test/wcc: carrier ownership repair and driver-contract adaptation

Every surviving carrier now owns its artifacts: checked mkdir/mkdtemp/
fopen acquisition, one all-exit cleanup funnel per carrier, ENOENT-
tolerant checked unlinks, exact-path deletion (rm -rf only for an
owned pid-keyed dir or a .sepwork beneath one), and cleanup failure
fails a passing carrier without overwriting its diagnostic. In the
same pass the carriers adapt to the driver contract this branch lands:
--sep and WW_PKGCACHE are gone, -S and the /tmp/ww_run_<pid> scratch
contract are asserted, and rows whose runtime or reject coverage moved
to test/wcc/data fixtures or test/lang @test owners are trimmed to the
byte/artifact/diagnostic observations only they can make.

Repair and adaptation ride together because most files interleave both
in the same hunks; splitting would manufacture intermediate carrier
states that never existed and cannot run against either driver.

test/wcc/989_sepdotpath_run.c

@@ -15,11 +15,12 @@
  *
  * Graph (smallest that mixes both kinds):  root -> { a.b (dotted), c (single) }.
  *
- * Asserts (all COLD — `<stem>.sepwork` scratch is wiped each run):
+ * Asserts (fresh output stems under an invocation-owned root; retained
+ * `<stem>.sepwork` is inspected, then removed by final carrier cleanup):
  *  1. Build + run, BOTH stages → exit EXPECT_EXIT (the dotted-package symbol
  *     resolves + links; the program runs). Pre-#57 the link failed.
  *  2. cs==ww (rule 10): per-package `.s`/`.wwi`/`.unit.ww` AND the final
- *     binary are byte-identical between `ww --sep` and `ww_ww --sep`.
+ *     binary are byte-identical between `ww` and `ww_ww`.
  *  3. NON-VACUITY (a) — definer==importer on the DOTTED form: the producer's
  *     `a.b.s` DEFINES `a.b.val` and the root's `__root.s` REFERENCES
  *     `a.b.val`. Pre-#57 the definer emitted the leaf `b.val` → the strings
@@ -30,8 +31,7 @@
  *     cs==ww (covered by assert 2). Cross-commit byte-id of single-component
  *     output is additionally pinned by 989_sepbuild_run + the 990-997 gates.
  *
- * Light wwstage-driver test (CLAUDE.md rule 14): all intermediates are
- * `-o`-redirected to /tmp, so it is phase-1 parallel-safe. Models
+ * All intermediates are `-o`-redirected to /tmp for isolation. Models
  * 989_sepbuild_run.c conventions; 989 prefix per the sep-gate precedent.
  */
 #include <stdio.h>
@@ -40,6 +40,7 @@
 #include <unistd.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
+#include <errno.h>
 
 #define EXPECT_EXIT 37
 
@@ -126,18 +127,39 @@ main(void)
 	const char *bin = absbin();
 	if (!bin) return 1;
 	char td[64], cmd[8192], p[1024];
-	int fail = 0;
+	int fail = 0, have_lib = 0, have_a = 0, have_ab = 0, have_c = 0;
 
 	snprintf(td, sizeof td, "/tmp/wwsepdot_%d", getpid());
-	snprintf(cmd, sizeof cmd, "rm -rf %s", td);
-	runwait(cmd);
-	mkdir(td, 0755);
+	if (mkdir(td, 0755) != 0) {
+		fprintf(stderr, "sepdotpath FAIL: cannot acquire %s\n", td);
+		return 1;
+	}
 
 	/* lib/a/b — a 2-level dotted package (clause `package b;`, dir a/b). */
-	snprintf(p, sizeof p, "%s/lib", td);          mkdir(p, 0755);
-	snprintf(p, sizeof p, "%s/lib/a", td);        mkdir(p, 0755);
-	snprintf(p, sizeof p, "%s/lib/a/b", td);      mkdir(p, 0755);
-	snprintf(p, sizeof p, "%s/lib/c", td);        mkdir(p, 0755);
+	snprintf(p, sizeof p, "%s/lib", td);
+	if (mkdir(p, 0755) != 0) {
+		fprintf(stderr, "sepdotpath FAIL: cannot create %s\n", p);
+		fail++; goto out;
+	}
+	have_lib = 1;
+	snprintf(p, sizeof p, "%s/lib/a", td);
+	if (mkdir(p, 0755) != 0) {
+		fprintf(stderr, "sepdotpath FAIL: cannot create %s\n", p);
+		fail++; goto out;
+	}
+	have_a = 1;
+	snprintf(p, sizeof p, "%s/lib/a/b", td);
+	if (mkdir(p, 0755) != 0) {
+		fprintf(stderr, "sepdotpath FAIL: cannot create %s\n", p);
+		fail++; goto out;
+	}
+	have_ab = 1;
+	snprintf(p, sizeof p, "%s/lib/c", td);
+	if (mkdir(p, 0755) != 0) {
+		fprintf(stderr, "sepdotpath FAIL: cannot create %s\n", p);
+		fail++; goto out;
+	}
+	have_c = 1;
 
 	snprintf(p, sizeof p, "%s/lib/a/b/mod.ww", td);
 	if (write_file(p, "package b;\nexport fn val() i32 = { return 42; };\n"))
@@ -162,15 +184,14 @@ main(void)
 
 	for (int s = 0; s < 2; s++) {
 		snprintf(stg[s].prog, sizeof stg[s].prog, "%s/prog.%s", td, stg[s].tag);
-		/* Per-stage fresh WW_PKGCACHE → every package compiles COLD, so the
-		 * `.s`/`.unit.ww` this gate inspects are always produced (a warm
-		 * shared out/.pkgcache hit would skip them). Mirrors 989_pkgcache. */
+		/* Each direct build produces the `.s`/`.unit.ww` artifacts this
+		 * gate inspects. */
 		snprintf(cmd, sizeof cmd,
-		    "WW_PKGCACHE='%s/cache.%s' timeout 240 %s/%s build --sep "
+		    "timeout 240 %s/%s build "
 		    "-I %s/lib -o %s %s >/dev/null 2>&1",
-		    td, stg[s].tag, bin, stg[s].drv, td, stg[s].prog, rootww);
+		    bin, stg[s].drv, td, stg[s].prog, rootww);
 		if (runwait(cmd) != 0) {
-			fprintf(stderr, "sepdotpath FAIL: %s build --sep\n", stg[s].drv);
+			fprintf(stderr, "sepdotpath FAIL: %s build\n", stg[s].drv);
 			fail++;
 			continue;
 		}
@@ -261,8 +282,51 @@ main(void)
 	}
 
 out:
-	snprintf(cmd, sizeof cmd, "rm -rf %s", td);
-	runwait(cmd);
+	snprintf(cmd, sizeof cmd,
+	    "rm -rf -- '%s/prog.cs.sepwork' '%s/prog.ww.sepwork'", td, td);
+	if (runwait(cmd) != 0) {
+		fprintf(stderr, "sepdotpath FAIL: cannot clean .sepwork trees\n");
+		fail++;
+	}
+	{
+		char path[1200];
+		snprintf(path, sizeof path, "%s/root.ww", td);
+		if (unlink(path) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", path); fail++; }
+		snprintf(path, sizeof path, "%s/prog.cs", td);
+		if (unlink(path) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", path); fail++; }
+		snprintf(path, sizeof path, "%s/prog.ww", td);
+		if (unlink(path) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", path); fail++; }
+	}
+	if (have_ab) {
+		snprintf(p, sizeof p, "%s/lib/a/b", td);
+		{
+			char path[1200];
+			snprintf(path, sizeof path, "%s/mod.ww", p);
+			if (unlink(path) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", path); fail++; }
+		}
+		if (rmdir(p) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", p); fail++; }
+	}
+	if (have_a) {
+		snprintf(p, sizeof p, "%s/lib/a", td);
+		if (rmdir(p) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", p); fail++; }
+	}
+	if (have_c) {
+		snprintf(p, sizeof p, "%s/lib/c", td);
+		{
+			char path[1200];
+			snprintf(path, sizeof path, "%s/mod.ww", p);
+			if (unlink(path) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", path); fail++; }
+		}
+		if (rmdir(p) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", p); fail++; }
+	}
+	if (have_lib) {
+		snprintf(p, sizeof p, "%s/lib", td);
+		if (rmdir(p) != 0 && errno != ENOENT) { fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", p); fail++; }
+	}
+	if (rmdir(td) != 0 && errno != ENOENT) {
+		fprintf(stderr, "sepdotpath FAIL: cannot remove %s\n", td);
+		fail++;
+	}
 	if (fail) {
 		fprintf(stderr, "sepdotpath: %d check(s) failed\n", fail);
 		return 1;