w6c+selfhost: cgdot N_DOT tagged-field source ABI (closes #28)

cgdot of a tagged-union struct field previously dropped the AX/DX/CX/R8
payload-register convention used by tagged-union returns: cstage's
direct-struct branch stopped at CX (size > 16) and never loaded R8
(slice-payload variants, slot 32B); the via_ptr branch had no TY_TAGGED
handler at all, falling through to fldloadop and yielding only the tag
in AX. The N_DOT scrutinee fallback in N_MATCH similarly stored only AX
into the spill slot. Wwstage cgdot had no TY_TAGGED branch in any of
the direct, *struct, or top-level-global field-load paths, and cgmatch's
non-ident scrutinee branch didn't recognise N_DOT — dispatch always
computed want = 0 and the spill scratch was hardcoded 24B. The combined
effect: any code reading `s.taggedfield` and consuming more than one
quadword of the payload saw garbage in the upper halves.

Cstage: extended the direct-struct TY_TAGGED branch with an R8 load for
size > 24 (CX still loaded last so global LEAQ-into-CX rooting
survives), added a parallel TY_TAGGED handler to the via_ptr (TY_PTR
inner TY_STRUCT) field branch, and extended the N_DOT scrutinee spill
fallback in N_MATCH to write DX/CX/R8 alongside AX.

Wwstage: new cgloadtaggedfield helper emits the four-register load with
CX-last ordering, and dotfieldtnode resolves a field's declared type
node for a local-ident or *struct base. cgdot grew three TY_TAGGED
branches (direct local, *struct deref staging in BX, top-level global
through CX). cgmatch's non-ident-scrutinee branch grew an N_DOT type-
extraction path mirroring the N_CALL / N_INDEX shapes and now sizes the
@match_spill slot from slotsize(scrutt) so slice-payload variants don't
overflow the historical 24B alloc. rhstaggedabicall accepts N_DOT so
`let copy: ev = h.e;` and tagged-arg call sites pass through the
tagged-source spill branch of cgwidentaggedstore.

Out of scope for #28 and left as separate latents: wwstage's match-arm
bind for a TY_STRUCT-typed variant copies only 8B (cstage falls back
to bu->size; wwstage's bsz=8 default), and the variant-index lookup
for an i64 literal in (i32 | i64) picks the wrong tag on the write
side. Both surface in struct-payload tagged unions and merit their
own tasks; the new test rows steer clear so #28's fix verifies
end-to-end on scalar / str / slice payloads.

Test 693_dot_tagged_source — three variant shapes (16B i64, 24B str,
32B slice) read from direct local, *struct param, top-level global,
and let-init round-trip. The 32B-slice rows verify v.cap (R8 / +24)
so dropping the upper-word load isn't masked by len-only checks; the
top-level-global row routes the write through *p because the direct
global-LHS tagged store is a separate wwstage gap (followup). Three
negative controls (untagged i32 / str / slice fields) keep the new
TY_TAGGED guard from shadowing the existing field-load paths. Wired
into make test; 37 tests total. Bootstrap ww2 == ww3 == ww4
byte-identical.

selfhost/cmd/wcc/cgenutil.ww

@@ -2110,10 +2110,50 @@ fn rhstaggedident(c: *cgen, src: *node) *node = {
 	return resolvetagged(c, tn);
 };
 
+// dotfieldtnode — for an N_DOT src whose base is a local ident or
+// *struct, return the declared type node of the named field, or nil
+// if the shape doesn't resolve (e.g. enum-member access, pseudo-
+// field `.len`, top-level global). Used by rhstaggedabicall and
+// related predicates to walk into the field's tagged type.
+fn dotfieldtnode(c: *cgen, n: *node) *node = {
+	if (n == nil) { return nil; };
+	if (n.kind != nkind.N_DOT) { return nil; };
+	let base: *node = n.lhs;
+	let fld: str = n.str;
+	if (base == nil) { return nil; };
+	if (base.kind != nkind.N_IDENT) { return nil; };
+	let lc: *local = localfindnode(c, base.str);
+	let btn: *node = nil;
+	if (lc != nil) { btn = lc.tnode; }
+	else           { btn = letvartnode(c, base.str); };
+	if (btn == nil) { return nil; };
+	let bk: nkind = btn.kind;
+	let sname: str;
+	sname.ptr = nil; sname.len = 0;
+	if (bk == nkind.N_TPTR) {
+		let inner: *node = btn.lhs;
+		if (inner != nil) {
+			if (inner.kind == nkind.N_TNAME) { sname = inner.str; };
+		};
+	};
+	if (bk == nkind.N_TNAME) { sname = btn.str; };
+	if (sname.len == 0) { return nil; };
+	let si: *structinfo = structlookup(c, sname);
+	if (si == nil) { return nil; };
+	let fi: *fieldinfo = si.fields;
+	for (fi != nil) {
+		if (streq(fi.fname, fld)) { return fi.tnode; };
+		fi = fi.finext;
+	};
+	return nil;
+};
+
 // rhstaggedabicall — does `src` produce a tagged value via the AX/DX/CX
-// return ABI? True for N_CALL of a tagged-returning fn and N_INDEX of a
-// tagged-element base. Used to decide whether cgexpr/spill works for the
-// tagged-source branch of cgwidentaggedstore.
+// return ABI? True for N_CALL of a tagged-returning fn, N_INDEX of a
+// tagged-element base, and N_DOT of a tagged-typed struct field (after
+// #28's cgdot fix loads AX/DX/CX/R8 from the field's slot). Used to
+// decide whether cgexpr/spill works for the tagged-source branch of
+// cgwidentaggedstore.
 fn rhstaggedabicall(c: *cgen, src: *node) bool = {
 	if (src == nil) { return false; };
 	if (src.kind == nkind.N_CALL) {
@@ -2155,9 +2195,55 @@ fn rhstaggedabicall(c: *cgen, src: *node) bool = {
 			};
 		};
 	};
+	// N_DOT of a tagged-typed struct field — cgdot loads
+	// AX=tag, DX=word0, CX=word1[, R8=word2], so downstream
+	// spill matches the call/index shapes.
+	if (src.kind == nkind.N_DOT) {
+		let ft: *node = dotfieldtnode(c, src);
+		if (ft != nil) {
+			if (istaggedtype(c, ft)) { return true; };
+		};
+	};
 	return false;
 };
 
+// cgloadtaggedfield — load a tagged-union slot at `basereg`+foff
+// into the tagged-return ABI registers (AX=tag, DX=word0, CX=word1,
+// R8=word2). Slot sizes: 16B = (tag, word0), 24B = + word1, 32B
+// = + word2 (slice variant). Mirrors the cstage tagged-field load
+// in cmd/w6c/cgen.c (N_DOT TY_STRUCT/TY_PTR branches).
+//
+// Load order is fixed regardless of basereg: tag, word0, word2,
+// word1. CX (word1 target) goes LAST because basereg may itself
+// be CX — top-level globals address via LEAQ name(SB), CX — and
+// overwriting it earlier would trash the base address for the
+// remaining loads. For BP / BX bases the order is harmless.
+// Callers must guarantee basereg is one of "BP", "BX", "CX"; the
+// only register loaded into that is NOT a target is BX, so AX-
+// or DX-rooted callers must spill first.
+fn cgloadtaggedfield(c: *cgen, basereg: str, foff: i32, slot_sz: i32) void = {
+	// tag → AX
+	emitline("\tMOVQ\t");
+	emitdispreg(foff: i64, basereg);
+	emitline(", AX\n");
+	// word0 → DX
+	emitline("\tMOVQ\t");
+	emitdispreg((foff + 8): i64, basereg);
+	emitline(", DX\n");
+	// word2 → R8 (slice variant: slot = 8 tag + 24 payload = 32).
+	if (slot_sz > 24) {
+		emitline("\tMOVQ\t");
+		emitdispreg((foff + 24): i64, basereg);
+		emitline(", R8\n");
+	};
+	// word1 → CX (load LAST; conflicts with CX-base globals).
+	if (slot_sz > 16) {
+		emitline("\tMOVQ\t");
+		emitdispreg((foff + 16): i64, basereg);
+		emitline(", CX\n");
+	};
+};
+
 // cgwidentaggedstore — write tagged-union slot bytes for `src` into
 // the slot at `basereg`+slot_off, sized to slot_sz. Mirrors
 // cg_widen_tagged_store in cmd/w6c/cgen.c.