rt: bump-over-mmap allocator (rt_segmalloc + rt_free no-op)

rt_malloc was a bare mmap-per-call wrapper: every allocation, even a
32-72B AST/symbol node, consumed a page-rounded 4KB region and was
never freed. w6a/w6c emit ~4 such nodes per .s line, so assembling a
145K-line file burned ~625K pages (~2.5GB); test 995's 5 concurrent
self-rebuilds then OOM'd. The defect is linear and str-independent --
the str->24B codegen merely enlarged .s files past the cliff.

Replace it with the no-free SUBSET of Hare's allocator
(ref/hare/rt/malloc.ha): 2MiB chunk-bump (CHUNKSZ malloc.ha:24, ALIGN
malloc.ha:14), oversized (>CHUNKSZ) requests direct-mmap'd. The
bin/freelist/META machinery exists only to support free, which ww does
not have, so it is omitted. Policy lives in rt/malloc.ww; the raw mmap
primitive stays in rt/alloc.s as rt_segmalloc -- Hare's malloc/segmalloc
split.

rt_free becomes a documented no-op (os.free re-exports it for the public
API, so the symbol must stay); rt/ensure.ww drops its now-impossible
reclaim. Zero-init is preserved: the bump never reuses memory, so every
byte is fresh MAP_ANONYMOUS-zeroed.

w6a_ww on a 145K-line .s: 2165MB -> 28MB (~glibc parity, C w6a 24MB).
.o output byte-identical; both stages emit identical asm. make test
134/134.

Makefile

@@ -39,7 +39,7 @@ W6L_SRC	= cmd/w6l/main.c cmd/w6l/obj.c cmd/w6l/sym.c cmd/w6l/pass.c cmd/w6l/out.
 W6L_OBJ	= $(W6L_SRC:cmd/w6l/%.c=$(OBJ)/w6l/%.o)
 
 RT_S	= rt/start.s rt/syscall.s rt/alloc.s rt/streq.s rt/abort.s
-RT_WW	= rt/ensure.ww
+RT_WW	= rt/ensure.ww rt/malloc.ww
 RT_OBJ	= $(RT_S:rt/%.s=$(OBJ)/rt/%.o) $(RT_WW:rt/%.ww=$(OBJ)/rt/%.o)
 
 # Cstage: one-time C bootstrap (see BOOTSTRAP.md). Built by `cc`.

rt/alloc.s

@@ -1,18 +1,18 @@
-// rt/alloc.s — page allocator via the mmap syscall.
+// rt/alloc.s — raw page primitive via the mmap syscall.
 //
-// rt_malloc(n: u64) returns a *void aligned at a page boundary, sized
+// rt_segmalloc(n: u64) returns a *void aligned at a page boundary, sized
-// to the next page multiple. Pair with rt_free(p, n).
+// to the next page multiple. It is the primitive under rt/malloc.ww's
+// bump allocator (renamed from rt_malloc, task #8) — callers use the
+// bump rt_malloc, not this directly.
 //
 // We pin to PROT_READ|PROT_WRITE and MAP_PRIVATE|MAP_ANONYMOUS so
 // callers never have to plumb file descriptors through.
 //
-// On mmap failure the raw syscall returns -errno (negative). Task #30
+// On mmap failure the raw syscall returns -errno (negative); we map
-// graduated the `alloc` builtin to a fallible `(*T | nomem)` /
+// that to 0 so the bump allocator's null-check (and the alloc builtin's
-// `([]T | nomem)` signature whose cgen branches on a null return, so
+// `!`/`?` lowering, task #30) sees a clean nil.
-// the failure path here returns 0 instead of a poisoned pointer. The
-// builtin's caller is expected to `!`/`?` the result.
 
-TEXT rt_malloc,$0
+TEXT rt_segmalloc,$0
 	MOVQ	DI, SI		// arg 1: length = caller's n
 	MOVQ	$0, DI		// arg 0: addr = NULL (kernel chooses)
 	MOVQ	$3, DX		// arg 2: prot = R|W
@@ -22,13 +22,15 @@ TEXT rt_malloc,$0
 	MOVQ	$9, AX		// syscall: mmap
 	SYSCALL
 	CMPQ	$0, AX
-	JGE	rt_malloc_ok
+	JGE	rt_segmalloc_ok
 	XORQ	AX, AX
-rt_malloc_ok:
+rt_segmalloc_ok:
 	RET
 
+// rt_free is a no-op: ww is a no-free runtime. rt/malloc.ww bumps over
+// shared 2MiB chunks, so a mid-chunk pointer cannot be unmapped without
+// corrupting its neighbours; all memory is reclaimed at process exit.
+// Kept as a symbol because os.free re-exports it (lib/os/os.ww) for the
+// public API — callers' frees become harmless leaks. (task #8)
 TEXT rt_free,$0
-	// DI already holds ptr, SI already holds length
-	MOVQ	$11, AX		// syscall: munmap
-	SYSCALL
 	RET

rt/ensure.ww

@@ -20,7 +20,6 @@
 // bare symbol name so the linker resolves it.
 
 @symbol("rt_malloc") fn malloc(n: u64) *void;
-@symbol("rt_free")  fn free(p: *void, n: u64) void;
 
 // Mirrors ww's []T header layout: 24 bytes with 8-byte slots.
 // ww's source uses i32 for len/cap but the compiler stores them in
@@ -46,9 +45,8 @@ export fn rt_ensure(s: *slice, membsz: u64) void = {
 		np[i] = s.ptr[i];
 		i += 1u64;
 	};
-	if (s.cap > 0i64) {
+	// No free: the bump allocator (rt/malloc.ww) can't reclaim a
-		free(s.ptr: *void, (s.cap: u64) * membsz);
+	// mid-chunk region; the old buffer leaks until process exit. (#8)
-	};
 	s.ptr = np;
 	s.cap = nc;
 };

rt/malloc.ww

@@ -0,0 +1,44 @@
+// rt/malloc.ww — bump allocator over 2MiB chunks. Archived into
+// libwwrt.a, compiled standalone (no `module`) with bare symbols, like
+// rt/ensure.ww.
+//
+// WHY bump, replacing the page-per-call mmap (rt_segmalloc, ex-rt_malloc):
+// the old rt_malloc page-rounded every request, so a 32-72B node cost a
+// whole 4KiB page. w6a/w6c emit ~4 such nodes per .s line; a 145K-line
+// assembly burned ~625K pages (~2.5GB) vs C w6a's 24MB. Packing nodes
+// into shared chunks collapses that to the live set. (task #8)
+//
+// Mirrors Hare rt::malloc's chunk-bump (ref/hare/rt/malloc.ha:52-66,
+// CHUNKSZ :24, ALIGN :14), minus the bin/freelist machinery — that
+// exists only to support free, which ww does not have.
+//
+// Zero-init is preserved: every byte handed out is fresh from
+// MAP_ANONYMOUS (kernel-zeroed) and never reused, so alloc(T{})'s
+// zero-fill still holds. Lazy first chunk falls out of cur=rem=0.
+
+def CHUNKSZ: u64 = 2097152u64;	// 1<<21, ref/hare/rt/malloc.ha:24
+def ALIGN:   u64 = 16u64;	// ref/hare/rt/malloc.ha:14
+
+@symbol("rt_segmalloc") fn segmalloc(n: u64) *void;
+
+let cur: u64 = 0u64;
+let rem: u64 = 0u64;
+
+@symbol("rt_malloc") export fn rt_malloc(n: u64) *void = {
+	let need: u64 = (n + (ALIGN - 1u64)) & ~(ALIGN - 1u64);
+	// Oversized requests bypass the chunk so one huge alloc can't
+	// strand most of a chunk (ref/hare/rt/malloc.ha:38).
+	if (need > CHUNKSZ) { return segmalloc(need); };
+	if (rem < need) {
+		let c: *void = segmalloc(CHUNKSZ);
+		// mmap failure: keep the nomem null contract that the
+		// alloc-builtin `!`/`?` lowering checks.
+		if (c == nil) { return nil; };
+		cur = c: u64;
+		rem = CHUNKSZ;
+	};
+	let p: u64 = cur;
+	cur += need;
+	rem -= need;
+	return p: *void;
+};