_DOT (slice field), not a plain ident.
+ *
+ * The cap word is observed through `let e: str = <index>` (a 3-word
+ * copy into the slot) then `e.cap` (an N_IDENT pseudo-field read off the
+ * slot). A direct `<index>.cap` would NOT observe it — the non-ident
+ * .cap N_DOT path only handles .ptr/.len today (a separate gap, out of
+ * F2's scope).
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return -1;
+}
+
+struct row { const char *label; const char *src; int want; };
+
+static const struct row rows[] = {
+	/* Site A — N_IDENT base. Poison cap=8 (len=2), read back via a
+	 * local [2]str. Broken 2-word read leaves cap = len = 2. */
+	{ "sitea_ident_base",
+	  "export fn main() i32 = {\n"
+	  "    let p: str = \"hi\";\n"
+	  "    p.cap = 8i32;\n"
+	  "    let xs: [2]str;\n"
+	  "    xs[0] = p;\n"
+	  "    let e: str = xs[0];\n"
+	  "    if (e.cap: i32 != 8) { return 1; };\n"
+	  "    if (e.len: i32 != 2) { return 2; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+	/* Site B — fallback base. Element behind an N_DOT slice field, so
+	 * the N_INDEX base isn't a plain ident. Poison cap=9 (len=5).
+	 * Broken read leaves cap = the slice header's own cap, not the
+	 * element's. */
+	{ "siteb_fallback_base",
+	  "type box = struct { items: []str };\n"
+	  "export fn main() i32 = {\n"
+	  "    let q: str = \"world\";\n"
+	  "    q.cap = 9i32;\n"
+	  "    let arr: [2]str;\n"
+	  "    arr[0] = q;\n"
+	  "    let b: box;\n"
+	  "    b.items = arr[0:2];\n"
+	  "    let e: str = b.items[0];\n"
+	  "    if (e.cap: i32 != 9) { return 1; };\n"
+	  "    if (e.len: i32 != 5) { return 2; };\n"
+	  "    return 0;\n"
+	  "};\n",
+	  0 },
+};
+
+static int
+run_driver(const char *driver, const struct row *r, int i)
+{
+	char src[96], tmpdir[96], cmd[1024];
+	snprintf(src, sizeof src, "/tmp/strelemcap_%d_%d.ww", getpid(), i);
+	snprintf(tmpdir, sizeof tmpdir, "/tmp/strelemcap_%d_d_%d", getpid(), i);
+
+	FILE *f = fopen(src, "wb");
+	if (!f) return -1;
+	fputs(r->src, f);
+	fclose(f);
+
+	mkdir(tmpdir, 0755);
+	snprintf(cmd, sizeof cmd, "cd %s && %s build %s",
+	    tmpdir, driver, src);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "row[%s]: build via %s failed\n",
+		    r->label, driver);
+		unlink(src); rmdir(tmpdir);
+		return -1;
+	}
+
+	const char *base = strrchr(src, '/');
+	base = base ? base + 1 : src;
+	char outbin[160];
+	snprintf(outbin, sizeof outbin, "%s/%s", tmpdir, base);
+	char *dot = strrchr(outbin, '.');
+	if (dot && strcmp(dot, ".ww") == 0) *dot = '\0';
+	int got = runwait(outbin);
+
+	unlink(src); unlink(outbin); rmdir(tmpdir);
+	return got;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[512];
+	if (bin[0] != '/') {
+		char cwd[256];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+
+	char cdrv[640];
+	snprintf(cdrv, sizeof cdrv, "%s/ww", bin);
+	char wdrv[640];
+	snprintf(wdrv, sizeof wdrv, "%s/ww_ww", bin);
+
+	struct { const char *name; const char *path; int gated_on_existence; }
+	drivers[] = {
+		{ "cstage",  cdrv, 0 },
+		{ "wwstage", wdrv, 1 },
+		{ NULL, NULL, 0 },
+	};
+
+	int n = (int)(sizeof rows / sizeof rows[0]);
+	int total = 0, fail = 0;
+	for (int d = 0; drivers[d].name; d++) {
+		if (drivers[d].gated_on_existence
+		    && access(drivers[d].path, X_OK) != 0) {
+			fprintf(stderr,
+			    "str_elem_cap_run: skip %s (no %s)\n",
+			    drivers[d].name, drivers[d].path);
+			continue;
+		}
+		for (int i = 0; i < n; i++) {
+			int got = run_driver(drivers[d].path, &rows[i], i);
+			total++;
+			if (got != rows[i].want) {
+				fprintf(stderr,
+				    "str_elem_cap_run[%s][%s]: exit=%d want=%d\n",
+				    drivers[d].name, rows[i].label,
+				    got, rows[i].want);
+				fail++;
+			}
+		}
+	}
+
+	if (fail) {
+		fprintf(stderr, "str_elem_cap_run: %d/%d fixtures failed\n",
+		    fail, total);
+		return 1;
+	}
+	printf("str_elem_cap_run: %d/%d ok\n", total, total);
+	return 0;
+}